feat(worker): record merge commit SHA and add revert_merge tool

Persists the merge commit SHA on WorktreeEntity for every successful
single-task and unit merge, and adds a TaskMergeService.RevertMergeAsync
+ revert_merge MCP tool that undoes a merged task's merge via
`git revert -m 1` (never reset/rewrite, since the target checkout is
shared). Rejects cleanly when there's no recorded SHA, the repo is
mid-merge/mid-revert, or the target has foreign uncommitted changes;
a conflicting revert aborts immediately. Also exposes the new
mergeCommit field via get_task_worktree.

src/ClaudeDo.Worker/CLAUDE.md

@@ -34,7 +34,7 @@ Interfaces (e.g. `IQueueWaker`, `IPrimeClock`, `ITaskStateService`) live in an `
 - **OverrideSlotService** — owns `RunNow` / `ContinueTask`; goes through `TaskStateService.StartRunningAsync` (caller-driven, serialized by slot lock).
 - **StaleTaskRecovery** — startup-only service; calls `TaskStateService.RecoverStaleRunningAsync` to flip orphaned `Running` rows to `Failed`.
 - **External/*** — always-on MCP tools for general Claude sessions, scoped to *starting* and *observing* sessions (no worktree/merge, multi-turn, planning, or app-settings writes). Auth via optional `X-ClaudeDo-Key` header. Registered explicitly in `Program.cs`'s external app via `.WithTools<T>()`. Every optional/filter parameter across these tools must carry a C# default value (e.g. `string? status = null`) — the MCP schema only marks a parameter optional when it has one; nullability alone doesn't do it (`ExternalMcpToolSchemaTests` guards this by reflection). `ExternalMcpExceptionFilter.Wrap` is registered as a call-tool filter so `InvalidOperationException`/`ArgumentException` messages survive as `McpException` — otherwise the SDK's own catch-all replaces any non-`McpException` with a generic "An error occurred invoking 'X'." **No external tool returns bare `Task` or a nullable payload directly** — an MCP client can't tell an empty/omitted response apart from a dropped one. Write tools return a small confirmation record (`{ ok/deleted/removed/reset/started: true, <id>, ... }`, e.g. `DeleteListResult`, `RunTaskNowResult`, `ResetFailedTaskResult`, `RemoveAttachmentResult`; `SetListConfigResult`/`SetTaskConfigResult` additionally echo the resulting config so the caller can see which fields were set vs. cleared to null); read tools that may have nothing to return use an explicit `Found`/`Available` flag alongside the nullable payload (`TaskConfigResult`, pre-existing `BatchGetTaskResult`, `TaskLogResult`) instead of returning null outright. Organized by concern:
-  - `ExternalMcpService` — task CRUD + execution: `ListTaskLists`, `ListTasks`, `GetTask`, `AddTask`, `AddSubtask`, `UpdateTask`, `UpdateTaskStatus` (`Idle` / `Queued` / `Cancelled` / `Done` — `Cancelled` goes through `TaskStateService.CancelAsync(..., allowFromIdle: true)`, the only caller that opts into cancelling from `Idle`; `PlanningChainCoordinator` relies on `Idle` staying a no-op there by default, since a child parked back to `Idle` mid-chain is a manual opt-out signal; `Done` goes through `TaskStateService.ForceSetStatusAsync` — same unconditional write the UI's "set status freely" affordance uses — but is refused here with an active-worktree task, since that would skip `review_task`'s merge), `GetTaskStatusValues`, `ReviewTask` (`approve` / `reject_rerun` / `reject_park` / `cancel` for a WaitingForReview task; approve is review+merge exactly like the hub's `ApproveReview` — unit merge for parents, worktree merge into optional `targetBranch` for childless tasks, conflicts reported in the `ReviewTaskResult`), `RunTaskNow`, `ContinueTask`, `CancelTask`, `DeleteTask`; worktree/git: `GetTaskWorktree`, `GetTaskDiff`, `MergeTask`, `ListWorktrees`, `CleanupTaskWorktree`
+  - `ExternalMcpService` — task CRUD + execution: `ListTaskLists`, `ListTasks`, `GetTask`, `AddTask`, `AddSubtask`, `UpdateTask`, `UpdateTaskStatus` (`Idle` / `Queued` / `Cancelled` / `Done` — `Cancelled` goes through `TaskStateService.CancelAsync(..., allowFromIdle: true)`, the only caller that opts into cancelling from `Idle`; `PlanningChainCoordinator` relies on `Idle` staying a no-op there by default, since a child parked back to `Idle` mid-chain is a manual opt-out signal; `Done` goes through `TaskStateService.ForceSetStatusAsync` — same unconditional write the UI's "set status freely" affordance uses — but is refused here with an active-worktree task, since that would skip `review_task`'s merge), `GetTaskStatusValues`, `ReviewTask` (`approve` / `reject_rerun` / `reject_park` / `cancel` for a WaitingForReview task; approve is review+merge exactly like the hub's `ApproveReview` — unit merge for parents, worktree merge into optional `targetBranch` for childless tasks, conflicts reported in the `ReviewTaskResult`), `RunTaskNow`, `ContinueTask`, `CancelTask`, `DeleteTask`; worktree/git: `GetTaskWorktree`, `GetTaskDiff`, `MergeTask`, `ContinueMerge`, `AbortMerge`, `RevertMerge` (undoes a previously merged task's merge commit on `targetBranch` via `git revert -m 1` — a new commit, never a reset/rewrite, since the target working directory is shared with other sessions; requires the task to be `Done` with a `Merged` worktree carrying a recorded `WorktreeEntity.MergeCommit` — a task merged before that field existed has none and is refused rather than guessed via `git log`; on success the task returns to `WaitingForReview` and the worktree moves to `Kept`, not `Active` (its directory/branch are typically already gone from the original merge's cleanup) and not `Merged`/`Discarded` (`WorktreeMaintenanceService` sweeps those); a conflicting revert is aborted immediately, no half-resolved state is ever left in the tree), `ListWorktrees`, `CleanupTaskWorktree`
   - `BatchMcpTools` — best-effort batch variants that loop the `ExternalMcpService` single-entity methods (sequential — the scoped DbContext is not thread-safe; merge/review stay single-task): `BatchGetTasks`, `BatchAddTasks`, `BatchUpdateTaskStatus`, `BatchCancelTasks`, `BatchDeleteTasks`, `BatchSetMyDay`, `BatchCleanupTaskWorktrees`. Every tool returns a per-item result array ({ id/index, ok, error?, … }) — a failing item never aborts the rest — and rejects batches over 100 items.
   - `ListMcpTools` — `CreateList`, `UpdateList`, `DeleteList`
   - `ConfigMcpTools` — `GetListConfig`, `SetListConfig`, `GetTaskConfig`, `SetTaskConfig`

src/ClaudeDo.Worker/External/ExternalMcpService.cs

@@ -39,7 +39,7 @@ public sealed record TaskDto(
 
 public sealed record WorktreeInfoDto(
     string Path, string Branch, string HeadCommit, string BaseCommit,
-    int Ahead, int Behind, bool IsDirty);
+    int Ahead, int Behind, bool IsDirty, string? MergeCommit = null);
 
 public sealed record TaskDiffDto(
     string Content, IReadOnlyList<string> Files, bool Truncated, int TotalBytes);
@@ -59,6 +59,9 @@ public sealed record WorktreeListItemDto(
 public sealed record CleanupWorktreeResult(
     bool Removed, string WorktreePath, bool BranchDeleted);
 
+public sealed record RevertMergeResultDto(
+    bool Reverted, string? RevertCommit, IReadOnlyList<string> Conflicts, string? Message);
+
 public sealed record DailyPrepCandidateDto(
     string Id, string ListId, string ListName, string Title, string? Description,
     bool IsStarred, DateTime? ScheduledFor, DateTime CreatedAt);
@@ -486,7 +489,10 @@ public sealed class ExternalMcpService
         "Get git worktree details for a task: path, branch, headCommit (current HEAD SHA), " +
         "baseCommit (SHA where the branch was created), ahead (commits on branch since base), " +
         "behind (commits on main not yet on this branch; 0 if 'main' ref is unreachable), " +
-        "isDirty (has uncommitted changes in the worktree directory). " +
+        "isDirty (has uncommitted changes in the worktree directory), " +
+        "mergeCommit (SHA of the merge commit this worktree's branch produced on the target branch, " +
+        "if it has been merged and that succeeded after this field was introduced; null otherwise — " +
+        "required by revert_merge). " +
         "Throws if the task or its worktree does not exist.")]
     public async Task<WorktreeInfoDto> GetTaskWorktree(string taskId, CancellationToken cancellationToken)
     {
@@ -500,7 +506,7 @@ public sealed class ExternalMcpService
         var ahead  = await GitRevListCountAsync(wt.Path, $"{wt.BaseCommit}..HEAD", cancellationToken);
         var behind = await GitRevListCountAsync(wt.Path, "HEAD..main", cancellationToken);
 
-        return new WorktreeInfoDto(wt.Path, wt.BranchName, headCommit!, wt.BaseCommit, ahead, behind, isDirty);
+        return new WorktreeInfoDto(wt.Path, wt.BranchName, headCommit!, wt.BaseCommit, ahead, behind, isDirty, wt.MergeCommit);
     }
 
     [McpServerTool, Description(
@@ -729,6 +735,34 @@ public sealed class ExternalMcpService
         return ToDto((await _tasks.GetByIdAsync(taskId, cancellationToken))!);
     }
 
+    [McpServerTool, Description(
+        "Revert a previously merged task's merge commit on targetBranch (default: main), via `git revert -m 1` — " +
+        "a new commit, never a reset/rewrite (the target working directory is shared with other sessions). " +
+        "Requires the task to be Done with a Merged worktree that has a recorded merge commit; tasks merged " +
+        "before this feature existed have no recorded commit and are refused rather than guessed via git log. " +
+        "On success: reverted=true, revertCommit is the new commit's SHA, and the task returns to " +
+        "WaitingForReview so it can be reconsidered. " +
+        "On a conflicting revert: reverted=false, the revert is aborted immediately (no half-resolved state " +
+        "left in the tree) and conflicts lists the files that would have conflicted. " +
+        "Throws if there is no recorded merge commit, the repo is mid-merge/mid-revert, or the target working " +
+        "tree has uncommitted changes from another session.")]
+    public async Task<RevertMergeResultDto> RevertMerge(
+        string taskId, string targetBranch = "main", CancellationToken cancellationToken = default)
+    {
+        var result = await _merge.RevertMergeAsync(taskId, targetBranch, cancellationToken);
+
+        if (result.Status == TaskMergeService.StatusReverted)
+        {
+            await _broadcaster.TaskUpdated(taskId);
+            return new RevertMergeResultDto(true, result.RevertCommit, Array.Empty<string>(), null);
+        }
+
+        if (result.Status == TaskMergeService.StatusConflictAborted)
+            return new RevertMergeResultDto(false, null, result.ConflictFiles, result.ErrorMessage);
+
+        throw new InvalidOperationException(result.ErrorMessage ?? $"Revert blocked: {result.Status}");
+    }
+
     [McpServerTool, Description(
         "List all ClaudeDo-tracked worktrees. " +
         "Each entry: taskId, path, branch, headCommit (empty if path missing on disk), " +

src/ClaudeDo.Worker/Lifecycle/TaskMergeService.cs

@@ -32,6 +32,12 @@ public sealed record ConflictDocumentContent(
     bool IsBinary,
     IReadOnlyList<MergeSegment> Segments);
 
+public sealed record RevertResult(
+    string Status,
+    string? RevertCommit,
+    IReadOnlyList<string> ConflictFiles,
+    string? ErrorMessage);
+
 public sealed class TaskMergeService
 {
     public const string StatusMerged   = "merged";
@@ -39,6 +45,9 @@ public sealed class TaskMergeService
     public const string StatusBlocked  = "blocked";
     public const string StatusAborted  = "aborted";
 
+    public const string StatusReverted       = "reverted";
+    public const string StatusConflictAborted = "conflict_aborted";
+
     public const string PreviewClean       = "clean";
     public const string PreviewConflict    = "conflict";
     public const string PreviewUnavailable = "unavailable";
@@ -75,11 +84,11 @@ public sealed class TaskMergeService
         return (task, list, wt);
     }
 
-    private async Task MarkWorktreeMergedAsync(string taskId, CancellationToken ct)
+    private async Task MarkWorktreeMergedAsync(string taskId, string mergeCommitSha, CancellationToken ct)
     {
         using (var ctx = _dbFactory.CreateDbContext())
         {
-            await new WorktreeRepository(ctx).SetStateAsync(taskId, WorktreeState.Merged, ct);
+            await new WorktreeRepository(ctx).SetMergedAsync(taskId, mergeCommitSha, ct);
         }
         await _broadcaster.WorktreeUpdated(taskId);
     }
@@ -155,6 +164,8 @@ public sealed class TaskMergeService
             return new MergeResult(StatusConflict, files, null);
         }
 
+        var mergeSha = await _git.RevParseHeadAsync(list.WorkingDir, ct);
+
         string? cleanupWarning = null;
         if (removeWorktree)
         {
@@ -175,7 +186,7 @@ public sealed class TaskMergeService
             }
         }
 
-        await MarkWorktreeMergedAsync(taskId, ct);
+        await MarkWorktreeMergedAsync(taskId, mergeSha, ct);
         await ApproveIfWaitingForReviewAsync(task, ct);
 
         _logger.LogInformation(
@@ -233,7 +244,8 @@ public sealed class TaskMergeService
         try { await _git.CommitAsync(list.WorkingDir, $"Merge branch '{wt.BranchName}'", ct); }
         catch (Exception ex) { return Blocked($"commit failed: {ex.Message}"); }
 
-        await MarkWorktreeMergedAsync(taskId, ct);
+        var mergeSha = await _git.RevParseHeadAsync(list.WorkingDir, ct);
+        await MarkWorktreeMergedAsync(taskId, mergeSha, ct);
         await ApproveIfWaitingForReviewAsync(task, ct);
         _logger.LogInformation("Continued merge of task {TaskId} branch {Branch}", taskId, wt.BranchName);
 
@@ -257,6 +269,84 @@ public sealed class TaskMergeService
         return new MergeResult(StatusAborted, Array.Empty<string>(), null);
     }
 
+    /// <summary>
+    /// Reverts the merge commit recorded for this task (<see cref="WorktreeEntity.MergeCommit"/>)
+    /// via `git revert -m 1`, a new commit that undoes the merge without rewriting history — the
+    /// target working directory is shared with other sessions, so a reset/rebase is never an option.
+    /// On success the task returns to WaitingForReview so it can be reconsidered, and the worktree
+    /// state moves to Kept: Merged/Discarded are swept by WorktreeMaintenanceService, and by the time
+    /// a merge can be reverted its worktree directory and branch are typically already gone (removed
+    /// during the original merge cleanup), so Active — which implies a live, resumable worktree —
+    /// would be misleading. A conflicting revert is aborted immediately (`git revert --abort`); no
+    /// partial/half-resolved state is ever left in the tree.
+    /// </summary>
+    public async Task<RevertResult> RevertMergeAsync(string taskId, string targetBranch, CancellationToken ct)
+    {
+        var (task, list, wt) = await LoadMergeContextAsync(taskId, ct);
+
+        if (task.Status != TaskStatus.Done)
+            return RevertBlocked("task is not Done; only a merged task's revert can be undone");
+        if (wt is null)
+            return RevertBlocked("task has no worktree");
+        if (wt.State != WorktreeState.Merged)
+            return RevertBlocked($"worktree state is {wt.State}, expected Merged");
+        if (string.IsNullOrWhiteSpace(wt.MergeCommit))
+            return RevertBlocked("no merge commit recorded for this task; cannot revert");
+        if (string.IsNullOrWhiteSpace(list.WorkingDir))
+            return RevertBlocked("list has no working directory");
+        if (!await _git.IsGitRepoAsync(list.WorkingDir, ct))
+            return RevertBlocked("working directory is not a git repository");
+        if (await _git.IsMidMergeAsync(list.WorkingDir, ct))
+            return RevertBlocked("target working directory is mid-merge");
+        if (await _git.IsMidRevertAsync(list.WorkingDir, ct))
+            return RevertBlocked("target working directory is mid-revert");
+        if (await _git.HasChangesAsync(list.WorkingDir, includeUntracked: false, ct))
+            return RevertBlocked("target working tree has uncommitted changes");
+
+        var currentBranch = await _git.GetCurrentBranchAsync(list.WorkingDir, ct);
+        if (!string.Equals(currentBranch, targetBranch, StringComparison.Ordinal))
+        {
+            try { await _git.CheckoutBranchAsync(list.WorkingDir, targetBranch, ct); }
+            catch (Exception ex) { return RevertBlocked($"failed to switch target branch: {ex.Message}"); }
+        }
+
+        var (exitCode, stderr) = await _git.RevertMergeCommitAsync(list.WorkingDir, wt.MergeCommit!, ct);
+        if (exitCode != 0)
+        {
+            List<string> files;
+            try { files = await _git.ListConflictedFilesAsync(list.WorkingDir, ct); }
+            catch { files = new(); }
+
+            try { await _git.RevertAbortAsync(list.WorkingDir, ct); }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "git revert --abort failed after conflict — repo is mid-revert");
+                return RevertBlocked($"revert conflict and abort failed: {ex.Message} — repo is mid-revert, resolve manually");
+            }
+
+            if (files.Count == 0)
+                return RevertBlocked($"revert failed: {stderr}");
+
+            return new RevertResult(StatusConflictAborted, null, files, "revert conflicted; aborted cleanly, no changes made");
+        }
+
+        var revertSha = await _git.RevParseHeadAsync(list.WorkingDir, ct);
+
+        using (var ctx = _dbFactory.CreateDbContext())
+        {
+            await new WorktreeRepository(ctx).SetStateAsync(taskId, WorktreeState.Kept, ct);
+        }
+        await _broadcaster.WorktreeUpdated(taskId);
+        await _state.ForceSetStatusAsync(taskId, TaskStatus.WaitingForReview, ct);
+
+        _logger.LogInformation(
+            "Reverted merge of task {TaskId} (merge commit {MergeSha}) via revert commit {RevertSha}",
+            taskId, wt.MergeCommit, revertSha);
+        await _broadcaster.WorkerLog($"Reverted merge of \"{task.Title}\"", WorkerLogLevel.Warn, DateTime.UtcNow);
+
+        return new RevertResult(StatusReverted, revertSha, Array.Empty<string>(), null);
+    }
+
     /// <summary>
     /// Reads each conflicted working-tree file and parses its conflict markers into line-level
     /// segments (with the diff3 merge base when present). Binary files are flagged and skipped.
@@ -376,4 +466,7 @@ public sealed class TaskMergeService
 
     private static MergeResult Blocked(string reason) =>
         new(StatusBlocked, Array.Empty<string>(), reason);
+
+    private static RevertResult RevertBlocked(string reason) =>
+        new(StatusBlocked, null, Array.Empty<string>(), reason);
 }