@mu-crew/mu 3.10.2 → 3.11.1

package/dist/index.d.ts

@@ -1901,6 +1901,20 @@ declare class AgentCtlUnreachableError extends Error implements HasNextSteps {
     constructor(agentName: string, workstream: string, socket: string, kind: "missing" | "refused");
     errorNextSteps(): NextStep[];
 }
+/**
+ * A ctl verb (send, abort, ...) found the agent's control socket silent
+ * AND its pane gone: the process exited (or the pane was closed behind
+ * mu's back), so there is nothing to link, kick or forward. Raised
+ * instead of AgentCtlUnreachableError, which is for a live pane.
+ */
+declare class AgentPaneDeadError extends Error implements HasNextSteps {
+    readonly agentName: string;
+    readonly workstream: string;
+    readonly paneId: string;
+    readonly name = "AgentPaneDeadError";
+    constructor(agentName: string, workstream: string, paneId: string);
+    errorNextSteps(): NextStep[];
+}
 /**
  * `mu agent abort` on an agent that does not run pi: there is no control
  * socket to carry the abort, and mu does not silently signal the pane.
@@ -5696,4 +5710,4 @@ declare function summarizeWorkstream(db: Db, opts: WorkstreamOptions): Promise<W
  */
 declare function teardownWorkstream(db: Db, opts: TeardownWorkstreamOptions): Promise<TeardownResult>;
 
-export { AGENT_STATE_GLYPH, type AbortAgentOptions, type AbortResult, type AddNoteOptions, type AddTaskOptions, type AdoptAgentOptions, type AdoptAgentResult, AgentAbortNeedsCtlError, AgentAbortTimeoutError, AgentBusyError, AgentCtlUnreachableError, AgentDiedOnSpawnError, AgentExistsError, AgentExtensionOutdatedError, AgentFreshNeedsCtlError, AgentNameExhaustedError, AgentNotFoundError, AgentNotInWorkstreamError, type AgentRow, AgentSlashCommandUnsupportedError, AgentSpawnCliNotFoundError, AgentSpawnStartupError, type AmbientOptions, type AmbientResult, type AppendLogOptions, type ApplyResult, type BlockEdgeResult, CAPTURE_TRIGGER_DDL, CURRENT_SCHEMA_VERSION, type CaptureDb, type CaptureIntent, type CaptureOptions, type CaseCollision, type CheapDriftReport, type ClaimResult, type ClaimTaskOptions, ClaimerNotRegisteredError, type CloseAgentOptions, type CloseAgentResult, type CloseSubstate, type CloseTaskResult, type CommandResolutionResult, type CommandResolver, CrossWorkstreamEdgeError, type CtlLink, CycleError, DEFAULT_SUBSTATE, DRIFT_REPORT_CAP, type Db, type DeleteTaskResult, type DoctorCheck, type DoctorStatus, type DoctorSummary, DriftDetectedError, type DriftRecord, type DriftReport, EXPECTED_TABLES, type EvidenceOption, type FileLockOptions, type FleetHazard, type FlushResult, type FsProbe, type FullDag, GLYPH, GroupIdAmbiguousError, type GroupSummary, HazardFailError, type HazardSeverity, type Hlc, HlcOverflowError, HlcParseError, HomeDirAsProjectRootError, type IdFromTitleResult, type IngestFromDbResult, type IngestResult, type InsertAgentInput, InvalidSubstateError, type InverseOp, KNOWN_INTENTS, KNOWN_VERBS, type KickAgentOptions, type KickAgentResult, type KickProcessExecutor, type KickSignal, type KnownIntent, LinkConflictError, type LinkState, type LinkStatus, type ListLiveAgentsOptions, type ListLogsOptions, type ListNotesOptions, type ListReadyOptions, type ListTasksOptions, type LiveAgent, type LiveAgentsView, type LoadFullDagOptions, type LoadWorkstreamSnapshotOptions, type LocalIntent, type LogKind, LogKindReservedError, type LogRow, MACHINE_LOCAL_ENTITIES, MACHINE_LOCAL_TABLES, MU_SHIM_MARKER, MachineIdentityMissingError, type MachineLocalEntity, type MachineLocalLoss, type MachineLocalTable, type MuxBackend, type MuxBackendName, MuxError, type MuxPane, type MuxPaneStatus, type MuxSession, type MuxWindow, type NewSessionOptions, type NewWindowOptions, NoForegroundProcessError, NoMultiplexerError, NothingToUndoError, OP_CTX_DDL, type Op, type OpContext, OpEntityNotSyncedError, OpKeyMalformedError, type OpenDbOptions, type OwnedTasksSummary, PANE_ID_RE, PEER_SHORT_LEN, PEER_STALE_MS, PORTABLE_TABLES, PaneNotFoundError, PaneNotInSessionError, type ParkTaskOptions, type PeerSegment, type PeerStatus, type PortableTable, ReaperDetectedDuringWaitError, type RebuildOptions, type RebuildReport, RebuildTargetExistsError, RebuildTargetIsSourceError, type ReconcileMode, type ReconcileOptions, type ReconcileReport, type ReleaseResult, type ReleaseTaskOptions, type RemoveBlockEdgeResult, type RenderableOp, type RenderedOp, type ReparentTaskResult, type RoiBucket, type RuntimeState, SEGMENT_FORMAT_VERSION, SYNCED_ENTITIES, SchemaTooNewError, SchemaTooOldError, type SegmentDefect, type SegmentDefectKind, type SegmentLine, type SegmentManifest, type SendOptions, type SendResult, type SendWarning, type SetStatusOptions, type SetStatusResult, type SlugifyResult, type SpawnAgentOptions, type SplitWindowOptions, StallDetectedDuringWaitError, type StateReading, type StateSource, type StrandedWorkspaceOrphan, SubstateReasonRequiredError, type SyncPassResult, SyncPeerNotFoundError, SyncPeerRefAmbiguousError, SyncSourceNotFoundError, type SyncedEntity, TASK_STATUSES, TASK_STATUS_LIST, TASK_SUBSTATES, TASK_SUBSTATE_ROWS, TaskAlreadyOwnedError, TaskClaimStaleWorkspaceError, type TaskEdgeWithStatus, type TaskEdges, type TaskEdgesWithStatus, TaskExistsError, TaskIdInvalidError, TaskInTriageError, TaskNotFoundError, TaskNotInWorkstreamError, type TaskNoteRow, type TaskPair, TaskParkStateError, TaskParkedError, type TaskRow, type TaskStatus, type TaskSubstate, TaskTitleSlugEmptyError, type TaskWaitOptions, type TaskWaitRef, type TaskWaitResult, type TaskWaitTaskState, type TeardownResult, TmuxError, type TmuxExecResult, type TmuxExecutor, type TmuxPane, type TmuxSession, type TmuxWindow, type Track, type Transport, UNKNOWN_REASON, UndoGroupNotFoundError, type UndoOptions, type UndoPlan, type UndoResult, UndoSupersededError, type UpdateTaskOptions, type UpdateTaskResult, type VcsBackend, type VcsBackendName, WORKSPACE_STALE_THRESHOLD, WorkspaceConflictError, WorkspaceDirtyError, WorkspaceExistsError, type WorkspaceFailure, WorkspaceNotFoundError, type WorkspaceOrphan, WorkspacePathNotEmptyError, WorkspacePreservedError, type WorkspaceRow, type WorkspaceStaleness, WorkspaceVcsRequiredError, WorkstreamExistsError, WorkstreamNameInvalidError, WorkstreamNameReservedError, WorkstreamNotFoundError, type WorkstreamOptions, type WorkstreamSnapshot, type WorkstreamSnapshotSlowFields, type WorkstreamSummary, abortAgent, acceptTask, activeMux, addBlockEdge, addNote, addTask, adoptAgent, agentKey, agentStateGlyph, agentStateHistogram, ambientFlush, ambientIngest, ambientSyncPass, appendLog, applyIncomingOp, applyOp, applyOps, assertValidPaneId, awaitPaneQuiescence, backendByName, capturePane, checkCaseCollisions, checkCheapDriftInvariant, checkCommandResolvable, checkDbInsideSyncDir, checkDrift, checkFleetHazards, checkNetworkMount, claimTask, classifyFsType, closeAgent, closeTask, compareHlc, composeAgentTitle, countProblems, createWorkspace, ctlRuntimeState, currentAgentName, currentOpContext, currentPaneTitle, decorateWithDirty, decorateWithStaleness, defaultDbPath, defaultSendDelayMs, defaultSendReadinessMs, defaultSpawnLivenessMs, defaultStateDir, deleteAgent, deleteTask, detectBackend, detectMux, discoverPeers, driftRemediation, emitEvent, ensureWorkstream, envVarNameForCli, expectsCtl, findCaseCollisions, flushSegment, foregroundPgid, formatDriftRecord, formatHlc, formatPair, freeWorkspace, getAgent, getAgentByPane, getParallelTracks, getPrerequisites, getTask, getTaskEdges, getTaskEdgesWithStatus, getWaitPollCount, getWatermark, getWorkspaceForAgent, getWorkspaceStaleness, gitBackend, hasWorkMarker, idFromTitle, idFromTitleVerbose, ingestFromDb, ingestSegment, insertAgent, inspectLinks, installCapture, interruptAgent, isKickSignal, isPathInside, isTaskStatus, isValidAgentName, isValidPair, isValidPaneId, isValidTaskId, isValidWorkstreamName, isWorkspaceStale, jjBackend, kickAgent, killPane, killSession, latestSeq, linkPi, linkSkill, listAgents, listAllOrphanWorkspaces, listBlocked, listGoals, listInProgress, listLiveAgents, listLogs, listNotes, listPanes, listPanesInSession, listReady, listRecentClosed, listRecentGroups, listSessions, listTasks, listTasksByOwner, listWindows, listWorkspaceOrphans, listWorkspaces, listWorkstreams, loadDoctorChecks, loadDoctorSummary, loadFullDag, loadWorkstreamSnapshot, loadWorkstreamSnapshotFast, loadWorkstreamSnapshotSlow, localMachineId, locksDir, mapLegacyStatus, mergeSnapshotFastSlow, mostRecentGroup, murmurAvailable, mux, muxByName, newSession, newSessionWithPane, newWindow, nextHlc, noneBackend, opSubject, openDb, openTask, paneExists, paneTTY, parkTask, parseAgentNameFromTitle, parseHlc, parseOpKey, parsePsTtyOutput, peerStatuses, planUndo, priorFieldValue, probeFilesystem, readAgent, readAgentStates, readFileLockMeta, readManifest, rebuildInto, receiveHlc, reconcile, refreshAgentTitle, releaseTask, remediationParagraph, removeBlockEdge, renderForest, renderOp, renderOpLine, renderTaskTree, repairPeer, reparentTask, resetCommandResolverForTests, resetKickProcessExecutor, resetMux, resetSleep, resetTmuxExecutor, resetWaitPollCount, resetWatermark, resolveActorIdentity, resolveCliCommand, resolveCliCommandWithSource, resolveGroupId, resolvePair, resolvePeerRef, roiBucket, segmentLineCount, segmentPath, selectLayout, sendToAgent, sendToPane, sendViaTransport, sessionExists, setCommandResolverForTests, setKickProcessExecutor, setMuxForTests, setPaneTitle, setSleepForTests, setTaskStatus, setTmuxExecutor, setWaitSleepForTests, setWaitStuckWarnForTests, setWatermark, slBackend, sleep, slugifyTitle, slugifyTitleVerbose, spawnAgent, splitWindow, summarizeOwnedTasks, summarizeWorkstream, syncDir, syncEnabled, syncPass, teardownWorkstream, tmux, tmuxBackend, transportNextSteps, undoGroup, unparkTask, updateTask, verifyAgainstManifest, waitForTasks, withCaptureSuppressed, withFileLock, withOpContext, workspacePath, workspacesRoot, yankCommandForCheck };
+export { AGENT_STATE_GLYPH, type AbortAgentOptions, type AbortResult, type AddNoteOptions, type AddTaskOptions, type AdoptAgentOptions, type AdoptAgentResult, AgentAbortNeedsCtlError, AgentAbortTimeoutError, AgentBusyError, AgentCtlUnreachableError, AgentDiedOnSpawnError, AgentExistsError, AgentExtensionOutdatedError, AgentFreshNeedsCtlError, AgentNameExhaustedError, AgentNotFoundError, AgentNotInWorkstreamError, AgentPaneDeadError, type AgentRow, AgentSlashCommandUnsupportedError, AgentSpawnCliNotFoundError, AgentSpawnStartupError, type AmbientOptions, type AmbientResult, type AppendLogOptions, type ApplyResult, type BlockEdgeResult, CAPTURE_TRIGGER_DDL, CURRENT_SCHEMA_VERSION, type CaptureDb, type CaptureIntent, type CaptureOptions, type CaseCollision, type CheapDriftReport, type ClaimResult, type ClaimTaskOptions, ClaimerNotRegisteredError, type CloseAgentOptions, type CloseAgentResult, type CloseSubstate, type CloseTaskResult, type CommandResolutionResult, type CommandResolver, CrossWorkstreamEdgeError, type CtlLink, CycleError, DEFAULT_SUBSTATE, DRIFT_REPORT_CAP, type Db, type DeleteTaskResult, type DoctorCheck, type DoctorStatus, type DoctorSummary, DriftDetectedError, type DriftRecord, type DriftReport, EXPECTED_TABLES, type EvidenceOption, type FileLockOptions, type FleetHazard, type FlushResult, type FsProbe, type FullDag, GLYPH, GroupIdAmbiguousError, type GroupSummary, HazardFailError, type HazardSeverity, type Hlc, HlcOverflowError, HlcParseError, HomeDirAsProjectRootError, type IdFromTitleResult, type IngestFromDbResult, type IngestResult, type InsertAgentInput, InvalidSubstateError, type InverseOp, KNOWN_INTENTS, KNOWN_VERBS, type KickAgentOptions, type KickAgentResult, type KickProcessExecutor, type KickSignal, type KnownIntent, LinkConflictError, type LinkState, type LinkStatus, type ListLiveAgentsOptions, type ListLogsOptions, type ListNotesOptions, type ListReadyOptions, type ListTasksOptions, type LiveAgent, type LiveAgentsView, type LoadFullDagOptions, type LoadWorkstreamSnapshotOptions, type LocalIntent, type LogKind, LogKindReservedError, type LogRow, MACHINE_LOCAL_ENTITIES, MACHINE_LOCAL_TABLES, MU_SHIM_MARKER, MachineIdentityMissingError, type MachineLocalEntity, type MachineLocalLoss, type MachineLocalTable, type MuxBackend, type MuxBackendName, MuxError, type MuxPane, type MuxPaneStatus, type MuxSession, type MuxWindow, type NewSessionOptions, type NewWindowOptions, NoForegroundProcessError, NoMultiplexerError, NothingToUndoError, OP_CTX_DDL, type Op, type OpContext, OpEntityNotSyncedError, OpKeyMalformedError, type OpenDbOptions, type OwnedTasksSummary, PANE_ID_RE, PEER_SHORT_LEN, PEER_STALE_MS, PORTABLE_TABLES, PaneNotFoundError, PaneNotInSessionError, type ParkTaskOptions, type PeerSegment, type PeerStatus, type PortableTable, ReaperDetectedDuringWaitError, type RebuildOptions, type RebuildReport, RebuildTargetExistsError, RebuildTargetIsSourceError, type ReconcileMode, type ReconcileOptions, type ReconcileReport, type ReleaseResult, type ReleaseTaskOptions, type RemoveBlockEdgeResult, type RenderableOp, type RenderedOp, type ReparentTaskResult, type RoiBucket, type RuntimeState, SEGMENT_FORMAT_VERSION, SYNCED_ENTITIES, SchemaTooNewError, SchemaTooOldError, type SegmentDefect, type SegmentDefectKind, type SegmentLine, type SegmentManifest, type SendOptions, type SendResult, type SendWarning, type SetStatusOptions, type SetStatusResult, type SlugifyResult, type SpawnAgentOptions, type SplitWindowOptions, StallDetectedDuringWaitError, type StateReading, type StateSource, type StrandedWorkspaceOrphan, SubstateReasonRequiredError, type SyncPassResult, SyncPeerNotFoundError, SyncPeerRefAmbiguousError, SyncSourceNotFoundError, type SyncedEntity, TASK_STATUSES, TASK_STATUS_LIST, TASK_SUBSTATES, TASK_SUBSTATE_ROWS, TaskAlreadyOwnedError, TaskClaimStaleWorkspaceError, type TaskEdgeWithStatus, type TaskEdges, type TaskEdgesWithStatus, TaskExistsError, TaskIdInvalidError, TaskInTriageError, TaskNotFoundError, TaskNotInWorkstreamError, type TaskNoteRow, type TaskPair, TaskParkStateError, TaskParkedError, type TaskRow, type TaskStatus, type TaskSubstate, TaskTitleSlugEmptyError, type TaskWaitOptions, type TaskWaitRef, type TaskWaitResult, type TaskWaitTaskState, type TeardownResult, TmuxError, type TmuxExecResult, type TmuxExecutor, type TmuxPane, type TmuxSession, type TmuxWindow, type Track, type Transport, UNKNOWN_REASON, UndoGroupNotFoundError, type UndoOptions, type UndoPlan, type UndoResult, UndoSupersededError, type UpdateTaskOptions, type UpdateTaskResult, type VcsBackend, type VcsBackendName, WORKSPACE_STALE_THRESHOLD, WorkspaceConflictError, WorkspaceDirtyError, WorkspaceExistsError, type WorkspaceFailure, WorkspaceNotFoundError, type WorkspaceOrphan, WorkspacePathNotEmptyError, WorkspacePreservedError, type WorkspaceRow, type WorkspaceStaleness, WorkspaceVcsRequiredError, WorkstreamExistsError, WorkstreamNameInvalidError, WorkstreamNameReservedError, WorkstreamNotFoundError, type WorkstreamOptions, type WorkstreamSnapshot, type WorkstreamSnapshotSlowFields, type WorkstreamSummary, abortAgent, acceptTask, activeMux, addBlockEdge, addNote, addTask, adoptAgent, agentKey, agentStateGlyph, agentStateHistogram, ambientFlush, ambientIngest, ambientSyncPass, appendLog, applyIncomingOp, applyOp, applyOps, assertValidPaneId, awaitPaneQuiescence, backendByName, capturePane, checkCaseCollisions, checkCheapDriftInvariant, checkCommandResolvable, checkDbInsideSyncDir, checkDrift, checkFleetHazards, checkNetworkMount, claimTask, classifyFsType, closeAgent, closeTask, compareHlc, composeAgentTitle, countProblems, createWorkspace, ctlRuntimeState, currentAgentName, currentOpContext, currentPaneTitle, decorateWithDirty, decorateWithStaleness, defaultDbPath, defaultSendDelayMs, defaultSendReadinessMs, defaultSpawnLivenessMs, defaultStateDir, deleteAgent, deleteTask, detectBackend, detectMux, discoverPeers, driftRemediation, emitEvent, ensureWorkstream, envVarNameForCli, expectsCtl, findCaseCollisions, flushSegment, foregroundPgid, formatDriftRecord, formatHlc, formatPair, freeWorkspace, getAgent, getAgentByPane, getParallelTracks, getPrerequisites, getTask, getTaskEdges, getTaskEdgesWithStatus, getWaitPollCount, getWatermark, getWorkspaceForAgent, getWorkspaceStaleness, gitBackend, hasWorkMarker, idFromTitle, idFromTitleVerbose, ingestFromDb, ingestSegment, insertAgent, inspectLinks, installCapture, interruptAgent, isKickSignal, isPathInside, isTaskStatus, isValidAgentName, isValidPair, isValidPaneId, isValidTaskId, isValidWorkstreamName, isWorkspaceStale, jjBackend, kickAgent, killPane, killSession, latestSeq, linkPi, linkSkill, listAgents, listAllOrphanWorkspaces, listBlocked, listGoals, listInProgress, listLiveAgents, listLogs, listNotes, listPanes, listPanesInSession, listReady, listRecentClosed, listRecentGroups, listSessions, listTasks, listTasksByOwner, listWindows, listWorkspaceOrphans, listWorkspaces, listWorkstreams, loadDoctorChecks, loadDoctorSummary, loadFullDag, loadWorkstreamSnapshot, loadWorkstreamSnapshotFast, loadWorkstreamSnapshotSlow, localMachineId, locksDir, mapLegacyStatus, mergeSnapshotFastSlow, mostRecentGroup, murmurAvailable, mux, muxByName, newSession, newSessionWithPane, newWindow, nextHlc, noneBackend, opSubject, openDb, openTask, paneExists, paneTTY, parkTask, parseAgentNameFromTitle, parseHlc, parseOpKey, parsePsTtyOutput, peerStatuses, planUndo, priorFieldValue, probeFilesystem, readAgent, readAgentStates, readFileLockMeta, readManifest, rebuildInto, receiveHlc, reconcile, refreshAgentTitle, releaseTask, remediationParagraph, removeBlockEdge, renderForest, renderOp, renderOpLine, renderTaskTree, repairPeer, reparentTask, resetCommandResolverForTests, resetKickProcessExecutor, resetMux, resetSleep, resetTmuxExecutor, resetWaitPollCount, resetWatermark, resolveActorIdentity, resolveCliCommand, resolveCliCommandWithSource, resolveGroupId, resolvePair, resolvePeerRef, roiBucket, segmentLineCount, segmentPath, selectLayout, sendToAgent, sendToPane, sendViaTransport, sessionExists, setCommandResolverForTests, setKickProcessExecutor, setMuxForTests, setPaneTitle, setSleepForTests, setTaskStatus, setTmuxExecutor, setWaitSleepForTests, setWaitStuckWarnForTests, setWatermark, slBackend, sleep, slugifyTitle, slugifyTitleVerbose, spawnAgent, splitWindow, summarizeOwnedTasks, summarizeWorkstream, syncDir, syncEnabled, syncPass, teardownWorkstream, tmux, tmuxBackend, transportNextSteps, undoGroup, unparkTask, updateTask, verifyAgainstManifest, waitForTasks, withCaptureSuppressed, withFileLock, withOpContext, workspacePath, workspacesRoot, yankCommandForCheck };

package/dist/index.js

@@ -8,7 +8,7 @@ import {
   priorFieldValue,
   resolveGroupId,
   undoGroup
-} from "./chunk-JEWHQ4GB.js";
+} from "./chunk-DXKJY3NT.js";
 import {
   AGENT_STATE_GLYPH,
   AgentAbortNeedsCtlError,
@@ -22,6 +22,7 @@ import {
   AgentNameExhaustedError,
   AgentNotFoundError,
   AgentNotInWorkstreamError,
+  AgentPaneDeadError,
   AgentSlashCommandUnsupportedError,
   AgentSpawnCliNotFoundError,
   AgentSpawnStartupError,
@@ -251,7 +252,7 @@ import {
   workspacePath,
   workspacesRoot,
   yankCommandForCheck
-} from "./chunk-KGGOITI5.js";
+} from "./chunk-JYZUNPPO.js";
 import {
   CAPTURE_TRIGGER_DDL,
   CURRENT_SCHEMA_VERSION,
@@ -342,6 +343,7 @@ export {
   AgentNameExhaustedError,
   AgentNotFoundError,
   AgentNotInWorkstreamError,
+  AgentPaneDeadError,
   AgentSlashCommandUnsupportedError,
   AgentSpawnCliNotFoundError,
   AgentSpawnStartupError,

package/dist/{tui-SKZMGHA6.js → tui-DGDEH4JX.js}

@@ -12,7 +12,7 @@ import {
   relTimeBasisForSort,
   sortTasks,
   truncate
-} from "./chunk-RXVYBV3P.js";
+} from "./chunk-2FJK6OOZ.js";
 import {
   GLYPH,
   WORKSPACE_STALE_THRESHOLD,
@@ -41,7 +41,7 @@ import {
   summarizeOwnedTasks,
   superscriptDigit,
   yankCommandForCheck
-} from "./chunk-KGGOITI5.js";
+} from "./chunk-JYZUNPPO.js";
 import {
   TASK_STATUSES,
   ambientSyncPass,
@@ -6449,4 +6449,4 @@ async function runTui(db, opts) {
 export {
   runTui
 };
-//# sourceMappingURL=tui-SKZMGHA6.js.map
+//# sourceMappingURL=tui-DGDEH4JX.js.map

package/docs/VISION.md

@@ -201,6 +201,9 @@ mu agent spawn worker-1   --cli pi_mini
 mu agent spawn reviewer-1 --cli pi_big
 ```
 
+The skill's [model tiers](../skills/mu/recipes/models.md) are advice to
+the agent choosing; mu reads none of it.
+
 ## What it enables
 
 - **Visible crews.** Spawn agents once and send them work all day. Each

package/docs/guide/delegate.md

@@ -22,7 +22,7 @@ Delegates called in one turn run in parallel.
 | `timeout` | Seconds to wait for the answer (default 3600). After it, the answer does not come back; the follow-up gives the `mu agent wait` command. |
 | `workspace` | Own VCS checkout, for delegates that edit files. The follow-up names its path. It isolates repository edits only. |
 | `cli` | Key for `$MU_<CLI>_COMMAND` (default `pi`). Only keys set in pi's environment exist. |
-| `model` | pi `--model` value, appended to the cli's command (`sonnet`, `openai/gpt-5:high`). Varies models across a panel. tmux only: herdr refuses a command override. |
+| `model` | pi `--model` value, appended to the cli's command (`sonnet`, `<provider>/<model>:high`, copied from `pi --list-models`). Varies models across a panel. tmux only: herdr refuses a command override. |
 | `keep` | Keep the pane after it finishes, to talk to it again. |
 | `record` | `{ task, workstream? }` (or `task: "<ws>/<task>"`): write the answer's verdict onto that task as a note. See [Record a verdict](#record-a-verdict). |
 
@@ -30,7 +30,9 @@ Delegates called in one turn run in parallel.
 - Stop: `mu_delegate_cancel`, or `mu agent abort <name> -w scratch`.
 - The pane closes after a clean finish; died or timed-out panes stay
   as evidence.
-- pi's footer shows how many delegates this session is waiting on.
+- pi's footer shows how many delegates this session is waiting on, and
+  `N results pending` for delegates that finished but whose answer has
+  not reached the conversation yet (queued behind the running turn).
 - Each delegate costs a pane and a pi process. A session runs at most
   `MU_DELEGATE_MAX` at once (default 16). Further calls are queued, up
   to four times the cap: the footer reads `16 delegates running, 4 queued`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mu-crew/mu",
-  "version": "3.10.2",
+  "version": "3.11.1",
   "description": "A persistent, observable crew of pi agents running in one tmux or herdr session per workstream, coordinated through a built-in task DAG.",
   "publishConfig": {
     "access": "public"

package/skills/mu/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: mu
 description: >-
-  Fresh-context subagents and crews in tmux/herdr panes. Check before you
+  Fresh-context delegates (mu's counterpart to hidden subagents) and crews
+  in tmux/herdr panes. Check before you
   commit: before acting on a claim, root cause, plan, fix or brief, have a
   `mu_delegate` call refute it. Also for a fresh delegate's second look at
   your own work or diff; parallel read-only research, investigation or fan-out
@@ -24,14 +25,14 @@ not in `--help` do not exist.
 Default output is a card on stdout plus a `Next:` block. Read both.
 Every verb takes `--json`: one stdout object; collections are
 `{items, count}`, except `mu agent list` (`{agents, orphans}`); `mu sql --json` is bare rows; `mu log --tail` is
-NDJSON. Errors are `{error,message,nextSteps,exitCode}` on stderr
+NDJSON; `mu log` writes print text even with `--json`. Errors are `{error,message,nextSteps,exitCode}` on stderr
 (validation errors add `usage`). **`nextSteps` survives in JSON.**
 
 ## Vocabulary
 
 - **workstream** — one **mux session** `mu-<name>` (tmux session or
   herdr workspace) and one DB partition.
-- **agent** — named worker in a pane (you may be one).
+- **agent** — named process in a pane (you may be one); a **worker** is an agent claiming tasks.
 - **mux** — tmux or herdr, one per invocation. `mu doctor` names it;
   `MU_MUX` forces it. `mu agent kick` is Linux-only on herdr.
 - **control socket (ctl)** — how mu drives a pi agent: the mu pi
@@ -44,7 +45,8 @@ NDJSON. Errors are `{error,message,nextSteps,exitCode}` on stderr
 - **claim / release** — atomic take/clear of `tasks.owner`.
 - **note** — append-only task context; survives sessions.
 - **track** — tasks connected by `block` edges (`mu task block B --by A`
-  puts B on A's track); spawn at most one agent per ready track.
+  puts B on A's track). Spawn one agent per ready task, not per track:
+  an umbrella puts all its units on one track.
 - **workspace** — per-agent VCS copy under
   `<state-dir>/workspaces/<workstream>/<agent>/`.
 
@@ -62,7 +64,7 @@ Recipe words, the same in every recipe:
 - **finding** — one reported problem, recorded as an `OPEN/triage` task.
 - **verdict** — a check's answer: `VERDICT: <id> CONFIRMED | REFUTED |
   UNVERIFIED <one line>` plus `EVIDENCE:` lines (or ACCEPT | REJECT for
-  a review gate).
+  a review gate). REFUTED on a brief means it holds a false claim: rewrite it.
 - **stop rule** — the command and condition that end a loop, written on
   the umbrella first ([loop-until-done](recipes/loop-until-done.md)).
 
@@ -76,12 +78,12 @@ or inspection.
 
 Before you act on a claim, root cause, plan, fix or brief, or to get a second
 look at your own work or diff, make a [delegate call](recipes/tasks-or-calls.md#delegate-call)
-that tries to refute it (briefs: see Orchestrator rules; many claims: [refute](recipes/refute.md)).
+that tries to refute it, on another model family ([models](recipes/models.md#checkers); briefs: see
+Orchestrator rules; many claims: [refute](recipes/refute.md)).
 
 For one-shot work inside pi, call `mu_delegate` (installed by `mu link pi`). Outside pi: spawn
-into the reserved `scratch` workstream (no task DAG, auto-created), `send --fresh --json`, then
-`mu agent wait --after-runs <its runs> --json` (`lastText`); without `--after-runs` a run that
-ends first hangs the wait. Recipes call either form a **delegate call**. A check judging a mu
+into the reserved `scratch` workstream (no task DAG, auto-created), as in
+[delegate call](recipes/tasks-or-calls.md#delegate-call). Recipes call either form a **delegate call**. A check judging a mu
 task lands its verdict there: `record: { task: "<ws>/<id>" }` on `mu_delegate`, a hand-written
 `REFUTER` note on the spawn path; with no task, skip both.
 
@@ -102,8 +104,10 @@ wrapper whose argv0 is not `pi`/`pi-meta` it shows `needs_input`): add
 ### Workstreams, DAGs, tracks
 
 The DAG has one edge: `mu task block A --by B` means **B blocks A**.
-Tracks sharing a prerequisite collapse into one, so two agents never
-take the same dependency.
+Tracks sharing a prerequisite collapse into one, so an umbrella every
+unit blocks makes the whole job one track. Parallelism is the ready
+set: tasks that edit the same files get a `block` edge between them,
+so only one is ready at a time.
 
 ### Workspaces prevent trampling
 
@@ -112,9 +116,9 @@ repo, spawn with `--workspace`. Two builds in one checkout corrupt each
 other; keep the main checkout for orchestration.
 
 Workspaces auto-detect jj, sl, or git (else `cp -a`). `mu agent close`
-frees one **only if clean** (no uncommitted changes, no commits since
-fork); otherwise it fails with `WorkspacePreservedError`. Then use
-`mu workspace free <agent>` or `--discard-workspace` (lossy).
+frees one **only if clean**; otherwise it fails with
+`WorkspacePreservedError`. A `cp -a` copy is never clean. Cherry-pick what
+to keep, and pass `--discard-workspace` only to throw the rest away.
 Before each `--fresh` send, `mu workspace refresh <agent>` rebases onto
 main and keeps LLM context ([waves](recipes/waves.md) when workers share
 files). Claim and send warn at ≥10 commits behind
@@ -190,7 +194,7 @@ rules hold even when you skip it:
 - **Send, don't note, a running worker**: it never sees new notes. The note is the durable copy
   ([how to send](recipes/orchestrator-loop.md#sending)).
 - **Refute a brief claiming a cause, fix, threshold or code fact** before dispatch:
-  one `record`ed refuter call; rewrite on AMEND. Others get a `REFUTE-EXEMPT: <why>` note.
+  one `record`ed refuter call; rewrite on REFUTED. Others get a `REFUTE-EXEMPT: <why>` note.
 - **Checks are calls, not tasks.** Refuters, claim checkers, judges and
   skeptics are [delegate calls](recipes/tasks-or-calls.md#delegate-call)
   (`mu_delegate`, or a `scratch` spawn without it), all issued in one
@@ -205,13 +209,9 @@ rules hold even when you skip it:
 
 ## CLI gotchas
 
-- **`task close --if-ready`** no-ops until every blocker is CLOSED; bare
-  `task release` reopens IN_PROGRESS.
 - **`task close --as rejected|wontfix --why ...`** unblocks dependents
   (listed in the output). `rejected` = the claim is false; `wontfix` =
-  true, not worth doing. To keep dependents waiting, `task park --why` instead: parked
-  leaves `next`, and `claim` refuses it without `--force`. Park refuses
-  IN_PROGRESS — `task release` first.
+  true, not worth doing. To keep dependents waiting, `task park --why` instead.
 - **For waits use `task wait`, not `log --tail`.** `mu log --kind <k>`
   entries are your own durable state (a ledger); `--intent` filters what
   mu recorded.
@@ -225,23 +225,14 @@ rules hold even when you skip it:
 
 ## Models and thinking effort
 
-mu doesn't reason about models; pi does. Controls:
+mu passes the model through; you pick it. Before you choose one for a
+spawn or a delegate call, read [recipes/models.md](recipes/models.md):
+tiers, which roles need which, and local models as a last resort.
 
-```bash
-mu agent spawn r --command "pi --model opus:high"
-export MU_PI_COMMAND="pi --model sonnet:medium"
-mu agent spawn a --cli pi_big   # uses $MU_PI_BIG_COMMAND
-```
-
-`pi_mini` scouts and finds, `pi` builds and refactors, `pi_big` designs and
-handles incidents. A reviewer, refuter,
-judge or auditor checks level or up, never down: at least the worker's
-capability, from another family if one exists (provider or model-id prefix in
-`pi --list-models`). Small-model signs: a local runtime (ollama, lmstudio,
-llama.cpp), a size (`4b`, `27b`), mini/haiku/flash/nano/lite, thinking `no`,
-context or max-out far below the worker's. No such peer: same model, fresh
-context, higher thinking unless at max. Probe an unused model first
-(`pi --model <provider/model> -p "say ok"`); `ctl: ok` does not test it.
+- `mu_delegate` takes `model`; a spawn takes `--command "pi --model <id>"`.
+- A checker (reviewer, refuter, judge, auditor) runs at the author's tier
+  or higher, from another family when one exists. A delegate with no
+  `model` runs the cli's default model; pass `model` when it matters.
 
 ## Reaper and agent state
 
@@ -264,7 +255,7 @@ Close the task as your last action, or the orchestrator's wait hangs.
 ## Guardrails
 
 Task ownership outranks agent state. Coordinate through task notes and
-the activity log. Keep edges within one workstream. Give workers
+the ops log (`mu log`). Keep edges within one workstream. Give workers
 bounded paths and commands.
 
 ## Recipes
@@ -287,6 +278,7 @@ risky job that needs several of them, start with
 | [drift-audit](recipes/drift-audit.md) | hours into a long run, after a batch, compaction or resume, before a stop rule |
 | [watcher](recipes/watcher.md) | a helper polls a PR, CI, or log for change |
 | [findings](recipes/findings.md) | any review, audit, or check reports problems: where they live, how they are triaged |
+| [models](recipes/models.md) | you pick a model for a spawn or delegate call |
 | [tasks-or-calls](recipes/tasks-or-calls.md) | a recipe step spawns an agent: DAG task or delegate call |
 | [adversarial-review](recipes/adversarial-review.md) | gate each unit you dispatch before it merges (a review task per unit) |
 | [fan-out](recipes/fan-out.md) | a sweep or migration: the same change over many files or call sites |

package/skills/mu/recipes/adversarial-review.md

@@ -1,13 +1,15 @@
 # Adversarial review
 
 Use when a unit of work must be checked by someone other than its
-author before it counts: a fix, a finding, a claim, a plan. The author
+author before it counts: a unit that produces commits (a fix, a feature).
+Checking a finding or claim is a delegate call
+([findings § Triage](findings.md#triage), [refute](refute.md)). The author
 grades its own work generously; a fresh agent told to refute it does
 not. Every other review-shaped recipe builds on this one.
 
 The review is a task in the DAG, not a step inside the worker's
-session. Its verdict, its evidence, and every gap it finds stay in the
-DB: each gap is a finding task ([findings](findings.md)). For a one-off
+session. Its verdict, its evidence, and every finding it makes stay in the
+DB: each is a finding task ([findings](findings.md)). For a one-off
 check outside any workstream, one
 [delegate call](tasks-or-calls.md#delegate-call) is enough; to review a
 PR or diff from several angles, use [review-panel](review-panel.md).
@@ -22,27 +24,29 @@ PR or diff from several angles, use [review-panel](review-panel.md).
 
    ```bash
    mu task add review_x -w <ws> -t "Review x" -i 50 -e 0.5 --blocked-by x \
-     --note 'ACCEPTANCE: see x notes. Refute; report gaps, not style.'
+     --note 'ACCEPTANCE: see x notes. Refute; report findings, not style.'
    ```
 
 3. **Dispatch the work** as usual. When `x` closes, `review_x` becomes
    ready.
 4. **Spawn a fresh reviewer.** A new agent, or `--fresh` on an idle one,
-   so it has none of the author's reasoning, on a model chosen per
-   [Models](../SKILL.md#models-and-thinking-effort). Give it the worker's workspace path
+   so it has none of the author's reasoning, at the worker's tier or
+   higher and from another family ([models](models.md#checkers)). Give it the worker's workspace path
    and commits read-only by instruction; it edits nothing.
 5. **Claim `review_x` for the reviewer**, send the brief (below), wait.
 6. **Act on the verdict:**
    The review's state is the verdict: `CLOSED/done` for ACCEPT,
    `CLOSED/rejected` for REJECT.
    - `ACCEPT`: cherry-pick `x`'s commits and verify the merge.
-   - `REJECT`: the reviewer recorded each gap as an `OPEN/triage` task.
-     Add `review_x_2` and block it on every gap
-     (`mu task block review_x_2 --by <gap>`); work downstream of `x`
-     waits on `review_x_2`, not on the rejected review. Decide each gap
-     as a finding ([findings § Triage](findings.md#triage)), then
-     dispatch the accepted gaps to the original worker, whose context
-     still holds the work. Repeat from step 4 when the gaps are closed.
+   - `REJECT`: the reviewer recorded each finding as an `OPEN/triage` task.
+     Add `review_x_2` and block it on every finding
+     (`mu task block review_x_2 --by <finding>`). Closing `review_x`
+     `--as rejected` unblocked its dependents, so re-block each task
+     downstream of `x` on `review_x_2`
+     (`mu task block <downstream> --by review_x_2`). Decide each
+     finding ([findings § Triage](findings.md#triage)), then
+     dispatch the accepted ones to the original worker, whose context
+     still holds the work. Repeat from step 4 when the findings are closed.
      The DAG grows; nothing is rewritten.
 7. **Cap the rounds.** After two rejections on the same unit, stop the
    loop and decide yourself: split the unit, change the criteria, or
@@ -60,24 +64,25 @@ You are reviewing task <x>. You did not write it. Your job is to find
 where it fails the acceptance criteria in `mu task notes <x>`.
 
 - Read the diff (<range>) and the criteria. Run the tests that cover it.
-- Report gaps against the criteria: a requirement not met, an edge case
+- Report findings against the criteria: a requirement not met, an edge case
   without a test, a change outside scope, a claim the evidence does not
   support. Not style, not preferences.
-- Record each gap as a finding, per findings.md § Record:
-  mu task add -w <ws> --triage -t "<severity>: <gap>" -i <n> -e <days> \
-    --note 'FINDING: <severity> <file:line> <gap> EVIDENCE: <command + output>'
+- Record each as a finding, per findings.md § Record:
+  mu task add -w <ws> --triage -t "<severity>: <title>" -i <n> -e <days> \
+    --note 'FINDING: <severity> <file:line> <what fails> EVIDENCE: <command + output>'
 - If you could not check something (tool failed, no access), say
   UNVERIFIED for it. Unverified is not a pass and not a fail.
-- Do not edit files.
+- Your only writes are `mu task add` (findings), the verdict note, and
+  the close; leave the workspace as you found it.
 
 Write the verdict note (FILES/COMMANDS/FINDINGS/VERIFIED), then close
 (long reasons: a heredoc variable, brief.md § Quoting):
   ACCEPT: mu task close review_<x> --evidence "<key command>: <result>"
   REJECT: mu task close review_<x> --as rejected \
-            --why "<n> gaps: <id> (<why it fails, one clause>), ..."
+            --why "<n> findings: <id> (<why it fails, one clause>), ..."
 ```
 
-mu adds each named gap's title to the REJECTED note.
+mu adds each named finding's title to the REJECTED note.
 
 **Closing a review yourself** (you fixed a finding, or accept without a
 fresh reviewer): write the reviewer's note plus `COMMIT: <sha> fixes
@@ -93,7 +98,7 @@ by orchestrator`.
   reviewer ran. A review with no evidence is a
   rejected review: re-send it.
 - **Reviewers drift into fixing.** A reviewer that edits the code is now
-  an author nobody reviews. The fix belongs to the gap tasks.
+  an author nobody reviews. The fix belongs to the finding tasks.
 - **Review is not merge verification.** An accepted unit can still
   break once merged with moved main. Verify the merge as in
   [orchestrator-loop](orchestrator-loop.md#merging).

package/skills/mu/recipes/brief.md

@@ -77,5 +77,6 @@ mu task close <id> -w <ws> --evidence "$v"
 Chain batched adds with `&&`, then `mu task list`, so one
 quoting failure cannot half-apply the batch unseen.
 
-Done when a worker with no other context could finish the task from
-the brief and the notes it points at, and could tell when it is done.
+Done when the brief has GOAL, FILES, DONE WHEN, VERIFY and the
+final-action block, every shared fact is a `Read:` pointer, and the task
+holds a refuter verdict or a `REFUTE-EXEMPT:` note.

package/skills/mu/recipes/codemode-driver.md

@@ -44,7 +44,7 @@ return wait.output;
 
 Size the worker list from the ceiling on the umbrella
 ([orchestrator-loop § Concurrency](orchestrator-loop.md#concurrency)),
-one per ready track. Merge and verify outside the script
+one per ready task. Merge and verify outside the script
 ([orchestrator-loop § Merging](orchestrator-loop.md#merging)). Check
 field names against `--json` output; the script is a shape, not an API.
 
@@ -54,8 +54,8 @@ field names against `--json` output; the script is a shape, not an API.
 answers arrive after the script, as follow-up messages: the script
 gains nothing over issuing the calls in one turn. Use it from a script
 only when `codemode.mode` is `only` and the tool is not offered
-directly. Check `Promise.allSettled` results for rejections: past the
-cap, `mu_delegate` refuses.
+directly. Check `Promise.allSettled` results for rejections; the cap is in
+[orchestrator-loop § Concurrency](orchestrator-loop.md#concurrency).
 
 To get the verdicts back as one table instead of one message each, use
 the `scratch` form through `tools.bash`:
@@ -63,8 +63,9 @@ the `scratch` form through `tools.bash`:
 ```js
 // @options: {"timeout_ms": 1800000}
 const ws = "audit";
-const findings = ["f_auth_put", "f_sql_order"]; // finding task ids, at most the cap per script
+const findings = ["f_auth_put", "f_sql_order"]; // finding task ids, within the cap
 const sh = async (c) => (await tools.bash({ command: c })).output;
+const dir = `${(await sh("echo $HOME")).trim()}/.local/state/mu`;
 const json = (s) => { try { return JSON.parse(s); } catch { return {}; } };
 const el = (ms) => { const t = Math.round(ms / 1000); return t < 60 ? `${t}s` : `${Math.floor(t / 60)}m ${String(t % 60).padStart(2, "0")}s`; };
 const rows = await Promise.all(findings.map(async (id, i) => {
@@ -77,7 +78,8 @@ const rows = await Promise.all(findings.map(async (id, i) => {
   const note = w.outcome !== "done" ? `REFUTER ${i + 1}: no verdict (${w.outcome ?? "no result"})`
     : `REFUTER ${i + 1} (${a}, ${el(Date.now() - t0)}):\n` + (at < 0 ? `NO VERDICT LINE: ${(w.lastText ?? "").slice(-1500)}`
     : [lines[at], ...lines.slice(at + 1).filter((l) => /^[\s>*_`-]*EVIDENCE:/.test(l))].join("\n"));
-  await sh(`mu task note ${id} -w ${ws} - <<'MU_EOF'\n${note}\nMU_EOF`);
+  await tools.write({ path: `${dir}/note-${a}.txt`, content: note }); // answer text never touches a shell
+  await sh(`mu task note ${id} -w ${ws} - < ${dir}/note-${a}.txt && rm ${dir}/note-${a}.txt`);
   if (w.outcome === "done") await sh(`mu agent close ${a} -w scratch`);
   return `${id}\t${note.split("\n")[1] ?? note}`;
 }));
@@ -87,7 +89,8 @@ return rows.join("\n");
 What the tool did for you, the script now owns:
 
 - **The cap.** `MU_DELEGATE_MAX` does not apply to bash spawns: keep
-  each script's list at or under it.
+  each script's list within
+  [orchestrator-loop § Concurrency](orchestrator-loop.md#concurrency).
 - **Cleanup.** Close each scratch pane; a timed-out one stays, readable
   with `mu agent read <a> -w scratch`.
 - **Recording.** The script writes each `REFUTER` note in `record`'s

package/skills/mu/recipes/deep-research.md

@@ -31,7 +31,8 @@ answer rests on is an `OPEN/triage` task, decided like a finding
    ```
 
    A claim without a source and a quote is not a claim. Searchers can
-   run on a cheap model.
+   run cheap (hosted, not local: [models](models.md#local-models-are-a-last-resort));
+   the checkers in step 4 run mid or higher.
 3. **Dedupe claims**: merge the same fact from several sources (keep
    every source), and flag claims that contradict each other. In
    workstream mode, each surviving claim becomes an `OPEN/triage` task

package/skills/mu/recipes/drift-audit.md

@@ -35,13 +35,14 @@ or close you compare against is often older than it.
    IN_PROGRESS note, and each merged fix its task's findings depend on:
    git merge-base --is-ancestor <fix> <pinned>. Exit 1 = pin is stale.
 3. Closed-task notes: notes added after the task's last task.close op,
-   minus the `CLOSE:` or `<SUBSTATE>:` note the close verb itself writes
-   as the very next op (seq + 1); any other note counts, whatever its
-   prefix. Report each of the top 5 by count as its own finding with its count,
+   minus those the close verb writes in its own transaction
+   (`--evidence`, `--why`: timestamp within 50ms of the close op); any
+   other note counts, whatever its prefix. Report each of the top 5 by
+   count as its own finding with its count,
    even when the notes look routine. A late note that reports the
    closed bug again usually ran on a build without the closing fix:
    check its sha with git merge-base --is-ancestor <fix> <sha>.
-   mu sql "select t.local_id name, count(*) late from tasks t join workstreams w on w.id=t.workstream_id join task_notes n on n.task_id=t.id join (select key, max(seq) seq, max(created_at) at from ops where intent='task.close' and entity='task' group by key) c on c.key='<ws>/'||t.local_id where w.name='<ws>' and t.status='CLOSED' and n.created_at > c.at and not exists (select 1 from ops x where x.seq=c.seq+1 and x.entity='note' and x.key=c.key||'#'||n.id and (n.content like 'CLOSE: %' or n.content like upper(t.substate)||': %')) group by t.local_id order by late desc"
+   mu sql "select t.local_id name, count(*) late from tasks t join workstreams w on w.id=t.workstream_id join task_notes n on n.task_id=t.id join (select key, max(created_at) at from ops where intent='task.close' and entity='task' group by key) c on c.key='<ws>/'||t.local_id where w.name='<ws>' and t.status='CLOSED' and (julianday(n.created_at)-julianday(c.at))*86400 > 0.05 group by t.local_id order by late desc"
 4. Thin decisions: an ACCEPT/REJECTED/CLOSE/SUPERSEDED note under 40
    chars; a refuter tally with no REFUTER or VERDICT note; a review the
    orchestrator closed with no FILES/COMMANDS note and no commit.

package/skills/mu/recipes/fan-out.md

@@ -9,7 +9,9 @@ some and calls the job done; one task per unit cannot.
 1. **Enumerate first.** A scout (a [delegate call](tasks-or-calls.md#delegate-call)) lists the units and
    writes them to the umbrella's note, one per line. The list is done
    when it matches a command the scout ran (`rg -l`, a test listing),
-   not when it looks complete. Record the command and the count.
+   not when it looks complete. Record the command and the count. The
+   scout runs cheap; the units run mid, or strong when each is a
+   judgement call ([models](models.md#roles)).
 2. **One task per unit**, blocked into an umbrella:
 
    ```bash
@@ -23,13 +25,13 @@ some and calls the job done; one task per unit cannot.
    only checks (no commits) makes each unit a delegate call instead
    ([tasks-or-calls](tasks-or-calls.md)).
 3. **Cap concurrency** ([orchestrator-loop § Concurrency](orchestrator-loop.md#concurrency)).
-   Spawn at most one agent per ready track. Tell workers to avoid
+   One agent per ready unit, up to the ceiling. Tell workers to avoid
    repo-wide commands so more can run.
 4. **Pipeline.** Dispatch, wait `--first`, merge
    ([orchestrator-loop § Merging](orchestrator-loop.md#merging)), dispatch
    the next unit to the freed worker with `--fresh`. With `codemode`, a
    [driver](codemode-driver.md) can dispatch each batch. Units that touch the same files
-   go on one track (see [waves](waves.md)).
+   are chained with `block` (see [waves](waves.md)).
 5. **Review per unit** when a wrong unit is costly: add a review task
    per unit ([adversarial-review](adversarial-review.md)).
 6. **Synthesize** when the output is a report, not commits: one

package/skills/mu/recipes/findings.md

@@ -94,8 +94,10 @@ across reviewers and creates one task per real problem.
    | could not check | stays in triage, with an `UNVERIFIED: <why>` note | |
 
 4. **Group** accepted findings that touch the same files into one fix
-   task when separate workers would collide; close the grouped findings
-   `--as superseded --why "fixed in <fix-task>"`.
+   task when separate workers would collide. Block the umbrella on the
+   fix task (`mu task block <umbrella> --by <fix-task>`), then close the
+   grouped findings `--as superseded --why "fixed in <fix-task>"`:
+   superseding unblocks the umbrella.
 
 Done when `mu task list --substate triage -w <ws>` lists only findings
 with an `UNVERIFIED` note, and each of those is reported to the human.
@@ -105,7 +107,9 @@ with an `UNVERIFIED` note, and each of those is reported to the human.
 Accepted findings are ordinary tasks: dispatch them, review the fix
 ([adversarial-review](adversarial-review.md)), merge. The umbrella
 closes with `mu task close <umbrella> --if-ready` once every finding is
-`CLOSED/*`. A plain `close` would succeed with findings still open.
+`CLOSED/*`. A plain `close` would succeed with findings still open; an
+`UNVERIFIED` finding blocks `--if-ready`, so the umbrella stays open
+until the human decides it.
 
 The report is a query, not a document: `mu task list -w <ws>
 --substate rejected`, `--substate duplicate`, `--status OPEN`, and the

package/skills/mu/recipes/hypothesis-panel.md

@@ -9,7 +9,8 @@ form independent theories; separate agents then try to kill them.
 
 1. **Write the symptom** on the umbrella: what happens, how often, the
    repro command, and what would count as fixed.
-2. **One reader per evidence source** (a [delegate call](tasks-or-calls.md#delegate-call)): logs, the
+2. **One reader per evidence source** (a [delegate call](tasks-or-calls.md#delegate-call), strong tier:
+   root cause is judgement, [models](models.md#roles)): logs, the
    code path, recent commits, data, environment. Each sees only its
    source, so the theories do not anchor on each other. Record each
    theory as an `OPEN/triage` task blocking the umbrella, decided like