taskplane 0.5.12 → 0.6.0

package/extensions/taskplane/resume.ts

@@ -5,19 +5,21 @@
 import { existsSync } from "fs";
 import { join } from "path";
 
+import { assembleDiagnosticInput, emitDiagnosticReports } from "./diagnostic-reports.ts";
 import { runDiscovery } from "./discovery.ts";
 import { executeOrchBatch } from "./engine.ts";
 import { computeTransitiveDependents, execLog, executeWave, pollUntilTaskComplete, spawnLaneSession, tmuxHasSession } from "./execution.ts";
 import type { MonitorUpdateCallback } from "./execution.ts";
 import { getCurrentBranch, runGit } from "./git.ts";
 import { attemptAutoIntegration, mergeWaveByRepo } from "./merge.ts";
-import { computeMergeFailurePolicy, formatRepoMergeSummary, ORCH_MESSAGES } from "./messages.ts";
+import { applyMergeRetryLoop, computeCleanupGatePolicy, computeMergeFailurePolicy, formatRepoMergeSummary, ORCH_MESSAGES } from "./messages.ts";
+import type { CleanupGateRepoFailure } from "./messages.ts";
 import { resolveOperatorId } from "./naming.ts";
-import { deleteBatchState, hasTaskDoneMarker, loadBatchState, persistRuntimeState, seedPendingOutcomesForAllocatedLanes, syncTaskOutcomesFromMonitor, upsertTaskOutcome } from "./persistence.ts";
-import { StateFileError } from "./types.ts";
+import { applyPartialProgressToOutcomes, deleteBatchState, hasTaskDoneMarker, loadBatchState, persistRuntimeState, seedPendingOutcomesForAllocatedLanes, syncTaskOutcomesFromMonitor, upsertTaskOutcome } from "./persistence.ts";
+import { defaultResilienceState, StateFileError } from "./types.ts";
 import type { AllocatedLane, AllocatedTask, LaneExecutionResult, LaneTaskOutcome, LaneTaskStatus, MergeWaveResult, OrchBatchPhase, OrchBatchRuntimeState, OrchestratorConfig, ParsedTask, PersistedBatchState, PersistedLaneRecord, ReconciledTaskState, ResumeEligibility, ResumePoint, TaskRunnerConfig, WaveExecutionResult, WorkspaceConfig } from "./types.ts";
 import { buildDependencyGraph, resolveBaseBranch, resolveRepoRoot } from "./waves.ts";
-import { deleteBranchBestEffort, forceCleanupWorktree, listWorktrees, removeAllWorktrees, removeWorktree, safeResetWorktree } from "./worktree.ts";
+import { deleteBranchBestEffort, forceCleanupWorktree, listWorktrees, preserveFailedLaneProgress, removeAllWorktrees, removeWorktree, safeResetWorktree, sleepSync } from "./worktree.ts";
 
 // ── Resume Repo Helpers ──────────────────────────────────────────────
 
@@ -191,20 +193,23 @@ export function collectAllRepoRoots(
  * Check whether a persisted batch state is eligible for resume.
  *
  * Resume eligibility matrix:
- * | Phase     | Eligible? | Reason                                    |
- * |-----------|-----------|-------------------------------------------|
- * | paused    | ✅        | Batch was paused (user/merge-failure)      |
- * | executing | ✅        | Batch was executing when orchestrator died |
- * | merging   | ✅        | Batch was merging when orchestrator died   |
- * | stopped   | ❌        | Batch was stopped by policy                |
- * | failed    | ❌        | Batch has terminal failure                 |
- * | completed | ❌        | Batch already completed                   |
- * | idle      | ❌        | Batch never started execution              |
- * | planning  | ❌        | Batch was still planning                   |
+ * | Phase     | Normal    | --force   | Reason                                    |
+ * |-----------|-----------|-----------|-------------------------------------------|
+ * | paused    | ✅        | ✅        | Batch was paused (user/merge-failure)      |
+ * | executing | ✅        | ✅        | Batch was executing when orchestrator died |
+ * | merging   | ✅        | ✅        | Batch was merging when orchestrator died   |
+ * | stopped   | ❌        | ✅        | Batch was stopped by policy                |
+ * | failed    | ❌        | ✅        | Batch has terminal failure                 |
+ * | completed | ❌        | ❌        | Batch already completed                   |
+ * | idle      | ❌        | ❌        | Batch never started execution              |
+ * | planning  | ❌        | ❌        | Batch was still planning                   |
  *
  * Pure function — no process or filesystem access.
+ *
+ * @param state - Persisted batch state to check
+ * @param force - When true, `stopped` and `failed` phases become eligible
  */
-export function checkResumeEligibility(state: PersistedBatchState): ResumeEligibility {
+export function checkResumeEligibility(state: PersistedBatchState, force: boolean = false): ResumeEligibility {
 	const { phase, batchId } = state;
 
 	switch (phase) {
@@ -233,17 +238,33 @@ export function checkResumeEligibility(state: PersistedBatchState): ResumeEligib
 			};
 
 		case "stopped":
+			if (force) {
+				return {
+					eligible: true,
+					reason: `Batch ${batchId} was stopped by failure policy. Force-resuming (--force).`,
+					phase,
+					batchId,
+				};
+			}
 			return {
 				eligible: false,
-				reason: `Batch ${batchId} was stopped by failure policy. Use /orch-abort to clean up, then start a new batch.`,
+				reason: `Batch ${batchId} was stopped by failure policy. Use --force to resume, or /orch-abort to clean up.`,
 				phase,
 				batchId,
 			};
 
 		case "failed":
+			if (force) {
+				return {
+					eligible: true,
+					reason: `Batch ${batchId} has a terminal failure. Force-resuming (--force).`,
+					phase,
+					batchId,
+				};
+			}
 			return {
 				eligible: false,
-				reason: `Batch ${batchId} has a terminal failure. Use /orch-abort to clean up, then start a new batch.`,
+				reason: `Batch ${batchId} has a terminal failure. Use --force to resume, or /orch-abort to clean up.`,
 				phase,
 				batchId,
 			};
@@ -251,7 +272,7 @@ export function checkResumeEligibility(state: PersistedBatchState): ResumeEligib
 		case "completed":
 			return {
 				eligible: false,
-				reason: `Batch ${batchId} already completed. Delete the state file or start a new batch.`,
+				reason: `Batch ${batchId} already completed. ${force ? "--force cannot resume a completed batch. " : ""}Delete the state file or start a new batch.`,
 				phase,
 				batchId,
 			};
@@ -522,6 +543,127 @@ export function computeResumePoint(
 }
 
 
+// ── Pre-Resume Diagnostics ───────────────────────────────────────────
+
+/**
+ * Result of a single diagnostic check.
+ */
+export interface DiagnosticCheckResult {
+	/** Short label for the check */
+	check: string;
+	/** Whether the check passed */
+	passed: boolean;
+	/** Human-readable detail (reason for failure or confirmation) */
+	detail: string;
+}
+
+/**
+ * Aggregate result of pre-resume diagnostics.
+ */
+export interface PreResumeDiagnosticsResult {
+	/** Whether all checks passed and resume can proceed */
+	passed: boolean;
+	/** Individual check results */
+	checks: DiagnosticCheckResult[];
+	/** Summary message for operator display */
+	summary: string;
+}
+
+/**
+ * Run pre-resume diagnostics before allowing a force-resume.
+ *
+ * Checks performed (per repo in workspace mode):
+ * 1. **State coherence:** batch-state.json exists and is loadable
+ * 2. **Branch consistency:** orch branch exists in each repo
+ * 3. **Worktree health:** persisted lane worktrees are accessible or cleanly absent
+ *
+ * Pure-ish function — reads filesystem/git state but does not mutate anything.
+ *
+ * @param persistedState   - Loaded batch state
+ * @param repoRoot         - Default repo root (cwd)
+ * @param stateRoot        - Root for state files (.pi/)
+ * @param workspaceConfig  - Workspace configuration (null in repo mode)
+ * @returns Diagnostics result with pass/fail and per-check details
+ */
+export function runPreResumeDiagnostics(
+	persistedState: PersistedBatchState,
+	repoRoot: string,
+	stateRoot: string,
+	workspaceConfig?: WorkspaceConfig | null,
+): PreResumeDiagnosticsResult {
+	const checks: DiagnosticCheckResult[] = [];
+
+	// 1. State coherence — verify batch-state.json is well-formed
+	// (Already loaded by caller, so if we get here the state is valid.)
+	checks.push({
+		check: "state-coherence",
+		passed: true,
+		detail: `Batch state loaded successfully (batchId: ${persistedState.batchId}, phase: ${persistedState.phase})`,
+	});
+
+	// 2. Branch consistency — verify orch branch exists in each repo
+	const repoRoots = collectRepoRoots(persistedState, repoRoot, workspaceConfig);
+	for (const root of repoRoots) {
+		const repoId = resolveRepoIdFromRoot(root, workspaceConfig);
+		const label = repoId ? `repo:${repoId}` : "default-repo";
+
+		if (persistedState.orchBranch) {
+			const branchCheck = runGit(["rev-parse", "--verify", `refs/heads/${persistedState.orchBranch}`], root);
+			if (branchCheck.ok) {
+				checks.push({
+					check: `branch-consistency:${label}`,
+					passed: true,
+					detail: `Orch branch "${persistedState.orchBranch}" exists in ${label}`,
+				});
+			} else {
+				checks.push({
+					check: `branch-consistency:${label}`,
+					passed: false,
+					detail: `Orch branch "${persistedState.orchBranch}" not found in ${label}. ` +
+						`The branch may have been deleted or the repo is in an inconsistent state.`,
+				});
+			}
+		}
+	}
+
+	// 3. Worktree health — check each persisted lane worktree
+	for (const lane of persistedState.lanes) {
+		if (!lane.worktreePath) continue;
+
+		const wtExists = existsSync(lane.worktreePath);
+		if (wtExists) {
+			// Verify it's a valid git worktree (has .git file/directory)
+			const gitMarker = join(lane.worktreePath, ".git");
+			const isValidWt = existsSync(gitMarker);
+			checks.push({
+				check: `worktree-health:lane-${lane.laneNumber}`,
+				passed: isValidWt,
+				detail: isValidWt
+					? `Lane ${lane.laneNumber} worktree exists and has valid .git marker`
+					: `Lane ${lane.laneNumber} worktree exists at ${lane.worktreePath} but lacks .git marker (corrupted)`,
+			});
+		} else {
+			// Absent worktree is OK — resume will re-create or skip
+			checks.push({
+				check: `worktree-health:lane-${lane.laneNumber}`,
+				passed: true,
+				detail: `Lane ${lane.laneNumber} worktree absent (will be re-created on resume)`,
+			});
+		}
+	}
+
+	const failed = checks.filter(c => !c.passed);
+	const passed = failed.length === 0;
+
+	const summary = passed
+		? `✅ Pre-resume diagnostics passed (${checks.length} checks)`
+		: `❌ Pre-resume diagnostics failed (${failed.length}/${checks.length} checks failed):\n` +
+		  failed.map(c => `   • ${c.check}: ${c.detail}`).join("\n");
+
+	return { passed, checks, summary };
+}
+
+
 export async function resumeOrchBatch(
 	orchConfig: OrchestratorConfig,
 	runnerConfig: TaskRunnerConfig,
@@ -532,6 +674,7 @@ export async function resumeOrchBatch(
 	workspaceConfig?: WorkspaceConfig | null,
 	workspaceRoot?: string,
 	agentRoot?: string,
+	force: boolean = false,
 ): Promise<void> {
 	const repoRoot = cwd;
 	// State files (.pi/batch-state.json, lane-state, etc.) belong in the workspace root,
@@ -563,7 +706,7 @@ export async function resumeOrchBatch(
 	}
 
 	// ── 2. Check eligibility ─────────────────────────────────────
-	const eligibility = checkResumeEligibility(persistedState);
+	const eligibility = checkResumeEligibility(persistedState, force);
 	if (!eligibility.eligible) {
 		onNotify(
 			ORCH_MESSAGES.resumePhaseNotResumable(persistedState.batchId, persistedState.phase, eligibility.reason),
@@ -572,6 +715,37 @@ export async function resumeOrchBatch(
 		return;
 	}
 
+	// ── 2b. Force-resume: pre-resume diagnostics & state mutation ──
+	const isForceResume = force && (persistedState.phase === "stopped" || persistedState.phase === "failed");
+	if (isForceResume) {
+		onNotify(
+			ORCH_MESSAGES.forceResumeStarting(persistedState.batchId, persistedState.phase),
+			"warning",
+		);
+
+		// Run pre-resume diagnostics before allowing force-resume
+		const diagnostics = runPreResumeDiagnostics(persistedState, repoRoot, stateRoot, workspaceConfig);
+		onNotify(diagnostics.summary, diagnostics.passed ? "info" : "error");
+
+		if (!diagnostics.passed) {
+			onNotify(
+				ORCH_MESSAGES.forceResumeDiagnosticsFailed(persistedState.batchId),
+				"error",
+			);
+			return;
+		}
+
+		// Record force intent in resilience state
+		persistedState.resilience.resumeForced = true;
+
+		// Reset phase to paused so normal resume flow can proceed
+		execLog("resume", persistedState.batchId, `force-resume: phase ${persistedState.phase} → paused`, {
+			diagnosticChecks: diagnostics.checks.length,
+			diagnosticsPassed: diagnostics.passed,
+		});
+		persistedState.phase = "paused";
+	}
+
 	onNotify(
 		ORCH_MESSAGES.resumeStarting(persistedState.batchId, persistedState.phase),
 		"info",
@@ -702,6 +876,14 @@ export async function resumeOrchBatch(
 	batchState.currentWaveIndex = resumePoint.resumeWaveIndex;
 	batchState.waveResults = [];
 
+	// v3: Carry forward resilience and diagnostics from persisted state
+	batchState.resilience = persistedState.resilience;
+	batchState.diagnostics = persistedState.diagnostics;
+	// Carry forward unknown fields for roundtrip preservation
+	if (persistedState._extraFields) {
+		batchState._extraFields = persistedState._extraFields;
+	}
+
 	// ── 7. Re-run discovery for ParsedTask metadata ──────────────
 	// We need fresh ParsedTask data (taskFolder, promptPath) for execution.
 	// Use "all" to discover all areas.
@@ -953,6 +1135,7 @@ export async function resumeOrchBatch(
 				workspaceConfig,
 				stateRoot,
 				agentRoot,
+				runnerConfig.testing_commands,
 			);
 
 			if (reExecMergeResult.status === "succeeded") {
@@ -962,8 +1145,9 @@ export async function resumeOrchBatch(
 				);
 
 				// Clean up merged branches (resolve per-lane repo root for workspace mode)
+				// TP-032 R006-3: Exclude verification_new_failure lanes from branch cleanup
 				for (const lr of reExecMergeResult.laneResults) {
-					if (lr.result?.status === "SUCCESS" || lr.result?.status === "CONFLICT_RESOLVED") {
+					if (!lr.error && (lr.result?.status === "SUCCESS" || lr.result?.status === "CONFLICT_RESOLVED")) {
 						const laneRepoRoot = resolveRepoRoot(lr.repoId, repoRoot, workspaceConfig);
 						deleteBranchBestEffort(lr.sourceBranch, laneRepoRoot);
 					}
@@ -1024,6 +1208,11 @@ export async function resumeOrchBatch(
 				: persistedTask?.exitReason ?? "",
 			sessionName: persistedTask?.sessionName ?? "",
 			doneFileFound: status === "succeeded" ? true : task.doneFileFound,
+			// Carry forward partial progress from persisted state (TP-028)
+			partialProgressCommits: persistedTask?.partialProgressCommits,
+			partialProgressBranch: persistedTask?.partialProgressBranch,
+			// v3: Carry forward exit diagnostic from persisted state (TP-030)
+			exitDiagnostic: persistedTask?.exitDiagnostic,
 		});
 	}
 
@@ -1232,20 +1421,23 @@ export async function resumeOrchBatch(
 					workspaceConfig,
 					stateRoot,
 					agentRoot,
+					runnerConfig.testing_commands,
 				);
 				batchState.mergeResults.push(mergeResult);
 
 				// Emit per-lane merge notifications
 				for (const lr of mergeResult.laneResults) {
 					const durationSec = Math.round(lr.durationMs / 1000);
-					if (lr.result?.status === "SUCCESS") {
+					// TP-032 R006-3: Check lr.error first — verification_new_failure lanes
+					// have error set even though lr.result.status may be SUCCESS/CONFLICT_RESOLVED.
+					if (lr.error) {
+						onNotify(ORCH_MESSAGES.orchMergeLaneFailed(lr.laneNumber, lr.error), "error");
+					} else if (lr.result?.status === "SUCCESS") {
 						onNotify(ORCH_MESSAGES.orchMergeLaneSuccess(lr.laneNumber, lr.result.merge_commit, durationSec), "info");
 					} else if (lr.result?.status === "CONFLICT_RESOLVED") {
 						onNotify(ORCH_MESSAGES.orchMergeLaneConflictResolved(lr.laneNumber, lr.result.conflicts.length, durationSec), "info");
 					} else if (lr.result?.status === "CONFLICT_UNRESOLVED" || lr.result?.status === "BUILD_FAILURE") {
-						onNotify(ORCH_MESSAGES.orchMergeLaneFailed(lr.laneNumber, lr.error || lr.result.status), "error");
-					} else if (lr.error) {
-						onNotify(ORCH_MESSAGES.orchMergeLaneFailed(lr.laneNumber, lr.error), "error");
+						onNotify(ORCH_MESSAGES.orchMergeLaneFailed(lr.laneNumber, lr.result.status), "error");
 					}
 				}
 
@@ -1257,8 +1449,9 @@ export async function resumeOrchBatch(
 					mergeResult = { ...mergeResult, status: "partial", failedLane: mixedOutcomeLanes[0].laneNumber, failureReason };
 				}
 
+				// TP-032 R006-3: Exclude verification_new_failure lanes from success count
 				const mergedCount = mergeResult.laneResults.filter(
-					r => r.result?.status === "SUCCESS" || r.result?.status === "CONFLICT_RESOLVED",
+					r => !r.error && (r.result?.status === "SUCCESS" || r.result?.status === "CONFLICT_RESOLVED"),
 				).length;
 				const mergeTotalSec = Math.round(mergeResult.totalDurationMs / 1000);
 
@@ -1304,24 +1497,139 @@ export async function resumeOrchBatch(
 			onNotify(ORCH_MESSAGES.orchMergeSkipped(waveIdx + 1), "info");
 		}
 
-		// Handle merge failure — shared helper guarantees parity with engine.ts (TP-005 Step 2)
-		if (mergeResult && (mergeResult.status === "failed" || mergeResult.status === "partial")) {
-			const policyResult = computeMergeFailurePolicy(mergeResult, waveIdx, orchConfig);
-
-			execLog("batch", batchState.batchId, `merge failure — applying ${policyResult.policy} policy`, policyResult.logDetails);
+		// ── TP-033: Safe-stop on rollback failure ─────────────────
+		// When a verification rollback failed, force paused regardless of
+		// on_merge_failure policy. The merge worktree and temp branch are
+		// preserved for manual recovery using commands in the transaction record.
+		if (mergeResult?.rollbackFailed) {
+			// TP-033 R004-2: Include persistence error warning when transaction
+			// record files may be missing, so operator knows to inspect manually
+			const hasPersistErrors = mergeResult.persistenceErrors && mergeResult.persistenceErrors.length > 0;
+			const persistWarning = hasPersistErrors
+				? ` WARNING: ${mergeResult.persistenceErrors!.length} transaction record(s) failed to persist — recovery file(s) may be missing.`
+				: "";
+
+			execLog("batch", batchState.batchId, "SAFE-STOP: verification rollback failed — forcing paused regardless of policy", {
+				waveIndex: waveIdx,
+				configPolicy: orchConfig.failure.on_merge_failure,
+				...(hasPersistErrors ? { persistenceErrors: mergeResult.persistenceErrors } : {}),
+			});
 
-			batchState.phase = policyResult.targetPhase;
-			batchState.errors.push(policyResult.errorMessage);
-			persistRuntimeState(policyResult.persistTrigger, batchState, wavePlan, latestAllocatedLanes, allTaskOutcomes, discovery, stateRoot);
-			onNotify(policyResult.notifyMessage, policyResult.notifyLevel);
+			batchState.phase = "paused";
+			batchState.errors.push(
+				`Safe-stop at wave ${waveIdx + 1}: verification rollback failed. ` +
+				`Merge worktree and temp branch preserved for recovery. ` +
+				`Check transaction records in .pi/verification/ for recovery commands.` +
+				persistWarning
+			);
+			persistRuntimeState("merge-rollback-safe-stop", batchState, wavePlan, latestAllocatedLanes, allTaskOutcomes, discovery, stateRoot);
+			onNotify(
+				`🛑 Safe-stop: verification rollback failed at wave ${waveIdx + 1}. ` +
+				`Batch force-paused. Merge worktree preserved for manual recovery. ` +
+				`See .pi/verification/ transaction records for recovery commands.` +
+				persistWarning,
+				"error",
+			);
 			preserveWorktreesForResume = true;
 			break;
 		}
 
+		// Handle merge failure — TP-033 Step 2 (R006): Retry policy matrix via shared applyMergeRetryLoop.
+		// Uses the same centralized loop as engine.ts for guaranteed parity.
+		if (mergeResult && (mergeResult.status === "failed" || mergeResult.status === "partial")) {
+			// Initialize resilience state if not yet present
+			if (!batchState.resilience) {
+				batchState.resilience = defaultResilienceState();
+			}
+
+			const retryOutcome = applyMergeRetryLoop(
+				mergeResult,
+				waveIdx,
+				batchState.resilience.retryCountByScope,
+				{
+					performMerge: () => {
+						batchState.phase = "merging";
+						return mergeWaveByRepo(
+							waveResult.allocatedLanes,
+							waveResult,
+							waveIdx + 1,
+							orchConfig,
+							repoRoot,
+							batchState.batchId,
+							batchState.orchBranch,
+							workspaceConfig,
+							stateRoot,
+							agentRoot,
+							runnerConfig.testing_commands,
+						);
+					},
+					persist: (trigger) => persistRuntimeState(trigger, batchState, wavePlan, latestAllocatedLanes, allTaskOutcomes, discovery, stateRoot),
+					log: (message, details) => execLog("batch", batchState.batchId, message, details),
+					notify: (message, level) => onNotify(message, level),
+					updateMergeResult: (result) => {
+						mergeResult = result;
+						batchState.mergeResults[batchState.mergeResults.length - 1] = result;
+					},
+					sleep: sleepSync,
+				},
+			);
+
+			if (retryOutcome.kind === "retry_succeeded") {
+				mergeResult = retryOutcome.mergeResult;
+				batchState.phase = "executing";
+				persistRuntimeState("merge-retry-succeeded", batchState, wavePlan, latestAllocatedLanes, allTaskOutcomes, discovery, stateRoot);
+				// Fall through to normal post-merge flow
+			} else if (retryOutcome.kind === "safe_stop") {
+				mergeResult = retryOutcome.mergeResult;
+				batchState.phase = "paused";
+				batchState.errors.push(retryOutcome.errorMessage);
+				persistRuntimeState("merge-rollback-safe-stop", batchState, wavePlan, latestAllocatedLanes, allTaskOutcomes, discovery, stateRoot);
+				onNotify(retryOutcome.notifyMessage, "error");
+				preserveWorktreesForResume = true;
+				break;
+			} else if (retryOutcome.kind === "exhausted") {
+				// TP-033 R006-2: Force paused regardless of on_merge_failure config.
+				mergeResult = retryOutcome.mergeResult;
+				const exhaustionMsg = retryOutcome.errorMessage +
+					` [${retryOutcome.classification ?? "unknown"} ${retryOutcome.lastDecision.currentAttempt}/${retryOutcome.lastDecision.maxAttempts}, scope=${retryOutcome.scopeKey}]`;
+
+				execLog("batch", batchState.batchId, `merge retry exhausted — forcing paused`, {
+					classification: retryOutcome.classification,
+					scopeKey: retryOutcome.scopeKey,
+					attempts: retryOutcome.lastDecision.currentAttempt,
+					maxAttempts: retryOutcome.lastDecision.maxAttempts,
+				});
+
+				batchState.phase = "paused";
+				batchState.errors.push(exhaustionMsg);
+				persistRuntimeState("merge-retry-exhausted", batchState, wavePlan, latestAllocatedLanes, allTaskOutcomes, discovery, stateRoot);
+				onNotify(retryOutcome.notifyMessage, "error");
+				preserveWorktreesForResume = true;
+				break;
+			} else {
+				// kind === "no_retry": fall through to standard on_merge_failure policy
+				mergeResult = retryOutcome.mergeResult;
+				const policyResult = computeMergeFailurePolicy(mergeResult, waveIdx, orchConfig);
+				const classNote = retryOutcome.classification
+					? ` [not retriable: ${retryOutcome.classification}, scope=${retryOutcome.scopeKey}]`
+					: "";
+
+				execLog("batch", batchState.batchId, `merge failure — applying ${policyResult.policy} policy${classNote}`, policyResult.logDetails);
+
+				batchState.phase = policyResult.targetPhase;
+				batchState.errors.push(policyResult.errorMessage + classNote);
+				persistRuntimeState(policyResult.persistTrigger, batchState, wavePlan, latestAllocatedLanes, allTaskOutcomes, discovery, stateRoot);
+				onNotify(policyResult.notifyMessage + classNote, policyResult.notifyLevel);
+				preserveWorktreesForResume = true;
+				break;
+			}
+		}
+
 		// Post-merge: reset worktrees for next wave
+		// TP-032 R006-3: Exclude verification_new_failure lanes from branch cleanup
 		if (mergeResult && mergeResult.status === "succeeded") {
 			for (const lr of mergeResult.laneResults) {
-				if (lr.result?.status === "SUCCESS" || lr.result?.status === "CONFLICT_RESOLVED") {
+				if (!lr.error && (lr.result?.status === "SUCCESS" || lr.result?.status === "CONFLICT_RESOLVED")) {
 					const laneRepoRoot = resolveRepoRoot(lr.repoId, repoRoot, workspaceConfig);
 					const ancestorCheck = runGit(["merge-base", "--is-ancestor", lr.sourceBranch, lr.targetBranch], laneRepoRoot);
 					if (ancestorCheck.ok) {
@@ -1331,9 +1639,58 @@ export async function resumeOrchBatch(
 			}
 		}
 
+		// ── TP-028: Preserve partial progress before inter-wave reset ──
+		// Hoisted outside the if-block so unsafeBranches is accessible to the
+		// reset loop below — both blocks share the same guard condition.
+		let ppUnsafeBranches = new Set<string>();
+		if (waveIdx < persistedState.wavePlan.length - 1 && !batchState.pauseSignal.paused) {
+			const ppOpId = resolveOperatorId(orchConfig);
+			const ppResult = preserveFailedLaneProgress(
+				latestAllocatedLanes,
+				allTaskOutcomes,
+				ppOpId,
+				batchState.batchId,
+				(repoId) => {
+					const perRepoRoot = resolveRepoRoot(repoId, repoRoot, workspaceConfig);
+					let targetBranch = batchState.orchBranch;
+					if (repoId && perRepoRoot !== repoRoot) {
+						try {
+							targetBranch = resolveBaseBranch(repoId, perRepoRoot, batchState.orchBranch, workspaceConfig);
+						} catch { /* fall back to orchBranch */ }
+					}
+					return { repoRoot: perRepoRoot, targetBranch };
+				},
+			);
+			ppUnsafeBranches = ppResult.unsafeBranches;
+			if (ppResult.results.some(r => r.saved)) {
+				execLog("batch", batchState.batchId,
+					`preserved partial progress for ${ppResult.results.filter(r => r.saved).length} failed task(s) before inter-wave reset`);
+			}
+			// Log per-task warnings for failed preservation attempts
+			for (const r of ppResult.results) {
+				if (!r.saved && (r.commitCount > 0 || r.error)) {
+					execLog("batch", batchState.batchId,
+						`WARNING: Failed to preserve partial progress for task ${r.taskId} ` +
+						`(${r.commitCount} commit(s) at risk on lane branch)`,
+						{ taskId: r.taskId, commitCount: r.commitCount, error: r.error ?? "unknown" });
+				}
+			}
+			if (ppUnsafeBranches.size > 0) {
+				execLog("batch", batchState.batchId,
+					`WARNING: ${ppUnsafeBranches.size} lane branch(es) could not be preserved — skipping reset for those lanes to prevent commit loss`,
+					{ unsafeBranches: [...ppUnsafeBranches] });
+			}
+			// TP-028: Stamp task outcomes with partial progress data for persistence
+			applyPartialProgressToOutcomes(ppResult, allTaskOutcomes);
+		}
+
 		if (waveIdx < persistedState.wavePlan.length - 1 && !batchState.pauseSignal.paused) {
 			const wtPrefix = orchConfig.orchestrator.worktree_prefix;
 			const resetOpId = resolveOperatorId(orchConfig);
+			// TP-029 R006: Track worktrees that failed reset AND removal
+			// so the cleanup gate only fires on true stale state, not
+			// successfully-reset reusable worktrees. (Parity with engine.ts)
+			const failedRemovalWorktrees = new Map<string, { repoId: string | undefined; paths: string[] }>();
 
 			// Use encounteredRepoRoots which includes both persisted lanes
 			// AND newly allocated lanes from resumed waves, ensuring repos
@@ -1357,21 +1714,124 @@ export async function resumeOrchBatch(
 						}
 					}
 					for (const wt of existingWorktrees) {
+						// TP-028: Skip reset for worktrees whose lane branch has
+						// unsaved partial progress (preservation failed with commits)
+						if (ppUnsafeBranches.has(wt.branch)) {
+							execLog("batch", batchState.batchId,
+								`skipping worktree reset for lane ${wt.laneNumber} — branch "${wt.branch}" has unsaved partial progress`,
+								{ path: wt.path, branch: wt.branch });
+							continue;
+						}
+
 						const resetResult = safeResetWorktree(wt, targetBranch, perRepoRoot);
 						if (!resetResult.success) {
 							try {
 								removeWorktree(wt, perRepoRoot);
 							} catch {
 								forceCleanupWorktree(wt, perRepoRoot, batchState.batchId);
+								// Track this worktree for the cleanup gate — it may still be registered
+								const perRepoId = perRepoRoot === repoRoot
+									? undefined
+									: resolveRepoIdFromRoot(perRepoRoot, workspaceConfig);
+								if (!failedRemovalWorktrees.has(perRepoRoot)) {
+									failedRemovalWorktrees.set(perRepoRoot, { repoId: perRepoId, paths: [] });
+								}
+								failedRemovalWorktrees.get(perRepoRoot)!.paths.push(wt.path);
 							}
 						}
 					}
 				}
 			}
+
+			// ── TP-029: Post-merge cleanup gate (parity with engine.ts) ──
+			// Only gate on worktrees that the reset loop tried and failed
+			// to remove. Successfully-reset reusable worktrees are expected
+			// to remain registered — they will be reused in the next wave.
+			// For each failed-removal worktree, verify it is still registered
+			// before classifying it as truly stale.
+			const cleanupGateFailures: CleanupGateRepoFailure[] = [];
+			if (failedRemovalWorktrees.size > 0) {
+				for (const [perRepoRoot, { repoId: perRepoId, paths: failedPaths }] of failedRemovalWorktrees) {
+					const remaining = listWorktrees(wtPrefix, perRepoRoot, resetOpId, batchState.batchId);
+					const remainingPaths = new Set(remaining.map(wt => wt.path));
+					// Only report worktrees that were targeted for removal but are still registered
+					const stale = failedPaths.filter(p => remainingPaths.has(p));
+					if (stale.length > 0) {
+						cleanupGateFailures.push({
+							repoRoot: perRepoRoot,
+							repoId: perRepoId,
+							staleWorktrees: stale,
+						});
+					}
+				}
+			}
+
+			if (cleanupGateFailures.length > 0) {
+				const gatePolicyResult = computeCleanupGatePolicy(waveIdx, cleanupGateFailures);
+
+				execLog("batch", batchState.batchId, `cleanup gate failed — pausing batch`, gatePolicyResult.logDetails);
+
+				batchState.phase = gatePolicyResult.targetPhase;
+				batchState.errors.push(gatePolicyResult.errorMessage);
+				persistRuntimeState(gatePolicyResult.persistTrigger, batchState, wavePlan, latestAllocatedLanes, allTaskOutcomes, discovery, stateRoot);
+				onNotify(gatePolicyResult.notifyMessage, gatePolicyResult.notifyLevel);
+				preserveWorktreesForResume = true;
+				break;
+			}
 		}
 	}
 
+	// ── Pre-cleanup: Determine if worktrees should be preserved ──
+	// TP-031 (R006): Parity with engine.ts — this check MUST run before cleanup
+	// so that worktrees survive when failedTasks > 0. Without this, cleanup
+	// deletes worktrees before the batch is marked "paused", breaking resumability.
+	if (!preserveWorktreesForResume &&
+		((batchState.phase as OrchBatchPhase) === "executing" || (batchState.phase as OrchBatchPhase) === "merging") &&
+		batchState.failedTasks > 0) {
+		preserveWorktreesForResume = true;
+		execLog("resume", batchState.batchId, "pre-cleanup: failedTasks > 0 detected, preserving worktrees for resume");
+	}
+
 	// ── 11. Cleanup and terminal state ───────────────────────────
+
+	// ── TP-028: Preserve partial progress before terminal cleanup ──
+	if (!preserveWorktreesForResume) {
+		const ppOpId = resolveOperatorId(orchConfig);
+		const ppResult = preserveFailedLaneProgress(
+			latestAllocatedLanes,
+			allTaskOutcomes,
+			ppOpId,
+			batchState.batchId,
+			(repoId) => {
+				const perRepoRoot = resolveRepoRoot(repoId, repoRoot, workspaceConfig);
+				let targetBranch = batchState.orchBranch;
+				if (repoId && perRepoRoot !== repoRoot) {
+					try {
+						targetBranch = resolveBaseBranch(repoId, perRepoRoot, batchState.orchBranch, workspaceConfig);
+					} catch { /* fall back to orchBranch */ }
+				}
+				return { repoRoot: perRepoRoot, targetBranch };
+			},
+		);
+		if (ppResult.results.some(r => r.saved)) {
+			execLog("batch", batchState.batchId,
+				`preserved partial progress for ${ppResult.results.filter(r => r.saved).length} failed task(s) before terminal cleanup`);
+		}
+		// Log warnings for failed preservation attempts — at terminal cleanup
+		// we cannot skip deletion (batch is ending), but operators need to know
+		// that commits may become unreachable via reflog only.
+		for (const r of ppResult.results) {
+			if (!r.saved && (r.commitCount > 0 || r.error)) {
+				execLog("batch", batchState.batchId,
+					`WARNING: Failed to preserve partial progress for task ${r.taskId} ` +
+					`(${r.commitCount} commit(s) may become unreachable after cleanup)`,
+					{ taskId: r.taskId, commitCount: r.commitCount, error: r.error ?? "unknown" });
+			}
+		}
+		// TP-028: Stamp task outcomes with partial progress data for persistence
+		applyPartialProgressToOutcomes(ppResult, allTaskOutcomes);
+	}
+
 	if (!preserveWorktreesForResume) {
 		const wtPrefix = orchConfig.orchestrator.worktree_prefix;
 		const cleanupOpId = resolveOperatorId(orchConfig);
@@ -1416,7 +1876,12 @@ export async function resumeOrchBatch(
 
 	if ((batchState.phase as OrchBatchPhase) === "executing" || (batchState.phase as OrchBatchPhase) === "merging") {
 		if (batchState.failedTasks > 0) {
-			batchState.phase = "failed";
+			// TP-031: Parity with engine.ts — default to "paused" so the batch is
+			// resumable without --force. "failed" is reserved for unrecoverable
+			// invariant violations after retry exhaustion.
+			// NOTE: preserveWorktreesForResume was already set pre-cleanup to ensure
+			// worktrees survive; this just sets the phase for state persistence.
+			batchState.phase = "paused";
 		} else {
 			batchState.phase = "completed";
 		}
@@ -1450,6 +1915,10 @@ export async function resumeOrchBatch(
 
 	persistRuntimeState("batch-terminal", batchState, wavePlan, latestAllocatedLanes, allTaskOutcomes, discovery, stateRoot);
 
+	// ── TP-031: Emit diagnostic reports (JSONL + markdown) ──
+	// Non-fatal: errors are logged but never crash batch finalization.
+	emitDiagnosticReports(assembleDiagnosticInput(orchConfig, batchState, wavePlan, latestAllocatedLanes, allTaskOutcomes, stateRoot));
+
 	if (batchState.phase === "paused" || batchState.phase === "stopped") {
 		execLog("resume", batchState.batchId, "resumed batch ended in non-terminal state", { phase: batchState.phase });
 	} else {