@ordewell/core 0.6.0 → 0.6.1

package/dist/index.mjs

@@ -15,7 +15,7 @@ import {
   resolveTaskMode,
   runnerModesFrom,
   validatePlanModification
-} from "./chunk-OM4D274O.mjs";
+} from "./chunk-M4KXBEFJ.mjs";
 import {
   CHECKPOINT_TRUNCATE_LENGTH,
   EMPTY_CONVERSATION,
@@ -76,7 +76,7 @@ import {
   unsendLatest,
   usageLine,
   validateTaskEdit
-} from "./chunk-2SOVKO7P.mjs";
+} from "./chunk-I6U3PVHL.mjs";
 import {
   PLAN_ENVELOPE_KEY,
   PlanParseError,
@@ -105,7 +105,7 @@ import {
   updateTaskInPlan,
   validateModifiedPlan,
   warningsText
-} from "./chunk-EDGUFCIR.mjs";
+} from "./chunk-JRZPSNRO.mjs";
 import {
   resolveOrderLabel,
   taskOrderLabel
@@ -121,7 +121,7 @@ import {
   migratePlanStateIsolation,
   repoRootOf,
   taskIsolationOf
-} from "./chunk-C44UWIAD.mjs";
+} from "./chunk-N66ZHFGN.mjs";
 
 // src/models/TaskLog.ts
 var HEAD_LINES = 60;
@@ -5143,6 +5143,18 @@ function leftoverMarkerFiles(check) {
   const files = check.split(/\r?\n/).flatMap((line) => /^(.+):\d+: leftover conflict marker$/.exec(line)?.[1] ?? []);
   return [...new Set(files)];
 }
+function rawDiffStates(raw) {
+  const parts = raw.split("\0");
+  const states = {};
+  for (let i = 0; i + 1 < parts.length; i += 2) {
+    const meta = parts[i].trim();
+    const file = parts[i + 1];
+    if (!meta.startsWith(":") || !file) continue;
+    const [, mode, , blob] = meta.slice(1).split(" ");
+    states[file] = `${mode}:${blob}`;
+  }
+  return states;
+}
 function settleStatus(record, status) {
   record.status = status;
   delete record.repairBase;
@@ -5242,6 +5254,8 @@ var GitWorktreeIsolation = class {
   adminChains = /* @__PURE__ */ new Map();
   waiting = [];
   draining = false;
+  /** Landings and Merge all take turns on this, so a merge never reads an integration branch mid-landing. */
+  turns = Promise.resolve();
   async isActive(workspaceRoot) {
     if (!this.deps.config.worktreeIsolation) return { active: false, reason: "disabled" };
     const version = await this.tryGit(void 0, ["--version"]);
@@ -5598,6 +5612,62 @@ var GitWorktreeIsolation = class {
       return !linked.has(rel) && !linked.has(rel.split("/")[0]);
     });
   }
+  async findInHead(run) {
+    const found = [];
+    for (const record of Object.values(run.tasks)) {
+      if (record.status !== "merged" || record.inHead) continue;
+      if (!await this.headContains(run, record)) continue;
+      record.inHead = true;
+      found.push(record.taskId);
+    }
+    return found;
+  }
+  async headContains(run, record) {
+    for (const repo of run.repos) {
+      const entry = record.repos[repo.path];
+      if (!entry?.changed) continue;
+      const merged = await this.tryGit(repo.root, ["merge-base", "--is-ancestor", entry.landedTip ?? repo.integrationBranch, "HEAD"]);
+      if (!merged.ok) return false;
+    }
+    return true;
+  }
+  async snapshotTree(workspaceRoot, exclude) {
+    const scan = await this.scanGroup(workspaceRoot);
+    if ("refused" in scan) return null;
+    const repos = (await this.committedRepos(workspaceRoot, scan.paths)).filter((repoPath) => !exclude.includes(repoPath));
+    if (repos.length === 0) return null;
+    const snapshot = {};
+    for (const repoPath of repos) {
+      const states = await this.trackedStates(repoRootOf(workspaceRoot, repoPath));
+      if (states) snapshot[repoPath] = states;
+    }
+    return snapshot;
+  }
+  async changedSince(workspaceRoot, snapshot) {
+    const changed = [];
+    for (const [repoPath, before] of Object.entries(snapshot)) {
+      const now = await this.trackedStates(repoRootOf(workspaceRoot, repoPath));
+      if (!now) continue;
+      for (const [file, state] of Object.entries(now)) {
+        if (before[file] !== state) changed.push(repoPath === SELF_REPO ? file : `${repoPath}/${file}`);
+      }
+    }
+    return changed.sort();
+  }
+  /**
+   * Each tracked file that differs from HEAD, with what it holds. `git stash
+   * create` records the working tree as a commit without touching the tree,
+   * the index or the stash, so a file changed again is told apart from one
+   * left as it was. Null when git cannot tell — a merge in progress, say.
+   */
+  async trackedStates(root) {
+    const stash = await this.tryGit(root, ["stash", "create"]);
+    if (!stash.ok) return null;
+    const commit = stash.stdout.trim();
+    if (!commit) return {};
+    const diff = await this.tryGit(root, ["diff", "--raw", "--no-abbrev", "--no-renames", "-z", "HEAD", commit]);
+    return diff.ok ? rawDiffStates(diff.stdout) : null;
+  }
   /**
    * One section per repo with changes. A repo below the workspace root gets a
    * header and paths prefixed with its own, so the whole reads as one patch
@@ -5615,7 +5685,10 @@ var GitWorktreeIsolation = class {
     }
     return diff;
   }
-  async mergeIntoCheckedOut(run) {
+  mergeIntoCheckedOut(run) {
+    return this.inTurn(() => this.mergeAll(run));
+  }
+  async mergeAll(run) {
     const partial = await this.settleLanding(run);
     if (partial.length > 0) return { outcome: "blocked", blocked: partial.map((repo) => ({ repo, reason: "partial-landing", files: [] })) };
     const repos = await this.reposWithWork(run);
@@ -5749,7 +5822,7 @@ var GitWorktreeIsolation = class {
           if (entry2.run.id === runId && (pick < 0 || entry2.task.order < this.waiting[pick].task.order)) pick = i;
         });
         const [entry] = this.waiting.splice(pick, 1);
-        entry.settle(await this.land(entry.task, entry.run, entry.persist).catch(() => "failed"));
+        entry.settle(await this.inTurn(() => this.land(entry.task, entry.run, entry.persist)).catch(() => "failed"));
       }
     } finally {
       this.draining = false;
@@ -5801,6 +5874,10 @@ var GitWorktreeIsolation = class {
         return (await this.settleLanding(run)).length === 0 ? this.stopLanding(record, outcome, repo, files, error) : this.stopLanding(record, "failed", repo);
       }
     }
+    for (const repo of changed) {
+      const tip = await this.tryGit(repo.root, ["rev-parse", "--verify", "-q", repo.integrationBranch]);
+      if (tip.ok) record.repos[repo.path].landedTip = tip.stdout.trim();
+    }
     delete run.landing;
     settleStatus(record, "merged");
     delete record.conflictRepo;
@@ -6075,6 +6152,11 @@ var GitWorktreeIsolation = class {
   async abortMerge(cwd) {
     if (!(await this.tryGit(cwd, ["merge", "--abort"])).ok) await this.tryGit(cwd, ["reset", "--hard"]);
   }
+  inTurn(fn) {
+    const turn = this.turns.then(fn, fn);
+    this.turns = turn.catch(() => void 0);
+    return turn;
+  }
   admin(repoKey, fn) {
     const prior = this.adminChains.get(repoKey) ?? Promise.resolve();
     const next = prior.then(fn, fn);
@@ -6491,8 +6573,22 @@ function researchPhaseBlock(harnessMode) {
     "- Research and questions can interleave \u2014 you can explore a file, then ask a question grounded in it, in one response"
   ].join("\n");
 }
-var ISOLATED_PARALLELISM_RULE = "- Each AI task runs in its own git worktree, and its work is merged in afterwards, so tasks that edit the same files can still run in parallel. Never add a dependency just because two tasks touch the same file \u2014 keep dependencies for genuine logical ordering.";
+var ISOLATED_PARALLELISM_RULE = "- Each change task runs in its own git worktree, and its work is merged in afterwards, so tasks that edit the same files can still run in parallel. Never add a dependency just because two tasks touch the same file \u2014 keep dependencies for genuine logical ordering.";
 var OVERLAP_AVOIDANCE_RULE = "- For parallel tasks, specify different target files to avoid merge conflicts.";
+function opsTaskSection(conversation) {
+  return [
+    "",
+    "CHANGE AND OPS TASKS:",
+    "- Every AI task is either a change task or an ops task. Decide by one test: is the task's result a change to files in the repository?",
+    '- A change task (the default) edits repository files. Omit "ops".',
+    `- An ops task changes no repository files: it acts on systems outside the repository (a cloud CLI, a deployment, a pipeline, a provisioned resource) or on the git refs and history of the user's branch (push, tag, reword commits). Set "ops": true. Only top-level "ai" tasks can be ops; a subtask runs with its parent.`,
+    `- Ops tasks run in the user's own checkout, after the user has merged the change tasks they depend on. Give an ops task a dependency on every change task whose result it acts on \u2014 "deploy the fix" depends on the fix.`,
+    '- Split a request that mixes the two into a change task and an ops task that depends on it: "bump the version and redeploy" is a change task that bumps and commits the version, then an ops task that pushes and watches the pipeline.',
+    "- Ops tasks run in parallel as their dependencies allow. Two ops tasks whose git operations would collide (a push and a reword of the same branch) must not run in parallel \u2014 make one depend on the other.",
+    "- An ops task runs until what it acts on has finished: one that watches a pipeline reports done only when the pipeline has ended.",
+    ...conversation ? [`- A question is not a task. "What is the frontend's URL?" is answered in this conversation, from your research; never make a task of it.`] : []
+  ];
+}
 var SHARED_APPEND_FILE_RULE = "- Tasks that run in parallel must not each append to the same shared file (changelogs, registries, index lists) \u2014 give that edit to the final task, or to one task the others depend on.";
 function repoGroupSection(isolated) {
   if (!isolated) return [];
@@ -6572,6 +6668,7 @@ function buildConversationBody(goal, context, modelsJson, runners, modeGuide, mo
     '      "taskMode": "' + modeExamples + '",',
     '      "autonomy": "AFK|HITL",',
     '      "sliceType": "AFK|HITL",',
+    '      "ops": true,',
     '      "userStoriesCovered": ["user story text"],',
     '      "subtasks": [{ "id": "sub-id-string", "order": 1, "title": "Sub-step title", "description": "What it accomplishes", "type": "ai", "dependencies": [], "prompt": "Detailed instructions", "autonomy": "AFK|HITL", "sliceType": "AFK|HITL", "subtasks": [] }]',
     "    }",
@@ -6597,6 +6694,7 @@ function buildConversationBody(goal, context, modelsJson, runners, modeGuide, mo
     SHARED_APPEND_FILE_RULE,
     ...variant.isolatedExecution ? [ISOLATED_PARALLELISM_RULE] : [],
     ...repoGroupSection(variant.isolatedExecution),
+    ...opsTaskSection(true),
     "",
     "RULES:",
     "- Do NOT wrap the JSON in markdown code blocks. Output ONLY the JSON object when committing the plan.",
@@ -6672,6 +6770,7 @@ function corePlannerPrompt(isolatedExecution) {
     '      "taskMode": "{{MODE_EXAMPLES}}",',
     '      "autonomy": "AFK|HITL",',
     '      "sliceType": "AFK|HITL",',
+    '      "ops": true,',
     '      "userStoriesCovered": ["user story text"],',
     '      "subtasks": [{ "id": "sub-id-string", "order": 1, "title": "Sub-step title", "description": "What it accomplishes", "type": "ai", "dependencies": [], "prompt": "Detailed instructions", "autonomy": "AFK|HITL", "sliceType": "AFK|HITL", "subtasks": [] }]',
     "    }",
@@ -6699,6 +6798,7 @@ function corePlannerPrompt(isolatedExecution) {
     SHARED_APPEND_FILE_RULE,
     isolatedExecution ? ISOLATED_PARALLELISM_RULE : "- Slices that touch different areas of the codebase are naturally parallel.",
     ...repoGroupSection(isolatedExecution),
+    ...opsTaskSection(false),
     "",
     "RULES:",
     '- Mark as type "ai" any task the coding assistant can do autonomously.',
@@ -8702,6 +8802,17 @@ You are running as: ${currentTask.assignedRunner}` : "";
     lines.join("\n") + footer + runnerNote
   ].join("\n");
 }
+function renderPreviousAttempt(output) {
+  const tail = output.trim() ? defuseMarkers(output.trim()).split("\n").map((l) => "  " + l).join("\n") : "  (no output captured)";
+  return [
+    "## Previous attempt",
+    "",
+    "This task ran before and did not finish. What it did outside the repository was not undone: before acting, check what already exists \u2014 resources, deployments, pushed refs \u2014 and do not repeat a step that already took effect.",
+    "",
+    "The end of its output:",
+    tail
+  ].join("\n");
+}
 function renderCompletionMarker(task) {
   return `
 
@@ -8753,6 +8864,7 @@ function composeAugmentedPrompt(task, allTasks, opts) {
   const flat = flattenTasks(allTasks);
   const outputs = collectDirectDependencyOutputs(task, flat);
   if (outputs.length > 0) blocks.push(renderPriorOutputs(outputs));
+  if (opts?.previousAttempt !== void 0) blocks.push(renderPreviousAttempt(opts.previousAttempt));
   if (opts?.tddEnabled) {
     blocks.push(renderTddInstruction());
   }
@@ -8765,9 +8877,9 @@ function composeAugmentedPrompt(task, allTasks, opts) {
 
 ${basePrompt}${marker2}`;
 }
-function composeContinuationPrompt(task, message) {
+function composeContinuationPrompt(task, message, opts = {}) {
   const reminder = [
-    "(Ordewell) You are continuing this task in the same session. Your working directory was recreated from the integration branch: work from your earlier attempt is there only if it landed, so check the files before relying on them."
+    opts.ops ? "(Ordewell) You are continuing this task in the same session, in the same checkout. What your earlier attempt did outside the repository was not undone: check what already exists before acting again." : "(Ordewell) You are continuing this task in the same session. Your working directory was recreated from the integration branch: work from your earlier attempt is there only if it landed, so check the files before relying on them."
   ];
   if (isHitlTask(task)) {
     reminder.push(`If you reach a decision that needs human judgment, print one line holding only the checkpoint marker and wait for ORDEWELL_CONTINUE or ORDEWELL_REJECT. ${CHECKPOINT_MARKER_HOWTO}.`);
@@ -9507,6 +9619,8 @@ var PlanStore = class {
   _planTasks = [];
   _allTasks = [];
   _taskMap = /* @__PURE__ */ new Map();
+  /** Task id → the top-level task it hangs under, itself for a top-level task. */
+  _rootMap = /* @__PURE__ */ new Map();
   _planRunners = ["claude-code"];
   _onMutate = null;
   _executionLog = [];
@@ -9544,6 +9658,14 @@ var PlanStore = class {
   get(taskId) {
     return this._taskMap.get(taskId);
   }
+  /**
+   * Whether a task runs as an ops task (ADR-0020). Only a top-level AI task
+   * can be one; a subtask runs with the top-level task it hangs under.
+   */
+  isOps(taskId) {
+    const root = this._rootMap.get(taskId);
+    return root?.type === "ai" && root.ops === true;
+  }
   /** A copy of the task tree, detached from the store: later status changes do not reach it. */
   snapshot() {
     return cloneTasks(this._planTasks);
@@ -9638,6 +9760,7 @@ ${taskB.description}`,
       assignedRunner: taskA.assignedRunner,
       assignedModel: taskA.assignedModel,
       taskMode: taskA.taskMode,
+      ops: taskA.ops === true && taskB.ops === true,
       order: Math.min(taskA.order, taskB.order)
     });
     const mergedId = merged.id;
@@ -9667,7 +9790,8 @@ ${taskB.description}`,
         taskMode: spec.taskMode ?? original.taskMode,
         autonomy: spec.autonomy ?? original.autonomy,
         sliceType: spec.sliceType ?? original.sliceType,
-        userStoriesCovered: spec.userStoriesCovered ?? original.userStoriesCovered
+        userStoriesCovered: spec.userStoriesCovered ?? original.userStoriesCovered,
+        ops: spec.ops ?? original.ops
       }));
     });
     const tailId = finalized[finalized.length - 1].id;
@@ -9721,8 +9845,14 @@ ${taskB.description}`,
       this.setStatus(id, "pending");
       task.verdict = void 0;
       task.outputSummary = void 0;
+      delete task.forcedPastGate;
     }
   }
+  /** Kept on the task: it was force-started past its merge gate, before these dependencies' work was merged (ADR-0020). */
+  setForcedPastGate(id, dependencies) {
+    const task = this._taskMap.get(id);
+    if (task) task.forcedPastGate = dependencies;
+  }
   /** A reason outlives nothing: any status but `awaiting_user` drops it. */
   setStatus(id, status) {
     const task = this._taskMap.get(id);
@@ -9805,6 +9935,10 @@ ${taskB.description}`,
     for (const task of this._allTasks) {
       this._taskMap.set(task.id, task);
     }
+    this._rootMap.clear();
+    for (const root of this._planTasks) {
+      for (const task of flattenTasks([root])) this._rootMap.set(task.id, root);
+    }
   }
   validateAssignedRunners() {
     for (const task of this._allTasks) {
@@ -9858,9 +9992,9 @@ var IsolationRunController = class {
   /** Copied paths already reported for the current run: every task gets the same copies. */
   reportedCopies = /* @__PURE__ */ new Set();
   /**
-   * How the open run executes; null while no run is open. A run is one
-   * Execute-Plan or one manual task run, from its start until it settles or
-   * is stopped.
+   * How the open run executes; null while no run is open, `undecided` until
+   * its first change task asks. A run is one Execute-Plan or one manual task
+   * run, from its start until it settles or is stopped.
    */
   mode = null;
   /** Resolver task id → the conflicted task it resolves; see {@link linkResolver}. */
@@ -9884,6 +10018,10 @@ var IsolationRunController = class {
   get isOpen() {
     return this.mode !== null;
   }
+  /** The open run has decided whether it isolates. */
+  get decided() {
+    return this.mode === "isolated" || this.mode === "shared";
+  }
   /** The open run executes in worktrees. */
   get isolating() {
     return this.mode === "isolated" && this.run !== null;
@@ -9940,13 +10078,22 @@ var IsolationRunController = class {
       this.tell("warn", `Could not prune leftover worktrees: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
+  /** Open a run if none is, leaving whether it isolates to its first change task. */
+  open() {
+    if (this.mode) return;
+    this.mode = "undecided";
+    this.listener.opened();
+  }
   /**
-   * Open a run if none is: decide once, at its start, whether it executes in
-   * worktrees. `resume` is what a dirty tree parks until the user chooses how
-   * to go on. Resolves false when the run did not start.
+   * Decide once per run, as its first change task starts, whether it executes
+   * in worktrees (ADR-0020): an ops task needs none, so a run of only ops
+   * tasks never asks. `resume` is what a dirty tree parks until the user
+   * chooses how to go on. Resolves false while the run waits on that choice.
    */
-  open(resume) {
-    if (this.mode) return Promise.resolve(true);
+  decide(resume) {
+    this.open();
+    if (this.decided) return Promise.resolve(true);
+    if (this.blockedStart) return Promise.resolve(false);
     this.opening ??= this.activate(resume).finally(() => {
       this.opening = null;
     });
@@ -9961,8 +10108,8 @@ var IsolationRunController = class {
    * the safe rule then.
    */
   async plannerLayout() {
-    if (this.mode) return this.isolating && this.run ? layoutOf(this.run) : false;
-    const decision = await this.decide(this.workspaceRoot());
+    if (this.decided) return this.isolating && this.run ? layoutOf(this.run) : false;
+    const decision = await this.assess(this.workspaceRoot());
     return decision.mode === "isolated" ? decision.layout : false;
   }
   /**
@@ -9997,7 +10144,7 @@ var IsolationRunController = class {
       const { cwd: cwd2 } = await this.isolation.reopen(task, this.run);
       return { cwd: cwd2, worktree: true };
     }
-    if (!this.isolating || !this.run) {
+    if (opts.ops || !this.isolating || !this.run) {
       await this.release(task.id, { keep: false });
       return { cwd: this.workspaceRoot(), worktree: false };
     }
@@ -10042,18 +10189,71 @@ var IsolationRunController = class {
     }
     this.listener.changed();
   }
-  /** Close the open run. An isolated one hands its integration branch over for review. */
+  /**
+   * Close the open run. An isolated one hands its integration branch over for
+   * review — unless the user merged everything it landed at merge gates
+   * already, which leaves nothing to hand over, so it is cleared up as a Merge
+   * all would have.
+   */
   async close() {
     const mode = this.mode;
     this.mode = null;
-    if (mode !== "isolated" || !this.run) return;
+    const run = this.run;
+    if (mode !== "isolated" || !run) return;
+    await this.refreshInHead();
+    const records = Object.values(run.tasks);
+    if (records.length > 0 && records.every((r) => r.status === "merged" && r.inHead)) {
+      this.tell("info", "Everything this run landed is merged into your branch already.");
+      await this.clearMerged(run);
+      return;
+    }
     try {
-      this.listener.handoff(await this.isolation.handoff(this.run));
+      this.listener.handoff(await this.isolation.handoff(run));
     } catch (err) {
       this.tell("warn", `Could not hand the run's integration branch over: ${err instanceof Error ? err.message : String(err)}`);
     }
     this.listener.changed();
   }
+  /**
+   * Whether a task's landed work still waits to be merged into the user's
+   * branch — what holds an ops or user task at its merge gate (ADR-0020). A
+   * task with no record never landed anything to wait for.
+   */
+  awaitsMerge(taskId) {
+    const record = this.run?.tasks[taskId];
+    return !!record && record.status === "merged" && !record.inHead;
+  }
+  /**
+   * Look again for landed work the user has merged — by Merge all, or by hand
+   * with git. Resolves true when some was found.
+   */
+  async refreshInHead() {
+    const run = this.run;
+    if (!run || !Object.values(run.tasks).some((r) => r.status === "merged" && !r.inHead)) return false;
+    const found = await this.isolation.findInHead(run).catch(() => []);
+    if (found.length > 0) this.listener.changed();
+    return found.length > 0;
+  }
+  /**
+   * The tracked state of the workspace as an ops task starts, for
+   * {@link filesChangedSince} (ADR-0020). Null where the check does not run:
+   * a run that shares the workspace root, where every task's edits land in
+   * it, or a workspace git cannot isolate at all.
+   */
+  async snapshotWorkspace() {
+    if (this.mode === "shared") return null;
+    const root = this.workspaceRoot();
+    if (!this.isolating) {
+      const availability = await this.isolation.isActive(root).catch(() => null);
+      if (!availability || !availability.active && availability.reason !== "dirty") return null;
+    }
+    return this.isolation.snapshotTree(root, this.run?.sharedRepos ?? []).catch(() => null);
+  }
+  /** Tracked files changed since `snapshot`; none when the run has since gone on in the workspace root. */
+  async filesChangedSince(snapshot) {
+    if (!snapshot || this.mode === "shared") return [];
+    return this.isolation.changedSince(this.workspaceRoot(), snapshot).catch(() => []);
+  }
   /**
    * A stop or a plan load: the open run ends without a handoff and a parked
    * start is dropped. `keepOpen` spares a run the scheduler is still driving.
@@ -10084,19 +10284,23 @@ var IsolationRunController = class {
   }
   /**
    * "Merge all": the run's integration branches into whatever the user has
-   * checked out, in every repo or none. Once everything merged, the run has
-   * nothing left to hand over, so it is cleared up and forgotten; a branch
-   * the user's HEAD somehow does not contain stays for the next run's sweep.
+   * checked out, in every repo or none. During a run it merges what has
+   * landed so far and the run goes on (ADR-0020): its branches stay for the
+   * tasks still to land. Once a settled run merged everything, it has nothing
+   * left to hand over, so it is cleared up and forgotten; a branch the user's
+   * HEAD somehow does not contain stays for the next run's sweep.
    */
   async merge() {
     const run = this.requireRun();
+    const repaired = handoffOf(run).landed.filter((t) => t.repairedFiles?.length);
     const result = await this.isolation.mergeIntoCheckedOut(run);
     const branch = integrationBranchNameOf(run);
     const group = run.repos.some((r) => r.path !== SELF_REPO);
-    const repaired = handoffOf(run).landed.filter((t) => t.repairedFiles?.length);
     const { level, message } = describeMergeResult(result, branch, group, repaired);
     this.tell(level, message);
-    if (result.outcome === "merged") await this.clearMerged(run);
+    if (result.outcome !== "merged") return result;
+    await this.refreshInHead();
+    if (!this.isOpen) await this.clearMerged(run);
     return result;
   }
   /** Worktrees and task branches go; the integration branch and the record stay for review and merge. */
@@ -10128,7 +10332,7 @@ var IsolationRunController = class {
     this.resolvers = {};
     this.listener.changed();
   }
-  async decide(root) {
+  async assess(root) {
     const availability = await this.isolation.isActive(root);
     const continued = this.continuableRun(root);
     const continuing = continued !== null;
@@ -10143,7 +10347,7 @@ var IsolationRunController = class {
   }
   async activate(resume) {
     const root = this.workspaceRoot();
-    const decision = await this.decide(root);
+    const decision = await this.assess(root);
     if (decision.mode === "blocked") {
       this.blockedStart = resume;
       this.blockedRepos = decision.repos;
@@ -10170,8 +10374,8 @@ var IsolationRunController = class {
     return true;
   }
   begin(mode) {
+    this.open();
     this.mode = mode;
-    this.listener.opened();
   }
   /** What earlier runs left merged in the group goes; a failure here is worth a word, never a stopped run. */
   async sweep() {
@@ -10518,8 +10722,9 @@ var MessageQueue = class {
 // src/services/readiness.ts
 function selectReadyTasks(input) {
   const { store, onHold, runs, active, maxParallel } = input;
-  if (active >= maxParallel) return { ready: [], candidateCount: 0, excluded: [] };
+  if (active >= maxParallel) return { ready: [], candidateCount: 0, excluded: [], gated: [] };
   const availableSlots = maxParallel - active;
+  const gated = [];
   const candidates = store.allTasks.filter((t) => {
     if (t.status !== "pending" && t.status !== "approved") return false;
     if (t.type === "user") return false;
@@ -10527,13 +10732,21 @@ function selectReadyTasks(input) {
     if (onHold.has(t.id)) return false;
     if (isBlocked(t, store)) return false;
     if (!t.dependencies.every((depId) => dependencyMet(depId, store, runs))) return false;
+    if (store.isOps(t.id)) {
+      if (input.merging) return false;
+      if (mergeGate(t, store, runs).length > 0) {
+        gated.push(t);
+        return false;
+      }
+    }
     return true;
   });
-  const excluded = store.allTasks.filter((t) => t.type === "ai" && t.prompt && !candidates.includes(t)).map((task) => ({ task, reasons: exclusionReasons(task, store, onHold, runs) }));
+  const excluded = store.allTasks.filter((t) => t.type === "ai" && t.prompt && !candidates.includes(t)).map((task) => ({ task, reasons: exclusionReasons(task, input) }));
   return {
     ready: candidates.sort((a, b) => a.order - b.order).slice(0, availableSlots),
     candidateCount: candidates.length,
-    excluded
+    excluded,
+    gated
   };
 }
 function isBlocked(task, store) {
@@ -10546,12 +10759,19 @@ function dependencyMet(depId, store, runs) {
   const record = runs.openRecord(depId);
   return !record || record.status === "merged";
 }
-function exclusionReasons(task, store, onHold, runs) {
+function mergeGate(task, store, runs) {
+  if (task.type !== "user" && !store.isOps(task.id)) return [];
+  return task.dependencies.filter((depId) => store.isCompleted(depId) && runs.awaitsMerge(depId));
+}
+function exclusionReasons(task, input) {
+  const { store, onHold, runs } = input;
   const reasons = [];
   if (task.status !== "pending" && task.status !== "approved") reasons.push(`status=${task.status}`);
   if (onHold.has(task.id)) reasons.push("on-hold");
   if (isBlocked(task, store)) reasons.push("blocked");
   if (!task.dependencies.every((depId) => dependencyMet(depId, store, runs))) reasons.push("deps");
+  if (mergeGate(task, store, runs).length > 0) reasons.push("merge-gate");
+  if (input.merging && store.isOps(task.id)) reasons.push("merging");
   return reasons;
 }
 
@@ -13426,6 +13646,10 @@ var TaskOrchestrator = class _TaskOrchestrator {
    * pending and nothing ran until the user also re-ran the whole plan.
    */
   haltedByFailure = false;
+  /** A Merge all is under way: no ops task starts until it ends (ADR-0020). */
+  merging = false;
+  /** The last "waiting for Merge all" notice, so a run paused at a gate says it once, not on every tick. */
+  gateNotice = "";
   /** The workspace's own variables for a task's cwd (ADR-0016); swapped out in tests. */
   workspaceEnv;
   /** What the workspace env has already warned about, so a run says it once, not per task. */
@@ -13734,9 +13958,48 @@ var TaskOrchestrator = class _TaskOrchestrator {
   async reviewRunDiff() {
     return this.runs.reviewDiff();
   }
-  /** "Merge all"; a run that merged everything is cleared up and forgotten. */
+  /**
+   * "Merge all"; a settled run that merged everything is cleared up and
+   * forgotten. During a run it merges what has landed and the run goes on:
+   * the tasks waiting at a merge gate for that work then start (ADR-0020).
+   * Never while an ops task runs, and no ops task starts until it ends — the
+   * one overlap the plan cannot order, because the merge is the user's.
+   */
   async mergeRun() {
-    return this.runs.merge();
+    const ops = [...this.attempts.values()].find((a) => a.ops);
+    if (ops) {
+      const title = this.store.get(ops.taskId)?.title ?? ops.taskId;
+      throw new TaskControlError(`Ops task "${title}" is running in your checkout \u2014 Merge all once it has finished.`);
+    }
+    this.merging = true;
+    let result;
+    try {
+      result = await this.runs.merge();
+    } finally {
+      this.merging = false;
+    }
+    await this.tick();
+    return result;
+  }
+  /**
+   * The run as a surface offers Merge all mid-run (ADR-0020): what has landed
+   * and is not merged, and whether the run is paused at its gates with nothing
+   * else running. Null while no task waits at a gate.
+   */
+  mergeGateView() {
+    const handoff = this.runs.view()?.handoff;
+    if (!handoff || !this.store.allTasks.some((t) => this.getMergeGate(t.id).length > 0)) return null;
+    return { paused: this.running && this.attempts.size === 0, repos: handoff.repos, landed: handoff.landed };
+  }
+  /**
+   * The dependencies an ops or user task waits on at its merge gate: those
+   * whose landed work is not in the user's branch yet (ADR-0020). Empty once
+   * the task has started, and for every other task.
+   */
+  getMergeGate(taskId) {
+    const task = this.store.get(taskId);
+    if (!task || task.status !== "pending" && task.status !== "approved") return [];
+    return mergeGate(task, this.store, this.runs);
   }
   /** Worktrees and task branches go; the integration branch and the record stay for review and merge. */
   async cleanupRun() {
@@ -13836,7 +14099,7 @@ var TaskOrchestrator = class _TaskOrchestrator {
       this.emit("onReviewNeeded", { tasks: this.store.planTasks, planRunners: this.store.planRunners });
       return;
     }
-    if (!await this.runs.open(() => this.start()) || this.running) return;
+    this.runs.open();
     console.log(`[TaskOrchestrator] Starting with ${this.store.allTasks.length} tasks (${this.store.allTasks.filter((t) => t.type === "ai" && t.prompt).length} AI ready)`);
     this.running = true;
     this.haltedByFailure = false;
@@ -13878,13 +14141,17 @@ var TaskOrchestrator = class _TaskOrchestrator {
     const summary = await this.output.finalText({ ...attempt, completionMarker: task.completionMarker }, doneToken);
     if (this.attempts.get(taskId) !== attempt) return;
     const landing = verdict.outcome === "pass" ? await this.land(attempt, () => this.landing.landPassed(task, attempt)) : null;
+    const changedFiles = landing && attempt.ops ? await this.runs.filesChangedSince(attempt.snapshot) : [];
     const unresumedReason = this.unresumed(attempt) ? unresumedMessage(task, `${attempt.runner} could not find its saved session`) : null;
     if (this.attempts.get(taskId) !== attempt) return;
     this.endAttempt(taskId, "verdict");
     this.store.setTaskVerdict(taskId, verdict);
     console.error(`[TaskOrchestrator] Output summary:
 ${summary || "(empty \u2014 no output captured)"}`);
-    if (landing) {
+    if (changedFiles.length > 0) {
+      this.store.markAwaitingUser(taskId, "files-changed");
+      this.tell("warn", `Ops task "${task.title}" finished, but changed tracked files in your checkout: ${capConflictFiles(changedFiles)}. An ops task must not change repository files, so nothing was committed \u2014 look at the changes, then mark it complete or retry it.`);
+    } else if (landing) {
       await this.applyLanding(task, landing, () => this.notifications.info(`Task "${task.title}" completed.`));
     } else if (classifyRunnerStop(attempt.session?.getOutput() ?? "") === "usage-limit") {
       this.store.markAwaitingUser(taskId);
@@ -13986,21 +14253,35 @@ ${summary || "(empty \u2014 no output captured)"}`);
     });
   }
   getReadyTasks() {
-    if (!this.running) return [];
+    return this.readiness().ready;
+  }
+  readiness() {
+    if (!this.running) return { ready: [], candidateCount: 0, excluded: [], gated: [] };
     const maxParallel = this.config.maxParallelSessions;
     const active = this.attempts.size;
-    const { ready, candidateCount, excluded } = selectReadyTasks({
+    const readiness = selectReadyTasks({
       store: this.store,
       onHold: this.onHold,
       runs: this.runs,
       active,
-      maxParallel
+      maxParallel,
+      merging: this.merging
     });
-    for (const { task, reasons } of excluded) {
+    for (const { task, reasons } of readiness.excluded) {
       console.log(`[TaskOrchestrator] excluded: #${task.order} "${task.title}" \u2014 ${reasons.join(", ")}`);
     }
-    console.log(`[TaskOrchestrator] getReadyTasks: ${candidateCount} candidates, ${Math.max(0, maxParallel - active)} slots, maxParallel=${maxParallel}`);
-    return ready;
+    console.log(`[TaskOrchestrator] getReadyTasks: ${readiness.candidateCount} candidates, ${Math.max(0, maxParallel - active)} slots, maxParallel=${maxParallel}`);
+    return readiness;
+  }
+  /**
+   * Open the run a task starts in, and for a change task decide whether it
+   * isolates (ADR-0020): an ops task needs no worktree, so it never waits on
+   * that choice. False while a dirty tree waits on the user; `resume` is what
+   * their choice replays.
+   */
+  async openFor(taskId, resume) {
+    this.runs.open();
+    return this.store.isOps(taskId) || this.runs.decide(resume);
   }
   /**
    * Cancel a running (or scheduled) task: kill its session and return it to
@@ -14128,7 +14409,7 @@ ${summary || "(empty \u2014 no output captured)"}`);
     const runner = this.store.resolveTaskRunner(task);
     const route = routeTransport("structured", runner, this.registry);
     if (route.transport !== "structured") throw new TaskControlError(`Task "${task.title}" cannot be continued: ${route.fallback}. Use Retry instead.`);
-    if (!await this.runs.open(() => this.continueTask(taskId, message))) return;
+    if (!await this.openFor(taskId, () => this.continueTask(taskId, message))) return;
     if (this.attempts.has(taskId) || !continuability(task).ok) return;
     this.retryCounts.set(taskId, (this.retryCounts.get(taskId) ?? 0) + 1);
     this.endAttempt(taskId, "retry");
@@ -14150,10 +14431,29 @@ ${summary || "(empty \u2014 no output captured)"}`);
     const task = this.store.get(taskId);
     if (!task || task.type !== "ai") return;
     if (this.attempts.has(taskId)) return;
-    if (!await this.runs.open(() => this.forceStartTask(taskId))) return;
+    this.refuseOpsDuringMerge(task);
+    if (!await this.openFor(taskId, () => this.forceStartTask(taskId))) return;
     this.onHold.delete(taskId);
+    this.notePastGate(task);
     await this.startTask(task);
   }
+  refuseOpsDuringMerge(task) {
+    if (this.merging && this.store.isOps(task.id)) {
+      throw new TaskControlError(`A Merge all is under way \u2014 ops task "${task.title}" can start once it has finished.`);
+    }
+  }
+  /**
+   * A force start passes a merge gate (ADR-0020), and the surface confirmed it
+   * first; the choice is kept on the task and said, because the work it acts
+   * on is not in the user's branch.
+   */
+  notePastGate(task) {
+    const unmerged = mergeGate(task, this.store, this.runs);
+    if (unmerged.length === 0) return;
+    const titles = unmerged.map((id) => `"${this.store.get(id)?.title ?? id}"`);
+    this.store.setForcedPastGate(task.id, titles);
+    this.tell("warn", `Task "${task.title}" was force-started before the work of ${titles.join(", ")} was merged into your branch.`);
+  }
   /**
    * Run exactly one task outside full-plan scheduling. The active/starting
    * session still contributes to {@link hasLiveWork} so every surface exposes
@@ -14164,8 +14464,10 @@ ${summary || "(empty \u2014 no output captured)"}`);
     if (this.hasLiveWork) return;
     const task = this.store.get(taskId);
     if (!task || task.type !== "ai") return;
-    if (!await this.runs.open(() => this.runTask(taskId))) return;
+    this.refuseOpsDuringMerge(task);
+    if (!await this.openFor(taskId, () => this.runTask(taskId))) return;
     this.onHold.delete(taskId);
+    this.notePastGate(task);
     await this.startTask(task);
   }
   getCompletedCount() {
@@ -14205,7 +14507,11 @@ ${summary || "(empty \u2014 no output captured)"}`);
       }
       return;
     }
-    const ready = this.getReadyTasks();
+    let readiness = this.readiness();
+    const atGate = readiness.gated.length > 0 || this.store.allTasks.some((t) => t.type === "user" && this.getMergeGate(t.id).length > 0);
+    if (atGate && await this.runs.refreshInHead()) readiness = this.readiness();
+    if (!this.running) return;
+    const { ready } = readiness;
     console.log(`[TaskOrchestrator] tick(): ${ready.length} ready, ${this.attempts.size} active, queue=${this.messageQueue.length}`);
     if (ready.length === 0 && this.attempts.size === 0) {
       const remaining = this.store.allTasks.filter((t) => t.status !== "completed");
@@ -14225,14 +14531,29 @@ ${summary || "(empty \u2014 no output captured)"}`);
         this.emit("onExecutionComplete");
       } else {
         this.notifications.info("Remaining tasks require user action or are on hold.");
+        this.sayGate();
         this.emit("onTaskChanged");
         this.emit("onTick");
       }
       return;
     }
-    for (const task of ready) await this.startTask(task);
+    for (const task of ready) {
+      if (this.store.isOps(task.id) ? this.merging : !await this.runs.decide(() => this.tick())) continue;
+      await this.startTask(task);
+    }
     this.emit("onTick");
   }
+  /**
+   * A run paused at merge gates says so, as plainly as a task that waits on
+   * the user: which tasks wait, and that Merge all lets them go on (ADR-0020).
+   */
+  sayGate() {
+    const waiting = this.store.allTasks.filter((t) => this.getMergeGate(t.id).length > 0);
+    const notice = waiting.length === 0 ? "" : `Waiting for Merge all: ${waiting.map((t) => `"${t.title}"`).join(", ")} ${waiting.length === 1 ? "needs" : "need"} work that is not merged into your branch yet.`;
+    if (notice === this.gateNotice) return;
+    this.gateNotice = notice;
+    if (notice) this.tell("info", notice);
+  }
   async startTask(task, continuation = null) {
     if (this.attempts.has(task.id)) return;
     const attempt = {
@@ -14246,6 +14567,8 @@ ${summary || "(empty \u2014 no output captured)"}`);
       integration: null,
       repair: this.landing.nextRepair(task.id),
       continuation,
+      ops: this.store.isOps(task.id),
+      snapshot: null,
       startedAt: (/* @__PURE__ */ new Date()).toISOString(),
       decided: false
     };
@@ -14271,18 +14594,22 @@ ${summary || "(empty \u2014 no output captured)"}`);
    */
   async spawnAttempt(task, attempt) {
     try {
-      const { cwd, worktree } = await this.runs.attemptCwd(task, { repair: attempt.repair !== null });
+      const { cwd, worktree } = await this.runs.attemptCwd(task, { repair: attempt.repair !== null, ops: attempt.ops });
       attempt.cwd = cwd;
       attempt.worktree = worktree;
+      if (attempt.ops) attempt.snapshot = await this.runs.snapshotWorkspace();
       if (this.attempts.get(task.id) !== attempt) {
         if (attempt.worktree && !this.attempts.has(task.id)) await this.runs.release(task.id, { keep: attempt.repair !== null });
         this.abandonSpawn(task, attempt);
         return false;
       }
-      const finalPrompt = attempt.continuation ? composeContinuationPrompt(task, attempt.continuation.message) : composeAugmentedPrompt(attempt.repair ? { ...task, prompt: this.landing.repairPrompt(task) } : task, this.store.planTasks, {
+      const finalPrompt = attempt.continuation ? composeContinuationPrompt(task, attempt.continuation.message, { ops: attempt.ops }) : composeAugmentedPrompt(attempt.repair ? { ...task, prompt: this.landing.repairPrompt(task) } : task, this.store.planTasks, {
         planMapEnabled: this.config.planMapEnabled,
         // A merge to resolve is not new behaviour to drive test-first.
-        tddEnabled: !attempt.repair && this.tddEnabled()
+        tddEnabled: !attempt.repair && this.tddEnabled(),
+        // An ops task's effects outlive a failed attempt and are never rolled
+        // back, so the next one is told what the last one did (ADR-0020).
+        previousAttempt: attempt.ops ? this.output.liveTail(task.id, { maxLines: OPS_RETRY_TAIL_LINES })?.text : void 0
       });
       this.lingering.close(task.id);
       const env = await this.envForTask(cwd);
@@ -14459,6 +14786,7 @@ ${summary || "(empty \u2014 no output captured)"}`);
     return ended;
   }
 };
+var OPS_RETRY_TAIL_LINES = 60;
 function unresumedMessage(task, why) {
   return `Could not continue task "${task.title}": ${why}. Retry starts it afresh.`;
 }
@@ -16916,7 +17244,7 @@ Execution is RUNNING${locked.length ? ` \u2014 these tasks are locked: ${locked.
     return tasks.map((t) => {
       const isMan = t.type === "user";
       const runFields = isMan ? `steps:${t.userSteps?.length ?? 0}` : `${t.assignedModel ? `model:${t.assignedModel.modelId} ` : ""}mode:${t.taskMode ?? "build"} effort:${t.thinkingEffort ?? "-"}`;
-      return `#${t.order} id=${t.id} "${t.title}" [${t.status}] type:${isMan ? "MAN" : "AI"} runner:${t.assignedRunner} ${runFields} autonomy:${t.autonomy ?? "-"} slice:${t.sliceType ?? "-"} deps:[${t.dependencies.map((d) => orderOf.get(d) ?? d).join(", ")}]`;
+      return `#${t.order} id=${t.id} "${t.title}" [${t.status}] type:${isMan ? "MAN" : t.ops ? "AI ops" : "AI"} runner:${t.assignedRunner} ${runFields} autonomy:${t.autonomy ?? "-"} slice:${t.sliceType ?? "-"} deps:[${t.dependencies.map((d) => orderOf.get(d) ?? d).join(", ")}]`;
     });
   }
 };
@@ -17413,6 +17741,7 @@ var SessionEventRelay = class {
     this.statusOwed = this.statusHeld;
     if (this.statusHeld) return;
     plan.tasks = this.store.snapshot();
+    const gate = this.orchestrator.mergeGateView();
     this.broadcast({
       type: "status_update",
       tasks: this.store.allTasks.map((t) => serializeTaskStatus(
@@ -17420,8 +17749,10 @@ var SessionEventRelay = class {
         this.orchestrator.getIdleSince(t.id),
         this.orchestrator.getTaskIsolation(t.id),
         this.orchestrator.getQueuedTaskMessages(t.id),
-        this.awaitingApproval(t.id)
-      ))
+        this.awaitingApproval(t.id),
+        this.orchestrator.getMergeGate(t.id)
+      )),
+      ...gate ? { gate } : {}
     });
   }
   /**
@@ -18754,6 +19085,14 @@ var Session = class {
   isolationView() {
     return this.orchestrator.isolationView();
   }
+  /** The dependencies a task waits on at its merge gate (ADR-0020); empty when it waits for no Merge all. */
+  mergeGate(taskId) {
+    return this.orchestrator.getMergeGate(taskId);
+  }
+  /** What Merge all would merge mid-run, while any task waits at a merge gate; null otherwise. */
+  mergeGateView() {
+    return this.orchestrator.mergeGateView();
+  }
   /** The run's integration branch against its base ref, as a unified diff. */
   async reviewRunDiff() {
     if (!this.orchestrator.isolationRecord) throw new PlanEditError("This plan has no isolated run");
@@ -18763,10 +19102,12 @@ var Session = class {
    * "Merge all": each repo's integration branch into whatever the user has
    * checked out there — every repo, or none if any cannot take it. The one
    * irreversible step of isolated execution, so this explicit call is the
-   * only way it ever happens.
+   * only way it ever happens. During a run it merges what has landed so far,
+   * which is what opens a merge gate (ADR-0020); it waits for no ops task,
+   * and refuses while one runs.
    */
   async mergeRun() {
-    this.requireSettledRun();
+    if (!this.orchestrator.isolationRecord) throw new PlanEditError("This plan has no isolated run");
     const result = await this.orchestrator.mergeRun();
     this.broadcast({ type: "isolation_merge", result });
     return result;
@@ -18856,7 +19197,8 @@ var Session = class {
    * falls through to the no-op `store.update` below instead of throwing.
    */
   async updateTask(taskId, changes) {
-    if ((changes.dependencies || changes.type || changes.assignedModel || changes.taskMode) && this.store.get(taskId)) {
+    if ("ops" in changes) changes = { ...changes, ops: changes.ops === true ? true : void 0 };
+    if ((changes.dependencies || changes.type || changes.assignedModel || changes.taskMode || "ops" in changes) && this.store.get(taskId)) {
       const check = validateTaskEdit("direct", this.store.planTasks, taskId, changes, this.editCatalog());
       if (!check.ok) throw new PlanEditError(check.error ?? "Those changes are not valid");
       if (check.clear?.length) {