fix(worker): route FinalizeParentDoneAsync through TaskStateService

Replaces the direct EF Status write in PlanningMergeOrchestrator with
_state.ApproveReviewAsync, enforcing the TaskStateService invariant as
sole owner of Status writes. Handles the improvement-parent path where
TaskMergeService already approved the parent's own worktree during the
drain (status == Done on entry → still success). If the parent was
concurrently cancelled, the transition guard rejects the approve,
PlanningCompleted is not broadcast, and the cancelled status is
preserved. ApproveReviewAsync now also sets FinishedAt.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/ClaudeDo.Worker.Tests/Planning/PlanningMergeOrchestratorTests.cs

@@ -101,7 +101,7 @@ public sealed class PlanningMergeOrchestratorTests : IDisposable
         ctx.Tasks.Add(new TaskEntity
         {
             Id = parentId, ListId = listId, Title = "plan", CreatedAt = DateTime.UtcNow,
-            Status = TaskStatus.Idle, PlanningPhase = PlanningPhase.Finalized, SortOrder = 0,
+            Status = TaskStatus.WaitingForReview, PlanningPhase = PlanningPhase.Finalized, SortOrder = 0,
         });
 
         var subA = Guid.NewGuid().ToString();
@@ -169,7 +169,7 @@ public sealed class PlanningMergeOrchestratorTests : IDisposable
         ctx.Tasks.Add(new TaskEntity
         {
             Id = parentId, ListId = listId, Title = "plan", CreatedAt = DateTime.UtcNow,
-            Status = TaskStatus.Idle, PlanningPhase = PlanningPhase.Finalized, SortOrder = 0,
+            Status = TaskStatus.WaitingForReview, PlanningPhase = PlanningPhase.Finalized, SortOrder = 0,
         });
         var subA = Guid.NewGuid().ToString();
         var subB = Guid.NewGuid().ToString();
@@ -252,15 +252,17 @@ public sealed class PlanningMergeOrchestratorTests : IDisposable
         var broadcaster = new HubBroadcaster(fakeHub);
         var git = new GitService();
         var factory = db.CreateFactory();
+        var built = TaskStateServiceBuilder.Build(factory);
         var merge = new TaskMergeService(
             factory, git, broadcaster,
-            TaskStateServiceBuilder.Build(factory).State,
+            built.State,
             NullLogger<TaskMergeService>.Instance);
         var aggregator = new PlanningAggregator(
             factory, git,
             NullLogger<PlanningAggregator>.Instance);
         var orch = new PlanningMergeOrchestrator(
             factory, merge, aggregator, broadcaster, git,
+            built.State,
             NullLogger<PlanningMergeOrchestrator>.Instance);
         return (orch, spy.Calls);
     }
@@ -426,4 +428,72 @@ public sealed class PlanningMergeOrchestratorTests : IDisposable
 
         return (parentId, subA, subB);
     }
+
+    /// <summary>
+    /// Parent is Cancelled before the orchestrator finalizes (simulates a race where the user
+    /// cancels the parent while the merge drain is in progress). After the drain completes,
+    /// ApproveReviewAsync sees Status != WaitingForReview and refuses — parent must stay
+    /// Cancelled and PlanningCompleted must not be broadcast.
+    /// </summary>
+    [Fact]
+    public async Task StartAsync_ParentCancelledBeforeFinalize_StatusRemainsAndNoPlanningCompleted()
+    {
+        var db = NewDb();
+        var repo = NewRepo();
+        GitRepoFixture.RunGit(repo.RepoDir, "branch", "-m", "main");
+
+        // Improvement parent (PlanningPhase.None) seeded as Cancelled — simulates the race
+        // where a user or another thread cancelled the parent during the merge drain.
+        var (parentId, subA, subB) = await SeedCancelledParentWithDoneChildrenAsync(db, repo);
+
+        var (orch, calls) = BuildOrchestrator(db);
+        await orch.StartAsync(parentId, "main", CancellationToken.None);
+
+        using var ctx = db.CreateContext();
+        Assert.Equal(TaskStatus.Cancelled, ctx.Tasks.Single(t => t.Id == parentId).Status);
+        Assert.DoesNotContain(calls, c => c.Method == "PlanningCompleted");
+        // Child worktrees were still merged during the drain
+        Assert.Equal(WorktreeState.Merged, ctx.Worktrees.Single(w => w.TaskId == subA).State);
+        Assert.Equal(WorktreeState.Merged, ctx.Worktrees.Single(w => w.TaskId == subB).State);
+    }
+
+    private async Task<(string parentId, string subA, string subB)> SeedCancelledParentWithDoneChildrenAsync(
+        DbFixture db, GitRepoFixture repo)
+    {
+        using var ctx = db.CreateContext();
+
+        var listId = Guid.NewGuid().ToString();
+        ctx.Lists.Add(new ListEntity
+        {
+            Id = listId, Name = "test", CreatedAt = DateTime.UtcNow,
+            WorkingDir = repo.RepoDir,
+        });
+
+        var parentId = Guid.NewGuid().ToString();
+        ctx.Tasks.Add(new TaskEntity
+        {
+            Id = parentId, ListId = listId, Title = "improve", CreatedAt = DateTime.UtcNow,
+            Status = TaskStatus.Cancelled, PlanningPhase = PlanningPhase.None, SortOrder = 0,
+        });
+
+        var subA = Guid.NewGuid().ToString();
+        var subB = Guid.NewGuid().ToString();
+        ctx.Tasks.Add(new TaskEntity
+        {
+            Id = subA, ListId = listId, Title = "child A", CreatedAt = DateTime.UtcNow,
+            ParentTaskId = parentId, Status = TaskStatus.Done, SortOrder = 1,
+        });
+        ctx.Tasks.Add(new TaskEntity
+        {
+            Id = subB, ListId = listId, Title = "child B", CreatedAt = DateTime.UtcNow,
+            ParentTaskId = parentId, Status = TaskStatus.Done, SortOrder = 2,
+        });
+        await ctx.SaveChangesAsync();
+
+        SeedWorktree(ctx, repo, subA, "fileA.txt", "content A");
+        SeedWorktree(ctx, repo, subB, "fileB.txt", "content B");
+        await ctx.SaveChangesAsync();
+
+        return (parentId, subA, subB);
+    }
 }