fix(installer): retry stashing app/worker through transient file locks on update

The update pipeline moved app/ and worker/ to .bak before extraction with no
retry, so a just-killed worker whose file handles had not been released yet
(WaitForExit returns before the OS flushes them) caused Directory.Move to throw
ERROR_SHARING_VIOLATION, stopping the pipeline on a cryptic error screen.

- DownloadAndExtractStep: stash/rollback moves+deletes now retry through
  transient IO/access errors (~5s); a persistent lock returns an actionable
  message instead of the raw error.
- StopWorkerStep: reading MainModule no longer skips Kill on failure, and a
  short settle follows the kill so handles are released before extraction.

CHANGELOG.md

@@ -1,5 +1,134 @@
 # Changelog
 
+## v2.3.0 — 2026-07-24
+
+### Features
+
+- open merge-helper ConPTY tile from selection (083e1f3)
+- add "Let Claude handle it" entry points (ecbc734)
+- add merge-helper task selection dialog (327ae2b)
+- expose merge-helper launch spec over hub + client (5ba0c09)
+- build merge-helper interactive launch spec (78d4e1a)
+- add merge-helper prompt templates (c7d64e9)
+- add continue_merge and abort_merge MCP tools (7517f2a)
+- let review_task/merge_task leave conflicts in tree via MCP (f4f7c81)
+
+### Documentation
+
+- helper handles all merges; manual conflict fallback (2a3ab55)
+- spec + implementation plan (962f68c)
+- update for v2.2.0 (d12a888)
+
+## v2.2.0 — 2026-07-24
+
+### Features
+
+- submit interactive (ConPTY) work for review (109a35c)
+- gate Approve & Merge behind opening the diff (2aaaa23)
+- run interactive planning sessions via embedded ConPTY (ef285b2)
+- AskUser question banner in the detail island (798d100)
+- conflict resolver shows why Continue is disabled (da6a70a)
+- session-skills empty-state + neutral subtask terminology (85d0f9d)
+
+### Fixes
+
+- use default permission mode so MCP planning tools don't prompt (624ec7a)
+- hide misleading Idle chip on planning parents (e8f7e3a)
+- show structured-output summary instead of raw JSON in OUTCOME (8a7275a)
+- live-refresh child rows on parent planning transitions (f4dd67d)
+- restore turn/token counts on task reload (0226c98)
+- clearer rename display in diff viewer (b9b3053)
+- diagnostic error surfacing on attachment drop (671c886)
+- surface resume-planning-session failures (ffff1ee)
+- render Plus and agent-settings gear icons (ad2acdd)
+- kill cancelled runs' processes and make MCP approve actually merge (fee6999)
+- make external MCP filter params optional, surface tool errors (d7ebafd)
+- merge preflights ignore untracked files in target working tree (14e4c08)
+- UnifiedDiffParser mishandles paths with spaces and git-quoted paths (0f2d202)
+- validate conflict markers before staging in ContinueMergeAsync (377409e)
+- cascade cancel of a WaitingForChildren parent to its non-terminal children (941c8b9)
+- advance parent when the last non-terminal child is deleted (2452e39)
+- keep planning-chain cascade moving past an Idle middle link (816f247)
+
+### Documentation
+
+- spec for ConPTY planning sessions (2612831)
+- record session progress (A/B done, C#9+#11, D#13+#14; C#10/#12 + group E deferred) (04044bd)
+- add fix-plan for fresh session (findings grouped by fixability); defer §10, mark §11 OK per Mika (efd7cc9)
+- §3 UnfinishedPlanning modal (Finalize/Discard PASS, Resume BUG); generalize child-row live-refresh finding; edges done (75a6e0e)
+- finding — Resume planning session is broken (session_id never captured) + error swallowed by empty catch (9efc5c9)
+- §1 DiffModal error-state resolved via code analysis (defensive/unreachable, gates prevent it) (6ca8cac)
+- §4 merge-editor Abort PASS (tree clean, task stays WaitingForReview) (9a1fa3d)
+- §9 attachments drag&drop UI PASS (overlay/drop/picker/remove); finding — intermittent first-drop error (9b4d343)
+- §8 Session Skills complete (Remove PASS); refresh handoff summary + fixture state (a1ba3b6)
+- §8 per-task activation + no-leak counterprobe PASS; UI partial (cards/general-tab open) (9b041ba)
+- finding — agent-settings gear uses Unicode glyph, not Icon.Settings PathIcon (inconsistent) (39fc594)
+- §8 skill install PASS (6 skills, commit-pinned); finding — Skills tab has no empty-state (b353ed6)
+- note Mika explicitly wants AskUser interaction in detail island (416e47e)
+- §7 AskUser complete — timeout UI-cleanup visually verified (banner clears) (e8b5e97)
+- §7 AskUser PASS (happy-path + backend timeout); finding — banner only in Mission Control, absent in detail island (d19ef54)
+- note fixture cleanup (verif tasks/worktrees removed, ClaudeDoTests reset) (ded068c)
+- refresh handoff for next session — progress, remaining (§7-§11+edges), gotchas, fixture state (9556e0e)
+- trim to actively-verified 2026-07-24 findings; drop stale manual-verif/historical blocks (9d39a8f)
+- §5 ConPTY/Mission Control PASS (prompt-send, close kills proc); ad-hoc icon invisible + re-open re-sends noted (b536b6f)
+- §5 findings — invisible New-session icon (Icon.Plus stroke-only), re-open re-sends prompt (1b80bb0)
+- §3 PASS end-to-end (+§1 children-band, +§4 planning-conflict); dequeue-X UX nit (4394623)
+- §3 finalize findings — improvements-mislabel, child-badge live-refresh, chain not visualized (f0b0582)
+- planning session permission-prompt bug + planning-active parent shows Idle (UX) (07de897)
+- clean additive approve PASS (2101228)
+- §1 commit-range-after-merge PASS; blocked-merge silent-fail confirmed on clean path too (8241bf8)
+- §4 merge editor PASS end-to-end + UX findings (continue-btn, multi-file, blocked-merge) (255705d)
+- Approve & Merge silently swallows a blocked merge (no footer error) (3dfd75f)
+- §1 findings — raw-JSON outcome bug, rename/turns nits, session-tab expected (26c03a5)
+- correct permission finding — auto+haiku denies writes (not a CLI regression), §2 happy-path PASS (3211bfc)
+- log autonomous-batch results (§2/§6/§9/§12) (79ce7af)
+- track CLI 2.1.207 --permission-mode auto write-denial regression (0ad93f4)
+- remove chain-cascade bug bullet (fixed in 110364a) (3d668da)
+- explore-notes convention + verification handoff for manual checks (d6891b8)
+- update for v2.1.0 (ad58129)
+
+## v2.1.0 — 2026-07-23
+
+### Features
+
+- seed fresh task session with the task prompt (d8194ad)
+- New session button for ad-hoc ConPTY sessions (3feb08d)
+- fresh-worktree-on-demand + ad-hoc launch specs (9ab48d7)
+- host task-based ConPTY sessions in Command Center (0513265)
+- embedded ConPTY terminal host in UI (5f740c0)
+- worker launch-spec for embedded ConPTY sessions (1245e75)
+- session skills registry tab + per-level selectors (7c3c061)
+- session skills SignalR surface + per-level persistence (b4c5808)
+- resolve and seed session skills before each run (4626481)
+- session skill registry (install/update/remove, pinned clone) (dea2b7d)
+- session skills entity, repository, and migration (54cdaf8)
+- pick up a task's session in a terminal (eb88dc1)
+- resume a task's claude session in a terminal (140ae2f)
+
+### Fixes
+
+- set monospace font + stretch on ConPTY terminal (d9a4627)
+- use library LaunchProcess instead of custom pty bypass (2b06ab0)
+- correct ConPTY terminal size + reduce lag (bb62740)
+- forward keyboard input to ConPTY terminal (25922a2)
+- seed planning brief via file to avoid newline truncation (865e12c)
+
+### Refactoring
+
+- remove streaming interactive stack (superseded by ConPTY) (c412a84)
+
+### Documentation
+
+- update ConPTY spec + open items to final state (85c7e65)
+- record ConPTY library + binding decision from spike (d28c63d)
+- ConPTY interactive sessions spec + plan (d91ad2d)
+- session skills verification items (f33838d)
+- mark cwd-skill discovery verified in headless mode (dbaefe9)
+- revise for multi-skill plugin repos (ponytail) (62b245a)
+- spec + plan for per-level session skills (4e5057d)
+- pick up a task's session in a terminal — verification (1bf08ec)
+- update for v2.0.0 (914fa5a)
+
 ## v2.0.0 — 2026-06-26
 
 ### Features

CLAUDE.md

@@ -39,7 +39,7 @@ Each project has its own `CLAUDE.md` — those are the living per-project docs.
 - EF Core migrations manage schema (Migrations/ folder in ClaudeDo.Data)
 - `IDbContextFactory<ClaudeDoDbContext>` used by singleton consumers (e.g. Worker)
 - Entity configuration via `IEntityTypeConfiguration<T>` in Configuration/ folder
-- Task status flow: Idle | Queued -> Running -> WaitingForReview -> Done | Failed | Cancelled. A task that spawns/has children passes through WaitingForChildren first, then surfaces for review once every child is terminal — this is the single parent model for both planning and improvement parents (planning/improvement *children* themselves go straight to Done, only the parent is reviewed). From review you can approve, reject-rerun (Queued, resumes the session with feedback), reject-park (Idle), or cancel. Approve is the single review+merge action: a childless task merges its own worktree then Done (conflicts keep it in WaitingForReview); a task with children drives the unit merge (parent worktree if any + each Done child in order, with conflict continue/abort). Tasks with no active worktree (sandbox run) approve straight to Done.
+- Task status flow: Idle | Queued -> Running -> WaitingForReview -> Done | Failed | Cancelled. A task that spawns/has children passes through WaitingForChildren first, then surfaces for review once every child is terminal — this is the single parent model for both planning and improvement parents (planning/improvement *children* themselves go straight to Done, only the parent is reviewed). From review you can approve, reject-rerun (Queued, resumes the session with feedback), reject-park (Idle), or cancel. Approve is the single review+merge action: a childless task merges its own worktree then Done (conflicts keep it in WaitingForReview); a task with children drives the unit merge (parent worktree if any + each Done child in order, with conflict continue/abort). Tasks with no active worktree (sandbox run) approve straight to Done. In the detail pane, **Approve & Merge is gated behind opening the diff**: when there is something to inspect (worktree diff / merged range / children combined diff) the button stays disabled until the diff or combined-diff viewer has been opened once, and re-locks per run (any state change resets it); tasks with nothing to inspect are never gated. The row-level quick-approve in the task list is an intentional bypass.
 - Worktree state flow: Active -> Merged | Discarded | Kept
 - The queue picker claims tasks by `Status=Queued` (with `BlockedByTaskId IS NULL`); the legacy tag system was removed
 - Interfaces live in an `Interfaces/` subfolder beside their consumers (namespace unchanged)
@@ -84,3 +84,4 @@ dotnet test tests/ClaudeDo.Worker.Tests/ClaudeDo.Worker.Tests.csproj -c Release
 - `docs/improvement-plan.md` — improvement snapshot from 2026-04-13 (historical)
 - `docs/prompts-inventory.md`, `docs/mailbox-proposal.md` — reference material (mailbox integration is parked)
 - `CHANGELOG.md` — Keep a Changelog format, maintained on release
+- `docs/explore-notes/` — distilled maps of complex subsystems from deep exploration (detail too fine for a CLAUDE.md). **Before** deep-exploring a subsystem, check for a matching note first; **after** a deep explore, distill durable findings back and bump its "verified against" commit. Always verify against current code before trusting. See `docs/explore-notes/README.md`.

docs/explore-notes/README.md

@@ -0,0 +1,38 @@
+# Explore-notes
+
+Distilled, reusable maps of complex subsystems, produced by deep code exploration.
+The goal: stop re-exploring the same subsystem from scratch in every new session.
+
+These sit **between** the CLAUDE.md files and the code:
+
+- **CLAUDE.md** — high-level orientation, hand-maintained, always-loaded.
+- **explore-notes** — deeper subsystem detail (flows, who-calls-whom, invariants) that is
+  too fine-grained for a CLAUDE.md but stable enough to be worth caching. Read on demand.
+- **code** — the only source of truth.
+
+## Rules
+
+- **Only stable structure.** Flows, responsibilities, entry points, invariants, relative
+  file paths. **No line numbers**, no exhaustive symbol dumps — those rot fastest.
+- **Verify before trusting.** A note is a starting map, not authority. Always confirm
+  against current code before acting on it. Each note records the commit it was verified
+  against so you can diff for drift.
+- **Not a substitute for CLAUDE.md.** If a fact belongs in orientation, put it there.
+
+## Header every note must carry
+
+```
+> **Explore-note — verify before trusting.** Distilled map of a subsystem, not authoritative.
+> Last verified against commit `<short-hash>` (<date>).
+> Drift check: `git log --oneline <short-hash>..HEAD -- <paths this note covers>`
+> Stable structure only (no line numbers). See docs/explore-notes/README.md.
+```
+
+## Workflow
+
+1. **Before** deep-exploring a subsystem, check for a matching note here and read it first;
+   explore only to fill gaps or confirm.
+2. **After** a deep explore, distill the durable findings into a new/updated note and bump
+   its "verified against" commit line.
+3. If the drift check shows the covered paths changed a lot since the verified commit, treat
+   the note as suspect and re-verify the parts you rely on.

docs/explore-notes/worker-task-pipeline.md

@@ -0,0 +1,124 @@
+> **Explore-note — verify before trusting.** Distilled map of a subsystem, not authoritative.
+> Last verified against commit `896d4b5` (2026-07-23).
+> Drift check: `git log --oneline 896d4b5..HEAD -- src/ClaudeDo.Worker`
+> Stable structure only (no line numbers). See docs/explore-notes/README.md.
+
+# Worker: Task Execution Pipeline
+
+How a task moves Queued → Running → terminal, across `src/ClaudeDo.Worker`
+(Queue, Runner, Lifecycle, State, Agents, Worktrees, Hub).
+
+## End-to-End Flow (Queued → Terminal)
+
+1. **Enqueue** — `ITaskStateService.EnqueueAsync()` (State/TaskStateService.cs)
+   - Idle → Queued, then wakes the dispatcher via `IQueueWaker.Wake()`.
+
+2. **Dispatch** — `QueueService` loop (Queue/QueueService.cs)
+   - `BackgroundService`; waits for a wake signal or a backstop timer.
+   - Reads the max-parallel limit from settings; claims a free slot if under limit.
+
+3. **Atomic Claim** — `IQueuePicker.ClaimNextAsync()` (Queue/QueuePicker.cs)
+   - Raw SQL `UPDATE ... RETURNING` in one transaction: picks an eligible Queued task
+     (unblocked, due or unscheduled; sorted by sort_order/created_at), sets status→Running
+     + started_at, returns the row. Prevents two workers claiming the same task (TOCTOU).
+
+4. **Slot Execution** — `QueueService.RunInSlotAsync()` (Queue/QueueService.cs)
+   - For review feedback: resume the prior session if one exists, else fold feedback into
+     the prompt. Calls `TaskRunner.RunAsync()` / `ContinueAsync()` with `alreadyClaimed=true`.
+
+5. **Run Preparation** — `TaskRunner.RunAsync()` (Runner/TaskRunner.cs)
+   - Loads task, list config, subtasks, attachments from the DB.
+   - `PrepareRunDirectoryAsync()`: worktree (via WorktreeManager) if the list has a WorkingDir,
+     else sandbox. Generates a per-run MCP token, writes MCP config to disk.
+   - `StartRunningAsync()` (only if not pre-claimed): atomic Queued → Running. Broadcasts TaskStarted.
+
+6. **Claude Execution** — `TaskRunner.RunOnceAsync()` (Runner/TaskRunner.cs)
+   - Creates a TaskRunEntity, points the task at the run's log path.
+   - Builds claude CLI args (ClaudeArgsBuilder), spawns the process via `IClaudeProcess.RunAsync()`
+     with prompt + working dir + streaming callback.
+   - Stream lines → NDJSON log + broadcast via TaskMessage. MCP tools (AskUser, SuggestImprovement)
+     are scoped by the per-run token.
+
+7. **Result Handling** — `TaskRunner.HandleSuccess()` / `MarkFailed()` (Runner/TaskRunner.cs)
+   - Success (exit 0 + result markdown): if worktree, commit + broadcast WorktreeUpdated; then
+     transition to Done / WaitingForReview / WaitingForChildren (CompleteAsync / SubmitForReviewAsync
+     / SubmitForChildrenAsync).
+   - Failure: if a session exists, auto-retry once via ContinueAsync; else MarkFailed → FailAsync.
+   - All terminal writes use `CancellationToken.None` so a task is never left Running.
+
+8. **Terminal States** — `ITaskStateService` transitions (State/TaskStateService.cs)
+   - **Done** CompleteAsync (Running → Done) — top-level success.
+   - **WaitingForReview** SubmitForReviewAsync (Running → WaitingForReview) — review gate.
+   - **WaitingForChildren** SubmitForChildrenAsync (Running → WaitingForChildren) — blocks on children.
+   - **Failed** FailAsync (Running/Queued → Failed).
+   - **Cancelled** CancelAsync (Running/Queued/WaitingForReview/WaitingForChildren → Cancelled).
+
+## Component Responsibilities
+
+**Queue/**
+- `QueueService` — main dispatch loop; slot limit; decides when to start tasks.
+- `QueuePicker` — atomic Queued→Running claim via raw SQL.
+- `QueueWaker` — semaphore for non-blocking, idempotent wake signals.
+- `OverrideSlotService` — owns the RunNow / ContinueTask slot (bypasses the queue).
+
+**Runner/**
+- `TaskRunner` — orchestrates the run (prepare, execute, handle result).
+- `WorktreeManager` — creates/manages git worktrees; self-heals stale branches.
+- `ClaudeProcess` — spawns the claude CLI subprocess; manages streams/logs.
+- `TaskRunMcpService` — runtime MCP tools (AskUser, SuggestImprovement).
+- `TaskRunTokenRegistry` — per-run MCP identity for tool-access control.
+- `InteractiveLaunchSpecService` — config for the task's claude run.
+
+**State/**
+- `TaskStateService` — all task status transitions; guards preconditions; signals queue/hub.
+
+**Lifecycle/** (startup recovery)
+- `StaleTaskRecovery` — tasks stuck Running after a crash/restart → Failed.
+- `OrphanRecovery` — dequeues children whose parent is no longer planning (stays attached).
+- `AttachmentOrphanRecovery` — cleans orphaned attachment files.
+- `TaskResetService` — manual reset to Idle.
+- `TaskMergeService` — conflict resolution for worktree merges.
+
+**Hub/**
+- `HubBroadcaster` — single SignalR broadcast point (TaskStarted/TaskUpdated/TaskMessage/RunCreated…).
+- `WorkerHub` — SignalR hub + client methods.
+
+**Agents/**
+- `AgentFileService` — file I/O for custom agents.
+- `DefaultAgentSeeder` — seeds built-in agents on startup.
+
+**Worktrees/**
+- `WorktreeMaintenanceService` — cleanup, state tracking, overview reporting.
+
+## Entry Points & Call Chain
+
+```
+Program.cs (DI setup)
+ ├─ QueueService (BackgroundService) → ExecuteAsync loop
+ │   ├─ waits: IQueueWaker.WaitAsync() or timer
+ │   ├─ claims: IQueuePicker.ClaimNextAsync()
+ │   └─ runs:  TaskRunner.RunAsync() / ContinueAsync()
+ ├─ Hub clients → WorkerHub methods
+ │   ├─ Enqueue     → ITaskStateService.EnqueueAsync() → Wake()
+ │   ├─ RunNow      → OverrideSlotService.RunNow()      → TaskRunner.RunAsync()
+ │   ├─ ContinueTask→ OverrideSlotService.ContinueTask()→ TaskRunner.ContinueAsync()
+ │   └─ CancelTask  → QueueService.CancelTask()
+ ├─ Lifecycle recovery (startup): StaleTaskRecovery / OrphanRecovery / AttachmentOrphanRecovery
+ └─ State transitions → HubBroadcaster.TaskUpdated()
+```
+
+## Invariants & Conventions
+
+- **Atomic claiming** — QueuePicker's `UPDATE ... RETURNING` makes Queued→Running atomic.
+- **Slot limit** — respects MaxParallelExecutions; a backstop timer wakes even if a Wake() is missed.
+- **Pre-claimed tasks** — the dispatcher pre-claims via the picker; the override slot
+  (RunNow/ContinueTask) must call StartRunningAsync if a task is not pre-claimed.
+- **Terminal writes** — use `CancellationToken.None`; a task is never left Running after crash/cancel.
+- **Per-run MCP tokens** — each run gets a unique token scoping tool access; unregistered on end.
+- **Auto-retry** — one automatic retry if a session exists and the first run failed.
+- **Worktree self-heal** — on branch collision, remove phantom worktrees, prune, delete branch, retry add.
+- **Review feedback** — stored on the task; consumed once a run reaches a terminal state; a re-queued
+  task resumes the session or folds feedback into the prompt.
+- **Child tasks** — planning creates draft children; finalization requires no Queued children remain;
+  OrphanRecovery dequeues children if the parent is not planning.
+- **Lifecycle recovery** runs at startup: stale-Running → Failed; orphaned children → dequeued but attached.

docs/fix-plan-2026-07-24.md

@@ -0,0 +1,189 @@
+# Fix-Plan — Verifikations-Findings (Stand 2026-07-24)
+
+Einstiegspunkt für eine **frische Fix-Session**. Sammelt die in der manuellen Verifikation
+(§7–§9 + Kanten §1/§3/§4) gefundenen Probleme, gruppiert nach **Fixbarkeit**. Volltext je
+Finding (mit Kontext/Wiederholschritten) steht in `docs/open.md`; hier steht der Fix-Blick:
+Root-Cause, konkreter Ansatz, Loc/Test-Hinweise, und **welche Punkte vor der Umsetzung eine
+Entscheidung brauchen**.
+
+**Immer zuerst:** file:line-Angaben gegen den aktuellen Code prüfen (können minimal driften).
+Build/Test-Regeln + Gotchas s. Projekt-`CLAUDE.md` (u.a. `.slnx` braucht .NET 9 → einzelne
+`.csproj -c Release`; Localization.Tests erzwingt en/de-Parität; Subagents `sonnet`, Dateien
+pfad-scoped stagen). Pro Fix ein Conventional Commit.
+
+---
+
+## Bearbeitungsstand (Session 2026-07-24, nicht gepusht)
+
+**Erledigt & committed:**
+- Gruppe A #1–5 + beide Optional-Nits (Icon.Plus gefüllt, Gear-PathIcon, Skills-Empty-State,
+  „Subtasks"-Terminologie, Conflict-Continue-Hinweis, Rename-Darstellung, Turns/Tokens-Reload).
+- Gruppe B #7 (Resume-Fehler surfacen) + #8 (Attachment-Drop-Diagnose).
+- Gruppe C #9 (AskUser-Banner in Detail-Insel via geteiltem `TaskMonitorViewModel`),
+  #11 (OUTCOME zeigt `summary` statt rohem JSON: Worker-Unwrap + UI-Sicherheitsnetz).
+- Gruppe D #13 (Kind-Rows live-refresh bei Parent-Planning-Transitionen) + #14 (Idle-Chip auf
+  Planning-Parents ausgeblendet). *Visual-Verification für #13 (Finalize/Discard live) offen.*
+
+**#6** war im aktuellen Code bereits abgedeckt (Worker wirft `HubException` bei `blocked`
+→ UI-Dialog); zusätzlich als ClaudeDo-Task `f9809a93` erfasst. Nicht angefasst.
+
+**Offen:**
+- **#10 + #12** — bewusst gebündelt mit dem ConPTY-Planning-Task `5d627df8` (dort lässt sich
+  die Session-Id sauber greifen bzw. das MCP-Permission-Verhalten klären). Sofort-Schutz für
+  #10 (Resume ausgrauen wenn keine Id) wurde NICHT gebaut — bräuchte Worker-Plumbing, das der
+  ConPTY-Umbau ohnehin liefert; der #7-Fix verhindert bereits das stille Scheitern.
+- **Gruppe E** — nur noch design-/feature-behaftete Punkte. Der scheinbare Quick-Win
+  „Dequeue-X auf blockierten Kettengliedern" wurde bewusst NICHT umgesetzt: einzelnes Dequeue
+  eines Kettenglieds hinterlässt hängende Nachfolger (deren `BlockedByTaskId` zeigt weiter auf
+  das nun idle Glied) → braucht Chain-Repair-Design.
+
+---
+
+## Gruppe A — Mechanisch, sofort fixbar (keine Entscheidung nötig)
+
+Ideale Kandidaten für den Start / parallele Subagents (disjunkte Dateien).
+
+1. **„New session"-Button unsichtbar (Icon.Plus strich-only)**
+   `IslandStyles.axaml` (`Icon.Plus` = `M12 5v14M5 12h14`, reine Linie) wird in einem
+   `<PathIcon>` (MissionControlView.axaml, füllt Geometrie) unsichtbar gerendert.
+   **Fix:** `Icon.Plus` als gefüllte Geometrie authoren ODER als gestricheltes `Path`
+   rendern (vgl. `Path.plan-icon`). **Andere `Icon.Plus`-Verwendungen mitprüfen.**
+
+2. **Agent-Settings-Gear weicht vom Listen-Gear ab**
+   `TaskHeaderBar.axaml:68` rendert `<TextBlock Text="⚙">`; überall sonst `Icon.Settings`
+   (PathIcon, IslandStyles.axaml:110). **Fix:** den `⚙`-TextBlock durch
+   `<PathIcon Data="{StaticResource Icon.Settings}" Width=".." Height=".."/>` ersetzen.
+
+3. **Session-Skills-Tab ohne Empty-State**
+   Bei 0 Skills nur nackte Fläche. **Fix:** Empty-State-Text unter der Install-Zeile
+   (z.B. „No skills installed — paste a GitHub URL above"). **Loc:** neue Keys in en.json
+   **und** de.json (Parität!). Datei: `SessionSkillsSettingsTab*`.
+
+4. **„Waiting for Improvements" für Planning-Parents (Terminologie)**
+   `en.json` `taskStatus.waitingForChildren`/`agentStatus.children`/`childOutcomesLabel`
+   sagen „Improvements". Seit unified-parent gilt `WaitingForChildren` auch für Planning.
+   **Fix:** auf neutrales „Waiting for Subtasks"/„Subtasks"/„SUBTASKS" umstellen — en **und**
+   de (Parität).
+
+5. **Conflict-Resolver: Continue-Button klickbar trotz offener Konflikte**
+   Merge passiert korrekt erst nach Auflösung, aber der Button ist nicht disabled → früher
+   Klick = stummer No-op. **Fix:** `CanContinue`/`AllResolved` an `IsEnabled` binden (ggf.
+   Hinweis „N Konflikte in M Dateien offen"). Datei: `ConflictResolverView(.axaml)` +
+   `ConflictResolverViewModel`.
+
+Optional-Nits (gleiche Gruppe, niedrige Prio):
+- **Diff-Viewer Rename schwach dargestellt** (alt→neu-Pfad + „renamed"-Label statt „+0 −0").
+- **Header-TurnsText `0/max`** bei terminalem Reload — `Turns` aus `task_runs.turnCount`
+  restaurieren.
+
+---
+
+## Gruppe B — Error-Surfacing (klare Richtung: kein stiller/leerer Fehlerpfad)
+
+Leitlinie `feedback_ui_error_surfacing`: User-Action-Fehler in den Footer
+(`FlashFooterError`) bzw. Dialog, nie leerer `catch`/stiller No-op.
+
+6. **Approve & Merge schluckt „blocked" still**
+   `DetailsIslandViewModel.ApproveReviewAsync` reagiert nur auf `Status == "conflict"`; bei
+   `"blocked"` (z.B. dirty Ziel-Tree) passiert nichts. **Fix:** bei `blocked`/unerwartetem
+   Status `result.ErrorMessage` surfacen. *(Als ClaudeDo-Task `f9809a93` erfasst — koppelt
+   „Approve erzwingt Diff/Review vor Merge".)*
+
+7. **„Resume planning session" verschluckt den Fehler (Teil-Fix hier, Rest → Gruppe C #10)**
+   `TasksIslandViewModel.ResumePlanningSessionAsync` (~Zeile 870) hüllt alles in `catch { }`.
+   **Sofort-Fix:** den Fehler surfacen statt schlucken. Der eigentliche Resume-Defekt braucht
+   eine Entscheidung → #10.
+
+8. **Attachments: intermittenter erster-Drop-Fehler („An error occurred")**
+   Einmalig beobachtet (erster Drop der Session, nichts persistiert), nicht reproduzierbar.
+   **Fix (diagnostisch):** `AddFilesAsync`/`OnDrop` robustes Error-Logging geben (die genaue
+   Exception fehlt, weil `DropStatus` nur `{fileName}: {ex.Message}` zeigt) — damit der
+   nächste Fall auswertbar ist. Kandidaten-Ursachen: SQLite-Contention (UI schreibt `todo.db`
+   direkt, während der Worker sie hält) oder Drop-Stream-Pfad (`IStorageFile.OpenReadAsync`
+   im Code-Behind, außerhalb des `try`).
+
+---
+
+## Gruppe C — Erst Entscheidung/Brainstorm, DANN umsetzen (nicht blind fixen)
+
+9. **AskUser-Interaktion auch in der Detail-Insel** *(von Mika ausdrücklich gewünscht)*
+   Der `ask_user`-Banner + Inline-Antwort existiert nur in Mission Control
+   (`MonitorPaneView`); die Detail-Insel zeigt für den laufenden Task nichts.
+   **Entscheidung:** wie den Zustand teilen — `TaskMonitorViewModel` hält ihn bereits; für
+   die Detail-Insel replizieren, teilen, oder ein gemeinsames Banner-Control? Danach:
+   Banner + `AnswerDraft`/`SubmitAnswer` in `DetailsIslandView(Model)` einhängen.
+
+10. **„Resume planning session" grundsätzlich kaputt (Session-Id nie erfasst)**
+    `PlanningSessionManager.ResumeAsync:238` wirft immer „No Claude session ID captured yet",
+    weil `TaskRepository.UpdatePlanningSessionIdAsync:322` **keinen Aufrufer** hat →
+    `planning_session_id` bleibt NULL. **Entscheidung:** (a) claude-Session-Id der
+    wt-Planning-Session erfassen + via `UpdatePlanningSessionIdAsync` persistieren (echtes
+    Resume) ODER (b) Resume entfernen/deaktivieren, wenn keine Id vorliegt. Hängt mit der
+    Design-Entscheidung „Planning über embedded ConPTY statt wt" zusammen (ClaudeDo-Task
+    `5d627df8`) — dort ließe sich die Session-Id sauber greifen.
+
+11. **OUTCOME-Karte rendert rohes Structured-Output-JSON**
+    `TaskMonitorViewModel.ApplyOutcome` setzt bei Tasks ohne Roadblock `SessionOutcome`
+    = `task.Result` wörtlich; der Worker legt dort rohes `{"summary":…}` ab.
+    **Entscheidung:** (a) UI parst JSON-Result und zeigt `summary`, oder (b) Worker schreibt
+    `summary`/`resultMarkdown` statt JSON in `task.Result`.
+
+12. **Planning-Session prompted nach MCP-Tool-Permission**
+    Trotz `--allowedTools "mcp__claudedo__*,…"` + `--permission-mode plan` prompted die
+    wt-Planning-Session beim ersten `create_child_task`. **Untersuchen/Entscheiden:** matcht
+    der `mcp__claudedo__*`-Glob in CLI 2.1.207 nicht (Syntax evtl. ganzer Server-Name), oder
+    gated Plan-Mode MCP-Writes generell? Gekoppelt an ConPTY-Planning-Task `5d627df8`.
+
+---
+
+## Gruppe D — Erst Root-Cause pinnen (Investigation)
+
+13. **Kind-Rows aktualisieren nach Parent-Planning-Transitionen nicht live**
+    Nach **Finalize** bleiben Kind-Badges „Draft" statt „Planned"; nach **Discard** bleiben
+    die (in der DB gelöschten) Kind-Rows sichtbar — bis Listen-Reload. Doppelt verifiziert §3.
+    **Untersuchen:** wie wird die Kinderliste/-gruppierung auf ein Parent-`TaskUpdated`
+    reagierend neu aufgelöst? Vermutlich fehlt ein Regroup/Refetch der Children beim
+    Parent-Broadcast (`TasksIslandViewModel` hierarchie-Regrouping). Fix danach: Children bei
+    Parent-Transition live neu auflösen.
+
+14. **Planning-aktiver Parent zeigt weiter „Idle"**
+    Parent `planning_phase=active` hat `Status=Idle` (korrekt im Modell), aber der Row-Chip
+    zeigt „Idle"; `PlanningBadge` überschreibt das nicht sichtbar. **Untersuchen/Design:** ein
+    klarer „Planning/Draft aktiv"-Zustand, der den Idle-Chip überschreibt. (Verwandt mit #13 —
+    Row-Statusdarstellung.)
+
+---
+
+## Gruppe E — UX-Nits / Feature-Wünsche (niedrige Prio, sammeln)
+
+- **Conflict-Resolver: mehrere Konfliktdateien schlecht erkennbar** — prominentere Datei-Liste
+  / „x von y Dateien".
+- **Blocked-by-Kette nicht visualisiert** — Reihenfolge/Abhängigkeit darstellen
+  („wartet auf <Vorgänger>").
+- **Dequeue-„X" fehlt auf blockierten Kettengliedern** — `CanRemoveFromQueue` erweitern
+  (`IsWaiting` einschließen).
+- **„Open ConPTY session" erneut = Prompt wird neu gesendet** — Resume-Affordance / Re-Open-
+  Warnung (bewusst kein Session-Persist).
+- **Conflict-Resolver: farbliches Hervorheben übernommener Zeilen im Result-Pane** (Feature).
+
+---
+
+## Nicht anfassen / Kontext
+
+- **§1 DiffModal-Fehler-State** (`vm.diff.unavailable`) ist **defensiver, über die UI
+  unerreichbarer** Code — alle Aufrufer sind gegated (`CanDiffMergedRange` verlangt base+head
+  non-null; `ConfigureWorktree` nur mit existierendem Pfad). Kein Fix nötig.
+- **`--permission-mode auto` + `haiku` denied Writes** — modellabhängiges Verhalten, keine
+  Regression; Default (sonnet) unbetroffen. Beobachten (Memory `auto_permission_haiku_footgun`).
+- **§10 Daily Prep/Weekly** — Verifikation zurückgestellt bis zum geplanten Rework.
+
+---
+
+## Empfohlene Reihenfolge
+
+1. **Gruppe A** (mechanisch, schnell, teils parallel) → sofort sichtbare Wins.
+2. **Gruppe B** (Error-Surfacing, klein & risikoarm).
+3. **Gruppe C** — pro Punkt kurz brainstormen/entscheiden, dann umsetzen (#10 + #12 zusammen
+   mit der ConPTY-Planning-Entscheidung betrachten).
+4. **Gruppe D** — Investigation, dann Fix (#13 zuerst — betrifft mehrere Planning-Flows).
+5. **Gruppe E** — nach Bedarf.

docs/open.md

@@ -1,72 +1,49 @@
 # ClaudeDo — Offene Punkte
 
-Stand: 2026-06-10. **Nur noch offene Punkte.** Was erledigt ist, steht in den Commits und im Code — nicht hier.
+Stand: 2026-07-24. Diese Datei listet die **aktiv verifizierten Findings** aus der Verifikations-Session vom 2026-07-24. Die laufende Verifikations-Checkliste (Pass/Fail je Abschnitt, inkl. noch offener Abschnitte §7–§11 und Kanten) lebt in `docs/verification-handoff.md`. Erledigtes steht in den Commits/im Code, nicht hier.
 
 ---
 
-## Manuelle Verifikation (offen)
+## Bugs (verifiziert 2026-07-24)
 
-Kein Code-Aufwand, nur Durchspielen mit explizit notiertem Pass-Kriterium. Der Großteil der Pipeline ist laut User bereits in der Praxis getestet; hier das, was noch ein falsifizierbares Observable braucht.
+- **OUTCOME-Karte rendert rohes Structured-Output-JSON:** `TaskMonitorViewModel.ApplyOutcome` (ClaudeDo.Ui) setzt bei Tasks ohne Roadblock-Marker `SessionOutcome = result` wörtlich (Zeile ~261). Der Worker legt in `task.Result` das rohe `{"summary":…,"files_changed":[…]}` ab (die lesbare Fassung steht in `task_runs.resultMarkdown`), also zeigt die Detail-Insel OUTCOME als JSON-Blob statt als Text. Fix: (a) UI parst ein JSON-Result und zeigt `summary`, oder (b) Worker schreibt `summary`/`resultMarkdown` statt des JSON in `task.Result`. Verifiziert am Task `verif §1 diff matrix`. Deckt sich mit Memory `worker_testing_findings`.
+- **Approve & Merge schluckt einen „blocked"-Merge still:** `DetailsIslandViewModel.ApproveReviewAsync` reagiert nur auf `result.Status == "conflict"` (öffnet den Resolver); bei `"blocked"` (z.B. Ziel-Working-Tree hat uncommittete getrackte Änderungen) und anderen Nicht-`merged`/Nicht-`conflict`-Status passiert **nichts** — kein Footer-Fehler, kein Dialog (der `catch` greift nur bei Exceptions, „blocked" ist aber ein normaler Rückgabewert mit `ErrorMessage`). User sieht „Klick tut nichts". Doppelt verifiziert (Konflikt-Approve UND sauberer additiver Approve `verif §1b`, beide bei dirty `main`-Checkout still). Fix: bei `blocked`/unerwartetem Status `result.ErrorMessage` via `ShowErrorAsync`/`FlashFooterError` surfacen. Verstößt gegen `feedback_ui_error_surfacing`. (Der Konflikt-Resolver + 3-Pane-Editor funktionieren, sobald der Ziel-Tree sauber ist.)
+- **„Waiting for Improvements" für Planning-Parents (Terminologie):** `taskStatus.waitingForChildren` = „Waiting for Improvements" (en.json:504), `agentStatus.children` dito (503), `childOutcomesLabel` = „IMPROVEMENTS" (191). Seit dem unified-parent-Modell gilt `WaitingForChildren` für Planning **und** Improvement-Parents — „Improvements" ist für einen Planning-Parent falsch. Auf neutrales „Waiting for Subtasks"/„Subtasks" umstellen (en **und** de — Localization.Tests-Parität). Verifiziert §3.
+- **Kind-Rows aktualisieren nach Parent-Planning-Transitionen nicht live:** Parent-getriebene Änderungen propagieren nicht auf die Kind-`TaskRowViewModel`s ohne Listen-Reload. (a) Nach „Finalize planning" bleiben Kind-Rows auf „Draft" (`IsDraft`) statt „Planned" (`IsPlanned`) — der geänderte `ParentFinalized` kommt nicht über das Parent-`TaskUpdated`-Broadcast an. (b) Nach „Discard" bleiben die (in der DB gelöschten) Draft-Kind-Rows sichtbar, bis die Liste neu geladen wird. Gemeinsame Ursache: die Kinderliste/-zustände werden bei Parent-Transitionen nicht live neu aufgelöst. Doppelt verifiziert §3 (Finalize **und** Discard, 2026-07-24).
+- **AskUser-Frage erscheint NUR in Mission Control, nicht in der Task-Detail-Insel:** Der `ask_user`-Banner (Frage + Antwort-Eingabe) lebt ausschließlich in `MonitorPaneView` (Mission Control). Die Detail-Insel (`DetailsIslandView`) streamt zwar den Live-Log eines laufenden Tasks, zeigt aber **kein** Frage-Banner — ein Nutzer, der nur die Detailansicht offen hat, sieht nicht, dass der Run auf eine Antwort wartet, und läuft nach 3 min in den Timeout-Fallback. Verifiziert §7 (User schaute Detailansicht, Frage war unsichtbar; erst in Mission Control sichtbar). Fix: Frage-Banner + Inline-Antwort auch in der Detail-Insel für den gebundenen laufenden Task surfacen (VM-Zustand liegt bereits in `TaskMonitorViewModel`, müsste für die Detail-Insel repliziert/geteilt werden). **Von Mika bei der §7-Verifikation ausdrücklich gewünscht** („vermisse diese Interaktion in der Detail-Ansicht"). §7.
+- **„New session"-Button (Mission Control) unsichtbar — Icon.Plus ist Strich-Only:** `Icon.Plus` = `M12 5v14M5 12h14` (IslandStyles.axaml:61) ist reine Linien-Geometrie ohne Fläche; im `<PathIcon>` (MissionControlView.axaml:38, füllt Geometrie) rendert sie **unsichtbar** → der Ad-hoc-„New session"-Button erscheint leer und ist nicht auffindbar (Feature + VM `OpenAdHocConPtySessionAsync` + Tests funktionieren, nur das Icon fehlt sichtbar). Fix: Icon.Plus als gefüllte Geometrie authoren ODER als gestricheltes `Path` rendern (Icon-Gotcha in CLAUDE.md). **Andere `Icon.Plus`-Verwendungen mitprüfen.** Verifiziert §5.
 
-- **Worktree-Pipeline:**
-  - Worktree-Happy-Path → `worktrees.state='active'`, `head_commit` gesetzt, `diff_stat` non-empty, Branch `claudedo/<id>` auf Disk.
-  - No-Changes-Run → `status='Done'`, `head_commit IS NULL`, `diff_stat IS NULL`.
-  - Kein Git-Repo (`working_dir=C:\Temp`) → `status='Failed'`, **keine** `worktrees`-Row, Git-Fehler im Log.
-- **Feature-Walkthroughs:** Planning-Session-Flow (Draft→Finalize→Chain), Prime/Daily-Prep-Trigger, Weekly-Report-Generierung, Self-Update (Banner → Update → „up to date").
-- **UI-Sichtprüfung (neu, 2026-06-09):** Diff-Viewer (Dateiliste, Added/Deleted/Renamed/Binary-Erkennung, Commit-Range-Diff nach Merge) und das „children need attention"-Band auf dem Session-Tab des Parents.
-- **UI-Sichtprüfung (neu, 2026-06-10, nach Refactoring-Merges):** Detail-Insel komplett durchklicken (Output/Git/Session-Tabs, Merge-Sektion, Agent-Settings-Overrides, Prep-Panel) — `DetailsIslandViewModel` wurde in Sektions-VMs aufgeteilt, Bindings angepasst. Außerdem: DiffModal-Fehler-State „Diff nicht mehr verfügbar" (Commit-Range ohne aufgezeichnete Commits) und der In-App-Konflikt-Resolver (Hub-Methoden umbenannt).
-- **UI-Sichtprüfung (neu, 2026-06-19, Rider-Style 3-Pane Merge-Editor):** Echten Konflikt auslösen (Single-Task-Approve mit Konflikt **und** Planning-Unit-Merge) und prüfen: drei Panes (Ours read-only | Result editierbar | Theirs read-only), Konfliktblöcke rot / aufgelöst grün in allen Panes, Inline-Accept `›`/`‹` in den Zwischen-Guttern landen die jeweilige Seite im Result, nur Konfliktregionen im Result editierbar (Stable read-only), synchrones vertikales Scrollen, File-Switcher bei mehreren Dateien, `M conflicts · K resolved`-Readout, Continue erst bei allen Konflikten gelöst, Binär-Guard. **Bekannte Kanten:** (1) Konflikt mit leerer Ours-Seite → Result-Region ist null-lang (Gutter via 1-Zeichen-Probe positioniert, Accept funktioniert; nur Hand-Tippen in die leere Region ist fummelig). (2) Gutter-Y nutzt `TranslatePoint` vom Result-`TextView` — bei sehr hohen Fenstern / großen Scrollständen die Ausrichtung gegenprüfen. (3) Blöcke richten sich nur über Stable-Text aus; nach einem Konflikt mit unterschiedlicher Zeilenzahl je Seite driften nachfolgende Blöcke vertikal (aligned/virtual-space Scroll ist bewusst zurückgestellt).
-- **Worker-Autostart am Gerät:** Logoff/Logon-Autostart, Update-Pfad, Uninstall entfernt die Startup-`.lnk`.
-- **In-App Interactive Sessions (2026-06-26, REMOVED 2026-07-23):** der In-App-Streaming-Chat (`StreamingClaudeSession`, Composer/Queue auf `TaskMonitorViewModel`/`SessionTerminalView`) wurde komplett entfernt und durch die **embedded ConPTY**-Sessions ersetzt (echte `claude`-TUI im UI-Prozess, siehe `docs/superpowers/specs/2026-07-23-conpty-interactive-sessions-design.md`). Kein offener Punkt mehr — nur zur Historie.
-- **Embedded ConPTY Sessions (neu, 2026-07-23):** Command Center hostet echte `claude`-TUI-Kacheln (`Iciclecreek.Avalonia.Terminal` 2.0.3 via `TerminalControl.LaunchProcess()`). Rendering/Input/Tempo vom User verifiziert. **Noch durchzuspielen:**
-  - Task-basiert (Kontextmenü „Open ConPTY session"): frischer Task → Worktree wird on-demand angelegt, `claude` startet mit Task-Prompt (Title+Description als positionaler Prompt) — **verifizieren, dass `claude "<prompt>"` interaktiv wirklich SENDET**, nicht nur vorbefüllt.
-  - Ad-hoc („New session"-Button → Ordnerwahl): freie Session im gewählten Verzeichnis.
-  - Grid↔Tabs-Toggle, Close killt Session + entfernt Kachel, mehrere Sessions parallel, Pane-Resize reflowt.
-  - Resume einer interaktiven Session: nur via claude-eigenes `claude --continue`/`--resume` im Worktree-Dir (ClaudeDo speichert die Session-Id NICHT — ConPTY ist opak).
-  - **Zurückgestellt:** Avalonia-12.1-Upgrade (braucht .NET-9-SDK-Floor wg. Roslyn-4.14-XAML-Generator; CI-Risiko) — bleibt auf 12.0.x.
-- **Pick up in terminal (neu, 2026-07-01):** neue Aktion, die die Claude-Session einer Task per `claude --resume <id>` in einem **echten** `wt`-Terminal fortsetzt (echte TUI: Permission-Prompts/Fragen inklusive) — bewusst NICHT der In-App-Streaming-Chat. Real-CLI-Smoke (kein Claude in Tests):
-  - Kontextmenü einer Task in **WaitingForReview** oder **Failed** → „Pick up in terminal" sowie der Terminal-Button (Icon `ArrowOut`) im Detail-Header sind sichtbar; bei anderen Status (Idle/Running/Queued/Done) NICHT.
-  - Klick → neues Windows-Terminal im Worktree-Verzeichnis der Task, Claude nimmt die letzte Session mit erhaltenem Kontext wieder auf.
-  - Fehlerfälle surfacen sauber (Footer-Strip aus der Task-Insel bzw. Fehler-Dialog im Detail): laufende/gequeuete Task (verboten), keine persistierte Session-Id, kein aktiver Worktree.
-  - **Gating-Kante:** parked-Idle (reject-park) hat oft noch Session+Worktree, wird aber bewusst NICHT angezeigt (Idle nicht von fresh-Idle unterscheidbar). Falls das nervt → `CanPickUpInTerminal` erweitern.
-- **Session Skills (neu, 2026-07-03):** per-Ebene (global/list/task, additiv-union) Skills für headless Task-Agenten; Registry klont+pinnt ein GitHub-Repo, Worker seedet aktivierte Skills in `<cwd>/.claude/skills/` vor jedem Run (worktree-`info/exclude`, damit `git add -A` sie nicht committet). Discovery-Mechanismus ist bereits verifiziert (headless `claude -p` lädt cwd-Skills). Spec: `docs/superpowers/specs/2026-07-03-session-skills-design.md`. Offen (kein Code, nur Durchspielen):
-  - **E2E-Smoke (echter Worker, kein Claude in Tests):** In Settings → Skills `https://github.com/DietrichGebert/ponytail` installieren → 6 Skills erscheinen (ponytail, -help, -review, -audit, -debt, -gain), gepinnt auf einen Commit, Dateien unter `~/.todo-app/session-skills/<name>/`. Skill per-Task (Agent-Settings-Flyout) und/oder global aktivieren → eine Task laufen lassen → im Worktree liegt `.claude/skills/<name>/`, der Skill ist dem Agenten verfügbar, und er wird **nicht** mitcommittet (`git status` im Worktree sauber). Gegenprobe: eine **nicht** aktivierte/andere interaktive Session sieht den Skill nicht (kein global-Leak in `~/.claude`).
-  - **UI-Sichtprüfung:** neuer Skills-Tab (Install-Zeile, installierte-Skill-Karten mit Update/Remove), Session-Skills-Checkbox-Liste im General-Tab und im `AgentConfigEditor` (List-Settings-Modal + per-Task-Flyout — Flyout-Höhe prüfen). Leerer Zustand (0 installierte Skills) rendert eine leere Liste ohne Platzhaltertext — ok oder Empty-State ergänzen. Lange Namen/URLs (Trimming).
-- **Drag-and-drop file attachments on the detail pane:** verify the "Drop to attach" hover overlay, drop round-trip (file appears in the list), "Add file…" picker, remove button, and that files land under `~/.todo-app/attachments/<taskId>/`. Also verify the MCP `AddTaskAttachment`/`ListTaskAttachments`/`RemoveTaskAttachment` tools and that a Running task refuses add/remove. (Manual; can't be unit-tested.)
+## UX / Nits (verifiziert 2026-07-24)
 
-## Offene Code-Punkte
+- **„Resume planning session" ist grundsätzlich kaputt (Session-Id wird nie erfasst) + Fehler wird verschluckt:** Im UnfinishedPlanning-Modal macht **Resume** nichts. Ursache: `PlanningSessionManager.ResumeAsync` (PlanningSessionManager.cs:238) bricht mit `InvalidOperationException("No Claude session ID captured yet; cannot resume.")` ab, wenn `task.PlanningSessionId` leer ist — und der Setter `TaskRepository.UpdatePlanningSessionIdAsync` (TaskRepository.cs:322) hat **keinen einzigen Aufrufer** im Worker, d.h. `planning_session_id` wird nie befüllt (verifiziert an `verif §3 resume-discard`: `planning_session_id=NULL`, Token gesetzt, Drafts angelegt). Resume kann also **nie** erfolgreich sein. Zusätzlich verschluckt `TasksIslandViewModel.ResumePlanningSessionAsync` den ganzen Block in einem leeren `catch { }` (~Zeile 870) → der Button ist ein **stummer No-op**, kein Footer-Fehler, kein Dialog (verstößt gegen `feedback_ui_error_surfacing`). Hintergrund: die wt-Planning-Session ist interaktiv; ClaudeDo erfasst die claude-Session-Id dort nicht (analog zur bewusst nicht persistierten ConPTY-Session-Id, §5). Fix-Optionen: (a) beim Planning-Start/-Lauf die claude-Session-Id erfassen und via `UpdatePlanningSessionIdAsync` persistieren, damit Resume echt resumen kann; ODER (b) Resume entfernen/deaktivieren, wenn keine Session-Id vorliegt; in JEDEM Fall den Fehler statt des leeren `catch` surfacen. Verifiziert §3. §3.
+- **Attachments: erster Drag&Drop der Session schlug einmalig fehl („An error occurred"):** Beim allerersten Drop-to-attach einer UI-Session zeigte die `DropStatus`-Zeile inline einen generischen Fehler und es wurde nichts persistiert (kein File, keine DB-Row); alle folgenden Drops derselben Session + der „Add file…"-Picker + Remove funktionierten fehlerfrei. Nicht reproduzierbar nach dem ersten Mal (App-Neustart nötig, um die „erster-Drop"-Bedingung wiederherzustellen). Kandidaten: transiente SQLite-Contention (der UI-Prozess schreibt `todo.db` direkt via `new TaskAttachmentRepository`, während der Worker dieselbe DB hält) ODER ein Fehler im Drop-Stream-Pfad (`IStorageFile.OpenReadAsync` im Code-Behind, außerhalb des `try` in `AddFilesAsync`). Falls es erneut auftritt: `AddFilesAsync`/`OnDrop` mit robusterem Error-Logging versehen (die genaue Exception-Message fehlt, weil `DropStatus` nur `{fileName}: {ex.Message}` zeigt). Verifiziert §9 (einmalig beobachtet). §9.
+- **Agent-Settings-Gear weicht vom übrigen Settings-Icon ab:** Der Agent-Settings-Flyout-Button (`TaskHeaderBar.axaml:68`) rendert ein Unicode-Glyph `⚙` (`<TextBlock Text="⚙">`), während die Listen-Nav (`ListsIslandView.axaml:56`) und die Listen-Settings (`TasksIslandView.axaml:47`) das gefüllte `Icon.Settings`-PathIcon (Gear-StreamGeometry, IslandStyles.axaml:110) nutzen → optisch ein anderes Zahnrad. Angleichen: den `⚙`-TextBlock durch `<PathIcon Data="{StaticResource Icon.Settings}" .../>` ersetzen. Verifiziert §8 (User-Sichtprüfung). §8.
+- **Session-Skills-Tab hat keinen Empty-State:** Bei 0 installierten Skills zeigt der Skills-Tab (Settings) nur eine nackte leere Fläche unter der Install-Zeile — kein erklärender Hinweis (z.B. „Noch keine Skills installiert — GitHub-URL oben einfügen"). Verifiziert §8 (frischer Zustand vor ponytail-Install). Kleiner Empty-State-Text ergänzen.
 
-- **Status-Bar Live-Update:** Prüfen, ob `RunNow`-Enable/Disable pro Task-Row bei Connection-Change sauber re-evaluiert. Connection-Status lebt in `IslandsShellViewModel` / `WorkerConnectionModalViewModel` (es gibt keinen `StatusBarViewModel` mehr). Erst messen, dann ggf. fixen. Klein.
-- **`AgentMcpTools` liegt in `LifecycleMcpTools.cs`** — beim Suchen irreführend; in eigene Datei verschieben. Ein-Minuten-Fix, lohnt keinen Agent-Lauf — beim nächsten Worker-Touch mitnehmen.
+- **Diff-Viewer: reiner Rename schwach dargestellt:** Rename korrekt erkannt (`UnifiedDiffParser` → `DiffFileStatus.Renamed`, Badge `StatusCode="R"`), aber der File-Tree zeigt nur den neuen Namen + „+0 −0" ohne „alt → neu"-Pfad; liest sich wie „keine Änderung". Optional: alten Pfad + „renamed"-Label anzeigen. §1.
+- **Header-TurnsText zeigt `0/max` für abgeschlossene Runs:** `TurnsText => {Turns}/{EffectiveMaxTurns}` — `Turns` wird beim Laden eines terminalen Tasks nicht aus `task_runs.turnCount` restauriert (nur live gefüllt). Kosmetisch. §1.
+- **Conflict-Resolver: Continue/Merge-Button klickbar trotz offener Konflikte:** Gate greift funktional (merged erst wenn alle Konflikte in allen Dateien gelöst), aber der Button ist nicht disabled/gegraut → früher Klick ist ein stummer No-op. Besser: disabled bis `AllResolved`, oder Hinweis „N Konflikte in M Dateien offen". §4.
+- **Conflict-Resolver: mehrere Konfliktdateien schlecht erkennbar:** Beim 2-Datei-Konflikt schwer zu sehen, dass zwei Dateien betroffen sind (File-Switcher/Anzahl zu unauffällig). Prominentere Datei-Liste / „x von y Dateien". §4.
+- **Planning-aktiver Parent zeigt weiter „Idle":** Parent in `planning_phase=active` hat `Status=Idle` (korrekt im Modell), aber der Row-Status-Chip zeigt „Idle"; der `PlanningBadge` ersetzt das nicht sichtbar → liest sich wie ein normaler Idle-Task. Wunsch: klarer „Planning/Draft aktiv"-Zustand, der Idle überschreibt. (Kinder zeigen korrekt „Draft".) §3.
+- **Blocked-by-Kette nicht sichtbar:** Nach Finalize ist die sequentielle Kette korrekt gesetzt (child[i] blocked-by child[i-1]), aber die UI stellt die Reihenfolge/Abhängigkeit nicht dar. Wunsch: Kette visualisieren (z.B. „wartet auf <Vorgänger>"), nicht nur der „waiting"-Chip nach dem Queueen. §3.
+- **Dequeue-„X" fehlt auf wartenden (blockierten) Kettengliedern:** `CanRemoveFromQueue = IsQueued || HasQueuedSubtasks`, `IsQueued` verlangt leeres `blocked_by`. Ein gequeuetes, aber blockiertes Kind (`IsWaiting`) bekommt daher kein Remove-from-queue-X — nur Parent + erstes (entsperrtes) Kind. §3.
+- **„Open ConPTY session" erneut = Prompt wird neu gesendet, kein Resume:** Da die ConPTY-Session-Id bewusst nicht persistiert wird, startet ein erneutes „Open ConPTY session" auf demselben Task eine frische Session und sendet den Task-Prompt erneut (re-runt die Arbeit im selben Worktree) statt zu resumen. So designt, aber UX-Falle — evtl. „Resume"-Affordance oder Re-Open-Warnung. §5.
 
-## Nachklapp Refactoring-/Bug-Runde (2026-06-09/10)
+## Feature-Wünsche (aus der Session)
 
-Alle 9 Review-Tasks (5 Refactorings, 4 Bugfixes) sind umgesetzt und gemerged; Details in den Commits. Offen geblieben:
+- **Conflict-Resolver: farbliches Hervorheben eingefügter Zeilen im Result-Pane** (grüner „flow" der übernommenen Zeilen). §4.
+- Als ClaudeDo-Tasks in Liste „Claude do" erfasst: **Approve erzwingt Diff/Review vor Merge** (koppelt den blocked-Merge-Silent-Fail-Fix) und **interaktive Planning-Session über embedded ConPTY statt externem wt-Fenster** (koppelt den Planning-Permission-Prompt).
 
-- **`DetailsIslandViewModel` ist nach dem Split noch 1258 Zeilen** (Ziel war ~800) — die drei Sektions-VMs (AgentSettings, Merge, Prep) sind extrahiert, weitere Extraktion (z.B. ChildOutcomes/Subtasks-Sektion) lohnt erst, wenn die Datei wieder wächst.
-- **Bewusst zurückgestellt:** WorkerHub-Split nach Concern (~60 Methoden in einer Hub-Klasse). Die Interface-Parität löst das akute Testbarkeits-Problem; ein Hub-Split ist eine größere Architekturentscheidung → erst besprechen.
-- **Lessons learned:** Der `StartRunningAsync`-Guard-Task hat isoliert grün getestet, aber den Queue-Pfad gebrochen (Picker claimt vor dem Dispatch) — Integrationsfix `74ca2e0`. Bei parallelen Tasks, die denselben Pfad berühren, nach JEDEM Merge-Schwung die volle Suite auf main fahren.
+## Beobachtung (offen — Entscheidung Mika)
 
-## Bug-Befunde (Korrektheits-Review 2026-06-09)
-
-**Plausibel, noch nicht einzeln verifiziert (bei Gelegenheit prüfen):**
-
-- Cancel eines `WaitingForChildren`-Parents kaskadiert nicht auf laufende/queued Kinder (verwaiste Worktree-Commits).
-- Ketten-Kaskade stoppt an einem `Idle`-Mittelglied (`OnChildFinishedAsync` prüft `CancelAsync`-Ergebnis nicht) → Rest bleibt `Queued+blocked`.
-- Delete des *letzten* nicht-terminalen Kindes triggert kein `TryAdvanceParentAsync` → Parent kann in `WaitingForChildren` hängen (FK `SET NULL` rettet nur die Blocked-Kette).
-- `ContinueMergeAsync` staged per `git add -A` vor dem Konflikt-Check (Marker im Index, Abort danach ggf. unsauber).
-- `HasChangesAsync` zählt untracked Files → blockiert Merges unnötig (`--untracked-files=no`).
-- `UnifiedDiffParser`: Pfade mit Leerzeichen / git-gequotete Pfade aus `diff --git` falsch geparst.
-- Kleinkram: MergePreview-Race bei schnellem Target-Wechsel, CTS-Dispose-Leak in Debounce-Saves, `Environment.CurrentDirectory`-Fallback im Konflikt-Dialog, Doppel-Continue-Fenster im Orchestrator.
-
-**Geprüft und verworfen (keine Bugs):** ReviewFeedback-„Endlosschleife" (Fallback existiert), Cross-Thread-Crashes im DetailsIslandViewModel (Dispatcher-Marshalling im WorkerClient), Chain-Wedge nach Child-Delete (FK `ON DELETE SET NULL`), `\ No newline`-Parsing.
+- **`--permission-mode auto` + Modell `haiku` → Writes werden denied:** Kontrolliert verifiziert (CLI 2.1.207): unter dem Default-Mode `auto` bekommt **sonnet** Writes auto-approved (`permission_denials:[]`), **haiku** wird `denied` (`permission_denials:[Write]`, keine Datei) — eine haiku-Task macht unter `auto` still nichts und landet ohne Änderung in `WaitingForReview`. Normalbetrieb (Default = sonnet) nicht betroffen. KEINE CLI-Regression, sondern modellabhängiges `auto`-Verhalten. Optionen falls es nervt: haiku aus der Auswahl nehmen, ODER Runner auf `acceptEdits`/`bypassPermissions` (modell-unabhängig). Mika: erstmal beobachten. Siehe Memory `auto_permission_haiku_footgun`.
 
 ---
 
 ## Bewusst verworfen (nicht erneut vorschlagen)
 
 - **CI-Build/Test-Pipeline** — push-to-main + release-on-push deckt das ab; Tests laufen am Ende jeder Session.
-- **Real-`claude`-Smoke-Test als xUnit-Test** — kein Claude in `dotnet test`; bleibt manueller Check (siehe oben). Tests nutzen `FakeClaudeProcess`.
-- **`architecture.md` / ADRs** — die per-Projekt-`CLAUDE.md`-Dateien sind die lebende Doku; ADRs lohnen solo nicht.
-- **Task-Mailbox-Integration** — geparkt; das generische `mcp__mailbox__*`-Plugin reicht (Begründung in `mailbox-proposal.md`).
-- **Tag-Negation, Tag-Multi-Select, Notes-`lists.kind`-Switch, Install-Service-Skript** — durch die aktuelle Architektur überholt (Tag-System entfernt, Notes/Autostart anders gelöst).
+- **Real-`claude`-Smoke-Test als xUnit-Test** — kein Claude in `dotnet test`; bleibt manueller Check. Tests nutzen `FakeClaudeProcess`.
+- **`architecture.md` / ADRs** — die per-Projekt-`CLAUDE.md`-Dateien sind die lebende Doku.
+- **Task-Mailbox-Integration** — geparkt; das generische `mcp__mailbox__*`-Plugin reicht (`mailbox-proposal.md`).
+- **Tag-Negation, Tag-Multi-Select, Notes-`lists.kind`-Switch, Install-Service-Skript** — durch die aktuelle Architektur überholt.

docs/superpowers/plans/2026-07-24-merge-helper.md

@@ -0,0 +1,79 @@
+# Merge Helper — Implementation Plan
+
+Spec: `docs/superpowers/specs/2026-07-24-merge-helper-design.md`
+Approach: subagent-driven (one subagent per task, `sonnet`, TDD, stage files by path — never `git add -A`). Build with `-c Release` per-csproj (a running Worker locks `Debug`). Commit per task, Conventional Commits.
+
+---
+
+## Phase A — Worker MCP conflict tools
+
+Independently useful; merges first. All in `src/ClaudeDo.Worker/External/ExternalMcpService.cs` + tests in `tests/ClaudeDo.Worker.Tests/`.
+
+### A1 — Verify engine surface (spike, no commit)
+Read `TaskMergeService.MergeAsync` / `ContinueMergeAsync` / `AbortMergeAsync` and the hub conflict flow (`WorkerHub.StartConflictMerge`/`ContinueConflictMerge`/`AbortConflictMerge`). Pin down:
+- exact `ContinueMergeAsync` / `AbortMergeAsync` signatures and how in-progress-merge state is located (repo + target branch from task/list, not shared hub state);
+- how the childless approve path (`ApproveAndMergeAsync`) threads `leaveConflictsInTree`.
+Record findings in the task notes; feeds A2/A3.
+
+### A2 — `leaveConflictsInTree` on review_task / merge_task
+- TDD: tests in `Worker.Tests` (real git) — clean merge → Done; conflict + flag → `conflict_in_tree`, markers present, task stays `WaitingForReview`, `repoPath` returned.
+- Add optional param `leaveConflictsInTree = false` to `MergeTask` and `ReviewTask` (approve branch). When true, call the `leaveConflictsInTree:true` engine path and map the conflict result to `{ mergeStatus/merged, conflicts, repoPath }`.
+- Keep default behaviour (abort-on-conflict) byte-identical when the flag is absent/false.
+- Commit: `feat(worker): let review_task/merge_task leave conflicts in tree via MCP`
+
+### A3 — `continue_merge` + `abort_merge` MCP tools
+- TDD: continue after on-disk resolution → committed, task Done, worktree merged; continue with markers remaining → returns conflicts; abort → markers gone, task `WaitingForReview`; both on no-active-merge → clean MCP error; `TaskUpdated` fired.
+- Add `[McpServerTool] continue_merge(taskId)` → `ContinueMergeAsync`; `abort_merge(taskId)` → `AbortMergeAsync`. Locate the merge from the task's repo/target. Emit `TaskUpdated`.
+- **Route both single-task and orchestrated (parent/children) in-progress merges** where locatable from the task (per A1 findings): detect the kind and call the matching engine continue/abort (`TaskMergeService` vs `PlanningMergeOrchestrator.Continue/Abort`). If the orchestrated path can't be located without hub UI state, leave it to the manual fallback (documented in the B1 prompt) and note the gap in `docs/open.md`.
+- Commit: `feat(worker): add continue_merge and abort_merge MCP tools`
+
+---
+
+## Phase B — Worker launch for the merge-helper session
+
+### B1 — Prompt templates
+- Add `PromptKind.MergeHelper` + `PromptKind.MergeHelperInitial` to `ClaudeDo.Data/PromptFiles.cs` (file names `merge-helper-system.md` / `merge-helper-initial.md`, built-in `DefaultFor`, `Render` tokens for the initial brief).
+- System prompt encodes §7 behaviour (per-status algorithm, ask-on-uncertainty, summary format). Merge-state rule: **prefer MCP tools whenever they apply**; hand-merge (Edit + `git commit -- <paths>`) is an accepted fallback only for merges the MCP tools can't reach (§5.3), never a shortcut around them.
+- Initial brief renders a task table `{id,title,status,list,repo}` + scope label.
+- TDD: `PromptFiles` tests — kinds resolve, defaults non-empty, `Render` substitutes brief tokens.
+- Commit: `feat(data): add merge-helper prompt templates`
+
+### B2 — `BuildForMergeHelper` launch spec
+- TDD (`Worker.Tests`): distinct-repo `--add-dir` set computed from selected tasks; correct cwd per scope (per-list repo vs first repo global); brief file written to `~/.todo-app/merge-helper-sessions/<guid>/brief.md`; allowed-tools + `--permission-mode default` + `MCP_TOOL_TIMEOUT` env correct; single-line kickoff points at the brief.
+- Implement `InteractiveLaunchSpecService.BuildForMergeHelper(IReadOnlyList<string> taskIds, MergeHelperScope scope, ct)`. Reuse the planning brief-file/kickoff pattern.
+- Commit: `feat(worker): build merge-helper interactive launch spec`
+
+### B3 — Hub endpoint + client method
+- `WorkerHub.GetMergeHelperLaunchSpec(string[] taskIds, string? listId)`; `IWorkerClient.GetMergeHelperLaunchSpecAsync(...)` + `WorkerClient` impl.
+- Update hand-rolled `IWorkerClient` fakes in **both** test projects (see gotcha memory).
+- Commit: `feat(worker): expose merge-helper launch spec over the hub`
+
+---
+
+## Phase C — UI
+
+### C1 — Selection dialog (View + VM)
+- New `MergeHelperSelectionViewModel` + `MergeHelperSelectionDialog.axaml` (compiled bindings, `TaskCompletionSource<T>` pattern). Checkbox rows (title, status badge, list/repo), grouping in global mode, default ticks per §4, select-all/none, confirm disabled when empty.
+- Candidates via existing `list_tasks`/worker client; filter client-side.
+- TDD (`Ui.Tests`): default-tick logic, empty→confirm-disabled, returns ordered selected IDs + list mapping.
+- Commit: `feat(ui): add merge-helper task selection dialog`
+
+### C2 — Entry points + event plumbing
+- Per-list context-menu item **"Let Claude handle it"** in `ListsIslandView.axaml` (user-list rows) + one global entry in the footer. Bind to `LetClaudeHandleCommand` on `ListsIslandViewModel` (param = `ListNavItemViewModel` or a global sentinel).
+- VM raises `LetClaudeHandleRequested(MergeHelperScope)`; `IslandsShellViewModel` forwards to Mission Control.
+- Commit: `feat(ui): add "Let Claude handle it" entry points`
+
+### C3 — Mission Control wiring
+- `MissionControlViewModel.OpenMergeHelperConPtySessionAsync(scope)`: open selection dialog → on confirm, `GetMergeHelperLaunchSpecAsync` → wrap in `TerminalLaunchDescriptor` → new `ConPtyPaneViewModel` (never deduped) → add to `ConPtySessions`/`Panes`.
+- Commit: `feat(ui): open merge-helper ConPTY tile from selection`
+
+---
+
+## Verify (per task + at the end)
+- Read each subagent diff; build the touched csproj `-c Release`; run the relevant test project.
+- `locales/en.json` + `de.json` parity for any new UI strings (Localization.Tests enforces it).
+- Flag visual-verification gaps (dialog layout, tile) for the user — never claim UI works without a run.
+- End-to-end ConPTY smoke (real Claude) is a manual item in `docs/open.md`.
+
+## Commit docs first
+`docs(merge-helper): spec + implementation plan` (this file + the spec).

docs/superpowers/specs/2026-07-24-conpty-planning-design.md

@@ -0,0 +1,61 @@
+# ConPTY Planning Sessions — Design (2026-07-24)
+
+**Task:** `5d627df8` — interaktive Planning-Session über embedded ConPTY statt externem `wt`-Fenster.
+
+## Problem
+Planning-Sessions (`StartPlanningSession`/`ResumePlanningSession`) öffnen heute ein externes
+Windows-Terminal (`WindowsTerminalLauncher` → `wt.exe`). Seit ConPTY existiert (embedded
+claude-TUI im UI-Prozess, Command Center), soll die interaktive Planning-Session denselben
+Weg nutzen: konsistente UX, keine externen Fenster.
+
+## Approved decisions (Brainstorm 2026-07-24)
+- **Env-Isolation:** Prozess-global akzeptiert (Sessions werden sequenziell per Klick geöffnet;
+  jedes claude-Child snapshottet Env beim Spawn). Keine Änderung an `PtyTerminalSession`.
+- **wt-Launcher:** Code bleibt; nur das Routing für Planning wird auf ConPTY umgestellt
+  (kein Rip-out von `LaunchPlanningStart/ResumeAsync`).
+- Planning-Kachel im Command Center (Mission Control), wie andere ConPTY-Sessions.
+  Finalize/Discard/Queue-Plan bleiben unverändert auf den bestehenden Buttons.
+
+## Change map
+
+### Worker
+1. `WindowsTerminalLauncher`: Planning-Start-Args in einen bare Builder
+   `BuildPlanningStartArgs(PlanningSessionStartContext) -> IReadOnlyList<string>` herausziehen
+   (analog `BuildResumeArgs`); `BuildPlanningStartCommand` nutzt ihn weiter (wt unverändert).
+   Resume-Args `BuildPlanningResumeArgs(sessionId) = ["--permission-mode","plan","--resume",id]`
+   (bisher inline in `LaunchPlanningResumeAsync`).
+2. `InteractiveLaunchSpecService`: `BuildPlanningStart(PlanningSessionStartContext) -> LaunchSpec`
+   und `BuildPlanningResume(PlanningSessionResumeContext) -> LaunchSpec` — resolve claude,
+   Args aus (1), Env `MAX_THINKING_TOKENS=20000` + `CLAUDEDO_PLANNING_TOKEN=<token>`
+   (+ `MCP_TOOL_TIMEOUT` wie interaktiv), Cwd = ctx.WorkingDir. Nimmt den Kontext (keine
+   Manager-Kopplung).
+3. Hub: `GetPlanningStartLaunchSpec(taskId) -> LaunchSpec` (ruft `_planning.StartAsync`,
+   broadcastet `TaskUpdated`, baut Spec; bei Fehler discard+rethrow wie heute),
+   `GetPlanningResumeLaunchSpec(taskId) -> LaunchSpec` (ruft `_planning.ResumeAsync`).
+
+### UI
+4. `IWorkerClient`/`WorkerClient`: `GetPlanningStartLaunchSpecAsync`/`GetPlanningResumeLaunchSpecAsync`
+   (mirror `GetInteractiveLaunchSpecAsync`).
+5. `MissionControlViewModel`: `OpenPlanningConPtySessionAsync(taskId, resume)` — dedupt nach
+   TaskId, holt die Planning-Spec, baut `TerminalLaunchDescriptor` → `ConPtyPaneViewModel`
+   (Titel „<task> (Planning)").
+6. `TasksIslandViewModel`: `OpenPlanningSessionAsync`/`ResumePlanningSessionAsync` (Resume-Zweig
+   der `UnfinishedPlanningModal`) öffnen die Planning-ConPTY-Kachel via neuem Event
+   `OpenPlanningConPtyRequested(taskId, resume)`, statt `StartPlanningSessionAsync`/wt.
+   `IslandsShellViewModel` verdrahtet das Event → `OpenMissionControl()` +
+   `MissionControl.OpenPlanningConPtySessionAsync`.
+
+### #12 (Nebenbefund)
+MCP-Permission-Prompt trotz `--allowedTools "mcp__claudedo__*"`: im interaktiven ConPTY vom
+User bestätigbar (kein Blocker wie headless). Beim Testen prüfen, ob der Glob den Prompt in
+der aktuellen CLI unterdrückt; falls nicht, allowedTools/`--permission-mode`-Kombi nachziehen.
+
+## Out of scope
+- Entfernen des wt-Codes / `ResumeTaskInTerminal`.
+- Per-Child-Env-Isolation in `PtyTerminalSession`.
+- Änderungen an Finalize/Discard/Queue-Plan-Lifecycle.
+
+## Verification
+- Build Worker + App (`-c Release`), Worker.Tests + Ui.Tests grün.
+- Visual (User): Planning-Start öffnet Command-Center-Kachel mit claude-TUI im Plan-Modus;
+  create_child_task erzeugt Draft-Kinder live; Resume greift die Session; kein wt-Fenster.

docs/superpowers/specs/2026-07-24-merge-helper-design.md

@@ -0,0 +1,182 @@
+# Merge Helper ("Let Claude handle it") — Design
+
+**Status:** Proposed — awaiting approval
+**Date:** 2026-07-24
+**Scope:** Feature — a per-list and global button that opens an **interactive ConPTY Claude session** pre-loaded with a set of user-selected tasks. The session (the "Merge Helper") drives each selected task to completion and merge autonomously via `mcp__claudedo__*` tools, asks the user interactively (in the ConPTY terminal) only when uncertain, resolves merge conflicts itself, and ends with a written summary of everything that changed.
+
+---
+
+## 1. Goal
+
+Collapse the repetitive per-task review→merge clicking into a single "Let Claude handle it" action. The user picks the tasks; an embedded Claude session babysits them — running the ones that still need running, reviewing diffs, merging the clean ones, resolving conflicts, and reporting back — while remaining fully interactive so the user can answer questions mid-run.
+
+This reuses the existing ConPTY infrastructure (UI-process embedded terminal) and the globally-registered `claudedo` MCP server. The only genuinely new worker capability is **MCP-driven conflict resolution** (§5), which today exists only in the UI hub.
+
+---
+
+## 2. Decisions (locked with user, 2026-07-24)
+
+| Question | Decision |
+|---|---|
+| Which tasks does the helper handle? | **Free choice, any status.** User hand-picks; helper acts per-status. |
+| How are tasks selected for a run? | **Checkbox dialog before launch** (candidates listed, user ticks). |
+| Merge authority / review-gate | **Auto-merge; asks interactively on uncertainty.** The app's per-task diff-gate is intentionally bypassed for helper-driven merges. |
+| Conflict handling | **Build MCP conflict tools** so the helper resolves conflicts in the working tree itself, asking only when unsure (Option B). The helper must handle **all** cases including parent/children unit merges; where the MCP path doesn't reach, **manual resolution by hand (Edit + git) is an accepted fallback** (user-confirmed 2026-07-24). |
+
+---
+
+## 3. UX Flow
+
+1. **Entry points**
+   - **Per-list:** context-menu item **"Let Claude handle it"** on each user-list row in `ListsIslandView.axaml` (alongside Settings / Worktrees / Open in Explorer).
+   - **Global:** one entry (footer of the lists island) that spans *all* lists/repos.
+2. Click opens the **Merge Helper selection dialog** (§4): a checkbox list of candidate tasks, grouped by list/repo, pre-filtered to tasks worth acting on but freely overridable.
+3. User ticks tasks → **"Let Claude handle it"** confirm button.
+4. UI asks the worker for a `MergeHelperLaunchSpec`, opens a **ConPTY tile in Mission Control** running the real `claude` TUI with the merge-helper prompt.
+5. The session works through the tasks, printing progress and asking questions inline; the user answers directly in the terminal.
+6. On completion Claude prints a **summary** (merged / skipped / conflicted / follow-ups). The tile stays open for review.
+
+---
+
+## 4. Selection Dialog
+
+New modal `MergeHelperSelectionDialog` (View + VM), built with the existing `TaskCompletionSource<T>` dialog pattern used by other modals.
+
+**Contents:**
+- Title: *"Let Claude handle it"* + subtitle naming the scope ("List: <name>" or "All lists").
+- A scrollable checkbox list of **candidate tasks**. Per row: checkbox, title, status badge, list/repo name (in global mode).
+- Grouping: by list/repo in global mode; flat in per-list mode.
+- Default selection: all **actionable** tasks pre-ticked — actionable = `WaitingForReview`, `Idle`, `Queued`, `Failed` (resettable). `Running` / `WaitingForChildren` shown but unticked (helper will poll them). Terminal `Done`/`Cancelled` excluded from the list entirely.
+- Footer: **"Let Claude handle it"** (disabled when nothing ticked) + **Cancel**. A "select all / none" affordance.
+
+**Candidate source:** `list_tasks` via the existing worker client (per list, or across all lists for global). No new query needed; the VM filters client-side by status.
+
+**Output:** an ordered `IReadOnlyList<string>` of selected task IDs (+ their list/repo mapping), passed to the launch request.
+
+---
+
+## 5. New Worker Capability — MCP Conflict Resolution
+
+Today (verified): `merge_task` / `review_task approve` call `TaskMergeService.MergeAsync(..., leaveConflictsInTree:false)` — on conflict they run `git merge --abort` (clean rollback, no markers) and return `mergeStatus="conflict"`; the task stays `WaitingForReview`. Continue/abort/write-resolution exist **only** on the SignalR hub (Rider merge editor). An MCP agent therefore cannot resolve conflicts. This section adds that.
+
+### 5.1 Approach
+
+Reuse the *exact* engine methods the UI already uses — `TaskMergeService.MergeAsync(leaveConflictsInTree:true)`, `ContinueMergeAsync`, `AbortMergeAsync` — and expose them over MCP. The helper resolves conflict markers on disk (it has filesystem access to the repo checkouts via `--add-dir`, see §6.3) and drives the merge state exclusively through MCP tools so the engine stays authoritative.
+
+### 5.2 MCP surface changes (`ExternalMcpService.cs`)
+
+1. **`review_task` / `merge_task` — new optional param `leaveConflictsInTree: bool = false`.**
+   When `true` and the merge conflicts: leave markers in the checkout instead of aborting, and return
+   `{ mergeStatus: "conflict_in_tree", conflicts: string[], repoPath: string }`
+   where `repoPath` is the checkout holding the markers. Task stays `WaitingForReview`, merge is in progress. Clean-merge behaviour is unchanged, so the helper can always pass `true`.
+
+2. **New tool `continue_merge(taskId)`** → `TaskMergeService.ContinueMergeAsync`.
+   Stages the resolved files and commits the merge; on success the task goes to `Done` and the worktree is marked merged, returning `{ merged: true, mergeCommit }`. If markers remain, returns `{ merged: false, conflicts: string[] }`.
+
+3. **New tool `abort_merge(taskId)`** → `TaskMergeService.AbortMergeAsync`.
+   Aborts the in-progress merge; task stays `WaitingForReview`. Returns `{ aborted: true }`.
+
+**Implementation notes (verify against `TaskMergeService.cs` during the plan):**
+- Confirm the exact signatures of `ContinueMergeAsync` / `AbortMergeAsync` and how in-progress-merge state is keyed. The hub tracks a single active conflict merge; the MCP variants must locate the merge from `taskId` (target branch + repo from the task/list), not shared hub state.
+- Emit the existing `TaskUpdated` event after continue/abort so the UI list re-buckets live.
+- Guard against a repo already mid-merge (`Blocked`) — surface it to the agent rather than clobbering.
+
+### 5.3 Parent/children unit merges
+
+`review_task approve` on a task **with children** drives `PlanningMergeOrchestrator` (a multi-step unit merge with its own continue/abort on the hub). The helper must handle these too. Two paths, tried in order:
+
+1. **MCP (preferred):** `continue_merge` / `abort_merge` detect *which* kind of in-progress merge the task has (single-task `TaskMergeService` vs orchestrated `PlanningMergeOrchestrator`) and route to the matching engine continue/abort. This keeps the orchestrated path engine-mediated over MCP too. Implement if the orchestrator's continue/abort can be located from the task without shared hub UI state (verify in A1).
+2. **Manual fallback (accepted):** where the MCP path genuinely can't reach an in-progress merge, the helper resolves the conflict markers on disk (Read/Edit) and completes the merge by hand (`git add <paths>` + `git commit`, or `git merge --continue`). The user has explicitly accepted hand-merging as a fallback. The system prompt still mandates: **prefer the MCP tools whenever they apply**; only drop to raw git for cases the MCP tools don't cover, and honour the shared-checkout rule (`git commit -- <paths>`, never a bare commit that sweeps peers' index).
+
+---
+
+## 6. Launch — Worker + Wiring
+
+### 6.1 Prompt templates
+
+Add `PromptKind.MergeHelper` (system) and `PromptKind.MergeHelperInitial` (brief) to `ClaudeDo.Data/PromptFiles.cs`, with built-in defaults and `{{token}}` rendering, mirroring `Planning` / `PlanningInitial`.
+
+- **System prompt** (`merge-helper-system.md`): defines the role and the per-status algorithm (§7), the merge/conflict rules, the "ask on uncertainty" posture, and the required final summary format.
+- **Initial brief** (`merge-helper-initial.md`): rendered with the selected tasks — a table of `{id, title, status, list, repo}` plus the scope label. Written to a session-brief file on disk; the positional prompt is a **single-line kickoff** pointing at that file via `--add-dir` (planning pattern — a multi-line positional prompt truncates at the first newline).
+
+### 6.2 Session files
+
+Path: `~/.todo-app/merge-helper-sessions/<sessionId>/` (a fresh GUID per run — these sessions are ephemeral and never resumed):
+- `brief.md` — rendered task list + scope + instructions.
+- No per-session MCP config: the session uses the **globally-registered `claudedo` MCP server** (same as task/ad-hoc sessions), so no token is needed.
+
+Cleanup: prune session dirs older than N days on app start (best-effort; same posture as planning dirs).
+
+### 6.3 Launch spec
+
+New `InteractiveLaunchSpecService.BuildForMergeHelper(selectedTaskIds, scope, ct)` returning a `LaunchSpec`:
+- **Cwd:** per-list → the list's repo working dir; global → the first selected task's repo (any valid repo; the agent works cross-repo via MCP).
+- **`--add-dir`:** the session-brief dir **plus every distinct repo checkout** among the selected tasks (so the agent can read/resolve conflict markers in each repo). Computed from each task's list working dir.
+- **Args:** `--permission-mode default`, `--allowedTools mcp__claudedo__*,Read,Grep,Glob,Edit,Bash,WebFetch,WebSearch,Skill`, `--append-system-prompt-file <merge-helper-system.md>`, `--add-dir ...`, then the single-line kickoff prompt.
+  - `Edit` is required for conflict resolution; `Bash` is allowed for **read-only** git inspection (`git status`/`diff`) — the system prompt mandates that all merge *state changes* go through MCP tools, never raw `git merge/commit`, to keep the engine authoritative and honour the user's rejection of the "raw git" option.
+- **Env:** `MCP_TOOL_TIMEOUT=200000` (as task/ad-hoc sessions set).
+
+### 6.4 Hub + client + Mission Control
+
+- **Hub:** `WorkerHub.GetMergeHelperLaunchSpec(string[] taskIds, string? listId)` → `_launchSpecService.BuildForMergeHelper(...)`. Sibling to `GetAdHocLaunchSpec` / `GetPlanningStartLaunchSpec`.
+- **Client:** `IWorkerClient.GetMergeHelperLaunchSpecAsync(...)` + `WorkerClient` impl.
+- **Mission Control:** `MissionControlViewModel.OpenMergeHelperConPtySessionAsync(spec)` — wraps the spec in a `TerminalLaunchDescriptor`, creates a `ConPtyPaneViewModel` (ad-hoc style, **never deduped** — each run is its own tile), adds it to `ConPtySessions`.
+- **Event plumbing:** `ListsIslandViewModel` raises `LetClaudeHandleRequested(scope)`; `IslandsShellViewModel` forwards to Mission Control, which opens the selection dialog, then (on confirm) fetches the spec and opens the tile.
+
+---
+
+## 7. Helper Behaviour (encoded in the system prompt)
+
+For each selected task, act by status:
+- **Idle / Queued:** `run_task_now`; poll `get_task` until terminal or `WaitingForReview`.
+- **Failed:** `reset_failed_task` then run, *or* ask the user — failures often need a human call; default to asking briefly.
+- **Running / WaitingForChildren:** poll `get_task` until it surfaces for review.
+- **WaitingForReview:** `get_task_diff` (stat first, then full if needed), sanity-check the change against the task's intent, then `review_task approve` with `leaveConflictsInTree:true`.
+  - **Clean →** merged, task Done.
+  - **Conflict (`conflict_in_tree`) →** open the conflicted files under `repoPath` (Read/Edit), resolve the markers guided by both sides' intent, then `continue_merge`. If the resolution is non-obvious or risky, **ask the user in the terminal** before continuing. `abort_merge` if the user declines or it's unsafe.
+- **Parent with children:** clean unit merge proceeds; on conflict, resolve via the MCP tools if they reach the orchestrated merge, else hand-merge the markers and complete it (§5.3) — asking the user first when the resolution is non-obvious.
+
+Cross-cutting rules (in the prompt):
+- Ask the user interactively for anything ambiguous, risky, or destructive — that is the point of the ConPTY session.
+- Never use raw `git merge/commit/reset`; drive all merge state through the MCP tools.
+- Keep a running tally; at the end print a **summary**: per task — final status, merge commit (if any), conflicts resolved, anything skipped, and suggested follow-ups.
+
+---
+
+## 8. Testing
+
+**Automated (`ClaudeDo.Worker.Tests`, real SQLite + real git):**
+- `review_task`/`merge_task` with `leaveConflictsInTree:true`: clean merge → Done; conflicting merge → `conflict_in_tree`, markers present in the checkout, task stays `WaitingForReview`.
+- `continue_merge`: after markers resolved on disk → commits, task Done, worktree merged; with markers still present → returns remaining conflicts.
+- `abort_merge`: in-progress merge aborted, markers gone, task stays `WaitingForReview`.
+- `continue_merge`/`abort_merge` on a task with no in-progress merge → clean MCP error, no clobber.
+- `TaskUpdated` fired after continue/abort.
+- `BuildForMergeHelper`: computes distinct repo `--add-dir` set, correct cwd per scope, brief file rendered with all selected tasks, allowed-tools string correct.
+
+**No real-Claude tests** (per project convention) — the end-to-end ConPTY run is a manual smoke item.
+
+**Manual (add to `docs/open.md`):**
+- ConPTY tile launches with the brief; MCP tools reachable; a clean multi-task run merges all and prints a summary.
+- A seeded conflict is resolved autonomously via `continue_merge`.
+- Interactive question round-trip (helper asks, user answers in terminal).
+- Global (multi-repo) run with `--add-dir` for each repo.
+- Selection dialog: grouping, default ticks, select-all/none, per-list vs global scope.
+
+---
+
+## 9. Phasing
+
+Delivered as one plan with three phases (see the plan doc). Phase A is independently useful and merges first.
+
+- **Phase A — Worker MCP conflict tools** (§5): `leaveConflictsInTree` param + `continue_merge` + `abort_merge` + tests. No UI.
+- **Phase B — Worker launch** (§6.1–6.4 worker side): prompt templates, `BuildForMergeHelper`, hub endpoint, session-file/brief generation, client method. Contract for C locked here.
+- **Phase C — UI**: selection dialog (View+VM), per-list + global entries, event plumbing, `OpenMergeHelperConPtySessionAsync`.
+
+---
+
+## 10. Out of scope (v1)
+
+- Resuming a merge-helper session (`--resume`); sessions are ephemeral.
+- A non-interactive/headless merge-helper (this is deliberately a ConPTY interactive session).
+- Cross-list *batching* semantics beyond "act on each selected task independently."
+- Any change to the existing per-task Approve/diff-gate flow.

docs/verification-handoff.md

@@ -0,0 +1,113 @@
+# Verifikations-Handoff (Stand 2026-07-24)
+
+Manuelle Verifikation am laufenden System. **Mika bedient die UI, die Session protokolliert Pass/Fail** und bereitet Fixtures vor (Tasks via ClaudeDo-MCP, Git-Setups im Testrepo). Aktive Findings landen in `docs/open.md`; hier steht der Fortschritt je Abschnitt.
+
+## Handoff für die nächste Session
+
+**Erledigt (2026-07-24):** §1 Detail-Insel/Diff-Viewer (bis auf DiffModal-Fehler-State), §2 Worktree-Pipeline (alle 3), §3 Planning-Walkthrough (inkl. UnfinishedPlanning-Modal: dismiss/Finalize/Discard PASS, **Resume BUG**), §4 Merge-Editor (Single-Task **und** Planning-Unit-Konflikt **und** Abort), §6 Pick-up-Gating (Code), §7 AskUser (Happy-Path + Timeout + UI-Cleanup; Finding: Banner nur in Mission Control), §8 Session Skills (Install/Aktivierung/Seeding/Gegenprobe/Remove; Findings: fehlender Empty-State + abweichendes Agent-Gear-Icon), §9 Attachments (Drag&Drop-UI + MCP + ComposedPreview; Finding: intermittenter erster-Drop-Fehler), §12 RunNow (moot).
+
+**Noch offen:**
+- **§10 Daily Prep/Weekly** — **Bewusst zurückgestellt (2026-07-24)**: Mika will Daily Prep + Weekly Report ohnehin überarbeiten — Verifikation lohnt erst nach dem Rework.
+- **§11 Self-Update/Autostart** — **Nicht formell gefahren, aber laut Mika „läuft bisher sehr gut" (2026-07-24)** → als OK behandelt; bei Bedarf später gezielt nachtesten.
+- ~~**Kanten:** §1 DiffModal-Fehler-State, §3 UnfinishedPlanning-Modal, §4 Abort~~ — **alle erledigt (2026-07-24)**: §4 Abort PASS, §3 Modal (Finalize/Discard PASS, Resume BUG), §1 via Code-Analyse geklärt (defensiv/unerreichbar).
+
+**Vorbedingungen:** Worker + App laufen (SignalR 37821, External MCP 47822 — lt. `~/.todo-app/worker.config.json`). Testliste **`ClaudeDoTests`** (`C:\TestRepos\ClaudeDoTests`, listId `e7992fee6035448394b646d069690e05`) für zerstörungsfreie Runs.
+
+**Wichtige Gotchas / Lessons (diese Session):**
+- **NIE `model:"haiku"` für schreibende Task-/Verifikations-Runs** — unter dem Default `--permission-mode auto` werden haiku-Writes denied (still no-op). Immer **sonnet**. (Memory `auto_permission_haiku_footgun`.)
+- **Merge-Preflight blockt bei dirty Ziel-Working-Tree** (getrackte uncommittete Änderung im `main`-Checkout) — und **Approve schluckt das still** (Bug, open.md). Vor Merge-Checks `git -C C:\TestRepos\ClaudeDoTests status --short` prüfen; fremde WIP nur mit Rücksprache verwerfen (Memory `shared_worktree_partial_commits`: nur pfad-scoped committen).
+- **Konflikt-Fixture-Rezept:** Task (sonnet) überschreibt eine getrackte Datei im Branch → danach dieselbe Datei auf `main` divergent ändern + `git commit -- <pfad>` → Approve konfliktet. Für Planning-Unit-Konflikt: main-Edit erst scharfschalten, wenn der Parent in WaitingForReview steht.
+- **Datenwahrheit** notfalls direkt aus der DB: `sqlite3 -readonly ~/.todo-app/todo.db "SELECT substr(id,1,8),status,planning_phase,substr(blocked_by_task_id,1,8),title FROM tasks WHERE …"`.
+
+**Testrepo-/Fixture-Zustand:** Aufgeräumt (2026-07-24, §7+§8-Session-Ende) — alle `verif §7/§8`-Tasks gelöscht, deren Worktrees + Branches entfernt, `ClaudeDoTests`-`main` unangetastet bei `ecad650` (Tree clean; die §7-Runs liefen isoliert in Worktrees, main nie berührt). ponytail-Skills nach dem Remove-Test wieder deinstalliert (`session_skills` leer, `~/.todo-app/session-skills/` leer). Keine `verif`-Tasks und keine claudedotests-Worktrees übrig. Die übrigen `claudedo/*`-Branches im Testrepo stammen aus früheren Sessions — nicht anfassen. **Die nächste Session baut Fixtures frisch** (Rezepte s. Gotchas oben).
+
+**Erfasste Folge-Tasks** (Liste „Claude do", Idle, brauchen Brainstorm vor Umsetzung): `f9809a93` Approve erzwingt Diff/Review vor Merge (+ blocked-Merge-Silent-Fail-Fix), `5d627df8` Planning-Session über embedded ConPTY statt wt (+ Planning-Permission-Prompt).
+
+**Fix-Session:** Alle fixbaren Findings sind für eine frische Session in **`docs/fix-plan-2026-07-24.md`** aufbereitet (gruppiert nach Fixbarkeit: A mechanisch, B error-surfacing, C entscheidungsbedürftig, D investigation, E nits). Volltext je Finding bleibt in `docs/open.md`.
+
+**Nacharbeit:** Erledigtes aus `docs/open.md` austragen; dieses File löschen, sobald §10 (nach Rework) + evtl. §11-Nachtest erledigt sind.
+
+---
+
+## 1. Detail-Insel & Diff-Viewer (reines Durchklicken)
+
+- [~] Detail-Insel komplett: Output/Git/Session-Tabs, Merge-Sektion, Agent-Settings-Overrides (InheritedBadge korrekt), Prep-Panel — nach dem VM-Split (`DetailsIslandViewModel` → Sektions-VMs) alles gebunden, keine leeren Panels. — **TEILWEISE (2026-07-24, User-Sichtprüfung an `verif §1 diff matrix`):** Output/Git-Tabs, Merge-Sektion, Agent-Badges vorhanden & gebunden, keine leeren Panels. Git-Tab: `+1 −37`, „merges cleanly" korrekt. **BUG:** OUTCOME-Karte zeigt rohes JSON (s. open.md). Session-Tab fehlt — **erwartet** (nur bei Parent mit Kindern, `HasChildOutcomes`; wird in §4/§3 mit echtem Parent geprüft). Minor: TurnsText `0/max` bei terminalem Reload (open.md). Prep-Panel → §10.
+- [~] Diff-Viewer: Dateiliste, Added/Deleted/Renamed/Binary-Erkennung, Commit-Range-Diff nach einem Merge. — **Added/Deleted/Binary PASS**; **Renamed** erkannt + „R"-Badge, aber schwach dargestellt (kein alt→neu-Pfad, „+0 −0" — nit, s. open.md); „Review Combined Diff" korrekt ausgegraut (kein Planning-Parent). **Commit-Range-Diff nach Merge: PASS (2026-07-24)** — Diff des gemergten Done-Tasks rendert über `base..head` trotz entferntem Worktree.
+- [x] DiffModal-Fehler-State: Commit-Range ohne aufgezeichnete Commits → „Diff nicht mehr verfügbar" statt Crash/leer. — **GEKLÄRT via Code-Analyse (2026-07-24): der Fehler-State ist defensiv/unerreichbar.** `vm.diff.unavailable` (DiffViewerViewModel.cs:117-119) feuert nur bei `FromCommitRange && (BaseRef==null || HeadCommit==null)` oder `WorktreePath==null`. Alle Aufrufer sind gegated: `MergeSectionViewModel.OpenDiffAsync` ruft `ConfigureCommitRange` nur unter `CanDiffMergedRange` (base **und** head non-null) und `ConfigureWorktree` nur unter `hasLiveWorktree` (Pfad non-null + existiert); `WorktreesOverviewModalViewModel` übergibt `row.Path` (non-null). Damit können die Null-Checks über die UI nie wahr werden — der „Crash/leer"-Fall, den der Check absichern wollte, ist durch die CanExecute-/Modus-Gates ausgeschlossen. (Fehlende Commit-Objekte bei vorhandenem base+head → `GetCommitRangeDiffAsync` wirft → „loadFailed", nicht „unavailable".) Nicht manuell auslösbar; kein Bug.
+- [x] „children need attention"-Band auf dem Session-Tab eines Parents mit failed/blocked Kind. — **PASS (2026-07-24, in §3)**: Band + OUTCOMES-Liste mit Roadblock-Hinweis auf dem Session-Tab des Planning-Parents (`verif §3`, Roadblock-Kind).
+
+## 2. Worktree-Pipeline (3 falsifizierbare Fälle)
+
+- [x] Happy-Path: Task mit WorkingDir → `worktrees.state='active'`, `head_commit` gesetzt, `diff_stat` non-empty, Branch `claudedo/<id[:8]>` existiert auf Disk. — **PASS (2026-07-24)** via Task `e63eb2f5` (sonnet): Worktree active, `headCommit 8a3ae86` (ahead=1 vom Base), `diff_stat` non-empty (`review-cancel.txt`), Branch `claudedo/e63eb2f5…` auf Disk. (Mein erster Versuch mit `model=haiku` schlug fehl — das war ein haiku/auto-Footgun, keine Pipeline-Sache; s. open.md.)
+- [x] No-Changes-Run: → `status='Done'`, `head_commit IS NULL`, `diff_stat IS NULL`. — **PASS (2026-07-24)**; Präzisierung: aktueller Flow endet in `WaitingForReview` (nicht `Done`, das ist erst nach Approve) — Doc-„Done" ist veraltet. Kein neuer Commit, leerer Diff bestätigt.
+- [x] Kein Git-Repo (WorkingDir = `C:\Temp`): → `status='Failed'`, KEINE `worktrees`-Row, Git-Fehler im Log. — **PASS (2026-07-24)**; Fehler: „Worktree creation failed: working_dir is not a git repository".
+
+## 3. Planning-Flow-Walkthrough
+
+- [x] Draft → Finalize → Kette: Finalize queued NICHT automatisch (Kinder bleiben Idle); „Queue plan" setzt alle nicht-terminalen Kinder Queued, Kette läuft sequenziell durch (blocked-by löst sich je Vorgänger). — **PASS (2026-07-24, End-to-End mit `verif §3`)**: 3 Kinder gedraftet, Finalize → Parent WaitingForChildren+finalized, Kinder Idle+Kette (clean→conflict→roadblock), Queue plan → sequenzieller Durchlauf, alle Done. **Begleit-Findings (open.md):** „Waiting for Improvements"-Mislabel, Kind-Badge-Live-Refresh (Draft→Planned erst nach Listenwechsel), Kette nicht visualisiert, planning-aktiver Parent zeigt „Idle", Dequeue-X fehlt auf wartenden Kindern, Planning-Permission-Prompt, Planning nutzt wt statt ConPTY.
+- [x] Parent landet nach letztem terminalen Kind in WaitingForReview; Approve merged die ganze Unit (Parent-Worktree falls Active + jedes Done-Kind in Reihenfolge). — **PASS (2026-07-24)**: Parent → WaitingForReview auch mit Roadblock-Kind; Approve → Unit-Merge (child-clean clean, child-conflict → Konflikt-Editor pro Subtask → aufgelöst → Continue, child-roadblock no-op) → Parent Done, Merge gelandet.
+- [x] UnfinishedPlanning-Modal: Resume / FinalizeNow / Discard. — **GETESTET (2026-07-24, `verif §3 unfinished-planning` + `verif §3 resume-discard`)**: Modal wird via Rechtsklick→„Resume planning session" ausgelöst, zeigt Titel + „N draft task(s) waiting to be finalized" + Buttons Discard/Finalize/Resume + ×. **× (dismiss)**: No-op (State bleibt `active`). **Finalize**: Parent → `finalized`+`WaitingForChildren`, Kinder Idle+Blocked-by-Kette (= Planned) — PASS. **Discard**: Draft-Kinder gelöscht, Parent → `none`+`idle` — funktional PASS. **Resume: BUG — macht nichts** (`planning_session_id` nie erfasst → `ResumeAsync` wirft „No Claude session ID captured yet", vom UI im leeren `catch` verschluckt; s. open.md). Beide State-ändernden Aktionen reproduzieren das Kind-Rows-Live-Refresh-Finding (Finalize: Badges stale; Discard: gelöschte Rows bleiben bis Reload; open.md).
+
+## 4. Merge-Editor (Rider-Style 3-Pane) mit echtem Konflikt
+
+Konflikt provozieren: gleiche Datei auf main ändern, während der Task-Branch sie ändert. Beide Wege testen: **(a)** Single-Task-Approve mit Konflikt, **(b)** Planning-Unit-Merge mit Konflikt in einem Subtask (`PlanningMergeConflict` → Editor öffnet pro Subtask).
+
+**Verifiziert 2026-07-24 (Single-Task-Approve mit Konflikt, 2 Dateien, `verif §4`): End-to-End PASS** — Approve→Konflikt→3-Pane-Resolver→beide Dateien auflösen→Continue→Merge→Task Done (Merge-Commit gelandet). Sauberer additiver Approve (`verif §1b`, kein Konflikt) → direkt gemergt → Done, kein Editor: **PASS (2026-07-24)**. ⚠ **Vorbedingung-Fund:** ein dirty Ziel-Working-Tree (getrackte uncommittete Änderung) blockt den Merge und Approve schluckt das **still** (s. open.md „Approve & Merge schluckt blocked"). Planning-Unit-Merge-Konflikt (Weg b): **PASS (2026-07-24, in §3)** — Approve eines Planning-Parents mit einem konfliktenden Subtask öffnet den 3-Pane-Editor pro Subtask (`PlanningMergeConflict`), Continue führt den Unit-Merge fort → Parent Done.
+
+- [x] Drei Panes: MAIN read-only | Result editierbar | INCOMING read-only; Konfliktblöcke rot, aufgelöst grün, in allen Panes. — **PASS**.
+- [x] Gutter-Toggle `›`/`‹`: Seite rein/raus, Klickreihenfolge = Reihenfolge im Result; main/incoming/beide/keine möglich. — **PASS**.
+- [x] Nur Konfliktregionen im Result editierbar (Stable read-only); Edits fließen in den Block zurück. — **PASS**.
+- [~] Synchrones vertikales Scrollen; File-Switcher bei mehreren Dateien; `M conflicts · K resolved`-Readout; Conflict-Ruler (Klick springt). — **PASS**, aber **Multi-File schlecht erkennbar** (2 Konfliktdateien schwer zu sehen — UX-Nit, open.md).
+- [~] Continue erst aktiv, wenn ALLE Konflikte in ALLEN Dateien gelöst; Binär-Guard greift. — **funktional PASS** (merged erst nach Auflösung beider Dateien), aber **Button ist klickbar statt disabled** solange offen → stummer No-op (UX-Bug, open.md). Binär-Guard hier n/a.
+- [x] Abort: Tree sauber, Task bleibt WaitingForReview. — **PASS (2026-07-24, `verif §4 abort`)**: Single-Task-Approve mit divergentem main→Konflikt→3-Pane-Editor→**Abort**: Editor schließt, Task bleibt `WaitingForReview`, `main`-Tree sauber (kein `MERGE_HEAD`, kein dirty), `main`-Inhalt + HEAD unverändert.
+- [FEATURE-WUNSCH] farbliches Hervorheben der übernommenen/eingefügten Zeilen im Result-Pane (open.md).
+- Bekannte Kanten (nur gegenprüfen, nicht als Fail werten): leere Ours-Seite → null-lange Result-Region (Accept geht, Handtippen fummelig); Gutter-Y-Ausrichtung bei sehr hohen Fenstern/großem Scroll; vertikaler Drift nachfolgender Blöcke nach Konflikt mit ungleicher Zeilenzahl.
+
+## 5. Embedded ConPTY / Mission Control
+
+- [x] **Kritisch:** Task-basiert (Kontextmenü „Open ConPTY session"): frischer Task → Worktree wird on-demand angelegt, `claude` startet — Task-Prompt wirklich GESENDET. — **PASS (2026-07-24)**: Agent antwortete mit dem Marker `CONPTY-PROMPT-RECEIVED-4Q7`, Worktree on-demand angelegt.
+- [~] Ad-hoc: „New session"-Button → Ordnerwahl → freie Session im gewählten Verzeichnis. — **funktioniert, aber Button unsichtbar**: `Icon.Plus` ist Strich-Only → `PathIcon` rendert nichts (Bug, open.md). Über Tooltip/Klick auf die leere Header-Fläche erreichbar; Ordnerwahl + Ad-hoc-Session funktionieren.
+- [x] Grid↔Tabs-Toggle; Close killt den Prozess + entfernt die Kachel; mehrere Sessions parallel; Pane-Resize reflowt das TUI. — **PASS (2026-07-24)**: Resize/Reflow ok; Close entfernt Kachel UND killt den Prozess (verifiziert: ConPTY-PID 50964, Kind von ClaudeDo.App, nach Close tot).
+- [~] Resume: im Worktree-Dir per `claude --continue` möglich (ClaudeDo persistiert die ConPTY-Session-Id bewusst nicht). — **wie designt**: erneutes „Open ConPTY session" resumt NICHT, sondern startet frisch und **sendet den Prompt erneut** (UX-Falle, open.md). In-App-Resume gibt es nicht; nur claude-eigenes `--continue`/`--resume` im Worktree-Dir.
+
+## 6. Pick up in terminal
+
+- [x] Sichtbarkeit: Kontextmenü-Eintrag + Terminal-Button (ArrowOut) NUR bei WaitingForReview und Failed; bei Idle/Running/Queued/Done nicht. — **PASS (2026-07-24, Code+Test)**: `CanPickUpInTerminal => Status is WaitingForReview or Failed` (TaskRowViewModel.cs:69, DetailsIslandViewModel.cs:898), gebunden in TaskRowView.axaml:56 + TaskHeaderBar.axaml:34, Notify bei Statuswechsel, Unit-Test `CanPickUpInTerminal_OnlyForReviewOrFailed`. (Klick→Terminal + Fehler-Surfacing bleiben manueller UI/CLI-Check.)
+- [ ] Klick → neues Windows-Terminal im Worktree-Verzeichnis, `claude --resume <id>` nimmt die Session mit Kontext wieder auf.
+- [ ] Fehlerfälle surfacen sauber (Footer-Strip bzw. Fehlerdialog): laufende/gequeuete Task, keine persistierte Session-Id, kein aktiver Worktree.
+- Bekannte Kante: parked-Idle (reject-park) hat oft Session+Worktree, zeigt die Aktion aber bewusst NICHT (Idle nicht unterscheidbar). Nervt das in der Praxis → `CanPickUpInTerminal` erweitern.
+
+## 7. AskUser (Frage aus laufendem Task)
+
+Runtime-Toolname ist `mcp__claudedo_run__ask_user` (snake_case, nicht `AskUser`). Fixture: sonnet-Task mit Prompt „zwei sich widersprechende, irreversible Optionen — du MUSST `ask_user` fragen, nicht raten" erzwingt den Call zuverlässig.
+
+- [x] Task, dessen Prompt eine Rückfrage erzwingt → Frage erscheint im Task-Monitor (Mission Control), Prozess wartet. — **PASS (2026-07-24, `verif §7 askuser 2`)**: Banner in Mission Control, Run blockiert im `ask_user`-Tool-Call. **BUG:** in der Task-Detail-Insel erscheint KEIN Banner (nur Mission Control) → s. open.md.
+- [x] Antwort inline absenden → Run läuft mit der Antwort weiter. — **PASS (2026-07-24)**: Antwort „A" inline gesendet → Agent bekam „option A", benannte `merge-playground.txt` → `renamed-by-agent.txt` um, schrieb `askuser-result.txt` = „USER CHOSE: A", Task → WaitingForReview.
+- [x] Timeout-/Cleanup-Verhalten der PendingQuestionRegistry (Frage unbeantwortet lassen): Task schlägt kontrolliert fehl, UI räumt die Frage auf (MCP_TOOL_TIMEOUT-Gotcha). — **PASS (2026-07-24)**: Backend (`verif §7 askuser`) nach exakt 3 min Fallback zurück, Agent hielt sich an „MUST NOT guess", meldete `CLAUDEDO_BLOCKED`, Repo untouched, Registry im `finally` aufgeräumt, Run endete `success` → WaitingForReview. **UI-Cleanup visuell bestätigt** (`verif §7 timeout-ui`, MC-Kachel offen/subscribt bis zum Timeout): Banner verschwindet beim Timeout automatisch (`TaskQuestionResolved` → `ClearPendingQuestion`).
+
+## 8. Session Skills (E2E + UI)
+
+- [x] Settings → Skills: `https://github.com/DietrichGebert/ponytail` installieren → 6 Skills erscheinen (ponytail, -help, -review, -audit, -debt, -gain), auf Commit gepinnt, Dateien unter `~/.todo-app/session-skills/<name>/`. — **PASS (2026-07-24)**: 6 Rows in `session_skills`, alle auf Commit `16f29800` gepinnt, `subpath=skills/<name>`, Dateien inkl. `SKILL.md` am erwarteten Ort. UI-Install nahm die URL an. **Nit:** Skills-Tab hat keinen Empty-State (s. open.md).
+- [x] Skill per-Task (Agent-Settings-Flyout) oder global aktivieren → Task laufen lassen → im Worktree liegt `.claude/skills/<name>/`, Agent kann ihn nutzen, `git status` im Worktree bleibt sauber (info/exclude greift). — **PASS (2026-07-24, per-Task, `verif §8 skill-activate`)**: `ponytail-help` per Flyout aktiviert (`task.SessionSkills=["ponytail-help"]`), Run → `.claude/skills/ponytail-help/SKILL.md` im Worktree, `info/exclude` bekam `/.claude/skills/ponytail-help/`, `git status` clean, Auto-Commit enthält NUR `skill-proof.txt` (Skill NICHT im Tree). Agent hat den Skill nachweislich genutzt (`skill-proof.txt` = ponytail-help-Referenzkarte verbatim). Global-Aktivierung (AppSettings.SessionSkills, General-Tab) nutzt denselben Seeding-Union-Pfad — funktional äquivalent, nicht separat gefahren.
+- [x] Gegenprobe: nicht-aktivierte/andere interaktive Session sieht den Skill NICHT (kein Leak nach `~/.claude`). — **PASS (2026-07-24)**: `~/.claude/skills/` enthält nur die vorbestehenden globalen Skills, KEIN ponytail. Seeder schreibt per Konstruktion nur nach `<workingDir>/.claude/skills` (SessionSkillSeeder), nie nach `~/.claude`.
+- [~] UI: Skills-Tab (Install-Zeile, Karten mit Update/Remove), Checkbox-Listen im General-Tab + AgentConfigEditor (Flyout-Höhe!), leerer Zustand (0 Skills — Empty-State fehlt evtl., dann entscheiden), lange Namen/URLs (Trimming). — **TEILWEISE (2026-07-24)**: Install-Zeile nimmt URL an (PASS); AgentConfigEditor-Flyout-Checkbox-Liste zeigt alle 6 Skills, Höhe ok, Trimming ok (User: „funktioniert wie erhofft"). **Empty-State fehlt** (nackte Fläche — open.md). **Agent-Settings-Gear ⚙ weicht vom Listen-Gear ab** (open.md). Skills-Tab-**Karten** (Name/Beschreibung/Pinned-Commit + Update/Remove) und **General-Tab-Checkbox-Liste** (6 Skills) sichtgeprüft (User: „sieht alles gut aus"). **Remove PASS (2026-07-24)**: ein Remove-Klick auf eine ponytail-Karte entfernte alle 6 Skills per Quell-URL (`session_skills` leer, alle Verzeichnisse unter `~/.todo-app/session-skills/` weg). **Update** nicht separat gefahren (Code-Pfad `SessionSkillRegistry.UpdateAsync`).
+
+## 9. Attachments (Drag & Drop + MCP)
+
+- [x] Drop aufs Detail-Pane: „Drop to attach"-Overlay, Datei erscheint in der Liste, landet unter `~/.todo-app/attachments/<taskId>/`; „Add file…"-Picker; Remove-Button. — **PASS (2026-07-24, `verif §9 attachments-ui`)**: Overlay/Highlight beim Drüberziehen, Drop-Round-Trip (`drop-me.txt` in Liste + Disk + DB, 29 B), „Add file…"-Picker (`pick-me.md`), Remove (Datei aus Liste + Disk + DB) — alle bestätigt. **Finding:** der ALLERERSTE Drop der Session schlug einmalig mit inline „An error occurred" fehl (nichts persistiert), danach fehlerfrei — intermittierend, nicht reproduzierbar (s. open.md).
+- [x] `ComposedPreview` enthält die Attachment-Pfade („## Reference files"). — **PASS (2026-07-24, Code+Test)**: TaskPromptComposer.cs:31 emittiert „## Reference files", ComposedPreview reicht Pfade durch, TaskRunner.cs:132 injiziert zur Laufzeit; TaskPromptComposerTests decken es ab.
+- [x] MCP: `add_task_attachment` / `list_task_attachments` / `remove_task_attachment`; Running-Task verweigert add/remove. — **PASS (2026-07-24)** für add/list/remove-Round-Trip inkl. Datei unter `~/.todo-app/attachments/<taskId>/` (71 B, korrekt, nach Remove weg). Running-Task-Verweigerung ist code-guarded (AttachmentMcpTools), aber ohne dauerhaft laufende Task nicht live geprüft → manueller Rest.
+
+## 10. Daily Prep (Prime) & Weekly Report
+
+- [ ] Prime-Trigger: Schedule feuert bzw. „Plan day" manuell → Prep-Log streamt live, `daily-prep.log` enthält letzten Run, MyDay-Auswahl respektiert `DailyPrepMaxTasks`.
+- [ ] Weekly Report: Range-Default „seit letztem Standup-Wochentag → heute", Markdown rendert, Cache pro Range.
+
+## 11. Self-Update & Autostart (am Gerät)
+
+- [ ] Update-Banner → Update durchführen → danach „up to date".
+- [ ] Autostart: Logoff/Logon startet den Worker (Startup-`.lnk`); Update-Pfad erhält den Autostart; Uninstall entfernt die `.lnk`.
+
+## 12. Status-Bar / RunNow (Mini-Codecheck, erst messen)
+
+- [x] Worker trennen/verbinden → prüfen, ob RunNow-Enable pro Task-Row sauber re-evaluiert (Connection-State lebt in `IslandsShellViewModel`). Nur fixen, wenn tatsächlich kaputt. — **PASS/moot (2026-07-24, Code)**: Es gibt kein per-Row-RunNow-Control in der UI; `RunNowAsync` (IWorkerClient/WorkerClient) hat keinen VM/View-Aufrufer (RunNow nur via MCP `run_task_now`). Die realen Detail-Pane-Aktionen (Enqueue/Dequeue/Continue/ResetAndRetry) re-evaluieren korrekt bei Connection-Change (DetailsIslandViewModel.cs:317-323). Nebenbefund: `RunNowAsync` in der UI ist toter Code.

src/ClaudeDo.App/Program.cs

@@ -125,6 +125,7 @@ sealed class Program
         sc.AddTransient<Func<DiffViewerViewModel>>(sp => () => sp.GetRequiredService<DiffViewerViewModel>());
         sc.AddTransient<WorktreesOverviewModalViewModel>();
         sc.AddTransient<Func<WorktreesOverviewModalViewModel>>(sp => () => sp.GetRequiredService<WorktreesOverviewModalViewModel>());
+        sc.AddTransient<MergeHelperSelectionModalViewModel>();
         sc.AddSingleton<IPrimeScheduleApi, WorkerPrimeScheduleApi>();
         sc.AddSingleton<INotesApi, WorkerNotesApi>();
         sc.AddSingleton<IOnlineLoginService, OnlineLoginService>();

src/ClaudeDo.Data/Git/GitService.cs

@@ -71,9 +71,22 @@ public sealed class GitService
         return stdout;
     }
 
-    public async Task<bool> HasChangesAsync(string worktreePath, CancellationToken ct = default)
+    public Task<bool> HasChangesAsync(string worktreePath, CancellationToken ct = default) =>
+        HasChangesAsync(worktreePath, includeUntracked: true, ct);
+
+    /// <summary>
+    /// Uncommitted-changes check. <paramref name="includeUntracked"/>=false ignores untracked
+    /// files — use this for merge preflights on a shared target working dir, where stray
+    /// untracked files (e.g. from a concurrent session) shouldn't block a merge. Auto-commit
+    /// and data-loss-guard callers keep the default (true): a new file a task created, or an
+    /// untracked file about to be discarded, is a real uncommitted change.
+    /// </summary>
+    public async Task<bool> HasChangesAsync(string worktreePath, bool includeUntracked, CancellationToken ct = default)
     {
-        var (exitCode, stdout, stderr) = await RunGitAsync(worktreePath, ["status", "--porcelain"], ct);
+        string[] args = includeUntracked
+            ? ["status", "--porcelain"]
+            : ["status", "--porcelain", "--untracked-files=no"];
+        var (exitCode, stdout, stderr) = await RunGitAsync(worktreePath, args, ct);
         if (exitCode != 0)
             throw new InvalidOperationException($"git status --porcelain failed (exit {exitCode}): {stderr}");
         return !string.IsNullOrWhiteSpace(stdout);
@@ -330,13 +343,6 @@ public sealed class GitService
             .Count(s => s.Length > 0);
     }
 
-    public async Task MergeFfOnlyAsync(string repoDir, string branchName, CancellationToken ct = default)
-    {
-        var (exitCode, _, stderr) = await RunGitAsync(repoDir, ["merge", "--ff-only", branchName], ct);
-        if (exitCode != 0)
-            throw new InvalidOperationException($"Fast-forward merge of '{branchName}' failed. Manual merge required. git stderr: {stderr}");
-    }
-
     private static async Task<(int ExitCode, string Stdout, string Stderr)> RunGitAsync(
         string workDir, IEnumerable<string> args, CancellationToken ct, string? stdinData = null, bool trimOutput = true)
     {

src/ClaudeDo.Data/PromptFiles.cs

@@ -2,7 +2,7 @@ using System.Text;
 
 namespace ClaudeDo.Data;
 
-public enum PromptKind { System, Planning, PlanningInitial, Retry, DailyPrep, WeeklyReport, ImprovementChild, Refine }
+public enum PromptKind { System, Planning, PlanningInitial, Retry, DailyPrep, WeeklyReport, ImprovementChild, Refine, MergeHelper, MergeHelperInitial }
 
 public static class PromptFiles
 {
@@ -18,6 +18,8 @@ public static class PromptFiles
         PromptKind.WeeklyReport => Path.Combine(Root, "weekly-report.md"),
         PromptKind.ImprovementChild => Path.Combine(Root, "improvement-child.md"),
         PromptKind.Refine => Path.Combine(Root, "refine.md"),
+        PromptKind.MergeHelper => Path.Combine(Root, "merge-helper-system.md"),
+        PromptKind.MergeHelperInitial => Path.Combine(Root, "merge-helper-initial.md"),
         _ => throw new ArgumentOutOfRangeException(nameof(kind))
     };
 
@@ -63,6 +65,8 @@ public static class PromptFiles
         PromptKind.WeeklyReport => WeeklyReportDefault,
         PromptKind.ImprovementChild => ImprovementChildDefault,
         PromptKind.Refine => RefineDefault,
+        PromptKind.MergeHelper => MergeHelperDefault,
+        PromptKind.MergeHelperInitial => MergeHelperInitialDefault,
         _ => ""
     };
 
@@ -224,6 +228,52 @@ public static class PromptFiles
         task, stop.
         """;
 
+    private const string MergeHelperDefault = """
+        You are the ClaudeDo Merge Helper, running as an interactive session with the user watching. Ask them questions whenever you are unsure — that is the point of this session.
+
+        Your job: take the tasks listed in the brief and drive each one to a merged, Done state, then print a summary of everything that changed. You act through the mcp__claudedo__* tools. Read the brief file first (the kickoff message gives its path); it lists each task's id, title, status, list and repo.
+
+        Handle the tasks in the order listed, one at a time. For each task, act on its current status:
+        - Idle or Queued: run it with run_task_now, then poll get_task until it leaves Running (it lands in WaitingForReview on success, or Failed).
+        - Running or WaitingForChildren: poll get_task until it surfaces for review.
+        - Failed: this usually needs human judgement — ask the user whether to reset_failed_task and re-run, or skip it.
+        - WaitingForReview: review, then merge it (below).
+
+        Reviewing and merging a WaitingForReview task:
+        1. Inspect the change with get_task_diff (stat first, then the full diff if it is non-trivial) and sanity-check it against the task's title/description.
+        2. If the change looks wrong, incomplete, or risky, STOP and ask the user before merging — offer reject_rerun (with feedback) or skip.
+        3. Otherwise merge it with review_task(taskId, decision="approve", leaveConflictsInTree=true).
+           - Clean merge → the task is Done; move on.
+           - Conflict (markers left in the working tree, repoPath returned) → resolve it (below).
+
+        Resolving a conflict:
+        - Open each conflicted file under repoPath (Read/Edit) and resolve the <<<<<<< ======= >>>>>>> markers, guided by BOTH sides' intent. Then call continue_merge(taskId). If markers remain it tells you — fix and call again. Use abort_merge(taskId) to cancel a merge you cannot safely resolve.
+        - For a task WITH children (a unit merge), pass the PARENT task id to continue_merge / abort_merge.
+        - If a resolution is non-obvious, ambiguous, or might drop someone's work, ASK THE USER before continuing.
+        - Prefer the MCP tools whenever they apply. Only if the MCP tools cannot reach an in-progress merge may you finish it by hand: resolve the markers, then `git add -- <the resolved paths>` and `git commit` — NEVER `git add -A` or a bare commit, because the checkout is shared with other sessions.
+
+        Rules:
+        - Never use raw `git merge`, `git reset`, or `git checkout` to force a merge. Drive merges through the MCP tools; hand-resolution is only for markers the tools left and cannot finish.
+        - Ask the user for anything ambiguous, risky, or destructive.
+
+        When every task is handled, print a SUMMARY:
+        - one line per task: title — final status — merge commit (if any) — conflicts resolved (if any)
+        - anything you skipped or left for the user, and why
+        - suggested follow-ups, if any.
+        """;
+
+    private const string MergeHelperInitialDefault = """
+        # Merge Helper brief
+
+        Scope: {scope}
+
+        Handle the following tasks, in order. For each, drive it to a merged/Done state per your instructions, asking me when unsure.
+
+        {tasks}
+
+        When every task is handled, print the summary.
+        """;
+
     private const string WeeklyReportDefault = """
         You are generating a concise weekly standup report for a software developer,
         covering {start} to {end}.

src/ClaudeDo.Installer/Steps/DownloadAndExtractStep.cs

@@ -1,5 +1,6 @@
 using System.IO;
 using System.IO.Compression;
+using System.Threading;
 using ClaudeDo.Installer.Core;
 using ClaudeDo.Releases;
 
@@ -77,10 +78,23 @@ public sealed class DownloadAndExtractStep : IInstallStep
             var appBak = appDest + ".bak";
             var workerBak = workerDest + ".bak";
 
-            if (Directory.Exists(appBak))    Directory.Delete(appBak, recursive: true);
-            if (Directory.Exists(workerBak)) Directory.Delete(workerBak, recursive: true);
-            if (Directory.Exists(appDest))   Directory.Move(appDest, appBak);
-            if (Directory.Exists(workerDest)) Directory.Move(workerDest, workerBak);
+            try
+            {
+                if (Directory.Exists(appBak))    DeleteWithRetry(appBak);
+                if (Directory.Exists(workerBak)) DeleteWithRetry(workerBak);
+                if (Directory.Exists(appDest))   MoveWithRetry(appDest, appBak);
+                if (Directory.Exists(workerDest)) MoveWithRetry(workerDest, workerBak);
+            }
+            catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+            {
+                // A just-stopped app/worker (or an Explorer/terminal window sitting in
+                // the install dir) still held a handle. Surface an actionable message
+                // instead of the raw "process cannot access the file" error.
+                return StepResult.Fail(
+                    "Could not replace the existing app/worker files — they are still in use. " +
+                    "Make sure ClaudeDo is fully closed (app and worker) and no Explorer or " +
+                    $"terminal window is open inside the install folder, then run the update again. Details: {ex.Message}");
+            }
 
             progress.Report("Extracting...");
             Directory.CreateDirectory(ctx.InstallDirectory);
@@ -91,17 +105,17 @@ public sealed class DownloadAndExtractStep : IInstallStep
             catch (Exception ex)
             {
                 // Roll back to previous binaries.
-                if (Directory.Exists(appDest))   Directory.Delete(appDest, recursive: true);
-                if (Directory.Exists(workerDest)) Directory.Delete(workerDest, recursive: true);
-                if (Directory.Exists(appBak))    Directory.Move(appBak, appDest);
-                if (Directory.Exists(workerBak)) Directory.Move(workerBak, workerDest);
+                if (Directory.Exists(appDest))   DeleteWithRetry(appDest);
+                if (Directory.Exists(workerDest)) DeleteWithRetry(workerDest);
+                if (Directory.Exists(appBak))    MoveWithRetry(appBak, appDest);
+                if (Directory.Exists(workerBak)) MoveWithRetry(workerBak, workerDest);
                 return StepResult.Fail(
                     $"Extraction failed; previous binaries have been restored: {ex.Message}.");
             }
 
             // Success — drop stash.
-            if (Directory.Exists(appBak))    Directory.Delete(appBak, recursive: true);
-            if (Directory.Exists(workerBak)) Directory.Delete(workerBak, recursive: true);
+            if (Directory.Exists(appBak))    DeleteWithRetry(appBak);
+            if (Directory.Exists(workerBak)) DeleteWithRetry(workerBak);
 
             ctx.InstalledVersion = release.TagName.TrimStart('v', 'V');
             return StepResult.Ok();
@@ -111,4 +125,26 @@ public sealed class DownloadAndExtractStep : IInstallStep
             try { Directory.Delete(scratchDir, recursive: true); } catch { /* best effort */ }
         }
     }
+
+    private static void MoveWithRetry(string source, string dest)
+        => RetryIo(() => Directory.Move(source, dest));
+
+    private static void DeleteWithRetry(string dir)
+        => RetryIo(() => Directory.Delete(dir, recursive: true));
+
+    // WaitForExit returns before Windows releases a just-killed process's file
+    // handles, so the stash Move/Delete can briefly hit a sharing violation.
+    // Retry through transient IO/access errors (~5s) before letting it surface.
+    private static void RetryIo(Action action)
+    {
+        const int attempts = 10;
+        for (var i = 0; ; i++)
+        {
+            try { action(); return; }
+            catch (Exception ex) when (ex is IOException or UnauthorizedAccessException && i < attempts - 1)
+            {
+                Thread.Sleep(500);
+            }
+        }
+    }
 }

src/ClaudeDo.Installer/Steps/StopWorkerStep.cs

@@ -19,22 +19,33 @@ public sealed class StopWorkerStep : IInstallStep
     {
         progress.Report("Stopping ClaudeDo processes (if running)...");
         var installDir = ctx.InstallDirectory;
+        var killedAny = false;
         foreach (var name in ProcessNames)
         {
             foreach (var p in Process.GetProcessesByName(name))
             {
                 try
                 {
-                    var path = p.MainModule?.FileName;
+                    // Scope to THIS install when the module path is readable; if it
+                    // can't be read (access race / exiting process), fall through and
+                    // kill anyway — a survivor would lock the install dir during
+                    // extraction. Reading MainModule must not skip the Kill.
+                    string? path = null;
+                    try { path = p.MainModule?.FileName; } catch { /* unreadable — kill anyway */ }
                     if (path is not null && !IsUnder(path, installDir)) continue;
                     p.Kill(entireProcessTree: true);
                     p.WaitForExit(10000);
+                    killedAny = true;
                 }
                 catch { /* process may have exited or be inaccessible */ }
                 finally { p.Dispose(); }
             }
         }
-        await Task.CompletedTask;
+
+        // WaitForExit returns before the OS releases the process's file handles.
+        // Give it a moment so DownloadAndExtractStep's Directory.Move doesn't race
+        // a still-open handle. (That step also retries, this just avoids the churn.)
+        if (killedAny) await Task.Delay(1500, ct);
         return StepResult.Ok();
     }
 

src/ClaudeDo.Localization/locales/de.json

@@ -108,7 +108,8 @@
       "installButton": "Installieren",
       "installedSection": "INSTALLIERT",
       "updateButton": "Aktualisieren",
-      "removeButton": "Entfernen"
+      "removeButton": "Entfernen",
+      "emptyState": "Keine Skills installiert — oben eine GitHub-URL einfügen, um einen hinzuzufügen."
     }
   },
   "tasks": {
@@ -172,8 +173,10 @@
     "contextWorktrees": "Worktrees…",
     "contextOpenExplorer": "Im Explorer öffnen",
     "contextOpenTerminal": "Im Terminal öffnen",
+    "contextLetClaude": "Claude machen lassen",
     "newList": "Neue Liste",
-    "addReposTip": "Repos als Listen hinzufügen"
+    "addReposTip": "Repos als Listen hinzufügen",
+    "letClaudeAllTip": "Claude machen lassen (alle Listen)"
   },
   "details": {
     "pickUpInTerminalTip": "Diese Sitzung im Terminal fortsetzen",
@@ -188,7 +191,7 @@
     "mergeTargetLabel": "Merge-Ziel",
     "reviewCombinedDiff": "Kombiniertes Diff prüfen",
     "mergeAllSubtasks": "Alle Teilaufgaben mergen",
-    "childOutcomesLabel": "VERBESSERUNGEN",
+    "childOutcomesLabel": "TEILAUFGABEN",
     "stepsLabel": "SCHRITTE",
     "addStepPlaceholder": "Schritt hinzufügen...",
     "detailsLabel": "DETAILS",
@@ -209,6 +212,7 @@
       "addedSummary": "✓ Hinzugefügt: {0} ({1} Datei(en))",
       "overLimitError": "Konnte {0} nicht hinzufügen: {1}",
       "invalidNameError": "Konnte {0} nicht hinzufügen: {1}",
+      "dropReadError": "Abgelegte Dateien konnten nicht gelesen werden: {0}",
       "selectIdleTask": "Zuerst eine inaktive Aufgabe auswählen"
     },
     "sections": {
@@ -264,6 +268,11 @@
     "overviewMode": "Übersicht",
     "closeSession": "Sitzung schließen",
     "conptyLaunchFailed": "ConPTY-Sitzung konnte nicht geöffnet werden: {0}",
+    "mergeHelperTitle": "Merge-Helfer",
+    "submitForReviewFailed": "Einreichen zum Review fehlgeschlagen: {0}",
+    "submitForReview": "Zum Review einreichen",
+    "submitForReviewTip": "Diesen Worktree committen und den Task ins Review bringen, damit er gemergt werden kann",
+    "planningTitleSuffix": " (Planung)",
     "question": {
       "title": "Claude fragt nach",
       "placeholder": "Antwort eingeben…",
@@ -359,6 +368,20 @@
       "forgetFolders": "Ordner vergessen",
       "alreadyAdded": "(bereits hinzugefügt)"
     },
+    "mergeHelper": {
+      "title": "CLAUDE MACHEN LASSEN",
+      "windowTitle": "Claude machen lassen",
+      "scopeAll": "Alle Listen",
+      "scopeList": "Liste: {0}",
+      "confirm": "Claude machen lassen",
+      "cancel": "Abbrechen",
+      "selectAll": "Alle auswählen",
+      "selectNone": "Keine auswählen",
+      "empty": "Keine Aufgaben zu übergeben — alles erledigt oder abgebrochen.",
+      "columnTask": "AUFGABE",
+      "columnStatus": "STATUS",
+      "columnList": "LISTE"
+    },
     "unfinishedPlanning": {
       "title": "UNVOLLENDETE PLANUNGSSITZUNG",
       "windowTitle": "Unvollendete Planungssitzung",
@@ -500,11 +523,11 @@
   "vm": {
     "connection": { "online": "Online", "connecting": "Verbinden…", "offline": "Offline" },
     "shell": { "restartingWorker": "Worker wird neu gestartet…" },
-    "agentStatus": { "idle": "Leerlauf", "queued": "In Warteschlange", "running": "Läuft", "review": "Prüfung", "children": "Wartet auf Verbesserungen", "done": "Fertig", "failed": "Fehlgeschlagen", "cancelled": "Abgebrochen" },
-    "taskStatus": { "idle": "Leerlauf", "queued": "In Warteschlange", "running": "Läuft", "waitingForReview": "Wartet auf Prüfung", "waitingForChildren": "Wartet auf Verbesserungen", "done": "Fertig", "failed": "Fehlgeschlagen", "cancelled": "Abgebrochen", "parked": "Geparkt" },
+    "agentStatus": { "idle": "Leerlauf", "queued": "In Warteschlange", "running": "Läuft", "review": "Prüfung", "children": "Wartet auf Teilaufgaben", "done": "Fertig", "failed": "Fehlgeschlagen", "cancelled": "Abgebrochen" },
+    "taskStatus": { "idle": "Leerlauf", "queued": "In Warteschlange", "running": "Läuft", "waitingForReview": "Wartet auf Prüfung", "waitingForChildren": "Wartet auf Teilaufgaben", "done": "Fertig", "failed": "Fehlgeschlagen", "cancelled": "Abgebrochen", "parked": "Geparkt" },
     "planningBadge": { "active": "PLANUNG", "finalized": "GEPLANT" },
     "taskRow": { "createdPrefix": "Erstellt {0}", "stepsText": "{0}/{1} Schritte" },
-    "tasksIsland": { "completedHeader": "ABGESCHLOSSEN", "completedHeaderCount": "ABGESCHLOSSEN · {0}", "planningOpenFailed": "Planungssitzung konnte nicht geöffnet werden: {0}", "pickUpInTerminalFailed": "Im Terminal fortsetzen fehlgeschlagen: {0}", "approveFailed": "Genehmigen & Mergen fehlgeschlagen: {0}" },
+    "tasksIsland": { "completedHeader": "ABGESCHLOSSEN", "completedHeaderCount": "ABGESCHLOSSEN · {0}", "planningOpenFailed": "Planungssitzung konnte nicht geöffnet werden: {0}", "planningResumeFailed": "Planungssitzung konnte nicht fortgesetzt werden: {0}", "pickUpInTerminalFailed": "Im Terminal fortsetzen fehlgeschlagen: {0}", "approveFailed": "Genehmigen & Mergen fehlgeschlagen: {0}" },
     "diff": { "loadFailed": "Diff konnte nicht geladen werden: {0}", "noChanges": "Keine Änderungen anzuzeigen.", "unavailable": "Diff nicht mehr verfügbar — Commit-Bereich unvollständig." },
     "planningDiff": { "hubError": "Kombinierte Vorschau konnte nicht erstellt werden (Hub-Fehler).", "conflict": "Kombinierte Vorschau nicht möglich: Teilaufgabe {0} steht im Konflikt mit einer früheren Teilaufgabe ({1} Dateien)." },
     "merge": { "commitMessage": "Merge-Aufgabe: {0}", "workerOfflineBranches": "Worker offline — Branches können nicht aufgelistet werden.", "loadBranchesFailed": "Branches konnten nicht geladen werden: {0}", "merged": "Zusammengeführt.", "conflict": "Merge-Konflikt — Ziel-Branch wiederhergestellt. Manuell oder über Fortsetzen lösen, dann erneut versuchen.", "blocked": "Blockiert: {0}", "unknownStatus": "Unbekannter Status: {0}", "mergeFailed": "Merge fehlgeschlagen: {0}" },

src/ClaudeDo.Localization/locales/en.json

@@ -108,7 +108,8 @@
       "installButton": "Install",
       "installedSection": "INSTALLED",
       "updateButton": "Update",
-      "removeButton": "Remove"
+      "removeButton": "Remove",
+      "emptyState": "No skills installed — paste a GitHub URL above to add one."
     }
   },
   "tasks": {
@@ -172,8 +173,10 @@
     "contextWorktrees": "Worktrees…",
     "contextOpenExplorer": "Open in Explorer",
     "contextOpenTerminal": "Open in Terminal",
+    "contextLetClaude": "Let Claude handle it",
     "newList": "New list",
-    "addReposTip": "Add repos as lists"
+    "addReposTip": "Add repos as lists",
+    "letClaudeAllTip": "Let Claude handle it (all lists)"
   },
   "details": {
     "pickUpInTerminalTip": "Pick up this session in a terminal",
@@ -188,7 +191,7 @@
     "mergeTargetLabel": "Merge target",
     "reviewCombinedDiff": "Review combined diff",
     "mergeAllSubtasks": "Merge all subtasks",
-    "childOutcomesLabel": "IMPROVEMENTS",
+    "childOutcomesLabel": "SUBTASKS",
     "stepsLabel": "STEPS",
     "addStepPlaceholder": "Add a step...",
     "detailsLabel": "DETAILS",
@@ -209,6 +212,7 @@
       "addedSummary": "✓ Added {0} ({1} file(s))",
       "overLimitError": "Could not add {0}: {1}",
       "invalidNameError": "Could not add {0}: {1}",
+      "dropReadError": "Couldn't read the dropped files: {0}",
       "selectIdleTask": "Select an idle task first"
     },
     "sections": {
@@ -264,6 +268,11 @@
     "overviewMode": "Overview",
     "closeSession": "Close session",
     "conptyLaunchFailed": "Couldn't open ConPTY session: {0}",
+    "mergeHelperTitle": "Merge Helper",
+    "submitForReviewFailed": "Couldn't submit for review: {0}",
+    "submitForReview": "Submit for review",
+    "submitForReviewTip": "Commit this worktree and move the task to review so it can be merged",
+    "planningTitleSuffix": " (Planning)",
     "question": {
       "title": "Claude is asking",
       "placeholder": "Type your answer…",
@@ -359,6 +368,20 @@
       "forgetFolders": "Forget folders",
       "alreadyAdded": "(already added)"
     },
+    "mergeHelper": {
+      "title": "LET CLAUDE HANDLE IT",
+      "windowTitle": "Let Claude handle it",
+      "scopeAll": "All lists",
+      "scopeList": "List: {0}",
+      "confirm": "Let Claude handle it",
+      "cancel": "Cancel",
+      "selectAll": "Select all",
+      "selectNone": "Select none",
+      "empty": "No tasks to hand over — everything is done or cancelled.",
+      "columnTask": "TASK",
+      "columnStatus": "STATUS",
+      "columnList": "LIST"
+    },
     "unfinishedPlanning": {
       "title": "UNFINISHED PLANNING SESSION",
       "windowTitle": "Unfinished planning session",
@@ -500,11 +523,11 @@
   "vm": {
     "connection": { "online": "Online", "connecting": "Connecting…", "offline": "Offline" },
     "shell": { "restartingWorker": "Restarting worker…" },
-    "agentStatus": { "idle": "Idle", "queued": "Queued", "running": "Running", "review": "Review", "children": "Waiting for Improvements", "done": "Done", "failed": "Failed", "cancelled": "Cancelled" },
-    "taskStatus": { "idle": "Idle", "queued": "Queued", "running": "Running", "waitingForReview": "Waiting for Review", "waitingForChildren": "Waiting for Improvements", "done": "Done", "failed": "Failed", "cancelled": "Cancelled", "parked": "Parked" },
+    "agentStatus": { "idle": "Idle", "queued": "Queued", "running": "Running", "review": "Review", "children": "Waiting for Subtasks", "done": "Done", "failed": "Failed", "cancelled": "Cancelled" },
+    "taskStatus": { "idle": "Idle", "queued": "Queued", "running": "Running", "waitingForReview": "Waiting for Review", "waitingForChildren": "Waiting for Subtasks", "done": "Done", "failed": "Failed", "cancelled": "Cancelled", "parked": "Parked" },
     "planningBadge": { "active": "PLANNING", "finalized": "PLANNED" },
     "taskRow": { "createdPrefix": "Created {0}", "stepsText": "{0}/{1} steps" },
-    "tasksIsland": { "completedHeader": "COMPLETED", "completedHeaderCount": "COMPLETED · {0}", "planningOpenFailed": "Couldn't open planning session: {0}", "pickUpInTerminalFailed": "Pick up in terminal failed: {0}", "approveFailed": "Approve & merge failed: {0}" },
+    "tasksIsland": { "completedHeader": "COMPLETED", "completedHeaderCount": "COMPLETED · {0}", "planningOpenFailed": "Couldn't open planning session: {0}", "planningResumeFailed": "Couldn't resume planning session: {0}", "pickUpInTerminalFailed": "Pick up in terminal failed: {0}", "approveFailed": "Approve & merge failed: {0}" },
     "diff": { "loadFailed": "Failed to load diff: {0}", "noChanges": "No changes to show.", "unavailable": "Diff no longer available — commit range incomplete." },
     "planningDiff": { "hubError": "Could not build combined preview (hub error).", "conflict": "Cannot build combined preview: subtask {0} conflicts with an earlier subtask ({1} files)." },
     "merge": { "commitMessage": "Merge task: {0}", "workerOfflineBranches": "Worker offline — cannot list branches.", "loadBranchesFailed": "Failed to load branches: {0}", "merged": "Merged.", "conflict": "Merge conflict — target branch restored. Resolve manually or via Continue, then retry.", "blocked": "Blocked: {0}", "unknownStatus": "Unknown status: {0}", "mergeFailed": "Merge failed: {0}" },

src/ClaudeDo.Ui/CLAUDE.md

@@ -36,7 +36,7 @@ Design/     — Tokens.axaml (design tokens; merged before styles) + IslandStyle
 - **IslandsShellViewModel** — root coordinator; owns the three island VMs and the `WorkerClient`, wires cross-island events (selection, notes/prep mode, conflict resolution), owns connection state, the update banner, the inline worker-log strip (clickable → Log Visualizer overlay via `OpenLogVisualizerCommand`; `FlashFooterError` surfaces UI-action failures + the worker's Serilog Warn/Error there), responsive-layout flags (`ShowLists`/`ShowDetails` by window width), `PrimeStatus` flash, and the modal openers (About, RepoImport, WeeklyReport, WorktreesOverview, WorkerConnection help, LogVisualizer) plus `RestartWorkerAsync`/`CheckForUpdatesAsync`. Hosts `UpdateCheckService`.
 - **ListsIslandViewModel** — smart lists (My Day, Important, Planned, virtual queued/running/review), user lists, selection, list CRUD, drag-reorder, badge counts, opens list settings / repo import / worktrees overview, `OpenInExplorer`/`OpenInTerminal`.
 - **TasksIslandViewModel** — open/overdue/completed groups for the selected list with hierarchy-aware regrouping; task CRUD, drag-reorder, toggle done/star, schedule, enqueue/dequeue, cancel; review actions (approve, reject-rerun, reject-park, cancel); planning session lifecycle (open/resume/discard/finalize, `QueuePlanningSubtasksAsync`); `RefineTask`, `OpenConPtySessionRequested` (embedded ConPTY terminal), `PickUpInTerminalAsync`; MyDay extras (`IsMyDayList`, `ClearDayCommand`, `ShowPrepLogCommand`) and the pinned Notes pseudo-row (`ShowNotesRow`, `OpenNotesCommand`). Raises `NotesRequested`/`PrepRequested` events consumed by the shell.
-- **DetailsIslandViewModel** — the detail pane for a bound `TaskRowViewModel`. Owns live-log streaming (`Log` via `StreamLineFormatter`), debounced title/description editing, subtasks, session-outcome/roadblock split (splits `Result` at the roadblock marker into two cards), the three-tab work console (`output`/`git`/`session`), child surfacing (`ChildOutcomes` rows plus `ChildrenNeedingAttention`/`HasChildrenNeedingAttention` — children that failed, were cancelled, await review, or reported roadblocks — drive an attention band on the Session tab, which is only visible when `HasChildOutcomes`), and the modes: `IsNotesMode` (hosts `NotesEditorViewModel`), `IsPrepMode`, computed `IsTaskDetailVisible = !IsNotesMode && !IsPrepMode`. Three concerns are extracted into section VMs exposed as properties: **AgentConfigEditorViewModel** (scope=Task; per-task Model/MaxTurns/AgentPath overrides with `InheritedBadge` + `InheritanceResolver`, additive SystemPrompt, debounced auto-save; exposed as `AgentSettings`), **MergeSectionViewModel** (merge-target selection, mergeability indicator via `MergePreviewPresenter` over `PreviewMergeAsync`, `OpenDiffAsync` and `ReviewCombinedDiffCommand` — both build a `DiffViewerViewModel` and call `ShowDiffViewer`), **PrepPanelViewModel** (daily-prep panel: `PrepLog`, `PlanDayCommand` → `RunDailyPrepNowAsync`, persisted last run via `GetLastPrepLogAsync`). Attachments: `Attachments` (`ObservableCollection<AttachmentRowViewModel>`), `IsDragOver`, `DropStatus`, `CanAcceptDrop`, `AddFilesAsync`, `RemoveAttachmentCommand`; loads on task change; `ComposedPreview` includes attachment paths. Writes directly via `new AttachmentStore()` + `new TaskAttachmentRepository(ctx)`. Helper rows (`ChildOutcomeRowViewModel`, `SubtaskRowViewModel`, `LogLineViewModel`, `AttachmentRowViewModel`) live in the same file.
+- **DetailsIslandViewModel** — the detail pane for a bound `TaskRowViewModel`. Owns live-log streaming (`Log` via `StreamLineFormatter`), debounced title/description editing, subtasks, session-outcome/roadblock split (splits `Result` at the roadblock marker into two cards), the three-tab work console (`output`/`git`/`session`), child surfacing (`ChildOutcomes` rows plus `ChildrenNeedingAttention`/`HasChildrenNeedingAttention` — children that failed, were cancelled, await review, or reported roadblocks — drive an attention band on the Session tab, which is only visible when `HasChildOutcomes`), and the modes: `IsNotesMode` (hosts `NotesEditorViewModel`), `IsPrepMode`, computed `IsTaskDetailVisible = !IsNotesMode && !IsPrepMode`. Three concerns are extracted into section VMs exposed as properties: **AgentConfigEditorViewModel** (scope=Task; per-task Model/MaxTurns/AgentPath overrides with `InheritedBadge` + `InheritanceResolver`, additive SystemPrompt, debounced auto-save; exposed as `AgentSettings`), **MergeSectionViewModel** (merge-target selection, mergeability indicator via `MergePreviewPresenter` over `PreviewMergeAsync`, `OpenDiffAsync` and `ReviewCombinedDiffCommand` — both build a `DiffViewerViewModel`, call `ShowDiffViewer`, and fire the `DiffViewed` callback; `HasReviewableDiff` reports whether anything is inspectable, feeding the review gate), **PrepPanelViewModel** (daily-prep panel: `PrepLog`, `PlanDayCommand` → `RunDailyPrepNowAsync`, persisted last run via `GetLastPrepLogAsync`). Attachments: `Attachments` (`ObservableCollection<AttachmentRowViewModel>`), `IsDragOver`, `DropStatus`, `CanAcceptDrop`, `AddFilesAsync`, `RemoveAttachmentCommand`; loads on task change; `ComposedPreview` includes attachment paths. Writes directly via `new AttachmentStore()` + `new TaskAttachmentRepository(ctx)`. Helper rows (`ChildOutcomeRowViewModel`, `SubtaskRowViewModel`, `LogLineViewModel`, `AttachmentRowViewModel`) live in the same file.
 - **TaskRowViewModel** / **ListNavItemViewModel** — lightweight display VMs (task row: status, planning phase, parent/blocked links, roadblock count, computed `IsDraft`/`IsPlanned`/`IsChild`/`IsPlanningParent`/`CanRefine`; list row: kind Smart/Virtual/User, count, icon/dot keys, drop hints).
 - **NotesEditorViewModel** — day navigator + bullet CRUD for daily notes via `INotesApi`.
 - **Modal VMs** — `SettingsModalViewModel` (four tabs: General, Worktrees, Files prompt-paths, Prime Claude incl. `DailyPrepMaxTasks` + prime-schedule rows), `ListSettingsModalViewModel` (name, working dir, commit type, delete list; hosts shared `AgentConfigEditorViewModel` as `Agent` property (scope=List) — save delegates to `Agent.SaveAsync()`), `RepoImportModalViewModel` (bulk-create lists from git repos found under chosen parents; already-wired repos disabled), `WeeklyReportModalViewModel` (range pickers default "since last standup weekday → today", cached per range, markdown via MarkdownView), `MergeModalViewModel` (single-task merge form, called from the diff modal), `WorktreesOverviewModalViewModel` (global/per-list worktree rows, batch merge + state ops), `UnfinishedPlanningModalViewModel` (Resume/FinalizeNow/Discard for a draft planning session), `WorkerConnectionModalViewModel` (offline help), `AboutModalViewModel`, `LogVisualizerViewModel` (worker logs, last 30 min, all levels + a warn/error-only filter; loads via `GetRecentLogsAsync`).

src/ClaudeDo.Ui/Design/IslandStyles.axaml

@@ -57,8 +57,8 @@
     <!-- Icon.Search -->
     <StreamGeometry x:Key="Icon.Search">M11 4a7 7 0 1 0 0 14A7 7 0 0 0 11 4z M20 20l-3.5-3.5</StreamGeometry>
 
-    <!-- Icon.Plus -->
-    <StreamGeometry x:Key="Icon.Plus">M12 5v14M5 12h14</StreamGeometry>
+    <!-- Icon.Plus — filled cross (PathIcon fills, so a stroke-only plus renders invisible) -->
+    <StreamGeometry x:Key="Icon.Plus">M10.6 5 H13.4 V10.6 H19 V13.4 H13.4 V19 H10.6 V13.4 H5 V10.6 H10.6 Z</StreamGeometry>
 
     <!-- Icon.MoreHorizontal (three filled dots) — uses fill so rendered via PathIcon with fill brush -->
     <StreamGeometry x:Key="Icon.MoreHorizontal">M5 12m-1.3 0a1.3 1.3 0 1 0 2.6 0 1.3 1.3 0 1 0-2.6 0 M12 12m-1.3 0a1.3 1.3 0 1 0 2.6 0 1.3 1.3 0 1 0-2.6 0 M19 12m-1.3 0a1.3 1.3 0 1 0 2.6 0 1.3 1.3 0 1 0-2.6 0</StreamGeometry>
@@ -1162,6 +1162,13 @@
     <Setter Property="BorderBrush" Value="{StaticResource AccentBrush}" />
     <Setter Property="TextElement.Foreground" Value="{StaticResource TextBrush}" />
   </Style>
+  <!-- Disabled: drop the accent so a gated action (e.g. Approve before the diff is
+       opened) reads clearly as unavailable instead of looking clickable. -->
+  <Style Selector="Button.accent:disabled /template/ ContentPresenter">
+    <Setter Property="Background"  Value="{StaticResource Surface2Brush}" />
+    <Setter Property="BorderBrush" Value="{StaticResource LineBrush}" />
+    <Setter Property="TextElement.Foreground" Value="{StaticResource TextMuteBrush}" />
+  </Style>
 
   <!-- ============================================================ -->
   <!-- DAY TOGGLE                                                    -->

src/ClaudeDo.Ui/Services/IDialogService.cs

@@ -22,6 +22,9 @@ public interface IDialogService
     Task ShowListSettingsAsync(ListSettingsModalViewModel vm);
     Task ShowRepoImportAsync(RepoImportModalViewModel vm);
     Task ShowWorktreesOverviewAsync(WorktreesOverviewModalViewModel vm);
+
+    /// <summary>Merge-helper task picker. Returns the ordered selected task ids, or null on cancel.</summary>
+    Task<IReadOnlyList<string>?> ShowMergeHelperSelectionAsync(MergeHelperSelectionModalViewModel vm);
     Task ShowWorkerConnectionAsync(WorkerConnectionModalViewModel vm);
     Task ShowConflictResolverAsync(ConflictResolverViewModel vm);
     Task ShowLogVisualizerAsync(LogVisualizerViewModel vm);

src/ClaudeDo.Ui/Services/Interfaces/IWorkerClient.cs

@@ -76,12 +76,23 @@ public interface IWorkerClient : INotifyPropertyChanged
     Task StartPlanningSessionAsync(string taskId, CancellationToken ct = default);
     // Picks up a task's Claude session in a real terminal window (--resume).
     Task ResumeTaskInTerminalAsync(string taskId, CancellationToken ct = default);
+    /// <summary>Commits an interactively-worked task's worktree and moves it to WaitingForReview
+    /// (the only path that flips a hand-driven ConPTY session into the review/merge pipeline).</summary>
+    Task SubmitTaskForReviewAsync(string taskId, CancellationToken ct = default);
     /// <summary>Launch spec for an embedded ConPTY terminal to open an interactive session
     /// in a task's worktree (same worktree prep as an autonomous run).</summary>
     Task<LaunchSpec> GetInteractiveLaunchSpecAsync(string taskId, CancellationToken ct = default);
     /// <summary>Launch spec for an ad-hoc interactive session in an arbitrary directory --
     /// no task, no worktree.</summary>
     Task<LaunchSpec> GetAdHocLaunchSpecAsync(string directory, CancellationToken ct = default);
+    /// <summary>Launch spec for an embedded ConPTY "merge helper" session that drives the given
+    /// tasks to a merged/Done state. listId scopes the session to that list; null = all lists.</summary>
+    Task<LaunchSpec> GetMergeHelperLaunchSpecAsync(IReadOnlyList<string> taskIds, string? listId, CancellationToken ct = default);
+    /// <summary>Starts a planning session and returns the launch spec for an embedded ConPTY
+    /// planning terminal (replaces StartPlanningSessionAsync's external wt window).</summary>
+    Task<LaunchSpec> GetPlanningStartLaunchSpecAsync(string taskId, CancellationToken ct = default);
+    /// <summary>Resumes a planning session and returns its embedded-ConPTY launch spec.</summary>
+    Task<LaunchSpec> GetPlanningResumeLaunchSpecAsync(string taskId, CancellationToken ct = default);
     Task ResumePlanningSessionAsync(string taskId, CancellationToken ct = default);
     Task<DiscardPlanningOutcome> DiscardPlanningSessionAsync(string taskId, bool dequeueQueuedChildren = false, CancellationToken ct = default);
     Task FinalizePlanningSessionAsync(string taskId, bool queueAgentTasks = true, CancellationToken ct = default);

src/ClaudeDo.Ui/Services/WorkerClient.cs

@@ -513,12 +513,24 @@ public partial class WorkerClient : ObservableObject, IAsyncDisposable, IWorkerC
     public async Task ResumeTaskInTerminalAsync(string taskId, CancellationToken ct = default)
         => await _hub.InvokeAsync("ResumeTaskInTerminal", taskId, ct);
 
+    public async Task SubmitTaskForReviewAsync(string taskId, CancellationToken ct = default)
+        => await _hub.InvokeAsync("SubmitTaskForReview", taskId, ct);
+
     public async Task<LaunchSpec> GetInteractiveLaunchSpecAsync(string taskId, CancellationToken ct = default)
         => await _hub.InvokeAsync<LaunchSpec>("GetInteractiveLaunchSpec", taskId, ct);
 
     public async Task<LaunchSpec> GetAdHocLaunchSpecAsync(string directory, CancellationToken ct = default)
         => await _hub.InvokeAsync<LaunchSpec>("GetAdHocLaunchSpec", directory, ct);
 
+    public async Task<LaunchSpec> GetMergeHelperLaunchSpecAsync(IReadOnlyList<string> taskIds, string? listId, CancellationToken ct = default)
+        => await _hub.InvokeAsync<LaunchSpec>("GetMergeHelperLaunchSpec", taskIds, listId, ct);
+
+    public async Task<LaunchSpec> GetPlanningStartLaunchSpecAsync(string taskId, CancellationToken ct = default)
+        => await _hub.InvokeAsync<LaunchSpec>("GetPlanningStartLaunchSpec", taskId, ct);
+
+    public async Task<LaunchSpec> GetPlanningResumeLaunchSpecAsync(string taskId, CancellationToken ct = default)
+        => await _hub.InvokeAsync<LaunchSpec>("GetPlanningResumeLaunchSpec", taskId, ct);
+
     public async Task<DiscardPlanningOutcome> DiscardPlanningSessionAsync(string taskId, bool dequeueQueuedChildren = false, CancellationToken ct = default)
         => await _hub.InvokeAsync<DiscardPlanningOutcome>("DiscardPlanningSessionAsync", taskId, dequeueQueuedChildren, ct);
 

src/ClaudeDo.Ui/ViewModels/Conflicts/ConflictResolverViewModel.cs

@@ -103,9 +103,19 @@ public sealed partial class ConflictResolverViewModel : ObservableObject
         }
     }
 
-    public string ContinueHint => HasBinaryFiles
-        ? "Binary conflicts must be resolved externally — abort and resolve in your editor."
-        : "";
+    public string ContinueHint
+    {
+        get
+        {
+            if (HasBinaryFiles)
+                return "Binary conflicts must be resolved externally — abort and resolve in your editor.";
+            var openFiles = Files.Count(f => !f.AllResolved);
+            if (openFiles == 0) return "";
+            var openConflicts = _flat.Count(x => !x.Block.IsResolved);
+            return $"{openConflicts} {(openConflicts == 1 ? "conflict" : "conflicts")} in " +
+                   $"{openFiles} {(openFiles == 1 ? "file" : "files")} still unresolved.";
+        }
+    }
 
     private bool InRange => CurrentIndex >= 0 && CurrentIndex < _flat.Count;
 
@@ -188,6 +198,7 @@ public sealed partial class ConflictResolverViewModel : ObservableObject
         OnPropertyChanged(nameof(HasBinaryFiles));
         OnPropertyChanged(nameof(HasMultipleFiles));
         OnPropertyChanged(nameof(FilesSummary));
+        OnPropertyChanged(nameof(ContinueHint));
         RecomputeCanContinue();
         if (_flat.Count > 0)
             MoveTo(0); // also sets ActiveFile via MoveTo
@@ -211,6 +222,7 @@ public sealed partial class ConflictResolverViewModel : ObservableObject
             OnPropertyChanged(nameof(PositionText));
             OnPropertyChanged(nameof(ActiveResultText));
             OnPropertyChanged(nameof(FilesSummary));
+            OnPropertyChanged(nameof(ContinueHint));
         }
     }
 

src/ClaudeDo.Ui/ViewModels/Islands/DetailsIslandViewModel.cs

@@ -296,6 +296,15 @@ public sealed partial class DetailsIslandViewModel : ViewModelBase, IDisposable
 
         AgentSettings = new AgentConfigEditorViewModel(worker, AgentConfigScope.Task);
         Merge = new MergeSectionViewModel(worker, services);
+        Merge.DiffViewed = () => ReviewDiffViewed = true;
+        Merge.PropertyChanged += (_, e) =>
+        {
+            if (e.PropertyName == nameof(MergeSectionViewModel.HasReviewableDiff))
+            {
+                ApproveReviewCommand.NotifyCanExecuteChanged();
+                OnPropertyChanged(nameof(ShowReviewDiffHint));
+            }
+        };
         Prep = new PrepPanelViewModel(worker);
 
         Notes = new NotesEditorViewModel(_notesApi);
@@ -399,6 +408,13 @@ public sealed partial class DetailsIslandViewModel : ViewModelBase, IDisposable
                 DequeueCommand.NotifyCanExecuteChanged();
                 ResetAndRetryCommand.NotifyCanExecuteChanged();
                 ContinueCommand.NotifyCanExecuteChanged();
+                // A state change means a new run/review cycle: the diff must be
+                // re-inspected before merge can be approved again.
+                ReviewDiffViewed = false;
+                ApproveReviewCommand.NotifyCanExecuteChanged();
+                OnPropertyChanged(nameof(ShowReviewDiffHint));
+                OnPropertyChanged(nameof(CanSubmitForReview));
+                SubmitForReviewCommand.NotifyCanExecuteChanged();
                 AgentSettings.IsRunning = IsRunning;
                 NotifySessionSections();
                 OnPropertyChanged(nameof(CanAcceptDrop));
@@ -536,6 +552,10 @@ public sealed partial class DetailsIslandViewModel : ViewModelBase, IDisposable
             var latestRun = await runRepo.GetLatestByTaskIdAsync(row.Id, ct);
             ct.ThrowIfCancellationRequested();
             LatestRunSessionId = latestRun?.SessionId;
+            // Restore turn/token counts from the last run so a reloaded terminal task
+            // shows its real turns instead of "0/max".
+            Turns = latestRun?.TurnCount ?? 0;
+            Tokens = (latestRun?.TokensIn ?? 0) + (latestRun?.TokensOut ?? 0);
             Monitor.ApplyOutcome(entity.Result, latestRun?.ErrorMarkdown);
 
             Monitor.SetTaskId(row.Id);
@@ -740,6 +760,8 @@ public sealed partial class DetailsIslandViewModel : ViewModelBase, IDisposable
         Merge.SyncWorktree(WorktreePath, WorktreeBaseCommit, WorktreeHeadCommit,
             WorktreeStateLabel, _listWorkingDir);
         NotifySessionSections();
+        OnPropertyChanged(nameof(CanSubmitForReview));
+        SubmitForReviewCommand.NotifyCanExecuteChanged();
     }
 
     partial void OnWorktreeHeadCommitChanged(string? value) =>
@@ -748,6 +770,7 @@ public sealed partial class DetailsIslandViewModel : ViewModelBase, IDisposable
 
     partial void OnTaskChanged(TaskRowViewModel? value)
     {
+        ReviewDiffViewed = false;
         Merge.SyncTaskContext(Task?.Id, Task?.Title, Task?.IsPlanningParent == true);
         NotifySessionSections();
         OnPropertyChanged(nameof(CanAcceptDrop));
@@ -977,7 +1000,20 @@ public sealed partial class DetailsIslandViewModel : ViewModelBase, IDisposable
     private bool CanResetAndRetry() =>
         Task != null && _worker.IsConnected && ShowResetAndRetry;
 
-    [RelayCommand]
+    // Set once the user opens the diff/combined-diff for the current review. Reset on
+    // task switch and on every state change (a new run means a new diff to read), so
+    // Approve & Merge stays blocked until the pending changes have been inspected.
+    [ObservableProperty]
+    [NotifyCanExecuteChangedFor(nameof(ApproveReviewCommand))]
+    [NotifyPropertyChangedFor(nameof(ShowReviewDiffHint))]
+    private bool _reviewDiffViewed;
+
+    // True while a review is pending, there is a diff to inspect, and it has not been
+    // opened yet — drives the "open the diff first" hint next to Approve & Merge.
+    public bool ShowReviewDiffHint =>
+        IsWaitingForReview && Merge.HasReviewableDiff && !ReviewDiffViewed;
+
+    [RelayCommand(CanExecute = nameof(CanApproveReview))]
     private async System.Threading.Tasks.Task ApproveReviewAsync()
     {
         if (Task is null || !_worker.IsConnected) return;
@@ -995,6 +1031,30 @@ public sealed partial class DetailsIslandViewModel : ViewModelBase, IDisposable
         }
     }
 
+    // Force the diff to have been opened before a merge can happen — but only when
+    // there is actually something to inspect (a childless sandbox run with no worktree
+    // has no diff, so it approves straight through).
+    private bool CanApproveReview() =>
+        Task != null && _worker.IsConnected && IsWaitingForReview
+        && (!Merge.HasReviewableDiff || ReviewDiffViewed);
+
+    // An interactive (ConPTY) session leaves its worktree changed but never flips the task
+    // status. Offer "Submit for review" for an Idle/Failed task that still has a worktree, so
+    // its hand-driven work can enter the normal review/merge flow (commits first, server-side).
+    public bool CanSubmitForReview =>
+        Task != null && _worker.IsConnected && (IsIdle || IsFailed) && !string.IsNullOrEmpty(WorktreePath);
+
+    [RelayCommand(CanExecute = nameof(CanSubmitForReview))]
+    private async System.Threading.Tasks.Task SubmitForReviewAsync()
+    {
+        if (Task is null || !_worker.IsConnected) return;
+        try { await _worker.SubmitTaskForReviewAsync(Task.Id); }
+        catch (Exception ex)
+        {
+            if (ShowErrorAsync != null) await ShowErrorAsync(ex.Message);
+        }
+    }
+
     [RelayCommand(CanExecute = nameof(HasReviewFeedback))]
     private async System.Threading.Tasks.Task RejectReviewAsync()
     {
@@ -1099,7 +1159,8 @@ public sealed partial class DetailsIslandViewModel : ViewModelBase, IDisposable
             }
             catch (Exception ex)
             {
-                failures.Add($"{fileName}: {ex.Message}");
+                // Keep the exception type in the message so an intermittent failure is analyzable.
+                failures.Add($"{fileName}: {ex.GetType().Name}: {ex.Message}");
             }
         }
 

src/ClaudeDo.Ui/ViewModels/Islands/ListsIslandViewModel.cs

@@ -16,6 +16,9 @@ namespace ClaudeDo.Ui.ViewModels.Islands;
 
 public enum ListKind { Smart, Virtual, User }
 
+/// <summary>Confirmed merge-helper run: the scope list (null = all lists) and the ordered selected task ids.</summary>
+public sealed record MergeHelperRequest(string? ListId, IReadOnlyList<string> TaskIds);
+
 public sealed partial class ListsIslandViewModel : ViewModelBase, IDisposable
 {
     private readonly IDbContextFactory<ClaudeDoDbContext> _dbFactory;
@@ -80,6 +83,35 @@ public sealed partial class ListsIslandViewModel : ViewModelBase, IDisposable
         finally { _worktreesOverviewOpen = false; }
     }
 
+    /// <summary>Raised after the merge-helper selection dialog is confirmed; the shell opens the ConPTY tile.</summary>
+    public event Action<MergeHelperRequest>? LetClaudeHandleRequested;
+
+    [RelayCommand]
+    private async Task LetClaudeHandleListAsync(ListNavItemViewModel? row)
+    {
+        if (row is null || Dialogs is null || _services is null) return;
+        if (row.Kind != ListKind.User || string.IsNullOrWhiteSpace(row.WorkingDir)) return;
+        var rawId = row.Id.StartsWith("user:", StringComparison.Ordinal) ? row.Id["user:".Length..] : row.Id;
+        var vm = _services.GetRequiredService<MergeHelperSelectionModalViewModel>();
+        vm.Configure(rawId, row.Name);
+        await vm.LoadAsync();
+        var ids = await Dialogs.ShowMergeHelperSelectionAsync(vm);
+        if (ids is { Count: > 0 })
+            LetClaudeHandleRequested?.Invoke(new MergeHelperRequest(rawId, ids));
+    }
+
+    [RelayCommand]
+    private async Task LetClaudeHandleAllAsync()
+    {
+        if (Dialogs is null || _services is null) return;
+        var vm = _services.GetRequiredService<MergeHelperSelectionModalViewModel>();
+        vm.Configure(null, null);
+        await vm.LoadAsync();
+        var ids = await Dialogs.ShowMergeHelperSelectionAsync(vm);
+        if (ids is { Count: > 0 })
+            LetClaudeHandleRequested?.Invoke(new MergeHelperRequest(null, ids));
+    }
+
     [RelayCommand]
     private void OpenInExplorer(ListNavItemViewModel? row)
     {

src/ClaudeDo.Ui/ViewModels/Islands/MergeSectionViewModel.cs

@@ -48,6 +48,15 @@ public sealed partial class MergeSectionViewModel : ViewModelBase
     public Func<DiffViewerViewModel, System.Threading.Tasks.Task>? ShowDiffViewer { get; set; }
     public Func<MergeModalViewModel, System.Threading.Tasks.Task>? ShowMergeModal { get; set; }
 
+    // Raised when the user opens a diff/combined-diff for the current task, so the
+    // review gate can record that the changes were inspected before merging.
+    public Action? DiffViewed { get; set; }
+
+    // True when there is something to inspect before merging (a live worktree diff,
+    // a merged commit range, or a planning/children combined diff). When false there
+    // is nothing to read, so the review gate must not block approve.
+    public bool HasReviewableDiff => CanOpenDiff() || CanReviewDiff();
+
     public MergeSectionViewModel(IWorkerClient worker, IServiceProvider services)
     {
         _worker = worker;
@@ -69,6 +78,7 @@ public sealed partial class MergeSectionViewModel : ViewModelBase
         _worktreeStateLabel = worktreeState;
         _listWorkingDir = listWorkDir;
         OnPropertyChanged(nameof(ShowMergeSection));
+        OnPropertyChanged(nameof(HasReviewableDiff));
         OpenDiffCommand.NotifyCanExecuteChanged();
         OpenWorktreeCommand.NotifyCanExecuteChanged();
     }
@@ -79,6 +89,7 @@ public sealed partial class MergeSectionViewModel : ViewModelBase
         TaskTitle = taskTitle;
         _isPlanningParent = isPlanningParent;
         OnPropertyChanged(nameof(ShowMergeSection));
+        OnPropertyChanged(nameof(HasReviewableDiff));
     }
 
     internal void SyncChildOutcomes(bool hasChildOutcomes, int subtaskCount)
@@ -86,6 +97,7 @@ public sealed partial class MergeSectionViewModel : ViewModelBase
         _hasChildOutcomes = hasChildOutcomes;
         _subtaskCount = subtaskCount;
         OnPropertyChanged(nameof(ShowMergeSection));
+        OnPropertyChanged(nameof(HasReviewableDiff));
         ReviewCombinedDiffCommand.NotifyCanExecuteChanged();
     }
 
@@ -128,6 +140,7 @@ public sealed partial class MergeSectionViewModel : ViewModelBase
         var vm = _services.GetRequiredService<DiffViewerViewModel>();
         vm.ConfigurePlanning(TaskId, SelectedMergeTarget ?? "main");
         await vm.LoadAsync();
+        DiffViewed?.Invoke();
         await ShowDiffViewer(vm);
     }
 
@@ -157,6 +170,7 @@ public sealed partial class MergeSectionViewModel : ViewModelBase
         else return;
 
         await vm.LoadAsync();
+        DiffViewed?.Invoke();
         await ShowDiffViewer(vm);
     }
 

src/ClaudeDo.Ui/ViewModels/Islands/TaskMonitorViewModel.cs

@@ -1,5 +1,6 @@
 using System.Collections.ObjectModel;
 using System.Text;
+using System.Text.Json;
 using CommunityToolkit.Mvvm.ComponentModel;
 using CommunityToolkit.Mvvm.Input;
 using ClaudeDo.Data;
@@ -258,16 +259,38 @@ public sealed partial class TaskMonitorViewModel : ViewModelBase, IMissionContro
         var idx = result.IndexOf(RoadblockMarker, StringComparison.Ordinal);
         if (idx < 0)
         {
-            SessionOutcome = result;
+            SessionOutcome = UnwrapSummary(result);
             Roadblocks = null;
             return;
         }
 
         var summary = result[..idx].TrimEnd().TrimEnd('⚠').TrimEnd();
-        SessionOutcome = string.IsNullOrWhiteSpace(summary) ? null : summary;
+        SessionOutcome = string.IsNullOrWhiteSpace(summary) ? null : UnwrapSummary(summary);
         Roadblocks = result[(idx + RoadblockMarker.Length)..].Trim();
     }
 
+    /// <summary>Safety net for older rows persisted as raw structured-output JSON: if the outcome
+    /// is a JSON object with a string <c>summary</c>, show that; otherwise keep the text as-is.</summary>
+    private static string? UnwrapSummary(string? text)
+    {
+        if (string.IsNullOrWhiteSpace(text)) return text;
+        var trimmed = text.TrimStart();
+        if (trimmed.Length == 0 || trimmed[0] != '{') return text;
+        try
+        {
+            using var doc = JsonDocument.Parse(trimmed);
+            if (doc.RootElement.ValueKind == JsonValueKind.Object &&
+                doc.RootElement.TryGetProperty("summary", out var s) &&
+                s.ValueKind == JsonValueKind.String)
+            {
+                var summary = s.GetString();
+                if (!string.IsNullOrWhiteSpace(summary)) return summary;
+            }
+        }
+        catch { }
+        return text;
+    }
+
     public async System.Threading.Tasks.Task ReplayLogFileAsync(string? logPath, CancellationToken ct)
     {
         if (string.IsNullOrWhiteSpace(logPath)) return;

src/ClaudeDo.Ui/ViewModels/Islands/TaskRowViewModel.cs

@@ -128,6 +128,11 @@ public sealed partial class TaskRowViewModel : ViewModelBase
         _                           => Status.ToString(),
     };
 
+    // A planning parent that is still Idle (Active planning, or Finalized-but-not-yet-queued)
+    // already shows its state via the PLANNING/PLANNED badge next to the title. The lifecycle
+    // chip would read "Idle" (or "Parked"), which is misleading, so hide it in that case.
+    public bool ShowStatusChip => !(PlanningPhase != PlanningPhase.None && Status == TaskStatus.Idle);
+
     public string StatusChipClass => (Status, IsBlocked: !string.IsNullOrEmpty(BlockedByTaskId)) switch
     {
         (TaskStatus.Running,            _) => "running",
@@ -144,6 +149,7 @@ public sealed partial class TaskRowViewModel : ViewModelBase
     {
         OnPropertyChanged(nameof(StatusChipClass));
         OnPropertyChanged(nameof(StatusLabel));
+        OnPropertyChanged(nameof(ShowStatusChip));
         OnPropertyChanged(nameof(IsRunning));
         OnPropertyChanged(nameof(IsWaitingForReview));
         OnPropertyChanged(nameof(CanPickUpInTerminal));
@@ -189,6 +195,7 @@ public sealed partial class TaskRowViewModel : ViewModelBase
     {
         OnPropertyChanged(nameof(IsPlanningParent));
         OnPropertyChanged(nameof(PlanningBadge));
+        OnPropertyChanged(nameof(ShowStatusChip));
         OnPropertyChanged(nameof(IsPlanActive));
         OnPropertyChanged(nameof(IsPlanFinalized));
         OnPropertyChanged(nameof(CanOpenPlanningSession));

src/ClaudeDo.Ui/ViewModels/Islands/TasksIslandViewModel.cs

@@ -151,6 +151,18 @@ public sealed partial class TasksIslandViewModel : ViewModelBase, IDisposable
                 .Include(t => t.Worktree)
                 .FirstOrDefaultAsync(t => t.Id == taskId);
 
+            // A parent transition (finalize/discard) broadcasts only the parent's id, but it
+            // changes its children's derived state — finalize flips them Draft→Planned, discard
+            // deletes them. The delta path below only touches the parent row and never recomputes
+            // the child-derived flags (ParentFinalized, HasPlanningChildren) nor drops deleted
+            // children, so reconcile the whole list when the updated task is (or owns) a subtree.
+            if (entity is not null &&
+                (entity.PlanningPhase != PlanningPhase.None || Items.Any(r => r.ParentTaskId == entity.Id)))
+            {
+                LoadForList(list);
+                return;
+            }
+
             var existing = Items.FirstOrDefault(r => r.Id == taskId);
 
             if (entity is null)
@@ -801,19 +813,24 @@ public sealed partial class TasksIslandViewModel : ViewModelBase, IDisposable
     private void OpenListSettings() => OpenListSettingsRequested?.Invoke(this, EventArgs.Empty);
 
     [RelayCommand]
-    private async Task OpenPlanningSessionAsync(TaskRowViewModel? row)
+    private void OpenPlanningSession(TaskRowViewModel? row)
     {
         if (row is null) return;
         if (row.Status != TaskStatus.Idle || row.PlanningPhase != PlanningPhase.None) return;
-        ForegroundHelper.AllowAny();
-        try { await _worker!.StartPlanningSessionAsync(row.Id); }
-        catch (Exception ex) { ErrorReported?.Invoke(Loc.T("vm.tasksIsland.planningOpenFailed", ex.Message)); }
+        // Planning now runs as an embedded ConPTY pane in the Command Center (not an external wt
+        // window). The shell owns Mission Control, so raise an event; the actual StartAsync happens
+        // server-side inside GetPlanningStartLaunchSpec when the pane opens.
+        OpenPlanningConPtyRequested?.Invoke(row.Id, false);
     }
 
     // Opens the task in an embedded ConPTY terminal pane in the Command Center. The shell owns
     // the Mission Control view model, so this just raises an event for it to act on.
     public event Action<string>? OpenConPtySessionRequested;
 
+    // Opens (resume=false) or resumes (resume=true) a planning session as an embedded ConPTY
+    // pane in the Command Center.
+    public event Action<string, bool>? OpenPlanningConPtyRequested;
+
     [RelayCommand]
     private void OpenConPtySession(TaskRowViewModel? row)
     {
@@ -853,8 +870,9 @@ public sealed partial class TasksIslandViewModel : ViewModelBase, IDisposable
             switch (choice)
             {
                 case UnfinishedPlanningModalResult.Resume:
-                    ForegroundHelper.AllowAny();
-                    await _worker.ResumePlanningSessionAsync(row.Id);
+                    // Resume as an embedded ConPTY pane (server-side ResumeAsync runs inside
+                    // GetPlanningResumeLaunchSpec when the pane opens).
+                    OpenPlanningConPtyRequested?.Invoke(row.Id, true);
                     break;
                 case UnfinishedPlanningModalResult.FinalizeNow:
                     await _worker.FinalizePlanningSessionAsync(row.Id, queueAgentTasks: false);
@@ -867,7 +885,7 @@ public sealed partial class TasksIslandViewModel : ViewModelBase, IDisposable
                     break;
             }
         }
-        catch { }
+        catch (Exception ex) { ErrorReported?.Invoke(Loc.T("vm.tasksIsland.planningResumeFailed", ex.Message)); }
     }
 
     [RelayCommand]

src/ClaudeDo.Ui/ViewModels/IslandsShellViewModel.cs

@@ -97,7 +97,6 @@ public sealed partial class IslandsShellViewModel : ViewModelBase, IDisposable
 
     [ObservableProperty] private bool _isUpdateBannerVisible;
     [ObservableProperty] private string? _updateBannerLatestVersion;
-    [ObservableProperty] private string? _inlineUpdateStatus;
     private bool _bannerDismissedThisSession;
 
     [ObservableProperty]
@@ -234,6 +233,16 @@ public sealed partial class IslandsShellViewModel : ViewModelBase, IDisposable
             OpenMissionControl();
             _ = MissionControl.OpenConPtySessionAsync(taskId);
         };
+        Tasks.OpenPlanningConPtyRequested += (taskId, resume) =>
+        {
+            OpenMissionControl();
+            _ = MissionControl.OpenPlanningConPtySessionAsync(taskId, resume);
+        };
+        Lists.LetClaudeHandleRequested += req =>
+        {
+            OpenMissionControl();
+            _ = MissionControl.OpenMergeHelperConPtySessionAsync(req.ListId, req.TaskIds);
+        };
         Tasks.TasksChanged     += (_, _) => _ = Lists.RefreshCountsAsync();
         Tasks.OpenListSettingsRequested += (_, _) =>
         {
@@ -305,25 +314,15 @@ public sealed partial class IslandsShellViewModel : ViewModelBase, IDisposable
                 if (_bannerDismissedThisSession) { IsUpdateBannerVisible = false; break; }
                 UpdateBannerLatestVersion = _updateCheck.LatestVersion;
                 IsUpdateBannerVisible = true;
-                InlineUpdateStatus = null;
                 break;
             case UpdateCheckStatus.UpToDate:
                 IsUpdateBannerVisible = false;
-                ShowInlineStatus($"You're up to date (v{_updateCheck.CurrentVersion})");
                 break;
             case UpdateCheckStatus.CheckFailed:
-                ShowInlineStatus("Could not check for updates");
                 break;
         }
     }
 
-    private async void ShowInlineStatus(string text)
-    {
-        InlineUpdateStatus = text;
-        await Task.Delay(3000);
-        if (InlineUpdateStatus == text) InlineUpdateStatus = null;
-    }
-
     [RelayCommand]
     private void OpenMissionControl()
     {

src/ClaudeDo.Ui/ViewModels/MissionControl/ConPtyPaneViewModel.cs

@@ -17,6 +17,9 @@ public sealed partial class ConPtyPaneViewModel : ViewModelBase, IMissionControl
 {
     public string? TaskId { get; }
 
+    // Only a task-based pane can be submitted for review (an ad-hoc directory session has no task).
+    public bool IsTaskBased => TaskId is not null;
+
     [ObservableProperty] private string _displayTitle;
 
     public InteractiveTerminalViewModel Terminal { get; } = new();
@@ -27,6 +30,10 @@ public sealed partial class ConPtyPaneViewModel : ViewModelBase, IMissionControl
     /// <summary>Set by the host (Mission Control) to remove this pane from its collection.</summary>
     public Action<ConPtyPaneViewModel>? CloseRequested { get; set; }
 
+    /// <summary>Raised when the user submits this task's hand-driven work for review; the host
+    /// commits the worktree and moves the task to WaitingForReview.</summary>
+    public event Action<string>? SubmitForReviewRequested;
+
     /// <summary>Task-based pane — dedup'd by <see cref="TaskId"/>. Pass null for an ad-hoc pane
     /// (no task, never deduped); prefer <see cref="CreateAdHoc"/> at ad-hoc call sites.</summary>
     public ConPtyPaneViewModel(string? taskId, string displayTitle, TerminalLaunchDescriptor descriptor)
@@ -50,6 +57,14 @@ public sealed partial class ConPtyPaneViewModel : ViewModelBase, IMissionControl
     [RelayCommand]
     private void Close() => CloseRequested?.Invoke(this);
 
+    private bool CanSubmitForReview() => IsTaskBased;
+
+    [RelayCommand(CanExecute = nameof(CanSubmitForReview))]
+    private void SubmitForReview()
+    {
+        if (TaskId is { } id) SubmitForReviewRequested?.Invoke(id);
+    }
+
     public void Dispose()
     {
         Terminal.PropertyChanged -= OnTerminalPropertyChanged;

src/ClaudeDo.Ui/ViewModels/MissionControlViewModel.cs

@@ -248,6 +248,47 @@ public sealed partial class MissionControlViewModel : ViewModelBase, IDisposable
             var pane = new ConPtyPaneViewModel(taskId, title, descriptor);
             pane.ErrorReported += OnConPtyPaneError;
             pane.CloseRequested += CloseConPtySession;
+            pane.SubmitForReviewRequested += OnPaneSubmitForReview;
+            ConPtySessions.Add(pane);
+        }
+        catch (Exception ex)
+        {
+            ErrorReported?.Invoke(Loc.T("missionControl.conptyLaunchFailed", ex.Message));
+        }
+    }
+
+    // Starts (or resumes) a planning session and hosts it as an embedded ConPTY Command Center
+    // pane — the ConPTY replacement for the old external wt planning window. Deduped by TaskId
+    // like OpenConPtySessionAsync.
+    public async System.Threading.Tasks.Task OpenPlanningConPtySessionAsync(string taskId, bool resume)
+    {
+        if (string.IsNullOrEmpty(taskId)) return;
+        if (ConPtySessions.FirstOrDefault(s => s.TaskId == taskId) is { } existing)
+        {
+            FocusedPane = existing;
+            return;
+        }
+
+        var title = taskId;
+        try
+        {
+            await using var ctx = await _dbFactory.CreateDbContextAsync();
+            var entity = await ctx.Tasks.AsNoTracking().FirstOrDefaultAsync(t => t.Id == taskId);
+            if (entity?.Title is { Length: > 0 } t) title = t;
+        }
+        catch { /* best-effort title lookup */ }
+        title += Loc.T("missionControl.planningTitleSuffix");
+
+        try
+        {
+            var spec = resume
+                ? await _worker.GetPlanningResumeLaunchSpecAsync(taskId)
+                : await _worker.GetPlanningStartLaunchSpecAsync(taskId);
+            var descriptor = new TerminalLaunchDescriptor(spec.Cwd, spec.Exe, spec.Args, spec.Env);
+            var pane = new ConPtyPaneViewModel(taskId, title, descriptor);
+            pane.ErrorReported += OnConPtyPaneError;
+            pane.CloseRequested += CloseConPtySession;
+            pane.SubmitForReviewRequested += OnPaneSubmitForReview;
             ConPtySessions.Add(pane);
         }
         catch (Exception ex)
@@ -272,6 +313,41 @@ public sealed partial class MissionControlViewModel : ViewModelBase, IDisposable
             var pane = ConPtyPaneViewModel.CreateAdHoc(title, descriptor);
             pane.ErrorReported += OnConPtyPaneError;
             pane.CloseRequested += CloseConPtySession;
+            pane.SubmitForReviewRequested += OnPaneSubmitForReview;
+            ConPtySessions.Add(pane);
+        }
+        catch (Exception ex)
+        {
+            ErrorReported?.Invoke(Loc.T("missionControl.conptyLaunchFailed", ex.Message));
+        }
+    }
+
+    // Merge-helper session over a hand-picked set of tasks ("Let Claude handle it").
+    // Ad-hoc style: no owning task, never deduped — every run opens a fresh pane.
+    public async System.Threading.Tasks.Task OpenMergeHelperConPtySessionAsync(string? listId, IReadOnlyList<string> taskIds)
+    {
+        if (taskIds is not { Count: > 0 }) return;
+
+        var title = Loc.T("missionControl.mergeHelperTitle");
+        if (listId is not null)
+        {
+            try
+            {
+                await using var ctx = await _dbFactory.CreateDbContextAsync();
+                var list = await ctx.Lists.AsNoTracking().FirstOrDefaultAsync(l => l.Id == listId);
+                if (list?.Name is { Length: > 0 } name) title = $"{title} — {name}";
+            }
+            catch { /* best-effort title lookup */ }
+        }
+
+        try
+        {
+            var spec = await _worker.GetMergeHelperLaunchSpecAsync(taskIds, listId);
+            var descriptor = new TerminalLaunchDescriptor(spec.Cwd, spec.Exe, spec.Args, spec.Env);
+            var pane = ConPtyPaneViewModel.CreateAdHoc(title, descriptor);
+            pane.ErrorReported += OnConPtyPaneError;
+            pane.CloseRequested += CloseConPtySession;
+            pane.SubmitForReviewRequested += OnPaneSubmitForReview;
             ConPtySessions.Add(pane);
         }
         catch (Exception ex)
@@ -282,6 +358,22 @@ public sealed partial class MissionControlViewModel : ViewModelBase, IDisposable
 
     private void OnConPtyPaneError(string message) => ErrorReported?.Invoke(message);
 
+    // Submit a task's hand-driven ConPTY work for review, then close the pane (the interactive
+    // session is finished). The worker commits the worktree and moves the task to WaitingForReview.
+    private async void OnPaneSubmitForReview(string taskId)
+    {
+        try
+        {
+            await _worker.SubmitTaskForReviewAsync(taskId);
+            if (ConPtySessions.FirstOrDefault(s => s.TaskId == taskId) is { } pane)
+                CloseConPtySession(pane);
+        }
+        catch (Exception ex)
+        {
+            ErrorReported?.Invoke(Loc.T("missionControl.submitForReviewFailed", ex.Message));
+        }
+    }
+
     private void CloseConPtySession(ConPtyPaneViewModel pane)
     {
         if (!ConPtySessions.Contains(pane)) return;

src/ClaudeDo.Ui/ViewModels/Modals/DiffModels.cs

@@ -54,6 +54,14 @@ public sealed class DiffFileViewModel
 
     /// A text file that produced no diff hunks (e.g. a newly added empty file).
     public bool IsEmptyContent => !IsBinary && Lines.Count == 0;
+
+    /// A rename with no content change — showing "+0 −0" for it is misleading.
+    public bool IsPureRename => Status == DiffFileStatus.Renamed && Additions == 0 && Deletions == 0;
+
+    /// Header path label: for a rename, spell out old → new; otherwise just the path.
+    public string HeaderPath => Status == DiffFileStatus.Renamed && !string.IsNullOrEmpty(OldPath)
+        ? $"{OldPath} → {Path}"
+        : Path;
 }
 
 /// One row in the planning subtask list (left pane in Planning mode).
@@ -72,7 +80,7 @@ public sealed partial class DiffTreeNodeViewModel : ViewModelBase
     [ObservableProperty] private bool _isExpanded = true;
 
     public string? StatusCode => File?.StatusCode;
-    public bool ShowStats => File is { IsBinary: false };
+    public bool ShowStats => File is { IsBinary: false, IsPureRename: false };
     public int Additions => File?.Additions ?? 0;
     public int Deletions => File?.Deletions ?? 0;
 }

src/ClaudeDo.Ui/ViewModels/Modals/MergeHelperSelectionModalViewModel.cs

@@ -0,0 +1,124 @@
+using System.Collections.ObjectModel;
+using System.ComponentModel;
+using ClaudeDo.Data;
+using ClaudeDo.Ui.Localization;
+using CommunityToolkit.Mvvm.ComponentModel;
+using CommunityToolkit.Mvvm.Input;
+using Microsoft.EntityFrameworkCore;
+using TaskStatus = ClaudeDo.Data.Models.TaskStatus;
+
+namespace ClaudeDo.Ui.ViewModels.Modals;
+
+public sealed partial class MergeHelperTaskRowViewModel : ViewModelBase
+{
+    public required string Id { get; init; }
+    public required string Title { get; init; }
+    public required string StatusText { get; init; }
+    public required string ListName { get; init; }
+
+    [ObservableProperty] private bool _isSelected;
+}
+
+/// <summary>
+/// "Let Claude handle it" task picker: lists the non-terminal tasks of a list (or all lists),
+/// pre-ticks the actionable ones, and resolves <see cref="Result"/> with the ordered selected
+/// task ids (null on cancel).
+/// </summary>
+public sealed partial class MergeHelperSelectionModalViewModel : ViewModelBase
+{
+    private readonly IDbContextFactory<ClaudeDoDbContext> _dbFactory;
+    private string? _listId;
+
+    public ObservableCollection<MergeHelperTaskRowViewModel> Tasks { get; } = new();
+
+    [ObservableProperty] private string _scopeLabel = "";
+    [ObservableProperty] private bool _isGlobal;
+
+    public bool HasTasks => Tasks.Count > 0;
+    public bool CanConfirm => Tasks.Any(t => t.IsSelected);
+
+    public TaskCompletionSource<IReadOnlyList<string>?> Result { get; } = new();
+    public Action? CloseAction { get; set; }
+
+    public MergeHelperSelectionModalViewModel(IDbContextFactory<ClaudeDoDbContext> dbFactory)
+        => _dbFactory = dbFactory;
+
+    public void Configure(string? listId, string? listName)
+    {
+        _listId = listId;
+        IsGlobal = listId is null;
+        ScopeLabel = listId is null
+            ? Loc.T("modals.mergeHelper.scopeAll")
+            : Loc.T("modals.mergeHelper.scopeList", listName ?? "");
+    }
+
+    public async Task LoadAsync(CancellationToken ct = default)
+    {
+        foreach (var row in Tasks) row.PropertyChanged -= OnRowChanged;
+        Tasks.Clear();
+
+        await using var ctx = await _dbFactory.CreateDbContextAsync(ct);
+        var query = ctx.Tasks.AsNoTracking()
+            .Where(t => t.Status != TaskStatus.Done && t.Status != TaskStatus.Cancelled);
+        if (_listId is not null)
+            query = query.Where(t => t.ListId == _listId);
+
+        var candidates = await query
+            .OrderBy(t => t.SortOrder).ThenBy(t => t.CreatedAt)
+            .Select(t => new { t.Id, t.Title, t.Status, ListName = t.List.Name })
+            .ToListAsync(ct);
+
+        foreach (var c in candidates)
+        {
+            var row = new MergeHelperTaskRowViewModel
+            {
+                Id = c.Id,
+                Title = c.Title,
+                StatusText = c.Status.ToString(),
+                ListName = c.ListName,
+                IsSelected = IsTickedByDefault(c.Status),
+            };
+            row.PropertyChanged += OnRowChanged;
+            Tasks.Add(row);
+        }
+        OnPropertyChanged(nameof(HasTasks));
+        OnPropertyChanged(nameof(CanConfirm));
+    }
+
+    // Actionable statuses are pre-ticked; Running/WaitingForChildren are listed but unticked
+    // (the helper would only poll them). Done/Cancelled never make it into the list.
+    internal static bool IsTickedByDefault(TaskStatus status) => status
+        is TaskStatus.Idle or TaskStatus.Queued or TaskStatus.WaitingForReview or TaskStatus.Failed;
+
+    private void OnRowChanged(object? sender, PropertyChangedEventArgs e)
+    {
+        if (e.PropertyName == nameof(MergeHelperTaskRowViewModel.IsSelected))
+            OnPropertyChanged(nameof(CanConfirm));
+    }
+
+    [RelayCommand]
+    private void SelectAll()
+    {
+        foreach (var t in Tasks) t.IsSelected = true;
+    }
+
+    [RelayCommand]
+    private void SelectNone()
+    {
+        foreach (var t in Tasks) t.IsSelected = false;
+    }
+
+    [RelayCommand]
+    private void Confirm()
+    {
+        Result.TrySetResult(Tasks.Where(t => t.IsSelected).Select(t => t.Id).ToList());
+        CloseAction?.Invoke();
+    }
+
+    [RelayCommand]
+    private void Cancel()
+    {
+        Result.TrySetResult(null);
+        CloseAction?.Invoke();
+    }
+}

src/ClaudeDo.Ui/ViewModels/Modals/Settings/SessionSkillsSettingsTabViewModel.cs

@@ -13,6 +13,7 @@ public sealed partial class SessionSkillsSettingsTabViewModel : ViewModelBase
     [ObservableProperty] private string _installUrl = "";
     [ObservableProperty] private string _statusMessage = "";
     [ObservableProperty] private bool _isBusy;
+    [ObservableProperty] private bool _isEmpty = true;
 
     public ObservableCollection<SessionSkillDto> Skills { get; } = new();
 
@@ -26,6 +27,7 @@ public sealed partial class SessionSkillsSettingsTabViewModel : ViewModelBase
             var skills = await _worker.GetSessionSkillsAsync();
             Skills.Clear();
             foreach (var s in skills) Skills.Add(s);
+            IsEmpty = Skills.Count == 0;
         }
         finally { IsBusy = false; }
     }

src/ClaudeDo.Ui/ViewModels/Modals/UnifiedDiffParser.cs

@@ -1,3 +1,5 @@
+using System.Text;
+
 namespace ClaudeDo.Ui.ViewModels.Modals;
 
 /// Shared unified-diff parser used by both the per-task diff viewer and the
@@ -16,10 +18,13 @@ public static class UnifiedDiffParser
         {
             if (line.StartsWith("diff --git ", StringComparison.Ordinal))
             {
-                // e.g. "diff --git a/src/Foo.cs b/src/Foo.cs"
-                var parts = line.Split(' ');
-                var path = parts.Length >= 4 ? parts[3][2..] : line;
-                current = new DiffFileViewModel { Path = path };
+                // e.g. "diff --git a/src/Foo.cs b/src/Foo.cs". Paths may each be
+                // git-quoted (C-style, octal-escaped) when they contain non-ASCII
+                // bytes, and unquoted paths may themselves contain spaces, so the
+                // two paths can't be split on a plain ' ' - this is only a best
+                // effort default; "--- "/"+++ "/rename lines below correct it.
+                var (_, newPath) = SplitGitHeaderPaths(line["diff --git ".Length..]);
+                current = new DiffFileViewModel { Path = newPath };
                 files.Add(current);
                 oldLine = 0; newLine = 0;
                 continue;
@@ -41,13 +46,13 @@ public static class UnifiedDiffParser
             if (line.StartsWith("rename from ", StringComparison.Ordinal))
             {
                 current.Status = DiffFileStatus.Renamed;
-                current.OldPath = line["rename from ".Length..];
+                current.OldPath = UnquotePath(line["rename from ".Length..]);
                 continue;
             }
             if (line.StartsWith("rename to ", StringComparison.Ordinal))
             {
                 current.Status = DiffFileStatus.Renamed;
-                current.Path = line["rename to ".Length..];
+                current.Path = UnquotePath(line["rename to ".Length..]);
                 continue;
             }
             if (line.StartsWith("Binary files", StringComparison.Ordinal) ||
@@ -64,10 +69,27 @@ public static class UnifiedDiffParser
                 continue;
             }
 
+            // "--- a/..." / "+++ b/..." each carry a single unambiguous path (unlike
+            // the two-paths-on-one-line "diff --git" header above), so use them to
+            // correct the file's identity - git also appends a disambiguating tab
+            // after unquoted paths that contain whitespace, which must be trimmed.
+            if (line.StartsWith("--- ", StringComparison.Ordinal))
+            {
+                var oldPath = UnquotePath(line[4..].TrimEnd('\t'));
+                if (oldPath != "/dev/null" && current.Status == DiffFileStatus.Deleted)
+                    current.Path = StripPrefix(oldPath, "a/");
+                continue;
+            }
+            if (line.StartsWith("+++ ", StringComparison.Ordinal))
+            {
+                var newPath = UnquotePath(line[4..].TrimEnd('\t'));
+                if (newPath != "/dev/null" && current.Status != DiffFileStatus.Renamed)
+                    current.Path = StripPrefix(newPath, "b/");
+                continue;
+            }
+
             // Skip remaining diff metadata lines
-            if (line.StartsWith("--- ", StringComparison.Ordinal) ||
-                line.StartsWith("+++ ", StringComparison.Ordinal) ||
-                line.StartsWith("index ", StringComparison.Ordinal) ||
+            if (line.StartsWith("index ", StringComparison.Ordinal) ||
                 line.StartsWith("old mode", StringComparison.Ordinal) ||
                 line.StartsWith("new mode", StringComparison.Ordinal) ||
                 line.StartsWith("similarity index", StringComparison.Ordinal) ||
@@ -140,4 +162,111 @@ public static class UnifiedDiffParser
                 newStart = n;
         }
     }
+
+    /// Splits a "diff --git" header's remainder ("a/<old> b/<new>", where
+    /// either side may be individually git-quoted) into its two paths.
+    private static (string OldPath, string NewPath) SplitGitHeaderPaths(string content)
+    {
+        string oldToken, newToken;
+
+        if (content.Length > 0 && content[0] == '"')
+        {
+            var close = FindClosingQuote(content, 0);
+            oldToken = content[..(close + 1)];
+            newToken = content[(close + 1)..].TrimStart(' ');
+        }
+        else
+        {
+            var quoteAt = content.IndexOf('"');
+            if (quoteAt >= 0)
+            {
+                // Mixed quoting: an unquoted path never contains a literal quote
+                // (git would have quoted it), so the quote marks the other side.
+                oldToken = content[..quoteAt].TrimEnd(' ');
+                newToken = content[quoteAt..];
+            }
+            else
+            {
+                var splitAt = content.IndexOf(" b/", StringComparison.Ordinal);
+                oldToken = splitAt < 0 ? content : content[..splitAt];
+                newToken = splitAt < 0 ? content : content[(splitAt + 1)..];
+            }
+        }
+
+        return (StripPrefix(UnquotePath(oldToken), "a/"), StripPrefix(UnquotePath(newToken), "b/"));
+    }
+
+    private static int FindClosingQuote(string s, int start)
+    {
+        var i = start + 1;
+        while (i < s.Length)
+        {
+            if (s[i] == '\\') { i += 2; continue; }
+            if (s[i] == '"') return i;
+            i++;
+        }
+        return s.Length - 1;
+    }
+
+    private static string StripPrefix(string path, string prefix) =>
+        path.StartsWith(prefix, StringComparison.Ordinal) ? path[prefix.Length..] : path;
+
+    /// Reverses git's C-style path quoting: a quoted token is wrapped in double
+    /// quotes with '\\', '"' and non-ASCII bytes escaped as \nnn octal sequences
+    /// (used whenever core.quotePath would otherwise consider the path "unusual").
+    private static string UnquotePath(string token)
+    {
+        if (token.Length < 2 || token[0] != '"' || token[^1] != '"')
+            return token;
+
+        var bytes = new List<byte>();
+        var end = token.Length - 1;
+        var i = 1;
+        while (i < end)
+        {
+            var c = token[i];
+            if (c != '\\')
+            {
+                bytes.Add((byte)c);
+                i++;
+                continue;
+            }
+
+            i++;
+            if (i >= end) break;
+            switch (token[i])
+            {
+                case '"': bytes.Add((byte)'"'); i++; break;
+                case '\\': bytes.Add((byte)'\\'); i++; break;
+                case 'a': bytes.Add(0x07); i++; break;
+                case 'b': bytes.Add(0x08); i++; break;
+                case 'f': bytes.Add(0x0C); i++; break;
+                case 'n': bytes.Add((byte)'\n'); i++; break;
+                case 'r': bytes.Add((byte)'\r'); i++; break;
+                case 't': bytes.Add((byte)'\t'); i++; break;
+                case 'v': bytes.Add(0x0B); i++; break;
+                default:
+                    if (token[i] is >= '0' and <= '7')
+                    {
+                        var value = 0;
+                        var digits = 0;
+                        while (digits < 3 && i < end && token[i] is >= '0' and <= '7')
+                        {
+                            value = value * 8 + (token[i] - '0');
+                            i++;
+                            digits++;
+                        }
+                        bytes.Add((byte)value);
+                    }
+                    else
+                    {
+                        bytes.Add((byte)token[i]);
+                        i++;
+                    }
+                    break;
+            }
+        }
+
+        return Encoding.UTF8.GetString(bytes.ToArray());
+    }
 }

src/ClaudeDo.Ui/Views/Conflicts/ConflictResolverView.axaml

@@ -67,7 +67,7 @@
         <TextBlock Grid.Column="0" Classes="meta" VerticalAlignment="Center"
                    Foreground="{DynamicResource BloodBrush}"
                    Text="{Binding ContinueHint}"
-                   IsVisible="{Binding HasBinaryFiles}"/>
+                   IsVisible="{Binding ContinueHint, Converter={x:Static StringConverters.IsNotNullOrEmpty}}"/>
         <StackPanel Grid.Column="1" Orientation="Horizontal" Spacing="8">
           <Button Classes="btn accent" Content="{loc:Tr conflictResolver.continue}"
                   Command="{Binding ContinueCommand}" IsEnabled="{Binding CanContinue}"/>

src/ClaudeDo.Ui/Views/Islands/Detail/TaskHeaderBar.axaml

@@ -65,7 +65,7 @@
             IsEnabled="{Binding AgentSettings.IsEnabled}"
             VerticalAlignment="Top"
             Margin="6,0,0,0">
-      <TextBlock Text="⚙" FontSize="{StaticResource FontSizeTaskTitle}"/>
+      <PathIcon Data="{StaticResource Icon.Settings}" Width="15" Height="15"/>
       <Button.Flyout>
         <Flyout Placement="BottomEdgeAlignedRight" ShowMode="Standard">
           <StackPanel Width="340" Spacing="10" Margin="4">

src/ClaudeDo.Ui/Views/Islands/Detail/WorkConsole.axaml

@@ -348,6 +348,16 @@
               <Border Height="1" Background="{DynamicResource LineBrush}"
                       IsVisible="{Binding Merge.ShowMergeSection}" />
 
+              <!-- Gate: you must open the diff before Approve & Merge unlocks. -->
+              <StackPanel Orientation="Horizontal" Spacing="6"
+                          IsVisible="{Binding ShowReviewDiffHint}">
+                <PathIcon Data="{StaticResource Icon.ArrowOut}" Width="11" Height="11"
+                          Foreground="{DynamicResource AmberBrush}" VerticalAlignment="Center" />
+                <TextBlock Classes="meta" VerticalAlignment="Center"
+                           Foreground="{DynamicResource AmberBrush}"
+                           Text="Open the diff to enable merge" />
+              </StackPanel>
+
               <WrapPanel Orientation="Horizontal">
                 <Button Classes="btn accent" Content="Approve &amp; Merge" Margin="0,0,8,8"
                         Command="{Binding ApproveReviewCommand}" />
@@ -362,6 +372,17 @@
                       ToolTip.Tip="{loc:Tr session.reviewResetTip}"
                       Command="{Binding ResetReviewCommand}" />
             </StackPanel>
+
+            <!-- Submit an interactive (ConPTY) session for review: an Idle/Failed task that
+                 still has a worktree. Commits the worktree, then moves it to WaitingForReview. -->
+            <StackPanel Spacing="8" IsVisible="{Binding CanSubmitForReview}">
+              <Border Height="1" Background="{DynamicResource LineBrush}" />
+              <TextBlock Classes="meta" TextWrapping="Wrap"
+                         Foreground="{DynamicResource TextMuteBrush}"
+                         Text="Worked on this by hand? Submit the worktree for review to merge it." />
+              <Button Classes="btn accent" Content="Submit for review" HorizontalAlignment="Left"
+                      Command="{Binding SubmitForReviewCommand}" />
+            </StackPanel>
           </StackPanel>
         </ScrollViewer>
 

src/ClaudeDo.Ui/Views/Islands/DetailsIslandView.axaml

@@ -80,6 +80,37 @@
                                    Foreground="{DynamicResource TextDimBrush}"/>
             </StackPanel>
           </Border>
+
+          <!-- Question prompt (AskUser): answer the running task's question inline, mirroring
+               the Mission Control banner. State is shared via the same TaskMonitorViewModel. -->
+          <Border DockPanel.Dock="Top"
+                  IsVisible="{Binding Monitor.HasPendingQuestion}"
+                  Margin="0,0,0,10" Padding="12,8"
+                  Background="{DynamicResource AccentSoftBrush}"
+                  BorderBrush="{DynamicResource AccentBrush}"
+                  BorderThickness="1" CornerRadius="10">
+            <StackPanel Spacing="6">
+              <TextBlock Classes="meta"
+                         Text="{loc:Tr missionControl.question.title}"
+                         Foreground="{DynamicResource AccentBrush}" FontWeight="SemiBold"/>
+              <TextBlock Text="{Binding Monitor.PendingQuestion}" TextWrapping="Wrap"
+                         Foreground="{DynamicResource TextBrush}"/>
+              <Grid ColumnDefinitions="*,Auto" ColumnSpacing="6">
+                <TextBox Grid.Column="0"
+                         Text="{Binding Monitor.AnswerDraft, UpdateSourceTrigger=PropertyChanged}"
+                         PlaceholderText="{loc:Tr missionControl.question.placeholder}"
+                         AcceptsReturn="False">
+                  <TextBox.KeyBindings>
+                    <KeyBinding Gesture="Enter" Command="{Binding Monitor.SubmitAnswerCommand}"/>
+                  </TextBox.KeyBindings>
+                </TextBox>
+                <Button Grid.Column="1"
+                        Content="{loc:Tr missionControl.question.send}"
+                        Command="{Binding Monitor.SubmitAnswerCommand}"/>
+              </Grid>
+            </StackPanel>
+          </Border>
+
           <detail:WorkConsole/>
         </DockPanel>
 

src/ClaudeDo.Ui/Views/Islands/DetailsIslandView.axaml.cs

@@ -81,14 +81,28 @@ public partial class DetailsIslandView : UserControl
         if (items is null) return;
 
         var files = new List<(string FileName, System.IO.Stream Content)>();
-        foreach (var item in items)
+        try
         {
-            if (item is IStorageFile sf)
+            foreach (var item in items)
             {
-                var stream = await sf.OpenReadAsync();
-                files.Add((sf.Name, stream));
+                if (item is IStorageFile sf)
+                {
+                    var stream = await sf.OpenReadAsync();
+                    files.Add((sf.Name, stream));
+                }
             }
         }
+        catch (Exception ex)
+        {
+            // Opening the dropped stream can fail (shell IO, file lock) before AddFilesAsync
+            // ever runs; surface it with the exception type so the next occurrence is analyzable
+            // instead of vanishing as an unobserved async-void fault.
+            _vm.DropStatus = string.Format(
+                ClaudeDo.Ui.Localization.Loc.T("details.attachments.dropReadError"),
+                $"{ex.GetType().Name}: {ex.Message}");
+            foreach (var (_, s) in files) await s.DisposeAsync();
+            return;
+        }
 
         if (files.Count == 0) return;
 

src/ClaudeDo.Ui/Views/Islands/ListsIslandView.axaml

@@ -137,6 +137,11 @@
                               IsVisible="{Binding WorkingDir, Converter={x:Static StringConverters.IsNotNullOrEmpty}}"
                               Command="{Binding $parent[UserControl].((vm:ListsIslandViewModel)DataContext).OpenInTerminalCommand}"
                               CommandParameter="{Binding}"/>
+                    <Separator IsVisible="{Binding WorkingDir, Converter={x:Static StringConverters.IsNotNullOrEmpty}}"/>
+                    <MenuItem Header="{loc:Tr lists.contextLetClaude}"
+                              IsVisible="{Binding WorkingDir, Converter={x:Static StringConverters.IsNotNullOrEmpty}}"
+                              Command="{Binding $parent[UserControl].((vm:ListsIslandViewModel)DataContext).LetClaudeHandleListCommand}"
+                              CommandParameter="{Binding}"/>
                   </ContextMenu>
                 </Border.ContextMenu>
                 <Grid ColumnDefinitions="20,*,Auto">
@@ -176,8 +181,8 @@
           </ItemsControl.ItemTemplate>
         </ItemsControl>
 
-        <!-- New list + import row -->
-        <Grid ColumnDefinitions="*,Auto" Margin="0,4,0,0">
+        <!-- New list + import + merge-helper row -->
+        <Grid ColumnDefinitions="*,Auto,Auto" Margin="0,4,0,0">
           <Button Grid.Column="0" Classes="new-list-btn"
                   Command="{Binding CreateListCommand}">
             <StackPanel Orientation="Horizontal" Spacing="6">
@@ -198,6 +203,13 @@
                       Width="14" Height="14"
                       Foreground="{DynamicResource TextMuteBrush}"/>
           </Button>
+          <Button Grid.Column="2" Classes="icon-btn" Margin="6,0,0,0"
+                  Command="{Binding LetClaudeHandleAllCommand}"
+                  ToolTip.Tip="{loc:Tr lists.letClaudeAllTip}">
+            <PathIcon Data="{StaticResource Icon.Broom}"
+                      Width="14" Height="14"
+                      Foreground="{DynamicResource TextMuteBrush}"/>
+          </Button>
         </Grid>
 
       </StackPanel>

src/ClaudeDo.Ui/Views/Islands/TaskRowView.axaml

@@ -156,6 +156,7 @@
 
             <!-- Status chip -->
             <Border Classes="chip"
+                    IsVisible="{Binding ShowStatusChip}"
                     Classes.parked="{Binding IsParked}"
                     Classes.running="{Binding Status, Converter={StaticResource EqStatus}, ConverterParameter=Running}"
                     Classes.review="{Binding Status, Converter={StaticResource EqStatus}, ConverterParameter=WaitingForReview}"

src/ClaudeDo.Ui/Views/Islands/TaskRowView.axaml.cs

@@ -55,10 +55,10 @@ public partial class TaskRowView : UserControl
             await vm.RemoveFromMyDayCommand.ExecuteAsync(row);
     }
 
-    private async void OnOpenPlanningSessionClick(object? sender, RoutedEventArgs e)
+    private void OnOpenPlanningSessionClick(object? sender, RoutedEventArgs e)
     {
         if (DataContext is TaskRowViewModel row && FindTasksVm() is { } vm)
-            await vm.OpenPlanningSessionCommand.ExecuteAsync(row);
+            vm.OpenPlanningSessionCommand.Execute(row);
     }
 
     private void OnOpenConPtySessionClick(object? sender, RoutedEventArgs e)

src/ClaudeDo.Ui/Views/MainWindow.axaml

@@ -22,7 +22,7 @@
     <KeyBinding Gesture="Shift+OemQuestion" Command="{Binding FocusSearchCommand}"/>
     <KeyBinding Gesture="Ctrl+N" Command="{Binding FocusAddTaskCommand}"/>
   </Window.KeyBindings>
-  <Grid x:Name="RootGrid" RowDefinitions="36,Auto,*,22">
+  <Grid x:Name="RootGrid" RowDefinitions="36,*,22">
     <!-- Custom title bar -->
     <Border Grid.Row="0"
             Background="{DynamicResource DeepBrush}"
@@ -107,45 +107,8 @@
       </Grid>
     </Border>
 
-    <!-- Update banner -->
-    <Border Grid.Row="1"
-            Background="{DynamicResource DeepBrush}"
-            BorderBrush="{DynamicResource LineBrush}"
-            BorderThickness="0,0,0,1"
-            Padding="14,6"
-            IsVisible="{Binding IsUpdateBannerVisible}">
-      <Grid ColumnDefinitions="*,Auto,Auto">
-        <TextBlock Grid.Column="0"
-                   Classes="body"
-                   VerticalAlignment="Center">
-          <Run Text="{loc:Tr shell.update.available}"/>
-          <Run Text="{Binding UpdateCheck.CurrentVersion}"/>
-          <Run Text=" → v"/>
-          <Run Text="{Binding UpdateBannerLatestVersion}"/>
-        </TextBlock>
-        <Button Grid.Column="1"
-                Classes="btn"
-                Margin="0,0,8,0"
-                Content="{loc:Tr shell.update.updateNow}"
-                Command="{Binding UpdateNowCommand}"/>
-        <Button Grid.Column="2"
-                Classes="btn"
-                Content="{loc:Tr shell.update.dismiss}"
-                Command="{Binding DismissBannerCommand}"/>
-      </Grid>
-    </Border>
-
-    <!-- Inline update status (appears at right of banner row when no banner) -->
-    <TextBlock Grid.Row="1"
-               Classes="meta"
-               HorizontalAlignment="Right"
-               VerticalAlignment="Center"
-               Margin="0,0,14,0"
-               Text="{Binding InlineUpdateStatus}"
-               IsVisible="{Binding InlineUpdateStatus, Converter={x:Static ObjectConverters.IsNotNull}}"/>
-
     <!-- Background gradient layer -->
-    <Border Grid.Row="2">
+    <Border Grid.Row="1">
       <Border.Background>
         <RadialGradientBrush Center="50%,50%" GradientOrigin="50%,50%" RadiusX="70%" RadiusY="70%">
           <GradientStop Offset="0"   Color="{StaticResource DeepColor}" />
@@ -155,7 +118,7 @@
     </Border>
 
     <!-- Three islands (user-resizable) -->
-    <Grid Grid.Row="2" Margin="7">
+    <Grid Grid.Row="1" Margin="7">
       <Grid.ColumnDefinitions>
         <ColumnDefinition Width="260" MinWidth="200"/>
         <ColumnDefinition Width="Auto"/>
@@ -196,7 +159,7 @@
     </Grid>
 
     <!-- Footer: connection status -->
-    <Border Grid.Row="3"
+    <Border Grid.Row="2"
             Background="{DynamicResource DeepBrush}"
             BorderBrush="{DynamicResource LineBrush}"
             BorderThickness="0,1,0,0">
@@ -255,5 +218,35 @@
         <Panel/>
       </DockPanel>
     </Border>
+    <!-- Update popup card — bottom-right corner, only when update available -->
+    <Border Grid.Row="0" Grid.RowSpan="3"
+            VerticalAlignment="Bottom" HorizontalAlignment="Right"
+            Margin="0,0,16,30"
+            ZIndex="100"
+            IsVisible="{Binding IsUpdateBannerVisible}"
+            Background="{DynamicResource DeepBrush}"
+            BorderBrush="{DynamicResource LineBrush}"
+            BorderThickness="1"
+            CornerRadius="6"
+            Padding="14,10">
+      <StackPanel Spacing="8" Width="260">
+        <TextBlock Classes="body">
+          <Run Text="{loc:Tr shell.update.available}"/>
+          <Run Text=" v"/>
+          <Run Text="{Binding UpdateCheck.CurrentVersion}"/>
+          <Run Text=" → v"/>
+          <Run Text="{Binding UpdateBannerLatestVersion}"/>
+        </TextBlock>
+        <StackPanel Orientation="Horizontal" Spacing="8" HorizontalAlignment="Right">
+          <Button Classes="btn"
+                  Content="{loc:Tr shell.update.dismiss}"
+                  Command="{Binding DismissBannerCommand}"/>
+          <Button Classes="btn"
+                  Content="{loc:Tr shell.update.updateNow}"
+                  Command="{Binding UpdateNowCommand}"/>
+        </StackPanel>
+      </StackPanel>
+    </Border>
+
   </Grid>
 </Window>

src/ClaudeDo.Ui/Views/MissionControl/ConPtyPaneView.axaml

@@ -14,13 +14,18 @@
               Background="{DynamicResource Surface2Brush}"
               BorderBrush="{DynamicResource LineBrush}"
               BorderThickness="0,0,0,1" Padding="8,3">
-        <Grid ColumnDefinitions="*,Auto">
+        <Grid ColumnDefinitions="*,Auto,Auto">
           <TextBlock Grid.Column="0" Classes="meta" Text="{Binding DisplayTitle}"
                      TextTrimming="CharacterEllipsis"
                      ToolTip.Tip="{Binding DisplayTitle}"
                      Foreground="{DynamicResource TextDimBrush}"
                      VerticalAlignment="Center" Margin="4,0,0,0" />
-          <Button Grid.Column="1" Classes="title-ctrl"
+          <Button Grid.Column="1" Classes="btn" Margin="0,0,6,0"
+                  IsVisible="{Binding IsTaskBased}"
+                  Content="{loc:Tr missionControl.submitForReview}"
+                  ToolTip.Tip="{loc:Tr missionControl.submitForReviewTip}"
+                  Command="{Binding SubmitForReviewCommand}" />
+          <Button Grid.Column="2" Classes="title-ctrl"
                   Command="{Binding CloseCommand}"
                   ToolTip.Tip="{loc:Tr missionControl.closeSession}">
             <PathIcon Data="{StaticResource Icon.WinClose}" Width="12" Height="12"/>

src/ClaudeDo.Ui/Views/Modals/DiffViewerView.axaml

@@ -131,7 +131,7 @@
                                FontFamily="{DynamicResource MonoFont}" FontSize="{StaticResource FontSizeEyebrow}"
                                Foreground="{DynamicResource TextBrush}"/>
                   </Border>
-                  <TextBlock Grid.Column="1" Classes="path-mono" Text="{Binding SelectedFile.Path}"
+                  <TextBlock Grid.Column="1" Classes="path-mono" Text="{Binding SelectedFile.HeaderPath}"
                              VerticalAlignment="Center" TextTrimming="PrefixCharacterEllipsis"/>
                 </Grid>
               </Border>

src/ClaudeDo.Ui/Views/Modals/MergeHelperSelectionModal.axaml

@@ -0,0 +1,81 @@
+<Window xmlns="https://github.com/avaloniaui"
+        xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+        xmlns:vm="using:ClaudeDo.Ui.ViewModels.Modals"
+        xmlns:ctl="using:ClaudeDo.Ui.Views.Controls"
+        xmlns:loc="using:ClaudeDo.Ui.Localization"
+        x:Class="ClaudeDo.Ui.Views.Modals.MergeHelperSelectionModal"
+        x:DataType="vm:MergeHelperSelectionModalViewModel"
+        Title="{loc:Tr modals.mergeHelper.windowTitle}"
+        Width="560" Height="480" MinWidth="420" MinHeight="320"
+        CanResize="True"
+        WindowDecorations="BorderOnly"
+        ExtendClientAreaToDecorationsHint="True"
+        ExtendClientAreaTitleBarHeightHint="-1"
+        WindowStartupLocation="CenterOwner"
+        Background="{DynamicResource SurfaceBrush}">
+  <Window.KeyBindings>
+    <KeyBinding Gesture="Escape" Command="{Binding CancelCommand}"/>
+  </Window.KeyBindings>
+
+  <ctl:ModalShell Title="{loc:Tr modals.mergeHelper.title}" CloseCommand="{Binding CancelCommand}">
+    <ctl:ModalShell.Footer>
+      <StackPanel Orientation="Horizontal" Spacing="8" HorizontalAlignment="Right"
+                  VerticalAlignment="Center">
+        <Button Classes="btn" Content="{loc:Tr modals.mergeHelper.cancel}" Command="{Binding CancelCommand}" MinWidth="90"/>
+        <Button Content="{loc:Tr modals.mergeHelper.confirm}" Command="{Binding ConfirmCommand}"
+                IsEnabled="{Binding CanConfirm}" MinWidth="140" Classes="primary"/>
+      </StackPanel>
+    </ctl:ModalShell.Footer>
+
+    <!-- Body: scope + select-all/none toolbar, headers, checkbox rows -->
+    <DockPanel>
+      <Grid DockPanel.Dock="Top" ColumnDefinitions="*,Auto,Auto" Margin="20,12,20,6">
+        <TextBlock Grid.Column="0" Classes="meta" Text="{Binding ScopeLabel}" VerticalAlignment="Center"/>
+        <Button Grid.Column="1" Classes="btn" Content="{loc:Tr modals.mergeHelper.selectAll}"
+                Command="{Binding SelectAllCommand}" IsEnabled="{Binding HasTasks}"/>
+        <Button Grid.Column="2" Classes="btn" Content="{loc:Tr modals.mergeHelper.selectNone}"
+                Command="{Binding SelectNoneCommand}" IsEnabled="{Binding HasTasks}" Margin="8,0,0,0"/>
+      </Grid>
+
+      <!-- Column headers -->
+      <Grid DockPanel.Dock="Top" ColumnDefinitions="32,*,120,120" Margin="20,0,20,4"
+            IsVisible="{Binding HasTasks}">
+        <TextBlock Grid.Column="1" Classes="eyebrow" Text="{loc:Tr modals.mergeHelper.columnTask}"/>
+        <TextBlock Grid.Column="2" Classes="eyebrow" Text="{loc:Tr modals.mergeHelper.columnStatus}"/>
+        <TextBlock Grid.Column="3" Classes="eyebrow" Text="{loc:Tr modals.mergeHelper.columnList}"
+                   IsVisible="{Binding IsGlobal}"/>
+      </Grid>
+
+      <ScrollViewer Padding="20,2,20,8">
+        <StackPanel>
+          <TextBlock Classes="meta" Margin="0,8"
+                     Text="{loc:Tr modals.mergeHelper.empty}"
+                     IsVisible="{Binding !HasTasks}"/>
+          <ItemsControl ItemsSource="{Binding Tasks}">
+            <ItemsControl.ItemTemplate>
+              <DataTemplate DataType="vm:MergeHelperTaskRowViewModel">
+                <Grid ColumnDefinitions="32,*,120,120" Margin="0,1">
+                  <CheckBox Grid.Column="0" MinWidth="0"
+                            IsChecked="{Binding IsSelected, Mode=TwoWay}"
+                            VerticalAlignment="Center"/>
+                  <TextBlock Classes="body" Grid.Column="1" Text="{Binding Title}"
+                             VerticalAlignment="Center" Margin="4,0,0,0"
+                             TextTrimming="CharacterEllipsis"/>
+                  <Border Grid.Column="2" Classes="chip"
+                          HorizontalAlignment="Left" VerticalAlignment="Center">
+                    <TextBlock Text="{Binding StatusText}"/>
+                  </Border>
+                  <TextBlock Classes="meta" Grid.Column="3" Text="{Binding ListName}"
+                             VerticalAlignment="Center" Margin="8,0,0,0"
+                             TextTrimming="CharacterEllipsis"
+                             IsVisible="{Binding $parent[Window].((vm:MergeHelperSelectionModalViewModel)DataContext).IsGlobal}"/>
+                </Grid>
+              </DataTemplate>
+            </ItemsControl.ItemTemplate>
+          </ItemsControl>
+        </StackPanel>
+      </ScrollViewer>
+    </DockPanel>
+
+  </ctl:ModalShell>
+</Window>

src/ClaudeDo.Ui/Views/Modals/MergeHelperSelectionModal.axaml.cs

@@ -0,0 +1,11 @@
+using Avalonia.Controls;
+
+namespace ClaudeDo.Ui.Views.Modals;
+
+public partial class MergeHelperSelectionModal : Window
+{
+    public MergeHelperSelectionModal()
+    {
+        InitializeComponent();
+    }
+}

src/ClaudeDo.Ui/Views/Modals/SettingsModalView.axaml

@@ -413,6 +413,9 @@
                     </DataTemplate>
                   </ItemsControl.ItemTemplate>
                 </ItemsControl>
+                <TextBlock Classes="meta" Opacity="0.6" TextWrapping="Wrap"
+                           Text="{loc:Tr settings.skills.emptyState}"
+                           IsVisible="{Binding SessionSkills.IsEmpty}"/>
               </StackPanel>
 
               <TextBlock Classes="meta" Text="{Binding SessionSkills.StatusMessage}"

src/ClaudeDo.Ui/Views/WindowDialogService.cs

@@ -81,6 +81,15 @@ public sealed class WindowDialogService : IDialogService
         await dlg.ShowDialog(_owner);
     }
 
+    public async Task<System.Collections.Generic.IReadOnlyList<string>?> ShowMergeHelperSelectionAsync(MergeHelperSelectionModalViewModel vm)
+    {
+        var dlg = new MergeHelperSelectionModal { DataContext = vm };
+        vm.CloseAction = () => dlg.Close();
+        dlg.Closed += (_, _) => vm.Result.TrySetResult(null);   // native close counts as cancel
+        await dlg.ShowDialog(_owner);
+        return await vm.Result.Task;
+    }
+
     public async Task ShowWorktreesOverviewAsync(WorktreesOverviewModalViewModel vm)
     {
         var dlg = new WorktreesOverviewModalView { DataContext = vm };

src/ClaudeDo.Worker/CLAUDE.md

@@ -7,7 +7,7 @@ ASP.NET Core hosted service that executes tasks via Claude CLI in isolated envir
 ```
 Worker/
   State/        — TaskStateService + TransitionResult (sole owner of Status/PlanningPhase/BlockedBy writes)
-  Queue/        — IQueueWaker, IQueuePicker, QueueService (BackgroundService), OverrideSlotService
+  Queue/        — IQueueWaker, IQueuePicker, QueueService (BackgroundService), OverrideSlotService, RunCancellationRegistry (taskId → running-run CTS; lets TaskStateService.CancelAsync kill the process of a cancelled task/child without a DI cycle)
   Lifecycle/    — StaleTaskRecovery, TaskResetService, TaskMergeService, ClaudeCliPreflight, OrphanRecovery, PlanningLineageRecovery, AttachmentOrphanRecovery (startup sweep: deletes any `attachments/<taskId>/` dirs whose task no longer exists)
   Worktrees/    — WorktreeMaintenanceService
   Agents/       — AgentFileService, DefaultAgentSeeder
@@ -20,7 +20,7 @@ Worker/
   Logging/      — LogRingBuffer (30-min in-memory log window) + BroadcastLogSink (Serilog sink → footer + overlay)
   Report/       — ClaudeHistoryReader, WeekReportPromptBuilder, WeekReportService; interfaces in Report/Interfaces/
   Prime/        — daily-prep ("Prime Claude"): PrimeScheduler (BackgroundService), PrimeRunner (runs the daily prep), DailyPrepPrompt (fixed prompt + CLI args + LogPath() helper), NextDueCalculator, PrimeScheduleSignal; interfaces in Prime/Interfaces/ (IPrimeRunner, IPrimeClock, IPrimeScheduleSignal, IPrimeBroadcaster)
-  Online/       — optional Online Inbox sync: OnlineInboxConfig (config record), Dtos (RemoteList/RemoteTask/MirrorTask), IOnlineInboxApi, OnlineInboxApiClient (typed HttpClient, bearer auth, HTTPS guard), OnlineTokenStore (DPAPI refresh-token store, Windows-only), StaticTokenAuthProvider (default/test IOnlineAuthProvider), ZitadelAuthProvider (stub — TODO(online-inbox) Phase 2), OnlineSyncService (BackgroundService: reconcile loop), OnlineBacklog (Idle-backlog filter/query); interface in Online/Interfaces/ (IOnlineAuthProvider)
+  Online/       — optional Online Inbox sync: OnlineInboxConfig (config record), Dtos (RemoteList/RemoteTask/MirrorTask), IOnlineInboxApi, OnlineInboxApiClient (typed HttpClient, bearer auth, HTTPS guard), OnlineTokenStore (DPAPI refresh-token store, Windows-only), StaticTokenAuthProvider (default/test IOnlineAuthProvider), ZitadelAuthProvider (OIDC discovery + refresh-token flow), OnlineSyncService (BackgroundService: reconcile loop), OnlineBacklog (Idle-backlog filter/query); interface in Online/Interfaces/ (IOnlineAuthProvider)
 ```
 
 Interfaces (e.g. `IQueueWaker`, `IPrimeClock`, `ITaskStateService`) live in an `Interfaces/` subfolder within their area; the namespace stays the area namespace.
@@ -32,13 +32,13 @@ Interfaces (e.g. `IQueueWaker`, `IPrimeClock`, `ITaskStateService`) live in an `
 - **IQueueWaker / IQueuePicker / QueueService** — waker is a singleton `SemaphoreSlim`; picker performs the atomic `Queued → Running` claim filtered by `BlockedByTaskId IS NULL` and schedule; QueueService is a thin `BackgroundService` that loops on the waker and dispatches via `TaskRunner`.
 - **OverrideSlotService** — owns `RunNow` / `ContinueTask`; goes through `TaskStateService.StartRunningAsync` (caller-driven, serialized by slot lock).
 - **StaleTaskRecovery** — startup-only service; calls `TaskStateService.RecoverStaleRunningAsync` to flip orphaned `Running` rows to `Failed`.
-- **External/*** — always-on MCP tools for general Claude sessions, scoped to *starting* and *observing* sessions (no worktree/merge, multi-turn, planning, or app-settings writes). Auth via optional `X-ClaudeDo-Key` header. Registered explicitly in `Program.cs`'s external app via `.WithTools<T>()`. Organized by concern:
-  - `ExternalMcpService` — task CRUD + execution: `ListTaskLists`, `ListTasks`, `GetTask`, `AddTask`, `AddSubtask`, `UpdateTask`, `UpdateTaskStatus` (`Idle` / `Queued`), `GetTaskStatusValues`, `ReviewTask` (`approve` / `reject_rerun` / `reject_park` / `cancel` for a WaitingForReview task), `RunTaskNow`, `ContinueTask`, `CancelTask`, `DeleteTask`; worktree/git: `GetTaskWorktree`, `GetTaskDiff`, `MergeTask`, `ListWorktrees`, `CleanupTaskWorktree`
+- **External/*** — always-on MCP tools for general Claude sessions, scoped to *starting* and *observing* sessions (no worktree/merge, multi-turn, planning, or app-settings writes). Auth via optional `X-ClaudeDo-Key` header. Registered explicitly in `Program.cs`'s external app via `.WithTools<T>()`. Every optional/filter parameter across these tools must carry a C# default value (e.g. `string? status = null`) — the MCP schema only marks a parameter optional when it has one; nullability alone doesn't do it (`ExternalMcpToolSchemaTests` guards this by reflection). `ExternalMcpExceptionFilter.Wrap` is registered as a call-tool filter so `InvalidOperationException`/`ArgumentException` messages survive as `McpException` — otherwise the SDK's own catch-all replaces any non-`McpException` with a generic "An error occurred invoking 'X'." Organized by concern:
+  - `ExternalMcpService` — task CRUD + execution: `ListTaskLists`, `ListTasks`, `GetTask`, `AddTask`, `AddSubtask`, `UpdateTask`, `UpdateTaskStatus` (`Idle` / `Queued`), `GetTaskStatusValues`, `ReviewTask` (`approve` / `reject_rerun` / `reject_park` / `cancel` for a WaitingForReview task; approve is review+merge exactly like the hub's `ApproveReview` — unit merge for parents, worktree merge into optional `targetBranch` for childless tasks, conflicts reported in the `ReviewTaskResult`), `RunTaskNow`, `ContinueTask`, `CancelTask`, `DeleteTask`; worktree/git: `GetTaskWorktree`, `GetTaskDiff`, `MergeTask`, `ListWorktrees`, `CleanupTaskWorktree`
   - `BatchMcpTools` — best-effort batch variants that loop the `ExternalMcpService` single-entity methods (sequential — the scoped DbContext is not thread-safe; merge/review stay single-task): `BatchGetTasks`, `BatchAddTasks`, `BatchUpdateTaskStatus`, `BatchCancelTasks`, `BatchDeleteTasks`, `BatchSetMyDay`, `BatchCleanupTaskWorktrees`. Every tool returns a per-item result array ({ id/index, ok, error?, … }) — a failing item never aborts the rest — and rejects batches over 100 items.
   - `ListMcpTools` — `CreateList`, `UpdateList`, `DeleteList`
   - `ConfigMcpTools` — `GetListConfig`, `SetListConfig`, `GetTaskConfig`, `SetTaskConfig`
   - `RunHistoryMcpTools` — `ListRuns`, `GetRun`, `GetTaskLog` (latest run's log, tail-capped at 256 KB)
-  - `AgentMcpTools` — `ListAgents` (class lives in `LifecycleMcpTools.cs`)
+  - `AgentMcpTools` — `ListAgents`
   - `LifecycleMcpTools` — `ResetFailedTask`
   - `AppSettingsMcpTools` — `GetAppSettings` (read-only)
   - `AttachmentMcpTools` — `AddTaskAttachment(taskId, fileName, textContent?|base64Content?)`, `ListTaskAttachments`, `RemoveTaskAttachment`. Re-attaching the same fileName overwrites; add/remove refuse on a Running task.
@@ -177,7 +177,7 @@ Loaded from `~/.todo-app/worker.config.json`:
   - `enabled` (bool, default false) — when false the entire `Online/` stack is not registered
   - `api_base_url` (string) — must be HTTPS or loopback; validated at startup when enabled
   - `poll_interval_seconds` (int, default 60)
-  - `zitadel.authority`, `zitadel.client_id`, `zitadel.scopes` (Phase 2; not used until ZitadelAuthProvider is wired)
+  - `zitadel.authority`, `zitadel.client_id`, `zitadel.scopes` — used by `ZitadelAuthProvider` (OIDC discovery + refresh-token flow)
   - The refresh token is NOT in this file — stored encrypted via DPAPI at `~/.todo-app/online-inbox.token`
 
 Per-list config (`list_config` in DB) provides defaults for `model`, `system_prompt`, `agent_path`; tasks can override each individually. Task-generating MCP tools (`AddTask`, planning `CreateChildTask`, `SuggestImprovement`) accept an optional `model` (alias-validated via `ModelRegistry.NormalizeAlias` — `haiku`/`sonnet`/`opus`, blank = inherit) so Claude assigns the cheapest capable model at creation time; the planning/system/improvement prompts instruct it to do so (`ModelRegistry.ByCostAscending` = the cost order).

src/ClaudeDo.Worker/External/AgentMcpTools.cs

@@ -0,0 +1,18 @@
+using System.ComponentModel;
+using ClaudeDo.Data.Models;
+using ClaudeDo.Worker.Agents;
+using ModelContextProtocol.Server;
+
+namespace ClaudeDo.Worker.External;
+
+[McpServerToolType]
+public sealed class AgentMcpTools
+{
+    private readonly AgentFileService _agents;
+
+    public AgentMcpTools(AgentFileService agents) => _agents = agents;
+
+    [McpServerTool, Description("List available agent definition files (name, description, path) for use as a task's agent path.")]
+    public async Task<IReadOnlyList<AgentInfo>> ListAgents(CancellationToken cancellationToken)
+        => await _agents.ScanAsync(cancellationToken);
+}

src/ClaudeDo.Worker/External/ConfigMcpTools.cs

@@ -31,7 +31,8 @@ public sealed class ConfigMcpTools
 
     [McpServerTool, Description("Set a list's default model/system prompt/agent path/max turns. Passing all four as null clears the list config.")]
     public async Task SetListConfig(
-        string listId, string? model, string? systemPrompt, string? agentPath, int? maxTurns, CancellationToken cancellationToken)
+        string listId, string? model = null, string? systemPrompt = null, string? agentPath = null,
+        int? maxTurns = null, CancellationToken cancellationToken = default)
     {
         _ = await _lists.GetByIdAsync(listId, cancellationToken)
             ?? throw new InvalidOperationException($"List {listId} not found.");
@@ -53,7 +54,8 @@ public sealed class ConfigMcpTools
 
     [McpServerTool, Description("Set per-task config overrides (model/system prompt/agent path/max turns). Pass null for any field to clear that override.")]
     public async Task SetTaskConfig(
-        string taskId, string? model, string? systemPrompt, string? agentPath, int? maxTurns, CancellationToken cancellationToken)
+        string taskId, string? model = null, string? systemPrompt = null, string? agentPath = null,
+        int? maxTurns = null, CancellationToken cancellationToken = default)
     {
         _ = await _tasks.GetByIdAsync(taskId, cancellationToken)
             ?? throw new InvalidOperationException($"Task {taskId} not found.");

src/ClaudeDo.Worker/External/ExternalMcpExceptionFilter.cs

@@ -0,0 +1,32 @@
+using ModelContextProtocol;
+using ModelContextProtocol.Protocol;
+using ModelContextProtocol.Server;
+
+namespace ClaudeDo.Worker.External;
+
+/// <summary>
+/// The MCP SDK's own call-tool catch-all only preserves ex.Message for <see cref="McpException"/> —
+/// any other exception type is replaced with a generic "An error occurred invoking 'X'." with no detail.
+/// This filter translates the expected validation exceptions thrown across the External/ tool classes
+/// (task/list not found, bad status, unknown model, etc.) into McpException so callers see why a call failed.
+/// </summary>
+public static class ExternalMcpExceptionFilter
+{
+    public static McpRequestHandler<CallToolRequestParams, CallToolResult> Wrap(
+        McpRequestHandler<CallToolRequestParams, CallToolResult> next) =>
+        async (request, cancellationToken) =>
+        {
+            try
+            {
+                return await next(request, cancellationToken);
+            }
+            catch (InvalidOperationException ex)
+            {
+                throw new McpException(ex.Message, ex);
+            }
+            catch (ArgumentException ex)
+            {
+                throw new McpException(ex.Message, ex);
+            }
+        };
+}

src/ClaudeDo.Worker/External/ExternalMcpService.cs

@@ -6,6 +6,7 @@ using ClaudeDo.Data.Models;
 using ClaudeDo.Data.Repositories;
 using ClaudeDo.Worker.Hub;
 using ClaudeDo.Worker.Lifecycle;
+using ClaudeDo.Worker.Planning;
 using ClaudeDo.Worker.Queue;
 using ClaudeDo.Worker.State;
 using ClaudeDo.Worker.Worktrees;
@@ -18,6 +19,7 @@ namespace ClaudeDo.Worker.External;
 public sealed record TaskListDto(string Id, string Name, string? WorkingDir);
 public sealed record DeleteTaskResult(bool Deleted, string Id);
 public sealed record CancelTaskResult(bool Cancelled, string Id);
+public sealed record ReviewTaskResult(TaskDto Task, string? MergeStatus, IReadOnlyList<string> MergeConflicts, string? MergeMessage, string? RepoPath = null);
 public sealed record StatusValueDto(string Status, string Meaning);
 
 public sealed record TaskDto(
@@ -42,7 +44,12 @@ public sealed record TaskDiffDto(
     string Content, IReadOnlyList<string> Files, bool Truncated, int TotalBytes);
 
 public sealed record MergeTaskResultDto(
-    bool Merged, string? MergeCommit, IReadOnlyList<string> Conflicts);
+    bool Merged, string? MergeCommit, IReadOnlyList<string> Conflicts,
+    bool ConflictsInTree = false, string? RepoPath = null);
+
+public sealed record MergeContinuationResultDto(
+    bool Merged, string TaskStatus, IReadOnlyList<string> Conflicts,
+    string? RepoPath, string? Message);
 
 public sealed record WorktreeListItemDto(
     string? TaskId, string Path, string Branch,
@@ -72,6 +79,7 @@ public sealed class ExternalMcpService
     private readonly IDbContextFactory<ClaudeDoDbContext> _dbFactory;
     private readonly WorktreeMaintenanceService _maintenance;
     private readonly TaskMergeService _merge;
+    private readonly PlanningMergeOrchestrator _planningMerge;
 
     public ExternalMcpService(
         TaskRepository tasks,
@@ -82,7 +90,8 @@ public sealed class ExternalMcpService
         GitService git,
         IDbContextFactory<ClaudeDoDbContext> dbFactory,
         WorktreeMaintenanceService maintenance,
-        TaskMergeService merge)
+        TaskMergeService merge,
+        PlanningMergeOrchestrator planningMerge)
     {
         _tasks = tasks;
         _lists = lists;
@@ -93,6 +102,7 @@ public sealed class ExternalMcpService
         _dbFactory = dbFactory;
         _maintenance = maintenance;
         _merge = merge;
+        _planningMerge = planningMerge;
     }
 
     [McpServerTool, Description("List all task lists available in ClaudeDo.")]
@@ -107,9 +117,9 @@ public sealed class ExternalMcpService
         "Valid status values: Idle, Queued, Running, WaitingForReview, WaitingForChildren, Done, Failed, Cancelled.")]
     public async Task<IReadOnlyList<TaskDto>> ListTasks(
         string listId,
-        string? createdBy,
-        string? status,
-        CancellationToken cancellationToken)
+        string? createdBy = null,
+        string? status = null,
+        CancellationToken cancellationToken = default)
     {
         TaskStatus? statusFilter = null;
         if (!string.IsNullOrWhiteSpace(status))
@@ -193,10 +203,10 @@ public sealed class ExternalMcpService
     [McpServerTool, Description("Update an existing task's title, description, and/or commit type. Pass null to leave a field unchanged. Refuses if the task is currently Running.")]
     public async Task<TaskDto> UpdateTask(
         string taskId,
-        string? title,
-        string? description,
-        string? commitType,
-        CancellationToken cancellationToken)
+        string? title = null,
+        string? description = null,
+        string? commitType = null,
+        CancellationToken cancellationToken = default)
     {
         var task = await _tasks.GetByIdAsync(taskId, cancellationToken)
             ?? throw new InvalidOperationException($"Task {taskId} not found.");
@@ -219,8 +229,8 @@ public sealed class ExternalMcpService
     public async Task<TaskDto> AddSubtask(
         string taskId,
         string title,
-        int? orderNum,
-        CancellationToken cancellationToken)
+        int? orderNum = null,
+        CancellationToken cancellationToken = default)
     {
         if (string.IsNullOrWhiteSpace(title))
             throw new InvalidOperationException("title is required.");
@@ -292,34 +302,99 @@ public sealed class ExternalMcpService
 
     [McpServerTool, Description(
         "Review a task that is WaitingForReview. " +
-        "decision='approve' → Done. " +
+        "decision='approve' → review+merge, exactly like the UI's Approve: a childless task merges its worktree into " +
+        "targetBranch (default: the repo's current branch) then goes Done; a task with children drives the unit merge " +
+        "(parent worktree if active + each Done child in order); a task without an active worktree approves straight to Done. " +
+        "mergeStatus 'conflict' means the merge stopped on conflicts (files listed) — by default the merge is cleanly " +
+        "aborted and you resolve in the ClaudeDo UI; pass leaveConflictsInTree=true to instead leave the conflict " +
+        "markers in the working tree (repoPath in the result) so you can resolve them and call continue_merge, " +
+        "or abort_merge to cancel. " +
         "decision='reject_rerun' → Queued and re-runs, resuming the agent's session with your feedback as the next turn (feedback is required). " +
         "decision='reject_park' → Idle for manual editing (feedback ignored). " +
         "decision='cancel' → Cancelled. " +
         "Fails if the task is not currently WaitingForReview (except cancel, which also works while Running/Queued).")]
-    public async Task<TaskDto> ReviewTask(
+    public async Task<ReviewTaskResult> ReviewTask(
         string taskId,
         string decision,
-        string? feedback,
-        CancellationToken cancellationToken)
+        string? feedback = null,
+        string? targetBranch = null,
+        bool leaveConflictsInTree = false,
+        CancellationToken cancellationToken = default)
     {
-        _ = await _tasks.GetByIdAsync(taskId, cancellationToken)
+        var task = await _tasks.GetByIdAsync(taskId, cancellationToken)
             ?? throw new InvalidOperationException($"Task {taskId} not found.");
 
-        TransitionResult result = decision.Trim().ToLowerInvariant() switch
+        string? mergeStatus = null;
+        IReadOnlyList<string> mergeConflicts = Array.Empty<string>();
+        string? mergeMessage = null;
+        string? repoPath = null;
+
+        if (decision.Trim().ToLowerInvariant() == "approve")
         {
-            "approve"      => await _state.ApproveReviewAsync(taskId, cancellationToken),
-            "reject_rerun" => await _state.RejectToQueueAsync(taskId, feedback ?? "", cancellationToken),
-            "reject_park"  => await _state.RejectToIdleAsync(taskId, cancellationToken),
-            "cancel"       => await _state.CancelAsync(taskId, DateTime.UtcNow, cancellationToken),
-            _ => throw new InvalidOperationException(
-                $"Unknown decision '{decision}'. Use approve, reject_rerun, reject_park, or cancel."),
-        };
+            // Approve is the single review+merge action — mirror the hub's ApproveReview
+            // routing instead of only flipping the status (which left branches unmerged).
+            bool hasChildren;
+            await using (var ctx = await _dbFactory.CreateDbContextAsync(cancellationToken))
+                hasChildren = await ctx.Tasks.AnyAsync(t => t.ParentTaskId == taskId, cancellationToken);
 
-        if (!result.Ok)
-            throw new InvalidOperationException(result.Reason ?? "Review action failed.");
+            if (hasChildren)
+            {
+                await _planningMerge.StartAsync(taskId, targetBranch ?? "", cancellationToken);
+                var parentDone = (await _tasks.GetByIdAsync(taskId, cancellationToken))!.Status == TaskStatus.Done;
+                mergeStatus = parentDone ? TaskMergeService.StatusMerged : TaskMergeService.StatusConflict;
+                if (!parentDone)
+                {
+                    var list = await _lists.GetByIdAsync(task.ListId, cancellationToken);
+                    repoPath = list?.WorkingDir;
+                    mergeMessage = "unit merge paused on a conflict — markers left in the working tree; " +
+                        "resolve them then call continue_merge with the parent task id, or abort_merge to cancel";
+                }
+            }
+            else
+            {
+                var r = await _merge.ApproveAndMergeAsync(taskId, targetBranch ?? "", leaveConflictsInTree, cancellationToken);
+                if (r.Status == TaskMergeService.StatusBlocked)
+                    throw new InvalidOperationException(r.ErrorMessage ?? "approve failed");
+                mergeStatus = r.Status;
+                mergeConflicts = r.ConflictFiles;
+                if (r.Status == TaskMergeService.StatusConflict)
+                {
+                    if (leaveConflictsInTree)
+                    {
+                        var list = await _lists.GetByIdAsync(task.ListId, cancellationToken);
+                        repoPath = list?.WorkingDir;
+                        mergeMessage = "merge conflict — markers left in the working tree; " +
+                            "resolve them then call continue_merge, or abort_merge to cancel";
+                    }
+                    else
+                    {
+                        mergeMessage = "merge conflict — the task stays WaitingForReview; resolve it in the ClaudeDo UI";
+                    }
+                }
+                else
+                {
+                    mergeMessage = r.ErrorMessage;
+                }
+            }
+        }
+        else
+        {
+            TransitionResult result = decision.Trim().ToLowerInvariant() switch
+            {
+                "reject_rerun" => await _state.RejectToQueueAsync(taskId, feedback ?? "", cancellationToken),
+                "reject_park"  => await _state.RejectToIdleAsync(taskId, cancellationToken),
+                "cancel"       => await _state.CancelAsync(taskId, DateTime.UtcNow, cancellationToken),
+                _ => throw new InvalidOperationException(
+                    $"Unknown decision '{decision}'. Use approve, reject_rerun, reject_park, or cancel."),
+            };
 
-        return ToDto((await _tasks.GetByIdAsync(taskId, cancellationToken))!);
+            if (!result.Ok)
+                throw new InvalidOperationException(result.Reason ?? "Review action failed.");
+        }
+
+        return new ReviewTaskResult(
+            ToDto((await _tasks.GetByIdAsync(taskId, cancellationToken))!),
+            mergeStatus, mergeConflicts, mergeMessage, repoPath);
     }
 
     [McpServerTool, Description("Immediately run a task in the override execution slot (bypasses the agent queue).")]
@@ -357,6 +432,8 @@ public sealed class ExternalMcpService
             throw new InvalidOperationException("Cannot delete a running task. Cancel it first.");
 
         await _tasks.DeleteAsync(taskId, cancellationToken);
+        if (task.ParentTaskId is not null)
+            await _state.TryAdvanceParentAsync(task.ParentTaskId);
         await _broadcaster.TaskUpdated(taskId);
         return new DeleteTaskResult(true, taskId);
     }
@@ -437,13 +514,17 @@ public sealed class ExternalMcpService
         "dryRun=true: validates preconditions only, does not perform the merge; merged=false in the result means 'not actually merged'. " +
         "allowWaitingForReview=true: also allows merging a task in WaitingForReview (default false, which only allows Done). " +
         "On success: merged=true, mergeCommit contains the new merge commit SHA. " +
-        "On conflict: the merge is cleanly aborted (no half-merged state left); merged=false and conflicts lists the affected files.")]
+        "On conflict: by default the merge is cleanly aborted (no half-merged state left); merged=false and conflicts lists the affected files. " +
+        "leaveConflictsInTree=true: on conflict the merge is NOT aborted — conflict markers are left in the working " +
+        "tree at repoPath (conflictsInTree=true in the result) so you can resolve them there and call continue_merge, " +
+        "or abort_merge to cancel.")]
     public async Task<MergeTaskResultDto> MergeTask(
         string taskId,
         string targetBranch = "main",
         bool noFf = true,
         bool dryRun = false,
         bool allowWaitingForReview = false,
+        bool leaveConflictsInTree = false,
         CancellationToken cancellationToken = default)
     {
         var task = await _tasks.GetByIdAsync(taskId, cancellationToken)
@@ -470,7 +551,7 @@ public sealed class ExternalMcpService
 
         var commitMessage = $"Merge task branch for: {task.Title}";
         var result = await _merge.MergeAsync(
-            taskId, targetBranch, removeWorktree: false, commitMessage, cancellationToken);
+            taskId, targetBranch, removeWorktree: false, commitMessage, leaveConflictsInTree, cancellationToken);
 
         if (result.Status == TaskMergeService.StatusMerged)
         {
@@ -485,11 +566,110 @@ public sealed class ExternalMcpService
         }
 
         if (result.Status == TaskMergeService.StatusConflict)
-            return new MergeTaskResultDto(false, null, result.ConflictFiles);
+            return leaveConflictsInTree
+                ? new MergeTaskResultDto(false, null, result.ConflictFiles,
+                    ConflictsInTree: true, RepoPath: list?.WorkingDir)
+                : new MergeTaskResultDto(false, null, result.ConflictFiles);
 
         throw new InvalidOperationException(result.ErrorMessage ?? $"Merge blocked: {result.Status}");
     }
 
+    [McpServerTool, Description(
+        "Finish an in-progress conflicted merge after the conflict markers in the working tree (repoPath from " +
+        "merge_task/review_task) have been resolved. Handles both a single task's merge and a parent/children unit " +
+        "merge — pass the PARENT task id to continue a unit merge. On success merged=true and the task reaches its " +
+        "post-merge status (Done when approving). If conflict markers are still present, merged=false and conflicts " +
+        "lists the affected files — resolve them and call continue_merge again. " +
+        "Throws if there is no in-progress merge for the task; use abort_merge to cancel a paused merge instead.")]
+    public async Task<MergeContinuationResultDto> ContinueMerge(string taskId, CancellationToken cancellationToken)
+    {
+        var task = await _tasks.GetByIdAsync(taskId, cancellationToken)
+            ?? throw new InvalidOperationException($"Task {taskId} not found.");
+        var list = await _lists.GetByIdAsync(task.ListId, cancellationToken);
+        var workingDir = list?.WorkingDir;
+
+        bool merged;
+        IReadOnlyList<string> conflicts = Array.Empty<string>();
+        string? repoPath = null;
+        string? message = null;
+
+        if (_planningMerge.HasActiveMerge(taskId))
+        {
+            await _planningMerge.ContinueAsync(taskId, cancellationToken);
+            var parent = (await _tasks.GetByIdAsync(taskId, cancellationToken))!;
+            if (parent.Status == TaskStatus.Done)
+            {
+                merged = true;
+            }
+            else
+            {
+                var remaining = !string.IsNullOrWhiteSpace(workingDir)
+                    ? await _git.ListConflictedFilesAsync(workingDir, cancellationToken)
+                    : new List<string>();
+                merged = false;
+                if (remaining.Count > 0)
+                {
+                    conflicts = remaining;
+                    repoPath = workingDir;
+                    message = "conflicts remain — resolve and call continue_merge again";
+                }
+                else
+                {
+                    message = "unit merge did not complete — the orchestrator aborted or was blocked; " +
+                        "check the parent task and approve again to restart the merge";
+                }
+            }
+        }
+        else
+        {
+            var r = await _merge.ContinueMergeAsync(taskId, cancellationToken);
+            if (r.Status == TaskMergeService.StatusMerged)
+            {
+                merged = true;
+            }
+            else if (r.Status == TaskMergeService.StatusConflict)
+            {
+                merged = false;
+                conflicts = r.ConflictFiles;
+                repoPath = workingDir;
+                message = r.ErrorMessage;
+            }
+            else
+            {
+                throw new InvalidOperationException(r.ErrorMessage ?? "continue failed");
+            }
+        }
+
+        var reloaded = (await _tasks.GetByIdAsync(taskId, cancellationToken))!;
+        await _broadcaster.TaskUpdated(taskId);
+        return new MergeContinuationResultDto(merged, reloaded.Status.ToString(), conflicts, repoPath, message);
+    }
+
+    [McpServerTool, Description(
+        "Abort an in-progress conflicted merge, discarding the conflict markers and restoring a clean working tree. " +
+        "Handles both a single task's merge and a parent/children unit merge — pass the PARENT task id to abort a " +
+        "unit merge. The task keeps its pre-merge status (e.g. WaitingForReview). " +
+        "Throws if there is no in-progress merge for the task.")]
+    public async Task<TaskDto> AbortMerge(string taskId, CancellationToken cancellationToken)
+    {
+        _ = await _tasks.GetByIdAsync(taskId, cancellationToken)
+            ?? throw new InvalidOperationException($"Task {taskId} not found.");
+
+        if (_planningMerge.HasActiveMerge(taskId))
+        {
+            await _planningMerge.AbortAsync(taskId, cancellationToken);
+        }
+        else
+        {
+            var r = await _merge.AbortMergeAsync(taskId, cancellationToken);
+            if (r.Status == TaskMergeService.StatusBlocked)
+                throw new InvalidOperationException(r.ErrorMessage ?? "abort failed");
+        }
+
+        await _broadcaster.TaskUpdated(taskId);
+        return ToDto((await _tasks.GetByIdAsync(taskId, cancellationToken))!);
+    }
+
     [McpServerTool, Description(
         "List all ClaudeDo-tracked worktrees. " +
         "Each entry: taskId, path, branch, headCommit (empty if path missing on disk), " +
@@ -617,8 +797,8 @@ public sealed class ExternalMcpService
     public async Task<TaskDto> SetMyDay(
         string taskId,
         bool isMyDay,
-        int? sortOrder,
-        CancellationToken cancellationToken)
+        int? sortOrder = null,
+        CancellationToken cancellationToken = default)
     {
         await using var ctx = await _dbFactory.CreateDbContextAsync(cancellationToken);
 

src/ClaudeDo.Worker/External/LifecycleMcpTools.cs

@@ -1,25 +1,11 @@
 using System.ComponentModel;
-using ClaudeDo.Data.Models;
 using ClaudeDo.Data.Repositories;
-using ClaudeDo.Worker.Agents;
 using ClaudeDo.Worker.Lifecycle;
 using ModelContextProtocol.Server;
 using TaskStatus = ClaudeDo.Data.Models.TaskStatus;
 
 namespace ClaudeDo.Worker.External;
 
-[McpServerToolType]
-public sealed class AgentMcpTools
-{
-    private readonly AgentFileService _agents;
-
-    public AgentMcpTools(AgentFileService agents) => _agents = agents;
-
-    [McpServerTool, Description("List available agent definition files (name, description, path) for use as a task's agent path.")]
-    public async Task<IReadOnlyList<AgentInfo>> ListAgents(CancellationToken cancellationToken)
-        => await _agents.ScanAsync(cancellationToken);
-}
-
 [McpServerToolType]
 public sealed class LifecycleMcpTools
 {

src/ClaudeDo.Worker/External/ListMcpTools.cs

@@ -22,7 +22,7 @@ public sealed class ListMcpTools
 
     [McpServerTool, Description("Create a new task list. workingDir sets the git repo tasks run against; commitType defaults to 'chore'.")]
     public async Task<ListSummaryDto> CreateList(
-        string name, string? workingDir, string? commitType, CancellationToken cancellationToken)
+        string name, string? workingDir = null, string? commitType = null, CancellationToken cancellationToken = default)
     {
         if (string.IsNullOrWhiteSpace(name))
             throw new InvalidOperationException("name is required.");
@@ -42,7 +42,8 @@ public sealed class ListMcpTools
 
     [McpServerTool, Description("Rename a list and/or change its working dir and default commit type. Pass null to leave a field unchanged.")]
     public async Task<ListSummaryDto> UpdateList(
-        string listId, string? name, string? workingDir, string? commitType, CancellationToken cancellationToken)
+        string listId, string? name = null, string? workingDir = null, string? commitType = null,
+        CancellationToken cancellationToken = default)
     {
         var entity = await _lists.GetByIdAsync(listId, cancellationToken)
             ?? throw new InvalidOperationException($"List {listId} not found.");

src/ClaudeDo.Worker/Hub/WorkerHub.cs

@@ -130,6 +130,7 @@ public sealed class WorkerHub : Microsoft.AspNetCore.SignalR.Hub
     private readonly LogRingBuffer? _logBuffer;
     private readonly ISessionSkillRegistry _skillRegistry;
     private readonly IInteractiveLaunchSpecService? _interactiveLaunchSpec;
+    private readonly WorktreeManager? _worktreeManager;
 
     public WorkerHub(
         QueueService queue,
@@ -157,7 +158,8 @@ public sealed class WorkerHub : Microsoft.AspNetCore.SignalR.Hub
         Runner.PendingQuestionRegistry pendingQuestions,
         ISessionSkillRegistry skillRegistry,
         LogRingBuffer? logBuffer = null,
-        IInteractiveLaunchSpecService? interactiveLaunchSpec = null)
+        IInteractiveLaunchSpecService? interactiveLaunchSpec = null,
+        WorktreeManager? worktreeManager = null)
     {
         _queue = queue;
         _waker = waker;
@@ -185,6 +187,7 @@ public sealed class WorkerHub : Microsoft.AspNetCore.SignalR.Hub
         _skillRegistry = skillRegistry;
         _logBuffer = logBuffer;
         _interactiveLaunchSpec = interactiveLaunchSpec;
+        _worktreeManager = worktreeManager;
     }
 
     // Persistence boundary for the session_skills JSON-array columns (task/list/global).
@@ -673,6 +676,82 @@ public sealed class WorkerHub : Microsoft.AspNetCore.SignalR.Hub
         return _interactiveLaunchSpec.BuildForDirectoryAsync(directory, Context.ConnectionAborted);
     });
 
+    // Builds the launch spec for an embedded ConPTY "merge helper" session that drives the given
+    // tasks to a merged/Done state via the mcp__claudedo__* tools. listId scopes the brief label
+    // and cwd to that list; null means all lists.
+    public Task<LaunchSpec> GetMergeHelperLaunchSpec(string[] taskIds, string? listId) => HubGuard(() =>
+    {
+        if (_interactiveLaunchSpec is null)
+            throw new InvalidOperationException("Interactive launch spec service is not configured.");
+        return _interactiveLaunchSpec.BuildForMergeHelperAsync(taskIds, listId, Context.ConnectionAborted);
+    });
+
+    // Starts a planning session (worktree + prompt files + token, task -> Planning) and returns
+    // the launch spec for an embedded ConPTY planning terminal -- the ConPTY replacement for
+    // StartPlanningSessionAsync's external wt window. On any spec-build failure the just-started
+    // session is discarded (no children exist yet), mirroring StartPlanningSessionAsync.
+    public Task<LaunchSpec> GetPlanningStartLaunchSpec(string taskId) => HubGuard(async () =>
+    {
+        if (_interactiveLaunchSpec is null)
+            throw new InvalidOperationException("Interactive launch spec service is not configured.");
+        var ctx = await _planning.StartAsync(taskId, Context.ConnectionAborted);
+        try
+        {
+            var spec = _interactiveLaunchSpec.BuildPlanningStart(ctx);
+            await Clients.All.SendAsync("TaskUpdated", taskId);
+            return spec;
+        }
+        catch
+        {
+            await _planning.DiscardAsync(taskId, dequeueQueuedChildren: true, Context.ConnectionAborted);
+            throw;
+        }
+    });
+
+    // Resumes a planning session and returns the ConPTY launch spec (--permission-mode plan
+    // --resume). ConPTY replacement for ResumePlanningSessionAsync's external wt window.
+    public Task<LaunchSpec> GetPlanningResumeLaunchSpec(string taskId) => HubGuard(async () =>
+    {
+        if (_interactiveLaunchSpec is null)
+            throw new InvalidOperationException("Interactive launch spec service is not configured.");
+        var ctx = await _planning.ResumeAsync(taskId, Context.ConnectionAborted);
+        return _interactiveLaunchSpec.BuildPlanningResume(ctx);
+    });
+
+    // Submits an interactively-worked task for review: commits whatever the ConPTY session left
+    // in the worktree (so there is a diff to merge), then transitions Idle/Failed -> WaitingForReview.
+    // The normal Approve flow then merges it. This is the only path that flips a hand-driven session
+    // into the review pipeline — a ConPTY session never touches task status on its own.
+    public Task SubmitTaskForReview(string taskId) => HubGuard(async () =>
+    {
+        if (_worktreeManager is null)
+            throw new InvalidOperationException("Worktree manager is not configured.");
+
+        await using var ctx = await _dbFactory.CreateDbContextAsync();
+        var task = await new TaskRepository(ctx).GetByIdAsync(taskId, Context.ConnectionAborted)
+            ?? throw new KeyNotFoundException();
+        if (task.Status is TaskStatus.Running or TaskStatus.Queued)
+            throw new InvalidOperationException("Can't submit a running or queued task — interrupt it first.");
+        if (task.Status is TaskStatus.WaitingForReview or TaskStatus.WaitingForChildren)
+            throw new InvalidOperationException("Task is already awaiting review.");
+
+        var worktree = await new WorktreeRepository(ctx).GetByTaskIdAsync(taskId, Context.ConnectionAborted);
+        if (worktree is null || worktree.State is not (WorktreeState.Active or WorktreeState.Kept))
+            throw new InvalidOperationException("This task has no active worktree to submit.");
+        if (!Directory.Exists(worktree.Path))
+            throw new InvalidOperationException("The task's worktree directory no longer exists.");
+
+        var list = await new ListRepository(ctx).GetByIdAsync(task.ListId, Context.ConnectionAborted)
+            ?? throw new InvalidOperationException("Task list not found.");
+
+        var wtCtx = new WorktreeContext(worktree.Path, worktree.BranchName, worktree.BaseCommit);
+        await _worktreeManager.CommitIfChangedAsync(wtCtx, task, list, Context.ConnectionAborted);
+
+        var result = await _state.SubmitInteractiveForReviewAsync(taskId, DateTime.UtcNow, Context.ConnectionAborted);
+        if (!result.Ok)
+            throw new InvalidOperationException(result.Reason ?? "Could not submit for review.");
+    });
+
     public async Task<DiscardPlanningOutcome> DiscardPlanningSessionAsync(string taskId, bool dequeueQueuedChildren = false)
     {
         var outcome = await _planning.DiscardAsync(taskId, dequeueQueuedChildren, Context.ConnectionAborted);

src/ClaudeDo.Worker/Lifecycle/TaskMergeService.cs

@@ -115,7 +115,7 @@ public sealed class TaskMergeService
             return Blocked("working directory is not a git repository");
         if (await _git.IsMidMergeAsync(list.WorkingDir, ct))
             return Blocked("target working directory is mid-merge");
-        if (await _git.HasChangesAsync(list.WorkingDir, ct))
+        if (await _git.HasChangesAsync(list.WorkingDir, includeUntracked: false, ct))
             return Blocked("target working tree has uncommitted changes");
 
         var currentBranch = await _git.GetCurrentBranchAsync(list.WorkingDir, ct);
@@ -204,6 +204,26 @@ public sealed class TaskMergeService
         if (!await _git.IsMidMergeAsync(list.WorkingDir, ct))
             return Blocked("repo is not mid-merge");
 
+        // Validate BEFORE staging: `git add` marks a conflicted path resolved regardless of
+        // its content, so an unresolved file with markers still in it would otherwise get
+        // staged (and committed) as-is. Check text content for markers first; binary files
+        // can't carry markers, so they're left to the post-stage index check below.
+        var unresolved = await _git.ListConflictedFilesAsync(list.WorkingDir, ct);
+        var stillConflicted = new List<string>();
+        foreach (var path in unresolved)
+        {
+            var full = Path.Combine(list.WorkingDir, path.Replace('/', Path.DirectorySeparatorChar));
+            string text;
+            try { text = await File.ReadAllTextAsync(full, ct); }
+            catch { continue; }
+
+            if (!LooksBinary(text) && ConflictMarkerParser.HasConflicts(text))
+                stillConflicted.Add(path);
+        }
+
+        if (stillConflicted.Count > 0)
+            return new MergeResult(StatusConflict, stillConflicted, "conflicts not fully resolved");
+
         await _git.AddAllAsync(list.WorkingDir, ct);
 
         var remaining = await _git.ListConflictedFilesAsync(list.WorkingDir, ct);
@@ -322,7 +342,11 @@ public sealed class TaskMergeService
         return new MergePreviewResult(PreviewClean, Array.Empty<string>(), count);
     }
 
-    public async Task<MergeResult> ApproveAndMergeAsync(string taskId, string targetBranch, CancellationToken ct)
+    public Task<MergeResult> ApproveAndMergeAsync(string taskId, string targetBranch, CancellationToken ct)
+        => ApproveAndMergeAsync(taskId, targetBranch, leaveConflictsInTree: false, ct);
+
+    public async Task<MergeResult> ApproveAndMergeAsync(
+        string taskId, string targetBranch, bool leaveConflictsInTree, CancellationToken ct)
     {
         var (task, list, wt) = await LoadMergeContextAsync(taskId, ct);
 
@@ -347,7 +371,7 @@ public sealed class TaskMergeService
         // MergeAsync transitions the task WaitingForReview -> Done on a successful merge.
         // Remove the worktree on approve (matching the unit-merge path) so merged
         // worktrees don't pile up; the merge commit on the target branch is the record.
-        return await MergeAsync(taskId, target, removeWorktree: true, $"Merge {wt.BranchName}", ct);
+        return await MergeAsync(taskId, target, removeWorktree: true, $"Merge {wt.BranchName}", leaveConflictsInTree, ct);
     }
 
     private static MergeResult Blocked(string reason) =>

src/ClaudeDo.Worker/Planning/PlanningChainCoordinator.cs

@@ -92,14 +92,7 @@ public sealed class PlanningChainCoordinator
     public async Task<string?> OnChildFinishedAsync(
         string childTaskId, TaskStatus finalStatus, CancellationToken ct = default)
     {
-        await using var ctx = await _dbFactory.CreateDbContextAsync(ct);
-        // The successor is whichever sibling explicitly blocks on this child.
-        var nextId = await ctx.Tasks
-            .AsNoTracking()
-            .Where(t => t.BlockedByTaskId == childTaskId)
-            .OrderBy(t => t.SortOrder).ThenBy(t => t.CreatedAt)
-            .Select(t => t.Id)
-            .FirstOrDefaultAsync(ct);
+        var nextId = await FindSuccessorAsync(childTaskId, ct);
         if (nextId is null) return null;
 
         if (finalStatus == TaskStatus.Done)
@@ -108,10 +101,33 @@ public sealed class PlanningChainCoordinator
             return nextId;
         }
 
-        // Child failed or was cancelled: cancel the immediate successor so the chain
-        // is not left wedged. CancelAsync triggers OnChildTerminalAsync → OnChildFinishedAsync
-        // for that successor, cascading cancellation through the rest of the chain.
-        await _state().CancelAsync(nextId, DateTime.UtcNow, ct);
-        return null;
+        // Child failed or was cancelled: cancel the immediate successor so the chain is
+        // not left wedged. If it's cancellable, CancelAsync's own OnChildTerminalAsync
+        // callback recurses into this method for its successor, cascading cancellation
+        // through the rest of the chain. If it's not (e.g. it was parked back to Idle
+        // out of band), CancelAsync is a no-op and nothing will ever call back for it —
+        // keep walking the chain ourselves so the tail isn't left wedged forever.
+        var predecessorId = nextId;
+        while (true)
+        {
+            var result = await _state().CancelAsync(predecessorId, DateTime.UtcNow, ct);
+            if (result.Ok) return null;
+
+            var following = await FindSuccessorAsync(predecessorId, ct);
+            if (following is null) return null;
+            predecessorId = following;
+        }
+    }
+
+    // The successor is whichever sibling explicitly blocks on this task.
+    private async Task<string?> FindSuccessorAsync(string taskId, CancellationToken ct)
+    {
+        await using var ctx = await _dbFactory.CreateDbContextAsync(ct);
+        return await ctx.Tasks
+            .AsNoTracking()
+            .Where(t => t.BlockedByTaskId == taskId)
+            .OrderBy(t => t.SortOrder).ThenBy(t => t.CreatedAt)
+            .Select(t => t.Id)
+            .FirstOrDefaultAsync(ct);
     }
 }

src/ClaudeDo.Worker/Planning/PlanningMergeOrchestrator.cs

@@ -87,7 +87,7 @@ public sealed class PlanningMergeOrchestrator
         if (await _git.IsMidMergeAsync(workingDir, ct))
             throw new InvalidOperationException(
                 "repo is mid-merge; use AbortPlanningMerge to reset the repository, then Approve again");
-        if (await _git.HasChangesAsync(workingDir, ct))
+        if (await _git.HasChangesAsync(workingDir, includeUntracked: false, ct))
             throw new InvalidOperationException("working tree has uncommitted changes");
 
         var idsToMerge = new List<string>();
@@ -108,6 +108,10 @@ public sealed class PlanningMergeOrchestrator
         await DrainAsync(parentTaskId, ct);
     }
 
+    /// <summary>True when a unit merge for this parent is paused on a conflict (in-memory state).</summary>
+    public bool HasActiveMerge(string parentTaskId) =>
+        _states.TryGetValue(parentTaskId, out var s) && s.CurrentSubtaskId is not null;
+
     public async Task ContinueAsync(string planningTaskId, CancellationToken ct)
     {
         if (!_states.TryGetValue(planningTaskId, out var state) || state.CurrentSubtaskId is null)

src/ClaudeDo.Worker/Planning/WindowsTerminalLauncher.cs

@@ -74,11 +74,7 @@ public sealed class WindowsTerminalLauncher : ITerminalLauncher
         var resolvedWt = ResolveWtOrThrow();
         var resolvedClaude = ResolveClaudeOrThrow();
 
-        var command = BuildPwshCommand(resolvedClaude, new[]
-        {
-            "--permission-mode", "plan",
-            "--resume", ctx.ClaudeSessionId,
-        });
+        var command = BuildPwshCommand(resolvedClaude, BuildPlanningResumeArgs(ctx.ClaudeSessionId));
 
         StartInWindowsTerminal(resolvedWt, ctx.WorkingDir, command, env =>
         {
@@ -103,8 +99,8 @@ public sealed class WindowsTerminalLauncher : ITerminalLauncher
         return Task.CompletedTask;
     }
 
-    // Resumes a session by id in default (interactive) permission mode: the user drives
-    // tool approvals in the terminal, unlike planning which pins --permission-mode plan.
+    // Resumes a session by id with no extra flags: the user drives every tool approval in the
+    // terminal, unlike planning which additionally allowlists its MCP planning tools.
     internal static string BuildResumeCommand(string claudePath, string claudeSessionId) =>
         BuildPwshCommand(claudePath, BuildResumeArgs(claudeSessionId));
 
@@ -117,23 +113,42 @@ public sealed class WindowsTerminalLauncher : ITerminalLauncher
     // Arg order matters: variadic flags (--allowedTools, --add-dir) come first; the
     // single-line kickoff prompt is positional, so it must follow a single-value flag
     // (--append-system-prompt-file) or a variadic flag would swallow it.
-    internal static string BuildPlanningStartCommand(string claudePath, PlanningSessionStartContext ctx)
+    internal static string BuildPlanningStartCommand(string claudePath, PlanningSessionStartContext ctx) =>
+        BuildPwshCommand(claudePath, BuildPlanningStartArgs(ctx));
+
+    // The raw claude CLI args for an interactive planning START, shared with the embedded-ConPTY
+    // planning path (InteractiveLaunchSpecService), which needs the bare Exe/Args pair rather than
+    // a pwsh-wrapped command line. Arg order matters: variadic flags (--allowedTools, --add-dir)
+    // come first; the single-line kickoff prompt is positional, so it must follow a single-value
+    // flag (--append-system-prompt-file) or a variadic flag would swallow it.
+    internal static IReadOnlyList<string> BuildPlanningStartArgs(PlanningSessionStartContext ctx)
     {
         var kickoff =
             $"Read the file {ctx.Files.InitialPromptPath} first. It contains the task you must plan. " +
             "After reading it, begin the planning session as your instructions describe.";
 
-        return BuildPwshCommand(claudePath, new[]
+        return new[]
         {
             "--model", Model,
-            "--permission-mode", "plan",
+            // NOT --permission-mode plan: plan mode gates EVERY MCP tool call regardless of
+            // --allowedTools, so the session would prompt the user on the first CreateChildTask
+            // (the whole point of a planning session). Default mode honours the allowlist below,
+            // and file edits stay blocked anyway — the planning system prompt forbids them and
+            // AllowedTools omits Write/Edit/Bash (an unexpected edit would prompt, not run silently).
+            "--permission-mode", "default",
             "--allowedTools", AllowedTools,
             "--add-dir", ctx.Files.SessionDirectory,
             "--append-system-prompt-file", ctx.Files.SystemPromptPath,
             kickoff,
-        });
+        };
     }
 
+    // The raw claude CLI args for an interactive planning RESUME, shared with the embedded-ConPTY
+    // planning path. Re-passes the planning allowlist in default mode (not --resume alone): the CLI
+    // does not restore --allowedTools across a resume, and plan mode would gate the MCP tools.
+    internal static IReadOnlyList<string> BuildPlanningResumeArgs(string claudeSessionId) =>
+        new[] { "--permission-mode", "default", "--allowedTools", AllowedTools, "--resume", claudeSessionId };
+
     private string ResolveWtOrThrow() =>
         Resolve(_wtPath) ?? throw new TerminalLaunchException($"Windows Terminal not found: {_wtPath}");
 

src/ClaudeDo.Worker/Program.cs

@@ -92,6 +92,7 @@ builder.Services.AddSingleton<PlanningChainCoordinator>();
 builder.Services.AddSingleton<QueueWaker>();
 builder.Services.AddSingleton<IQueueWaker>(sp => sp.GetRequiredService<QueueWaker>());
 builder.Services.AddSingleton<IQueuePicker, QueuePicker>();
+builder.Services.AddSingleton<RunCancellationRegistry>();
 
 builder.Services.AddSingleton<Func<ITaskStateService>>(sp => () => sp.GetRequiredService<ITaskStateService>());
 builder.Services.AddSingleton<ITaskStateService>(sp => new TaskStateService(
@@ -99,6 +100,7 @@ builder.Services.AddSingleton<ITaskStateService>(sp => new TaskStateService(
     sp.GetRequiredService<HubBroadcaster>(),
     sp.GetRequiredService<IQueueWaker>(),
     sp.GetRequiredService<PlanningChainCoordinator>(),
+    sp.GetRequiredService<RunCancellationRegistry>(),
     sp.GetRequiredService<ILogger<TaskStateService>>()));
 
 // Agent file management.
@@ -269,6 +271,7 @@ if (cfg.ExternalMcpPort > 0)
     externalBuilder.Services.AddSingleton(app.Services.GetRequiredService<GitService>());
     externalBuilder.Services.AddSingleton(app.Services.GetRequiredService<WorktreeMaintenanceService>());
     externalBuilder.Services.AddSingleton(app.Services.GetRequiredService<TaskMergeService>());
+    externalBuilder.Services.AddSingleton(app.Services.GetRequiredService<PlanningMergeOrchestrator>());
     externalBuilder.Services.AddScoped<ExternalMcpService>();
     externalBuilder.Services.AddScoped<BatchMcpTools>();
     externalBuilder.Services.AddScoped<ListMcpTools>();
@@ -282,6 +285,7 @@ if (cfg.ExternalMcpPort > 0)
     externalBuilder.Services.AddScoped<AttachmentMcpTools>();
     externalBuilder.Services.AddMcpServer()
         .WithHttpTransport()
+        .WithRequestFilters(f => f.AddCallToolFilter(ExternalMcpExceptionFilter.Wrap))
         .WithTools<ExternalMcpService>()
         .WithTools<BatchMcpTools>()
         .WithTools<ListMcpTools>()

src/ClaudeDo.Worker/Queue/OverrideSlotService.cs

@@ -10,6 +10,7 @@ public sealed class OverrideSlotService
     private readonly IDbContextFactory<ClaudeDoDbContext> _dbFactory;
     private readonly TaskRunner _runner;
     private readonly ILogger<OverrideSlotService> _logger;
+    private readonly RunCancellationRegistry _runCancels;
 
     private readonly object _lock = new();
     private volatile QueueSlotState? _slot;
@@ -17,11 +18,13 @@ public sealed class OverrideSlotService
     public OverrideSlotService(
         IDbContextFactory<ClaudeDoDbContext> dbFactory,
         TaskRunner runner,
-        ILogger<OverrideSlotService> logger)
+        ILogger<OverrideSlotService> logger,
+        RunCancellationRegistry runCancels)
     {
         _dbFactory = dbFactory;
         _runner = runner;
         _logger = logger;
+        _runCancels = runCancels;
     }
 
     public QueueSlotState? CurrentSlot => _slot;
@@ -66,12 +69,14 @@ public sealed class OverrideSlotService
 
             var cts = new CancellationTokenSource();
             _slot = new QueueSlotState { TaskId = taskId, StartedAt = DateTime.UtcNow, Cts = cts };
+            _runCancels.Register(taskId, cts);
 
             _ = work(cts.Token).ContinueWith(t =>
             {
                 if (t.IsFaulted)
                     _logger.LogError(t.Exception, faultMessage, taskId);
                 lock (_lock) { _slot = null; }
+                _runCancels.Unregister(taskId, cts);
                 cts.Dispose();
             }, TaskScheduler.Default);
         }

src/ClaudeDo.Worker/Queue/QueueService.cs

@@ -19,6 +19,7 @@ public sealed class QueueService : BackgroundService
     private readonly IQueuePicker _picker;
     private readonly OverrideSlotService _override;
     private readonly ITaskStateService _state;
+    private readonly RunCancellationRegistry _runCancels;
 
     private readonly object _lock = new();
     private readonly Dictionary<string, QueueSlotState> _queueSlots = new();
@@ -31,7 +32,8 @@ public sealed class QueueService : BackgroundService
         QueueWaker waker,
         IQueuePicker picker,
         OverrideSlotService overrideSlot,
-        ITaskStateService state)
+        ITaskStateService state,
+        RunCancellationRegistry runCancels)
     {
         _dbFactory = dbFactory;
         _runner = runner;
@@ -41,6 +43,7 @@ public sealed class QueueService : BackgroundService
         _picker = picker;
         _override = overrideSlot;
         _state = state;
+        _runCancels = runCancels;
     }
 
     public IReadOnlyList<(string slot, string taskId, DateTime startedAt)> GetActive()
@@ -125,12 +128,14 @@ public sealed class QueueService : BackgroundService
                     {
                         var cts = CancellationTokenSource.CreateLinkedTokenSource(stoppingToken);
                         _queueSlots[task.Id] = new QueueSlotState { TaskId = task.Id, StartedAt = DateTime.UtcNow, Cts = cts };
+                        _runCancels.Register(task.Id, cts);
 
                         _ = RunInSlotAsync(task.Id, cts.Token).ContinueWith(t =>
                         {
                             if (t.IsFaulted)
                                 _logger.LogError(t.Exception, "RunInSlotAsync failed for task {TaskId} in queue slot", task.Id);
                             lock (_lock) { _queueSlots.Remove(task.Id); }
+                            _runCancels.Unregister(task.Id, cts);
                             cts.Dispose();
                             _waker.Wake(); // Check for next task immediately.
                         }, TaskScheduler.Default);

src/ClaudeDo.Worker/Queue/RunCancellationRegistry.cs

@@ -0,0 +1,35 @@
+using System.Collections.Concurrent;
+
+namespace ClaudeDo.Worker.Queue;
+
+/// Maps a running task id to the CancellationTokenSource driving its Claude process.
+/// QueueService and OverrideSlotService register their slots here so components that
+/// cancel tasks DB-side (TaskStateService.CancelAsync and its child cascade) can also
+/// stop the process — without depending on the queue services, which would create a
+/// DI cycle (QueueService → TaskRunner → ITaskStateService).
+public sealed class RunCancellationRegistry
+{
+    private readonly ConcurrentDictionary<string, CancellationTokenSource> _running = new(StringComparer.Ordinal);
+
+    public void Register(string taskId, CancellationTokenSource cts) => _running[taskId] = cts;
+
+    /// Removes the registration only if <paramref name="cts"/> is still the registered
+    /// one — a re-run may already have registered a newer CTS under the same task id.
+    public void Unregister(string taskId, CancellationTokenSource cts) =>
+        _running.TryRemove(new KeyValuePair<string, CancellationTokenSource>(taskId, cts));
+
+    public bool TryCancel(string taskId)
+    {
+        if (!_running.TryGetValue(taskId, out var cts)) return false;
+        try
+        {
+            cts.Cancel();
+            return true;
+        }
+        catch (ObjectDisposedException)
+        {
+            // Slot cleanup raced us; the run is already finished.
+            return false;
+        }
+    }
+}

src/ClaudeDo.Worker/Runner/InteractiveLaunchSpecService.cs

@@ -107,6 +107,40 @@ public sealed class InteractiveLaunchSpecService : IInteractiveLaunchSpecService
         return new LaunchSpec(worktree.Path, resolvedClaude, args, env);
     }
 
+    public LaunchSpec BuildPlanningStart(PlanningSessionStartContext ctx)
+    {
+        var resolvedClaude = WindowsTerminalLauncher.Resolve(_claudePath)
+            ?? throw new InvalidOperationException($"claude executable not found: {_claudePath}");
+
+        // Mirrors the env the wt planning launcher set (MAX_THINKING_TOKENS + the per-session
+        // planning token); MCP_TOOL_TIMEOUT matches the other embedded-ConPTY specs. Applied to
+        // the UI process env at spawn time (see PtyTerminalSession) — process-global by design.
+        var env = new Dictionary<string, string>
+        {
+            ["MAX_THINKING_TOKENS"] = "20000",
+            ["CLAUDEDO_PLANNING_TOKEN"] = ctx.Token,
+            ["MCP_TOOL_TIMEOUT"] = "200000",
+        };
+
+        return new LaunchSpec(
+            ctx.WorkingDir, resolvedClaude, WindowsTerminalLauncher.BuildPlanningStartArgs(ctx), env);
+    }
+
+    public LaunchSpec BuildPlanningResume(PlanningSessionResumeContext ctx)
+    {
+        var resolvedClaude = WindowsTerminalLauncher.Resolve(_claudePath)
+            ?? throw new InvalidOperationException($"claude executable not found: {_claudePath}");
+
+        var env = new Dictionary<string, string>
+        {
+            ["CLAUDEDO_PLANNING_TOKEN"] = ctx.Token,
+            ["MCP_TOOL_TIMEOUT"] = "200000",
+        };
+
+        return new LaunchSpec(
+            ctx.WorkingDir, resolvedClaude, WindowsTerminalLauncher.BuildPlanningResumeArgs(ctx.ClaudeSessionId), env);
+    }
+
     public Task<LaunchSpec> BuildForDirectoryAsync(string directory, CancellationToken ct)
     {
         if (!Directory.Exists(directory))
@@ -123,6 +157,101 @@ public sealed class InteractiveLaunchSpecService : IInteractiveLaunchSpecService
         return Task.FromResult(new LaunchSpec(directory, resolvedClaude, Array.Empty<string>(), env));
     }
 
+    // Tools the merge helper may use without prompting: the claudedo MCP surface (run, poll,
+    // diff, review/merge, continue/abort merge), read/search, Edit + Bash for hand-resolving
+    // conflict markers the MCP tools left behind, and web/skill lookups.
+    private const string MergeHelperAllowedTools =
+        "mcp__claudedo__*,Read,Grep,Glob,Edit,Bash,WebFetch,WebSearch,Skill";
+
+    public async Task<LaunchSpec> BuildForMergeHelperAsync(IReadOnlyList<string> taskIds, string? listId, CancellationToken ct)
+    {
+        if (taskIds.Count == 0)
+            throw new InvalidOperationException("No tasks selected for the merge helper.");
+
+        await using var ctx = await _dbFactory.CreateDbContextAsync(ct);
+        var taskRepo = new TaskRepository(ctx);
+        var listRepo = new ListRepository(ctx);
+
+        var listsById = new Dictionary<string, ListEntity?>();
+        var briefLines = new List<string>();
+        var repoDirs = new List<string>(); // distinct, existing, in first-seen order
+
+        foreach (var id in taskIds)
+        {
+            var task = await taskRepo.GetByIdAsync(id, ct)
+                ?? throw new KeyNotFoundException($"Task not found: {id}");
+            if (!listsById.TryGetValue(task.ListId, out var list))
+                listsById[task.ListId] = list = await listRepo.GetByIdAsync(task.ListId, ct);
+
+            var workingDir = list?.WorkingDir;
+            if (!string.IsNullOrEmpty(workingDir) && Directory.Exists(workingDir) && !repoDirs.Contains(workingDir))
+                repoDirs.Add(workingDir);
+
+            briefLines.Add(
+                $"- [{task.Status}] {task.Title} (id: {task.Id}, list: {list?.Name ?? "—"}, " +
+                $"repo: {(string.IsNullOrEmpty(workingDir) ? "—" : workingDir)})");
+        }
+
+        if (repoDirs.Count == 0)
+            throw new InvalidOperationException("none of the selected tasks are in a working directory");
+
+        string scopeLabel;
+        string cwd;
+        if (listId is not null)
+        {
+            var scopeList = await listRepo.GetByIdAsync(listId, ct)
+                ?? throw new KeyNotFoundException($"List not found: {listId}");
+            scopeLabel = $"List: {scopeList.Name}";
+            cwd = scopeList.WorkingDir is { Length: > 0 } wd && Directory.Exists(wd) ? wd : repoDirs[0];
+        }
+        else
+        {
+            scopeLabel = "All lists";
+            cwd = repoDirs[0];
+        }
+
+        var sessionDir = Path.Combine(Paths.AppDataRoot(), "merge-helper-sessions", Guid.NewGuid().ToString());
+        Directory.CreateDirectory(sessionDir);
+
+        var systemPromptPath = Path.Combine(sessionDir, "system-prompt.md");
+        await File.WriteAllTextAsync(systemPromptPath, PromptFiles.ReadOrDefault(PromptKind.MergeHelper), ct);
+
+        var briefPath = Path.Combine(sessionDir, "brief.md");
+        await File.WriteAllTextAsync(briefPath, PromptFiles.Render(PromptKind.MergeHelperInitial,
+            new Dictionary<string, string>
+            {
+                ["scope"] = scopeLabel,
+                ["tasks"] = string.Join("\n", briefLines),
+            }), ct);
+
+        var resolvedClaude = WindowsTerminalLauncher.Resolve(_claudePath)
+            ?? throw new InvalidOperationException($"claude executable not found: {_claudePath}");
+
+        // Mirrors WindowsTerminalLauncher.BuildPlanningStartArgs ordering: variadic flags
+        // (--allowedTools, --add-dir) first, then a single-value flag, then the single-line
+        // positional kickoff LAST — a multi-line positional prompt truncates at the first
+        // newline, so the full multi-line brief travels via the file exposed through --add-dir.
+        var args = new List<string>
+        {
+            "--permission-mode", "default",
+            "--allowedTools", MergeHelperAllowedTools,
+            "--add-dir", sessionDir,
+        };
+        args.AddRange(repoDirs);
+        args.Add("--append-system-prompt-file");
+        args.Add(systemPromptPath);
+        args.Add(
+            $"Read the file {briefPath} first. It lists the tasks you must merge and their status. " +
+            "After reading it, begin the merge-helper session as your instructions describe.");
+
+        var env = new Dictionary<string, string>
+        {
+            ["MCP_TOOL_TIMEOUT"] = "200000",
+        };
+
+        return new LaunchSpec(cwd, resolvedClaude, args, env);
+    }
+
     // The positional prompt claude opens the interactive session on. Empty (no positional arg)
     // if the task has neither a title nor a description.
     private static IReadOnlyList<string> BuildFreshPromptArgs(TaskEntity task)

src/ClaudeDo.Worker/Runner/Interfaces/IInteractiveLaunchSpecService.cs

@@ -1,7 +1,18 @@
+using ClaudeDo.Worker.Planning;
+
 namespace ClaudeDo.Worker.Runner;
 
 public interface IInteractiveLaunchSpecService
 {
+    /// <summary>Maps an already-prepared planning START context (worktree + prompt files + token,
+    /// produced by PlanningSessionManager.StartAsync) into a LaunchSpec for an embedded ConPTY
+    /// planning session — same planning CLI args as the wt launcher, planning env carried in Env.</summary>
+    LaunchSpec BuildPlanningStart(PlanningSessionStartContext ctx);
+
+    /// <summary>Maps a planning RESUME context (from PlanningSessionManager.ResumeAsync) into a
+    /// LaunchSpec for an embedded ConPTY planning session (--permission-mode plan --resume).</summary>
+    LaunchSpec BuildPlanningResume(PlanningSessionResumeContext ctx);
+
     /// <summary>Builds a LaunchSpec for opening an interactive session in a task's worktree.
     /// Throws KeyNotFoundException if the task doesn't exist, InvalidOperationException
     /// if it's Running/Queued. If the task has no usable worktree yet, one is created on
@@ -15,4 +26,12 @@ public interface IInteractiveLaunchSpecService
     /// no task, no worktree, no session-skills seeding. Throws InvalidOperationException if the
     /// directory doesn't exist.</summary>
     Task<LaunchSpec> BuildForDirectoryAsync(string directory, CancellationToken ct);
+
+    /// <summary>Builds a LaunchSpec for an embedded ConPTY "merge helper" session that drives the
+    /// given tasks to a merged/Done state via the mcp__claudedo__* tools. Writes a per-session
+    /// system prompt + task brief under ~/.todo-app/merge-helper-sessions/&lt;guid&gt; and exposes
+    /// that dir plus every distinct existing repo dir via --add-dir. listId scopes the brief label
+    /// and the cwd to that list; null means all lists (cwd = first existing repo dir). Throws
+    /// InvalidOperationException if taskIds is empty or no task has an existing working directory.</summary>
+    Task<LaunchSpec> BuildForMergeHelperAsync(IReadOnlyList<string> taskIds, string? listId, CancellationToken ct);
 }

src/ClaudeDo.Worker/Runner/StreamAnalyzer.cs

@@ -91,16 +91,34 @@ public sealed class StreamAnalyzer
 
     private string? FallbackResult()
     {
+        // A --json-schema run sometimes echoes the structured JSON as the result text; unwrap
+        // that to its summary. A plain markdown result is kept verbatim (even when a separate
+        // structured_output is also present). Only when there is no result text do we fall back
+        // to the structured summary, then the raw JSON.
+        if (SummaryFromJson(_resultMarkdown) is { } fromResult) return fromResult;
         if (!string.IsNullOrEmpty(_resultMarkdown)) return _resultMarkdown;
-        if (_structuredOutputJson is null) return _resultMarkdown;
+        if (SummaryFromJson(_structuredOutputJson) is { } fromStructured) return fromStructured;
+        return _structuredOutputJson;
+    }
+
+    /// <summary>Extracts a non-empty string <c>summary</c> from a JSON object, or null when
+    /// the input isn't such an object (a plain markdown result parses to null and is kept).</summary>
+    private static string? SummaryFromJson(string? json)
+    {
+        if (string.IsNullOrWhiteSpace(json)) return null;
         try
         {
-            using var doc = JsonDocument.Parse(_structuredOutputJson);
-            if (doc.RootElement.TryGetProperty("summary", out var s))
-                return s.GetString();
+            using var doc = JsonDocument.Parse(json);
+            if (doc.RootElement.ValueKind == JsonValueKind.Object &&
+                doc.RootElement.TryGetProperty("summary", out var s) &&
+                s.ValueKind == JsonValueKind.String)
+            {
+                var text = s.GetString();
+                return string.IsNullOrWhiteSpace(text) ? null : text;
+            }
         }
         catch { }
-        return _structuredOutputJson;
+        return null;
     }
 
     private void CollectFromAssistant(JsonElement root)

src/ClaudeDo.Worker/State/Interfaces/ITaskStateService.cs

@@ -6,6 +6,7 @@ public interface ITaskStateService
     Task<TransitionResult> StartRunningAsync(string taskId, DateTime startedAt, CancellationToken ct);
     Task<TransitionResult> CompleteAsync(string taskId, DateTime finishedAt, string? result, CancellationToken ct);
     Task<TransitionResult> SubmitForReviewAsync(string taskId, DateTime finishedAt, string? result, CancellationToken ct);
+    Task<TransitionResult> SubmitInteractiveForReviewAsync(string taskId, DateTime finishedAt, CancellationToken ct);
     Task<TransitionResult> SubmitForChildrenAsync(string taskId, DateTime finishedAt, string? result, CancellationToken ct);
     Task<TransitionResult> FailAsync(string taskId, DateTime finishedAt, string? error, CancellationToken ct);
     Task<TransitionResult> CancelAsync(string taskId, DateTime finishedAt, CancellationToken ct);
@@ -24,5 +25,10 @@ public interface ITaskStateService
     Task<TransitionResult> BlockOnAsync(string taskId, string predecessorTaskId, CancellationToken ct);
     Task<TransitionResult> UnblockAsync(string taskId, CancellationToken ct);
 
+    // Surfaces a WaitingForChildren parent for review once all its children are terminal.
+    // Best-effort (swallows and logs failures) — safe to call after any child mutation,
+    // e.g. deleting the last non-terminal child (no terminal transition fires for a delete).
+    Task TryAdvanceParentAsync(string parentId);
+
     Task<int> RecoverStaleRunningAsync(string reason, CancellationToken ct);
 }

src/ClaudeDo.Worker/State/TaskStateService.cs

@@ -15,6 +15,7 @@ public sealed class TaskStateService : ITaskStateService
     private readonly HubBroadcaster _broadcaster;
     private readonly IQueueWaker _waker;
     private readonly PlanningChainCoordinator _chain;
+    private readonly RunCancellationRegistry _runCancels;
     private readonly ILogger<TaskStateService> _logger;
 
     public TaskStateService(
@@ -22,12 +23,14 @@ public sealed class TaskStateService : ITaskStateService
         HubBroadcaster broadcaster,
         IQueueWaker waker,
         PlanningChainCoordinator chain,
+        RunCancellationRegistry runCancels,
         ILogger<TaskStateService> logger)
     {
         _dbFactory = dbFactory;
         _broadcaster = broadcaster;
         _waker = waker;
         _chain = chain;
+        _runCancels = runCancels;
         _logger = logger;
     }
 
@@ -107,6 +110,26 @@ public sealed class TaskStateService : ITaskStateService
         return new TransitionResult(true, null);
     }
 
+    // Submit an interactively-worked task (a ConPTY session left its worktree with commits/changes)
+    // for review. Unlike SubmitForReviewAsync — which only fires from the headless Running state —
+    // this transitions from Idle or Failed, the states an interactive task sits in after the user
+    // finishes the session by hand. The caller commits the worktree first so there is a diff to merge.
+    public async Task<TransitionResult> SubmitInteractiveForReviewAsync(string taskId, DateTime finishedAt, CancellationToken ct)
+    {
+        await using var ctx = await _dbFactory.CreateDbContextAsync(ct);
+        var affected = await ctx.Tasks
+            .Where(t => t.Id == taskId && (t.Status == TaskStatus.Idle || t.Status == TaskStatus.Failed))
+            .ExecuteUpdateAsync(s => s
+                .SetProperty(t => t.Status, TaskStatus.WaitingForReview)
+                .SetProperty(t => t.FinishedAt, finishedAt), ct);
+
+        if (affected == 0)
+            return new TransitionResult(false, "Task is not Idle or Failed; cannot submit for review.");
+
+        await _broadcaster.TaskUpdated(taskId);
+        return new TransitionResult(true, null);
+    }
+
     public async Task<TransitionResult> SubmitForChildrenAsync(string taskId, DateTime finishedAt, string? result, CancellationToken ct)
     {
         await using var ctx = await _dbFactory.CreateDbContextAsync(ct);
@@ -220,6 +243,7 @@ public sealed class TaskStateService : ITaskStateService
 
     public async Task<TransitionResult> CancelAsync(string taskId, DateTime finishedAt, CancellationToken ct)
     {
+        List<string> cancelledChildIds;
         await using (var ctx = await _dbFactory.CreateDbContextAsync(ct))
         {
             var affected = await ctx.Tasks
@@ -233,10 +257,38 @@ public sealed class TaskStateService : ITaskStateService
 
             if (affected == 0)
                 return new TransitionResult(false, "Task not in cancellable state.");
+
+            // Cascade to this task's own non-terminal children (one level — children are
+            // leaves in the current model) so a Queued/Running child doesn't keep going
+            // against a parent that's already gone, orphaning its worktree commit.
+            cancelledChildIds = await ctx.Tasks
+                .Where(t => t.ParentTaskId == taskId
+                    && t.Status != TaskStatus.Done
+                    && t.Status != TaskStatus.Failed
+                    && t.Status != TaskStatus.Cancelled)
+                .Select(t => t.Id)
+                .ToListAsync(ct);
+
+            if (cancelledChildIds.Count > 0)
+                await ctx.Tasks
+                    .Where(t => cancelledChildIds.Contains(t.Id))
+                    .ExecuteUpdateAsync(s => s
+                        .SetProperty(t => t.Status, TaskStatus.Cancelled)
+                        .SetProperty(t => t.FinishedAt, finishedAt)
+                        .SetProperty(t => t.BlockedByTaskId, (string?)null), ct);
         }
 
+        // Also stop the actual Claude processes: the DB flip above doesn't reach a run
+        // already executing in a queue/override slot — without this it would keep going
+        // and only fail its final (now-invalid) transition.
+        _runCancels.TryCancel(taskId);
+        foreach (var childId in cancelledChildIds)
+            _runCancels.TryCancel(childId);
+
         await OnChildTerminalAsync(taskId, TaskStatus.Cancelled);
         await _broadcaster.TaskUpdated(taskId);
+        foreach (var childId in cancelledChildIds)
+            await _broadcaster.TaskUpdated(childId);
         return new TransitionResult(true, null);
     }
 
@@ -395,9 +447,18 @@ public sealed class TaskStateService : ITaskStateService
             _logger.LogWarning(ex, "PlanningChain advance failed for {TaskId}", taskId);
         }
 
+        await TryAdvanceParentAsync(parentId);
+    }
+
+    // Any parent (planning or improvement) sitting in WaitingForChildren surfaces for review
+    // once every child is terminal (Done/Failed/Cancelled). A failed or cancelled child does
+    // not wedge the parent — it is flagged on the result. Also called directly after a child
+    // is deleted, since no terminal transition fires in that case.
+    public async Task TryAdvanceParentAsync(string parentId)
+    {
         try
         {
-            await TryAdvanceParentAsync(parentId);
+            await AdvanceParentIfAllChildrenTerminalAsync(parentId);
         }
         catch (Exception ex)
         {
@@ -405,10 +466,7 @@ public sealed class TaskStateService : ITaskStateService
         }
     }
 
-    // Any parent (planning or improvement) sitting in WaitingForChildren surfaces for review
-    // once every child is terminal (Done/Failed/Cancelled). A failed or cancelled child does
-    // not wedge the parent — it is flagged on the result.
-    private async Task TryAdvanceParentAsync(string parentId)
+    private async Task AdvanceParentIfAllChildrenTerminalAsync(string parentId)
     {
         string? parentResult;
         List<TaskStatus> childStatuses;

tests/ClaudeDo.Data.Tests/PromptFilesTests.cs

@@ -43,4 +43,41 @@ public class PromptFilesTests
     {
         Assert.EndsWith("planning-system.md", PromptFiles.PathFor(PromptKind.Planning));
     }
+
+    [Fact]
+    public void PathFor_merge_helper_kinds_map_to_their_files()
+    {
+        Assert.EndsWith("merge-helper-system.md", PromptFiles.PathFor(PromptKind.MergeHelper));
+        Assert.EndsWith("merge-helper-initial.md", PromptFiles.PathFor(PromptKind.MergeHelperInitial));
+    }
+
+    [Fact]
+    public void DefaultFor_merge_helper_is_non_empty_and_mentions_the_merge_tools()
+    {
+        var d = PromptFiles.DefaultFor(PromptKind.MergeHelper);
+        Assert.False(string.IsNullOrWhiteSpace(d));
+        Assert.Contains("review_task", d);
+        Assert.Contains("continue_merge", d);
+    }
+
+    [Fact]
+    public void DefaultFor_merge_helper_initial_has_scope_and_tasks_tokens()
+    {
+        var d = PromptFiles.DefaultFor(PromptKind.MergeHelperInitial);
+        Assert.False(string.IsNullOrWhiteSpace(d));
+        Assert.Contains("{scope}", d);
+        Assert.Contains("{tasks}", d);
+    }
+
+    [Fact]
+    public void RenderTemplate_merge_helper_initial_substitutes_scope_and_tasks()
+    {
+        var outp = PromptFiles.RenderTemplate(
+            PromptFiles.DefaultFor(PromptKind.MergeHelperInitial),
+            new Dictionary<string, string> { ["scope"] = "All lists", ["tasks"] = "- [Idle] T1" });
+        Assert.Contains("Scope: All lists", outp);
+        Assert.Contains("- [Idle] T1", outp);
+        Assert.DoesNotContain("{scope}", outp);
+        Assert.DoesNotContain("{tasks}", outp);
+    }
 }

tests/ClaudeDo.Ui.Tests/StubWorkerClient.cs

@@ -95,10 +95,17 @@ public abstract class StubWorkerClient : IWorkerClient
     public virtual Task AbortConflictMergeAsync(string taskId) => Task.CompletedTask;
     public virtual Task StartPlanningSessionAsync(string taskId, CancellationToken ct = default) => Task.CompletedTask;
     public virtual Task ResumeTaskInTerminalAsync(string taskId, CancellationToken ct = default) => Task.CompletedTask;
+    public virtual Task SubmitTaskForReviewAsync(string taskId, CancellationToken ct = default) => Task.CompletedTask;
     public virtual Task<LaunchSpec> GetInteractiveLaunchSpecAsync(string taskId, CancellationToken ct = default)
         => Task.FromResult(new LaunchSpec(".", "claude", Array.Empty<string>(), new Dictionary<string, string>()));
     public virtual Task<LaunchSpec> GetAdHocLaunchSpecAsync(string directory, CancellationToken ct = default)
         => Task.FromResult(new LaunchSpec(directory, "claude", Array.Empty<string>(), new Dictionary<string, string>()));
+    public virtual Task<LaunchSpec> GetMergeHelperLaunchSpecAsync(IReadOnlyList<string> taskIds, string? listId, CancellationToken ct = default)
+        => Task.FromResult(new LaunchSpec(".", "claude", Array.Empty<string>(), new Dictionary<string, string>()));
+    public virtual Task<LaunchSpec> GetPlanningStartLaunchSpecAsync(string taskId, CancellationToken ct = default)
+        => Task.FromResult(new LaunchSpec(".", "claude", Array.Empty<string>(), new Dictionary<string, string>()));
+    public virtual Task<LaunchSpec> GetPlanningResumeLaunchSpecAsync(string taskId, CancellationToken ct = default)
+        => Task.FromResult(new LaunchSpec(".", "claude", Array.Empty<string>(), new Dictionary<string, string>()));
     public virtual Task ResumePlanningSessionAsync(string taskId, CancellationToken ct = default) => Task.CompletedTask;
     public virtual Task<DiscardPlanningOutcome> DiscardPlanningSessionAsync(string taskId, bool dequeueQueuedChildren = false, CancellationToken ct = default)
         => Task.FromResult(new DiscardPlanningOutcome(DiscardPlanningResult.Discarded, 0, 0));

tests/ClaudeDo.Ui.Tests/ViewModels/DetailsIslandReviewActionsTests.cs

@@ -98,4 +98,43 @@ public class DetailsIslandReviewActionsTests : IDisposable
         vm.ReviewFeedback = "   ";
         Assert.False(vm.RejectReviewCommand.CanExecute(null));
     }
+
+    [Fact]
+    public void Approve_IsEnabled_WhenThereIsNothingToReview()
+    {
+        // A childless sandbox run has no worktree diff to inspect, so the gate must
+        // not block it — it approves straight through.
+        var vm = BuildVm(new RecordingWorkerClient());
+        vm.Bind(new TaskRowViewModel { Id = "task-nodiff-1", Status = TaskStatus.WaitingForReview });
+        vm.Monitor.ApplyState(TaskStatus.WaitingForReview);
+
+        Assert.False(vm.Merge.HasReviewableDiff);
+        Assert.False(vm.ShowReviewDiffHint);
+        Assert.True(vm.ApproveReviewCommand.CanExecute(null));
+    }
+
+    [Fact]
+    public void Approve_IsGatedUntilDiffOpened_AndReLocksOnNewRun()
+    {
+        var vm = BuildVm(new RecordingWorkerClient());
+        vm.Bind(new TaskRowViewModel { Id = "task-diff-1", Status = TaskStatus.WaitingForReview });
+        vm.Merge.SyncWorktree("/tmp/wt", null, null, "Active", null);
+        vm.Monitor.ApplyState(TaskStatus.WaitingForReview);
+
+        // There is a diff to read, but it has not been opened → merge is blocked.
+        Assert.True(vm.Merge.HasReviewableDiff);
+        Assert.True(vm.ShowReviewDiffHint);
+        Assert.False(vm.ApproveReviewCommand.CanExecute(null));
+
+        // Opening the diff records the inspection and unlocks the merge.
+        vm.Merge.DiffViewed?.Invoke();
+        Assert.False(vm.ShowReviewDiffHint);
+        Assert.True(vm.ApproveReviewCommand.CanExecute(null));
+
+        // A new run means a fresh diff — the gate re-engages.
+        vm.Monitor.ApplyState(TaskStatus.Running);
+        vm.Monitor.ApplyState(TaskStatus.WaitingForReview);
+        Assert.True(vm.ShowReviewDiffHint);
+        Assert.False(vm.ApproveReviewCommand.CanExecute(null));
+    }
 }

tests/ClaudeDo.Ui.Tests/ViewModels/MergeHelperSelectionModalViewModelTests.cs

@@ -0,0 +1,183 @@
+using System.Linq;
+using ClaudeDo.Data;
+using ClaudeDo.Data.Models;
+using ClaudeDo.Ui.ViewModels.Modals;
+using Microsoft.EntityFrameworkCore;
+using Xunit;
+using TaskStatus = ClaudeDo.Data.Models.TaskStatus;
+
+namespace ClaudeDo.Ui.Tests.ViewModels;
+
+public class MergeHelperSelectionModalViewModelTests : IDisposable
+{
+    private readonly string _dbPath;
+
+    public MergeHelperSelectionModalViewModelTests()
+    {
+        _dbPath = Path.Combine(Path.GetTempPath(), $"claudedo_mh_test_{Guid.NewGuid():N}.db");
+        using var ctx = NewContext();
+        ctx.Database.EnsureCreated();
+    }
+
+    public void Dispose()
+    {
+        try { File.Delete(_dbPath); } catch { }
+        try { File.Delete(_dbPath + "-wal"); } catch { }
+        try { File.Delete(_dbPath + "-shm"); } catch { }
+    }
+
+    private ClaudeDoDbContext NewContext()
+    {
+        var opts = new DbContextOptionsBuilder<ClaudeDoDbContext>()
+            .UseSqlite($"Data Source={_dbPath}")
+            .Options;
+        return new ClaudeDoDbContext(opts);
+    }
+
+    private sealed class TestDbFactory : IDbContextFactory<ClaudeDoDbContext>
+    {
+        private readonly Func<ClaudeDoDbContext> _create;
+        public TestDbFactory(Func<ClaudeDoDbContext> create) => _create = create;
+        public ClaudeDoDbContext CreateDbContext() => _create();
+    }
+
+    private MergeHelperSelectionModalViewModel BuildVm()
+        => new(new TestDbFactory(NewContext));
+
+    private async Task SeedAllStatusesAsync()
+    {
+        await using var db = NewContext();
+        db.Lists.Add(new ListEntity { Id = "L1", Name = "Work", CreatedAt = DateTime.UtcNow });
+        db.Lists.Add(new ListEntity { Id = "L2", Name = "Home", CreatedAt = DateTime.UtcNow });
+        var order = 0;
+        void Add(string id, string listId, TaskStatus status) =>
+            db.Tasks.Add(new TaskEntity
+            {
+                Id = id, ListId = listId, Title = $"task {id}",
+                Status = status, CreatedAt = DateTime.UtcNow, SortOrder = order++,
+            });
+
+        Add("t-idle", "L1", TaskStatus.Idle);
+        Add("t-queued", "L1", TaskStatus.Queued);
+        Add("t-running", "L1", TaskStatus.Running);
+        Add("t-review", "L1", TaskStatus.WaitingForReview);
+        Add("t-children", "L1", TaskStatus.WaitingForChildren);
+        Add("t-failed", "L1", TaskStatus.Failed);
+        Add("t-done", "L1", TaskStatus.Done);
+        Add("t-cancelled", "L1", TaskStatus.Cancelled);
+        Add("t-other-list", "L2", TaskStatus.Idle);
+        await db.SaveChangesAsync();
+    }
+
+    [Fact]
+    public async Task Load_ExcludesTerminalStatuses_AndTicksActionableByDefault()
+    {
+        await SeedAllStatusesAsync();
+        var vm = BuildVm();
+        vm.Configure(null, null);
+        await vm.LoadAsync();
+
+        Assert.DoesNotContain(vm.Tasks, t => t.Id is "t-done" or "t-cancelled");
+        Assert.Equal(7, vm.Tasks.Count);
+
+        Assert.True(vm.Tasks.Single(t => t.Id == "t-idle").IsSelected);
+        Assert.True(vm.Tasks.Single(t => t.Id == "t-queued").IsSelected);
+        Assert.True(vm.Tasks.Single(t => t.Id == "t-review").IsSelected);
+        Assert.True(vm.Tasks.Single(t => t.Id == "t-failed").IsSelected);
+        Assert.False(vm.Tasks.Single(t => t.Id == "t-running").IsSelected);
+        Assert.False(vm.Tasks.Single(t => t.Id == "t-children").IsSelected);
+    }
+
+    [Fact]
+    public async Task Load_PerListScope_FiltersToThatList()
+    {
+        await SeedAllStatusesAsync();
+        var vm = BuildVm();
+        vm.Configure("L2", "Home");
+        await vm.LoadAsync();
+
+        Assert.Single(vm.Tasks);
+        Assert.Equal("t-other-list", vm.Tasks[0].Id);
+        Assert.Equal("Home", vm.Tasks[0].ListName);
+        Assert.False(vm.IsGlobal);
+        Assert.Contains("Home", vm.ScopeLabel);
+    }
+
+    [Fact]
+    public async Task CanConfirm_FollowsRowSelection()
+    {
+        await SeedAllStatusesAsync();
+        var vm = BuildVm();
+        vm.Configure(null, null);
+        await vm.LoadAsync();
+
+        Assert.True(vm.CanConfirm);
+
+        vm.SelectNoneCommand.Execute(null);
+        Assert.False(vm.CanConfirm);
+        Assert.All(vm.Tasks, t => Assert.False(t.IsSelected));
+
+        vm.Tasks[0].IsSelected = true;      // single row re-enables via PropertyChanged hook
+        Assert.True(vm.CanConfirm);
+
+        vm.SelectAllCommand.Execute(null);
+        Assert.All(vm.Tasks, t => Assert.True(t.IsSelected));
+    }
+
+    [Fact]
+    public async Task Confirm_ReturnsSelectedIds_InRowOrder()
+    {
+        await SeedAllStatusesAsync();
+        var vm = BuildVm();
+        vm.Configure(null, null);
+        await vm.LoadAsync();
+
+        vm.SelectNoneCommand.Execute(null);
+        vm.Tasks.Single(t => t.Id == "t-review").IsSelected = true;
+        vm.Tasks.Single(t => t.Id == "t-idle").IsSelected = true;
+
+        var closed = false;
+        vm.CloseAction = () => closed = true;
+        vm.ConfirmCommand.Execute(null);
+
+        var result = await vm.Result.Task;
+        Assert.NotNull(result);
+        // Row order (SortOrder): t-idle was seeded before t-review.
+        Assert.Equal(new[] { "t-idle", "t-review" }, result);
+        Assert.True(closed);
+    }
+
+    [Fact]
+    public async Task Cancel_ReturnsNull()
+    {
+        await SeedAllStatusesAsync();
+        var vm = BuildVm();
+        vm.Configure(null, null);
+        await vm.LoadAsync();
+
+        var closed = false;
+        vm.CloseAction = () => closed = true;
+        vm.CancelCommand.Execute(null);
+
+        Assert.Null(await vm.Result.Task);
+        Assert.True(closed);
+    }
+
+    [Fact]
+    public async Task Load_NoCandidates_HasTasksFalse_CannotConfirm()
+    {
+        await using (var db = NewContext())
+        {
+            db.Lists.Add(new ListEntity { Id = "L1", Name = "Work", CreatedAt = DateTime.UtcNow });
+            db.Tasks.Add(new TaskEntity { Id = "t-done", ListId = "L1", Title = "done", Status = TaskStatus.Done, CreatedAt = DateTime.UtcNow });
+            await db.SaveChangesAsync();
+        }
+
+        var vm = BuildVm();
+        vm.Configure("L1", "Work");
+        await vm.LoadAsync();
+
+        Assert.False(vm.HasTasks);
+        Assert.False(vm.CanConfirm);
+    }
+}

tests/ClaudeDo.Ui.Tests/ViewModels/MissionControlViewModelTests.cs

@@ -406,6 +406,65 @@ public class MissionControlViewModelTests : IDisposable
         Assert.Empty(vm.Panes);
     }
 
+    private sealed class ThrowingMergeHelperLaunchSpecWorker : StubWorkerClient
+    {
+        public override Task<LaunchSpec> GetMergeHelperLaunchSpecAsync(IReadOnlyList<string> taskIds, string? listId, CancellationToken ct = default)
+            => throw new InvalidOperationException("spec failed");
+    }
+
+    [Fact]
+    public async Task OpenMergeHelperConPtySessionAsync_AddsAdHocPane()
+    {
+        var worker = new FakeWorker();
+        using var vm = BuildVm(worker);
+
+        await vm.OpenMergeHelperConPtySessionAsync(null, new[] { "t1", "t2" });
+
+        Assert.Single(vm.ConPtySessions);
+        Assert.Null(vm.ConPtySessions[0].TaskId);
+        Assert.Single(vm.Panes);
+        Assert.Same(vm.ConPtySessions[0], vm.Panes[0]);
+    }
+
+    [Fact]
+    public async Task OpenMergeHelperConPtySessionAsync_TwoRuns_NeverDeduped()
+    {
+        var worker = new FakeWorker();
+        using var vm = BuildVm(worker);
+
+        await vm.OpenMergeHelperConPtySessionAsync(null, new[] { "t1" });
+        await vm.OpenMergeHelperConPtySessionAsync(null, new[] { "t1" });
+
+        Assert.Equal(2, vm.ConPtySessions.Count);
+    }
+
+    [Fact]
+    public async Task OpenMergeHelperConPtySessionAsync_EmptySelection_NoPane()
+    {
+        var worker = new FakeWorker();
+        using var vm = BuildVm(worker);
+
+        await vm.OpenMergeHelperConPtySessionAsync(null, Array.Empty<string>());
+
+        Assert.Empty(vm.ConPtySessions);
+        Assert.Empty(vm.Panes);
+    }
+
+    [Fact]
+    public async Task OpenMergeHelperConPtySessionAsync_WorkerThrows_RaisesErrorReported_NoPaneAdded()
+    {
+        var worker = new ThrowingMergeHelperLaunchSpecWorker();
+        using var vm = BuildVm(worker);
+        string? error = null;
+        vm.ErrorReported += msg => error = msg;
+
+        await vm.OpenMergeHelperConPtySessionAsync(null, new[] { "t1" });
+
+        Assert.Empty(vm.ConPtySessions);
+        Assert.Empty(vm.Panes);
+        Assert.NotNull(error);
+    }
+
     [Fact]
     public void ToggleLayoutCommand_FlipsIsFocusMode()
     {

tests/ClaudeDo.Ui.Tests/ViewModels/UnifiedDiffParserTests.cs

@@ -106,4 +106,72 @@ public class UnifiedDiffParserTests
         Assert.False(file.HasLines);
         Assert.True(file.IsEmptyContent);
     }
+
+    [Fact]
+    public void Path_with_spaces_is_parsed_in_full()
+    {
+        const string raw =
+            "diff --git a/pfad mit space.txt b/pfad mit space.txt\n" +
+            "index 111..222 100644\n" +
+            "--- a/pfad mit space.txt\t\n" +
+            "+++ b/pfad mit space.txt\t\n" +
+            "@@ -1,1 +1,1 @@\n" +
+            "-old\n" +
+            "+new\n";
+
+        var file = Assert.Single(UnifiedDiffParser.Parse(raw));
+        Assert.Equal("pfad mit space.txt", file.Path);
+        Assert.Equal(DiffFileStatus.Modified, file.Status);
+    }
+
+    [Fact]
+    public void Rename_with_spaces_on_both_sides_captures_full_paths()
+    {
+        const string raw =
+            "diff --git a/old name with space.txt b/new name with space.txt\n" +
+            "similarity index 75%\n" +
+            "rename from old name with space.txt\n" +
+            "rename to new name with space.txt\n" +
+            "index 111..222 100644\n" +
+            "--- a/old name with space.txt\t\n" +
+            "+++ b/new name with space.txt\t\n";
+
+        var file = Assert.Single(UnifiedDiffParser.Parse(raw));
+        Assert.Equal(DiffFileStatus.Renamed, file.Status);
+        Assert.Equal("old name with space.txt", file.OldPath);
+        Assert.Equal("new name with space.txt", file.Path);
+    }
+
+    [Fact]
+    public void Git_quoted_unicode_path_is_unquoted()
+    {
+        // git quotes paths containing non-ASCII bytes as C-style octal escapes,
+        // e.g. "pfad_ä.txt" -> "pfad_\303\244.txt" (UTF-8 bytes for 'ä').
+        const string raw =
+            "diff --git \"a/pfad_\\303\\244.txt\" \"b/pfad_\\303\\244.txt\"\n" +
+            "index 111..222 100644\n" +
+            "--- \"a/pfad_\\303\\244.txt\"\n" +
+            "+++ \"b/pfad_\\303\\244.txt\"\n" +
+            "@@ -1,1 +1,1 @@\n" +
+            "-old\n" +
+            "+new\n";
+
+        var file = Assert.Single(UnifiedDiffParser.Parse(raw));
+        Assert.Equal("pfad_ä.txt", file.Path);
+    }
+
+    [Fact]
+    public void Binary_file_with_spaces_is_parsed_in_full()
+    {
+        const string raw =
+            "diff --git a/bin file.png b/bin file.png\n" +
+            "new file mode 100644\n" +
+            "index 000..abc\n" +
+            "Binary files /dev/null and b/bin file.png differ\n";
+
+        var file = Assert.Single(UnifiedDiffParser.Parse(raw));
+        Assert.Equal("bin file.png", file.Path);
+        Assert.True(file.IsBinary);
+        Assert.False(file.HasLines);
+    }
 }

tests/ClaudeDo.Worker.Tests/External/AddSubtaskToolTests.cs

@@ -4,6 +4,7 @@ using ClaudeDo.Data.Repositories;
 using ClaudeDo.Worker.External;
 using ClaudeDo.Worker.Hub;
 using ClaudeDo.Worker.Lifecycle;
+using ClaudeDo.Worker.Planning;
 using ClaudeDo.Worker.Queue;
 using ClaudeDo.Worker.Runner;
 using ClaudeDo.Worker.Tests.Infrastructure;
@@ -72,14 +73,18 @@ public sealed class AddSubtaskToolTests : IDisposable
             NullLogger<TaskRunner>.Instance, state, new TaskRunTokenRegistry(), new AttachmentStore(), new FakeSessionSkillSeeder());
         var waker = new ClaudeDo.Worker.Queue.QueueWaker();
         var picker = new ClaudeDo.Worker.Queue.QueuePicker(dbFactory);
-        var overrideSlot = new OverrideSlotService(dbFactory, runner, NullLogger<OverrideSlotService>.Instance);
-        var queue = new QueueService(dbFactory, runner, cfg, NullLogger<QueueService>.Instance, waker, picker, overrideSlot, state);
+        var runCancels = new RunCancellationRegistry();
+        var overrideSlot = new OverrideSlotService(dbFactory, runner, NullLogger<OverrideSlotService>.Instance, runCancels);
+        var queue = new QueueService(dbFactory, runner, cfg, NullLogger<QueueService>.Instance, waker, picker, overrideSlot, state, runCancels);
         var maintenance = new WorktreeMaintenanceService(dbFactory, git, NullLogger<WorktreeMaintenanceService>.Instance);
-        var merge = new TaskMergeService(dbFactory, git, broadcaster, TaskStateServiceBuilder.Build(dbFactory).State, NullLogger<TaskMergeService>.Instance);
+        var merge = new TaskMergeService(dbFactory, git, broadcaster, state, NullLogger<TaskMergeService>.Instance);
+        var aggregator = new PlanningAggregator(dbFactory, git, NullLogger<PlanningAggregator>.Instance);
+        var planningMerge = new PlanningMergeOrchestrator(
+            dbFactory, merge, aggregator, broadcaster, git, state, NullLogger<PlanningMergeOrchestrator>.Instance);
         return new ExternalMcpService(
             _tasks, _lists, queue, broadcaster,
             state,
-            git, dbFactory, maintenance, merge);
+            git, dbFactory, maintenance, merge, planningMerge);
     }
 
     [Fact]

tests/ClaudeDo.Worker.Tests/External/BatchMcpToolsTests.cs

@@ -6,6 +6,7 @@ using ClaudeDo.Worker.Config;
 using ClaudeDo.Worker.External;
 using ClaudeDo.Worker.Hub;
 using ClaudeDo.Worker.Lifecycle;
+using ClaudeDo.Worker.Planning;
 using ClaudeDo.Worker.Queue;
 using ClaudeDo.Worker.Runner;
 using ClaudeDo.Worker.Tests.Infrastructure;
@@ -64,11 +65,15 @@ public sealed class BatchMcpToolsTests : IDisposable
         var git = new GitService();
         var factory = _db.CreateFactory();
         var maintenance = new WorktreeMaintenanceService(factory, git, NullLogger<WorktreeMaintenanceService>.Instance);
-        var merge = new TaskMergeService(factory, git, _broadcaster, TaskStateServiceBuilder.Build(factory).State, NullLogger<TaskMergeService>.Instance);
+        var state = TaskStateServiceBuilder.Build(factory).State;
+        var merge = new TaskMergeService(factory, git, _broadcaster, state, NullLogger<TaskMergeService>.Instance);
+        var aggregator = new PlanningAggregator(factory, git, NullLogger<PlanningAggregator>.Instance);
+        var planningMerge = new PlanningMergeOrchestrator(
+            factory, merge, aggregator, _broadcaster, git, state, NullLogger<PlanningMergeOrchestrator>.Instance);
         var svc = new ExternalMcpService(
             _tasks, _lists, CreateQueue(), _broadcaster,
-            TaskStateServiceBuilder.Build(factory).State,
-            git, factory, maintenance, merge);
+            state,
+            git, factory, maintenance, merge, planningMerge);
         return new BatchMcpTools(svc);
     }
 
@@ -88,9 +93,10 @@ public sealed class BatchMcpToolsTests : IDisposable
         var state = TaskStateServiceBuilder.Build(dbFactory).State;
         var runner = new TaskRunner(new FakeClaudeProcess(), dbFactory, broadcaster, wtManager, new ClaudeArgsBuilder(), cfg,
             NullLogger<TaskRunner>.Instance, state, new TaskRunTokenRegistry(), new AttachmentStore(), new FakeSessionSkillSeeder());
-        var overrideSlot = new OverrideSlotService(dbFactory, runner, NullLogger<OverrideSlotService>.Instance);
+        var runCancels = new RunCancellationRegistry();
+        var overrideSlot = new OverrideSlotService(dbFactory, runner, NullLogger<OverrideSlotService>.Instance, runCancels);
         return new QueueService(dbFactory, runner, cfg, NullLogger<QueueService>.Instance,
-            new QueueWaker(), new QueuePicker(dbFactory), overrideSlot, state);
+            new QueueWaker(), new QueuePicker(dbFactory), overrideSlot, state, runCancels);
     }
 
     [Fact]

tests/ClaudeDo.Worker.Tests/External/ExternalMcpExceptionFilterTests.cs

@@ -0,0 +1,48 @@
+using ClaudeDo.Worker.External;
+using ModelContextProtocol;
+using ModelContextProtocol.Protocol;
+using ModelContextProtocol.Server;
+
+namespace ClaudeDo.Worker.Tests.External;
+
+public sealed class ExternalMcpExceptionFilterTests
+{
+    [Fact]
+    public async Task Wrap_TranslatesInvalidOperationException_PreservingMessage()
+    {
+        McpRequestHandler<CallToolRequestParams, CallToolResult> next =
+            (_, _) => throw new InvalidOperationException("Task abc123 not found.");
+        var wrapped = ExternalMcpExceptionFilter.Wrap(next);
+
+        var ex = await Assert.ThrowsAsync<McpException>(
+            () => wrapped(null!, CancellationToken.None).AsTask());
+
+        Assert.Equal("Task abc123 not found.", ex.Message);
+    }
+
+    [Fact]
+    public async Task Wrap_TranslatesArgumentException_PreservingMessage()
+    {
+        McpRequestHandler<CallToolRequestParams, CallToolResult> next =
+            (_, _) => throw new ArgumentException("Unknown model alias 'gpt4'.");
+        var wrapped = ExternalMcpExceptionFilter.Wrap(next);
+
+        var ex = await Assert.ThrowsAsync<McpException>(
+            () => wrapped(null!, CancellationToken.None).AsTask());
+
+        Assert.Equal("Unknown model alias 'gpt4'.", ex.Message);
+    }
+
+    [Fact]
+    public async Task Wrap_PassesThroughSuccessfulResult()
+    {
+        var expected = new CallToolResult();
+        McpRequestHandler<CallToolRequestParams, CallToolResult> next =
+            (_, _) => ValueTask.FromResult(expected);
+        var wrapped = ExternalMcpExceptionFilter.Wrap(next);
+
+        var result = await wrapped(null!, CancellationToken.None);
+
+        Assert.Same(expected, result);
+    }
+}

tests/ClaudeDo.Worker.Tests/External/ExternalMcpServiceTests.cs

@@ -6,6 +6,7 @@ using ClaudeDo.Worker.Config;
 using ClaudeDo.Worker.External;
 using ClaudeDo.Worker.Hub;
 using ClaudeDo.Worker.Lifecycle;
+using ClaudeDo.Worker.Planning;
 using ClaudeDo.Worker.Queue;
 using ClaudeDo.Worker.Runner;
 using ClaudeDo.Worker.Tests.Infrastructure;
@@ -104,7 +105,8 @@ public sealed class ExternalMcpServiceTests : IDisposable
         return id;
     }
 
-    private async Task<TaskEntity> SeedTaskAsync(string listId, string title = "t", TaskStatus status = TaskStatus.Idle)
+    private async Task<TaskEntity> SeedTaskAsync(
+        string listId, string title = "t", TaskStatus status = TaskStatus.Idle, string? parentId = null)
     {
         var task = new TaskEntity
         {
@@ -112,6 +114,7 @@ public sealed class ExternalMcpServiceTests : IDisposable
             ListId = listId,
             Title = title,
             Status = status,
+            ParentTaskId = parentId,
             CreatedAt = DateTime.UtcNow,
             CommitType = "chore",
         };
@@ -124,11 +127,15 @@ public sealed class ExternalMcpServiceTests : IDisposable
         var git = new GitService();
         var factory = _db.CreateFactory();
         var maintenance = new WorktreeMaintenanceService(factory, git, NullLogger<WorktreeMaintenanceService>.Instance);
-        var merge = new TaskMergeService(factory, git, _broadcaster, TaskStateServiceBuilder.Build(factory).State, NullLogger<TaskMergeService>.Instance);
+        var state = TaskStateServiceBuilder.Build(factory).State;
+        var merge = new TaskMergeService(factory, git, _broadcaster, state, NullLogger<TaskMergeService>.Instance);
+        var aggregator = new PlanningAggregator(factory, git, NullLogger<PlanningAggregator>.Instance);
+        var planningMerge = new PlanningMergeOrchestrator(
+            factory, merge, aggregator, _broadcaster, git, state, NullLogger<PlanningMergeOrchestrator>.Instance);
         return new ExternalMcpService(
             _tasks, _lists, queue, _broadcaster,
-            TaskStateServiceBuilder.Build(factory).State,
-            git, factory, maintenance, merge);
+            state,
+            git, factory, maintenance, merge, planningMerge);
     }
 
     private QueueService CreateQueue()
@@ -152,8 +159,9 @@ public sealed class ExternalMcpServiceTests : IDisposable
             NullLogger<TaskRunner>.Instance, state, new TaskRunTokenRegistry(), new AttachmentStore(), new FakeSessionSkillSeeder());
         var waker = new ClaudeDo.Worker.Queue.QueueWaker();
         var picker = new ClaudeDo.Worker.Queue.QueuePicker(dbFactory);
-        var overrideSlot = new OverrideSlotService(dbFactory, runner, NullLogger<OverrideSlotService>.Instance);
-        return new QueueService(dbFactory, runner, cfg, NullLogger<QueueService>.Instance, waker, picker, overrideSlot, state);
+        var runCancels = new RunCancellationRegistry();
+        var overrideSlot = new OverrideSlotService(dbFactory, runner, NullLogger<OverrideSlotService>.Instance, runCancels);
+        return new QueueService(dbFactory, runner, cfg, NullLogger<QueueService>.Instance, waker, picker, overrideSlot, state, runCancels);
     }
 
     [Fact]
@@ -208,9 +216,10 @@ public sealed class ExternalMcpServiceTests : IDisposable
         var task = await SeedTaskAsync(listId, status: TaskStatus.WaitingForReview);
         var sut = BuildSut(CreateQueue());
 
-        var dto = await sut.ReviewTask(task.Id, "approve", null, CancellationToken.None);
+        var result = await sut.ReviewTask(task.Id, "approve", null, null, cancellationToken: CancellationToken.None);
 
-        Assert.Equal("Done", dto.Status);
+        Assert.Equal("Done", result.Task.Status);
+        Assert.Equal(TaskMergeService.StatusMerged, result.MergeStatus);
     }
 
     [Fact]
@@ -221,7 +230,7 @@ public sealed class ExternalMcpServiceTests : IDisposable
         var sut = BuildSut(CreateQueue());
 
         await Assert.ThrowsAsync<InvalidOperationException>(() =>
-            sut.ReviewTask(task.Id, "reject_rerun", null, CancellationToken.None));
+            sut.ReviewTask(task.Id, "reject_rerun", null, null, cancellationToken: CancellationToken.None));
     }
 
     [Fact]
@@ -231,9 +240,9 @@ public sealed class ExternalMcpServiceTests : IDisposable
         var task = await SeedTaskAsync(listId, status: TaskStatus.WaitingForReview);
         var sut = BuildSut(CreateQueue());
 
-        var dto = await sut.ReviewTask(task.Id, "reject_rerun", "fix it", CancellationToken.None);
+        var result = await sut.ReviewTask(task.Id, "reject_rerun", "fix it", null, cancellationToken: CancellationToken.None);
 
-        Assert.Equal("Queued", dto.Status);
+        Assert.Equal("Queued", result.Task.Status);
         var loaded = await new TaskRepository(_db.CreateContext()).GetByIdAsync(task.Id);
         Assert.Equal("fix it", loaded!.ReviewFeedback);
     }
@@ -246,7 +255,79 @@ public sealed class ExternalMcpServiceTests : IDisposable
         var sut = BuildSut(CreateQueue());
 
         await Assert.ThrowsAsync<InvalidOperationException>(() =>
-            sut.ReviewTask(task.Id, "bogus", null, CancellationToken.None));
+            sut.ReviewTask(task.Id, "bogus", null, null, cancellationToken: CancellationToken.None));
+    }
+
+    [Fact]
+    public async Task ReviewTask_Approve_WithActiveWorktree_MergesIntoTargetBranch()
+    {
+        if (!GitAvailable) return;
+        var (task, list, wt) = await SeedWorktreeAsync(status: TaskStatus.WaitingForReview);
+
+        File.WriteAllText(Path.Combine(wt.WorktreePath, "feature.txt"), "x\n");
+        GitRepoFixture.RunGit(wt.WorktreePath, "add", "feature.txt");
+        GitRepoFixture.RunGit(wt.WorktreePath, "commit", "-m", "add feature");
+        using (var ctx = _db.CreateContext())
+        {
+            var row = ctx.Worktrees.Single(w => w.TaskId == task.Id);
+            row.HeadCommit = GitRepoFixture.RunGit(wt.WorktreePath, "rev-parse", "HEAD").Trim();
+            ctx.SaveChanges();
+        }
+
+        var sut = BuildSut(CreateQueue());
+        var result = await sut.ReviewTask(task.Id, "approve", null, null, cancellationToken: CancellationToken.None);
+
+        Assert.Equal(TaskMergeService.StatusMerged, result.MergeStatus);
+        Assert.Equal("Done", result.Task.Status);
+        Assert.True(File.Exists(Path.Combine(list.WorkingDir!, "feature.txt")));
+        using var verify = _db.CreateContext();
+        Assert.Equal(WorktreeState.Merged, verify.Worktrees.Single(w => w.TaskId == task.Id).State);
+    }
+
+    [Fact]
+    public async Task ReviewTask_Approve_ParentWithChildren_RunsUnitMerge()
+    {
+        if (!GitAvailable) return;
+        var repo = new GitRepoFixture();
+        _repos.Add(repo);
+        GitRepoFixture.RunGit(repo.RepoDir, "branch", "-m", "main");
+
+        var listId = Guid.NewGuid().ToString();
+        var parentId = Guid.NewGuid().ToString();
+        var childId = Guid.NewGuid().ToString();
+        using (var ctx = _db.CreateContext())
+        {
+            ctx.Lists.Add(new ListEntity { Id = listId, Name = "L", WorkingDir = repo.RepoDir, CreatedAt = DateTime.UtcNow });
+            ctx.Tasks.Add(new TaskEntity { Id = parentId, ListId = listId, Title = "plan", CreatedAt = DateTime.UtcNow,
+                Status = TaskStatus.WaitingForReview, PlanningPhase = PlanningPhase.Finalized });
+            ctx.Tasks.Add(new TaskEntity { Id = childId, ListId = listId, Title = "child", CreatedAt = DateTime.UtcNow,
+                ParentTaskId = parentId, Status = TaskStatus.Done, SortOrder = 1 });
+
+            var wtPath = Path.Combine(Path.GetTempPath(), $"wt_{Guid.NewGuid():N}");
+            _worktreeCleanups.Add((repo.RepoDir, wtPath));
+            var branch = $"claudedo/{childId[..8]}";
+            GitRepoFixture.RunGit(repo.RepoDir, "worktree", "add", "-b", branch, wtPath, repo.BaseCommit);
+            File.WriteAllText(Path.Combine(wtPath, "child.txt"), "c\n");
+            GitRepoFixture.RunGit(wtPath, "add", "child.txt");
+            GitRepoFixture.RunGit(wtPath, "commit", "-m", "add child.txt");
+            ctx.Worktrees.Add(new WorktreeEntity
+            {
+                TaskId = childId, Path = wtPath, BranchName = branch,
+                BaseCommit = repo.BaseCommit,
+                HeadCommit = GitRepoFixture.RunGit(wtPath, "rev-parse", "HEAD").Trim(),
+                State = WorktreeState.Active, CreatedAt = DateTime.UtcNow,
+            });
+            await ctx.SaveChangesAsync();
+        }
+
+        var sut = BuildSut(CreateQueue());
+        var result = await sut.ReviewTask(parentId, "approve", null, "main", cancellationToken: CancellationToken.None);
+
+        Assert.Equal(TaskMergeService.StatusMerged, result.MergeStatus);
+        Assert.Equal("Done", result.Task.Status);
+        Assert.True(File.Exists(Path.Combine(repo.RepoDir, "child.txt")));
+        using var verify = _db.CreateContext();
+        Assert.Equal(WorktreeState.Merged, verify.Worktrees.Single(w => w.TaskId == childId).State);
     }
 
     [Fact]
@@ -284,6 +365,21 @@ public sealed class ExternalMcpServiceTests : IDisposable
             sut.DeleteTask("does-not-exist", CancellationToken.None));
     }
 
+    [Fact]
+    public async Task DeleteTask_LastNonTerminalChild_AdvancesParentToWaitingForReview()
+    {
+        var listId = await SeedListAsync();
+        var parent = await SeedTaskAsync(listId, status: TaskStatus.WaitingForChildren);
+        await SeedTaskAsync(listId, status: TaskStatus.Done, parentId: parent.Id);
+        var lastChild = await SeedTaskAsync(listId, status: TaskStatus.Idle, parentId: parent.Id);
+        var sut = BuildSut(CreateQueue());
+
+        await sut.DeleteTask(lastChild.Id, CancellationToken.None);
+
+        var reloadedParent = await _tasks.GetByIdAsync(parent.Id);
+        Assert.Equal(TaskStatus.WaitingForReview, reloadedParent!.Status);
+    }
+
     private ExternalMcpService NewService() => BuildSut(CreateQueue());
 
     private async Task<string> SeedIdleTask(string title = "t")
@@ -514,7 +610,7 @@ public sealed class ExternalMcpServiceTests : IDisposable
         var sut = BuildSut(CreateQueue());
 
         var ex = await Assert.ThrowsAsync<InvalidOperationException>(
-            () => sut.MergeTask(task.Id, "main", true, false, false, CancellationToken.None));
+            () => sut.MergeTask(task.Id, "main", true, false, false, cancellationToken: CancellationToken.None));
         Assert.Contains("Done", ex.Message);
     }
 
@@ -689,7 +785,7 @@ public sealed class ExternalMcpServiceTests : IDisposable
         var sut = BuildSut(CreateQueue());
 
         var ex = await Assert.ThrowsAsync<InvalidOperationException>(
-            () => sut.MergeTask(task.Id, "main", true, false, false, CancellationToken.None));
+            () => sut.MergeTask(task.Id, "main", true, false, false, cancellationToken: CancellationToken.None));
         Assert.Contains("Done", ex.Message);
     }
 
@@ -701,7 +797,7 @@ public sealed class ExternalMcpServiceTests : IDisposable
         var (task, _, _) = await SeedWorktreeAsync(TaskStatus.WaitingForReview);
         var sut = BuildSut(CreateQueue());
 
-        var result = await sut.MergeTask(task.Id, "main", true, dryRun: true, allowWaitingForReview: true, CancellationToken.None);
+        var result = await sut.MergeTask(task.Id, "main", true, dryRun: true, allowWaitingForReview: true, cancellationToken: CancellationToken.None);
 
         Assert.False(result.Merged);
         Assert.Null(result.MergeCommit);
@@ -721,13 +817,264 @@ public sealed class ExternalMcpServiceTests : IDisposable
         var target = await new GitService().GetCurrentBranchAsync(list.WorkingDir, CancellationToken.None);
         var sut = BuildSut(CreateQueue());
 
-        var result = await sut.MergeTask(task.Id, target, true, dryRun: false, allowWaitingForReview: true, CancellationToken.None);
+        var result = await sut.MergeTask(task.Id, target, true, dryRun: false, allowWaitingForReview: true, cancellationToken: CancellationToken.None);
 
         Assert.True(result.Merged);
         var reloaded = await new TaskRepository(_db.CreateContext()).GetByIdAsync(task.Id);
         Assert.Equal(TaskStatus.Done, reloaded!.Status);
     }
 
+    // ── leaveConflictsInTree ──────────────────────────────────────────────────
+
+    private async Task<(TaskEntity task, ListEntity list, WorktreeContext wt)> SeedConflictingWorktreeAsync(
+        TaskStatus status = TaskStatus.WaitingForReview)
+    {
+        var (task, list, wt) = await SeedWorktreeAsync(status);
+
+        File.WriteAllText(Path.Combine(wt.WorktreePath, "README.md"), "# from worktree\n");
+        GitRepoFixture.RunGit(wt.WorktreePath, "add", "README.md");
+        GitRepoFixture.RunGit(wt.WorktreePath, "commit", "-m", "worktree edit");
+
+        File.WriteAllText(Path.Combine(list.WorkingDir!, "README.md"), "# from main\n");
+        GitRepoFixture.RunGit(list.WorkingDir!, "add", "README.md");
+        GitRepoFixture.RunGit(list.WorkingDir!, "commit", "-m", "main edit");
+
+        return (task, list, wt);
+    }
+
+    [Fact]
+    public async Task MergeTask_LeaveConflictsInTree_LeavesMarkersAndKeepsRepoMidMerge()
+    {
+        if (!GitAvailable) { Assert.True(true, "git not available -- skipping"); return; }
+
+        var (task, list, _) = await SeedConflictingWorktreeAsync(TaskStatus.WaitingForReview);
+        var target = await new GitService().GetCurrentBranchAsync(list.WorkingDir!);
+        var sut = BuildSut(CreateQueue());
+
+        var result = await sut.MergeTask(task.Id, target, true, dryRun: false,
+            allowWaitingForReview: true, leaveConflictsInTree: true, CancellationToken.None);
+
+        Assert.False(result.Merged);
+        Assert.True(result.ConflictsInTree);
+        Assert.Equal(list.WorkingDir, result.RepoPath);
+        Assert.Contains("README.md", result.Conflicts);
+        Assert.Contains("<<<<<<<", File.ReadAllText(Path.Combine(list.WorkingDir!, "README.md")));
+        Assert.True(await new GitService().IsMidMergeAsync(list.WorkingDir!));
+        var reloaded = await new TaskRepository(_db.CreateContext()).GetByIdAsync(task.Id);
+        Assert.Equal(TaskStatus.WaitingForReview, reloaded!.Status);
+
+        GitRepoFixture.RunGit(list.WorkingDir!, "merge", "--abort");
+    }
+
+    [Fact]
+    public async Task MergeTask_ConflictWithoutLeaveFlag_AbortsCleanly()
+    {
+        if (!GitAvailable) { Assert.True(true, "git not available -- skipping"); return; }
+
+        var (task, list, _) = await SeedConflictingWorktreeAsync(TaskStatus.WaitingForReview);
+        var target = await new GitService().GetCurrentBranchAsync(list.WorkingDir!);
+        var sut = BuildSut(CreateQueue());
+
+        var result = await sut.MergeTask(task.Id, target, true, dryRun: false,
+            allowWaitingForReview: true, leaveConflictsInTree: false, CancellationToken.None);
+
+        Assert.False(result.Merged);
+        Assert.False(result.ConflictsInTree);
+        Assert.Null(result.RepoPath);
+        Assert.Contains("README.md", result.Conflicts);
+        Assert.DoesNotContain("<<<<<<<", File.ReadAllText(Path.Combine(list.WorkingDir!, "README.md")));
+        Assert.False(await new GitService().IsMidMergeAsync(list.WorkingDir!));
+    }
+
+    [Fact]
+    public async Task ReviewTask_Approve_LeaveConflictsInTree_LeavesMarkersAndReportsRepoPath()
+    {
+        if (!GitAvailable) { Assert.True(true, "git not available -- skipping"); return; }
+
+        var (task, list, _) = await SeedConflictingWorktreeAsync(TaskStatus.WaitingForReview);
+        var sut = BuildSut(CreateQueue());
+
+        var result = await sut.ReviewTask(task.Id, "approve", null, null,
+            leaveConflictsInTree: true, CancellationToken.None);
+
+        Assert.Equal(TaskMergeService.StatusConflict, result.MergeStatus);
+        Assert.Equal(list.WorkingDir, result.RepoPath);
+        Assert.Contains("continue_merge", result.MergeMessage);
+        Assert.Contains("<<<<<<<", File.ReadAllText(Path.Combine(list.WorkingDir!, "README.md")));
+        Assert.True(await new GitService().IsMidMergeAsync(list.WorkingDir!));
+        Assert.Equal("WaitingForReview", result.Task.Status);
+
+        GitRepoFixture.RunGit(list.WorkingDir!, "merge", "--abort");
+    }
+
+    [Fact]
+    public async Task ReviewTask_Approve_ConflictWithoutLeaveFlag_KeepsOldBehaviour()
+    {
+        if (!GitAvailable) { Assert.True(true, "git not available -- skipping"); return; }
+
+        var (task, list, _) = await SeedConflictingWorktreeAsync(TaskStatus.WaitingForReview);
+        var sut = BuildSut(CreateQueue());
+
+        var result = await sut.ReviewTask(task.Id, "approve", null, null, cancellationToken: CancellationToken.None);
+
+        Assert.Equal(TaskMergeService.StatusConflict, result.MergeStatus);
+        Assert.Null(result.RepoPath);
+        Assert.Contains("ClaudeDo UI", result.MergeMessage);
+        Assert.DoesNotContain("<<<<<<<", File.ReadAllText(Path.Combine(list.WorkingDir!, "README.md")));
+        Assert.False(await new GitService().IsMidMergeAsync(list.WorkingDir!));
+        Assert.Equal("WaitingForReview", result.Task.Status);
+    }
+
+    // ── continue_merge / abort_merge ──────────────────────────────────────────
+
+    [Fact]
+    public async Task ContinueMerge_AfterResolvingMarkers_MergesAndSetsDone()
+    {
+        if (!GitAvailable) { Assert.True(true, "git not available -- skipping"); return; }
+
+        var (task, list, _) = await SeedConflictingWorktreeAsync(TaskStatus.WaitingForReview);
+        var sut = BuildSut(CreateQueue());
+        await sut.ReviewTask(task.Id, "approve", null, null,
+            leaveConflictsInTree: true, CancellationToken.None);
+
+        // Resolve the conflict on disk and stage it.
+        File.WriteAllText(Path.Combine(list.WorkingDir!, "README.md"), "# resolved\n");
+        GitRepoFixture.RunGit(list.WorkingDir!, "add", "README.md");
+
+        var result = await sut.ContinueMerge(task.Id, CancellationToken.None);
+
+        Assert.True(result.Merged);
+        Assert.Equal("Done", result.TaskStatus);
+        Assert.Empty(result.Conflicts);
+        Assert.False(await new GitService().IsMidMergeAsync(list.WorkingDir!));
+    }
+
+    [Fact]
+    public async Task ContinueMerge_MarkersStillPresent_ReportsConflicts()
+    {
+        if (!GitAvailable) { Assert.True(true, "git not available -- skipping"); return; }
+
+        var (task, list, _) = await SeedConflictingWorktreeAsync(TaskStatus.WaitingForReview);
+        var sut = BuildSut(CreateQueue());
+        await sut.ReviewTask(task.Id, "approve", null, null,
+            leaveConflictsInTree: true, CancellationToken.None);
+
+        // Markers never resolved — continue must refuse and list the files.
+        var result = await sut.ContinueMerge(task.Id, CancellationToken.None);
+
+        Assert.False(result.Merged);
+        Assert.Contains("README.md", result.Conflicts);
+        Assert.Equal(list.WorkingDir, result.RepoPath);
+        Assert.Equal("WaitingForReview", result.TaskStatus);
+        Assert.True(await new GitService().IsMidMergeAsync(list.WorkingDir!));
+
+        GitRepoFixture.RunGit(list.WorkingDir!, "merge", "--abort");
+    }
+
+    [Fact]
+    public async Task AbortMerge_RestoresCleanTreeAndKeepsWaitingForReview()
+    {
+        if (!GitAvailable) { Assert.True(true, "git not available -- skipping"); return; }
+
+        var (task, list, _) = await SeedConflictingWorktreeAsync(TaskStatus.WaitingForReview);
+        var sut = BuildSut(CreateQueue());
+        await sut.ReviewTask(task.Id, "approve", null, null,
+            leaveConflictsInTree: true, CancellationToken.None);
+
+        var dto = await sut.AbortMerge(task.Id, CancellationToken.None);
+
+        Assert.Equal("WaitingForReview", dto.Status);
+        Assert.DoesNotContain("<<<<<<<", File.ReadAllText(Path.Combine(list.WorkingDir!, "README.md")));
+        Assert.False(await new GitService().IsMidMergeAsync(list.WorkingDir!));
+    }
+
+    [Fact]
+    public async Task ContinueMerge_NoMergeInProgress_Throws()
+    {
+        if (!GitAvailable) { Assert.True(true, "git not available -- skipping"); return; }
+
+        var (task, _, _) = await SeedWorktreeAsync(TaskStatus.WaitingForReview);
+        var sut = BuildSut(CreateQueue());
+
+        var ex = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => sut.ContinueMerge(task.Id, CancellationToken.None));
+        Assert.Contains("mid-merge", ex.Message);
+    }
+
+    [Fact]
+    public async Task AbortMerge_NoMergeInProgress_Throws()
+    {
+        if (!GitAvailable) { Assert.True(true, "git not available -- skipping"); return; }
+
+        var (task, _, _) = await SeedWorktreeAsync(TaskStatus.WaitingForReview);
+        var sut = BuildSut(CreateQueue());
+
+        var ex = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => sut.AbortMerge(task.Id, CancellationToken.None));
+        Assert.Contains("mid-merge", ex.Message);
+    }
+
+    [Fact]
+    public async Task ContinueMerge_ParentUnitMergeConflict_RoutesToOrchestratorAndCompletes()
+    {
+        if (!GitAvailable) { Assert.True(true, "git not available -- skipping"); return; }
+
+        var repo = new GitRepoFixture();
+        _repos.Add(repo);
+        GitRepoFixture.RunGit(repo.RepoDir, "branch", "-m", "main");
+
+        // main edits README.md so the child's edit conflicts.
+        File.WriteAllText(Path.Combine(repo.RepoDir, "README.md"), "# main change\n");
+        GitRepoFixture.RunGit(repo.RepoDir, "add", "README.md");
+        GitRepoFixture.RunGit(repo.RepoDir, "commit", "-m", "main edit");
+
+        var listId = Guid.NewGuid().ToString();
+        var parentId = Guid.NewGuid().ToString();
+        var childId = Guid.NewGuid().ToString();
+        using (var ctx = _db.CreateContext())
+        {
+            ctx.Lists.Add(new ListEntity { Id = listId, Name = "L", WorkingDir = repo.RepoDir, CreatedAt = DateTime.UtcNow });
+            ctx.Tasks.Add(new TaskEntity { Id = parentId, ListId = listId, Title = "plan", CreatedAt = DateTime.UtcNow,
+                Status = TaskStatus.WaitingForReview, PlanningPhase = PlanningPhase.Finalized });
+            ctx.Tasks.Add(new TaskEntity { Id = childId, ListId = listId, Title = "child", CreatedAt = DateTime.UtcNow,
+                ParentTaskId = parentId, Status = TaskStatus.Done, SortOrder = 1 });
+
+            var wtPath = Path.Combine(Path.GetTempPath(), $"wt_{Guid.NewGuid():N}");
+            _worktreeCleanups.Add((repo.RepoDir, wtPath));
+            var branch = $"claudedo/{childId[..8]}";
+            GitRepoFixture.RunGit(repo.RepoDir, "worktree", "add", "-b", branch, wtPath, repo.BaseCommit);
+            File.WriteAllText(Path.Combine(wtPath, "README.md"), "# child change\n");
+            GitRepoFixture.RunGit(wtPath, "add", "README.md");
+            GitRepoFixture.RunGit(wtPath, "commit", "-m", "child edit");
+            ctx.Worktrees.Add(new WorktreeEntity
+            {
+                TaskId = childId, Path = wtPath, BranchName = branch,
+                BaseCommit = repo.BaseCommit,
+                HeadCommit = GitRepoFixture.RunGit(wtPath, "rev-parse", "HEAD").Trim(),
+                State = WorktreeState.Active, CreatedAt = DateTime.UtcNow,
+            });
+            await ctx.SaveChangesAsync();
+        }
+
+        var sut = BuildSut(CreateQueue());
+        var review = await sut.ReviewTask(parentId, "approve", null, "main", cancellationToken: CancellationToken.None);
+        Assert.Equal(TaskMergeService.StatusConflict, review.MergeStatus);
+        Assert.Equal(repo.RepoDir, review.RepoPath);
+        Assert.Contains("continue_merge", review.MergeMessage);
+
+        // Resolve the conflict on disk.
+        File.WriteAllText(Path.Combine(repo.RepoDir, "README.md"), "# resolved\n");
+
+        var result = await sut.ContinueMerge(parentId, CancellationToken.None);
+
+        Assert.True(result.Merged);
+        Assert.Equal("Done", result.TaskStatus);
+        Assert.Empty(result.Conflicts);
+        Assert.False(await new GitService().IsMidMergeAsync(repo.RepoDir));
+        using var verify = _db.CreateContext();
+        Assert.Equal(WorktreeState.Merged, verify.Worktrees.Single(w => w.TaskId == childId).State);
+    }
+
     // ── AddTask model override ────────────────────────────────────────────────
 
     [Fact]

tests/ClaudeDo.Worker.Tests/External/ExternalMcpToolSchemaTests.cs

@@ -0,0 +1,74 @@
+using System.Reflection;
+using ClaudeDo.Worker.External;
+using Microsoft.Extensions.AI;
+using ModelContextProtocol.Server;
+
+namespace ClaudeDo.Worker.Tests.External;
+
+/// <summary>
+/// MCP clients routinely omit optional arguments. The generated tool schema only marks a
+/// parameter optional when the C# method declares a default value — nullability alone is not
+/// enough (verified against ModelContextProtocol/Microsoft.Extensions.AI 1.2.0 / 10.4.1's
+/// AIJsonUtilities.CreateFunctionJsonSchema, which checks ParameterInfo.IsOptional). This sweeps
+/// every [McpServerToolType] class in the External/ namespace so a future tool can't reintroduce
+/// a nullable-but-required filter parameter.
+/// </summary>
+public sealed class ExternalMcpToolSchemaTests
+{
+    private static IEnumerable<MethodInfo> ExternalToolMethods()
+    {
+        var toolTypes = typeof(ExternalMcpService).Assembly.GetTypes()
+            .Where(t => t.Namespace == typeof(ExternalMcpService).Namespace
+                        && t.GetCustomAttribute<McpServerToolTypeAttribute>() is not null);
+
+        foreach (var type in toolTypes)
+        foreach (var method in type.GetMethods(BindingFlags.Public | BindingFlags.Instance | BindingFlags.DeclaredOnly))
+        {
+            if (method.GetCustomAttribute<McpServerToolAttribute>() is not null)
+                yield return method;
+        }
+    }
+
+    [Fact]
+    public void NoExternalTool_HasARequiredNullableParameter()
+    {
+        var nullabilityContext = new NullabilityInfoContext();
+        var violations = new List<string>();
+
+        foreach (var method in ExternalToolMethods())
+        {
+            var schema = AIJsonUtilities.CreateFunctionJsonSchema(method);
+            var required = schema.TryGetProperty("required", out var requiredElement)
+                ? requiredElement.EnumerateArray().Select(e => e.GetString()).ToHashSet()
+                : new HashSet<string?>();
+
+            foreach (var parameter in method.GetParameters())
+            {
+                if (parameter.ParameterType == typeof(CancellationToken)) continue;
+                if (!required.Contains(parameter.Name)) continue;
+
+                var isNullableValueType = Nullable.GetUnderlyingType(parameter.ParameterType) is not null;
+                var isNullableRefType = !parameter.ParameterType.IsValueType
+                    && nullabilityContext.Create(parameter).WriteState == NullabilityState.Nullable;
+
+                if (isNullableValueType || isNullableRefType)
+                {
+                    violations.Add(
+                        $"{method.DeclaringType!.Name}.{method.Name}({parameter.Name}) is a nullable " +
+                        "type but has no default value, so MCP clients omitting it will fail. " +
+                        "Give it a default value (e.g. '= null').");
+                }
+            }
+        }
+
+        Assert.True(violations.Count == 0, string.Join(Environment.NewLine, violations));
+    }
+
+    [Fact]
+    public void ExternalToolMethods_AreDiscovered()
+    {
+        // Guards the sweep itself: if this drops to 0, ExternalToolMethods() broke silently
+        // (e.g. namespace/attribute mismatch) and the schema test above would pass vacuously.
+        Assert.True(ExternalToolMethods().Count() > 20);
+    }
+}

tests/ClaudeDo.Worker.Tests/Infrastructure/TaskStateServiceBuilder.cs

@@ -17,13 +17,15 @@ public static class TaskStateServiceBuilder
         PlanningChainCoordinator Chain,
         CapturingHubContext Hub,
         Func<int> WakeCount,
-        CountingQueueWaker Waker);
+        CountingQueueWaker Waker,
+        RunCancellationRegistry RunCancels);
 
     public static Built Build(IDbContextFactory<ClaudeDoDbContext> dbFactory)
     {
         var hub = new CapturingHubContext();
         var broadcaster = new HubBroadcaster(hub);
         var waker = new CountingQueueWaker();
+        var runCancels = new RunCancellationRegistry();
 
         TaskStateService? state = null;
         var chain = new PlanningChainCoordinator(dbFactory, () => state!);
@@ -32,9 +34,10 @@ public static class TaskStateServiceBuilder
             broadcaster,
             waker,
             chain,
+            runCancels,
             NullLogger<TaskStateService>.Instance);
 
-        return new Built(state, chain, hub, () => waker.Count, waker);
+        return new Built(state, chain, hub, () => waker.Count, waker, runCancels);
     }
 }
 

tests/ClaudeDo.Worker.Tests/Planning/PlanningChainCoordinatorTests.cs

@@ -178,6 +178,37 @@ public sealed class PlanningChainCoordinatorTests : IDisposable
         Assert.Equal(TaskStatus.Cancelled, kids[3].Status);
     }
 
+    [Fact]
+    public async Task OnChildFailed_MidChain_IdleSuccessor_DoesNotWedgeTail()
+    {
+        // Chain: c0 → c1 → c2 → c3. c1 is parked back to Idle (e.g. a manual reset)
+        // while still wired into the chain (BlockedByTaskId = c0). c0 then fails:
+        // CancelAsync(c1) is a no-op because Idle isn't a cancellable state, so the
+        // cascade must keep walking past c1 instead of leaving c2/c3 wedged forever.
+        await SeedPlanningFamilyAsync("P", 4);
+        await _sut.SetupChainAsync("P", enqueue: true, default);
+
+        await using (var ctx = _factory.CreateDbContext())
+        {
+            var c0 = await ctx.Tasks.FirstAsync(t => t.Id == "P-c0");
+            c0.Status = TaskStatus.Failed;
+            var c1 = await ctx.Tasks.FirstAsync(t => t.Id == "P-c1");
+            c1.Status = TaskStatus.Idle;
+            await ctx.SaveChangesAsync();
+        }
+
+        var advanced = await _sut.OnChildFinishedAsync("P-c0", TaskStatus.Failed, default);
+
+        Assert.Null(advanced);
+        var kids = await GetChildrenAsync("P");
+        Assert.Equal(TaskStatus.Failed, kids[0].Status);
+        // c1 was already parked Idle; the coordinator must not resurrect it.
+        Assert.Equal(TaskStatus.Idle, kids[1].Status);
+        // c2/c3 must not stay wedged as Queued+blocked forever.
+        Assert.Equal(TaskStatus.Cancelled, kids[2].Status);
+        Assert.Equal(TaskStatus.Cancelled, kids[3].Status);
+    }
+
     [Fact]
     public async Task OnChildDone_LastChild_ReturnsNull()
     {

tests/ClaudeDo.Worker.Tests/Planning/PlanningMergeOrchestratorTests.cs

@@ -348,7 +348,8 @@ public sealed class PlanningMergeOrchestratorTests : IDisposable
         GitRepoFixture.RunGit(repo.RepoDir, "branch", "-m", "main");
         var (parentId, _, _) = await SeedPlanningWithTwoNonConflictingChildrenAsync(db, repo);
 
-        File.WriteAllText(Path.Combine(repo.RepoDir, "dirty.txt"), "unstaged\n");
+        // Modify a tracked file (real uncommitted change).
+        File.WriteAllText(Path.Combine(repo.RepoDir, "README.md"), "unstaged\n");
 
         var (orch, _) = BuildOrchestrator(db);
 
@@ -357,6 +358,27 @@ public sealed class PlanningMergeOrchestratorTests : IDisposable
         Assert.Contains("uncommitted", ex.Message);
     }
 
+    [Fact]
+    public async Task StartAsync_UntrackedFileInRepo_DoesNotThrow()
+    {
+        var db = NewDb();
+        var repo = NewRepo();
+        GitRepoFixture.RunGit(repo.RepoDir, "branch", "-m", "main");
+        var (parentId, subA, subB) = await SeedPlanningWithTwoNonConflictingChildrenAsync(db, repo);
+
+        // An untracked file (e.g. left behind by a concurrent session) must not block the merge.
+        File.WriteAllText(Path.Combine(repo.RepoDir, "untracked.txt"), "stray\n");
+
+        var (orch, _) = BuildOrchestrator(db);
+
+        await orch.StartAsync(parentId, "main", CancellationToken.None);
+
+        using var ctx = db.CreateContext();
+        Assert.Equal(TaskStatus.Done, ctx.Tasks.Single(t => t.Id == parentId).Status);
+        Assert.Equal(WorktreeState.Merged, ctx.Worktrees.Single(w => w.TaskId == subA).State);
+        Assert.Equal(WorktreeState.Merged, ctx.Worktrees.Single(w => w.TaskId == subB).State);
+    }
+
     [Fact]
     public async Task StartAsync_IdempotentRestart_SkipsAlreadyMergedWorktrees()
     {

tests/ClaudeDo.Worker.Tests/Planning/WindowsTerminalLauncherTests.cs

@@ -70,6 +70,39 @@ public sealed class WindowsTerminalLauncherTests
         Assert.DoesNotContain("CLAUDEDO_LAUNCH_PROMPT", command);
     }
 
+    [Fact]
+    public void BuildPlanningStartArgs_HasPlanningFlagsAndKickoffLast()
+    {
+        var ctx = MakeStartCtx();
+
+        var args = WindowsTerminalLauncher.BuildPlanningStartArgs(ctx);
+
+        Assert.Equal("--model", args[0]);
+        var permIdx = args.ToList().IndexOf("--permission-mode");
+        Assert.True(permIdx >= 0);
+        // Default mode, NOT plan mode: plan mode gates every MCP tool call regardless of the
+        // allowlist, which would prompt on the first CreateChildTask.
+        Assert.Equal("default", args[permIdx + 1]);
+        Assert.Contains("--allowedTools", args);
+        Assert.Contains(ctx.Files.SessionDirectory, args);
+        Assert.Contains(ctx.Files.SystemPromptPath, args);
+        // Kickoff positional is the last token and points at the brief file.
+        Assert.Contains(ctx.Files.InitialPromptPath, args[^1]);
+    }
+
+    [Fact]
+    public void BuildPlanningResumeArgs_DefaultModeAllowlistsMcpAndResumes()
+    {
+        var args = WindowsTerminalLauncher.BuildPlanningResumeArgs("sess-9");
+        Assert.Equal("--permission-mode", args[0]);
+        Assert.Equal("default", args[1]);
+        Assert.Equal("--allowedTools", args[2]);
+        // The MCP planning tools must be re-allowlisted on resume: the CLI does not restore
+        // --allowedTools across a --resume, so without it CreateChildTask would prompt again.
+        Assert.Contains("mcp__claudedo__", args[3]);
+        Assert.Equal(new[] { "--resume", "sess-9" }, args.Skip(4).ToArray());
+    }
+
     [Fact]
     public void BuildResumeCommand_ResumesSessionSingleQuoted()
     {

tests/ClaudeDo.Worker.Tests/Queue/RunCancellationRegistryTests.cs

@@ -0,0 +1,51 @@
+using ClaudeDo.Worker.Queue;
+
+namespace ClaudeDo.Worker.Tests.Queue;
+
+public sealed class RunCancellationRegistryTests
+{
+    [Fact]
+    public void TryCancel_RegisteredTask_CancelsAndReturnsTrue()
+    {
+        var sut = new RunCancellationRegistry();
+        using var cts = new CancellationTokenSource();
+        sut.Register("t1", cts);
+
+        Assert.True(sut.TryCancel("t1"));
+        Assert.True(cts.IsCancellationRequested);
+    }
+
+    [Fact]
+    public void TryCancel_UnknownTask_ReturnsFalse()
+    {
+        var sut = new RunCancellationRegistry();
+        Assert.False(sut.TryCancel("nope"));
+    }
+
+    [Fact]
+    public void Unregister_RemovesOnlyTheGivenRegistration()
+    {
+        var sut = new RunCancellationRegistry();
+        using var stale = new CancellationTokenSource();
+        using var current = new CancellationTokenSource();
+
+        sut.Register("t1", stale);
+        sut.Register("t1", current); // re-run replaced the registration
+        sut.Unregister("t1", stale); // late cleanup of the old slot must not evict the new one
+
+        Assert.True(sut.TryCancel("t1"));
+        Assert.True(current.IsCancellationRequested);
+        Assert.False(stale.IsCancellationRequested);
+    }
+
+    [Fact]
+    public void TryCancel_DisposedCts_ReturnsFalse()
+    {
+        var sut = new RunCancellationRegistry();
+        var cts = new CancellationTokenSource();
+        sut.Register("t1", cts);
+        cts.Dispose();
+
+        Assert.False(sut.TryCancel("t1"));
+    }
+}

tests/ClaudeDo.Worker.Tests/Runner/GitServiceMergeTests.cs

@@ -168,6 +168,39 @@ public class GitServiceMergeTests : IDisposable
         Assert.Equal("feature/checkout-test", current);
     }
 
+    [Fact]
+    public async Task HasChangesAsync_UntrackedFileOnly_DefaultReturnsTrue()
+    {
+        if (!GitRepoFixture.IsGitAvailable()) return;
+        var repo = NewRepo();
+        File.WriteAllText(Path.Combine(repo.RepoDir, "untracked.txt"), "new\n");
+
+        var git = new GitService();
+        Assert.True(await git.HasChangesAsync(repo.RepoDir));
+    }
+
+    [Fact]
+    public async Task HasChangesAsync_UntrackedFileOnly_IncludeUntrackedFalse_ReturnsFalse()
+    {
+        if (!GitRepoFixture.IsGitAvailable()) return;
+        var repo = NewRepo();
+        File.WriteAllText(Path.Combine(repo.RepoDir, "untracked.txt"), "new\n");
+
+        var git = new GitService();
+        Assert.False(await git.HasChangesAsync(repo.RepoDir, includeUntracked: false));
+    }
+
+    [Fact]
+    public async Task HasChangesAsync_ModifiedTrackedFile_IncludeUntrackedFalse_StillReturnsTrue()
+    {
+        if (!GitRepoFixture.IsGitAvailable()) return;
+        var repo = NewRepo();
+        File.WriteAllText(Path.Combine(repo.RepoDir, "README.md"), "changed\n");
+
+        var git = new GitService();
+        Assert.True(await git.HasChangesAsync(repo.RepoDir, includeUntracked: false));
+    }
+
     [Fact]
     public async Task ListConflictedFilesAsync_MidConflict_ReturnsConflictedFile()
     {

tests/ClaudeDo.Worker.Tests/Runner/InteractiveLaunchSpecServiceTests.cs

@@ -2,6 +2,7 @@ using ClaudeDo.Data.Git;
 using ClaudeDo.Data.Models;
 using ClaudeDo.Data.Repositories;
 using ClaudeDo.Worker.Config;
+using ClaudeDo.Worker.Planning;
 using ClaudeDo.Worker.Runner;
 using ClaudeDo.Worker.Skills;
 using ClaudeDo.Worker.Tests.Infrastructure;
@@ -51,6 +52,8 @@ public sealed class InteractiveLaunchSpecServiceTests : IDisposable
         _db.Dispose();
         foreach (var f in _gitFixtures) f.Dispose();
         try { Directory.Delete(_tempDir, true); } catch { /* best effort */ }
+        foreach (var d in _mergeHelperSessionDirs)
+            try { Directory.Delete(d, true); } catch { /* best effort */ }
     }
 
     private sealed class FakeSessionSkillRegistry : ISessionSkillRegistry
@@ -69,23 +72,23 @@ public sealed class InteractiveLaunchSpecServiceTests : IDisposable
             new WorktreeManager(new GitService(), _db.CreateFactory(), new WorkerConfig(), NullLogger<WorktreeManager>.Instance),
             new WorkerConfig { ClaudeBin = _claudeStubPath });
 
-    private async Task<string> SeedListAsync(string? workingDir = null)
+    private async Task<string> SeedListAsync(string? workingDir = null, string name = "L")
     {
         var listId = Guid.NewGuid().ToString();
         using var ctx = _db.CreateContext();
         await new ListRepository(ctx).AddAsync(new ListEntity
         {
-            Id = listId, Name = "L", WorkingDir = workingDir ?? _tempDir, CreatedAt = DateTime.UtcNow,
+            Id = listId, Name = name, WorkingDir = workingDir ?? _tempDir, CreatedAt = DateTime.UtcNow,
         });
         return listId;
     }
 
-    private async Task SeedTaskAsync(string taskId, string listId, TaskStatus status, string? sessionSkillsJson = null)
+    private async Task SeedTaskAsync(string taskId, string listId, TaskStatus status, string? sessionSkillsJson = null, string title = "T")
     {
         using var ctx = _db.CreateContext();
         await new TaskRepository(ctx).AddAsync(new TaskEntity
         {
-            Id = taskId, ListId = listId, Title = "T", Status = status,
+            Id = taskId, ListId = listId, Title = title, Status = status,
             CreatedAt = DateTime.UtcNow, SessionSkills = sessionSkillsJson,
         });
     }
@@ -342,4 +345,172 @@ public sealed class InteractiveLaunchSpecServiceTests : IDisposable
         await Assert.ThrowsAsync<InvalidOperationException>(
             () => svc.BuildForDirectoryAsync(Path.Combine(_tempDir, "does-not-exist"), CancellationToken.None));
     }
+
+    // ── Merge helper ──
+
+    private readonly List<string> _mergeHelperSessionDirs = new();
+
+    /// The session dir is the value right after --add-dir; register it for cleanup
+    /// (BuildForMergeHelperAsync writes under the real ~/.todo-app).
+    private string TrackSessionDir(LaunchSpec spec)
+    {
+        var args = spec.Args.ToList();
+        var dir = args[args.IndexOf("--add-dir") + 1];
+        _mergeHelperSessionDirs.Add(dir);
+        return dir;
+    }
+
+    [Fact]
+    public async Task BuildForMergeHelperAsync_EmptyTaskIds_ThrowsInvalidOperation()
+    {
+        var svc = BuildService();
+        await Assert.ThrowsAsync<InvalidOperationException>(
+            () => svc.BuildForMergeHelperAsync(Array.Empty<string>(), null, CancellationToken.None));
+    }
+
+    [Fact]
+    public async Task BuildForMergeHelperAsync_NoExistingWorkingDirs_ThrowsInvalidOperation()
+    {
+        var listId = await SeedListAsync(workingDir: Path.Combine(_tempDir, "gone"));
+        var taskId = Guid.NewGuid().ToString();
+        await SeedTaskAsync(taskId, listId, TaskStatus.WaitingForReview);
+
+        var svc = BuildService();
+        var ex = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => svc.BuildForMergeHelperAsync(new[] { taskId }, null, CancellationToken.None));
+        Assert.Contains("working directory", ex.Message);
+    }
+
+    [Fact]
+    public async Task BuildForMergeHelperAsync_TasksAcrossTwoRepos_BuildsGlobalScopeSpec()
+    {
+        var repoA = Path.Combine(_tempDir, "repoA");
+        var repoB = Path.Combine(_tempDir, "repoB");
+        Directory.CreateDirectory(repoA);
+        Directory.CreateDirectory(repoB);
+
+        var listA = await SeedListAsync(workingDir: repoA, name: "Alpha");
+        var listB = await SeedListAsync(workingDir: repoB, name: "Beta");
+        var t1 = Guid.NewGuid().ToString();
+        var t2 = Guid.NewGuid().ToString();
+        var t3 = Guid.NewGuid().ToString();
+        await SeedTaskAsync(t1, listA, TaskStatus.WaitingForReview, title: "First task");
+        await SeedTaskAsync(t2, listB, TaskStatus.Idle, title: "Second task");
+        await SeedTaskAsync(t3, listA, TaskStatus.Failed, title: "Third task"); // same repo as t1 -> distinct
+
+        var svc = BuildService();
+        var spec = await svc.BuildForMergeHelperAsync(new[] { t1, t2, t3 }, null, CancellationToken.None);
+        var sessionDir = TrackSessionDir(spec);
+
+        // cwd: no listId -> first existing repo dir.
+        Assert.Equal(repoA, spec.Cwd);
+        Assert.Equal(_claudeStubPath, spec.Exe);
+
+        var args = spec.Args.ToList();
+
+        // --permission-mode default
+        var pmIdx = args.IndexOf("--permission-mode");
+        Assert.True(pmIdx >= 0);
+        Assert.Equal("default", args[pmIdx + 1]);
+
+        // allowedTools string for the merge helper
+        var atIdx = args.IndexOf("--allowedTools");
+        Assert.Equal("mcp__claudedo__*,Read,Grep,Glob,Edit,Bash,WebFetch,WebSearch,Skill", args[atIdx + 1]);
+
+        // --add-dir: session dir + BOTH distinct repo dirs (repoA only once)
+        var addIdx = args.IndexOf("--add-dir");
+        var appendIdx = args.IndexOf("--append-system-prompt-file");
+        var addDirs = args.GetRange(addIdx + 1, appendIdx - addIdx - 1);
+        Assert.Equal(new[] { sessionDir, repoA, repoB }, addDirs);
+
+        // system prompt file follows --append-system-prompt-file
+        var systemPromptPath = args[appendIdx + 1];
+        Assert.Equal(Path.Combine(sessionDir, "system-prompt.md"), systemPromptPath);
+        Assert.True(File.Exists(systemPromptPath));
+
+        // kickoff is the LAST arg (positional), single line, points at brief.md
+        var kickoff = args[^1];
+        var briefPath = Path.Combine(sessionDir, "brief.md");
+        Assert.Contains(briefPath, kickoff);
+        Assert.DoesNotContain('\n', kickoff);
+
+        // brief exists, carries the scope label and every task's title
+        Assert.True(File.Exists(briefPath));
+        var brief = File.ReadAllText(briefPath);
+        Assert.Contains("Scope: All lists", brief);
+        Assert.Contains("First task", brief);
+        Assert.Contains("Second task", brief);
+        Assert.Contains("Third task", brief);
+
+        Assert.Equal("200000", spec.Env["MCP_TOOL_TIMEOUT"]);
+    }
+
+    [Fact]
+    public async Task BuildForMergeHelperAsync_WithListId_UsesListWorkingDirAsCwdAndListScope()
+    {
+        var repoA = Path.Combine(_tempDir, "repoA2");
+        var repoB = Path.Combine(_tempDir, "repoB2");
+        Directory.CreateDirectory(repoA);
+        Directory.CreateDirectory(repoB);
+
+        var listA = await SeedListAsync(workingDir: repoA, name: "Alpha");
+        var listB = await SeedListAsync(workingDir: repoB, name: "Beta");
+        var t1 = Guid.NewGuid().ToString();
+        var t2 = Guid.NewGuid().ToString();
+        await SeedTaskAsync(t1, listA, TaskStatus.WaitingForReview, title: "Task in Alpha");
+        await SeedTaskAsync(t2, listB, TaskStatus.WaitingForReview, title: "Task in Beta");
+
+        var svc = BuildService();
+        // Scope on listB even though listA's task comes first: cwd must be listB's repo.
+        var spec = await svc.BuildForMergeHelperAsync(new[] { t1, t2 }, listB, CancellationToken.None);
+        var sessionDir = TrackSessionDir(spec);
+
+        Assert.Equal(repoB, spec.Cwd);
+
+        var brief = File.ReadAllText(Path.Combine(sessionDir, "brief.md"));
+        Assert.Contains("Scope: List: Beta", brief);
+        Assert.Contains("Task in Alpha", brief);
+        Assert.Contains("Task in Beta", brief);
+    }
+
+    [Fact]
+    public void BuildPlanningStart_MapsPlanningArgsAndEnv()
+    {
+        var sessionDir = Path.Combine(_tempDir, "sess");
+        Directory.CreateDirectory(sessionDir);
+        var ctx = new PlanningSessionStartContext(
+            ParentTaskId: "p1", WorkingDir: _worktreeDir, Token: "tok-1",
+            WorktreePath: _worktreeDir, BranchName: "claudedo/planning/p1",
+            Files: new PlanningSessionFiles(sessionDir,
+                Path.Combine(sessionDir, "system-prompt.md"),
+                Path.Combine(sessionDir, "initial-prompt.txt")));
+
+        var spec = BuildService().BuildPlanningStart(ctx);
+
+        Assert.Equal(_worktreeDir, spec.Cwd);
+        Assert.Equal(_claudeStubPath, spec.Exe);
+        Assert.Contains("--permission-mode", spec.Args);
+        // Default mode, not plan mode -- plan mode would gate the MCP planning tools.
+        Assert.Contains("default", spec.Args);
+        Assert.Equal("tok-1", spec.Env["CLAUDEDO_PLANNING_TOKEN"]);
+        Assert.Equal("20000", spec.Env["MAX_THINKING_TOKENS"]);
+    }
+
+    [Fact]
+    public void BuildPlanningResume_MapsResumeArgsAndToken()
+    {
+        var ctx = new PlanningSessionResumeContext(
+            ParentTaskId: "p1", WorkingDir: _worktreeDir,
+            ClaudeSessionId: "sess-42", Token: "tok-2", WorktreePath: _worktreeDir);
+
+        var spec = BuildService().BuildPlanningResume(ctx);
+
+        Assert.Equal("--permission-mode", spec.Args[0]);
+        Assert.Equal("default", spec.Args[1]);
+        Assert.Equal("--allowedTools", spec.Args[2]);
+        Assert.Contains("mcp__claudedo__", spec.Args[3]);
+        Assert.Equal(new[] { "--resume", "sess-42" }, spec.Args.Skip(4).ToArray());
+        Assert.Equal("tok-2", spec.Env["CLAUDEDO_PLANNING_TOKEN"]);
+        Assert.Equal(_worktreeDir, spec.Cwd);
+    }
 }

tests/ClaudeDo.Worker.Tests/Services/QueueServiceSlotGuardTests.cs

@@ -52,13 +52,14 @@ public sealed class QueueServiceSlotGuardTests : IDisposable
         var dbFactory = _db.CreateFactory();
         var wtManager = new WorktreeManager(new ClaudeDo.Data.Git.GitService(), dbFactory, _cfg, NullLogger<WorktreeManager>.Instance);
         var argsBuilder = new ClaudeArgsBuilder();
-        var state = TaskStateServiceBuilder.Build(dbFactory).State;
+        var built = TaskStateServiceBuilder.Build(dbFactory);
+        var state = built.State;
         var runner = new TaskRunner(fake, dbFactory, broadcaster, wtManager, argsBuilder, _cfg,
             NullLogger<TaskRunner>.Instance, state, new TaskRunTokenRegistry(), new AttachmentStore(), new FakeSessionSkillSeeder());
         _waker = new QueueWaker();
         var picker = new QueuePicker(dbFactory);
-        var overrideSlot = new OverrideSlotService(dbFactory, runner, NullLogger<OverrideSlotService>.Instance);
-        var service = new QueueService(dbFactory, runner, _cfg, NullLogger<QueueService>.Instance, _waker, picker, overrideSlot, state);
+        var overrideSlot = new OverrideSlotService(dbFactory, runner, NullLogger<OverrideSlotService>.Instance, built.RunCancels);
+        var service = new QueueService(dbFactory, runner, _cfg, NullLogger<QueueService>.Instance, _waker, picker, overrideSlot, state, built.RunCancels);
         return (service, fake);
     }
 

tests/ClaudeDo.Worker.Tests/Services/QueueServiceTests.cs

@@ -53,13 +53,14 @@ public sealed class QueueServiceTests : IDisposable
         var dbFactory = _db.CreateFactory();
         var wtManager = new WorktreeManager(new GitService(), dbFactory, _cfg, NullLogger<WorktreeManager>.Instance);
         var argsBuilder = new ClaudeArgsBuilder();
-        var state = TaskStateServiceBuilder.Build(dbFactory).State;
+        var built = TaskStateServiceBuilder.Build(dbFactory);
+        var state = built.State;
         var runner = new TaskRunner(fake, dbFactory, broadcaster, wtManager, argsBuilder, _cfg,
             NullLogger<TaskRunner>.Instance, state, new TaskRunTokenRegistry(), new AttachmentStore(), new FakeSessionSkillSeeder());
         _waker = new QueueWaker();
         var picker = new QueuePicker(dbFactory);
-        var overrideSlot = new OverrideSlotService(dbFactory, runner, NullLogger<OverrideSlotService>.Instance);
-        var service = new QueueService(dbFactory, runner, _cfg, NullLogger<QueueService>.Instance, _waker, picker, overrideSlot, state);
+        var overrideSlot = new OverrideSlotService(dbFactory, runner, NullLogger<OverrideSlotService>.Instance, built.RunCancels);
+        var service = new QueueService(dbFactory, runner, _cfg, NullLogger<QueueService>.Instance, _waker, picker, overrideSlot, state, built.RunCancels);
         return (service, fake);
     }
 

tests/ClaudeDo.Worker.Tests/Services/TaskMergeServiceTests.cs

@@ -302,8 +302,8 @@ public class TaskMergeServiceTests : IDisposable
         var wtCtx = await wtMgr.CreateAsync(task, list, CancellationToken.None);
         _wtCleanups.Add((repo.RepoDir, wtCtx.WorktreePath));
 
-        // Dirty the target working dir.
-        File.WriteAllText(Path.Combine(repo.RepoDir, "dirt.txt"), "dirty\n");
+        // Modify a tracked file in the target working dir (real uncommitted change).
+        File.WriteAllText(Path.Combine(repo.RepoDir, "README.md"), "dirty\n");
 
         var (svc, _) = BuildService(db);
         var result = await svc.MergeAsync(task.Id, "main", false, "Merge", CancellationToken.None);
@@ -312,6 +312,33 @@ public class TaskMergeServiceTests : IDisposable
         Assert.Contains("uncommitted", result.ErrorMessage ?? "");
     }
 
+    [Fact]
+    public async Task MergeAsync_UntrackedFileInTargetWorkingTree_DoesNotBlock()
+    {
+        if (!GitRepoFixture.IsGitAvailable()) return;
+        var repo = NewRepo();
+        var db = NewDb();
+        var (list, task) = await SeedListAndTask(db, workingDir: repo.RepoDir, status: TaskStatus.Done);
+
+        var wtMgr = BuildWorktreeManager(db);
+        var wtCtx = await wtMgr.CreateAsync(task, list, CancellationToken.None);
+        _wtCleanups.Add((repo.RepoDir, wtCtx.WorktreePath));
+
+        File.WriteAllText(Path.Combine(wtCtx.WorktreePath, "feature.txt"), "x\n");
+        await wtMgr.CommitIfChangedAsync(wtCtx, task, list, CancellationToken.None);
+
+        // An untracked file (e.g. left behind by a concurrent session) must not block the merge.
+        File.WriteAllText(Path.Combine(repo.RepoDir, "untracked.txt"), "stray\n");
+
+        var (svc, _) = BuildService(db);
+        var currentBranch = await new GitService().GetCurrentBranchAsync(repo.RepoDir);
+
+        var result = await svc.MergeAsync(task.Id, currentBranch, removeWorktree: false,
+            commitMessage: "Merge", ct: CancellationToken.None);
+
+        Assert.Equal("merged", result.Status);
+    }
+
     [Fact]
     public async Task MergeAsync_TargetBranchDifferentFromHead_ChecksOutBeforeMerging()
     {
@@ -410,6 +437,52 @@ public class TaskMergeServiceTests : IDisposable
         Assert.Equal(WorktreeState.Merged, wt.State);
     }
 
+    [Fact]
+    public async Task ContinueMergeAsync_UnresolvedConflictMarkersLeft_RefusesAndDoesNotCommit()
+    {
+        if (!GitRepoFixture.IsGitAvailable()) return;
+
+        var db = NewDb();
+        var repo = NewRepo();
+        GitRepoFixture.RunGit(repo.RepoDir, "branch", "-m", "main");
+
+        File.WriteAllText(Path.Combine(repo.RepoDir, "README.md"), "# main change\n");
+        GitRepoFixture.RunGit(repo.RepoDir, "commit", "-am", "main change");
+
+        var wtPath = Path.Combine(Path.GetTempPath(), $"wt_{Guid.NewGuid():N}");
+        _wtCleanups.Add((repo.RepoDir, wtPath));
+        GitRepoFixture.RunGit(repo.RepoDir, "worktree", "add", "-b", "claudedo/t4", wtPath, repo.BaseCommit);
+        File.WriteAllText(Path.Combine(wtPath, "README.md"), "# branch change\n");
+        GitRepoFixture.RunGit(wtPath, "commit", "-am", "branch change");
+
+        var (_, task) = await SeedListAndTask(db, workingDir: repo.RepoDir, status: TaskStatus.Done);
+        await SeedWorktree(db, task.Id, wtPath, "claudedo/t4", repo.BaseCommit);
+
+        var (svc, _) = BuildService(db);
+
+        var first = await svc.MergeAsync(task.Id, "main", false, "msg",
+            leaveConflictsInTree: true, CancellationToken.None);
+        Assert.Equal(TaskMergeService.StatusConflict, first.Status);
+        var headBefore = GitRepoFixture.RunGit(repo.RepoDir, "rev-parse", "HEAD").Trim();
+
+        // User never resolves the conflict — README.md still contains "<<<<<<<" markers.
+        var result = await svc.ContinueMergeAsync(task.Id, CancellationToken.None);
+
+        Assert.Equal(TaskMergeService.StatusConflict, result.Status);
+        Assert.Contains("README.md", result.ConflictFiles);
+        Assert.Contains("<<<<<<<", File.ReadAllText(Path.Combine(repo.RepoDir, "README.md")));
+
+        // No commit must have happened, and the repo must still be mid-merge so Abort can clean it up.
+        Assert.Equal(headBefore, GitRepoFixture.RunGit(repo.RepoDir, "rev-parse", "HEAD").Trim());
+        Assert.True(await new GitService().IsMidMergeAsync(repo.RepoDir));
+
+        var abort = await svc.AbortMergeAsync(task.Id, CancellationToken.None);
+
+        Assert.Equal(TaskMergeService.StatusAborted, abort.Status);
+        Assert.False(await new GitService().IsMidMergeAsync(repo.RepoDir));
+        Assert.True(string.IsNullOrWhiteSpace(GitRepoFixture.RunGit(repo.RepoDir, "status", "--porcelain")));
+    }
+
     [Fact]
     public async Task AbortMergeAsync_AfterConflict_RestoresCleanStateAndLeavesWorktreeActive()
     {

tests/ClaudeDo.Worker.Tests/State/ReviewTransitionTests.cs

@@ -87,6 +87,38 @@ public sealed class ReviewTransitionTests : IDisposable
         Assert.Equal(TaskStatus.Queued, (await GetTaskAsync(id)).Status);
     }
 
+    // ─── SubmitInteractiveForReviewAsync ──────────────────────────────────
+
+    [Theory]
+    [InlineData(TaskStatus.Idle)]
+    [InlineData(TaskStatus.Failed)]
+    public async Task SubmitInteractiveForReviewAsync_FromIdleOrFailed_TransitionsToWaitingForReview(TaskStatus from)
+    {
+        var id = await SeedTaskAsync(from);
+
+        var result = await _sut.SubmitInteractiveForReviewAsync(id, DateTime.UtcNow, default);
+
+        Assert.True(result.Ok);
+        var t = await GetTaskAsync(id);
+        Assert.Equal(TaskStatus.WaitingForReview, t.Status);
+        Assert.NotNull(t.FinishedAt);
+    }
+
+    [Theory]
+    [InlineData(TaskStatus.Running)]
+    [InlineData(TaskStatus.Queued)]
+    [InlineData(TaskStatus.Done)]
+    [InlineData(TaskStatus.WaitingForReview)]
+    public async Task SubmitInteractiveForReviewAsync_FromOtherStates_Rejects(TaskStatus from)
+    {
+        var id = await SeedTaskAsync(from);
+
+        var result = await _sut.SubmitInteractiveForReviewAsync(id, DateTime.UtcNow, default);
+
+        Assert.False(result.Ok);
+        Assert.Equal(from, (await GetTaskAsync(id)).Status);
+    }
+
     // ─── ApproveReviewAsync ───────────────────────────────────────────────
 
     [Fact]

tests/ClaudeDo.Worker.Tests/UiVm/TasksIslandViewModelPlanningTests.cs

@@ -72,10 +72,19 @@ sealed class FakeWorkerClient : IWorkerClient
     public int PickUpInTerminalCalls { get; private set; }
     public string? LastPickUpTaskId { get; private set; }
     public Task ResumeTaskInTerminalAsync(string taskId, CancellationToken ct = default) { PickUpInTerminalCalls++; LastPickUpTaskId = taskId; return Task.CompletedTask; }
+    public Task SubmitTaskForReviewAsync(string taskId, CancellationToken ct = default) => Task.CompletedTask;
     public Task<LaunchSpec> GetInteractiveLaunchSpecAsync(string taskId, CancellationToken ct = default)
         => Task.FromResult(new LaunchSpec(".", "claude", Array.Empty<string>(), new Dictionary<string, string>()));
+    public Task<LaunchSpec> GetMergeHelperLaunchSpecAsync(IReadOnlyList<string> taskIds, string? listId, CancellationToken ct = default)
+        => Task.FromResult(new LaunchSpec(".", "claude", Array.Empty<string>(), new Dictionary<string, string>()));
     public Task<LaunchSpec> GetAdHocLaunchSpecAsync(string directory, CancellationToken ct = default)
         => Task.FromResult(new LaunchSpec(directory, "claude", Array.Empty<string>(), new Dictionary<string, string>()));
+    public int PlanningStartSpecCalls { get; private set; }
+    public int PlanningResumeSpecCalls { get; private set; }
+    public Task<LaunchSpec> GetPlanningStartLaunchSpecAsync(string taskId, CancellationToken ct = default)
+    { PlanningStartSpecCalls++; return Task.FromResult(new LaunchSpec(".", "claude", Array.Empty<string>(), new Dictionary<string, string>())); }
+    public Task<LaunchSpec> GetPlanningResumeLaunchSpecAsync(string taskId, CancellationToken ct = default)
+    { PlanningResumeSpecCalls++; return Task.FromResult(new LaunchSpec(".", "claude", Array.Empty<string>(), new Dictionary<string, string>())); }
     public Task QueuePlanningSubtasksAsync(string parentTaskId, CancellationToken ct = default) => Task.CompletedTask;
     public Task ResumePlanningSessionAsync(string taskId, CancellationToken ct = default) { ResumePlanningCalls++; return Task.CompletedTask; }
     public Task<DiscardPlanningOutcome> DiscardPlanningSessionAsync(string taskId, bool dequeueQueuedChildren = false, CancellationToken ct = default)
@@ -224,25 +233,29 @@ public class TasksIslandViewModelPlanningTests
     }
 
     [Fact]
-    public async Task OpenPlanningSession_IgnoresNonIdleRow()
+    public void OpenPlanningSession_IgnoresNonIdleRow()
     {
         var row = MakeRow("t1", TaskStatus.Queued);
-        var (vm, worker) = VmFactory.Create([row]);
+        var (vm, _) = VmFactory.Create([row]);
+        (string TaskId, bool Resume)? raised = null;
+        vm.OpenPlanningConPtyRequested += (id, resume) => raised = (id, resume);
 
-        await ((IAsyncRelayCommand<TaskRowViewModel?>)vm.OpenPlanningSessionCommand).ExecuteAsync(row);
+        vm.OpenPlanningSessionCommand.Execute(row);
 
-        Assert.Equal(0, worker.StartPlanningCalls);
+        Assert.Null(raised);
     }
 
     [Fact]
-    public async Task OpenPlanningSession_CallsWorkerForIdleRow()
+    public void OpenPlanningSession_RequestsConPtyPaneForIdleRow()
     {
         var row = MakeRow("t1", TaskStatus.Idle);
-        var (vm, worker) = VmFactory.Create([row]);
+        var (vm, _) = VmFactory.Create([row]);
+        (string TaskId, bool Resume)? raised = null;
+        vm.OpenPlanningConPtyRequested += (id, resume) => raised = (id, resume);
 
-        await ((IAsyncRelayCommand<TaskRowViewModel?>)vm.OpenPlanningSessionCommand).ExecuteAsync(row);
+        vm.OpenPlanningSessionCommand.Execute(row);
 
-        Assert.Equal(1, worker.StartPlanningCalls);
+        Assert.Equal(("t1", false), raised);
     }
 
     [Fact]

tests/ClaudeDo.Worker.Tests/WaitingForChildrenLifecycleTests.cs

@@ -183,6 +183,72 @@ public sealed class WaitingForChildrenLifecycleTests : IDisposable
         }
     }
 
+    [Fact]
+    public async Task Cancelling_WaitingForChildren_parent_cascades_to_nonterminal_children()
+    {
+        using (var ctx = _db.CreateContext())
+        {
+            ctx.Lists.Add(new ListEntity { Id = "l1", Name = "L", CreatedAt = DateTime.UtcNow });
+            ctx.Tasks.Add(new TaskEntity { Id = "par", ListId = "l1", Title = "Parent",
+                Status = TaskStatus.WaitingForChildren, CreatedAt = DateTime.UtcNow });
+            ctx.Tasks.Add(new TaskEntity { Id = "c_running", ListId = "l1", Title = "Running child",
+                Status = TaskStatus.Running, ParentTaskId = "par", CreatedAt = DateTime.UtcNow });
+            ctx.Tasks.Add(new TaskEntity { Id = "c_queued", ListId = "l1", Title = "Queued child",
+                Status = TaskStatus.Queued, ParentTaskId = "par", BlockedByTaskId = "c_running",
+                CreatedAt = DateTime.UtcNow });
+            await ctx.SaveChangesAsync();
+        }
+
+        var result = await _built.State.CancelAsync("par", DateTime.UtcNow, default);
+
+        Assert.True(result.Ok);
+        using var ctx2 = _db.CreateContext();
+        var repo = new TaskRepository(ctx2);
+        var parent = await repo.GetByIdAsync("par");
+        var runningChild = await repo.GetByIdAsync("c_running");
+        var queuedChild = await repo.GetByIdAsync("c_queued");
+
+        Assert.Equal(TaskStatus.Cancelled, parent!.Status);
+        Assert.Equal(TaskStatus.Cancelled, runningChild!.Status);
+        Assert.Equal(TaskStatus.Cancelled, queuedChild!.Status);
+        Assert.Null(queuedChild.BlockedByTaskId);
+    }
+
+    [Fact]
+    public async Task Cancelling_WaitingForChildren_parent_stops_running_child_process()
+    {
+        using (var ctx = _db.CreateContext())
+        {
+            ctx.Lists.Add(new ListEntity { Id = "l1", Name = "L", CreatedAt = DateTime.UtcNow });
+            ctx.Tasks.Add(new TaskEntity { Id = "par", ListId = "l1", Title = "Parent",
+                Status = TaskStatus.WaitingForChildren, CreatedAt = DateTime.UtcNow });
+            ctx.Tasks.Add(new TaskEntity { Id = "c_running", ListId = "l1", Title = "Running child",
+                Status = TaskStatus.Running, ParentTaskId = "par", CreatedAt = DateTime.UtcNow });
+            await ctx.SaveChangesAsync();
+        }
+
+        using var childCts = new CancellationTokenSource();
+        _built.RunCancels.Register("c_running", childCts);
+
+        var result = await _built.State.CancelAsync("par", DateTime.UtcNow, default);
+
+        Assert.True(result.Ok);
+        Assert.True(childCts.IsCancellationRequested);
+    }
+
+    [Fact]
+    public async Task Cancelling_running_task_signals_its_registered_run()
+    {
+        var id = await SeedRunningStandaloneAsync();
+        using var cts = new CancellationTokenSource();
+        _built.RunCancels.Register(id, cts);
+
+        var result = await _built.State.CancelAsync(id, DateTime.UtcNow, default);
+
+        Assert.True(result.Ok);
+        Assert.True(cts.IsCancellationRequested);
+    }
+
     // ─── FinalizePlanningAsync ────────────────────────────────────────────
 
     private async Task<string> SeedActivePlanningParentAsync(string id = "par")