taskplane 0.30.4 → 0.30.6

package/extensions/taskplane/engine-worker.ts

@@ -120,6 +120,14 @@ export interface EngineWorkerData {
 	force?: boolean;
 	/** Supervisor autonomy mode propagated to worker bridge tools. */
 	supervisorAutonomy?: "interactive" | "supervised" | "autonomous";
+	/**
+	 * #631: the batch this engine is AUTHORIZED to drive. Preallocated by the
+	 * parent so the engine identity (pid) is published BEFORE the engine starts
+	 * — for a fresh batch this is the id the engine must adopt instead of
+	 * generating its own; for resume it is the persisted/reconstructed target
+	 * the parent gated ownership against, and resume verifies it matches.
+	 */
+	authorizedBatchId?: string;
 }
 
 // ── Serialization helpers (used by both main thread and worker) ──────
@@ -211,13 +219,57 @@ export function applySerializedState(
 
 // Guard: only run engine main when launched via fork() with the sentinel env var.
 if (process.env.TASKPLANE_ENGINE_FORK === "1" && typeof process.send === "function") {
+	// #631: a send() on a CLOSED channel does not throw synchronously — Node emits
+	// an asynchronous ERR_IPC_CHANNEL_CLOSED on `process`, which would surface as
+	// an uncaughtException and route an orphaned engine into reportFatalAndExit
+	// instead of its graceful paused wind-down. Gate every send on
+	// `process.connected`, and absorb any stray channel error.
 	const send = (msg: WorkerToMainMessage) => {
+		if (!process.connected) return;
 		try {
 			process.send?.(msg);
 		} catch {
 			// best effort only
 		}
 	};
+	const safeDisconnect = () => {
+		if (!process.connected) return;
+		try {
+			process.disconnect?.();
+		} catch {
+			/* already closed */
+		}
+	};
+	process.on("error", (err: unknown) => {
+		const code = (err as { code?: string } | null)?.code;
+		if (code === "ERR_IPC_CHANNEL_CLOSED" || code === "EPIPE") return; // parent gone — expected while orphaned
+		throw err;
+	});
+
+	// #631: orphan detection must be armed BEFORE the async module imports below
+	// (a parent can die during engine startup). `batchState` is hoisted so the
+	// handler can pause it once it exists.
+	let batchState: OrchBatchRuntimeState | null = null;
+	let orphanedBeforeInit = false;
+	process.on("disconnect", () => {
+		if (!batchState) {
+			// Parent vanished before init/planning produced any state: nothing to
+			// checkpoint, nothing another session could inherit. Exit quietly.
+			orphanedBeforeInit = true;
+			process.exit(0);
+			return;
+		}
+		// We call process.disconnect() ourselves after a terminal state — that is
+		// not an orphaning; only act while the batch is still active.
+		const p = batchState.phase;
+		if (p === "completed" || p === "failed" || p === "paused" || p === "stopped") return;
+		batchState.pauseSignal.paused = true;
+		batchState.pauseSignal.cause = "operator";
+		process.stderr.write(
+			`[orch] engine-worker: supervisor disconnected (parent pid gone) — winding down as paused (#631)
+`,
+		);
+	});
 
 	const sendWithAck = (msg: WorkerToMainMessage, onFlushed: () => void) => {
 		if (typeof process.send !== "function" || !process.connected) {
@@ -255,8 +307,8 @@ if (process.env.TASKPLANE_ENGINE_FORK === "1" && typeof process.send === "functi
 	// Wait for the init message carrying workerData, then start the engine.
 	process.once("message", async (initMsg: { type: string; data: EngineWorkerData }) => {
 		if (initMsg?.type !== "init") return;
+		if (orphanedBeforeInit) return;
 
-		let batchState: OrchBatchRuntimeState | null = null;
 		let fatalHandled = false;
 		const reportFatalAndExit = (source: WorkerErrorSource, err: unknown) => {
 			if (fatalHandled) return;
@@ -292,6 +344,7 @@ if (process.env.TASKPLANE_ENGINE_FORK === "1" && typeof process.send === "functi
 
 		// Create a fresh batch state for this process
 		batchState = freshOrchBatchState();
+		if (data.authorizedBatchId) batchState.batchId = data.authorizedBatchId; // #631
 		batchState.phase = "launching";
 		batchState.startedAt = Date.now();
 
@@ -306,12 +359,15 @@ if (process.env.TASKPLANE_ENGINE_FORK === "1" && typeof process.send === "functi
 			switch (msg.type) {
 				case "pause":
 					batchState.pauseSignal.paused = true;
+					batchState.pauseSignal.cause = "operator";
 					break;
 				case "resume":
 					batchState.pauseSignal.paused = false;
+					batchState.pauseSignal.cause = undefined;
 					break;
 				case "abort":
 					batchState.pauseSignal.paused = true;
+					batchState.pauseSignal.cause = "abort";
 					break;
 			}
 		});
@@ -392,7 +448,7 @@ if (process.env.TASKPLANE_ENGINE_FORK === "1" && typeof process.send === "functi
 				const finalState = serializeBatchState(batchState);
 				send({ type: "complete", state: finalState });
 				// Disconnect IPC so the child process can exit cleanly
-				process.disconnect?.();
+				safeDisconnect();
 			})
 			.catch((err: unknown) => {
 				const normalized = normalizeError(err);
@@ -409,7 +465,7 @@ if (process.env.TASKPLANE_ENGINE_FORK === "1" && typeof process.send === "functi
 					message: normalized.message,
 					stack: normalized.stack,
 				});
-				process.disconnect?.();
+				safeDisconnect();
 			});
 	});
 }

package/extensions/taskplane/engine.ts

@@ -10,6 +10,7 @@ import {
 	buildReviewerEnv,
 	buildWorkerEnv,
 	buildWorkerExcludeEnv,
+	batchTaskScope,
 	computeTransitiveDependents,
 	execLog,
 	executeLaneV2,
@@ -21,7 +22,7 @@ import type { RuntimeBackend } from "./execution.ts";
 import type { MonitorUpdateCallback } from "./execution.ts";
 // classifyExit no longer called directly — Tier 0 uses exitDiagnostic.classification
 // from the diagnostic-reports pipeline (populated by assembleDiagnosticInput).
-import { getCurrentBranch, runGit } from "./git.ts";
+import { describeOrchBranchStateAcrossRepos, getCurrentBranch, runGit } from "./git.ts";
 import { killAllMergeAgentsV2, mergeWaveByRepo, MergeHealthMonitor } from "./merge.ts";
 import {
 	applyMergeRetryLoop,
@@ -1581,6 +1582,18 @@ async function attemptWorkerCrashRetry(
 			continue;
 		}
 
+		// #629: a finalize refusal over an outstanding REVISE/RETHINK is a
+		// governance outcome, not a fault. Re-running the same worker without
+		// the review file changing cannot succeed; the supervisor adjudicates.
+		if (classification === "review_gate_refusal") {
+			execLog(
+				"batch",
+				batchState.batchId,
+				`tier0: task ${taskId} review_gate_refusal — awaiting adjudication, NOT auto-retrying (#629)`,
+			);
+			continue;
+		}
+
 		// Check if retryable
 		if (!TIER0_RETRYABLE_CLASSIFICATIONS.has(classification)) {
 			execLog(
@@ -2341,6 +2354,8 @@ async function attemptStaleWorktreeRecovery(
 			thinking: runnerConfig?.reviewer?.thinking || "",
 			tools: runnerConfig?.reviewer?.tools || "",
 			excludeExtensions: runnerConfig?.reviewer?.excludeExtensions ?? [],
+			severityLabels: runnerConfig?.reviewer?.severityLabels,
+			spiral: runnerConfig?.reviewer?.spiral,
 		},
 		runnerConfig?.worker
 			? {
@@ -2533,7 +2548,9 @@ export async function executeOrchBatch(
 
 	// ── Phase 1: Planning ────────────────────────────────────────
 	batchState.phase = "planning";
-	batchState.batchId = generateBatchId();
+	// #631: honour a parent-preallocated (authorized) batchId so the engine
+	// identity could be published before this process started.
+	batchState.batchId = batchState.batchId || generateBatchId();
 	// Preserve startedAt if set during "launching" phase (TP-040)
 	if (!batchState.startedAt) batchState.startedAt = Date.now();
 	// Preserve pauseSignal if already set during "launching" phase (TP-040)
@@ -2887,6 +2904,7 @@ export async function executeOrchBatch(
 		// Check pause signal before starting each wave
 		if (batchState.pauseSignal.paused) {
 			batchState.phase = "paused";
+			preserveWorktreesForResume = true; // every pause exit preserves recovery worktrees
 			execLog("batch", batchState.batchId, `batch paused before wave ${waveIdx + 1}`);
 			{
 				const { displayWave } = resolveDisplayWaveNumber(waveIdx, roundToTaskWave, taskLevelWaveCount);
@@ -3111,6 +3129,8 @@ export async function executeOrchBatch(
 				thinking: runnerConfig?.reviewer?.thinking || "",
 				tools: runnerConfig?.reviewer?.tools || "",
 				excludeExtensions: runnerConfig?.reviewer?.excludeExtensions ?? [],
+				severityLabels: runnerConfig?.reviewer?.severityLabels,
+				spiral: runnerConfig?.reviewer?.spiral,
 			},
 			runnerConfig?.worker
 				? {
@@ -3243,7 +3263,11 @@ export async function executeOrchBatch(
 			if (modelFallbackOutcome.succeededRetries.length > 0) {
 				// Recompute blocked tasks after model fallback successes
 				if (waveResult.policyApplied === "skip-dependents" && waveResult.failedTaskIds.length > 0) {
-					const recomputed = computeTransitiveDependents(new Set(waveResult.failedTaskIds), depGraph);
+					const recomputed = computeTransitiveDependents(
+						new Set(waveResult.failedTaskIds),
+						depGraph,
+						batchTaskScope(wavePlan),
+					);
 					waveResult.blockedTaskIds = [...recomputed].sort();
 				} else if (waveResult.failedTaskIds.length === 0) {
 					waveResult.blockedTaskIds = [];
@@ -3285,7 +3309,11 @@ export async function executeOrchBatch(
 				// attemptWorkerCrashRetry already updated waveResult.failedTaskIds
 				// and waveResult.succeededTaskIds in-place.
 				if (waveResult.policyApplied === "skip-dependents" && waveResult.failedTaskIds.length > 0) {
-					const recomputed = computeTransitiveDependents(new Set(waveResult.failedTaskIds), depGraph);
+					const recomputed = computeTransitiveDependents(
+						new Set(waveResult.failedTaskIds),
+						depGraph,
+						batchTaskScope(wavePlan),
+					);
 					waveResult.blockedTaskIds = [...recomputed].sort();
 				} else if (waveResult.failedTaskIds.length === 0) {
 					// All failures recovered — no blocked tasks
@@ -3312,9 +3340,13 @@ export async function executeOrchBatch(
 			if (
 				waveResult.failedTaskIds.length === 0 &&
 				batchState.pauseSignal.paused &&
+				// Positive check: Tier-0 clears ONLY a policy-caused pause. Operator,
+				// abort and merge-failure pauses are never cleared by a recovered retry.
+				(batchState.pauseSignal.cause === undefined || batchState.pauseSignal.cause === "stop-wave") &&
 				waveResult.policyApplied === "stop-wave"
 			) {
 				batchState.pauseSignal.paused = false;
+				batchState.pauseSignal.cause = undefined;
 				execLog(
 					"batch",
 					batchState.batchId,
@@ -3748,9 +3780,14 @@ export async function executeOrchBatch(
 		batchState.failedTasks += waveResult.failedTaskIds.length;
 		batchState.skippedTasks += waveResult.skippedTaskIds.length;
 
-		// Add newly blocked tasks (after retry so recovered tasks don't block dependents)
-		for (const blocked of waveResult.blockedTaskIds) {
-			batchState.blockedTaskIds.add(blocked);
+		// Add newly blocked tasks (after retry so recovered tasks don't block dependents).
+		// #629: the dependency graph is repo-wide — only record IDs that belong to
+		// this batch (the blockedTasks counter is already wave-scoped).
+		{
+			const scope = batchTaskScope(wavePlan);
+			for (const blocked of waveResult.blockedTaskIds) {
+				if (scope.has(blocked)) batchState.blockedTaskIds.add(blocked);
+			}
 		}
 
 		// ── TP-040: Emit task_complete / task_failed events ──────
@@ -3919,6 +3956,51 @@ export async function executeOrchBatch(
 			break;
 		}
 
+		// ── Pause finalizer (penster 20260906T194514) ───────────────
+		// A pause that lands DURING a wave leaves tasks pending (never skipped).
+		// Previously pause was only honoured before the NEXT wave, so a paused
+		// single-wave batch "completed" 0/1, merged nothing and cleaned up its
+		// worktree. Finalize as paused here: persist the pending outcomes and
+		// frontier, preserve worktrees, emit batch_paused, and stop — no merge.
+		// A stop-all abort also leaves peers pending — that is the abort path's
+		// business, never a pause. The exclusion applies to the WHOLE predicate.
+		const notAborting =
+			batchState.pauseSignal.cause !== "abort" && waveResult.overallStatus !== "aborted";
+		const operatorPaused = batchState.pauseSignal.paused && notAborting;
+		if (notAborting && ((waveResult.pausedTaskIds?.length ?? 0) > 0 || operatorPaused)) {
+			batchState.phase = "paused";
+			preserveWorktreesForResume = true;
+			const pausedIds = waveResult.pausedTaskIds ?? [];
+			execLog("batch", batchState.batchId, `batch paused during wave ${waveIdx + 1}`, {
+				cause: batchState.pauseSignal.cause ?? "operator",
+				pendingTasks: pausedIds.join(",") || "(none)",
+				succeeded: waveResult.succeededTaskIds.length,
+				failed: waveResult.failedTaskIds.length,
+			});
+			// (Succeeded/failed/skipped counters were already accumulated above; paused
+			// tasks are pending and intentionally not counted.)
+			persistRuntimeState(
+				"pause-during-wave",
+				batchState,
+				wavePlan,
+				latestAllocatedLanes,
+				allTaskOutcomes,
+				discoveryRef,
+				stateRoot,
+			);
+			{
+				const { displayWave } = resolveDisplayWaveNumber(waveIdx, roundToTaskWave, taskLevelWaveCount);
+				onNotify(
+					`⏸️  Batch paused during wave ${displayWave}: ${pausedIds.length} task(s) remain pending` +
+						`${waveResult.succeededTaskIds.length > 0 ? `, ${waveResult.succeededTaskIds.length} succeeded (unmerged until resume)` : ""}. ` +
+						`Worktrees preserved. Use orch_resume() to continue.`,
+					"warning",
+				);
+			}
+			emitTerminalEvent(`Paused during wave ${waveIdx + 1}`);
+			break;
+		}
+
 		// ── TS-009: Persist state after wave execution ──
 		persistRuntimeState(
 			"wave-execution-complete",
@@ -4915,12 +4997,28 @@ export async function executeOrchBatch(
 						});
 						// If reset fails, remove this worktree so the next wave can recreate it cleanly.
 						try {
-							removeWorktree(wt, perRepoRoot);
-							execLog(
-								"batch",
-								batchState.batchId,
-								`removed unrecoverable worktree for lane ${wt.laneNumber}`,
-							);
+							const rm = removeWorktree(wt, perRepoRoot);
+							if (rm.refusedDirty) {
+								// #628: refusal is NOT success — the worktree still exists with
+								// uncommitted work. Track it for the cleanup gate and surface loudly;
+								// do NOT force-clean (that would destroy the work being protected).
+								execLog(
+									"batch",
+									batchState.batchId,
+									`worktree removal REFUSED for lane ${wt.laneNumber}: ${rm.dirtyFileCount} uncommitted change(s) — preserve progress before cleanup (#628)`,
+									{ path: wt.path },
+								);
+								if (!failedRemovalWorktrees.has(perRepoRoot)) {
+									failedRemovalWorktrees.set(perRepoRoot, { repoId: perRepoId, paths: [] });
+								}
+								failedRemovalWorktrees.get(perRepoRoot)!.paths.push(wt.path);
+							} else {
+								execLog(
+									"batch",
+									batchState.batchId,
+									`removed unrecoverable worktree for lane ${wt.laneNumber}`,
+								);
+							}
 						} catch (removeErr: unknown) {
 							execLog(
 								"batch",
@@ -5841,14 +5939,36 @@ export async function executeOrchBatch(
 				? `${Math.floor(batchDurationMs / 60000)}m ${Math.round((batchDurationMs % 60000) / 1000)}s`
 				: "unknown";
 		if (batchState.phase === "completed" && batchState.failedTasks === 0) {
+			// Report outcomes and branch state SEPARATELY and truthfully (penster
+			// 20260906T194514 saw "Merged … Ready for integration" on 0/1 succeeded
+			// with an empty orch branch). Never say "merged" unless the orch branch is
+			// verifiably ahead of base; a failed comparison is "unknown", not "nothing".
+			const branchState = describeOrchBranchStateAcrossRepos(
+				batchState.orchBranch,
+				batchState.baseBranch,
+				encounteredRepoRoots.keys(),
+			);
+			const hasSuccess = batchState.succeededTasks > 0;
+			const outcomeLine =
+				`  ${batchState.succeededTasks}/${batchState.totalTasks} tasks succeeded` +
+				(batchState.skippedTasks > 0 ? `, ${batchState.skippedTasks} skipped` : "") +
+				"\n";
+			const nextStep =
+				hasSuccess && branchState.kind === "ahead"
+					? `Ready for integration. Run orch_integrate() or review first.`
+					: branchState.kind === "ahead"
+						? `⚠️ No task succeeded, yet ${branchState.detail} — partial work was merged; inspect before integrating.`
+						: branchState.kind === "unknown"
+							? `⚠️ Could not verify the orch branch (${branchState.detail}). Inspect before integrating.`
+							: `Nothing to integrate: ${branchState.detail}.`;
 			emitAlert({
 				category: "batch-complete",
 				summary:
-					`✅ Batch ${batchState.batchId} completed\n` +
-					`  ${batchState.succeededTasks}/${batchState.totalTasks} tasks succeeded\n` +
+					`${hasSuccess ? "✅" : "⚠️"} Batch ${batchState.batchId} completed\n` +
+					outcomeLine +
 					`  ${batchState.taskLevelWaveCount ?? batchState.totalWaves} wave(s), duration: ${durationStr}\n` +
-					`  Merged to orch branch: ${batchState.orchBranch}\n\n` +
-					`Ready for integration. Run orch_integrate() or review first.`,
+					`  Orch branch ${batchState.orchBranch}: ${branchState.detail}\n\n` +
+					nextStep,
 				context: {
 					batchProgress: buildBatchProgressSnapshot(batchState),
 					batchDurationMs,

package/extensions/taskplane/execution.ts

@@ -35,6 +35,7 @@ import type {
 	ParsedTask,
 	TaskMonitorSnapshot,
 	WaveExecutionResult,
+	PauseSignal,
 	WorkspaceConfig,
 	ExecutionUnit,
 	PacketPaths,
@@ -1198,7 +1199,7 @@ export async function monitorLanes(
 	lanes: AllocatedLane[],
 	config: OrchestratorConfig,
 	repoRoot: string,
-	pauseSignal: { paused: boolean },
+	pauseSignal: PauseSignal,
 	waveNumber: number = 1,
 	onUpdate?: MonitorUpdateCallback,
 	isWorkspaceMode?: boolean,
@@ -1521,15 +1522,25 @@ export async function monitorLanes(
  * The failed tasks themselves are NOT included in the output — only their
  * downstream dependents.
  *
+ * #629 side-effect 3: the dependency graph is REPO-WIDE (built from all
+ * discovered tasks), so without a scope the result can name tasks that are
+ * not in the batch at all ("blocked=TP-2047" for a single-task batch). When
+ * `scope` is given, traversal still walks THROUGH out-of-scope nodes (a
+ * transitive dependent reached via one is still blocked) but only in-scope
+ * task IDs are REPORTED.
+ *
  * @param failedTaskIds     - Set of task IDs that failed
  * @param dependencyGraph   - Dependency graph with dependents map
+ * @param scope             - Optional batch task set; only these IDs are reported
  * @returns Set of task IDs transitively blocked (excludes the failed tasks themselves)
  */
 export function computeTransitiveDependents(
 	failedTaskIds: Set<string>,
 	dependencyGraph: DependencyGraph,
+	scope?: Set<string>,
 ): Set<string> {
 	const blocked = new Set<string>();
+	const visited = new Set<string>(); // traversal set — distinct from the reported set
 	const queue = [...failedTaskIds];
 
 	while (queue.length > 0) {
@@ -1540,9 +1551,10 @@ export function computeTransitiveDependents(
 		const sortedDependents = [...dependents].sort();
 
 		for (const dep of sortedDependents) {
-			if (blocked.has(dep)) continue;
+			if (visited.has(dep)) continue;
 			if (failedTaskIds.has(dep)) continue; // Don't re-add failed tasks
-			blocked.add(dep);
+			visited.add(dep);
+			if (!scope || scope.has(dep)) blocked.add(dep);
 			queue.push(dep); // Continue BFS for transitive closure
 		}
 	}
@@ -1550,6 +1562,13 @@ export function computeTransitiveDependents(
 	return blocked;
 }
 
+/** Flatten a wave plan into the set of task IDs that belong to the batch. */
+export function batchTaskScope(wavePlan: string[][] | undefined | null): Set<string> {
+	const scope = new Set<string>();
+	for (const wave of wavePlan ?? []) for (const id of wave) scope.add(id);
+	return scope;
+}
+
 // ── Pre-flight: Commit Untracked Task Files ─────────────────────────
 
 /**
@@ -1914,7 +1933,7 @@ export async function executeWave(
 	config: OrchestratorConfig,
 	repoRoot: string,
 	batchId: string,
-	pauseSignal: { paused: boolean },
+	pauseSignal: PauseSignal,
 	dependencyGraph: DependencyGraph,
 	orchBranch: string,
 	onMonitorUpdate?: MonitorUpdateCallback,
@@ -1928,6 +1947,8 @@ export async function executeWave(
 		thinking?: string;
 		tools?: string;
 		excludeExtensions?: string[];
+		severityLabels?: string[];
+		spiral?: import("./config-schema.ts").ReviewSpiralConfig;
 	},
 	workerConfig?: {
 		model?: string;
@@ -2166,6 +2187,7 @@ export async function executeWave(
 	// ── Stage 5: Build WaveExecutionResult ───────────────────────
 	const failedTaskIds: string[] = [];
 	const skippedTaskIds: string[] = [];
+	const pausedTaskIds: string[] = [];
 	const succeededTaskIds: string[] = [];
 
 	for (const lr of laneResults) {
@@ -2176,6 +2198,8 @@ export async function executeWave(
 				failedTaskIds.push(t.taskId);
 			} else if (t.status === "skipped") {
 				skippedTaskIds.push(t.taskId);
+			} else if (t.status === "pending") {
+				pausedTaskIds.push(t.taskId);
 			}
 		}
 	}
@@ -2184,6 +2208,7 @@ export async function executeWave(
 	failedTaskIds.sort();
 	skippedTaskIds.sort();
 	succeededTaskIds.sort();
+	pausedTaskIds.sort();
 
 	// Compute blocked tasks for future waves (skip-dependents policy)
 	let blockedTaskIds: string[] = [];
@@ -2210,6 +2235,10 @@ export async function executeWave(
 	let overallStatus: WaveExecutionResult["overallStatus"];
 	if (policy === "stop-all" && failedTaskIds.length > 0) {
 		overallStatus = "aborted";
+	} else if (pausedTaskIds.length > 0 && failedTaskIds.length === 0) {
+		// Interrupted, not succeeded: a wave with paused (pending) tasks is not
+		// complete. The engine finalizes as `paused` and does not merge.
+		overallStatus = succeededTaskIds.length > 0 ? "partial" : "failed";
 	} else if (failedTaskIds.length === 0) {
 		overallStatus = "succeeded";
 	} else if (succeededTaskIds.length > 0) {
@@ -2225,6 +2254,7 @@ export async function executeWave(
 		succeeded: succeededTaskIds.length,
 		failed: failedTaskIds.length,
 		skipped: skippedTaskIds.length,
+		paused: pausedTaskIds.length,
 		blocked: blockedTaskIds.length,
 		elapsed: `${elapsedSec}s`,
 		stoppedEarly,
@@ -2238,6 +2268,7 @@ export async function executeWave(
 		policyApplied: policy,
 		stoppedEarly,
 		failedTaskIds,
+		pausedTaskIds,
 		skippedTaskIds,
 		succeededTaskIds,
 		blockedTaskIds,
@@ -2269,7 +2300,7 @@ export async function executeWave(
 export async function executeWithStopAll(
 	lanes: AllocatedLane[],
 	lanePromises: Promise<LaneExecutionResult>[],
-	pauseSignal: { paused: boolean },
+	pauseSignal: PauseSignal,
 	waveIndex: number,
 ): Promise<LaneExecutionResult[]> {
 	// Track results as they complete
@@ -2290,6 +2321,7 @@ export async function executeWithStopAll(
 					// First failure detected — trigger stop-all
 					abortTriggered = true;
 					pauseSignal.paused = true;
+					pauseSignal.cause = "abort";
 
 					// Determine which task failed first for logging
 					const firstFailed = result.tasks
@@ -2325,6 +2357,7 @@ export async function executeWithStopAll(
 			if (!abortTriggered) {
 				abortTriggered = true;
 				pauseSignal.paused = true;
+				pauseSignal.cause = "abort";
 				execLog(
 					"wave",
 					`W${waveIndex}`,
@@ -2758,6 +2791,8 @@ export function buildReviewerEnv(
 		thinking?: string;
 		tools?: string;
 		excludeExtensions?: string[];
+		severityLabels?: string[];
+		spiral?: import("./config-schema.ts").ReviewSpiralConfig;
 	} | null,
 ): Record<string, string> {
 	const env: Record<string, string> = {};
@@ -2768,6 +2803,17 @@ export function buildReviewerEnv(
 	if (reviewerConfig?.excludeExtensions && reviewerConfig.excludeExtensions.length > 0) {
 		env.TASKPLANE_REVIEWER_EXCLUDE_EXTENSIONS = JSON.stringify(reviewerConfig.excludeExtensions);
 	}
+	// Review-boundary notifications: forward the severity vocabulary + spiral
+	// tuning as one JSON blob so the lane-runner can analyze reviews and detect
+	// spirals. Absent fields fall back to lane-runner defaults.
+	const analysis: Record<string, unknown> = {};
+	if (reviewerConfig?.severityLabels && reviewerConfig.severityLabels.length > 0) {
+		analysis.severityLabels = reviewerConfig.severityLabels;
+	}
+	if (reviewerConfig?.spiral) analysis.spiral = reviewerConfig.spiral;
+	if (Object.keys(analysis).length > 0) {
+		env.TASKPLANE_REVIEW_ANALYSIS = JSON.stringify(analysis);
+	}
 	return env;
 }
 
@@ -2785,12 +2831,21 @@ export function buildWorkerEnv(
 		thinking?: string;
 		tools?: string;
 		excludeExtensions?: string[];
+		exitInterceptTimeoutSec?: number;
 	} | null,
 ): Record<string, string> {
 	const env: Record<string, string> = {};
 	if (workerConfig?.model) env.TASKPLANE_WORKER_MODEL = workerConfig.model;
 	if (workerConfig?.thinking) env.TASKPLANE_WORKER_THINKING = workerConfig.thinking;
 	if (workerConfig?.tools) env.TASKPLANE_WORKER_TOOLS = workerConfig.tools;
+	if (
+		typeof workerConfig?.exitInterceptTimeoutSec === "number" &&
+		Number.isFinite(workerConfig.exitInterceptTimeoutSec)
+	) {
+		env.TASKPLANE_EXIT_INTERCEPT_TIMEOUT_SEC = String(
+			Math.min(1800, Math.max(15, Math.round(workerConfig.exitInterceptTimeoutSec))),
+		);
+	}
 
 	return env;
 }
@@ -2813,7 +2868,7 @@ export async function executeLaneV2(
 	lane: AllocatedLane,
 	config: OrchestratorConfig,
 	repoRoot: string,
-	pauseSignal: { paused: boolean },
+	pauseSignal: PauseSignal,
 	workspaceRoot?: string,
 	isWorkspaceMode?: boolean,
 	extraEnvVars?: Record<string, string>,
@@ -2892,12 +2947,14 @@ export async function executeLaneV2(
 	for (const task of lane.tasks) {
 		const taskSegmentId = task.task.activeSegmentId ?? null;
 		if (shouldSkipRemaining || pauseSignal.paused) {
+			// A pause leaves the remaining lane tasks PENDING (they never ran); only a
+			// prior failure in the lane skips them.
 			const reason = pauseSignal.paused
-				? "Skipped due to pause signal"
+				? "Paused by user"
 				: "Skipped due to prior task failure in lane";
 			outcomes.push({
 				taskId: task.taskId,
-				status: "skipped",
+				status: pauseSignal.paused && !shouldSkipRemaining ? "pending" : "skipped",
 				segmentId: taskSegmentId,
 				startTime: null,
 				endTime: null,
@@ -2920,6 +2977,24 @@ export async function executeLaneV2(
 				? (rawAutonomy as LaneRunnerConfig["supervisorAutonomy"])
 				: "autonomous";
 
+		// Review-boundary notifications: parse the severity vocabulary + spiral
+		// tuning forwarded by buildReviewerEnv (best-effort; lane-runner applies
+		// defaults when absent or unparseable).
+		let reviewSeverityLabels: string[] | undefined;
+		let reviewSpiral: import("./config-schema.ts").ReviewSpiralConfig | undefined;
+		if (extraEnvVars?.TASKPLANE_REVIEW_ANALYSIS) {
+			try {
+				const parsed = JSON.parse(extraEnvVars.TASKPLANE_REVIEW_ANALYSIS) as {
+					severityLabels?: string[];
+					spiral?: import("./config-schema.ts").ReviewSpiralConfig;
+				};
+				if (Array.isArray(parsed.severityLabels)) reviewSeverityLabels = parsed.severityLabels;
+				if (parsed.spiral && typeof parsed.spiral === "object") reviewSpiral = parsed.spiral;
+			} catch {
+				/* best effort — fall back to lane-runner defaults */
+			}
+		}
+
 		const laneRunnerConfig: LaneRunnerConfig = {
 			batchId,
 			agentIdPrefix,
@@ -2928,12 +3003,18 @@ export async function executeLaneV2(
 			branch: lane.branch,
 			repoId: lane.repoId ?? "default",
 			stateRoot,
+			reviewSeverityLabels,
+			reviewSpiral,
 			workerModel: extraEnvVars?.TASKPLANE_WORKER_MODEL || "",
 			// TP-184: This is the user-tools default. Engine bridge tools are NOT
 			// added here — buildWorkerToolsAllowlist() at the lane-runner spawn
 			// site appends ENGINE_BRIDGE_TOOLS exactly once, regardless of source.
 			workerTools: extraEnvVars?.TASKPLANE_WORKER_TOOLS || DEFAULT_WORKER_USER_TOOLS,
 			workerThinking: extraEnvVars?.TASKPLANE_WORKER_THINKING || "",
+			exitInterceptTimeoutSec: (() => {
+				const n = Number.parseInt(extraEnvVars?.TASKPLANE_EXIT_INTERCEPT_TIMEOUT_SEC ?? "", 10);
+				return Number.isFinite(n) && n >= 15 ? Math.min(1800, n) : 60;
+			})(),
 			workerSystemPrompt,
 			workerSegmentPrompt,
 			reviewerModel: extraEnvVars?.TASKPLANE_REVIEWER_MODEL || "",