Merge branch 'claudedo/340b4a2df0f14235a34fe0d02b2dc06f'

docs/explore-notes/review-merge.md

@@ -1,7 +1,7 @@
 # Review, merge & conflict resolution
 
 > **Explore-note — verify before trusting.** Distilled map of a subsystem, not authoritative.
-> Last verified against `2f3f938` (2026-08-07), which finished the diff-viewer rework:
+> Last verified against `6a2a19c` (2026-08-10), which added the preview-time verify build.
 > Planning mode renders per file and `DiffLinesView` is retired.
 > Drift check: `git log --oneline 20bce9b..HEAD -- src/ClaudeDo.Worker/Lifecycle src/ClaudeDo.Worker/State src/ClaudeDo.Worker/Planning src/ClaudeDo.Ui/ViewModels/Conflicts src/ClaudeDo.Worker/External`
 > Stable structure only (no line numbers). See docs/explore-notes/README.md.
@@ -115,6 +115,26 @@ the target branch at once would be the one run nothing checks.
 so a verify run can't be interrupted by a second merge landing in the same working dir
 mid-build.
 
+### Verify in the preview, not just post-merge
+
+`TaskMergeService.PreviewAsync(taskId, targetBranch, runVerify, ct)` can additionally build/test a
+clean `git merge-tree` result *before* anything is merged. It never touches the real working tree:
+the tree `PreviewMergeAsync` would write is wrapped in a throwaway commit
+(`GitService.CommitTreeAsync`, parent = the target branch's current tip) and checked out into a
+detached-HEAD scratch worktree under the OS temp dir (`GitService.WorktreeAddDetachedAsync`), which
+is always removed afterward (`finally`, non-cancellable cleanup). No verify command configured, or
+`runVerify=false`, reproduces the pre-existing preview exactly — no delay, no scratch worktree.
+
+Wired into `ExternalMcpService`: `preview_merge` (single task) always requests a verify run when the
+list has a command configured; `preview_merge_set` only does when its `runVerify` parameter is
+explicitly set (default `false`) — a set preview never starts N builds unasked. The Hub's
+`PreviewMerge` (the UI's live mergeability indicator) always passes `runVerify: false`, since
+running a build on every poll would be a bad regression; `MergePreviewDto` carries the
+verify fields anyway so a future UI entry point can opt in. Result fields: `VerifyExitCode` (null =
+not run; `-1` = timed out or failed to start; mirrors the post-merge gate's convention),
+`VerifyDurationMs`, `VerifyOutputTail` (tail of output, only populated on non-zero exit, via the
+same `TailOutput` helper the post-merge gate uses).
+
 ## `MergeCommit` and revert
 
 `WorktreeEntity.MergeCommit` (nullable) is the SHA of the merge commit this worktree's branch