pi-plans 0.7.0 → 0.8.1

package/src/plan.ts

@@ -503,7 +503,7 @@ export function lintPlanTasks(planText: string): string | null {
 		}
 	}
 	// Covers references must point at known tasks; a check with zero covers
-	// never enters the completion audit — surface that exemption loudly.
+	// never enters the execution review — surface that exemption loudly.
 	for (const item of parseChecklist(planText)) {
 		const covered = extractTaskCoverage(item.text);
 		if (covered.length === 0) {

package/src/refine-ui-state.ts

@@ -1,6 +1,6 @@
 import type { SubagentProgressEvent, SubagentResult } from "./subagent.ts";
 
-export type RefineOverlayRole = "reviewer" | "refs";
+export type RefineOverlayRole = "reviewer" | "refs" | "auditor";
 export type RefineLaneStatus = "queued" | "running" | "complete" | "failed" | "cancelled";
 export type RefineTranscriptEntryType = "assistant-text" | "thinking" | "tool-call" | "tool-result" | "diagnostic";
 

package/src/refine-ui.ts

@@ -135,10 +135,12 @@ function previewTranscriptText(entry: RefineTranscriptEntry, width: number): { l
 	return { lines: lines.slice(-STREAMING_PREVIEW_LINES), truncated: true };
 }
 
-function footerText(laneCount: number, lang: UiLanguage): string {
+function footerText(laneCount: number, lang: UiLanguage, role: RefineOverlayRole = "reviewer"): string {
 	const chrome = refineChrome(lang);
 	const parts = [chrome.close, chrome.scroll, chrome.page];
 	if (laneCount > 1) parts.push(chrome.switchLane);
+	// Auditor overlay only: the reopen shortcut is the way back after ESC.
+	if (role === "auditor") parts.push(chrome.reopen);
 	return parts.join(" · ");
 }
 
@@ -166,7 +168,7 @@ function summaryFor(role: RefineOverlayRole, lanes: RefineLaneState[], modelLabe
 	const complete = lanes.filter((lane) => lane.status === "complete").length;
 	const terminal = lanes.filter((lane) => ["complete", "failed", "cancelled"].includes(lane.status)).length;
 	const running = lanes.filter((lane) => lane.status === "running").length;
-	const title = role === "reviewer" ? "Reviewer" : "Refs";
+	const title = role === "reviewer" ? "Reviewer" : role === "auditor" ? "Execution review" : "Refs";
 	const visibleTitle = modelLabel ? `${title} (${modelLabel})` : title;
 	const state = terminal === lanes.length ? "done" : running > 0 ? `${running} running` : "queued";
 	return `${visibleTitle} · ${complete}/${lanes.length} done · ${state}`;
@@ -181,10 +183,15 @@ export class RefineOverlayComponent implements Component {
 	private readonly modelLabel?: string;
 	/** Chrome language (issue #3); defaults to English for direct construction. */
 	private readonly lang: UiLanguage;
+	/** v0.8.1: pi-tui routes input ONLY to the focused component (no
+	 * bubbling), so an open overlay otherwise swallows every global shortcut
+	 * — including the Ctrl+Shift+T dashboard toggle users expect to work while
+	 * watching a review/refine overlay. Unhandled keys are forwarded here. */
+	private readonly onUnhandledKey?: (data: string) => void;
 	private selectedLane = 0;
 	private disposed = false;
 
-	constructor(theme: Theme, role: RefineOverlayRole, lanes: RefineLaneState[], onCancel: () => void, tui?: TUI, modelLabel?: string, lang: UiLanguage = "en") {
+	constructor(theme: Theme, role: RefineOverlayRole, lanes: RefineLaneState[], onCancel: () => void, tui?: TUI, modelLabel?: string, lang: UiLanguage = "en", onUnhandledKey?: (data: string) => void) {
 		this.theme = theme;
 		this.role = role;
 		this.lanes = lanes;
@@ -192,6 +199,7 @@ export class RefineOverlayComponent implements Component {
 		this.tui = tui;
 		this.modelLabel = modelLabel;
 		this.lang = lang;
+		this.onUnhandledKey = onUnhandledKey;
 		this.tui?.terminal?.write?.("\x1b[?1000h\x1b[?1006h");
 	}
 
@@ -212,7 +220,10 @@ export class RefineOverlayComponent implements Component {
 			return;
 		}
 		const lane = this.lanes[this.selectedLane];
-		if (!lane) return;
+		if (!lane) {
+			this.onUnhandledKey?.(data);
+			return;
+		}
 		const viewport = Math.max(1, lane.viewportHeight ?? 1);
 		if (matchesTerminalKey(data, "up")) lane.scrollOffset -= 1;
 		else if (matchesTerminalKey(data, "down")) lane.scrollOffset += 1;
@@ -220,7 +231,11 @@ export class RefineOverlayComponent implements Component {
 		else if (matchesTerminalKey(data, "pageDown")) lane.scrollOffset += Math.max(1, viewport - 1);
 		else {
 			const mouse = data.match(/^\x1b\[<(\d+);\d+;\d+[Mm]$/);
-			if (!mouse || (Number(mouse[1]) & 64) !== 64) return;
+			if (!mouse || (Number(mouse[1]) & 64) !== 64) {
+				// Not ours: forward instead of swallowing (see onUnhandledKey note).
+				this.onUnhandledKey?.(data);
+				return;
+			}
 			lane.scrollOffset += (Number(mouse[1]) & 1) === 0 ? -3 : 3;
 		}
 		lane.followTranscript = false;
@@ -250,7 +265,7 @@ export class RefineOverlayComponent implements Component {
 				lines.push(...this.renderPane(this.lanes[index]!, innerWidth, paneHeight, index === this.selectedLane));
 			}
 		}
-		lines.push(renderRow(this.theme, this.theme.fg("dim", footerText(this.lanes.length, this.lang)), innerWidth));
+		lines.push(renderRow(this.theme, this.theme.fg("dim", footerText(this.lanes.length, this.lang, this.role)), innerWidth));
 		lines.push(renderBorderLine(this.theme, innerWidth, "bottom"));
 		return lines.map((line) => fitLine(line, width));
 	}
@@ -301,11 +316,14 @@ export class RefineOverlayController {
 	private tui: TUI | undefined;
 	private closed = false;
 	private readonly lang: UiLanguage;
+	/** Forwarded unhandled keys (see RefineOverlayComponent.onUnhandledKey). */
+	private readonly onUnhandledKey?: (data: string) => void;
 
-	constructor(role: RefineOverlayRole, laneIds: Array<{ id: string; label?: string }>, onCancel: () => void, lang: UiLanguage = "en") {
+	constructor(role: RefineOverlayRole, laneIds: Array<{ id: string; label?: string }>, onCancel: () => void, lang: UiLanguage = "en", onUnhandledKey?: (data: string) => void) {
 		this.role = role;
 		this.onCancel = onCancel;
 		this.lang = lang;
+		this.onUnhandledKey = onUnhandledKey;
 		this.lanes = laneIds.map((lane) => ({
 			id: lane.id,
 			label: lane.label ?? lane.id,
@@ -328,7 +346,7 @@ export class RefineOverlayController {
 				(_tui, theme, _keybindings, done) => {
 					this.tui = _tui;
 					this.done = done;
-					this.component = new RefineOverlayComponent(theme, this.role, this.lanes, () => this.cancel(), _tui, modelLabel, this.lang);
+					this.component = new RefineOverlayComponent(theme, this.role, this.lanes, () => this.cancel(), _tui, modelLabel, this.lang, this.onUnhandledKey);
 					if (this.closed) done(undefined);
 					return this.component;
 				},
@@ -352,6 +370,20 @@ export class RefineOverlayController {
 			.catch(() => undefined);
 	}
 
+	/** Repaint without a progress event (the engine mutates lane state directly). */
+	rerender(): void {
+		if (this.closed) return;
+		this.tui?.requestRender();
+	}
+
+	/** Replace the lane with a matching id with engine-held state — used by the
+	 * execution-review reopen path so a fresh controller continues the SAME
+	 * transcript (one-shot controllers can never re-open themselves). */
+	seedLane(state: RefineLaneState): void {
+		const index = this.lanes.findIndex((lane) => lane.id === state.id);
+		if (index >= 0) this.lanes[index] = state;
+	}
+
 	update(laneId: string, event: SubagentProgressEvent): void {
 		if (this.closed) return;
 		const lane = this.lanes.find((candidate) => candidate.id === laneId);

package/src/resume-command.ts

@@ -300,11 +300,27 @@ async function buildBrief(
 			const reverify = load.reverifyAll
 				? `\nThe code state (HEAD) changed since approval: the authorization is KEPT, but every previously closed task was re-opened and must be re-done. Historically verified checks (evidence only): ${doneList}.`
 				: `\nPreviously verified and still valid: ${doneList}.`;
-			const paused = load.pausedReason ? `\nExecution had been paused: ${load.pausedReason} — the pause is cleared by this resume; continue from where it stopped.` : "";
+			// v0.8: a review-cap pause is NOT cleared by this resume — only
+			// /plans-execute (an explicit user confirmation) grants a fresh
+			// five-round budget; ordinary resumes and input keep it paused.
+			const paused = load.pausedReason
+				? load.pausedReason.startsWith("execution review exhausted") || load.pausedReason.startsWith("completion audit exhausted")
+					? `\nExecution had been paused: ${load.pausedReason} — this pause survives the resume; run /plans-execute to grant a fresh five-round review budget.`
+					: `\nExecution had been paused: ${load.pausedReason} — the pause is cleared by this resume; continue from where it stopped.`
+				: "";
 			const legacy = load.legacyPlan ? "\nThis plan parses through the legacy I-### compatibility mapping; upgrade it to the ## Tasks format at the next revision." : "";
+			// v0.9.1 (F-005): outstanding highs surface in the brief itself, not
+			// only in the per-turn injection.
+			const highs = (load.findings ?? []).filter((f) => f.severity === "high");
+			const highLine = highs.length > 0
+				? `\nUnresolved high-severity findings from review round (stable ids): ${highs.map((f) => `${f.id}${f.taskIds.length ? ` (${f.taskIds.join(", ")})` : ""}: ${f.note}`).join("; ")} — fix them, then re-close the affected tasks.`
+				: "";
+			// v0.8: a verifying run keeps checkpoint phase "executing" but the run
+			// STATUS is verifying — surface which loop owns the run right now.
+			const verifying = run.status === "verifying";
 			return {
-				phaseLabel: "executing",
-				text: `[PI-PLANS RESUME] Execution of run ${runId} continues in this session.\nPlan: ${load.planPath}${reverify}${paused}${legacy}\nFollow the execution-loop contract: work through tasks in wave order, report every task with the plans_update_task tool (status + evidence / skipReason), and let the completion auditor verify the checks. The current wave and remaining tasks are injected each turn.`,
+				phaseLabel: verifying ? "verifying" : "executing",
+				text: `[PI-PLANS RESUME] ${verifying ? "Execution review of" : "Execution of"} run ${runId} continues in this session.\nPlan: ${load.planPath}${reverify}${paused}${legacy}${highLine}\n${verifying ? "The task tree is terminal and the execution-review loop owns the run: when all tasks are terminal and checks are still owed, a read-only reviewer round runs automatically (status verifying → done when every check passes). If a check fails, its tasks roll back to pending — fix and re-close them with plans_update_task." : "Follow the execution-loop contract: work through tasks in wave order, report every task with the plans_update_task tool (status + evidence / skipReason), and let the execution reviewer verify the checks. The current wave and remaining tasks are injected each turn."}`,
 			};
 		}
 		if (load.legacyDelegate) {

package/src/resume.ts

@@ -27,7 +27,7 @@ export interface ResumeCandidate {
 	updatedAt: string;
 }
 
-const RESUMABLE_RUN_STATUSES = new Set(["planning", "accepted", "executing", "stopped"]);
+const RESUMABLE_RUN_STATUSES = new Set(["planning", "accepted", "executing", "verifying", "stopped"]);
 
 /** Terminal runs are resumable only when unfinished implementation-review evidence exists (D-008). */
 function legacyDoneResumable(run: RunInfo, checkpoint: WorkflowCheckpoint | null): boolean {
@@ -52,6 +52,10 @@ function legacyDoneResumable(run: RunInfo, checkpoint: WorkflowCheckpoint | null
 }
 
 function phaseLabelOf(run: RunInfo, checkpoint: WorkflowCheckpoint | null): string {
+	// A verifying run keeps checkpoint.phase === "executing" (the execution
+	// state machine's phase is unchanged); surface the run status instead so
+	// the resume list never hides the verification loop behind "executing".
+	if (run.status === "verifying") return "verifying";
 	if (checkpoint !== null) return checkpoint.phase;
 	if (run.status === "stopped") return "executing (stopped)";
 	return run.status;

package/src/staleness.ts

@@ -0,0 +1,53 @@
+/**
+ * Stale-extension probe (v0.7.1, extracted).
+ *
+ * pi imports an extension's module graph once per process, so a fix written
+ * to disk while the session is running stays invisible until /reload. Both
+ * /plans (which reports it) and the execution reviewer (which suggests it when
+ * a verdict cannot be read) need the same answer, so the probe lives here
+ * rather than in index.ts -- exec.ts already depends on index.ts's imports and
+ * a back-import would close a cycle.
+ *
+ * index.ts records when its own copy was loaded; this module never holds that
+ * state, so callers pass it in and stay testable.
+ */
+
+import * as fs from "node:fs";
+import * as path from "node:path";
+
+/** mtime (ms) of the newest .ts file under the extension root, or 0. */
+export function newestSourceMtime(baseDir: string): number {
+	const stack = [baseDir, path.join(baseDir, "src"), path.join(baseDir, "tools")];
+	let newest = 0;
+	while (stack.length) {
+		const dir = stack.pop()!;
+		for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+			const full = path.join(dir, entry.name);
+			if (entry.isDirectory()) stack.push(full);
+			else if (entry.isFile() && entry.name.endsWith(".ts")) {
+				const mtime = fs.statSync(full).mtimeMs;
+				if (mtime > newest) newest = mtime;
+			}
+		}
+	}
+	return newest;
+}
+
+/** One line describing whether the loaded copy is current. A clock-skew
+ * tolerance keeps a same-second write from reading as staleness. */
+export function stalenessLine(baseDir: string, loadedAt: Date): string {
+	try {
+		if (newestSourceMtime(baseDir) > loadedAt.getTime() + 2000) {
+			return `⚠ extension code on disk is newer than the loaded copy (loaded ${loadedAt.toISOString()}); run /reload to pick it up`;
+		}
+		return `Extension loaded: ${loadedAt.toISOString()} (up to date)`;
+	} catch {
+		return `Extension loaded: ${loadedAt.toISOString()}`;
+	}
+}
+
+/** Short form for inline hints: the /reload advice, or null when current. */
+export function staleReloadHint(baseDir: string, loadedAt: Date): string | null {
+	const line = stalenessLine(baseDir, loadedAt);
+	return line.startsWith("⚠") ? line : null;
+}

package/src/state.ts

@@ -119,6 +119,7 @@ export const VALID_RUN_STATUSES = new Set([
 	"planning",
 	"accepted",
 	"executing",
+	"verifying",
 	"stopped",
 	"abandoned",
 	"done",

package/src/task-tool.ts

@@ -64,7 +64,7 @@ export function registerTaskStatusTool(ext: ExtensionAPI): void {
 		name: "plans_update_task",
 		label: "Update task",
 		description:
-			'Report execution progress for one task of the accepted plan: set status "complete" (with evidence) or "skipped" (with skipReason). Fails outside pi-plans execution mode. Statuses are immutable once set — the independent completion auditor handles any rollback.',
+			'Report execution progress for one task of the accepted plan: set status "complete" (with evidence) or "skipped" (with skipReason). Fails outside pi-plans execution mode. Statuses are immutable once set — the independent execution reviewer handles any rollback.',
 		promptSnippet: "Report plan task completion",
 		parameters: UpdateTaskParams,
 

package/src/tasks.ts

@@ -2,7 +2,7 @@
  * Task-tree runtime model (v0.6.1): the execution phase tracks plan tasks
  * (`## Tasks`) as the unit of progress. Status flows in exclusively through
  * the task status tool; completion of the whole run is gated by the
- * independent completion auditor over the plan's verification checks.
+ * independent execution reviewer over the plan's verification checks.
  */
 
 import type { CheckItem, PlanTasks, TaskNode, WaveEntry } from "./plan.ts";
@@ -77,11 +77,13 @@ export function allTasksTerminal(tasks: TaskView[]): boolean {
 	return flattenTaskViews(tasks).length > 0 && flattenTaskViews(tasks).every((task) => taskIsTerminal(task));
 }
 
-/** Snapshot of statuses for persistence and stall detection. */
+/** Snapshot of statuses for persistence and stall detection. Every task gets
+ * a record: a rolled-back task must stay visible with the evidence from its
+ * previous attempt, otherwise a rollback erases the run's history and the
+ * agent can no longer tell "done and rolled back" from "never started". */
 export function taskProgressMap(tasks: TaskView[]): TaskProgressMap {
 	const map: TaskProgressMap = {};
 	for (const task of flattenTaskViews(tasks)) {
-		if (task.status === "pending" && task.evidence === undefined && task.skipReason === undefined) continue;
 		map[task.id] = {
 			status: task.status,
 			evidence: task.evidence,
@@ -132,7 +134,13 @@ export function canTransition(task: TaskView, next: TaskStatus): boolean {
 
 /** Rollback set for a failed verification check: every task in its covers
  * clause (parents cascade to their children, skipped tasks reopen too).
- * Returns the ids that actually reopen. */
+ * Returns the ids that actually reopen.
+ *
+ * The task's `evidence` is deliberately kept. It records what the previous
+ * attempt actually did, which is the one thing the agent cannot reconstruct
+ * once it reopens the task; re-reporting overwrites it. `skipReason` is
+ * cleared because it described a deliberate skip that the audit has now
+ * overturned. */
 export function auditRollbackSet(
 	tasks: TaskView[],
 	checklist: CheckItem[],
@@ -146,7 +154,6 @@ export function auditRollbackSet(
 	const reopenNode = (node: TaskView): void => {
 		if (node.status !== "pending") {
 			node.status = "pending";
-			node.evidence = undefined;
 			node.skipReason = undefined;
 			reopen.push(node.id);
 		}
@@ -158,6 +165,56 @@ export function auditRollbackSet(
 	return reopen;
 }
 
+/** Rollback set for high-severity findings (v0.9): reopen exactly the named
+ * tasks — parents cascade to their children, skipped tasks reopen too — with
+ * semantics identical to auditRollbackSet, but keyed by task id because
+ * findings carry task ids, not VC ids. Evidence is kept and skipReason
+ * cleared for the same reasons as the VC path. */
+export function findingsRollbackSet(tasks: TaskView[], taskIds: string[]): string[] {
+	const wanted = new Set(taskIds);
+	const flat = flattenTaskViews(tasks);
+	const reopen: string[] = [];
+	const reopenNode = (node: TaskView): void => {
+		if (node.status !== "pending") {
+			node.status = "pending";
+			node.skipReason = undefined;
+			reopen.push(node.id);
+		}
+		for (const child of node.children) reopenNode(child);
+	};
+	for (const node of flat) {
+		if (wanted.has(node.id)) reopenNode(node);
+	}
+	return reopen;
+}
+
+/** Checks that lose their satisfied state because a rollback reopened work
+ * they were verifying. Returns the ids whose `done` flag was cleared.
+ *
+ * A check can be presolved without an audit round (skipped-pass), or affirmed
+ * in an earlier round, and stay `done` while another check's rollback reopens
+ * one of its covered tasks. Left alone it renders as "check passed" next to a
+ * task that is open again with stale evidence. The caller owns this: it runs
+ * after the rollback set is known. */
+export function invalidateChecksForRolledBackTasks(
+	checklist: CheckItem[],
+	tasks: TaskView[],
+	reopenedIds: string[],
+): string[] {
+	if (reopenedIds.length === 0) return [];
+	const reopened = new Set(reopenedIds);
+	const cleared: string[] = [];
+	for (const item of checklist) {
+		if (!item.done) continue;
+		const covered = extractTaskCoverage(item.text);
+		if (covered.some((id) => reopened.has(id))) {
+			item.done = false;
+			cleared.push(item.id);
+		}
+	}
+	return cleared;
+}
+
 /** Verification checks that cover no task are excluded from audit (their
  * pass state cannot be derived from task statuses). */
 export function auditableChecks(checklist: CheckItem[], tasks: TaskView[]): CheckItem[] {

package/src/ui-language.ts

@@ -103,6 +103,8 @@ export interface RefineChrome {
 	scroll: string;
 	page: string;
 	switchLane: string;
+	/** Auditor overlay only (v0.8): the shortcut that reopens the in-flight round. */
+	reopen: string;
 }
 
 const REFINE_CHROME: Record<UiLanguage, RefineChrome> = {
@@ -111,12 +113,14 @@ const REFINE_CHROME: Record<UiLanguage, RefineChrome> = {
 		scroll: "↑/↓ 滚动",
 		page: "PgUp/PgDn 翻页",
 		switchLane: "Tab & Shift + Tab 切换 lane",
+		reopen: "Ctrl+Shift+R 重开评审面板",
 	},
 	en: {
 		close: "Esc close",
 		scroll: "↑/↓ scroll",
 		page: "PgUp/PgDn page",
 		switchLane: "Tab & Shift + Tab switch lane",
+		reopen: "Ctrl+Shift+R reopen review overlay",
 	},
 };
 

package/src/workflow-state.ts

@@ -152,8 +152,40 @@ export interface ExecutionCheckpoint {
 	 * progress record. doneVcIds stays for legacy checkpoints and the final
 	 * audit pass. */
 	tasks?: Record<string, { status: string; evidence?: string; skipReason?: string }>;
+	/** v0.7.1: watchdog round counter. Persisted so a session restart cannot
+	 * silently hand a stalled run a fresh budget; optional so checkpoints
+	 * written before this field keep loading. */
+	stallRounds?: number;
+	/** v0.9.1 (F-002): set when the execution-review loop mechanically
+	 * appended finding tasks to the approved plan. The checkpoint's plan
+	 * identity is re-stamped at that moment so /resume-plans accepts the
+	 * amended plan; the approval record keeps the ORIGINAL digest as
+	 * evidence of what the user actually approved. */
+	planAmended?: { sha256: string; amendedAt: string; round: number };
 	/** v0.6.1: completion-audit bookkeeping (rounds, last failed set, pass). */
-	audit?: { rounds: number; lastResult?: string; passed?: boolean };
+	audit?: {
+		rounds: number;
+		lastResult?: string;
+		passed?: boolean;
+		undeterminable?: string[];
+		/** v0.9: unresolved implementation findings from the newest committed
+		 * review round (stable F-### ids). Optional so pre-v0.9 checkpoints
+		 * keep loading as "no findings". */
+		findings?: ReviewFindingRecord[];
+	};
+}
+
+/** Serializable shape of one review finding (v0.9). Structurally identical to
+ * auditor.ts's ReviewFinding; declared here so the checkpoint layer does not
+ * import the auditor. */
+export interface ReviewFindingRecord {
+	id: string;
+	severity: string;
+	taskIds: string[];
+	proposedTask?: string;
+	note: string;
+	evidence: string;
+	raw: string;
 }
 
 export interface OwnerInfo {
@@ -461,7 +493,7 @@ function asExecution(value: unknown, label: string): ExecutionCheckpoint {
 	const record = asRecord(value, label);
 	rejectExtraKeys(
 		record,
-		new Set(["approval", "doneVcIds", "implStatus", "currentI", "usage", "pausedReason", "reverifyAll", "originWorktree", "delegate", "tasks", "audit"]),
+		new Set(["approval", "doneVcIds", "implStatus", "currentI", "usage", "pausedReason", "reverifyAll", "originWorktree", "delegate", "tasks", "stallRounds", "planAmended", "audit"]),
 		label,
 	);
 	const execution: ExecutionCheckpoint = {
@@ -505,14 +537,47 @@ function asExecution(value: unknown, label: string): ExecutionCheckpoint {
 		}
 		execution.tasks = tasks;
 	}
+	if (record.stallRounds !== undefined && record.stallRounds !== null) {
+		execution.stallRounds = asInt(record.stallRounds, `${label}.stallRounds`, 0);
+	}
+	if (record.planAmended !== undefined && record.planAmended !== null) {
+		const rec = asRecord(record.planAmended, `${label}.planAmended`);
+		rejectExtraKeys(rec, new Set(["sha256", "amendedAt", "round"]), `${label}.planAmended`);
+		execution.planAmended = {
+			sha256: asString(rec.sha256, `${label}.planAmended.sha256`),
+			amendedAt: asString(rec.amendedAt, `${label}.planAmended.amendedAt`),
+			round: asInt(rec.round, `${label}.planAmended.round`, 0),
+		};
+	}
 	if (record.audit !== undefined && record.audit !== null) {
 		const audit = asRecord(record.audit, `${label}.audit`);
-		rejectExtraKeys(audit, new Set(["rounds", "lastResult", "passed"]), `${label}.audit`);
-		const parsed: { rounds: number; lastResult?: string; passed?: boolean } = {
+		rejectExtraKeys(audit, new Set(["rounds", "lastResult", "passed", "undeterminable", "findings"]), `${label}.audit`);
+		const parsed: { rounds: number; lastResult?: string; passed?: boolean; undeterminable?: string[]; findings?: ReviewFindingRecord[] } = {
 			rounds: asInt(audit.rounds, `${label}.audit.rounds`, 0),
 		};
 		if (audit.lastResult !== undefined) parsed.lastResult = asString(audit.lastResult, `${label}.audit.lastResult`);
 		if (audit.passed !== undefined) parsed.passed = asBool(audit.passed, `${label}.audit.passed`);
+		if (audit.undeterminable !== undefined) {
+			parsed.undeterminable = asStringArray(audit.undeterminable, `${label}.audit.undeterminable`);
+		}
+		if (audit.findings !== undefined && audit.findings !== null) {
+			const arr = Array.isArray(audit.findings) ? audit.findings : null;
+			if (!arr) throw new CheckpointValidationError(`${label}.audit.findings must be an array`);
+			parsed.findings = arr.map((entry, i) => {
+				const rec = asRecord(entry, `${label}.audit.findings.${i}`);
+				rejectExtraKeys(rec, new Set(["id", "severity", "taskIds", "proposedTask", "note", "evidence", "raw"]), `${label}.audit.findings.${i}`);
+				const out: ReviewFindingRecord = {
+					id: asString(rec.id, `${label}.audit.findings.${i}.id`),
+					severity: asString(rec.severity, `${label}.audit.findings.${i}.severity`),
+					taskIds: rec.taskIds === undefined ? [] : asStringArray(rec.taskIds, `${label}.audit.findings.${i}.taskIds`),
+					note: rec.note === undefined ? "" : asString(rec.note, `${label}.audit.findings.${i}.note`),
+					evidence: rec.evidence === undefined ? "" : asString(rec.evidence, `${label}.audit.findings.${i}.evidence`),
+					raw: rec.raw === undefined ? "" : asString(rec.raw, `${label}.audit.findings.${i}.raw`),
+				};
+				if (rec.proposedTask !== undefined) out.proposedTask = asString(rec.proposedTask, `${label}.audit.findings.${i}.proposedTask`);
+				return out;
+			});
+		}
 		execution.audit = parsed;
 	}
 	return execution;
@@ -1070,8 +1135,12 @@ export interface ExecutionProgressInput {
 	delegate?: { modelSelector: string; startedAt: string } | null;
 	/** v0.6.1: task-tree progress snapshot (authoritative). */
 	tasks?: Record<string, { status: string; evidence?: string; skipReason?: string }>;
-	/** v0.6.1: completion-audit bookkeeping update. */
-	audit?: { rounds: number; lastResult?: string; passed?: boolean };
+	/** v0.6.1: completion-audit bookkeeping update. v0.9: findings rides the
+	 * same replace-semantics slot — callers that must preserve findings (e.g.
+	 * budget renewal) pass them through explicitly. */
+	audit?: { rounds: number; lastResult?: string; passed?: boolean; undeterminable?: string[]; findings?: ReviewFindingRecord[] };
+	/** v0.7.1: watchdog budget counter, so a restart cannot refresh it. */
+	stallRounds?: number;
 }
 
 export function applyExecutionProgress(cp: WorkflowCheckpoint, progress: ExecutionProgressInput): WorkflowCheckpoint {
@@ -1091,10 +1160,28 @@ export function applyExecutionProgress(cp: WorkflowCheckpoint, progress: Executi
 	if (progress.delegate === null) delete execution.delegate;
 	else if (progress.delegate !== undefined) execution.delegate = progress.delegate;
 	if (progress.tasks !== undefined) execution.tasks = progress.tasks;
+	if (progress.stallRounds !== undefined) execution.stallRounds = progress.stallRounds;
 	if (progress.audit !== undefined) execution.audit = progress.audit;
 	return { ...cp, execution };
 }
 
+/** v0.9.1 (F-002): the execution-review loop appended finding tasks to the
+ * approved plan file; re-stamp the checkpoint's plan identity to the amended
+ * digest so a later /resume-plans does not reject the run as plan-mismatch.
+ * The approval record is untouched — it keeps the digest the user actually
+ * approved, and planAmended records when and why the identity moved. */
+export function applyExecutionPlanAmended(cp: WorkflowCheckpoint, plan: PlanIdentity, round: number): WorkflowCheckpoint {
+	if (cp.phase !== "executing" || !cp.execution) throw new StateError("requires phase \"executing\"");
+	return {
+		...cp,
+		plan,
+		execution: {
+			...cp.execution,
+			planAmended: { sha256: plan.sha256, amendedAt: utcNow(), round },
+		},
+	};
+}
+
 /** D-011/F-001: code state changed under an unchanged plan — keep authorization, re-verify first. */
 export function applyExecutionHeadChanged(cp: WorkflowCheckpoint): WorkflowCheckpoint {
 	if (cp.phase !== "executing" || !cp.execution) throw new StateError("requires phase \"executing\"");

package/tests/analyze-refs.test.ts

@@ -303,7 +303,7 @@ describe("analyze_refs fanout", () => {
 
 	it("pins the per-batch overlay lifecycle (open before spawn, close in finally, cap 3)", () => {
 		const source = fs.readFileSync(path.join(ROOT, "tools", "analyze-refs.ts"), "utf8");
-		assert.equal((source.match(/new RefineOverlayController\("refs"/g) ?? []).length, 1, "controller must be constructed per batch inside the loop");
+		assert.equal((source.match(/new RefineOverlayController\(\s*"refs"/g) ?? []).length, 1, "controller must be constructed per batch inside the loop");
 		assert.match(source, /overlay\?\.open\(refineOverlayContext\(ctx\), modelLabel\)/);
 		assert.match(source, /await overlay\?\.close\(\);/);
 		assert.match(source, /const BATCH_SIZE = 3;/);