Merge remote-tracking branch 'origin/main'

Eine manuelle Liste (Erinnerungen) hat kein WorkingDir. BuildForTaskAsync
warf dafuer bisher "no working directory configured", die interaktive
Session liess sich also nicht oeffnen. Jetzt faellt der Pfad auf das
User-Verzeichnis zurueck; Session-Skills werden dort bewusst nicht
geseedet, weil das Ziel das echte ~/.claude/skills waere.

CHANGELOG.md

@@ -1,5 +1,96 @@
 # Changelog
 
+## v2.13.3 — 2026-09-03
+
+### Fixes
+
+- raise SignalR MaximumParallelInvocationsPerClient (e64d5705)
+
+### Documentation
+
+- update for v2.13.2 (fc25ee45)
+
+## v2.13.2 — 2026-09-03
+
+### Features
+
+- Handler-Run per Knopf abbrechen (bd5aa265)
+
+### Fixes
+
+- strip CLAUDE_CODE_CHILD_SESSION/CLAUDECODE before every ConPTY launch (51ee5050)
+- Dequeue-X auf blockierten Queue-Zeilen anzeigen und Kette konsistent halten (df3e7ba0)
+- report and gate ListSettingsModal load failures instead of swallowing them (a1b20d9f)
+- move ScrollViewer padding to inner content in modal bodies (e0c6b670)
+- Mission Control oeffnen, wenn ein Handler-Run per MCP startet oder ein Handoff eintrifft (b05b6fba)
+
+### Performance
+
+- show list settings modal before its seven-round-trip load finishes (f24654df)
+
+### Documentation
+
+- remove stale session-skills empty-state entry (2bd48ea1)
+- update for v2.13.1 (eb3aee41)
+- update for v2.13.0 (2b873322)
+
+## v2.13.1 — 2026-09-02
+
+### Fixes
+
+- Mission Control oeffnen, wenn ein Handler-Run per MCP startet oder ein Handoff eintrifft (9f64ba50)
+
+## v2.13.0 — 2026-09-02
+
+### Features
+
+- Handler-Session vor dem Usage-Limit warnen und Handoff bis zum Reset zurueckhalten (fe818651)
+- start_list_handler MCP-Tool startet einen List-Handler-Run wie der Button (c2166a0d)
+- Handler-Session nach Usage-Limit-Reset automatisch neu starten (016b9203)
+- PowerUse-Zeitfenster + Handoff-Schwellwert als Settings (69898be5)
+- PowerUse-Toggle im Usage-Monitor, Opt-in pro Liste (19375254)
+- PowerUse-Addendum an die Handler-Prompts, Cap aus den Settings (453d61ca)
+- PowerUse-Flags und konfigurierbares Handoff-Budget (3cf9628f)
+- depends_on als Menge statt Einzelfeld (c25732cf)
+- surface the handoff round budget in the merge-helper handoff brief (81a5fc5d)
+- add ExpectsNoDiff flag for verification/audit tasks (0b506f52)
+- add dependency audit and diff-review threshold to list-handler prompts (9e805646)
+- add "move to list" to the task row context menu (80fe188a)
+- notes get their own list, a day log and an Enter chain (0f04b796)
+- add_note MCP tool with a per-day agent cap (ae0c7d37)
+
+### Fixes
+
+- carry ExpectsNoDiff into the relocated merge MCP tools (4ee1d05f)
+- stop Ui.Tests order-dependent flakiness on shared Loc.Current (dc1e67d0)
+- add failureReason field to batch_get_tasks (91220177)
+- make locale-parity test able to detect a malformed locale file (4c78a5d6)
+- don't leave an orphaned list behind on cancel (56bc1651)
+- stop treating git worktrees and submodules as repos (b6e5876b)
+- fix Bandel ticket sync and reactivate the integration (30d0611b)
+- Shift+Enter in the capture box, not just in the note rows (f6405804)
+- let Shift+Enter break the line, and clear the leftovers around the editor (b90c5855)
+- auto-bootstrap commit-less repos before creating worktrees (e0748ba3)
+- bootstrap commit-less repos and survive missing git identity (de44196b)
+
+### Performance
+
+- switch to workstation GC to cut idle memory (c347e4fc)
+
+### Refactoring
+
+- share StubWorkerClient between Ui.Tests and Worker.Tests (9f90e75a)
+- remove the stale-worker banner (6be62f02)
+
+### Documentation
+
+- Handler-Prompt praezisieren (Wave-Plan, Task-Split, review_task-Aufruf) (20b3b4ce)
+- Test-Scoping fuer Implementer-Tasks, PowerUse in den Explore-Notes (416997d7)
+- plan for multi-dependency depends_on relation table (84d955df)
+- empty-repo hardening notes + verification item (cf093e31)
+- spec + plan for empty-repo (unborn HEAD) hardening (fea8236e)
+- update for v2.12.0 (1d6cd49b)
+
 ## v2.12.0 — 2026-08-28
 
 ### Features

docs/explore-notes/conpty-sessions.md

@@ -143,6 +143,43 @@ outgoing session is only ever told to end its turn, never to exit. This keeps th
 `MCP_TOOL_TIMEOUT` is 200 s here — `TaskWaitMcpTools` clamps its own timeout to 170 s to stay
 comfortably under it (see [external-mcp.md](external-mcp.md)).
 
+### Auto-restart after the usage limit
+
+A handler session that dies mid-phase used to be a silent dead tile: `InteractiveTerminalViewModel.
+OnSessionProcessExited` only raised a visible banner for a death **inside** its 5 s
+`StartupGraceWindow`. It now raises `ExitedAfterStartup` for a later non-zero exit; the pane
+forwards it as `SessionDiedAfterStartup(taskId, exitCode)` and `MissionControlViewModel` reports it
+via `WorkerHub.ReportInteractiveSessionExited`. Every task-based pane reports — the UI does no
+filtering, because the exit code is the *only* thing it knows.
+
+`HandlerRestartCoordinator` (Worker) decides the rest and **fails closed** — unlike the usage gate,
+every missing signal means "don't relaunch":
+
+- **Which round was running** comes from `HandlerRoundState`, a JSON file at
+  `~/.claudeDo/handler-rounds.json` (one `HandlerRound` per handler task id, deliberately not a DB
+  column). `BuildForMergeHelperAsync` writes the opening round as phase `"triage"`;
+  `BuildForMergeHelperHandoffAsync` writes each subsequent `MergeHelperPhase`. Without it the phase
+  and task set exist *only* in the transient `HandoffRequested` broadcast, so a dead tile could not
+  be reopened. A `"triage"` round is never reopened — there is no handoff spec for it.
+- **Was it really the usage limit?** A ConPTY session has no captured stdout, so `TaskRunner.
+  IsUsageLimitMessage` (which matches the CLI's own "session limit" text) has nothing to read. The
+  corroborating witness is `UsageState.Snapshot.FiveHour.Utilization ≥ 95`
+  (`HandlerRestartCoordinator.UsageLimitProofPct`) at the moment of death. A crash at 40 % is not
+  restarted; no snapshot at all is not restarted.
+- **PowerUse only** — both keys, exactly like the prompt addendum above.
+- **One restart per round**, claimed via `HandlerRoundState.TryClaimAutoRestart` before the wait, so
+  a restart that dies again stays dead. `HandlerRoundState.Save` carries `AutoRestartUsed` over when
+  the phase is unchanged, because the restart's own launch-spec build writes the round again — a
+  naive overwrite would hand out a fresh budget every time and loop all night.
+- The restart waits out `FiveHour.ResetsAt`, then re-broadcasts `HandoffRequested` with the
+  persisted phase + task set, which the UI already handles by reopening the tile. It goes **around**
+  `handoff_list_handler`, so `HandoffRoundTracker.Register` is never called and the run loses no
+  handoff budget.
+
+Sibling to `UsageLimitAutoContinueCoordinator`, not an extension of it: that one only ever sees
+headless runs (`FailureReason == "usage_limit"`, resumed through the override slot), and a ConPTY
+session has no `task_runs` row to classify.
+
 ### The host task and its commit range
 
 The handler run **owns a real ClaudeDo task**, created by `CreateMergeHelperTask` (hub) →

docs/open.md

@@ -15,9 +15,7 @@ Checkliste lebt in `docs/verification-handoff.md`.
 
 - **Planning-aktiver Parent zeigt weiter „Idle":** Parent in `planning_phase=active` hat `Status=Idle` (korrekt im Modell), aber `TaskRowViewModel.StatusLabel` (Zeile 132) kennt nur `HasInteractiveSession`/`IsParked` als Overrides — der `PlanningBadge` ersetzt den Chip nicht sichtbar → liest sich wie ein normaler Idle-Task. Wunsch: klarer „Planning/Draft aktiv"-Zustand, der Idle überschreibt. (Kinder zeigen korrekt „Draft".)
 - **Blocked-by-Kette nicht sichtbar:** Nach Finalize ist die sequentielle Kette korrekt gesetzt (child[i] blocked-by child[i-1]), aber die UI stellt Reihenfolge/Abhängigkeit nicht dar — es gibt nur den „waiting"-Chip. Wunsch: Kette visualisieren (z.B. „wartet auf <Vorgänger>").
-- **Dequeue-„X" fehlt auf wartenden (blockierten) Kettengliedern:** `CanRemoveFromQueue = IsQueued || HasQueuedSubtasks` (TaskRowViewModel.cs:99), `IsQueued` verlangt leeres `blocked_by`. Ein gequeuetes, aber blockiertes Kind (`IsWaiting`) bekommt daher kein Remove-from-queue-X — nur Parent + erstes (entsperrtes) Kind.
-- **Session-Skills-Tab hat keinen Empty-State:** Bei 0 installierten Skills zeigt der Skills-Tab (Settings) nur eine nackte leere Fläche unter der Install-Zeile — kein erklärender Hinweis (z.B. „Noch keine Skills installiert — GitHub-URL oben einfügen"). Im `sessionSkillsTab`-Locale-Namespace (en.json:674) gibt es keinen `empty`-Key.
-- **Modal-Bodies sind unten abgeschnitten** (Sichtprüfung 2026-08-06, beobachtet in den Listen-Settings: der Hinweistext unter „Verify command" ist mitten in der Zeile vom Footer weggeschnitten und lässt sich nicht herunterscrollen; laut Mika „fast überall" in den Settings-Modals). Gemeinsames Muster: `<ScrollViewer Padding="20,16">` als Modal-Body — in `ListSettingsModalView:36`, `MergeModalView:33`, `WorktreesOverviewModalView:131`, `AboutModalView:20`, `MergeHelperSelectionModal:47`, `RepoImportModalView:45`, `LogVisualizerView:45` sowie `WorkConsole:295/395`. **Vermutete** Ursache (nicht verifiziert): das untere `Padding` des ScrollViewers zählt nicht zum scrollbaren Extent, die letzten Pixel sind also unerreichbar. Erst am echten Fall nachmessen, dann ggf. einheitlich das Padding vom ScrollViewer auf ein `Margin` des inneren Inhalts umziehen.
+- **Modal-Bodies unten abgeschnitten — gefixt, Sichtprüfung offen** (Ursache 2026-09-02 verifiziert: `ScrollViewer.Padding` zählt in Avalonia 12 nicht zum Extent; Fix ist das Padding auf ein `Margin` des inneren Inhalts umzuziehen). Betraf `AboutModalView`, `MergeHelperSelectionModal`, `MergeModalView`, `RepoImportModalView`, `WorktreesOverviewModalView` — alle fünf umgestellt. `ListSettingsModalView`, `LogVisualizerView` und `WorkConsole` hatten zu diesem Zeitpunkt bereits kein ScrollViewer-Padding mehr.
 - **Usage-Monitor-Modal: Analyse-Tabellen ausbaufähig** (Sichtprüfung 2026-08-06; Gauges, Info-Bänder, Presets/Custom-Range und Refresh-Button sind in Ordnung). Models-Tab: die Spaltenköpfe „OTHER CACHE" und „SHARE" kollidieren zu `OTHER CACHISHARE`; `claude-haiku-4-5-20251001` läuft in die IN-Spalte; alle Zahlen linksbündig und ohne Tausendertrenner (`506830708`). Tasks-Tab: Task-Titel wird ohne Ellipse hart an der LIST-Spalte abgeschnitten, der LIST-Text ebenfalls; MODEL ist bei Runs von vor der `task_runs.model`-Spalte leer (besser „—"). Wunsch: Zahlen rechtsbündig + `#,##0` (oder k/M), Spaltenbreiten/Truncation fixen.
 - **Conflict-Resolver: mehrere Konfliktdateien schlecht erkennbar:** Beim 2-Datei-Konflikt schwer zu sehen, dass zwei Dateien betroffen sind (File-Switcher/Anzahl zu unauffällig). Prominentere Datei-Liste / „x von y Dateien".
 - **Attachments: erster Drag&Drop der Session schlug einmalig fehl („An error occurred"):** Beim allerersten Drop-to-attach einer UI-Session zeigte die `DropStatus`-Zeile inline einen generischen Fehler und es wurde nichts persistiert (kein File, keine DB-Row); alle folgenden Drops derselben Session + der „Add file…"-Picker + Remove funktionierten fehlerfrei. Nicht reproduzierbar nach dem ersten Mal. Kandidaten: transiente SQLite-Contention (der UI-Prozess schreibt `todo.db` direkt via `new TaskAttachmentRepository`, während der Worker dieselbe DB hält) ODER ein Fehler im Drop-Stream-Pfad (`IStorageFile.OpenReadAsync` im Code-Behind, außerhalb des `try` in `AddFilesAsync`). Falls es erneut auftritt: `AddFilesAsync`/`OnDrop` mit robusterem Error-Logging versehen.

src/ClaudeDo.Data/CLAUDE.md

@@ -41,10 +41,18 @@ Beyond the basics it carries:
 | `NextTaskNumber` | `next_task_number` | 1 | Persistent counter for `TaskEntity.Number` allocation. Incremented atomically in `TaskNumberAllocator.AddWithNumberAsync` on every task insert. **Monotonic only:** the counter itself advances across all tasks (no per-list numbering), and it never resets. A deleted task leaves a gap. |
 | `PowerUseEnabled` | `power_use_enabled` | false | PowerUse master switch, toggled on the **usage monitor** (not Settings). ⚠️ Never sufficient alone — a handler run is in PowerUse only when `list_config.power_use_allowed` is also set. |
 | `ListHandlerMaxHandoffs` | `list_handler_max_handoffs` | 4 | Cap on a list-handler run's wait↔merge handoff chain (`HandoffRoundTracker`). 4 = two merge rounds. Independent of PowerUse — applies to interactive runs too. Clamped to min 1 in `WorkerHub.UpdateAppSettings` and again in `Register`, because 0 would remove the only bound on a runaway chain. |
+| `PowerUseWindowStart` / `PowerUseWindowEnd` | `power_use_window_*` | null | Optional local-time window (`HH:mm`) narrowing when PowerUse applies. Both null (or only one set) = round the clock, i.e. byte-identical to the pre-window behaviour; end before start wraps over midnight. Semantics live in the pure `PowerUseWindow`; checked in `InteractiveLaunchSpecService.ComposeHandlerPromptAsync` **per phase** at prompt-build time, so a chain handing off past the end time drops the addendum from there on. Unparseable input is stored as null, not rejected. |
+| `PowerUseHandoffPct` | `power_use_handoff_pct` | 95 | 5h-usage percentage at which a PowerUse handler session should hand off. Clamped 50..99. Stored + shown on the usage monitor; the consumer is the handoff prompt. |
 
 All four usage percentages are clamped 0..100 by `AppSettingsRepository.UpdateAsync`.
 Gate/throttle semantics → [usage-monitoring](../../docs/explore-notes/usage-monitoring.md).
 
+⚠️ **`AppSettingsRepository.UpdateAsync` copies the incoming entity field by field** onto the
+singleton row — a property missing from that block never persists, however correctly the caller
+filled the entity, and nothing fails. `ModelPresets`, `PowerUseEnabled` and
+`ListHandlerMaxHandoffs` were all silently unwritable that way until 2026-09-02. Add a new column
+to that block, not just to the entity + the hub.
+
 ### Model / effort registries
 
 - **ModelPresets / ModelPreset** — per-model run defaults (`Model`, `Effort`, `MaxTurns`), one row per `ModelRegistry.Aliases` entry, supplying the **global** effort and max-turns defaults. Ship defaults: haiku medium/20, sonnet high/30, opus high/40, fable high/25. `Parse`/`Serialize` normalize (unknown models dropped, missing aliases filled from `Defaults`, effort validated, turns clamped 1–200) and **never throw** — a malformed settings row must not stop a run. `For(presets, model, fallbackMaxTurns)` always returns a usable row; resolution order and the fallback trap → [worker-task-pipeline](../../docs/explore-notes/worker-task-pipeline.md).

src/ClaudeDo.Data/Configuration/AppSettingsEntityConfiguration.cs

@@ -72,6 +72,12 @@ public class AppSettingsEntityConfiguration : IEntityTypeConfiguration<AppSettin
 
         builder.Property(s => s.PowerUseEnabled)
             .HasColumnName("power_use_enabled").IsRequired().HasDefaultValue(false);
+        builder.Property(s => s.PowerUseWindowStart)
+            .HasColumnName("power_use_window_start");
+        builder.Property(s => s.PowerUseWindowEnd)
+            .HasColumnName("power_use_window_end");
+        builder.Property(s => s.PowerUseHandoffPct)
+            .HasColumnName("power_use_handoff_pct").IsRequired().HasDefaultValue(95);
         builder.Property(s => s.ListHandlerMaxHandoffs)
             .HasColumnName("list_handler_max_handoffs").IsRequired().HasDefaultValue(4);
 

src/ClaudeDo.Data/Migrations/20260902170501_AddPowerUseWindow.cs

@@ -0,0 +1,56 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace ClaudeDo.Data.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddPowerUseWindow : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<int>(
+                name: "power_use_handoff_pct",
+                table: "app_settings",
+                type: "INTEGER",
+                nullable: false,
+                defaultValue: 95);
+
+            migrationBuilder.AddColumn<string>(
+                name: "power_use_window_end",
+                table: "app_settings",
+                type: "TEXT",
+                nullable: true);
+
+            migrationBuilder.AddColumn<string>(
+                name: "power_use_window_start",
+                table: "app_settings",
+                type: "TEXT",
+                nullable: true);
+
+            migrationBuilder.UpdateData(
+                table: "app_settings",
+                keyColumn: "id",
+                keyValue: 1,
+                columns: new[] { "power_use_handoff_pct", "power_use_window_end", "power_use_window_start" },
+                values: new object[] { 95, null, null });
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "power_use_handoff_pct",
+                table: "app_settings");
+
+            migrationBuilder.DropColumn(
+                name: "power_use_window_end",
+                table: "app_settings");
+
+            migrationBuilder.DropColumn(
+                name: "power_use_window_start",
+                table: "app_settings");
+        }
+    }
+}

src/ClaudeDo.Data/Migrations/ClaudeDoDbContextModelSnapshot.cs

@@ -100,6 +100,20 @@ namespace ClaudeDo.Data.Migrations
                         .HasDefaultValue(false)
                         .HasColumnName("power_use_enabled");
 
+                    b.Property<int>("PowerUseHandoffPct")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("INTEGER")
+                        .HasDefaultValue(95)
+                        .HasColumnName("power_use_handoff_pct");
+
+                    b.Property<string>("PowerUseWindowEnd")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("power_use_window_end");
+
+                    b.Property<string>("PowerUseWindowStart")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("power_use_window_start");
+
                     b.Property<string>("RepoImportFolders")
                         .HasColumnType("TEXT")
                         .HasColumnName("repo_import_folders");
@@ -192,6 +206,7 @@ namespace ClaudeDo.Data.Migrations
                             MaxTurnsCeiling = 80,
                             NextTaskNumber = 1,
                             PowerUseEnabled = false,
+                            PowerUseHandoffPct = 95,
                             StandupWeekday = 3,
                             UsageGateFiveHourPct = 80,
                             UsageGateSevenDayPct = 90,

src/ClaudeDo.Data/Models/AppSettingsEntity.cs

@@ -69,6 +69,17 @@ public sealed class AppSettingsEntity
     // run unattended. Composition lives in InteractiveLaunchSpecService.
     public bool PowerUseEnabled { get; set; }
 
+    // Optional local-time window (both `HH:mm`) narrowing when PowerUse applies, checked per phase
+    // at prompt-build time. Both null (the default) = round the clock, byte-identical to the
+    // pre-window behaviour; only one set counts as unset too. End before start wraps over midnight.
+    // Semantics live in PowerUseWindow.
+    public string? PowerUseWindowStart { get; set; }
+    public string? PowerUseWindowEnd { get; set; }
+
+    // Percentage of the 5h usage window at which a PowerUse handler session is told to hand off
+    // rather than start more work. Stored and displayed here; the consumer is the handoff prompt.
+    public int PowerUseHandoffPct { get; set; } = 95;
+
     // Server-side cap on a list-handler run's wait<->merge handoff chain (HandoffRoundTracker).
     // 4 = two full wait/merge cycles, the long-standing default. Raise it for a run meant to keep
     // going for hours. It exists to bound runaway handoff loops, so it must stay >= 1.

src/ClaudeDo.Data/Models/PowerUseWindow.cs

@@ -0,0 +1,32 @@
+namespace ClaudeDo.Data.Models;
+
+/// <summary>
+/// The optional local-time window restricting when PowerUse applies
+/// (<see cref="AppSettingsEntity.PowerUseWindowStart"/> / <c>End</c>, both <c>HH:mm</c>).
+/// Pure on purpose — the caller supplies "now", so the window logic is testable without a clock.
+/// </summary>
+public static class PowerUseWindow
+{
+    /// <summary>Parses an <c>HH:mm</c> string; anything else (including null/blank) is null.</summary>
+    public static TimeOnly? Parse(string? value)
+        => TimeOnly.TryParseExact(value?.Trim(), "HH:mm", out var t) ? t : null;
+
+    /// <summary>Round-trips a stored/typed value through <see cref="Parse"/>, so an unparseable
+    /// string is stored as null instead of sitting in the column pretending to be a window.</summary>
+    public static string? Normalize(string? value) => Parse(value)?.ToString("HH:mm");
+
+    /// <summary>
+    /// True when <paramref name="now"/> falls inside the window. Half-open: start is included,
+    /// end is not. Either bound missing = no window at all = always true (the pre-window
+    /// behaviour). A window whose end is before its start wraps over midnight.
+    /// </summary>
+    public static bool Contains(TimeOnly now, TimeOnly? start, TimeOnly? end)
+    {
+        if (start is not { } from || end is not { } to) return true;
+        return from < to ? now >= from && now < to : now >= from || now < to;
+    }
+
+    /// <summary>Convenience overload for the two stored strings and a wall clock.</summary>
+    public static bool IsOpen(DateTime now, string? start, string? end)
+        => Contains(TimeOnly.FromDateTime(now), Parse(start), Parse(end));
+}

src/ClaudeDo.Data/Repositories/AppSettingsRepository.cs

@@ -93,6 +93,16 @@ public sealed class AppSettingsRepository
         row.UsageThrottleSevenDaySoftPct = Math.Clamp(updated.UsageThrottleSevenDaySoftPct, 0, 100);
         row.UsageThrottleSevenDayHardPct = Math.Clamp(updated.UsageThrottleSevenDayHardPct, 0, 100);
         row.AutoContinueOnUsageLimit = updated.AutoContinueOnUsageLimit;
+        // ModelPresets / PowerUse* / ListHandlerMaxHandoffs were missing from this copy block, so
+        // every write of them was silently dropped (the row keeps whatever it already had). This
+        // block is the single write path for the singleton row — a field absent here does not
+        // persist, no matter how correctly the hub fills the entity.
+        row.ModelPresets = string.IsNullOrWhiteSpace(updated.ModelPresets) ? row.ModelPresets : updated.ModelPresets;
+        row.PowerUseEnabled = updated.PowerUseEnabled;
+        row.PowerUseWindowStart = PowerUseWindow.Normalize(updated.PowerUseWindowStart);
+        row.PowerUseWindowEnd = PowerUseWindow.Normalize(updated.PowerUseWindowEnd);
+        row.PowerUseHandoffPct = Math.Clamp(updated.PowerUseHandoffPct, 50, 99);
+        row.ListHandlerMaxHandoffs = Math.Max(1, updated.ListHandlerMaxHandoffs);
 
         await _context.SaveChangesAsync(ct);
     }

src/ClaudeDo.Data/Wire.cs

@@ -40,7 +40,13 @@ public record AppSettingsDto(
     // PowerUse master switch — toggled on the usage monitor, not typed in Settings. Only takes
     // effect for a list that also set PowerUseAllowed.
     bool PowerUseEnabled = false,
-    int ListHandlerMaxHandoffs = 4);
+    int ListHandlerMaxHandoffs = 4,
+    // PowerUse time window (`HH:mm`, local, null = round the clock) + the 5h-usage percentage at
+    // which a PowerUse handler session should hand off. Also usage-monitor-owned, so Settings has
+    // to round-trip them too.
+    string? PowerUseWindowStart = null,
+    string? PowerUseWindowEnd = null,
+    int PowerUseHandoffPct = 95);
 
 public record ModelPresetDto(string Model, string Effort, int MaxTurns);
 
@@ -211,6 +217,10 @@ public sealed record LaunchSpec(
     IReadOnlyList<string> Args,
     IReadOnlyDictionary<string, string> Env);
 
+// A handler round's still-open (Queued/Running) task, for the Mission Control "abandon run"
+// action -- confirms with a count, then cancels each one before closing the pane.
+public record HandlerOpenTaskDto(string Id, string Title);
+
 public record TicketSettingsDto(string? ApiBaseUrl, bool TokenSet);
 public record TicketConnectionDto(bool Ok, string? UserName, IReadOnlyList<string> Scopes, string? Error);
 public record TicketProjectDto(int Id, string Title, string DepartmentName);

src/ClaudeDo.Localization/locales/de.json

@@ -338,6 +338,7 @@
     "closeSession": "Sitzung beenden",
     "conptyLaunchFailed": "Interaktive Sitzung konnte nicht geöffnet werden: {0}",
     "conptyStarting": "Sitzung wird gestartet…",
+    "usageWarningNotDelivered": "Die Listen-Handler-Sitzung konnte nicht vor dem Usage-Limit gewarnt werden.",
     "mergeHelperTitle": "Merge-Helfer",
     "mergeHelperHandoffTitleSuffix": " (Übergabe)",
     "mergeHelperTaskTitle": "Listen-Handler: {0}",
@@ -353,6 +354,10 @@
     "enqueueAlreadyOpen": "Kann nicht in die Warteschlange gestellt werden — dieser Task hat eine offene interaktive Sitzung.",
     "enqueueFailed": "In die Warteschlange stellen fehlgeschlagen: {0}",
     "queueRefreshFailed": "Warteschlange konnte nicht aktualisiert werden: {0}",
+    "abandonRun": "Lauf abbrechen",
+    "abandonRunTip": "Die noch offenen Tasks dieses Laufs abbrechen und die Sitzung schließen",
+    "abandonRunConfirm": "{0} offene(n) Task(s) abbrechen und diese Sitzung schließen? Tasks im Review oder bereits erledigt bleiben unangetastet.",
+    "abandonRunFailed": "Offene Tasks konnten nicht abgebrochen werden: {0}",
     "question": {
       "title": "Claude fragt nach",
       "placeholder": "Antwort eingeben…",
@@ -511,6 +516,10 @@
       "noGauges": "Noch keine Nutzungslimits gemeldet.",
       "powerUse": "PowerUse",
       "powerUseHint": "Das restliche Fenster ausnutzen: ein List-Handler-Run fragt nichts, löst Konflikte selbst, sammelt neue Arbeit und handoffet weiter, solange sein Budget reicht. Wirkt nur auf Listen, die PowerUse in ihren Listen-Einstellungen erlaubt haben.",
+      "powerUseWindow": "Nur zwischen",
+      "powerUseWindowPlaceholder": "HH:mm",
+      "powerUseHandoffPct": "Übergabe bei (% von 5h)",
+      "powerUseWindowHint": "Beide Zeiten leer = rund um die Uhr. Das Fenster wird bei jedem Start einer Handler-Phase geprüft — eine Kette, die über das Ende hinausläuft, macht ohne PowerUse weiter.",
       "refresh": "Jetzt aktualisieren",
       "refreshHint": "Abruf alle 5 Min., während ein Task läuft, sonst alle 15 Min.",
       "staleFormat": "Werte veraltet (Stand {0})",
@@ -767,7 +776,7 @@
     "sessionSkillsTab": { "installed": "Installiert: {0}", "installFailed": "Installation fehlgeschlagen: {0}", "updated": "Aktualisiert.", "updateFailed": "Aktualisierung fehlgeschlagen: {0}", "removed": "Entfernt.", "removeFailed": "Entfernen fehlgeschlagen: {0}" },
     "worktreesTab": { "workerOffline": "Worker offline.", "removed": "{0} Worktree(s) entfernt.", "blocked": "Zwangsentfernung nicht möglich: {0} Aufgabe(n) laufen noch. Brich sie zuerst ab.", "removedFrom": "{0} Worktree(s) von {1} Aufgabe(n) entfernt.", "cleanupFailed": "Aufräumen fehlgeschlagen: {0}", "resetFailed": "Zurücksetzen fehlgeschlagen: {0}" },
     "worktreesOverview": { "titleAll": "Worktrees", "titleList": "Worktrees — {0}", "listFallback": "Liste", "cleanupFailed": "Aufräumen fehlgeschlagen.", "cleanupFailedDetailed": "Aufräumen fehlgeschlagen: {0}", "removed": "{0} Worktree(s) entfernt.", "discardConfirm": "Worktree für \"{0}\" verwerfen? Nicht committete Arbeit geht verloren.", "discardFailed": "Worktree konnte nicht verworfen werden.", "keepFailed": "Worktree konnte nicht behalten werden.", "cannotForceRunning": "Eine laufende Aufgabe kann nicht zwangsweise entfernt werden.", "forceRemoveFailed": "Zwangsentfernung fehlgeschlagen.", "forceRemoveFailedDetailed": "Zwangsentfernung fehlgeschlagen: {0}", "batchDone": "{0} gemergt, {1} zu lösen.", "openInExplorerFailed": "Pfad konnte nicht geöffnet werden: {0}" },
-    "listSettings": { "untitled": "Unbenannt", "ticketProjectNone": "— keins —" },
+    "listSettings": { "untitled": "Unbenannt", "ticketProjectNone": "— keins —", "loadFailed": "Listeneinstellungen konnten nicht geladen werden: {0}", "ticketProjectsLoadFailed": "Ticket-Projekte konnten nicht geladen werden: {0}" },
     "detailsIsland": { "verifyFailed": "Merge ist erfolgt, aber das Verifikationskommando der Liste ist fehlgeschlagen — die Aufgabe wurde nicht auf 'Erledigt' gesetzt.", "untrackedCollision": "Merge abgelehnt — er würde eine unversionierte Datei im Ziel-Arbeitsverzeichnis überschreiben.", "stopOffline": "Worker offline — Task kann nicht gestoppt werden.", "stopFailed": "Stoppen fehlgeschlagen: {0}", "enqueueFailed": "In die Warteschlange stellen fehlgeschlagen: {0}", "dequeueFailed": "Aus der Warteschlange entfernen fehlgeschlagen: {0}", "resetAndRetryFailed": "Zurücksetzen & erneut versuchen fehlgeschlagen: {0}", "toggleDoneFailed": "Erledigt-Status konnte nicht aktualisiert werden: {0}" },
     "mergeSection": { "openWorktreeFailed": "Worktree konnte nicht geöffnet werden: {0}" },
     "about": { "openPathFailed": "Pfad konnte nicht geöffnet werden: {0}" },

src/ClaudeDo.Localization/locales/en.json

@@ -338,6 +338,7 @@
     "closeSession": "Kill session",
     "conptyLaunchFailed": "Couldn't open interactive session: {0}",
     "conptyStarting": "Starting session…",
+    "usageWarningNotDelivered": "Couldn't warn the list-handler session about the usage limit.",
     "mergeHelperTitle": "Merge Helper",
     "mergeHelperHandoffTitleSuffix": " (Handoff)",
     "mergeHelperTaskTitle": "List handler: {0}",
@@ -353,6 +354,10 @@
     "enqueueAlreadyOpen": "Can't queue — this task has an open interactive session.",
     "enqueueFailed": "Queue failed: {0}",
     "queueRefreshFailed": "Couldn't refresh the queue: {0}",
+    "abandonRun": "Abandon run",
+    "abandonRunTip": "Cancel this run's still-open tasks and close the session",
+    "abandonRunConfirm": "Cancel {0} open task(s) and close this session? Tasks already in review or done are not affected.",
+    "abandonRunFailed": "Couldn't cancel the open tasks: {0}",
     "question": {
       "title": "Claude is asking",
       "placeholder": "Type your answer…",
@@ -511,6 +516,10 @@
       "noGauges": "No usage limits reported yet.",
       "powerUse": "PowerUse",
       "powerUseHint": "Spend the rest of the window: a list-handler run asks nothing, resolves conflicts itself, harvests new work, and keeps handing off for as long as its budget allows. Only affects lists that allowed PowerUse in their list settings.",
+      "powerUseWindow": "Only between",
+      "powerUseWindowPlaceholder": "HH:mm",
+      "powerUseHandoffPct": "Hand off at (% of 5h)",
+      "powerUseWindowHint": "Leave both times empty for round the clock. A window is checked whenever a handler phase starts, so a chain that runs past the end time continues without PowerUse.",
       "refresh": "Refresh now",
       "refreshHint": "Polled every 5 min while a task runs, otherwise every 15 min.",
       "staleFormat": "Values stale (as of {0})",
@@ -767,7 +776,7 @@
     "sessionSkillsTab": { "installed": "Installed: {0}", "installFailed": "Install failed: {0}", "updated": "Updated.", "updateFailed": "Update failed: {0}", "removed": "Removed.", "removeFailed": "Remove failed: {0}" },
     "worktreesTab": { "workerOffline": "Worker offline.", "removed": "Removed {0} worktree(s).", "blocked": "Cannot force-remove: {0} task(s) still running. Cancel them first.", "removedFrom": "Removed {0} worktree(s) from {1} task(s).", "cleanupFailed": "Cleanup failed: {0}", "resetFailed": "Reset failed: {0}" },
     "worktreesOverview": { "titleAll": "Worktrees", "titleList": "Worktrees — {0}", "listFallback": "list", "cleanupFailed": "Cleanup failed.", "cleanupFailedDetailed": "Cleanup failed: {0}", "removed": "Removed {0} worktree(s).", "discardConfirm": "Discard the worktree for \"{0}\"? Uncommitted work will be lost.", "discardFailed": "Failed to discard worktree.", "keepFailed": "Failed to keep worktree.", "cannotForceRunning": "Cannot force-remove a running task.", "forceRemoveFailed": "Force remove failed.", "forceRemoveFailedDetailed": "Force remove failed: {0}", "batchDone": "Merged {0}, {1} need resolution.", "openInExplorerFailed": "Couldn't open path: {0}" },
-    "listSettings": { "untitled": "Untitled", "ticketProjectNone": "— none —" },
+    "listSettings": { "untitled": "Untitled", "ticketProjectNone": "— none —", "loadFailed": "Couldn't load list settings: {0}", "ticketProjectsLoadFailed": "Couldn't load ticket projects: {0}" },
     "detailsIsland": { "verifyFailed": "Merge landed, but the list's verify command failed — the task was kept out of Done.", "untrackedCollision": "Merge refused — it would overwrite an untracked file in the target working directory.", "stopOffline": "Worker offline — can't stop the task.", "stopFailed": "Stop failed: {0}", "enqueueFailed": "Queue failed: {0}", "dequeueFailed": "Remove from queue failed: {0}", "resetAndRetryFailed": "Reset & retry failed: {0}", "toggleDoneFailed": "Couldn't update done state: {0}" },
     "mergeSection": { "openWorktreeFailed": "Couldn't open worktree: {0}" },
     "about": { "openPathFailed": "Couldn't open path: {0}" },

src/ClaudeDo.Ui/Services/Interfaces/IWorkerClient.cs

@@ -30,6 +30,14 @@ public interface IWorkerClient : INotifyPropertyChanged
     /// task to carry out nextPhase ("wait" | "merge" | "wait_final" | "merge_final").</summary>
     event Action<string, IReadOnlyList<string>, string>? HandoffRequestedEvent;
 
+    /// <summary>start_list_handler was called through the external MCP: (listId, taskIds). The UI
+    /// starts a list-handler run for them exactly like the "Let Claude handle it" button.</summary>
+    event Action<string, IReadOnlyList<string>>? ListHandlerStartRequestedEvent;
+    /// <summary>The 5h usage window is running out under a running list-handler session:
+    /// (handlerTaskId, message). Mission Control types the message into that task's ConPTY pane so
+    /// the session can hand off cleanly; no pane for the task means nothing happens.</summary>
+    event Action<string, string>? HandlerUsageWarningEvent;
+
     /// <summary>An agent added a note through the MCP tool — an open notes editor reloads.</summary>
     event Action? NotesUpdatedEvent;
 
@@ -146,6 +154,14 @@ public interface IWorkerClient : INotifyPropertyChanged
     /// session's role: "wait" | "merge" | "wait_final" | "merge_final".</summary>
     Task<LaunchSpec> GetMergeHelperHandoffLaunchSpecAsync(
         string taskId, IReadOnlyList<string> survivingTaskIds, string nextPhase, CancellationToken ct = default);
+    /// <summary>Reports that a task-based ConPTY session's process exited non-zero after it had been
+    /// running. The exit code only exists in this process; the worker decides whether it was a
+    /// list-handler session killed by the usage limit and reopens the same phase after the 5h reset.</summary>
+    Task ReportInteractiveSessionExitedAsync(string taskId, int exitCode, CancellationToken ct = default);
+    /// <summary>The handler round's still-open (Queued/Running) tasks, for the Mission Control
+    /// "abandon run" action. Empty when the round has no entry or nothing open -- the caller then
+    /// closes the pane without a confirmation dialog.</summary>
+    Task<IReadOnlyList<HandlerOpenTaskDto>> GetHandlerOpenTasksAsync(string handlerTaskId, CancellationToken ct = default);
     /// <summary>Starts a planning session and returns the launch spec for an embedded ConPTY
     /// planning terminal (replaces StartPlanningSessionAsync's external wt window).</summary>
     Task<LaunchSpec> GetPlanningStartLaunchSpecAsync(string taskId, CancellationToken ct = default);

src/ClaudeDo.Ui/Services/PtyTerminalSession.cs

@@ -1,5 +1,6 @@
 using System;
 using System.Collections.Generic;
+using System.Reflection;
 using System.Threading;
 using System.Threading.Tasks;
 using Iciclecreek.Terminal;
@@ -67,6 +68,14 @@ public sealed class PtyTerminalSession : IDisposable
         await WaitForLaunchGateAsync(s_launchGate, s_launchGateTimeout, ct);
         try
         {
+            // If ClaudeDo.App itself was started from inside a claude session (e.g. a dev/test
+            // launch), it inherits these markers and every embedded PTY session would otherwise
+            // inherit them too — the child claude then thinks it's a spawned subagent and
+            // disables transcript saving / degrades its own startup banner. Every ConPTY tile
+            // must look like a fresh top-level session regardless of how ClaudeDo.App was launched.
+            Environment.SetEnvironmentVariable("CLAUDE_CODE_CHILD_SESSION", null);
+            Environment.SetEnvironmentVariable("CLAUDECODE", null);
+
             foreach (var (key, value) in descriptor.Env)
                 Environment.SetEnvironmentVariable(key, value);
 
@@ -93,6 +102,56 @@ public sealed class PtyTerminalSession : IDisposable
         ProcessExited?.Invoke(this, e.ExitCode);
     }
 
+    /// <summary>
+    /// Types <paramref name="text"/> into the running session and submits it, exactly as if the user
+    /// had typed it — used to warn a list-handler session before the usage limit
+    /// (<c>HandlerUsageWarning</c>). Verified against a real `claude` TUI, including while it was
+    /// mid-turn (the message is queued and acted on when the turn ends).
+    ///
+    /// Three non-obvious details, all established by that spike:
+    /// • <see cref="TerminalControl"/> exposes no public write path at all — its only public paste is
+    ///   <c>TerminalView.PasteAsync()</c>, which takes no argument and reads the clipboard. The
+    ///   private <c>SendToPtyAsync</c> on the inner view is the write seam, hence the reflection.
+    /// • The text and the Enter must be TWO writes. A single <c>text + "\r"</c> chunk lands in
+    ///   claude's composer but is never submitted — a chunk carrying an embedded CR reads as pasted
+    ///   text, not as a keypress.
+    /// • The Enter bytes come from the emulator (<c>GenerateKeyInput</c>) rather than a literal
+    ///   "\r", because claude turns Win32 input mode on and the emulator owns that encoding.
+    ///
+    /// Best-effort by design: a package upgrade that renames the private member costs a warning that
+    /// never arrives, never a crashed Mission Control.
+    /// </summary>
+    public async Task<bool> SendLineAsync(string text)
+    {
+        if (_control is not { } control || !IsRunning || string.IsNullOrEmpty(text)) return false;
+        try
+        {
+            await SendRawAsync(control, text);
+            await Task.Delay(SubmitDelay);
+            await SendRawAsync(control, control.Terminal.GenerateKeyInput(XTerm.Input.Key.Enter, XTerm.Input.KeyModifiers.None));
+            return true;
+        }
+        catch (Exception)
+        {
+            return false;
+        }
+    }
+
+    // Long enough that the two writes can't be read as one chunk by the child's stdin reader.
+    private static readonly TimeSpan SubmitDelay = TimeSpan.FromMilliseconds(150);
+
+    private static readonly FieldInfo? s_terminalViewField =
+        typeof(TerminalControl).GetField("_terminalView", BindingFlags.Instance | BindingFlags.NonPublic);
+    private static readonly MethodInfo? s_sendToPty =
+        typeof(TerminalView).GetMethod("SendToPtyAsync", BindingFlags.Instance | BindingFlags.NonPublic);
+
+    private static Task SendRawAsync(TerminalControl control, string data)
+    {
+        if (s_terminalViewField?.GetValue(control) is not TerminalView view || s_sendToPty is null)
+            throw new InvalidOperationException("Iciclecreek.Avalonia.Terminal no longer exposes a PTY write seam.");
+        return (Task)s_sendToPty.Invoke(view, new object[] { data, CancellationToken.None })!;
+    }
+
     public void Kill()
     {
         try { _control?.Kill(); }

src/ClaudeDo.Ui/Services/WorkerClient.cs

@@ -49,6 +49,8 @@ public partial class WorkerClient : ObservableObject, IAsyncDisposable, IWorkerC
     public event Action<string, string, string>? TaskQuestionAskedEvent;
     public event Action<string, string>? TaskQuestionResolvedEvent;
     public event Action<string, IReadOnlyList<string>, string>? HandoffRequestedEvent;
+    public event Action<string, IReadOnlyList<string>>? ListHandlerStartRequestedEvent;
+    public event Action<string, string>? HandlerUsageWarningEvent;
     public event Action? ConnectionRestoredEvent;
     public event Action<string>? WorktreeUpdatedEvent;
     public event Action<string>? ListUpdatedEvent;
@@ -159,6 +161,16 @@ public partial class WorkerClient : ObservableObject, IAsyncDisposable, IWorkerC
             Dispatcher.UIThread.Post(() => HandoffRequestedEvent?.Invoke(taskId, survivingTaskIds, nextPhase));
         });
 
+        _hub.On<string, IReadOnlyList<string>>("ListHandlerStartRequested", (listId, taskIds) =>
+        {
+            Dispatcher.UIThread.Post(() => ListHandlerStartRequestedEvent?.Invoke(listId, taskIds));
+        });
+
+        _hub.On<string, string>("HandlerUsageWarning", (taskId, message) =>
+        {
+            Dispatcher.UIThread.Post(() => HandlerUsageWarningEvent?.Invoke(taskId, message));
+        });
+
         _hub.On<string>("WorktreeUpdated", taskId =>
         {
             Dispatcher.UIThread.Post(() => WorktreeUpdatedEvent?.Invoke(taskId));
@@ -626,6 +638,12 @@ public partial class WorkerClient : ObservableObject, IAsyncDisposable, IWorkerC
         string taskId, IReadOnlyList<string> survivingTaskIds, string nextPhase, CancellationToken ct = default)
         => await InvokeTimedAsync<LaunchSpec>("GetMergeHelperHandoffLaunchSpec", () => _hub.InvokeAsync<LaunchSpec>("GetMergeHelperHandoffLaunchSpec", taskId, survivingTaskIds, nextPhase, ct));
 
+    public Task ReportInteractiveSessionExitedAsync(string taskId, int exitCode, CancellationToken ct = default)
+        => InvokeTimedAsync("ReportInteractiveSessionExited", () => _hub.InvokeAsync("ReportInteractiveSessionExited", taskId, exitCode, ct));
+
+    public async Task<IReadOnlyList<HandlerOpenTaskDto>> GetHandlerOpenTasksAsync(string handlerTaskId, CancellationToken ct = default)
+        => await InvokeTimedAsync<List<HandlerOpenTaskDto>>("GetHandlerOpenTasks", () => _hub.InvokeAsync<List<HandlerOpenTaskDto>>("GetHandlerOpenTasks", handlerTaskId, ct));
+
     public async Task<LaunchSpec> GetPlanningStartLaunchSpecAsync(string taskId, CancellationToken ct = default)
         => await InvokeTimedAsync<LaunchSpec>("GetPlanningStartLaunchSpec", () => _hub.InvokeAsync<LaunchSpec>("GetPlanningStartLaunchSpec", taskId, ct));
 

src/ClaudeDo.Ui/ViewModels/Agent/AgentConfigEditorViewModel.cs

@@ -236,6 +236,10 @@ public sealed partial class AgentConfigEditorViewModel : ViewModelBase, IDisposa
         return names.Count == 0 ? null : names;
     }
 
+    // The list_config row fetched by the most recent LoadForListAsync — exposed so a caller that
+    // needs the same row (ListSettingsModalViewModel) can reuse it instead of fetching it again.
+    public ListConfigDto? LastLoadedListConfig { get; private set; }
+
     public async System.Threading.Tasks.Task LoadForListAsync(string listId, CancellationToken ct = default)
     {
         _suppressSave = true;
@@ -246,6 +250,7 @@ public sealed partial class AgentConfigEditorViewModel : ViewModelBase, IDisposa
             await LoadGlobalDefaultsAsync();
 
             var cfg = await _worker.GetListConfigAsync(listId);
+            LastLoadedListConfig = cfg;
             ApplyConfig(cfg?.Model, cfg?.MaxTurns, cfg?.SystemPrompt, cfg?.AgentPath, cfg?.PermissionMode);
             await ReloadSessionSkillsAsync(cfg?.SessionSkills);
 

src/ClaudeDo.Ui/ViewModels/InteractiveTerminalViewModel.cs

@@ -96,6 +96,13 @@ public sealed partial class InteractiveTerminalViewModel : ViewModelBase, IDispo
         }
     }
 
+    /// <summary>Raised when the process died non-zero *after* clearing <see cref="StartupGraceWindow"/> —
+    /// i.e. a session that ran, then broke. That used to be a silent dead tile with no signal at all;
+    /// the worker turns it into a usage-limit auto-restart for list-handler sessions
+    /// (<c>HandlerRestartCoordinator</c>). A startup death keeps using <see cref="StartError"/> instead:
+    /// it never reached a state worth resuming.</summary>
+    public event Action<int>? ExitedAfterStartup;
+
     /// <summary>Internal (not private) so tests can drive it directly without a real ConPTY spawn.</summary>
     internal void OnSessionProcessExited(object? sender, int exitCode)
     {
@@ -103,11 +110,16 @@ public sealed partial class InteractiveTerminalViewModel : ViewModelBase, IDispo
         HasExited = true;
         ExitCode = exitCode;
 
+        if (exitCode == 0) return;
+        if (_startedAtUtc is not { } startedAt) return; // never reached "running" — nothing ran to resume
+
         // Died at startup: route through the same banner as a launch-time failure instead of
         // leaving a dead terminal with no Retry affordance (ConPtyPaneViewModel.CanRetry
         // requires StartError).
-        if (exitCode != 0 && _startedAtUtc is { } startedAt && _utcNow() - startedAt < StartupGraceWindow)
+        if (_utcNow() - startedAt < StartupGraceWindow)
             StartError = $"Session exited immediately (code {exitCode}).";
+        else
+            ExitedAfterStartup?.Invoke(exitCode);
     }
 
     /// <summary>Reports a failure that happened before <see cref="Start"/> could be called (e.g. the
@@ -119,6 +131,11 @@ public sealed partial class InteractiveTerminalViewModel : ViewModelBase, IDispo
         StartError = message;
     }
 
+    /// <summary>Types a line into the live session and submits it — see
+    /// <see cref="PtyTerminalSession.SendLineAsync"/>. False when there is no running process to
+    /// type into (or the write seam is gone).</summary>
+    public Task<bool> SendLineAsync(string text) => _session.SendLineAsync(text);
+
     public void Kill() => _session.Kill();
 
     public void Dispose()

src/ClaudeDo.Ui/ViewModels/Islands/ListsIslandViewModel.cs

@@ -58,7 +58,8 @@ public sealed partial class ListsIslandViewModel : ViewModelBase, IDisposable
         if (row is null || Dialogs is null || _services is null) return;
         var rawId = row.Id.StartsWith("user:", StringComparison.Ordinal) ? row.Id["user:".Length..] : row.Id;
         var vm = _services.GetRequiredService<ListSettingsModalViewModel>();
-        await vm.LoadAsync(rawId, row.Name, row.WorkingDir, row.DefaultCommitType, row.IsManual, row.FindingsTracked, row.IconKey);
+        vm.ErrorReported += msg => ErrorReported?.Invoke(msg);
+        vm.BeginLoad(rawId, row.Name, row.WorkingDir, row.DefaultCommitType, row.IsManual, row.FindingsTracked, row.IconKey);
         await Dialogs.ShowListSettingsAsync(vm);
         if (vm.Deleted) await LoadAsync();
         else await RefreshRowAsync(row.Id);
@@ -408,7 +409,8 @@ public sealed partial class ListsIslandViewModel : ViewModelBase, IDisposable
         if (Dialogs is not null && _services is not null)
         {
             var vm = _services.GetRequiredService<ListSettingsModalViewModel>();
-            await vm.LoadAsync(entity.Id, entity.Name, entity.WorkingDir, entity.DefaultCommitType, entity.IsManual, entity.FindingsTracked, entity.Icon);
+            vm.ErrorReported += msg => ErrorReported?.Invoke(msg);
+            vm.BeginLoad(entity.Id, entity.Name, entity.WorkingDir, entity.DefaultCommitType, entity.IsManual, entity.FindingsTracked, entity.Icon);
             await Dialogs.ShowListSettingsAsync(vm);
             if (!vm.Saved && !vm.Deleted)
             {

src/ClaudeDo.Ui/ViewModels/Islands/TaskRowViewModel.cs

@@ -112,6 +112,7 @@ public sealed partial class TaskRowViewModel : ViewModelBase
     [NotifyPropertyChangedFor(nameof(IsQueued))]
     [NotifyPropertyChangedFor(nameof(IsWaiting))]
     [NotifyPropertyChangedFor(nameof(StatusChipClass))]
+    [NotifyPropertyChangedFor(nameof(CanRemoveFromQueue))]
     private string? _blockedByTaskId;
     [ObservableProperty]
     [NotifyPropertyChangedFor(nameof(DependsOnTaskId))]
@@ -276,7 +277,7 @@ public sealed partial class TaskRowViewModel : ViewModelBase
                                && !HasInteractiveSession;
     public bool IsQueued    => Status == TaskStatus.Queued && string.IsNullOrEmpty(BlockedByTaskId);
     public bool IsWaiting   => Status == TaskStatus.Queued && !string.IsNullOrEmpty(BlockedByTaskId);
-    public bool CanRemoveFromQueue => IsQueued || HasQueuedSubtasks;
+    public bool CanRemoveFromQueue => IsQueued || IsWaiting || HasQueuedSubtasks;
     // "Send to queue" is the single queue entry. On a finalized planning parent it queues the
     // plan (children) via CanQueuePlan; an Active (not-yet-finalized) planning parent is hidden —
     // it must be finalized first. The worker never sees a UI-hosted ConPTY session (it never

src/ClaudeDo.Ui/ViewModels/IslandsShellViewModel.cs

@@ -329,6 +329,7 @@ public sealed partial class IslandsShellViewModel : ViewModelBase, IDisposable
         UsagePill.OpenMonitorRequested += () => _ = OpenUsageMonitor();
         MissionControl.OpenInApp = id => _ = RevealTaskAsync(id);
         MissionControl.OpenSettingsRequested = () => Lists.OpenSettingsCommand.Execute(null);
+        MissionControl.OpenRequested = OpenMissionControl;
         MissionControl.ErrorReported += FlashFooterError;
         // Keep the task rows' "Interactive" chip in step with Mission Control's open ConPTY panes.
         MissionControl.ConPtySessions.CollectionChanged += (_, _) => SyncInteractiveSessionChips();

src/ClaudeDo.Ui/ViewModels/MissionControl/ConPtyPaneViewModel.cs

@@ -18,6 +18,12 @@ public sealed partial class ConPtyPaneViewModel : ViewModelBase, IDisposable
     // Only a task-based pane can be submitted for review (an ad-hoc directory session has no task).
     public bool IsTaskBased => TaskId is not null;
 
+    /// <summary>Set by the host for a list-handler run ("Let Claude handle it" / "Let Claude merge
+    /// the reviews") pane -- shows the "Abandon run" action. Plain mutable property, not
+    /// <see cref="ObservableProperty"/>: the host sets it once right after construction, before the
+    /// pane is added to the visible collection, so no change notification is needed.</summary>
+    public bool IsListHandler { get; set; }
+
     [ObservableProperty] private string _displayTitle;
 
     [ObservableProperty] private InteractiveTerminalViewModel _terminal = new();
@@ -26,6 +32,10 @@ public sealed partial class ConPtyPaneViewModel : ViewModelBase, IDisposable
     /// flight, so a rapid double-click can't race two submissions for the same task.</summary>
     [ObservableProperty] private bool _isSubmitPending;
 
+    /// <summary>Set by the host while an abandon-run round trip (query open tasks, confirm,
+    /// cancel each, close pane) is in flight, so a rapid double-click can't race two runs.</summary>
+    [ObservableProperty] private bool _isAbandonPending;
+
     /// <summary>Raised when the terminal failed to start — the host surfaces this via the footer error strip.</summary>
     public event Action<string>? ErrorReported;
 
@@ -36,6 +46,18 @@ public sealed partial class ConPtyPaneViewModel : ViewModelBase, IDisposable
     /// commits the worktree and moves the task to WaitingForReview.</summary>
     public event Action<string>? SubmitForReviewRequested;
 
+    /// <summary>Raised when the user abandons a list-handler run (<see cref="IsListHandler"/>
+    /// only): the host looks up this round's still-open tasks, confirms with the user (naming the
+    /// count), cancels them, then closes this pane -- one action instead of closing the tile and
+    /// separately cancelling the queue.</summary>
+    public event Action<string>? AbandonRunRequested;
+
+    /// <summary>Raised with <c>(taskId, exitCode)</c> when a task-based session that had been running
+    /// dies non-zero. The host reports it to the worker, which decides whether this was a list
+    /// handler killed by the usage limit and worth reopening. Ad-hoc panes never raise it — there is
+    /// no task to reopen.</summary>
+    public event Action<string, int>? SessionDiedAfterStartup;
+
     /// <summary>Task-based pane — dedup'd by <see cref="TaskId"/>. Pass null for an ad-hoc pane
     /// (no task, never deduped); prefer <see cref="CreateAdHoc"/> at ad-hoc call sites.
     /// <paramref name="descriptorFactory"/> is resolved by the pane itself (in <see cref="Start"/>)
@@ -49,7 +71,34 @@ public sealed partial class ConPtyPaneViewModel : ViewModelBase, IDisposable
         TaskId = taskId;
         _displayTitle = displayTitle;
         _descriptorFactory = descriptorFactory;
-        Terminal.PropertyChanged += OnTerminalPropertyChanged;
+        Subscribe(Terminal);
+    }
+
+    // Terminal is swapped wholesale on Retry, so the handlers follow the property rather than being
+    // wired once at construction. (The initial value comes from the field initializer, which never
+    // runs through the setter -- hence the explicit Subscribe in the constructor.)
+    partial void OnTerminalChanging(InteractiveTerminalViewModel? oldValue, InteractiveTerminalViewModel newValue)
+    {
+        if (oldValue is not null) Unsubscribe(oldValue);
+    }
+
+    partial void OnTerminalChanged(InteractiveTerminalViewModel value) => Subscribe(value);
+
+    private void Subscribe(InteractiveTerminalViewModel terminal)
+    {
+        terminal.PropertyChanged += OnTerminalPropertyChanged;
+        terminal.ExitedAfterStartup += OnTerminalExitedAfterStartup;
+    }
+
+    private void Unsubscribe(InteractiveTerminalViewModel terminal)
+    {
+        terminal.PropertyChanged -= OnTerminalPropertyChanged;
+        terminal.ExitedAfterStartup -= OnTerminalExitedAfterStartup;
+    }
+
+    private void OnTerminalExitedAfterStartup(int exitCode)
+    {
+        if (TaskId is { } id) SessionDiedAfterStartup?.Invoke(id, exitCode);
     }
 
     private readonly Func<System.Threading.Tasks.Task<TerminalLaunchDescriptor>> _descriptorFactory;
@@ -90,6 +139,10 @@ public sealed partial class ConPtyPaneViewModel : ViewModelBase, IDisposable
         }
     }
 
+    /// <summary>Types a message into this pane's live session and submits it (the worker's
+    /// pre-usage-limit warning). False when the session isn't running.</summary>
+    public System.Threading.Tasks.Task<bool> SendLineAsync(string text) => Terminal.SendLineAsync(text);
+
     [RelayCommand]
     private void Close() => CloseRequested?.Invoke(this);
 
@@ -104,6 +157,16 @@ public sealed partial class ConPtyPaneViewModel : ViewModelBase, IDisposable
 
     partial void OnIsSubmitPendingChanged(bool value) => SubmitForReviewCommand.NotifyCanExecuteChanged();
 
+    private bool CanAbandonRun() => IsListHandler && !IsAbandonPending;
+
+    [RelayCommand(CanExecute = nameof(CanAbandonRun))]
+    private void AbandonRun()
+    {
+        if (TaskId is { } id) AbandonRunRequested?.Invoke(id);
+    }
+
+    partial void OnIsAbandonPendingChanged(bool value) => AbandonRunCommand.NotifyCanExecuteChanged();
+
     // A launch failure permanently occupies the TaskId dedupe slot unless the user can retry —
     // re-opening the same task would otherwise just re-focus a dead tile.
     private bool CanRetry() => Terminal.HasExited && Terminal.StartError is not null;
@@ -111,16 +174,15 @@ public sealed partial class ConPtyPaneViewModel : ViewModelBase, IDisposable
     [RelayCommand(CanExecute = nameof(CanRetry))]
     private void Retry()
     {
-        Terminal.PropertyChanged -= OnTerminalPropertyChanged;
-        Terminal.Dispose();
-        Terminal = new InteractiveTerminalViewModel();
-        Terminal.PropertyChanged += OnTerminalPropertyChanged;
+        var dead = Terminal;
+        Terminal = new InteractiveTerminalViewModel(); // OnTerminalChanging/Changed move the handlers
+        dead.Dispose();
         Start();
     }
 
     public void Dispose()
     {
-        Terminal.PropertyChanged -= OnTerminalPropertyChanged;
+        Unsubscribe(Terminal);
         Terminal.Kill();
         Terminal.Dispose();
     }

src/ClaudeDo.Ui/ViewModels/MissionControlViewModel.cs

@@ -21,6 +21,8 @@ public sealed partial class MissionControlViewModel : ViewModelBase, IDisposable
     private readonly Action<string> _onTaskUpdated;
     private readonly Action _onConnectionRestored;
     private readonly Action<string, IReadOnlyList<string>, string> _onHandoffRequested;
+    private readonly Action<string, IReadOnlyList<string>> _onListHandlerStartRequested;
+    private readonly Action<string, string> _onHandlerUsageWarning;
 
     // Embedded ConPTY sessions (task-based only) — a manual cockpit detached from the
     // review/merge/status machinery.
@@ -56,6 +58,11 @@ public sealed partial class MissionControlViewModel : ViewModelBase, IDisposable
     // View-layer seam: open the app Settings modal from the Mission Control window.
     public Action? OpenSettingsRequested { get; set; }
 
+    // Set by the shell: bring Mission Control on screen. A ConPTY pane only launches its process once
+    // its view is attached, so a run started from outside the UI (start_list_handler MCP tool) or a
+    // handoff arriving while Mission Control is closed would otherwise sit there without a process.
+    public Action? OpenRequested { get; set; }
+
     public bool HasPanes => Panes.Count > 0;
 
     // Read-only activity strip. Beyond the queue itself (Queued/Running) it also carries the rows
@@ -72,6 +79,10 @@ public sealed partial class MissionControlViewModel : ViewModelBase, IDisposable
     // MissionControlView.OnNewSessionClicked).
     public Action? BrowseForSessionRequested { get; set; }
 
+    // View-layer seam: confirms the "abandon run" action, naming the open-task count. Wired by the
+    // view the same way TasksIslandViewModel/DetailsIslandViewModel are.
+    public Func<string, System.Threading.Tasks.Task<bool>>? ConfirmAsync { get; set; }
+
     public UsagePillViewModel UsagePill { get; }
 
     public MissionControlViewModel(IDbContextFactory<ClaudeDoDbContext> dbFactory, IWorkerClient worker, UsagePillViewModel usagePill)
@@ -98,6 +109,11 @@ public sealed partial class MissionControlViewModel : ViewModelBase, IDisposable
         _onHandoffRequested = (taskId, survivingTaskIds, nextPhase) => { _ = OpenMergeHelperHandoffConPtySessionAsync(taskId, survivingTaskIds, nextPhase); };
         _worker.HandoffRequestedEvent += _onHandoffRequested;
 
+        _onListHandlerStartRequested = (listId, taskIds) => { OpenRequested?.Invoke(); _ = OpenMergeHelperConPtySessionAsync(listId, taskIds); };
+        _worker.ListHandlerStartRequestedEvent += _onListHandlerStartRequested;
+        _onHandlerUsageWarning = (taskId, message) => { _ = WarnHandlerSessionAsync(taskId, message); };
+        _worker.HandlerUsageWarningEvent += _onHandlerUsageWarning;
+
         _ = RefreshQueueAsync();
         _ = RefreshSessionTargetsAsync();
     }
@@ -363,7 +379,7 @@ public sealed partial class MissionControlViewModel : ViewModelBase, IDisposable
             }
 
             AddConPtyPane(new ConPtyPaneViewModel(taskId, title,
-                () => DescribeAsync(() => launchSpec(taskId))));
+                () => DescribeAsync(() => launchSpec(taskId))) { IsListHandler = true });
         }
         finally
         {
@@ -383,6 +399,7 @@ public sealed partial class MissionControlViewModel : ViewModelBase, IDisposable
         string taskId, IReadOnlyList<string> survivingTaskIds, string nextPhase)
     {
         if (string.IsNullOrEmpty(taskId) || survivingTaskIds is not { Count: > 0 }) return;
+        OpenRequested?.Invoke();
 
         foreach (var stale in ConPtySessions.Where(s => s.TaskId == taskId).ToList())
             CloseConPtySession(stale);
@@ -403,7 +420,21 @@ public sealed partial class MissionControlViewModel : ViewModelBase, IDisposable
         catch { /* best-effort title lookup */ }
 
         AddConPtyPane(new ConPtyPaneViewModel(taskId, title,
-            () => DescribeAsync(() => _worker.GetMergeHelperHandoffLaunchSpecAsync(taskId, survivingTaskIds, nextPhase))));
+            () => DescribeAsync(() => _worker.GetMergeHelperHandoffLaunchSpecAsync(taskId, survivingTaskIds, nextPhase)))
+            { IsListHandler = true });
+    }
+
+    // The 5h usage window is about to run out under this handler session: type the worker's warning
+    // into its pane so the session can hand off cleanly instead of dying mid-merge. The UI process
+    // owns the terminal, so this is the only place that can reach it at all. No pane (the tile was
+    // closed, or this is a second app instance) = nothing to warn, and that is not an error.
+    internal async System.Threading.Tasks.Task WarnHandlerSessionAsync(string taskId, string message)
+    {
+        if (string.IsNullOrEmpty(taskId) || string.IsNullOrEmpty(message)) return;
+        if (ConPtySessions.FirstOrDefault(s => s.TaskId == taskId) is not { } pane) return;
+
+        if (!await pane.SendLineAsync(message))
+            ErrorReported?.Invoke(Loc.T("missionControl.usageWarningNotDelivered"));
     }
 
     // Wires a freshly built pane and shows it immediately — the pane resolves its own launch spec,
@@ -413,10 +444,29 @@ public sealed partial class MissionControlViewModel : ViewModelBase, IDisposable
         pane.ErrorReported += OnConPtyPaneError;
         pane.CloseRequested += CloseConPtySession;
         pane.SubmitForReviewRequested += OnPaneSubmitForReview;
+        pane.SessionDiedAfterStartup += OnPaneSessionDied;
+        pane.AbandonRunRequested += OnPaneAbandonRun;
         ConPtySessions.Add(pane);
         pane.Start();
     }
 
+    // A ConPTY session that had been running died. The UI process owns the terminal, so this is the
+    // only place the exit code exists -- report it and let the worker decide whether it was a list
+    // handler killed by the usage limit and worth reopening after the reset
+    // (HandlerRestartCoordinator). Every other pane is just a no-op there, so no filtering here.
+    private async void OnPaneSessionDied(string taskId, int exitCode)
+    {
+        try
+        {
+            await _worker.ReportInteractiveSessionExitedAsync(taskId, exitCode);
+        }
+        catch (Exception ex)
+        {
+            // A worker that is down cannot restart anything anyway; the dead tile is already visible.
+            ErrorReported?.Invoke(Loc.T("missionControl.conptyLaunchFailed", ex.Message));
+        }
+    }
+
     private static async System.Threading.Tasks.Task<TerminalLaunchDescriptor> DescribeAsync(
         Func<System.Threading.Tasks.Task<LaunchSpec>> fetch)
     {
@@ -451,12 +501,49 @@ public sealed partial class MissionControlViewModel : ViewModelBase, IDisposable
         }
     }
 
+    // Handler-run abort ("Not-Aus"): cancels every still-open (Queued/Running) task this handler
+    // round queued or started, then closes the pane -- one action instead of "close tile" + "cancel
+    // the tasks separately", which used to leave orphaned rows nobody merges. No open tasks (or no
+    // round entry at all -- 7-day retention, or a run predating this feature) closes the pane
+    // straight away, no confirmation needed. Guarded by IsAbandonPending like OnPaneSubmitForReview.
+    private async void OnPaneAbandonRun(string taskId)
+    {
+        if (ConPtySessions.FirstOrDefault(s => s.TaskId == taskId) is not { } pane || pane.IsAbandonPending)
+            return;
+
+        pane.IsAbandonPending = true;
+        try
+        {
+            var open = await _worker.GetHandlerOpenTasksAsync(taskId);
+            if (open.Count > 0)
+            {
+                if (ConfirmAsync is null) return;
+                if (!await ConfirmAsync(Loc.T("missionControl.abandonRunConfirm", open.Count))) return;
+
+                foreach (var task in open)
+                    await _worker.CancelTaskAsync(task.Id);
+            }
+
+            CloseConPtySession(pane);
+        }
+        catch (Exception ex)
+        {
+            ErrorReported?.Invoke(Loc.T("missionControl.abandonRunFailed", ex.Message));
+        }
+        finally
+        {
+            pane.IsAbandonPending = false;
+        }
+    }
+
     private void CloseConPtySession(ConPtyPaneViewModel pane)
     {
         if (!ConPtySessions.Contains(pane)) return;
         pane.ErrorReported -= OnConPtyPaneError;
         pane.CloseRequested -= CloseConPtySession;
         pane.SubmitForReviewRequested -= OnPaneSubmitForReview;
+        pane.SessionDiedAfterStartup -= OnPaneSessionDied;
+        pane.AbandonRunRequested -= OnPaneAbandonRun;
         ConPtySessions.Remove(pane);
         pane.Dispose();
     }
@@ -500,6 +587,8 @@ public sealed partial class MissionControlViewModel : ViewModelBase, IDisposable
         _worker.TaskUpdatedEvent -= _onTaskUpdated;
         _worker.ConnectionRestoredEvent -= _onConnectionRestored;
         _worker.HandoffRequestedEvent -= _onHandoffRequested;
+        _worker.ListHandlerStartRequestedEvent -= _onListHandlerStartRequested;
+        _worker.HandlerUsageWarningEvent -= _onHandlerUsageWarning;
         ConPtySessions.CollectionChanged -= OnConPtySessionsChanged;
         Panes.CollectionChanged -= OnPanesChanged;
         foreach (var c in ConPtySessions.ToList())
@@ -507,6 +596,8 @@ public sealed partial class MissionControlViewModel : ViewModelBase, IDisposable
             c.ErrorReported -= OnConPtyPaneError;
             c.CloseRequested -= CloseConPtySession;
             c.SubmitForReviewRequested -= OnPaneSubmitForReview;
+            c.SessionDiedAfterStartup -= OnPaneSessionDied;
+            c.AbandonRunRequested -= OnPaneAbandonRun;
             c.Dispose();
         }
         ConPtySessions.Clear();

src/ClaudeDo.Ui/ViewModels/Modals/ListSettingsModalViewModel.cs

@@ -34,6 +34,9 @@ public sealed partial class ListSettingsModalViewModel : ViewModelBase
     public Func<string, Task<bool>>? ConfirmAsync { get; set; }
     public Func<string, Task>? ShowErrorAsync { get; set; }
 
+    // Mirrors UsageMonitorModalViewModel.ErrorReported — the caller wires this into FlashFooterError.
+    public event Action<string>? ErrorReported;
+
     [ObservableProperty] private string _name = "";
     [ObservableProperty] private string _workingDir = "";
     [ObservableProperty] private string _defaultCommitType = CommitTypeRegistry.DefaultType;
@@ -56,6 +59,25 @@ public sealed partial class ListSettingsModalViewModel : ViewModelBase
     [ObservableProperty] private TicketProjectOption? _selectedTicketProject;
     public ObservableCollection<TicketProjectOption> TicketProjects { get; } = new();
 
+    // Gates Save/Delete while the core fields (name/agent/verify command) are still loading, so a
+    // save can't land before they're populated and clobber the list_config row with blanks. Ticket
+    // projects load separately (see LoadTicketProjectsAsync) and are NOT covered by this — Save's
+    // own tri-state handles that case instead.
+    [ObservableProperty]
+    [NotifyCanExecuteChangedFor(nameof(SaveCommand))]
+    [NotifyCanExecuteChangedFor(nameof(DeleteCommand))]
+    private bool _isLoading;
+
+    // Set when the core load (name/agent/verify command) threw — keeps Save gated even after
+    // IsLoading resets to false in LoadAsync's finally, so a failed load can't clobber the
+    // stored config with blank fields.
+    private bool _loadFailed;
+
+    // True once GetTicketProjectsAsync has completed successfully for the current load — Save
+    // only writes an explicit TicketProjectId when this is true, so a slow/unreachable ticket
+    // system leaves the stored link untouched instead of wiping it to "none".
+    private bool _ticketProjectsLoaded;
+
     public ObservableCollection<string> CommitTypeOptions { get; } = new(CommitTypeRegistry.Types);
 
     public const string DefaultIcon = "Folder";
@@ -91,6 +113,19 @@ public sealed partial class ListSettingsModalViewModel : ViewModelBase
         Agent = new AgentConfigEditorViewModel(worker, AgentConfigScope.List);
     }
 
+    // Fires the load without blocking the caller, so the modal window can be shown right away
+    // instead of appearing only after seven serial hub round-trips (one of them a 10s-timeout
+    // ticket-system HTTP call) have finished — same pattern as UsageMonitorModalViewModel.BeginLoad.
+    public void BeginLoad(
+        string listId,
+        string name,
+        string? workingDir,
+        string defaultCommitType,
+        bool isManual = false,
+        bool findingsTracked = false,
+        string? icon = null)
+        => _ = LoadAsync(listId, name, workingDir, defaultCommitType, isManual, findingsTracked, icon);
+
     public async Task LoadAsync(
         string listId,
         string name,
@@ -101,43 +136,81 @@ public sealed partial class ListSettingsModalViewModel : ViewModelBase
         string? icon = null,
         CancellationToken ct = default)
     {
-        ListId = listId;
-        Name = name;
-        IsManual = isManual;
-        FindingsTracked = findingsTracked;
-        // An unknown/legacy key would leave the picker with no selection and silently reset the
-        // icon on the next save — fall back to the default instead.
-        Icon = IconOptions.Contains(icon) ? icon! : DefaultIcon;
-        WorkingDir = workingDir ?? "";
-        DefaultCommitType = string.IsNullOrWhiteSpace(defaultCommitType) ? CommitTypeRegistry.DefaultType : defaultCommitType;
-
-        await Agent.LoadForListAsync(listId, ct);
-        var cfg = await _worker.GetListConfigAsync(listId);
-        VerifyCommand = cfg?.VerifyCommand ?? "";
-        PowerUseAllowed = cfg?.PowerUseAllowed ?? false;
-
-        var ticketSettings = TicketSettingsTabViewModel.FeatureEnabled
-            ? await _worker.GetTicketSettingsAsync()
-            : null;
-        TicketsAvailable = !string.IsNullOrWhiteSpace(ticketSettings?.ApiBaseUrl);
-        TicketProjects.Clear();
-        if (TicketsAvailable)
+        ListConfigDto? cfg = null;
+        IsLoading = true;
+        _loadFailed = false;
+        try
         {
+            ListId = listId;
+            Name = name;
+            IsManual = isManual;
+            FindingsTracked = findingsTracked;
+            // An unknown/legacy key would leave the picker with no selection and silently reset the
+            // icon on the next save — fall back to the default instead.
+            Icon = IconOptions.Contains(icon) ? icon! : DefaultIcon;
+            WorkingDir = workingDir ?? "";
+            DefaultCommitType = string.IsNullOrWhiteSpace(defaultCommitType) ? CommitTypeRegistry.DefaultType : defaultCommitType;
+
+            await Agent.LoadForListAsync(listId, ct);
+            cfg = Agent.LastLoadedListConfig;
+            VerifyCommand = cfg?.VerifyCommand ?? "";
+            PowerUseAllowed = cfg?.PowerUseAllowed ?? false;
+        }
+        catch (Exception ex)
+        {
+            // BeginLoad fires this without awaiting it — catching here (instead of letting it
+            // propagate) turns what would be an unobserved task exception, with the modal stuck
+            // open and every field blank, into a reported error and a locked Save button.
+            _loadFailed = true;
+            ErrorReported?.Invoke(Loc.T("vm.listSettings.loadFailed", ex.Message));
+        }
+        finally { IsLoading = false; }
+
+        if (_loadFailed) return;
+
+        // Deliberately NOT awaited: an unreachable ticket system (10s HTTP timeout) must not hold
+        // up the rest of the modal. The dropdown just stays empty until this finishes.
+        _ = LoadTicketProjectsAsync(cfg?.TicketProjectId);
+    }
+
+    private async Task LoadTicketProjectsAsync(int? existingTicketProjectId)
+    {
+        _ticketProjectsLoaded = false;
+        TicketProjects.Clear();
+        try
+        {
+            var ticketSettings = TicketSettingsTabViewModel.FeatureEnabled
+                ? await _worker.GetTicketSettingsAsync()
+                : null;
+            TicketsAvailable = !string.IsNullOrWhiteSpace(ticketSettings?.ApiBaseUrl);
+            if (!TicketsAvailable)
+            {
+                SelectedTicketProject = null;
+                return;
+            }
+
             TicketProjects.Add(new TicketProjectOption(0, Loc.T("vm.listSettings.ticketProjectNone")));
             foreach (var p in await _worker.GetTicketProjectsAsync())
                 TicketProjects.Add(new TicketProjectOption(p.Id, $"{p.DepartmentName} / {p.Title}"));
 
-            SelectedTicketProject = cfg?.TicketProjectId is int id
+            SelectedTicketProject = existingTicketProjectId is int id
                 ? TicketProjects.FirstOrDefault(t => t.Id == id) ?? TicketProjects[0]
                 : TicketProjects[0];
+            _ticketProjectsLoaded = true;
         }
-        else
+        catch (Exception ex)
         {
-            SelectedTicketProject = null;
+            // Ticket system unreachable/slow — leave the dropdown as-is. Save's tri-state (below)
+            // skips writing TicketProjectId when _ticketProjectsLoaded is false, so the stored
+            // link survives instead of being wiped to "none".
+            ErrorReported?.Invoke(Loc.T("vm.listSettings.ticketProjectsLoadFailed", ex.Message));
         }
     }
 
-    [RelayCommand]
+    private bool CanSave() => !IsLoading && !_loadFailed;
+    private bool CanDelete() => !IsLoading;
+
+    [RelayCommand(CanExecute = nameof(CanSave))]
     private async Task SaveAsync()
     {
         await _worker.UpdateListAsync(new UpdateListDto(
@@ -149,10 +222,11 @@ public sealed partial class ListSettingsModalViewModel : ViewModelBase
             FindingsTracked,
             Icon));
 
-        // Tri-state: dropdown never shown (no base URL) -> null, leave the stored link alone.
-        // Dropdown shown -> always an explicit value, 0 for "— none —" to actively clear it.
-        // Never null here, or an explicit unlink would silently fail to reach the worker.
-        var ticketProjectId = TicketsAvailable ? (SelectedTicketProject?.Id ?? 0) : (int?)null;
+        // Tri-state: dropdown never shown (no base URL), or ticket projects failed/never loaded
+        // (e.g. an unreachable ticket system) -> null, leave the stored link alone. Dropdown shown
+        // and loaded -> always an explicit value, 0 for "— none —" to actively clear it. Never
+        // null in that case, or an explicit unlink would silently fail to reach the worker.
+        var ticketProjectId = TicketsAvailable && _ticketProjectsLoaded ? (SelectedTicketProject?.Id ?? 0) : (int?)null;
 
         // Always explicit (never null) — this modal owns the checkbox, so unchecking it has to reach
         // the worker as a real false rather than a "leave it alone".
@@ -165,7 +239,7 @@ public sealed partial class ListSettingsModalViewModel : ViewModelBase
         CloseAction?.Invoke();
     }
 
-    [RelayCommand]
+    [RelayCommand(CanExecute = nameof(CanDelete))]
     private async Task DeleteAsync()
     {
         var displayName = string.IsNullOrWhiteSpace(Name) ? Loc.T("vm.listSettings.untitled") : Name;

src/ClaudeDo.Ui/ViewModels/Modals/SettingsModalViewModel.cs

@@ -134,6 +134,10 @@ public sealed partial class SettingsModalViewModel : ViewModelBase
     // opening and saving Settings can't switch it off behind the user's back.
     private bool _powerUseEnabled;
 
+    // Ditto for the PowerUse time window and handoff threshold — usage-monitor-owned, invisible
+    // here, but they must survive a Settings save.
+    private (string? Start, string? End, int HandoffPct) _powerUseWindow = (null, null, 95);
+
     public async Task LoadAsync()
     {
         IsBusy = true;
@@ -156,6 +160,7 @@ public sealed partial class SettingsModalViewModel : ViewModelBase
                 // because SaveAsync rebuilds the whole DTO positionally and would otherwise write
                 // the record default (false) back and silently switch PowerUse off.
                 _powerUseEnabled = dto.PowerUseEnabled;
+                _powerUseWindow = (dto.PowerUseWindowStart, dto.PowerUseWindowEnd, dto.PowerUseHandoffPct);
                 _throttleStages = (
                     dto.UsageThrottleFiveHourSoftPct, dto.UsageThrottleFiveHourHardPct,
                     dto.UsageThrottleSevenDaySoftPct, dto.UsageThrottleSevenDayHardPct);
@@ -224,7 +229,10 @@ public sealed partial class SettingsModalViewModel : ViewModelBase
                 _throttleStages.SevenHard,
                 General.AutoContinueOnUsageLimit,
                 _powerUseEnabled,
-                General.ListHandlerMaxHandoffs);
+                General.ListHandlerMaxHandoffs,
+                _powerUseWindow.Start,
+                _powerUseWindow.End,
+                _powerUseWindow.HandoffPct);
             await _worker.UpdateAppSettingsAsync(dto);
             await Prime.SaveAsync();
             await OnlineInbox.SaveAsync();

src/ClaudeDo.Ui/ViewModels/Modals/UsageMonitorModalViewModel.cs

@@ -2,6 +2,7 @@ using System;
 using System.Collections.Generic;
 using System.Linq;
 using System.Threading.Tasks;
+using ClaudeDo.Data.Models;
 using ClaudeDo.Ui.Localization;
 using ClaudeDo.Ui.Services;
 using CommunityToolkit.Mvvm.ComponentModel;
@@ -108,6 +109,14 @@ public sealed partial class UsageMonitorModalViewModel : ViewModelBase
     /// </summary>
     [ObservableProperty] private bool _powerUseEnabled;
 
+    /// <summary>Optional local-time window (<c>HH:mm</c>) narrowing when PowerUse applies. Both
+    /// blank = round the clock. Committed on focus loss / Enter, not per keystroke.</summary>
+    [ObservableProperty] private string? _powerUseWindowStart;
+    [ObservableProperty] private string? _powerUseWindowEnd;
+
+    /// <summary>5h-usage percentage at which a PowerUse handler session should hand off.</summary>
+    [ObservableProperty] private int _powerUseHandoffPct = 95;
+
     // Set while LoadAsync writes the stored value in, so seeding the property doesn't immediately
     // write it straight back to the worker.
     private bool _loadingPowerUse;
@@ -115,13 +124,16 @@ public sealed partial class UsageMonitorModalViewModel : ViewModelBase
     partial void OnPowerUseEnabledChanged(bool value)
     {
         if (_loadingPowerUse) return;
-        _ = SavePowerUseAsync(value);
+        _ = SavePowerUse();
     }
 
     /// Read-modify-write, same discipline as SaveStagesAsync: never clobber a field this modal
-    /// doesn't own.
-    private async Task SavePowerUseAsync(bool value)
+    /// doesn't own. All four PowerUse fields go in one write, so committing one box can't drop a
+    /// value the user just typed into a sibling box.
+    [RelayCommand]
+    private async Task SavePowerUse()
     {
+        if (_loadingPowerUse) return;
         try
         {
             var settings = await _worker.GetAppSettingsAsync();
@@ -131,7 +143,28 @@ public sealed partial class UsageMonitorModalViewModel : ViewModelBase
                 return;
             }
 
-            await _worker.UpdateAppSettingsAsync(settings with { PowerUseEnabled = value });
+            // The worker stores an unparseable time as null; normalize here too so the box shows
+            // what was actually saved instead of a typo that looks like a live window.
+            var start = PowerUseWindow.Normalize(PowerUseWindowStart);
+            var end = PowerUseWindow.Normalize(PowerUseWindowEnd);
+            var pct = Math.Clamp(PowerUseHandoffPct, 50, 99);
+
+            await _worker.UpdateAppSettingsAsync(settings with
+            {
+                PowerUseEnabled = PowerUseEnabled,
+                PowerUseWindowStart = start,
+                PowerUseWindowEnd = end,
+                PowerUseHandoffPct = pct,
+            });
+
+            _loadingPowerUse = true;
+            try
+            {
+                PowerUseWindowStart = start;
+                PowerUseWindowEnd = end;
+                PowerUseHandoffPct = pct;
+            }
+            finally { _loadingPowerUse = false; }
         }
         catch (Exception ex)
         {
@@ -192,7 +225,13 @@ public sealed partial class UsageMonitorModalViewModel : ViewModelBase
             if (settings is not null)
             {
                 _loadingPowerUse = true;
-                try { PowerUseEnabled = settings.PowerUseEnabled; }
+                try
+                {
+                    PowerUseEnabled = settings.PowerUseEnabled;
+                    PowerUseWindowStart = settings.PowerUseWindowStart;
+                    PowerUseWindowEnd = settings.PowerUseWindowEnd;
+                    PowerUseHandoffPct = settings.PowerUseHandoffPct;
+                }
                 finally { _loadingPowerUse = false; }
             }
 

src/ClaudeDo.Ui/Views/MissionControl/ConPtyPaneView.axaml

@@ -14,7 +14,7 @@
               Background="{DynamicResource Surface2Brush}"
               BorderBrush="{DynamicResource LineBrush}"
               BorderThickness="0,0,0,1" Padding="8,3">
-        <Grid ColumnDefinitions="*,Auto,Auto">
+        <Grid ColumnDefinitions="*,Auto,Auto,Auto">
           <TextBlock Grid.Column="0" Classes="meta" Text="{Binding DisplayTitle}"
                      TextTrimming="CharacterEllipsis"
                      ToolTip.Tip="{Binding DisplayTitle}"
@@ -25,7 +25,12 @@
                   Content="{loc:Tr missionControl.submitForReview}"
                   ToolTip.Tip="{loc:Tr missionControl.submitForReviewTip}"
                   Command="{Binding SubmitForReviewCommand}" />
-          <Button Grid.Column="2" Classes="title-ctrl"
+          <Button Grid.Column="2" Classes="btn" Margin="0,0,6,0"
+                  IsVisible="{Binding IsListHandler}"
+                  Content="{loc:Tr missionControl.abandonRun}"
+                  ToolTip.Tip="{loc:Tr missionControl.abandonRunTip}"
+                  Command="{Binding AbandonRunCommand}" />
+          <Button Grid.Column="3" Classes="title-ctrl"
                   Command="{Binding CloseCommand}"
                   ToolTip.Tip="{loc:Tr missionControl.closeSession}">
             <PathIcon Data="{StaticResource Icon.WinClose}" Width="12" Height="12"/>

src/ClaudeDo.Ui/Views/MissionControl/MissionControlView.axaml.cs

@@ -2,6 +2,7 @@ using System;
 using System.Collections.Specialized;
 using System.ComponentModel;
 using System.Linq;
+using Avalonia;
 using Avalonia.Controls;
 using Avalonia.Layout;
 using Avalonia.Media;
@@ -55,6 +56,7 @@ public partial class MissionControlView : UserControl
             _vm.Panes.CollectionChanged -= OnPanesChanged;
             _vm.PropertyChanged -= OnViewModelPropertyChanged;
             _vm.BrowseForSessionRequested = null;
+            _vm.ConfirmAsync = null;
         }
 
         _vm = DataContext as MissionControlViewModel;
@@ -64,12 +66,59 @@ public partial class MissionControlView : UserControl
             _vm.Panes.CollectionChanged += OnPanesChanged;
             _vm.PropertyChanged += OnViewModelPropertyChanged;
             _vm.BrowseForSessionRequested = BrowseForSessionAsync;
+            _vm.ConfirmAsync = ShowConfirmAsync;
         }
 
         RebuildOverviewGrid();
         UpdateQueueColumn();
     }
 
+    // Abandon-run confirmation -- same TaskCompletionSource-backed plain Window as
+    // TasksIslandView.ShowConfirmAsync (no shared control for this shape yet).
+    private async Task<bool> ShowConfirmAsync(string message)
+    {
+        var owner = TopLevel.GetTopLevel(this) as Window;
+        if (owner is null) return false;
+
+        var tcs = new TaskCompletionSource<bool>();
+        var cancel = new Button { Content = "Cancel", MinWidth = 90 };
+        var confirm = new Button { Content = "Confirm", MinWidth = 90, Classes = { "danger" } };
+
+        var dialog = new Window
+        {
+            Title = "Confirm",
+            Width = 380,
+            SizeToContent = SizeToContent.Height,
+            CanResize = false,
+            WindowStartupLocation = WindowStartupLocation.CenterOwner,
+            ShowInTaskbar = false,
+            Background = this.FindResource("SurfaceBrush") as IBrush,
+            Content = new StackPanel
+            {
+                Margin = new Thickness(20),
+                Spacing = 16,
+                Children =
+                {
+                    new TextBlock { Text = message, TextWrapping = TextWrapping.Wrap },
+                    new StackPanel
+                    {
+                        Orientation = Orientation.Horizontal,
+                        HorizontalAlignment = HorizontalAlignment.Right,
+                        Spacing = 8,
+                        Children = { cancel, confirm },
+                    },
+                },
+            },
+        };
+
+        cancel.Click += (_, _) => { tcs.TrySetResult(false); dialog.Close(); };
+        confirm.Click += (_, _) => { tcs.TrySetResult(true); dialog.Close(); };
+        dialog.Closed += (_, _) => tcs.TrySetResult(false);
+
+        _ = dialog.ShowDialog(owner);
+        return await tcs.Task;
+    }
+
     private void OnPanesChanged(object? sender, NotifyCollectionChangedEventArgs e) => RebuildOverviewGrid();
 
     private void OnViewModelPropertyChanged(object? sender, PropertyChangedEventArgs e)

src/ClaudeDo.Ui/Views/Modals/AboutModalView.axaml

@@ -17,8 +17,8 @@
 
   <ctl:ModalShell Title="{loc:Tr modals.about.title}" CloseCommand="{Binding CloseCommand}">
     <!-- Body -->
-    <ScrollViewer Padding="20,16" HorizontalScrollBarVisibility="Disabled">
-      <Grid RowDefinitions="Auto,Auto,Auto,Auto" ColumnDefinitions="90,*,Auto" RowSpacing="10" ColumnSpacing="8">
+    <ScrollViewer HorizontalScrollBarVisibility="Disabled">
+      <Grid Margin="20,16" RowDefinitions="Auto,Auto,Auto,Auto" ColumnDefinitions="90,*,Auto" RowSpacing="10" ColumnSpacing="8">
         <TextBlock Classes="meta" Grid.Row="0" Grid.Column="0" Text="{loc:Tr modals.about.version}" VerticalAlignment="Center"/>
         <TextBlock Classes="meta" Grid.Row="0" Grid.Column="1" Text="{Binding AppVersion}" VerticalAlignment="Center"/>
         <TextBlock Classes="meta" Grid.Row="1" Grid.Column="0" Text="{loc:Tr modals.about.data}" VerticalAlignment="Center"/>

src/ClaudeDo.Ui/Views/Modals/MergeHelperSelectionModal.axaml

@@ -44,8 +44,8 @@
         <TextBlock Grid.Column="3" Classes="eyebrow" Text="{loc:Tr modals.mergeHelper.columnStatus}"/>
       </Grid>
 
-      <ScrollViewer Padding="20,2,20,8">
-        <StackPanel>
+      <ScrollViewer>
+        <StackPanel Margin="20,2,20,8">
           <TextBlock Classes="meta" Margin="0,8"
                      Text="{loc:Tr modals.mergeHelper.empty}"
                      IsVisible="{Binding !HasTasks}"/>

src/ClaudeDo.Ui/Views/Modals/MergeModalView.axaml

@@ -39,8 +39,8 @@
     </ctl:ModalShell.Footer>
 
     <!-- Body -->
-    <ScrollViewer Padding="20,16">
-      <StackPanel Spacing="12">
+    <ScrollViewer>
+      <StackPanel Margin="20,16" Spacing="12">
 
         <TextBlock Classes="title" Text="{Binding TaskTitle, StringFormat='Merging: {0}'}" />
 

src/ClaudeDo.Ui/Views/Modals/RepoImportModalView.axaml

@@ -43,8 +43,8 @@
       </StackPanel>
 
       <!-- Repo checklist -->
-      <ScrollViewer Padding="20,2,20,8">
-        <ItemsControl ItemsSource="{Binding Repos}">
+      <ScrollViewer>
+        <ItemsControl Margin="20,2,20,8" ItemsSource="{Binding Repos}">
           <ItemsControl.ItemTemplate>
             <DataTemplate DataType="vm:RepoImportItemViewModel">
               <Grid ColumnDefinitions="Auto,Auto,*,Auto" Margin="0,1"

src/ClaudeDo.Ui/Views/Modals/UsageMonitorModalView.axaml

@@ -144,6 +144,29 @@
                     Content="{loc:Tr modals.usageMonitor.powerUse}"/>
           <TextBlock Classes="meta" TextWrapping="Wrap"
                      Text="{loc:Tr modals.usageMonitor.powerUseHint}"/>
+          <!-- Window + handoff threshold. Same commit-on-blur/Enter discipline as the gauge
+               legend boxes: a hub write per keystroke would be one save per typed digit. -->
+          <StackPanel Orientation="Horizontal" Spacing="8" Margin="0,6,0,0">
+            <TextBlock Classes="meta" VerticalAlignment="Center"
+                       Text="{loc:Tr modals.usageMonitor.powerUseWindow}"/>
+            <TextBox Width="70" FontSize="12" Padding="6,2"
+                     Watermark="{loc:Tr modals.usageMonitor.powerUseWindowPlaceholder}"
+                     Text="{Binding PowerUseWindowStart, Mode=TwoWay}"
+                     LostFocus="OnPowerUseBoxCommit" KeyDown="OnPowerUseBoxKeyDown"/>
+            <TextBlock Classes="meta" VerticalAlignment="Center" Text="–"/>
+            <TextBox Width="70" FontSize="12" Padding="6,2"
+                     Watermark="{loc:Tr modals.usageMonitor.powerUseWindowPlaceholder}"
+                     Text="{Binding PowerUseWindowEnd, Mode=TwoWay}"
+                     LostFocus="OnPowerUseBoxCommit" KeyDown="OnPowerUseBoxKeyDown"/>
+            <TextBlock Classes="meta" VerticalAlignment="Center" Margin="12,0,0,0"
+                       Text="{loc:Tr modals.usageMonitor.powerUseHandoffPct}"/>
+            <NumericUpDown Width="80" FontSize="12" Padding="6,2" ShowButtonSpinner="False"
+                           Minimum="50" Maximum="99" Increment="1" FormatString="0"
+                           Value="{Binding PowerUseHandoffPct, Mode=TwoWay, Converter={StaticResource KeepLastNumber}}"
+                           LostFocus="OnPowerUseBoxCommit" KeyDown="OnPowerUseBoxKeyDown"/>
+          </StackPanel>
+          <TextBlock Classes="meta" TextWrapping="Wrap" Opacity="0.75"
+                     Text="{loc:Tr modals.usageMonitor.powerUseWindowHint}"/>
         </StackPanel>
       </Border>
 

src/ClaudeDo.Ui/Views/Modals/UsageMonitorModalView.axaml.cs

@@ -33,4 +33,19 @@ public partial class UsageMonitorModalView : Window
         OnStageBoxCommit(sender, e);
         e.Handled = true;
     }
+
+    /// <summary>Persists the PowerUse window / handoff threshold on blur — a save per keystroke
+    /// would be one hub round-trip per typed digit.</summary>
+    private void OnPowerUseBoxCommit(object? sender, RoutedEventArgs e)
+    {
+        if (DataContext is not UsageMonitorModalViewModel vm) return;
+        if (vm.SavePowerUseCommand.CanExecute(null)) vm.SavePowerUseCommand.Execute(null);
+    }
+
+    private void OnPowerUseBoxKeyDown(object? sender, KeyEventArgs e)
+    {
+        if (e.Key != Key.Enter) return;
+        OnPowerUseBoxCommit(sender, e);
+        e.Handled = true;
+    }
 }

src/ClaudeDo.Ui/Views/Modals/WorktreesOverviewModalView.axaml

@@ -134,8 +134,8 @@
       </Border>
 
       <!-- Content -->
-      <ScrollViewer Padding="20,16">
-        <StackPanel>
+      <ScrollViewer>
+        <StackPanel Margin="20,16">
           <Border IsVisible="{Binding ConflictRows.Count}"
                   Background="{DynamicResource ErrorTintBrush}"
                   BorderBrush="{DynamicResource StatusErrorBrush}"

src/ClaudeDo.Worker/External/HandoffMcpTools.cs

@@ -11,7 +11,11 @@ namespace ClaudeDo.Worker.External;
 // Coerced=true means nextPhase asked for a non-final phase but the server-side round cap
 // (HandoffRoundTracker) forced it to its "_final" counterpart instead -- NextPhase already
 // reflects the effective (post-coercion) value in that case.
-public sealed record HandoffListHandlerResult(bool Requested, string TaskId, int Number, int SurvivingCount, string NextPhase, bool Coerced = false);
+// DeferredUntil set means the next session was NOT opened yet: the 5h usage window is exhausted and
+// the handoff is parked until it resets (HandlerUsageGuard).
+public sealed record HandoffListHandlerResult(
+    bool Requested, string TaskId, int Number, int SurvivingCount, string NextPhase, bool Coerced = false,
+    DateTimeOffset? DeferredUntil = null);
 
 public sealed record HandoffStatusResult(string TaskId, int Number, int Round, int Remaining, bool Final);
 
@@ -22,17 +26,20 @@ public sealed class HandoffMcpTools
     private readonly HubBroadcaster _broadcaster;
     private readonly HandoffRoundTracker _rounds;
     private readonly IDbContextFactory<ClaudeDoDbContext> _dbFactory;
+    private readonly HandlerUsageGuard _usageGuard;
 
     public HandoffMcpTools(
         TaskRepository tasks,
         HubBroadcaster broadcaster,
         HandoffRoundTracker rounds,
-        IDbContextFactory<ClaudeDoDbContext> dbFactory)
+        IDbContextFactory<ClaudeDoDbContext> dbFactory,
+        HandlerUsageGuard usageGuard)
     {
         _tasks = tasks;
         _broadcaster = broadcaster;
         _rounds = rounds;
         _dbFactory = dbFactory;
+        _usageGuard = usageGuard;
     }
 
     [McpServerTool, Description(
@@ -47,8 +54,10 @@ public sealed class HandoffMcpTools
         "4 by default, i.e. two " +
         "full wait/merge cycles) for a given handler task: once reached, a \"wait\"/\"merge\" request is " +
         "silently coerced to its \"_final\" counterpart instead (check the result's coerced field), and " +
-        "any handoff at all after a merge_final round for this task throws. The current tile stays " +
-        "open; you must end your own turn immediately after calling this.")]
+        "any handoff at all after a merge_final round for this task throws. If the 5h usage window is " +
+        "already exhausted the next session is NOT opened right away -- the handoff is parked until " +
+        "the window resets and the result carries deferredUntil; say so in your summary. The current " +
+        "tile stays open; you must end your own turn immediately after calling this either way.")]
     public async Task<HandoffListHandlerResult> HandoffListHandler(
         [Description("This session's own handler task id.")] string taskId,
         [Description("The tasks that made it past dedupe, in the order to run them.")] IReadOnlyList<string> survivingTaskIds,
@@ -77,8 +86,15 @@ public sealed class HandoffMcpTools
         if (round.Rejected)
             throw new InvalidOperationException(round.Error);
 
-        await _broadcaster.HandoffRequested(taskId, survivingTaskIds, round.EffectivePhase);
-        return new HandoffListHandlerResult(true, taskId, task.Number, survivingTaskIds.Count, round.EffectivePhase, round.Coerced);
+        // The round is registered either way (the budget is spent by asking, not by the tile
+        // opening); only the broadcast waits when the 5h window is exhausted.
+        var deferredUntil = await _usageGuard.TryDeferHandoffAsync(
+            taskId, survivingTaskIds, round.EffectivePhase, cancellationToken);
+        if (deferredUntil is null)
+            await _broadcaster.HandoffRequested(taskId, survivingTaskIds, round.EffectivePhase);
+
+        return new HandoffListHandlerResult(
+            true, taskId, task.Number, survivingTaskIds.Count, round.EffectivePhase, round.Coerced, deferredUntil);
     }
 
     [McpServerTool, Description(

src/ClaudeDo.Worker/External/ListHandlerMcpTools.cs

@@ -0,0 +1,72 @@
+using System.ComponentModel;
+using ClaudeDo.Data.Models;
+using ClaudeDo.Data.Repositories;
+using ClaudeDo.Worker.Hub;
+using ModelContextProtocol.Server;
+using TaskStatus = ClaudeDo.Data.Models.TaskStatus;
+
+namespace ClaudeDo.Worker.External;
+
+public sealed record StartListHandlerResult(bool Requested, string ListId, string ListName, int TaskCount, IReadOnlyList<int> TaskNumbers);
+
+// The "Let Claude handle it" button, reachable from outside the UI. The worker only broadcasts;
+// the App owns the ConPTY tile and creates the handler task exactly as the button does
+// (MissionControlViewModel.OpenMergeHelperConPtySessionAsync), so there is one code path for
+// starting a run, not two. Without a connected App nothing happens -- the result says so.
+[McpServerToolType]
+public sealed class ListHandlerMcpTools
+{
+    private readonly ListRepository _lists;
+    private readonly TaskRepository _tasks;
+    private readonly HubBroadcaster _broadcaster;
+
+    public ListHandlerMcpTools(ListRepository lists, TaskRepository tasks, HubBroadcaster broadcaster)
+    {
+        _lists = lists;
+        _tasks = tasks;
+        _broadcaster = broadcaster;
+    }
+
+    [McpServerTool, Description(
+        "Start a list-handler run (\"Let Claude handle it\") for a list, exactly like the button in " +
+        "Mission Control: the connected ClaudeDo App creates the handler task and opens the triage " +
+        "ConPTY tile for the given tasks. taskIds defaults to every Idle, non-manual task of the list. " +
+        "Requires the App to be running and connected to this worker -- the worker only broadcasts " +
+        "the request. taskIds accept task numbers (#123 or bare 123).")]
+    public async Task<StartListHandlerResult> StartListHandler(
+        [Description("The list to run the handler on.")] string listId,
+        [Description("Tasks to hand to the run, in the order to triage them. Omit for all Idle, non-manual tasks of the list.")] IReadOnlyList<string>? taskIds = null,
+        CancellationToken cancellationToken = default)
+    {
+        var list = await _lists.GetByIdAsync(listId, cancellationToken)
+            ?? throw new InvalidOperationException($"List {listId} not found.");
+
+        var listTasks = await _tasks.GetByListIdAsync(listId, cancellationToken);
+        List<TaskEntity> chosen;
+        if (taskIds is { Count: > 0 })
+        {
+            var resolved = await TaskIdResolver.ResolveManyAsync(_tasks, taskIds, cancellationToken);
+            chosen = new List<TaskEntity>();
+            foreach (var id in resolved)
+            {
+                var t = listTasks.FirstOrDefault(x => x.Id == id)
+                    ?? throw new InvalidOperationException($"Task {id} not found in list {list.Name}.");
+                chosen.Add(t);
+            }
+        }
+        else
+        {
+            chosen = listTasks
+                .Where(t => t.Status == TaskStatus.Idle && !t.IsManual && t.ParentTaskId is null)
+                .OrderBy(t => t.SortOrder)
+                .ToList();
+        }
+
+        if (chosen.Count == 0)
+            throw new InvalidOperationException($"No tasks to hand to the list handler for {list.Name}.");
+
+        var ids = chosen.Select(t => t.Id).ToList();
+        await _broadcaster.ListHandlerStartRequested(listId, ids);
+        return new StartListHandlerResult(true, listId, list.Name, ids.Count, chosen.Select(t => t.Number).ToList());
+    }
+}

src/ClaudeDo.Worker/Hub/HubBroadcaster.cs

@@ -37,6 +37,16 @@ public sealed class HubBroadcaster : IPrimeBroadcaster, IRefineBroadcaster
     public Task HandoffRequested(string taskId, IReadOnlyList<string> survivingTaskIds, string nextPhase) =>
         _hub.Clients.All.SendAsync("HandoffRequested", taskId, survivingTaskIds, nextPhase);
 
+    // start_list_handler (External MCP) -- the App creates the handler task and opens the triage
+    // tile, exactly like the "Let Claude handle it" button.
+    public Task ListHandlerStartRequested(string listId, IReadOnlyList<string> taskIds) =>
+        _hub.Clients.All.SendAsync("ListHandlerStartRequested", listId, taskIds);
+    // The 5h usage window is about to run out under a running list-handler session (HandlerUsageGuard).
+    // Mission Control types `message` straight into that task's ConPTY pane, so the session can hand
+    // off cleanly instead of dying mid-merge. No pane for the task = nothing happens.
+    public Task HandlerUsageWarning(string handlerTaskId, string message) =>
+        _hub.Clients.All.SendAsync("HandlerUsageWarning", handlerTaskId, message);
+
     /// <summary>An agent wrote a note through MCP — the open notes editor reloads.</summary>
     public Task NotesUpdated() =>
         _hub.Clients.All.SendAsync("NotesUpdated");

src/ClaudeDo.Worker/Hub/WorkerHub.cs

@@ -72,6 +72,8 @@ public sealed class WorkerHub : Microsoft.AspNetCore.SignalR.Hub
     private readonly TicketPatStore _ticketPat;
     private readonly TicketClientFactory _ticketClients;
     private readonly TicketImportService _ticketImport;
+    private readonly HandlerRestartCoordinator? _handlerRestart;
+    private readonly HandlerRoundState? _roundState;
 
     public WorkerHub(
         QueueService queue,
@@ -110,7 +112,9 @@ public sealed class WorkerHub : Microsoft.AspNetCore.SignalR.Hub
         TicketSystemConfig ticketConfig = null!,
         TicketPatStore ticketPat = null!,
         TicketClientFactory ticketClients = null!,
-        TicketImportService ticketImport = null!)
+        TicketImportService ticketImport = null!,
+        HandlerRestartCoordinator? handlerRestart = null,
+        HandlerRoundState? roundState = null)
     {
         _queue = queue;
         _waker = waker;
@@ -149,6 +153,8 @@ public sealed class WorkerHub : Microsoft.AspNetCore.SignalR.Hub
         _ticketPat = ticketPat;
         _ticketClients = ticketClients;
         _ticketImport = ticketImport;
+        _handlerRestart = handlerRestart;
+        _roundState = roundState;
     }
 
     // Persistence boundary for the session_skills JSON-array columns (task/list/global).
@@ -323,7 +329,10 @@ public sealed class WorkerHub : Microsoft.AspNetCore.SignalR.Hub
             row.UsageThrottleSevenDayHardPct,
             row.AutoContinueOnUsageLimit,
             row.PowerUseEnabled,
-            row.ListHandlerMaxHandoffs);
+            row.ListHandlerMaxHandoffs,
+            row.PowerUseWindowStart,
+            row.PowerUseWindowEnd,
+            row.PowerUseHandoffPct);
     }
 
     public async Task UpdateAppSettings(AppSettingsDto dto)
@@ -363,6 +372,12 @@ public sealed class WorkerHub : Microsoft.AspNetCore.SignalR.Hub
             // The cap is what bounds a runaway handoff loop; a 0 from a stale or hand-written
             // client would remove that bound entirely, so clamp instead of trusting the wire value.
             ListHandlerMaxHandoffs = Math.Max(1, dto.ListHandlerMaxHandoffs),
+            // An unparseable time string is stored as null (= no window) rather than rejected: the
+            // window is an optional narrowing, and a typo must not silently mean "PowerUse never
+            // applies". Below 50% a handoff threshold would fire before the session got anywhere.
+            PowerUseWindowStart = PowerUseWindow.Normalize(dto.PowerUseWindowStart),
+            PowerUseWindowEnd = PowerUseWindow.Normalize(dto.PowerUseWindowEnd),
+            PowerUseHandoffPct = Math.Clamp(dto.PowerUseHandoffPct, 50, 99),
         });
     }
 
@@ -786,6 +801,36 @@ public sealed class WorkerHub : Microsoft.AspNetCore.SignalR.Hub
         return _interactiveLaunchSpec.BuildForMergeHelperHandoffAsync(taskId, survivingTaskIds, nextPhase, Context.ConnectionAborted);
     });
 
+    // Reports that an embedded ConPTY session's process exited. Only the UI process owns the
+    // terminal, so the exit code exists nowhere else; every decision about it (was this a list
+    // handler, did the usage limit kill it, is PowerUse on, when does the window reset) belongs to
+    // HandlerRestartCoordinator. Fire-and-forget on purpose: the coordinator's task stays parked
+    // until the 5h reset, which is far longer than this connection or this hub instance lives, so
+    // it must not run under Context.ConnectionAborted either.
+    public void ReportInteractiveSessionExited(string taskId, int exitCode)
+    {
+        if (_handlerRestart is null) return;
+        _ = _handlerRestart.OnSessionExitedAsync(taskId, exitCode, CancellationToken.None);
+    }
+
+    // The Mission Control "abandon run" action: what a handler round queued/started that is still
+    // open (Queued or Running), read from the structured HandlerRoundState store rather than
+    // parsed out of the handler task's description. Empty when there is no round entry (7-day
+    // retention, or a run from before this feature) or the round has no open tasks -- the caller
+    // treats both as "nothing to confirm, just close the pane".
+    public async Task<IReadOnlyList<HandlerOpenTaskDto>> GetHandlerOpenTasks(string handlerTaskId)
+    {
+        var round = _roundState?.Get(handlerTaskId);
+        if (round is not { TaskIds.Count: > 0 }) return Array.Empty<HandlerOpenTaskDto>();
+
+        await using var ctx = await _dbFactory.CreateDbContextAsync();
+        return await ctx.Tasks.AsNoTracking()
+            .Where(t => round.TaskIds.Contains(t.Id)
+                     && (t.Status == TaskStatus.Queued || t.Status == TaskStatus.Running))
+            .Select(t => new HandlerOpenTaskDto(t.Id, t.Title))
+            .ToListAsync();
+    }
+
     // Starts a planning session (worktree + prompt files + token, task -> Planning) and returns
     // the launch spec for an embedded ConPTY planning terminal -- the ConPTY replacement for
     // StartPlanningSessionAsync's external wt window. On any spec-build failure the just-started

src/ClaudeDo.Worker/Program.cs

@@ -78,10 +78,14 @@ builder.Services.AddHostedService<AttachmentOrphanRecovery>();
 builder.Services.AddHostedService<PromptFileRecovery>();
 builder.Services.AddHostedService<LegacyWorktreeFolderRecovery>();
 builder.Services.AddHostedService<UntrackedWorktreeRecovery>();
-builder.Services.AddSignalR().AddJsonProtocol(options =>
-{
-    options.PayloadSerializerOptions.Converters.Add(new System.Text.Json.Serialization.JsonStringEnumConverter());
-});
+// Default MaximumParallelInvocationsPerClient=1 serializes every hub call on one connection —
+// a slow one (e.g. GetTicketProjects hitting an unreachable ticket system) blocks unrelated
+// calls like UpdateList/UpdateListConfig behind it for the same 10s.
+builder.Services.AddSignalR(options => options.MaximumParallelInvocationsPerClient = 10)
+    .AddJsonProtocol(options =>
+    {
+        options.PayloadSerializerOptions.Converters.Add(new System.Text.Json.Serialization.JsonStringEnumConverter());
+    });
 
 // Runner stack.
 builder.Services.AddSingleton<IClaudeProcess, ClaudeProcess>();
@@ -95,6 +99,10 @@ builder.Services.AddSingleton<IRepoCloner, GitRepoCloner>();
 builder.Services.AddSingleton<ISessionSkillRegistry, SessionSkillRegistry>();
 builder.Services.AddSingleton<ISessionSkillSeeder, SessionSkillSeeder>();
 builder.Services.AddSingleton<HandoffRoundTracker>();
+builder.Services.AddSingleton<HandlerRoundState>();
+builder.Services.AddSingleton<HandlerRestartCoordinator>();
+builder.Services.AddSingleton<HandlerUsageGuard>();
+builder.Services.AddHostedService(sp => sp.GetRequiredService<HandlerUsageGuard>());
 builder.Services.AddSingleton<InteractiveLaunchSpecService>();
 builder.Services.AddSingleton<TaskRunner>();
 builder.Services.AddSingleton<WorktreeMaintenanceService>();
@@ -337,6 +345,7 @@ if (cfg.ExternalMcpPort > 0)
     Share<AttachmentStore>();
     Share<FindingsStore>();
     Share<HandoffRoundTracker>();
+    Share<HandlerUsageGuard>();
 
     externalBuilder.Services.AddScoped<ClaudeDoDbContext>(sp =>
         sp.GetRequiredService<IDbContextFactory<ClaudeDoDbContext>>().CreateDbContext());
@@ -355,6 +364,7 @@ if (cfg.ExternalMcpPort > 0)
     externalBuilder.Services.AddScoped<AgentMcpTools>();
     externalBuilder.Services.AddScoped<LifecycleMcpTools>();
     externalBuilder.Services.AddScoped<HandoffMcpTools>();
+    externalBuilder.Services.AddScoped<ListHandlerMcpTools>();
     externalBuilder.Services.AddScoped<AppSettingsMcpTools>();
     externalBuilder.Services.AddScoped<TaskWaitMcpTools>();
     externalBuilder.Services.AddScoped<QueueStateMcpTools>();
@@ -375,6 +385,7 @@ if (cfg.ExternalMcpPort > 0)
         .WithTools<AgentMcpTools>()
         .WithTools<LifecycleMcpTools>()
         .WithTools<HandoffMcpTools>()
+        .WithTools<ListHandlerMcpTools>()
         .WithTools<AppSettingsMcpTools>()
         .WithTools<TaskWaitMcpTools>()
         .WithTools<QueueStateMcpTools>()

src/ClaudeDo.Worker/Runner/HandlerRestartCoordinator.cs

@@ -0,0 +1,120 @@
+using ClaudeDo.Data;
+using ClaudeDo.Data.Models;
+using ClaudeDo.Data.Repositories;
+using ClaudeDo.Worker.Hub;
+using ClaudeDo.Worker.Usage;
+using Microsoft.EntityFrameworkCore;
+
+namespace ClaudeDo.Worker.Runner;
+
+/// <summary>
+/// Reopens a list-handler ConPTY session that died on the Anthropic usage limit, once the 5h window
+/// resets — the interactive counterpart to <c>UsageLimitAutoContinueCoordinator</c>, which only ever
+/// sees headless task runs. Deliberately a sibling and not an extension of it: a ConPTY session has
+/// no <c>task_runs</c> row, no <c>FailureReason</c>, and is resumed by relaunching a phase rather
+/// than by <c>ContinueTask</c> through the override slot.
+///
+/// Driven by the UI (<c>WorkerHub.ReportInteractiveSessionExited</c>) because the exit code only
+/// exists in the process that owns the terminal. Everything else — was it the usage limit, is
+/// PowerUse on, which phase and task set, when does the window reset — is decided here.
+///
+/// Fails CLOSED, unlike the usage gate: every missing signal means "don't relaunch". An interactive
+/// session that pops back up at 3am uninvited is worse than one that stays dead.
+///
+/// It does not wait here. The restart is <b>parked in <see cref="HandlerRoundState"/></b> and fired
+/// by <see cref="HandlerUsageGuard"/> — the same slot a session that handed off cleanly before the
+/// limit uses, so exactly one of the two reopens a round. Parking it also survives a worker restart
+/// during the hours-long wait, which an in-process <c>Task.Delay</c> did not.
+/// </summary>
+public sealed class HandlerRestartCoordinator
+{
+    private readonly IDbContextFactory<ClaudeDoDbContext> _dbFactory;
+    private readonly UsageState _usageState;
+    private readonly HandlerRoundState _rounds;
+    private readonly HubBroadcaster _broadcaster;
+    private readonly ILogger<HandlerRestartCoordinator> _logger;
+
+    public HandlerRestartCoordinator(
+        IDbContextFactory<ClaudeDoDbContext> dbFactory,
+        UsageState usageState,
+        HandlerRoundState rounds,
+        HubBroadcaster broadcaster,
+        ILogger<HandlerRestartCoordinator> logger)
+    {
+        _dbFactory = dbFactory;
+        _usageState = usageState;
+        _rounds = rounds;
+        _broadcaster = broadcaster;
+        _logger = logger;
+    }
+
+    /// <summary>Handles a ConPTY session's process exit. Returns true when a restart was parked for
+    /// the reset (HandlerUsageGuard fires it). Any non-handler task, clean exit, non-usage-limit
+    /// death, PowerUse-off list, already-used round, or round that already has a handoff parked is a
+    /// silent no-op.</summary>
+    public async Task<bool> OnSessionExitedAsync(string taskId, int exitCode, CancellationToken ct = default)
+    {
+        if (exitCode == 0 || string.IsNullOrEmpty(taskId)) return false;
+
+        var round = _rounds.Get(taskId);
+        // Not a list-handler session at all (a plain interactive task pane), or the initial triage
+        // session, which has no handoff launch spec to reopen -- BuildForMergeHelperAsync needs the
+        // list id and the original selection, and its dedupe/enhance work is not idempotent.
+        if (round is null || !MergeHelperPhase.All.Contains(round.Phase, StringComparer.Ordinal)) return false;
+
+        var snapshot = _usageState.Snapshot;
+        if (snapshot?.FiveHour is not { } fiveHour) return false;
+        if (fiveHour.ResetsAt is not { } resetsAt) return false;
+
+        int number;
+        try
+        {
+            await using var ctx = await _dbFactory.CreateDbContextAsync(ct);
+            var task = await new TaskRepository(ctx).GetByIdAsync(taskId, ct);
+            if (task is null) return false;
+            number = task.Number;
+
+            // Both PowerUse keys, exactly as ComposeHandlerPromptAsync gates the PowerUse prompt
+            // addendum: the global switch alone must not make an interactive run on some unrelated
+            // list restart itself overnight.
+            var settings = await new AppSettingsRepository(ctx).GetAsync(ct);
+            if (!settings.PowerUseEnabled) return false;
+            if ((await new ListRepository(ctx).GetConfigAsync(task.ListId, ct))?.PowerUseAllowed != true) return false;
+
+            // The corroborating signal that this exit really was the usage limit. A ConPTY session
+            // gives us nothing but an exit code -- there is no stdout to match against, so
+            // TaskRunner's IsUsageLimitMessage regex (which reads the CLI's own "session limit
+            // reached" text) has nothing to read here. The 5h utilization at the moment of death is
+            // the one independent witness we do have. Same threshold the warning and the withheld
+            // handoff use (PowerUseHandoffPct) so all three agree on where "at the limit" starts;
+            // a crash or a manual Ctrl-C well below it is NOT restarted.
+            if (fiveHour.Utilization < Math.Clamp(settings.PowerUseHandoffPct, 50, 99)) return false;
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "HandlerRestartCoordinator: could not evaluate handler task {TaskId}; not restarting", taskId);
+            return false;
+        }
+
+        // One restart per round, and never on top of a handoff the session itself already parked.
+        // The budget is NOT spent here -- HandlerUsageGuard spends it when the broadcast goes out,
+        // so a worker that dies during the wait doesn't leave the round marked "restart used".
+        var dueAt = resetsAt + HandlerUsageGuard.ResetGrace;
+        if (!_rounds.TryScheduleAutoRestart(taskId, dueAt, round.Phase, round.TaskIds)) return false;
+
+        // Fire-and-forget caller (WorkerHub): an unobserved exception here would be invisible, so
+        // the log line must not be able to throw past this point.
+        try
+        {
+            await _broadcaster.WorkerLog(
+                $"List handler #{number} died at the usage limit (5h {fiveHour.Utilization:0}%) — " +
+                $"restarting phase {round.Phase} after the reset, at {dueAt.ToLocalTime():HH:mm}",
+                WorkerLogLevel.Warn, DateTime.UtcNow);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "HandlerRestartCoordinator: restart of #{Number} is parked, but the WorkerLog broadcast failed", number);
+        }
+        return true;
+    }
+}

src/ClaudeDo.Worker/Runner/HandlerRoundState.cs

@@ -0,0 +1,220 @@
+using System.Text.Json;
+using ClaudeDo.Data;
+
+namespace ClaudeDo.Worker.Runner;
+
+/// <summary>One list-handler round: the phase a session is running and the exact task set it was
+/// handed. Written every time a handler session is built, so an outside observer (a crashed tile,
+/// a deferred handoff) can reopen the SAME phase with the SAME set without the in-flight
+/// <c>HandoffRequested</c> broadcast that is the only other place these ids exist.</summary>
+/// <param name="Phase">A <see cref="MergeHelperPhase"/> value, or "triage" for the initial session
+/// (which has no handoff spec and therefore cannot be reopened — see HandlerRestartCoordinator).</param>
+/// <param name="AutoRestartUsed">Spent once per round, and only once the deferred
+/// <c>HandoffRequested</c> broadcast has actually gone out — a restart that is merely *scheduled*
+/// must not count, or a worker that dies during the hours-long wait leaves the round permanently
+/// marked "restart used" without one ever having happened.</param>
+/// <param name="DeferredHandoffAt">Due time of a handoff parked until the 5h usage window resets.
+/// One slot per round, shared by both producers: a session that handed off cleanly just before the
+/// limit (HandlerUsageGuard) and a session that died at it (HandlerRestartCoordinator) — so the two
+/// can never reopen the same round twice. Fired by HandlerUsageGuard, which re-picks it up after a
+/// worker restart because it lives in this file rather than in a timer.</param>
+public sealed record HandlerRound(
+    string HandlerTaskId,
+    string Phase,
+    IReadOnlyList<string> TaskIds,
+    DateTime StartedAtUtc,
+    bool AutoRestartUsed = false,
+    DateTimeOffset? DeferredHandoffAt = null,
+    string? DeferredPhase = null,
+    IReadOnlyList<string>? DeferredTaskIds = null,
+    bool DeferredIsAutoRestart = false,
+    bool UsageWarningSent = false);
+
+/// <summary>
+/// File-backed store for <see cref="HandlerRound"/>, one entry per handler task. Deliberately a
+/// JSON file under <c>~/.claudeDo/</c> (same Load/Save shape as <c>ClaudeDo.Ui.AppSettings</c>)
+/// rather than a DB column: rounds are process-lifetime scratch state that no query joins against,
+/// and an EF migration here would collide with the one the settings work owns this round.
+/// Every read/write goes through one lock and re-serializes the whole file — there are at most a
+/// handful of concurrent handler runs, so nothing here needs to be clever.
+/// </summary>
+public sealed class HandlerRoundState
+{
+    // Entries older than this are dropped on the next save. A round that has been open for a week
+    // is not coming back, and without a sweep the file only ever grows.
+    private static readonly TimeSpan Retention = TimeSpan.FromDays(7);
+
+    private readonly string _path;
+    private readonly object _lock = new();
+    private Dictionary<string, HandlerRound>? _rounds;
+
+    public HandlerRoundState() : this(Path.Combine(Paths.AppDataRoot(), "handler-rounds.json"))
+    {
+    }
+
+    /// <summary>Test seam — point the store at a temp file instead of the live app data root.</summary>
+    internal HandlerRoundState(string path) => _path = path;
+
+    public HandlerRound? Get(string handlerTaskId)
+    {
+        lock (_lock)
+            return Rounds().GetValueOrDefault(handlerTaskId);
+    }
+
+    /// <summary>Overwrites this handler task's round. <see cref="HandlerRound.AutoRestartUsed"/> is
+    /// carried over when the phase is unchanged: the auto-restart itself rebuilds the same phase's
+    /// launch spec, which lands right back here, and a naive overwrite would hand the round a fresh
+    /// restart budget every time — exactly the all-night relaunch loop the claim exists to prevent.
+    /// A genuinely new phase is a new round and starts with a fresh budget.</summary>
+    public void Save(HandlerRound round)
+    {
+        lock (_lock)
+        {
+            var rounds = Rounds();
+            if (rounds.TryGetValue(round.HandlerTaskId, out var previous)
+                && string.Equals(previous.Phase, round.Phase, StringComparison.Ordinal)
+                && previous.AutoRestartUsed)
+            {
+                round = round with { AutoRestartUsed = true };
+            }
+
+            rounds[round.HandlerTaskId] = round;
+            Persist(rounds);
+        }
+    }
+
+    public IReadOnlyList<HandlerRound> All()
+    {
+        lock (_lock)
+            return Rounds().Values.ToList();
+    }
+
+    /// <summary>Claims this round's single "warn the session before the usage limit" shot. True only
+    /// the first time, so a monitor that keeps ticking above the threshold does not retype the same
+    /// warning into the session every 30 seconds.</summary>
+    public bool TryMarkUsageWarned(string handlerTaskId)
+    {
+        lock (_lock)
+        {
+            var rounds = Rounds();
+            if (!rounds.TryGetValue(handlerTaskId, out var round) || round.UsageWarningSent) return false;
+
+            rounds[handlerTaskId] = round with { UsageWarningSent = true };
+            Persist(rounds);
+            return true;
+        }
+    }
+
+    /// <summary>Parks a handoff the running session asked for until <paramref name="dueAt"/>.
+    /// Overwrites any existing slot: the live session's own request is the most recent word on what
+    /// the next round should be.</summary>
+    public void SetDeferredHandoff(
+        string handlerTaskId, DateTimeOffset dueAt, string phase, IReadOnlyList<string> taskIds)
+        => WriteDeferred(handlerTaskId, dueAt, phase, taskIds, isAutoRestart: false);
+
+    /// <summary>Schedules this round's single auto-restart (the session died at the limit). False
+    /// when there is no round, the restart budget is already spent, or a handoff is *already* parked
+    /// for this round — the deferred handoff and the auto-restart are one trigger, not two.
+    /// <see cref="HandlerRound.AutoRestartUsed"/> is deliberately NOT set here; only
+    /// <see cref="ClearDeferredHandoff"/> spends it, once the broadcast really went out.</summary>
+    public bool TryScheduleAutoRestart(
+        string handlerTaskId, DateTimeOffset dueAt, string phase, IReadOnlyList<string> taskIds)
+    {
+        lock (_lock) // Monitor is reentrant — WriteDeferred takes the same lock.
+        {
+            var rounds = Rounds();
+            if (!rounds.TryGetValue(handlerTaskId, out var round)) return false;
+            if (round.AutoRestartUsed || round.DeferredHandoffAt is not null) return false;
+
+            WriteDeferred(handlerTaskId, dueAt, phase, taskIds, isAutoRestart: true);
+            return true;
+        }
+    }
+
+    /// <summary>Clears the parked handoff. <paramref name="spendAutoRestart"/> marks the round's
+    /// restart budget as used — pass the slot's own <see cref="HandlerRound.DeferredIsAutoRestart"/>,
+    /// so a clean pre-limit handoff never costs the next session its restart.</summary>
+    public void ClearDeferredHandoff(string handlerTaskId, bool spendAutoRestart)
+    {
+        lock (_lock)
+        {
+            var rounds = Rounds();
+            if (!rounds.TryGetValue(handlerTaskId, out var round)) return;
+
+            rounds[handlerTaskId] = round with
+            {
+                DeferredHandoffAt = null,
+                DeferredPhase = null,
+                DeferredTaskIds = null,
+                DeferredIsAutoRestart = false,
+                AutoRestartUsed = round.AutoRestartUsed || spendAutoRestart,
+            };
+            Persist(rounds);
+        }
+    }
+
+    private void WriteDeferred(
+        string handlerTaskId, DateTimeOffset dueAt, string phase, IReadOnlyList<string> taskIds, bool isAutoRestart)
+    {
+        lock (_lock)
+        {
+            var rounds = Rounds();
+            if (!rounds.TryGetValue(handlerTaskId, out var round)) return;
+
+            rounds[handlerTaskId] = round with
+            {
+                DeferredHandoffAt = dueAt,
+                DeferredPhase = phase,
+                DeferredTaskIds = taskIds.ToList(),
+                DeferredIsAutoRestart = isAutoRestart,
+            };
+            Persist(rounds);
+        }
+    }
+
+    public void Remove(string handlerTaskId)
+    {
+        lock (_lock)
+        {
+            var rounds = Rounds();
+            if (rounds.Remove(handlerTaskId)) Persist(rounds);
+        }
+    }
+
+    // Callers hold _lock.
+    private Dictionary<string, HandlerRound> Rounds()
+    {
+        if (_rounds is not null) return _rounds;
+        try
+        {
+            if (File.Exists(_path))
+            {
+                _rounds = JsonSerializer.Deserialize<Dictionary<string, HandlerRound>>(
+                    File.ReadAllText(_path), new JsonSerializerOptions { PropertyNameCaseInsensitive = true });
+            }
+        }
+        catch
+        {
+            // A corrupt/unreadable file must never block a handler launch — start empty.
+        }
+        return _rounds ??= new Dictionary<string, HandlerRound>(StringComparer.Ordinal);
+    }
+
+    private void Persist(Dictionary<string, HandlerRound> rounds)
+    {
+        var cutoff = DateTime.UtcNow - Retention;
+        foreach (var stale in rounds.Where(kv => kv.Value.StartedAtUtc < cutoff).Select(kv => kv.Key).ToList())
+            rounds.Remove(stale);
+
+        try
+        {
+            var dir = Path.GetDirectoryName(_path);
+            if (!string.IsNullOrEmpty(dir)) Directory.CreateDirectory(dir);
+            File.WriteAllText(_path, JsonSerializer.Serialize(rounds, new JsonSerializerOptions { WriteIndented = true }));
+        }
+        catch
+        {
+            // Losing persistence costs an auto-restart across a worker restart, never a launch.
+        }
+    }
+}

src/ClaudeDo.Worker/Runner/HandlerUsageGuard.cs

@@ -0,0 +1,207 @@
+using ClaudeDo.Data;
+using ClaudeDo.Data.Models;
+using ClaudeDo.Data.Repositories;
+using ClaudeDo.Worker.External;
+using ClaudeDo.Worker.Hub;
+using ClaudeDo.Worker.Usage;
+using Microsoft.EntityFrameworkCore;
+
+namespace ClaudeDo.Worker.Runner;
+
+/// <summary>
+/// Hands a PowerUse list-handler round over cleanly across the 5h usage limit, instead of letting it
+/// die mid-merge:
+///
+/// 1. <b>Warn</b> — once per round, as soon as the 5h window crosses
+///    <c>AppSettings.PowerUseHandoffPct</c>, a message is typed straight into the live ConPTY session
+///    (<c>HandlerUsageWarning</c> → Mission Control) telling it to finish what it is doing and call
+///    <c>handoff_list_handler</c> itself. A session that hands off on its own leaves no half-merged
+///    tree behind; an auto-restart after the fact cannot clean one up.
+/// 2. <b>Withhold</b> — the resulting handoff is not broadcast immediately (the next session would
+///    open straight into the same exhausted window) but parked in <see cref="HandlerRoundState"/>
+///    until the window resets. Same slot the auto-restart of a session that *did* die uses
+///    (<see cref="HandlerRestartCoordinator"/>), so the two can never reopen one round twice.
+/// 3. <b>Fire</b> — this service's tick is also what releases a parked handoff. Deliberately a poll
+///    over the persisted state rather than a timer: a worker restart mid-wait re-picks the parked
+///    handoff up on the next tick, and an overdue one goes out immediately, for free.
+/// </summary>
+public sealed class HandlerUsageGuard : BackgroundService
+{
+    internal static readonly TimeSpan TickInterval = TimeSpan.FromSeconds(30);
+
+    // Small cushion past ResetsAt: the reported reset time is the server's, and reopening a session
+    // one second early buys nothing but another dead tile.
+    internal static readonly TimeSpan ResetGrace = TimeSpan.FromSeconds(60);
+
+    private readonly IDbContextFactory<ClaudeDoDbContext> _dbFactory;
+    private readonly UsageState _usageState;
+    private readonly HandlerRoundState _rounds;
+    private readonly HandoffRoundTracker _handoffRounds;
+    private readonly HubBroadcaster _broadcaster;
+    private readonly ILogger<HandlerUsageGuard> _logger;
+
+    public HandlerUsageGuard(
+        IDbContextFactory<ClaudeDoDbContext> dbFactory,
+        UsageState usageState,
+        HandlerRoundState rounds,
+        HandoffRoundTracker handoffRounds,
+        HubBroadcaster broadcaster,
+        ILogger<HandlerUsageGuard> logger)
+    {
+        _dbFactory = dbFactory;
+        _usageState = usageState;
+        _rounds = rounds;
+        _handoffRounds = handoffRounds;
+        _broadcaster = broadcaster;
+        _logger = logger;
+    }
+
+    /// <summary>Test seam — a real 5h wait is not a test.</summary>
+    internal Func<DateTimeOffset> NowUtc { get; set; } = () => DateTimeOffset.UtcNow;
+
+    /// <summary>PowerUse verdict for one handler task: both PowerUse switches on, a 5h bucket
+    /// available, plus the configured threshold and the task's display number.</summary>
+    internal sealed record Policy(int HandoffPct, UsageBucket FiveHour, int Number);
+
+    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
+    {
+        while (!stoppingToken.IsCancellationRequested)
+        {
+            try
+            {
+                await TickAsync(stoppingToken);
+                await Task.Delay(TickInterval, stoppingToken);
+            }
+            catch (OperationCanceledException)
+            {
+                return;
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "HandlerUsageGuard: tick failed");
+                await Task.Delay(TickInterval, stoppingToken);
+            }
+        }
+    }
+
+    internal async Task TickAsync(CancellationToken ct)
+    {
+        foreach (var round in _rounds.All())
+        {
+            await FireIfDueAsync(round);
+            await WarnIfNearLimitAsync(round, ct);
+        }
+    }
+
+    /// <summary>Called by <c>handoff_list_handler</c>. Returns the time the handoff was parked until
+    /// when it must be withheld, or null when it should go out now (PowerUse off for this list, well
+    /// below the threshold, or no reset time to wait for).</summary>
+    public async Task<DateTimeOffset?> TryDeferHandoffAsync(
+        string handlerTaskId, IReadOnlyList<string> survivingTaskIds, string phase, CancellationToken ct)
+    {
+        var policy = await EvaluateAsync(handlerTaskId, ct);
+        if (policy is null) return null;
+
+        // The warning flag matters on its own: utilization can dip back under the threshold between
+        // the warning and the session actually finishing its merge, and a handoff produced *because*
+        // of the warning must still wait for the reset.
+        var warned = _rounds.Get(handlerTaskId)?.UsageWarningSent == true;
+        if (policy.FiveHour.Utilization < policy.HandoffPct && !warned) return null;
+
+        if (policy.FiveHour.ResetsAt is not { } resetsAt)
+        {
+            _logger.LogWarning(
+                "HandlerUsageGuard: 5h window at {Pct}% has no reset time; handing off {TaskId} immediately",
+                policy.FiveHour.Utilization, handlerTaskId);
+            return null;
+        }
+
+        var dueAt = resetsAt + ResetGrace;
+        _rounds.SetDeferredHandoff(handlerTaskId, dueAt, phase, survivingTaskIds);
+        await _broadcaster.WorkerLog(
+            $"List handler #{policy.Number}: handoff to phase {phase} withheld until " +
+            $"{dueAt.ToLocalTime():HH:mm} (5h window at {policy.FiveHour.Utilization:0}%)",
+            WorkerLogLevel.Warn, DateTime.UtcNow);
+        return dueAt;
+    }
+
+    private async Task FireIfDueAsync(HandlerRound round)
+    {
+        if (round.DeferredHandoffAt is not { } dueAt || dueAt > NowUtc()) return;
+
+        if (round.DeferredPhase is not { Length: > 0 } phase || round.DeferredTaskIds is not { Count: > 0 } taskIds)
+        {
+            _rounds.ClearDeferredHandoff(round.HandlerTaskId, spendAutoRestart: false);
+            return;
+        }
+
+        // Cleared BEFORE the broadcast so a throw on the way out can't leave a slot that re-fires on
+        // every tick; the restart budget is spent here too, which is the point of the whole
+        // rework -- it is now only spent once a handoff really went out.
+        _rounds.ClearDeferredHandoff(round.HandlerTaskId, spendAutoRestart: round.DeferredIsAutoRestart);
+
+        await _broadcaster.HandoffRequested(round.HandlerTaskId, taskIds, phase);
+        await _broadcaster.WorkerLog(
+            $"Reopening list handler at phase {phase} after the usage-limit reset",
+            WorkerLogLevel.Info, DateTime.UtcNow);
+    }
+
+    private async Task WarnIfNearLimitAsync(HandlerRound round, CancellationToken ct)
+    {
+        if (round.UsageWarningSent) return;
+        // A sealed chain has no further handoff to ask for -- telling it to call
+        // handoff_list_handler would only earn the session an exception.
+        if (_handoffRounds.GetState(round.HandlerTaskId).Sealed) return;
+
+        var policy = await EvaluateAsync(round.HandlerTaskId, ct);
+        if (policy is null || policy.FiveHour.Utilization < policy.HandoffPct) return;
+        if (!_rounds.TryMarkUsageWarned(round.HandlerTaskId)) return;
+
+        await _broadcaster.HandlerUsageWarning(
+            round.HandlerTaskId, BuildWarning(round.HandlerTaskId, round.Phase, policy.FiveHour.Utilization));
+        await _broadcaster.WorkerLog(
+            $"List handler #{policy.Number}: warned the session at 5h {policy.FiveHour.Utilization:0}% " +
+            $"(handoff threshold {policy.HandoffPct}%)",
+            WorkerLogLevel.Warn, DateTime.UtcNow);
+    }
+
+    // Plain ASCII on purpose: this is typed character-by-character into a PTY, not rendered by us.
+    internal static string BuildWarning(string handlerTaskId, string phase, double utilization) =>
+        $"USAGE LIMIT IMMINENT ({utilization:0}% of the 5h window). Finish or abort the merge you are " +
+        "in - never leave conflict markers in the tree - then call " +
+        $"handoff_list_handler(taskId: \"{handlerTaskId}\", survivingTaskIds: <every task not yet Done>, " +
+        $"nextPhase: \"{NextPhaseFor(phase)}\") right now. Do not start anything new. " +
+        "The next session opens automatically after the limit resets.";
+
+    // The session should resume where it is, so the warning names its own phase back. The opening
+    // triage round is the exception: "triage" is not a handoff phase, and what follows triage is
+    // always the wait phase.
+    private static string NextPhaseFor(string phase) =>
+        MergeHelperPhase.All.Contains(phase, StringComparer.Ordinal) ? phase : MergeHelperPhase.Wait;
+
+    /// <summary>Both PowerUse switches, exactly as <c>ComposeHandlerPromptAsync</c> and
+    /// <see cref="HandlerRestartCoordinator"/> gate them — the global toggle alone must not make an
+    /// unrelated list's handler session get typed into. Null = leave this round alone.</summary>
+    private async Task<Policy?> EvaluateAsync(string handlerTaskId, CancellationToken ct)
+    {
+        if (_usageState.Snapshot?.FiveHour is not { } fiveHour) return null;
+
+        try
+        {
+            await using var ctx = await _dbFactory.CreateDbContextAsync(ct);
+            var task = await new TaskRepository(ctx).GetByIdAsync(handlerTaskId, ct);
+            if (task is null) return null;
+
+            var settings = await new AppSettingsRepository(ctx).GetAsync(ct);
+            if (!settings.PowerUseEnabled) return null;
+            if ((await new ListRepository(ctx).GetConfigAsync(task.ListId, ct))?.PowerUseAllowed != true) return null;
+
+            return new Policy(Math.Clamp(settings.PowerUseHandoffPct, 50, 99), fiveHour, task.Number);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "HandlerUsageGuard: could not evaluate handler task {TaskId}", handlerTaskId);
+            return null;
+        }
+    }
+}

src/ClaudeDo.Worker/Runner/InteractiveLaunchSpecService.cs

@@ -44,6 +44,10 @@ public sealed class InteractiveLaunchSpecService
     private readonly GitService _git;
     private readonly string _claudePath;
     private readonly HandoffRoundTracker _handoffRounds;
+    private readonly HandlerRoundState _roundState;
+
+    // Local wall clock, injectable so the PowerUse time window is testable without sleeping.
+    private readonly Func<DateTime> _now;
 
     public InteractiveLaunchSpecService(
         IDbContextFactory<ClaudeDoDbContext> dbFactory,
@@ -52,8 +56,11 @@ public sealed class InteractiveLaunchSpecService
         WorktreeManager wtManager,
         GitService git,
         WorkerConfig cfg,
-        HandoffRoundTracker handoffRounds)
+        HandoffRoundTracker handoffRounds,
+        HandlerRoundState roundState,
+        Func<DateTime>? now = null)
     {
+        _now = now ?? (() => DateTime.Now);
         _dbFactory = dbFactory;
         _skillSeeder = skillSeeder;
         _skillRegistry = skillRegistry;
@@ -61,13 +68,15 @@ public sealed class InteractiveLaunchSpecService
         _git = git;
         _claudePath = cfg.ClaudeBin;
         _handoffRounds = handoffRounds;
+        _roundState = roundState;
     }
 
     /// <summary>Builds a LaunchSpec for opening an interactive session in a task's worktree.
     /// Throws KeyNotFoundException if the task doesn't exist, InvalidOperationException
     /// if it's Running/Queued. If the task has no usable worktree yet, one is created on
     /// demand (same mechanism as an autonomous run) provided the task's list has a working
-    /// directory pointing at a git repo -- otherwise throws InvalidOperationException. Resumes
+    /// directory pointing at a git repo; a non-repo directory is opened directly, and a list with
+    /// no working directory at all (manual/reminder list) opens in the user's home dir. Resumes
     /// (--resume) this task's own last interactive session (TaskEntity.InteractiveSessionId) if
     /// it has one, else the latest autonomous run's session; a task that has never run either
     /// way, or whose worktree was just created fresh, gets a fresh-start spec instead -- pre-
@@ -86,6 +95,7 @@ public sealed class InteractiveLaunchSpecService
         var isFreshWorktree = false;
         string sessionDir;
         bool sessionIsWorktree;
+        var seedSkills = true;
 
         if (worktree is null || worktree.State is not (WorktreeState.Active or WorktreeState.Kept))
         {
@@ -97,10 +107,17 @@ public sealed class InteractiveLaunchSpecService
             // existing shape in the codebase (a list-handler task also has no worktree and commits
             // straight to the list's working dir), so no WorktreeEntity is created here either.
             var list = await new ListRepository(ctx).GetByIdAsync(task.ListId, ct);
-            if (list?.WorkingDir is null)
-                throw new InvalidOperationException("This task has no working directory configured -- can't create a worktree.");
-
-            if (await _git.IsGitRepoAsync(list.WorkingDir, ct))
+            if (list is null || string.IsNullOrEmpty(list.WorkingDir))
+            {
+                // A manual/reminder list has no repo at all -- open the session in the user's
+                // home directory instead of refusing it. Skills are deliberately NOT seeded
+                // there: the destination would be the user's REAL ~/.claude/skills, not a
+                // throwaway session copy.
+                sessionDir = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile);
+                sessionIsWorktree = false;
+                seedSkills = false;
+            }
+            else if (await _git.IsGitRepoAsync(list.WorkingDir, ct))
             {
                 // A stale (Merged/Discarded) row is already tracked in `ctx`'s identity map from
                 // the read above -- CreateAsync replaces it via its OWN context, so re-querying on
@@ -138,9 +155,12 @@ public sealed class InteractiveLaunchSpecService
         // history the task accumulated before its previous worktree went away.
         var run = isFreshWorktree ? null : await new TaskRunRepository(ctx).GetLatestByTaskIdAsync(taskId, ct);
 
-        var requestedSkills = TaskRunner.UnionSkillNames(task.SessionSkills, listConfig?.SessionSkills, globalSettings.SessionSkills);
-        var skillNames = await FilterToInstalledSkillsAsync(requestedSkills, ct);
-        await _skillSeeder.SeedAsync(sessionDir, skillNames, isWorktree: sessionIsWorktree, ct);
+        if (seedSkills)
+        {
+            var requestedSkills = TaskRunner.UnionSkillNames(task.SessionSkills, listConfig?.SessionSkills, globalSettings.SessionSkills);
+            var skillNames = await FilterToInstalledSkillsAsync(requestedSkills, ct);
+            await _skillSeeder.SeedAsync(sessionDir, skillNames, isWorktree: sessionIsWorktree, ct);
+        }
 
         var resolvedClaude = WindowsTerminalLauncher.Resolve(_claudePath)
             ?? throw new InvalidOperationException($"claude executable not found: {_claudePath}");
@@ -342,9 +362,20 @@ public sealed class InteractiveLaunchSpecService
             ["MCP_TOOL_TIMEOUT"] = McpToolTimeoutMs,
         };
 
+        // The opening round. Recorded so anything watching a handler run knows which round is live
+        // (the deferred-handoff follow-up needs that), but marked "triage" rather than a
+        // MergeHelperPhase value on purpose: there is no handoff spec for this phase, so
+        // HandlerRestartCoordinator will not reopen it.
+        _roundState.Save(new HandlerRound(handlerTaskId, TriagePhase, taskIds, DateTime.UtcNow));
+
         return new LaunchSpec(repoDir, resolvedClaude, args, env);
     }
 
+    /// <summary>The <see cref="HandlerRound.Phase"/> marker for the initial (dedupe/enhance) handler
+    /// session. Deliberately not a <see cref="MergeHelperPhase"/> value — that set is exactly the
+    /// phases <see cref="BuildForMergeHelperHandoffAsync"/> can rebuild.</summary>
+    public const string TriagePhase = "triage";
+
     // Builds the LaunchSpec for the fresh session a merge-helper run hands off to for the given
     // phase -- SAME handler task id as the run that called handoff_list_handler, so
     // HandlerBaseCommit/HandlerHeadCommit and the review range stay untouched; this never creates
@@ -449,6 +480,11 @@ public sealed class InteractiveLaunchSpecService
             ["MCP_TOOL_TIMEOUT"] = McpToolTimeoutMs,
         };
 
+        // Persist the round that is about to start. Phase + task set only exist in the transient
+        // HandoffRequested broadcast otherwise, so without this a dead tile cannot be reopened at
+        // the same phase with the same set (see HandlerRestartCoordinator).
+        _roundState.Save(new HandlerRound(taskId, nextPhase, survivingTaskIds, DateTime.UtcNow));
+
         return new LaunchSpec(repoDir, resolvedClaude, args, env);
     }
 
@@ -580,7 +616,11 @@ public sealed class InteractiveLaunchSpecService
     // Appending rather than substituting a second prompt set keeps the shared 95% in one place --
     // the addendum is written to read as an override of the base prompt's interactive rules. A run
     // that is not in PowerUse gets a byte-identical prompt to what it got before PowerUse existed.
-    private static async Task<string> ComposeHandlerPromptAsync(
+    //
+    // The optional time window is checked HERE, i.e. per phase at prompt-build time: a chain that
+    // hands off out of the window drops the addendum from that point on instead of staying
+    // unattended because the first phase happened to start inside it.
+    private async Task<string> ComposeHandlerPromptAsync(
         ClaudeDoDbContext ctx, string listId, PromptKind kind, CancellationToken ct)
     {
         var basePrompt = PromptFiles.ReadOrDefault(kind);
@@ -588,6 +628,9 @@ public sealed class InteractiveLaunchSpecService
         var settings = await new AppSettingsRepository(ctx).GetAsync(ct);
         if (!settings.PowerUseEnabled) return basePrompt;
 
+        if (!PowerUseWindow.IsOpen(_now(), settings.PowerUseWindowStart, settings.PowerUseWindowEnd))
+            return basePrompt;
+
         var listConfig = await new ListRepository(ctx).GetConfigAsync(listId, ct);
         if (listConfig?.PowerUseAllowed != true) return basePrompt;
 

src/ClaudeDo.Worker/State/TaskStateService.cs

@@ -430,6 +430,17 @@ public sealed class TaskStateService : ITaskStateService
         if (affected == 0)
             return new TransitionResult(false, "Task is not queued; cannot remove from queue.");
 
+        // A dequeued task may have been a planning-chain predecessor. Without unblocking its
+        // successor here, the successor is left permanently wedged on a BlockedByTaskId link to
+        // a task that has left the queue and will never reach the terminal state that would
+        // otherwise resolve it (PlanningChainCoordinator.OnChildFinishedAsync).
+        var successorId = await ctx.Tasks.AsNoTracking()
+            .Where(t => t.BlockedByTaskId == taskId)
+            .Select(t => t.Id)
+            .FirstOrDefaultAsync(ct);
+        if (successorId is not null)
+            await UnblockAsync(successorId, ct);
+
         await NotifyAsync(taskId);
         return new TransitionResult(true, null);
     }

tests/ClaudeDo.Data.Tests/PowerUseTests.cs

@@ -95,4 +95,56 @@ public sealed class PowerUseTests : IDisposable
         Assert.True(settings.PowerUseEnabled);
         Assert.Equal(40, settings.ListHandlerMaxHandoffs);
     }
+
+    [Fact]
+    public async Task AppSettings_WindowDefaults_AreEmptyAnd95Percent()
+    {
+        var settings = await new AppSettingsRepository(_ctx).GetAsync();
+
+        Assert.Null(settings.PowerUseWindowStart);
+        Assert.Null(settings.PowerUseWindowEnd);
+        Assert.Equal(95, settings.PowerUseHandoffPct);
+    }
+
+    /// UpdateAsync copies the incoming entity field by field onto the singleton row — a field
+    /// missing from that block never persists, however correctly the hub filled the entity. That
+    /// was true for PowerUseEnabled, ListHandlerMaxHandoffs and ModelPresets until 2026-09-02, so
+    /// pin the whole PowerUse group through the real write path.
+    [Fact]
+    public async Task AppSettings_UpdateAsync_PersistsThePowerUseGroup()
+    {
+        var repo = new AppSettingsRepository(_ctx);
+        var current = await repo.GetAsync();
+        current.PowerUseEnabled = true;
+        current.PowerUseWindowStart = "22:00";
+        current.PowerUseWindowEnd = "07:00";
+        current.PowerUseHandoffPct = 88;
+        current.ListHandlerMaxHandoffs = 40;
+        await repo.UpdateAsync(current);
+
+        using var reload = Reload();
+        var settings = await new AppSettingsRepository(reload).GetAsync();
+        Assert.True(settings.PowerUseEnabled);
+        Assert.Equal("22:00", settings.PowerUseWindowStart);
+        Assert.Equal("07:00", settings.PowerUseWindowEnd);
+        Assert.Equal(88, settings.PowerUseHandoffPct);
+        Assert.Equal(40, settings.ListHandlerMaxHandoffs);
+    }
+
+    [Fact]
+    public async Task AppSettings_UpdateAsync_NormalizesAndClamps()
+    {
+        var repo = new AppSettingsRepository(_ctx);
+        var current = await repo.GetAsync();
+        current.PowerUseWindowStart = "nonsense";
+        current.PowerUseWindowEnd = " 07:00 ";
+        current.PowerUseHandoffPct = 5;
+        await repo.UpdateAsync(current);
+
+        using var reload = Reload();
+        var settings = await new AppSettingsRepository(reload).GetAsync();
+        Assert.Null(settings.PowerUseWindowStart);
+        Assert.Equal("07:00", settings.PowerUseWindowEnd);
+        Assert.Equal(50, settings.PowerUseHandoffPct);
+    }
 }

tests/ClaudeDo.Data.Tests/PowerUseWindowTests.cs

@@ -0,0 +1,54 @@
+using ClaudeDo.Data.Models;
+
+namespace ClaudeDo.Data.Tests;
+
+/// The window decides whether a handler session runs unattended, so its edges matter: an
+/// off-by-one at midnight would leave an overnight window either always or never open.
+public sealed class PowerUseWindowTests
+{
+    private static TimeOnly T(string hhmm) => TimeOnly.ParseExact(hhmm, "HH:mm");
+
+    [Theory]
+    // Plain window, half-open: start included, end excluded.
+    [InlineData("09:00", "08:00", "17:00", true)]
+    [InlineData("08:00", "08:00", "17:00", true)]
+    [InlineData("17:00", "08:00", "17:00", false)]
+    [InlineData("07:59", "08:00", "17:00", false)]
+    [InlineData("23:30", "08:00", "17:00", false)]
+    // Wrap over midnight.
+    [InlineData("23:30", "22:00", "07:00", true)]
+    [InlineData("00:30", "22:00", "07:00", true)]
+    [InlineData("12:00", "22:00", "07:00", false)]
+    [InlineData("07:00", "22:00", "07:00", false)]
+    public void Contains_BothBoundsSet(string now, string start, string end, bool expected)
+        => Assert.Equal(expected, PowerUseWindow.Contains(T(now), T(start), T(end)));
+
+    /// Only one bound is not a window — it must behave exactly like no window, or a half-filled
+    /// pair of boxes would silently switch PowerUse off for most of the day.
+    [Fact]
+    public void Contains_OnlyOneBoundSet_IsAlwaysOpen()
+    {
+        Assert.True(PowerUseWindow.Contains(T("12:00"), T("22:00"), null));
+        Assert.True(PowerUseWindow.Contains(T("12:00"), null, T("07:00")));
+        Assert.True(PowerUseWindow.Contains(T("12:00"), null, null));
+    }
+
+    [Theory]
+    [InlineData("22:00", "22:00")]
+    [InlineData(" 07:30 ", "07:30")]
+    [InlineData("7:30", null)]
+    [InlineData("22:00:00", null)]
+    [InlineData("nonsense", null)]
+    [InlineData("", null)]
+    [InlineData(null, null)]
+    public void Normalize_KeepsOnlyExactHhMm(string? input, string? expected)
+        => Assert.Equal(expected, PowerUseWindow.Normalize(input));
+
+    [Fact]
+    public void IsOpen_UsesTheTimeOfDayOfTheGivenInstant()
+    {
+        Assert.True(PowerUseWindow.IsOpen(new DateTime(2026, 9, 2, 23, 30, 0), "22:00", "07:00"));
+        Assert.False(PowerUseWindow.IsOpen(new DateTime(2026, 9, 2, 12, 0, 0), "22:00", "07:00"));
+        Assert.True(PowerUseWindow.IsOpen(new DateTime(2026, 9, 2, 12, 0, 0), null, null));
+    }
+}

tests/ClaudeDo.Ui.Tests/StubWorkerClient.cs

@@ -26,6 +26,8 @@ public abstract class StubWorkerClient : IWorkerClient
     public event Action<string, string, string>? TaskQuestionAskedEvent;
     public event Action<string, string>? TaskQuestionResolvedEvent;
     public event Action<string, IReadOnlyList<string>, string>? HandoffRequestedEvent;
+    public event Action<string, IReadOnlyList<string>>? ListHandlerStartRequestedEvent;
+    public event Action<string, string>? HandlerUsageWarningEvent;
     public event Action? NotesUpdatedEvent;
     public event Action? PrepStartedEvent;
     public event Action<string>? PrepLineEvent;
@@ -56,7 +58,9 @@ public abstract class StubWorkerClient : IWorkerClient
     public void RaiseListUpdated(string listId) => ListUpdatedEvent?.Invoke(listId);
     public void RaiseTaskQuestionAsked(string taskId, string questionId, string question) => TaskQuestionAskedEvent?.Invoke(taskId, questionId, question);
     public void RaiseTaskQuestionResolved(string taskId, string questionId) => TaskQuestionResolvedEvent?.Invoke(taskId, questionId);
+    public void RaiseListHandlerStartRequested(string listId, IReadOnlyList<string> taskIds) => ListHandlerStartRequestedEvent?.Invoke(listId, taskIds);
     public void RaiseHandoffRequested(string taskId, IReadOnlyList<string> survivingTaskIds, string nextPhase = "wait") => HandoffRequestedEvent?.Invoke(taskId, survivingTaskIds, nextPhase);
+    public void RaiseHandlerUsageWarning(string taskId, string message) => HandlerUsageWarningEvent?.Invoke(taskId, message);
     public void RaisePlanningMergeConflict(string planningTaskId, string subtaskId, IReadOnlyList<string> files, bool externallyDriven)
         => PlanningMergeConflictEvent?.Invoke(planningTaskId, subtaskId, files, externallyDriven);
     public void RaiseOperationProgress(string opKey, string phase, int current, int total) => OperationProgressEvent?.Invoke(opKey, phase, current, total);
@@ -132,6 +136,10 @@ public abstract class StubWorkerClient : IWorkerClient
     public virtual Task<LaunchSpec> GetMergeHelperHandoffLaunchSpecAsync(
         string taskId, IReadOnlyList<string> survivingTaskIds, string nextPhase, CancellationToken ct = default)
         => Task.FromResult(new LaunchSpec(".", "claude", Array.Empty<string>(), new Dictionary<string, string>()));
+    public virtual Task ReportInteractiveSessionExitedAsync(string taskId, int exitCode, CancellationToken ct = default)
+        => Task.CompletedTask;
+    public virtual Task<IReadOnlyList<HandlerOpenTaskDto>> GetHandlerOpenTasksAsync(string handlerTaskId, CancellationToken ct = default)
+        => Task.FromResult<IReadOnlyList<HandlerOpenTaskDto>>(Array.Empty<HandlerOpenTaskDto>());
     public virtual Task<LaunchSpec> GetPlanningStartLaunchSpecAsync(string taskId, CancellationToken ct = default)
         => Task.FromResult(new LaunchSpec(".", "claude", Array.Empty<string>(), new Dictionary<string, string>()));
     public virtual Task<LaunchSpec> GetPlanningResumeLaunchSpecAsync(string taskId, CancellationToken ct = default)

tests/ClaudeDo.Ui.Tests/ViewModels/ListSettingsModalViewModelTests.cs

@@ -0,0 +1,172 @@
+using ClaudeDo.Data;
+using ClaudeDo.Localization;
+using ClaudeDo.Ui.Localization;
+using ClaudeDo.Ui.ViewModels.Modals;
+using Microsoft.EntityFrameworkCore;
+
+namespace ClaudeDo.Ui.Tests.ViewModels;
+
+// Perf fix: the modal used to await seven serial hub round-trips (including a 10s-timeout
+// ticket-system HTTP call) before showing itself. LoadAsync must fetch the list config exactly
+// once and must never let a slow/failing ticket-projects call block or corrupt the rest of the
+// load, or the save that follows it.
+public class ListSettingsModalViewModelTests
+{
+    static ListSettingsModalViewModelTests()
+    {
+        var dir = AppContext.BaseDirectory;
+        while (dir is not null && !Directory.Exists(Path.Combine(dir, "src", "ClaudeDo.Localization", "locales")))
+            dir = Path.GetDirectoryName(dir);
+        Loc.Current = new Localizer(
+            LocaleStore.Load(Path.Combine(dir!, "src", "ClaudeDo.Localization", "locales")), "en");
+    }
+
+    private static IDbContextFactory<ClaudeDoDbContext> NewFactory()
+    {
+        var dbPath = Path.Combine(Path.GetTempPath(), $"claudedo_listsettings_{Guid.NewGuid():N}.db");
+        ClaudeDoDbContext New() => new(new DbContextOptionsBuilder<ClaudeDoDbContext>()
+            .UseSqlite($"Data Source={dbPath}").Options);
+        using (var ctx = New()) ctx.Database.EnsureCreated();
+        return new TestDbFactory(New);
+    }
+
+    private sealed class CountingWorker : StubWorkerClient
+    {
+        public int GetListConfigCalls;
+        public ListConfigDto? Cfg;
+        public TicketSettingsDto? TicketSettings = new("http://ticket.example", true);
+        public Func<Task<List<TicketProjectDto>>>? TicketProjectsFactory;
+        public UpdateListConfigDto? SavedListConfig;
+
+        public Exception? GetListConfigThrows;
+
+        public override Task<ListConfigDto?> GetListConfigAsync(string listId)
+        {
+            GetListConfigCalls++;
+            if (GetListConfigThrows is not null) throw GetListConfigThrows;
+            return Task.FromResult(Cfg);
+        }
+
+        public override Task<TicketSettingsDto?> GetTicketSettingsAsync() => Task.FromResult(TicketSettings);
+
+        public override Task<List<TicketProjectDto>> GetTicketProjectsAsync() =>
+            TicketProjectsFactory?.Invoke() ?? Task.FromResult(new List<TicketProjectDto>());
+
+        public override Task UpdateListConfigAsync(UpdateListConfigDto dto)
+        {
+            SavedListConfig = dto;
+            return Task.CompletedTask;
+        }
+    }
+
+    [Fact]
+    public async Task LoadAsync_CallsGetListConfig_ExactlyOnce()
+    {
+        var worker = new CountingWorker { Cfg = new ListConfigDto("opus", null, null) };
+        var vm = new ListSettingsModalViewModel(worker, NewFactory());
+
+        await vm.LoadAsync("l1", "List One", "/repo", "feat");
+
+        Assert.Equal(1, worker.GetListConfigCalls);
+    }
+
+    [Fact]
+    public async Task LoadAsync_TicketProjectsNeverResolving_DoesNotBlockRestOfLoad()
+    {
+        var pending = new TaskCompletionSource<List<TicketProjectDto>>();
+        var worker = new CountingWorker
+        {
+            Cfg = new ListConfigDto("opus", null, null, 42, null, "make test", "acceptEdits", 7, true),
+            TicketProjectsFactory = () => pending.Task,
+        };
+        var vm = new ListSettingsModalViewModel(worker, NewFactory());
+
+        // LoadAsync must complete on its own even though the ticket-projects call it kicked off
+        // never resolves -- ticket loading is fire-and-forget precisely so a slow/unreachable
+        // ticket system can't hold up the rest of the modal.
+        var loadTask = vm.LoadAsync("l1", "List One", "/repo", "feat");
+        var completed = await Task.WhenAny(loadTask, Task.Delay(TimeSpan.FromSeconds(2)));
+
+        Assert.Same(loadTask, completed);
+        Assert.Equal("make test", vm.VerifyCommand);
+        Assert.True(vm.PowerUseAllowed);
+        Assert.False(vm.IsLoading);
+    }
+
+    [Fact]
+    public async Task Save_WhileTicketProjectsUnreachable_PreservesStoredTicketLink()
+    {
+        var worker = new CountingWorker
+        {
+            Cfg = new ListConfigDto("opus", null, null, null, null, null, null, 7, false),
+            TicketProjectsFactory = () => throw new InvalidOperationException("ticket system unreachable"),
+        };
+        var vm = new ListSettingsModalViewModel(worker, NewFactory());
+
+        await vm.LoadAsync("l1", "List One", "/repo", "feat");
+        await vm.SaveCommand.ExecuteAsync(null);
+
+        Assert.NotNull(worker.SavedListConfig);
+        Assert.Null(worker.SavedListConfig!.TicketProjectId);
+    }
+
+    [Fact]
+    public async Task Save_AfterSuccessfulTicketLoad_WritesSelectedTicketProject()
+    {
+        var worker = new CountingWorker
+        {
+            Cfg = new ListConfigDto("opus", null, null, null, null, null, null, 7, false),
+            TicketProjectsFactory = () => Task.FromResult(new List<TicketProjectDto>
+            {
+                new(7, "Fix the thing", "Dev"),
+            }),
+        };
+        var vm = new ListSettingsModalViewModel(worker, NewFactory());
+
+        await vm.LoadAsync("l1", "List One", "/repo", "feat");
+        await vm.SaveCommand.ExecuteAsync(null);
+
+        Assert.Equal(7, worker.SavedListConfig!.TicketProjectId);
+    }
+
+    [Fact]
+    public async Task LoadAsync_CoreLoadThrows_BlocksSaveAndDoesNotOverwriteConfig()
+    {
+        var worker = new CountingWorker
+        {
+            Cfg = new ListConfigDto("opus", null, null),
+            GetListConfigThrows = new InvalidOperationException("worker offline"),
+        };
+        var vm = new ListSettingsModalViewModel(worker, NewFactory());
+        string? reported = null;
+        vm.ErrorReported += m => reported = m;
+
+        await vm.LoadAsync("l1", "List One", "/repo", "feat");
+
+        Assert.False(vm.SaveCommand.CanExecute(null));
+        Assert.NotNull(reported);
+        Assert.Contains("worker offline", reported);
+        Assert.Null(worker.SavedListConfig);
+    }
+
+    [Fact]
+    public async Task LoadAsync_TicketProjectsThrow_ReportsErrorButRestOfLoadStillWorks()
+    {
+        var worker = new CountingWorker
+        {
+            Cfg = new ListConfigDto("opus", null, null, null, null, "make test", null, 7, true),
+            TicketProjectsFactory = () => throw new InvalidOperationException("ticket system down"),
+        };
+        var vm = new ListSettingsModalViewModel(worker, NewFactory());
+        string? reported = null;
+        vm.ErrorReported += m => reported = m;
+
+        await vm.LoadAsync("l1", "List One", "/repo", "feat");
+
+        Assert.Equal("make test", vm.VerifyCommand);
+        Assert.True(vm.PowerUseAllowed);
+        Assert.True(vm.SaveCommand.CanExecute(null));
+        Assert.NotNull(reported);
+        Assert.Contains("ticket system down", reported);
+    }
+}

tests/ClaudeDo.Ui.Tests/ViewModels/MissionControl/ConPtyPaneViewModelTests.cs

@@ -1,4 +1,5 @@
 using ClaudeDo.Ui.Services;
+using ClaudeDo.Ui.ViewModels;
 using ClaudeDo.Ui.ViewModels.MissionControl;
 using Xunit;
 
@@ -150,5 +151,62 @@ public class ConPtyPaneViewModelTests
         Assert.True(pane.RetryCommand.CanExecute(null));
     }
 
+    // ── SessionDiedAfterStartup (feeds the worker's usage-limit auto-restart) ────────────────────
+
+    [Fact]
+    public void SessionDiedAfterStartup_TaskPane_RaisesWithTaskIdAndExitCode()
+    {
+        using var pane = NewTaskPane(NeverCompletes, taskId: "handler-1");
+        (string TaskId, int ExitCode)? reported = null;
+        pane.SessionDiedAfterStartup += (id, code) => reported = (id, code);
+
+        DieAfterRunning(pane, exitCode: 1);
+
+        Assert.Equal(("handler-1", 1), reported);
+    }
+
+    [Fact]
+    public void SessionDiedAfterStartup_AdHocPane_NeverRaises()
+    {
+        using var pane = ConPtyPaneViewModel.CreateAdHoc("Ad hoc", NeverCompletes);
+        var raised = false;
+        pane.SessionDiedAfterStartup += (_, _) => raised = true;
+
+        DieAfterRunning(pane, exitCode: 1);
+
+        Assert.False(raised);
+    }
+
+    // Retry swaps in a fresh terminal -- the death of the RETRIED session must still be reported.
+    [Fact]
+    public void SessionDiedAfterStartup_StillWiredAfterRetry()
+    {
+        var callCount = 0;
+        using var pane = NewTaskPane(
+            () => callCount++ == 0 ? Failing() : NeverCompletes(), taskId: "handler-1");
+        pane.Start();
+        pane.RetryCommand.Execute(null);
+
+        var raised = false;
+        pane.SessionDiedAfterStartup += (_, _) => raised = true;
+
+        DieAfterRunning(pane, exitCode: 1);
+
+        Assert.True(raised);
+    }
+
     private static void SetRunning(ConPtyPaneViewModel pane) => pane.Terminal.IsRunning = true;
+
+    // Drives the terminal past its startup grace window, then kills it: IsRunning stamps the launch
+    // time off the real clock, so a sleep-free "ran for a while" needs the exit routed through a
+    // terminal whose clock has already moved on.
+    private static void DieAfterRunning(ConPtyPaneViewModel pane, int exitCode)
+    {
+        var launchedAt = new DateTime(2026, 1, 1, 0, 0, 0, DateTimeKind.Utc);
+        var callCount = 0;
+        pane.Terminal = new InteractiveTerminalViewModel(
+            () => callCount++ == 0 ? launchedAt : launchedAt.AddMinutes(90));
+        pane.Terminal.IsRunning = true;
+        pane.Terminal.OnSessionProcessExited(null, exitCode);
+    }
 }

tests/ClaudeDo.Ui.Tests/ViewModels/MissionControl/InteractiveTerminalViewModelTests.cs

@@ -49,4 +49,54 @@ public class InteractiveTerminalViewModelTests
         Assert.True(terminal.HasExited);
         Assert.Null(terminal.StartError);
     }
+
+    // ── ExitedAfterStartup (a session that ran, then broke -- used to be a silent dead tile;
+    //    the worker turns it into a usage-limit auto-restart for list handlers) ───────────────────
+
+    [Fact]
+    public void ProcessExitsNonzero_AfterRunningAWhile_RaisesExitedAfterStartup()
+    {
+        using var terminal = NewTerminalExitingAfter(TimeSpan.FromMinutes(90));
+        int? reported = null;
+        terminal.ExitedAfterStartup += code => reported = code;
+
+        terminal.OnSessionProcessExited(null, 1);
+
+        Assert.Equal(1, reported);
+    }
+
+    [Fact]
+    public void ProcessExitsNonzero_WithinGraceWindow_DoesNotRaiseExitedAfterStartup()
+    {
+        using var terminal = new InteractiveTerminalViewModel(() => LaunchedAt);
+        terminal.IsRunning = true;
+        var raised = false;
+        terminal.ExitedAfterStartup += _ => raised = true;
+
+        terminal.OnSessionProcessExited(null, 1);
+
+        Assert.False(raised);
+        Assert.NotNull(terminal.StartError); // still the startup-failure banner
+    }
+
+    [Fact]
+    public void ProcessExitsZero_AfterRunningAWhile_DoesNotRaiseExitedAfterStartup()
+    {
+        using var terminal = NewTerminalExitingAfter(TimeSpan.FromMinutes(90));
+        var raised = false;
+        terminal.ExitedAfterStartup += _ => raised = true;
+
+        terminal.OnSessionProcessExited(null, 0);
+
+        Assert.False(raised);
+    }
+
+    private static InteractiveTerminalViewModel NewTerminalExitingAfter(TimeSpan uptime)
+    {
+        var callCount = 0;
+        var terminal = new InteractiveTerminalViewModel(
+            () => callCount++ == 0 ? LaunchedAt : LaunchedAt + uptime);
+        terminal.IsRunning = true; // records LaunchedAt via the first clock call
+        return terminal;
+    }
 }

tests/ClaudeDo.Ui.Tests/ViewModels/MissionControlViewModelTests.cs

@@ -867,6 +867,93 @@ public class MissionControlViewModelTests : IDisposable
         Assert.Equal(0, SubscriberCount(pane, "SubmitForReviewRequested"));
     }
 
+    // ── usage-limit auto-restart: the exit code has to reach the worker ─────────────────────────
+
+    private sealed class RecordingExitWorker : StubWorkerClient
+    {
+        public readonly List<(string TaskId, int ExitCode)> Reported = new();
+        public override Task ReportInteractiveSessionExitedAsync(string taskId, int exitCode, CancellationToken ct = default)
+        {
+            Reported.Add((taskId, exitCode));
+            return Task.CompletedTask;
+        }
+    }
+
+    // A handler tile that ran for a while and then died non-zero used to be a silent dead pane.
+    // Whether it was the usage limit (and worth reopening) is the worker's call, so the UI's only
+    // job is reporting the exit -- hence no filtering here, every task pane reports.
+    [Fact]
+    public async Task PaneSessionDiesAfterRunning_ReportsExitToWorker()
+    {
+        var worker = new RecordingExitWorker();
+        using var vm = BuildVm(worker);
+        await vm.OpenMergeHelperHandoffConPtySessionAsync("handler-1", new[] { "t1" }, "merge");
+        var pane = Assert.Single(vm.ConPtySessions);
+
+        DieAfterRunning(pane, exitCode: 1);
+
+        Assert.Equal(new[] { ("handler-1", 1) }, worker.Reported);
+    }
+
+    [Fact]
+    public async Task ClosedPane_DoesNotReportItsSessionExit()
+    {
+        var worker = new RecordingExitWorker();
+        using var vm = BuildVm(worker);
+        await vm.OpenMergeHelperHandoffConPtySessionAsync("handler-1", new[] { "t1" }, "merge");
+        var pane = Assert.Single(vm.ConPtySessions);
+
+        pane.CloseCommand.Execute(null);
+        DieAfterRunning(pane, exitCode: 1);
+
+        Assert.Empty(worker.Reported);
+    }
+
+    // Drives a pane's terminal past its startup grace window and then kills it. IsRunning stamps the
+    // launch time off the terminal's own clock, so a sleep-free "ran for 90 minutes" needs a fresh
+    // terminal with a stubbed clock -- the pane re-wires its handlers on assignment.
+    private static void DieAfterRunning(ConPtyPaneViewModel pane, int exitCode)
+    {
+        var launchedAt = new DateTime(2026, 1, 1, 0, 0, 0, DateTimeKind.Utc);
+        var callCount = 0;
+        pane.Terminal = new InteractiveTerminalViewModel(
+            () => callCount++ == 0 ? launchedAt : launchedAt.AddMinutes(90));
+        pane.Terminal.IsRunning = true;
+        pane.Terminal.OnSessionProcessExited(null, exitCode);
+    }
+
+    // The worker's pre-usage-limit warning is typed into the pane for that handler task. There is no
+    // ConPTY process in a headless test, so SendLineAsync reports "not delivered" -- what this pins
+    // is the routing: the right pane is picked, and a warning for a task with no pane open is a
+    // silent no-op rather than an error in the footer.
+    [Fact]
+    public async Task HandlerUsageWarning_WithNoPaneForTheTask_IsSilentlyIgnored()
+    {
+        var worker = new FakeWorker();
+        using var vm = BuildVm(worker);
+        string? error = null;
+        vm.ErrorReported += msg => error = msg;
+
+        await vm.WarnHandlerSessionAsync("handler-nobody-opened", "USAGE LIMIT IMMINENT");
+
+        Assert.Null(error);
+    }
+
+    [Fact]
+    public async Task HandlerUsageWarning_UndeliverableToItsPane_SurfacesAnError()
+    {
+        var worker = new FakeWorker();
+        using var vm = BuildVm(worker);
+        await vm.OpenMergeHelperHandoffConPtySessionAsync("handler-1", new[] { "t1" }, "merge");
+        Assert.Single(vm.ConPtySessions);
+        string? error = null;
+        vm.ErrorReported += msg => error = msg;
+
+        await vm.WarnHandlerSessionAsync("handler-1", "USAGE LIMIT IMMINENT");
+
+        Assert.NotNull(error);
+    }
+
     [Fact]
     public void ToggleLayoutCommand_FlipsIsFocusMode()
     {
@@ -879,4 +966,110 @@ public class MissionControlViewModelTests : IDisposable
         vm.ToggleLayoutCommand.Execute(null);
         Assert.False(vm.IsFocusMode);
     }
+
+    // ── Abandon run: single-action "stop session + cancel its still-open tasks" ────────────────
+
+    private sealed class RecordingAbandonWorker : StubWorkerClient
+    {
+        public IReadOnlyList<HandlerOpenTaskDto> OpenTasks { get; set; } = Array.Empty<HandlerOpenTaskDto>();
+        public readonly List<string> Cancelled = new();
+
+        public override Task<IReadOnlyList<HandlerOpenTaskDto>> GetHandlerOpenTasksAsync(string handlerTaskId, CancellationToken ct = default)
+            => Task.FromResult(OpenTasks);
+
+        public override Task CancelTaskAsync(string taskId)
+        {
+            Cancelled.Add(taskId);
+            return Task.CompletedTask;
+        }
+    }
+
+    // A plain OpenConPtySessionAsync pane (not a list handler) never shows/allows the action --
+    // acceptance criterion 5 ("only at handler panes").
+    [Fact]
+    public async Task AbandonRun_OnNonHandlerPane_IsNotAvailable()
+    {
+        var worker = new FakeWorker();
+        using var vm = BuildVm(worker);
+        await vm.OpenConPtySessionAsync("t1");
+        var pane = vm.ConPtySessions[0];
+
+        Assert.False(pane.IsListHandler);
+        Assert.False(pane.AbandonRunCommand.CanExecute(null));
+    }
+
+    [Fact]
+    public async Task AbandonRun_ListHandlerPane_IsListHandlerTrue_CommandAvailable()
+    {
+        var worker = new RecordingAbandonWorker();
+        using var vm = BuildVm(worker);
+        await vm.OpenMergeHelperConPtySessionAsync("L1", new[] { "t1" });
+        var pane = Assert.Single(vm.ConPtySessions);
+
+        Assert.True(pane.IsListHandler);
+        Assert.True(pane.AbandonRunCommand.CanExecute(null));
+    }
+
+    // Acceptance criterion 4: no open tasks (or no round entry, which the fake models the same
+    // way) closes the pane straight away -- no confirmation dialog.
+    [Fact]
+    public async Task AbandonRun_NoOpenTasks_ClosesPaneWithoutConfirming()
+    {
+        var worker = new RecordingAbandonWorker { OpenTasks = Array.Empty<HandlerOpenTaskDto>() };
+        using var vm = BuildVm(worker);
+        await vm.OpenMergeHelperConPtySessionAsync("L1", new[] { "t1" });
+        var pane = Assert.Single(vm.ConPtySessions);
+        var confirmCalled = false;
+        vm.ConfirmAsync = _ => { confirmCalled = true; return Task.FromResult(true); };
+
+        pane.AbandonRunCommand.Execute(null);
+        await Task.Delay(20);
+
+        Assert.False(confirmCalled);
+        Assert.Empty(vm.ConPtySessions);
+    }
+
+    // Acceptance criterion 3 (decline branch): declining leaves the session and its tasks
+    // untouched.
+    [Fact]
+    public async Task AbandonRun_OpenTasks_ConfirmDeclined_LeavesSessionAndTasksUntouched()
+    {
+        var worker = new RecordingAbandonWorker
+        {
+            OpenTasks = new[] { new HandlerOpenTaskDto("t1", "First"), new HandlerOpenTaskDto("t2", "Second") },
+        };
+        using var vm = BuildVm(worker);
+        await vm.OpenMergeHelperConPtySessionAsync("L1", new[] { "t1", "t2" });
+        var pane = Assert.Single(vm.ConPtySessions);
+        string? confirmMessage = null;
+        vm.ConfirmAsync = msg => { confirmMessage = msg; return Task.FromResult(false); };
+
+        pane.AbandonRunCommand.Execute(null);
+        await Task.Delay(20);
+
+        Assert.NotNull(confirmMessage);
+        Assert.Empty(worker.Cancelled);
+        Assert.Single(vm.ConPtySessions);
+    }
+
+    // Acceptance criteria 1-3 (accept branch): the count is confirmed, every open task is
+    // cancelled, then the pane closes -- one action instead of two.
+    [Fact]
+    public async Task AbandonRun_OpenTasks_ConfirmAccepted_CancelsEachThenClosesPane()
+    {
+        var worker = new RecordingAbandonWorker
+        {
+            OpenTasks = new[] { new HandlerOpenTaskDto("t1", "First"), new HandlerOpenTaskDto("t2", "Second") },
+        };
+        using var vm = BuildVm(worker);
+        await vm.OpenMergeHelperConPtySessionAsync("L1", new[] { "t1", "t2" });
+        var pane = Assert.Single(vm.ConPtySessions);
+        vm.ConfirmAsync = _ => Task.FromResult(true);
+
+        pane.AbandonRunCommand.Execute(null);
+        await Task.Delay(20);
+
+        Assert.Equal(new[] { "t1", "t2" }, worker.Cancelled);
+        Assert.Empty(vm.ConPtySessions);
+    }
 }

tests/ClaudeDo.Ui.Tests/ViewModels/TaskRowContextMenuTests.cs

@@ -41,6 +41,23 @@ public class TaskRowContextMenuTests
         Assert.NotNull(row.SendToQueueDisabledReason);
     }
 
+    [Fact]
+    public void CanRemoveFromQueue_True_When_Queued_And_Blocked()
+    {
+        var row = MakeRow();
+        row.Status = TaskStatus.Queued;
+        row.BlockedByTaskId = "predecessor-id";
+        Assert.True(row.CanRemoveFromQueue);
+    }
+
+    [Fact]
+    public void CanRemoveFromQueue_False_When_Idle()
+    {
+        var row = MakeRow();
+        row.Status = TaskStatus.Idle;
+        Assert.False(row.CanRemoveFromQueue);
+    }
+
     [Fact]
     public void CancelDisabledReason_Null_While_Running()
     {

tests/ClaudeDo.Worker.Tests/External/ExternalMcpToolSchemaTests.cs

@@ -106,7 +106,7 @@ public sealed class ExternalMcpToolSchemaTests
         "list_runs", "get_run", "get_task_log",
         "list_agents",
         "reset_failed_task", "submit_task_for_review",
-        "handoff_list_handler", "get_handoff_status",
+        "handoff_list_handler", "get_handoff_status", "start_list_handler",
         "get_app_settings",
         "wait_for_task_change",
         "get_queue_state",

tests/ClaudeDo.Worker.Tests/External/HandoffMcpToolsTests.cs

@@ -3,8 +3,11 @@ using ClaudeDo.Data.Models;
 using ClaudeDo.Data.Repositories;
 using ClaudeDo.Worker.External;
 using ClaudeDo.Worker.Hub;
+using ClaudeDo.Worker.Runner;
 using ClaudeDo.Worker.Tests.Infrastructure;
+using ClaudeDo.Worker.Usage;
 using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Logging.Abstractions;
 using TaskStatus = ClaudeDo.Data.Models.TaskStatus;
 
 namespace ClaudeDo.Worker.Tests.External;
@@ -16,18 +19,35 @@ public sealed class HandoffMcpToolsTests : IDisposable
     private readonly TaskRepository _tasks;
     private readonly ListRepository _lists;
     private readonly CapturingHubContext _hubContext = new();
+    private readonly string _tempDir;
 
     public HandoffMcpToolsTests()
     {
         _ctx = _db.CreateContext();
         _tasks = new TaskRepository(_ctx);
         _lists = new ListRepository(_ctx);
+        _tempDir = Path.Combine(Path.GetTempPath(), $"cd_handoffmcp_{Guid.NewGuid():N}");
+        Directory.CreateDirectory(_tempDir);
     }
 
-    public void Dispose() { _ctx.Dispose(); _db.Dispose(); }
+    public void Dispose()
+    {
+        _ctx.Dispose();
+        _db.Dispose();
+        try { Directory.Delete(_tempDir, true); } catch { }
+    }
 
-    private HandoffMcpTools BuildSut(HandoffRoundTracker? tracker = null) =>
-        new(_tasks, new HubBroadcaster(_hubContext), tracker ?? new HandoffRoundTracker(), _db.CreateFactory());
+    // No usage snapshot -> HandlerUsageGuard never withholds, which is the behaviour every test
+    // below assumes. The withholding path has its own tests in HandlerUsageGuardTests.
+    private HandoffMcpTools BuildSut(HandoffRoundTracker? tracker = null)
+    {
+        var rounds = tracker ?? new HandoffRoundTracker();
+        var guard = new HandlerUsageGuard(
+            _db.CreateFactory(), new UsageState(),
+            new HandlerRoundState(Path.Combine(_tempDir, "handler-rounds.json")), rounds,
+            new HubBroadcaster(_hubContext), NullLogger<HandlerUsageGuard>.Instance);
+        return new HandoffMcpTools(_tasks, new HubBroadcaster(_hubContext), rounds, _db.CreateFactory(), guard);
+    }
 
     /// The cap the SUT reads comes from app_settings, so a test that wants a different cap has to
     /// write it there. GetAsync is AsNoTracking, hence the separate tracked query.

tests/ClaudeDo.Worker.Tests/Hub/HandlerOpenTasksHubTests.cs

@@ -0,0 +1,141 @@
+using ClaudeDo.Data;
+using ClaudeDo.Data.Git;
+using ClaudeDo.Data.Models;
+using ClaudeDo.Data.Repositories;
+using ClaudeDo.Worker.Config;
+using ClaudeDo.Worker.Hub;
+using ClaudeDo.Worker.Lifecycle;
+using ClaudeDo.Worker.Runner;
+using ClaudeDo.Worker.Skills;
+using ClaudeDo.Worker.Tests.Infrastructure;
+using Xunit;
+using TaskStatus = ClaudeDo.Data.Models.TaskStatus;
+
+namespace ClaudeDo.Worker.Tests.Hub;
+
+/// Covers WorkerHub.GetHandlerOpenTasks -- the Mission Control "abandon run" action's read side.
+/// The round's TaskIds come from HandlerRoundState (structured store, not the handler task's
+/// description); only rows still Queued or Running are returned, so WaitingForReview/Done/Failed/
+/// Cancelled/Idle work is never touched by a subsequent cancel loop.
+public sealed class HandlerOpenTasksHubTests : IDisposable
+{
+    private readonly DbFixture _db = new();
+    private readonly ClaudeDoDbContext _ctx;
+    private readonly TaskRepository _tasks;
+    private readonly ListRepository _lists;
+    private readonly string _roundsPath = Path.Combine(Path.GetTempPath(), $"claudedo_rounds_{Guid.NewGuid():N}.json");
+    private readonly HandlerRoundState _rounds;
+
+    private sealed class FakeSessionSkillRegistry : ISessionSkillRegistry
+    {
+        public Task<IReadOnlyList<string>> InstallAsync(string url, CancellationToken ct) => throw new NotImplementedException();
+        public Task UpdateAsync(string sourceUrl, CancellationToken ct) => throw new NotImplementedException();
+        public Task RemoveAsync(string sourceUrl, CancellationToken ct) => throw new NotImplementedException();
+        public Task<IReadOnlyList<SessionSkillEntity>> ListAsync(CancellationToken ct)
+            => Task.FromResult<IReadOnlyList<SessionSkillEntity>>(Array.Empty<SessionSkillEntity>());
+    }
+
+    public HandlerOpenTasksHubTests()
+    {
+        _ctx = _db.CreateContext();
+        _tasks = new TaskRepository(_ctx);
+        _lists = new ListRepository(_ctx);
+        _rounds = new HandlerRoundState(_roundsPath);
+    }
+
+    public void Dispose()
+    {
+        _ctx.Dispose();
+        _db.Dispose();
+        try { File.Delete(_roundsPath); } catch { /* best effort */ }
+    }
+
+    private WorkerHub CreateHub()
+    {
+        var factory = _db.CreateFactory();
+        var git = new GitService();
+        var wtManager = new WorktreeManager(git, factory, new WorkerConfig(), Microsoft.Extensions.Logging.Abstractions.NullLogger<WorktreeManager>.Instance);
+        var interactiveLaunchSpec = new InteractiveLaunchSpecService(
+            factory, new FakeSessionSkillSeeder(), new FakeSessionSkillRegistry(), wtManager, git,
+            new WorkerConfig { ClaudeBin = "claude" }, new ClaudeDo.Worker.External.HandoffRoundTracker(), _rounds);
+        var built = TaskStateServiceBuilder.Build(factory);
+
+        var hub = new WorkerHub(
+            null!, null!, null!, null!, null!, factory, null!, null!, null!,
+            null!, null!, null!, null!, null!, null!, null!, built.State, null!, null!,
+            null!, new ClaudeDo.Worker.Online.OnlineInboxConfig(), new ClaudeDo.Worker.OnlineRefreshTokenStore(new ClaudeDo.Worker.DpapiTokenStore("unused.token")),
+            new ClaudeDo.Worker.Runner.PendingQuestionRegistry(), null!,
+            logBuffer: null, interactiveLaunchSpec: interactiveLaunchSpec, worktreeManager: wtManager, git: git,
+            roundState: _rounds);
+        return hub;
+    }
+
+    private async Task<string> SeedListAsync(string name = "L")
+    {
+        var listId = Guid.NewGuid().ToString();
+        await _lists.AddAsync(new ListEntity { Id = listId, Name = name, WorkingDir = Path.GetTempPath(), CreatedAt = DateTime.UtcNow });
+        return listId;
+    }
+
+    private async Task<TaskEntity> SeedTaskAsync(string listId, TaskStatus status, string title = "T")
+    {
+        var task = new TaskEntity
+        {
+            Id = Guid.NewGuid().ToString(),
+            ListId = listId,
+            Title = title,
+            Status = status,
+            CreatedAt = DateTime.UtcNow,
+        };
+        await _tasks.AddAsync(task);
+        return task;
+    }
+
+    [Fact]
+    public async Task NoRoundEntry_ReturnsEmpty()
+    {
+        var hub = CreateHub();
+        var result = await hub.GetHandlerOpenTasks("no-such-handler-task");
+        Assert.Empty(result);
+    }
+
+    [Fact]
+    public async Task RoundWithOnlyTerminalTasks_ReturnsEmpty()
+    {
+        var listId = await SeedListAsync();
+        var done = await SeedTaskAsync(listId, TaskStatus.Done, "Done task");
+        var review = await SeedTaskAsync(listId, TaskStatus.WaitingForReview, "Review task");
+        var failed = await SeedTaskAsync(listId, TaskStatus.Failed, "Failed task");
+        var cancelled = await SeedTaskAsync(listId, TaskStatus.Cancelled, "Cancelled task");
+        var idle = await SeedTaskAsync(listId, TaskStatus.Idle, "Idle task");
+        var handlerTaskId = "handler-1";
+        _rounds.Save(new HandlerRound(handlerTaskId, "wait",
+            new[] { done.Id, review.Id, failed.Id, cancelled.Id, idle.Id }, DateTime.UtcNow));
+
+        var hub = CreateHub();
+        var result = await hub.GetHandlerOpenTasks(handlerTaskId);
+
+        Assert.Empty(result);
+    }
+
+    [Fact]
+    public async Task RoundWithMixedTasks_ReturnsOnlyQueuedAndRunning()
+    {
+        var listId = await SeedListAsync();
+        var queued = await SeedTaskAsync(listId, TaskStatus.Queued, "Queued task");
+        var running = await SeedTaskAsync(listId, TaskStatus.Running, "Running task");
+        var done = await SeedTaskAsync(listId, TaskStatus.Done, "Done task");
+        var notInRound = await SeedTaskAsync(listId, TaskStatus.Queued, "Unrelated queued task");
+        var handlerTaskId = "handler-2";
+        _rounds.Save(new HandlerRound(handlerTaskId, "wait",
+            new[] { queued.Id, running.Id, done.Id }, DateTime.UtcNow));
+
+        var hub = CreateHub();
+        var result = await hub.GetHandlerOpenTasks(handlerTaskId);
+
+        Assert.Equal(2, result.Count);
+        Assert.Contains(result, r => r.Id == queued.Id && r.Title == "Queued task");
+        Assert.Contains(result, r => r.Id == running.Id && r.Title == "Running task");
+        Assert.DoesNotContain(result, r => r.Id == notInRound.Id);
+    }
+}

tests/ClaudeDo.Worker.Tests/Hub/MergeHelperTaskHubTests.cs

@@ -64,7 +64,9 @@ public sealed class MergeHelperTaskHubTests : IDisposable
         var wtManager = new WorktreeManager(git, factory, new WorkerConfig(), NullLogger<WorktreeManager>.Instance);
         var interactiveLaunchSpec = new InteractiveLaunchSpecService(
             factory, new FakeSessionSkillSeeder(), new FakeSessionSkillRegistry(), wtManager, git,
-            new WorkerConfig { ClaudeBin = "claude" }, new ClaudeDo.Worker.External.HandoffRoundTracker());
+            new WorkerConfig { ClaudeBin = "claude" }, new ClaudeDo.Worker.External.HandoffRoundTracker(),
+            new ClaudeDo.Worker.Runner.HandlerRoundState(
+                Path.Combine(Path.GetTempPath(), $"claudedo_rounds_{Guid.NewGuid():N}.json")));
         var built = TaskStateServiceBuilder.Build(factory);
         var reviewSubmission = new InteractiveReviewSubmissionService(factory, git, built.State, wtManager);
 

tests/ClaudeDo.Worker.Tests/Hub/PowerUseSettingsHubTests.cs

@@ -0,0 +1,101 @@
+using ClaudeDo.Worker.Hub;
+using ClaudeDo.Worker.Tests.Infrastructure;
+using Xunit;
+
+namespace ClaudeDo.Worker.Tests.Hub;
+
+/// The PowerUse window and handoff threshold are edited on the usage monitor, but Settings→General
+/// rebuilds the whole DTO positionally on save. So the contract that matters is: whatever
+/// GetAppSettings hands out, feeding it straight back must change nothing.
+public sealed class PowerUseSettingsHubTests : IDisposable
+{
+    private readonly DbFixture _db = new();
+
+    public void Dispose() => _db.Dispose();
+
+    private WorkerHub CreateHub()
+    {
+        var broadcaster = new HubBroadcaster(new CapturingHubContext());
+        var hub = new WorkerHub(
+            null!, null!, null!, null!, broadcaster, _db.CreateFactory(),
+            null!, null!, null!, null!, null!, null!, null!, null!, null!, null!, null!, null!, null!,
+            null!, new ClaudeDo.Worker.Online.OnlineInboxConfig(), new ClaudeDo.Worker.OnlineRefreshTokenStore(new ClaudeDo.Worker.DpapiTokenStore("unused.token")),
+            new ClaudeDo.Worker.Runner.PendingQuestionRegistry(), null!);
+        hub.Clients = new FakeHubCallerClients(new RecordingClientProxy());
+        hub.Context = new FakeHubCallerContext();
+        return hub;
+    }
+
+    [Fact]
+    public async Task GetAppSettings_Defaults_HaveNoWindowAnd95Percent()
+    {
+        var settings = await CreateHub().GetAppSettings();
+
+        Assert.Null(settings.PowerUseWindowStart);
+        Assert.Null(settings.PowerUseWindowEnd);
+        Assert.Equal(95, settings.PowerUseHandoffPct);
+    }
+
+    [Fact]
+    public async Task UpdateAppSettings_RoundTripsTheWindowAndThreshold()
+    {
+        var hub = CreateHub();
+
+        var before = await hub.GetAppSettings();
+        await hub.UpdateAppSettings(before with
+        {
+            PowerUseEnabled = true,
+            PowerUseWindowStart = "22:00",
+            PowerUseWindowEnd = "07:00",
+            PowerUseHandoffPct = 88,
+        });
+        var after = await hub.GetAppSettings();
+
+        Assert.True(after.PowerUseEnabled);
+        Assert.Equal("22:00", after.PowerUseWindowStart);
+        Assert.Equal("07:00", after.PowerUseWindowEnd);
+        Assert.Equal(88, after.PowerUseHandoffPct);
+    }
+
+    /// The Settings→General case: a save that touches none of the PowerUse fields must leave them
+    /// exactly as they were.
+    [Fact]
+    public async Task UpdateAppSettings_UnchangedDto_LeavesPowerUseFieldsAlone()
+    {
+        var hub = CreateHub();
+        await hub.UpdateAppSettings((await hub.GetAppSettings()) with
+        {
+            PowerUseEnabled = true,
+            PowerUseWindowStart = "22:00",
+            PowerUseWindowEnd = "07:00",
+            PowerUseHandoffPct = 88,
+        });
+
+        var stored = await hub.GetAppSettings();
+        await hub.UpdateAppSettings(stored);
+        var after = await hub.GetAppSettings();
+
+        Assert.Equal(stored.PowerUseEnabled, after.PowerUseEnabled);
+        Assert.Equal(stored.PowerUseWindowStart, after.PowerUseWindowStart);
+        Assert.Equal(stored.PowerUseWindowEnd, after.PowerUseWindowEnd);
+        Assert.Equal(stored.PowerUseHandoffPct, after.PowerUseHandoffPct);
+    }
+
+    [Fact]
+    public async Task UpdateAppSettings_InvalidTimeAndOutOfRangePct_AreNormalized()
+    {
+        var hub = CreateHub();
+
+        await hub.UpdateAppSettings((await hub.GetAppSettings()) with
+        {
+            PowerUseWindowStart = "25:99",
+            PowerUseWindowEnd = "07:00",
+            PowerUseHandoffPct = 120,
+        });
+        var after = await hub.GetAppSettings();
+
+        Assert.Null(after.PowerUseWindowStart);
+        Assert.Equal("07:00", after.PowerUseWindowEnd);
+        Assert.Equal(99, after.PowerUseHandoffPct);
+    }
+}

tests/ClaudeDo.Worker.Tests/Runner/HandlerRestartCoordinatorTests.cs

@@ -0,0 +1,296 @@
+using ClaudeDo.Data.Models;
+using ClaudeDo.Data.Repositories;
+using ClaudeDo.Worker.External;
+using ClaudeDo.Worker.Hub;
+using ClaudeDo.Worker.Runner;
+using ClaudeDo.Worker.Tests.Infrastructure;
+using ClaudeDo.Worker.Usage;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Logging.Abstractions;
+
+namespace ClaudeDo.Worker.Tests.Runner;
+
+/// Auto-restart of a list-handler ConPTY session that died at the usage limit. The UI half (the
+/// exit code reaching the worker at all) lives in Ui.Tests' InteractiveTerminalViewModel /
+/// MissionControlViewModel tests.
+public sealed class HandlerRestartCoordinatorTests : IDisposable
+{
+    private readonly DbFixture _db = new();
+    private readonly string _tempDir;
+    private readonly CapturingHubContext _hub = new();
+    private readonly HandlerRoundState _rounds;
+
+    private static readonly DateTimeOffset ResetsAt = new(2026, 9, 3, 2, 0, 0, TimeSpan.Zero);
+
+    public HandlerRestartCoordinatorTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), $"cd_handlerrestart_{Guid.NewGuid():N}");
+        Directory.CreateDirectory(_tempDir);
+        _rounds = new HandlerRoundState(Path.Combine(_tempDir, "handler-rounds.json"));
+    }
+
+    public void Dispose() { _db.Dispose(); try { Directory.Delete(_tempDir, true); } catch { } }
+
+    private static readonly DateTimeOffset DueAt = ResetsAt + HandlerUsageGuard.ResetGrace;
+
+    private HandlerRestartCoordinator BuildCoordinator(UsageState usage) =>
+        new(_db.CreateFactory(), usage, _rounds, new HubBroadcaster(_hub),
+            NullLogger<HandlerRestartCoordinator>.Instance);
+
+    /// The coordinator only parks the restart; this is what actually fires it. `now` decides whether
+    /// the parked handoff is already due, so a 5h wait costs a test nothing.
+    private HandlerUsageGuard BuildGuard(UsageState usage, DateTimeOffset now) =>
+        new(_db.CreateFactory(), usage, _rounds, new HandoffRoundTracker(), new HubBroadcaster(_hub),
+            NullLogger<HandlerUsageGuard>.Instance)
+        { NowUtc = () => now };
+
+    /// The one signal a ConPTY death gives the worker: the 5h window pinned at the limit.
+    private static UsageState AtUsageLimit(double percent = 100) =>
+        Snapshot(new UsageBucket(percent, ResetsAt));
+
+    private static UsageState Snapshot(UsageBucket? fiveHour)
+    {
+        var state = new UsageState();
+        state.ReportSuccess(new UsageSnapshot(fiveHour, null, Array.Empty<UsageLimitRow>(), DateTime.UtcNow));
+        return state;
+    }
+
+    private int _nextNumber = 1;
+
+    private async Task<string> SeedHandlerTaskAsync(bool powerUseEnabled = true, bool powerUseAllowed = true)
+    {
+        var listId = Guid.NewGuid().ToString();
+        var taskId = Guid.NewGuid().ToString();
+        using (var ctx = _db.CreateContext())
+        {
+            ctx.Lists.Add(new ListEntity { Id = listId, Name = "L", WorkingDir = _tempDir, CreatedAt = DateTime.UtcNow });
+            ctx.ListConfigs.Add(new ListConfigEntity { ListId = listId, PowerUseAllowed = powerUseAllowed });
+            ctx.Tasks.Add(new TaskEntity
+            {
+                Id = taskId, ListId = listId, Title = "Handler", Number = _nextNumber++,
+                IsManual = true, CreatedAt = DateTime.UtcNow,
+            });
+            await ctx.SaveChangesAsync();
+
+            // Written straight to the row: AppSettingsRepository.UpdateAsync deliberately doesn't
+            // copy PowerUseEnabled (the usage monitor owns that toggle, not the settings modal).
+            await new AppSettingsRepository(ctx).GetAsync(); // materializes the singleton row
+            var settings = await ctx.AppSettings.FirstAsync(s => s.Id == AppSettingsEntity.SingletonId);
+            settings.PowerUseEnabled = powerUseEnabled;
+            await ctx.SaveChangesAsync();
+        }
+        return taskId;
+    }
+
+    private IReadOnlyList<CapturedHubCall> HandoffCalls =>
+        _hub.Proxy.Calls.Where(c => c.Method == "HandoffRequested").ToList();
+
+    // ── acceptance 1: same phase, same task set, after the reset ────────────────────────────────
+
+    [Fact]
+    public async Task UsageLimitDeath_ReopensSamePhaseWithSameTaskSet_AfterTheReset()
+    {
+        var taskId = await SeedHandlerTaskAsync();
+        _rounds.Save(new HandlerRound(taskId, MergeHelperPhase.Merge, new[] { "a", "b" }, DateTime.UtcNow));
+
+        Assert.True(await BuildCoordinator(AtUsageLimit()).OnSessionExitedAsync(taskId, 1));
+
+        // Parked, not relaunched straight into the same exhausted window.
+        Assert.Empty(HandoffCalls);
+        Assert.Equal(DueAt, _rounds.Get(taskId)!.DeferredHandoffAt);
+
+        await BuildGuard(AtUsageLimit(), DueAt).TickAsync(default);
+
+        var call = Assert.Single(HandoffCalls);
+        Assert.Equal(taskId, call.Args[0]);
+        Assert.Equal(new[] { "a", "b" }, (IReadOnlyList<string>)call.Args[1]!);
+        Assert.Equal(MergeHelperPhase.Merge, call.Args[2]);
+    }
+
+    // The #272 review finding: the restart budget used to be spent when the wait STARTED, so a
+    // worker that died during the hours-long wait left the round marked "restart used" without one
+    // ever having happened -- and the session stayed dead forever.
+    [Fact]
+    public async Task ParkedRestart_SurvivesAWorkerRestart_AndOnlySpendsTheBudgetOnceItFires()
+    {
+        var taskId = await SeedHandlerTaskAsync();
+        _rounds.Save(new HandlerRound(taskId, MergeHelperPhase.Merge, new[] { "a" }, DateTime.UtcNow));
+        Assert.True(await BuildCoordinator(AtUsageLimit()).OnSessionExitedAsync(taskId, 1));
+
+        // Worker restart: a fresh state object re-reads the same file, nothing else carries over.
+        var afterRestart = new HandlerRoundState(Path.Combine(_tempDir, "handler-rounds.json"));
+        Assert.False(afterRestart.Get(taskId)!.AutoRestartUsed);
+        Assert.Equal(DueAt, afterRestart.Get(taskId)!.DeferredHandoffAt);
+
+        // Still parked while the window is open...
+        await BuildGuard(AtUsageLimit(), DueAt.AddMinutes(-5)).TickAsync(default);
+        Assert.Empty(HandoffCalls);
+
+        // ...and sent as soon as it is due, which is also when the budget is spent.
+        await BuildGuard(AtUsageLimit(), DueAt).TickAsync(default);
+        Assert.Single(HandoffCalls);
+        Assert.True(_rounds.Get(taskId)!.AutoRestartUsed);
+        Assert.Null(_rounds.Get(taskId)!.DeferredHandoffAt);
+    }
+
+    // ── acceptance 2: at most one auto-restart per round ───────────────────────────────────────
+
+    [Fact]
+    public async Task SecondDeathInTheSameRound_DoesNotRestartAgain()
+    {
+        var taskId = await SeedHandlerTaskAsync();
+        _rounds.Save(new HandlerRound(taskId, MergeHelperPhase.Merge, new[] { "a" }, DateTime.UtcNow));
+        var coordinator = BuildCoordinator(AtUsageLimit());
+
+        Assert.True(await coordinator.OnSessionExitedAsync(taskId, 1));
+        await BuildGuard(AtUsageLimit(), DueAt).TickAsync(default);
+
+        Assert.False(await coordinator.OnSessionExitedAsync(taskId, 1));
+        Assert.Single(HandoffCalls);
+    }
+
+    // A second death while the first restart is still parked must not overwrite or duplicate it.
+    [Fact]
+    public async Task SecondDeathWhileTheRestartIsStillParked_ChangesNothing()
+    {
+        var taskId = await SeedHandlerTaskAsync();
+        _rounds.Save(new HandlerRound(taskId, MergeHelperPhase.Merge, new[] { "a" }, DateTime.UtcNow));
+        var coordinator = BuildCoordinator(AtUsageLimit());
+
+        Assert.True(await coordinator.OnSessionExitedAsync(taskId, 1));
+        Assert.False(await coordinator.OnSessionExitedAsync(taskId, 1));
+
+        await BuildGuard(AtUsageLimit(), DueAt).TickAsync(default);
+        Assert.Single(HandoffCalls);
+    }
+
+    // The restart relaunches the SAME phase, which writes the round again through
+    // InteractiveLaunchSpecService -- that re-save must not hand the round a fresh restart budget.
+    [Fact]
+    public async Task RestartRebuildingTheSamePhase_DoesNotRefreshTheRestartBudget()
+    {
+        var taskId = await SeedHandlerTaskAsync();
+        _rounds.Save(new HandlerRound(taskId, MergeHelperPhase.Merge, new[] { "a" }, DateTime.UtcNow));
+        var coordinator = BuildCoordinator(AtUsageLimit());
+
+        Assert.True(await coordinator.OnSessionExitedAsync(taskId, 1));
+        await BuildGuard(AtUsageLimit(), DueAt).TickAsync(default);
+        // The relaunched session's launch spec writes the round again, same phase.
+        _rounds.Save(new HandlerRound(taskId, MergeHelperPhase.Merge, new[] { "a" }, DateTime.UtcNow));
+
+        Assert.False(await coordinator.OnSessionExitedAsync(taskId, 1));
+        Assert.Single(HandoffCalls);
+    }
+
+    // ── acceptance 3: PowerUse gates it ────────────────────────────────────────────────────────
+
+    [Fact]
+    public async Task ListWithoutPowerUseOptIn_NoRestart()
+    {
+        var taskId = await SeedHandlerTaskAsync(powerUseAllowed: false);
+        _rounds.Save(new HandlerRound(taskId, MergeHelperPhase.Merge, new[] { "a" }, DateTime.UtcNow));
+        var coordinator = BuildCoordinator(AtUsageLimit());
+
+        Assert.False(await coordinator.OnSessionExitedAsync(taskId, 1));
+
+        Assert.Empty(HandoffCalls);
+    }
+
+    [Fact]
+    public async Task PowerUseGloballyOff_NoRestart()
+    {
+        var taskId = await SeedHandlerTaskAsync(powerUseEnabled: false);
+        _rounds.Save(new HandlerRound(taskId, MergeHelperPhase.Merge, new[] { "a" }, DateTime.UtcNow));
+        var coordinator = BuildCoordinator(AtUsageLimit());
+
+        Assert.False(await coordinator.OnSessionExitedAsync(taskId, 1));
+
+        Assert.Empty(HandoffCalls);
+    }
+
+    // ── acceptance 4: a restart spends no handoff budget ───────────────────────────────────────
+
+    // handoff_list_handler is the only caller of HandoffRoundTracker.Register, and the restart never
+    // goes through it -- so a run interrupted by the usage limit does not lose a round of its
+    // wait/merge chain. Asserted against the tool the handler session itself reads the budget from.
+    [Fact]
+    public async Task Restart_DoesNotConsumeHandoffBudget()
+    {
+        var taskId = await SeedHandlerTaskAsync();
+        _rounds.Save(new HandlerRound(taskId, MergeHelperPhase.Merge, new[] { "a" }, DateTime.UtcNow));
+
+        var tracker = new HandoffRoundTracker();
+        tracker.Register(taskId, MergeHelperPhase.Merge, 4); // the run's real handoff into this phase
+
+        using var ctx = _db.CreateContext();
+        var usage = AtUsageLimit();
+        var tools = new HandoffMcpTools(
+            new TaskRepository(ctx), new HubBroadcaster(_hub), tracker, _db.CreateFactory(),
+            BuildGuard(usage, ResetsAt));
+        var before = await tools.GetHandoffStatus(taskId);
+
+        Assert.True(await BuildCoordinator(usage).OnSessionExitedAsync(taskId, 1));
+        await BuildGuard(usage, DueAt).TickAsync(default);
+
+        var after = await tools.GetHandoffStatus(taskId);
+        Assert.Equal(before.Round, after.Round);
+        Assert.Equal(before.Remaining, after.Remaining);
+        Assert.False(after.Final);
+    }
+
+    // ── proof requirement: a non-zero exit alone is not enough ─────────────────────────────────
+
+    // The user closed the session -- exit 0 even sitting at the usage limit.
+    [Fact]
+    public async Task CleanExit_NoRestart()
+    {
+        var taskId = await SeedHandlerTaskAsync();
+        _rounds.Save(new HandlerRound(taskId, MergeHelperPhase.Merge, new[] { "a" }, DateTime.UtcNow));
+
+        Assert.False(await BuildCoordinator(AtUsageLimit()).OnSessionExitedAsync(taskId, 0));
+        Assert.Empty(HandoffCalls);
+    }
+
+    [Fact]
+    public async Task NonZeroExit_WellBelowTheLimit_IsTreatedAsACrash_NoRestart()
+    {
+        var taskId = await SeedHandlerTaskAsync();
+        _rounds.Save(new HandlerRound(taskId, MergeHelperPhase.Merge, new[] { "a" }, DateTime.UtcNow));
+
+        Assert.False(await BuildCoordinator(AtUsageLimit(percent: 40)).OnSessionExitedAsync(taskId, 1));
+        Assert.Empty(HandoffCalls);
+    }
+
+    [Fact]
+    public async Task NoUsageSnapshot_FailsClosed_NoRestart()
+    {
+        var taskId = await SeedHandlerTaskAsync();
+        _rounds.Save(new HandlerRound(taskId, MergeHelperPhase.Merge, new[] { "a" }, DateTime.UtcNow));
+
+        Assert.False(await BuildCoordinator(new UsageState()).OnSessionExitedAsync(taskId, 1));
+        Assert.Empty(HandoffCalls);
+    }
+
+    // ── not a handler round at all ─────────────────────────────────────────────────────────────
+
+    [Fact]
+    public async Task PlainInteractiveSession_HasNoRound_NoRestart()
+    {
+        var taskId = await SeedHandlerTaskAsync();
+
+        Assert.False(await BuildCoordinator(AtUsageLimit()).OnSessionExitedAsync(taskId, 1));
+        Assert.Empty(HandoffCalls);
+    }
+
+    // The triage round has no handoff launch spec, so there is nothing to reopen it with.
+    [Fact]
+    public async Task TriageRound_IsNotReopened()
+    {
+        var taskId = await SeedHandlerTaskAsync();
+        _rounds.Save(new HandlerRound(
+            taskId, InteractiveLaunchSpecService.TriagePhase, new[] { "a" }, DateTime.UtcNow));
+
+        Assert.False(await BuildCoordinator(AtUsageLimit()).OnSessionExitedAsync(taskId, 1));
+        Assert.Empty(HandoffCalls);
+    }
+}

tests/ClaudeDo.Worker.Tests/Runner/HandlerUsageGuardTests.cs

@@ -0,0 +1,277 @@
+using ClaudeDo.Data.Models;
+using ClaudeDo.Data.Repositories;
+using ClaudeDo.Worker.External;
+using ClaudeDo.Worker.Hub;
+using ClaudeDo.Worker.Runner;
+using ClaudeDo.Worker.Tests.Infrastructure;
+using ClaudeDo.Worker.Usage;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Logging.Abstractions;
+
+namespace ClaudeDo.Worker.Tests.Runner;
+
+/// Handing a PowerUse list-handler round over cleanly across the 5h usage limit: warn the live
+/// session once, then withhold the handoff it produces until the window resets. The UI half (the
+/// warning actually reaching the ConPTY session) lives in Ui.Tests' MissionControlViewModel tests.
+public sealed class HandlerUsageGuardTests : IDisposable
+{
+    private readonly DbFixture _db = new();
+    private readonly string _tempDir;
+    private readonly CapturingHubContext _hub = new();
+    private readonly HandlerRoundState _rounds;
+    private readonly HandoffRoundTracker _handoffRounds = new();
+
+    private static readonly DateTimeOffset ResetsAt = new(2026, 9, 3, 2, 0, 0, TimeSpan.Zero);
+    private static readonly DateTimeOffset DueAt = ResetsAt + HandlerUsageGuard.ResetGrace;
+    private static readonly DateTimeOffset Now = ResetsAt.AddHours(-3);
+
+    public HandlerUsageGuardTests()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), $"cd_usageguard_{Guid.NewGuid():N}");
+        Directory.CreateDirectory(_tempDir);
+        _rounds = new HandlerRoundState(RoundsPath);
+    }
+
+    private string RoundsPath => Path.Combine(_tempDir, "handler-rounds.json");
+
+    public void Dispose() { _db.Dispose(); try { Directory.Delete(_tempDir, true); } catch { } }
+
+    private static UsageState Usage(double percent, DateTimeOffset? resetsAt) =>
+        Snapshot(new UsageBucket(percent, resetsAt));
+
+    private static UsageState Snapshot(UsageBucket? fiveHour)
+    {
+        var state = new UsageState();
+        state.ReportSuccess(new UsageSnapshot(fiveHour, null, Array.Empty<UsageLimitRow>(), DateTime.UtcNow));
+        return state;
+    }
+
+    private HandlerUsageGuard BuildGuard(UsageState usage, DateTimeOffset? now = null, HandlerRoundState? rounds = null) =>
+        new(_db.CreateFactory(), usage, rounds ?? _rounds, _handoffRounds, new HubBroadcaster(_hub),
+            NullLogger<HandlerUsageGuard>.Instance)
+        { NowUtc = () => now ?? Now };
+
+    private int _nextNumber = 1;
+
+    private async Task<string> SeedHandlerTaskAsync(bool powerUseEnabled = true, bool powerUseAllowed = true)
+    {
+        var listId = Guid.NewGuid().ToString();
+        var taskId = Guid.NewGuid().ToString();
+        using (var ctx = _db.CreateContext())
+        {
+            ctx.Lists.Add(new ListEntity { Id = listId, Name = "L", WorkingDir = _tempDir, CreatedAt = DateTime.UtcNow });
+            ctx.ListConfigs.Add(new ListConfigEntity { ListId = listId, PowerUseAllowed = powerUseAllowed });
+            ctx.Tasks.Add(new TaskEntity
+            {
+                Id = taskId, ListId = listId, Title = "Handler", Number = _nextNumber++,
+                IsManual = true, CreatedAt = DateTime.UtcNow,
+            });
+            await ctx.SaveChangesAsync();
+
+            // Written straight to the row: AppSettingsRepository.UpdateAsync deliberately doesn't
+            // copy PowerUseEnabled (the usage monitor owns that toggle, not the settings modal).
+            await new AppSettingsRepository(ctx).GetAsync();
+            var settings = await ctx.AppSettings.FirstAsync(s => s.Id == AppSettingsEntity.SingletonId);
+            settings.PowerUseEnabled = powerUseEnabled;
+            await ctx.SaveChangesAsync();
+        }
+        return taskId;
+    }
+
+    private IReadOnlyList<CapturedHubCall> Calls(string method) =>
+        _hub.Proxy.Calls.Where(c => c.Method == method).ToList();
+
+    private IReadOnlyList<CapturedHubCall> Warnings => Calls("HandlerUsageWarning");
+    private IReadOnlyList<CapturedHubCall> HandoffCalls => Calls("HandoffRequested");
+
+    // ── acceptance 1: exactly one warning per round ────────────────────────────────────────────
+
+    [Fact]
+    public async Task AtTheThreshold_WarnsTheSessionExactlyOncePerRound()
+    {
+        var taskId = await SeedHandlerTaskAsync();
+        _rounds.Save(new HandlerRound(taskId, MergeHelperPhase.Merge, new[] { "a" }, DateTime.UtcNow));
+        var guard = BuildGuard(Usage(95, ResetsAt));
+
+        await guard.TickAsync(default);
+        await guard.TickAsync(default);
+        await BuildGuard(Usage(99, ResetsAt)).TickAsync(default);
+
+        var warning = Assert.Single(Warnings);
+        Assert.Equal(taskId, warning.Args[0]);
+        var message = (string)warning.Args[1]!;
+        Assert.Contains("USAGE LIMIT IMMINENT", message);
+        // Names the session's own phase back, so it resumes where it is.
+        Assert.Contains($"nextPhase: \"{MergeHelperPhase.Merge}\"", message);
+        Assert.Contains(taskId, message);
+    }
+
+    [Fact]
+    public async Task BelowTheThreshold_NoWarning()
+    {
+        var taskId = await SeedHandlerTaskAsync();
+        _rounds.Save(new HandlerRound(taskId, MergeHelperPhase.Merge, new[] { "a" }, DateTime.UtcNow));
+
+        await BuildGuard(Usage(94, ResetsAt)).TickAsync(default);
+
+        Assert.Empty(Warnings);
+    }
+
+    // The triage round has no "triage" handoff phase -- what follows it is always the wait phase.
+    [Fact]
+    public async Task TriageRound_IsToldToHandOffToTheWaitPhase()
+    {
+        var taskId = await SeedHandlerTaskAsync();
+        _rounds.Save(new HandlerRound(
+            taskId, InteractiveLaunchSpecService.TriagePhase, new[] { "a" }, DateTime.UtcNow));
+
+        await BuildGuard(Usage(96, ResetsAt)).TickAsync(default);
+
+        Assert.Contains($"nextPhase: \"{MergeHelperPhase.Wait}\"", (string)Assert.Single(Warnings).Args[1]!);
+    }
+
+    // A sealed chain can't hand off at all -- telling it to would only earn the session an exception.
+    [Fact]
+    public async Task SealedChain_IsNotWarned()
+    {
+        var taskId = await SeedHandlerTaskAsync();
+        _rounds.Save(new HandlerRound(taskId, MergeHelperPhase.MergeFinal, new[] { "a" }, DateTime.UtcNow));
+        _handoffRounds.Register(taskId, MergeHelperPhase.MergeFinal);
+
+        await BuildGuard(Usage(99, ResetsAt)).TickAsync(default);
+
+        Assert.Empty(Warnings);
+    }
+
+    // ── acceptance 5: PowerUse gates both halves ───────────────────────────────────────────────
+
+    [Theory]
+    [InlineData(false, true)]
+    [InlineData(true, false)]
+    public async Task PowerUseOff_NeitherWarnsNorWithholds(bool powerUseEnabled, bool powerUseAllowed)
+    {
+        var taskId = await SeedHandlerTaskAsync(powerUseEnabled, powerUseAllowed);
+        _rounds.Save(new HandlerRound(taskId, MergeHelperPhase.Merge, new[] { "a" }, DateTime.UtcNow));
+        var guard = BuildGuard(Usage(99, ResetsAt));
+
+        await guard.TickAsync(default);
+
+        Assert.Empty(Warnings);
+        Assert.Null(await guard.TryDeferHandoffAsync(taskId, new[] { "a" }, MergeHelperPhase.Merge, default));
+        Assert.Null(_rounds.Get(taskId)!.DeferredHandoffAt);
+    }
+
+    // ── acceptance 2 + 3: withholding the handoff ──────────────────────────────────────────────
+
+    [Fact]
+    public async Task BelowTheThreshold_HandoffIsNotWithheld()
+    {
+        var taskId = await SeedHandlerTaskAsync();
+        _rounds.Save(new HandlerRound(taskId, MergeHelperPhase.Merge, new[] { "a" }, DateTime.UtcNow));
+
+        var deferred = await BuildGuard(Usage(94, ResetsAt))
+            .TryDeferHandoffAsync(taskId, new[] { "a" }, MergeHelperPhase.Merge, default);
+
+        Assert.Null(deferred);
+        Assert.Null(_rounds.Get(taskId)!.DeferredHandoffAt);
+    }
+
+    [Fact]
+    public async Task AtTheThreshold_HandoffIsWithheldUntilTheResetPlusGrace()
+    {
+        var taskId = await SeedHandlerTaskAsync();
+        _rounds.Save(new HandlerRound(taskId, MergeHelperPhase.Wait, new[] { "a" }, DateTime.UtcNow));
+        var guard = BuildGuard(Usage(95, ResetsAt));
+
+        var deferred = await guard.TryDeferHandoffAsync(taskId, new[] { "a", "b" }, MergeHelperPhase.Merge, default);
+
+        Assert.Equal(DueAt, deferred);
+        Assert.Empty(HandoffCalls);
+
+        // Still parked before it is due, sent afterwards -- with the handed-off phase and task set,
+        // not the round's own.
+        await BuildGuard(Usage(95, ResetsAt), DueAt.AddMinutes(-1)).TickAsync(default);
+        Assert.Empty(HandoffCalls);
+
+        await BuildGuard(Usage(95, ResetsAt), DueAt).TickAsync(default);
+        var call = Assert.Single(HandoffCalls);
+        Assert.Equal(taskId, call.Args[0]);
+        Assert.Equal(new[] { "a", "b" }, (IReadOnlyList<string>)call.Args[1]!);
+        Assert.Equal(MergeHelperPhase.Merge, call.Args[2]);
+        // A clean handoff must not cost the next session its auto-restart budget.
+        Assert.False(_rounds.Get(taskId)!.AutoRestartUsed);
+    }
+
+    // Utilization can dip back below the threshold while the session finishes its merge; the handoff
+    // that the warning ASKED for still has to wait for the reset.
+    [Fact]
+    public async Task AfterAWarning_HandoffIsWithheldEvenIfUtilizationDropped()
+    {
+        var taskId = await SeedHandlerTaskAsync();
+        _rounds.Save(new HandlerRound(taskId, MergeHelperPhase.Merge, new[] { "a" }, DateTime.UtcNow));
+        await BuildGuard(Usage(97, ResetsAt)).TickAsync(default);
+        Assert.Single(Warnings);
+
+        var deferred = await BuildGuard(Usage(80, ResetsAt))
+            .TryDeferHandoffAsync(taskId, new[] { "a" }, MergeHelperPhase.Merge, default);
+
+        Assert.Equal(DueAt, deferred);
+    }
+
+    // No reset time = nothing to wait for. Sending now beats parking a handoff that never fires.
+    [Fact]
+    public async Task NoResetTime_HandsOffImmediately()
+    {
+        var taskId = await SeedHandlerTaskAsync();
+        _rounds.Save(new HandlerRound(taskId, MergeHelperPhase.Merge, new[] { "a" }, DateTime.UtcNow));
+
+        var deferred = await BuildGuard(Usage(99, null))
+            .TryDeferHandoffAsync(taskId, new[] { "a" }, MergeHelperPhase.Merge, default);
+
+        Assert.Null(deferred);
+        Assert.Null(_rounds.Get(taskId)!.DeferredHandoffAt);
+    }
+
+    // ── acceptance 4: a parked handoff survives a worker restart ───────────────────────────────
+
+    [Fact]
+    public async Task WorkerRestart_ReschedulesAParkedHandoff_AndSendsAnOverdueOneAtOnce()
+    {
+        var taskId = await SeedHandlerTaskAsync();
+        _rounds.Save(new HandlerRound(taskId, MergeHelperPhase.Merge, new[] { "a" }, DateTime.UtcNow));
+        await BuildGuard(Usage(99, ResetsAt))
+            .TryDeferHandoffAsync(taskId, new[] { "a" }, MergeHelperPhase.Merge, default);
+
+        // Worker restart: nothing but the file carries over.
+        var afterRestart = new HandlerRoundState(RoundsPath);
+        Assert.Equal(DueAt, afterRestart.Get(taskId)!.DeferredHandoffAt);
+
+        // Not due yet -> still parked.
+        await BuildGuard(Usage(99, ResetsAt), Now, afterRestart).TickAsync(default);
+        Assert.Empty(HandoffCalls);
+
+        // Long overdue (the worker was down past the reset) -> goes out on the first tick.
+        await BuildGuard(Usage(99, ResetsAt), DueAt.AddHours(2), afterRestart).TickAsync(default);
+        Assert.Single(HandoffCalls);
+        Assert.Null(afterRestart.Get(taskId)!.DeferredHandoffAt);
+    }
+
+    // One trigger, one state: a parked handoff blocks the auto-restart of the same round, so the
+    // round can never be reopened twice.
+    [Fact]
+    public async Task AParkedHandoff_BlocksTheAutoRestartOfTheSameRound()
+    {
+        var taskId = await SeedHandlerTaskAsync();
+        _rounds.Save(new HandlerRound(taskId, MergeHelperPhase.Merge, new[] { "a" }, DateTime.UtcNow));
+        var usage = Usage(99, ResetsAt);
+        await BuildGuard(usage).TryDeferHandoffAsync(taskId, new[] { "a" }, MergeHelperPhase.Merge, default);
+
+        var coordinator = new HandlerRestartCoordinator(
+            _db.CreateFactory(), usage, _rounds, new HubBroadcaster(_hub),
+            NullLogger<HandlerRestartCoordinator>.Instance);
+        Assert.False(await coordinator.OnSessionExitedAsync(taskId, 1));
+
+        await BuildGuard(usage, DueAt).TickAsync(default);
+        Assert.Single(HandoffCalls);
+    }
+}

tests/ClaudeDo.Worker.Tests/Runner/InteractiveLaunchSpecServiceTests.cs

@@ -73,12 +73,20 @@ public sealed class InteractiveLaunchSpecServiceTests : IDisposable
             => Task.FromResult<IReadOnlyList<SessionSkillEntity>>(Installed);
     }
 
-    private InteractiveLaunchSpecService BuildService(HandoffRoundTracker? handoffRounds = null) =>
+    private InteractiveLaunchSpecService BuildService(
+        HandoffRoundTracker? handoffRounds = null, HandlerRoundState? roundState = null, DateTime? now = null) =>
         new(_db.CreateFactory(), _seeder, _registry,
             new WorktreeManager(new GitService(), _db.CreateFactory(), new WorkerConfig(), NullLogger<WorktreeManager>.Instance),
             new GitService(),
             new WorkerConfig { ClaudeBin = _claudeStubPath },
-            handoffRounds ?? new HandoffRoundTracker());
+            handoffRounds ?? new HandoffRoundTracker(),
+            roundState ?? NewRoundState(),
+            now is { } t ? () => t : null);
+
+    // Never the live ~/.claudeDo/handler-rounds.json -- a test run would otherwise write real
+    // handler rounds into the running app's state.
+    private HandlerRoundState NewRoundState() =>
+        new(Path.Combine(_tempDir, $"handler-rounds-{Guid.NewGuid():N}.json"));
 
     private async Task<string> SeedListAsync(string? workingDir = null, string name = "L")
     {
@@ -212,8 +220,15 @@ public sealed class InteractiveLaunchSpecServiceTests : IDisposable
     }
 
     [Fact]
-    public async Task BuildForTaskAsync_NoWorktreeRow_NoWorkingDirConfigured_ThrowsInvalidOperation()
+    public async Task BuildForTaskAsync_NoWorktreeRow_NoWorkingDirConfigured_OpensInUserHomeWithoutSeedingSkills()
     {
+        _registry.Installed.Add(new SessionSkillEntity
+        {
+            Name = "installed-skill", SourceUrl = "https://example.com/x.git",
+            PinnedRef = "abc", Subpath = "skills/installed-skill", Description = "d",
+            AddedAt = DateTimeOffset.UtcNow,
+        });
+
         var listId = await SeedListAsync();
         using (var ctx = _db.CreateContext())
         {
@@ -222,11 +237,18 @@ public sealed class InteractiveLaunchSpecServiceTests : IDisposable
             await ctx.SaveChangesAsync();
         }
         var taskId = Guid.NewGuid().ToString();
-        await SeedTaskAsync(taskId, listId, TaskStatus.Idle);
+        await SeedTaskAsync(taskId, listId, TaskStatus.Idle,
+            sessionSkillsJson: "[\"installed-skill\"]");
 
         var svc = BuildService();
-        await Assert.ThrowsAsync<InvalidOperationException>(
-            () => svc.BuildForTaskAsync(taskId, CancellationToken.None));
+        var spec = await svc.BuildForTaskAsync(taskId, CancellationToken.None);
+
+        Assert.Equal(Environment.GetFolderPath(Environment.SpecialFolder.UserProfile), spec.Cwd);
+        // Seeding here would copy into the user's REAL ~/.claude/skills.
+        Assert.Empty(_seeder.Calls);
+
+        using var readCtx = _db.CreateContext();
+        Assert.Null(await new WorktreeRepository(readCtx).GetByTaskIdAsync(taskId));
     }
 
     [Fact]
@@ -685,9 +707,19 @@ public sealed class InteractiveLaunchSpecServiceTests : IDisposable
         });
     }
 
-    private async Task<string> ReadHandlerSystemPromptAsync(string listId, string taskId)
+    private async Task SetPowerUseWindowAsync(string? start, string? end)
     {
-        var svc = BuildService();
+        using var ctx = _db.CreateContext();
+        await new AppSettingsRepository(ctx).GetAsync();
+        var row = await ctx.AppSettings.FirstAsync(s => s.Id == AppSettingsEntity.SingletonId);
+        row.PowerUseWindowStart = start;
+        row.PowerUseWindowEnd = end;
+        await ctx.SaveChangesAsync();
+    }
+
+    private async Task<string> ReadHandlerSystemPromptAsync(string listId, string taskId, DateTime? now = null)
+    {
+        var svc = BuildService(now: now);
         var spec = await svc.BuildForMergeHelperAsync(
             new[] { taskId }, listId, Guid.NewGuid().ToString(), CancellationToken.None);
         var sessionDir = TrackSessionDir(spec);
@@ -752,6 +784,67 @@ public sealed class InteractiveLaunchSpecServiceTests : IDisposable
         Assert.StartsWith(PromptFiles.ReadOrDefault(PromptKind.MergeHelperTriage), prompt);
     }
 
+    /// The window is a third key on top of the global switch and the list opt-in. Both corners
+    /// use the same overnight window, so only the injected clock differs — that is the whole point
+    /// of injecting it rather than reading DateTime.Now inside the composition.
+    [Fact]
+    public async Task BuildForMergeHelperAsync_PowerUseOutsideWindow_LeavesPromptUntouched()
+    {
+        var repo = Path.Combine(_tempDir, "puOutsideWindow");
+        Directory.CreateDirectory(repo);
+        var listId = await SeedListAsync(workingDir: repo);
+        var taskId = Guid.NewGuid().ToString();
+        await SeedTaskAsync(taskId, listId, TaskStatus.WaitingForReview);
+
+        await SetPowerUseEnabledAsync(true);
+        await SetPowerUseAllowedAsync(listId, true);
+        await SetPowerUseWindowAsync("22:00", "07:00");
+
+        var prompt = await ReadHandlerSystemPromptAsync(
+            listId, taskId, now: new DateTime(2026, 9, 2, 12, 0, 0));
+
+        Assert.DoesNotContain(AddendumMarker, prompt);
+        Assert.Equal(PromptFiles.ReadOrDefault(PromptKind.MergeHelperTriage), prompt);
+    }
+
+    [Fact]
+    public async Task BuildForMergeHelperAsync_PowerUseInsideWindow_AppendsAddendum()
+    {
+        var repo = Path.Combine(_tempDir, "puInsideWindow");
+        Directory.CreateDirectory(repo);
+        var listId = await SeedListAsync(workingDir: repo);
+        var taskId = Guid.NewGuid().ToString();
+        await SeedTaskAsync(taskId, listId, TaskStatus.WaitingForReview);
+
+        await SetPowerUseEnabledAsync(true);
+        await SetPowerUseAllowedAsync(listId, true);
+        await SetPowerUseWindowAsync("22:00", "07:00");
+
+        var prompt = await ReadHandlerSystemPromptAsync(
+            listId, taskId, now: new DateTime(2026, 9, 2, 23, 30, 0));
+
+        Assert.Contains(AddendumMarker, prompt);
+    }
+
+    [Fact]
+    public async Task BuildForMergeHelperAsync_HalfSetWindow_AppendsAddendumAtAnyTime()
+    {
+        var repo = Path.Combine(_tempDir, "puHalfWindow");
+        Directory.CreateDirectory(repo);
+        var listId = await SeedListAsync(workingDir: repo);
+        var taskId = Guid.NewGuid().ToString();
+        await SeedTaskAsync(taskId, listId, TaskStatus.WaitingForReview);
+
+        await SetPowerUseEnabledAsync(true);
+        await SetPowerUseAllowedAsync(listId, true);
+        await SetPowerUseWindowAsync("22:00", null);
+
+        var prompt = await ReadHandlerSystemPromptAsync(
+            listId, taskId, now: new DateTime(2026, 9, 2, 12, 0, 0));
+
+        Assert.Contains(AddendumMarker, prompt);
+    }
+
     [Fact]
     public async Task BuildForMergeHelperAsync_EmptyTaskIds_ThrowsInvalidOperation()
     {

tests/ClaudeDo.Worker.Tests/State/TaskStateServiceTests.cs

@@ -585,6 +585,23 @@ public sealed class TaskStateServiceTests : IDisposable
         Assert.Equal(TaskStatus.Running, await GetStatusAsync(id));
     }
 
+    [Fact]
+    public async Task DequeueToIdleAsync_MidChain_UnblocksSuccessor()
+    {
+        // pred (queued, blocked) is removed from the queue in the middle of a chain;
+        // successor was blocked on pred and must not be left wedged forever.
+        var pred = await SeedTaskAsync(TaskStatus.Queued);
+        var id = await SeedTaskAsync(TaskStatus.Queued, blockedBy: pred);
+        var successor = await SeedTaskAsync(TaskStatus.Queued, blockedBy: id);
+
+        var result = await _sut.DequeueToIdleAsync(id, default);
+
+        Assert.True(result.Ok);
+        var successorTask = await GetTaskAsync(successor);
+        Assert.Equal(TaskStatus.Queued, successorTask.Status);
+        Assert.Null(successorTask.BlockedByTaskId);
+    }
+
     // ─── StartPlanningAsync ───────────────────────────────────────────────
 
     [Fact]

tests/ClaudeDo.Worker.Tests/UiVm/TaskRowViewModelNotificationsTests.cs

@@ -281,6 +281,7 @@ public class TaskRowViewModelNotificationsTests
             nameof(TaskRowViewModel.IsQueued),
             nameof(TaskRowViewModel.IsWaiting),
             nameof(TaskRowViewModel.StatusChipClass),
+            nameof(TaskRowViewModel.CanRemoveFromQueue),
         }, raised);
     }