feat(ui): show the origin list chip in smart lists

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -1,5 +1,306 @@
 # Changelog
 
+## v2.19.0 — 2026-10-02
+
+### Features
+
+- resolve conflicts straight from the merge modal (214e53b7)
+- ssh workspaces settings tab (89ed8852)
+- ssh workspaces as quick-session targets in mission control (6c400dfb)
+- ssh launch spec with reverse-tunnelled claudedo MCP (1b58e628)
+- remote MCP listener gated by per-session tokens (34970ca6)
+- store ssh workspaces on app_settings (03143198)
+- folder/file-type icons and change-kind colours in the file tree (ae778d5c)
+- offer Mark as Idle for cancelled tasks (3fab4016)
+- attach clipboard image on Ctrl+V in the task description (393e5946)
+- rename sessions inline in the Recent sessions flyout (5bf08873)
+- merge helper knows company-repo approve ends in a draft PR (0e6a48e2)
+- external services tab with Azure DevOps PAT, draft PR button and link in company repos (4976ded7)
+- show running Worker operations in a Running now section (2dbec543)
+- Azure DevOps PAT settings and connection test (fed0b6ac)
+- approve in a company repo verifies in the worktree, pushes and opens a draft PR (bc959f25)
+- company unit roots start from a fetched origin base, local base fast-forwarded best-effort (7f7f2376)
+- Azure DevOps client and PAT store, ported from pr-create.ps1 (78f4d182)
+- fetch/push/ff primitives with auth env, no task trailer in company repos (76f260a9)
+- worktrees.pull_request_url for the company-repo draft PR (bc0aa28a)
+- show task number in Mission Control activity strip (f66cbca6)
+- combined diff of a unit is base..head, no integration branch checkout (44d94caa)
+- approve a unit parent like a single task, orchestrator only for legacy units (1f373a5a)
+- fast-forward finished children into the parent's unit branch (9da522b0)
+- add ff-only merge and allow a merged worktree without merge commit (724ad90f)
+- colour agent output by kind and stop cutting tool calls at 120 chars (9bb0e67a)
+- base branch field in list settings, real branch names in dialogs (ae845bf0)
+- use the list base branch as worktree base and default merge target (69c7803b)
+- per-list base branch, preserved by every config writer (3fe1fead)
+- name task branches <type>/<number>-<slug> (814b083a)
+- branch type and number rules for task branches (4a9cff55)
+- selectable list/folder colors with accent-aware swatches and custom picker (a6926f53)
+- detect company repos by origin remote pattern (faa91e06)
+- stream claude update progress into the footer strip (2b19c8c4)
+- swap tiles by dragging their header (97af85c8)
+- tickets + plan day button, fallback list and prime action (e35b054a)
+- add RunTicketImportNow and ticket fallback list endpoints (9fc2e26e)
+- ImportTickets runs the ticket import before filling MyDay (915f2c83)
+- add get_ticket_import_candidates and import_ticket tools (57c30c4a)
+- sweep all project boards for assigned tickets and tasks (47583ab1)
+- add ImportTickets prime kind, ticket fallback list and import prompt (a0b234fe)
+
+### Fixes
+
+- pass the stash consent to the conflict resolver so it opens on a dirty target (feb0afa3)
+- auto-scroll the lists sidebar while dragging near its top/bottom edge (bba7117d)
+- close the pseudo console when a conpty tile is disposed (a75acbb2)
+- remove remote mcp config via trap when the tile kills ssh (b35755e1)
+- put ~/.local/bin on PATH for remote claude in ssh sessions (4b1f5c65)
+- ssh settings tab survives an offline worker without wiping workspaces (8c5db95c)
+- stop pinning --effort on hand-driven interactive sessions (d9f42d7d)
+- drop outbound HttpClient request logs from the worker log (542501cb)
+- wrap table headers, ellipsis-trim long cells with tooltip (b7e7aebc)
+- offer clean reset for parked tasks in the Git tab (9a9b86fd)
+- detect external merges, clean up empty dirs, prune in owning repo (0c0bb7f2)
+- Log Visualizer shows every footer-log message (c956ab10)
+- align island header separators via shared header height (34c71bbe)
+- show post-merge verify as Verifying instead of In review (46e9303d)
+- open diff viewer and merge window as independent top-level windows (0fea339b)
+- reset cursor to arrow over pane header buttons (74e06d62)
+- preview_merge_set no longer reports a symbol the same diff re-declares (06fb73c4)
+- batch_get_tasks accept "number" and "id" in fields filter (ef5dad27)
+- Mission Control no longer lists finished operations as running (e9c1ff2e)
+- drop SignalR hub invocation events so PATs stay out of the worker log (61645acf)
+- strip credentials from origin URL in the not-ready message (c834f17c)
+- kept worktree in a company repo opens a PR, unexpected ADO/git errors never fail a task start (4917533c)
+- keep Git Credential Manager from prompting during company fetch/push (674db27f)
+- open the merge modal non-modal so a running merge no longer blocks the main window (3d74e3da)
+- hide Submit for review on list-handler panes in Mission Control (0cfc28ad)
+- prevent dragging completed tasks in the task list (b776fd28)
+- add right padding to add-task input so the caret clears the last glyph (335bfe95)
+- block approve of a planning parent with an unfinished child, surface git stderr on ff failure (acd188bc)
+- return to the list base branch after integration cleanup, not a guessed task branch (cd5b27c0)
+- deliver AltGr characters to ConPTY tiles as text (cf3db919)
+- register ticket import tools in the external MCP container (2b40ea2d)
+
+### Performance
+
+- read untracked-worktree sweep from .git instead of spawning git per list (59d990c2)
+
+### Refactoring
+
+- drop ForceSetStatusAsync, route every status write through a guarded transition (ff7197c4)
+- delete dead Icon.* geometries and icon-stroke styles, add MDI name guard test (de685151)
+- Material icons for list, folder and smart-list icon keys with legacy mapping (7c0fe92a)
+- drop harness duplicates and maintainer notes from bundled prompts (a76788a5)
+- detect untracked worktrees by path instead of branch prefix (8911408b)
+
+### Documentation
+
+- document ssh workspace sessions (2e29e03a)
+- spec and plan for ssh workspace sessions (f7625baa)
+- document company mode (fetch, push, draft PR) and its open smoke tests (93fd6740)
+- plan for unit branch part 3 (company mode, draft PR) (2b2f61d7)
+- describe unit-branch routing in the review_task tool description (a3538973)
+- document unit branch, child absorb and legacy approve routing (82336848)
+- plan for unit branch part 2 (children fast-forward) (dc73f138)
+- document new branch naming and per-list base branch (8ac272df)
+- unit branch part 1 - naming and per-list base branch (db3c7e69)
+- per-list base branch and fetch before unit branch (3dc735b2)
+- unit branch and draft PR design (0e9373c0)
+- note the external MCP DI registration trap (16adcad8)
+- document cross-project ticket import and open checks (7724f5eb)
+- note the ImportTickets prime radio and the ticket fallback list (cb775958)
+- implementation plan for cross-project ticket import (c34680b4)
+- switch import source to project-board sweep after live probe (5bb49495)
+- design for cross-project ticket import with day planning (0ac49653)
+- update for v2.18.0 (899648ad)
+
+## v2.18.0 — 2026-09-30
+
+### Features
+
+- column picker for the overview grid (a7c3d185)
+- folders slide open and closed, rows below follow (2be8ba5d)
+- animate folder expand in the sidebar (928e3905)
+- assign a colour to a sidebar folder (bb92dc27)
+- write weekly report as short bullets with haiku (8a31a67c)
+- searchable Material Design icon library for lists and folders (f2ff865d)
+- coloured dots for icon-less lists, guide line under chevron (9991f1fc)
+- make sidebar folder hierarchy readable (75b78cb2)
+- mission-control pane title shows usage limit reset time (5be97256)
+
+### Fixes
+
+- Recent-Sessions Resume/Brief-Buttons fuehren ihren Command wieder aus (60358100)
+- convert ticket HTML to markdown on import (27d2b1d8)
+- stop row buttons flashing disabled while a row command runs (2558e02b)
+- show diff window before parsing so ParseOp spinner is visible (ecb1cdbb)
+
+### Documentation
+
+- add visual verification session notes 2026-09-16 (05deda83)
+- update for v2.17.0 (f88d2a89)
+
+## v2.17.0 — 2026-09-28
+
+### Features
+
+- allow nested sidebar folders via drag and drop (0dac047c)
+- UI-Prozess loggt auf Platte (ui-.log) + fehlgeschlagene Hub- (57dd6766)
+- Mission Control Recent Sessions mit verschachtelten Handoffs (d3db4455)
+- Mission-Control-Kacheln behalten Position und Identitaetsfarbe ueber Handoffs (e0a1448f)
+
+### Fixes
+
+- Interactive sessions no longer Instantly start working (87dbb117)
+- snake_case Serilog tokens + no Warning-log on cancelled hub calls (3009ff0f)
+- DeleteTask aus der UI schlug immer mit generischem Serverfehler fehl (352aaa52)
+
+### Documentation
+
+- update for v2.16.0 (c9dd885f)
+
+## v2.16.0 — 2026-09-16
+
+### Features
+
+- dirty Ziel-Verzeichnis beim Oeffnen des Merge-Dialogs melden statt nach dem Fehlschlag (09bcd696)
+- preview_merge_set flags removed symbols and locale-key overlaps (684b0115)
+- Bilder aus der Zwischenablage ins interaktive Terminal einfuegen (56161e4e)
+- poll the OAuth usage endpoint as fast as its measured rate limit allows (50b6b56f)
+
+### Fixes
+
+- duplizierter Confirm-Dialog mit "Delete"-Knopf – zusammenfuehren und lokalisieren (86cc309b)
+- Worktrees-Uebersicht zeigt Task-Nummern, DIFF-Spalte trimmt statt abzuschneiden (1325ab94)
+- Diff-Viewer scrollt jetzt auch horizontal synchron (4ff5383b)
+- Ordner-Toggle in der Sidebar schluckt schnelle Klicks (5cdfb14f)
+- preview_merge braucht einen runVerify-Parameter wie preview_merge_set (7452f6cf)
+- depends_on-Nachfolger schon beim gelandeten Merge freigeben (c874bf7e)
+- Worker-Neustart trifft nun den tatsaechlich laufenden Prozess (9a41bed0)
+- Shutdown terminates the app even with secondary windows open (103eb9a6)
+
+### Documentation
+
+- update for v2.16.0 (31dfaffc)
+- update for v2.15.0 (18394dd6)
+
+## v2.15.0 — 2026-09-11
+
+### Features
+
+- Stash-Option fuer uncommittete Aenderungen im Ziel-Tree (251b70ce)
+
+### Documentation
+
+- update for v2.14.0 (8e2d37e6)
+
+## v2.14.0 — 2026-09-10
+
+### Features
+
+- Listen und Ordner in einer gemischten Sidebar-Reihenfolge (bfb1c652)
+- confirm before closing a running ConPTY session (eb623714)
+- worker-menu Shutdown ends worker + app after confirm (1bdf2027)
+- chain a normal parent's children on WaitingForChildren (d2648f96)
+- localize WorkConsole, DescriptionStepsCard and the ROADBLOCK label (8e6f0d16)
+- surface depends_on blocking in status chip, chain label, and detail pane (4cf601e4)
+- Worker-Menü "Update Claude CLI" führt claude update aus (dbee4a0d)
+- triage model picker (opus/fable) in the merge helper start modal (1177463a)
+- collapsible folders for the list sidebar (25c9a619)
+- list_folders table plus lists.folder_id (13e860f0)
+
+### Fixes
+
+- Import broadcastet TaskUpdated fuer neue Tasks (1770b677)
+- ConnectedClientTracker in den externen MCP-Container teilen (3d09323e)
+- de.json-Konsistenz-Pass und restliche harte EN-Strings (d6696c33)
+- force English git output for locale-fragile stderr matches (5ecf6f75)
+- make diff-stat parsing locale-safe and dedupe the two parsers (29ea18c4)
+- report failed paste/drop in the interactive terminal (0cec0a77)
+- surface worker connect/restart failures instead of no-opting (b4b62254)
+- validate PowerUse window, explain effort and Prime Claude in Settings (951c2fe9)
+- start_list_handler ehrlich machen, wenn keine App verbunden ist (451c0184)
+- warn and block save when a list's working dir isn't a git repo (3348736e)
+- show a banner when a ConPTY session dies after startup (256bea5f)
+- merge duplicate top-level "checks" block in en/de.json (741f66fe)
+- translate max_turns failure text to English (0fcfe7c5)
+- route WeekReportService permission-mode through PermissionModeResolver (1c768529)
+- report startup port conflicts instead of crashing silently (c9d4823f)
+
+### Documentation
+
+- record list folders in the Data and Ui CLAUDE.md (5477ae53)
+- update for v2.13.6 (ec1e60be)
+
+## v2.13.6 — 2026-09-07
+
+### Features
+
+- Home-Ordner als Sitzungsziel in Mission Control (f231f08a)
+- Einfuegen und Datei-Drop im interaktiven Terminal (23491d3b)
+- Cheat-Sheet-Fenster im Hilfe-Menue (0db9fade)
+- PowerUse-Einstellungen nach Settings -> Ausfuehrung verschieben (7c7c33d6)
+
+### Documentation
+
+- update for v2.13.5 (c7392e08)
+
+## v2.13.5 — 2026-09-03
+
+### Fixes
+
+- Version im About-Dialog aus der FileVersion lesen (cccfe2ec)
+
+### Refactoring
+
+- "Nach Updates suchen" ins Hilfe-Menue verschieben (c16c7b97)
+
+### Documentation
+
+- update for v2.13.4 (a8ec5507)
+
+## v2.13.4 — 2026-09-03
+
+### Fixes
+
+- interaktive Session ohne Arbeitsverzeichnis im User-Verzeichnis starten (f70503d0)
+
+### Documentation
+
+- update for v2.13.3 (9360cd2f)
+
+## v2.13.3 — 2026-09-03
+
+### Fixes
+
+- raise SignalR MaximumParallelInvocationsPerClient (e64d5705)
+
+### Documentation
+
+- update for v2.13.2 (fc25ee45)
+
+## v2.13.2 — 2026-09-03
+
+### Features
+
+- Handler-Run per Knopf abbrechen (bd5aa265)
+
+### Fixes
+
+- strip CLAUDE_CODE_CHILD_SESSION/CLAUDECODE before every ConPTY launch (51ee5050)
+- Dequeue-X auf blockierten Queue-Zeilen anzeigen und Kette konsistent halten (df3e7ba0)
+- report and gate ListSettingsModal load failures instead of swallowing them (a1b20d9f)
+- move ScrollViewer padding to inner content in modal bodies (e0c6b670)
+- Mission Control oeffnen, wenn ein Handler-Run per MCP startet oder ein Handoff eintrifft (b05b6fba)
+
+### Performance
+
+- show list settings modal before its seven-round-trip load finishes (f24654df)
+
+### Documentation
+
+- remove stale session-skills empty-state entry (2bd48ea1)
+- update for v2.13.1 (eb3aee41)
+- update for v2.13.0 (2b873322)
+
 ## v2.13.1 — 2026-09-02
 
 ### Fixes

CLAUDE.md

@@ -100,7 +100,7 @@ So, per task:
 
 ### Gotchas
 - **Subagents:** use the `sonnet` model; stage files explicitly by path — never `git add -A` (parallel sessions often leave unrelated WIP in the tree).
-- **Icons:** `PathIcon` *fills* its geometry — line-art icons must be filled geometry or a `Path Classes="icon-stroke"`, else they render invisible. Colour comes from the `ICON PAINTING` block in `IslandStyles.axaml` (class + state); setting `Foreground`/`Stroke` inline kills the hover state.
+- **Icons:** Material Design Icons via `mdi:Name` + the `IconKey` converter (a misspelled name silently renders nothing — `MdiIconNamesTests` guards it). Colour comes from the `ICON PAINTING` block in `IslandStyles.axaml` (class + state); setting `Foreground`/`Stroke` inline kills the hover state.
 - **Localization:** `locales/en.json` and `locales/de.json` keys must stay in parity (Localization.Tests enforces it).
 - **Test fakes:** changing `IWorkerClient` / `WorkerHub` / ViewModel constructors breaks hand-rolled fakes in both test projects — update them.
 

docs/explore-notes/conpty-sessions.md

@@ -11,14 +11,16 @@ process hosts (real `claude` TUI in a Mission Control tile).
 Autonomous queue tasks are **not** covered here — they stay on the stream-json path via
 `TaskRunner`. See [worker-task-pipeline.md](worker-task-pipeline.md).
 
-## The four session kinds
+## The six session kinds
 
 | Kind | Hub spec method | Notes |
 |---|---|---|
-| Task session | `GetInteractiveLaunchSpec` | Effort from the task/list model preset |
+| Task session | `GetInteractiveLaunchSpec` | No `--effort` — CLI default |
-| Ad-hoc | `GetAdHocLaunchSpec` | Effort from the global default |
+| Ad-hoc | `GetAdHocLaunchSpec` | No `--effort` — CLI default |
-| Planning | (planning start/resume) | Effort from `PlanningAlias`; uses `--permission-mode default`, **not** `plan` |
+| Planning | (planning start/resume) | No `--effort`; uses `--permission-mode default`, **not** `plan` |
 | List handler | `GetMergeHelperLaunchSpec` / `GetMergeHelperHandoffLaunchSpec` | Model + effort fixed per role (`ModelRegistry.HandlerTriageAlias`/`HandlerWaitAlias`/`HandlerMergeAlias`), **not** from list config; `--permission-mode` via `PermissionModeResolver` (unattended) |
+| SSH workspace | `GetSshLaunchSpec` | Exe is `ssh.exe`, not claude: `-R <random port>:127.0.0.1:<remote_mcp_port>` + one remote shell command that base64-decodes a `claudedo` MCP config (per-session token) to `~/.claudedo/mcp-<paneId>.json` and runs claude. **Not** recorded in `mission_control_sessions`, no `claudedo_pane`/handoff hint. Workspaces: `app_settings.ssh_workspaces`, Settings → SSH-Workspaces |
+| Custom tile | none — built in the UI | `MissionControlViewModel.OpenCustomTileSession`: any console program from `ui.config.json` → `CustomTiles` (Settings → Custom tiles). Exe resolved via `ExecutableResolver` (shims through `cmd /c`), args split by `CustomTile.SplitArgs` (the library re-quotes each token). Empty folder → a submenu of home/list folders/browse. Not recorded, no env, no MCP |
 
 ## ⚠️ Gotcha: never pass task free-text as a CLI argument
 
@@ -39,9 +41,10 @@ description skips the file **and** the positional arg entirely — it still gets
 
 ## Argument ordering
 
-Every spec passes `--effort <level>` from the relevant model's preset. It **leads** the args —
+Only the list-handler specs pass `--effort` (from the role model's preset). Hand-driven sessions
-except for a fresh task session with a brief, where `--add-dir <sessionDir>` must come first so
+(task, ad-hoc, planning, handoff, resume) deliberately pass none, so the CLI default / the user's
-`--effort` (a single-value flag) can sit directly before the positional kickoff.
+`/effort` setting applies. A positional kickoff must follow a single-value flag (`--session-id`,
+`--append-system-prompt-file`), never a variadic one (`--add-dir`, `--allowedTools`).
 
 `--model` is deliberately **NOT** forced on an interactive session — the user can still switch
 models in the TUI.
@@ -87,7 +90,7 @@ own transcript:
    `TaskRepository.SetInteractiveSessionIdAsync` — **before** the `LaunchSpec` is returned, i.e.
    before the ConPTY host ever spawns `claude`. `BuildFreshTaskArgsAsync` then passes it as
    `--session-id <guid>`, placed as the single-value flag directly before the positional kickoff
-   (or, with no brief, right after `--effort`).
+   (or, with no brief, as the only arg).
 3. **Fresh worktree wins.** `isFreshWorktree` forces `run` to `null` *and* is checked before
    reading `task.InteractiveSessionId`, so a recreated worktree never resumes a stale id from
    either source — it always takes the fresh path, which overwrites the stale
@@ -97,6 +100,48 @@ Net effect: reopening an interactive session for a task (pane closed, process ki
 resumes the same claude conversation, because the id was committed to the DB before the previous
 launch even started.
 
+## Session handoff (`handoff_session`)
+
+Task and ad-hoc tiles can hand off to a fresh session in the same tile. The **paneId is the pane's
+`IdentityKey`**: the task id for a task tile, a GUID minted by `OpenAdHocConPtySessionAsync` for an
+ad-hoc one.
+
+**The model never passes an id** (it guesses GUIDs). Instead, every such spec gets
+`--mcp-config ~/.claudeDo/pane-sessions/<paneId>/mcp.json`, which adds a second entry,
+`claudedo_pane`. It points at the same external MCP, with headers `X-ClaudeDo-Pane` and
+`X-ClaudeDo-Session` (plus `X-ClaudeDo-Key` when one is configured). An `AddListToolsFilter`
+(`SessionHandoffMcpTools.FilterByPane`) splits the tool list by that header:
+- `claudedo_pane` lists only `handoff_session`;
+- the plain `claudedo` entry lists everything except `handoff_session`.
+
+The hint (`handoff-hint.md`, via `--append-system-prompt-file`) says when to call
+`mcp__claudedo_pane__handoff_session(brief)` and what goes into the brief, and contains no ids. Ad-hoc
+tiles get a pre-assigned `--session-id` so the header has one. With `ExternalMcpPort = 0` the tile
+gets neither the entry nor the hint.
+
+`handoff_session(brief)` writes `pane-sessions/<paneId>/handoffs/<guid>/brief.md` (first line:
+`Handed off from session <id>`) and broadcasts `SessionHandoffRequested(paneId, briefPath)`. The
+worker has no pane registry: the UI looks up the pane by `IdentityKey`, takes its `Cwd` (from the
+resolved launch spec) and its `TaskId`, and closes it. It then reopens the tile at the same slot
+with the same `IdentityKey` via `GetSessionHandoffLaunchSpec` → `BuildHandoffAsync`. For a task
+tile, the new session id replaces `InteractiveSessionId`, so reopening the task resumes the
+handed-off session. The old transcript remains under `~/.claude/projects/`.
+
+## Recent sessions
+
+Every task, ad-hoc and handoff tile launch (only those — `paneId != null`) records its session in
+`mission_control_sessions` from inside `InteractiveLaunchSpecService`, which is where the session id
+is known. A handoff's predecessor comes from the brief's first line
+(`SessionHandoffMcpTools.ReadHandedOffFrom`), and it inherits the predecessor's title and task.
+The clock button in the Mission Control header opens a flyout (`RefreshRecentSessionsAsync`, last 14
+days / 50 rows, read straight from the DB). `NestHandoffs` groups each chain under its origin.
+- **Resume**: a task's *current* `InteractiveSessionId` reopens the task tile (deduped by TaskId).
+  Any other session gets a fresh ad-hoc tile via `GetResumeSessionLaunchSpec` → `BuildResumeAsync`
+  (`--resume <id>` in the recorded cwd, handoff hint included).
+- **Brief**: `ShellOpen.Path(brief.md)`, which opens the file in the default editor.
+- Not guarded: resuming a session that is still live in another ad-hoc tile, since panes don't
+  track their session id.
+
 ## List handler ("Let Claude handle it")
 
 `BuildForMergeHelperAsync`/`BuildForMergeHelperHandoffAsync` resolve `--permission-mode` via
@@ -121,7 +166,7 @@ per call and `Register` clamps to min 1, so 0 can never mean "unbounded"). Past
 `wait`/`merge` request is silently coerced to its `_final` counterpart — check the result's
 `coerced` flag — and any handoff after a `merge_final` round throws.
 
-**PowerUse.** When `AppSettingsEntity.PowerUseEnabled` (toggled on the usage monitor) **and** the
+**PowerUse.** When `AppSettingsEntity.PowerUseEnabled` (Settings → Execution) **and** the
 list's own `ListConfigEntity.PowerUseAllowed` are both set, `InteractiveLaunchSpecService.
 ComposeHandlerPromptAsync` appends `PromptKind.PowerUseAddendum` to whichever handler prompt the
 phase resolved to. The addendum is written as an *override* of the base prompt's interactive rules
@@ -285,6 +330,8 @@ bails out immediately instead of racing past the collection-based dedupe.
 (scoped to `MainWindow` via `AddClassHandler<MainWindow>`) never runs there — **Escape always
 reaches the PTY**. See the note in `src/ClaudeDo.Ui/CLAUDE.md`.
 
+**AltGr bypass:** Windows reports AltGr as Ctrl+Alt, and Iciclecreek's `TerminalView.OnKeyDown` turns any Ctrl/Alt combo into a control sequence (NUL/0x1C/ESC) and marks it handled, so `@ \ { } € ~ |` never arrive as text. `InteractiveTerminalView.OnPreviewKeyDown` (tunnel) detects it via `IsAltGrText` and sends `KeySymbol` through `SendTextAsync` first.
+
 `TaskRowViewModel.HasInteractiveSession` shows an accent "Interactive" chip instead of "Parked";
 tapping it jumps to that Mission Control pane. `TasksIslandViewModel.SyncInteractiveSessions`
 mirrors Mission Control's open panes onto the rows.
@@ -311,7 +358,7 @@ Autonomous and interactive sessions do **not** share a system prompt. Per start
 |---|---|---|
 | Autonomous run/continue/retry | `TaskRunner.ResolveConfigAsync` → `ClaudeArgsBuilder.Build` | `--append-system-prompt <text>`, recomputed and re-sent on **every** invocation including a `--resume` continue (`PromptKind.System` + improvement/list/task overrides) |
 | Interactive task session, fresh | `InteractiveLaunchSpecService.BuildForTaskAsync` → `BuildFreshTaskArgsAsync` | none — no `--append-system-prompt(-file)` at all |
-| Interactive task session, resume | `InteractiveLaunchSpecService.BuildForTaskAsync` → `WindowsTerminalLauncher.BuildResumeArgs` | none — only `--resume <id>` (+ `--effort`) |
+| Interactive task session, resume | `InteractiveLaunchSpecService.BuildForTaskAsync` → `WindowsTerminalLauncher.BuildResumeArgs` | none — only `--resume <id>` |
 | Ad-hoc directory session | `InteractiveLaunchSpecService.BuildForDirectoryAsync` | none |
 | Planning session start | `InteractiveLaunchSpecService.BuildPlanningStart` → `WindowsTerminalLauncher.BuildPlanningStartArgs` | `--append-system-prompt-file <path>` (`PromptKind.Planning`) |
 | Planning session resume | `InteractiveLaunchSpecService.BuildPlanningResume` → `WindowsTerminalLauncher.BuildPlanningResumeArgs` | none — only `--permission-mode default --allowedTools <planning allowlist> --resume <id>` |

docs/explore-notes/external-mcp.md

@@ -1,8 +1,8 @@
 # External MCP tool surface
 
 > **Explore-note — verify before trusting.** Distilled map of a subsystem, not authoritative.
-> Last verified against commit `38af549` (2026-08-11).
+> Last verified against commit `cb775958` (2026-10-01).
-> Drift check: `git log --oneline 38af549..HEAD -- src/ClaudeDo.Worker/External`
+> Drift check: `git log --oneline cb775958..HEAD -- src/ClaudeDo.Worker/External`
 > Stable structure only (no line numbers). See docs/explore-notes/README.md.
 
 Covers `src/ClaudeDo.Worker/External/` — the always-on MCP tools ClaudeDo exposes to general
@@ -25,8 +25,8 @@ is wired through `TaskIdResolver`, which resolves:
 This is **not** ambiguous: a GUID is never all-digits, so a pure-integer parameter is always a
 number, not a partial GUID. All task-returning tools (`GetTask`, `ListTasks`, `AddTask`,
 `BatchGetTasks`, etc.) stamp the resolved task's `Number` in the DTO — both `TaskDto` and the
-lean `TaskRefDto` carry an `int Number` field. **Branch names and worktree paths** (`claudedo/{id}`)
+lean `TaskRefDto` carry an `int Number` field. **Task worktree branches and folders** are `claudedo/{number}-{title-slug}`;
-continue to use the GUID; the number is a display alias, never the identity.
+otherwise the number is a display alias, never the identity.
 
 Every tool description carries a shared boilerplate clause (defined in `McpToolDocs.TaskNumberHint`)
 instructing the agent to **refer to tasks as `#<number>` when reporting results to the user** —
@@ -98,6 +98,8 @@ Daily prep: `GetDailyPrepCandidates`, `SetMyDay`.
 | `TaskWaitMcpTools` | `WaitForTaskChange` |
 | `QueueStateMcpTools` | `GetQueueState` |
 | `AttachmentMcpTools` | `AddTaskAttachment`, `ListTaskAttachments`, `RemoveTaskAttachment` |
+| `ListHandlerMcpTools` | `StartListHandler` |
+| `TicketMcpTools` | `GetTicketImportCandidates` (open assigned ticket-system items not yet imported + all lists + fallback list; `available=false` + `reason` when no ticket system), `ImportTicket` (one Idle task per item; no `list` → fallback list; `created=false` always carries `skippedReason`) |
 
 ## Per-tool behaviour worth knowing
 
@@ -107,13 +109,13 @@ Description/Result) in `tasksFull` instead (`tasks` null). Filtering by `created
 happens before the lean/full projection either way.
 
 **`UpdateTaskStatus`** accepts `Idle` / `Queued` / `Cancelled` / `Done` only.
-- `Cancelled` goes through `TaskStateService.CancelAsync(..., allowFromIdle: true)` — the
+- `Cancelled` goes through `TaskStateService.CancelAsync(..., retire: true)` — like the UI's
-  **only** caller that opts into cancelling from `Idle`. `PlanningChainCoordinator` relies on
+  "Mark as cancelled", it opts into cancelling from `Idle`/`Failed`. `PlanningChainCoordinator`
-  `Idle` staying a no-op there by default, because a child parked back to `Idle` mid-chain is
+  relies on `Idle` staying a no-op there by default, because a child parked back to `Idle`
-  a manual opt-out signal.
+  mid-chain is a manual opt-out signal.
-- `Done` goes through `TaskStateService.ForceSetStatusAsync` (the same unconditional write the
+- `Done` goes through `TaskStateService.MarkDoneAsync` (the done toggle, so a chain successor
-  UI's "set status freely" affordance uses) but is **refused** for a task with an active
+  unblocks and the parent advances) but is **refused** for a task with an active worktree,
-  worktree, since that would skip `review_task`'s merge.
+  since that would skip `review_task`'s merge.
 
 **`AddTask`** — always creates the task; also returns `possibleDuplicates` (up to 3, id/title/status
 only, no descriptions) — open (non-terminal) tasks in the *same list* whose normalized title
@@ -235,6 +237,13 @@ task already outside those two (unknown ids reported as status `"NotFound"`, als
 **`AttachmentMcpTools`** — re-attaching the same `fileName` overwrites. Add/remove refuse on a
 `Running` task.
 
+**`StartListHandler`** — the worker only broadcasts `ListHandlerStartRequested`; the connected
+ClaudeDo App does the actual work (creates the handler task, opens the triage ConPTY tile). Before
+broadcasting it checks `ConnectedClientTracker` (a `WorkerHub.OnConnectedAsync`/`OnDisconnectedAsync`-driven
+singleton count) — with zero connected clients the broadcast would reach nobody, so the tool
+returns `Requested: false` plus a `Reason` instead of claiming success. Does not queue or retry the
+request for a later connect.
+
 **`GetDailyPrepCandidates`** — Idle, non-blocked tasks in a git repo **not** excluded by
 `AppSettings.ReportExcludedPaths` and not already `IsMyDay`, plus the current Idle MyDay tasks
 and `maxTasks` (= `DailyPrepMaxTasks`). Repo-exclusion logic lives in the `DailyPrepFilter`

docs/explore-notes/review-merge.md

@@ -1,8 +1,8 @@
 # Review, merge & conflict resolution
 
 > **Explore-note — verify before trusting.** Distilled map of a subsystem, not authoritative.
-> Last verified against `168ab1cd` (2026-08-26), which added the batch verify
+> Last verified against `0e6a48e2` (2026-10-01): parent's worktree is the unit branch (children
-> (`skipVerify` + `verify_merges`).
+> fast-forwarded into it); in a company repo approve ends in a pushed branch + draft PR.
 > Planning mode renders per file and `DiffLinesView` is retired.
 > Drift check: `git log --oneline 20bce9b..HEAD -- src/ClaudeDo.Worker/Lifecycle src/ClaudeDo.Worker/State src/ClaudeDo.Worker/Planning src/ClaudeDo.Ui/ViewModels/Conflicts src/ClaudeDo.Worker/External`
 > Stable structure only (no line numbers). See docs/explore-notes/README.md.
@@ -15,12 +15,32 @@ Covers the review→merge path: `TaskStateService` review transitions, `TaskMerg
 `ApproveReview` (hub) and `review_task` approve (MCP) are the **single** review+merge action.
 There is no separate "Merge all" entry.
 
-- **Task with children** → drives `PlanningMergeOrchestrator`: merges the parent worktree if
+- **Legacy unit** (`UnitBranchService.HasUnabsorbedChildrenAsync`: a `Done` child whose worktree
-  `Active`, then each `Done` child in order, then sets the parent `Done`. A mid-merge conflict
+  is still `Active`, i.e. planned before the unit branch existed) → drives
-  pauses for `ContinuePlanningMerge` / `AbortPlanningMerge`.
+  `PlanningMergeOrchestrator`: merges the parent worktree if `Active` (planning parents too, for a
-- **Childless task** → `TaskMergeService.ApproveAndMergeAsync`. A conflict keeps the task in
+  mixed unit), then each `Done` child in order, then sets the parent `Done`. A mid-merge conflict
-  `WaitingForReview`.
+  pauses for `ContinuePlanningMerge` / `AbortPlanningMerge`. Children in `WaitingForReview` are
+  silently skipped there.
+- **Everything else** — a childless task, or a parent whose children were absorbed into its unit
+  branch → `TaskMergeService.ApproveAndMergeAsync` on the task's own worktree. A conflict keeps
+  the task in `WaitingForReview`. A planning parent with any child not `Done` is `blocked` there
+  (`subtask X is not Done (status …)`, same as the orchestrator) — no half plan on the target.
+- **Child of a unit** (parent has an `Active` worktree) → `ApproveAndMergeAsync` absorbs it into
+  the unit branch (`UnitBranchService.AbsorbChildAsync`, ff-only) instead of merging to the target.
 - **No active worktree** (sandbox run) → straight to `Done`.
+- **Company repo** (`PullRequestPublisher.IsCompanyRepoAsync`, origin matches
+  `company_remote_pattern`, checked live) with an `Active` or `Kept` worktree → `ApproveCompanyAsync`
+  instead of a merge, after the planning-parent gate and the child absorb: missing PAT / non-ADO
+  remote is `blocked` before anything runs, then the verify command in the **worktree**
+  (`skipVerify` ignored — no local merge to defer it to; red = `verify_failed`, nothing pushed),
+  then `PullRequestPublisher.PublishAsync`: `git push -u origin <branch>` (PAT via `GIT_CONFIG_*`
+  env, `AzureDevOpsClient.GitAuthEnv`), find-or-create the draft PR, store
+  `worktrees.pull_request_url`, `WorktreeUpdated`. Result `pr_created` / `pr_updated` + URL
+  (`MergeResult.PullRequestUrl`; MCP puts it in `mergeMessage`). Task stays `WaitingForReview`,
+  worktree `Active`, ticket `InBearbeitung`; `Done` is the user's manual toggle after the ADO
+  merge. A PR failure after a successful push is `blocked` with `gepusht, PR fehlgeschlagen: …`.
+  ⚠️ Only approve branches — `merge_task`/the merge modal and the legacy-unit orchestrator still
+  merge locally in a company repo.
 
 Review transitions all live in `TaskStateService`: `SubmitForReviewAsync`,
 `SubmitForChildrenAsync`, `ApproveReviewAsync`, `RejectToQueueAsync`, `RejectToIdleAsync`,
@@ -184,9 +204,9 @@ detached-HEAD scratch worktree under the OS temp dir (`GitService.WorktreeAddDet
 is always removed afterward (`finally`, non-cancellable cleanup). No verify command configured, or
 `runVerify=false`, reproduces the pre-existing preview exactly — no delay, no scratch worktree.
 
-Wired into `ExternalMcpService`: `preview_merge` (single task) always requests a verify run when the
+Wired into `ExternalMcpService`: both `preview_merge` (single task) and `preview_merge_set` only
-list has a command configured; `preview_merge_set` only does when its `runVerify` parameter is
+request a verify run when their `runVerify` parameter is explicitly set (default `false`) — a
-explicitly set (default `false`) — a set preview never starts N builds unasked. The Hub's
+preview never starts a build unasked. The Hub's
 `PreviewMerge` (the UI's live mergeability indicator) always passes `runVerify: false`, since
 running a build on every poll would be a bad regression; `MergePreviewDto` carries the
 verify fields anyway so a future UI entry point can opt in. Result fields: `VerifyExitCode` (null =
@@ -203,7 +223,8 @@ succeeds, written **only** by `WorktreeRepository.SetMergedAsync` (which atomica
 
 It is the only thing that makes `revert_merge` possible without heuristically searching
 `git log` — see [external-mcp.md](external-mcp.md) → `RevertMerge`. Null for any worktree
-merged before the field existed.
+merged before the field existed, and for a child absorbed into its unit branch (a fast-forward
+has no merge commit) — such a child is reverted with its whole unit, never alone.
 
 ## Review gate in the UI
 
@@ -231,6 +252,11 @@ Single-task mode starts the conflict merge, then parses each conflicted file int
 conflict `MergeFileSegment`s via the worker's `GetMergeConflictDocuments`. Types live in
 `ConflictModels`: `MergeFile` / `MergeFileSegment` / `MergeConflictBlock`.
 
+⚠️ **The resolver restarts the merge itself** (`StartConflictMerge`, `leaveConflictsInTree`), so the caller's
+`autostash` consent must travel with it (`MergeCoordinator.ResolveConflictAsync(..., autostash)` →
+`OpenAsync(target, autostash)` → hub). Without it a dirty target answers `dirty_target`, the
+resolver stays closed after the stash-retry approve already reported `conflict`.
+
 Exposed per active file: `ActiveOursText` / `ActiveResultText` / `ActiveTheirsText`
 (reconstructed from `MergeFile.OursText/ResultText/TheirsText`; Result seeds unresolved
 conflicts with Ours), plus `ActiveFile` / `SelectFileCommand` (multi-file switcher),

docs/explore-notes/usage-monitoring.md

@@ -21,6 +21,11 @@ authenticated with the Bearer access token Claude Code itself keeps fresh at
 Because the endpoint is undocumented and can change without notice, **every consumer
 fails open**. That is the single most important invariant here.
 
+**Measured 2026-09-16** (clean burst against the live endpoint, Worker otherwise idle): exactly
+5 requests succeed, the 6th 429s with `Retry-After: 300` — a flat 5-requests-per-5-minute quota,
+no `ratelimit-*`/`x-ratelimit-*` headers on either the 200s or the 429. The quota is per-account,
+not per-process, so a manual refresh or another consumer of the same OAuth token shares it.
+
 ## Components (`Usage/`)
 
 | Type | Role |
@@ -28,7 +33,7 @@ fails open**. That is the single most important invariant here.
 | `UsageModels` | `UsageBucket` / `UsageLimitRow` / `UsageSnapshot`. `UsageBucket.Utilization` is already a 0–100 percent — compare directly against thresholds, don't rescale. |
 | `ClaudeOAuthUsageClient` | Reads the token, calls the endpoint. Defensive parsing: missing/null buckets → null, missing `limits` → empty list. |
 | `UsageState` | Threadsafe singleton. A failed poll **never** overwrites the last good snapshot — it only sets `LastError`. |
-| `UsageMonitorService` | `BackgroundService`; polls on `usage_poll_interval_seconds` (default 60, clamped to min 15 on config load), one poll at startup. Logs a failure at most once per distinct error message. Broadcasts `HubBroadcaster.UsageUpdated` after **every** tick, success or failure. |
+| `UsageMonitorService` | `BackgroundService`; polls on `usage_poll_interval_active_seconds` / `usage_poll_interval_idle_seconds` (default 120 each, clamped to min 90 on config load), one poll at startup. Logs a failure at most once per distinct error message. Broadcasts `HubBroadcaster.UsageUpdated` after **every** tick, success or failure. |
 | `UsageSnapshotBuilder` | Builds the Hub-facing `UsageSnapshotDto` from `UsageState` + `IUsageGate` + `AppSettings`. The one shared place for stale/threshold/gate logic — `WorkerHub.GetUsageSnapshot` and `UsageMonitorService` must not diverge. |
 | `UsageGate` | Hard pause decision → `UsageGateDecision(IsBlocked, Reason)`. |
 | `UsageThrottle` | Pure static staging of parallelism ahead of the gate. |
@@ -254,6 +259,7 @@ degrades instead of throwing. Worker config: `usage_poll_interval_active_seconds
 `usage_poll_interval_idle_seconds`.
 
 The gate percentages are editable in **two** places that both write the same `app_settings` row:
-Settings → General (typed) and the usage-monitor gauges (dragged). The throttle stages are
+Settings → Execution (typed) and the usage-monitor gauges (dragged). The throttle stages are
 gauge-only — `SettingsModalViewModel` therefore carries them load→save verbatim so saving Settings
-can't reset a dragged value.
+can't reset a dragged value. PowerUse (switch, time window, handoff %) used to be usage-monitor-only
+and is now typed on the same Settings tab, so it needs no such round-trip.

docs/open.md

@@ -13,6 +13,7 @@ Checkliste lebt in `docs/verification-handoff.md`.
 
 ## UX / Nits (offen)
 
+- **Eigene Tiles — Sichtprüfung offen** (gebaut 2026-10-05, `f37b59d5`). Nur Unit-Tests, nicht in der laufenden App geklickt. Prüfen: Einstellungen → „Eigene Tiles" anlegen/speichern; im +-Flyout öffnet ein Eintrag mit Ordner direkt ein Tile; ein Eintrag ohne Ordner zeigt ein **Untermenü** (Home, Listen-Ordner, „Ordner wählen…") — wackligster Teil ist der selbstreferenzierende `SessionTargetItemTheme` (`DynamicResource`) in `MissionControlView.axaml`; ungültiges Programm zeigt die Fehlermeldung im Tile.
 - **Planning-aktiver Parent zeigt weiter „Idle":** Parent in `planning_phase=active` hat `Status=Idle` (korrekt im Modell), aber `TaskRowViewModel.StatusLabel` (Zeile 132) kennt nur `HasInteractiveSession`/`IsParked` als Overrides — der `PlanningBadge` ersetzt den Chip nicht sichtbar → liest sich wie ein normaler Idle-Task. Wunsch: klarer „Planning/Draft aktiv"-Zustand, der Idle überschreibt. (Kinder zeigen korrekt „Draft".)
 - **Blocked-by-Kette nicht sichtbar:** Nach Finalize ist die sequentielle Kette korrekt gesetzt (child[i] blocked-by child[i-1]), aber die UI stellt Reihenfolge/Abhängigkeit nicht dar — es gibt nur den „waiting"-Chip. Wunsch: Kette visualisieren (z.B. „wartet auf <Vorgänger>").
 - **Modal-Bodies unten abgeschnitten — gefixt, Sichtprüfung offen** (Ursache 2026-09-02 verifiziert: `ScrollViewer.Padding` zählt in Avalonia 12 nicht zum Extent; Fix ist das Padding auf ein `Margin` des inneren Inhalts umzuziehen). Betraf `AboutModalView`, `MergeHelperSelectionModal`, `MergeModalView`, `RepoImportModalView`, `WorktreesOverviewModalView` — alle fünf umgestellt. `ListSettingsModalView`, `LogVisualizerView` und `WorkConsole` hatten zu diesem Zeitpunkt bereits kein ScrollViewer-Padding mehr.
@@ -32,7 +33,7 @@ Der Sichtprüfungs-Block dieses Batches (Ctrl+K/`#`, Titel-Edit, ConPTY-/Refine-
 Interactive-Chip, Diff-Viewer-Abstände, Manual-Tasks, Vorgaben-pro-Modell-Tabelle) ist von Mika
 verifiziert und deshalb hier entfernt. Es bleiben die Entscheidungen, die daran hängen:
 
-- Interaktive ConPTY-Sessions bekommen `--effort`, aber **kein** `--model` — die Session läuft weiter unter dem Modell aus Mikas Claude-Config, der Effort kommt aus dem Preset des Modells, das ClaudeDo für die Task auflösen würde. Falls ClaudeDo auch interaktiv das Modell erzwingen soll, ist das ein Folge-Task.
+- Interaktive (handgesteuerte) ConPTY-Sessions bekommen weder `--model` noch `--effort` — beides kommt aus Mikas Claude-Config bzw. dem CLI-Default. Nur die List-Handler-Sessions pinnen Modell + Effort pro Rolle.
 - `AppSettings.DefaultMaxTurns` ist jetzt tatsächlich verdrahtet (`ModelPresets.For(..., global.DefaultMaxTurns)` in `TaskRunner.ResolveConfigAsync`): reiner Fallback für ein Modell, das auch nach `ModelRegistry.TryNormalizeAlias` auf keine Preset-Zeile trifft — vorher war das Feld tot (hartkodierte 30). Hat weiterhin keinen eigenen Editor mehr (nur die Preset-Tabelle pro Modell); Spalte könnte später entfallen, falls das nie zutrifft.
 
 ## Beobachtung (offen — Entscheidung Mika)
@@ -74,6 +75,35 @@ Bleibt manuell zu prüfen (UI-Pfad, nie sichtbar gelaufen):
 - [ ] Base-URL leeren → Menüeintrag verschwindet, keine Netzwerkaufrufe mehr.
 - [ ] Sichtprüfung des Settings-Tabs + des Ticket-Projekt-Dropdowns (nie gerendert gesehen).
 
+## Offene Verifikation (2026-10-01, Unit-Branch Teil 3: Firmen-Modus / Draft-PR)
+
+Build + gefilterte Tests grün (Worker: AzureDevOps/CompanyFetchBase/CompanyApprove/CommitMessageBuilder,
+Ui: TicketSettingsTab/MergeSectionCompanyRepo, Data: PromptFiles, Localization). **Nie gegen echtes ADO,
+nicht visuell geprüft:**
+
+- [ ] Sichtprüfung: Settings-Reiter heißt „Externe Dienste", Abschnitt Azure DevOps (PAT, Test, Löschen);
+      Detail-Pane im Firmen-Repo: kein Ziel-Dropdown, Button „Draft-PR erstellen" → nach dem Approve
+      „PR aktualisieren" + Button „Pull Request öffnen"; Approve bleibt hinter „Diff öffnen" gegated.
+- [ ] PAT eintragen, „Verbindung testen" — meldet Repo + Default-Branch der ersten Firmen-Liste.
+- [ ] Ticket-Task in einem echten Firmen-Repo bis zum Draft-PR: Branch `<typ>/<ticket>-<slug>` startet
+      von frisch gefetchtem `origin/<basis>`, Commit ohne `ClaudeDo-Task:`-Trailer, PR-Titel
+      `…, Resolves #<id>`, Beschreibung mit Ticket-Link (Projekt-Id-Lookup über `GET /api/ticket/{id}`
+      ist nur gegen den Stub getestet) und `Geprüft:`-Zeile, Task bleibt WaitingForReview.
+- [ ] Zweiter Approve nach Reject mit Feedback → `pr_updated`, derselbe PR bekommt die neuen Commits.
+- [ ] Planning-Unit mit 2 Children im Firmen-Repo → ein PR für die ganze Unit.
+- [ ] API-Version-Fallback (Server meldet „supports is X") ist nur gegen den Stub getestet.
+
+## Offene Verifikation (2026-10-01, Ticket-Import über alle Projekte)
+
+Build + Unit-Tests grün, **nicht visuell/live verifiziert**:
+
+- [ ] Sichtprüfung: Button „Tickets + Tag planen" im Prep-Panel (nur sichtbar mit Base-URL + Token),
+      Fallback-Listen-Dropdown in Settings → Ticketsystem, Radio „Tickets + Tag planen" im Prime-Tab.
+- [ ] E2E: Button einmal gegen das echte Ticketsystem klicken — Items landen in sinnvollen Listen, die
+      Fallback-Liste fängt den Rest, danach ist MyDay gefüllt; ein zweiter Klick importiert nichts Neues.
+- [ ] `PATCH /api/Ticket/{id}/status` auf einem **Task** (nicht Ticket) ist ungetestet — nachdem der erste
+      importierte Task den Status wechselt, im Worker-Log auf eine `TicketStatusSync`-Warnung prüfen.
+
 ## Offene Verifikation (2026-07-27)
 
 - **Empty-Repo-Hardening (2026-07-30)** — Worker/App neu starten (laufende Instanz hat den
@@ -273,6 +303,14 @@ Weitere Punkte, gebaut + unit-getestet auf `main`, aber **nicht visuell verifizi
       `ClaudeProcess`/`ClaudeCliPreflight` den Shim über `cmd.exe /c` tatsächlich startet, nicht
       nur, dass der Check ihn findet).
 
+## Offene Verifikation (2026-10-02, SSH-Workspaces)
+
+- [ ] Sichtprüfung Settings → SSH-Workspaces: Reiter wählt richtig, Zeilen-Layout, Host-Vorschläge aus `~/.ssh/config`, Papierkorb-Hover, Fehlermeldung bei ungültiger Zeile.
+- [ ] VPS-Eintrag im Quick-Session-Menü startet eine Kachel; ssh-Prompts (Host-Key, Passphrase) erscheinen in der Kachel.
+- [ ] In der Remote-Session zeigt `/mcp` `claudedo` verbunden, `list_task_lists` funktioniert.
+- [ ] Kachel schließen baut den Tunnel ab (Port auf der VPS frei), zwei parallele Kacheln auf denselben Host gehen.
+- [ ] Worker nach Update neu starten — erst dann lauscht der Remote-Listener auf 47823.
+
 ---
 
 ## Bewusst verworfen (nicht erneut vorschlagen)

docs/superpowers/plans/2026-10-01-unit-branch-1-naming-base-branch.md

@@ -0,0 +1,928 @@
+# Unit-Branch Teil 1: Branch-Naming + Basis-Branch pro Liste — Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Task-Branches heißen `<typ>/<nummer>-<slug>` statt `claudedo/{nr}-{slug}`, Firmen-Repos werden über ein konfigurierbares Remote-Muster erkannt, und jede Liste kann einen Basis-Branch (z.B. `dev`) festlegen, der Basis neuer Worktrees und Default-Merge-Ziel ist.
+
+**Architecture:** Erkennung = statischer Helper `CompanyRepo` über `git remote get-url origin` + `WorkerConfig.CompanyRemotePattern`. Naming bleibt in `WorktreeManager` (`NameFor` + `BranchTypeFor`). `list_config.base_branch` ist eine neue nullable Spalte, tri-state durch alle Writer gereicht; `WorktreeManager.ResolveBaseCommitAsync` und `TaskMergeService.ResolveTargetAsync` lesen sie.
+
+**Tech Stack:** .NET 8, EF Core (SQLite), xUnit mit echtem git, Avalonia 12.
+
+**Spec:** `docs/superpowers/specs/2026-10-01-unit-branch-draft-pr-design.md` (Abschnitt 1 + Basis-Branch). Teil 2 (Unit-Branch/Children) und Teil 3 (Firmen-Modus: Fetch, Push, Draft-PR) folgen als eigene Pläne.
+
+**Abweichung von der Spec (bewusst):** Der Self-Heal in `WorktreeManager.CreateAsync` bekommt **keinen** zusätzlichen DB-Ownership-Guard. Er feuert nur, wenn auch der Id-suffixte Name schon existiert — und der enthält die Task-Id, gehört also per Konstruktion diesem Task. Ein fremder Branch mit dem Klarnamen wird schon vom Kollisionscheck auf das Suffix umgelenkt. Nötig ist nur, dass der Kollisionscheck den **vollen neuen** Branchnamen prüft (Task 3).
+
+**Konventionen für jede Task:**
+- Build: `dotnet build ClaudeDo.slnx -c Release` (nie Debug — ein laufender Worker lockt es).
+- Tests: `dotnet test <projekt> -c Release --no-build --filter "<filter>"` — nie die volle Suite.
+- Commit: `git add <pfade>` explizit, dann `git commit -m "..." -- <pfade>` (geteilter Checkout, nie `git add -A`). Kein Co-Authored-Trailer.
+
+---
+
+## Dateiübersicht
+
+| Datei | Änderung |
+|---|---|
+| `src/ClaudeDo.Worker/Config/WorkerConfig.cs` | + `CompanyRemotePattern` (`company_remote_pattern`, Default `/_git/`) |
+| `src/ClaudeDo.Data/Git/GitService.cs` | + `GetRemoteUrlAsync` |
+| `src/ClaudeDo.Worker/Git/CompanyRepo.cs` | neu: `Matches`, `IsCompanyAsync` |
+| `src/ClaudeDo.Worker/Runner/CommitMessageBuilder.cs` | `ToSlug` löst Umlaute auf |
+| `src/ClaudeDo.Worker/Runner/WorktreeManager.cs` | `NameFor(task, ticketId, isCompany)`, `BranchTypeFor`, neuer Branchname, Ticket-Auflösung, Basis-Branch |
+| `src/ClaudeDo.Worker/Lifecycle/UntrackedWorktreeRecovery.cs` | Pfad- statt Präfix-Filter |
+| `src/ClaudeDo.Data/Models/ListConfigEntity.cs`, `Configuration/ListConfigEntityConfiguration.cs`, `Repositories/ListRepository.cs`, Migration | + `BaseBranch` |
+| `src/ClaudeDo.Data/Wire.cs` | `UpdateListConfigDto` / `ListConfigDto` + `BaseBranch` |
+| `src/ClaudeDo.Worker/Hub/WorkerHub.cs` | `UpdateListConfig` / `GetListConfig` |
+| `src/ClaudeDo.Worker/External/ConfigMcpTools.cs` | erhält `BaseBranch` **und** `PowerUseAllowed` (Bestandsbug), `get_list_config` liefert `baseBranch` |
+| `src/ClaudeDo.Worker/Lifecycle/TaskMergeService.cs` | `ResolveTargetAsync`, leeres Ziel zentral in `MergeAsync` aufgelöst |
+| `src/ClaudeDo.Ui/ViewModels/Agent/AgentConfigEditorViewModel.cs`, `ViewModels/Modals/ListSettingsModalViewModel.cs`, `Views/Modals/ListSettingsModalView.axaml`, `locales/*.json` | Basis-Branch-Feld |
+| `src/ClaudeDo.Ui/ViewModels/Islands/DetailsIslandViewModel.cs` | echte Branchnamen in Dialogen, kein `← main` |
+| `src/ClaudeDo.Worker/CLAUDE.md`, `src/ClaudeDo.Data/CLAUDE.md` | Doku |
+
+---
+
+### Task 1: Firmen-Repo-Erkennung
+
+**Files:**
+- Modify: `src/ClaudeDo.Worker/Config/WorkerConfig.cs` (nach `TicketApiBaseUrl`, ~Zeile 71)
+- Modify: `src/ClaudeDo.Data/Git/GitService.cs` (neben `ListLocalBranchesAsync`, ~Zeile 404)
+- Create: `src/ClaudeDo.Worker/Git/CompanyRepo.cs`
+- Test: `tests/ClaudeDo.Worker.Tests/Git/CompanyRepoTests.cs`
+
+- [ ] **Step 1: Failing test schreiben**
+
+```csharp
+using ClaudeDo.Data.Git;
+using ClaudeDo.Worker.Git;
+using ClaudeDo.Worker.Tests.Infrastructure;
+
+namespace ClaudeDo.Worker.Tests.Git;
+
+public sealed class CompanyRepoTests : IDisposable
+{
+    private readonly GitRepoFixture _repo = new();
+    public void Dispose() => _repo.Dispose();
+
+    [Theory]
+    [InlineData("https://srv.local/Coll/Proj/_git/Repo", "/_git/", true)]
+    [InlineData("https://mika@srv.local/tfs/Coll/Proj/_git/Mein%20Repo.git", "/_git/", true)]
+    [InlineData("ssh://git@git.kuns.dev:22222/kuns/ClaudeDo.git", "/_git/", false)]
+    [InlineData(null, "/_git/", false)]
+    [InlineData("https://srv.local/Coll/Proj/_git/Repo", "", false)]
+    [InlineData("https://GITHUB.com/acme/repo.git", "github.com/acme", true)]
+    public void Matches(string? url, string pattern, bool expected)
+        => Assert.Equal(expected, CompanyRepo.Matches(url, pattern));
+
+    [Fact]
+    public async Task IsCompanyAsync_reads_origin()
+    {
+        if (!GitRepoFixture.IsGitAvailable()) return;
+        var git = new GitService();
+        Assert.False(await CompanyRepo.IsCompanyAsync(git, _repo.RepoDir, "/_git/", CancellationToken.None));
+
+        GitRepoFixture.RunGit(_repo.RepoDir, "remote", "add", "origin", "https://srv.local/Coll/Proj/_git/Repo");
+
+        Assert.True(await CompanyRepo.IsCompanyAsync(git, _repo.RepoDir, "/_git/", CancellationToken.None));
+        Assert.Equal("https://srv.local/Coll/Proj/_git/Repo", await git.GetRemoteUrlAsync(_repo.RepoDir));
+    }
+}
+```
+
+- [ ] **Step 2: Test laufen lassen — muss am Compiler scheitern**
+
+Run: `dotnet build ClaudeDo.slnx -c Release`
+Expected: FAIL, `CompanyRepo` / `GetRemoteUrlAsync` existieren nicht.
+
+- [ ] **Step 3: Implementieren**
+
+`WorkerConfig.cs`, direkt nach der `TicketApiBaseUrl`-Property:
+
+```csharp
+    /// <summary>Teilstring der <c>origin</c>-URL, an dem ein Firmen-Repo erkannt wird. Nur per Hand editierbar.</summary>
+    [JsonPropertyName("company_remote_pattern")]
+    public string CompanyRemotePattern { get; set; } = "/_git/";
+```
+
+`GitService.cs`, neben `ListLocalBranchesAsync`:
+
+```csharp
+    /// <summary>URL des Remotes <paramref name="remote"/>, oder null wenn es keins gibt.</summary>
+    public async Task<string?> GetRemoteUrlAsync(string repoDir, string remote = "origin", CancellationToken ct = default)
+    {
+        var (exitCode, stdout, _) = await RunGitAsync(repoDir, ["remote", "get-url", remote], ct);
+        return exitCode == 0 && !string.IsNullOrWhiteSpace(stdout) ? stdout.Trim() : null;
+    }
+```
+
+`src/ClaudeDo.Worker/Git/CompanyRepo.cs`:
+
+```csharp
+using ClaudeDo.Data.Git;
+
+namespace ClaudeDo.Worker.Git;
+
+/// <summary>Erkennt Firmen-Repos am <c>origin</c>-Remote; das Muster kommt aus <c>WorkerConfig.CompanyRemotePattern</c>.</summary>
+public static class CompanyRepo
+{
+    /// <summary>True wenn <paramref name="remoteUrl"/> das (nicht-leere) Muster enthält, ohne Groß-/Kleinschreibung.</summary>
+    public static bool Matches(string? remoteUrl, string? pattern) =>
+        !string.IsNullOrWhiteSpace(remoteUrl) && !string.IsNullOrWhiteSpace(pattern)
+        && remoteUrl.Contains(pattern, StringComparison.OrdinalIgnoreCase);
+
+    /// <summary>Liest <c>origin</c> live (kein Cache — ein Remote kann sich jederzeit ändern).</summary>
+    public static async Task<bool> IsCompanyAsync(GitService git, string workingDir, string? pattern, CancellationToken ct) =>
+        Matches(await git.GetRemoteUrlAsync(workingDir, "origin", ct), pattern);
+}
+```
+
+- [ ] **Step 4: Build + Test**
+
+Run: `dotnet build ClaudeDo.slnx -c Release` → 0 Fehler.
+Run: `dotnet test tests/ClaudeDo.Worker.Tests/ClaudeDo.Worker.Tests.csproj -c Release --no-build --filter "FullyQualifiedName~CompanyRepoTests"`
+Expected: PASS (7 Tests).
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/ClaudeDo.Worker/Config/WorkerConfig.cs src/ClaudeDo.Data/Git/GitService.cs src/ClaudeDo.Worker/Git/CompanyRepo.cs tests/ClaudeDo.Worker.Tests/Git/CompanyRepoTests.cs
+git commit -m "feat(worker): detect company repos by origin remote pattern" -- src/ClaudeDo.Worker/Config/WorkerConfig.cs src/ClaudeDo.Data/Git/GitService.cs src/ClaudeDo.Worker/Git/CompanyRepo.cs tests/ClaudeDo.Worker.Tests/Git/CompanyRepoTests.cs
+```
+
+---
+
+### Task 2: Naming-Bausteine (Typ, Nummer, Umlaute)
+
+**Files:**
+- Modify: `src/ClaudeDo.Worker/Runner/CommitMessageBuilder.cs:49-60` (`ToSlug`)
+- Modify: `src/ClaudeDo.Worker/Runner/WorktreeManager.cs:41-47` (`NameFor`) + neues `BranchTypeFor`
+- Test: `tests/ClaudeDo.Worker.Tests/Runner/WorktreeManagerTests.cs:82-89` (Theory ersetzen), `tests/ClaudeDo.Worker.Tests/Runner/CommitMessageBuilderTests.cs`
+
+- [ ] **Step 1: Tests anpassen/ergänzen**
+
+In `WorktreeManagerTests.cs` die Theory `NameFor_NumberPlusCappedTitleSlug` (Zeilen 82-89) ersetzen durch:
+
+```csharp
+    [Theory]
+    [InlineData("Fix: Löschen   des Tasks!", null, false, "7-fix-loeschen-des-tasks")]
+    [InlineData("äöü", null, false, "7-aeoeue")]
+    [InlineData("a very long title that goes well beyond the forty char cap", null, false, "7-a-very-long-title-that-goes-well-beyond")]
+    [InlineData("test task", 412, false, "412-test-task")]
+    [InlineData("test task", 412, true, "412-test-task")]
+    [InlineData("test task", null, true, "test-task")]
+    [InlineData("!!!", null, true, "7")]
+    public void NameFor_NumberRules(string title, int? ticketId, bool isCompany, string expected)
+    {
+        var task = new TaskEntity { Id = "x", ListId = "y", Title = title, Number = 7, CreatedAt = DateTime.UtcNow };
+        Assert.Equal(expected, WorktreeManager.NameFor(task, ticketId, isCompany));
+    }
+
+    [Theory]
+    [InlineData("feat", "feature")]
+    [InlineData("fix", "fix")]
+    [InlineData("refactor", "refactor")]
+    [InlineData("docs", "docs")]
+    [InlineData("test", "test")]
+    [InlineData("chore", "chore")]
+    [InlineData("ci", "chore")]
+    [InlineData("perf", "chore")]
+    [InlineData(" FEAT ", "feature")]
+    [InlineData("", "chore")]
+    public void BranchTypeFor_maps_commit_types(string commitType, string expected)
+        => Assert.Equal(expected, WorktreeManager.BranchTypeFor(commitType));
+```
+
+In `CommitMessageBuilderTests.cs` einen Test ergänzen:
+
+```csharp
+    [Fact]
+    public void ToSlug_transliterates_umlauts()
+    {
+        Assert.Equal("aerger-ueber-groesse-strasse", CommitMessageBuilder.ToSlug("Ärger über Größe Straße"));
+    }
+```
+
+- [ ] **Step 2: Build — muss scheitern**
+
+Run: `dotnet build ClaudeDo.slnx -c Release`
+Expected: FAIL, `NameFor` hat keine 3-Parameter-Überladung, `BranchTypeFor` fehlt.
+
+- [ ] **Step 3: Implementieren**
+
+`CommitMessageBuilder.ToSlug` — erste Zeile ersetzen:
+
+```csharp
+        // Umlaute auflösen statt strippen: "Löschen" -> "loeschen", nicht "lschen".
+        var lower = name.ToLowerInvariant()
+            .Replace("ä", "ae").Replace("ö", "oe").Replace("ü", "ue").Replace("ß", "ss");
+```
+
+`WorktreeManager.cs` — `NameFor` (Zeilen 41-47) ersetzen durch:
+
+```csharp
+    /// <summary>
+    /// Branch leaf and folder name: <c>{nummer}-{slug}</c>. Nummer = Ticket-Id, sonst die Task-Nummer —
+    /// außer im Firmen-Repo ohne Ticket, dort sähe sie wie eine Ticket-Id aus und entfällt.
+    /// </summary>
+    public static string NameFor(TaskEntity task, int? ticketId, bool isCompanyRepo)
+    {
+        var titleSlug = CommitMessageBuilder.ToSlug(task.Title);
+        if (titleSlug.Length > 40) titleSlug = titleSlug[..40].TrimEnd('-');
+        var number = ticketId?.ToString() ?? (isCompanyRepo ? null : task.Number.ToString());
+        if (titleSlug.Length == 0) return number ?? task.Number.ToString();
+        return number is null ? titleSlug : $"{number}-{titleSlug}";
+    }
+
+    /// <summary>Branch-Präfix nach work-conventions: <c>feat</c> → <c>feature</c>, Typen ohne eigenes Präfix → <c>chore</c>.</summary>
+    public static string BranchTypeFor(string? commitType)
+    {
+        var t = (commitType ?? "").Trim().ToLowerInvariant();
+        return t switch
+        {
+            "feat" => "feature",
+            "fix" or "refactor" or "docs" or "test" or "chore" => t,
+            _ => "chore",
+        };
+    }
+```
+
+In `CreateAsync` vorerst nur den Aufruf kompilierbar machen (Zeile 62): `var name = NameFor(task, null, false);` — die echte Verdrahtung macht Task 3.
+
+Die übrigen `NameFor(task)`-Aufrufe in `WorktreeManagerTests.cs` (Zeilen 131, 137, 160, 314, 320) auf `WorktreeManager.NameFor(task, null, false)` umstellen — sonst kompiliert das Testprojekt nicht. Die `claudedo/`-Literale dort bleiben in diesem Task stehen (Task 3 ändert sie).
+
+- [ ] **Step 4: Build + Test**
+
+Run: `dotnet build ClaudeDo.slnx -c Release` → 0 Fehler.
+Run: `dotnet test tests/ClaudeDo.Worker.Tests/ClaudeDo.Worker.Tests.csproj -c Release --no-build --filter "FullyQualifiedName~WorktreeManagerTests|FullyQualifiedName~CommitMessageBuilderTests"`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/ClaudeDo.Worker/Runner/CommitMessageBuilder.cs src/ClaudeDo.Worker/Runner/WorktreeManager.cs tests/ClaudeDo.Worker.Tests/Runner/WorktreeManagerTests.cs tests/ClaudeDo.Worker.Tests/Runner/CommitMessageBuilderTests.cs
+git commit -m "feat(worker): branch type and number rules for task branches" -- src/ClaudeDo.Worker/Runner/CommitMessageBuilder.cs src/ClaudeDo.Worker/Runner/WorktreeManager.cs tests/ClaudeDo.Worker.Tests/Runner/WorktreeManagerTests.cs tests/ClaudeDo.Worker.Tests/Runner/CommitMessageBuilderTests.cs
+```
+
+---
+
+### Task 3: `CreateAsync` nutzt das neue Schema
+
+**Files:**
+- Modify: `src/ClaudeDo.Worker/Runner/WorktreeManager.cs:49-90` (`CreateAsync`) + neue private `ResolveTicketIdAsync`
+- Test: `tests/ClaudeDo.Worker.Tests/Runner/WorktreeManagerTests.cs`
+
+- [ ] **Step 1: Tests anpassen + neue Tests**
+
+Bestehende Literale umstellen (der Test-Task hat `CommitType = "chore"`, also Präfix `chore/`):
+- Zeile 69: `Assert.StartsWith($"chore/{task.Number}-test-task", ctx.BranchName);`
+- Zeile 131: `var foreign = $"chore/{WorktreeManager.NameFor(task, null, false)}";`
+- Zeile 138: `Assert.Equal($"chore/{suffixed}", ctx.BranchName);`
+- Zeile 160: `var branchName = $"chore/{WorktreeManager.NameFor(task, null, false)}";`
+- Zeile 314: `var branchName = $"chore/{WorktreeManager.NameFor(task, null, false)}";`
+
+Neue Tests in derselben Klasse (vor `MakeEntities`):
+
+```csharp
+    [Fact]
+    public async Task CreateAsync_CompanyRepoWithTicket_UsesTicketIdAndFeaturePrefix()
+    {
+        if (!GitAvailable) { Assert.True(true, "git not available -- skipping"); return; }
+
+        var repo = CreateRepo();
+        GitRepoFixture.RunGit(repo.RepoDir, "remote", "add", "origin", "https://srv.local/Coll/Proj/_git/Repo");
+        var (task, list) = MakeEntities(repo.RepoDir);
+        task.CommitType = "feat";
+        task.TicketRef = "bandel:412";
+        var (mgr, _) = await CreateManagerAsync(task, list);
+
+        var ctx = await mgr.CreateAsync(task, list, CancellationToken.None);
+        _worktreeCleanups.Add((repo.RepoDir, ctx.WorktreePath));
+
+        Assert.StartsWith("feature/412-test-task", ctx.BranchName);
+    }
+
+    [Fact]
+    public async Task CreateAsync_CompanyRepoWithoutTicket_OmitsNumber()
+    {
+        if (!GitAvailable) { Assert.True(true, "git not available -- skipping"); return; }
+
+        var repo = CreateRepo();
+        GitRepoFixture.RunGit(repo.RepoDir, "remote", "add", "origin", "https://srv.local/Coll/Proj/_git/Repo");
+        var (task, list) = MakeEntities(repo.RepoDir);
+        var (mgr, _) = await CreateManagerAsync(task, list);
+
+        var ctx = await mgr.CreateAsync(task, list, CancellationToken.None);
+        _worktreeCleanups.Add((repo.RepoDir, ctx.WorktreePath));
+
+        Assert.StartsWith("chore/test-task", ctx.BranchName);
+        Assert.DoesNotContain($"/{task.Number}-", ctx.BranchName);
+    }
+
+    [Fact]
+    public async Task CreateAsync_ChildWithoutTicket_UsesParentTicket()
+    {
+        if (!GitAvailable) { Assert.True(true, "git not available -- skipping"); return; }
+
+        var repo = CreateRepo();
+        var (child, list) = MakeEntities(repo.RepoDir);
+        var parent = new TaskEntity
+        {
+            Id = Guid.NewGuid().ToString(), ListId = list.Id, Title = "parent", CommitType = "feat",
+            TicketRef = "bandel:77", CreatedAt = DateTime.UtcNow,
+        };
+        child.ParentTaskId = parent.Id;
+
+        var db = new DbFixture();
+        _dbFixtures.Add(db);
+        using (var seedCtx = db.CreateContext())
+        {
+            await new ListRepository(seedCtx).AddAsync(list);
+            await new TaskRepository(seedCtx).AddAsync(parent);
+            await new TaskRepository(seedCtx).AddAsync(child);
+        }
+        var mgr = new WorktreeManager(new GitService(), db.CreateFactory(),
+            new WorkerConfig { WorktreeRootStrategy = "sibling" }, NullLogger<WorktreeManager>.Instance);
+
+        var ctx = await mgr.CreateAsync(child, list, CancellationToken.None);
+        _worktreeCleanups.Add((repo.RepoDir, ctx.WorktreePath));
+
+        Assert.StartsWith("chore/77-test-task", ctx.BranchName);
+    }
+```
+
+- [ ] **Step 2: Test laufen lassen — muss scheitern**
+
+Run: `dotnet build ClaudeDo.slnx -c Release && dotnet test tests/ClaudeDo.Worker.Tests/ClaudeDo.Worker.Tests.csproj -c Release --no-build --filter "FullyQualifiedName~WorktreeManagerTests"`
+Expected: FAIL — Branches heißen noch `claudedo/…`.
+
+- [ ] **Step 3: Implementieren**
+
+In `CreateAsync` Zeile 62 (`var name = NameFor(task, null, false);`) ersetzen durch:
+
+```csharp
+        var isCompany = await CompanyRepo.IsCompanyAsync(_git, workingDir, _cfg.CompanyRemotePattern, ct);
+        var name = NameFor(task, await ResolveTicketIdAsync(task, ct), isCompany);
+        var branchType = BranchTypeFor(task.CommitType);
+```
+
+Kollisionscheck + Branchname (Zeilen 80-89) ersetzen durch:
+
+```csharp
+        // Numbers restart after a DB reset, and without the claudedo/ prefix a taken name may also be
+        // the user's own branch — the self-heal below would force-delete it, the id suffix keeps it untouched.
+        if (Directory.Exists(Path.Combine(parentDir, name))
+            || (await _git.ListLocalBranchesAsync(workingDir, ct)).Contains($"{branchType}/{name}"))
+        {
+            var id = task.Id.Replace("-", "");
+            name = $"{name}-{id[..Math.Min(8, id.Length)]}";
+        }
+
+        var branchName = $"{branchType}/{name}";
+```
+
+Neue private Methode (vor `ResolveBaseCommitAsync`):
+
+```csharp
+    /// <summary>Ticket-Id des Tasks, sonst die seines Parents (Children erben das Ticket ihrer Unit).</summary>
+    private async Task<int?> ResolveTicketIdAsync(TaskEntity task, CancellationToken ct)
+    {
+        var own = TicketStatusMap.ParseBandelTicketId(task.TicketRef);
+        if (own is not null || task.ParentTaskId is null) return own;
+        using var ctx = _dbFactory.CreateDbContext();
+        var parentRef = await ctx.Tasks.AsNoTracking()
+            .Where(t => t.Id == task.ParentTaskId)
+            .Select(t => t.TicketRef)
+            .FirstOrDefaultAsync(ct);
+        return TicketStatusMap.ParseBandelTicketId(parentRef);
+    }
+```
+
+Usings ergänzen: `using ClaudeDo.Worker.Tickets;` (für `TicketStatusMap`). `ClaudeDo.Worker.Git` ist schon importiert.
+
+- [ ] **Step 4: Build + Test**
+
+Run: `dotnet build ClaudeDo.slnx -c Release && dotnet test tests/ClaudeDo.Worker.Tests/ClaudeDo.Worker.Tests.csproj -c Release --no-build --filter "FullyQualifiedName~WorktreeManagerTests|FullyQualifiedName~InteractiveLaunchSpecServiceTests|FullyQualifiedName~TaskRunnerTests"`
+Expected: PASS. Schlägt ein Test fehl, der einen `claudedo/{nummer}-…`-Namen **erwartet** (nicht nur als Fixture seedet), auf `chore/…` umstellen und im Bericht nennen.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/ClaudeDo.Worker/Runner/WorktreeManager.cs tests/ClaudeDo.Worker.Tests/Runner/WorktreeManagerTests.cs
+git commit -m "feat(worker): name task branches <type>/<number>-<slug>" -- src/ClaudeDo.Worker/Runner/WorktreeManager.cs tests/ClaudeDo.Worker.Tests/Runner/WorktreeManagerTests.cs
+```
+
+---
+
+### Task 4: UntrackedWorktreeRecovery ohne Präfix
+
+**Files:**
+- Modify: `src/ClaudeDo.Worker/Lifecycle/UntrackedWorktreeRecovery.cs`
+- Test: `tests/ClaudeDo.Worker.Tests/Lifecycle/UntrackedWorktreeRecoveryTests.cs` (bestehende Datei; per `Glob tests/**/UntrackedWorktreeRecoveryTests.cs` finden und dort ergänzen)
+
+- [ ] **Step 1: Failing test**
+
+```csharp
+    [Theory]
+    [InlineData(@"C:\src\.claudedo-worktrees\lager-app\412-fix", @"C:\Users\x\.claudeDo\worktrees", true)]
+    [InlineData(@"C:\src\.claudedo-worktrees\planning\abc123", @"C:\Users\x\.claudeDo\worktrees", false)]
+    [InlineData(@"C:\Users\x\.claudeDo\worktrees\lager-app\412-fix", @"C:\Users\x\.claudeDo\worktrees", true)]
+    [InlineData(@"C:\Users\x\.claudeDo\worktrees\planning\abc123", @"C:\Users\x\.claudeDo\worktrees", false)]
+    [InlineData(@"C:\src\my-own-worktree", @"C:\Users\x\.claudeDo\worktrees", false)]
+    public void IsTaskWorktreePath(string path, string centralRoot, bool expected)
+    {
+        if (!OperatingSystem.IsWindows()) return;
+        Assert.Equal(expected, UntrackedWorktreeRecovery.IsTaskWorktreePath(path, centralRoot));
+    }
+```
+
+- [ ] **Step 2: Build — scheitert** (`IsTaskWorktreePath` fehlt).
+
+Run: `dotnet build ClaudeDo.slnx -c Release` → FAIL.
+
+- [ ] **Step 3: Implementieren**
+
+Konstante `BranchPrefix` löschen. Konstruktor um `WorkerConfig cfg` erweitern (Feld `_cfg`; `using ClaudeDo.Worker.Config;`). Klassen-Summary auf „ClaudeDo-Task-Worktrees (unter `.claudedo-worktrees` oder dem Central-Root, ohne Planning-Sessions)“ ändern.
+
+In `StartAsync` nach dem Laden der Listen den Central-Root bestimmen:
+
+```csharp
+        var settings = await new AppSettingsRepository(ctx).GetAsync(cancellationToken);
+        var centralRoot = !string.IsNullOrWhiteSpace(settings.CentralWorktreeRoot)
+            ? settings.CentralWorktreeRoot
+            : _cfg.CentralWorktreeRoot;
+```
+
+Den Filter `claudedoPaths` ersetzen:
+
+```csharp
+            var claudedoPaths = registered
+                .Where(w => w.Branch is not null && IsTaskWorktreePath(w.Path, centralRoot))
+                .Select(w => w.Path);
+```
+
+Neue statische Methode (neben `FindUntrackedPaths`):
+
+```csharp
+    /// <summary>True für einen Pfad unter <c>.claudedo-worktrees</c> oder dem Central-Root, außer Planning-Session-Worktrees.</summary>
+    public static bool IsTaskWorktreePath(string path, string centralRoot)
+    {
+        var sep = Path.DirectorySeparatorChar;
+        var full = Normalize(path);
+        string? rest = null;
+
+        var central = Normalize(centralRoot);
+        if (full.StartsWith(central + sep, StringComparison.OrdinalIgnoreCase))
+            rest = full[(central.Length + 1)..];
+        else
+        {
+            var marker = $"{sep}.claudedo-worktrees{sep}";
+            var idx = full.IndexOf(marker, StringComparison.OrdinalIgnoreCase);
+            if (idx >= 0) rest = full[(idx + marker.Length)..];
+        }
+
+        return rest is not null && !rest.StartsWith($"planning{sep}", StringComparison.OrdinalIgnoreCase);
+    }
+```
+
+- [ ] **Step 4: Build + Test**
+
+Run: `dotnet build ClaudeDo.slnx -c Release && dotnet test tests/ClaudeDo.Worker.Tests/ClaudeDo.Worker.Tests.csproj -c Release --no-build --filter "FullyQualifiedName~UntrackedWorktreeRecovery"`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/ClaudeDo.Worker/Lifecycle/UntrackedWorktreeRecovery.cs tests/ClaudeDo.Worker.Tests/Lifecycle/UntrackedWorktreeRecoveryTests.cs
+git commit -m "refactor(worker): detect untracked worktrees by path instead of branch prefix" -- src/ClaudeDo.Worker/Lifecycle/UntrackedWorktreeRecovery.cs tests/ClaudeDo.Worker.Tests/Lifecycle/UntrackedWorktreeRecoveryTests.cs
+```
+
+(Pfad der Testdatei an den tatsächlichen Fundort anpassen.)
+
+---
+
+### Task 5: `list_config.base_branch` durch alle Writer
+
+**Files:**
+- Modify: `src/ClaudeDo.Data/Models/ListConfigEntity.cs`, `src/ClaudeDo.Data/Configuration/ListConfigEntityConfiguration.cs`, `src/ClaudeDo.Data/Repositories/ListRepository.cs:161-180`
+- Create: Migration `AddListBaseBranch` (generiert)
+- Modify: `src/ClaudeDo.Data/Wire.cs:111,115`
+- Modify: `src/ClaudeDo.Worker/Hub/WorkerHub.cs:577-647`
+- Modify: `src/ClaudeDo.Worker/External/ConfigMcpTools.cs:13,53-59,104-139`
+- Test: `tests/ClaudeDo.Worker.Tests/Hub/ListConfigBaseBranchTests.cs`
+
+- [ ] **Step 1: Failing tests**
+
+`tests/ClaudeDo.Worker.Tests/Hub/ListConfigBaseBranchTests.cs` — Hub-Aufbau 1:1 aus `tests/ClaudeDo.Worker.Tests/Tickets/ListConfigTicketProjectTests.cs` (gleicher `CreateHub`, `SeedListAsync`, `ReadConfigAsync`):
+
+```csharp
+using ClaudeDo.Data;
+using ClaudeDo.Data.Models;
+using ClaudeDo.Data.Repositories;
+using ClaudeDo.Worker.External;
+using ClaudeDo.Worker.Hub;
+using ClaudeDo.Worker.Tests.Infrastructure;
+using Xunit;
+
+namespace ClaudeDo.Worker.Tests.Hub;
+
+/// BaseBranch und PowerUseAllowed sitzen in der SetConfigAsync-kopiert-verbatim-Falle: jeder Writer,
+/// der sie nicht durchreicht, setzt sie still zurück.
+public sealed class ListConfigBaseBranchTests : IDisposable
+{
+    private readonly DbFixture _db = new();
+    public void Dispose() => _db.Dispose();
+
+    private WorkerHub CreateHub()
+    {
+        var factory = _db.CreateFactory();
+        var broadcaster = new HubBroadcaster(new CapturingHubContext());
+        var hub = new WorkerHub(
+            null!, null!, null!, null!, broadcaster, factory,
+            null!, null!, null!, null!, null!, null!, null!, null!, null!, null!, null!, null!, null!,
+            null!, new ClaudeDo.Worker.Online.OnlineInboxConfig(), new ClaudeDo.Worker.OnlineRefreshTokenStore(new ClaudeDo.Worker.DpapiTokenStore("unused.token")),
+            new ClaudeDo.Worker.Runner.PendingQuestionRegistry(), null!);
+        hub.Clients = new FakeHubCallerClients(new RecordingClientProxy());
+        hub.Context = new FakeHubCallerContext();
+        return hub;
+    }
+
+    private async Task<string> SeedListAsync(string? baseBranch, bool powerUse = false)
+    {
+        var listId = Guid.NewGuid().ToString();
+        await using var ctx = _db.CreateContext();
+        var repo = new ListRepository(ctx);
+        await repo.AddAsync(new ListEntity { Id = listId, Name = "L", CreatedAt = DateTime.UtcNow });
+        await repo.SetConfigAsync(new ListConfigEntity { ListId = listId, BaseBranch = baseBranch, PowerUseAllowed = powerUse });
+        return listId;
+    }
+
+    private async Task<ListConfigEntity?> ReadConfigAsync(string listId)
+    {
+        await using var ctx = _db.CreateContext();
+        return await new ListRepository(ctx).GetConfigAsync(listId);
+    }
+
+    [Fact]
+    public async Task set_list_config_preserves_BaseBranch_and_PowerUseAllowed()
+    {
+        var listId = await SeedListAsync("dev", powerUse: true);
+        var factory = _db.CreateFactory();
+        await using var ctx = factory.CreateDbContext();
+        var tool = new ConfigMcpTools(new ListRepository(ctx), new TaskRepository(ctx),
+            new HubBroadcaster(new CapturingHubContext()), factory);
+
+        await tool.SetListConfig(listId, model: "opus", cancellationToken: CancellationToken.None);
+
+        var cfg = await ReadConfigAsync(listId);
+        Assert.Equal("dev", cfg!.BaseBranch);
+        Assert.True(cfg.PowerUseAllowed);
+    }
+
+    [Fact]
+    public async Task get_list_config_returns_BaseBranch()
+    {
+        var listId = await SeedListAsync("dev");
+        var factory = _db.CreateFactory();
+        await using var ctx = factory.CreateDbContext();
+        var tool = new ConfigMcpTools(new ListRepository(ctx), new TaskRepository(ctx),
+            new HubBroadcaster(new CapturingHubContext()), factory);
+
+        var result = await tool.GetListConfig(listId, CancellationToken.None);
+
+        Assert.Equal("dev", result.Config!.BaseBranch);
+    }
+
+    [Fact]
+    public async Task UpdateListConfig_null_keeps_BaseBranch()
+    {
+        var listId = await SeedListAsync("dev");
+        await CreateHub().UpdateListConfig(new UpdateListConfigDto(listId, "opus", null, null));
+        Assert.Equal("dev", (await ReadConfigAsync(listId))!.BaseBranch);
+    }
+
+    [Fact]
+    public async Task UpdateListConfig_empty_clears_BaseBranch()
+    {
+        var listId = await SeedListAsync("dev");
+        await CreateHub().UpdateListConfig(new UpdateListConfigDto(listId, "opus", null, null, BaseBranch: ""));
+        Assert.Null((await ReadConfigAsync(listId))!.BaseBranch);
+    }
+
+    [Fact]
+    public async Task UpdateListConfig_sets_BaseBranch_and_GetListConfig_returns_it()
+    {
+        var listId = await SeedListAsync(null);
+        var hub = CreateHub();
+        await hub.UpdateListConfig(new UpdateListConfigDto(listId, null, null, null, BaseBranch: "dev"));
+        Assert.Equal("dev", (await hub.GetListConfig(listId))!.BaseBranch);
+    }
+}
+```
+
+- [ ] **Step 2: Build — scheitert** (`BaseBranch` fehlt).
+
+- [ ] **Step 3: Implementieren**
+
+`ListConfigEntity.cs`, nach `PowerUseAllowed`:
+
+```csharp
+    /// <summary>
+    /// Basis neuer Worktrees und Default-Merge-/PR-Ziel (z.B. <c>dev</c>). Null = ausgecheckter Branch
+    /// (privat) bzw. Default-Branch des Remotes (Firma). ⚠️ SetConfigAsync kopiert verbatim.
+    /// </summary>
+    public string? BaseBranch { get; set; }
+```
+
+`ListConfigEntityConfiguration.cs`: `builder.Property(c => c.BaseBranch).HasColumnName("base_branch");`
+
+`ListRepository.SetConfigAsync`, im `else`-Zweig: `existing.BaseBranch = config.BaseBranch;`
+
+Migration erzeugen:
+
+```bash
+dotnet ef migrations add AddListBaseBranch --project src/ClaudeDo.Data/ClaudeDo.Data.csproj --configuration Release
+```
+
+Erwartet: neue Migration mit genau einem `AddColumn<string>(name: "base_branch", table: "list_config", nullable: true)`. Steht mehr drin (fremde Snapshot-Drift), abbrechen und melden.
+
+`Wire.cs` — Kommentar über `UpdateListConfigDto` um eine Zeile ergänzen: `// BaseBranch: null = keep stored, "" = clear, value = set.` Dann beide Records erweitern:
+
+```csharp
+public record UpdateListConfigDto(string ListId, string? Model, string? SystemPrompt, string? AgentPath, int? MaxTurns = null, List<string>? SessionSkills = null, string? VerifyCommand = null, string? PermissionMode = null, int? TicketProjectId = null, bool? PowerUseAllowed = null, string? BaseBranch = null);
+```
+
+```csharp
+public record ListConfigDto(string? Model, string? SystemPrompt, string? AgentPath, int? MaxTurns = null, List<string>? SessionSkills = null, string? VerifyCommand = null, string? PermissionMode = null, int? TicketProjectId = null, bool PowerUseAllowed = false, string? BaseBranch = null);
+```
+
+`WorkerHub.UpdateListConfig` — nach der `powerUseAllowed`-Zeile:
+
+```csharp
+        // Tri-State wie oben: null = behalten, "" = löschen.
+        var baseBranch = dto.BaseBranch is null ? existing?.BaseBranch : dto.BaseBranch.NullIfBlank();
+```
+
+Leer-Prüfung um `&& baseBranch is null` ergänzen, im `new ListConfigEntity { … }` `BaseBranch = baseBranch,` ergänzen. `GetListConfig`: `config.BaseBranch` als letztes Argument an `new ListConfigDto(…)` hängen.
+
+`ConfigMcpTools.cs`:
+- Zeile 13: `public sealed record ListConfigDto(string? Model, string? SystemPrompt, string? AgentPath, int? MaxTurns, string? VerifyCommand, string? BaseBranch = null);`
+- `GetListConfig`: `new ListConfigDto(cfg.Model, cfg.SystemPrompt, cfg.AgentPath, cfg.MaxTurns, cfg.VerifyCommand, cfg.BaseBranch)`
+- `hasUnrelatedSettings` erweitern:
+
+```csharp
+        var hasUnrelatedSettings = existing is not null
+            && (existing.SessionSkills is not null
+                || existing.PermissionMode is not null || existing.TicketProjectId is not null
+                || existing.BaseBranch is not null || existing.PowerUseAllowed);
+```
+
+- im `SetConfigAsync(new ListConfigEntity { … })` ergänzen: `BaseBranch = existing?.BaseBranch, PowerUseAllowed = existing?.PowerUseAllowed ?? false,`
+- `config = allCleared ? null : new ListConfigDto(m, sp, ap, mt, vc, existing?.BaseBranch);`
+
+- [ ] **Step 4: Build + Test**
+
+Run: `dotnet build ClaudeDo.slnx -c Release && dotnet test tests/ClaudeDo.Worker.Tests/ClaudeDo.Worker.Tests.csproj -c Release --no-build --filter "FullyQualifiedName~ListConfigBaseBranchTests|FullyQualifiedName~ListConfigTicketProjectTests|FullyQualifiedName~ListConfigHubTests|FullyQualifiedName~ExternalMcpToolSchemaTests"`
+Run: `dotnet test tests/ClaudeDo.Data.Tests/ClaudeDo.Data.Tests.csproj -c Release --no-build --filter "FullyQualifiedName~Migration"`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/ClaudeDo.Data/Models/ListConfigEntity.cs src/ClaudeDo.Data/Configuration/ListConfigEntityConfiguration.cs src/ClaudeDo.Data/Repositories/ListRepository.cs src/ClaudeDo.Data/Migrations src/ClaudeDo.Data/Wire.cs src/ClaudeDo.Worker/Hub/WorkerHub.cs src/ClaudeDo.Worker/External/ConfigMcpTools.cs tests/ClaudeDo.Worker.Tests/Hub/ListConfigBaseBranchTests.cs
+git commit -m "feat(data): per-list base branch, preserved by every config writer" -- src/ClaudeDo.Data/Models/ListConfigEntity.cs src/ClaudeDo.Data/Configuration/ListConfigEntityConfiguration.cs src/ClaudeDo.Data/Repositories/ListRepository.cs src/ClaudeDo.Data/Migrations src/ClaudeDo.Data/Wire.cs src/ClaudeDo.Worker/Hub/WorkerHub.cs src/ClaudeDo.Worker/External/ConfigMcpTools.cs tests/ClaudeDo.Worker.Tests/Hub/ListConfigBaseBranchTests.cs
+```
+
+---
+
+### Task 6: Basis-Branch als Worktree-Basis und Merge-Ziel
+
+**Files:**
+- Modify: `src/ClaudeDo.Worker/Runner/WorktreeManager.cs` (`ResolveBaseCommitAsync`, Fallback-Zeile)
+- Modify: `src/ClaudeDo.Worker/Lifecycle/TaskMergeService.cs` (`GetTargetsAsync` ~869, `PreviewAsync` ~910, `ApproveAndMergeAsync` ~1077, `MergeAsync` ~375)
+- Test: `tests/ClaudeDo.Worker.Tests/Runner/WorktreeManagerTests.cs`, `tests/ClaudeDo.Worker.Tests/Services/TaskMergeServiceTests.cs`
+
+- [ ] **Step 1: Failing tests**
+
+`WorktreeManagerTests.cs`:
+
+```csharp
+    [Fact]
+    public async Task CreateAsync_BaseBranchSet_BasesOnItEvenWhenAnotherBranchIsCheckedOut()
+    {
+        if (!GitAvailable) { Assert.True(true, "git not available -- skipping"); return; }
+
+        var repo = CreateRepo();
+        GitRepoFixture.RunGit(repo.RepoDir, "checkout", "-b", "dev");
+        File.WriteAllText(Path.Combine(repo.RepoDir, "dev.txt"), "dev");
+        GitRepoFixture.RunGit(repo.RepoDir, "add", "-A");
+        GitRepoFixture.RunGit(repo.RepoDir, "commit", "-m", "dev work");
+        var devHead = GitRepoFixture.RunGit(repo.RepoDir, "rev-parse", "HEAD").Trim();
+        GitRepoFixture.RunGit(repo.RepoDir, "checkout", "-b", "elsewhere", repo.BaseCommit);
+
+        var (task, list) = MakeEntities(repo.RepoDir);
+        var (mgr, db) = await CreateManagerAsync(task, list);
+        using (var ctx0 = db.CreateContext())
+            await new ListRepository(ctx0).SetConfigAsync(new ListConfigEntity { ListId = list.Id, BaseBranch = "dev" });
+
+        var ctx = await mgr.CreateAsync(task, list, CancellationToken.None);
+        _worktreeCleanups.Add((repo.RepoDir, ctx.WorktreePath));
+
+        Assert.Equal(devHead, ctx.BaseCommit);
+    }
+```
+
+`TaskMergeServiceTests.cs` — am vorhandenen Setup der Klasse orientieren (Repo + `SeedWorktree`-Helper, wie die übrigen Tests der Datei). Ein Test, der zeigt, dass `GetTargetsAsync` `BaseBranch` als Default liefert, auch wenn ein anderer Branch ausgecheckt ist:
+
+```csharp
+    [Fact]
+    public async Task GetTargetsAsync_prefers_list_base_branch()
+    {
+        // Setup wie die anderen Tests dieser Datei: Repo, Liste, Task mit Worktree (SeedWorktree).
+        // Zusätzlich: Branch "dev" anlegen (`git branch dev`), list_config.BaseBranch = "dev" setzen,
+        // Main-Checkout bleibt auf seinem Default-Branch.
+        // Assert: targets.DefaultBranch == "dev".
+    }
+```
+
+Der Implementer schreibt diesen Test konkret mit dem Fixture-Setup, das in `TaskMergeServiceTests.cs` schon für `GetTargetsAsync`/Merge-Tests verwendet wird (per `Grep "GetTargetsAsync" tests/ClaudeDo.Worker.Tests` den nächstliegenden bestehenden Test kopieren und um `BaseBranch` ergänzen). Ein zweiter Test: `ApproveAndMergeAsync(taskId, "")` mit `BaseBranch = "dev"` merged auf `dev` (`git log dev --oneline` enthält den Merge-Commit, der vorher ausgecheckte Branch nicht).
+
+- [ ] **Step 2: Tests laufen lassen — scheitern**
+
+Run: `dotnet build ClaudeDo.slnx -c Release && dotnet test tests/ClaudeDo.Worker.Tests/ClaudeDo.Worker.Tests.csproj -c Release --no-build --filter "FullyQualifiedName~BaseBranch|FullyQualifiedName~prefers_list_base_branch"`
+Expected: FAIL.
+
+- [ ] **Step 3: Implementieren**
+
+`WorktreeManager.ResolveBaseCommitAsync` — die letzte Zeile `return await _git.RevParseHeadAsync(workingDir, ct);` ersetzen:
+
+```csharp
+        using var cfgCtx = _dbFactory.CreateDbContext();
+        var baseBranch = await cfgCtx.ListConfigs.AsNoTracking()
+            .Where(c => c.ListId == task.ListId)
+            .Select(c => c.BaseBranch)
+            .FirstOrDefaultAsync(ct);
+        return string.IsNullOrWhiteSpace(baseBranch)
+            ? await _git.RevParseHeadAsync(workingDir, ct)
+            : await _git.RevParseAsync(workingDir, baseBranch, ct);
+```
+
+(Ein nicht existierender Branch wirft aus `RevParseAsync` mit „git rev-parse 'dev' failed“ — gewollt, der Lauf scheitert mit lesbarer Meldung.)
+
+`TaskMergeService` — neue öffentliche Methode (bei `GetTargetsAsync`):
+
+```csharp
+    /// <summary>Leeres Ziel → <c>list_config.base_branch</c>, sonst der ausgecheckte Branch des Main-Checkouts.</summary>
+    public async Task<string> ResolveTargetAsync(ListEntity list, string? targetBranch, CancellationToken ct)
+    {
+        if (!string.IsNullOrWhiteSpace(targetBranch)) return targetBranch;
+        using var ctx = _dbFactory.CreateDbContext();
+        var baseBranch = await ctx.ListConfigs.AsNoTracking()
+            .Where(c => c.ListId == list.Id)
+            .Select(c => c.BaseBranch)
+            .FirstOrDefaultAsync(ct);
+        return string.IsNullOrWhiteSpace(baseBranch)
+            ? await _git.GetCurrentBranchAsync(list.WorkingDir!, ct)
+            : baseBranch;
+    }
+```
+
+Aufrufer umstellen:
+- `GetTargetsAsync`: `var current = await _git.GetCurrentBranchAsync(...)` → `var current = await ResolveTargetAsync(list, null, ct);`
+- `PreviewAsync` (~910) und `ApproveAndMergeAsync` (~1077): die `var target = string.IsNullOrWhiteSpace(targetBranch) ? await _git.GetCurrentBranchAsync(...) : targetBranch;`-Blöcke → `var target = await ResolveTargetAsync(list, targetBranch, ct);`
+- `MergeAsync`: direkt nachdem `list.WorkingDir` geprüft ist und **vor** dem `currentBranch`-Vergleich (~Zeile 414) `targetBranch = await ResolveTargetAsync(list, targetBranch, ct);` einfügen. Grund: `PlanningMergeOrchestrator.DrainAsync` reicht ein leeres Ziel (MCP `review_task` ohne `targetBranch`) unverändert durch, was heute in `git checkout ""` → Blocked endet. Mit der zentralen Auflösung ist das für alle Aufrufer behoben.
+
+- [ ] **Step 4: Build + Test**
+
+Run: `dotnet build ClaudeDo.slnx -c Release && dotnet test tests/ClaudeDo.Worker.Tests/ClaudeDo.Worker.Tests.csproj -c Release --no-build --filter "FullyQualifiedName~WorktreeManagerTests|FullyQualifiedName~TaskMergeServiceTests|FullyQualifiedName~PlanningMergeOrchestratorTests"`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/ClaudeDo.Worker/Runner/WorktreeManager.cs src/ClaudeDo.Worker/Lifecycle/TaskMergeService.cs tests/ClaudeDo.Worker.Tests/Runner/WorktreeManagerTests.cs tests/ClaudeDo.Worker.Tests/Services/TaskMergeServiceTests.cs
+git commit -m "feat(worker): use the list base branch as worktree base and default merge target" -- src/ClaudeDo.Worker/Runner/WorktreeManager.cs src/ClaudeDo.Worker/Lifecycle/TaskMergeService.cs tests/ClaudeDo.Worker.Tests/Runner/WorktreeManagerTests.cs tests/ClaudeDo.Worker.Tests/Services/TaskMergeServiceTests.cs
+```
+
+---
+
+### Task 7: UI — Basis-Branch-Feld + echte Branchnamen
+
+**Files:**
+- Modify: `src/ClaudeDo.Ui/ViewModels/Agent/AgentConfigEditorViewModel.cs:216-231`
+- Modify: `src/ClaudeDo.Ui/ViewModels/Modals/ListSettingsModalViewModel.cs` (Property ~57, Load ~276, Save ~375)
+- Modify: `src/ClaudeDo.Ui/Views/Modals/ListSettingsModalView.axaml` (nach dem WorkingDir-StackPanel, ~Zeile 125)
+- Modify: `src/ClaudeDo.Localization/locales/en.json`, `de.json` (Block `modals.listSettings`, nach `workingDirectoryPlaceholder`)
+- Modify: `src/ClaudeDo.Ui/ViewModels/Islands/DetailsIslandViewModel.cs:670,933,1223,1385`
+- Test: `tests/ClaudeDo.Ui.Tests` — bestehende ListSettingsModal-Tests per `Grep "ListSettingsModalViewModel" tests/ClaudeDo.Ui.Tests` finden
+
+- [ ] **Step 1: Failing test**
+
+In der vorhandenen ListSettingsModal-Testklasse (gleiche Fake-`IWorkerClient`-Mechanik wie die dortigen Save-Tests, die `UpdateListConfigDto` mitschneiden):
+
+```csharp
+    [Fact]
+    public async Task Save_sends_BaseBranch_explicitly()
+    {
+        // Arrange: VM wie in den Nachbartests laden; BaseBranch = "dev" setzen.
+        // Act: Save ausführen.
+        // Assert: der mitgeschnittene UpdateListConfigDto hat BaseBranch == "dev".
+        // Zweiter Fall: BaseBranch = "" → DTO.BaseBranch == "" (nicht null), damit Leeren wirklich löscht.
+    }
+```
+
+Der Implementer schreibt die beiden Fälle konkret gegen den Fake, den die Nachbartests (z.B. der PowerUseAllowed-Save-Test) verwenden.
+
+- [ ] **Step 2: Build/Test — scheitert** (`BaseBranch` fehlt im VM).
+
+- [ ] **Step 3: Implementieren**
+
+`AgentConfigEditorViewModel.SaveAsync`: Signatur um `string? baseBranch = null` erweitern und im List-Zweig durchreichen:
+
+```csharp
+    public async System.Threading.Tasks.Task SaveAsync(
+        string? verifyCommand = null, int? ticketProjectId = null, bool? powerUseAllowed = null, string? baseBranch = null)
+```
+
+```csharp
+            await _worker.UpdateListConfigAsync(new UpdateListConfigDto(TargetId, model, sp, ap, turns, skills, verifyCommand, permission, ticketProjectId, powerUseAllowed, baseBranch));
+```
+
+`ListSettingsModalViewModel`:
+
+```csharp
+    // Basis neuer Worktrees und Default-Merge-Ziel; leer = ausgecheckter Branch.
+    [ObservableProperty] private string _baseBranch = "";
+```
+
+Load (nach `VerifyCommand = …`): `BaseBranch = cfg?.BaseBranch ?? "";`
+Save: `await Agent.SaveAsync(…, PowerUseAllowed, BaseBranch.Trim());` — immer explizit, `""` löscht (das Modal besitzt das Feld).
+
+View, nach dem WorkingDir-StackPanel:
+
+```xml
+              <StackPanel Spacing="4" IsVisible="{Binding !IsFolder}">
+                <TextBlock Classes="field-label" Text="{loc:Tr modals.listSettings.baseBranch}"/>
+                <TextBox Text="{Binding BaseBranch, Mode=TwoWay, UpdateSourceTrigger=PropertyChanged}"
+                         PlaceholderText="{loc:Tr modals.listSettings.baseBranchPlaceholder}"/>
+                <TextBlock Text="{loc:Tr modals.listSettings.baseBranchHint}"
+                           Opacity="0.6" FontSize="12" TextWrapping="Wrap"/>
+              </StackPanel>
+```
+
+Locales (beide Dateien, gleiche Keys, direkt nach `workingDirectoryPlaceholder`):
+
+en.json:
+```json
+      "baseBranch": "Base branch",
+      "baseBranchPlaceholder": "(checked-out branch)",
+      "baseBranchHint": "New task branches start here and approved work merges back here, e.g. dev. Leave empty to use whatever branch is checked out.",
+```
+
+de.json:
+```json
+      "baseBranch": "Basis-Branch",
+      "baseBranchPlaceholder": "(ausgecheckter Branch)",
+      "baseBranchHint": "Neue Task-Branches starten hier, und freigegebene Arbeit wird hierhin gemergt, z.B. dev. Leer = der gerade ausgecheckte Branch.",
+```
+
+Nach dem Editieren beide JSON-Dateien separat parsen (`python -c "import json;json.load(open('src/ClaudeDo.Localization/locales/de.json',encoding='utf-8'))"`), weil ein kaputtes `de.json` vom LocaleStore still geschluckt wird.
+
+`DetailsIslandViewModel`:
+- Zeilen 670 und 933: `BranchLine = entity.Worktree is { } w ? $"{w.BranchName} ← main" : null;` → `BranchLine = entity.Worktree?.BranchName;` (das Ziel ist nicht mehr immer `main`).
+- Zeilen 1223 und 1385: `var branchName = $"claudedo/{Task.Id.Replace("-", "")}";` → `var branchName = BranchLine ?? "the task branch";`
+
+- [ ] **Step 4: Build + Test**
+
+Run: `dotnet build ClaudeDo.slnx -c Release && dotnet test tests/ClaudeDo.Ui.Tests/ClaudeDo.Ui.Tests.csproj -c Release --no-build --filter "FullyQualifiedName~ListSettings|FullyQualifiedName~DetailsIsland"`
+Run: `dotnet test tests/ClaudeDo.Localization.Tests/ClaudeDo.Localization.Tests.csproj -c Release --no-build`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/ClaudeDo.Ui/ViewModels/Agent/AgentConfigEditorViewModel.cs src/ClaudeDo.Ui/ViewModels/Modals/ListSettingsModalViewModel.cs src/ClaudeDo.Ui/Views/Modals/ListSettingsModalView.axaml src/ClaudeDo.Localization/locales/en.json src/ClaudeDo.Localization/locales/de.json src/ClaudeDo.Ui/ViewModels/Islands/DetailsIslandViewModel.cs <ui-testdatei>
+git commit -m "feat(ui): base branch field in list settings, real branch names in dialogs" -- <dieselben pfade>
+```
+
+**Sichtprüfung offen (Mika):** Feld im Listen-Modal, Branchzeile im Detail-Pane.
+
+---
+
+### Task 8: Doku
+
+**Files:**
+- Modify: `src/ClaudeDo.Worker/CLAUDE.md` (Key Components → WorktreeManager; Notes → „Task worktree branches follow…“; External → „Task worktree branches and folders are named…“; Config → `company_remote_pattern`)
+- Modify: `src/ClaudeDo.Data/CLAUDE.md` (list_config: `base_branch`)
+
+- [ ] **Step 1: Texte ersetzen**
+
+Überall `claudedo/{number}-{title-slug}` → `<typ>/<nummer>-<slug>` mit der Regel: Typ aus `WorktreeManager.BranchTypeFor` (`feat`→`feature`, sonst `fix/refactor/docs/test/chore`, Rest `chore`); Nummer = Ticket-Id (eigene oder des Parents), sonst Task-Nummer, im Firmen-Repo ohne Ticket keine. Planning bleibt `claudedo/planning/{guid}`.
+
+Config-Abschnitt ergänzen: `` `company_remote_pattern` (`/_git/`) — Teilstring der origin-URL, an dem `CompanyRepo` ein Firmen-Repo erkennt; nur per Hand editierbar. ``
+
+Data/CLAUDE.md: `list_config.base_branch` — Basis neuer Worktrees + Default-Merge-Ziel, tri-state in `UpdateListConfigDto`, ⚠️ verbatim-copy-Falle wie `ticket_project_id`.
+
+- [ ] **Step 2: Commit**
+
+```bash
+git add src/ClaudeDo.Worker/CLAUDE.md src/ClaudeDo.Data/CLAUDE.md
+git commit -m "docs(worker): document new branch naming and per-list base branch" -- src/ClaudeDo.Worker/CLAUDE.md src/ClaudeDo.Data/CLAUDE.md
+```

docs/superpowers/plans/2026-10-01-unit-branch-2-children.md

@@ -0,0 +1,184 @@
+# Unit-Branch Teil 2: Children per fast-forward — Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Children of a unit start from the unit branch head and are fast-forwarded into it as soon as they finish; a parent is approved like a single task.
+
+**Architecture:** New `UnitBranchService` (Worker/Runner) owns the git side: it creates the planning parent's worktree on "Queue plan" and absorbs a finished child (`merge --ff-only` in the parent worktree, child worktree removed, row `Merged`, `MergeCommit` null). It never touches task status — `TaskRunner` (`FailAsync` on a ff failure) and `TaskMergeService` (approve of an interactive child) own the transitions, so `TaskStateService`/`PlanningChainCoordinator` stay git-free and the DI graph stays acyclic. Legacy units (a `Done` child with an `Active` worktree) keep going through `PlanningMergeOrchestrator`.
+
+**Tech Stack:** .NET 8, EF Core SQLite, git CLI, xUnit (real git + real SQLite in Worker.Tests).
+
+Spec: `docs/superpowers/specs/2026-10-01-unit-branch-draft-pr-design.md`, section 2. Private behaviour only — company mode (push/PR) is part 3.
+
+## File map
+
+| File | Change |
+|---|---|
+| `src/ClaudeDo.Data/Git/GitService.cs` | + `MergeFastForwardOnlyAsync` |
+| `src/ClaudeDo.Data/Repositories/WorktreeRepository.cs` | `SetMergedAsync(…, string? mergeCommit)` |
+| `src/ClaudeDo.Worker/Runner/WorktreeManager.cs` | `ResolveBaseCommitAsync`: child → `rev-parse <parentWt.BranchName>` for any parent with an Active worktree |
+| `src/ClaudeDo.Worker/Runner/UnitBranchService.cs` | **new** — `EnsureUnitWorktreeAsync`, `AbsorbChildAsync`, `HasUnabsorbedChildrenAsync` |
+| `src/ClaudeDo.Worker/Program.cs` | register `UnitBranchService` (+ `Share<>` for the external container is not needed — the MCP side only uses the static helper) |
+| `src/ClaudeDo.Worker/Planning/PlanningChainCoordinator.cs` | `QueuePlanAsync` calls `EnsureUnitWorktreeAsync` |
+| `src/ClaudeDo.Worker/Runner/TaskRunner.cs` | `HandleSuccess`: absorb before `CompleteAsync`, ff failure → `MarkFailed` |
+| `src/ClaudeDo.Worker/Lifecycle/TaskMergeService.cs` | `ApproveAndMergeAsync`: child of a unit worktree → absorb instead of merge |
+| `src/ClaudeDo.Worker/Hub/WorkerHub.cs`, `src/ClaudeDo.Worker/External/ExternalMcpService.cs` | approve routing: orchestrator only for unabsorbed (legacy) children |
+| `src/ClaudeDo.Worker/Planning/PlanningMergeOrchestrator.cs` | also merges a *planning* parent's own Active worktree (mixed legacy unit) |
+| `src/ClaudeDo.Worker/Planning/PlanningAggregator.cs` | combined diff = `unitBase..unitBranch` without `checkout -b` when the parent owns the unit; per-child diff of absorbed children from the commit range |
+| `tests/ClaudeDo.Worker.Tests/Runner/UnitBranchTests.cs` | **new** — all unit-branch tests |
+| `src/ClaudeDo.Worker/CLAUDE.md`, `docs/explore-notes/review-merge.md` | docs |
+
+---
+
+### Task 1: Git primitive + nullable MergeCommit
+
+**Files:** Modify `src/ClaudeDo.Data/Git/GitService.cs` (after `MergeNoFfAsync`), `src/ClaudeDo.Data/Repositories/WorktreeRepository.cs:39`
+
+- [ ] **Step 1: Add the method**
+
+```csharp
+/// <summary><c>git merge --ff-only</c>: moves the checked-out branch to <paramref name="sourceRef"/> or fails without touching it.</summary>
+public async Task<(int ExitCode, string Stderr)> MergeFastForwardOnlyAsync(
+    string worktreePath, string sourceRef, CancellationToken ct = default)
+{
+    var (exitCode, _, stderr) = await RunGitAsync(worktreePath, ["merge", "--ff-only", sourceRef], ct);
+    return (exitCode, stderr);
+}
+```
+
+- [ ] **Step 2:** `SetMergedAsync(string taskId, string? mergeCommit, …)` — an absorbed child has no merge commit.
+- [ ] **Step 3:** Covered by the Task 3 tests (no standalone test for a one-line git wrapper).
+
+### Task 2: Child base = unit head
+
+**Files:** Modify `src/ClaudeDo.Worker/Runner/WorktreeManager.cs` (`ResolveBaseCommitAsync`)
+
+- [ ] **Step 1: Failing test** (`UnitBranchTests.Child_starts_from_unit_head`): planning parent (`PlanningPhase.Finalized`) with a worktree, commit a file in the parent worktree (`git -C <wt> commit`), then `CreateAsync(child)` → `ctx.BaseCommit == rev-parse <parentBranch>`. Fails today because planning children fall through to `HEAD` of the main checkout.
+- [ ] **Step 2: Implement**
+
+```csharp
+if (task.ParentTaskId is not null)
+{
+    using var ctx = _dbFactory.CreateDbContext();
+    var parentWt = await new WorktreeRepository(ctx).GetByTaskIdAsync(task.ParentTaskId, ct);
+    if (parentWt is { State: WorktreeState.Active })
+        return await _git.RevParseAsync(workingDir, parentWt.BranchName, ct);
+}
+```
+
+- [ ] **Step 3:** run `--filter "FullyQualifiedName~UnitBranchTests|FullyQualifiedName~WorktreeManagerTests"`, commit.
+
+### Task 3: UnitBranchService
+
+**Files:** Create `src/ClaudeDo.Worker/Runner/UnitBranchService.cs`, register in `Program.cs` next to `WorktreeManager`.
+
+```csharp
+public sealed record AbsorbResult(bool Applicable, string? Error)
+{
+    public static readonly AbsorbResult NotApplicable = new(false, null);
+    public static readonly AbsorbResult Absorbed = new(true, null);
+    public bool Failed => Error is not null;
+}
+
+public sealed class UnitBranchService
+{
+    // ctor: GitService, WorktreeManager, IDbContextFactory, HubBroadcaster?, ILogger
+
+    /// Planning parent → own worktree = unit branch; no-op if it already has an Active one or the list has no git working dir.
+    public async Task EnsureUnitWorktreeAsync(string parentId, CancellationToken ct);
+
+    /// ff the parent worktree to the child branch; child row Merged (MergeCommit null), child worktree + branch removed.
+    /// NotApplicable when the child or its parent has no Active worktree. Never changes task status.
+    public async Task<AbsorbResult> AbsorbChildAsync(string childId, CancellationToken ct);
+
+    /// Legacy routing: a Done child whose worktree is still Active was never absorbed.
+    public static Task<bool> HasUnabsorbedChildrenAsync(ClaudeDoDbContext ctx, string parentId, CancellationToken ct) =>
+        ctx.Tasks.AnyAsync(t => t.ParentTaskId == parentId && t.Status == TaskStatus.Done
+            && t.Worktree != null && t.Worktree.State == WorktreeState.Active, ct);
+}
+```
+
+Absorb order: ff → parent `UpdateHeadAsync(head, diffstat base..head)` → child `SetMergedAsync(null)` → best-effort `worktree remove --force` + `branch -D` → `WorktreeUpdated` for both. ff failure returns `Error` with a clear message and a `ponytail:` comment (no merge fallback).
+
+- [ ] Tests (real git): two serial children absorbed, child 2 sees child 1's file, parent branch head == child 2 head, child rows `Merged` with null `MergeCommit`, child branches gone; a child forked from the old head after the unit moved → `Failed`, unit branch unchanged.
+- [ ] Commit.
+
+### Task 4: Queue plan creates the parent worktree
+
+**Files:** `PlanningChainCoordinator.cs` (optional ctor param `UnitBranchService? unitBranch = null`), `TaskStateServiceBuilder.cs` (optional pass-through).
+
+```csharp
+if (_unitBranch is not null) await _unitBranch.EnsureUnitWorktreeAsync(parentTaskId, ct);
+return await SetupChainAsync(parentTaskId, enqueue: true, ct);
+```
+
+- [ ] Test: finalized planning parent + 1 child in a git list → after `QueuePlanAsync` the parent has an Active worktree row whose base = repo HEAD; a second call keeps the same row.
+- [ ] Commit.
+
+### Task 5: TaskRunner absorbs before CompleteAsync
+
+**Files:** `TaskRunner.cs` (optional trailing ctor param `UnitBranchService? unitBranch = null`; in the child branch of `HandleSuccess`):
+
+```csharp
+if (_unitBranch is not null)
+{
+    var absorb = await _unitBranch.AbsorbChildAsync(task.Id, CancellationToken.None);
+    if (absorb.Failed)
+    {
+        await MarkFailed(task.Id, task.Number, task.Title, slot, absorb.Error, result.TurnCount);
+        return;
+    }
+}
+```
+
+- [ ] Test: TaskRunner with `FakeClaudeProcess` writing a file into its working dir, two queued children of a unit → both Done, unit head has both files; a child whose base was overtaken → `Failed` with the ff message.
+- [ ] Commit.
+
+### Task 6: Interactive child approve absorbs
+
+**Files:** `TaskMergeService.cs` (optional ctor param `UnitBranchService? unitBranch = null`); in `ApproveAndMergeAsync` after the `WaitingForReview` guard:
+
+```csharp
+if (task.ParentTaskId is not null && _unitBranch is not null)
+{
+    var absorb = await _unitBranch.AbsorbChildAsync(taskId, ct);
+    if (absorb.Failed) return Blocked(absorb.Error!);
+    if (absorb.Applicable)
+    {
+        var approved = await _state.ApproveReviewAsync(taskId, ct);
+        return approved.Ok ? new MergeResult(StatusMerged, Array.Empty<string>(), null) : Blocked(approved.Reason ?? "approve failed");
+    }
+}
+```
+
+A blocked approve keeps the child `WaitingForReview` (the reviewer can reject/re-run) — the `Failed` rule applies to autonomous runs.
+
+- [ ] Test: child in `WaitingForReview` with a commit → approve → child Done, unit branch contains the file, main untouched.
+- [ ] Commit.
+
+### Task 7: Approve routing
+
+**Files:** `WorkerHub.ApproveReview`, `ExternalMcpService.ReviewTask`, `PlanningMergeOrchestrator.StartAsync`.
+
+- Replace `hasChildren` with `UnitBranchService.HasUnabsorbedChildrenAsync` for the orchestrator branch (MCP still computes `emptyChildren` whenever children exist; absorbed children count as empty when their row has no `HeadCommit`).
+- Orchestrator: `if (parentHasWorktree) idsToMerge.Add(parentTaskId)` (drop `!isPlanning`) so a mixed legacy unit still lands the unit branch.
+- [ ] Tests: approve of a new parent (all children absorbed) merges the unit branch onto `main` and the parent goes Done; a legacy parent (Done child with Active worktree, no parent worktree) still goes through the orchestrator and lands the child.
+- [ ] Commit.
+
+### Task 8: Combined diff without the integration branch
+
+**Files:** `PlanningAggregator.cs`.
+
+- `BuildIntegrationBranchAsync`: parent with Active worktree and no unabsorbed child → `Ok(parentWt.BranchName, git diff <BaseCommit> <BranchName>)`, no checkout in the main checkout. Otherwise legacy path.
+- `GetAggregatedDiffAsync`: a node whose worktree directory is gone but has `HeadCommit` → `GetCommitRangeDiffAsync(repoDir, BaseCommit, HeadCommit)`; an improvement parent's own node is limited to `BaseCommit..firstChild.BaseCommit` once children were forked from it (else it would repeat the absorbed children).
+- [ ] Test: unit with an absorbed child → combined diff contains the child's file, main checkout stays on `main`, no `planning/*-integration` branch exists.
+- [ ] Commit.
+
+### Task 9: Docs
+
+`src/ClaudeDo.Worker/CLAUDE.md` (Planning Flow, Unified parent model, WorktreeManager base rule), `docs/explore-notes/review-merge.md` (Approve section, MergeCommit/revert note, Unit-Branch section). Commit.
+
+## Verification
+
+`dotnet build ClaudeDo.slnx -c Release`, then
+`dotnet test tests/ClaudeDo.Worker.Tests/ClaudeDo.Worker.Tests.csproj -c Release --no-build --filter "FullyQualifiedName~UnitBranch|FullyQualifiedName~WorktreeManager|FullyQualifiedName~PlanningMerge|FullyQualifiedName~PlanningAggregator|FullyQualifiedName~StandaloneChildren|FullyQualifiedName~TaskMergeService|FullyQualifiedName~ReviewTask"`.

docs/superpowers/plans/2026-10-01-unit-branch-3-company-pr.md

@@ -0,0 +1,112 @@
+# Unit-Branch Teil 3: Firmen-Modus (Fetch, Push, Draft-PR) — Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** In a company repo (origin matches `company_remote_pattern`) a unit root starts from a freshly fetched `origin/<basis>`, and Approve ends in a pushed branch plus an Azure DevOps **draft PR** instead of a local merge.
+
+**Architecture:** `AzureDevOpsClient` (port of `pr-create.ps1`) is the only HTTP surface to ADO; it also builds the git auth environment (PAT as `http.extraHeader` via `GIT_CONFIG_COUNT/KEY_0/VALUE_0`, never on the command line). `WorktreeManager.ResolveBaseCommitAsync` fetches the basis for unit roots in company repos. `TaskMergeService.ApproveAndMergeAsync` branches on `CompanyRepo.IsCompanyAsync` into `ApproveCompanyAsync`: verify in the unit-root worktree → `PullRequestPublisher.PublishAsync` (push, find-or-create draft PR, store `worktrees.pull_request_url`, `WorktreeUpdated`). The task stays `WaitingForReview`; result status `pr_created` / `pr_updated`. Every failure is a `blocked` result with a precise reason (hub → `HubException`, MCP → tool error, UI → footer strip).
+
+**Tech Stack:** .NET 8, EF Core SQLite, git CLI, xUnit (real git + SQLite), Avalonia.
+
+Spec: `docs/superpowers/specs/2026-10-01-unit-branch-draft-pr-design.md`, sections 3–5, decision rows "Basis-Branch" / "Basis aktualisieren", section 7.
+
+**Live finding (ticket system, 2026-10-01):** `ParentId` of a ticket is its project (`ItemType 0`, `ParentTicketID` null); a task's parent is the ticket. Project id = walk `GET /api/ticket/{id}` up until `parentTicketID` is null (max 3 hops). Ticket web URL: `https://ticket.fb-tuning.local/board/project/<project>/ticket/<id>`.
+
+## File map
+
+| File | Change |
+|---|---|
+| `src/ClaudeDo.Data/Models/WorktreeEntity.cs`, `Configuration/WorktreeEntityConfiguration.cs`, `Migrations/*AddWorktreePullRequestUrl*` | `PullRequestUrl` → `worktrees.pull_request_url` |
+| `src/ClaudeDo.Data/Repositories/WorktreeRepository.cs` | `SetPullRequestUrlAsync` |
+| `src/ClaudeDo.Data/Git/GitService.cs` | env-aware `RunGitAsync`; `FetchBranchAsync`, `PushBranchAsync`, `FastForwardLocalBranchAsync`, `GetRemoteHeadBranchAsync` |
+| `src/ClaudeDo.Worker/Runner/CommitMessageBuilder.cs`, `WorktreeManager.cs` | trailer off in company repos; fetch basis for unit roots |
+| `src/ClaudeDo.Worker/AzureDevOps/AzureDevOpsClient.cs` | **new** — remote parsing, auth env, default branch, find-or-create draft PR, api-version fallback |
+| `src/ClaudeDo.Worker/AzureDevOps/PullRequestPublisher.cs` | **new** — push + PR + URL + ticket link |
+| `src/ClaudeDo.Worker/DpapiTokenStore.cs`, `Program.cs` | `AzureDevOpsPatStore` (`~/.claudeDo/azdo.pat`), DI |
+| `src/ClaudeDo.Worker/Lifecycle/TaskMergeService.cs` | `ApproveCompanyAsync`, `StatusPrCreated/Updated`, `MergeResult.PullRequestUrl`, `MergeTargets.IsCompanyRepo` |
+| `src/ClaudeDo.Worker/Hub/WorkerHub.cs`, `External/ExternalMcpService.cs` | ADO settings methods; PR URL in results |
+| `src/ClaudeDo.Data/Wire.cs` | `AzureDevOpsSettingsDto`, `AzureDevOpsConnectionDto`, `MergeResultDto.PullRequestUrl`, `MergeTargetsDto.IsCompanyRepo` |
+| `src/ClaudeDo.Ui/...` | IWorkerClient/WorkerClient, settings tab "Externe Dienste", detail-pane PR button/link |
+| `tests/ClaudeDo.Ui.Tests/StubWorkerClient.cs` | new members |
+| `src/ClaudeDo.Data/PromptFiles.cs` | company-repo paragraph in the merge prompt (merge + merge_final share it) |
+| `tests/ClaudeDo.Worker.Tests/AzureDevOps/*` | **new** — client, fetch basis, company approve |
+| docs | Worker/CLAUDE.md, review-merge.md, open.md |
+
+---
+
+### Task 1: `worktrees.pull_request_url`
+
+- [ ] `WorktreeEntity.PullRequestUrl` (`string?`), mapped to `pull_request_url`.
+- [ ] `dotnet ef migrations add AddWorktreePullRequestUrl` (project `src/ClaudeDo.Data`). Check the generated Designer contains `base_branch` (parent `AddListBaseBranch`) — see trap `ef-migration-parallel-designer-collision`.
+- [ ] `WorktreeRepository.SetPullRequestUrlAsync(taskId, url, ct)` via `ExecuteUpdateAsync`.
+- [ ] Covered by Task 5 tests.
+
+### Task 2: Git primitives + trailer
+
+- [ ] `RunGitAsync(..., IReadOnlyDictionary<string,string>? env = null)`; network ops always set `GIT_TERMINAL_PROMPT=0`.
+- [ ] `FetchBranchAsync(repoDir, branch, env, ct)` → `git fetch origin +refs/heads/<b>:refs/remotes/origin/<b>` (explicit refspec: works without a configured fetch refspec); returns `(ExitCode, Stderr)`.
+- [ ] `FastForwardLocalBranchAsync(repoDir, branch, ct)` → `git fetch . refs/remotes/origin/<b>:refs/heads/<b>` (local, no network; git refuses a non-fast-forward itself).
+- [ ] `PushBranchAsync(worktreePath, branch, env, ct)` → `git push -u origin <b>`.
+- [ ] `GetRemoteHeadBranchAsync(repoDir, ct)` → `symbolic-ref --short refs/remotes/origin/HEAD` minus `origin/`, or null.
+- [ ] `CommitMessageBuilder.Build(..., bool includeTrailer = true)`; `WorktreeManager.CommitIfChangedAsync` passes `!isCompany`. Test in `CommitMessageBuilderTests`: no `ClaudeDo-Task:` line when false.
+
+### Task 3: `AzureDevOpsClient` + PAT store
+
+- [ ] `AzureDevOpsPatStore(DpapiTokenStore)` marker, registered with `InAppData("azdo.pat")`.
+- [ ] `AzureDevOpsClient(IHttpClientFactory, AzureDevOpsPatStore)`:
+  - `static AzdoRepo? ParseRemote(string remote)` — trim, strip `.git`, strip `user[:pw]@`, split at `/_git/`; `Repo` unescaped.
+  - `static IReadOnlyDictionary<string,string> GitAuthEnv(string? pat)` — `GIT_TERMINAL_PROMPT=0` + (pat ? `GIT_CONFIG_COUNT=1`, `GIT_CONFIG_KEY_0=http.extraHeader`, `GIT_CONFIG_VALUE_0=Authorization: Basic <b64(":pat")>`).
+  - `static string? SupportedVersion(string error)` — `supports is (\d+\.\d+)`.
+  - `GetDefaultBranchAsync(repo, ct)` → `GET …/_apis/git/repositories/<repo>` → `defaultBranch` without `refs/heads/`.
+  - `EnsureDraftPullRequestAsync(repo, source, target, title, description, ct)` → `GET …/pullrequests?searchCriteria.sourceRefName=refs/heads/<s>&searchCriteria.status=active`; first hit is reused, else `POST …/pullrequests` with `isDraft: true`. Returns `(Url, Created)`, URL `<webUrl>/pullrequest/<id>`.
+  - api version starts at `6.0`, one retry with the version the error names (remembered).
+  - errors → `AzureDevOpsException` with status code + server message; no PAT → `AzureDevOpsException("Kein Azure-DevOps-PAT hinterlegt …")`.
+- [ ] Tests (`AzureDevOpsClientTests`, `StubHandler` from Tickets): the two `-SelfTest` remotes + non-ADO remote, auth header `Basic OmdlaGVpbQ==`, version parse (match / foreign error), reuse of an active PR (no POST), create with `isDraft` + refs, version fallback retry.
+
+### Task 4: Fetch the basis before a unit root
+
+`WorktreeManager.ResolveBaseCommitAsync`, unit-root branch only, when `CompanyRepo.IsCompanyAsync`:
+1. basis = `base_branch` → ADO `defaultBranch` (if the remote parses and a PAT is set) → `GetRemoteHeadBranchAsync`. None → today's behaviour.
+2. `FetchBranchAsync(basis, GitAuthEnv(pat))`. Failure → warning, base = local `basis` (else HEAD). No throw.
+3. Success → base = `rev-parse origin/<basis>`; then best-effort local update: not checked out → `FastForwardLocalBranchAsync` (only if the local branch exists); checked out + clean (`HasChangesAsync(includeUntracked:false)`) → `MergeFastForwardOnlyAsync(workingDir, origin/<basis>)`; otherwise warning only.
+- [ ] Tests (`CompanyFetchBaseTests`, bare repo as origin, pattern = bare path): bare one commit ahead → unit root's `BaseCommit` == bare head, local `main` fast-forwarded; dirty checked-out `main` stays untouched (file content + HEAD unchanged) but the root still starts from origin; unreachable origin → worktree created from local `main`; private repo (pattern mismatch) → no fetch (origin ahead is ignored).
+
+### Task 5: Company approve
+
+- [ ] `TaskMergeService`: `StatusPrCreated = "pr_created"`, `StatusPrUpdated = "pr_updated"`; `MergeResult(..., string? PullRequestUrl = null)`; `MergeTargets(..., bool IsCompanyRepo = false)` filled in `GetTargetsAsync`.
+- [ ] `ApproveAndMergeAsync`: after the child-absorb block, if `wt` is Active and the repo is a company repo → `ApproveCompanyAsync` (ignores `skipVerify`):
+  - verify via `RunVerifyGateAsync(verifyCommand, wt.Path, …)` with `PhaseVerifying` broadcast; red → `verify_failed`, nothing pushed.
+  - `PullRequestPublisher.PublishAsync(task, list, wt, verified, ct)` wrapped in `ProgressReporter.RunAsync` ("push + draft PR running").
+- [ ] `PullRequestPublisher` (`GitService`, `AzureDevOpsClient`, `TicketClientFactory?`, db factory, broadcaster, logger):
+  - no PAT → blocked; remote does not parse → blocked.
+  - push with `GitAuthEnv`; rejected → blocked `push rejected: <stderr>`.
+  - target = `base_branch` else ADO default branch.
+  - title `<type>(<list-slug>): <title>[, Resolves #<ticket>]`; description `Resolves [#id](<url>)` (link only with a project id) + task description + `Geprüft: <cmd> grün` / `Geprüft: nichts automatisch`.
+  - PR error after push → blocked `gepusht, PR fehlgeschlagen: …`.
+  - success → `SetPullRequestUrlAsync`, `WorktreeUpdated`, `pr_created`/`pr_updated` with URL. Task status and worktree state untouched.
+- [ ] Hub `ApproveReview`: `MergeResultDto(..., r.PullRequestUrl)`. MCP `review_task`: `mergeMessage` = PR URL for `pr_*`; tool description mentions it.
+- [ ] Tests (`CompanyApproveTests`; origin URL `http://ado.test/coll/proj/_git/Repo` + `url.<bare>.pushInsteadOf` so the push lands in a local bare repo while the remote still parses as ADO; HTTP stubbed): creates draft PR (branch in bare, URL stored, task still WaitingForReview, worktree Active, title/description), reuses existing PR → `pr_updated` without POST, verify red → no push, PR error after push → blocked "gepusht, PR fehlgeschlagen", `skipVerify` ignored.
+
+### Task 6: Hub + wire + UI client
+
+- [ ] Wire: `AzureDevOpsSettingsDto(bool TokenSet)`, `AzureDevOpsConnectionDto(bool Ok, string? Repo, string? DefaultBranch, string? Error)`, `MergeResultDto.PullRequestUrl`, `MergeTargetsDto.IsCompanyRepo`.
+- [ ] Hub: `GetAzureDevOpsSettings`, `SetAzureDevOpsToken`, `ClearAzureDevOpsToken`, `TestAzureDevOpsConnection` (first list whose origin matches the pattern and parses → `GetDefaultBranchAsync`; every error is an answer, not a throw).
+- [ ] `IWorkerClient`/`WorkerClient` + `StubWorkerClient`.
+
+### Task 7: UI
+
+- [ ] Settings: tab header "Externe Dienste"/"External services"; second section Azure DevOps (PAT field, test, clear) in `TicketSettingsTabViewModel` (saved together with the ticket settings).
+- [ ] Detail pane: `Merge.IsCompanyRepo` (from targets) and `Merge.PullRequestUrl` (from the worktree row); target dropdown hidden in company repos; approve label "Draft-PR erstellen" / "PR aktualisieren"; PR link button (`ShellOpen.Url`); approve errors in company mode go to the footer strip (`ErrorReported`) instead of a modal; still gated behind "open diff".
+- [ ] Locales en + de in parity, both parsed separately.
+
+### Task 8: Merge-helper prompt
+
+- [ ] Company-repo paragraph in `MergeHelperMergeDefault`: approve returns `pr_created`/`pr_updated` + URL, task stays WaitingForReview, no `verify_merges`, summary lists PR links.
+
+### Task 9: Docs
+
+- [ ] `src/ClaudeDo.Worker/CLAUDE.md` (tickets/config section, new Azure DevOps section), `docs/explore-notes/review-merge.md`, `docs/open.md` (manual smoke: PAT + test button, ticket task to draft PR, planning unit with 2 children).
+
+## Verification
+
+`dotnet build ClaudeDo.slnx -c Release`; tests filtered: `FullyQualifiedName~AzureDevOps|FullyQualifiedName~CompanyFetchBase|FullyQualifiedName~CompanyApprove|FullyQualifiedName~CommitMessageBuilder|FullyQualifiedName~UnitBranch|FullyQualifiedName~WorktreeManager` (Worker), Localization.Tests, Ui.Tests filtered to settings/details.

docs/superpowers/specs/2026-10-01-ticket-import-all-design.md

@@ -0,0 +1,132 @@
+# Ticket-Import über alle Projekte + Tagesplanung — Design
+
+**Datum:** 2026-10-01 · **Status:** abgenommen
+
+## Ziel
+
+Ein Lauf holt **alle** Mika zugewiesenen, offenen Ticket-Items (Tickets, Tasks, Subtasks) aus dem
+Bandel-Ticketsystem, lässt Claude jedes Item nach **Inhalt** der passenden ClaudeDo-Liste zuordnen
+und plant danach den Tag (bestehender FillMyDay-Lauf). Auslösbar per Button und als Prime-Schedule.
+
+## Warum nicht der bestehende Import
+
+`TicketImportService.ImportAsync` arbeitet pro Liste über die feste Verknüpfung
+`ListConfigEntity.TicketProjectId` und nur für Board-Items vom Typ Ticket. Live-Stand 2026-10-01:
+
+- 6 von 10 offenen, zugewiesenen Items sind Tasks/Subtasks (z.B. 595/596/598/668 unter
+  „Lager Technik Plugin“) — der heutige Import sieht sie nie.
+- Projekt „Lager“ (493) enthält Items für mehrere Repos (Hub Lagertechnik, SorterController) und
+  ist mit zwei Listen verknüpft. Projekt→Liste ist die falsche Zuordnungsachse; Inhalt ist die
+  richtige.
+- DueDate ist fast überall null, Priorität fast überall „Niedrig“ — was heute dran ist, entscheidet
+  weiterhin FillMyDay, nicht die Ticketdaten.
+
+## Entscheidungen
+
+| Frage | Entscheidung |
+|---|---|
+| Zuordnung | Claude nach Inhalt (Titel, Parent, Projekt). Projekt-Verknüpfung einer Liste ist nur ein Hinweis. |
+| Granularität | Flach: jedes zugewiesene Ticket/Task/Subtask wird ein eigener ClaudeDo-Task. Parent steht in der Beschreibung. Keine Hierarchie. |
+| Ablauf | Ein Lauf, zwei Schritte: Zuordnungs-Lauf, danach FillMyDay — im selben `PrimeRunner`-Gate. |
+| Kein Treffer | Item geht in die **Fallback-Liste** (App-Setting). Signal für Mika: dafür fehlt eine Liste. Ist keine gesetzt → übersprungen und in der Zusammenfassung genannt. |
+| Fallback anwenden | Der **Worker**, nicht Claude: `import_ticket` ohne `list` → Fallback-Liste. |
+
+## Komponenten
+
+### 1. Datenquelle (`Worker/Tickets/`)
+
+**Sweep über alle Projekt-Boards** — nur Routen, die `BandelTicketClient` schon hat und die seit
+2026-09-01 live verifiziert sind: `GET /api/Navigation/sidebar` (alle sichtbaren Projekte) →
+pro Projekt `GET /api/Board/project/{id}`. Filter, `statusId ∈ {1, 2}`:
+
+- Ticket (Board-Item): `ticketAssignees[].assigneeName == userName`
+- Task (`tasks[]` am Board-Item): **`ticketTaskAssignees[].assigneeName`** == userName —
+  unabhängig davon, wem das Parent-Ticket gehört (730/732 hängen an 728 von marcel.sievers).
+
+Projekt-Titel kommt aus der Sidebar, Parent aus dem umschließenden Board-Item.
+`TicketBoardItem` bekommt `Tasks` (`id`, `title`, `statusId`, `hasChildren`,
+`ticketTaskAssignees`).
+
+**Live-Befund 2026-10-01** (7 Projekte, ~1,2 s): exakt die 10 offenen Items, die das Ticket-MCP
+`list_assigned_items` liefert — 665, 593 (+595/596/598/668), 1014, 1016, 1017, 730, 732.
+Verworfen wurde `GET /api/board/global/{userId}`: liefert kein Projekt, braucht eine userId, die
+`/pat/me` nicht hergibt (`/users/username/{u}` = 401 mit PAT), und ist **nicht** auf den
+Token-Inhaber beschränkt (`global/22` lieferte 147 fremde Items).
+
+Subtasks (Ebene 3): live existiert keiner (`hasChildren` überall false). Board-Tasks mit
+`hasChildren = true` werden übersprungen.
+<!-- ponytail: keine Rekursion über GET /api/item/{id}/children — nachrüsten, sobald Subtasks real vorkommen -->
+
+**Offen, manuell zu prüfen:** `PATCH /api/Ticket/{id}/status` auf einem **Task** (nicht Ticket) —
+nicht live getestet, weil es ein Schreibzugriff aufs Firmensystem ist. Laut Bandel.APIs-Breadcrumb
+gleiche Tabelle, Statusrecht u.a. für Assignees. Scheitert es, loggt `TicketStatusSync` nur eine
+Warnung (wirft nie) → beim ersten echten Lauf im Worker-Log prüfen.
+
+Details pro Item für die Beschreibung: `GET /api/ticket/{id}` (live: liefert `description`,
+`parentTicketID`).
+
+### 2. `TicketImportService`
+
+- `GetCandidatesAsync(ct)` → zugewiesene offene Items, deren `bandel:<id>` noch **in keiner Liste**
+  als `TicketRef` existiert, plus alle User-Listen (Id, Name, WorkingDir, verknüpftes
+  Ticket-Projekt) als Zuordnungskontext.
+- `ImportItemAsync(itemId, listId?, ct)` → lädt Details via `GET /api/ticket/{id}` (Beschreibung,
+  HTML→Markdown über das bestehende `HtmlToMarkdown`), legt einen `Idle`-Task an:
+  `TicketRef = bandel:<id>`, `CreatedBy = "ticketsystem"`, Beschreibung endet mit
+  `Ticket #<id>` und bei Kind-Items `Teil von #<parentId> <parentTitle>`.
+  `listId == null` → `AppSettings.TicketFallbackListId`; ist die auch null → kein Task, Ergebnis
+  meldet „übersprungen“. Bereits importiert (global) → No-op mit entsprechender Meldung.
+- **Fix im bestehenden `ImportAsync`:** Dedupe über `TicketRef` **listenübergreifend** statt nur
+  `t.ListId == listId` — sonst legt „Aus Ticketsystem aktualisieren“ ein bereits global
+  zugeordnetes Item ein zweites Mal an.
+
+### 3. MCP-Tools (External-MCP, neue `External/TicketMcpTools`)
+
+- `get_ticket_import_candidates()` → `{ available, items[], lists[], fallbackList }`.
+  `available = false` mit Grund, wenn das Ticketsystem nicht eingerichtet ist.
+- `import_ticket(ticketId, list = null)` → Bestätigungs-Record (`created`, `taskNumber`,
+  `listName`, `usedFallback`, `skippedReason`). `list` akzeptiert Name oder Id.
+
+Konventionen aus `src/ClaudeDo.Worker/CLAUDE.md` gelten (C#-Default für optionale Parameter,
+kein nacktes `Task`-Return, Tool-Doku nach `McpToolDocs`).
+
+### 4. Ablauf (`Worker/Prime/`)
+
+- `PrimeActionKind.ImportTickets`, DB-Wert `import_tickets` (Converter in
+  `PrimeScheduleEntityConfiguration`).
+- `TicketImportPrompt` (analog `DailyPrepPrompt`): Prompt über `PromptFiles`
+  (`PromptKind.TicketImport`), Args `--allowedTools` nur die zwei Tools, `--permission-mode
+  acceptEdits`. Prompt-Kern: Kandidaten holen, jedes Item der inhaltlich passenden Liste zuordnen
+  (Projekt-Verknüpfung = Hinweis), bei Unsicherheit `list` weglassen, am Ende Zusammenfassung
+  (importiert pro Liste, Fallback, übersprungen).
+- `PrimeRunner.RunImportTicketsAsync`: Log einmal leeren, `PrepStarted`, Zuordnungs-Lauf, dann den
+  FillMyDay-Teil (bestehende Logik ohne erneutes Leeren/`PrepStarted`), `PrepFinished`. Schlägt
+  der Import fehl, läuft FillMyDay trotzdem (bestehende Tasks sind weiter planbar); das Outcome
+  meldet den Importfehler.
+- Ist das Ticketsystem nicht eingerichtet, fällt der Lauf auf reines FillMyDay zurück.
+
+### 5. Hub + UI
+
+- `WorkerHub.RunTicketImportNow()` (synthetischer Schedule, Kind fix `ImportTickets`, wie
+  `RunDailyPrepNow`); `IWorkerClient`/`WorkerClient` + Test-Fakes nachziehen.
+- Prep-Panel (`DetailsIslandView`, neben „Plan day“): Button „Tickets + Tag planen“, nur sichtbar
+  wenn das Ticketsystem eingerichtet ist; gleiche Enable-Logik wie `PlanDayCommand`.
+- Prime-Tab: neuer Aktionstyp wählbar.
+- Settings → Ticketsystem: Dropdown „Fallback-Liste“ (User-Listen + „keine“).
+- `AppSettingsEntity.TicketFallbackListId` (nullable) + EF-Migration. Locale-Keys en + de.
+
+## Tests
+
+- `GetCandidatesAsync`: Status-Filter, Assignee-Filter über `ticketAssignees`, globale Dedupe.
+- `ImportItemAsync`: explizite Liste, Fallback, keine Fallback-Liste → übersprungen, Duplikat.
+- `ImportAsync`: Item bereits in anderer Liste → nicht erneut angelegt.
+- `PrimeRunner`: `ImportTickets` → zwei Claude-Läufe in Reihenfolge, ein Gate, Import-Fehler
+  blockiert FillMyDay nicht.
+- Fake-Client/Fake-Claude, **kein** echtes Claude. Live-Verifikation (Schritt 1) und
+  Sichtprüfung der UI sind manuelle Punkte → `docs/open.md`.
+
+## Bewusst nicht drin
+
+- Rückabgleich „Ticket im Ticketsystem erledigt, Task in ClaudeDo noch offen“.
+- Ticket-Hierarchie als ClaudeDo-Parent/Subtasks.
+- Aktualisieren bereits importierter Items (würde Notizen überschreiben — gleiche Regel wie heute).

docs/superpowers/specs/2026-10-01-unit-branch-draft-pr-design.md

@@ -0,0 +1,249 @@
+# Unit-Branch + Draft-PR — Design
+
+**Datum:** 2026-10-01 · **Status:** abgenommen (mit Basis-Branch pro Liste + Fetch)
+**Diagramme:** Obsidian `07 - Plattform & Technik/ClaudeDo/ClaudeDo - Branch und PR Ablauf.md`
+**Ersetzt:** die offene Entscheidung aus `2026-08-06-planning-chain-fork-base-design.md`
+
+## Ziel
+
+Aufgaben starten und später zu fertigen PRs zurückkommen. In Firmen-Repos (Azure DevOps Server)
+heißen Branches nach dem work-conventions-Schema, und das Review endet in einem **Draft-PR** statt
+in einem lokalen Merge auf `main`. Nebenbei sehen Planning-Children endlich die Arbeit ihres
+Vorgängers.
+
+## Begriffe
+
+- **Unit:** ein einzelner Task, oder ein Parent (Planning oder Improvement) samt Children.
+- **Unit-Branch:** der eine Branch, auf dem die ganze Arbeit einer Unit landet. Er gehört dem
+  Worktree des Unit-Roots (Einzeltask bzw. Parent).
+- **Firmen-Repo:** Die `origin`-URL enthält `company_remote_pattern` (`worker.config.json`,
+  Default `/_git/`, nur per Hand editierbar). Geprüft wird live über `git remote get-url origin`
+  und ohne Cache.
+
+## Entscheidungen
+
+| Frage | Entscheidung |
+|---|---|
+| Branchname | Einheitlich `<typ>/<nummer>-<slug>`. Die Nummer ist die Ticket-Id aus `TicketRef` (beim Child die des Unit-Roots), sonst privat die Task-Nummer. Im Firmen-Repo ohne Ticket entfällt sie (`<typ>/<slug>`). `claudedo/{nr}-…` fällt weg. Planning-Session-Worktrees bleiben `claudedo/planning/{guid}`. |
+| Typ | `feat`→`feature`. `fix`, `refactor`, `docs`, `test`, `chore` bleiben, wie sie sind. Alles andere (`ci`, `perf`, `style`, `build`) wird `chore`. |
+| Slug | `CommitMessageBuilder.ToSlug` plus Umlaut-Auflösung (`ä→ae`, `ö→oe`, `ü→ue`, `ß→ss`), ≤40 Zeichen wie heute. |
+| Children | Starten vom aktuellen Head des Unit-Branches. Ist ein Child fertig, wird der Unit-Branch sofort per **fast-forward** auf den Head des Childs gezogen. Das gilt privat und in Firmen-Repos. |
+| Review-Ende privat | Unverändert: Approve merged den Unit-Branch auf `main`, dann läuft Verify auf `main`. |
+| Review-Ende Firma | Approve führt Verify im Worktree des Unit-Roots aus, dann Push und Draft-PR. Der Task bleibt `WaitingForReview` mit PR-Link. `Done` setzt Mika per Toggle nach dem ADO-Merge. |
+| PR-Automatik | Kein Auto-PR bei einem Statuswechsel. Automatisiert wird über den Merge-Helper, dessen `approve` dann den PR erzeugt. |
+| ADO-Zugang | Eigener PAT (Scope Code Read & Write). Er wird per `DpapiTokenStore` in `~/.claudeDo/azdo.pat` gespeichert, ohne Abhängigkeit auf das work-conventions-Plugin. |
+| dependsOn über Units | Wartet bewusst auf den echten Merge. Abhängige Arbeit gehört in eine Unit mit einem PR. |
+| Basis-Branch | Pro Liste einstellbar (`list_config.base_branch`, z.B. `dev` für die LagerApp). Leer heißt: privat der gerade ausgecheckte Branch des Main-Checkouts (wie heute), Firma der Default-Branch des ADO-Repos. Gilt als Basis des Unit-Branches, als PR-Ziel und als Vorauswahl des privaten Merge-Ziels. |
+| Basis aktualisieren | Firmen-Repo: `git fetch origin <basis>`, bevor der Unit-Branch angelegt wird. Der Unit-Branch startet von `origin/<basis>`, der lokale Basis-Branch wird best-effort per fast-forward nachgezogen. |
+
+## 1. Branch-Naming (`WorktreeManager`)
+
+- `NameFor(task, ticketId, isCompany)` liefert den Leaf `<nummer>-<slug>` bzw. `<slug>`, und
+  `BranchFor` liefert `<typ>/<leaf>`. Der Ordnername des Worktrees bleibt der Leaf.
+- **Kollisionsprüfung** (heute `Contains($"claudedo/{name}")`, Zeile 83) prüft den neuen vollen
+  Branchnamen. Bei einem Treffer kommt das Id-Suffix dran, wie heute.
+- **Self-Heal** (`git branch -D` nach „already exists“) läuft nur noch, wenn der Branch in einer
+  `worktrees`-Zeile steht, deren Task der aktuelle Task ist. Sonst gibt es keinen Delete, sondern
+  das Id-Suffix, und der Branch des Nutzers bleibt unangetastet. Ohne das Präfix `claudedo/` ist
+  das Pflicht, sonst löscht ClaudeDo einen fremden `feature/…`-Branch.
+- **`UntrackedWorktreeRecovery`** filtert statt nach dem Präfix nach „Worktree-Pfad liegt unter
+  einer ClaudeDo-Worktree-Root (`.claudedo-worktrees` bzw. Central-Root), aber nicht unter
+  `planning/`“.
+- `PlanningAggregator.CleanupIntegrationBranchAsync:137` (Präfix-Check beim Checkout-Fallback)
+  wird mit Abschnitt 3 ohnehin hinfällig.
+- Bestehende Worktrees behalten ihren Namen. Der Branchname steht in der DB und wird nie neu
+  abgeleitet, eine Migration ist also nicht nötig.
+- **Bugfix nebenbei:** `DetailsIslandViewModel.cs:1223/1385` baut für Dialogtexte
+  `claudedo/{Task.Id}`, das ist schon heute falsch. Künftig steht dort `worktree.BranchName`. Das
+  literale `"← main"` (`:670/:933`) zeigt das echte Ziel an.
+
+## 2. Unit-Branch und Children
+
+**Wer besitzt den Unit-Branch?**
+- **Einzeltask:** sein eigener Worktree. Am Ablauf ändert sich nichts.
+- **Improvement-Parent:** sein eigener Worktree, den er schon heute hat. Seine Children starten
+  schon heute von `parent.HeadCommit`.
+- **Planning-Parent:** hat heute **keinen** Worktree. Neu: `QueuePlanAsync` legt per
+  `WorktreeManager.CreateAsync` einen Worktree für den Parent an, auf dem Unit-Branch und mit
+  `main` HEAD als Basis. Damit hat jeder Parent eine `worktrees`-Zeile, die den Unit-Branch und
+  später die PR-URL trägt.
+
+**Basis eines Childs** (`ResolveBaseCommitAsync`): Das ist immer der aktuelle Head des
+Unit-Branches (`rev-parse <unitBranch>`). Der Sonderfall „nur bei `PlanningPhase.None`“ fällt weg.
+
+**Basis eines Unit-Roots** (Einzeltask, Parent):
+- **Privat:** `list_config.base_branch`, sonst der ausgecheckte Branch des Main-Checkouts. Heute
+  ist es `RevParseHeadAsync`. Ist `base_branch` gesetzt, wird es `rev-parse <base_branch>`, auch
+  wenn gerade ein anderer Branch ausgecheckt ist.
+- **Firma:**
+  - Zuerst `git fetch origin <basis>`. `<basis>` ist `base_branch`, sonst der Default-Branch des
+    Repos per ADO-API, ersatzweise `git symbolic-ref refs/remotes/origin/HEAD`.
+  - Der Unit-Branch startet von `origin/<basis>`.
+  - Dann wird der lokale `<basis>` best-effort nachgezogen:
+    - nicht ausgecheckt: `git fetch origin <basis>:<basis>` (lehnt einen nicht-fast-forward
+      selbst ab)
+    - ausgecheckt und sauber: `git -C <workingDir> merge --ff-only origin/<basis>`
+    - schmutzig oder divergiert: Warnung ins Log, kein Eingriff in den Checkout
+  - Schlägt der Fetch fehl (offline, keine Credentials), wird gewarnt und es geht mit dem
+    lokalen `<basis>` weiter. Der Task scheitert daran nicht.
+  - Der Fetch nutzt dieselbe PAT-Übergabe wie der Push (Abschnitt 3).
+- Der Fetch läuft einmal pro Unit-Root, nicht pro Child. Children starten vom Unit-Branch.
+
+**Spalte `list_config.base_branch`** (nullable string, Migration):
+- Sie wird im Listeneinstellungs-Modal gepflegt, als Freitext mit Vorschlägen aus
+  `ListLocalBranchesAsync`, und in `get_list_config` mitgeliefert.
+- ⚠️ `ListRepository.SetConfigAsync` kopiert verbatim (siehe `TicketProjectId`). Jeder Schreiber
+  muss den Wert durchreichen, sonst setzt ihn z.B. `set_list_config` still zurück:
+  `WorkerHub.UpdateListConfig`, `ConfigMcpTools`, alle Stellen, die eine frische
+  `ListConfigEntity` bauen.
+- `UpdateListConfigDto` braucht ihn tri-state wie `TicketProjectId`, damit ein Aufrufer, der das
+  Feld nicht kennt, es nicht löscht.
+- **Merge-Ziel privat:** `TaskMergeService.GetTargetsAsync` setzt `DefaultBranch` auf
+  `base_branch`, falls gesetzt. Das leere Ziel (`ApproveAndMergeAsync:1077`, `PreviewAsync:910`)
+  löst ebenfalls auf `base_branch` auf, sonst wie heute.
+
+**Absorbieren eines Childs:** Neu ist `UnitBranchService.AbsorbChildAsync(childId)`, das in
+`git -C <parentWorktree> merge --ff-only <childBranch>` mündet.
+- Die Kette ist seriell (`BlockedByTaskId`), und das Child startet vom Head des Unit-Branches.
+  Deshalb ist es **immer** ein fast-forward, Konflikte sind ausgeschlossen. Lässt es sich nicht
+  fast-forwarden, z.B. weil jemand ein Child manuell parallel per „Run now“ gestartet hat, wird
+  das Child `Failed` mit einer klaren Meldung, ohne Merge-Versuch.
+  `ponytail: kein Merge-Fallback; einbauen, falls parallele Children ein echter Fall werden.`
+- Danach wird der Worktree des Childs entfernt, der Branch gelöscht und die Zeile auf `Merged`
+  gesetzt (`MergeCommit` = null, denn es gibt keinen Merge-Commit). `revert_merge` greift auf
+  Child-Ebene deshalb nicht, revertiert wird die ganze Unit.
+- Aufgerufen wird es aus `TaskRunner.HandleSuccess` direkt vor `_state.CompleteAsync`. Ein
+  ff-Fehler wird so zu `FailAsync` statt zu einem Unblock des Nachfolgers.
+- Interaktive Children landen in `WaitingForReview`, und ihr Approve geht durch
+  `TaskMergeService.ApproveAndMergeAsync`. Dort gilt neu: Hat der Task einen Parent mit eigenem
+  Worktree, wird `AbsorbChildAsync` aufgerufen statt auf das Ziel gemergt.
+- Kein Git-Code in `TaskStateService` oder `PlanningChainCoordinator`, die bleiben git-frei.
+
+**Was dabei wegfällt:** Den Unit-Merge Child für Child am Ende gibt es für neue Units nicht mehr.
+Ein Parent wird beim Approve wie ein Einzeltask behandelt, über seinen eigenen Worktree in
+`TaskMergeService.ApproveAndMergeAsync`. Auch der Integration-Branch
+(`PlanningAggregator`, `planning/{slug}-integration`, dafür `checkout -b` im Main-Checkout) ist
+für neue Units unnötig, denn der kombinierte Diff ist `unitBase..unitHead`.
+
+**Routing beim Approve** (`WorkerHub.ApproveReview`, `ExternalMcpService.ReviewTask`): Heute
+geht jeder Task mit Children an den Orchestrator. Neu gilt: Gibt es ein `Done`-Child mit einem
+`Active`-Worktree, also eins, das nicht absorbiert wurde, läuft der Legacy-Orchestrator. Sonst
+geht es über `ApproveAndMergeAsync` auf den Worktree des Parents.
+
+**Altbestand:** Parents ohne eigenen Worktree (vor dem Rollout geplant) laufen weiter über
+`PlanningMergeOrchestrator` und den bestehenden Aggregator. Diesen Legacy-Pfad entfernen wir in
+einem Folge-Task, sobald keine solchen Units mehr offen sind.
+
+## 3. Approve im Firmen-Repo
+
+`TaskMergeService.ApproveAndMergeAsync` verzweigt nach `IsCompanyRepo(list)`:
+
+1. **Verify** im Worktree des Unit-Roots (`IVerifyCommandRunner.RunAsync(worktreePath, …)`), nicht
+   im Main-Checkout. Ohne Verify-Command entfällt der Schritt. Rot heißt: Ergebnis
+   `verify_failed`, der Task bleibt `WaitingForReview`, kein Push. `skipVerify` wird im
+   Firmen-Modus ignoriert, weil kein Merge landet, auf den man das Verify verschieben könnte.
+2. **Push** mit `git -C <worktree> push -u origin <unitBranch>`. Der PAT geht als
+   `http.extraHeader` über `GIT_CONFIG_COUNT`/`GIT_CONFIG_KEY_0`/`GIT_CONFIG_VALUE_0` in der
+   Prozess-Umgebung mit. Er steht also nicht in der Kommandozeile, und es gibt keinen
+   Credential-Manager-Prompt im Hintergrundprozess.
+3. **PR**, neuer `AzureDevOpsClient`, portiert aus `pr-create.ps1`:
+   - Der Remote wird an `/_git/` zerlegt: API-Basis = alles davor, Repo = Segment danach.
+     Eingebettete Zugangsdaten fliegen raus.
+   - `GET …/pullrequests?searchCriteria.sourceRefName=refs/heads/<branch>&searchCriteria.status=active`.
+     Gibt es schon einen PR, wird er wiederverwendet (idempotent, auch wenn der Skill in der
+     Session schon einen angelegt hat).
+   - Sonst `POST …/pullrequests` mit `isDraft: true` und `targetRefName = <basis>`. Das ist
+     `list_config.base_branch`, sonst `defaultBranch` aus `GET …/repositories/<repo>`.
+   - Die API-Version fällt auf die zurück, die der Server in seiner Fehlermeldung nennt, wie im
+     Skript.
+4. Die **PR-URL** wird gespeichert, in der neuen nullable Spalte `worktrees.pull_request_url`
+   (Migration). Danach folgen `WorktreeUpdated` und der Rückgabestatus `pr_created` bzw.
+   `pr_updated`.
+5. Der Task bleibt `WaitingForReview`, der Worktree bleibt `Active`, und das Ticket bleibt auf
+   `InBearbeitung`.
+
+**PR-Inhalt:**
+- **Titel:** `<commitType>(<list-slug>): <titel>, Resolves #<ticket>`. Ohne Ticket entfällt
+  `Resolves`.
+- **Beschreibung:**
+  - `Resolves [#412](<ticket-url>)`. Die Projekt-Id kommt über `BandelTicketClient.GetTicketAsync`
+    → `ParentTicketID` (bei Tasks eine Ebene höher). Ohne Id gibt es keinen Link.
+  - Leerzeile, dann die Task-Beschreibung.
+  - Leerzeile, dann `Geprüft: <verify command> grün` bzw. `Geprüft: nichts automatisch`.
+
+**Commits im Firmen-Repo:** `CommitMessageBuilder` lässt den Trailer `ClaudeDo-Task:` weg. Er
+wird nirgends gelesen, und die Konvention verbietet Signatur-Trailer.
+
+**Rerun nach Änderungswunsch:** Ein normaler Reject mit Feedback, der auf demselben Worktree
+weiterläuft. Der nächste Approve pusht nach, und der vorhandene PR aktualisiert sich.
+
+**Fehler:** Fehlt der PAT, wird der Push abgelehnt oder scheitert ein REST-Aufruf, dann landen
+Statusmeldung und Footer-Strip (`FlashFooterError`) beim Nutzer, und der Task bleibt
+`WaitingForReview`. Scheitert der PR nach einem erfolgreichen Push, sagt die Meldung das genau
+so: „gepusht, PR fehlgeschlagen: …“.
+
+**Laufzeit:** Verify plus Push können länger als 5 s dauern. Der MCP-Pfad meldet deshalb Progress
+über `ProgressReporter`, sonst bricht der MCP-Client nach 300 s Leerlauf ab.
+
+## 4. Merge-Helper
+
+Die Prompts in `PromptFiles` (merge und merge_final) bekommen einen Firmen-Repo-Absatz:
+- `review_task approve` liefert `pr_created`/`pr_updated` mit URL.
+- `verify_merges` entfällt, weil das Verify bereits im Approve läuft.
+- Die Abschluss-Zusammenfassung listet die PR-Links auf.
+- Die Regel „erst mergen, dann neu starten“ bleibt harmlos, da `main` sich nicht bewegt.
+
+## 5. UI
+
+- Der Settings-Reiter „Ticketsystem“ heißt künftig **„Externe Dienste“**. Er bekommt einen
+  zweiten Abschnitt **Azure DevOps** mit PAT-Feld, Test-Button und Löschen-Button, gespiegelt vom
+  Ticket-PAT.
+- Neue Hub-Methoden: `GetAzureDevOpsSettings`, `SetAzureDevOpsToken`, `ClearAzureDevOpsToken`,
+  `TestAzureDevOpsConnection`. Neuer DI-Marker `AzureDevOpsPatStore`.
+- Der Test braucht ein Firmen-Repo als Kontext: Er nimmt die erste Liste, deren `origin` passt,
+  und ruft `GET …/repositories/<repo>` auf.
+- Im Detail-Pane heißt der Approve-Button im Firmen-Repo **„Draft-PR erstellen“**. Er ist weiter
+  hinter „Diff öffnen“ gegated, und das Ziel-Dropdown ist ausgeblendet. Ist eine PR-URL gesetzt,
+  erscheint ein Link und der Button heißt „PR aktualisieren“.
+- Locale-Keys kommen in `en.json` und `de.json` gleichzeitig hinzu.
+
+## 6. Bewusst draußen
+
+- PR-Status-Polling bzw. automatisches `Done` nach dem ADO-Merge.
+- Andere PR-Provider als Azure DevOps. `company_remote_pattern` schaltet nur das Schema um, die
+  PR-API ist ADO-spezifisch.
+- Aufräumen von Worktree und lokalem Branch, wenn ein Firmen-Task auf `Done` gesetzt wird. Das
+  geht über die bestehende Worktree-Übersicht.
+- `git fetch` in privaten Repos. Die Basis bleibt dort lokal.
+- Eine UI für `company_remote_pattern`.
+
+## 7. Tests
+
+Keine Tests mit der echten Claude-CLI und keine gegen das echte ADO.
+
+- **Naming:** Typ-Mapping, Nummernregel (Ticket, privat, Firma ohne Ticket), Umlaute,
+  Kollision mit einem fremden Branch (der Branch überlebt, das Suffix greift), Self-Heal löscht
+  nur DB-eigene Branches. Die betroffenen Asserts in `WorktreeManagerTests` (`:69`, `:131/138`,
+  `:160`, `:314`) passe ich an.
+- **Unit-Branch** (echtes git, Worker.Tests):
+  - Ein Child startet vom Head des Unit-Branches.
+  - Zwei serielle Children werden per fast-forward absorbiert, und Child 2 sieht die Dateien von
+    Child 1.
+  - Ein nicht fast-forwardbares Child wird `Failed`.
+  - Ein Planning-Parent bekommt seinen Worktree bei `QueuePlanAsync`.
+- **Approve Firma:**
+  - Ein lokales Bare-Repo dient als `origin`, und das Muster wird auf dessen Pfad gesetzt.
+  - `AzureDevOpsClient` wird gefakt: PR anlegen, vorhandenen PR wiederverwenden, Verify rot
+    heißt kein Push, PR-Fehler nach dem Push.
+- **Remote-Parsing:** die Fälle aus dem `-SelfTest` des Skripts.
+- **Basis:**
+  - `base_branch` gesetzt: Der Unit-Root startet davon, auch wenn ein anderer Branch ausgecheckt
+    ist.
+  - Firma: Nach dem Fetch startet der Unit-Root von `origin/<basis>`. Das testet ein Bare-Repo,
+    das einen Commit voraus ist.
+  - Der lokale Basis-Branch wird nachgezogen, ein schmutziger Checkout bleibt unangetastet.
+  - Ein Fetch-Fehler bricht den Task nicht.
+  - `SetConfigAsync`, `set_list_config` und `UpdateListConfig` erhalten `base_branch`.
+- **Manueller Smoke-Test (Mika):** PAT eintragen, Test-Button. Ein Ticket-Task in einem echten
+  Firmen-Repo bis zum Draft-PR durchspielen, danach eine Planning-Unit mit 2 Children.
+

docs/superpowers/specs/2026-10-02-ssh-workspaces-design.md

@@ -0,0 +1,104 @@
+# SSH workspaces — remote interactive sessions
+
+**Date:** 2026-10-02 · **Status:** approved (inline, Mika)
+
+## Goal
+
+Start an interactive `claude` session on a server (e.g. the VPS) as a Mission Control tile,
+with the `claudedo` MCP reachable from there. One extra entry per workspace in the
+quick-session flyout ("VPS"), click → tile → real claude TUI over ssh.
+
+## Scope
+
+In:
+- SSH workspaces configured in Settings: **Name, Host alias, Remote path**.
+- Host alias is picked from `%USERPROFILE%\.ssh\config` (`Host` lines, wildcards skipped);
+  user/key/port stay in the ssh config — ClaudeDo stores none of it.
+- Quick-session flyout lists each workspace after the local targets.
+- The tile runs `ssh.exe` with a reverse tunnel to the worker's external MCP for the
+  lifetime of the ssh process; the remote claude gets a `claudedo` MCP entry pointing at it.
+- Per-session token on a dedicated remote-only MCP listener.
+
+Out (v1):
+- Autonomous tasks on a remote host — the whole worktree/merge/verify pipeline is local-FS.
+- `handoff_session` and "Recent sessions"/resume for SSH tiles — both build local paths
+  (brief.md, cwd). SSH sessions are **not recorded** in `mission_control_sessions` and get
+  **no** `claudedo_pane` entry / handoff hint.
+- Path translation in MCP tool results (worktree/attachment paths stay Windows paths).
+- Password/key management UI — ssh prompts inside the tile like in a terminal.
+
+## Design
+
+### Storage
+`AppSettingsEntity.SshWorkspaces` (`ssh_workspaces`) — JSON array of
+`{ id, name, host, remotePath }`. Same pattern as `RepoImportFolders`: dedicated repository
+`Get/SetSshWorkspacesAsync` + hub `GetSshWorkspaces`/`SetSshWorkspaces`, **not** part of
+`AppSettingsDto` (`AppSettingsRepository.UpdateAsync` copies named fields only, so the column is
+never clobbered by a general settings save). One EF migration adds the column.
+
+Validation at the boundary (`SshWorkspace.Validate`, used by Settings before save and by the hub on
+set): name non-empty; host matches `^[A-Za-z0-9._@][A-Za-z0-9._@-]*$` — **a leading `-` would be
+parsed by ssh as an option (`-oProxyCommand=…` = local code execution)**; remote path starts with
+`/` or `~`, contains no `'` and no line break (it is single-quoted on the remote shell).
+
+### Launch spec (Worker)
+New hub method `GetSshLaunchSpec(string workspaceId, string paneId)` →
+`InteractiveLaunchSpecService.BuildForSshAsync`:
+
+- `Exe` = `ssh` resolved on PATH (Windows OpenSSH); clear error if missing.
+- `Cwd` = local user profile (ssh needs a local cwd; nothing remote reads it).
+- Remote port: random per session in `20000–60999`.
+- Token: random 32 bytes (hex), registered in a singleton `RemoteSessionTokenRegistry`.
+- Args (each a separate token, **no embedded double quotes** — ConPTY flattens Args into one
+  Windows command line, see `docs/explore-notes/conpty-sessions.md`):
+  ```
+  -t -o ExitOnForwardFailure=yes
+  -R <remotePort>:127.0.0.1:<RemoteMcpPort>
+  <hostAlias>
+  umask 077 && mkdir -p ~/.claudedo && echo <b64> | base64 -d > ~/.claudedo/mcp-<paneId>.json
+    && cd '<remotePath>' && MCP_TOOL_TIMEOUT=<ms> claude --mcp-config ~/.claudedo/mcp-<paneId>.json;
+    rm -f ~/.claudedo/mcp-<paneId>.json
+  ```
+  `<b64>` = base64 of `{"mcpServers":{"claudedo":{"type":"http","url":"http://127.0.0.1:<remotePort>/mcp","headers":{"X-ClaudeDo-Remote-Token":"<token>"}}}}`.
+  Base64 has no shell- or argv-sensitive characters; the file (mode 600 via umask) keeps the
+  JSON out of claude's own argv.
+- The server name is `claudedo` (not `claudedo_pane`) so tool names match local sessions.
+- Remote prerequisites: POSIX shell with `base64`, `claude` on PATH and logged in.
+
+### Remote-only MCP listener (security)
+The external MCP is loopback-only and keyless by default (`ExternalMcpAuthMiddleware`).
+Tunnel traffic arrives as loopback, so exposing the existing port would hand every process
+on the server that can reach the forwarded port full control of the local ClaudeDo.
+
+- New `WorkerConfig.RemoteMcpPort` (default `47823`, `0` = feature off). The external MCP app
+  additionally binds `127.0.0.1:<RemoteMcpPort>`.
+- `ExternalMcpAuthMiddleware`: a request whose `Connection.LocalPort == RemoteMcpPort`
+  must carry a valid `X-ClaudeDo-Remote-Token` (registry lookup) → else 401. The existing
+  key/loopback rule applies unchanged to the normal port.
+- Tunnels always target `RemoteMcpPort`, never `ExternalMcpPort`.
+
+Known ceilings (accepted):
+- The remote command line (incl. base64 → token) is visible to other users on the server via
+  `ps`/`/proc`. Protects against processes/containers that reach the port without reading
+  cmdlines; fine for a single-user VPS. Upgrade path: deliver the token via stdin before the TUI.
+- Tokens live in memory until worker restart (no revoke on tile close). A leaked token only
+  works while some tunnel to that port is open.
+
+### UI
+- **Settings:** new "SSH" category (Erweitert group, last tab) — list of workspaces with add/remove,
+  name textbox, host combobox (from ssh config, editable for aliases not in the file),
+  remote path textbox. Saves via `UpdateAppSettingsAsync`.
+- **Quick-session flyout:** `RefreshSessionTargetsAsync` appends one `SessionTargetViewModel`
+  per workspace (label = name, icon/suffix marks it as remote) →
+  `OpenSshConPtySessionAsync(workspace)` → new `ConPtyPaneViewModel` with title = name, spec
+  via `GetSshLaunchSpecAsync`.
+- Localization keys in en + de.
+
+## Testing
+- `RemoteSessionTokenRegistry` + middleware: remote port without/with wrong/with valid token;
+  normal port unaffected.
+- `BuildForSshAsync`: arg list shape, no `"` in any arg, base64 decodes to the expected JSON,
+  path validation rejects `'` / relative paths, unknown workspace id throws.
+- ssh-config host parsing (wildcards, multiple aliases per `Host` line, comments).
+- Manual: real VPS — tile opens, `/mcp` shows `claudedo` connected, `list_task_lists` works,
+  closing the tile tears the tunnel down; second tile to the same host works in parallel.

docs/test-session-2026-09-16.md

@@ -0,0 +1,161 @@
+# Sichtprüfungs-Session 2026-09-16
+
+Build: Debug 2.15.0 (App 08:05, Worker 09:40 — enthält den uncommitteten `WorktreeUpdated`-Fix).
+Sandkasten: Liste **ClaudeDoTests** → `C:\TestRepos\ClaudeDoTests` (sauber, alle Alt-Tasks Done).
+Vorgeseedet: **#334** (README.md) und **#335** (docs/notes.md) — laufen, landen in `WaitingForReview`.
+
+Abgedeckt wird alles seit dem letzten Sichtprüfungs-Pass (06.08.), also v2.13.x–v2.15.
+**Bewusst draußen:** Installer/SystemCheckPage (braucht echte Installation) und die
+Ticketsystem-Anbindung (braucht ein zugewiesenes Ticket) — beide aus `docs/open.md`.
+
+Notation: `[ ]` offen · `[x]` ok · `[!]` Fehler (Text dahinter = Fix-Kandidat)
+
+---
+
+## Pass 1 — Sidebar: Listen & Ordner (~8 min) · **ERLEDIGT** — 1.1–1.8 ok bis auf 1.2 (→ F1)
+
+> 1.7 verhält sich gut: Ordner löschen schiebt die enthaltene Liste raus statt sie mitzunehmen.
+
+- [ ] **1.1** Rechtsklick in die Listen-Sidebar → „Neue Liste": im Modal den Ordner-Toggle
+      einschalten → es entsteht ein **Ordner**, nicht eine Liste.
+- [ ] **1.2** Ordner anklicken → klappt auf/zu, Pfeil dreht sich, Zustand bleibt nach
+      Listenwechsel erhalten.
+- [ ] **1.3** Eine bestehende Liste per Drag in den Ordner ziehen → landet drin, Ordner zeigt sie.
+- [ ] **1.4** Liste wieder aus dem Ordner heraus auf die oberste Ebene ziehen → geht zurück.
+- [ ] **1.5** **Gemischte Reihenfolge** (das ist der Kern von 2.14): eine Liste **über** einen
+      Ordner ziehen → Reihenfolge hält. Ordner per Drag zwischen zwei Listen schieben → hält auch.
+- [ ] **1.6** App neu starten (oder Worker-Menü → Reconnect) → die gemischte Reihenfolge ist
+      noch dieselbe. *Das ist der Test, der `ReorderSidebarAsync` wirklich prüft.*
+- [ ] **1.7** Ordner löschen, während eine Liste drin liegt → was passiert mit der Liste?
+      (Erwartung unklar — notieren, was es tut.)
+- [ ] **1.8** Rechtsklick auf einen Task → „In Liste verschieben" → Ziel wählen → Task ist weg
+      aus der Quelle, da in der Zielliste.
+
+## Pass 2 — Review, Merge, Stash (~15 min) · der wichtigste Pass
+
+Braucht #334/#335 in `WaitingForReview`. Sag mir Bescheid, falls sie noch laufen.
+
+- [ ] **2.1** ⚠️ **Der uncommittete Fix.** Auf einem Task „Open ConPTY session" → im Terminal
+      irgendeine Kleinigkeit ändern → in der Mission-Control-Kachel „Submit for review".
+      **Erwartung:** Der Task landet in `WaitingForReview` und die REVIEW-Karte im Detail-Pane
+      zeigt **sofort** „Open diff" + Änderungs-Zusammenfassung — **ohne** dass du den Task neu
+      anklicken musst. (Vorher fehlte der ganze Block bis zur Neuauswahl.)
+- [ ] **2.2** #334 anklicken → „Open diff" → Side-by-side-Diff zeigt die README-Änderung,
+      Zeilen/Farben stimmen, kein Abschneiden unten.
+- [ ] **2.3** Approve-Gate: **ohne** geöffneten Diff ist Approve gesperrt, nach dem Diff aktiv.
+- [ ] **2.4** Approve auf #334 → merged, Task geht auf **Done**, Chip wechselt, Worker-Log-Zeile
+      im Footer erscheint (mit `#334` im Text — deckt gleich Pass 5.1 mit ab).
+- [ ] **2.5** 🔥 **Stash-Option (neuester Commit, komplett ungetestet).** Ich mache dir das
+      Ziel-Verzeichnis absichtlich dirty (sag „mach dirty"), dann auf #335 **Approve & Merge**:
+      Erwartung = **Bestätigungsdialog** „Änderungen stashen und mergen?" statt der alten
+      `blocked`-Sackgasse. Bestätigen → Merge läuft, und deine uncommitteten Änderungen in
+      `C:\TestRepos\ClaudeDoTests` sind danach **wieder da**.
+- [ ] **2.6** Derselbe Fall über das **Merge-Modal** (statt Approve): Button
+      „Änderungen stashen und mergen" ist da und tut dasselbe.
+- [ ] **2.7** Abbrechen im Stash-Dialog → nichts passiert, Task bleibt `WaitingForReview`,
+      Arbeitsverzeichnis unverändert.
+- [ ] **2.8** Worktrees-Übersicht öffnen → die gemergten Worktrees stehen als `Merged` drin,
+      Cleanup funktioniert, keine WARN-Flut im Footer.
+
+## Pass 3 — Interaktive Sessions & Mission Control (~12 min)
+
+- [ ] **3.1** ConPTY-Session läuft → auf das **X** klicken → **Rückfrage** erscheint
+      („Session läuft wirklich schließen?"), Abbrechen lässt sie laufen.
+- [ ] **3.2** Im interaktiven Terminal **Text einfügen** (Ctrl+V) → landet im Prompt.
+- [ ] **3.3** Eine **Datei ins Terminal droppen** → Pfad wird eingefügt.
+      Und: ein Drop, der scheitern muss (z.B. Ordner statt Datei) → Fehler wird **sichtbar**
+      gemeldet, nicht still geschluckt.
+- [ ] **3.4** **Session stirbt nach dem Start** (im Terminal `exit` tippen) → Banner erscheint
+      in der Kachel, nicht einfach eine tote schwarze Fläche.
+- [ ] **3.5** Mission Control: **Home-Ordner als Sitzungsziel** — neue Session ohne Liste/Task
+      starten → läuft im User-Verzeichnis, nicht irgendwo.
+- [ ] **3.6** Mission Control ist **minimiert** → Handler-Run/Session startet → Fenster wird
+      aus dem Minimiert-Zustand geholt, nicht nur in der Taskleiste blinkend.
+- [ ] **3.7** Handler-Run per Knopf **abbrechen** → Run endet sauber, Kachel verschwindet/
+      wechselt, kein Geister-Pane.
+
+## Pass 4 — Menüs, Settings, Fenster-Layout (~12 min)
+
+- [ ] **4.1** Hilfe-Menü → **Cheat-Sheets** → Fenster öffnet, sechs Sheets (git, Conventional
+      Commits, Claude CLI, Claude-Config, dotnet CLI, PowerShell).
+- [ ] **4.2** Im Cheat-Sheet: Sektionen sind Expander, Befehle sind Mono-Chips mit
+      **Copy-Button** → Klick kopiert wirklich (irgendwo einfügen und prüfen).
+- [ ] **4.3** Cheat-Sheet-Fenster **anpinnen** (Topmost) → bleibt über der App, App bleibt
+      bedienbar (modelos).
+- [ ] **4.4** Hilfe-Menü → „Nach Updates suchen" und „Über" → Version zeigt **2.15.0**
+      (aus der FileVersion, nicht hartkodiert).
+- [ ] **4.5** Worker-Menü → **„Update Claude CLI"** → führt sichtbar `claude update` aus,
+      Ausgabe landet irgendwo lesbar. *(Achtung: ändert wirklich deine CLI — überspring das,
+      wenn du gerade keine CLI-Version riskieren willst.)*
+- [ ] **4.6** Worker-Menü → **Shutdown** → Rückfrage → beendet Worker **und** App.
+      *Ganz am Ende machen, sonst ist die Session vorbei.*
+- [ ] **4.7** Settings → **Ausführung**: die PowerUse-Einstellungen sind hier (nicht mehr im
+      Usage-Monitor), Erklärtexte zu Effort und „Prime Claude" sind da und verständlich.
+      Ungültiges PowerUse-Zeitfenster eingeben → wird abgelehnt/erklärt, nicht still gespeichert.
+- [ ] **4.8** **Modal-Layout** (Fix vom 02.09., Sichtprüfung offen): Über-Dialog,
+      Merge-Modal, Repo-Import, Worktrees-Übersicht, Merge-Helper-Auswahl **einmal öffnen** und
+      prüfen, dass unten **nichts abgeschnitten** ist (letzte Zeile/Button voll sichtbar).
+- [ ] **4.9** Listeneinstellungen einer Liste öffnen → Modal erscheint **sofort** (lädt sichtbar
+      nach), und: Arbeitsverzeichnis auf einen Nicht-Git-Ordner setzen → **Warnung + Speichern
+      blockiert**, nicht stillschweigend akzeptiert.
+- [ ] **4.10** Merge-Helper starten → Start-Modal hat den **Triage-Modell-Picker (opus/fable)**.
+      *(Nur das Modal ansehen, Lauf nicht starten — kostet sonst die halbe Stunde.)*
+
+## Pass 5 — Reste & bekannte Nits (~8 min)
+
+- [ ] **5.1** **Task-Nummern:** `#334` steht dimmed vor dem Titel in der Zeile, der Detail-Chip
+      zeigt `#334` (nicht mehr GUID), Footer-Worker-Log schreibt `#334 …`.
+- [ ] **5.2** **depends_on sichtbar:** zwei Tasks verketten → der blockierte zeigt einen
+      Blocking-Chip, ein Ketten-Label („wartet auf …") und im Detail-Pane den Grund.
+      In der Queue-Zeile hat auch der **blockierte** Task ein Dequeue-**X**.
+- [ ] **5.3** **Usage-Monitor-Modal → Models-Tab:** die bekannten Nits — kollidierende
+      Spaltenköpfe (`OTHER CACHISHARE`), Zahlen linksbündig ohne Tausendertrenner, Task-Titel
+      hart abgeschnitten. Nur bestätigen, dass sie noch da sind → geht auf die Fix-Liste.
+- [ ] **5.4** **Deutsch:** einmal die Sprache auf DE stellen und durch Sidebar, Detail-Pane,
+      WorkConsole, ROADBLOCK-Karte und die Merge-Dialoge gehen → keine englischen Reste.
+      *(Der de.json-Konsistenz-Pass vom 10.09. ist nie angeschaut worden.)*
+- [ ] **5.5** **Worker-Verbindung:** Worker-Menü → Reconnect bei laufendem Worker → Erfolg
+      sichtbar. Und einmal Worker beenden, dann Reconnect → **Fehlschlag wird gemeldet**
+      (Footer-Strip), nicht still no-op.
+
+---
+
+## Ergebnis
+
+Alle fünf Pässe durchlaufen. **11 Befunde** aus ~45 Checks; Pass 4 (Menüs/Settings/Modal-Layout)
+war komplett sauber. Die drei schweren (F9/F10/F11) sind alle erst ganz am Ende aufgetaucht —
+Lebenszyklus der App, nicht Features.
+
+Nicht getestet: Installer/SystemCheckPage, Ticketsystem-Anbindung (beide brauchen echtes Setup),
+3.7 Handler-Abbruch nur oberflächlich.
+
+## Delegiert als Tasks (Liste „Claude do", alle Idle)
+
+| Task | Deckt ab |
+|---|---|
+| **#339** Shutdown beendet den Prozess nicht, Worker-Neustart tut nichts | F9 + F11 |
+| **#340** App-Speicherverbrauch messen — nur Diagnose | F10 |
+| **#341** duplizierter Confirm-Dialog mit „Delete"-Knopf | F4 + F5 |
+| **#342** Ordner-Toggle schluckt schnelle Klicks | F1 |
+| **#343** Diff-Viewer horizontal nicht synchron | F3 |
+| **#344** dirty Ziel früh melden statt nach dem Fehlschlag | F6 |
+| **#345** Bilder aus der Zwischenablage ins Terminal | F8 |
+| **#346** Worktrees-Übersicht: Nummern + Truncation | F7 |
+
+Nicht delegiert: **F2** (Modell für interaktive Sessions erzwingen) — Entscheidung Mika offen.
+
+## Fix-Liste
+
+| # | Pass | Befund | Schwere |
+|---|------|--------|---------|
+| F9 | 4.6 | **„Shutdown" beendet die App nicht — der Prozess überlebt.** `IslandsShellViewModel.cs:705` `ShutdownWorkerAndCloseApp` killt den Worker und ruft dann nur `CloseWindow` für das Hauptfenster. Mission Control, Cheat-Sheets und der Diff-Viewer sind eigene `Window`-Instanzen, bleiben offen und halten den Avalonia-Prozess am Leben (bestätigt: alle Nebenfenster standen nach dem „Shutdown" noch offen, `ClaudeDo.App` weiterhin im Task-Manager). Fix: alle Fenster schließen bzw. `IClassicDesktopStyleApplicationLifetime.Shutdown()` statt `CloseWindow`. | **hoch** |
+| F10 | — | **App-Speicherverbrauch ~1,2 GB.** Gemessen 2026-09-16 am laufenden Debug-Build: `ClaudeDo.App` 1227 MB, `ClaudeDo.Worker` 209 MB. Der Worker wurde 2026-09-02 (`c347e4fc`) bewusst auf Workstation-GC umgestellt, die App offenbar nicht — erster Verdacht, aber ungeprüft. Braucht eine echte Messung (Server-GC? gehaltene Log-/Diff-Puffer? ConPTY-Scrollback?), keinen Blindfix. | **hoch** |
+| F11 | 5.5 | **Worker-Neustart über den Button funktioniert nicht.** `IslandsShellViewModel.cs:656` `RestartWorkerService` beginnt mit `_workerLocator.Find()` und wirft „Worker executable not found", wenn nichts passt. **Hypothese, nicht verifiziert:** der Locator findet den *installierten* Worker (`C:\Program Files\ClaudeDo`), während der Debug-Build aus dem Repo läuft — dann wird der falsche oder gar kein Prozess gekillt/gestartet. Erst reproduzieren und die Footer-Meldung lesen, dann fixen. | **hoch** |
+| F8 | 3.2 | **Bilder aus der Zwischenablage lassen sich nicht ins interaktive Terminal einfügen** (Text geht). `InteractiveTerminalViewModel.PasteAsync` → `PtyTerminalSession.PasteAsync` liest nur Text. Lazy Fix: Bild-Clipboard in eine temporäre PNG schreiben und deren Pfad über den bereits funktionierenden Drop-Pfad (`SendTextAsync`) einfügen — Claude liest die Datei dann selbst. Kein neuer Mechanismus nötig. | mittel |
+| F6 | 2.6 | **Dirty-Target wird zu spät gemeldet.** `dirty_target` kommt erst als Fehlerergebnis *nachdem* der Merge gedrückt und abgelehnt wurde — der Zustand des Ziel-Trees ist aber schon beim Öffnen des Merge-Modals bekannt. Wunsch (Mika): beim Laden des Modals prüfen, Hinweis + „Änderungen stashen und mergen" direkt anbieten; ggf. schon im Diff-Viewer signalisieren. Betrifft beide Pfade (Approve + Merge-Modal). | mittel |
+| F7 | 2.8 | **Worktrees-Übersicht zeigt keine Task-Nummern.** TASK-Spalte listet nur den Titel; die Task-Numbers-Feature hat Zeile, Detail-Chip und Worker-Log abgedeckt, diese Tabelle nicht. Zusätzlich ist die DIFF-Spalte hart abgeschnitten ohne Ellipse (`docs/notes.m`, `1 file chan`) — gleiches Truncation-Muster wie im Usage-Monitor (F-Nit 5.3). | niedrig |
+| F4 | 2.5 | **Stash-Bestätigung trägt „Delete" als Bestätigungsknopf.** `DetailsIslandView.axaml.cs:262-263` ist eine zweite, kopierte Confirm-Dialog-Implementierung mit hartkodiertem `Content = "Delete"` (+ `Classes = { "danger" }`); `DetailsIslandViewModel.ConfirmAsync` hängt daran statt am gemeinsamen `WindowDialogService.ConfirmAsync:209` (dort korrekt „Confirm"). Der Stash-Dialog erbt damit die Beschriftung eines Lösch-Dialogs — irreführend bis gefährlich. Fix: Duplikat löschen, VM an den Service-Dialog hängen. | **hoch** |
+| F5 | 2.5 | **Confirm-/Error-Dialoge sind nicht lokalisiert.** Beide Implementierungen setzen `"Cancel"`/`"Confirm"`/`"Delete"`/`"OK"` und den Fenstertitel `"Confirm"`/`"Error"` als String-Literal, kein `Loc.T`. Fällt mit F4 zusammen erledigen. | mittel |
+| F3 | 2.2 | **Diff-Viewer scrollt nur vertikal synchron.** `DiffEditorSetup.cs` — die Sync-Klasse heißt `VerticalScrollSync`, Zeile 147 schreibt `new Vector(viewer.Offset.X, y)` und behält das X der Zielspalte bei; horizontal wurde nie verdrahtet, beide Seiten scrollen seitwärts unabhängig. Fix: X 1:1 mitspiegeln (gleiche Schrift/Breite in beiden Panes), Klasse entsprechend umbenennen. | mittel |
+| F2 | 2.1 | **Feature-Wunsch (kein Bug):** interaktive ConPTY-Sessions starten unter dem Modell aus Mikas Claude-Config, nicht unter dem im Task gewählten. Bewusste Entscheidung, siehe `docs/open.md:35` (`--effort` ja, `--model` nein) — dort schon als möglicher Folge-Task vermerkt. Entscheidung Mika offen. | Wunsch |
+| F1 | 1.2 | **Ordner-Toggle schluckt schnelle Klicks.** `ListsIslandViewModel.cs:626` `ToggleFolderAsync` ist ein async `[RelayCommand]` → `AsyncRelayCommand` setzt `CanExecute=false` für die Dauer des DB-Writes (`SetFolderCollapsedAsync`); jeder Klick in diesem Fenster wird verworfen. Fix: Toggle synchron (UI-State sofort), Persistierung fire-and-forget. Gleiches Muster in der Sidebar auf andere async RelayCommands gegenprüfen. | mittel |

src/ClaudeDo.App/App.axaml

@@ -32,6 +32,7 @@
 
     <Application.Styles>
         <FluentTheme />
+        <StyleInclude Source="avares://Avalonia.Controls.ColorPicker/Themes/Fluent/Fluent.xaml" />
         <StyleInclude Source="avares://AvaloniaEdit/Themes/Fluent/AvaloniaEdit.xaml" />
         <StyleInclude Source="avares://ClaudeDo.Ui/Design/IslandStyles.axaml" />
         <!-- Global defaults: every Window inherits Inter Tight + body size.

src/ClaudeDo.App/App.axaml.cs

@@ -52,6 +52,7 @@ public partial class App : Application
             Dispatcher.UIThread.UnhandledException += (_, e) =>
             {
                 e.Handled = true;
+                Serilog.Log.Error(e.Exception, "Unhandled exception on the UI dispatcher");
                 shell.FlashFooterError(Loc.T("vm.shell.unexpectedError", e.Exception.Message));
             };
 

src/ClaudeDo.App/ClaudeDo.App.csproj

@@ -26,6 +26,8 @@
     </PackageReference>
     <PackageReference Include="CommunityToolkit.Mvvm" Version="8.4.1" />
     <PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="8.0.1" />
+    <PackageReference Include="Serilog" Version="4.0.0" />
+    <PackageReference Include="Serilog.Sinks.File" Version="6.0.0" />
   </ItemGroup>
 
   <ItemGroup>

src/ClaudeDo.App/Program.cs

@@ -13,6 +13,7 @@ using ClaudeDo.Ui.ViewModels.Modals;
 using ClaudeDo.Ui.ViewModels.Modals.Settings;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.DependencyInjection;
+using Serilog;
 using System;
 using System.Globalization;
 using System.IO;
@@ -20,6 +21,7 @@ using System.Linq;
 using System.Net.Http;
 using System.Reflection;
 using System.Runtime.InteropServices;
+using System.Threading.Tasks;
 
 namespace ClaudeDo.App;
 
@@ -34,6 +36,35 @@ sealed class Program
         if (RuntimeInformation.IsOSPlatform(OSPlatform.Windows))
             SetCurrentProcessExplicitAppUserModelID("ClaudeDo.App");
 
+        var logRoot = Path.Combine(Paths.AppDataRoot(), "logs");
+        Directory.CreateDirectory(logRoot);
+        Log.Logger = new LoggerConfiguration()
+            .MinimumLevel.Information()
+            .WriteTo.File(
+                Path.Combine(logRoot, "ui-.log"),
+                rollingInterval: RollingInterval.Day,
+                retainedFileCountLimit: 7,
+                shared: true)
+            .CreateLogger();
+
+        var version = Assembly.GetEntryAssembly()?
+            .GetCustomAttribute<AssemblyInformationalVersionAttribute>()?.InformationalVersion
+            ?? "0.0.0";
+        Log.Information("ClaudeDo.App starting (version: {version})", version);
+
+        // Last-resort net: any exception that misses every other handler still gets one
+        // Fatal line in the log before the process dies.
+        AppDomain.CurrentDomain.UnhandledException += (_, e) =>
+        {
+            Log.Fatal(e.ExceptionObject as Exception, "Unhandled exception, terminating (is_terminating: {is_terminating})", e.IsTerminating);
+            Log.CloseAndFlush();
+        };
+        TaskScheduler.UnobservedTaskException += (_, e) =>
+        {
+            Log.Error(e.Exception, "Unobserved task exception");
+            e.SetObserved();
+        };
+
         var services = BuildServices();
 
         using (var scope = services.CreateScope())
@@ -42,6 +73,8 @@ sealed class Program
             ClaudeDoDbContext.MigrateAndConfigure(db);
         }
 
+        ClipboardImageTempStore.DeleteOlderThan(TimeSpan.FromHours(24), DateTime.UtcNow);
+
         try
         {
             ConfigureAppBuilder(AppBuilder.Configure(() => new App(services)))
@@ -60,6 +93,8 @@ sealed class Program
             {
                 /* best effort on shutdown */
             }
+
+            Log.CloseAndFlush();
         }
     }
 
@@ -179,7 +214,8 @@ sealed class Program
             new MissionControlViewModel(
                 sp.GetRequiredService<IDbContextFactory<ClaudeDoDbContext>>(),
                 sp.GetRequiredService<IWorkerClient>(),
-                sp.GetRequiredService<UsagePillViewModel>()));
+                sp.GetRequiredService<UsagePillViewModel>(),
+                sp.GetRequiredService<AppSettings>()));
         sc.AddSingleton<IslandsShellViewModel>(sp =>
         {
             var shell = ActivatorUtilities.CreateInstance<IslandsShellViewModel>(sp);

src/ClaudeDo.Data/CLAUDE.md

@@ -12,8 +12,11 @@ Shared data layer: models, repositories, SQLite infrastructure, and git operatio
   - `InteractiveSessionId` = the claude session id an embedded ConPTY interactive task session runs under, persisted by `InteractiveLaunchSpecService` before launch so a closed/aborted session can be resumed → [conpty-sessions](../../docs/explore-notes/conpty-sessions.md).
   - `Number` (INTEGER NOT NULL, unique index `idx_tasks_number`) — a global, monotonically increasing display alias for tasks. **Never reused**: deleting a task leaves a gap in numbering, ensuring that a task number that appears in a log or report always points to the same task (if it exists). Allocated by `TaskNumberAllocator.AddWithNumberAsync` on every insert via a persistent counter (`app_settings.next_task_number`). **Why not `MAX(number) + 1`:** deleting the highest-numbered task would free its number for reuse, breaking the immutability guarantee. The allocator uses an `UPDATE…RETURNING` statement to claim numbers atomically, retrying up to 5 times if a uniqueness collision occurs (the counter advances on each attempt, so retries always allocate fresh numbers). The one-time backfill for pre-existing rows lived in the `AddTaskNumbers` migration, squashed away 2026-08-26.
   - Legacy status values `Manual`/`Planning`/`Planned`/`Draft`/`Waiting` were retired. The backfill migration was squashed away (2026-08-26) — a database still holding those values can't be upgraded, see Schema below.
-- **ListEntity** — Id, Name, WorkingDir, DefaultCommitType, CreatedAt, IsManual (reminder list — tasks created here default to `IsManual`)
+- **ListEntity** — Id, Name, WorkingDir, DefaultCommitType, CreatedAt, IsManual (reminder list — tasks created here default to `IsManual`), Icon, Color, FolderId
-- **ListConfigEntity** — ListId (PK, 1:1), Model, SystemPrompt, AgentPath, MaxTurns, SessionSkills, VerifyCommand, PermissionMode, TicketProjectId (all nullable). `VerifyCommand` is an optional post-merge gate; null/blank = no gate → [review-merge](../../docs/explore-notes/review-merge.md). `PermissionMode` is null = inherit the global default; resolution order task → list → global lives in `EffectiveRunConfigResolver`. `TicketProjectId` (`ticket_project_id`) links the list to a project in the external ticket system; null = not linked → `ClaudeDo.Worker/CLAUDE.md` Tickets section.
+  - `Color` (`color`, nullable) — dot colour: a swatch key (`Swatch3`), a literal `#RRGGBB`, or null = the hash-derived identity colour. Same value format as `ListFolderEntity.Color`; resolved UI-side by `ColorBrushConverter`.
+  - `FolderId` (`folder_id`, nullable FK → `list_folders.id`, `ON DELETE SET NULL`) — the sidebar folder the list sits in; null = top level. Written only by the UI (`ListsIslandViewModel` drag/context menu), never by MCP.
+- **ListFolderEntity** — Id, Name, Icon, SortOrder, IsCollapsed, ParentFolderId, CreatedAt → `list_folders`. A pure sidebar grouping: no tasks, no config, no working dir. `ParentFolderId` (self-FK, `ON DELETE SET NULL`) lets folders nest arbitrarily deep — drag-and-drop only, no UI to pick a parent otherwise. Deliberately its own table rather than a flag on `lists`, so every caller that enumerates lists (MCP `list_task_lists`, "move to list", the queue picker, repo import) needs no folder filtering. Folder CRUD lives on `ListRepository`.
+- **ListConfigEntity** — ListId (PK, 1:1), Model, SystemPrompt, AgentPath, MaxTurns, SessionSkills, VerifyCommand, PermissionMode, TicketProjectId, BaseBranch (all nullable), PowerUseAllowed. `VerifyCommand` is an optional post-merge gate; null/blank = no gate → [review-merge](../../docs/explore-notes/review-merge.md). `PermissionMode` is null = inherit the global default; resolution order task → list → global lives in `EffectiveRunConfigResolver`. `TicketProjectId` (`ticket_project_id`) links the list to a project in the external ticket system; null = not linked → `ClaudeDo.Worker/CLAUDE.md` Tickets section. `BaseBranch` (`base_branch`) = base of new worktrees + default merge target; tri-state in `UpdateListConfigDto` (null = keep, "" = clear). ⚠️ Same verbatim-copy trap as `ticket_project_id`: `SetConfigAsync` overwrites every column, so every writer must carry it forward.
   - ⚠️ `ListRepository.SetConfigAsync` copies the entity **verbatim**, so every writer must carry the fields it doesn't own (`SessionSkills`, `PermissionMode`, `TicketProjectId`) or they silently reset. `UpdateListConfigDto.TicketProjectId` is tri-state (`null` = keep stored) for exactly that reason — only the list-settings modal sends an explicit value. This bit `PermissionMode` for real: its update-branch copy was missing from `SetConfigAsync` until `f0a3a186`, so a list's permission-mode override only ever stuck on the list's *first* save, never on a later one.
 - **WorktreeEntity** — TaskId (PK, 1:1), Path, BranchName, BaseCommit, HeadCommit, DiffStat, MergeCommit (nullable — SHA of the merge commit this branch produced; the only thing making `revert_merge` possible without searching `git log`), State (`Active|Merged|Discarded|Kept`)
 - **TaskRunEntity** — per-run record: session_id, turns, result, structured output, exit code, log path, nullable `Model` (what the run actually executed with), and `TokensIn`/`TokensOut`/`CacheReadTokens`/`CacheWriteTokens`. ⚠️ Token fields come from the **session transcript**, not the stream-json event, as a per-run delta → [usage-monitoring](../../docs/explore-notes/usage-monitoring.md).
@@ -22,6 +25,7 @@ Shared data layer: models, repositories, SQLite infrastructure, and git operatio
 - **WeekReportEntity** — Id, StartDate/EndDate (DateOnly), Markdown, GeneratedAt → `week_reports`, unique index on (start_date, end_date)
 - **TaskAttachmentEntity** — Id, TaskId (FK, ON DELETE CASCADE), FileName, ByteSize, CreatedAt → `task_attachments`
 - **TaskDependencyEntity** — one declared "run after" edge: TaskId + DependsOnTaskId, composite PK, table `task_dependencies`. Both FKs are `ON DELETE CASCADE`, which is what the old single `depends_on_task_id` column got from `ON DELETE SET NULL`: deleting a predecessor drops the edge so the dependent becomes pickable instead of blocked on a task that's gone. Written **only** by `TaskStateService.SetDependsOnAsync`.
+- **MissionControlSessionEntity** — SessionId (PK), Cwd, TaskId (no FK), Title, StartedAt, PredecessorSessionId, BriefPath → `mission_control_sessions`. Index behind Mission Control's "Recent sessions" flyout; written only by `InteractiveLaunchSpecService` (task/ad-hoc/handoff tile launches), insert-if-absent → [conpty-sessions](../../docs/explore-notes/conpty-sessions.md).
 - **SubtaskEntity**, **AgentInfo** — subtasks / record for scanned agent files
 
 ### AppSettingsEntity
@@ -39,10 +43,10 @@ Beyond the basics it carries:
 | `ReportExcludedPaths` | `report_excluded_paths` | null | JSON array of excluded path prefixes. |
 | `StandupWeekday` | `standup_weekday` | Wednesday | int `DayOfWeek`. |
 | `NextTaskNumber` | `next_task_number` | 1 | Persistent counter for `TaskEntity.Number` allocation. Incremented atomically in `TaskNumberAllocator.AddWithNumberAsync` on every task insert. **Monotonic only:** the counter itself advances across all tasks (no per-list numbering), and it never resets. A deleted task leaves a gap. |
-| `PowerUseEnabled` | `power_use_enabled` | false | PowerUse master switch, toggled on the **usage monitor** (not Settings). ⚠️ Never sufficient alone — a handler run is in PowerUse only when `list_config.power_use_allowed` is also set. |
+| `PowerUseEnabled` | `power_use_enabled` | false | PowerUse master switch, toggled in **Settings → Execution**. ⚠️ Never sufficient alone — a handler run is in PowerUse only when `list_config.power_use_allowed` is also set. |
 | `ListHandlerMaxHandoffs` | `list_handler_max_handoffs` | 4 | Cap on a list-handler run's wait↔merge handoff chain (`HandoffRoundTracker`). 4 = two merge rounds. Independent of PowerUse — applies to interactive runs too. Clamped to min 1 in `WorkerHub.UpdateAppSettings` and again in `Register`, because 0 would remove the only bound on a runaway chain. |
 | `PowerUseWindowStart` / `PowerUseWindowEnd` | `power_use_window_*` | null | Optional local-time window (`HH:mm`) narrowing when PowerUse applies. Both null (or only one set) = round the clock, i.e. byte-identical to the pre-window behaviour; end before start wraps over midnight. Semantics live in the pure `PowerUseWindow`; checked in `InteractiveLaunchSpecService.ComposeHandlerPromptAsync` **per phase** at prompt-build time, so a chain handing off past the end time drops the addendum from there on. Unparseable input is stored as null, not rejected. |
-| `PowerUseHandoffPct` | `power_use_handoff_pct` | 95 | 5h-usage percentage at which a PowerUse handler session should hand off. Clamped 50..99. Stored + shown on the usage monitor; the consumer is the handoff prompt. |
+| `PowerUseHandoffPct` | `power_use_handoff_pct` | 95 | 5h-usage percentage at which a PowerUse handler session should hand off. Clamped 50..99. Typed in Settings → Execution; the consumer is the handoff prompt. |
 
 All four usage percentages are clamped 0..100 by `AppSettingsRepository.UpdateAsync`.
 Gate/throttle semantics → [usage-monitoring](../../docs/explore-notes/usage-monitoring.md).
@@ -65,7 +69,8 @@ All use EF Core LINQ via `ClaudeDoDbContext`. The atomic `Queued → Running` cl
 Worker's `QueuePicker` (`FromSqlRaw`), **not** here.
 
 - **TaskRepository** — CRUD, planning helpers (`CreateChildAsync`, `SetPlanningStartedAsync`, `DiscardPlanningAsync`, `UpdateChildAsync`), `UpdateAgentSettingsAsync`. ⚠️ Status-mutation primitives (`MarkRunningAsync`/`MarkDoneAsync`/`MarkFailedAsync`/`FlipAllRunningToFailedAsync`) are **`internal`** — only the Worker's `TaskStateService` may call them. `CreateChildAsync` produces children with `Status=Idle, PlanningPhase=None`. **Task-number allocation:** `AddAsync` (line 20) and `CreateChildAsync` (line 276) are the two sole task-creation paths; both call `TaskNumberAllocator.AddWithNumberAsync` to allocate a number atomically during the same transaction as the insert. Every other creation path (UI, MCP `add_task`, `batch_add_tasks`, Online Inbox sync, merge-helper handler tasks, planning children) routes through one of these two.
-- **ListRepository** — CRUD, `GetConfigAsync`/`SetConfigAsync` (upsert)/`DeleteConfigAsync` for `list_config`
+- **ListRepository** — CRUD, `GetConfigAsync`/`SetConfigAsync` (upsert)/`DeleteConfigAsync` for `list_config`, plus the `list_folders` set: `GetFoldersAsync`, `AddFolderAsync` (appends), `RenameFolderAsync`, `DeleteFolderAsync` (folder only — the FK releases its lists), `SetFolderCollapsedAsync`, `SetListFolderAsync`. The folder writers are `ExecuteUpdate` patches, not entity `Update()`s, so a rename can't reset `SortOrder`/`IsCollapsed` the way `SetConfigAsync`'s verbatim copy resets forgotten columns.
+  - ⚠️ **`lists.sort_order` and `list_folders.sort_order` share one number space** — the sidebar interleaves folders and top-level lists in a single order, so `ReorderSidebarAsync` numbers the whole visual sequence (each folder followed by its children) across both tables, and `AddAsync`/`AddFolderAsync` append via `MAX(sort_order)+1` over **both**. Never renumber one table on its own.
 - **WorktreeRepository** — CRUD, `UpdateHeadAsync`, `SetStateAsync`, `SetMergedAsync` (atomically sets State=Merged **and** stamps MergeCommit in one update — the only writer of MergeCommit)
 - **TaskAttachmentRepository** — `AddAsync`, `UpdateAsync`, `GetAsync(taskId, fileName)`, `ListByTaskIdAsync`, `DeleteAsync(taskId, fileName)`. Bulk delete-per-task is the `ON DELETE CASCADE` on `task_attachments`, not a repository method.
 - **DailyNoteRepository**, **WeekReportRepository**, **TaskRunRepository**, **SubtaskRepository**, **AppSettingsRepository**
@@ -116,6 +121,8 @@ Tables (one per line so parallel migrations don't collide on the same line):
 - `week_reports`
 - `task_attachments`
 - `task_dependencies`
+- `list_folders`
+- `mission_control_sessions`
 
 Managed by EF Core migrations in `Migrations/`. **The 40 incremental migrations were squashed into
 a single `20260826094154_InitialCreate` on 2026-08-26** — the schema history is git history now,

src/ClaudeDo.Data/ClaudeDoDbContext.cs

@@ -43,6 +43,7 @@ public class ClaudeDoDbContext : DbContext
     public DbSet<TaskEntity> Tasks => Set<TaskEntity>();
     public DbSet<TaskDependencyEntity> TaskDependencies => Set<TaskDependencyEntity>();
     public DbSet<ListEntity> Lists => Set<ListEntity>();
+    public DbSet<ListFolderEntity> ListFolders => Set<ListFolderEntity>();
     public DbSet<ListConfigEntity> ListConfigs => Set<ListConfigEntity>();
     public DbSet<WorktreeEntity> Worktrees => Set<WorktreeEntity>();
     public DbSet<TaskRunEntity> TaskRuns => Set<TaskRunEntity>();
@@ -53,6 +54,7 @@ public class ClaudeDoDbContext : DbContext
     public DbSet<DailyNoteEntity> DailyNotes => Set<DailyNoteEntity>();
     public DbSet<WeekReportEntity> WeekReports => Set<WeekReportEntity>();
     public DbSet<SessionSkillEntity> SessionSkills => Set<SessionSkillEntity>();
+    public DbSet<MissionControlSessionEntity> MissionControlSessions => Set<MissionControlSessionEntity>();
 
     private static readonly ValueConverter<DateTime, DateTime> UtcConverter =
         new(v => v, v => DateTime.SpecifyKind(v, DateTimeKind.Utc));

src/ClaudeDo.Data/Configuration/AppSettingsEntityConfiguration.cs

@@ -43,6 +43,9 @@ public class AppSettingsEntityConfiguration : IEntityTypeConfiguration<AppSettin
         builder.Property(s => s.RepoImportFolders)
             .HasColumnName("repo_import_folders");
 
+        builder.Property(s => s.SshWorkspaces)
+            .HasColumnName("ssh_workspaces");
+
         builder.Property(s => s.ReportExcludedPaths).HasColumnName("report_excluded_paths");
         builder.Property(s => s.StandupWeekday).HasColumnName("standup_weekday")
             .IsRequired().HasDefaultValue((int)DayOfWeek.Wednesday);
@@ -81,6 +84,9 @@ public class AppSettingsEntityConfiguration : IEntityTypeConfiguration<AppSettin
         builder.Property(s => s.ListHandlerMaxHandoffs)
             .HasColumnName("list_handler_max_handoffs").IsRequired().HasDefaultValue(4);
 
+        builder.Property(s => s.TicketFallbackListId)
+            .HasColumnName("ticket_fallback_list_id");
+
         builder.HasData(new AppSettingsEntity { Id = AppSettingsEntity.SingletonId });
     }
 }

src/ClaudeDo.Data/Configuration/ListConfigEntityConfiguration.cs

@@ -21,5 +21,6 @@ public class ListConfigEntityConfiguration : IEntityTypeConfiguration<ListConfig
         builder.Property(c => c.PermissionMode).HasColumnName("permission_mode");
         builder.Property(c => c.TicketProjectId).HasColumnName("ticket_project_id");
         builder.Property(c => c.PowerUseAllowed).HasColumnName("power_use_allowed");
+        builder.Property(c => c.BaseBranch).HasColumnName("base_branch");
     }
 }

src/ClaudeDo.Data/Configuration/ListEntityConfiguration.cs

@@ -20,8 +20,18 @@ public class ListEntityConfiguration : IEntityTypeConfiguration<ListEntity>
         builder.Property(l => l.IsManual).HasColumnName("is_manual").IsRequired().HasDefaultValue(false);
         builder.Property(l => l.FindingsTracked).HasColumnName("findings_tracked").IsRequired().HasDefaultValue(false);
         builder.Property(l => l.Icon).HasColumnName("icon");
+        builder.Property(l => l.Color).HasColumnName("color");
+        builder.Property(l => l.FolderId).HasColumnName("folder_id");
 
         builder.HasIndex(l => l.SortOrder).HasDatabaseName("idx_lists_sort");
+        builder.HasIndex(l => l.FolderId).HasDatabaseName("idx_lists_folder");
+
+        // No navigation property on either side: nothing needs the graph, and a nav would have to
+        // be Include'd (or silently come back empty) in every list query.
+        builder.HasOne<ListFolderEntity>()
+            .WithMany()
+            .HasForeignKey(l => l.FolderId)
+            .OnDelete(DeleteBehavior.SetNull);
 
         builder.HasOne(l => l.Config)
             .WithOne(c => c.List)

src/ClaudeDo.Data/Configuration/ListFolderEntityConfiguration.cs

@@ -0,0 +1,31 @@
+using ClaudeDo.Data.Models;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Metadata.Builders;
+
+namespace ClaudeDo.Data.Configuration;
+
+public class ListFolderEntityConfiguration : IEntityTypeConfiguration<ListFolderEntity>
+{
+    public void Configure(EntityTypeBuilder<ListFolderEntity> builder)
+    {
+        builder.ToTable("list_folders");
+
+        builder.HasKey(f => f.Id);
+        builder.Property(f => f.Id).HasColumnName("id");
+        builder.Property(f => f.Name).HasColumnName("name").IsRequired();
+        builder.Property(f => f.CreatedAt).HasColumnName("created_at").IsRequired();
+        builder.Property(f => f.Icon).HasColumnName("icon");
+        builder.Property(f => f.Color).HasColumnName("color");
+        builder.Property(f => f.SortOrder).HasColumnName("sort_order").IsRequired().HasDefaultValue(0);
+        builder.Property(f => f.IsCollapsed).HasColumnName("is_collapsed").IsRequired().HasDefaultValue(false);
+        builder.Property(f => f.ParentFolderId).HasColumnName("parent_folder_id");
+
+        builder.HasIndex(f => f.SortOrder).HasDatabaseName("idx_list_folders_sort");
+        builder.HasIndex(f => f.ParentFolderId).HasDatabaseName("idx_list_folders_parent");
+
+        builder.HasOne<ListFolderEntity>()
+            .WithMany()
+            .HasForeignKey(f => f.ParentFolderId)
+            .OnDelete(DeleteBehavior.SetNull);
+    }
+}

src/ClaudeDo.Data/Configuration/MissionControlSessionEntityConfiguration.cs

@@ -0,0 +1,22 @@
+using ClaudeDo.Data.Models;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Metadata.Builders;
+
+namespace ClaudeDo.Data.Configuration;
+
+public class MissionControlSessionEntityConfiguration : IEntityTypeConfiguration<MissionControlSessionEntity>
+{
+    public void Configure(EntityTypeBuilder<MissionControlSessionEntity> builder)
+    {
+        builder.ToTable("mission_control_sessions");
+        builder.HasKey(s => s.SessionId);
+        builder.Property(s => s.SessionId).HasColumnName("session_id").ValueGeneratedNever();
+        builder.Property(s => s.Cwd).HasColumnName("cwd").IsRequired();
+        builder.Property(s => s.TaskId).HasColumnName("task_id");
+        builder.Property(s => s.Title).HasColumnName("title").IsRequired();
+        builder.Property(s => s.StartedAt).HasColumnName("started_at").IsRequired();
+        builder.Property(s => s.PredecessorSessionId).HasColumnName("predecessor_session_id");
+        builder.Property(s => s.BriefPath).HasColumnName("brief_path");
+        builder.HasIndex(s => s.StartedAt);
+    }
+}

src/ClaudeDo.Data/Configuration/PrimeScheduleEntityConfiguration.cs

@@ -11,12 +11,14 @@ public class PrimeScheduleEntityConfiguration : IEntityTypeConfiguration<PrimeSc
         => v == PrimeActionKind.Ping ? "ping"
          : v == PrimeActionKind.FillMyDay ? "fill_my_day"
          : v == PrimeActionKind.Custom ? "custom"
+         : v == PrimeActionKind.ImportTickets ? "import_tickets"
          : throw new ArgumentOutOfRangeException(nameof(v));
 
     private static PrimeActionKind KindFromString(string v)
         => v == "ping" ? PrimeActionKind.Ping
          : v == "fill_my_day" ? PrimeActionKind.FillMyDay
          : v == "custom" ? PrimeActionKind.Custom
+         : v == "import_tickets" ? PrimeActionKind.ImportTickets
          : throw new ArgumentOutOfRangeException(nameof(v));
 
     private static readonly ValueConverter<PrimeActionKind, string> KindConverter =

src/ClaudeDo.Data/Configuration/WorktreeEntityConfiguration.cs

@@ -36,6 +36,7 @@ public class WorktreeEntityConfiguration : IEntityTypeConfiguration<WorktreeEnti
         builder.Property(w => w.HeadCommit).HasColumnName("head_commit");
         builder.Property(w => w.DiffStat).HasColumnName("diff_stat");
         builder.Property(w => w.MergeCommit).HasColumnName("merge_commit");
+        builder.Property(w => w.PullRequestUrl).HasColumnName("pull_request_url");
         builder.Property(w => w.State).HasColumnName("state").IsRequired()
             .HasDefaultValue(WorktreeState.Active)
             .HasConversion(StateConverter);

src/ClaudeDo.Data/Git/GitService.cs

@@ -414,6 +414,13 @@ public sealed class GitService
             .ToList();
     }
 
+    /// <summary>URL des Remotes <paramref name="remote"/>, oder null wenn es keins gibt.</summary>
+    public async Task<string?> GetRemoteUrlAsync(string repoDir, string remote = "origin", CancellationToken ct = default)
+    {
+        var (exitCode, stdout, _) = await RunGitAsync(repoDir, ["remote", "get-url", remote], ct);
+        return exitCode == 0 && !string.IsNullOrWhiteSpace(stdout) ? stdout.Trim() : null;
+    }
+
     public async Task<bool> IsMidMergeAsync(string repoDir, CancellationToken ct = default)
     {
         var (exitCode, stdout, _) = await RunGitAsync(repoDir, ["rev-parse", "--git-dir"], ct);
@@ -424,14 +431,76 @@ public sealed class GitService
         return File.Exists(Path.Combine(gitDir, "MERGE_HEAD"));
     }
 
+    /// <param name="autostash">Stash the target working tree's uncommitted changes before the
+    /// merge and restore them after it. Git owns the bookkeeping: on a conflict the stash stays
+    /// pending and is re-applied by `merge --continue`/`--abort`, so a conflicted merge left in
+    /// the tree doesn't lose it. A restore that itself conflicts leaves the stash in
+    /// `git stash list` rather than dropping it.</param>
     public async Task<(int ExitCode, string Stderr)> MergeNoFfAsync(
-        string repoDir, string sourceBranch, string message, CancellationToken ct = default)
+        string repoDir, string sourceBranch, string message, CancellationToken ct = default,
+        bool autostash = false)
     {
         // diff3 conflict style writes the merge base (|||||||) into conflict markers so the
         // in-app resolver can show a true three-way view. It only enriches conflicted hunks;
         // clean merges are unaffected.
+        string[] args = autostash
+            ? ["-c", "merge.conflictStyle=diff3", "merge", "--no-ff", "--autostash", "-m", message, sourceBranch]
+            : ["-c", "merge.conflictStyle=diff3", "merge", "--no-ff", "-m", message, sourceBranch];
+        var (exitCode, _, stderr) = await RunGitAsync(repoDir, args, ct);
+        return (exitCode, stderr);
+    }
+
+    /// <summary>
+    /// <c>git fetch origin</c> for one branch into <c>refs/remotes/origin/&lt;branch&gt;</c>. The explicit
+    /// refspec works without a configured fetch refspec. <paramref name="env"/> carries the auth
+    /// header (never the command line) and must disable the terminal prompt.
+    /// </summary>
+    public async Task<(int ExitCode, string Stderr)> FetchBranchAsync(
+        string repoDir, string branch, IReadOnlyDictionary<string, string>? env, CancellationToken ct = default)
+    {
         var (exitCode, _, stderr) = await RunGitAsync(repoDir,
-            ["-c", "merge.conflictStyle=diff3", "merge", "--no-ff", "-m", message, sourceBranch], ct);
+            ["fetch", "origin", $"+refs/heads/{branch}:refs/remotes/origin/{branch}"], ct, env: env);
+        return (exitCode, stderr);
+    }
+
+    /// <summary>Moves the local, not checked-out <paramref name="branch"/> to <c>origin/&lt;branch&gt;</c>; git itself refuses a non-fast-forward. No network.</summary>
+    public async Task<(int ExitCode, string Stderr)> FastForwardLocalBranchAsync(
+        string repoDir, string branch, CancellationToken ct = default)
+    {
+        var (exitCode, _, stderr) = await RunGitAsync(repoDir,
+            ["fetch", ".", $"refs/remotes/origin/{branch}:refs/heads/{branch}"], ct);
+        return (exitCode, stderr);
+    }
+
+    /// <summary><c>git push -u origin &lt;branch&gt;</c> from <paramref name="worktreePath"/>; auth via <paramref name="env"/>.</summary>
+    public async Task<(int ExitCode, string Stderr)> PushBranchAsync(
+        string worktreePath, string branch, IReadOnlyDictionary<string, string>? env, CancellationToken ct = default)
+    {
+        var (exitCode, _, stderr) = await RunGitAsync(worktreePath, ["push", "-u", "origin", branch], ct, env: env);
+        return (exitCode, stderr);
+    }
+
+    /// <summary>Branch that <c>refs/remotes/origin/HEAD</c> points to (without <c>origin/</c>), or null.</summary>
+    public async Task<string?> GetRemoteHeadBranchAsync(string repoDir, CancellationToken ct = default)
+    {
+        var (exitCode, stdout, _) = await RunGitAsync(repoDir, ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"], ct);
+        if (exitCode != 0 || string.IsNullOrWhiteSpace(stdout)) return null;
+        var head = stdout.Trim();
+        return head.StartsWith("origin/", StringComparison.Ordinal) ? head["origin/".Length..] : head;
+    }
+
+    /// <summary>Absolute path of the <c>.git</c> dir shared by all worktrees of the repo owning <paramref name="dir"/>, or null.</summary>
+    public async Task<string?> GetCommonDirAsync(string dir, CancellationToken ct = default)
+    {
+        var (exitCode, stdout, _) = await RunGitAsync(dir, ["rev-parse", "--path-format=absolute", "--git-common-dir"], ct);
+        return exitCode == 0 && !string.IsNullOrWhiteSpace(stdout) ? stdout.Trim() : null;
+    }
+
+    /// <summary><c>git merge --ff-only</c>: moves the checked-out branch to <paramref name="sourceRef"/> or fails without touching it.</summary>
+    public async Task<(int ExitCode, string Stderr)> MergeFastForwardOnlyAsync(
+        string worktreePath, string sourceRef, CancellationToken ct = default)
+    {
+        var (exitCode, _, stderr) = await RunGitAsync(worktreePath, ["merge", "--ff-only", sourceRef], ct);
         return (exitCode, stderr);
     }
 
@@ -550,6 +619,16 @@ public sealed class GitService
         return exitCode == 0 ? stdout : null;
     }
 
+    /// <summary>
+    /// Content of <paramref name="path"/> at <paramref name="revision"/> via `git show revision:path`.
+    /// Null when the path doesn't exist at that revision (new, deleted, or renamed file).
+    /// </summary>
+    public async Task<string?> ShowFileAsync(string repoDir, string revision, string path, CancellationToken ct = default)
+    {
+        var (exitCode, stdout, _) = await RunGitAsync(repoDir, ["show", $"{revision}:{path}"], ct, trimOutput: false);
+        return exitCode == 0 ? stdout : null;
+    }
+
     /// <summary>
     /// Non-destructive mergeability probe via `git merge-tree --write-tree`. Writes only
     /// loose objects — the working tree, index, and refs are left untouched.
@@ -688,7 +767,8 @@ public sealed class GitService
 
 
     private static async Task<(int ExitCode, string Stdout, string Stderr)> RunGitAsync(
-        string workDir, IEnumerable<string> args, CancellationToken ct, string? stdinData = null, bool trimOutput = true)
+        string workDir, IEnumerable<string> args, CancellationToken ct, string? stdinData = null, bool trimOutput = true,
+        IReadOnlyDictionary<string, string>? env = null)
     {
         var psi = new ProcessStartInfo
         {
@@ -704,6 +784,13 @@ public sealed class GitService
             // (mktree "input format error") and would prepend to stdin commit messages.
             StandardInputEncoding = stdinData is not null ? new UTF8Encoding(false) : null,
         };
+        // Force English stderr/stdout so the English-only substring matches below
+        // (e.g. "ambiguous argument 'HEAD'", "tell me who you are") work regardless
+        // of the OS locale git for Windows picks up.
+        psi.Environment["LC_ALL"] = "C";
+        psi.Environment["LANGUAGE"] = "C";
+        if (env is not null)
+            foreach (var (key, value) in env) psi.Environment[key] = value;
         psi.ArgumentList.Add("-C");
         psi.ArgumentList.Add(workDir);
         foreach (var a in args) psi.ArgumentList.Add(a);

src/ClaudeDo.Data/Migrations/20260910062251_AddListFolders.cs

@@ -0,0 +1,74 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace ClaudeDo.Data.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddListFolders : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "folder_id",
+                table: "lists",
+                type: "TEXT",
+                nullable: true);
+
+            migrationBuilder.CreateTable(
+                name: "list_folders",
+                columns: table => new
+                {
+                    id = table.Column<string>(type: "TEXT", nullable: false),
+                    name = table.Column<string>(type: "TEXT", nullable: false),
+                    created_at = table.Column<DateTime>(type: "TEXT", nullable: false),
+                    icon = table.Column<string>(type: "TEXT", nullable: true),
+                    sort_order = table.Column<int>(type: "INTEGER", nullable: false, defaultValue: 0),
+                    is_collapsed = table.Column<bool>(type: "INTEGER", nullable: false, defaultValue: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_list_folders", x => x.id);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "idx_lists_folder",
+                table: "lists",
+                column: "folder_id");
+
+            migrationBuilder.CreateIndex(
+                name: "idx_list_folders_sort",
+                table: "list_folders",
+                column: "sort_order");
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_lists_list_folders_folder_id",
+                table: "lists",
+                column: "folder_id",
+                principalTable: "list_folders",
+                principalColumn: "id",
+                onDelete: ReferentialAction.SetNull);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropForeignKey(
+                name: "FK_lists_list_folders_folder_id",
+                table: "lists");
+
+            migrationBuilder.DropTable(
+                name: "list_folders");
+
+            migrationBuilder.DropIndex(
+                name: "idx_lists_folder",
+                table: "lists");
+
+            migrationBuilder.DropColumn(
+                name: "folder_id",
+                table: "lists");
+        }
+    }
+}

src/ClaudeDo.Data/Migrations/20260928100316_AddMissionControlSessions.cs

@@ -0,0 +1,44 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace ClaudeDo.Data.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddMissionControlSessions : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.CreateTable(
+                name: "mission_control_sessions",
+                columns: table => new
+                {
+                    session_id = table.Column<string>(type: "TEXT", nullable: false),
+                    cwd = table.Column<string>(type: "TEXT", nullable: false),
+                    task_id = table.Column<string>(type: "TEXT", nullable: true),
+                    title = table.Column<string>(type: "TEXT", nullable: false),
+                    started_at = table.Column<DateTime>(type: "TEXT", nullable: false),
+                    predecessor_session_id = table.Column<string>(type: "TEXT", nullable: true),
+                    brief_path = table.Column<string>(type: "TEXT", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_mission_control_sessions", x => x.session_id);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_mission_control_sessions_started_at",
+                table: "mission_control_sessions",
+                column: "started_at");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "mission_control_sessions");
+        }
+    }
+}

src/ClaudeDo.Data/Migrations/20260928111701_AddNestedListFolders.cs

@@ -0,0 +1,49 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace ClaudeDo.Data.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddNestedListFolders : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "parent_folder_id",
+                table: "list_folders",
+                type: "TEXT",
+                nullable: true);
+
+            migrationBuilder.CreateIndex(
+                name: "idx_list_folders_parent",
+                table: "list_folders",
+                column: "parent_folder_id");
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_list_folders_list_folders_parent_folder_id",
+                table: "list_folders",
+                column: "parent_folder_id",
+                principalTable: "list_folders",
+                principalColumn: "id",
+                onDelete: ReferentialAction.SetNull);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropForeignKey(
+                name: "FK_list_folders_list_folders_parent_folder_id",
+                table: "list_folders");
+
+            migrationBuilder.DropIndex(
+                name: "idx_list_folders_parent",
+                table: "list_folders");
+
+            migrationBuilder.DropColumn(
+                name: "parent_folder_id",
+                table: "list_folders");
+        }
+    }
+}

src/ClaudeDo.Data/Migrations/20260930080955_AddListFolderColor.cs

@@ -0,0 +1,28 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace ClaudeDo.Data.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddListFolderColor : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "color",
+                table: "list_folders",
+                type: "TEXT",
+                nullable: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "color",
+                table: "list_folders");
+        }
+    }
+}

src/ClaudeDo.Data/Migrations/20261001063306_AddTicketFallbackList.cs

@@ -0,0 +1,35 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace ClaudeDo.Data.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddTicketFallbackList : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "ticket_fallback_list_id",
+                table: "app_settings",
+                type: "TEXT",
+                nullable: true);
+
+            migrationBuilder.UpdateData(
+                table: "app_settings",
+                keyColumn: "id",
+                keyValue: 1,
+                column: "ticket_fallback_list_id",
+                value: null);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "ticket_fallback_list_id",
+                table: "app_settings");
+        }
+    }
+}

src/ClaudeDo.Data/Migrations/20261001082423_AddListColor.cs

@@ -0,0 +1,28 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace ClaudeDo.Data.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddListColor : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "color",
+                table: "lists",
+                type: "TEXT",
+                nullable: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "color",
+                table: "lists");
+        }
+    }
+}

src/ClaudeDo.Data/Migrations/20261001083902_AddListBaseBranch.cs

@@ -0,0 +1,28 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace ClaudeDo.Data.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddListBaseBranch : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "base_branch",
+                table: "list_config",
+                type: "TEXT",
+                nullable: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "base_branch",
+                table: "list_config");
+        }
+    }
+}

src/ClaudeDo.Data/Migrations/20261001094915_AddWorktreePullRequestUrl.cs

@@ -0,0 +1,28 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace ClaudeDo.Data.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddWorktreePullRequestUrl : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "pull_request_url",
+                table: "worktrees",
+                type: "TEXT",
+                nullable: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "pull_request_url",
+                table: "worktrees");
+        }
+    }
+}

src/ClaudeDo.Data/Migrations/20261002122020_AddSshWorkspaces.cs

@@ -0,0 +1,35 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace ClaudeDo.Data.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddSshWorkspaces : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "ssh_workspaces",
+                table: "app_settings",
+                type: "TEXT",
+                nullable: true);
+
+            migrationBuilder.UpdateData(
+                table: "app_settings",
+                keyColumn: "id",
+                keyValue: 1,
+                column: "ssh_workspaces",
+                value: null);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "ssh_workspaces",
+                table: "app_settings");
+        }
+    }
+}

src/ClaudeDo.Data/Migrations/ClaudeDoDbContextModelSnapshot.cs

@@ -126,12 +126,20 @@ namespace ClaudeDo.Data.Migrations
                         .HasColumnType("TEXT")
                         .HasColumnName("session_skills");
 
+                    b.Property<string>("SshWorkspaces")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("ssh_workspaces");
+
                     b.Property<int>("StandupWeekday")
                         .ValueGeneratedOnAdd()
                         .HasColumnType("INTEGER")
                         .HasDefaultValue(3)
                         .HasColumnName("standup_weekday");
 
+                    b.Property<string>("TicketFallbackListId")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("ticket_fallback_list_id");
+
                     b.Property<int>("UsageGateFiveHourPct")
                         .ValueGeneratedOnAdd()
                         .HasColumnType("INTEGER")
@@ -264,6 +272,10 @@ namespace ClaudeDo.Data.Migrations
                         .HasColumnType("TEXT")
                         .HasColumnName("agent_path");
 
+                    b.Property<string>("BaseBranch")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("base_branch");
+
                     b.Property<int?>("MaxTurns")
                         .HasColumnType("INTEGER")
                         .HasColumnName("max_turns");
@@ -307,6 +319,10 @@ namespace ClaudeDo.Data.Migrations
                         .HasColumnType("TEXT")
                         .HasColumnName("id");
 
+                    b.Property<string>("Color")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("color");
+
                     b.Property<DateTime>("CreatedAt")
                         .HasColumnType("TEXT")
                         .HasColumnName("created_at");
@@ -324,6 +340,10 @@ namespace ClaudeDo.Data.Migrations
                         .HasDefaultValue(false)
                         .HasColumnName("findings_tracked");
 
+                    b.Property<string>("FolderId")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("folder_id");
+
                     b.Property<string>("Icon")
                         .HasColumnType("TEXT")
                         .HasColumnName("icon");
@@ -351,12 +371,104 @@ namespace ClaudeDo.Data.Migrations
 
                     b.HasKey("Id");
 
+                    b.HasIndex("FolderId")
+                        .HasDatabaseName("idx_lists_folder");
+
                     b.HasIndex("SortOrder")
                         .HasDatabaseName("idx_lists_sort");
 
                     b.ToTable("lists", (string)null);
                 });
 
+            modelBuilder.Entity("ClaudeDo.Data.Models.ListFolderEntity", b =>
+                {
+                    b.Property<string>("Id")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("id");
+
+                    b.Property<string>("Color")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("color");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("created_at");
+
+                    b.Property<string>("Icon")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("icon");
+
+                    b.Property<bool>("IsCollapsed")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("INTEGER")
+                        .HasDefaultValue(false)
+                        .HasColumnName("is_collapsed");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("TEXT")
+                        .HasColumnName("name");
+
+                    b.Property<string>("ParentFolderId")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("parent_folder_id");
+
+                    b.Property<int>("SortOrder")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("INTEGER")
+                        .HasDefaultValue(0)
+                        .HasColumnName("sort_order");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ParentFolderId")
+                        .HasDatabaseName("idx_list_folders_parent");
+
+                    b.HasIndex("SortOrder")
+                        .HasDatabaseName("idx_list_folders_sort");
+
+                    b.ToTable("list_folders", (string)null);
+                });
+
+            modelBuilder.Entity("ClaudeDo.Data.Models.MissionControlSessionEntity", b =>
+                {
+                    b.Property<string>("SessionId")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("session_id");
+
+                    b.Property<string>("BriefPath")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("brief_path");
+
+                    b.Property<string>("Cwd")
+                        .IsRequired()
+                        .HasColumnType("TEXT")
+                        .HasColumnName("cwd");
+
+                    b.Property<string>("PredecessorSessionId")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("predecessor_session_id");
+
+                    b.Property<DateTime>("StartedAt")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("started_at");
+
+                    b.Property<string>("TaskId")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("task_id");
+
+                    b.Property<string>("Title")
+                        .IsRequired()
+                        .HasColumnType("TEXT")
+                        .HasColumnName("title");
+
+                    b.HasKey("SessionId");
+
+                    b.HasIndex("StartedAt");
+
+                    b.ToTable("mission_control_sessions", (string)null);
+                });
+
             modelBuilder.Entity("ClaudeDo.Data.Models.PrimeScheduleEntity", b =>
                 {
                     b.Property<Guid>("Id")
@@ -911,6 +1023,10 @@ namespace ClaudeDo.Data.Migrations
                         .HasColumnType("TEXT")
                         .HasColumnName("path");
 
+                    b.Property<string>("PullRequestUrl")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("pull_request_url");
+
                     b.Property<string>("State")
                         .IsRequired()
                         .ValueGeneratedOnAdd()
@@ -934,6 +1050,22 @@ namespace ClaudeDo.Data.Migrations
                     b.Navigation("List");
                 });
 
+            modelBuilder.Entity("ClaudeDo.Data.Models.ListEntity", b =>
+                {
+                    b.HasOne("ClaudeDo.Data.Models.ListFolderEntity", null)
+                        .WithMany()
+                        .HasForeignKey("FolderId")
+                        .OnDelete(DeleteBehavior.SetNull);
+                });
+
+            modelBuilder.Entity("ClaudeDo.Data.Models.ListFolderEntity", b =>
+                {
+                    b.HasOne("ClaudeDo.Data.Models.ListFolderEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ParentFolderId")
+                        .OnDelete(DeleteBehavior.SetNull);
+                });
+
             modelBuilder.Entity("ClaudeDo.Data.Models.SubtaskEntity", b =>
                 {
                     b.HasOne("ClaudeDo.Data.Models.TaskEntity", "Task")

src/ClaudeDo.Data/Models/AppSettingsEntity.cs

@@ -29,6 +29,8 @@ public sealed class AppSettingsEntity
 
     // JSON array of parent folders remembered by the repo-import modal.
     public string? RepoImportFolders { get; set; }
+    // JSON array of SshWorkspace rows offered as remote quick sessions in Mission Control.
+    public string? SshWorkspaces { get; set; }
     // JSON array of path prefixes whose sessions are excluded from the weekly report.
     public string? ReportExcludedPaths { get; set; }
     // DayOfWeek the standup happens on; default Wednesday. Drives the report's default range.
@@ -62,8 +64,7 @@ public sealed class AppSettingsEntity
     public bool AutoContinueOnUsageLimit { get; set; }
 
     // Master switch for PowerUse: list-handler runs go unattended (never ask the user) and harvest
-    // new work when a round would otherwise starve. Toggled from the usage monitor, because it is a
+    // new work when a round would otherwise starve. Toggled in Settings → Execution. Off by default,
-    // deliberate "spend the remaining window" decision rather than a normal default. Off by default,
     // and on its own it changes nothing — a run is only in PowerUse when the LIST also opted in via
     // ListConfigEntity.PowerUseAllowed, so leaving this on cannot make an unrelated list's handler
     // run unattended. Composition lives in InteractiveLaunchSpecService.
@@ -84,4 +85,8 @@ public sealed class AppSettingsEntity
     // 4 = two full wait/merge cycles, the long-standing default. Raise it for a run meant to keep
     // going for hours. It exists to bound runaway handoff loops, so it must stay >= 1.
     public int ListHandlerMaxHandoffs { get; set; } = 4;
+
+    // List that receives imported ticket items Claude could not place (import_ticket without a
+    // list). Null = such items are skipped. No FK: a deleted list simply reads as unset at import.
+    public string? TicketFallbackListId { get; set; }
 }

src/ClaudeDo.Data/Models/ListConfigEntity.cs

@@ -23,6 +23,12 @@ public sealed class ListConfigEntity
     // false, also opt-in. ⚠️ Gleiche Falle wie TicketProjectId: SetConfigAsync kopiert verbatim.
     public bool PowerUseAllowed { get; set; }
 
+    /// <summary>
+    /// Basis neuer Worktrees und Default-Merge-/PR-Ziel (z.B. <c>dev</c>). Null = ausgecheckter Branch
+    /// (privat) bzw. Default-Branch des Remotes (Firma). ⚠️ SetConfigAsync kopiert verbatim.
+    /// </summary>
+    public string? BaseBranch { get; set; }
+
     // Navigation property
     public ListEntity List { get; set; } = null!;
 }

src/ClaudeDo.Data/Models/ListEntity.cs

@@ -16,6 +16,11 @@ public sealed class ListEntity
     public bool FindingsTracked { get; set; }
     // Icon key into the UI's icon library (e.g. "Star"); null = the default folder icon.
     public string? Icon { get; set; }
+    // Dot colour: a swatch key ("Swatch3") or a literal "#RRGGBB"; null = the hash-derived default.
+    public string? Color { get; set; }
+    // Sidebar folder this list sits in (ListFolderEntity.Id); null = top level. ON DELETE SET NULL,
+    // so deleting a folder moves its lists back to the top level instead of deleting them.
+    public string? FolderId { get; set; }
 
     // Navigation properties
     public ListConfigEntity? Config { get; set; }

src/ClaudeDo.Data/Models/ListFolderEntity.cs

@@ -0,0 +1,25 @@
+namespace ClaudeDo.Data.Models;
+
+/// <summary>
+/// A sidebar folder grouping user lists. Deliberately its own table rather than a flag on
+/// <see cref="ListEntity"/>: every place that enumerates lists (MCP list_task_lists, "move to
+/// list", the queue picker, repo import) would otherwise have to filter folders out.
+/// Folders nest arbitrarily deep via <see cref="ParentFolderId"/>.
+/// </summary>
+public sealed class ListFolderEntity
+{
+    public required string Id { get; init; }
+    public required string Name { get; set; }
+    public required DateTime CreatedAt { get; init; }
+    // Icon key into the UI's icon library, same set as ListEntity.Icon; null = default folder icon.
+    public string? Icon { get; set; }
+    /// <summary>Hex colour (#RRGGBB) for the sidebar name and guide line; null = theme default.</summary>
+    public string? Color { get; set; }
+    public int SortOrder { get; set; }
+    // Sidebar expand/collapse state. Lives here rather than in ui.config.json because the row is
+    // already being read for the folder itself.
+    public bool IsCollapsed { get; set; }
+    // Parent folder, or null for a top-level folder. Self-FK, ON DELETE SET NULL — deleting a
+    // folder releases its subfolders to the top level, same as it does for its lists.
+    public string? ParentFolderId { get; set; }
+}

src/ClaudeDo.Data/Models/MissionControlSessionEntity.cs

@@ -0,0 +1,27 @@
+namespace ClaudeDo.Data.Models;
+
+/// <summary>One claude session started in a Mission Control tile (ad-hoc, task or handoff) — the
+/// index behind "Recent sessions". The transcript itself stays with Claude Code.</summary>
+public sealed class MissionControlSessionEntity
+{
+    /// <summary>The claude session id (`--session-id` / `--resume`).</summary>
+    public string SessionId { get; init; } = string.Empty;
+
+    /// <summary>Working directory the session ran in — a resume must start there.</summary>
+    public string Cwd { get; set; } = string.Empty;
+
+    /// <summary>Task the tile belonged to; null for an ad-hoc tile. No FK: the row outlives the task.</summary>
+    public string? TaskId { get; set; }
+
+    /// <summary>Tile title at start (task title or folder name; a handoff inherits its predecessor's).</summary>
+    public string Title { get; set; } = string.Empty;
+
+    /// <summary>UTC time the session was first launched.</summary>
+    public DateTime StartedAt { get; set; } = DateTime.UtcNow;
+
+    /// <summary>Session this one was handed off from; null unless it is a handoff session.</summary>
+    public string? PredecessorSessionId { get; set; }
+
+    /// <summary>brief.md the session started from; non-null exactly for handoff sessions.</summary>
+    public string? BriefPath { get; set; }
+}

src/ClaudeDo.Data/Models/PrimeActionKind.cs

@@ -8,5 +8,7 @@ public enum PrimeActionKind
     /// <summary>Run the daily prep prompt and let Claude fill MyDay.</summary>
     FillMyDay,
     /// <summary>Run the schedule's own prompt with the ClaudeDo MCP tools available.</summary>
-    Custom
+    Custom,
+    /// <summary>Import the assigned ticket-system items into lists by content, then fill MyDay.</summary>
+    ImportTickets
 }

src/ClaudeDo.Data/Models/SshWorkspace.cs

@@ -0,0 +1,29 @@
+using System.Text.RegularExpressions;
+
+namespace ClaudeDo.Data.Models;
+
+/// <summary>A server an interactive claude session can be started on via ssh; connection details live in the user's ssh config.</summary>
+public sealed record SshWorkspace(string Id, string Name, string Host, string RemotePath)
+{
+    // A leading '-' would make ssh parse the alias as an option (-oProxyCommand=... runs local code).
+    private static readonly Regex HostPattern = new(@"^[A-Za-z0-9._@][A-Za-z0-9._@-]*$", RegexOptions.Compiled);
+
+    /// <summary>Returns the first invalid field ("name", "host", "path") or null when valid.</summary>
+    public static string? Validate(SshWorkspace w)
+    {
+        if (string.IsNullOrWhiteSpace(w.Name)) return "name";
+        if (string.IsNullOrEmpty(w.Host) || !HostPattern.IsMatch(w.Host)) return "host";
+        var p = w.RemotePath ?? "";
+        if (!(p.StartsWith('/') || p.StartsWith('~')) || p.Contains('\'') || p.Contains('\n') || p.Contains('\r'))
+            return "path";
+        return null;
+    }
+
+    /// <summary>Single-quotes a validated remote path for a POSIX shell, leaving a leading <c>~</c> unquoted so it still expands.</summary>
+    public static string QuoteRemotePath(string path)
+    {
+        if (path == "~") return "~";
+        if (path.StartsWith("~/")) return "~/'" + path[2..] + "'";
+        return "'" + path + "'";
+    }
+}

src/ClaudeDo.Data/Models/WorktreeEntity.cs

@@ -17,6 +17,8 @@ public sealed class WorktreeEntity
     public string? HeadCommit { get; set; }
     public string? DiffStat { get; set; }
     public string? MergeCommit { get; set; }
+    /// <summary>Draft-PR auf Azure DevOps, gesetzt vom Approve im Firmen-Repo.</summary>
+    public string? PullRequestUrl { get; set; }
     public WorktreeState State { get; set; } = WorktreeState.Active;
     public required DateTime CreatedAt { get; init; }
 

src/ClaudeDo.Data/PromptFiles.cs

@@ -5,7 +5,7 @@ using System.Text.RegularExpressions;
 
 namespace ClaudeDo.Data;
 
-public enum PromptKind { System, Planning, PlanningInitial, Retry, DailyPrep, WeeklyReport, ImprovementChild, Refine, MergeHelperTriage, MergeHelperWait, MergeHelperMerge, MergeHelperInitial, MergeHelperHandoff, PowerUseAddendum }
+public enum PromptKind { System, Planning, PlanningInitial, Retry, DailyPrep, WeeklyReport, ImprovementChild, Refine, MergeHelperTriage, MergeHelperWait, MergeHelperMerge, MergeHelperInitial, MergeHelperHandoff, PowerUseAddendum, TicketImport }
 
 /// <summary>
 /// How a prompt kind's on-disk override (if any) relates to the bundled default.
@@ -45,6 +45,7 @@ public static class PromptFiles
         PromptKind.MergeHelperInitial => "merge-helper-initial.md",
         PromptKind.MergeHelperHandoff => "merge-helper-handoff.md",
         PromptKind.PowerUseAddendum => "power-use.md",
+        PromptKind.TicketImport => "ticket-import.md",
         _ => throw new ArgumentOutOfRangeException(nameof(kind))
     };
 
@@ -223,6 +224,7 @@ public static class PromptFiles
         PromptKind.MergeHelperInitial => MergeHelperInitialDefault,
         PromptKind.MergeHelperHandoff => MergeHelperHandoffDefault,
         PromptKind.PowerUseAddendum => PowerUseAddendumDefault,
+        PromptKind.TicketImport => TicketImportDefault,
         _ => ""
     };
 
@@ -252,10 +254,7 @@ public static class PromptFiles
         it, name the follow-up in your final report instead of trying to file it.
 
         ## Working in the repo
-        - Read a file before editing it. Match the conventions already in this codebase —
+        - Match the conventions already in this codebase — they override generic defaults.
-          they override generic defaults.
-        - Prefer editing existing files to creating new ones. Don't write comments that
-          just restate the code.
         - Validate only at real boundaries (user input, external APIs).
 
         ## Reading efficiently
@@ -319,11 +318,7 @@ public static class PromptFiles
           renames, reformatting, or "while I'm here" cleanup beyond what is asked.
         - Touch as few files as possible. Do not restructure unrelated code.
         - Do NOT file further improvements — improvements are one layer deep.
-        - Verify the build and relevant tests before finishing, and report what you ran.
+        - Make one focused commit; the Finishing rules above apply unchanged.
-        - Make one focused commit in this task's own worktree using the repository's
-          commit-message convention — that commit is the deliverable, not an unrequested auto-commit.
-          Report the real outcome, including the commit SHA; don't say no commit was
-          made when there was.
         """;
 
     private const string PlanningSystemDefault = """
@@ -385,6 +380,22 @@ public static class PromptFiles
         (build + tests) before you stop.
         """;
 
+    private const string TicketImportDefault = """
+        You are sorting my assigned items from the company ticket system into my ClaudeDo lists.
+
+        1. Call mcp__claudedo__get_ticket_import_candidates. If available is false, say why and stop.
+           If items is empty, say so and stop.
+        2. For every item, pick the list whose purpose fits the item's CONTENT — its title, its
+           parent and its project. A list's ticketProject is only a hint: one ticket project can
+           hold work for several repositories, and several lists can share one project.
+        3. Import each item exactly once with mcp__claudedo__import_ticket(ticketId, list).
+           If no list clearly fits, omit list — the item then goes to the fallback list.
+           Never force a weak match just to avoid the fallback.
+        4. Do not create, edit or move anything else.
+        5. Finish with a short summary: imported items per list, items that went to the fallback
+           list, and skipped items with their reason.
+        """;
+
     private const string DailyPrepDefault = """
         You are preparing my workday for {date}.
 
@@ -457,7 +468,7 @@ public static class PromptFiles
 
         Group what's left into waves: batches that can run in parallel, where a later wave depends only on tasks in an earlier one. Report this as a wave plan (e.g. "[3] → [4,5,6] → [7]"), not a flat list — the Wait/Merge sessions after you need the batching, not just which ids survived.
 
-        Then check the wave count against the handoff cap. This list-handler chain allows a limited number of handoffs (wait, merge, wait_final, merge_final) — by default 4, i.e. exactly two merge rounds, but it is configurable and may be higher for this run. Assume two rounds unless the kickoff tells you otherwise. If your wave plan needs more rounds than that to clear, say so explicitly when you hand off — name which waves won't fit — so the Merge session ends by telling the user "the rest needs manual approval in the UI" instead of silently stranding mid-chain.
+        Then check the wave count against the handoff cap: call get_handoff_status with your own handler task id — it reports how many handoffs (wait, merge, wait_final, merge_final) this run still has, i.e. how many merge rounds. If your wave plan needs more rounds than that to clear, say so explicitly when you hand off — name which waves won't fit — so the Merge session ends by telling the user "the rest needs manual approval in the UI" instead of silently stranding mid-chain.
 
         ## Phase 2 — Enhance for execution
         Before touching any task, check the list's verify command ONCE for this whole run (not per task): call get_list_config. If verifyCommand is already set, leave it alone — never overwrite an existing one — and move straight to sharpening tasks below.
@@ -482,7 +493,7 @@ public static class PromptFiles
         Once every surviving task is enhanced, print your triage summary — one line per task from the brief:
         title — dedupe action (kept / merged into X / cancelled as duplicate of X) — enhanced (yes/no).
 
-        Then print the wave plan from Phase 1.5, including any "won't fit in two rounds" note, and call handoff_list_handler(taskId, survivingTaskIds, nextPhase: "wait"). That opens a fresh session to carry out the wait/merge phases with just that list, without dragging along this session's dedupe/rewrite context. Say a short goodbye line, then stop — do not continue into phase 3 yourself.
+        Then print the wave plan from Phase 1.5, including any "won't fit in two rounds" note, and call handoff_list_handler(taskId, survivingTaskIds, nextPhase: "wait"). That opens a fresh session for the wait/merge phases. Say a short goodbye line, then stop — do not continue into phase 3 yourself.
         """;
 
     private const string MergeHelperWaitDefault = """
@@ -497,8 +508,6 @@ public static class PromptFiles
 
         Touch nothing else: do not read a diff, merge, reset, restart, or cancel any task. A task that lands in Failed is simply noted and passed on — deciding what to do about it belongs to the Merge session, not you.
 
-        MaxParallelExecutions is deliberately not reported here — the queue enforces it on its own; that reporting was the old combined phase's job and no longer belongs to this role.
-
         ## Handoff
         Once every task has left Queued/Running/WaitingForChildren, call handoff_list_handler(taskId, <every task id from this round>, nextPhase: "merge") — or nextPhase: "merge_final" if your own phase was "wait_final". Then stop your turn immediately.
         """;
@@ -523,7 +532,7 @@ public static class PromptFiles
            - Clean merge → mergeStatus "merged_verify_pending" (expected: the task deliberately stays WaitingForReview until verify_merges passes) or "merged" (list has no verify command; the task is Done). Either way, move on.
            - Conflict (markers left in the working tree, repoPath returned) → resolve it below.
 
-        After each merge, main has moved — a clean preview_merge_set result from before this merge is now stale for the remaining tasks. If you are unsure whether an earlier overlap warning still matters, call preview_merge for the next task again before merging it.
+        After each merge, main has moved — a clean preview_merge_set result from before this merge is now stale for the remaining tasks. If you are unsure whether an earlier overlap warning still matters, call preview_merge for the next task again before merging it (default runVerify=false — this is just a conflict recheck, not a build; the verify command still runs once via verify_merges after the last merge).
 
         Every branch in this run forked from the same base, so conflicts between them are the NORMAL case, not a failure. Resolve them and keep going; do not abandon the run because a merge conflicted.
 
@@ -534,6 +543,10 @@ public static class PromptFiles
         - Prefer the MCP tools whenever they apply. Only if the MCP tools cannot reach an in-progress merge may you finish it by hand: resolve the markers, then `git add -- <the resolved paths>` and `git commit` — NEVER `git add -A` or a bare commit, because the checkout is shared with other sessions.
         - Never use raw `git merge`, `git reset`, or `git checkout` to force a merge. Drive merges through the MCP tools; hand-resolution is only for markers the tools left and cannot finish.
 
+        ## Company repos (Azure DevOps)
+
+        If the list's repo is a company repo (origin on the Azure DevOps Server), approve does not merge anything locally: review_task approve runs the verify command in the task's own worktree, pushes its branch and opens a draft PR (or reuses the one already open for that branch). mergeStatus is "pr_created" or "pr_updated" and mergeMessage is the PR URL; the task deliberately stays WaitingForReview until the user merges the PR on Azure DevOps and ticks it Done. There are no merge conflicts to resolve and main does not move, so skip preview_merge_set's merge-order reasoning, do NOT call verify_merges (the verify already ran inside approve, skipVerify is ignored there), and the merge-before-rerun rule above does not apply. A blocked result names what failed (no Azure DevOps PAT, push rejected, or "gepusht, PR fehlgeschlagen: …" when the push landed but the PR call did not) — report it, do not retry blindly. In the Phase 5 summary, list every PR link.
+
         ## Verify once — after the last merge
 
         When every merge above is done (including conflict resolutions), call verify_merges with the ids of ALL tasks that reported merged_verify_pending. It runs the list's verify command a single time and promotes them all to Done on success — that is the per-merge gate you skipped, paid once.
@@ -582,7 +595,7 @@ public static class PromptFiles
 
         ## Phase 5 — Summary
         Print one line per task from the brief:
-        title — final status — merge commit (if any) — conflicts resolved (if any) — verify-failed (yes/no).
+        title — final status — merge commit or PR link (if any) — conflicts resolved (if any) — verify-failed (yes/no).
 
         Then list anything you skipped or left for the user and why, and any follow-ups worth turning into new tasks.
         """;
@@ -640,7 +653,7 @@ public static class PromptFiles
         Specifically:
         - **Duplicate pairs (Triage Phase 1):** decide them. Clear duplicate — same goal, or one fully contained in the other — fold the loser's unique content into the survivor and cancel the loser. Genuinely different intent that merely touches the same area — keep both and chain them with dependsOnTaskId so they cannot run against the same files at once.
         - **A task too vague to sharpen (Triage Phase 2):** cancel it with a recorded reason rather than guessing a specification for someone else's half-sentence. Guessing burns a whole slot on work nobody asked for.
-        - **Wave plan vs. handoff cap (Triage Phase 1.5):** do not assume two rounds, and never trim the wave plan to fit a cap or defer waves to "manual approval in the UI" — nobody will be there. Call get_handoff_status with your own handler task id to read this run's real cap, then plan the waves the work actually needs and hand off the first one.
+        - **Wave plan vs. handoff cap (Triage Phase 1.5):** never trim the wave plan to fit the cap or defer waves to "manual approval in the UI" — nobody will be there. Plan the waves the work actually needs and hand off the first one.
         - **A task that bundles several independent features (Triage Phase 2):** split it yourself — create the pieces, chain them with dependsOnTaskId where one builds on another, cancel or narrow the original, and record what you did.
         - **Verify command not set (Triage Phase 2):** determine it, run it once via Bash to prove it works, then set it. Never write a command you have not actually run.
         - **A risky or wrong-looking diff (Merge Phase 4):** if it contradicts the task's own acceptance criteria, call review_task(taskId, decision="reject_rerun", feedback=...) with concrete feedback naming what was missing. If it merely looks unusual but meets the criteria, merge it and say why. If it looks actively destructive — deletes code no task asked to delete, drops a migration, rewrites unrelated files — leave it unmerged and record it as HELD FOR REVIEW. Never merge something you would describe as destructive.
@@ -697,20 +710,21 @@ public static class PromptFiles
         """;
 
     private const string WeeklyReportDefault = """
-        You are generating a concise weekly standup report for a software developer,
+        You are writing memory-jogger notes for a developer's weekly standup,
-        covering {start} to {end}.
+        covering {start} to {end}. They read them aloud in their own words, so write
+        keywords, not sentences.
 
         Rules:
-        - Write the ENTIRE report in German.
+        - Write in German.
-        - Group by day. One "## <Wochentag>, <dd.MM.yyyy>" section per day that has
+        - Group by day. One "## <Wochentag>, <dd.MM.>" heading per day that has
           activity (German weekday names). Omit days with no activity.
-        - Within each day: 3–5 first-person, past-tense bullets ("- Habe X umgesetzt",
+        - Per day: 1–3 bullets, each at most ~6 words, noun style
-          "- Y behoben"). Merge related small work into one bullet.
+          ("- LagerApp: Etikettendruck gefixt", "- ClaudeDo Listen-Ordner"). No "Habe …".
-        - Drop trivia: typo fixes, pure exploration, false starts, tooling/log noise.
+        - One bullet per topic — merge everything about the same feature/bug.
-        - Blend the developer's own notes and the derived activity into ONE deduplicated
+        - Drop trivia: typo fixes, exploration, false starts, tooling/log noise.
-          bullet list per day. The notes are authoritative — never omit or contradict them.
+        - Merge the developer's notes with the derived activity, deduplicated.
-        - Name the project/repo when it adds clarity.
+          The notes are authoritative — never omit or contradict them.
-        - Output ONLY the dated sections. No preamble, no intro, no closing remarks.
+        - Output ONLY the day sections. No preamble, no summary, no closing remarks.
 
         Two sections follow below: an activity log derived from Claude session history,
         and the developer's own notes. Base the report on both; the notes are

src/ClaudeDo.Data/Repositories/AppSettingsRepository.cs

@@ -127,4 +127,34 @@ public sealed class AppSettingsRepository
         row.RepoImportFolders = list.Count == 0 ? null : JsonSerializer.Serialize(list);
         await _context.SaveChangesAsync(ct);
     }
+
+    /// <summary>Reads the configured SSH workspaces; missing or corrupt JSON yields an empty list.</summary>
+    public async Task<List<SshWorkspace>> GetSshWorkspacesAsync(CancellationToken ct = default)
+    {
+        var json = await _context.AppSettings.AsNoTracking()
+            .Where(s => s.Id == AppSettingsEntity.SingletonId)
+            .Select(s => s.SshWorkspaces)
+            .FirstOrDefaultAsync(ct);
+
+        if (string.IsNullOrWhiteSpace(json)) return new List<SshWorkspace>();
+        try { return JsonSerializer.Deserialize<List<SshWorkspace>>(json) ?? new List<SshWorkspace>(); }
+        catch (JsonException) { return new List<SshWorkspace>(); }
+    }
+
+    /// <summary>Writes only the SSH workspaces column; an empty list clears it.</summary>
+    public async Task SetSshWorkspacesAsync(IEnumerable<SshWorkspace> workspaces, CancellationToken ct = default)
+    {
+        var list = workspaces.ToList();
+        var row = await GetOrCreateTrackedRowAsync(ct);
+        row.SshWorkspaces = list.Count == 0 ? null : JsonSerializer.Serialize(list);
+        await _context.SaveChangesAsync(ct);
+    }
+
+    /// <summary>Writes only the ticket fallback list; blank clears it.</summary>
+    public async Task SetTicketFallbackListIdAsync(string? listId, CancellationToken ct = default)
+    {
+        var row = await GetOrCreateTrackedRowAsync(ct);
+        row.TicketFallbackListId = string.IsNullOrWhiteSpace(listId) ? null : listId.Trim();
+        await _context.SaveChangesAsync(ct);
+    }
 }

src/ClaudeDo.Data/Repositories/ListRepository.cs

@@ -17,10 +17,20 @@ public sealed class ListRepository
     public async Task AddAsync(ListEntity entity, CancellationToken ct = default)
     {
         NormalizeWorkingDir(entity);
+        if (entity.SortOrder == 0) entity.SortOrder = await NextSortOrderAsync(ct);
         _context.Lists.Add(entity);
         await _context.SaveChangesAsync(ct);
     }
 
+    /// <summary>One past the highest <c>sort_order</c> in use — across <b>both</b> tables, because
+    /// the sidebar interleaves folders and top-level lists in a single order sequence.</summary>
+    private async Task<int> NextSortOrderAsync(CancellationToken ct = default)
+    {
+        var maxList = await _context.Lists.MaxAsync(l => (int?)l.SortOrder, ct) ?? -1;
+        var maxFolder = await _context.ListFolders.MaxAsync(f => (int?)f.SortOrder, ct) ?? -1;
+        return Math.Max(maxList, maxFolder) + 1;
+    }
+
     public async Task UpdateAsync(ListEntity entity, CancellationToken ct = default)
     {
         NormalizeWorkingDir(entity);
@@ -56,18 +66,92 @@ public sealed class ListRepository
         return await _context.Lists.OrderBy(l => l.SortOrder).ThenBy(l => l.CreatedAt).ToListAsync(ct);
     }
 
-    public async Task ReorderAsync(IReadOnlyList<string> orderedListIds, CancellationToken ct = default)
+    /// <summary>
+    /// Writes the sidebar's visual order as one sequence spanning both tables: folders and lists
+    /// share the <c>sort_order</c> number space, which is what lets a top-level list sit between
+    /// two folders. A folder's own children follow it in the sequence, so ordering folders by
+    /// <c>sort_order</c> and lists by <c>sort_order</c> independently still reproduces the sidebar.
+    /// </summary>
+    public async Task ReorderSidebarAsync(IReadOnlyList<(string Id, bool IsFolder)> ordered, CancellationToken ct = default)
     {
-        var idSet = orderedListIds.ToHashSet();
+        var listIds = ordered.Where(o => !o.IsFolder).Select(o => o.Id).ToHashSet();
-        var entities = await _context.Lists.Where(l => idSet.Contains(l.Id)).ToListAsync(ct);
+        var folderIds = ordered.Where(o => o.IsFolder).Select(o => o.Id).ToHashSet();
-        for (int i = 0; i < orderedListIds.Count; i++)
+        var lists = await _context.Lists.Where(l => listIds.Contains(l.Id)).ToListAsync(ct);
+        var folders = await _context.ListFolders.Where(f => folderIds.Contains(f.Id)).ToListAsync(ct);
+
+        for (int i = 0; i < ordered.Count; i++)
         {
-            var e = entities.FirstOrDefault(x => x.Id == orderedListIds[i]);
+            var (id, isFolder) = ordered[i];
-            if (e is not null) e.SortOrder = i;
+            if (isFolder)
+            {
+                if (folders.FirstOrDefault(f => f.Id == id) is { } folder) folder.SortOrder = i;
+            }
+            else if (lists.FirstOrDefault(l => l.Id == id) is { } list) list.SortOrder = i;
         }
         await _context.SaveChangesAsync(ct);
     }
 
+    // ---- Sidebar folders (list_folders) ----
+    // Folders live here rather than in their own repository because they exist only as a grouping
+    // of these lists — every caller that touches one already holds a ListRepository.
+
+    public async Task<List<ListFolderEntity>> GetFoldersAsync(CancellationToken ct = default)
+    {
+        return await _context.ListFolders
+            .OrderBy(f => f.SortOrder).ThenBy(f => f.CreatedAt)
+            .ToListAsync(ct);
+    }
+
+    public async Task AddFolderAsync(ListFolderEntity folder, CancellationToken ct = default)
+    {
+        folder.SortOrder = await NextSortOrderAsync(ct);
+        _context.ListFolders.Add(folder);
+        await _context.SaveChangesAsync(ct);
+    }
+
+    /// <summary>Patches just the editable fields — a whole-entity Update would need
+    /// <c>CreatedAt</c>/<c>SortOrder</c>/<c>IsCollapsed</c> carried along and silently reset
+    /// whichever the caller forgot (see the SetConfigAsync note in CLAUDE.md).</summary>
+    public async Task RenameFolderAsync(string folderId, string name, string? icon, string? color, CancellationToken ct = default)
+    {
+        await _context.ListFolders
+            .Where(f => f.Id == folderId)
+            .ExecuteUpdateAsync(s => s
+                .SetProperty(f => f.Name, name)
+                .SetProperty(f => f.Icon, icon)
+                .SetProperty(f => f.Color, color), ct);
+    }
+
+    /// <summary>Deletes the folder only — its lists survive and fall back to the top level via
+    /// the ON DELETE SET NULL on <c>lists.folder_id</c>.</summary>
+    public async Task DeleteFolderAsync(string folderId, CancellationToken ct = default)
+    {
+        await _context.ListFolders.Where(f => f.Id == folderId).ExecuteDeleteAsync(ct);
+    }
+
+    public async Task SetFolderCollapsedAsync(string folderId, bool collapsed, CancellationToken ct = default)
+    {
+        await _context.ListFolders
+            .Where(f => f.Id == folderId)
+            .ExecuteUpdateAsync(s => s.SetProperty(f => f.IsCollapsed, collapsed), ct);
+    }
+
+    /// <summary>Moves a folder under <paramref name="parentFolderId"/>, or to the top level when null.</summary>
+    public async Task SetFolderParentAsync(string folderId, string? parentFolderId, CancellationToken ct = default)
+    {
+        await _context.ListFolders
+            .Where(f => f.Id == folderId)
+            .ExecuteUpdateAsync(s => s.SetProperty(f => f.ParentFolderId, parentFolderId), ct);
+    }
+
+    /// <summary>Moves a list into <paramref name="folderId"/>, or back to the top level when null.</summary>
+    public async Task SetListFolderAsync(string listId, string? folderId, CancellationToken ct = default)
+    {
+        await _context.Lists
+            .Where(l => l.Id == listId)
+            .ExecuteUpdateAsync(s => s.SetProperty(l => l.FolderId, folderId), ct);
+    }
+
     public async Task<ListConfigEntity?> GetConfigAsync(string listId, CancellationToken ct = default)
     {
         return await _context.ListConfigs.FirstOrDefaultAsync(c => c.ListId == listId, ct);
@@ -91,6 +175,7 @@ public sealed class ListRepository
             existing.PermissionMode = config.PermissionMode;
             existing.TicketProjectId = config.TicketProjectId;
             existing.PowerUseAllowed = config.PowerUseAllowed;
+            existing.BaseBranch = config.BaseBranch;
         }
         await _context.SaveChangesAsync(ct);
     }

src/ClaudeDo.Data/Repositories/MissionControlSessionRepository.cs

@@ -0,0 +1,39 @@
+using ClaudeDo.Data.Models;
+using Microsoft.EntityFrameworkCore;
+
+namespace ClaudeDo.Data.Repositories;
+
+/// <summary>Reads and writes <c>mission_control_sessions</c>.</summary>
+public sealed class MissionControlSessionRepository
+{
+    private readonly ClaudeDoDbContext _context;
+
+    public MissionControlSessionRepository(ClaudeDoDbContext context) => _context = context;
+
+    /// <summary>Inserts the session unless it is already recorded — a resumed task session keeps
+    /// its original row and start time.</summary>
+    public async Task RecordAsync(MissionControlSessionEntity session, CancellationToken ct = default)
+    {
+        if (await _context.MissionControlSessions.AnyAsync(s => s.SessionId == session.SessionId, ct)) return;
+        _context.MissionControlSessions.Add(session);
+        await _context.SaveChangesAsync(ct);
+    }
+
+    /// <summary>Sets the session's title; a no-op for an unknown id. <see cref="RecordAsync"/> never overwrites it.</summary>
+    public async Task RenameAsync(string sessionId, string title, CancellationToken ct = default) =>
+        await _context.MissionControlSessions.Where(s => s.SessionId == sessionId)
+            .ExecuteUpdateAsync(s => s.SetProperty(x => x.Title, title), ct);
+
+    /// <summary>The recorded session, or null.</summary>
+    public async Task<MissionControlSessionEntity?> GetAsync(string sessionId, CancellationToken ct = default) =>
+        await _context.MissionControlSessions.AsNoTracking().FirstOrDefaultAsync(s => s.SessionId == sessionId, ct);
+
+    /// <summary>Sessions started since <paramref name="sinceUtc"/>, newest first, at most <paramref name="max"/>.</summary>
+    public async Task<IReadOnlyList<MissionControlSessionEntity>> ListRecentAsync(
+        DateTime sinceUtc, int max, CancellationToken ct = default) =>
+        await _context.MissionControlSessions.AsNoTracking()
+            .Where(s => s.StartedAt >= sinceUtc)
+            .OrderByDescending(s => s.StartedAt)
+            .Take(max)
+            .ToListAsync(ct);
+}

src/ClaudeDo.Data/Repositories/WorktreeRepository.cs

@@ -36,7 +36,7 @@ public sealed class WorktreeRepository
             .ExecuteUpdateAsync(s => s.SetProperty(w => w.State, state), ct);
     }
 
-    public async Task SetMergedAsync(string taskId, string mergeCommit, CancellationToken ct = default)
+    public async Task SetMergedAsync(string taskId, string? mergeCommit, CancellationToken ct = default)
     {
         await _context.Worktrees
             .Where(w => w.TaskId == taskId)
@@ -45,6 +45,14 @@ public sealed class WorktreeRepository
                 .SetProperty(w => w.MergeCommit, mergeCommit), ct);
     }
 
+    /// <summary>Stores the draft PR an approve in a company repo created or reused.</summary>
+    public async Task SetPullRequestUrlAsync(string taskId, string url, CancellationToken ct = default)
+    {
+        await _context.Worktrees
+            .Where(w => w.TaskId == taskId)
+            .ExecuteUpdateAsync(s => s.SetProperty(w => w.PullRequestUrl, url), ct);
+    }
+
     /// <summary>Records a successful auto-rebase: the branch's fork point moves to the rebased-onto
     /// commit and its head moves to the new tip <c>git rebase</c> produced.</summary>
     public async Task SetRebasedAsync(string taskId, string baseCommit, string headCommit, CancellationToken ct = default)

src/ClaudeDo.Data/Wire.cs

@@ -13,6 +13,21 @@ namespace ClaudeDo.Data.Wire;
 
 public record ActiveTaskDto(string Slot, string TaskId, DateTime StartedAt);
 
+/// <summary>A Worker operation running right now (verify, merge, rebase, worktree creation).
+/// <paramref name="Title"/> is the task title, or the list name for a batch verify.</summary>
+public record RunningOperationDto(
+    string Id, string Kind, string? TaskId, int? TaskNumber, string? ListId, string Title, DateTime StartedAt);
+
+/// <summary>Stable <see cref="RunningOperationDto.Kind"/> tokens, localized by the UI.</summary>
+public static class OperationKinds
+{
+    public const string VerifyMerge = "verify-merge";
+    public const string VerifyBatch = "verify-batch";
+    public const string Merging = "merging";
+    public const string Rebasing = "rebasing";
+    public const string CreatingWorktree = "creating-worktree";
+}
+
 public record AppSettingsDto(
     string DefaultClaudeInstructions,
     string DefaultModel,
@@ -37,13 +52,12 @@ public record AppSettingsDto(
     int UsageThrottleSevenDaySoftPct = 50,
     int UsageThrottleSevenDayHardPct = 65,
     bool AutoContinueOnUsageLimit = false,
-    // PowerUse master switch — toggled on the usage monitor, not typed in Settings. Only takes
+    // PowerUse master switch — Settings → Execution. Only takes effect for a list that also set
-    // effect for a list that also set PowerUseAllowed.
+    // PowerUseAllowed.
     bool PowerUseEnabled = false,
     int ListHandlerMaxHandoffs = 4,
     // PowerUse time window (`HH:mm`, local, null = round the clock) + the 5h-usage percentage at
-    // which a PowerUse handler session should hand off. Also usage-monitor-owned, so Settings has
+    // which a PowerUse handler session should hand off. Same Settings tab.
-    // to round-trip them too.
     string? PowerUseWindowStart = null,
     string? PowerUseWindowEnd = null,
     int PowerUseHandoffPct = 95);
@@ -73,7 +87,9 @@ public record WorktreeOverviewDto(
     WorktreeState State,
     string? DiffStat,
     DateTime CreatedAt,
-    bool PathExistsOnDisk);
+    bool PathExistsOnDisk,
+    int TaskNumber = 0,
+    bool ContentInMain = false);
 
 public record ForceRemoveResultDto(bool Removed, string? Reason);
 
@@ -81,7 +97,7 @@ public record PlanningMergeConflictStateDto(string PlanningTaskId, string Subtas
 
 public record PendingQuestionDto(string TaskId, string QuestionId, string Question);
 
-public record MergeResultDto(string Status, IReadOnlyList<string> ConflictFiles, string? ErrorMessage);
+public record MergeResultDto(string Status, IReadOnlyList<string> ConflictFiles, string? ErrorMessage, string? PullRequestUrl = null);
 
 public record BaseDirtyWarningDto(int ModifiedCount, int UntrackedCount);
 
@@ -92,7 +108,8 @@ public record MergePreviewDto(
     int? VerifyExitCode = null, long? VerifyDurationMs = null, string? VerifyOutputTail = null);
 
 public record MergeTargetsDto(
-    string DefaultBranch, IReadOnlyList<string> LocalBranches, string DefaultCommitMessage);
+    string DefaultBranch, IReadOnlyList<string> LocalBranches, string DefaultCommitMessage,
+    bool TargetDirty = false, bool IsCompanyRepo = false);
 
 public record MergeConflictDocumentsDto(string TaskId, IReadOnlyList<ConflictDocumentDto> Files);
 
@@ -100,18 +117,19 @@ public record ConflictDocumentDto(string Path, bool IsBinary, IReadOnlyList<Merg
 
 public record MergeSegmentDto(bool IsConflict, string Text, string Ours, string? Base, string Theirs);
 
-public record UpdateListDto(string Id, string Name, string? WorkingDir, string DefaultCommitType, bool IsManual = false, bool FindingsTracked = false, string? Icon = null);
+public record UpdateListDto(string Id, string Name, string? WorkingDir, string DefaultCommitType, bool IsManual = false, bool FindingsTracked = false, string? Icon = null, string? Color = null);
 
 // TicketProjectId is tri-state on purpose: a caller that doesn't own the field (anything but the
 // list-settings modal) must not be able to clear it by omission — SetConfigAsync copies the entity
 // verbatim. Its scale: null = keep stored, <= 0 = clear the link, > 0 = set it.
 // PowerUseAllowed is nullable for the same reason: null = keep stored, false = revoke the opt-in.
 // A non-nullable bool here would let any caller that omits it silently revoke PowerUse for the list.
-public record UpdateListConfigDto(string ListId, string? Model, string? SystemPrompt, string? AgentPath, int? MaxTurns = null, List<string>? SessionSkills = null, string? VerifyCommand = null, string? PermissionMode = null, int? TicketProjectId = null, bool? PowerUseAllowed = null);
+// BaseBranch: null = keep stored, "" = clear, value = set.
+public record UpdateListConfigDto(string ListId, string? Model, string? SystemPrompt, string? AgentPath, int? MaxTurns = null, List<string>? SessionSkills = null, string? VerifyCommand = null, string? PermissionMode = null, int? TicketProjectId = null, bool? PowerUseAllowed = null, string? BaseBranch = null);
 
 public record UpdateTaskAgentSettingsDto(string TaskId, string? Model, string? SystemPrompt, string? AgentPath, int? MaxTurns = null, List<string>? SessionSkills = null, string? PermissionMode = null);
 
-public record ListConfigDto(string? Model, string? SystemPrompt, string? AgentPath, int? MaxTurns = null, List<string>? SessionSkills = null, string? VerifyCommand = null, string? PermissionMode = null, int? TicketProjectId = null, bool PowerUseAllowed = false);
+public record ListConfigDto(string? Model, string? SystemPrompt, string? AgentPath, int? MaxTurns = null, List<string>? SessionSkills = null, string? VerifyCommand = null, string? PermissionMode = null, int? TicketProjectId = null, bool PowerUseAllowed = false, string? BaseBranch = null);
 
 public record SeedResultDto(int Copied, int Skipped);
 
@@ -221,7 +239,10 @@ public sealed record LaunchSpec(
 // action -- confirms with a count, then cancels each one before closing the pane.
 public record HandlerOpenTaskDto(string Id, string Title);
 
-public record TicketSettingsDto(string? ApiBaseUrl, bool TokenSet);
+public record TicketSettingsDto(string? ApiBaseUrl, bool TokenSet, string? FallbackListId = null);
 public record TicketConnectionDto(bool Ok, string? UserName, IReadOnlyList<string> Scopes, string? Error);
+public record AzureDevOpsSettingsDto(bool TokenSet);
+// Repo = the company repo the test ran against (first list whose origin matches), DefaultBranch = its ADO default.
+public record AzureDevOpsConnectionDto(bool Ok, string? Repo, string? DefaultBranch, string? Error);
 public record TicketProjectDto(int Id, string Title, string DepartmentName);
 public record TicketImportResultDto(int Examined, int Created);

src/ClaudeDo.Installer/Checks/ClaudeAuthCheck.cs

@@ -1,5 +1,6 @@
 using System.Text.Json;
 using ClaudeDo.Installer.Core;
+using ClaudeDo.Installer.Localization;
 
 namespace ClaudeDo.Installer.Checks;
 
@@ -23,11 +24,12 @@ public sealed class ClaudeAuthCheck : IEnvironmentCheck
 
     public async Task<CheckResult> RunAsync(InstallContext ctx, CancellationToken ct)
     {
+        var loc = TrExtension.Localizer;
         var lookup = await _lookup.ResolveAsync(ctx, ct);
         if (lookup.Resolved is null)
         {
             return CheckResult.Unknown(Id, Severity, "checks.claudeAuth.title",
-                "The claude CLI was not found — login could not be checked.");
+                loc?["checks.claudeAuth.notFound"] ?? "The claude CLI was not found — login could not be checked.");
         }
 
         var (fileName, arguments) = ProcessCommand.For(lookup.Resolved, "auth", "status", "--json");
@@ -36,19 +38,19 @@ public sealed class ClaudeAuthCheck : IEnvironmentCheck
         if (exitCode != 0)
         {
             return CheckResult.Unknown(Id, Severity, "checks.claudeAuth.title",
-                "Login status could not be determined.", output);
+                loc?["checks.claudeAuth.undetermined"] ?? "Login status could not be determined.", output);
         }
 
         var loggedIn = TryParseLoggedIn(output);
         if (loggedIn is null)
         {
             return CheckResult.Unknown(Id, Severity, "checks.claudeAuth.title",
-                "Login status could not be determined.", output);
+                loc?["checks.claudeAuth.undetermined"] ?? "Login status could not be determined.", output);
         }
 
         return loggedIn.Value
-            ? CheckResult.Ok(Id, Severity, "checks.claudeAuth.title", "Logged in.")
+            ? CheckResult.Ok(Id, Severity, "checks.claudeAuth.title", loc?["checks.claudeAuth.loggedIn"] ?? "Logged in.")
-            : CheckResult.Fail(Id, Severity, "checks.claudeAuth.title", "Not logged in.", "checks.claudeAuth.hint");
+            : CheckResult.Fail(Id, Severity, "checks.claudeAuth.title", loc?["checks.claudeAuth.notLoggedIn"] ?? "Not logged in.", "checks.claudeAuth.hint");
     }
 
     private static bool? TryParseLoggedIn(string output)

src/ClaudeDo.Installer/Checks/ClaudeCliCheck.cs

@@ -1,6 +1,7 @@
 using System.IO;
 using ClaudeDo.Data.Environment;
 using ClaudeDo.Installer.Core;
+using ClaudeDo.Installer.Localization;
 
 namespace ClaudeDo.Installer.Checks;
 
@@ -21,20 +22,21 @@ public sealed class ClaudeCliCheck : IEnvironmentCheck
 
     public async Task<CheckResult> RunAsync(InstallContext ctx, CancellationToken ct)
     {
+        var loc = TrExtension.Localizer;
         var lookup = await _lookup.ResolveAsync(ctx, ct);
 
         if (lookup.Resolved is null)
         {
             var searched = string.Join(", ", SearchedLocations());
             return CheckResult.Fail(Id, Severity, "checks.claudeCli.title",
-                $"'{ctx.ClaudeBin}' was not found on PATH. Searched: {searched}.",
+                loc?.Get("checks.claudeCli.notFound", ctx.ClaudeBin, searched) ?? $"'{ctx.ClaudeBin}' was not found on PATH. Searched: {searched}.",
                 "checks.claudeCli.hint");
         }
 
         if (lookup.ExitCode != 0)
         {
             return CheckResult.Fail(Id, Severity, "checks.claudeCli.title",
-                $"'{lookup.Resolved.Path}' exited with code {lookup.ExitCode}.",
+                loc?.Get("checks.claudeCli.exitCode", lookup.Resolved.Path, lookup.ExitCode) ?? $"'{lookup.Resolved.Path}' exited with code {lookup.ExitCode}.",
                 "checks.claudeCli.hint", detail: lookup.Output);
         }
 
@@ -42,7 +44,8 @@ public sealed class ClaudeCliCheck : IEnvironmentCheck
         var detail = lookup.Resolved.IsShim
             ? "Resolved via a shim (.cmd/.bat/.ps1), not a native .exe."
             : null;
-        return CheckResult.Ok(Id, Severity, "checks.claudeCli.title", $"{lookup.Resolved.Path} — {version}", detail);
+        return CheckResult.Ok(Id, Severity, "checks.claudeCli.title",
+            loc?.Get("checks.claudeCli.resolvedFormat", lookup.Resolved.Path, version) ?? $"{lookup.Resolved.Path} — {version}", detail);
     }
 
     private IEnumerable<string> SearchedLocations()

src/ClaudeDo.Installer/Checks/ClaudeVersionCheck.cs

@@ -1,4 +1,5 @@
 using ClaudeDo.Installer.Core;
+using ClaudeDo.Installer.Localization;
 
 namespace ClaudeDo.Installer.Checks;
 
@@ -27,28 +28,29 @@ public sealed class ClaudeVersionCheck : IEnvironmentCheck
 
     public async Task<CheckResult> RunAsync(InstallContext ctx, CancellationToken ct)
     {
+        var loc = TrExtension.Localizer;
         var lookup = await _lookup.ResolveAsync(ctx, ct);
 
         if (lookup.Resolved is null)
         {
             return CheckResult.Unknown(Id, Severity, "checks.claudeVersion.title",
-                "The claude CLI was not found — version could not be checked.");
+                loc?["checks.claudeVersion.notFound"] ?? "The claude CLI was not found — version could not be checked.");
         }
 
         if (lookup.ExitCode != 0 || lookup.ParsedVersion is null)
         {
             return CheckResult.Unknown(Id, Severity, "checks.claudeVersion.title",
-                $"Could not parse a version from '{lookup.Output.Trim()}'.");
+                loc?.Get("checks.claudeVersion.parseFailed", lookup.Output.Trim()) ?? $"Could not parse a version from '{lookup.Output.Trim()}'.");
         }
 
         if (lookup.ParsedVersion < MinimumVersion)
         {
             return CheckResult.Fail(Id, Severity, "checks.claudeVersion.title",
-                $"claude {lookup.ParsedVersion} is older than the required {MinimumVersion}.",
+                loc?.Get("checks.claudeVersion.tooOld", lookup.ParsedVersion, MinimumVersion) ?? $"claude {lookup.ParsedVersion} is older than the required {MinimumVersion}.",
                 "checks.claudeVersion.hint");
         }
 
         return CheckResult.Ok(Id, Severity, "checks.claudeVersion.title",
-            $"claude {lookup.ParsedVersion} meets the minimum ({MinimumVersion}).");
+            loc?.Get("checks.claudeVersion.ok", lookup.ParsedVersion, MinimumVersion) ?? $"claude {lookup.ParsedVersion} meets the minimum ({MinimumVersion}).");
     }
 }

src/ClaudeDo.Installer/Checks/GitCheck.cs

@@ -2,6 +2,7 @@ using System.Text.RegularExpressions;
 using ClaudeDo.Data.Environment;
 using ClaudeDo.Installer.Core;
 using ClaudeDo.Installer.Core.Interfaces;
+using ClaudeDo.Installer.Localization;
 
 namespace ClaudeDo.Installer.Checks;
 
@@ -27,10 +28,12 @@ public sealed class GitCheck : IEnvironmentCheck
 
     public async Task<CheckResult> RunAsync(InstallContext ctx, CancellationToken ct)
     {
+        var loc = TrExtension.Localizer;
         var resolved = ExecutableResolver.Resolve("git", _pathOverride, _pathExtOverride);
         if (resolved is null)
         {
-            return CheckResult.Fail(Id, Severity, "checks.git.title", "git was not found on PATH.",
+            return CheckResult.Fail(Id, Severity, "checks.git.title",
+                loc?["checks.git.notFound"] ?? "git was not found on PATH.",
                 "checks.git.hint", "https://git-scm.com/downloads");
         }
 
@@ -39,11 +42,13 @@ public sealed class GitCheck : IEnvironmentCheck
 
         if (exitCode != 0)
         {
-            return CheckResult.Fail(Id, Severity, "checks.git.title", $"'{resolved.Path}' exited with code {exitCode}.",
+            return CheckResult.Fail(Id, Severity, "checks.git.title",
+                loc?.Get("checks.git.exitCode", resolved.Path, exitCode) ?? $"'{resolved.Path}' exited with code {exitCode}.",
                 "checks.git.hint", "https://git-scm.com/downloads", output);
         }
 
         var version = VersionPattern.Match(output) is { Success: true } match ? match.Value : output.Trim();
-        return CheckResult.Ok(Id, Severity, "checks.git.title", $"{resolved.Path} — {version}");
+        return CheckResult.Ok(Id, Severity, "checks.git.title",
+            loc?.Get("checks.git.resolvedFormat", resolved.Path, version) ?? $"{resolved.Path} — {version}");
     }
 }

src/ClaudeDo.Installer/Checks/GitIdentityCheck.cs

@@ -1,6 +1,7 @@
 using ClaudeDo.Data.Environment;
 using ClaudeDo.Installer.Core;
 using ClaudeDo.Installer.Core.Interfaces;
+using ClaudeDo.Installer.Localization;
 
 namespace ClaudeDo.Installer.Checks;
 
@@ -25,10 +26,12 @@ public sealed class GitIdentityCheck : IEnvironmentCheck
 
     public async Task<CheckResult> RunAsync(InstallContext ctx, CancellationToken ct)
     {
+        var loc = TrExtension.Localizer;
         var resolved = ExecutableResolver.Resolve("git", _pathOverride, _pathExtOverride);
         if (resolved is null)
         {
-            return CheckResult.Unknown(Id, Severity, "checks.gitIdentity.title", "git was not found — identity could not be checked.");
+            return CheckResult.Unknown(Id, Severity, "checks.gitIdentity.title",
+                loc?["checks.gitIdentity.notFound"] ?? "git was not found — identity could not be checked.");
         }
 
         var name = await ReadConfigAsync(resolved, "user.name", ct);
@@ -48,7 +51,8 @@ public sealed class GitIdentityCheck : IEnvironmentCheck
             _ => "user.email",
         };
 
-        return CheckResult.Fail(Id, Severity, "checks.gitIdentity.title", $"Missing git identity: {missing}.", "checks.gitIdentity.hint");
+        return CheckResult.Fail(Id, Severity, "checks.gitIdentity.title",
+            loc?.Get("checks.gitIdentity.missing", missing) ?? $"Missing git identity: {missing}.", "checks.gitIdentity.hint");
     }
 
     private async Task<string> ReadConfigAsync(ResolvedExecutable resolved, string key, CancellationToken ct)

src/ClaudeDo.Installer/Checks/PermissionModeAutoCheck.cs

@@ -1,5 +1,6 @@
 using System.Text.RegularExpressions;
 using ClaudeDo.Installer.Core;
+using ClaudeDo.Installer.Localization;
 
 namespace ClaudeDo.Installer.Checks;
 
@@ -28,11 +29,12 @@ public sealed class PermissionModeAutoCheck : IEnvironmentCheck
 
     public async Task<CheckResult> RunAsync(InstallContext ctx, CancellationToken ct)
     {
+        var loc = TrExtension.Localizer;
         var lookup = await _lookup.ResolveAsync(ctx, ct);
         if (lookup.Resolved is null)
         {
             return CheckResult.Unknown(Id, Severity, "checks.permissionModeAuto.title",
-                "The claude CLI was not found — permission-mode support could not be checked.");
+                loc?["checks.permissionModeAuto.notFound"] ?? "The claude CLI was not found — permission-mode support could not be checked.");
         }
 
         var (fileName, arguments) = ProcessCommand.For(lookup.Resolved, "--help");
@@ -41,17 +43,17 @@ public sealed class PermissionModeAutoCheck : IEnvironmentCheck
         if (exitCode != 0 || string.IsNullOrWhiteSpace(output))
         {
             return CheckResult.Unknown(Id, Severity, "checks.permissionModeAuto.title",
-                "Could not determine whether --permission-mode auto is supported.");
+                loc?["checks.permissionModeAuto.undetermined"] ?? "Could not determine whether --permission-mode auto is supported.");
         }
 
         if (AutoIsListed(output))
         {
             return CheckResult.Ok(Id, Severity, "checks.permissionModeAuto.title",
-                "--permission-mode auto is recognized by this CLI.");
+                loc?["checks.permissionModeAuto.ok"] ?? "--permission-mode auto is recognized by this CLI.");
         }
 
         return CheckResult.Fail(Id, Severity, "checks.permissionModeAuto.title",
-            "This claude CLI version does not list 'auto' as a --permission-mode choice.",
+            loc?["checks.permissionModeAuto.notListed"] ?? "This claude CLI version does not list 'auto' as a --permission-mode choice.",
             "checks.permissionModeAuto.hint");
     }
 

src/ClaudeDo.Installer/Checks/PortCheck.cs

@@ -2,6 +2,7 @@ using System.Net;
 using System.Net.Sockets;
 using ClaudeDo.Installer.Checks.Interfaces;
 using ClaudeDo.Installer.Core;
+using ClaudeDo.Installer.Localization;
 
 namespace ClaudeDo.Installer.Checks;
 
@@ -19,6 +20,7 @@ public sealed class PortCheck : IEnvironmentCheck
 
     public async Task<CheckResult> RunAsync(InstallContext ctx, CancellationToken ct)
     {
+        var loc = TrExtension.Localizer;
         var ports = new (string Label, int Port)[]
         {
             ("SignalR", ctx.SignalRPort),
@@ -39,7 +41,9 @@ public sealed class PortCheck : IEnvironmentCheck
                 continue;
             }
 
-            blocked.Add(owner is null ? $"{label} port {port} is in use." : $"{label} port {port} is in use by '{owner}'.");
+            blocked.Add(owner is null
+                ? loc?.Get("checks.ports.inUse", label, port) ?? $"{label} port {port} is in use."
+                : loc?.Get("checks.ports.inUseBy", label, port, owner) ?? $"{label} port {port} is in use by '{owner}'.");
         }
 
         if (blocked.Count > 0)
@@ -49,10 +53,12 @@ public sealed class PortCheck : IEnvironmentCheck
 
         if (ownWorker.Count > 0)
         {
-            return CheckResult.Ok(Id, Severity, "checks.ports.title", $"In use by the running ClaudeDo Worker: {string.Join(", ", ownWorker)}.");
+            var ownWorkerList = string.Join(", ", ownWorker);
+            return CheckResult.Ok(Id, Severity, "checks.ports.title",
+                loc?.Get("checks.ports.inUseByOwnWorker", ownWorkerList) ?? $"In use by the running ClaudeDo Worker: {ownWorkerList}.");
         }
 
-        return CheckResult.Ok(Id, Severity, "checks.ports.title", "Ports are available.");
+        return CheckResult.Ok(Id, Severity, "checks.ports.title", loc?["checks.ports.available"] ?? "Ports are available.");
     }
 
     private static bool IsFree(int port)

src/ClaudeDo.Installer/Checks/WriteAccessCheck.cs

@@ -1,6 +1,7 @@
 using System.IO;
 using ClaudeDo.Data;
 using ClaudeDo.Installer.Core;
+using ClaudeDo.Installer.Localization;
 
 namespace ClaudeDo.Installer.Checks;
 
@@ -14,17 +15,19 @@ public sealed class WriteAccessCheck : IEnvironmentCheck
 
     public Task<CheckResult> RunAsync(InstallContext ctx, CancellationToken ct)
     {
+        var loc = TrExtension.Localizer;
         foreach (var target in new[] { ctx.InstallDirectory, Paths.AppDataRoot() })
         {
             var error = TryWrite(target);
             if (error is not null)
             {
                 return Task.FromResult(CheckResult.Fail(Id, Severity, "checks.writeAccess.title",
-                    $"Cannot write to '{target}': {error}", "checks.writeAccess.hint"));
+                    loc?.Get("checks.writeAccess.cannotWrite", target, error) ?? $"Cannot write to '{target}': {error}", "checks.writeAccess.hint"));
             }
         }
 
-        return Task.FromResult(CheckResult.Ok(Id, Severity, "checks.writeAccess.title", "Install directory and data directory are writable."));
+        return Task.FromResult(CheckResult.Ok(Id, Severity, "checks.writeAccess.title",
+            loc?["checks.writeAccess.writable"] ?? "Install directory and data directory are writable."));
     }
 
     private static string? TryWrite(string path)

src/ClaudeDo.Localization/locales/de.json

@@ -11,11 +11,14 @@
       "categoryGeneral": "Allgemein",
       "categoryExecution": "Ausführung",
       "categoryPrime": "Prime Claude",
+      "categoryPrimeHint": "Geplante Claude-Läufe: Ping, My Day füllen oder ein eigener Prompt, zu festen Zeiten.",
       "categoryWorktrees": "Worktrees",
       "categoryFiles": "Dateien & Prompts",
       "categorySkills": "Session Skills",
       "categoryReports": "Berichte",
-      "categoryTickets": "Ticketsystem"
+      "categoryTickets": "Externe Dienste",
+      "categorySsh": "SSH-Workspaces",
+      "categoryCustomTiles": "Eigene Tiles"
     },
     "repoHint": {
       "text": "Wirkt erst mit verknüpftem Repo.",
@@ -27,6 +30,7 @@
       "model": "Modell",
       "maxTurns": "Max. Durchläufe",
       "effort": "Effort",
+      "effortHint": "Denkaufwand, den das Modell anwendet. Höher kostet mehr und denkt tiefer.",
       "modelPresets": "Vorgaben pro Modell",
       "modelPresetsHint": "Effort und Durchlauf-Budget, mit denen eine Sitzung unter diesem Modell läuft. Overrides auf Listen- und Aufgabenebene gewinnen weiterhin.",
       "maxTurnsCeiling": "Max. Durchläufe – Obergrenze",
@@ -36,15 +40,23 @@
       "maxParallelExecutions": "Max. parallele Ausführungen",
       "maxParallelExecutionsHint": "Wie viele Aufgaben aus der Warteschlange der Worker gleichzeitig ausführt.",
       "usageGateHeading": "Usage-Limit-Stopp",
-      "usageGateHint": "Ab dieser Auslastung holt die Queue keine neuen Tasks mehr; laufende Tasks laufen zu Ende. 0 schaltet den Stopp ab.",
+      "usageGateHint": "Ab dieser Auslastung holt die Warteschlange keine neuen Aufgaben mehr; laufende Aufgaben laufen zu Ende. 0 schaltet den Stopp ab.",
       "usageGateFiveHourPct": "5-Stunden-Fenster (%)",
       "usageGateSevenDayPct": "7-Tage-Fenster (%)",
       "autoContinueOnUsageLimit": "Nach Limit-Reset fortsetzen",
-      "autoContinueOnUsageLimitHint": "Ist ein Run am Nutzungslimit abgebrochen, wird er nach Ablauf des 5-Stunden-Fensters automatisch fortgesetzt. Weckt außerdem die pausierte Queue genau zum Reset-Zeitpunkt statt erst beim nächsten Backstop-Check.",
+      "autoContinueOnUsageLimitHint": "Ist ein Run am Nutzungslimit abgebrochen, wird er nach Ablauf des 5-Stunden-Fensters automatisch fortgesetzt. Weckt außerdem die pausierte Warteschlange genau zum Reset-Zeitpunkt statt erst beim nächsten Backstop-Check.",
       "listHandlerMaxHandoffs": "Handoff-Budget des List-Handlers",
       "listHandlerMaxHandoffsHint": "Wie viele Wait/Merge-Handoffs ein „Let Claude handle it\"-Run verketten darf. 4 entspricht zwei Merge-Runden. Für Läufe, die stundenlang durchlaufen sollen, höher setzen; der Wert begrenzt eine entlaufene Kette und darf daher nicht 0 sein.",
+      "powerUseHeading": "PowerUse",
+      "powerUse": "PowerUse aktivieren",
+      "powerUseHint": "Das restliche Fenster ausnutzen: ein List-Handler-Run fragt nichts, löst Konflikte selbst, sammelt neue Arbeit und handoffet weiter, solange sein Budget reicht. Wirkt nur auf Listen, die PowerUse in ihren Listen-Einstellungen erlaubt haben.",
+      "powerUseWindow": "Nur zwischen",
+      "powerUseWindowPlaceholder": "HH:mm",
+      "powerUseHandoffPct": "Übergabe bei (% von 5h)",
+      "powerUseWindowHint": "Beide Zeiten leer = rund um die Uhr. Das Fenster wird bei jedem Start einer Handler-Phase geprüft — eine Kette, die über das Ende hinausläuft, macht ohne PowerUse weiter.",
+      "powerUseWindowInvalid": "PowerUse-Zeiten müssen im Format HH:mm sein oder leer bleiben.",
       "throttleStagesHeading": "Throttle-Stufen",
-      "throttleStagesHint": "Die Parallelität wird vor dem harten Gate begrenzt: soft auf 2 Slots, hard auf 1. Eingestellt wird das durch Ziehen der Marker an den Gauges im Usage-Monitor. Der Monitor schließt diese Einstellungen — vorher speichern, wenn du etwas geändert hast.",
+      "throttleStagesHint": "Die Parallelität wird vor dem harten Limit-Stopp begrenzt: soft auf 2 Slots, hard auf 1. Eingestellt wird das durch Ziehen der Marker an den Gauges im Usage-Monitor. Der Monitor schließt diese Einstellungen — vorher speichern, wenn du etwas geändert hast.",
       "throttleStagesValues": "5h: soft {0}% / hard {1}%  ·  7d: soft {2}% / hard {3}%",
       "openUsageMonitor": "Usage-Monitor öffnen...",
       "reportExcludedPaths": "Bericht: ausgeschlossene Pfade (einer pro Zeile)",
@@ -102,10 +114,11 @@
       "actionPing": "Ping",
       "actionFillMyDay": "Mein Tag füllen",
       "actionCustom": "Eigener Prompt",
-      "actionHint": "Ping öffnet nur das Nutzungsfenster. „Mein Tag füllen“ startet die Tagesplanung. „Eigener Prompt“ führt deinen eigenen Prompt mit den ClaudeDo-Tools aus.",
+      "actionImportTickets": "Tickets + Tag planen",
+      "actionHint": "Ping öffnet nur das Nutzungsfenster. „Mein Tag füllen“ startet die Tagesplanung. „Tickets + Tag planen“ importiert erst deine zugewiesenen Tickets in die passenden Listen und startet dann die Tagesplanung. „Eigener Prompt“ führt deinen eigenen Prompt mit den ClaudeDo-Tools aus.",
       "customPromptLabel": "Prompt",
       "customPromptPlaceholder": "Der vollständige Prompt für diesen Zeitplan (Pflichtfeld)",
-      "maxTasksDisabledHint": "Gilt nur für Zeitpläne mit „Mein Tag füllen“.",
+      "maxTasksDisabledHint": "Gilt nur für Zeitpläne mit „Mein Tag füllen“ oder „Tickets + Tag planen“.",
       "promptOverrideLabel": "Prompt-Zusatz",
       "promptOverridePlaceholder": "Zusätzliche Anweisungen, die für diesen Zeitplan an den Prime-Prompt angehängt werden (optional)",
       "dayMo": "Mo",
@@ -137,12 +150,46 @@
       "saveButton": "Konfiguration speichern"
     },
     "tickets": {
+      "ticketSection": "TICKETSYSTEM",
+      "azdoSection": "AZURE DEVOPS",
+      "azdoToken": "Personal Access Token (Scope: Code Read & Write)",
+      "azdoHint": "Gilt in Firmen-Repos (origin auf dem Azure DevOps Server): Fetch vor dem Task-Start, Push und Draft-PR beim Genehmigen.",
       "baseUrl": "API-Base-URL",
       "baseUrlHint": "Leer lassen, um die Ticket-Anbindung komplett zu deaktivieren.",
       "token": "Personal Access Token",
       "tokenSet": "gespeichert",
       "testConnection": "Verbindung testen",
-      "clearToken": "Token entfernen"
+      "clearToken": "Token entfernen",
+      "fallbackList": "Fallback-Liste",
+      "fallbackListHint": "Ticket-Items, die Claude keiner Liste zuordnen kann, landen hier. Keine = sie werden übersprungen.",
+      "fallbackNone": "(keine)"
+    },
+    "ssh": {
+      "hint": "Server, auf denen Mission Control eine interaktive Claude-Session starten kann. Host ist ein Alias aus ~/.ssh/config (User, Key und Port kommen von dort); Claude muss auf dem Server installiert und eingeloggt sein.",
+      "name": "Name",
+      "host": "Host-Alias",
+      "remotePath": "Pfad auf dem Server (/… oder ~/…)",
+      "add": "Workspace hinzufügen",
+      "remove": "Entfernen",
+      "invalid": {
+        "name": "SSH-Workspace: Name fehlt.",
+        "host": "SSH-Workspace „{0}“: Host muss ein ssh-Alias sein (Buchstaben, Ziffern, . _ @ -, nicht mit - beginnend).",
+        "path": "SSH-Workspace „{0}“: Pfad muss mit / oder ~ beginnen und darf kein ' enthalten."
+      }
+    },
+    "customTiles": {
+      "hint": "Konsolenprogramme, die Mission Control als Tile öffnen kann (z. B. pwsh, ssh lenovo-server, lazygit). Argumente werden an Leerzeichen getrennt; ein Argument mit Leerzeichen in Anführungszeichen setzen. Ordner leer lassen, um ihn beim Start auszuwählen.",
+      "name": "Name",
+      "program": "Programm",
+      "arguments": "Argumente",
+      "folder": "Ordner (optional)",
+      "pickFolder": "Ordner wählen",
+      "add": "Tile hinzufügen",
+      "remove": "Entfernen",
+      "invalid": {
+        "name": "Eigenes Tile: Name fehlt.",
+        "program": "Eigenes Tile „{0}“: Programm fehlt."
+      }
     },
     "inherit": {
       "inheritedFromList": "geerbt · Liste",
@@ -191,6 +238,7 @@
     "ctxMarkAs": "Markieren als",
     "ctxMarkDone": "Erledigt",
     "ctxMarkCancelled": "Abgebrochen",
+    "ctxMarkIdle": "Offen",
     "ctxOpenConPtySession": "Interaktive Sitzung öffnen",
     "ctxOpenWorktree": "Worktree öffnen",
     "ctxOpenPlanningSession": "Planungssitzung öffnen",
@@ -226,12 +274,13 @@
     "reasonIsPlanningParent": "Teil eines Plans",
     "reasonIsChildTask": "Teilaufgaben haben keine eigene Planungssitzung",
     "reasonPlanAlreadyFinalized": "Plan ist bereits finalisiert",
-    "reasonNoWorktree": "Kein Worktree für diesen Task",
+    "reasonNoWorktree": "Kein Worktree für diese Aufgabe",
     "cancel": "Abbrechen",
     "removeFromQueueTip": "Aus Warteschlange entfernen",
     "toggleSubtasksTip": "Unteraufgaben ein-/ausklappen",
     "agentSuggestedTip": "Vom Agenten vorgeschlagen",
     "interactiveChipTip": "Interaktive Sitzung offen — klicken, um im Mission Control dorthin zu springen",
+    "waitingOnTip": "Wartet auf {0}",
     "scheduleTitle": "Aufgabe planen",
     "scheduleWhen": "WANN",
     "scheduleConfirm": "Planen",
@@ -253,24 +302,28 @@
     "contextOpenFindings": "Findings-Ordner öffnen",
     "contextImportTickets": "Aus Ticketsystem aktualisieren",
     "contextSettings": "Einstellungen…",
+    "contextFolderSettings": "Ordner-Einstellungen…",
+    "contextRemoveFromFolder": "Aus Ordner herausnehmen",
     "newList": "Neue Liste",
     "addReposTip": "Repos als Listen hinzufügen",
-    "noRepoBannerText": "Noch kein Repo verknüpft. ClaudeDo führt Tasks in einem Git-Repo aus.",
+    "noRepoBannerText": "Noch kein Repo verknüpft. ClaudeDo führt Aufgaben in einem Git-Repo aus.",
     "noRepoBannerButton": "Repo importieren",
     "importTicketsResult": "{0} Tickets geprüft, {1} neue Tasks."
   },
   "details": {
     "deleteTaskTip": "Aufgabe löschen",
-    "killSessionTip": "Laufende Sitzung beenden",
+    "killSessionTip": "Laufende Sitzung hart beenden",
     "sendToQueue": "In Warteschlange einreihen",
     "sendToQueueTip": "Diese Aufgabe in die Warteschlange einreihen, damit Claude sie beim nächsten Lauf übernimmt",
     "copyTaskIdTip": "Aufgaben-ID kopieren",
     "starTip": "Favorit",
     "agentSettingsTip": "Agent-Einstellungen",
     "agentSettingsHeading": "Agent-Einstellungen (Überschreibungen)",
+    "waitingOnPrefix": "Wartet auf",
     "copyFormattedTip": "Titel, Beschreibung und offene Schritte kopieren",
     "toggleEditPreviewTip": "Bearbeiten/Vorschau umschalten",
     "planDay": "Tag planen",
+    "importTicketsAndPlanDay": "Tickets + Tag planen",
     "prepEmpty": "Heute noch keine Vorbereitung — klick Tag planen",
     "roadblockReply": {
       "placeholder": "Auf den Roadblock antworten…",
@@ -293,7 +346,41 @@
       "steps": "Schritte",
       "files": "Dateien"
     },
-    "emptyState": "Wähle eine Aufgabe aus, um Details zu sehen"
+    "emptyState": "Wähle eine Aufgabe aus, um Details zu sehen",
+    "roadblockLabel": "ROADBLOCK",
+    "stepsCard": {
+      "preview": "Vorschau",
+      "edit": "Bearbeiten",
+      "addStepPlaceholder": "Schritt hinzufügen…"
+    },
+    "workConsole": {
+      "continue": "Fortsetzen",
+      "resetAndRetry": "Zurücksetzen & erneut versuchen",
+      "tabOutput": "Ausgabe",
+      "tabGit": "Git",
+      "tabSession": "Sitzung",
+      "outcomeLabel": "ERGEBNIS",
+      "reviewLabel": "REVIEW",
+      "mergeLabel": "MERGE",
+      "targetBranch": "Zielbranch",
+      "openDiff": "Diff öffnen",
+      "worktree": "Worktree",
+      "reviewCombinedDiff": "Kombinierten Diff prüfen",
+      "openDiffHint": "Diff öffnen, um Mergen freizuschalten",
+      "targetDirty": "Ziel-Arbeitsverzeichnis hat uncommittete Änderungen — beim Mergen werden sie gestasht und danach wiederhergestellt.",
+      "approveMerge": "Genehmigen & Mergen",
+      "createDraftPr": "Draft-PR erstellen",
+      "updatePr": "PR aktualisieren",
+      "openPr": "Pull Request öffnen",
+      "companyTargetHint": "Firmen-Repo — Genehmigen pusht den Branch und erstellt einen Draft-PR auf Azure DevOps.",
+      "park": "Parken",
+      "parkTip": "Zurückstellen — zurück auf Leerlauf, Worktree bleibt erhalten",
+      "cancel": "Abbrechen",
+      "resetDiscardBranch": "Zurücksetzen (Branch verwerfen)…",
+      "submitForReviewHint": "Von Hand daran gearbeitet? Den Worktree zum Review einreichen, um ihn zu mergen.",
+      "submitForReview": "Zum Review einreichen",
+      "outcomesLabel": "ERGEBNISSE"
+    }
   },
   "agent": {
     "openWorktreeTip": "Worktree im Datei-Explorer öffnen — benötigt einen aktiven Worktree",
@@ -326,19 +413,45 @@
     "empty": "Keine laufenden Aufgaben",
     "settings": "Einstellungen",
     "activity": "Aktivität",
+    "runningNow": "Läuft gerade",
+    "opVerifyMerge": "Prüfung nach Merge",
+    "opVerifyBatch": "Verify (Batch)",
+    "opMerging": "Merge",
+    "opRebasing": "Rebase",
+    "opCreatingWorktree": "Worktree wird erstellt",
+    "operationsRefreshFailed": "Laufende Operationen konnten nicht geladen werden: {0}",
     "blocked": "Blockiert",
     "running": "Läuft",
     "review": "Im Review",
+    "verifying": "Wird geprüft",
     "failed": "Fehlgeschlagen",
     "roadblock": "Blockade gemeldet",
     "openSession": "Sitzung öffnen",
+    "homeFolder": "Home (Schnellsitzung)",
+    "sshTarget": "{0} (SSH)",
+    "customTarget": "{0} (eigenes Tile)",
+    "customProgramNotFound": "Programm „{0}“ nicht gefunden — Namen prüfen oder vollen Pfad angeben (Einstellungen → Eigene Tiles).",
     "browseForFolder": "Ordner wählen…",
+    "recentSessions": "Letzte Sitzungen",
+    "recentSessionsEmpty": "Keine Sitzungen in den letzten 14 Tagen",
+    "resumeSession": "Fortsetzen",
+    "showBrief": "Brief",
+    "renameSession": "Doppelklick zum Umbenennen",
+    "renameFailed": "Sitzung konnte nicht umbenannt werden: {0}",
+    "handoffSession": "Übergabe",
+    "briefOpenFailed": "Brief konnte nicht geöffnet werden: {0}",
     "focusMode": "Fokus",
     "overviewMode": "Übersicht",
-    "closeSession": "Sitzung beenden",
+    "columns": "Spalten",
+    "columnsAuto": "Auto",
+    "closeSession": "Sitzung hart beenden",
+    "closeSessionConfirm": "Laufende Sitzung beenden? Der Claude-Prozess wird abgebrochen.",
     "conptyLaunchFailed": "Interaktive Sitzung konnte nicht geöffnet werden: {0}",
     "conptyStarting": "Sitzung wird gestartet…",
+    "conptyExited": "Sitzung beendet (Code {0}).",
     "usageWarningNotDelivered": "Die Listen-Handler-Sitzung konnte nicht vor dem Usage-Limit gewarnt werden.",
+    "terminalSendFailed": "Konnte nicht an die Terminal-Sitzung gesendet werden.",
+    "deferredHandoffTitleSuffix": "warte auf Limit-Zurücksetzen ({0})",
     "mergeHelperTitle": "Merge-Helfer",
     "mergeHelperHandoffTitleSuffix": " (Übergabe)",
     "mergeHelperTaskTitle": "Listen-Handler: {0}",
@@ -356,7 +469,7 @@
     "queueRefreshFailed": "Warteschlange konnte nicht aktualisiert werden: {0}",
     "abandonRun": "Lauf abbrechen",
     "abandonRunTip": "Die noch offenen Tasks dieses Laufs abbrechen und die Sitzung schließen",
-    "abandonRunConfirm": "{0} offene(n) Task(s) abbrechen und diese Sitzung schließen? Tasks im Review oder bereits erledigt bleiben unangetastet.",
+    "abandonRunConfirm": "{0} offene Aufgabe(n) abbrechen und diese Sitzung schließen? Aufgaben im Review oder bereits erledigt bleiben unangetastet.",
     "abandonRunFailed": "Offene Tasks konnten nicht abgebrochen werden: {0}",
     "question": {
       "title": "Claude fragt nach",
@@ -391,15 +504,28 @@
       "body": "ClaudeDo kann den Hintergrund-Worker nicht erreichen. Normalerweise wird er bei der Anmeldung automatisch gestartet. Du kannst ihn jetzt starten oder neu installieren, falls das Problem bestehen bleibt.",
       "dismiss": "Ausblenden",
       "rerunInstaller": "Installer erneut ausführen",
-      "startWorker": "Worker starten"
+      "startWorker": "Worker starten",
+      "workerNotFound": "Worker-Programm nicht gefunden. Installation prüfen.",
+      "installerNotFound": "Installer nicht gefunden. Installation prüfen.",
+      "startFailed": "Start fehlgeschlagen: {0}"
     },
     "listSettings": {
       "title": "LISTENEINSTELLUNGEN",
+      "folderTitle": "ORDNER",
       "deleteList": "Liste löschen",
+      "deleteFolder": "Ordner löschen",
+      "createAsFolder": "Stattdessen einen Ordner anlegen",
+      "createAsFolderHint": "Ein Ordner gruppiert nur Listen in der Seitenleiste — er enthält keine Aufgaben und führt nichts aus. Listen per Drag-and-Drop hineinziehen.",
       "sectionGeneral": "ALLGEMEIN",
       "name": "Name",
+      "color": "Farbe",
+      "colorHint": "Färbt den Punkt einer Liste bzw. Namen und Führungslinie eines Ordners. Der leere Ring stellt den Standard wieder her.",
+      "colorCustom": "Eigene",
       "workingDirectory": "Arbeitsverzeichnis",
       "workingDirectoryPlaceholder": "(keines)",
+      "baseBranch": "Basis-Branch",
+      "baseBranchPlaceholder": "(ausgecheckter Branch)",
+      "baseBranchHint": "Neue Task-Branches starten hier, und freigegebene Arbeit wird hierhin gemergt, z.B. dev. Leer = der gerade ausgecheckte Branch.",
       "browse": "Durchsuchen...",
       "defaultCommitType": "Standard-Commit-Typ",
       "manualList": "Manuelle Liste (Erinnerungen)",
@@ -407,10 +533,12 @@
       "findingsTracked": "Findings-Ordner .claudedo einchecken",
       "findingsTrackedHint": "Aus: der Ordner bleibt über .git/info/exclude aus git heraus. An: Findings reisen mit dem Repo.",
       "powerUseAllowed": "PowerUse für diese Liste erlauben",
-      "powerUseAllowedHint": "Erlaubt einem List-Handler-Run auf dieser Liste, unbeaufsichtigt zu laufen, sobald PowerUse im Usage-Monitor eingeschaltet ist: er fragt nichts, löst Konflikte selbst und sammelt neue Arbeit. Beide Schalter sind nötig — ein global aktives PowerUse ändert an einer Liste ohne Opt-in also nichts.",
+      "powerUseAllowedHint": "Erlaubt einem List-Handler-Run auf dieser Liste, unbeaufsichtigt zu laufen, sobald PowerUse in Einstellungen → Ausführung eingeschaltet ist: er fragt nichts, löst Konflikte selbst und sammelt neue Arbeit. Beide Schalter sind nötig — ein global aktives PowerUse ändert an einer Liste ohne Opt-in also nichts.",
       "sectionIcon": "ICON",
       "icon": "Listen-Icon",
       "iconHint": "Wird in der Seitenleiste neben dem Listennamen angezeigt.",
+      "iconSearchWatermark": "Alle Icons durchsuchen (Englisch, z.B. rocket, car, bug)",
+      "iconSearchTruncated": "Die ersten 200 Treffer werden angezeigt — Suche verfeinern.",
       "sectionAgent": "AGENT",
       "resetAgentSettings": "Agent-Einstellungen zurücksetzen",
       "sectionVerify": "VERIFIKATION",
@@ -427,7 +555,9 @@
       "targetBranch": "Ziel-Branch",
       "removeWorktree": "Worktree nach dem Mergen entfernen",
       "commitMessage": "Commit-Nachricht",
-      "conflictedFiles": "Konfliktdateien:"
+      "conflictedFiles": "Konfliktdateien:",
+      "stashAndMerge": "Änderungen stashen und mergen",
+      "resolveConflicts": "Konflikte lösen"
     },
     "diff": {
       "title": "DIFF",
@@ -459,6 +589,8 @@
       "resolve": "Lösen",
       "phantom": "Phantom",
       "phantomTooltip": "Verzeichnis fehlt auf der Festplatte",
+      "mergedExternal": "gemergt (extern)",
+      "mergedExternalTooltip": "Die Commits sind schon im Default-Branch (lokaler origin-Stand, ohne Fetch), z.B. per Squash-PR. \"Abgeschlossene aufräumen\" entfernt ihn.",
       "ctxShowDiff": "Diff anzeigen",
       "ctxOpenInExplorer": "Im Explorer öffnen",
       "ctxJumpToTask": "Zur Aufgabe springen",
@@ -483,6 +615,8 @@
       "windowTitle": "Claude machen lassen",
       "scopeList": "Liste: {0}",
       "scopeReview": "Alle Listen — Tasks im Review",
+      "modelLabel": "Modell",
+      "modelTip": "Modell für die Triage-Session (Dedupe & Verfeinern). Spätere Merge-Phasen laufen immer auf Opus.",
       "confirm": "Claude machen lassen",
       "cancel": "Abbrechen",
       "selectAll": "Alle auswählen",
@@ -510,27 +644,27 @@
       "regenerate": "Neu erstellen",
       "emptyStateHint": "Noch kein Bericht für diesen Zeitraum. Klicke auf „Erstellen“."
     },
+    "cheatSheets": {
+      "title": "CHEAT SHEETS",
+      "windowTitle": "Cheat Sheets",
+      "pin": "Anpinnen",
+      "pinTooltip": "Fenster über den anderen halten",
+      "missing": "Cheat Sheet {0} nicht gefunden."
+    },
     "usageMonitor": {
       "title": "USAGE MONITOR",
       "windowTitle": "Usage Monitor",
       "noGauges": "Noch keine Nutzungslimits gemeldet.",
-      "powerUse": "PowerUse",
+      "refreshHint": "Jetzt aktualisieren — Abruf alle 5 Min., während ein Task läuft, sonst alle 15 Min.",
-      "powerUseHint": "Das restliche Fenster ausnutzen: ein List-Handler-Run fragt nichts, löst Konflikte selbst, sammelt neue Arbeit und handoffet weiter, solange sein Budget reicht. Wirkt nur auf Listen, die PowerUse in ihren Listen-Einstellungen erlaubt haben.",
-      "powerUseWindow": "Nur zwischen",
-      "powerUseWindowPlaceholder": "HH:mm",
-      "powerUseHandoffPct": "Übergabe bei (% von 5h)",
-      "powerUseWindowHint": "Beide Zeiten leer = rund um die Uhr. Das Fenster wird bei jedem Start einer Handler-Phase geprüft — eine Kette, die über das Ende hinausläuft, macht ohne PowerUse weiter.",
-      "refresh": "Jetzt aktualisieren",
-      "refreshHint": "Abruf alle 5 Min., während ein Task läuft, sonst alle 15 Min.",
       "staleFormat": "Werte veraltet (Stand {0})",
-      "staleGateHint": "Das Gate greift in diesem Zustand nicht.",
+      "staleGateHint": "Der Limit-Stopp greift in diesem Zustand nicht.",
       "gateBlockedFormat": "Warteschlange pausiert — {0}",
       "throttleFormat": "Warteschlange gedrosselt: {0}/{1} Slots ({2})",
       "resetIn": "Reset in {0} ({1})",
       "dragHint": "Marker ziehen oder Wert unten eintragen.",
       "legendSoft": "Soft · 2 Slots",
       "legendHard": "Hard · 1 Slot",
-      "legendGate": "Gate · Pause",
+      "legendGate": "Limit-Stopp · Pause",
       "gaugeSession": "Session (5 Std.)",
       "gaugeWeeklyAll": "Woche (alle Modelle)",
       "gaugeWeeklyScopedFormat": "Woche ({0})",
@@ -550,7 +684,7 @@
       "columnOtherOut": "ÜBRIGES OUT",
       "columnOtherCache": "ÜBRIGES CACHE",
       "columnShare": "ANTEIL",
-      "columnTask": "TASK",
+      "columnTask": "AUFGABE",
       "columnList": "LISTE",
       "columnModelShort": "MODELL",
       "columnRuns": "RUNS",
@@ -654,35 +788,61 @@
   "checks": {
     "git": {
       "title": "Git",
-      "hint": "Installiere Git und stelle sicher, dass es im PATH liegt."
+      "hint": "Installiere Git von https://git-scm.com/downloads und starte den Installer neu.",
+      "notFound": "git wurde nicht im PATH gefunden.",
+      "exitCode": "'{0}' wurde mit Exitcode {1} beendet.",
+      "resolvedFormat": "{0} — {1}"
     },
     "gitIdentity": {
       "title": "Git-Identität",
-      "hint": "Lege deine Git-Identität fest: git config --global user.name \"...\" und user.email \"...\"."
+      "hint": "Führe aus: git config --global user.name \"Dein Name\" und git config --global user.email \"du@example.com\"",
+      "notFound": "git wurde nicht gefunden — Identität konnte nicht geprüft werden.",
+      "missing": "Fehlende Git-Identität: {0}."
     },
     "ports": {
       "title": "Ports",
-      "hint": "Gib den Port frei oder ändere ihn nach der Installation auf der Worker-Seite."
+      "hint": "Ändere die SignalR-/MCP-Ports auf der Dienste-Seite, oder beende den blockierenden Prozess.",
+      "inUse": "{0}-Port {1} ist belegt.",
+      "inUseBy": "{0}-Port {1} ist belegt von '{2}'.",
+      "inUseByOwnWorker": "Belegt vom laufenden ClaudeDo Worker: {0}.",
+      "available": "Ports sind verfügbar."
     },
     "writeAccess": {
       "title": "Schreibzugriff",
-      "hint": "Wähle ein anderes Installationsverzeichnis oder starte den Installer als Administrator."
+      "hint": "Wähle ein anderes Installationsverzeichnis oder starte den Installer mit ausreichenden Rechten (z. B. als Administrator).",
+      "cannotWrite": "Kein Schreibzugriff auf '{0}': {1}",
+      "writable": "Installations- und Datenverzeichnis sind beschreibbar."
     },
     "claudeCli": {
       "title": "Claude CLI",
-      "hint": "Installiere die Claude CLI und stelle sicher, dass sie im PATH liegt."
+      "hint": "Installiere die Claude CLI (npm install -g @anthropic-ai/claude-code) und starte danach dein Terminal/deine Anmeldesitzung neu, damit der aktualisierte PATH greift.",
+      "notFound": "'{0}' wurde nicht im PATH gefunden. Durchsucht: {1}.",
+      "exitCode": "'{0}' wurde mit Exitcode {1} beendet.",
+      "resolvedFormat": "{0} — {1}"
     },
     "claudeVersion": {
       "title": "Claude-CLI-Version",
-      "hint": "Aktualisiere die Claude CLI auf eine neuere Version."
+      "hint": "Aktualisiere die CLI: npm update -g @anthropic-ai/claude-code",
+      "notFound": "Die claude-CLI wurde nicht gefunden — Version konnte nicht geprüft werden.",
+      "parseFailed": "Konnte keine Version aus '{0}' auslesen.",
+      "tooOld": "claude {0} ist älter als die erforderliche Version {1}.",
+      "ok": "claude {0} erfüllt die Mindestanforderung ({1})."
     },
     "claudeAuth": {
-      "title": "Claude-Anmeldung",
+      "title": "Claude-CLI-Login",
-      "hint": "Führe 'claude auth login' aus, um dich anzumelden."
+      "hint": "Starte 'claude' einmal und schließe den Login-Vorgang ab.",
+      "notFound": "Die claude-CLI wurde nicht gefunden — Login konnte nicht geprüft werden.",
+      "undetermined": "Login-Status konnte nicht ermittelt werden.",
+      "notLoggedIn": "Nicht angemeldet.",
+      "loggedIn": "Angemeldet."
     },
     "permissionModeAuto": {
       "title": "Berechtigungsmodus",
-      "hint": "Aktualisiere die Claude CLI auf eine Version, die --permission-mode auto unterstützt."
+      "hint": "Aktualisiere die CLI: npm update -g @anthropic-ai/claude-code. ClaudeDo funktioniert auch im Modus acceptEdits/default, dann mit mehr Rückfragen.",
+      "notFound": "Die claude-CLI wurde nicht gefunden — Unterstützung für permission-mode konnte nicht geprüft werden.",
+      "undetermined": "Konnte nicht ermitteln, ob --permission-mode auto unterstützt wird.",
+      "ok": "--permission-mode auto wird von dieser CLI erkannt.",
+      "notListed": "Diese claude-CLI-Version listet 'auto' nicht als --permission-mode-Option."
     }
   },
   "planning": {
@@ -710,6 +870,9 @@
     "abort": "Merge abbrechen"
   },
   "controls": {
+    "markdown": {
+      "copy": "Befehl kopieren"
+    },
     "datePicker": {
       "today": "Heute",
       "tomorrow": "Morgen",
@@ -719,6 +882,14 @@
       "done": "Fertig"
     }
   },
+  "dialog": {
+    "cancel": "Abbrechen",
+    "confirm": "Bestätigen",
+    "delete": "Löschen",
+    "ok": "OK",
+    "confirmTitle": "Bestätigen",
+    "errorTitle": "Fehler"
+  },
   "shell": {
     "menu": {
       "help": "Hilfe",
@@ -726,9 +897,18 @@
       "repositories": "Repositories",
       "checkForUpdates": "Nach Updates suchen",
       "restartWorker": "Worker neu starten",
+      "updateClaudeCli": "Claude CLI aktualisieren",
+      "shutdown": "Beenden",
       "worktrees": "Worktrees…",
       "weeklyReport": "Wochenbericht…",
       "usageMonitor": "Usage Monitor…",
+      "cheatSheets": "Cheat Sheets",
+      "cheatSheetGit": "Git…",
+      "cheatSheetCommits": "Conventional Commits…",
+      "cheatSheetClaude": "Claude CLI…",
+      "cheatSheetClaudeConfig": "Claude-Konfiguration…",
+      "cheatSheetDotnet": "dotnet CLI…",
+      "cheatSheetPowershell": "PowerShell…",
       "about": "Über…",
       "addRepos": "Repos als Listen hinzufügen…"
     },
@@ -744,10 +924,10 @@
   },
   "vm": {
     "connection": { "online": "Online", "connecting": "Verbinden…", "offline": "Offline" },
-    "shell": { "restartingWorker": "Worker wird neu gestartet…", "unexpectedError": "Unerwarteter Fehler: {0}" },
+    "shell": { "unexpectedError": "Unerwarteter Fehler: {0}", "updatingClaudeCli": "Claude CLI wird aktualisiert…", "shutdownConfirm": "Dadurch wird der ClaudeDo-Worker beendet (laufende Task-Runs und interaktive Sitzungen brechen ab) und die App geschlossen. Fortfahren?" },
     "mainWindow": { "closeConfirm": { "message": "{0} Mission-Control-Sitzung(en) laufen noch. Beim Beenden werden sie abgebrochen. Trotzdem schließen?" } },
     "agentStatus": { "idle": "Leerlauf", "queued": "In Warteschlange", "running": "Läuft", "review": "Prüfung", "children": "Wartet auf Teilaufgaben", "done": "Fertig", "failed": "Fehlgeschlagen", "cancelled": "Abgebrochen" },
-    "taskStatus": { "idle": "Leerlauf", "queued": "In Warteschlange", "running": "Läuft", "waitingForReview": "Wartet auf Prüfung", "waitingForChildren": "Wartet auf Teilaufgaben", "done": "Fertig", "failed": "Fehlgeschlagen", "cancelled": "Abgebrochen", "parked": "Geparkt", "interactive": "Interaktiv" },
+    "taskStatus": { "idle": "Leerlauf", "queued": "In Warteschlange", "running": "Läuft", "waitingForReview": "Wartet auf Prüfung", "waitingForChildren": "Wartet auf Teilaufgaben", "done": "Fertig", "failed": "Fehlgeschlagen", "cancelled": "Abgebrochen", "parked": "Geparkt", "interactive": "Interaktiv", "waiting": "Wartet" },
     "failureReason": { "maxTurns": "Turn-Limit erreicht", "timeout": "Zeitüberschreitung", "usageLimit": "Nutzungslimit erreicht", "error": "Fehler", "cancelled": "Abgebrochen", "unknown": "Grund unbekannt" },
     "failureReasonTooltip": { "maxTurns": "Turn-Limit erreicht ({0}/{1} Turns) — der Worktree ist meist brauchbar; Task fortsetzen statt zurücksetzen." },
     "planningBadge": { "active": "PLANUNG", "finalized": "GEPLANT" },
@@ -756,16 +936,15 @@
     "tasksIsland": { "completedHeader": "ABGESCHLOSSEN", "completedHeaderCount": "ABGESCHLOSSEN · {0}", "statusPill": "{0} laufend · {1} Prüfung", "openTaskOne": "1 offene Aufgabe", "openTasks": "{0} offene Aufgaben", "planningResumeFailed": "Planungssitzung konnte nicht fortgesetzt werden: {0}", "approveFailed": "Genehmigen & Mergen fehlgeschlagen: {0}", "cancelReviewFailed": "Prüfung abbrechen fehlgeschlagen: {0}", "sendToQueueFailed": "In die Warteschlange stellen fehlgeschlagen: {0}", "queuePlanBlockedInteractive": "Plan kann nicht in die Warteschlange gestellt werden — {0} hat eine offene interaktive Sitzung und muss zuerst geschlossen werden.", "moveRunningRejected": "Ein laufender Task kann nicht in eine andere Liste verschoben werden.", "moveWorktreeRejected": "Verschieben nicht möglich — dieser Task hat einen aktiven Worktree, der auf sein aktuelles Repo zeigt.", "moveRepoConfirm": "Unterschiedliche Repos — {0} → {1}. Task trotzdem verschieben?", "moveConfirmUnavailable": "Verschieben nicht möglich — der Bestätigungsdialog ist nicht verfügbar.", "quickClaudeNoWorkingDir": "Für diese Liste ist kein Arbeitsverzeichnis konfiguriert.", "quickClaudeDirMissing": "Arbeitsverzeichnis existiert nicht mehr: {0}", "setStatusFailed": "Status konnte nicht aktualisiert werden: {0}", "cancelFailed": "Abbrechen fehlgeschlagen: {0}", "rejectToQueueFailed": "Zurückweisen in die Warteschlange fehlgeschlagen: {0}", "rejectToIdleFailed": "Zurückweisen fehlgeschlagen: {0}", "deleteTaskConfirm": "\"{0}\" löschen? Dies kann nicht rückgängig gemacht werden.", "deleteTaskFailed": "Löschen fehlgeschlagen: {0}", "toggleDoneFailed": "Erledigt-Status konnte nicht aktualisiert werden: {0}", "removeFromQueueFailed": "Aus der Warteschlange entfernen fehlgeschlagen: {0}", "openWorktreeFailed": "Worktree konnte nicht geöffnet werden: {0}" },
     "diff": { "loadFailed": "Diff konnte nicht geladen werden: {0}", "noChanges": "Keine Änderungen anzuzeigen.", "unavailable": "Diff nicht mehr verfügbar — Commit-Bereich unvollständig." },
     "planningDiff": { "hubError": "Kombinierte Vorschau konnte nicht erstellt werden (Hub-Fehler).", "conflict": "Kombinierte Vorschau nicht möglich: Teilaufgabe {0} steht im Konflikt mit einer früheren Teilaufgabe ({1} Dateien).", "buildFailed": "Kombinierte Vorschau konnte nicht erstellt werden: {0}" },
-    "merge": { "commitMessage": "chore: merge {0}", "progressMerging": "Wird zusammengeführt…", "progressVerifying": "Verify-Kommando der Liste läuft… ({0})", "workerOfflineBranches": "Worker offline — Branches können nicht aufgelistet werden.", "loadBranchesFailed": "Branches konnten nicht geladen werden: {0}", "merged": "Zusammengeführt.", "blocked": "Blockiert: {0}", "verifyFailed": "Merge ist gelandet, aber das Verify-Kommando der Liste ist fehlgeschlagen — die Aufgabe wurde nicht auf Erledigt gesetzt.", "untrackedCollision": "Merge abgelehnt — er würde eine unversionierte Datei im Ziel-Arbeitsverzeichnis überschreiben.", "unknownStatus": "Unbekannter Status: {0}", "mergeFailed": "Merge fehlgeschlagen: {0}" },
+    "merge": { "commitMessage": "chore: merge {0}", "progressMerging": "Wird zusammengeführt…", "progressVerifying": "Verify-Kommando der Liste läuft… ({0})", "workerOfflineBranches": "Worker offline — Branches können nicht aufgelistet werden.", "loadBranchesFailed": "Branches konnten nicht geladen werden: {0}", "merged": "Zusammengeführt.", "blocked": "Blockiert: {0}", "verifyFailed": "Merge ist gelandet, aber das Verify-Kommando der Liste ist fehlgeschlagen — die Aufgabe wurde nicht auf Erledigt gesetzt.", "untrackedCollision": "Merge abgelehnt — er würde eine unversionierte Datei im Ziel-Arbeitsverzeichnis überschreiben.", "dirtyTarget": "Merge abgelehnt — das Ziel-Arbeitsverzeichnis hat uncommittete Änderungen.", "targetDirty": "Das Ziel-Arbeitsverzeichnis hat bereits uncommittete Änderungen — stashen und mergen?", "unknownStatus": "Unbekannter Status: {0}", "mergeFailed": "Merge fehlgeschlagen: {0}" },
     "settingsModal": { "workerOffline": "Worker offline — Einstellungen schreibgeschützt.", "saveFailed": "Speichern fehlgeschlagen: {0}" },
     "onlineInbox": { "workerOffline": "Worker offline — Konfiguration kann nicht geladen werden.", "saved": "Konfiguration gespeichert.", "saveFailed": "Speichern fehlgeschlagen: {0}", "signedIn": "Erfolgreich angemeldet.", "signedInNoRole": "Angemeldet, aber diesem Konto fehlt die Rolle 'user' in Zitadel — die Online-Synchronisierung wird abgelehnt, bis die Rolle im ClaudeDo-Projekt zugewiesen wird.", "signInFailed": "Anmeldung fehlgeschlagen: {0}", "signedOut": "Abgemeldet.", "signOutFailed": "Abmeldung fehlgeschlagen: {0}" },
-    "tickets": { "connectionOk": "Verbunden als {0}.", "connectionMissingScopes": "Verbunden als {0}, aber es fehlen Scopes: {1}", "tokenCleared": "Token entfernt.", "workerOffline": "Worker nicht erreichbar." },
+    "tickets": { "azdoConnectionOk": "Verbunden — Repo {0}, Default-Branch {1}.", "connectionOk": "Verbunden als {0}.", "connectionMissingScopes": "Verbunden als {0}, aber es fehlen Scopes: {1}", "tokenCleared": "Token entfernt.", "workerOffline": "Worker nicht erreichbar." },
     "weeklyReport": { "invalidRange": "Ungültiger Datumsbereich.", "error": "Fehler: {0}" },
     "usageMonitor": {
       "loadFailed": "Nutzungsdaten konnten nicht geladen werden: {0}",
       "refreshFailed": "Nutzung konnte nicht aktualisiert werden: {0}",
       "thresholdSaveFailed": "Grenze konnte nicht gespeichert werden: {0}",
-      "powerUseSaveFailed": "PowerUse-Schalter konnte nicht gespeichert werden: {0}",
       "installStarted": "TokenTracker wird installiert — der Fortschritt läuft in der Log-Leiste.",
       "installFailed": "TokenTracker konnte nicht installiert werden: {0}",
       "analyticsRefreshFailed": "Die Auswertung konnte nicht aktualisiert werden: {0}",
@@ -776,18 +955,19 @@
     "sessionSkillsTab": { "installed": "Installiert: {0}", "installFailed": "Installation fehlgeschlagen: {0}", "updated": "Aktualisiert.", "updateFailed": "Aktualisierung fehlgeschlagen: {0}", "removed": "Entfernt.", "removeFailed": "Entfernen fehlgeschlagen: {0}" },
     "worktreesTab": { "workerOffline": "Worker offline.", "removed": "{0} Worktree(s) entfernt.", "blocked": "Zwangsentfernung nicht möglich: {0} Aufgabe(n) laufen noch. Brich sie zuerst ab.", "removedFrom": "{0} Worktree(s) von {1} Aufgabe(n) entfernt.", "cleanupFailed": "Aufräumen fehlgeschlagen: {0}", "resetFailed": "Zurücksetzen fehlgeschlagen: {0}" },
     "worktreesOverview": { "titleAll": "Worktrees", "titleList": "Worktrees — {0}", "listFallback": "Liste", "cleanupFailed": "Aufräumen fehlgeschlagen.", "cleanupFailedDetailed": "Aufräumen fehlgeschlagen: {0}", "removed": "{0} Worktree(s) entfernt.", "discardConfirm": "Worktree für \"{0}\" verwerfen? Nicht committete Arbeit geht verloren.", "discardFailed": "Worktree konnte nicht verworfen werden.", "keepFailed": "Worktree konnte nicht behalten werden.", "cannotForceRunning": "Eine laufende Aufgabe kann nicht zwangsweise entfernt werden.", "forceRemoveFailed": "Zwangsentfernung fehlgeschlagen.", "forceRemoveFailedDetailed": "Zwangsentfernung fehlgeschlagen: {0}", "batchDone": "{0} gemergt, {1} zu lösen.", "openInExplorerFailed": "Pfad konnte nicht geöffnet werden: {0}" },
-    "listSettings": { "untitled": "Unbenannt", "ticketProjectNone": "— keins —", "loadFailed": "Listeneinstellungen konnten nicht geladen werden: {0}", "ticketProjectsLoadFailed": "Ticket-Projekte konnten nicht geladen werden: {0}" },
+    "listSettings": { "untitled": "Unbenannt", "ticketProjectNone": "— keins —", "loadFailed": "Listeneinstellungen konnten nicht geladen werden: {0}", "ticketProjectsLoadFailed": "Ticket-Projekte konnten nicht geladen werden: {0}", "confirmDeleteFolder": "Ordner \"{0}\" löschen? Die Listen und Unterordner darin bleiben erhalten und wandern auf die oberste Ebene.", "confirmDeleteList": "Liste \"{0}\" und alle ihre Aufgaben löschen? Das kann nicht rückgängig gemacht werden.", "deleteBlockedPlanning": "Diese Liste hat Planungssitzungen mit Kind-Aufgaben. Erst diese verwerfen, dann die Liste löschen.", "workingDirMissing": "Dieser Ordner existiert nicht.", "workingDirNotRepo": "Dieser Ordner ist noch kein Git-Repository. Führe darin zuerst `git init` aus, oder leere das Arbeitsverzeichnis, um dies als manuelle Liste zu speichern." },
-    "detailsIsland": { "verifyFailed": "Merge ist erfolgt, aber das Verifikationskommando der Liste ist fehlgeschlagen — die Aufgabe wurde nicht auf 'Erledigt' gesetzt.", "untrackedCollision": "Merge abgelehnt — er würde eine unversionierte Datei im Ziel-Arbeitsverzeichnis überschreiben.", "stopOffline": "Worker offline — Task kann nicht gestoppt werden.", "stopFailed": "Stoppen fehlgeschlagen: {0}", "enqueueFailed": "In die Warteschlange stellen fehlgeschlagen: {0}", "dequeueFailed": "Aus der Warteschlange entfernen fehlgeschlagen: {0}", "resetAndRetryFailed": "Zurücksetzen & erneut versuchen fehlgeschlagen: {0}", "toggleDoneFailed": "Erledigt-Status konnte nicht aktualisiert werden: {0}" },
+    "detailsIsland": { "verifyFailed": "Merge ist erfolgt, aber das Verifikationskommando der Liste ist fehlgeschlagen — die Aufgabe wurde nicht auf 'Erledigt' gesetzt.", "untrackedCollision": "Merge abgelehnt — er würde eine unversionierte Datei im Ziel-Arbeitsverzeichnis überschreiben.", "dirtyTarget": "Merge abgelehnt — das Ziel-Arbeitsverzeichnis hat uncommittete Änderungen.", "stashAndMergeConfirm": "Das Ziel-Arbeitsverzeichnis hat uncommittete Änderungen.\nStashen, mergen und danach wiederherstellen?", "stopOffline": "Worker offline — Task kann nicht gestoppt werden.", "stopFailed": "Stoppen fehlgeschlagen: {0}", "enqueueFailed": "In die Warteschlange stellen fehlgeschlagen: {0}", "dequeueFailed": "Aus der Warteschlange entfernen fehlgeschlagen: {0}", "resetAndRetryFailed": "Zurücksetzen & erneut versuchen fehlgeschlagen: {0}", "toggleDoneFailed": "Erledigt-Status konnte nicht aktualisiert werden: {0}" },
     "mergeSection": { "openWorktreeFailed": "Worktree konnte nicht geöffnet werden: {0}" },
     "about": { "openPathFailed": "Pfad konnte nicht geöffnet werden: {0}" },
     "lists": { "localSuffix": "{0} / lokal", "smartMyDay": "Mein Tag", "smartImportant": "Wichtig", "smartPlanned": "Geplant", "smartNotes": "Notizen", "virtualQueue": "Warteschlange", "virtualRunning": "Läuft", "virtualReview": "Prüfung", "newList": "Neue Liste", "findingsNotFound": "Für diese Liste gibt es noch keine Findings.", "findingsOpenFailed": "Findings-Ordner konnte nicht geöffnet werden: {0}", "openInExplorerFailed": "Pfad konnte nicht geöffnet werden: {0}" },
-    "repoImport": { "loadFailed": "Gespeicherte Ordner konnten nicht geladen werden: {0}", "saveFailed": "Ordner konnten nicht gespeichert werden: {0}" }
+    "repoImport": { "loadFailed": "Gespeicherte Ordner konnten nicht geladen werden: {0}", "saveFailed": "Ordner konnten nicht gespeichert werden: {0}", "createButton": "{0} Liste(n) erstellen" }
   },
   "ops": {
     "stalledHint": "Läuft weiter — Worker antwortet noch",
     "merge": {
       "merging": "Wird zusammengeführt…",
-      "verifying": "Verify-Kommando der Liste läuft… ({0})"
+      "verifying": "Verify-Kommando der Liste läuft… ({0})",
+      "publishing": "Push und Draft-PR laufen…"
     },
     "diff": {
       "parsing": "Diff wird geparst…"
@@ -821,7 +1001,8 @@
     },
     "reports": {
       "generatingWeekly": "Bericht wird erstellt…",
-      "runningDailyPrep": "Tagesvorbereitung läuft…"
+      "runningDailyPrep": "Tagesvorbereitung läuft…",
+      "runningTicketImport": "Tickets werden importiert, danach Tagesplanung…"
     },
     "planning": {
       "finalizing": "Plan wird finalisiert…",
@@ -849,39 +1030,5 @@
       "lastError": "Letzter Fehler: {0}",
       "throttled": "Gedrosselt: {0}/{1} Slots ({2})"
     }
-  },
-  "checks": {
-    "git": {
-      "title": "Git",
-      "hint": "Installiere Git von https://git-scm.com/downloads und starte den Installer neu."
-    },
-    "gitIdentity": {
-      "title": "Git-Identität",
-      "hint": "Führe aus: git config --global user.name \"Dein Name\" und git config --global user.email \"du@example.com\""
-    },
-    "ports": {
-      "title": "Ports",
-      "hint": "Ändere die SignalR-/MCP-Ports auf der Dienste-Seite, oder beende den blockierenden Prozess."
-    },
-    "writeAccess": {
-      "title": "Schreibzugriff",
-      "hint": "Wähle ein anderes Installationsverzeichnis oder starte den Installer mit ausreichenden Rechten (z. B. als Administrator)."
-    },
-    "claudeCli": {
-      "title": "Claude CLI",
-      "hint": "Installiere die Claude CLI (npm install -g @anthropic-ai/claude-code) und starte danach dein Terminal/deine Anmeldesitzung neu, damit der aktualisierte PATH greift."
-    },
-    "claudeVersion": {
-      "title": "Claude-CLI-Version",
-      "hint": "Aktualisiere die CLI: npm update -g @anthropic-ai/claude-code"
-    },
-    "claudeAuth": {
-      "title": "Claude-CLI-Login",
-      "hint": "Starte 'claude' einmal und schließe den Login-Vorgang ab."
-    },
-    "permissionModeAuto": {
-      "title": "Unterstützung für --permission-mode auto",
-      "hint": "Aktualisiere die CLI: npm update -g @anthropic-ai/claude-code. ClaudeDo funktioniert auch im Modus acceptEdits/default, dann mit mehr Rückfragen."
-    }
   }
 }

src/ClaudeDo.Localization/locales/en.json

@@ -11,11 +11,14 @@
       "categoryGeneral": "General",
       "categoryExecution": "Execution",
       "categoryPrime": "Prime Claude",
+      "categoryPrimeHint": "Scheduled Claude runs: Ping, Fill My Day, or a custom prompt, at fixed times.",
       "categoryWorktrees": "Worktrees",
       "categoryFiles": "Files & Prompts",
       "categorySkills": "Session Skills",
       "categoryReports": "Reports",
-      "categoryTickets": "Ticket system"
+      "categoryTickets": "External services",
+      "categorySsh": "SSH workspaces",
+      "categoryCustomTiles": "Custom tiles"
     },
     "repoHint": {
       "text": "Only takes effect once a repo is linked.",
@@ -27,6 +30,7 @@
       "model": "Model",
       "maxTurns": "Max turns",
       "effort": "Effort",
+      "effortHint": "Reasoning effort the model applies. Higher costs more and reasons deeper.",
       "modelPresets": "Per-model defaults",
       "modelPresetsHint": "Reasoning effort and turn budget used when a session runs under that model. List- and task-level max-turn overrides still win.",
       "maxTurnsCeiling": "Max turns ceiling",
@@ -43,6 +47,14 @@
       "autoContinueOnUsageLimitHint": "When a run stops because it hit the usage limit, automatically continue it once the 5-hour window resets. Also wakes the paused queue exactly at reset time instead of waiting for the next backstop check.",
       "listHandlerMaxHandoffs": "List-handler handoff budget",
       "listHandlerMaxHandoffsHint": "How many wait/merge handoffs one \"Let Claude handle it\" run may chain. 4 means two merge rounds. Raise it for runs meant to keep going for hours; it bounds a runaway chain, so it cannot be 0.",
+      "powerUseHeading": "PowerUse",
+      "powerUse": "Enable PowerUse",
+      "powerUseHint": "Spend the rest of the window: a list-handler run asks nothing, resolves conflicts itself, harvests new work, and keeps handing off for as long as its budget allows. Only affects lists that allowed PowerUse in their list settings.",
+      "powerUseWindow": "Only between",
+      "powerUseWindowPlaceholder": "HH:mm",
+      "powerUseHandoffPct": "Hand off at (% of 5h)",
+      "powerUseWindowHint": "Leave both times empty for round the clock. A window is checked whenever a handler phase starts, so a chain that runs past the end time continues without PowerUse.",
+      "powerUseWindowInvalid": "PowerUse window times must be HH:mm, or left blank.",
       "throttleStagesHeading": "Throttle stages",
       "throttleStagesHint": "Parallelism is capped before the hard gate: soft caps at 2 slots, hard at 1. Edited by dragging the markers on the usage-monitor gauges. Opening the monitor closes these settings — save first if you changed anything.",
       "throttleStagesValues": "5h: soft {0}% / hard {1}%  ·  7d: soft {2}% / hard {3}%",
@@ -102,10 +114,11 @@
       "actionPing": "Ping",
       "actionFillMyDay": "Fill My Day",
       "actionCustom": "Custom prompt",
-      "actionHint": "Ping only opens the usage window. Fill My Day runs the daily prep. Custom runs your own prompt with the ClaudeDo tools.",
+      "actionImportTickets": "Tickets + plan day",
+      "actionHint": "Ping only opens the usage window. Fill My Day runs the daily prep. Tickets + plan day first imports your assigned tickets into the matching lists, then runs the daily prep. Custom runs your own prompt with the ClaudeDo tools.",
       "customPromptLabel": "Prompt",
       "customPromptPlaceholder": "The full prompt to run for this schedule (required)",
-      "maxTasksDisabledHint": "Only applies to Fill My Day schedules.",
+      "maxTasksDisabledHint": "Only applies to Fill My Day and Tickets + plan day schedules.",
       "promptOverrideLabel": "Prompt addition",
       "promptOverridePlaceholder": "Extra instructions appended to the daily prep prompt for this schedule (optional)",
       "dayMo": "Mo",
@@ -137,12 +150,46 @@
       "saveButton": "Save config"
     },
     "tickets": {
+      "ticketSection": "TICKET SYSTEM",
+      "azdoSection": "AZURE DEVOPS",
+      "azdoToken": "Personal access token (scope: Code read & write)",
+      "azdoHint": "Used in company repos (origin on the Azure DevOps Server): fetch before a task starts, push and draft PR on approve.",
       "baseUrl": "API base URL",
       "baseUrlHint": "Leave empty to disable the ticket integration entirely.",
       "token": "Personal access token",
       "tokenSet": "stored",
       "testConnection": "Test connection",
-      "clearToken": "Remove token"
+      "clearToken": "Remove token",
+      "fallbackList": "Fallback list",
+      "fallbackListHint": "Imported ticket items Claude can't match to a list land here. None = they are skipped.",
+      "fallbackNone": "(none)"
+    },
+    "ssh": {
+      "hint": "Servers you can start an interactive Claude session on from Mission Control. Host is an alias from ~/.ssh/config (user, key and port come from there); Claude must be installed and logged in on the server.",
+      "name": "Name",
+      "host": "Host alias",
+      "remotePath": "Remote path (/… or ~/…)",
+      "add": "Add workspace",
+      "remove": "Remove",
+      "invalid": {
+        "name": "SSH workspace: name is required.",
+        "host": "SSH workspace \"{0}\": host must be an ssh alias (letters, digits, . _ @ -, not starting with -).",
+        "path": "SSH workspace \"{0}\": remote path must start with / or ~ and must not contain '."
+      }
+    },
+    "customTiles": {
+      "hint": "Console programs Mission Control can open as a tile (e.g. pwsh, ssh lenovo-server, lazygit). Arguments are split on spaces; quote an argument that contains one. Leave the folder empty to pick it when starting the tile.",
+      "name": "Name",
+      "program": "Program",
+      "arguments": "Arguments",
+      "folder": "Folder (optional)",
+      "pickFolder": "Choose folder",
+      "add": "Add tile",
+      "remove": "Remove",
+      "invalid": {
+        "name": "Custom tile: name is missing.",
+        "program": "Custom tile \"{0}\": program is missing."
+      }
     },
     "inherit": {
       "inheritedFromList": "inherited · List",
@@ -191,6 +238,7 @@
     "ctxMarkAs": "Mark as",
     "ctxMarkDone": "Done",
     "ctxMarkCancelled": "Cancelled",
+    "ctxMarkIdle": "Idle",
     "ctxOpenConPtySession": "Open interactive session",
     "ctxOpenWorktree": "Open worktree",
     "ctxOpenPlanningSession": "Open planning Session",
@@ -232,6 +280,7 @@
     "toggleSubtasksTip": "Expand / collapse subtasks",
     "agentSuggestedTip": "Suggested by the agent",
     "interactiveChipTip": "Interactive session open — click to jump to it in Mission Control",
+    "waitingOnTip": "Waiting on {0}",
     "scheduleTitle": "Schedule task",
     "scheduleWhen": "WHEN",
     "scheduleConfirm": "Schedule",
@@ -253,6 +302,8 @@
     "contextOpenFindings": "Open findings folder",
     "contextImportTickets": "Update from ticket system",
     "contextSettings": "Settings…",
+    "contextFolderSettings": "Folder settings…",
+    "contextRemoveFromFolder": "Move out of folder",
     "newList": "New list",
     "addReposTip": "Add repos as lists",
     "noRepoBannerText": "No repo linked yet. ClaudeDo runs tasks in a git repo.",
@@ -268,9 +319,11 @@
     "starTip": "Star",
     "agentSettingsTip": "Agent settings",
     "agentSettingsHeading": "Agent settings (overrides)",
+    "waitingOnPrefix": "Waiting on",
     "copyFormattedTip": "Copy title, description and open steps",
     "toggleEditPreviewTip": "Toggle edit/preview",
     "planDay": "Plan day",
+    "importTicketsAndPlanDay": "Tickets + plan day",
     "prepEmpty": "No prep run today yet — click Plan day",
     "roadblockReply": {
       "placeholder": "Reply to the roadblock…",
@@ -293,7 +346,41 @@
       "steps": "Steps",
       "files": "Files"
     },
-    "emptyState": "Select a task to see its details"
+    "emptyState": "Select a task to see its details",
+    "roadblockLabel": "ROADBLOCK",
+    "stepsCard": {
+      "preview": "Preview",
+      "edit": "Edit",
+      "addStepPlaceholder": "Add step…"
+    },
+    "workConsole": {
+      "continue": "Continue",
+      "resetAndRetry": "Reset & Retry",
+      "tabOutput": "Output",
+      "tabGit": "Git",
+      "tabSession": "Session",
+      "outcomeLabel": "OUTCOME",
+      "reviewLabel": "REVIEW",
+      "mergeLabel": "MERGE",
+      "targetBranch": "Target branch",
+      "openDiff": "Open Diff",
+      "worktree": "Worktree",
+      "reviewCombinedDiff": "Review Combined Diff",
+      "openDiffHint": "Open the diff to enable merge",
+      "targetDirty": "Target working directory has uncommitted changes — merging will stash and restore them.",
+      "approveMerge": "Approve & Merge",
+      "createDraftPr": "Create draft PR",
+      "updatePr": "Update PR",
+      "openPr": "Open pull request",
+      "companyTargetHint": "Company repo — approve pushes the branch and opens a draft PR on Azure DevOps.",
+      "park": "Park",
+      "parkTip": "Set aside — back to Idle, keeps the worktree",
+      "cancel": "Cancel",
+      "resetDiscardBranch": "Reset (discard branch)…",
+      "submitForReviewHint": "Worked on this by hand? Submit the worktree for review to merge it.",
+      "submitForReview": "Submit for review",
+      "outcomesLabel": "OUTCOMES"
+    }
   },
   "agent": {
     "openWorktreeTip": "Open worktree in file explorer — requires an active worktree",
@@ -326,19 +413,45 @@
     "empty": "No running tasks",
     "settings": "Settings",
     "activity": "Activity",
+    "runningNow": "Running now",
+    "opVerifyMerge": "Verifying after merge",
+    "opVerifyBatch": "Verify (batch)",
+    "opMerging": "Merging",
+    "opRebasing": "Rebasing",
+    "opCreatingWorktree": "Creating worktree",
+    "operationsRefreshFailed": "Couldn't load running operations: {0}",
     "blocked": "Blocked",
     "running": "Running",
     "review": "In review",
+    "verifying": "Verifying",
     "failed": "Failed",
     "roadblock": "Roadblock reported",
     "openSession": "Open session",
+    "homeFolder": "Home (quick session)",
+    "sshTarget": "{0} (SSH)",
+    "customTarget": "{0} (custom)",
+    "customProgramNotFound": "Program \"{0}\" not found — check the name or use a full path (Settings → Custom tiles).",
     "browseForFolder": "Choose folder…",
+    "recentSessions": "Recent sessions",
+    "recentSessionsEmpty": "No sessions in the last 14 days",
+    "resumeSession": "Resume",
+    "showBrief": "Brief",
+    "renameSession": "Double-click to rename",
+    "renameFailed": "Couldn't rename the session: {0}",
+    "handoffSession": "Handoff",
+    "briefOpenFailed": "Couldn't open the brief: {0}",
     "focusMode": "Focus",
     "overviewMode": "Overview",
+    "columns": "Columns",
+    "columnsAuto": "Auto",
     "closeSession": "Kill session",
+    "closeSessionConfirm": "End the running session? The Claude process will be aborted.",
     "conptyLaunchFailed": "Couldn't open interactive session: {0}",
     "conptyStarting": "Starting session…",
+    "conptyExited": "Session ended (code {0}).",
     "usageWarningNotDelivered": "Couldn't warn the list-handler session about the usage limit.",
+    "terminalSendFailed": "Couldn't send that to the terminal session.",
+    "deferredHandoffTitleSuffix": "waiting for limit reset ({0})",
     "mergeHelperTitle": "Merge Helper",
     "mergeHelperHandoffTitleSuffix": " (Handoff)",
     "mergeHelperTaskTitle": "List handler: {0}",
@@ -391,15 +504,28 @@
       "body": "ClaudeDo can't reach the background worker. It is normally started automatically at logon. You can start it now, or reinstall if the problem persists.",
       "dismiss": "Dismiss",
       "rerunInstaller": "Rerun Installer",
-      "startWorker": "Start Worker"
+      "startWorker": "Start Worker",
+      "workerNotFound": "Worker executable not found. Check the installation.",
+      "installerNotFound": "Installer not found. Check the installation.",
+      "startFailed": "Start failed: {0}"
     },
     "listSettings": {
       "title": "LIST SETTINGS",
+      "folderTitle": "FOLDER",
       "deleteList": "Delete list",
+      "deleteFolder": "Delete folder",
+      "createAsFolder": "Create a folder instead",
+      "createAsFolderHint": "A folder just groups lists in the sidebar — it holds no tasks and runs nothing. Drag lists onto it to fill it.",
       "sectionGeneral": "GENERAL",
       "name": "Name",
+      "color": "Colour",
+      "colorHint": "Tints the dot of a list, or the name and guide line of a folder. The empty ring restores the default.",
+      "colorCustom": "Custom",
       "workingDirectory": "Working directory",
       "workingDirectoryPlaceholder": "(none)",
+      "baseBranch": "Base branch",
+      "baseBranchPlaceholder": "(checked-out branch)",
+      "baseBranchHint": "New task branches start here and approved work merges back here, e.g. dev. Leave empty to use whatever branch is checked out.",
       "browse": "Browse...",
       "defaultCommitType": "Default commit type",
       "manualList": "Manual list (reminders)",
@@ -407,10 +533,12 @@
       "findingsTracked": "Commit the .claudedo findings folder",
       "findingsTrackedHint": "Off: the folder stays out of git via .git/info/exclude. On: findings travel with the repo.",
       "powerUseAllowed": "Allow PowerUse for this list",
-      "powerUseAllowedHint": "Lets a list-handler run on this list go unattended when PowerUse is switched on in the usage monitor: it asks nothing, resolves conflicts itself, and harvests new work. Both switches are needed, so leaving PowerUse on globally never changes a list that hasn't opted in.",
+      "powerUseAllowedHint": "Lets a list-handler run on this list go unattended when PowerUse is switched on in Settings → Execution: it asks nothing, resolves conflicts itself, and harvests new work. Both switches are needed, so leaving PowerUse on globally never changes a list that hasn't opted in.",
       "sectionIcon": "ICON",
       "icon": "List icon",
       "iconHint": "Shown next to the list name in the sidebar.",
+      "iconSearchWatermark": "Search all icons (English, e.g. rocket, car, bug)",
+      "iconSearchTruncated": "Showing the first 200 matches — refine the search.",
       "sectionAgent": "AGENT",
       "resetAgentSettings": "Reset agent settings",
       "sectionVerify": "VERIFICATION",
@@ -427,7 +555,9 @@
       "targetBranch": "Target branch",
       "removeWorktree": "Remove worktree after merge",
       "commitMessage": "Commit message",
-      "conflictedFiles": "Conflicted files:"
+      "conflictedFiles": "Conflicted files:",
+      "stashAndMerge": "Stash changes and merge",
+      "resolveConflicts": "Resolve conflicts"
     },
     "diff": {
       "title": "DIFF",
@@ -459,6 +589,8 @@
       "resolve": "Resolve",
       "phantom": "phantom",
       "phantomTooltip": "Directory missing on disk",
+      "mergedExternal": "merged (external)",
+      "mergedExternalTooltip": "Its commits are already in the default branch (local origin ref, not fetched) — e.g. a squash PR. \"Cleanup finished\" removes it.",
       "ctxShowDiff": "Show diff",
       "ctxOpenInExplorer": "Open in Explorer",
       "ctxJumpToTask": "Jump to task",
@@ -483,6 +615,8 @@
       "windowTitle": "Let Claude handle it",
       "scopeList": "List: {0}",
       "scopeReview": "All lists — tasks waiting for review",
+      "modelLabel": "Model",
+      "modelTip": "Model for the triage session (dedupe & refine). Later merge phases always run on opus.",
       "confirm": "Let Claude handle it",
       "cancel": "Cancel",
       "selectAll": "Select all",
@@ -510,18 +644,18 @@
       "regenerate": "Regenerate",
       "emptyStateHint": "No report for this range yet. Click “Generate”."
     },
+    "cheatSheets": {
+      "title": "CHEAT SHEETS",
+      "windowTitle": "Cheat Sheets",
+      "pin": "Pin",
+      "pinTooltip": "Keep this window on top of the others",
+      "missing": "Cheat sheet {0} not found."
+    },
     "usageMonitor": {
       "title": "USAGE MONITOR",
       "windowTitle": "Usage Monitor",
       "noGauges": "No usage limits reported yet.",
-      "powerUse": "PowerUse",
+      "refreshHint": "Refresh now — polled every 5 min while a task runs, otherwise every 15 min.",
-      "powerUseHint": "Spend the rest of the window: a list-handler run asks nothing, resolves conflicts itself, harvests new work, and keeps handing off for as long as its budget allows. Only affects lists that allowed PowerUse in their list settings.",
-      "powerUseWindow": "Only between",
-      "powerUseWindowPlaceholder": "HH:mm",
-      "powerUseHandoffPct": "Hand off at (% of 5h)",
-      "powerUseWindowHint": "Leave both times empty for round the clock. A window is checked whenever a handler phase starts, so a chain that runs past the end time continues without PowerUse.",
-      "refresh": "Refresh now",
-      "refreshHint": "Polled every 5 min while a task runs, otherwise every 15 min.",
       "staleFormat": "Values stale (as of {0})",
       "staleGateHint": "The gate does not apply while values are stale.",
       "gateBlockedFormat": "Queue paused — {0}",
@@ -654,35 +788,61 @@
   "checks": {
     "git": {
       "title": "Git",
-      "hint": "Install Git and make sure it is on PATH."
+      "hint": "Install Git from https://git-scm.com/downloads, then restart the installer.",
+      "notFound": "git was not found on PATH.",
+      "exitCode": "'{0}' exited with code {1}.",
+      "resolvedFormat": "{0} — {1}"
     },
     "gitIdentity": {
       "title": "Git Identity",
-      "hint": "Set your git identity: git config --global user.name \"...\" and user.email \"...\"."
+      "hint": "Run: git config --global user.name \"Your Name\" and git config --global user.email \"you@example.com\"",
+      "notFound": "git was not found — identity could not be checked.",
+      "missing": "Missing git identity: {0}."
     },
     "ports": {
       "title": "Ports",
-      "hint": "Free the port, or change it on the Worker page after install."
+      "hint": "Change the SignalR/MCP ports on the Service page, or stop the process using them.",
+      "inUse": "{0} port {1} is in use.",
+      "inUseBy": "{0} port {1} is in use by '{2}'.",
+      "inUseByOwnWorker": "In use by the running ClaudeDo Worker: {0}.",
+      "available": "Ports are available."
     },
     "writeAccess": {
       "title": "Write Access",
-      "hint": "Choose a different install directory, or run the installer as administrator."
+      "hint": "Choose a different install directory, or run the installer with sufficient permissions (e.g. as administrator).",
+      "cannotWrite": "Cannot write to '{0}': {1}",
+      "writable": "Install directory and data directory are writable."
     },
     "claudeCli": {
       "title": "Claude CLI",
-      "hint": "Install the Claude CLI and make sure it is on PATH."
+      "hint": "Install the Claude CLI (npm install -g @anthropic-ai/claude-code), then restart your terminal/login session so the updated PATH takes effect.",
+      "notFound": "'{0}' was not found on PATH. Searched: {1}.",
+      "exitCode": "'{0}' exited with code {1}.",
+      "resolvedFormat": "{0} — {1}"
     },
     "claudeVersion": {
       "title": "Claude CLI Version",
-      "hint": "Update the Claude CLI to a newer version."
+      "hint": "Update the CLI: npm update -g @anthropic-ai/claude-code",
+      "notFound": "The claude CLI was not found — version could not be checked.",
+      "parseFailed": "Could not parse a version from '{0}'.",
+      "tooOld": "claude {0} is older than the required {1}.",
+      "ok": "claude {0} meets the minimum ({1})."
     },
     "claudeAuth": {
-      "title": "Claude Login",
+      "title": "Claude CLI Login",
-      "hint": "Run 'claude auth login' to sign in."
+      "hint": "Run 'claude' once and complete the login flow.",
+      "notFound": "The claude CLI was not found — login could not be checked.",
+      "undetermined": "Login status could not be determined.",
+      "notLoggedIn": "Not logged in.",
+      "loggedIn": "Logged in."
     },
     "permissionModeAuto": {
       "title": "Permission Mode",
-      "hint": "Update the Claude CLI to a version that supports --permission-mode auto."
+      "hint": "Update the CLI: npm update -g @anthropic-ai/claude-code. ClaudeDo still works in acceptEdits/default mode, with more prompts.",
+      "notFound": "The claude CLI was not found — permission-mode support could not be checked.",
+      "undetermined": "Could not determine whether --permission-mode auto is supported.",
+      "ok": "--permission-mode auto is recognized by this CLI.",
+      "notListed": "This claude CLI version does not list 'auto' as a --permission-mode choice."
     }
   },
   "planning": {
@@ -710,6 +870,9 @@
     "abort": "Abort merge"
   },
   "controls": {
+    "markdown": {
+      "copy": "Copy command"
+    },
     "datePicker": {
       "today": "Today",
       "tomorrow": "Tomorrow",
@@ -719,6 +882,14 @@
       "done": "Done"
     }
   },
+  "dialog": {
+    "cancel": "Cancel",
+    "confirm": "Confirm",
+    "delete": "Delete",
+    "ok": "OK",
+    "confirmTitle": "Confirm",
+    "errorTitle": "Error"
+  },
   "shell": {
     "menu": {
       "help": "Help",
@@ -726,9 +897,18 @@
       "repositories": "Repositories",
       "checkForUpdates": "Check for updates",
       "restartWorker": "Restart worker",
+      "updateClaudeCli": "Update Claude CLI",
+      "shutdown": "Shutdown",
       "worktrees": "Worktrees…",
       "weeklyReport": "Weekly Report…",
       "usageMonitor": "Usage Monitor…",
+      "cheatSheets": "Cheat Sheets",
+      "cheatSheetGit": "Git…",
+      "cheatSheetCommits": "Conventional Commits…",
+      "cheatSheetClaude": "Claude CLI…",
+      "cheatSheetClaudeConfig": "Claude configuration…",
+      "cheatSheetDotnet": "dotnet CLI…",
+      "cheatSheetPowershell": "PowerShell…",
       "about": "About…",
       "addRepos": "Add repos as lists…"
     },
@@ -744,10 +924,10 @@
   },
   "vm": {
     "connection": { "online": "Online", "connecting": "Connecting…", "offline": "Offline" },
-    "shell": { "restartingWorker": "Restarting worker…", "unexpectedError": "Unexpected error: {0}" },
+    "shell": { "unexpectedError": "Unexpected error: {0}", "updatingClaudeCli": "Updating Claude CLI…", "shutdownConfirm": "This stops the ClaudeDo worker (any running task or interactive session is interrupted) and closes the app. Continue?" },
     "mainWindow": { "closeConfirm": { "message": "{0} Mission Control session(s) are still running. Closing the app will end them. Close anyway?" } },
     "agentStatus": { "idle": "Idle", "queued": "Queued", "running": "Running", "review": "Review", "children": "Waiting for Subtasks", "done": "Done", "failed": "Failed", "cancelled": "Cancelled" },
-    "taskStatus": { "idle": "Idle", "queued": "Queued", "running": "Running", "waitingForReview": "Waiting for Review", "waitingForChildren": "Waiting for Subtasks", "done": "Done", "failed": "Failed", "cancelled": "Cancelled", "parked": "Parked", "interactive": "Interactive" },
+    "taskStatus": { "idle": "Idle", "queued": "Queued", "running": "Running", "waitingForReview": "Waiting for Review", "waitingForChildren": "Waiting for Subtasks", "done": "Done", "failed": "Failed", "cancelled": "Cancelled", "parked": "Parked", "interactive": "Interactive", "waiting": "Waiting" },
     "failureReason": { "maxTurns": "Turn limit reached", "timeout": "Timed out", "usageLimit": "Usage limit reached", "error": "Error", "cancelled": "Cancelled", "unknown": "Unknown reason" },
     "failureReasonTooltip": { "maxTurns": "Turn limit reached ({0}/{1} turns) — the worktree is usually fine; continue the task instead of resetting it." },
     "planningBadge": { "active": "PLANNING", "finalized": "PLANNED" },
@@ -756,16 +936,15 @@
     "tasksIsland": { "completedHeader": "COMPLETED", "completedHeaderCount": "COMPLETED · {0}", "statusPill": "{0} running · {1} review", "openTaskOne": "1 open task", "openTasks": "{0} open tasks", "planningResumeFailed": "Couldn't resume planning session: {0}", "approveFailed": "Approve & merge failed: {0}", "cancelReviewFailed": "Cancel review failed: {0}", "sendToQueueFailed": "Send to queue failed: {0}", "queuePlanBlockedInteractive": "Can't queue the plan — {0} has an open interactive session and must be closed first.", "moveRunningRejected": "Can't move a running task to another list.", "moveWorktreeRejected": "Can't move — this task has an active worktree pointing at its current repo.", "moveRepoConfirm": "Different repos — {0} → {1}. Move the task anyway?", "moveConfirmUnavailable": "Can't move — the confirmation dialog isn't available.", "quickClaudeNoWorkingDir": "This list has no working directory configured.", "quickClaudeDirMissing": "Working directory no longer exists: {0}", "setStatusFailed": "Failed to update status: {0}", "cancelFailed": "Cancel failed: {0}", "rejectToQueueFailed": "Reject to queue failed: {0}", "rejectToIdleFailed": "Reject failed: {0}", "deleteTaskConfirm": "Delete \"{0}\"? This cannot be undone.", "deleteTaskFailed": "Delete failed: {0}", "toggleDoneFailed": "Couldn't update done state: {0}", "removeFromQueueFailed": "Remove from queue failed: {0}", "openWorktreeFailed": "Couldn't open worktree: {0}" },
     "diff": { "loadFailed": "Failed to load diff: {0}", "noChanges": "No changes to show.", "unavailable": "Diff no longer available — commit range incomplete." },
     "planningDiff": { "hubError": "Could not build combined preview (hub error).", "conflict": "Cannot build combined preview: subtask {0} conflicts with an earlier subtask ({1} files).", "buildFailed": "Could not build combined preview: {0}" },
-    "merge": { "commitMessage": "chore: merge {0}", "progressMerging": "Merging…", "progressVerifying": "Running the list's verify command… ({0})", "workerOfflineBranches": "Worker offline — cannot list branches.", "loadBranchesFailed": "Failed to load branches: {0}", "merged": "Merged.", "blocked": "Blocked: {0}", "verifyFailed": "Merge landed, but the list's verify command failed — the task was kept out of Done.", "untrackedCollision": "Merge refused — it would overwrite an untracked file in the target working directory.", "unknownStatus": "Unknown status: {0}", "mergeFailed": "Merge failed: {0}" },
+    "merge": { "commitMessage": "chore: merge {0}", "progressMerging": "Merging…", "progressVerifying": "Running the list's verify command… ({0})", "workerOfflineBranches": "Worker offline — cannot list branches.", "loadBranchesFailed": "Failed to load branches: {0}", "merged": "Merged.", "blocked": "Blocked: {0}", "verifyFailed": "Merge landed, but the list's verify command failed — the task was kept out of Done.", "untrackedCollision": "Merge refused — it would overwrite an untracked file in the target working directory.", "dirtyTarget": "Merge refused — the target working directory has uncommitted changes.", "targetDirty": "The target working directory already has uncommitted changes — stash them and merge?", "unknownStatus": "Unknown status: {0}", "mergeFailed": "Merge failed: {0}" },
     "settingsModal": { "workerOffline": "Worker offline — settings read-only.", "saveFailed": "Save failed: {0}" },
     "onlineInbox": { "workerOffline": "Worker offline — cannot load config.", "saved": "Config saved.", "saveFailed": "Save failed: {0}", "signedIn": "Signed in successfully.", "signedInNoRole": "Signed in, but this account is missing the 'user' role in Zitadel — online sync will be rejected until the role is granted in the ClaudeDo project.", "signInFailed": "Sign-in failed: {0}", "signedOut": "Signed out.", "signOutFailed": "Sign-out failed: {0}" },
-    "tickets": { "connectionOk": "Connected as {0}.", "connectionMissingScopes": "Connected as {0}, but missing scopes: {1}", "tokenCleared": "Token removed.", "workerOffline": "Worker not reachable." },
+    "tickets": { "azdoConnectionOk": "Connected — repo {0}, default branch {1}.", "connectionOk": "Connected as {0}.", "connectionMissingScopes": "Connected as {0}, but missing scopes: {1}", "tokenCleared": "Token removed.", "workerOffline": "Worker not reachable." },
     "weeklyReport": { "invalidRange": "Invalid date range.", "error": "Error: {0}" },
     "usageMonitor": {
       "loadFailed": "Couldn't load usage data: {0}",
       "refreshFailed": "Couldn't refresh usage: {0}",
       "thresholdSaveFailed": "Couldn't save the threshold: {0}",
-      "powerUseSaveFailed": "Couldn't save the PowerUse switch: {0}",
       "installStarted": "Installing TokenTracker — watch the log strip for progress.",
       "installFailed": "Couldn't install TokenTracker: {0}",
       "analyticsRefreshFailed": "Couldn't refresh the analytics: {0}",
@@ -776,18 +955,19 @@
     "sessionSkillsTab": { "installed": "Installed: {0}", "installFailed": "Install failed: {0}", "updated": "Updated.", "updateFailed": "Update failed: {0}", "removed": "Removed.", "removeFailed": "Remove failed: {0}" },
     "worktreesTab": { "workerOffline": "Worker offline.", "removed": "Removed {0} worktree(s).", "blocked": "Cannot force-remove: {0} task(s) still running. Cancel them first.", "removedFrom": "Removed {0} worktree(s) from {1} task(s).", "cleanupFailed": "Cleanup failed: {0}", "resetFailed": "Reset failed: {0}" },
     "worktreesOverview": { "titleAll": "Worktrees", "titleList": "Worktrees — {0}", "listFallback": "list", "cleanupFailed": "Cleanup failed.", "cleanupFailedDetailed": "Cleanup failed: {0}", "removed": "Removed {0} worktree(s).", "discardConfirm": "Discard the worktree for \"{0}\"? Uncommitted work will be lost.", "discardFailed": "Failed to discard worktree.", "keepFailed": "Failed to keep worktree.", "cannotForceRunning": "Cannot force-remove a running task.", "forceRemoveFailed": "Force remove failed.", "forceRemoveFailedDetailed": "Force remove failed: {0}", "batchDone": "Merged {0}, {1} need resolution.", "openInExplorerFailed": "Couldn't open path: {0}" },
-    "listSettings": { "untitled": "Untitled", "ticketProjectNone": "— none —", "loadFailed": "Couldn't load list settings: {0}", "ticketProjectsLoadFailed": "Couldn't load ticket projects: {0}" },
+    "listSettings": { "untitled": "Untitled", "ticketProjectNone": "— none —", "loadFailed": "Couldn't load list settings: {0}", "ticketProjectsLoadFailed": "Couldn't load ticket projects: {0}", "confirmDeleteFolder": "Delete folder \"{0}\"? The lists and subfolders inside it are kept and move back to the top level.", "confirmDeleteList": "Delete list \"{0}\" and all its tasks? This cannot be undone.", "deleteBlockedPlanning": "This list has planning sessions with child tasks. Discard those first, then delete the list.", "workingDirMissing": "This folder doesn't exist.", "workingDirNotRepo": "This folder isn't a git repository yet. Run `git init` in it first, or clear the working directory to save this as a manual list." },
-    "detailsIsland": { "verifyFailed": "Merge landed, but the list's verify command failed — the task was kept out of Done.", "untrackedCollision": "Merge refused — it would overwrite an untracked file in the target working directory.", "stopOffline": "Worker offline — can't stop the task.", "stopFailed": "Stop failed: {0}", "enqueueFailed": "Queue failed: {0}", "dequeueFailed": "Remove from queue failed: {0}", "resetAndRetryFailed": "Reset & retry failed: {0}", "toggleDoneFailed": "Couldn't update done state: {0}" },
+    "detailsIsland": { "verifyFailed": "Merge landed, but the list's verify command failed — the task was kept out of Done.", "untrackedCollision": "Merge refused — it would overwrite an untracked file in the target working directory.", "dirtyTarget": "Merge refused — the target working directory has uncommitted changes.", "stashAndMergeConfirm": "The target working directory has uncommitted changes.\nStash them, merge, and restore them afterwards?", "stopOffline": "Worker offline — can't stop the task.", "stopFailed": "Stop failed: {0}", "enqueueFailed": "Queue failed: {0}", "dequeueFailed": "Remove from queue failed: {0}", "resetAndRetryFailed": "Reset & retry failed: {0}", "toggleDoneFailed": "Couldn't update done state: {0}" },
     "mergeSection": { "openWorktreeFailed": "Couldn't open worktree: {0}" },
     "about": { "openPathFailed": "Couldn't open path: {0}" },
     "lists": { "localSuffix": "{0} / local", "smartMyDay": "My Day", "smartImportant": "Important", "smartPlanned": "Planned", "smartNotes": "Notes", "virtualQueue": "Queue", "virtualRunning": "Running", "virtualReview": "Review", "newList": "New list", "findingsNotFound": "No findings yet for this list.", "findingsOpenFailed": "Couldn't open findings folder: {0}", "openInExplorerFailed": "Couldn't open path: {0}" },
-    "repoImport": { "loadFailed": "Couldn't load remembered folders: {0}", "saveFailed": "Couldn't save folders: {0}" }
+    "repoImport": { "loadFailed": "Couldn't load remembered folders: {0}", "saveFailed": "Couldn't save folders: {0}", "createButton": "Create {0} list(s)" }
   },
   "ops": {
     "stalledHint": "Still running — worker hasn't responded in a while",
     "merge": {
       "merging": "Merging…",
-      "verifying": "Running the list's verify command… ({0})"
+      "verifying": "Running the list's verify command… ({0})",
+      "publishing": "Pushing and opening the draft PR…"
     },
     "diff": {
       "parsing": "Parsing diff…"
@@ -821,7 +1001,8 @@
     },
     "reports": {
       "generatingWeekly": "Generating report…",
-      "runningDailyPrep": "Running daily prep…"
+      "runningDailyPrep": "Running daily prep…",
+      "runningTicketImport": "Importing tickets, then planning the day…"
     },
     "planning": {
       "finalizing": "Finalizing plan…",
@@ -849,39 +1030,5 @@
       "lastError": "Last error: {0}",
       "throttled": "Throttled: {0}/{1} slots ({2})"
     }
-  },
-  "checks": {
-    "git": {
-      "title": "Git",
-      "hint": "Install Git from https://git-scm.com/downloads, then restart the installer."
-    },
-    "gitIdentity": {
-      "title": "Git identity",
-      "hint": "Run: git config --global user.name \"Your Name\" and git config --global user.email \"you@example.com\""
-    },
-    "ports": {
-      "title": "Ports",
-      "hint": "Change the SignalR/MCP ports on the Service page, or stop the process using them."
-    },
-    "writeAccess": {
-      "title": "Write access",
-      "hint": "Choose a different install directory, or run the installer with sufficient permissions (e.g. as administrator)."
-    },
-    "claudeCli": {
-      "title": "Claude CLI",
-      "hint": "Install the Claude CLI (npm install -g @anthropic-ai/claude-code), then restart your terminal/login session so the updated PATH takes effect."
-    },
-    "claudeVersion": {
-      "title": "Claude CLI version",
-      "hint": "Update the CLI: npm update -g @anthropic-ai/claude-code"
-    },
-    "claudeAuth": {
-      "title": "Claude CLI login",
-      "hint": "Run 'claude' once and complete the login flow."
-    },
-    "permissionModeAuto": {
-      "title": "--permission-mode auto support",
-      "hint": "Update the CLI: npm update -g @anthropic-ai/claude-code. ClaudeDo still works in acceptEdits/default mode, with more prompts."
-    }
   }
 }

src/ClaudeDo.Ui/AccentPresets.cs

@@ -5,20 +5,30 @@ using CommunityToolkit.Mvvm.ComponentModel;
 
 namespace ClaudeDo.Ui;
 
-public sealed record AccentPreset(string Name, string Accent, string Dim, string Soft, string Glow);
+/// <summary>An accent theme; <paramref name="Swatches"/> holds one hex per <c>SwatchNBrush</c> token (index 0 = Swatch1).</summary>
+public sealed record AccentPreset(string Name, string Accent, string Dim, string Soft, string Glow, string[] Swatches);
 
 public static class AccentPresets
 {
     // Hue 88 — moss/sage green (original)
-    public static readonly AccentPreset Moss = new("moss", "#FF7C9166", "#FF64785A", "#FF3E4B39", "#387C9166");
+    public static readonly AccentPreset Moss = new("moss", "#FF7C9166", "#FF64785A", "#FF3E4B39", "#387C9166",
+        ["#7C9166", "#D4A574", "#C87060", "#D9C27A", "#6FB3A8", "#7FA7C9", "#A38BC9", "#C77FA0", "#8B9D7A", "#B58B6A", "#5C78B8", "#9AA0A6"]);
     // Hue ~40 — warm earthy brown/terra
-    public static readonly AccentPreset Peat = new("peat", "#FF9A7B5C", "#FF7F6449", "#FF4D3C2C", "#389A7B5C");
+    public static readonly AccentPreset Peat = new("peat", "#FF9A7B5C", "#FF7F6449", "#FF4D3C2C", "#389A7B5C",
+        ["#9A7B5C", "#D9A066", "#C4604F", "#DBBF6A", "#7FA890", "#7C9AB8", "#A98BB8", "#C98A8A", "#A39A6E", "#B8825A", "#6E80AE", "#A09A90"]);
     // Hue ~180 — cool teal/sea-green
-    public static readonly AccentPreset Sea  = new("sea",  "#FF5B8F8C", "#FF4A7573", "#FF263D3C", "#385B8F8C");
+    public static readonly AccentPreset Sea  = new("sea",  "#FF5B8F8C", "#FF4A7573", "#FF263D3C", "#385B8F8C",
+        ["#5B8F8C", "#C9A87C", "#BF7468", "#CBC27F", "#4FA396", "#5FA8C8", "#8E8BCC", "#B87FA5", "#7C9A8E", "#A8907A", "#5C78B8", "#8FA0A8"]);
 
     public static readonly IReadOnlyList<AccentPreset> All = [Moss, Peat, Sea];
     public static AccentPreset Default => Moss;
 
+    /// <summary>Number of <c>SwatchNBrush</c> tokens every preset must define.</summary>
+    public const int SwatchCount = 12;
+
+    /// <summary>Swatch keys ("Swatch1".."SwatchN") as stored on lists and folders.</summary>
+    public static readonly string[] SwatchKeys = Enumerable.Range(1, SwatchCount).Select(i => $"Swatch{i}").ToArray();
+
     public static AccentPreset Find(string? name) =>
         All.FirstOrDefault(p => p.Name == name) ?? Default;
 }

src/ClaudeDo.Ui/AppSettings.cs

@@ -16,6 +16,12 @@ public sealed class AppSettings
     public string DiffViewMode { get; set; } = "unified";
     public bool DiffWrapLines { get; set; }
 
+    /// <summary>Mission Control overview column count; 0 = auto (derived from the pane count).</summary>
+    public int MissionControlColumns { get; set; }
+
+    /// <summary>User-defined console programs offered in Mission Control's new-session flyout.</summary>
+    public List<CustomTile> CustomTiles { get; set; } = new();
+
     private static readonly string DefaultConfigPath = Paths.Expand("~/.claudeDo/ui.config.json");
 
     /// Where this instance persists. Instance-level (not static) so tests can redirect it —
@@ -55,3 +61,35 @@ public sealed class AppSettings
         File.WriteAllText(ConfigPath, json);
     }
 }
+
+/// <summary>A console program the user can open as a Mission Control tile. An empty
+/// <see cref="Folder"/> means the folder is picked at launch.</summary>
+public sealed class CustomTile
+{
+    public string Name { get; set; } = "";
+    public string Program { get; set; } = "";
+    public string Arguments { get; set; } = "";
+    public string Folder { get; set; } = "";
+
+    /// <summary>Splits an argument string into tokens: whitespace separates, double quotes group and
+    /// are dropped. The terminal control quotes every token itself, so the raw string can't pass through.</summary>
+    public static List<string> SplitArgs(string? args)
+    {
+        var tokens = new List<string>();
+        var current = new System.Text.StringBuilder();
+        bool inQuotes = false, hasToken = false;
+        foreach (var c in args ?? "")
+        {
+            if (c == '"') { inQuotes = !inQuotes; hasToken = true; }
+            else if (char.IsWhiteSpace(c) && !inQuotes)
+            {
+                if (hasToken) tokens.Add(current.ToString());
+                current.Clear();
+                hasToken = false;
+            }
+            else { current.Append(c); hasToken = true; }
+        }
+        if (hasToken) tokens.Add(current.ToString());
+        return tokens;
+    }
+}

src/ClaudeDo.Ui/Assets/CheatSheets/claude-cli.md

@@ -0,0 +1,63 @@
+# Claude CLI
+
+## Session starten
+- `claude` — interaktive Session im aktuellen Verzeichnis
+- `claude "<prompt>"` — Session mit erstem Prompt starten
+- `claude -c` — letzte Session in diesem Verzeichnis fortsetzen
+- `claude -r` — Session aus einer Auswahlliste fortsetzen
+- `claude -r <session-id>` — bestimmte Session fortsetzen
+- `claude --fork-session -r <id>` — Session unter neuer ID fortsetzen
+- `claude -n "<name>"` — Anzeigename für die Session setzen
+
+## Modell und Aufwand
+- `claude --model sonnet` — Alias oder voller Name (`fable`, `opus`, `sonnet`, `claude-opus-5`)
+- `claude --effort high` — Denkaufwand: `low`, `medium`, `high`, `xhigh`, `max`
+- `claude --fallback-model sonnet` — Ausweichmodell bei Überlast (nur mit `-p`)
+
+## Nicht interaktiv
+- `claude -p "<prompt>"` — antworten und beenden
+- `claude -p --output-format json` — ein JSON-Ergebnis
+- `claude -p --output-format stream-json` — Streaming-JSON für Skripte
+- `claude -p --include-partial-messages` — Teil-Chunks mitstreamen
+- `claude -p --max-budget-usd 5` — Kostendeckel für den Lauf
+- `claude -p --json-schema '<schema>'` — strukturierte Ausgabe validieren
+
+## Berechtigungen und Tools
+- `claude --permission-mode <mode>` — `acceptEdits`, `auto`, `plan`, `manual`, `dontAsk`, `bypassPermissions`
+- `claude --allowed-tools "Bash(git *)" Edit` — nur diese Tools erlauben
+- `claude --disallowed-tools "Bash(rm *)"` — diese Tools sperren
+- `claude --tools "Bash,Edit,Read"` — Built-in-Toolset festlegen
+- `claude --add-dir <pfad>` — weiteres Arbeitsverzeichnis freigeben
+- `claude --restricted` — ohne befehlsausführende Tools und ohne lokale Settings
+
+## Kontext und Konfiguration
+- `claude --append-system-prompt "<text>"` — Systemprompt ergänzen
+- `claude --system-prompt "<text>"` — Systemprompt ersetzen
+- `claude --settings <datei|json>` — zusätzliche Settings laden
+- `claude --agents '<json>'` — eigene Subagents für diese Session
+- `claude --mcp-config <datei>` — MCP-Server aus JSON laden
+- `claude --strict-mcp-config` — nur diese MCP-Server, alle anderen ignorieren
+- `claude --safe-mode` — alle Anpassungen aus, zum Fehlersuchen
+- `claude --bare` — Minimalmodus ohne Hooks, Plugins, CLAUDE.md
+
+## Hintergrund-Sessions
+- `claude --bg "<prompt>"` — im Hintergrund starten, gibt die Kurz-ID aus
+- `claude agents` — laufende Hintergrund-Sessions auflisten
+- `claude attach <id>` — Hintergrund-Session in dieses Terminal holen
+- `claude logs <id>` — letzte Ausgabe einer Hintergrund-Session
+- `claude stop <id>` — Session stoppen, Verlauf bleibt
+- `claude rm <id>` — Session löschen
+
+## Worktree
+- `claude -w` — neuen Git-Worktree für diese Session anlegen
+- `claude -w <name>` — Worktree mit eigenem Namen
+
+## Verwaltung
+- `claude doctor` — Installation prüfen
+- `claude update` — auf neue Version aktualisieren
+- `claude mcp` — MCP-Server konfigurieren
+- `claude plugin` — Plugins verwalten
+- `claude auth` — Authentifizierung verwalten
+- `claude setup-token` — Langzeit-Token einrichten
+- `claude -d api,hooks` — Debugmodus mit Kategoriefilter
+- `claude -v` — Version ausgeben

src/ClaudeDo.Ui/Assets/CheatSheets/claude-config.md

@@ -0,0 +1,48 @@
+# Claude Konfiguration
+
+## Dateien und Orte
+- `~/.claude/settings.json` — globale Settings für alle Projekte
+- `.claude/settings.json` — Projekt-Settings, eingecheckt fürs Team
+- `.claude/settings.local.json` — persönliche Projekt-Settings, nicht eingecheckt
+- `Rangfolge: managed > local > projekt > global` — spezifischer gewinnt
+- `/config` — Settings interaktiv in der Session ansehen und ändern
+- `claude doctor` — Konfiguration auf Fehler prüfen
+
+## CLAUDE.md
+- `~/.claude/CLAUDE.md` — globale Anweisungen für alle Projekte
+- `CLAUDE.md` — im Projekt-Root, wird bei Start automatisch geladen
+- `<unterordner>/CLAUDE.md` — wird geladen, sobald dort gearbeitet wird
+- `@pfad/zur/datei.md` — Import einer weiteren Datei in eine CLAUDE.md
+- `# <notiz>` — in der Session: Notiz in die CLAUDE.md übernehmen
+- `/init` — CLAUDE.md für ein Projekt generieren lassen
+
+## Berechtigungen
+- `"permissions": { "allow": [...], "deny": [...], "ask": [...] }` — Struktur in settings.json
+- `Bash(git *)` — Bash-Befehle per Muster erlauben oder sperren
+- `Edit(src/**)` — Dateizugriff per Glob einschränken
+- `WebFetch(domain:example.com)` — Webzugriff auf eine Domain begrenzen
+- `mcp__<server>__<tool>` — Regel für ein einzelnes MCP-Tool
+- `/permissions` — Regeln in der Session ansehen und ergänzen
+
+## MCP-Server
+- `claude mcp add <name> -- <befehl>` — lokalen stdio-Server anlegen
+- `claude mcp add --transport http <name> <url>` — HTTP-Server anlegen
+- `claude mcp add --scope project <name> ...` — in `.mcp.json` fürs Team
+- `claude mcp list` — konfigurierte Server anzeigen
+- `claude mcp remove <name>` — Server entfernen
+- `/mcp` — Serverstatus in der Session, OAuth-Login
+
+## Hooks
+- `"hooks": { "PreToolUse": [...] }` — Shell-Befehle an Lifecycle-Events hängen
+- `PreToolUse / PostToolUse` — vor und nach jedem Tool-Aufruf
+- `UserPromptSubmit` — beim Absenden eines Prompts
+- `SessionStart / Stop` — bei Sessionbeginn und -ende
+- `Exit-Code 2` — blockiert die Aktion, stderr geht an Claude
+- `/hooks` — Hooks interaktiv verwalten
+
+## Erweiterungen
+- `.claude/commands/<name>.md` — eigener Slash-Command `/name`
+- `.claude/skills/<name>/SKILL.md` — Skill, wird bei passender Aufgabe geladen
+- `.claude/agents/<name>.md` — eigener Subagent-Typ
+- `~/.claude/...` — dieselben Ordner global statt pro Projekt
+- `claude plugin` — Plugins installieren und verwalten

src/ClaudeDo.Ui/Assets/CheatSheets/conventional-commits.md

@@ -0,0 +1,34 @@
+# Conventional Commits
+
+## Format
+- `<type>(<scope>): <beschreibung>` — Grundform, Scope optional
+- `feat(auth): add login endpoint` — Beispiel mit Scope
+- `fix: prevent crash on empty input` — Beispiel ohne Scope
+- `imperativ, klein, kein Punkt am Ende` — Stil der Beschreibung
+
+## Types
+- `feat` — neues Feature
+- `fix` — Bugfix
+- `refactor` — Umbau ohne Verhaltensänderung
+- `perf` — Performance-Verbesserung
+- `docs` — nur Dokumentation
+- `test` — Tests hinzufügen oder korrigieren
+- `style` — Formatierung, kein Code-Effekt
+- `build` — Build-System oder Dependencies
+- `ci` — CI-Konfiguration
+- `chore` — Sonstiges ohne src- oder Test-Änderung
+
+## Breaking Changes
+- `feat(api)!: remove legacy endpoint` — `!` markiert einen Breaking Change
+- `BREAKING CHANGE: <erklärung>` — alternativ als Footer im Commit-Body
+
+## Body und Footer
+- `Leerzeile nach der Betreffzeile` — dann optionaler Body mit dem Warum
+- `Refs: #123` — Footer für Ticket-Referenzen
+- `Reverts: <hash>` — Footer für Reverts
+
+## Warum das Ganze
+- `feat` — löst ein Minor-Release aus (SemVer)
+- `fix` — löst ein Patch-Release aus (SemVer)
+- `!` oder `BREAKING CHANGE` — löst ein Major-Release aus
+- `git log --oneline --grep "^feat"` — Verlauf wird filterbar

src/ClaudeDo.Ui/Assets/CheatSheets/dotnet-cli.md

@@ -0,0 +1,49 @@
+# dotnet CLI
+
+## Projekt anlegen
+- `dotnet new list` — verfügbare Vorlagen anzeigen
+- `dotnet new console -n <name>` — Projekt aus Vorlage anlegen
+- `dotnet new sln` — Solution anlegen
+- `dotnet sln add <projekt>` — Projekt in die Solution aufnehmen
+
+## Bauen
+- `dotnet restore` — NuGet-Pakete auflösen
+- `dotnet build <projekt> -c Release` — Release bauen
+- `dotnet build --no-restore` — ohne Restore, wenn Pakete aktuell sind
+- `dotnet build -v minimal` — knappere Ausgabe
+- `dotnet clean -c Release` — Build-Ausgabe löschen
+
+## Laufen lassen
+- `dotnet run --project <projekt> -c Release` — starten
+- `dotnet run --project <projekt> -- <args>` — Argumente an die App
+- `dotnet watch --project <projekt> run` — bei Dateiänderung neu starten
+
+## Testen
+- `dotnet test <projekt> -c Release --no-build` — Tests ohne Neubau
+- `dotnet test --filter "FullyQualifiedName~<name>"` — nur passende Tests
+- `dotnet test --filter "FullyQualifiedName!~<name>"` — Tests ausschließen
+- `dotnet test --logger "console;verbosity=detailed"` — Details pro Test
+- `dotnet test --blame-hang-timeout 60s` — hängende Tests aufspüren
+
+## Pakete
+- `dotnet add <projekt> package <name>` — Paket hinzufügen
+- `dotnet add <projekt> package <name> --version 1.2.3` — feste Version
+- `dotnet remove <projekt> package <name>` — Paket entfernen
+- `dotnet list <projekt> package --outdated` — veraltete Pakete
+- `dotnet nuget locals all --clear` — NuGet-Caches leeren
+
+## EF Core Migrationen
+- `dotnet ef migrations add <name> -p <daten-projekt>` — Migration anlegen
+- `dotnet ef migrations list -p <daten-projekt>` — Migrationen anzeigen
+- `dotnet ef migrations remove -p <daten-projekt>` — letzte Migration zurücknehmen
+- `dotnet ef database update -p <daten-projekt>` — Schema anwenden
+
+## Veröffentlichen
+- `dotnet publish <projekt> -c Release -r win-x64 --self-contained` — eigenständiges Build
+- `dotnet publish <projekt> -c Release -p:PublishSingleFile=true` — eine Exe
+
+## Diagnose
+- `dotnet --info` — SDKs, Runtimes, RID
+- `dotnet --list-sdks` — installierte SDKs
+- `dotnet format <projekt>` — Formatierung anwenden
+- `dotnet build -p:TreatWarningsAsErrors=true` — Warnungen als Fehler

src/ClaudeDo.Ui/Assets/CheatSheets/git.md

@@ -0,0 +1,80 @@
+# Git
+
+## Start
+- `git clone <url>` — Repository klonen
+- `git init` — neues Repository anlegen
+- `git remote add origin <url>` — Remote verbinden
+
+## Stand ansehen
+- `git status -sb` — Kurzstatus mit Branch-Zeile
+- `git diff` — nicht gestagete Änderungen
+- `git diff --staged` — gestagete Änderungen
+- `git diff main...HEAD` — alles, was dieser Branch gegenüber main bringt
+- `git diff --stat` — nur Datei- und Zeilenzähler
+- `git log --oneline --graph --decorate -20` — kompakter Verlauf
+- `git log -p -- <pfad>` — Verlauf einer Datei mit Diffs
+- `git show <commit>` — ein Commit im Detail
+
+## Branch
+- `git switch <branch>` — Branch wechseln
+- `git switch -c <name>` — Branch anlegen und wechseln
+- `git switch -` — zurück zum vorherigen Branch
+- `git branch -vv` — Branches mit Upstream und letztem Commit
+- `git branch -d <name>` — gemergten Branch löschen (`-D` erzwingt)
+
+## Committen
+- `git add <pfad>` — Änderungen stagen
+- `git add -p` — Änderungen hunk-weise stagen
+- `git commit -m "<text>"` — gestagete Änderungen committen
+- `git commit -- <pfad>` — nur diese Pfade committen
+- `git commit --amend --no-edit` — letzten Commit um die Staging-Area erweitern
+- `git commit --fixup <commit>` — Fixup für späteres Autosquash
+
+## Remote
+- `git fetch --all --prune` — alles holen, gelöschte Remote-Branches aufräumen
+- `git pull --rebase` — holen und eigene Commits obendrauf setzen
+- `git push -u origin <name>` — pushen und Upstream setzen
+- `git push --force-with-lease` — sicheres Force-Push, nie plain `--force`
+
+## Rebase und Merge
+- `git rebase main` — Branch auf aktuellen main setzen
+- `git rebase -i --autosquash main` — interaktiv aufräumen
+- `git rebase --continue` — nach gelöstem Konflikt weiter
+- `git rebase --abort` — Rebase abbrechen, Ausgangszustand zurück
+- `git merge --no-ff <branch>` — Merge-Commit erzwingen
+- `git merge --abort` — laufenden Merge abbrechen
+- `git cherry-pick <commit>` — einzelnen Commit übernehmen
+
+## Konflikte
+- `git diff --name-only --diff-filter=U` — konfliktbehaftete Dateien
+- `git checkout --ours <pfad>` — eigene Seite übernehmen
+- `git checkout --theirs <pfad>` — fremde Seite übernehmen
+- `git mergetool` — konfiguriertes Merge-Tool starten
+
+## Rückgängig
+- `git restore <pfad>` — Datei auf HEAD zurücksetzen, Änderungen weg
+- `git restore --staged <pfad>` — unstagen, Änderungen behalten
+- `git reset --soft HEAD~1` — letzten Commit auflösen, Änderungen gestaged behalten
+- `git reset --hard <commit>` — alles verwerfen, nicht rückholbar
+- `git revert <commit>` — Commit durch Gegen-Commit aufheben
+- `git reflog` — Referenzverlauf, um verlorene Commits wiederzufinden
+
+## Stash
+- `git stash push -m "<text>"` — Änderungen wegpacken
+- `git stash push -u` — inklusive unversionierter Dateien
+- `git stash list` — Stashes anzeigen
+- `git stash pop` — letzten Stash zurückholen und entfernen
+- `git stash apply <stash>` — anwenden, aber behalten
+
+## Worktrees
+- `git worktree list` — alle Worktrees
+- `git worktree add <pfad> <branch>` — Worktree für bestehenden Branch
+- `git worktree add -b <name> <pfad>` — Worktree mit neuem Branch
+- `git worktree remove <pfad>` — Worktree entfernen
+- `git worktree prune` — verwaiste Einträge aufräumen
+
+## Suchen
+- `git grep -n "<text>"` — im Arbeitsbaum suchen
+- `git log -S"<text>"` — Commits, die den Text einfügen oder entfernen
+- `git blame -L 40,60 <pfad>` — Zeilenbereich zuordnen
+- `git bisect start` — binäre Suche nach dem Fehler-Commit

src/ClaudeDo.Ui/Assets/CheatSheets/powershell.md

@@ -0,0 +1,52 @@
+# PowerShell
+
+## Navigieren und Dateien
+- `Get-ChildItem` — Verzeichnis auflisten (`ls`, `-Force` zeigt versteckte)
+- `Set-Location <pfad>` — Verzeichnis wechseln (`cd`)
+- `New-Item -ItemType Directory <pfad>` — Ordner anlegen (`mkdir`)
+- `Copy-Item <quelle> <ziel> -Recurse` — kopieren
+- `Move-Item <quelle> <ziel>` — verschieben oder umbenennen
+- `Remove-Item <pfad> -Recurse -Force` — löschen, endgültig
+- `Test-Path <pfad>` — existiert die Datei oder der Ordner?
+
+## Ansehen und Suchen
+- `Get-Content <datei> -Tail 50` — letzte Zeilen (`-Wait` folgt wie tail -f)
+- `Select-String "<text>" <dateien> -List` — in Dateien suchen (grep)
+- `Get-ChildItem -Recurse -Filter *.log` — Dateien rekursiv finden
+- `<befehl> | Select-Object -First 10` — Ausgabe begrenzen (head)
+- `<befehl> | Where-Object Name -like "*test*"` — Ausgabe filtern
+- `<befehl> | Measure-Object` — zählen (wc)
+- `<befehl> | Out-GridView` — Ausgabe in sortierbarem Fenster
+
+## Prozesse und Dienste
+- `Get-Process | Sort-Object CPU -Descending | Select-Object -First 10` — Top-Prozesse
+- `Stop-Process -Name <name>` — Prozess beenden (`-Id <pid>` per PID)
+- `Get-Service <name>` — Dienststatus
+- `Restart-Service <name>` — Dienst neu starten (Admin nötig)
+
+## Netzwerk
+- `Test-NetConnection <host> -Port 443` — Erreichbarkeit und Port testen
+- `Get-NetTCPConnection -LocalPort <port>` — wer belegt den Port (OwningProcess = PID)
+- `Invoke-RestMethod <url>` — HTTP-Aufruf, JSON kommt als Objekt zurück
+- `Resolve-DnsName <host>` — DNS-Auflösung prüfen
+
+## Umgebung
+- `$env:PATH -split ";"` — PATH lesbar ausgeben
+- `$env:NAME = "wert"` — Variable für diese Session setzen
+- `[Environment]::SetEnvironmentVariable("NAME", "wert", "User")` — dauerhaft setzen
+- `Get-Command <name>` — wo liegt ein Befehl (which)
+- `Get-History` — bisherige Befehle dieser Session
+
+## Windows-Spezifisches
+- `explorer .` — aktuellen Ordner im Explorer öffnen
+- `Start-Process <datei>` — mit Standardprogramm öffnen
+- `Start-Process pwsh -Verb RunAs` — Terminal als Administrator
+- `Set-ExecutionPolicy -Scope CurrentUser RemoteSigned` — lokale Skripte erlauben
+- `winget search <name>` — Software im Paketmanager suchen
+- `winget install <id>` — installieren
+- `winget upgrade --all` — alles aktualisieren
+
+## Hilfe
+- `Get-Help <befehl> -Examples` — Beispiele zu einem Cmdlet
+- `Get-Member` — Eigenschaften eines Pipeline-Objekts anzeigen
+- `Get-Alias <kurzform>` — welches Cmdlet steckt hinter einem Alias

src/ClaudeDo.Ui/CLAUDE.md

@@ -34,13 +34,14 @@ Views/          — mirrors the VM layout; Islands/Detail/ holds TaskHeaderBar,
 Views/Controls/ — MarkdownView, ModalShell, ThemedDatePicker, DiffTextView, DiffEditorSetup,
                   InheritedBadge, AgentConfigEditor, UsagePill, UsageGaugeBar
 Design/         — Tokens.axaml (design tokens; merged before styles)
-                  + IslandStyles.axaml (component styles + the filled icon geometry library)
+                  + IslandStyles.axaml (component styles; icons are Material Design Icons, no local geometry)
 ```
 
 ## Core ViewModels
 
 - **IslandsShellViewModel** — root coordinator. Owns the three island VMs and the `WorkerClient`, wires cross-island events (selection, notes/prep mode, conflict resolution), connection state, the update banner, the inline worker-log strip (clickable → Log Visualizer overlay; `FlashFooterError` surfaces UI-action failures + the worker's Warn/Error there), responsive-layout flags (`ShowLists`/`ShowDetails` by window width), `PrimeStatus` flash, the modal openers, and `RestartWorkerAsync`/`CheckForUpdatesAsync`. Hosts `UpdateCheckService`.
 - **ListsIslandViewModel** — smart lists (My Day, Important, Planned, virtual queued/running/review), user lists, selection, list CRUD, drag-reorder, badge counts, opens list settings / repo import / worktrees overview, `OpenInExplorer`/`OpenInTerminal`.
+  - **Folders:** the sidebar's top level is **one mixed collection**, `TopLevel` (`ObservableCollection<object>`: `ListFolderNavItemViewModel` rows, each with its own `Children`, interleaved with folder-less `ListNavItemViewModel` rows) — that's what lets a list sit *above* a folder. Folders nest arbitrarily deep — a folder's `Children` mixes lists and subfolders the same way `TopLevel` mixes folders and folder-less lists, via `ParentFolderId`. `Folders` is a **recursive** `OfType` projection over the whole tree (not just the top level); `RootLists` stays a `TopLevel`-only projection. `UserLists` stays the **flat superset** every count refresh, row refresh and the no-repo banner work over — a row lives in both. `ContainerOf(row-or-folder)` resolves which collection renders it (non-generic `IList`, since every container is mixed). The view is a single `ItemsControl` over `TopLevel` with **implicit, type-matched `DataTemplate`s in `UserControl.DataTemplates`** — no keyed row template, and the folder's child `ItemsControl` resolves the same templates recursively by walking up to the UserControl (which is also what indents nested folders: each level adds its template's fixed margin). A folder is never selectable: tapping the header runs `ToggleFolderCommand` (persisted to `list_folders.is_collapsed`), and its badge is the sum of all descendant lists, recursive. `DropAsync(source, target, placeBelow)` handles list and folder sources against any target and doubles as the move: a drop position implies a container, so dropping a row onto a row in another folder — or next to *anything* at the top level, folder headers included — reassigns `FolderId`/`ParentFolderId`. A folder dropped onto or next to a target inside its own subtree is silently ignored (self/descendant guard), never nested into itself. `MoveToFolderAsync` is the drop-into-the-header path (reaches collapsed/empty folders, bound to the middle half of the header — the outer quarters insert *next to* the folder instead; also takes a folder source now); `RemoveFromFolderCommand` is its context-menu counterpart. Both end in `PersistOrderAsync` → `ListRepository.ReorderSidebarAsync`/`SetFolderParentAsync`, one `sort_order` sequence spanning **both tables**, walked depth-first. ⚠️ A **folder** drag starts from `PointerMoved` past a 4px threshold using the *stored* `PointerPressedEventArgs` (`DoDragDropAsync` only accepts those) — starting it on press would capture the pointer and swallow the `Tapped` that folds the folder.
 - **TasksIslandViewModel** — open/overdue/completed groups for the selected list with hierarchy-aware regrouping; task CRUD, drag-reorder, toggle done/star, schedule, enqueue/dequeue, cancel; review actions; planning session lifecycle; `RefineTask`, `OpenConPtySessionRequested`, `ToggleManual`, `SyncInteractiveSessions`; MyDay extras (`IsMyDayList`, `ClearDayCommand`, `ShowPrepLogCommand`) and the pinned Notes pseudo-row. Raises `NotesRequested`/`PrepRequested` for the shell.
 - **DetailsIslandViewModel** — the detail pane for a bound `TaskRowViewModel`. Owns live-log streaming (`Log` via `StreamLineFormatter`), debounced title/description editing, subtasks, the session-outcome/roadblock split, the three-tab work console (`output`/`git`/`session`), child surfacing (`ChildOutcomes` + `ChildrenNeedingAttention` drive an attention band on the Session tab), attachments, and the modes `IsNotesMode`/`IsPrepMode`/computed `IsTaskDetailVisible`. Failures raise `ErrorReported`, wired by the shell into `FlashFooterError`.
   - Three concerns are extracted into section VMs exposed as properties: `AgentSettings` (`AgentConfigEditorViewModel`, scope=Task), `MergeSectionViewModel`, `PrepPanelViewModel`. Helper rows live in the same file.
@@ -54,17 +55,29 @@ Design/         — Tokens.axaml (design tokens; merged before styles)
 
 | VM | Notes |
 |---|---|
-| `SettingsModalViewModel` | Four tabs: General, Worktrees, Files (prompt paths), Prime Claude. General hosts the per-model preset table (`ModelPresetRowViewModel`: effort + max turns per alias) which **replaced** the single global "Max turns" field. The Prime Claude tab gives each schedule row a three-way action radio group (Ping / Fill My Day / Custom) — `RadioButton.GroupName` is bound to a **per-row** `RadioGroup` string, since a shared group name would make every schedule share one selection. `DailyPrepMaxTasks` is disabled unless some row is `FillMyDay`. |
+| `SettingsModalViewModel` | Four tabs: General, Worktrees, Files (prompt paths), Prime Claude. General hosts the per-model preset table (`ModelPresetRowViewModel`: effort + max turns per alias) which **replaced** the single global "Max turns" field. The Prime Claude tab gives each schedule row a four-way action radio group (Ping / Fill My Day / Tickets + plan day / Custom) — `RadioButton.GroupName` is bound to a **per-row** `RadioGroup` string, since a shared group name would make every schedule share one selection. `DailyPrepMaxTasks` is disabled unless some row is `FillMyDay` or `ImportTickets`. The Tickets tab (`TicketSettingsTabViewModel`) also holds the fallback-list dropdown for the ticket import; it reads the lists straight from the DB and only writes the fallback back after a successful load. |
-| `ListSettingsModalViewModel` | Name, working dir, commit type, "manual list" flag, `VerifyCommand`, delete. Hosts the shared `AgentConfigEditorViewModel` as `Agent` (scope=List) — ⚠️ save delegates to `Agent.SaveAsync(verifyCommand)` because both land in the same `list_config` row via one `UpdateListConfig` call and would otherwise clobber each other. |
+| `ListSettingsModalViewModel` | Name, working dir, commit type, "manual list" flag, `VerifyCommand`, delete. Hosts the shared `AgentConfigEditorViewModel` as `Agent` (scope=List) — ⚠️ save delegates to `Agent.SaveAsync(verifyCommand)` because both land in the same `list_config` row via one `UpdateListConfig` call and would otherwise clobber each other. **Doubles as the folder editor:** `IsFolder` collapses the body to name + icon, and it's reached either via the create-only "create a folder instead" toggle (`CanToggleFolder`, set by `BeginLoad`) or via `BeginLoadFolder` on an existing folder. There is no list↔folder conversion. Creating a folder writes a `list_folders` row and **deletes the list row the create flow pre-created**, reporting it as `Deleted` so the caller does a full reload. |
 | `WeeklyReportModalViewModel` | Range pickers default "since last standup weekday → today", cached per range. |
 | `MergeHelperSelectionModalViewModel` | "Let Claude handle it" picker → [conpty-sessions](../../docs/explore-notes/conpty-sessions.md). |
-| `UsageMonitorModalViewModel` | Opened from the usage pill (shown **before** the data loads via `BeginLoad`); gauges are **dynamic** per `UsageSnapshotDto.Limits` row, and the 5h/7d ones carry three draggable stage markers (soft/hard/gate) via `UsageGaugeBar` + the pure `UsageThresholdDrag`, plus a colour-matched legend with a `NumericUpDown` per stage → [usage-monitoring](../../docs/explore-notes/usage-monitoring.md). The **analytics** part (models/tasks/cost) comes from the external TokenTracker export, not from us: without the CLI the modal shows a hint card with an install button (gated on Node ≥ 20) instead of the totals header. Gauges, gate and throttle are unaffected by it. |
+| `UsageMonitorModalViewModel` | Opened from the usage pill (shown **before** the data loads via `BeginLoad`); gauges are **dynamic** per `UsageSnapshotDto.Limits` row, and the 5h/7d ones carry three draggable stage markers (soft/hard/gate) via `UsageGaugeBar` + the pure `UsageThresholdDrag`, plus a colour-matched legend with a `NumericUpDown` per stage → [usage-monitoring](../../docs/explore-notes/usage-monitoring.md). The **analytics** part (models/tasks/cost) comes from the external TokenTracker export, not from us: without the CLI the modal shows a hint card with an install button (gated on Node ≥ 20) instead of the totals header. Gauges, gate and throttle are unaffected by it. The modal is **display + threshold drag only** — the PowerUse switch/window/handoff % it used to host moved to Settings → Execution (`GeneralSettingsTabViewModel`), and "Refresh now" is an icon in the titlebar via `ModalShell.HeaderActions` rather than a body row. |
 
 Self-explanatory: `RepoImportModalViewModel` (bulk-create lists from git repos; already-wired
 repos disabled), `MergeModalViewModel`, `WorktreesOverviewModalViewModel`,
-`UnfinishedPlanningModalViewModel`, `LogVisualizerViewModel` (last 30 min, all levels + a
+`UnfinishedPlanningModalViewModel`, `LogVisualizerViewModel` (last 30 min, all levels, merged with the shell's footer-strip history — worker Warn/Error copies deduped by record equality — + a
 warn/error filter), `WorkerConnectionModalViewModel`, `AboutModalViewModel`.
 
+`CheatSheetsViewModel` backs the modeless `CheatSheetsWindow` (Help → Cheat Sheets): content is
+markdown under `Assets/CheatSheets/*.md` as **EmbeddedResource** (not `AvaloniaResource` —
+`AssetLoader` throws without an initialized Avalonia app, which would make the VM unconstructible
+in tests), rendered through `MarkdownView`, with a `Topmost` pin so it can sit docked beside the
+shell. A new sheet = a new `.md` file + its key in `CheatSheetsViewModel.Keys` (+ a menu entry if
+it should be directly reachable). `MarkdownView` has no table/fenced-code support, so sheets are
+bullet lists with inline code — rendered via its opt-in `CommandRows` property, which turns a
+`` `command` — description `` bullet into a mono chip + copy button + description and wraps each
+`##` section in a collapsible `Expander` (blocks are added to the open section's panel, not to the
+host). The flag is opt-in because the other three `MarkdownView` call sites (prompt-file viewer,
+weekly report, task-description preview) render prose where copy buttons would be noise.
+
 ## Diff & Conflicts
 
 `UnifiedDiffParser` (static) + `DiffModels.cs` shared types + `DiffViewerViewModel` (one unified
@@ -79,7 +92,7 @@ single-task and planning unit-merge conflicts. Full detail →
 The two surfaces are **not** variants of one control (read-only 2-way renderer over aligned rows
 vs. 3-way editor over a writable document), but they share their AvaloniaEdit host plumbing via
 `Views/Controls/DiffEditorSetup.cs`: the process-wide TextMate `Registry`, `InstallHighlighting`,
-`ApplyGrammar`, the `Brush` resource fallback, the `Seg` segment, and `VerticalScrollSync`. Put
+`ApplyGrammar`, the `Brush` resource fallback, the `Seg` segment, and `ScrollSync`. Put
 new editor boilerplate there rather than copying it a third time.
 
 ## Services
@@ -94,7 +107,7 @@ new editor boilerplate there rather than copying it a third time.
 
 ## Converters
 
-In `Converters/` — grep rather than list: log-level brush, dot brush,
+In `Converters/` — `ColorBrushConverter` (in `SimpleConverters.cs`) is the one resolver for stored list/folder colours (swatch key → `SwatchNBrush`, `#RRGGBB` → brush, else the `ConverterParameter` resource); the `Swatch1-12Brush` tokens are rewritten in place per accent preset by `AccentPresetService`, so every `AccentPreset` must carry all `AccentPresets.SwatchCount` hexes. Otherwise grep rather than list: log-level brush, dot brush,
 status equality, icon key, `KeepLastNumber`. The one-expression ones
 (strike/italic/opacity toggles, uppercase, not-a-header-row) share
 `SimpleConverters.cs`; put new trivial ones there instead of a new file.
@@ -106,6 +119,9 @@ There is no null→bool converter — bind
 Modals use `TaskCompletionSource` results behind the reusable `ModalShell` control — the dialog
 sets the result on save/cancel, the caller awaits the TCS.
 
+`ModalShell.HeaderActions` is the titlebar slot left of maximise/close — for a window-level action
+that should stay visible without costing a body row (currently only the usage monitor's refresh).
+
 `ModalShell` also owns the window chrome for every modal: the titlebar drag goes through
 `Window.BeginMoveDrag` (so Windows snap works — drag to the top edge to maximise; the OS only
 snaps `CanResize="True"` windows, which is the opt-in), and it insets itself by the window's
@@ -114,7 +130,7 @@ snaps `CanResize="True"` windows, which is the opt-in), and it insets itself by
 ## Gotchas
 
 - **Never set `Foreground`/`Stroke` on an icon inline.** A local value outranks every style, so the button's hover/checked/disabled states can't reach the icon and it looks dead on hover — this is what broke the icons that were "fixed" to the right colour inline. Colour is picked with a class; the single `ICON PAINTING` block in `IslandStyles.axaml` owns all states (`.danger`, `.star-btn.on`, `.active`, `:checked`, `:disabled`). Avalonia has no specificity — that block's **declaration order** is the mechanism, so add new variants in the right section, not at the end.
-- **`PathIcon` *fills* its geometry.** Line-art/stroke icons must be authored as filled geometry or rendered as `<Path Classes="icon-stroke">` inside a `Viewbox` (e.g. `Icon.PlanDay`, `Icon.GitBranch`). A pure stroke path in a `PathIcon` is **invisible**. `Path.icon-stroke` takes the same colour classes/states as `PathIcon`.
+- **Icons are Material Design Icons, nothing hand-drawn.** Use `<PathIcon Data="{Binding Source='mdi:Name', Converter={StaticResource IconKey}}"/>` (`IconKeyConverter`); legacy bare list keys stored in the DB resolve through `IconKeyConverter.LegacyKinds`. A misspelled kind makes the converter return null and the icon **silently vanishes** — `MdiIconNamesTests` scans every `mdi:Name` in `src/ClaudeDo.Ui` and fails on an unknown one. Never set `Foreground` inline (see above).
 - **`NumericUpDown.Value` is `decimal?` and goes null while the box is empty** — i.e. every time the user clears a value to type a new one. Bound TwoWay to a non-nullable `int`/`decimal`, that null throws `InvalidCastException`. Either bind a `decimal?` property (as `AgentConfigEditorViewModel.MaxTurns` does) or add `Converter={StaticResource KeepLastNumber}`, which drops the null via `BindingOperations.DoNothing`.
 - **`ScrollViewer.Padding` is excluded from the Extent (Avalonia 12).** At max scroll the content still sticks out below the viewport by the padding height, so the last line(s) are clipped and unreachable — even after `ScrollToEnd()`. Put the inset on the *content* (`Margin` on the inner `ItemsControl`/`StackPanel`) instead. Verified headlessly: 12,8,12,4 on the viewer → last item 20px below the viewport; same inset as content margin → fully visible. **`ListBox` does *not* have this trap** — its Fluent control-theme template forwards `Padding` onto `PART_ItemsPresenter`'s margin (content side), not the raw `ScrollViewer.Padding`; verified headlessly that `ListBox.Padding="10,4"` and a `Margin="10,4"` on the `ItemsPanelTemplate` panel produce an *identical* Extent and leave the last row fully visible at max scroll. Still fine to put the inset on the panel for consistency with the other scrollables above, just don't assume it's fixing a real bug there.
 - **Re-templating a `TabControl` must keep `PART_ItemsPresenter`.** `TabControl.SelectedContent` is resolved via `ContainerFromIndex`, and containers are only realized by the `ItemsPresenter`. A template that renders just `PART_SelectedContentHost` (to hide the tab strip) leaves `SelectedContent` permanently `null` → an empty body. Keep the presenter with `IsVisible="False"`; that still realizes containers (verified headlessly, Avalonia 12.0.4). This broke the whole Settings modal body in 56c3719e.

src/ClaudeDo.Ui/ClaudeDo.Ui.csproj

@@ -9,7 +9,9 @@
   <ItemGroup>
     <PackageReference Include="Avalonia" Version="12.0.4" />
     <PackageReference Include="Avalonia.AvaloniaEdit" Version="12.0.0" />
+    <PackageReference Include="Avalonia.Controls.ColorPicker" Version="12.0.4" />
     <PackageReference Include="AvaloniaEdit.TextMate" Version="12.0.0" />
+    <PackageReference Include="Material.Icons" Version="3.0.2" />
     <PackageReference Include="TextMateSharp.Grammars" Version="2.0.3" />
     <PackageReference Include="CommunityToolkit.Mvvm" Version="8.4.1" />
     <PackageReference Include="Microsoft.AspNetCore.SignalR.Client" Version="8.0.11" />
@@ -17,6 +19,7 @@
     <PackageReference Include="Microsoft.Win32.Registry" Version="5.0.0" />
     <PackageReference Include="Duende.IdentityModel.OidcClient" Version="7.1.0" />
     <PackageReference Include="Iciclecreek.Avalonia.Terminal" Version="2.0.3" />
+    <PackageReference Include="Serilog" Version="4.0.0" />
   </ItemGroup>
 
   <ItemGroup>
@@ -36,6 +39,9 @@
   </ItemGroup>
 
   <ItemGroup>
+    <!-- EmbeddedResource, not AvaloniaResource: reading these needs no initialized Avalonia
+         app, so the VM stays constructible in tests. -->
+    <EmbeddedResource Include="Assets/CheatSheets/*.md" />
     <AvaloniaResource Include="Assets/Fonts/*.ttf" />
     <AvaloniaResource Include="Assets/Fonts/OFL-InterTight.txt" />
     <AvaloniaResource Include="Assets/Fonts/OFL-JetBrainsMono.txt" />

src/ClaudeDo.Ui/Converters/IconKeyConverter.cs

@@ -2,27 +2,95 @@ using System.Globalization;
 using Avalonia;
 using Avalonia.Data.Converters;
 using Avalonia.Media;
+using Material.Icons;
 
 namespace ClaudeDo.Ui.Converters;
 
 /// <summary>
-/// Converts an icon key string (e.g. "Sun") to the matching StreamGeometry resource "Icon.Sun".
+/// Converts an icon key to its geometry: "mdi:RocketLaunch" → the Material Design Icons path of that
+/// <see cref="MaterialIconKind"/>; a legacy bare key ("Rocket") → its <see cref="LegacyKinds"/> entry;
+/// any other bare key → the "Icon.&lt;key&gt;" StreamGeometry resource.
 /// </summary>
 public class IconKeyConverter : IValueConverter
 {
+    /// <summary>Key prefix marking a Material Design Icons kind.</summary>
+    public const string MdiPrefix = "mdi:";
+
+    /// <summary>Bare keys stored in the DB by older versions → the MDI kind that replaces their hand-drawn geometry.</summary>
+    public static readonly IReadOnlyDictionary<string, MaterialIconKind> LegacyKinds = new Dictionary<string, MaterialIconKind>
+    {
+        ["Dot"] = MaterialIconKind.CircleMedium,
+        ["Folder"] = MaterialIconKind.FolderOutline,
+        ["Star"] = MaterialIconKind.StarOutline,
+        ["Sun"] = MaterialIconKind.WeatherSunny,
+        ["Calendar"] = MaterialIconKind.CalendarOutline,
+        ["Clock"] = MaterialIconKind.ClockOutline,
+        ["Inbox"] = MaterialIconKind.InboxOutline,
+        ["Mail"] = MaterialIconKind.EmailOutline,
+        ["Text"] = MaterialIconKind.NoteTextOutline,
+        ["Search"] = MaterialIconKind.Magnify,
+        ["Grid"] = MaterialIconKind.ViewGridOutline,
+        ["Code"] = MaterialIconKind.CodeTags,
+        ["Terminal"] = MaterialIconKind.Console,
+        ["Database"] = MaterialIconKind.DatabaseOutline,
+        ["Server"] = MaterialIconKind.ServerOutline,
+        ["Chip"] = MaterialIconKind.Chip,
+        ["Bolt"] = MaterialIconKind.LightningBoltOutline,
+        ["Wand"] = MaterialIconKind.AutoFix,
+        ["Flask"] = MaterialIconKind.FlaskOutline,
+        ["Shield"] = MaterialIconKind.ShieldOutline,
+        ["Activity"] = MaterialIconKind.Pulse,
+        ["Eye"] = MaterialIconKind.EyeOutline,
+        ["Check"] = MaterialIconKind.CheckCircleOutline,
+        ["Warning"] = MaterialIconKind.AlertOutline,
+        ["Chart"] = MaterialIconKind.ChartLineVariant,
+        ["Rocket"] = MaterialIconKind.RocketLaunchOutline,
+        ["Bulb"] = MaterialIconKind.LightbulbOutline,
+        ["Broom"] = MaterialIconKind.Broom,
+        ["AgentSuggested"] = MaterialIconKind.CreationOutline,
+        ["Settings"] = MaterialIconKind.Cog,
+        ["Box"] = MaterialIconKind.PackageVariantClosed,
+        ["Truck"] = MaterialIconKind.TruckOutline,
+        ["MapPin"] = MaterialIconKind.MapMarkerOutline,
+        ["Camera"] = MaterialIconKind.CameraOutline,
+        ["Image"] = MaterialIconKind.ImageOutline,
+        ["Barcode"] = MaterialIconKind.Barcode,
+        ["Skull"] = MaterialIconKind.SkullOutline,
+    };
+
     public static IconKeyConverter Instance { get; } = new();
 
+    private static readonly Dictionary<string, Geometry?> MdiCache = new();
+
     public object? Convert(object? value, Type targetType, object? parameter, CultureInfo culture)
     {
         if (value is not string key || string.IsNullOrEmpty(key))
             return null;
 
+        if (key.StartsWith(MdiPrefix, StringComparison.Ordinal))
+            return MdiGeometry(key[MdiPrefix.Length..]);
+
+        if (LegacyKinds.TryGetValue(key, out var legacy))
+            return MdiGeometry(legacy.ToString());
+
         var resourceKey = $"Icon.{key}";
         if (Application.Current?.TryGetResource(resourceKey, null, out var res) == true)
             return res as StreamGeometry;
         return null;
     }
 
+    /// <summary>Parses (and caches) the geometry for an MDI kind name; null for unknown names.</summary>
+    private static Geometry? MdiGeometry(string name)
+    {
+        if (MdiCache.TryGetValue(name, out var cached))
+            return cached;
+        var geometry = Enum.TryParse<MaterialIconKind>(name, out var kind)
+            ? StreamGeometry.Parse(MaterialIconDataProvider.GetData(kind))
+            : null;
+        MdiCache[name] = geometry;
+        return geometry;
+    }
+
     public object ConvertBack(object? value, Type targetType, object? parameter, CultureInfo culture)
         => throw new NotSupportedException();
 }

src/ClaudeDo.Ui/Converters/LogKindForegroundConverter.cs

@@ -24,15 +24,17 @@ public sealed class LogKindForegroundConverter : IValueConverter
     {
         var key = value is LogKind kind ? kind switch
         {
-            LogKind.Sys    => "TextMuteBrush",
+            LogKind.Sys        => "TextMuteBrush",
-            LogKind.Tool   => "SageBrush",
+            LogKind.Tool       => "SageBrush",
-            LogKind.Claude => "TextBrush",
+            LogKind.Claude     => "TextBrush",
-            LogKind.Stdout => "TextDimBrush",
+            LogKind.Stdout     => "TextDimBrush",
-            LogKind.Stderr => "BloodBrush",
+            LogKind.Stderr     => "BloodBrush",
-            LogKind.Done   => "MossBrightBrush",
+            LogKind.Done       => "MossBrightBrush",
-            LogKind.Msg    => "TextDimBrush",
+            LogKind.Msg        => "TextDimBrush",
-            LogKind.User   => "AccentBrush",
+            LogKind.User       => "AccentBrush",
-            _              => "TextDimBrush",
+            LogKind.Edit       => "AmberBrush",
+            LogKind.ToolResult => "TextMuteBrush",
+            _                  => "TextDimBrush",
         } : "TextDimBrush";
 
         return Resolve(key) ?? AvaloniaProperty.UnsetValue;

src/ClaudeDo.Ui/Converters/SimpleConverters.cs

@@ -9,6 +9,42 @@ namespace ClaudeDo.Ui.Converters;
 // instantiate a generic FuncValueConverter as a resource; they stay one per type so the
 // x:Key names in App.axaml keep resolving. Anything with real logic gets its own file.
 
+/// <summary>
+/// A stored list/folder colour to a brush: "#RRGGBB" becomes a <see cref="SolidColorBrush"/>, a swatch key
+/// ("Swatch3") resolves to the app resource "Swatch3Brush"; null, empty or unknown falls back to the resource named by the parameter.
+/// </summary>
+public sealed class ColorBrushConverter : OneWayConverter
+{
+    public static ColorBrushConverter Instance { get; } = new();
+    public override object? Convert(object? value, Type targetType, object? parameter, CultureInfo culture)
+        => Resolve(value as string, parameter as string, LookupResource);
+
+    private static object? LookupResource(string key)
+        => Avalonia.Application.Current?.TryGetResource(key, null, out var res) == true ? res : null;
+
+    /// <summary>Resolves a stored colour against <paramref name="lookup"/> (app resources in production); split out so tests need no Avalonia app.</summary>
+    internal static object? Resolve(string? value, string? fallbackKey, Func<string, object?> lookup)
+    {
+        if (value is { Length: > 0 })
+        {
+            if (value[0] == '#')
+            {
+                if (Color.TryParse(value, out var c)) return new SolidColorBrush(c);
+            }
+            else if (lookup(value + "Brush") is { } swatch) return swatch;
+        }
+        return fallbackKey is null ? null : lookup(fallbackKey);
+    }
+}
+
+/// <summary>True when the value's string form equals the parameter (segmented-switch active state).</summary>
+public sealed class EqualsParameterConverter : OneWayConverter
+{
+    public static EqualsParameterConverter Instance { get; } = new();
+    public override object? Convert(object? value, Type targetType, object? parameter, CultureInfo culture)
+        => Equals(value?.ToString(), parameter as string);
+}
+
 public sealed class UpperCaseConverter : OneWayConverter
 {
     public static UpperCaseConverter Instance { get; } = new();

src/ClaudeDo.Ui/Design/IslandStyles.axaml

@@ -15,179 +15,9 @@
         xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml">
 
   <!-- ============================================================ -->
-  <!-- ICON GEOMETRY RESOURCES                                      -->
+  <!-- SHARED RESOURCES                                             -->
   <!-- ============================================================ -->
   <Styles.Resources>
-    <!-- Window control icons — filled geometries (PathIcon fills, not strokes) -->
-    <StreamGeometry x:Key="Icon.WinMin">M4 9 H16 V11 H4 Z</StreamGeometry>
-    <StreamGeometry x:Key="Icon.WinMax">M4 4 H16 V6 H4 Z M4 14 H16 V16 H4 Z M4 4 H6 V16 H4 Z M14 4 H16 V16 H14 Z</StreamGeometry>
-    <!-- Icon.Grid (four filled panes — Mission Control launcher) -->
-    <StreamGeometry x:Key="Icon.Grid">M3 3 H9 V9 H3 Z M11 3 H17 V9 H11 Z M3 11 H9 V17 H3 Z M11 11 H17 V17 H11 Z</StreamGeometry>
-    <StreamGeometry x:Key="Icon.WinRestore">M4 7 H13 V9 H4 Z M4 14 H13 V16 H4 Z M4 7 H6 V16 H4 Z M11 7 H13 V16 H11 Z M7 4 H16 V6 H7 Z M14 4 H16 V13 H14 Z</StreamGeometry>
-    <StreamGeometry x:Key="Icon.WinClose">M4 5 L5 4 L16 15 L15 16 Z M15 4 L16 5 L5 16 L4 15 Z</StreamGeometry>
-    <!-- Brand check glyph — filled rounded square with inset tick -->
-    <StreamGeometry x:Key="Icon.BrandCheck">M3 3 H21 V21 H3 Z M6 12 L7 11 L10 14 L17 7 L18 8 L10 16 Z</StreamGeometry>
-
-    <!-- ============================================================ -->
-    <!-- Icons — central icon library (Phase B)                      -->
-    <!-- All d-strings sourced from icons.jsx                        -->
-    <!-- ============================================================ -->
-
-    <!-- Icon.Sun — filled disc + 8 rays. The old stroke-only version rendered as a bare dot in a
-         PathIcon (verified by rendering it); rays are kept clear of the disc so EvenOdd is safe. -->
-    <StreamGeometry x:Key="Icon.Sun">M7.5 12 C7.5 9.51 9.51 7.5 12 7.5 C14.49 7.5 16.5 9.51 16.5 12 C16.5 14.49 14.49 16.5 12 16.5 C9.51 16.5 7.5 14.49 7.5 12 Z M11 2 H13 V5.5 H11 Z M11 18.5 H13 V22 H11 Z M2 11 H5.5 V13 H2 Z M18.5 11 H22 V13 H18.5 Z M4.22 5.64 L5.64 4.22 L8.11 6.69 L6.69 8.11 Z M18.36 4.22 L19.78 5.64 L17.31 8.11 L15.89 6.69 Z M5.64 19.78 L4.22 18.36 L6.69 15.89 L8.11 17.31 Z M19.78 18.36 L18.36 19.78 L15.89 17.31 L17.31 15.89 Z</StreamGeometry>
-
-    <!-- Icon.Activity (pulse waveform) — filled outline of the polyline; PathIcon fills, a stroke-only pulse renders as blobs -->
-    <StreamGeometry x:Key="Icon.Activity">M3,11 L6.28,11 L9,2.84 L12.86,14.43 L14.46,8.04 L17.41,11 L21,11 L21,13 L16.59,13 L15.54,11.96 L13.14,21.57 L9,9.16 L7.72,13 L3,13 Z</StreamGeometry>
-
-    <!-- Icon.Star -->
-    <StreamGeometry x:Key="Icon.Star">M12 3.5l2.6 5.3 5.8.8-4.2 4.1 1 5.8-5.2-2.7-5.2 2.7 1-5.8-4.2-4.1 5.8-.8z</StreamGeometry>
-
-    <!-- Icon.Calendar — solid header band, hollow body, two binder posts and a date block.
-         The old stroke version filled into a plain black square. -->
-    <StreamGeometry x:Key="Icon.Calendar">F0 M3 5 H21 V21 H3 Z M5 11 H19 V19 H5 Z M7 2 H9 V5 H7 Z M15 2 H17 V5 H15 Z M7.5 13 H10 V15.5 H7.5 Z</StreamGeometry>
-
-    <!-- Icon.Eye -->
-    <StreamGeometry x:Key="Icon.Eye">M2 12s3.5-7 10-7 10 7 10 7-3.5 7-10 7S2 12 2 12z M12 9a3 3 0 1 0 0 6 3 3 0 0 0 0-6z</StreamGeometry>
-
-    <!-- Icon.Inbox — tray frame with an arrow dropping into the upper compartment.
-         The old stroke version filled into a solid slab. -->
-    <StreamGeometry x:Key="Icon.Inbox">F0 M3 5 H21 V19 H3 Z M5 7 H19 V12 H5 Z M5 14 H19 V17 H5 Z M11 7.6 H13 V9.4 H15 L12 12 L9 9.4 H11 Z</StreamGeometry>
-
-    <!-- Icon.Folder -->
-    <StreamGeometry x:Key="Icon.Folder">M3 7a2 2 0 0 1 2-2h4l2 2h8a2 2 0 0 1 2 2v9a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z</StreamGeometry>
-
-    <!-- Icon.Search — hollow ring + handle. The old stroke version filled into a solid disc with
-         no handle at all (this one is also the magnifier in the lists search box). -->
-    <StreamGeometry x:Key="Icon.Search">F0 M3 10.5 C3 6.36 6.36 3 10.5 3 C14.64 3 18 6.36 18 10.5 C18 14.64 14.64 18 10.5 18 C6.36 18 3 14.64 3 10.5 Z M5.2 10.5 C5.2 7.57 7.57 5.2 10.5 5.2 C13.43 5.2 15.8 7.57 15.8 10.5 C15.8 13.43 13.43 15.8 10.5 15.8 C7.57 15.8 5.2 13.43 5.2 10.5 Z M14.88 16.58 L16.58 14.88 L22.05 20.35 L20.35 22.05 Z</StreamGeometry>
-
-    <!-- Icon.Plus — filled cross (PathIcon fills, so a stroke-only plus renders invisible) -->
-    <StreamGeometry x:Key="Icon.Plus">M10.6 5 H13.4 V10.6 H19 V13.4 H13.4 V19 H10.6 V13.4 H5 V10.6 H10.6 Z</StreamGeometry>
-
-    <!-- Icon.MoreHorizontal (three filled dots) — uses fill so rendered via PathIcon with fill brush -->
-    <StreamGeometry x:Key="Icon.MoreHorizontal">M5 12m-1.3 0a1.3 1.3 0 1 0 2.6 0 1.3 1.3 0 1 0-2.6 0 M12 12m-1.3 0a1.3 1.3 0 1 0 2.6 0 1.3 1.3 0 1 0-2.6 0 M19 12m-1.3 0a1.3 1.3 0 1 0 2.6 0 1.3 1.3 0 1 0-2.6 0</StreamGeometry>
-
-    <!-- Icon.GitBranch -->
-    <StreamGeometry x:Key="Icon.GitBranch">M6 3a2 2 0 1 0 0 4 2 2 0 0 0 0-4z M6 19a2 2 0 1 0 0 4 2 2 0 0 0 0-4z M18 5a2 2 0 1 0 0 4 2 2 0 0 0 0-4z M6 7v10M6 13c0-4 12-2 12-4</StreamGeometry>
-
-    <!-- Icon.Copy -->
-    <StreamGeometry x:Key="Icon.Copy">M8 8h12a1.5 1.5 0 0 1 1.5 1.5v12A1.5 1.5 0 0 1 20 23H8a1.5 1.5 0 0 1-1.5-1.5v-12A1.5 1.5 0 0 1 8 8z M16 8V5a1 1 0 0 0-1-1H5a1 1 0 0 0-1 1v10a1 1 0 0 0 1 1h3</StreamGeometry>
-
-    <!-- Icon.Trash -->
-    <StreamGeometry x:Key="Icon.Trash">M4 7h16M10 11v6M14 11v6M5 7l1 13a1 1 0 0 0 1 1h10a1 1 0 0 0 1-1l1-13M9 7V4h6v3</StreamGeometry>
-
-    <!-- Icon.Broom (filled: handle + binding band + flared bristles) -->
-    <StreamGeometry x:Key="Icon.Broom">M11 3 H13 V10 H11 Z M8.5 10 H15.5 V12 H8.5 Z M9 12 H15 L17 21 H7 Z</StreamGeometry>
-
-    <!-- Icon.PlanDay (stroke-rendered via Path.icon-stroke — sun over horizon) -->
-    <StreamGeometry x:Key="Icon.PlanDay">M3,20 L21,20 M8.4,11 a3.6,3.6 0 1,0 7.2,0 a3.6,3.6 0 1,0 -7.2,0 M12,4.5 L12,3 M6,11 L4.5,11 M18,11 L19.5,11 M7.5,6.5 L6.4,5.4 M16.5,6.5 L17.6,5.4</StreamGeometry>
-
-    <!-- Icon.Refine (stroke-rendered via Path.icon-stroke — list lines + two sparkles) -->
-    <StreamGeometry x:Key="Icon.Refine">M3,6 L13,6 M3,11 L11,11 M3,16 L9,16 M18.5,3 L19.28,5.22 L21.5,6 L19.28,6.78 L18.5,9 L17.72,6.78 L15.5,6 L17.72,5.22 Z M19.5,14.9 L19.85,16.15 L21.1,16.5 L19.85,16.85 L19.5,18.1 L19.15,16.85 L17.9,16.5 L19.15,16.15 Z</StreamGeometry>
-
-    <!-- Icon.X — filled X outline (PathIcon fills, so a stroke-only X renders invisible) -->
-    <StreamGeometry x:Key="Icon.X">M6.4 4.6 L12 10.2 L17.6 4.6 L19.4 6.4 L13.8 12 L19.4 17.6 L17.6 19.4 L12 13.8 L6.4 19.4 L4.6 17.6 L10.2 12 L4.6 6.4 Z</StreamGeometry>
-
-    <!-- Icon.Stop — filled square (stop / interrupt) -->
-    <StreamGeometry x:Key="Icon.Stop">M4 4 H20 V20 H4 Z</StreamGeometry>
-
-    <!-- Icon.Check — filled tick. The old stroke version filled into a solid wedge. -->
-    <StreamGeometry x:Key="Icon.Check">M9.6 18.2 L3.4 12 L5.5 9.9 L9.6 14 L18.5 5.1 L20.6 7.2 Z</StreamGeometry>
-
-    <!-- Icon.ArrowOut — filled arrow for "open external" button -->
-    <StreamGeometry x:Key="Icon.ArrowOut">M13 4 H20 V11 H18 V7.4 L11.4 14 L10 12.6 L16.6 6 H13 Z M4 6 H10 V8 H6 V18 H16 V14 H18 V20 H4 Z</StreamGeometry>
-
-    <!-- Icon.ChevronRight / Icon.ChevronDown — filled expand/collapse chevrons (PathIcon fills) -->
-    <StreamGeometry x:Key="Icon.ChevronRight">M9 5 L16 12 L9 19 L6.8 16.8 L11.6 12 L6.8 7.2 Z</StreamGeometry>
-    <StreamGeometry x:Key="Icon.ChevronDown">M5 9 L12 16 L19 9 L16.8 6.8 L12 11.6 L7.2 6.8 Z</StreamGeometry>
-
-    <!-- Icon.Text — three filled horizontal bars (paragraph / description icon) -->
-    <StreamGeometry x:Key="Icon.Text">M4 6 H20 V8 H4 Z M4 11 H20 V13 H4 Z M4 16 H14 V18 H4 Z</StreamGeometry>
-
-    <!-- Icon.Warning — filled triangle with exclamation (roadblock badge) -->
-    <StreamGeometry x:Key="Icon.Warning">F0 M12 3 L22 20 H2 Z M11 9 H13 V14 H11 Z M11 16 H13 V18 H11 Z</StreamGeometry>
-
-    <!-- Icon.AgentSuggested — filled diamond (agent-suggested child badge) -->
-    <StreamGeometry x:Key="Icon.AgentSuggested">M12 3 L20 12 L12 21 L4 12 Z</StreamGeometry>
-
-    <!-- Icon.Settings (gear) -->
-    <StreamGeometry x:Key="Icon.Settings">M12 8a4 4 0 1 0 0 8 4 4 0 0 0 0-8z M19.43 12.98c.04-.32.07-.64.07-.98s-.03-.66-.07-.98l2.11-1.65a.5.5 0 0 0 .12-.64l-2-3.46a.5.5 0 0 0-.61-.22l-2.49 1a7.03 7.03 0 0 0-1.69-.98l-.38-2.65a.5.5 0 0 0-.5-.42h-4a.5.5 0 0 0-.5.42l-.38 2.65c-.61.25-1.17.59-1.69.98l-2.49-1a.5.5 0 0 0-.61.22l-2 3.46a.5.5 0 0 0 .12.64l2.11 1.65c-.04.32-.07.65-.07.98s.03.66.07.98l-2.11 1.65a.5.5 0 0 0-.12.64l2 3.46a.5.5 0 0 0 .61.22l2.49-1c.52.4 1.08.73 1.69.98l.38 2.65a.5.5 0 0 0 .5.42h4a.5.5 0 0 0 .5-.42l.38-2.65c.61-.25 1.17-.59 1.69-.98l2.49 1a.5.5 0 0 0 .61-.22l2-3.46a.5.5 0 0 0-.12-.64l-2.11-1.65z</StreamGeometry>
-
-    <!-- Icon.Wrap — a full-width line above a line that wraps back with an arrowhead -->
-    <StreamGeometry x:Key="Icon.Wrap">M3 5 H21 V7 H3 Z M3 11 H17 A4 4 0 0 1 17 19 H12 V21 L7 18 L12 15 V17 H17 A2 2 0 0 0 17 13 H3 Z</StreamGeometry>
-
-    <!-- Icon.Skull — filled silhouette: rounded cranium + eye holes (EvenOdd) + jaw -->
-    <StreamGeometry x:Key="Icon.Skull">F0 M12 2 C7 2 4 5.5 4 10 C4 13.5 6 16 8 17.5 L8 19 C8 20 8.9 21 10 21 L10 18.5 L14 18.5 L14 21 C15.1 21 16 20 16 19 L16 17.5 C18 16 20 13.5 20 10 C20 5.5 17 2 12 2 Z M8.5 8 L8.5 12 L11 12 L11 8 Z M13 8 L13 12 L15.5 12 L15.5 8 Z</StreamGeometry>
-
-    <!-- ============================================================ -->
-    <!-- List icons — pickable in list settings → Icon tab.           -->
-    <!-- All filled outlines (PathIcon fills; a stroke-only path is   -->
-    <!-- invisible). Holes rely on the EvenOdd default; the two that  -->
-    <!-- want overlapping subpaths to merge declare F1 explicitly.    -->
-    <!-- ============================================================ -->
-
-    <!-- Icon.Box — carton: solid lid band, open body, seam -->
-    <StreamGeometry x:Key="Icon.Box">F0 M3 5 H21 V20 H3 Z M5 11 H19 V18 H5 Z M11 11 H13 V14 H11 Z</StreamGeometry>
-
-    <!-- Icon.Truck — box body + cab + two wheels (F1: wheels overlap the body) -->
-    <StreamGeometry x:Key="Icon.Truck">F1 M2 6 H13.5 V16 H2 Z M13.5 9.5 H17.4 L21 13.1 V16 H13.5 Z M7 15.5 a2.5 2.5 0 1 0 0 5 a2.5 2.5 0 1 0 0-5 Z M17 15.5 a2.5 2.5 0 1 0 0 5 a2.5 2.5 0 1 0 0-5 Z</StreamGeometry>
-
-    <!-- Icon.MapPin — location pin with punched-out centre -->
-    <StreamGeometry x:Key="Icon.MapPin">F0 M12 2 C8.1 2 5 5.1 5 9 C5 14.2 12 22 12 22 C12 22 19 14.2 19 9 C19 5.1 15.9 2 12 2 Z M12 6.5 a2.5 2.5 0 1 0 0 5 a2.5 2.5 0 1 0 0-5 Z</StreamGeometry>
-
-    <!-- Icon.Chart — three rising bars -->
-    <StreamGeometry x:Key="Icon.Chart">M4 13 H8 V20 H4 Z M10 8 H14 V20 H10 Z M16 4 H20 V20 H16 Z</StreamGeometry>
-
-    <!-- Icon.Server — two rack units with punched-out status LEDs -->
-    <StreamGeometry x:Key="Icon.Server">F0 M3 4 H21 V10 H3 Z M3 14 H21 V20 H3 Z M5.5 6 H7.5 V8 H5.5 Z M5.5 16 H7.5 V18 H5.5 Z</StreamGeometry>
-
-    <!-- Icon.Chip — CPU die with hollow core and eight pins -->
-    <StreamGeometry x:Key="Icon.Chip">F0 M7 7 H17 V17 H7 Z M9.5 9.5 H14.5 V14.5 H9.5 Z M9 3 H10.5 V6.5 H9 Z M13.5 3 H15 V6.5 H13.5 Z M9 17.5 H10.5 V21 H9 Z M13.5 17.5 H15 V21 H13.5 Z M3 9 H6.5 V10.5 H3 Z M3 13.5 H6.5 V15 H3 Z M17.5 9 H21 V10.5 H17.5 Z M17.5 13.5 H21 V15 H17.5 Z</StreamGeometry>
-
-    <!-- Icon.Bolt — lightning bolt -->
-    <StreamGeometry x:Key="Icon.Bolt">M13 2 L4 14 H10 L9 22 L20 9 H13.6 Z</StreamGeometry>
-
-    <!-- Icon.Rocket — hull with porthole hole + exhaust -->
-    <StreamGeometry x:Key="Icon.Rocket">F0 M12 2 C15.5 5 17.5 9.5 17.5 14 V17 L14.5 19 H9.5 L6.5 17 V14 C6.5 9.5 8.5 5 12 2 Z M12 7.5 a2.2 2.2 0 1 0 0 4.4 a2.2 2.2 0 1 0 0-4.4 Z M9.5 19.5 H14.5 L13 22.5 H11 Z</StreamGeometry>
-
-    <!-- Icon.Bulb — bulb over two screw-base bands -->
-    <StreamGeometry x:Key="Icon.Bulb">F0 M12 2 C8.1 2 5 5.1 5 9 C5 11.6 6.4 13.9 8.5 15.1 V17 H15.5 V15.1 C17.6 13.9 19 11.6 19 9 C19 5.1 15.9 2 12 2 Z M8.5 18.2 H15.5 V19.8 H8.5 Z M9.8 20.9 H14.2 V22.3 H9.8 Z</StreamGeometry>
-
-    <!-- Icon.Flask — Erlenmeyer flask, single closed outline -->
-    <StreamGeometry x:Key="Icon.Flask">M9 2 H15 V4 H14 V9.3 L19.4 19.4 A1.5 1.5 0 0 1 18.1 21.6 H5.9 A1.5 1.5 0 0 1 4.6 19.4 L10 9.3 V4 H9 Z</StreamGeometry>
-
-    <!-- Icon.Shield — shield with a punched-out check -->
-    <StreamGeometry x:Key="Icon.Shield">F0 M12 2 L4 5 V11 C4 16 7.4 20.3 12 21.5 C16.6 20.3 20 16 20 11 V5 Z M11 16.2 L7.2 12.4 L8.9 10.7 L11 12.8 L15.4 8.4 L17.1 10.1 Z</StreamGeometry>
-
-    <!-- Icon.Camera — body with viewfinder bump and punched-out lens -->
-    <StreamGeometry x:Key="Icon.Camera">F0 M9 3 H15 L16.5 5.5 H20 A2 2 0 0 1 22 7.5 V19 A2 2 0 0 1 20 21 H4 A2 2 0 0 1 2 19 V7.5 A2 2 0 0 1 4 5.5 H7.5 Z M12 9 a4.5 4.5 0 1 0 0 9 a4.5 4.5 0 1 0 0-9 Z</StreamGeometry>
-
-    <!-- Icon.Image — frame with mountains and sun inside the cut-out -->
-    <StreamGeometry x:Key="Icon.Image">F0 M3 4 H21 V20 H3 Z M5 6 H19 V18 H5 Z M6.5 16.5 L10.5 11 L13.5 14.5 L15.5 12.5 L17.5 16.5 Z M8 8 a1.6 1.6 0 1 0 0 3.2 a1.6 1.6 0 1 0 0-3.2 Z</StreamGeometry>
-
-    <!-- Icon.Barcode — six bars of varying width -->
-    <StreamGeometry x:Key="Icon.Barcode">M3 4 H5 V20 H3 Z M6.5 4 H7.5 V20 H6.5 Z M9 4 H11.5 V20 H9 Z M13 4 H14 V20 H13 Z M15.5 4 H17.5 V20 H15.5 Z M19 4 H21 V20 H19 Z</StreamGeometry>
-
-    <!-- Icon.Mail — envelope: frame cut out, flap drawn back inside it -->
-    <StreamGeometry x:Key="Icon.Mail">F0 M2 5 H22 V19 H2 Z M4 7 H20 V17 H4 Z M4 7 L12 13.5 L20 7 L20 8.7 L12 15.2 L4 8.7 Z</StreamGeometry>
-
-    <!-- Icon.Terminal — console frame with prompt chevron and caret -->
-    <StreamGeometry x:Key="Icon.Terminal">F0 M2 4 H22 V20 H2 Z M4 6 H20 V18 H4 Z M6 8.4 L7.4 7 L11.4 11 L7.4 15 L6 13.6 L8.6 11 Z M12.5 13.4 H17 V15.2 H12.5 Z</StreamGeometry>
-
-    <!-- Icon.Code — angle brackets around a slash -->
-    <StreamGeometry x:Key="Icon.Code">M8.6 5.4 L10 6.8 L5.8 11 L10 15.2 L8.6 16.6 L3 11 Z M15.4 5.4 L21 11 L15.4 16.6 L14 15.2 L18.2 11 L14 6.8 Z M13.6 3.4 L15.4 3.9 L10.4 20.6 L8.6 20.1 Z</StreamGeometry>
-
-    <!-- Icon.Database — cylinder with the top ellipse punched out. Béziers, not arcs: an arc
-         spanning exactly its own diameter degenerates to a straight line here (measured). -->
-    <StreamGeometry x:Key="Icon.Database">F0 M5.3 5.2 C5.3 3.43 8.3 2 12 2 C15.7 2 18.7 3.43 18.7 5.2 V18.8 C18.7 20.57 15.7 22 12 22 C8.3 22 5.3 20.57 5.3 18.8 Z M5.3 5.2 C5.3 3.43 8.3 2 12 2 C15.7 2 18.7 3.43 18.7 5.2 C18.7 6.97 15.7 8.4 12 8.4 C8.3 8.4 5.3 6.97 5.3 5.2 Z</StreamGeometry>
-
-    <!-- Icon.Wand — wand shaft plus three sparkles (kept clear of the shaft) -->
-    <StreamGeometry x:Key="Icon.Wand">M3.3 19.3 L13.3 9.3 L14.7 10.7 L4.7 20.7 Z M18 2.5 L19.1 5.9 L22.5 7 L19.1 8.1 L18 11.5 L16.9 8.1 L13.5 7 L16.9 5.9 Z M6 3 L6.7 4.8 L8.5 5.5 L6.7 6.2 L6 8 L5.3 6.2 L3.5 5.5 L5.3 4.8 Z M19.5 15 L20.2 16.8 L22 17.5 L20.2 18.2 L19.5 20 L18.8 18.2 L17 17.5 L18.8 16.8 Z</StreamGeometry>
-
-    <!-- Icon.Clock — ring with hands; the hands only touch at x=12.8, never overlap (EvenOdd).
-         Béziers, not arcs: see Icon.Database. -->
-    <StreamGeometry x:Key="Icon.Clock">F0 M2 12 C2 6.48 6.48 2 12 2 C17.52 2 22 6.48 22 12 C22 17.52 17.52 22 12 22 C6.48 22 2 17.52 2 12 Z M4 12 C4 7.58 7.58 4 12 4 C16.42 4 20 7.58 20 12 C20 16.42 16.42 20 12 20 C7.58 20 4 16.42 4 12 Z M11.2 6.5 H12.8 V12.8 H11.2 Z M12.8 11.2 H16.5 V12.8 H12.8 Z</StreamGeometry>
-
     <!-- Badge brushes -->
     <SolidColorBrush x:Key="DraftBadgeBrush"    Color="{StaticResource TextMuteColor}"/>
     <SolidColorBrush x:Key="PlanningBadgeBrush" Color="{StaticResource PeatColor}"/>
@@ -297,6 +127,18 @@
     <Setter Property="Foreground" Value="{StaticResource StatusQueuedBrush}" />
   </Style>
 
+  <!-- waiting → muted amber: a Queued task blocked on an unmet predecessor (a task_dependencies
+       edge, or the planning chain's BlockedByTaskId) — distinct from queued (unblocked, next up
+       to run) and from children (a parent waiting on its own subtasks). Mutually exclusive with
+       .queued on the same chip (IsQueued/IsWaiting), so no declaration-order fight between them. -->
+  <Style Selector="Border.chip.waiting">
+    <Setter Property="Background"  Value="#332F1A" />
+    <Setter Property="BorderBrush" Value="#4D451A" />
+  </Style>
+  <Style Selector="Border.chip.waiting > TextBlock">
+    <Setter Property="Foreground" Value="#C9A227" />
+  </Style>
+
   <!-- done → green (#6FA86B) -->
   <Style Selector="Border.chip.done">
     <Setter Property="Background"  Value="{StaticResource DoneTintBrush}" />
@@ -428,27 +270,14 @@
     <Setter Property="TextElement.Foreground" Value="{StaticResource AccentBrush}" />
   </Style>
 
-  <!-- Line-art icon geometry (PathIcon would fill the lines away). Declared before the
-       icon-painting block below because Avalonia resolves ties by declaration order,
-       not specificity — a later rule always wins. -->
-  <Style Selector="Path.icon-stroke">
-    <Setter Property="Stroke"          Value="{StaticResource TextDimBrush}" />
-    <Setter Property="StrokeThickness" Value="1.7" />
-    <Setter Property="StrokeLineCap"   Value="Round" />
-    <Setter Property="StrokeJoin"      Value="Round" />
-  </Style>
-
   <!-- ══ ICON PAINTING — the one place icon colour is decided ══════════════════
        NEVER set Foreground/Stroke on an icon inline. A local value outranks every
        style, so the button's hover/checked/disabled states can't reach the icon and
        it stays dead on hover. Pick the colour with a class instead:
 
-         <PathIcon Data="{StaticResource Icon.X}"/>                 neutral   (mute → text)
+         <PathIcon Data="{Binding Source='mdi:Close', Converter={StaticResource IconKey}}"/>   neutral (mute → text)
-         <PathIcon Classes="danger" .../>                           destructive (blood → bright)
+         <PathIcon Classes="danger" .../>                                                      destructive (blood → bright)
-         <Viewbox><Path Classes="icon-stroke" .../></Viewbox>       line-art geometry
 
-       PathIcon *fills* its geometry — line-art icons must use Path.icon-stroke or
-       they render as blobs/invisible. Both forms take the same classes and states.
        Selectors are class-only (".icon-btn"), so Button and ToggleButton share them.
        Order is the whole mechanism (Avalonia has no specificity — the last matching
        rule wins), so the sequence below is: rest → hover → lit (.on/.active/:checked
@@ -458,21 +287,32 @@
   <Style Selector=".icon-btn PathIcon, .new-list-btn PathIcon">
     <Setter Property="Foreground" Value="{StaticResource TextMuteBrush}" />
   </Style>
-  <Style Selector=".icon-btn Path.icon-stroke">
-    <Setter Property="Stroke" Value="{StaticResource TextMuteBrush}" />
-  </Style>
   <!-- an unset star is barely there until you hover the row -->
   <Style Selector=".icon-btn.star-btn PathIcon">
     <Setter Property="Foreground" Value="{StaticResource TextFaintBrush}" />
   </Style>
 
+  <!-- diff file tree: folders stay neutral, file icons take the change-kind colour via Tag (A/D/M/R) -->
+  <Style Selector="PathIcon.tree-icon">
+    <Setter Property="Foreground" Value="{StaticResource TextMuteBrush}" />
+  </Style>
+  <Style Selector="PathIcon.tree-icon[Tag=A]">
+    <Setter Property="Foreground" Value="{StaticResource MossBrush}" />
+  </Style>
+  <Style Selector="PathIcon.tree-icon[Tag=D]">
+    <Setter Property="Foreground" Value="{StaticResource BloodBrush}" />
+  </Style>
+  <Style Selector="PathIcon.tree-icon[Tag=M]">
+    <Setter Property="Foreground" Value="{StaticResource PeatBrush}" />
+  </Style>
+  <Style Selector="PathIcon.tree-icon[Tag=R]">
+    <Setter Property="Foreground" Value="{StaticResource SageBrush}" />
+  </Style>
+
   <!-- hover -->
   <Style Selector=".icon-btn:pointerover PathIcon, .new-list-btn:pointerover PathIcon">
     <Setter Property="Foreground" Value="{StaticResource TextBrush}" />
   </Style>
-  <Style Selector=".icon-btn:pointerover Path.icon-stroke">
-    <Setter Property="Stroke" Value="{StaticResource TextBrush}" />
-  </Style>
   <!-- lit: on/active/checked keep their colour under the pointer -->
   <Style Selector=".icon-btn.star-btn.on PathIcon">
     <Setter Property="Foreground" Value="{StaticResource PeatBrush}" />
@@ -480,32 +320,20 @@
   <Style Selector=".icon-btn.active PathIcon, .icon-btn:checked PathIcon">
     <Setter Property="Foreground" Value="{StaticResource AccentBrush}" />
   </Style>
-  <Style Selector=".icon-btn.active Path.icon-stroke, .icon-btn:checked Path.icon-stroke">
-    <Setter Property="Stroke" Value="{StaticResource AccentBrush}" />
-  </Style>
 
   <!-- disabled greys out every neutral variant -->
   <Style Selector=".icon-btn:disabled PathIcon">
     <Setter Property="Foreground" Value="{StaticResource TextFaintBrush}" />
   </Style>
-  <Style Selector=".icon-btn:disabled Path.icon-stroke">
-    <Setter Property="Stroke" Value="{StaticResource TextFaintBrush}" />
-  </Style>
 
   <!-- …except danger, which is last on purpose: a destructive action stays red in every state,
        including disabled. Greying it out makes the button read as broken rather than blocked. -->
   <Style Selector=".icon-btn PathIcon.danger">
     <Setter Property="Foreground" Value="{StaticResource BloodBrush}" />
   </Style>
-  <Style Selector=".icon-btn Path.icon-stroke.danger">
-    <Setter Property="Stroke" Value="{StaticResource BloodBrush}" />
-  </Style>
   <Style Selector=".icon-btn:pointerover PathIcon.danger">
     <Setter Property="Foreground" Value="{StaticResource BloodBrightBrush}" />
   </Style>
-  <Style Selector=".icon-btn:pointerover Path.icon-stroke.danger">
-    <Setter Property="Stroke" Value="{StaticResource BloodBrightBrush}" />
-  </Style>
 
   <!-- Segmented switch: one control, mutually exclusive segments, active one highlighted.
        Use for picking a mode (not for independent on/off flags — those are icon toggles). -->
@@ -842,7 +670,7 @@
   <!-- LIST NAV ITEM                                                -->
   <!-- ============================================================ -->
   <Style Selector="Border.list-item">
-    <Setter Property="Padding"      Value="10,7" />
+    <Setter Property="Padding"      Value="10,4" />
     <Setter Property="CornerRadius" Value="8" />
     <Setter Property="Cursor"       Value="Hand" />
     <Setter Property="Background"   Value="Transparent" />
@@ -851,6 +679,10 @@
     <Setter Property="BorderThickness" Value="1.5" />
     <Setter Property="BorderBrush"     Value="Transparent" />
   </Style>
+  <!-- Folder tree rows sit tighter than the smart lists — a deep tree gets long fast. -->
+  <Style Selector="Border.list-item.tree-row">
+    <Setter Property="Padding" Value="4,4,10,4" />
+  </Style>
   <Style Selector="Border.list-item:pointerover">
     <Setter Property="Background" Value="{StaticResource Surface2Brush}" />
   </Style>
@@ -1006,7 +838,7 @@
   <Style Selector="TextBox.add-task-input">
     <Setter Property="Background"      Value="Transparent" />
     <Setter Property="BorderThickness" Value="0" />
-    <Setter Property="Padding"         Value="0" />
+    <Setter Property="Padding"         Value="0,0,2,0" />
     <Setter Property="FontSize"        Value="{StaticResource FontSizeTaskTitle}" />
     <Setter Property="Foreground"      Value="{StaticResource TextBrush}" />
     <Setter Property="CaretBrush"      Value="{StaticResource AccentBrush}" />
@@ -1256,6 +1088,19 @@
     <Setter Property="FontSize"   Value="{StaticResource FontSizeMono}" />
     <Setter Property="Foreground" Value="{StaticResource TextDimBrush}" />
   </Style>
+  <!-- diff file tree names: change-kind colour; must stay after TextBlock.meta -->
+  <Style Selector="TextBlock.tree-name[Tag=A]">
+    <Setter Property="Foreground" Value="{StaticResource MossBrush}" />
+  </Style>
+  <Style Selector="TextBlock.tree-name[Tag=D]">
+    <Setter Property="Foreground" Value="{StaticResource BloodBrush}" />
+  </Style>
+  <Style Selector="TextBlock.tree-name[Tag=M]">
+    <Setter Property="Foreground" Value="{StaticResource PeatBrush}" />
+  </Style>
+  <Style Selector="TextBlock.tree-name[Tag=R]">
+    <Setter Property="Foreground" Value="{StaticResource SageBrush}" />
+  </Style>
 
   <!-- Default body / list values / descriptions -->
   <Style Selector="TextBlock.body">

src/ClaudeDo.Ui/Design/Tokens.axaml

@@ -104,6 +104,31 @@
   <SolidColorBrush x:Key="RoadblockTintBrush"       Color="#1FD4A574" />
   <SolidColorBrush x:Key="RoadblockTintBorderBrush" Color="#4CD4A574" />
 
+  <!-- Mission Control tile identity colours. Cool hues only, on purpose: the warm/green half of
+       the wheel is taken by the status semantics above, and an identity strip must never read as
+       "running"/"review"/"failed". -->
+  <SolidColorBrush x:Key="Identity1Brush" Color="#5FA8C8" />
+  <SolidColorBrush x:Key="Identity2Brush" Color="#4FA396" />
+  <SolidColorBrush x:Key="Identity3Brush" Color="#7E88CC" />
+  <SolidColorBrush x:Key="Identity4Brush" Color="#A57BB5" />
+  <SolidColorBrush x:Key="Identity5Brush" Color="#C77FA0" />
+  <SolidColorBrush x:Key="Identity6Brush" Color="#5C78B8" />
+
+  <!-- Default colour swatches for lists and folders. Hexes are the Moss preset's; AccentPresetService
+       rewrites them in place on a preset switch, so everything bound to a swatch re-tints live. -->
+  <SolidColorBrush x:Key="Swatch1Brush" Color="#7C9166" />
+  <SolidColorBrush x:Key="Swatch2Brush" Color="#D4A574" />
+  <SolidColorBrush x:Key="Swatch3Brush" Color="#C87060" />
+  <SolidColorBrush x:Key="Swatch4Brush" Color="#D9C27A" />
+  <SolidColorBrush x:Key="Swatch5Brush" Color="#6FB3A8" />
+  <SolidColorBrush x:Key="Swatch6Brush" Color="#7FA7C9" />
+  <SolidColorBrush x:Key="Swatch7Brush" Color="#A38BC9" />
+  <SolidColorBrush x:Key="Swatch8Brush" Color="#C77FA0" />
+  <SolidColorBrush x:Key="Swatch9Brush" Color="#8B9D7A" />
+  <SolidColorBrush x:Key="Swatch10Brush" Color="#B58B6A" />
+  <SolidColorBrush x:Key="Swatch11Brush" Color="#5C78B8" />
+  <SolidColorBrush x:Key="Swatch12Brush" Color="#9AA0A6" />
+
   <!-- Merge editor (3-pane conflict resolver) block tints -->
   <SolidColorBrush x:Key="MergeOursTintBrush"     Color="#1F7C9166" /> <!-- ours side (moss) -->
   <SolidColorBrush x:Key="MergeTheirsTintBrush"   Color="#1FD4A574" /> <!-- theirs side (amber) -->
@@ -148,6 +173,7 @@
   <Thickness x:Key="IslandHeaderPadding">18,16,18,12</Thickness>
   <Thickness x:Key="IslandBodyPadding">14</Thickness>
   <Thickness x:Key="WindowBodyPadding">14</Thickness>
+  <Thickness x:Key="NestedRowIndent">18,0,0,0</Thickness>  <!-- SpaceXl: a child row under its parent -->
 
   <!-- ============================================================ -->
   <!-- CORNERS & BORDERS                                            -->

src/ClaudeDo.Ui/Helpers/StreamLineFormatter.cs

@@ -1,14 +1,17 @@
 using System.Text;
 using System.Text.Json;
+using ClaudeDo.Ui.ViewModels.Islands;
 
 namespace ClaudeDo.Ui.Helpers;
 
+/// <summary>Turns Claude CLI stream-json lines into kind-tagged log entries for the terminal views.</summary>
 public class StreamLineFormatter
 {
     private const int MaxLength = 50_000;
-    private const int MaxArgChars = 120;
+    private const int MaxArgChars = 500;
 
-    public string? FormatLine(string line)
+    /// <summary>Formats one stdout line; null when the event is filtered. Entry text may span several lines.</summary>
+    public IReadOnlyList<(LogKind Kind, string Text)>? FormatLine(string line)
     {
         JsonDocument doc;
         try
@@ -17,7 +20,7 @@ public class StreamLineFormatter
         }
         catch (JsonException)
         {
-            return line;
+            return [(LogKind.Stdout, line)];
         }
 
         using (doc)
@@ -28,7 +31,7 @@ public class StreamLineFormatter
             if (!root.TryGetProperty("type", out var typeProp))
                 return null;
 
-            return typeProp.GetString() switch
+            var entries = typeProp.GetString() switch
             {
                 "system"    => FormatSystem(root),
                 "assistant" => FormatAssistant(root),
@@ -36,10 +39,11 @@ public class StreamLineFormatter
                 "result"    => FormatResult(root),
                 _           => null,
             };
+            return entries is { Count: > 0 } ? entries : null;
         }
     }
 
-    private static string? FormatSystem(JsonElement root)
+    private static List<(LogKind, string)>? FormatSystem(JsonElement root)
     {
         if (!root.TryGetProperty("subtype", out var subtypeProp))
             return null;
@@ -48,7 +52,7 @@ public class StreamLineFormatter
         switch (subtype)
         {
             case "api_retry":
-                return "[Retrying API call...]\n";
+                return [(LogKind.Sys, "[Retrying API call...]")];
 
             case "init":
             {
@@ -61,7 +65,7 @@ public class StreamLineFormatter
                     ? sessionId[..8]
                     : sessionId ?? "?";
                 var modelPart = string.IsNullOrEmpty(model) ? "" : $" · {model}";
-                return $"[session {shortId}{modelPart}]\n";
+                return [(LogKind.Sys, $"[session {shortId}{modelPart}]")];
             }
 
             default:
@@ -69,12 +73,12 @@ public class StreamLineFormatter
         }
     }
 
-    private static string? FormatAssistant(JsonElement root)
+    private static List<(LogKind, string)>? FormatAssistant(JsonElement root)
     {
         if (!TryGetContentArray(root, out var content))
             return null;
 
-        var sb = new StringBuilder();
+        var entries = new List<(LogKind, string)>();
         foreach (var block in content.EnumerateArray())
         {
             if (block.ValueKind != JsonValueKind.Object) continue;
@@ -87,16 +91,12 @@ public class StreamLineFormatter
                     {
                         var text = textProp.GetString();
                         if (!string.IsNullOrEmpty(text))
-                        {
+                            entries.Add((LogKind.Claude, text));
-                            sb.Append(text);
-                            if (!text.EndsWith('\n')) sb.Append('\n');
-                        }
                     }
                     break;
 
                 case "tool_use":
-                    sb.Append(FormatToolUse(block));
+                    entries.Add(FormatToolUse(block));
-                    sb.Append('\n');
                     break;
 
                 case "thinking":
@@ -106,7 +106,7 @@ public class StreamLineFormatter
             }
         }
 
-        return sb.Length == 0 ? null : sb.ToString();
+        return entries;
     }
 
     private static bool TryGetContentArray(JsonElement root, out JsonElement content)
@@ -120,35 +120,30 @@ public class StreamLineFormatter
         return true;
     }
 
-    private static string? FormatUser(JsonElement root)
+    private static List<(LogKind, string)>? FormatUser(JsonElement root)
     {
         if (!TryGetContentArray(root, out var content))
             return null;
 
-        var sb = new StringBuilder();
+        var entries = new List<(LogKind, string)>();
         foreach (var block in content.EnumerateArray())
         {
             if (block.ValueKind != JsonValueKind.Object) continue;
             if (!block.TryGetProperty("type", out var blockTypeProp)) continue;
             if (blockTypeProp.GetString() != "tool_result") continue;
 
-            var summary = BuildToolResultSummary(root, block);
+            var isError = block.TryGetProperty("is_error", out var errProp)
+                          && errProp.ValueKind == JsonValueKind.True;
+            var summary = BuildToolResultSummary(root, block, isError);
             if (!string.IsNullOrEmpty(summary))
-            {
+                entries.Add((isError ? LogKind.Stderr : LogKind.ToolResult, "→ " + summary));
-                sb.Append("→ ");
-                sb.Append(summary);
-                sb.Append('\n');
-            }
         }
 
-        return sb.Length == 0 ? null : sb.ToString();
+        return entries;
     }
 
-    private static string BuildToolResultSummary(JsonElement root, JsonElement block)
+    private static string BuildToolResultSummary(JsonElement root, JsonElement block, bool isError)
     {
-        var isError = block.TryGetProperty("is_error", out var errProp)
-                      && errProp.ValueKind == JsonValueKind.True;
-
         var contentText = ResolveContentText(block);
 
         if (isError)
@@ -215,14 +210,14 @@ public class StreamLineFormatter
         return "";
     }
 
-    private static string? FormatResult(JsonElement root)
+    private static List<(LogKind, string)>? FormatResult(JsonElement root)
     {
         if (root.TryGetProperty("result", out var resultProp))
-            return $"\n--- Result ---\n{resultProp.GetString()}\n";
+            return [(LogKind.Done, $"--- Result ---\n{resultProp.GetString()}")];
         return null;
     }
 
-    private static string FormatToolUse(JsonElement block)
+    private static (LogKind, string) FormatToolUse(JsonElement block)
     {
         var name = block.TryGetProperty("name", out var nameProp)
             ? nameProp.GetString() ?? "?"
@@ -241,10 +236,9 @@ public class StreamLineFormatter
         }
 
         string? arg = hasInput ? BuildToolArg(name, input) : null;
+        var kind = name is "Edit" or "Write" or "NotebookEdit" ? LogKind.Edit : LogKind.Tool;
 
-        return string.IsNullOrEmpty(arg)
+        return (kind, string.IsNullOrEmpty(arg) ? $"[{label}]" : $"[{label}] {arg}");
-            ? $"[{label}]"
-            : $"[{label}] {arg}";
     }
 
     private static string? BuildToolArg(string toolName, JsonElement input)

src/ClaudeDo.Ui/Services/AccentPresetService.cs

@@ -14,6 +14,8 @@ public static class AccentPresetService
         SetBrushColor(app, "AccentSoftBrush", preset.Soft);
         SetBrushColor(app, "AccentGlowBrush", preset.Glow);
         SetBrushColor(app, "MossBrush",       preset.Accent);
+        for (var i = 0; i < preset.Swatches.Length; i++)
+            SetBrushColor(app, $"Swatch{i + 1}Brush", preset.Swatches[i]);
     }
 
     private static void SetBrushColor(Application app, string key, string hex)

src/ClaudeDo.Ui/Services/ClipboardBitmap.cs

@@ -0,0 +1,26 @@
+using System;
+using System.Threading.Tasks;
+using Avalonia.Controls;
+using Avalonia.Input;
+using Avalonia.Media.Imaging;
+
+namespace ClaudeDo.Ui.Services;
+
+/// <summary>Reads a bitmap off the clipboard; shared by the terminal view and the description editor.</summary>
+public static class ClipboardBitmap
+{
+    /// <summary>The clipboard bitmap (caller disposes), or null if there is none or the read failed.</summary>
+    public static async Task<Bitmap?> TryGetAsync(TopLevel? topLevel)
+    {
+        if (topLevel?.Clipboard is not { } clipboard) return null;
+        try
+        {
+            using var data = await clipboard.TryGetDataAsync();
+            return data is null ? null : await AsyncDataTransferExtensions.TryGetBitmapAsync(data);
+        }
+        catch (Exception)
+        {
+            return null;
+        }
+    }
+}

src/ClaudeDo.Ui/Services/ClipboardImageTempStore.cs

@@ -0,0 +1,48 @@
+using System;
+using System.IO;
+using ClaudeDo.Data;
+
+namespace ClaudeDo.Ui.Services;
+
+/// <summary>
+/// Temp PNGs written for clipboard-image paste into the interactive terminal (see
+/// <see cref="ClaudeDo.Ui.Views.InteractiveTerminalView"/>) — dropped into the composer as a path,
+/// the same way a file drop is, then read by Claude like any other file.
+/// </summary>
+public static class ClipboardImageTempStore
+{
+    public static string Directory => Path.Combine(Paths.AppDataRoot(), "tmp");
+
+    /// <summary>A fresh, collision-free path for one pasted image.</summary>
+    public static string NewPngPath(DateTime utcNow) => NewPngPath(Directory, utcNow);
+
+    /// <summary>Deletes files older than <paramref name="maxAge"/> under the tmp dir — called once at
+    /// app startup, not a running cleanup service.</summary>
+    public static void DeleteOlderThan(TimeSpan maxAge, DateTime utcNow) => DeleteOlderThan(Directory, maxAge, utcNow);
+
+    /// <summary>Test seam for <see cref="NewPngPath(DateTime)"/> — takes the target dir explicitly
+    /// instead of the real app data root.</summary>
+    internal static string NewPngPath(string dir, DateTime utcNow) => Path.Combine(dir, NewPngFileName(utcNow));
+
+    /// <summary>A fresh, collision-free <c>paste-….png</c> file name (also used as an attachment name).</summary>
+    public static string NewPngFileName(DateTime utcNow) =>
+        $"paste-{utcNow:yyyyMMdd-HHmmssfff}-{Guid.NewGuid():N}.png";
+
+    /// <summary>Test seam for <see cref="DeleteOlderThan(TimeSpan,DateTime)"/> — takes the target dir
+    /// explicitly instead of the real app data root.</summary>
+    internal static void DeleteOlderThan(string dir, TimeSpan maxAge, DateTime utcNow)
+    {
+        if (!System.IO.Directory.Exists(dir)) return;
+
+        foreach (var file in System.IO.Directory.EnumerateFiles(dir))
+        {
+            try
+            {
+                if (utcNow - File.GetLastWriteTimeUtc(file) > maxAge)
+                    File.Delete(file);
+            }
+            catch (IOException) { /* best effort */ }
+            catch (UnauthorizedAccessException) { /* best effort */ }
+        }
+    }
+}

src/ClaudeDo.Ui/Services/IDialogService.cs

@@ -28,12 +28,16 @@ public interface IDialogService
     Task ShowConflictResolverAsync(ConflictResolverViewModel vm);
     Task ShowLogVisualizerAsync(LogVisualizerViewModel vm);
 
-    /// <summary>Modal yes/no confirmation. Returns true only when confirmed.</summary>
+    /// <summary>Modal yes/no confirmation. Returns true only when confirmed. <paramref name="confirmLabel"/>
-    Task<bool> ConfirmAsync(string message);
+    /// overrides the default localized "Confirm" button text (e.g. a localized "Delete" for destructive actions).</summary>
+    Task<bool> ConfirmAsync(string message, string? confirmLabel = null);
 
     /// <summary>Modal error notice with a single dismiss button.</summary>
     Task ShowErrorAsync(string message);
 
     /// <summary>Show (or re-show + focus) the modeless Mission Control window. Lazily created; hides on close.</summary>
     void ShowMissionControl(MissionControlViewModel vm);
+
+    /// <summary>Show (or re-show + focus) the modeless cheat-sheet window for the shell's shared VM.</summary>
+    void ShowCheatSheets(CheatSheetsViewModel vm);
 }

src/ClaudeDo.Ui/Services/InstallArtifactLocator.cs

@@ -1,9 +1,10 @@
 namespace ClaudeDo.Ui.Services;
 
-// Two named types because DI resolves them by type, not by key.
+// Two named types because DI resolves them by type, not by key. Not sealed: tests subclass
-public sealed class InstallerLocator() : InstallArtifactLocator("uninstaller", "ClaudeDo.Installer.exe");
+// these to fake Find() without touching the real filesystem/registry.
+public class InstallerLocator() : InstallArtifactLocator("uninstaller", "ClaudeDo.Installer.exe");
 
-public sealed class WorkerLocator() : InstallArtifactLocator("worker", "ClaudeDo.Worker.exe");
+public class WorkerLocator() : InstallArtifactLocator("worker", "ClaudeDo.Worker.exe");
 
 /// <summary>
 /// Locates an executable inside a ClaudeDo install: walk up from the running
@@ -14,7 +15,7 @@ public abstract class InstallArtifactLocator(string subdir, string exeName)
 {
     private const string InstallJson = "install.json";
 
-    public string? Find()
+    public virtual string? Find()
         => FindByWalkingUp(AppContext.BaseDirectory)
            ?? (OperatingSystem.IsWindows() ? FindByRegistry() : null);
 

src/ClaudeDo.Ui/Services/Interfaces/IWorkerClient.cs

@@ -30,6 +30,10 @@ public interface IWorkerClient : INotifyPropertyChanged
     /// task to carry out nextPhase ("wait" | "merge" | "wait_final" | "merge_final").</summary>
     event Action<string, IReadOnlyList<string>, string>? HandoffRequestedEvent;
 
+    /// <summary>A Mission Control session called handoff_session: (paneId, briefPath). The UI replaces
+    /// the tile whose IdentityKey is paneId with a fresh session starting from the brief.</summary>
+    event Action<string, string>? SessionHandoffRequestedEvent;
+
     /// <summary>start_list_handler was called through the external MCP: (listId, taskIds). The UI
     /// starts a list-handler run for them exactly like the "Let Claude handle it" button.</summary>
     event Action<string, IReadOnlyList<string>>? ListHandlerStartRequestedEvent;
@@ -37,6 +41,9 @@ public interface IWorkerClient : INotifyPropertyChanged
     /// (handlerTaskId, message). Mission Control types the message into that task's ConPTY pane so
     /// the session can hand off cleanly; no pane for the task means nothing happens.</summary>
     event Action<string, string>? HandlerUsageWarningEvent;
+    /// <summary>A list-handler handoff is deferred because the 5h usage window is exhausted:
+    /// (handlerTaskId, dueAt). Mission Control updates the pane title to show the reset time.</summary>
+    event Action<string, DateTimeOffset>? HandlerHandoffDeferredEvent;
 
     /// <summary>An agent added a note through the MCP tool — an open notes editor reloads.</summary>
     event Action? NotesUpdatedEvent;
@@ -52,12 +59,10 @@ public interface IWorkerClient : INotifyPropertyChanged
     /// total.</summary>
     event Action<string, string, int, int>? OperationProgressEvent;
 
-    /// <summary>(taskId, phase, elapsedSeconds) — phase of an in-flight single-task merge
+    /// <summary>A Worker operation (verify, merge, rebase, worktree creation) began.</summary>
-    /// ("merging" | "verifying"). Fires while the MergeTask call itself is still pending, so the
+    event Action<RunningOperationDto>? OperationStartedEvent;
-    /// waiting UI can show what it's blocked on; the verify phase re-fires every 30 s. A thin
+    /// <summary>The operation with this id finished, failed or threw.</summary>
-    /// forwarder over <see cref="OperationProgressEvent"/> kept for existing consumers (elapsed
+    event Action<string>? OperationEndedEvent;
-    /// seconds riding in the generic "current" slot).</summary>
-    event Action<string, string, int>? MergeProgressEvent;
 
     event Action<string, string>? PlanningMergeStartedEvent;
     event Action<string, string>? PlanningSubtaskMergedEvent;
@@ -99,6 +104,10 @@ public interface IWorkerClient : INotifyPropertyChanged
     Task<List<string>> GetRepoImportFoldersAsync();
     /// <summary>Persists the repo-import folder list. Throws on a failed hub call.</summary>
     Task SetRepoImportFoldersAsync(List<string> folders);
+    /// <summary>The configured SSH workspaces (quick-session targets in Mission Control).</summary>
+    Task<List<SshWorkspace>> GetSshWorkspacesAsync();
+    /// <summary>Replaces the SSH workspace list; the worker rejects invalid entries.</summary>
+    Task SetSshWorkspacesAsync(List<SshWorkspace> workspaces);
     Task<List<SessionSkillDto>> GetSessionSkillsAsync();
     Task<List<string>> InstallSessionSkillAsync(string url);
     Task UpdateSessionSkillAsync(string sourceUrl);
@@ -117,15 +126,17 @@ public interface IWorkerClient : INotifyPropertyChanged
     /// and clears BlockedByTaskId in the same update) — call once per row (parent and each
     /// queued child) rather than cascading server-side.</summary>
     Task DequeueTaskAsync(string taskId);
-    Task<MergeResultDto?> ApproveReviewAsync(string taskId, string targetBranch);
+    /// <param name="autostash">Retry flag for status "dirty_target": stash the target working
+    /// tree's uncommitted changes before merging and restore them afterwards (git --autostash).</param>
+    Task<MergeResultDto?> ApproveReviewAsync(string taskId, string targetBranch, bool autostash = false);
     Task<MergePreviewDto?> PreviewMergeAsync(string taskId, string targetBranch);
-    Task<MergeResultDto> MergeTaskAsync(string taskId, string targetBranch, bool removeWorktree, string commitMessage);
+    Task<MergeResultDto> MergeTaskAsync(string taskId, string targetBranch, bool removeWorktree, string commitMessage, bool autostash = false);
     Task RejectReviewToQueueAsync(string taskId, string feedback);
     Task RejectReviewToIdleAsync(string taskId);
     Task CancelReviewAsync(string taskId);
 
     // ── Conflict resolution (worker hub side implemented by Layer C) ──
-    Task<MergeResultDto> StartConflictMergeAsync(string taskId, string targetBranch);
+    Task<MergeResultDto> StartConflictMergeAsync(string taskId, string targetBranch, bool autostash = false);
     Task<MergeConflictDocumentsDto> GetMergeConflictDocumentsAsync(string taskId);
     Task WriteConflictResolutionAsync(string taskId, string path, string resolvedContent);
     Task<MergeResultDto> ContinueConflictMergeAsync(string taskId);
@@ -138,13 +149,20 @@ public interface IWorkerClient : INotifyPropertyChanged
     /// in a task's worktree (same worktree prep as an autonomous run).</summary>
     Task<LaunchSpec> GetInteractiveLaunchSpecAsync(string taskId, CancellationToken ct = default);
     /// <summary>Launch spec for an ad-hoc interactive session in an arbitrary directory --
-    /// no task, no worktree.</summary>
+    /// no task, no worktree. paneId (the tile's IdentityKey) is rendered into the handoff hint.</summary>
-    Task<LaunchSpec> GetAdHocLaunchSpecAsync(string directory, CancellationToken ct = default);
+    Task<LaunchSpec> GetAdHocLaunchSpecAsync(string directory, string paneId, CancellationToken ct = default);
+    /// <summary>Launch spec for an interactive claude session on an SSH workspace's server, as tile paneId.</summary>
+    Task<LaunchSpec> GetSshLaunchSpecAsync(string workspaceId, string paneId, CancellationToken ct = default);
+    /// <summary>Launch spec for the fresh session a tile hands off to after handoff_session.</summary>
+    Task<LaunchSpec> GetSessionHandoffLaunchSpecAsync(string paneId, string cwd, string briefPath, string? taskId, CancellationToken ct = default);
+    /// <summary>Launch spec resuming a recorded Mission Control session in its cwd, as tile paneId.</summary>
+    Task<LaunchSpec> GetResumeSessionLaunchSpecAsync(string sessionId, string paneId, CancellationToken ct = default);
     /// <summary>Launch spec for an embedded ConPTY "merge helper" session that drives the given
     /// tasks to a merged/Done state. listId scopes the session (and cwd) to that list.
     /// handlerTaskId (from CreateMergeHelperTaskAsync) is rendered into the brief so the session
-    /// can call handoff_list_handler on its own handler task.</summary>
+    /// can call handoff_list_handler on its own handler task. model overrides the triage
-    Task<LaunchSpec> GetMergeHelperLaunchSpecAsync(IReadOnlyList<string> taskIds, string listId, string handlerTaskId, CancellationToken ct = default);
+    /// session's model (null = default).</summary>
+    Task<LaunchSpec> GetMergeHelperLaunchSpecAsync(IReadOnlyList<string> taskIds, string listId, string handlerTaskId, string? model = null, CancellationToken ct = default);
     /// <summary>Creates the ClaudeDo task that owns a list-handler run (one per run, Idle/IsManual,
     /// never queued) so the ConPTY tile can be task-based instead of ad-hoc. Returns the new task id.</summary>
     Task<string> CreateMergeHelperTaskAsync(
@@ -183,6 +201,8 @@ public interface IWorkerClient : INotifyPropertyChanged
     Task<string?> GetWeekReportAsync(DateOnly start, DateOnly end);
     Task<string> GenerateWeekReportAsync(DateOnly start, DateOnly end);
     Task<bool> RunDailyPrepNowAsync();
+    /// <summary>Ticket import, then the daily prep, in one Prime run.</summary>
+    Task<bool> RunTicketImportNowAsync();
     Task RefineTaskAsync(string taskId);
 
     event Action<string>? RefineStartedEvent;
@@ -199,6 +219,9 @@ public interface IWorkerClient : INotifyPropertyChanged
     Task<string> GetLastPrepLogAsync();
     Task<IReadOnlyList<WorkerLogEntry>> GetRecentLogsAsync();
 
+    /// <summary>Operations running on the Worker right now — the state to start from before applying started/ended events.</summary>
+    Task<IReadOnlyList<RunningOperationDto>> GetActiveOperationsAsync();
+
     Task<List<PrimeScheduleDto>> GetPrimeSchedulesAsync();
     Task<PrimeScheduleDto?> UpsertPrimeScheduleAsync(PrimeScheduleDto dto);
     Task DeletePrimeScheduleAsync(Guid id);
@@ -237,10 +260,16 @@ public interface IWorkerClient : INotifyPropertyChanged
     Task<TokenTrackerDashboardDto?> OpenTokenTrackerDashboardAsync();
 
     Task<TicketSettingsDto?> GetTicketSettingsAsync();
+    /// <summary>Sets the fallback list for imported ticket items; null clears it.</summary>
+    Task SetTicketFallbackListAsync(string? listId);
     Task SetTicketApiBaseUrlAsync(string? baseUrl);
     Task SetTicketTokenAsync(string token);
     Task ClearTicketTokenAsync();
     Task<TicketConnectionDto?> TestTicketConnectionAsync();
+    Task<AzureDevOpsSettingsDto?> GetAzureDevOpsSettingsAsync();
+    Task SetAzureDevOpsTokenAsync(string token);
+    Task ClearAzureDevOpsTokenAsync();
+    Task<AzureDevOpsConnectionDto?> TestAzureDevOpsConnectionAsync();
     Task<List<TicketProjectDto>> GetTicketProjectsAsync();
     /// <summary>Imports open tickets assigned to the token owner into the given list. Throws
     /// HubException (with a user-readable message) on failure so the caller can surface it via

src/ClaudeDo.Ui/Services/MergeCoordinator.cs

@@ -14,8 +14,10 @@ namespace ClaudeDo.Ui.Services;
 public sealed class MergeCoordinator
 {
     /// Set once at composition to the shell's resolver entry. Null (headless/tests) ⇒ no-op.
-    public Func<string, string, Task>? Handler { get; set; }
+    public Func<string, string, bool, Task>? Handler { get; set; }
 
-    public Task ResolveConflictAsync(string taskId, string targetBranch) =>
+    /// <summary>Opens the resolver for <paramref name="taskId"/>; <paramref name="autostash"/> is the
-        Handler?.Invoke(taskId, targetBranch) ?? Task.CompletedTask;
+    /// caller's stash consent, repeated because the resolver restarts the merge on its own.</summary>
+    public Task ResolveConflictAsync(string taskId, string targetBranch, bool autostash = false) =>
+        Handler?.Invoke(taskId, targetBranch, autostash) ?? Task.CompletedTask;
 }

src/ClaudeDo.Ui/Services/PtyTerminalSession.cs

@@ -137,6 +137,46 @@ public sealed class PtyTerminalSession : IDisposable
         }
     }
 
+    /// <summary>
+    /// Inserts <paramref name="text"/> at the cursor without submitting it — the drop-a-file-path
+    /// case. Same write seam as <see cref="SendLineAsync"/>, just without the Enter.
+    /// </summary>
+    public async Task<bool> SendTextAsync(string text)
+    {
+        if (_control is not { } control || !IsRunning || string.IsNullOrEmpty(text)) return false;
+        try
+        {
+            await SendRawAsync(control, text);
+            return true;
+        }
+        catch (Exception)
+        {
+            return false;
+        }
+    }
+
+    /// <summary>
+    /// Pastes the clipboard into the session. <see cref="TerminalControl"/> wires paste to the
+    /// right-click menu only, so Ctrl+V otherwise reaches the child as a raw control byte and does
+    /// nothing. Goes through the emulator's own <see cref="TerminalView.PasteAsync"/> rather than
+    /// writing the clipboard text raw, because that is what honours bracketed-paste mode — without
+    /// it a multi-line paste is read line by line and submits on the first newline.
+    /// </summary>
+    public async Task<bool> PasteAsync()
+    {
+        if (_control is not { } control || !IsRunning) return false;
+        try
+        {
+            if (s_terminalViewField?.GetValue(control) is not TerminalView view) return false;
+            await view.PasteAsync();
+            return true;
+        }
+        catch (Exception)
+        {
+            return false;
+        }
+    }
+
     // Long enough that the two writes can't be read as one chunk by the child's stdin reader.
     private static readonly TimeSpan SubmitDelay = TimeSpan.FromMilliseconds(150);
 
@@ -152,12 +192,24 @@ public sealed class PtyTerminalSession : IDisposable
         return (Task)s_sendToPty.Invoke(view, new object[] { data, CancellationToken.None })!;
     }
 
+    /// <summary>Kills the child and closes its pseudo console; falls back to a plain kill if the private seam is gone.</summary>
     public void Kill()
     {
-        try { _control?.Kill(); }
+        try
+        {
+            // TerminalControl.Kill() leaves the pseudo console open (one orphaned conhost.exe per tile);
+            // only the private CleanupProcess disposes it, and BeginReparent suppressed its detach-time call.
+            if (_control is { } control && s_terminalViewField?.GetValue(control) is TerminalView view && s_cleanupProcess is not null)
+                s_cleanupProcess.Invoke(view, null);
+            else
+                _control?.Kill();
+        }
         catch (Exception) { /* already exited */ }
     }
 
+    private static readonly MethodInfo? s_cleanupProcess =
+        typeof(TerminalView).GetMethod("CleanupProcess", BindingFlags.Instance | BindingFlags.NonPublic);
+
     public void Dispose()
     {
         if (_disposed) return;

src/ClaudeDo.Ui/Services/RepoScanner.cs

@@ -69,5 +69,5 @@ public static class RepoScanner
 
     // A real clone has .git as a directory. Worktrees and submodules have it as a file
     // ("gitdir: ...") — those are not standalone repos and would flood the list.
-    private static bool IsRepo(string dir) => Directory.Exists(Path.Combine(dir, ".git"));
+    public static bool IsRepo(string dir) => Directory.Exists(Path.Combine(dir, ".git"));
 }

src/ClaudeDo.Ui/Services/WorkerClient.cs

@@ -49,8 +49,10 @@ public partial class WorkerClient : ObservableObject, IAsyncDisposable, IWorkerC
     public event Action<string, string, string>? TaskQuestionAskedEvent;
     public event Action<string, string>? TaskQuestionResolvedEvent;
     public event Action<string, IReadOnlyList<string>, string>? HandoffRequestedEvent;
+    public event Action<string, string>? SessionHandoffRequestedEvent;
     public event Action<string, IReadOnlyList<string>>? ListHandlerStartRequestedEvent;
     public event Action<string, string>? HandlerUsageWarningEvent;
+    public event Action<string, DateTimeOffset>? HandlerHandoffDeferredEvent;
     public event Action? ConnectionRestoredEvent;
     public event Action<string>? WorktreeUpdatedEvent;
     public event Action<string>? ListUpdatedEvent;
@@ -67,7 +69,8 @@ public partial class WorkerClient : ObservableObject, IAsyncDisposable, IWorkerC
     public event Action<UsageSnapshotDto>? UsageUpdatedEvent;
 
     public event Action<string, string, int, int>? OperationProgressEvent;
-    public event Action<string, string, int>? MergeProgressEvent;
+    public event Action<RunningOperationDto>? OperationStartedEvent;
+    public event Action<string>? OperationEndedEvent;
 
     public event Action<string, string>? PlanningMergeStartedEvent;
     public event Action<string, string>? PlanningSubtaskMergedEvent;
@@ -161,6 +164,11 @@ public partial class WorkerClient : ObservableObject, IAsyncDisposable, IWorkerC
             Dispatcher.UIThread.Post(() => HandoffRequestedEvent?.Invoke(taskId, survivingTaskIds, nextPhase));
         });
 
+        _hub.On<string, string>("SessionHandoffRequested", (paneId, briefPath) =>
+        {
+            Dispatcher.UIThread.Post(() => SessionHandoffRequestedEvent?.Invoke(paneId, briefPath));
+        });
+
         _hub.On<string, IReadOnlyList<string>>("ListHandlerStartRequested", (listId, taskIds) =>
         {
             Dispatcher.UIThread.Post(() => ListHandlerStartRequestedEvent?.Invoke(listId, taskIds));
@@ -171,6 +179,11 @@ public partial class WorkerClient : ObservableObject, IAsyncDisposable, IWorkerC
             Dispatcher.UIThread.Post(() => HandlerUsageWarningEvent?.Invoke(taskId, message));
         });
 
+        _hub.On<string, DateTimeOffset>("HandlerHandoffDeferred", (taskId, dueAt) =>
+        {
+            Dispatcher.UIThread.Post(() => HandlerHandoffDeferredEvent?.Invoke(taskId, dueAt));
+        });
+
         _hub.On<string>("WorktreeUpdated", taskId =>
         {
             Dispatcher.UIThread.Post(() => WorktreeUpdatedEvent?.Invoke(taskId));
@@ -189,11 +202,17 @@ public partial class WorkerClient : ObservableObject, IAsyncDisposable, IWorkerC
 
         _hub.On<string, string, int, int>("OperationProgress", (opKey, phase, current, total) =>
         {
-            Dispatcher.UIThread.Post(() =>
+            Dispatcher.UIThread.Post(() => OperationProgressEvent?.Invoke(opKey, phase, current, total));
-            {
+        });
-                OperationProgressEvent?.Invoke(opKey, phase, current, total);
+
-                MergeProgressEvent?.Invoke(opKey, phase, current);
+        _hub.On<RunningOperationDto>("OperationStarted", op =>
-            });
+        {
+            Dispatcher.UIThread.Post(() => OperationStartedEvent?.Invoke(op));
+        });
+
+        _hub.On<string>("OperationEnded", id =>
+        {
+            Dispatcher.UIThread.Post(() => OperationEndedEvent?.Invoke(id));
         });
 
         _hub.On<string, string>("PlanningMergeStarted", (planningTaskId, targetBranch) =>
@@ -303,6 +322,11 @@ public partial class WorkerClient : ObservableObject, IAsyncDisposable, IWorkerC
             ok = true;
             return result;
         }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            Serilog.Log.Warning(ex, "Hub call {method_name} failed", method);
+            return default;
+        }
         catch { return default; }
         finally { OperationTiming.Shared.Record("hub", method, sw.Elapsed, ok); }
     }
@@ -317,6 +341,11 @@ public partial class WorkerClient : ObservableObject, IAsyncDisposable, IWorkerC
             await invoke();
             ok = true;
         }
+        catch (Exception ex)
+        {
+            Serilog.Log.Warning(ex, "Hub call {method_name} failed", method);
+            throw;
+        }
         finally { OperationTiming.Shared.Record("hub", method, sw.Elapsed, ok); }
     }
 
@@ -331,6 +360,11 @@ public partial class WorkerClient : ObservableObject, IAsyncDisposable, IWorkerC
             ok = true;
             return result;
         }
+        catch (Exception ex)
+        {
+            Serilog.Log.Warning(ex, "Hub call {method_name} failed", method);
+            throw;
+        }
         finally { OperationTiming.Shared.Record("hub", method, sw.Elapsed, ok); }
     }
 
@@ -358,14 +392,15 @@ public partial class WorkerClient : ObservableObject, IAsyncDisposable, IWorkerC
         await InvokeTimedAsync("ResetTask", () => _hub.InvokeAsync("ResetTask", taskId));
     }
 
-    public async Task<MergeResultDto> MergeTaskAsync(string taskId, string targetBranch, bool removeWorktree, string commitMessage)
+    public async Task<MergeResultDto> MergeTaskAsync(
+        string taskId, string targetBranch, bool removeWorktree, string commitMessage, bool autostash = false)
     {
         return await InvokeTimedAsync<MergeResultDto>("MergeTask", () => _hub.InvokeAsync<MergeResultDto>(
-            "MergeTask", taskId, targetBranch, removeWorktree, commitMessage));
+            "MergeTask", taskId, targetBranch, removeWorktree, commitMessage, autostash));
     }
 
-    public Task<MergeResultDto> StartConflictMergeAsync(string taskId, string targetBranch)
+    public Task<MergeResultDto> StartConflictMergeAsync(string taskId, string targetBranch, bool autostash = false)
-        => InvokeTimedAsync<MergeResultDto>("StartConflictMerge", () => _hub.InvokeAsync<MergeResultDto>("StartConflictMerge", taskId, targetBranch));
+        => InvokeTimedAsync<MergeResultDto>("StartConflictMerge", () => _hub.InvokeAsync<MergeResultDto>("StartConflictMerge", taskId, targetBranch, autostash));
 
     public Task<MergeConflictDocumentsDto> GetMergeConflictDocumentsAsync(string taskId)
         => InvokeTimedAsync<MergeConflictDocumentsDto>("GetMergeConflictDocuments", () => _hub.InvokeAsync<MergeConflictDocumentsDto>("GetMergeConflictDocuments", taskId));
@@ -481,6 +516,9 @@ public partial class WorkerClient : ObservableObject, IAsyncDisposable, IWorkerC
     public Task<bool> RunDailyPrepNowAsync()
         => InvokeTimedAsync<bool>("RunDailyPrepNow", () => _hub.InvokeAsync<bool>("RunDailyPrepNow"));
 
+    public Task<bool> RunTicketImportNowAsync()
+        => InvokeTimedAsync<bool>("RunTicketImportNow", () => _hub.InvokeAsync<bool>("RunTicketImportNow"));
+
     public Task RefineTaskAsync(string taskId) => InvokeTimedAsync("RefineTask", () => _hub.InvokeAsync("RefineTask", taskId));
 
     public Task ClearMyDayAsync()
@@ -504,6 +542,9 @@ public partial class WorkerClient : ObservableObject, IAsyncDisposable, IWorkerC
     public async Task<string> GetLastPrepLogAsync()
         => await TryInvokeAsync<string>("GetLastPrepLog") ?? string.Empty;
 
+    public async Task<IReadOnlyList<RunningOperationDto>> GetActiveOperationsAsync()
+        => await TryInvokeAsync<List<RunningOperationDto>>("GetActiveOperations") ?? new List<RunningOperationDto>();
+
     public async Task<IReadOnlyList<WorkerLogEntry>> GetRecentLogsAsync()
         => await TryInvokeAsync<List<WorkerLogEntry>>("GetRecentLogs") ?? new List<WorkerLogEntry>();
 
@@ -531,6 +572,12 @@ public partial class WorkerClient : ObservableObject, IAsyncDisposable, IWorkerC
     public Task SetRepoImportFoldersAsync(List<string> folders)
         => InvokeTimedAsync("SetRepoImportFolders", () => _hub.InvokeAsync("SetRepoImportFolders", folders));
 
+    public async Task<List<SshWorkspace>> GetSshWorkspacesAsync()
+        => await InvokeTimedAsync<List<SshWorkspace>>("GetSshWorkspaces", () => _hub.InvokeAsync<List<SshWorkspace>>("GetSshWorkspaces"));
+
+    public Task SetSshWorkspacesAsync(List<SshWorkspace> workspaces)
+        => InvokeTimedAsync("SetSshWorkspaces", () => _hub.InvokeAsync("SetSshWorkspaces", workspaces));
+
     public async Task<List<SessionSkillDto>> GetSessionSkillsAsync()
         => await TryInvokeAsync<List<SessionSkillDto>>("GetSessionSkills") ?? [];
 
@@ -558,10 +605,10 @@ public partial class WorkerClient : ObservableObject, IAsyncDisposable, IWorkerC
     public Task DequeueTaskAsync(string taskId)
         => InvokeTimedAsync("DequeueTask", () => _hub.InvokeAsync("DequeueTask", taskId));
 
-    public async Task<MergeResultDto?> ApproveReviewAsync(string taskId, string targetBranch)
+    public async Task<MergeResultDto?> ApproveReviewAsync(string taskId, string targetBranch, bool autostash = false)
     {
         LastApproveTarget = targetBranch;
-        return await InvokeTimedAsync<MergeResultDto>("ApproveReview", () => _hub.InvokeAsync<MergeResultDto>("ApproveReview", taskId, targetBranch));
+        return await InvokeTimedAsync<MergeResultDto>("ApproveReview", () => _hub.InvokeAsync<MergeResultDto>("ApproveReview", taskId, targetBranch, autostash));
     }
 
     public Task<MergePreviewDto?> PreviewMergeAsync(string taskId, string targetBranch)
@@ -624,11 +671,20 @@ public partial class WorkerClient : ObservableObject, IAsyncDisposable, IWorkerC
     public async Task<LaunchSpec> GetInteractiveLaunchSpecAsync(string taskId, CancellationToken ct = default)
         => await InvokeTimedAsync<LaunchSpec>("GetInteractiveLaunchSpec", () => _hub.InvokeAsync<LaunchSpec>("GetInteractiveLaunchSpec", taskId, ct));
 
-    public async Task<LaunchSpec> GetAdHocLaunchSpecAsync(string directory, CancellationToken ct = default)
+    public async Task<LaunchSpec> GetAdHocLaunchSpecAsync(string directory, string paneId, CancellationToken ct = default)
-        => await InvokeTimedAsync<LaunchSpec>("GetAdHocLaunchSpec", () => _hub.InvokeAsync<LaunchSpec>("GetAdHocLaunchSpec", directory, ct));
+        => await InvokeTimedAsync<LaunchSpec>("GetAdHocLaunchSpec", () => _hub.InvokeAsync<LaunchSpec>("GetAdHocLaunchSpec", directory, paneId, ct));
 
-    public async Task<LaunchSpec> GetMergeHelperLaunchSpecAsync(IReadOnlyList<string> taskIds, string listId, string handlerTaskId, CancellationToken ct = default)
+    public async Task<LaunchSpec> GetSshLaunchSpecAsync(string workspaceId, string paneId, CancellationToken ct = default)
-        => await InvokeTimedAsync<LaunchSpec>("GetMergeHelperLaunchSpec", () => _hub.InvokeAsync<LaunchSpec>("GetMergeHelperLaunchSpec", taskIds, listId, handlerTaskId, ct));
+        => await InvokeTimedAsync<LaunchSpec>("GetSshLaunchSpec", () => _hub.InvokeAsync<LaunchSpec>("GetSshLaunchSpec", workspaceId, paneId, ct));
+
+    public async Task<LaunchSpec> GetSessionHandoffLaunchSpecAsync(string paneId, string cwd, string briefPath, string? taskId, CancellationToken ct = default)
+        => await InvokeTimedAsync<LaunchSpec>("GetSessionHandoffLaunchSpec", () => _hub.InvokeAsync<LaunchSpec>("GetSessionHandoffLaunchSpec", paneId, cwd, briefPath, taskId, ct));
+
+    public async Task<LaunchSpec> GetResumeSessionLaunchSpecAsync(string sessionId, string paneId, CancellationToken ct = default)
+        => await InvokeTimedAsync<LaunchSpec>("GetResumeSessionLaunchSpec", () => _hub.InvokeAsync<LaunchSpec>("GetResumeSessionLaunchSpec", sessionId, paneId, ct));
+
+    public async Task<LaunchSpec> GetMergeHelperLaunchSpecAsync(IReadOnlyList<string> taskIds, string listId, string handlerTaskId, string? model = null, CancellationToken ct = default)
+        => await InvokeTimedAsync<LaunchSpec>("GetMergeHelperLaunchSpec", () => _hub.InvokeAsync<LaunchSpec>("GetMergeHelperLaunchSpec", taskIds, listId, handlerTaskId, model, ct));
 
     public async Task<string> CreateMergeHelperTaskAsync(
         IReadOnlyList<string> taskIds, string listId, string title, string descriptionHeader, CancellationToken ct = default)
@@ -729,6 +785,9 @@ public partial class WorkerClient : ObservableObject, IAsyncDisposable, IWorkerC
     public Task<TicketSettingsDto?> GetTicketSettingsAsync()
         => TryInvokeAsync<TicketSettingsDto>("GetTicketSettings");
 
+    public Task SetTicketFallbackListAsync(string? listId)
+        => InvokeTimedAsync("SetTicketFallbackList", () => _hub.InvokeAsync("SetTicketFallbackList", listId));
+
     public Task SetTicketApiBaseUrlAsync(string? baseUrl)
         => InvokeTimedAsync("SetTicketApiBaseUrl", () => _hub.InvokeAsync("SetTicketApiBaseUrl", baseUrl));
 
@@ -741,6 +800,18 @@ public partial class WorkerClient : ObservableObject, IAsyncDisposable, IWorkerC
     public Task<TicketConnectionDto?> TestTicketConnectionAsync()
         => TryInvokeAsync<TicketConnectionDto>("TestTicketConnection");
 
+    public Task<AzureDevOpsSettingsDto?> GetAzureDevOpsSettingsAsync()
+        => TryInvokeAsync<AzureDevOpsSettingsDto>("GetAzureDevOpsSettings");
+
+    public Task SetAzureDevOpsTokenAsync(string token)
+        => InvokeTimedAsync("SetAzureDevOpsToken", () => _hub.InvokeAsync("SetAzureDevOpsToken", token));
+
+    public Task ClearAzureDevOpsTokenAsync()
+        => InvokeTimedAsync("ClearAzureDevOpsToken", () => _hub.InvokeAsync("ClearAzureDevOpsToken"));
+
+    public Task<AzureDevOpsConnectionDto?> TestAzureDevOpsConnectionAsync()
+        => TryInvokeAsync<AzureDevOpsConnectionDto>("TestAzureDevOpsConnection");
+
     public async Task<List<TicketProjectDto>> GetTicketProjectsAsync()
         => await TryInvokeAsync<List<TicketProjectDto>>("GetTicketProjects") ?? [];
 

src/ClaudeDo.Ui/ViewModels/Agent/AgentConfigEditorViewModel.cs

@@ -208,13 +208,13 @@ public sealed partial class AgentConfigEditorViewModel : ViewModelBase, IDisposa
         catch { }
     }
 
-    // verifyCommand, ticketProjectId and powerUseAllowed are List-only fields owned by
+    // verifyCommand, ticketProjectId, powerUseAllowed and baseBranch are List-only fields owned by
     // ListSettingsModalViewModel (not this editor, which is also reused for Task scope); the caller
     // passes them through so the single UpdateListConfig call carries the full desired row instead
     // of clobbering it. powerUseAllowed stays null-by-default for the same reason ticketProjectId
     // does: a caller that doesn't own it must not revoke the list's opt-in by omission.
     public async System.Threading.Tasks.Task SaveAsync(
-        string? verifyCommand = null, int? ticketProjectId = null, bool? powerUseAllowed = null)
+        string? verifyCommand = null, int? ticketProjectId = null, bool? powerUseAllowed = null, string? baseBranch = null)
     {
         if (TargetId is null) return;
         var model = string.IsNullOrWhiteSpace(Model) ? null : Model;
@@ -227,7 +227,7 @@ public sealed partial class AgentConfigEditorViewModel : ViewModelBase, IDisposa
         if (_scope == AgentConfigScope.Task)
             await _worker.UpdateTaskAgentSettingsAsync(new UpdateTaskAgentSettingsDto(TargetId, model, sp, ap, turns, skills, permission));
         else
-            await _worker.UpdateListConfigAsync(new UpdateListConfigDto(TargetId, model, sp, ap, turns, skills, verifyCommand, permission, ticketProjectId, powerUseAllowed));
+            await _worker.UpdateListConfigAsync(new UpdateListConfigDto(TargetId, model, sp, ap, turns, skills, verifyCommand, permission, ticketProjectId, powerUseAllowed, baseBranch));
     }
 
     private List<string>? SelectedSessionSkillNames()