diff --git a/.changelog/NEXT.md b/.changelog/NEXT.md
index 651a4a467..8ddf04c6d 100644
--- a/.changelog/NEXT.md
+++ b/.changelog/NEXT.md
@@ -116,3 +116,5 @@
- **[issue-2220] Creative render tools with route-level persistence (CDO Phase 2 slice).** The Creative Director orchestrator can now render comic-issue and volume (season) covers — `pipeline_renderComicCover`, `pipeline_renderComicBackCover`, `pipeline_renderVolumeCover`, `pipeline_renderVolumeBackCover` are registered creative tools. These render jobs need more than a bare enqueue: the media-job filename hook attaches the finished image only if the target cover slot already carries the returned `jobId`, and that slot write used to live in the route factory (`routes/pipeline/covers.js#makeCoverRenderHandler`), so wrapping the bare `enqueueComicCover`-style service in a tool would silently drop orchestrated covers. The enqueue+persist flow (build the in-flight render slot, script-gate, write it onto the record) now lives in shared service entry points — `renderComicCover` / `renderComicBackCover` (→ `stages.comicPages.{cover|backCover}` via the serialized `updateStageWithLatest` series write tail) and `renderVolumeCover` / `renderVolumeBackCover` (→ `series.seasons[].{cover|backCover}` via `updateSeasonOnSeries`) in `visualStages.js` — so the four cover-render routes and the four orchestrator tools share ONE code path. The persist keeps the script-gate semantics (absent `coverScript` preserves the persisted concept, empty string clears it) and serializes against a concurrent blur-save on the same record. Tools charge as `render` against the daily action budget. Cover render is the primary deliverable; wrapping the remaining route-persisted render actions (comic page render / refine-render) as tools stays tracked on #2220.
- **`getSettings()` now serves from an in-memory cache instead of re-reading settings.json on every call.** `getSettings()` is invoked 100+ times across the codebase (several per request), each previously doing a fresh filesystem read + JSON.parse of app-wide, rarely-changing data. It now memoizes the parsed settings, populated lazily on first read and refreshed off the `settings:updated` event that every `save()`/`updateSettings()`/`updateSettingsWith()` already emits — so app-driven writes keep the cache coherent while write paths still read fresh off disk inside their write queue for the read-merge-write, preserving write-ordering guarantees. Mirrors the existing `settings:updated`-invalidated cache in `sharing/annotationIdentity.js`. Alongside it, a few independent per-file read loops are now parallelized (`digital-twin-analysis.validateCompleteness`, editorial series-health's series+settings load) and hot page derivations memoized (`Review` grouping/sorting, `Tribe` care-queue), cutting redundant work on socket-driven re-renders.
+
+- **Branch & PR reconciliation now runs on any managed app as a Chief-of-Staff scheduled task — not just PortOS.** The branch reconciler (finish this machine's unfinished local git work: delete fully-merged orphaned branches + their worktrees, open PRs for pushed-but-unopened work, resolve merge conflicts, drive the review loop, and auto-merge when a PR is green) used to be a PortOS-only feature with its own daily cron, `/api/branch-reconcile` route, `settings.branchReconcile` toggle, and a dedicated Settings tab — hardwired to the PortOS checkout. It is now a first-class per-app CoS task type, **`branch-reconcile`**, configured like every other improvement task (per-app enable, provider/model, cadence, cooldown, budget) under Chief of Staff → task scheduling. It runs `perpetual` (drain-until-done): each dispatch runs the deterministic, peer-safe cleanup + classification against the *app's* repo, dispatches the coordinator agent only while actionable in-flight branches remain, then parks on a daily recheck — so no agent is burned on a no-op run. A progress-signature convergence guard ensures the drain only re-dispatches when the actionable set actually *changed* since the last run (a branch advanced NEEDS_PR→IN_REVIEW→merged, or a new/removed branch): a cycle that leaves the same branches in the same states (a branch judged "not ready", a PR blocked on human review or red CI) parks instead of re-spawning an identical coordinator back-to-back. The peer-safety guarantee is unchanged (only local `refs/heads/` are ever touched; a federated peer's branch exists here only as a remote-tracking ref and is structurally invisible), and the per-behavior toggles (`cleanupMerged` / `openPr` / `resolveConflicts` / `autoMerge`) are now per-app task-metadata overrides. Off by default; enabling it on an app is the user's explicit consent to let it drive PRs on a schedule. The old dedicated scheduler, route, settings key, and Settings tab are removed; a migration (`scripts/migrations/170-branch-reconcile-to-cos-task.js`) carries a previously-enabled `branchReconcile` opt-in into the new task (cron→recheckCron, actions→per-app metadata) scoped to the PortOS app, and drops the dead settings key — so an install that had it on keeps reconciling instead of silently stopping. (`server/services/branchReconcile.js`, `server/services/cosTaskGenerator.js`, `server/services/taskSchedule.js`, `server/services/taskPromptDefaults/prompts.js`)
diff --git a/client/src/components/settings/BranchReconcileTab.jsx b/client/src/components/settings/BranchReconcileTab.jsx
deleted file mode 100644
index 001864751..000000000
--- a/client/src/components/settings/BranchReconcileTab.jsx
+++ /dev/null
@@ -1,205 +0,0 @@
-import { useEffect, useState } from 'react';
-import { Save, Loader2, GitPullRequest, RefreshCw } from 'lucide-react';
-import toast from '../ui/Toast';
-import BrailleSpinner from '../BrailleSpinner';
-import {
- getSettings,
- updateSettings,
- getBranchReconcileStatus,
- runBranchReconcile,
-} from '../../services/api';
-
-// Actions follow an opt-out model: absent/undefined means ON. Only an explicit
-// `false` disables. Mirrors the server's `actionOn` helper.
-const on = (v) => v !== false;
-
-const ACTIONS = [
- { key: 'cleanupMerged', label: 'Clean up merged/orphaned branches + worktrees', help: 'Deterministic — no agent. Removes a local branch whose work is already merged, plus its lingering worktree.' },
- { key: 'openPr', label: 'Open a PR for a finished branch without one', help: 'Agent verifies the work is complete, then runs /do:pr.' },
- { key: 'resolveConflicts', label: 'Resolve conflicts on open PRs', help: 'Agent rebases onto the default branch and resolves conflicts.' },
- { key: 'autoMerge', label: 'Auto-merge PRs that are fully green', help: 'Merges only when MERGEABLE + CI green + latest Copilot review has 0 comments.' },
-];
-
-// Settings → Branch Reconcile. Opt-in daily automation that finishes THIS
-// machine's unfinished local branches/PRs (cleanup merged, open PRs, resolve
-// conflicts, merge) without touching federated peers' branches. OFF by default.
-export function BranchReconcileTab() {
- const [loading, setLoading] = useState(true);
- const [enabled, setEnabled] = useState(false);
- const [cron, setCron] = useState('0 3 * * *');
- const [actions, setActions] = useState({ cleanupMerged: true, openPr: true, resolveConflicts: true, autoMerge: true });
-
- const [savedEnabled, setSavedEnabled] = useState(false);
- const [savedCron, setSavedCron] = useState('0 3 * * *');
- const [savedActions, setSavedActions] = useState({ cleanupMerged: true, openPr: true, resolveConflicts: true, autoMerge: true });
-
- const [saving, setSaving] = useState(false);
- const [running, setRunning] = useState(false);
- const [lastRun, setLastRun] = useState(null);
-
- useEffect(() => {
- Promise.all([
- getSettings({ silent: true }).catch(() => ({})),
- getBranchReconcileStatus({ silent: true }).catch(() => null),
- ]).then(([settings, status]) => {
- const c = settings?.branchReconcile || {};
- const en = c.enabled === true;
- const cr = typeof c.cron === 'string' && c.cron ? c.cron : '0 3 * * *';
- const acts = {
- cleanupMerged: on(c.actions?.cleanupMerged),
- openPr: on(c.actions?.openPr),
- resolveConflicts: on(c.actions?.resolveConflicts),
- autoMerge: on(c.actions?.autoMerge),
- };
- setEnabled(en); setCron(cr); setActions(acts);
- setSavedEnabled(en); setSavedCron(cr); setSavedActions(acts);
- setLastRun(status?.lastRun || null);
- }).finally(() => setLoading(false));
- }, []);
-
- const actionsDirty = ACTIONS.some((a) => actions[a.key] !== savedActions[a.key]);
- const dirty = enabled !== savedEnabled || cron.trim() !== savedCron || actionsDirty;
-
- const handleSave = async () => {
- const cr = cron.trim() || '0 3 * * *';
- setSaving(true);
- const merged = await updateSettings({ branchReconcile: { enabled, cron: cr, actions } }).catch(() => null);
- setSaving(false);
- if (!merged) return;
- setCron(cr);
- setSavedEnabled(enabled); setSavedCron(cr); setSavedActions(actions);
- toast.success('Saved — schedule applies on next server restart');
- };
-
- // Run Now gates on the SAVED enabled state (not the in-memory toggle) and is
- // disabled while the form is dirty or a save/run is in flight — so the user
- // can't trigger a run against a config they haven't persisted.
- const handleRunNow = async () => {
- setRunning(true);
- const summary = await runBranchReconcile({ silent: true }).catch(() => null);
- setRunning(false);
- if (!summary) { toast.error('Reconcile run failed'); return; }
- setLastRun(summary);
- // The server catches run failures and returns a 200 `{ error }` summary
- // (the run happens outside the request lifecycle), so a resolved promise is
- // NOT proof of success — check the failure fields before toasting success.
- if (summary.error) toast.error(`Reconcile failed: ${summary.error}`);
- else if (summary.skipped === 'disabled') toast.error('Reconciler is disabled — enable and save first');
- else toast.success(`Reconcile: cleaned ${summary.cleaned?.length ?? 0}, coordinator ${summary.queued ? 'queued' : 'not queued'}`);
- };
-
- if (loading) return ;
-
- return (
-
-
-
-
-
Branch & PR Reconciler
-
-
- Daily automation that finishes this machine's unfinished git work: cleans up branches
- whose PRs already merged, and dispatches an agent to open PRs, resolve conflicts, and merge in-flight ones.
- Only local branches are touched — branches created on federated peers are never affected. OFF by default.
-
{lastRun.at ? new Date(lastRun.at).toLocaleString() : '—'}
-
Cleaned
{lastRun.cleaned?.length ?? 0}
-
Coordinator queued
{lastRun.queued ? 'yes' : 'no'}
-
Actionable
{lastRun.actionable?.join(', ') || '—'}
-
WIP (left)
{lastRun.wip?.join(', ') || '—'}
-
- )}
- {/* The coordinator is queued but only RUNS when CoS auto-run is in Execute mode.
- Warn honestly so the queued state isn't mistaken for "an agent is running". */}
- {lastRun.queued && lastRun.coordinatorWillRun === false && (
-
- Coordinator queued but CoS auto-run is {lastRun.cosAutonomy || 'not execute'} — it will spawn once you set CoS auto-run to Execute.
-