pi-plans 0.8.0 → 0.8.1

package/src/exec.ts

@@ -57,6 +57,7 @@ import {
 	applyExecutionProgress,
 	applyExecutionStopped,
 	createCheckpoint,
+	applyExecutionPlanAmended,
 	loadCheckpoint,
 	mutateCheckpoint,
 	planIdentityOf,
@@ -72,6 +73,7 @@ import { resolveGraphMode } from "./code-graph/mode.ts";
 import {
 	parseChecklist,
 	parsePlanTasks,
+	CHECKLIST_HEADERS,
 	flattenTasks,
 	type CheckItem,
 	type PlanTasks,
@@ -82,8 +84,10 @@ import {
 	auditableChecks,
 	buildTaskView,
 	currentTask,
+	findingsRollbackSet,
 	flattenTaskViews,
 	invalidateChecksForRolledBackTasks,
+	maxWave,
 	taskIsTerminal,
 	taskProgress,
 	taskProgressMap,
@@ -99,13 +103,15 @@ import {
 	renderDashboardLines,
 	renderDashboardTreeLines,
 } from "./dashboard.ts";
-import { REVIEW_MAX_ROUNDS, presolvedCheckIds, runCompletionAudit, writeReviewRoundReport, type AuditRoundResult } from "./auditor.ts";
+import { REVIEW_MAX_ROUNDS, presolvedCheckIds, runCompletionAudit, writeReviewRoundReport, type AuditOutcome, type AuditRoundResult, type ReviewFinding } from "./auditor.ts";
+import type { ReviewFindingRecord } from "./workflow-state.ts";
 import { staleReloadHint as probeStaleReload } from "./staleness.ts";
 import { messaging } from "./messaging.ts";
 import { RefineOverlayController, refineOverlayContext } from "./refine-ui.ts";
 import { applyRefineProgress, applyRefineResult, type RefineLaneState } from "./refine-ui-state.ts";
 import { resolveReviewerSpawn } from "./thinking-levels.ts";
 import { loadGlobalConfig, reviewerReady } from "./global-state.ts";
+import { matchesTerminalKey } from "./terminal-keys.ts";
 
 export interface ExecState {
 	planPath: string;
@@ -127,7 +133,7 @@ export interface ExecState {
 	/** Completion-audit bookkeeping. `rounds` is the BUDGET counter — charged
 	 * only when a round outcome commits (never on discard/cancel) — and is the
 	 * only piece persisted. */
-	audit: { rounds: number; failed: string[]; undeterminable: string[]; running: boolean };
+	audit: { rounds: number; failed: string[]; undeterminable: string[]; running: boolean; findings: ReviewFinding[] };
 	/** Execution-review loop (v0.8), memory-only: the attempt index names the
 	 * per-round report files; consecutiveDiscards bounds the fingerprint
 	 * re-run loop; inFlight owns the round's abort lifecycle. */
@@ -229,6 +235,10 @@ export interface CheckpointExecutionLoad {
 	/** v0.6.1 (D-020): true when an orphaned v0.6.0 delegated executor was
 	 * detected — resume requires a fresh handoff approval. */
 	legacyDelegate?: boolean;
+	/** v0.9.1 (F-005): unresolved findings from the newest committed round,
+	 * so the /resume-plans brief can surface outstanding highs before the
+	 * per-turn injection ever runs. */
+	findings?: ReviewFinding[];
 	error?: string;
 }
 
@@ -314,6 +324,7 @@ export function loadExecutionFromCheckpoint(
 			rounds: cp.execution.audit?.rounds ?? 0,
 			failed: [],
 			undeterminable: cp.execution.audit?.undeterminable ?? [],
+			findings: toReviewFindings(cp.execution.audit?.findings),
 			running: false,
 		},
 		review: { attempts: 0, consecutiveDiscards: 0, inFlight: null },
@@ -362,6 +373,7 @@ export function loadExecutionFromCheckpoint(
 		pausedReason: cp.execution.pausedReason,
 		legacyPlan: planTasks.legacy,
 		legacyDelegate,
+		findings: toReviewFindings(cp.execution.audit?.findings),
 	};
 }
 
@@ -501,6 +513,7 @@ function updatePanelWidget(ctx: ExtensionContext): void {
 					auditRounds: current.audit.rounds > 0 || current.audit.running ? current.audit.rounds : null,
 					auditFailed: current.audit.failed,
 					auditUndeterminable: current.audit.undeterminable,
+					findings: current.audit.findings,
 					reviewRunning: current.audit.running === true || current.review.inFlight !== null,
 					startedAt: current.startedAt,
 					usage: current.usage,
@@ -525,6 +538,7 @@ export function updateStatusWidget(ctx: ExtensionContext): void {
 			auditRounds: execution.audit.rounds > 0 ? execution.audit.rounds : null,
 			auditFailed: execution.audit.failed,
 			auditUndeterminable: execution.audit.undeterminable,
+			findings: execution.audit.findings,
 			reviewRunning: execution.audit.running === true || execution.review.inFlight !== null,
 		});
 		ctx.ui.setStatus("pi-plans", ctx.ui.theme.fg("accent", formatDashboardSummaryLine(model)));
@@ -597,7 +611,7 @@ function persist(ctx: ExtensionContext): void {
 		startedAt: execution.startedAt,
 		usage: execution.usage,
 		stall: execution.stall,
-		audit: { rounds: execution.audit.rounds, failed: execution.audit.failed },
+		audit: { rounds: execution.audit.rounds, failed: execution.audit.failed, findings: execution.audit.findings },
 	});
 }
 
@@ -640,7 +654,7 @@ export async function startExecution(
 		usage: { inToks: 0, outToks: 0 },
 		uiLanguage: resolveUiLanguage(ctx.cwd),
 		stall: { rounds: 0, lastSnapshot: null, paused: false },
-		audit: { rounds: 0, failed: [], undeterminable: [], running: false },
+		audit: { rounds: 0, failed: [], undeterminable: [], findings: [], running: false },
 		review: { attempts: 0, consecutiveDiscards: 0, inFlight: null },
 		auditLatch: { auditedThisSettle: false, activity: 0 },
 	};
@@ -711,6 +725,9 @@ export function persistTaskProgress(ctx: ExtensionContext): void {
 				rounds: execution!.audit.rounds,
 				lastResult: execution!.audit.failed.length > 0 ? execution!.audit.failed.join(",") : undefined,
 				undeterminable: execution!.audit.undeterminable.length > 0 ? execution!.audit.undeterminable : undefined,
+				// v0.9: audit writes are replace-semantics — every writer must
+				// carry findings or a task update would silently wipe them.
+				findings: execution!.audit.findings,
 			},
 		}),
 	);
@@ -737,10 +754,10 @@ export function recordExecutionTurn(
 }
 
 /** Test hook: replace the audit subagent with a deterministic function. */
-let auditRunnerForTests: ((input: { planPath: string; checklist: CheckItem[]; tasks: TaskView[]; round: number }) => Promise<Awaited<ReturnType<typeof runCompletionAudit>>>) | null = null;
+let auditRunnerForTests: ((input: { planPath: string; checklist: CheckItem[]; tasks: TaskView[]; round: number; priorFindings: ReviewFinding[] }) => Promise<Awaited<ReturnType<typeof runCompletionAudit>>>) | null = null;
 
 export function __setAuditRunnerForTests(
-	runner: ((input: { planPath: string; checklist: CheckItem[]; tasks: TaskView[]; round: number }) => Promise<Awaited<ReturnType<typeof runCompletionAudit>>>) | null,
+	runner: ((input: { planPath: string; checklist: CheckItem[]; tasks: TaskView[]; round: number; priorFindings: ReviewFinding[] }) => Promise<Awaited<ReturnType<typeof runCompletionAudit>>>) | null,
 ): void {
 	auditRunnerForTests = runner;
 }
@@ -894,8 +911,30 @@ function abortInFlightReview(): void {
 	activeReviewChain = null;
 }
 
+/** v0.9: unresolved high-severity findings from the newest committed round.
+ * Presence in the newest round's report IS the unresolved set (stable ids:
+ * a problem is resolved only by no longer being reported). */
+function unresolvedHighFindings(ex: ExecState): ReviewFinding[] {
+	return ex.audit.findings.filter((f) => f.severity === "high");
+}
+
+/** v0.9: checkpoint records -> runtime findings. Invalid severities degrade to
+ * "malformed" (recorded, non-blocking) — the same never-fail posture as the
+ * report parser. */
+function toReviewFindings(records?: ReviewFindingRecord[]): ReviewFinding[] {
+	if (!records) return [];
+	return records.map((r) => {
+		const severity = (r.severity === "high" || r.severity === "medium" || r.severity === "low") ? r.severity : "malformed";
+		return { id: r.id, severity, taskIds: Array.isArray(r.taskIds) ? r.taskIds : [], proposedTask: r.proposedTask, note: r.note ?? "", evidence: r.evidence ?? "", raw: r.raw ?? "" };
+	});
+}
+
+/** v0.9: findings widen the owed predicate — an unresolved high finding keeps
+ * the review owed even when every check is done (the stranded-high path),
+ * mirroring how a failed check keeps it owed today. */
 function reviewOwed(ex: ExecState): boolean {
-	return allTasksTerminal(ex.tasks) && auditableChecks(ex.items, ex.tasks).some((item) => !item.done);
+	return allTasksTerminal(ex.tasks)
+		&& (auditableChecks(ex.items, ex.tasks).some((item) => !item.done) || unresolvedHighFindings(ex).length > 0);
 }
 
 function runDirOf(ctx: ExtensionContext): string | null {
@@ -996,11 +1035,21 @@ function freshReviewLane(attempt: number): RefineLaneState {
 
 /** Fresh controller per round (the controller is one-shot: closed latch,
  * overlayPromise bail, terminal-lane early return — reuse drops progress).
- * A UI failure must NEVER kill the round itself — best-effort only. */
+ * A UI failure must NEVER kill the round itself — best-effort only. The
+ * overlay forwards unhandled keys so Ctrl+Shift+T keeps working while the
+ * review overlay holds focus (pi-tui has no key bubbling). */
 function openReviewOverlay(ctx: ExtensionContext, lane: RefineLaneState, lang: "en" | "zh" | undefined, modelLabel: string): RefineOverlayController | null {
 	if (ctx.mode !== "tui" || ctx.hasUI !== true) return null;
 	try {
-		const controller = new RefineOverlayController("auditor", [{ id: lane.id, label: lane.label }], () => {}, lang ?? "en");
+		const controller = new RefineOverlayController(
+			"auditor",
+			[{ id: lane.id, label: lane.label }],
+			() => {},
+			lang ?? "en",
+			(data) => {
+				if (matchesTerminalKey(data, "ctrl+shift+t")) toggleDashboardExpanded(ctx);
+			},
+		);
 		controller.seedLane(lane);
 		controller.open(refineOverlayContext(ctx), modelLabel);
 		return controller;
@@ -1013,15 +1062,20 @@ function openReviewOverlay(ctx: ExtensionContext, lane: RefineLaneState, lang: "
  * state; inert when no round is in flight. */
 export function reopenReviewOverlay(ctx: ExtensionContext): void {
 	if (!execution?.review.inFlight || !reviewLane) return;
+	// Never stack a second overlay on a live one (Ctrl+Shift+R while open).
+	if (reviewOverlay && !reviewOverlay.isClosed()) return;
 	const controller = openReviewOverlay(ctx, reviewLane, execution.uiLanguage, reviewModelLabel ?? "session default");
 	if (controller) reviewOverlay = controller;
 }
 
 function pauseReviewCap(ctx: ExtensionContext, ex: ExecState): void {
+	const highs = unresolvedHighFindings(ex);
 	const detail =
 		ex.audit.failed.length > 0
-			? `failed: ${ex.audit.failed.join(", ")}`
-			: `unreadable verdicts: ${ex.audit.undeterminable.join(", ") || "unknown"}`;
+			? `failed: ${ex.audit.failed.join(", ")}${highs.length > 0 ? `; high findings: ${highs.map((f) => f.id).join(", ")}` : ""}`
+			: highs.length > 0
+				? `high findings: ${highs.map((f) => f.id).join(", ")}`
+				: `unreadable verdicts: ${ex.audit.undeterminable.join(", ") || "unknown"}`;
 	const reason = `${REVIEW_CAP_PAUSE_PREFIX} ${REVIEW_MAX_ROUNDS} rounds (${detail}). Only /plans-execute — an explicit user confirmation — grants a fresh five-round budget; ordinary messages and session restores do not. (Or close the failed checks' tasks as skipped to pass them as skipped-pass.)`;
 	pauseForStall(ctx, reason);
 	// In-band, headless-visible pause signal (the pi-plans-exec-stop pattern):
@@ -1044,7 +1098,10 @@ async function startReviewRound(ctx: ExtensionContext): Promise<void> {
 	// Only auditable checks (with task coverage) gate completion; checks that
 	// cover no task can never be verified and never block or complete.
 	const pendingChecks = auditableChecks(ex.items, ex.tasks).filter((item) => !item.done);
-	if (pendingChecks.length === 0) {
+	// v0.9: unresolved high findings block the fast completion path — they
+	// keep the review owed instead (liveness: a high can never be completed
+	// around, only fixed or paused at the cap).
+	if (pendingChecks.length === 0 && unresolvedHighFindings(ex).length === 0) {
 		await completeExecution(ctx);
 		return;
 	}
@@ -1075,12 +1132,13 @@ async function startReviewRound(ctx: ExtensionContext): Promise<void> {
 	let result: AuditRoundResult;
 	try {
 		result = auditRunnerForTests
-			? await auditRunnerForTests({ planPath: ex.planPath, checklist: ex.items, tasks: ex.tasks, round: round.attempt })
+			? await auditRunnerForTests({ planPath: ex.planPath, checklist: ex.items, tasks: ex.tasks, round: round.attempt, priorFindings: ex.audit.findings })
 			: await runCompletionAudit(ctx, {
 				planPath: ex.planPath,
 				checklist: ex.items,
 				tasks: ex.tasks,
 				round: round.attempt,
+				priorFindings: ex.audit.findings,
 				model: spawn.model,
 				thinkingLevel: spawn.thinkingLevel,
 				timeoutMs: REVIEW_ROUND_TIMEOUT_MS,
@@ -1160,6 +1218,9 @@ async function handleReviewOutcome(
 				passed: [],
 				failed: [],
 				undeterminable: pendingIds,
+				// v0.9.1 (F-014): the discard report must not understate a
+				// round whose embedded report carries highs.
+				findings: owner.audit.findings,
 				discardedReason: "fingerprint changed between round start and resolve (worktree/plan moved under the reviewer)",
 				fingerprintCaptured: round.fingerprint,
 				fingerprintFound: fingerprintNow,
@@ -1187,11 +1248,73 @@ async function handleReviewOutcome(
 	await commitReviewOutcome(ctx, owner, round, outcome, pendingIds);
 }
 
+/** v0.9 (findings-driven fix loop): append plan tasks for high findings no
+ * existing task owns. The reviewer stays read-only — it proposes the title
+ * (proposed-task); this machinery applies it with provenance, so every high
+ * finding always has an owner the executor can close, and the stable F-###
+ * id rides in the task title for traceability. Best-effort: an unwritable
+ * plan must not crash the loop (the finding then stays stranded and the cap
+ * pause surfaces it). Returns the appended task ids. */
+function appendFindingTasks(ex: ExecState, highs: ReviewFinding[]): string[] {
+	const appended: string[] = [];
+	let next = flattenTaskViews(ex.tasks).reduce((max, t) => {
+		const m = /^Task-(\d+)$/.exec(t.id);
+		return m ? Math.max(max, Number(m[1])) : max;
+	}, 0);
+	const wave = maxWave(ex.tasks) + 1;
+	try {
+		const planText = fs.readFileSync(ex.planPath, "utf8");
+		const lines = planText.split("\n");
+		// Insert inside the Tasks section: before the Execution Waves
+		// subsection when present, else before the FIRST checklist header the
+		// plan uses (v0.9.1 F-013: legacy plans say `## Verifier Checklist`,
+		// and an EOF fallback would land outside every parsed section), else
+		// at EOF; walk back over blank separators so the bullet lands
+		// adjacent to its siblings.
+		let insertAt = lines.length;
+		const wavesIdx = lines.findIndex((l) => /^###\s+Execution Waves/.test(l));
+		const checklistIdx = lines.findIndex((l) => CHECKLIST_HEADERS.some((h) => new RegExp(`^##\\s+${h}`).test(l)));
+		if (wavesIdx !== -1) insertAt = wavesIdx;
+		else if (checklistIdx !== -1) insertAt = checklistIdx;
+		while (insertAt > 0 && lines[insertAt - 1].trim() === "") insertAt--;
+		// v0.9.1 (F-012): reviewer text becomes task-title metadata at parse
+		// time — strip the microsyntax metacharacters (em/en dashes, `--`
+		// separators, the `;` field delimiter) so an embedded token can never
+		// split title from tail or forge fields.
+		const sanitize = (text: string): string => text.replace(/[—–]/g, "-").replace(/-{2,}/g, "-").replace(/;/g, ",");
+		const entries: Array<{ id: string; title: string }> = [];
+		const newLines: string[] = [];
+		for (const h of highs) {
+			next += 1;
+			const id = `Task-${next}`;
+			const title = `fix ${h.id}: ${sanitize(h.proposedTask ?? h.note ?? "address the finding")} (appended by execution review round ${ex.audit.rounds})`;
+			// v0.9.1 (F-006): carry the wave in the bullet tail so a re-parse
+			// restores the same wave the live tree assigned — without it the
+			// appended remediation task fell back to wave 1 on restore and
+			// hijacked the ▸ anchor.
+			newLines.push(`- \`${id}\`: ${title} — wave: ${wave}`);
+			entries.push({ id, title });
+		}
+		lines.splice(insertAt, 0, ...newLines);
+		fs.writeFileSync(ex.planPath, lines.join("\n"), "utf8");
+		// v0.9.1 (F-008): only a successful plan write mints the live tasks —
+		// pushing before the write left checkpoint entries the plan file does
+		// not contain whenever the write failed.
+		for (const entry of entries) {
+			ex.tasks.push({ id: entry.id, title: entry.title, wave, deps: [], files: [], status: "pending", children: [] });
+			appended.push(entry.id);
+		}
+	} catch {
+		/* best-effort: stranded highs surface via the cap pause */
+	}
+	return appended;
+}
+
 async function commitReviewOutcome(
 	ctx: ExtensionContext,
 	ex: ExecState,
 	round: InFlightReview,
-	outcome: { passed: string[]; failed: string[]; undeterminable: string[]; report: string } | null,
+	outcome: AuditOutcome | null,
 	pendingIds: string[],
 ): Promise<void> {
 	// The budget is charged only when an outcome commits — never on discard
@@ -1203,106 +1326,169 @@ async function commitReviewOutcome(
 	// report omitted the check, spelled the verdict unreadably, or the
 	// subagent never ran.
 	const undeterminable = pendingIds.filter((id) => !passed.includes(id) && !failed.includes(id));
+	// v0.9: the newest round's reported findings ARE the unresolved set
+	// (stable ids — a problem is resolved only by no longer being reported).
+	// v0.9.1 (F-001): only a REAL parsed report is authoritative. A round that
+	// produced no report at all — spawn failure (outcome === null) or the
+	// two-consecutive-discard synthesis — must PRESERVE the unresolved set:
+	// clearing it let the vacuous completion guard (empty pendingIds) mark a
+	// run done with its high finding silently dropped.
+	const reported = outcome !== null && outcome.findings !== undefined;
+	const findings = reported ? outcome.findings : ex.audit.findings;
+	ex.audit.findings = findings;
+	const highs = findings.filter((f) => f.severity === "high");
+	// Findings are actionable only when this round actually reported them;
+	// see the fix-loop branch below (v0.9.1, F-001).
+	const actionableHighs = reported ? highs : [];
 	const coveredTaskIds = flattenTaskViews(ex.tasks).map((task) => task.id);
 	const reportText = outcome?.report ?? "(review subagent failed to run)";
+	let reportPath: string | null = null;
 	{
 		const runDir = runDirOf(ctx);
 		if (runDir) {
-			writeReviewRoundReport(runDir, {
+			reportPath = writeReviewRoundReport(runDir, {
 				budgetRound: round.budgetRound,
 				attempt: round.attempt,
 				outcome: outcome === null
 					? "spawn-failed"
-					: failed.length > 0
+					: failed.length > 0 || actionableHighs.length > 0
 						? "failed"
 						: undeterminable.length > 0 ? "undeterminable" : "passed",
 				passed,
 				failed,
 				undeterminable,
+				findings,
 				fingerprintCaptured: round.fingerprint,
 				coveredTaskIds,
 				report: reportText,
 			});
 		}
 	}
+	// Partial progress counts: a check affirmed this round is done even when
+	// a sibling failed, so a later round only re-judges what is still open.
+	for (const id of passed) {
+		const item = ex.items.find((candidate) => candidate.id === id);
+		if (item) item.done = true;
+	}
+
+	// v0.9 fix loop — evaluated BEFORE the completion branch so an unresolved
+	// high finding can never complete the run (liveness). Failed checks and
+	// high findings drive ONE union rollback and exactly one executor wake;
+	// high wins over the undeterminable self-schedule (a finding is
+	// actionable independent of verdict evidence). v0.9.1 (F-001): verdicts
+	// are authoritative whenever a report exists, but the FINDINGS-driven
+	// half of the branch needs a findings-bearing report — a no-findings
+	// round (spawn failure, discard synthesis, legacy shape) preserves the
+	// unresolved set and self-schedules instead of rolling back on it.
+	if (failed.length > 0 || actionableHighs.length > 0) {
+		ex.audit.failed = failed;
+		ex.audit.undeterminable = undeterminable;
+		const rolledBack: string[] = [];
+		for (const id of failed) {
+			rolledBack.push(...auditRollbackSet(ex.tasks, ex.items, id));
+		}
+		// Invalidation is the VC-fail invariant ONLY: a check re-verifies its
+		// reopened tasks when a FAILED check rolled them back. A pure
+		// finding-driven rollback keeps earlier passes — the findings channel
+		// itself re-examines the repaired work next round (stable ids).
+		if (rolledBack.length > 0) invalidateChecksForRolledBackTasks(ex.items, ex.tasks, rolledBack);
+		const knownIds = new Set(coveredTaskIds);
+		const mappedHighIds = [...new Set(actionableHighs.flatMap((h) => h.taskIds).filter((id) => knownIds.has(id)))];
+		const highRolledBack = findingsRollbackSet(ex.tasks, mappedHighIds);
+		const unmappedHighs = actionableHighs.filter((h) => !h.taskIds.some((id) => knownIds.has(id)));
+		const amended = unmappedHighs.length > 0 ? appendFindingTasks(ex, unmappedHighs) : [];
+		const allRolledBack = [...new Set([...rolledBack, ...highRolledBack])];
+		withExecutionCheckpoint(ctx, (cp) => {
+			// v0.9.1 (F-002): appending finding tasks rewrote the approved plan;
+			// re-stamp the checkpoint's plan identity in the same revision so a
+			// later /resume-plans accepts the amended plan instead of rejecting
+			// it as plan-mismatch (which would cost a full re-approval).
+			const amendedCp = amended.length > 0
+				? applyExecutionPlanAmended(cp, planIdentityOf(ex.planPath, cp.plan?.version ?? 1), ex.audit.rounds)
+				: cp;
+			return applyExecutionProgress(amendedCp, {
+				tasks: taskProgressMap(ex.tasks),
+				doneVcIds: ex.items.filter((item) => item.done).map((item) => item.id),
+				audit: { rounds: ex.audit.rounds, lastResult: failed.join(",") || `highs: ${actionableHighs.map((h) => h.id).join(",")}`, findings },
+			});
+		});
+		if (allRolledBack.length > 0 || amended.length > 0) {
+			// Rolling back (or appending) is itself forward progress for the
+			// watchdog, but NOT for audit.rounds: that counter stays monotonic
+			// so the repair loop is bounded. The repair belongs to the
+			// executor — back to executing.
+			ex.stall.rounds = 0;
+			ex.stall.lastSnapshot = stallSnapshot();
+			setRunStatusForReview(ctx, "executing");
+		}
+		persist(ctx);
+		updateStatusWidget(ctx);
+		// v0.8 wake, generalized (v0.9): per-round one-shot token — exactly one
+		// triggerTurn per committed fix-needing outcome, even when the round
+		// resolves long after the settle that spawned it.
+		if (!round.wakeSent) {
+			round.wakeSent = true;
+			const openTasks = flattenTaskViews(ex.tasks)
+				.filter((task) => !taskIsTerminal(task))
+				.map((task) => task.id);
+			const stranded = allRolledBack.length === 0 && amended.length === 0;
+			const highLines = actionableHighs.map((h) => `- ${h.id}${h.taskIds.length ? ` (${h.taskIds.join(", ")})` : ""}: ${h.note}`).join("\n");
+			const reportRef = reportPath
+				? `Full round report: ${reportPath}`
+				: `Full round report (run dir unwritable — inline):\n\n---\n${reportText.slice(0, 4000)}`;
+			// v0.9.1 (F-004): a pure VC-fail round keeps the v0.8 lead — never
+			// announce "0 high-severity findings" over an empty block.
+			const findingsLead = actionableHighs.length > 0
+				? `**pi-plans: execution review round ${ex.audit.rounds} found ${actionableHighs.length} high-severity finding(s)**${failed.length > 0 ? ` and failed checks: ${failed.join(", ")}` : ""}.`
+				: `**pi-plans: execution review round ${ex.audit.rounds} failed** — checks: ${failed.join(", ")}.`;
+			const findingsBlock = actionableHighs.length > 0 ? `\n\nHigh findings:\n${highLines}` : "";
+			const content = `${findingsLead} Rolled back tasks: ${allRolledBack.join(", ") || "(none covered)"}${amended.length > 0 ? `. Tasks appended to the plan for unmapped findings: ${amended.join(", ")}` : ""}.${findingsBlock}\n\nFix them and re-close the affected tasks with \`plans_update_task\`; the review reruns automatically once all tasks are terminal again.${ex.audit.rounds >= REVIEW_MAX_ROUNDS ? ` This was round ${REVIEW_MAX_ROUNDS} of ${REVIEW_MAX_ROUNDS}: the next terminal-task cycle pauses the run for review.` : ""}${stranded ? ` No task covers the finding(s) and none could be appended — the task tree stayed terminal; the next settle re-runs the review automatically.` : ""}\n\n${reportRef}`;
+			messaging().sendMessage(
+				{
+					customType: "pi-plans-audit-failed",
+					content: `${content}\n\nStill open: ${openTasks.join(", ") || "(none — the tree is terminal)"}`,
+					display: true,
+				},
+				{ triggerTurn: true },
+			);
+		}
+		return; // The agent repairs; the next settle re-enters the loop.
+	}
 
-	// Fail-closed completion: every pending check affirmatively passed. An
-	// all-undeterminable round yields failed === [] — completing here would be
-	// fail-open, marking a run done with nothing verified.
-	if (passed.length === pendingIds.length) {
+	// Fail-closed completion: every pending check affirmatively passed AND no
+	// high finding remains. The highs guard is explicit (v0.9.1, F-001): a
+	// no-report round skips the fix branch above, so this is the last line
+	// against vacuously completing an empty-pendingIds round with an
+	// unresolved high. An all-undeterminable round yields failed === [] —
+	// completing here would be fail-open, marking a run done with nothing
+	// verified.
+	if (passed.length === pendingIds.length && highs.length === 0) {
 		ex.audit.failed = [];
 		ex.audit.undeterminable = [];
-		for (const id of passed) {
-			const item = ex.items.find((candidate) => candidate.id === id);
-			if (item) item.done = true;
-		}
 		withExecutionCheckpoint(ctx, (cp) =>
 			applyExecutionProgress(cp, {
 				tasks: taskProgressMap(ex.tasks),
 				doneVcIds: ex.items.filter((item) => item.done).map((item) => item.id),
-				audit: { rounds: ex.audit.rounds, passed: true },
+				audit: { rounds: ex.audit.rounds, passed: true, findings },
 			}),
 		);
 		await completeExecution(ctx);
 		return;
 	}
-	// Partial progress counts: a check affirmed this round is done even when a
-	// sibling failed, so a later round only re-judges what is still open.
-	for (const id of passed) {
-		const item = ex.items.find((candidate) => candidate.id === id);
-		if (item) item.done = true;
-	}
+
+	// Undeterminable-only round: the loop self-schedules the retry (Q-B) — no
+	// wake, no message; the dashboard/overlay carries the round counter.
 	ex.audit.failed = failed;
 	ex.audit.undeterminable = undeterminable;
-	const rolledBack: string[] = [];
-	for (const id of failed) {
-		rolledBack.push(...auditRollbackSet(ex.tasks, ex.items, id));
-	}
-	// A rollback reopens work other checks were verifying; those checks must
-	// stop claiming the run is satisfied there.
-	if (rolledBack.length > 0) invalidateChecksForRolledBackTasks(ex.items, ex.tasks, rolledBack);
 	withExecutionCheckpoint(ctx, (cp) =>
 		applyExecutionProgress(cp, {
 			tasks: taskProgressMap(ex.tasks),
 			doneVcIds: ex.items.filter((item) => item.done).map((item) => item.id),
-			audit: { rounds: ex.audit.rounds, lastResult: failed.join(",") },
+			audit: { rounds: ex.audit.rounds, lastResult: failed.join(",") || undefined, findings },
 		}),
 	);
-	if (rolledBack.length > 0) {
-		// Rolling back is itself forward progress for the watchdog, but NOT for
-		// audit.rounds: that counter stays monotonic so the repair loop is
-		// bounded. The repair belongs to the executor — back to executing.
-		ex.stall.rounds = 0;
-		ex.stall.lastSnapshot = stallSnapshot();
-		setRunStatusForReview(ctx, "executing");
-	}
 	persist(ctx);
 	updateStatusWidget(ctx);
-	if (failed.length > 0) {
-		// v0.8 wake: per-round one-shot token — exactly one triggerTurn per
-		// committed failed outcome, even when the round resolves long after the
-		// settle that spawned it. The continuation runtime is deliberately
-		// untouched: detached rounds outlive their settle.
-		if (!round.wakeSent) {
-			round.wakeSent = true;
-			const openTasks = flattenTaskViews(ex.tasks)
-				.filter((task) => !taskIsTerminal(task))
-				.map((task) => task.id);
-			const stranded = rolledBack.length === 0;
-			const content = `**pi-plans: execution review round ${ex.audit.rounds} failed** — checks: ${failed.join(", ")}. Rolled back tasks: ${rolledBack.join(", ") || "(none covered)"}. Fix the failures and re-close the rolled-back tasks with \`plans_update_task\`; the review reruns automatically once all tasks are terminal again.${ex.audit.rounds >= REVIEW_MAX_ROUNDS ? ` This was round ${REVIEW_MAX_ROUNDS} of ${REVIEW_MAX_ROUNDS}: the next terminal-task cycle pauses the run for review.` : ""}${stranded ? ` No task covers the failed check(s), so the task tree stayed terminal — the next settle re-runs the review automatically.` : ""}`;
-			messaging().sendMessage(
-				{
-					customType: "pi-plans-audit-failed",
-					content: `${content}\n\nStill open: ${openTasks.join(", ") || "(none — the tree is terminal)"}\n\n---\n${reportText.slice(0, 4000)}`,
-					display: true,
-				},
-				{ triggerTurn: true },
-			);
-		}
-		return; // The agent repairs; the next settle re-enters the loop.
-	}
-	// Undeterminable-only round: the loop self-schedules the retry (Q-B) — no
-	// wake, no message; the dashboard/overlay carries the round counter.
 	await maybeContinueReview(ctx, ex);
 }
 
@@ -1899,7 +2085,8 @@ function pendingAudit(ex: ExecState | null = execution): ex is ExecState {
 	// This also bounds the zero-input continue loop in agent_before_settle.
 	if (ex.stall.paused) return false;
 	if (ex.review.inFlight) return false;
-	return allTasksTerminal(ex.tasks) && auditableChecks(ex.items, ex.tasks).some((item) => !item.done);
+	return allTasksTerminal(ex.tasks)
+		&& (auditableChecks(ex.items, ex.tasks).some((item) => !item.done) || unresolvedHighFindings(ex).length > 0);
 }
 
 /** v0.7.1: record that this settle already ran (or declined) its audit, so a
@@ -2052,10 +2239,12 @@ export function resumeActiveExecution(ctx: ExtensionContext): boolean {
 		pausedEx.audit.rounds = 0;
 		pausedEx.audit.failed = [];
 		pausedEx.audit.undeterminable = [];
+		// v0.9: the fresh budget inherits unresolved findings (stable ids keep
+		// counting) — only the round counter resets.
 		withExecutionCheckpoint(ctx, (cp) =>
 			applyExecutionProgress(cp, {
 				tasks: taskProgressMap(pausedEx.tasks),
-				audit: { rounds: 0, lastResult: undefined },
+				audit: { rounds: 0, lastResult: undefined, findings: pausedEx.audit.findings },
 				pausedReason: null,
 			}),
 		);
@@ -2102,6 +2291,12 @@ export async function completeExecution(ctx: ExtensionContext): Promise<void> {
 	const summary = flat
 		.map((task) => `- ${taskIsTerminal(task) && task.status === "skipped" ? "~" : "✓"} \`${task.id}\` ${task.title}`)
 		.join("\n");
+	// v0.9: residual (non-high) findings are summarized, never silent — the
+	// loop converged because nothing high-blocking remained.
+	const residualFindings = execution.audit.findings.filter((f) => f.severity !== "high");
+	const residualNote = residualFindings.length > 0
+		? `\n\nRecorded findings that did not block completion: ${residualFindings.map((f) => `${f.id} (${f.severity})`).join(", ")} — see the execution-review round reports under the run directory.`
+		: "";
 	const planPath = execution.planPath;
 	withExecutionCheckpoint(ctx, (cp) => applyExecutionCompleted(cp));
 	execution = null;
@@ -2111,7 +2306,7 @@ export async function completeExecution(ctx: ExtensionContext): Promise<void> {
 	messaging().sendMessage(
 		{
 			customType: "pi-plans-complete",
-			content: `**Plan complete!** ✅ \`${planPath}\` — execution review passed.\n\n${summary}`,
+			content: `**Plan complete!** ✅ \`${planPath}\` — execution review passed.\n\n${summary}${residualNote}`,
 			display: true,
 		},
 		{ triggerTurn: false },
@@ -2146,13 +2341,17 @@ export function executionContextMessage(ctx: ExtensionContext): string | null {
 	const rollbackNote = execution.audit.failed.length > 0
 		? `\nExecution review round ${execution.audit.rounds} failed checks: ${execution.audit.failed.join(", ")} — the covered tasks were rolled back to pending; re-close them with evidence after fixing the failures.`
 		: "";
+	const unresolvedHighs = unresolvedHighFindings(execution);
+	const highFindingsNote = unresolvedHighs.length > 0
+		? `\nExecution review round ${execution.audit.rounds} unresolved high-severity findings:\n${unresolvedHighs.map((f) => `- ${f.id}${f.taskIds.length ? ` (${f.taskIds.join(", ")})` : ""}: ${f.note}`).join("\n")}\nFix them, then re-close the affected tasks with evidence.`
+		: "";
 	return `[PI-PLANS EXECUTION — write access enabled]
 Implement the accepted plan at ${execution.planPath} (tasks ${progress.done}/${progress.total}${execution.legacyPlan ? " · legacy I-### mapping" : ""} · VC ${vcDone}/${execution.items.length}).
 
 Current wave ${currentWave} open tasks:
 ${waveList}
 
-Remaining open tasks (all waves): ${open.map((task) => task.id).join(", ") || "(none)"}.${rollbackNote}
+Remaining open tasks (all waves): ${open.map((task) => task.id).join(", ") || "(none)"}.${rollbackNote}${highFindingsNote}
 
 ${graphLine}
 
@@ -2217,7 +2416,12 @@ export async function restoreFromSession(ctx: ExtensionContext, entries: Session
 		planTasks = parsePlanTasks(planText);
 		const snapshotProgress = taskProgressMap(snapshot.tasks ?? []);
 		tasks = buildTaskView(planTasks, snapshotProgress);
-		items = parseChecklist(planText);
+		// Fresh text wins, but the satisfied state survives the re-parse: a
+		// mid-loop session restore (v0.9.1, found via F-001's self-schedule
+		// path) must not hand the next round a brief that re-judges checks an
+		// earlier round already passed — that burned budget on every /reload.
+		const snapDone = new Set(snapshot.items.filter((c) => c.done).map((c) => c.id));
+		items = parseChecklist(planText).map((item) => (snapDone.has(item.id) ? { ...item, done: true } : item));
 	} catch {
 		tasks = snapshot.tasks;
 	}
@@ -2238,6 +2442,7 @@ export async function restoreFromSession(ctx: ExtensionContext, entries: Session
 			rounds: snapshot.audit?.rounds ?? 0,
 			failed: snapshot.audit?.failed ?? [],
 			undeterminable: [],
+			findings: toReviewFindings(snapshot.audit?.findings),
 			running: false,
 		},
 		review: { attempts: 0, consecutiveDiscards: 0, inFlight: null },