trantor 0.17.49 → 0.17.50

package/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + context-handoff for independent AI coding agents (Claude, Codex, Gemini, …)",
-    "version": "0.17.49"
+    "version": "0.17.50"
   },
   "plugins": [
     {
       "name": "trantor",
       "source": "./",
       "description": "The hub-world for AI agent crews. Say \"fire up the crew\" and Claude becomes the architect: a plan-aware Advisor routes the work (solo / cheap inline calls / live crew of Codex, GLM, Kimi & DeepSeek in their own terminal windows), a Kanban/flow command center with a testing gate tracks it, and an economics brain (Scrooge) keeps the receipts. Includes the relay MCP, a SessionStart auto-discovery hook, and a PreCompact context-handoff so a fresh session can take over a full window instead of compacting.",
-      "version": "0.17.49",
+      "version": "0.17.50",
       "author": {
         "name": "Sasha Bogojevic"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.17.49",
+  "version": "0.17.50",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/README.md

@@ -42,6 +42,12 @@ claude plugin install trantor
 That's it. (Prefer source? `git clone https://github.com/sashabogi/trantor && cd trantor &&
 npm install && bash deploy/setup.sh` — identical result.)
 
+**Recommended companion (macOS):** [**cmux**](https://cmux.com) — `brew install --cask cmux` — a
+native terminal built for running multiple AI agents. Trantor groups each crew into one cmux workspace
+with live per-seat status in the sidebar and project-scoped teardown. See
+*[Grouped crews in cmux](#grouped-crews-in-cmux-recommended)*. Optional — crews also run in tmux or plain
+Terminal windows.
+
 ## What gets installed — footprint & safety
 
 Trantor is a **local-first multi-agent orchestrator with a built-in cost router** — not a cloud
@@ -135,8 +141,10 @@ project takes over with a full window (and a PreCompact hook does this automatic
    (`solo | scrooge | crew | hybrid`), a routing table with a **reason per package**, why
    that many seats ("seats follow the work, not the install list"), and a real-money estimate
    with quota-pool accounting. You say go.
-2. **Windows open.** `trantor up codex kimi deepseek:deepseek glm:zai-coding-plan` spawns one titled
-   terminal window per agent. The seats aren't a fixed list — they're **whatever you've got**:
+2. **Windows open.** `trantor up codex kimi deepseek:deepseek glm:zai-coding-plan` spawns the crew in
+   visible terminals — grouped into **one [cmux](https://cmux.com) workspace per project** when cmux is
+   installed (seats tiled, live status in the sidebar; see *[Grouped crews in cmux](#grouped-crews-in-cmux-recommended)*
+   below), else tmux, else one titled Terminal window per seat. The seats aren't a fixed list — they're **whatever you've got**:
    the native CLIs (Codex, Kimi) plus *any* provider wired through OpenCode (DeepSeek, GLM, and
    **OpenRouter's hundreds of models, or a custom endpoint you bring** — see *Bring your own
    model* below). `agent:model` pins a model; `agent:provider --difficulty hard` picks the
@@ -159,6 +167,33 @@ project takes over with a full window (and a PreCompact hook does this automatic
 6. **It learns.** Failures become lessons (`relay_lesson`), stored on the hub and **injected
    into every future crew's prompts** — global or per-CLI. Your crew gets smarter every run.
 
+### Grouped crews in cmux (recommended)
+
+Trantor runs crews in visible terminals so nothing dies or fails silently. On macOS it prefers
+**[cmux](https://cmux.com)** — a native, Ghostty-based terminal *built for managing multiple AI coding
+agents* — and falls back to **tmux**, then plain Terminal windows.
+
+With cmux, each crew becomes **one workspace tab per project**, its seats tiled inside, every pane
+labeled `<agent> · <project>`, and each seat pushes its **live state into cmux's sidebar** —
+`building` (blue) while a turn runs, `idle` when it's waiting, `error`/`down` (red) on a failed turn —
+plus a per-crew progress pill. Teardown is **project-scoped**: `trantor down` closes only *this*
+project's workspace, so when you run several sessions each driving its own crew, one session's teardown
+can't nuke another's. `trantor down <agent>` drops a single seat; `trantor down --all --yes` tears down
+every project's crew.
+
+**One-time setup:**
+- Install cmux — `brew install --cask cmux` (or grab it from **[cmux.com](https://cmux.com)**).
+- Trantor drives cmux over its control socket, which is off to outside processes by default. Enable it in
+  `~/.config/cmux/cmux.json` (cmux auto-reloads):
+  ```json
+  { "automation": { "socketControlMode": "allowAll" } }
+  ```
+  This lets local processes drive your terminals. Leave it on the default `cmuxOnly` and Trantor
+  automatically falls back to AppleScript (same grouped layout, minus the native sidebar status).
+- The `cmux` CLI is symlinked onto your PATH on your first `trantor up`.
+
+No cmux or tmux? Crews still work — one titled Terminal window per seat, still project-scoped teardown.
+
 ## The dashboard — `trantor ui`
 
 A live command center at `http://127.0.0.1:4477`, grouped by **project** — and a *durable,

package/bin/cli.mjs

@@ -23,7 +23,7 @@ switch (cmd) {
   case "advise":  run("bin/advise.mjs"); break;
   case "verify":  run("bin/crew-verify.mjs"); break;
   case "up":      process.argv.splice(2, 1); spawn("/bin/bash", [join(ROOT, "bin/crew.sh"), "up", ...args], { stdio: "inherit", cwd: process.cwd() }).on("exit", c => process.exit(c ?? 0)); break;
-  case "down":    spawn("/bin/bash", [join(ROOT, "bin/crew.sh"), "down"], { stdio: "inherit", cwd: process.cwd() }).on("exit", c => process.exit(c ?? 0)); break;
+  case "down":    spawn("/bin/bash", [join(ROOT, "bin/crew.sh"), "down", ...args], { stdio: "inherit", cwd: process.cwd() }).on("exit", c => process.exit(c ?? 0)); break;
   case "swap":    spawn("/bin/bash", [join(ROOT, "bin/crew.sh"), "swap", ...args], { stdio: "inherit", cwd: process.cwd() }).on("exit", c => process.exit(c ?? 0)); break;
   case "hub":     run("hub.mjs"); break;
   case "watch":   run("bin/relay-watch.mjs"); break;
@@ -31,6 +31,7 @@ switch (cmd) {
   case "agents":  run("bin/agents.mjs"); break;
   case "gates":   run("bin/gates.mjs"); break;
   case "backfill": run("bin/git-backfill.mjs"); break;
+  case "sweep": run("bin/sweep.mjs"); break;
   case "init-hooks": run("bin/init-hooks.mjs"); break;
   case "balances": case "balance": case "credits": run("bin/balances.mjs"); break;
   case "recost": run("bin/recost.mjs"); break;

package/bin/crew-runner.mjs

@@ -50,6 +50,22 @@ async function api(path, body) {
   return r.json();
 }
 
+// ---- cmux sidebar integration ----
+// When this runner is inside a cmux surface (CMUX_SURFACE_ID is auto-set there), push its live state into
+// cmux's sidebar for THIS seat. An inside process is allowed by cmux's default cmuxOnly socket mode — no
+// allowAll needed. Fail-silent + short timeout; must never block or slow a turn.
+const CMUX_BIN = process.env.CMUX_BIN
+  || (existsSync("/Applications/cmux.app/Contents/Resources/bin/cmux") ? "/Applications/cmux.app/Contents/Resources/bin/cmux" : "cmux");
+const inCmux = () => !!process.env.CMUX_SURFACE_ID;
+function cmuxStatus(value, color, icon = "robot") {
+  if (!inCmux()) return;
+  try { spawnSync(CMUX_BIN, ["set-status", "trantor", value, "--color", color, "--icon", icon], { stdio: "ignore", timeout: 1500, env: { ...process.env, CMUX_QUIET: "1" } }); } catch {}
+}
+function cmuxLog(message, level = "info") {
+  if (!inCmux()) return;
+  try { spawnSync(CMUX_BIN, ["log", String(message).slice(0, 200), "--level", level], { stdio: "ignore", timeout: 1500, env: { ...process.env, CMUX_QUIET: "1" } }); } catch {}
+}
+
 // ---- per-CLI invocation (first turn vs resume turn). {P} = prompt file path ----
 // CREW_MODEL env pins the model: each CLI gets its own flag via {M} (empty when unset).
 let MODEL = process.env.CREW_MODEL || "";
@@ -119,6 +135,7 @@ async function reportFailure(exit, trigger) {
     ? `🛑 ${SESSION} DOWN — ${consecFails} consecutive failures (${reason}, exit ${exit})${hint}`
     : `⚠️ ${SESSION} turn FAILED (${trigger}, exit ${exit} · ${reason})${hint}`;
   await api("/send", { from: SESSION, to: "all", text, project: PROJ }).catch(() => {});
+  cmuxStatus(down ? "down" : "error", "#ef6a6a", "alert"); cmuxLog(`turn failed: ${reason} (exit ${exit})`, "error");
   log(`\x1b[31mreported failure to bus: ${reason} (exit ${exit})\x1b[0m`);
 }
 
@@ -127,6 +144,7 @@ async function reportHealthy() {
   consecFails = 0;
   await api("/register", { session: SESSION, project: PROJ, status: `active in ${PROJ}` }).catch(() => {});
   await api("/send", { from: SESSION, to: "all", text: `✅ ${SESSION} recovered`, project: PROJ }).catch(() => {});
+  cmuxStatus("ok", "#14b8a6", "check");
 }
 
 let sid = "";
@@ -142,6 +160,7 @@ function runTurn(prompt, isFirst, trigger = "kickoff") {
   const envs = [join(homedir(), ".agent-bus", ".env"), cli.env].filter(f => f && existsSync(f));
   for (const f of envs.reverse()) cmd = `set -a; source ${f}; set +a; ${cmd}`;   // ~/.agent-bus/.env wins
   log(`turn starting (${isFirst ? "fresh session" : "resume"})${MODEL ? ` · model=${MODEL}` : ""}`);
+  cmuxStatus("building", "#4a90d9", "hammer");
   // inherit stdio so the window shows the agent working live; also capture for sid-parsing.
   // Tee stderr to ERRF (still shown live in the window) so a failed turn can be classified.
   try { appendFileSync(ERRF, "", { flag: "w" }); } catch {}
@@ -155,6 +174,7 @@ function runTurn(prompt, isFirst, trigger = "kickoff") {
   if (cli.sid && r.stdout) { const m = r.stdout.match(cli.sid); if (m) sid = m[1]; }
   telemetry({ ts: Date.now(), agent: AGENT, project: PROJ, turn: TURN, trigger, model: MODEL || "default", duration_ms: Date.now() - t0, exit: r.status });
   log(`turn ended (exit ${r.status}, ${((Date.now() - t0) / 1000).toFixed(0)}s)`);
+  if (r.status === 0) cmuxStatus("idle", "#8a94a6", "robot");   // finished this turn, waiting for the next
   return r.status;
 }
 

package/bin/crew.sh

@@ -1,60 +1,234 @@
 #!/bin/bash
-# trantor crew launcher v2 — visible terminal windows that CANNOT silently die or silently fail.
+# trantor crew launcher v3 — visible, GROUPED, per-project crews that can't silently die and that ONE
+# session's teardown can't nuke out from under ANOTHER session's crew.
 #
-#   bin/crew.sh up codex gemini kimi deepseek    # one window per agent, in the CURRENT project dir
-#   bin/crew.sh down                             # kill crew processes + close windows (no dialogs)
+#   bin/crew.sh up codex glm kimi deepseek   # bring up THIS project's crew (tmux panes, or Terminal windows)
+#   bin/crew.sh down                          # tear down ONLY THIS PROJECT's crew (scoped, prints what it kills)
+#   bin/crew.sh down codex                    # tear down ONE seat
+#   bin/crew.sh down --all --yes              # tear down EVERY project's crew (global; --yes required)
+#   bin/crew.sh swap <oldAgent> <newSpec>     # replace one seat with a live-selected model
 #
-# Each window runs bin/crew-runner.mjs: the CLI does one turn and exits; the RUNNER long-polls
-# the bus (free, doubles as heartbeat) and resumes the CLI — with full context — whenever a
-# message arrives. No model-side parking, no harness fights, no token burn while idle.
+# WHY v3: v2 tracked windows in ONE global ~/.agent-bus/crew-windows.txt as bare `AGENT<TAB>WID` rows — no
+# project — so `down` from any session killed EVERY crew on the machine, mid-flight. And N free-floating
+# Terminal windows (2x2, then half-screen at 5+) were impossible to tell apart when several sessions each ran
+# a crew. v3 fixes both: STATE rows are `PROJECT<TAB>KIND<TAB>AGENT<TAB>HANDLE`, teardown is PROJECT-SCOPED,
+# and the crew launches as ONE tmux session `trantor:<project>` (named panes you see at once) — or, if tmux
+# isn't installed, the legacy per-agent Terminal grid with the window titled `<PROJECT> · <AGENT>`.
 #
-# Spawns are SERIALIZED and then VERIFIED on the bus (crew-verify.mjs); failures retry once and
-# are reported loudly — the orchestrator never gets a green lie.
+# Each pane/window runs bin/crew-runner.mjs: the CLI does one turn and exits; the RUNNER long-polls the bus
+# (free, doubles as heartbeat) and resumes the CLI — with full context — whenever a message arrives.
 #
-# Geometry: "crewRect": "X,Y,W,H" in ~/.agent-bus/config.json (or CREW_RECT env) — set once per
-# machine; used for every spawn including respawns. Default: right half of the main display.
+# CREW_DRY_RUN=1 prints every spawn/kill instead of doing it (used by test-crew.sh to prove teardown scoping).
 set -u
 CMD="${1:-up}"; shift 2>/dev/null || true
 DIR="$(pwd)"
-# Canonical project key: the orchestrator's RELAY_PROJECT wins, else the GIT REPO ROOT
-# basename (stable across subdirs), else the cwd basename. The crew inherits this exact
-# key so one repo = one lane (no host "builtbetter.ai" vs crew "builtbetter" split).
+# Canonical project key: the orchestrator's RELAY_PROJECT wins, else the GIT REPO ROOT basename (stable
+# across subdirs), else the cwd basename. The crew inherits this exact key so one repo = one lane.
 PROJ="${RELAY_PROJECT:-$(basename "$(git -C "$DIR" rev-parse --show-toplevel 2>/dev/null || echo "$DIR")")}"
 BUS_DIR="$(cd "$(dirname "$0")/.." && pwd)"
 STATE="$HOME/.agent-bus/crew-windows.txt"
 mkdir -p "$HOME/.agent-bus"
+TMUX_SESS="trantor:$PROJ"                                  # one tmux session per project
+HAVE_TMUX=0; command -v tmux >/dev/null 2>&1 && HAVE_TMUX=1
+# cmux (https://cmux — a Ghostty-based multiplexer) is the PREFERRED grouping when installed: one workspace
+# TAB per project, seats tiled inside it, scoped teardown via `close tab`. Driven by AppleScript (Apple
+# Events) — NOT the control socket — so it needs NO socket password (the socket denies external processes
+# by default; AppleScript bypasses that, exactly like we already script Terminal.app).
+HAVE_CMUX=0; [ -d "/Applications/cmux.app" ] && HAVE_CMUX=1
+# explicit override (user preference or tests): CREW_MUX=cmux|tmux|terminal forces the grouping UI.
+case "${CREW_MUX:-}" in
+  cmux)     HAVE_CMUX=1; HAVE_TMUX=0 ;;
+  tmux)     HAVE_CMUX=0; HAVE_TMUX=1 ;;
+  terminal) HAVE_CMUX=0; HAVE_TMUX=0 ;;
+esac
+SEATDIR="$HOME/.agent-bus/seats"; mkdir -p "$SEATDIR"
+DRY="${CREW_DRY_RUN:-0}"
+run() { if [ "$DRY" = "1" ]; then echo "[dry] $*"; else eval "$*"; fi; }
 
+# ── STATE helpers ──────────────────────────────────────────────────────────────────────────────────
+# Row schema (TSV): PROJECT <TAB> KIND <TAB> AGENT <TAB> HANDLE
+#   KIND=win    HANDLE=Terminal window id           (one row per agent)
+#   KIND=tmux   HANDLE=tmux pane id (e.g. %3)        (one row per agent; session = trantor:PROJECT)
+#   KIND=attach HANDLE=Terminal window id            (the single window attached to the tmux session)
+# Legacy v2 rows are bare `AGENT <TAB> WID` (2 fields, NO project) — read as PROJECT="" KIND=win.
+record_state() { [ "$DRY" = "1" ] && return 0; printf '%s\t%s\t%s\t%s\n' "$1" "$2" "$3" "$4" >> "$STATE"; }
+
+# parse a STATE line into globals RP/RK/RA/RH (PROJECT/KIND/AGENT/HANDLE), handling legacy 2-field rows.
+# We split the RAW line by field COUNT rather than round-tripping through a rebuilt string: tab is IFS
+# whitespace, so `read` COLLAPSES a leading empty field — a rebuilt "<TAB>win<TAB>…" would mis-parse an
+# empty PROJECT as KIND. New rows always carry a non-empty PROJECT (4 fields); only legacy rows are 2 fields.
+_parse_row() { # $1 = line
+  local -a f; IFS=$'\t' read -r -a f <<< "$1"
+  if [ "${#f[@]}" -ge 4 ]; then RP="${f[0]}"; RK="${f[1]}"; RA="${f[2]}"; RH="${f[3]}"
+  elif [ "${#f[@]}" -eq 2 ]; then RP=""; RK="win"; RA="${f[0]}"; RH="${f[1]}"      # legacy AGENT<TAB>WID
+  else RP=""; RK="win"; RA="${f[0]:-}"; RH="${f[1]:-}"; fi
+}
+
+# close a Terminal window + SIGKILL everything on its tty (TUIs trap SIGTERM; a live login makes Terminal
+# raise the "Terminate running processes?" dialog on close).
+_kill_win() { # $1 = window id
+  local wid="$1" tty pid
+  [ -n "$wid" ] || return 0
+  tty=$(osascript -e "tell application \"Terminal\" to get tty of (first window whose id is $wid)" 2>/dev/null)
+  if [ -n "$tty" ]; then for pid in $(ps -t "${tty#/dev/}" -o pid= 2>/dev/null); do run "kill -9 $pid 2>/dev/null"; done; fi
+  run "osascript -e 'tell application \"Terminal\" to close (first window whose id is $wid)' 2>/dev/null"
+}
+
+# ── cmux helpers ─────────────────────────────────────────────────────────────────────────────────
+# The cmux CLI lives inside the app bundle; prefer it on PATH (we symlink it on `up`), else full path.
+CMUX_BIN="$(command -v cmux 2>/dev/null)"; [ -n "$CMUX_BIN" ] || CMUX_BIN="/Applications/cmux.app/Contents/Resources/bin/cmux"
+_cmux() { CMUX_QUIET=1 "$CMUX_BIN" "$@"; }            # quiet CLI wrapper (suppresses alias/notice chatter)
+_CMUX_OK=""                                          # cached: does the control socket accept us (allowAll)?
+_cmux_ok() {
+  [ -n "$_CMUX_OK" ] && { [ "$_CMUX_OK" = "1" ] && return 0 || return 1; }
+  if [ "$HAVE_CMUX" = "1" ] && _cmux ping >/dev/null 2>&1; then _CMUX_OK=1; return 0; fi
+  _CMUX_OK=0; return 1
+}
+# resolve a freshly-created workspace REF (workspace:N) → its stable UUID (survives index shifts).
+_cmux_ws_uuid() {   # $1 = ref like "workspace:3"
+  _cmux workspace list --id-format both --json 2>/dev/null | REF="$1" node -e '
+let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{try{const o=JSON.parse(d.slice(d.search(/[\[{]/)));
+const a=Array.isArray(o)?o:(o.workspaces||[]);const w=a.find(x=>x.ref===process.env.REF);process.stdout.write(w?w.id:"");}catch(e){}});'
+}
+
+# A per-seat LAUNCHER script — avoids escaping a complex command into the CLI/AppleScript, and sets the pane
+# title via OSC (cmux surface names are read-only to rename-tab, so the seat labels itself `<AGENT> · <PROJ>`).
+_seat_launcher() {   # $1=agent  $2=full runner command → echoes the launcher path
+  local f="$SEATDIR/${PROJ}-$1.sh"
+  { printf '#!/bin/bash\n'; printf 'printf "\\033]0;%%s\\007" %q\n' "$1 · $PROJ"; printf '%s\n' "$2"; } > "$f"
+  printf '%s' "$f"
+}
+# Teardown prefers the control socket (close-workspace/close-surface by UUID); falls back to AppleScript
+# (Apple Events, no allowAll needed) — object UUIDs are the same in both worlds.
+_cmux_close_tab() {   # $1 = workspace uuid → close the whole project workspace (all its seats)
+  [ "$DRY" = "1" ] && { echo "[dry] cmux close-workspace $1"; return 0; }
+  if _cmux_ok; then _cmux close-workspace --workspace "$1" >/dev/null 2>&1 && return 0; fi
+  osascript 2>/dev/null <<OSA
+tell application "cmux"
+  repeat with w in windows
+    repeat with tt in tabs of w
+      if (id of tt) is "$1" then close tab tt
+    end repeat
+  end repeat
+end tell
+OSA
+}
+_cmux_close_term() {  # $1 = surface uuid → close a single seat
+  [ "$DRY" = "1" ] && { echo "[dry] cmux close-surface $1"; return 0; }
+  if _cmux_ok; then _cmux close-surface --surface "$1" >/dev/null 2>&1 && return 0; fi
+  osascript 2>/dev/null <<OSA
+tell application "cmux"
+  repeat with tr in terminals
+    if (id of tr) is "$1" then close tr
+  end repeat
+end tell
+OSA
+}
+
+# ── down: PROJECT-SCOPED teardown (never touches another project's crew) ─────────────────────────────
+usage_down() {
+  cat <<EOF
+usage: trantor down [<agent>...] [--all] [--yes]
+  trantor down              tear down THIS project's crew ($PROJ)
+  trantor down codex glm    tear down only those seats in this project
+  trantor down --all --yes  tear down EVERY project's crew on this machine (--yes required)
+EOF
+}
 down() {
+  local WANT_ALL=0 WANT_YES=0 AGENTS=() a
+  for a in "$@"; do case "$a" in
+    --all) WANT_ALL=1 ;;
+    --yes|-y) WANT_YES=1 ;;
+    --help|-h) usage_down; return 0 ;;
+    --*) echo "trantor down: unknown flag '$a'"; usage_down; return 1 ;;
+    *) AGENTS+=("$a") ;;
+  esac; done
   [ -f "$STATE" ] || { echo "no tracked crew windows"; return 0; }
-  while IFS=$'\t' read -r a wid; do
-    [ -n "${wid:-}" ] || wid="$a"          # back-compat: old STATE stored bare window ids
-    TTY=$(osascript -e "tell application \"Terminal\" to get tty of (first window whose id is $wid)" 2>/dev/null)
-    if [ -n "$TTY" ]; then
-      # SIGKILL everything on the tty, login included — TUIs trap SIGTERM, and a live login
-      # makes Terminal raise the "Terminate running processes?" dialog on close.
-      for pid in $(ps -t "${TTY#/dev/}" -o pid= 2>/dev/null); do kill -9 "$pid" 2>/dev/null; done
+  local SCOPE_DESC; [ "$WANT_ALL" = "1" ] && SCOPE_DESC="all projects" || SCOPE_DESC="project \"$PROJ\""
+
+  # collect the rows in scope + build a human kill-list. `scoped` entries are joined with '|' (NOT a tab):
+  # tab is IFS whitespace, so re-splitting a tab-joined string would collapse an empty leading PROJECT.
+  local scoped=() line killlist="" seentmux=""
+  while IFS= read -r line; do
+    [ -n "$line" ] || continue
+    _parse_row "$line"                                       # → RP RK RA RH
+    # scope: --all → every row; else → ONLY this project's rows. Legacy (project-less, pre-v3) rows are
+    # SKIPPED by a scoped down — we can't prove they're ours, and killing another project's crew is the exact
+    # bug we're fixing. `trantor down --all` reaches them; otherwise they self-heal via prune_dead_state.
+    if [ "$WANT_ALL" != "1" ] && [ "$RP" != "$PROJ" ]; then continue; fi
+    if [ "${#AGENTS[@]}" -gt 0 ]; then                       # agent filter (if specific seats named)
+      local match=0 want; for want in "${AGENTS[@]}"; do [ "$RA" = "$want" ] && match=1; done
+      [ "$match" = "1" ] || continue
     fi
+    scoped+=("$RP|$RK|$RA|$RH")
+    case "$RK" in attach|cmuxws) continue ;; esac       # infra rows (attach window / cmux workspace) — not seats
+    killlist="$killlist  • ${RP:-<legacy>} · $RA ($RK)"$'\n'
   done < "$STATE"
-  sleep 1
-  while IFS=$'\t' read -r a wid; do
-    [ -n "${wid:-}" ] || wid="$a"
-    osascript -e "tell application \"Terminal\" to close (first window whose id is $wid)" 2>/dev/null
+
+  if [ "${#scoped[@]}" -eq 0 ]; then echo "nothing to tear down for $SCOPE_DESC"; return 0; fi
+  echo "— tearing down ($SCOPE_DESC):"; printf '%s' "$killlist"
+  if [ "$WANT_ALL" = "1" ] && [ "$WANT_YES" != "1" ]; then
+    echo "— this is EVERY project's crew. Re-run with --yes to confirm:  trantor down --all --yes"; return 0
+  fi
+
+  # execute. Per-project teardown: cmux → close the workspace tab; tmux → kill the session; Terminal → close
+  # each window. Per-seat teardown (agents named): cmux → close that terminal; tmux → kill that pane.
+  local s P2 K2 A2 H2
+  for s in "${scoped[@]}"; do
+    IFS='|' read -r P2 K2 A2 H2 <<< "$s"
+    case "$K2" in
+      cmuxws) [ "${#AGENTS[@]}" -gt 0 ] || _cmux_close_tab "$H2" ;;   # whole workspace (no specific seats)
+      cmux)   [ "${#AGENTS[@]}" -gt 0 ] && _cmux_close_term "$H2" ;;  # a single seat's pane
+      tmux)
+        if [ "${#AGENTS[@]}" -gt 0 ]; then run "tmux kill-pane -t '$H2' 2>/dev/null"      # per-seat
+        else
+          local sess="trantor:$P2"
+          case " $seentmux " in *" $sess "*) : ;; *) run "tmux kill-session -t '$sess' 2>/dev/null"; seentmux="$seentmux $sess" ;; esac
+        fi ;;
+      win|attach) { [ "${#AGENTS[@]}" -gt 0 ] && [ "$K2" = "attach" ]; } && continue; _kill_win "$H2" ;;
+    esac
+  done
+
+  # rewrite STATE minus the rows we tore down (leaves OTHER projects' rows intact)
+  if [ "$DRY" != "1" ]; then
+    local tmp="$STATE.tmp"; : > "$tmp"
+    while IFS= read -r line; do
+      [ -n "$line" ] || continue
+      _parse_row "$line"
+      local drop=0
+      for s in "${scoped[@]}"; do [ "$s" = "$RP|$RK|$RA|$RH" ] && drop=1; done
+      [ "$drop" = "1" ] || printf '%s\t%s\t%s\t%s\n' "$RP" "$RK" "$RA" "$RH" >> "$tmp"
+    done < "$STATE"
+    mv "$tmp" "$STATE"
+    [ -s "$STATE" ] || rm -f "$STATE"
+  fi
+  echo "— crew torn down ($SCOPE_DESC)"
+}
+[ "$CMD" = "down" ] && { down "$@"; exit $?; }
+case "$CMD" in up|swap) ;; *) echo "usage: crew.sh up <agent...> | crew.sh swap <old> <new[:provider[/model]]> | crew.sh down [<agent>...] [--all --yes]"; exit 1 ;; esac
+
+# self-heal: drop STATE rows whose Terminal window is already gone (dead crews from past sessions), so the
+# file doesn't accumulate ghosts across ups. tmux rows are validated by their session existing.
+prune_dead_state() {
+  [ -f "$STATE" ] || return 0
+  [ "$DRY" = "1" ] && return 0
+  local tmp="$STATE.tmp" line alive
+  : > "$tmp"
+  while IFS= read -r line; do
+    [ -n "$line" ] || continue
+    _parse_row "$line"                                       # → RP RK RA RH
+    alive=1
+    if [ "$RK" = "win" ] || [ "$RK" = "attach" ]; then
+      [ -n "$(osascript -e "tell application \"Terminal\" to get id of (first window whose id is $RH)" 2>/dev/null)" ] || alive=0
+    elif [ "$RK" = "tmux" ]; then
+      tmux has-session -t "trantor:$RP" 2>/dev/null || alive=0
+    fi
+    [ "$alive" = "1" ] && printf '%s\t%s\t%s\t%s\n' "$RP" "$RK" "$RA" "$RH" >> "$tmp"
   done < "$STATE"
-  sleep 0.5
-  osascript -e 'tell application "System Events" to tell process "Terminal"' \
-            -e 'repeat with w in windows' -e 'try' \
-            -e 'if exists sheet 1 of w then click button "Terminate" of sheet 1 of w' \
-            -e 'end try' -e 'end repeat' -e 'end tell' >/dev/null 2>&1
-  rm -f "$STATE"
-  echo "crew torn down"
+  mv "$tmp" "$STATE"; [ -s "$STATE" ] || rm -f "$STATE"
 }
-[ "$CMD" = "down" ] && { down; exit 0; }
-case "$CMD" in up|swap) ;; *) echo "usage: crew.sh up <agent...> | crew.sh swap <oldAgent> <newAgent[:provider[/model]]> | crew.sh down"; exit 1 ;; esac
 
 # --task/--difficulty drive LAZY live-model selection for provider-only specs (agent:provider).
-# An agent spec is one of: `codex` (CLI default) · `glm:zai-coding-plan` (provider only → pick the
-# best live model now) · `glm:zai-coding-plan/glm-5.2` (full pin). The agent label is the bus
-# identity; any non-native label runs via opencode (legacy `opencode:zai-coding-plan` still works).
 TASK="code"; DIFF="medium"; _ARGS=()
 while [ $# -gt 0 ]; do
   case "$1" in
@@ -64,17 +238,13 @@ while [ $# -gt 0 ]; do
   esac
 done
 if [ ${#_ARGS[@]} -gt 0 ]; then set -- "${_ARGS[@]}"; else set --; fi
-[ $# -eq 0 ] && { echo "usage: crew.sh up [--task K --difficulty D] codex gemini kimi deepseek (agent:provider picks a live model; agent:provider/model pins one)"; exit 1; }
+[ $# -eq 0 ] && { echo "usage: crew.sh up [--task K --difficulty D] codex glm kimi deepseek (agent:provider picks a live model; agent:provider/model pins one)"; exit 1; }
 
 # scrooge (the model-routing brain) is bundled with this trantor install; fall back to PATH.
 SCROOGE="$BUS_DIR/engine/bin/scrooge"
 [ -f "$SCROOGE" ] || SCROOGE="$(command -v scrooge 2>/dev/null || echo scrooge)"
 
-# resolve_model <agent> <provider> <task> <diff> -> echoes a runner-ready model id, or empty
-# (→ CLI default). PROVIDER-AGNOSTIC: if opencode knows the provider (ANY of its vendors — built-in
-# or BROUGHT), enumerate via `opencode models <provider>`; else self-enumerate via the provider's
-# OpenAI-compatible /models. No hardcoded provider list — a newly-brought opencode provider routes
-# with zero change here. Never guesses an endpoint.
+# resolve_model <agent> <provider> <task> <diff> -> echoes a runner-ready model id, or empty (→ CLI default).
 resolve_model() {
   local agent="$1" provider="$2" task="$3" diff="$4" cands="" out=""
   cands="$(opencode models "$provider" 2>/dev/null | tr '\n' ' ')"
@@ -89,138 +259,271 @@ try: print(json.load(sys.stdin).get("qualified") or "")
 except Exception: pass' 2>/dev/null
 }
 
-# epoch_ms: milliseconds since the epoch, captured BEFORE a spawn so crew-verify can count an
-# agent the moment it registers (even "booting"), instead of racing its own start time. A slow
-# first turn (opencode+GLM cold start ~40s) means no heartbeat for the whole turn; anchoring the
-# verifier to this pre-spawn epoch lets the early "booting" registration satisfy it.
 epoch_ms() { python3 -c 'import time;print(int(time.time()*1000))'; }
 
-if [ "$(uname)" != "Darwin" ]; then
-  echo "Window spawning is macOS-only. Run one per terminal, in $DIR:"
-  for a in "$@"; do echo "  node $BUS_DIR/bin/crew-runner.mjs $a $DIR"; done
-  exit 0
-fi
+# resolve_spec <spec> -> sets AGENT + MODEL globals (live-selects a provider-only spec).
+AGENT=""; MODEL=""
+resolve_spec() {
+  local SPEC="$1" FIELD
+  AGENT="${SPEC%%:*}"; MODEL=""
+  FIELD=""; [ "$SPEC" != "$AGENT" ] && FIELD="${SPEC#*:}"
+  [ "$AGENT" = "openrouter" ] && [ -z "$FIELD" ] && FIELD="openrouter"
+  if [ -n "$FIELD" ]; then
+    case "$FIELD" in
+      */*) MODEL="$FIELD" ;;
+      *)   MODEL="$(resolve_model "$AGENT" "$FIELD" "$TASK" "$DIFF")"
+           if [ -n "$MODEL" ]; then echo "  → $AGENT: live model $MODEL ($FIELD · $TASK/$DIFF)"
+           else echo "  → $AGENT: '$FIELD' live selection unavailable — CLI default"; fi ;;
+    esac
+  fi
+}
+RUN_CMD() { printf 'cd %q && CREW_MODEL=%q RELAY_PROJECT=%q node %q %q %q' "$DIR" "$MODEL" "$PROJ" "$BUS_DIR/bin/crew-runner.mjs" "$AGENT" "$DIR"; }
 
-# one-time wiring for every detected CLI (idempotent, backed up)
-node "$BUS_DIR/bin/connect.mjs" | tail -n +2
+# ── tmux spawn: ONE session `trantor:$PROJ`, one named pane per seat, one Terminal window attached ────
+spawn_tmux() {   # $@ = specs
+  local first=1 SPEC
+  # a pre-existing session for THIS project = the crew is already up; add missing seats as new panes.
+  tmux has-session -t "$TMUX_SESS" 2>/dev/null && first=0
+  for SPEC in "$@"; do
+    resolve_spec "$SPEC"
+    local cmd; cmd="$(RUN_CMD)"
+    local pane=""
+    if [ "$first" = "1" ]; then
+      run "tmux new-session -d -s '$TMUX_SESS' -n crew -x 260 -y 60"
+      run "tmux send-keys -t '$TMUX_SESS' $(printf '%q' "$cmd") Enter"
+      pane="$( [ "$DRY" = "1" ] && echo "%DRY" || tmux display-message -p -t "$TMUX_SESS" '#{pane_id}' 2>/dev/null)"
+      first=0
+    else
+      run "tmux split-window -t '$TMUX_SESS' $(printf '%q' "$cmd")"
+      run "tmux select-layout -t '$TMUX_SESS' tiled >/dev/null 2>&1"
+      pane="$( [ "$DRY" = "1" ] && echo "%DRY" || tmux display-message -p -t "$TMUX_SESS" '#{pane_id}' 2>/dev/null)"
+    fi
+    run "tmux select-pane -t '${pane:-$TMUX_SESS}' -T $(printf '%q' "$(echo "$AGENT" | tr '[:lower:]' '[:upper:]')")"
+    record_state "$PROJ" "tmux" "$AGENT" "${pane:-%?}"
+    echo "  → $AGENT pane in $TMUX_SESS"
+  done
+  # pane borders show the seat name; attach ONE Terminal window titled with the project
+  run "tmux set-option -t '$TMUX_SESS' pane-border-status top >/dev/null 2>&1"
+  run "tmux set-option -t '$TMUX_SESS' pane-border-format ' #{pane_title} ' >/dev/null 2>&1"
+  if [ "$DRY" = "1" ]; then echo "[dry] would attach a Terminal window to $TMUX_SESS"; record_state "$PROJ" "attach" "__win__" "%DRYWIN"; return 0; fi
+  local attach_wid
+  attach_wid="$(osascript \
+    -e 'tell application "Terminal"' \
+    -e "  set w to do script \"tmux attach -t $TMUX_SESS\"" \
+    -e "  set custom title of w to \"$PROJ — trantor crew\"" \
+    -e "  set theWin to first window whose tabs contains w" \
+    -e "  return id of theWin" \
+    -e 'end tell' 2>/dev/null)"
+  [ -n "$attach_wid" ] && record_state "$PROJ" "attach" "__win__" "$attach_wid"
+  echo "— crew grouped in tmux session $TMUX_SESS (one window: $PROJ — trantor crew). Detach with Ctrl-b d; it keeps running. —"
+}
 
-# ---- geometry: AUTO-DETECTED from the screen you're working on (never hard-coded coords).
-# NSScreen.mainScreen = the display with keyboard focus; visibleFrame excludes menu bar/Dock.
-# Crew tiles into the RIGHT 58% of THAT screen (left side stays for dashboard/main terminal).
-# One-off override: CREW_RECT="X,Y,W,H" env (no persistent config — display setups change).
-if [ -n "${CREW_RECT:-}" ]; then
-  IFS=',' read -r GX GY GW GH <<< "$CREW_RECT"
-else
+# ── Terminal-grid fallback (no tmux): per-agent windows, titled `<PROJECT> · <AGENT>` so sessions differ ──
+# Geometry: auto-detected right 58% of the FOCUSED screen.
+compute_rect() {
+  if [ -n "${CREW_RECT:-}" ]; then IFS=',' read -r GX GY GW GH <<< "$CREW_RECT"; return; fi
   eval "$(osascript -l JavaScript -e '
     ObjC.import("AppKit");
     const f=$.NSScreen.mainScreen.visibleFrame, prim=$.NSScreen.screens.objectAtIndex(0).frame;
     const yTop = prim.size.height - (f.origin.y + f.size.height);
-    const x=Math.round(f.origin.x), y=Math.round(yTop), w=Math.round(f.size.width), h=Math.round(f.size.height);
-    `SX=${x} SY=${y} SW=${w} SH=${h}`' 2>/dev/null)"
-  if [ -z "${SW:-}" ]; then  # fallback: primary display via Finder
-    read -r SX SY SW SH <<< "$(osascript -e 'tell application "Finder" to get bounds of window of desktop' | tr ',' ' ')"
-    SY=25; SH=$(( SH - 25 ))
-  fi
+    `SX=${Math.round(f.origin.x)} SY=${Math.round(yTop)} SW=${Math.round(f.size.width)} SH=${Math.round(f.size.height)}`' 2>/dev/null)"
+  if [ -z "${SW:-}" ]; then read -r SX SY SW SH <<< "$(osascript -e 'tell application "Finder" to get bounds of window of desktop' | tr ',' ' ')"; SY=25; SH=$(( SH - 25 )); fi
   GX=$(( SX + SW * 42 / 100 )); GY=$SY; GW=$(( SW * 58 / 100 )); GH=$SH
-fi
-echo "— crew area: ${GW}x${GH} at ${GX},${GY} (focused screen, auto-detected) —"
-
-spawn_grid() {  # $@ = agents — (re)computes the grid for THIS batch and spawns serially
-  local N=$# COLS=2
-  [ $N -le 2 ] && COLS=1
+}
+spawn_grid() {   # $@ = specs
+  compute_rect
+  local N=$# COLS=2; [ $N -le 2 ] && COLS=1
   local ROWS=$(( (N + COLS - 1) / COLS ))
-  local CW=$(( GW / COLS )) CH=$(( GH / ROWS ))
-  local i=0 SPEC AGENT FIELD MODEL
+  local CW=$(( GW / COLS )) CH=$(( GH / ROWS )) i=0 SPEC
   for SPEC in "$@"; do
-    AGENT="${SPEC%%:*}"                       # agent[:provider[/model]] — model rides in as CREW_MODEL
-    FIELD=""; [ "$SPEC" != "$AGENT" ] && FIELD="${SPEC#*:}"
-    # `trantor up openrouter` (no provider) → default the opencode provider to openrouter so it
-    # live-selects from the OpenRouter catalog instead of falling back to opencode's default model.
-    [ "$AGENT" = "openrouter" ] && [ -z "$FIELD" ] && FIELD="openrouter"
-    MODEL=""
-    if [ -n "$FIELD" ]; then
-      case "$FIELD" in
-        */*) MODEL="$FIELD" ;;                                          # full pin: provider/model
-        *)   MODEL="$(resolve_model "$AGENT" "$FIELD" "$TASK" "$DIFF")"  # provider only: pick live now
-             if [ -n "$MODEL" ]; then echo "  → $AGENT: live model $MODEL ($FIELD · $TASK/$DIFF)"
-             else echo "  → $AGENT: '$FIELD' live selection unavailable — CLI default"; fi ;;
-      esac
-    fi
-    local C=$(( i % COLS )) R=$(( i / COLS ))
-    local X1=$(( GX + C * CW )) Y1=$(( GY + R * CH )) WID=""
+    resolve_spec "$SPEC"
+    local cmd; cmd="$(RUN_CMD)"
+    local C=$(( i % COLS )) R=$(( i / COLS )) X1 Y1 WID=""
+    X1=$(( GX + C * CW )); Y1=$(( GY + R * CH ))
+    if [ "$DRY" = "1" ]; then echo "[dry] Terminal window for $AGENT at $X1,$Y1"; record_state "$PROJ" "win" "$AGENT" "%DRYWIN$i"; i=$(( i + 1 )); continue; fi
     WID="$(osascript \
       -e 'tell application "Terminal"' \
-      -e "  set w to do script \"cd $DIR && clear && CREW_MODEL=$MODEL RELAY_PROJECT=$PROJ node $BUS_DIR/bin/crew-runner.mjs $AGENT $DIR\"" \
-      -e "  set custom title of w to \"$(echo "$AGENT" | tr '[:lower:]' '[:upper:]') — trantor crew\"" \
+      -e "  set w to do script \"clear && $cmd\"" \
+      -e "  set custom title of w to \"$PROJ · $(echo "$AGENT" | tr '[:lower:]' '[:upper:]')\"" \
       -e "  set theWin to first window whose tabs contains w" \
       -e "  set bounds of theWin to {$X1, $Y1, $(( X1 + CW )), $(( Y1 + CH ))}" \
       -e "  return id of theWin" \
       -e 'end tell' 2>/dev/null)"
-    if [ -n "$WID" ]; then printf '%s\t%s\n' "$AGENT" "$WID" >> "$STATE"; echo "  → $AGENT window spawned"; else echo "  ✗ $AGENT osascript spawn ERROR"; fi
-    sleep 1.2   # serialize — rapid-fire 'do script' calls race and silently drop windows
+    if [ -n "$WID" ]; then record_state "$PROJ" "win" "$AGENT" "$WID"; echo "  → $AGENT window spawned ($PROJ · $AGENT)"; else echo "  ✗ $AGENT osascript spawn ERROR"; fi
+    sleep 1.2
+    i=$(( i + 1 ))
+  done
+}
+# ── cmux spawn: ONE workspace TAB per project, seats tiled inside it ──────────────────────────────────
+# PRIMARY = the control socket (structured, stable UUIDs, native sidebar status) when it's authorized
+# (automation.socketControlMode = allowAll). new-workspace launches seat 1; new-split + send add each
+# further seat; rename-workspace titles the sidebar tab; the runner pushes per-seat status. Whole-project
+# teardown = close-workspace by UUID. FALLBACK = AppleScript (Apple Events, no allowAll needed) when the
+# socket is off. Each seat's command rides a launcher script (OSC pane title + no CLI-escaping headaches).
+_cmux_surf_json() { node -e 'let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{try{const j=JSON.parse(d);process.stdout.write(j.surface_id||j.surface_ref||"")}catch(e){}})'; }
+spawn_cmux() {   # $@ = specs
+  if ! _cmux_ok; then
+    echo "— cmux control socket is OFF (mode cmuxOnly) → using AppleScript (works; no native sidebar status)."
+    echo "  Enable the full integration: add \"automation\": { \"socketControlMode\": \"allowAll\" } to"
+    echo "  ~/.config/cmux/cmux.json (cmux auto-reloads). —"
+    spawn_cmux_applescript "$@"; return
+  fi
+  local first=1 SPEC wsid="" surf="" i=0
+  local dirs=(down right down right down right down right)
+  for SPEC in "$@"; do
+    resolve_spec "$SPEC"
+    local cmd launcher; cmd="$(RUN_CMD)"; launcher="$(_seat_launcher "$AGENT" "$cmd")"
+    if [ "$first" = "1" ]; then
+      if [ "$DRY" = "1" ]; then
+        echo "[dry] cmux: new-workspace (cwd $DIR) --command 'bash $launcher' → rename 'trantor:$PROJ'"
+        wsid="%DRYWS"; surf="%DRYT0"
+      else
+        local out ref; out="$(_cmux new-workspace --cwd "$DIR" --command "bash $launcher" 2>&1)"
+        ref="$(printf '%s' "$out" | awk '{print $2}')"; wsid="$(_cmux_ws_uuid "$ref")"
+        [ -n "$wsid" ] && _cmux rename-workspace --workspace "$wsid" "trantor:$PROJ" >/dev/null 2>&1
+        surf="$(_cmux list-pane-surfaces --workspace "$wsid" --id-format uuids --json 2>/dev/null | node -e 'let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{try{const o=JSON.parse(d.slice(d.search(/[\[{]/)));const a=o.surfaces||o.panes||o||[];const s=Array.isArray(a)?a[0]:null;process.stdout.write((s&&(s.id||s.surface_id))||"")}catch(e){}})')"
+      fi
+      record_state "$PROJ" "cmuxws" "__ws__" "$wsid"
+      first=0
+    else
+      local dir="${dirs[$(( i % ${#dirs[@]} ))]}"
+      if [ "$DRY" = "1" ]; then
+        echo "[dry] cmux: new-split $dir + send 'bash $launcher'"; surf="%DRYT$i"
+      else
+        surf="$(_cmux new-split "$dir" --workspace "$wsid" --id-format uuids --json 2>/dev/null | _cmux_surf_json)"
+        [ -n "$surf" ] && { _cmux send --surface "$surf" "bash $launcher" >/dev/null 2>&1; _cmux send-key --surface "$surf" enter >/dev/null 2>&1; }
+      fi
+    fi
+    record_state "$PROJ" "cmux" "$AGENT" "$surf"
+    echo "  → $AGENT seat in cmux workspace ($PROJ)"
     i=$(( i + 1 ))
   done
+  [ "$DRY" = "1" ] || [ -z "$wsid" ] || _cmux set-status trantor "crew up" --icon rocket --color "#14b8a6" --workspace "$wsid" >/dev/null 2>&1
+  echo "— crew grouped in cmux: ONE workspace tab for $PROJ, seats tiled + sidebar status. Teardown (this project only): trantor down —"
 }
 
-# swap <oldAgent> <newSpec>: replace a live agent (e.g. one reported exhausted) with a fresh
-# one whose model is live-selected. Tears down the old agent's window, spawns the new spec.
-swap() {
-  local OLD="${1:-}" NEWSPEC="${2:-}"
-  [ -n "$OLD" ] && [ -n "$NEWSPEC" ] || { echo "usage: trantor swap <oldAgent> <newAgent[:provider[/model]]> [--task K --difficulty D]"; exit 1; }
-  if [ -f "$STATE" ]; then
-    local tmp="$STATE.tmp"; : > "$tmp"
-    while IFS=$'\t' read -r a wid; do
-      [ -n "${wid:-}" ] || { wid="$a"; a=""; }
-      if [ "$a" = "$OLD" ]; then
-        echo "— tearing down old agent '$OLD' (window $wid) —"
-        local TTY; TTY=$(osascript -e "tell application \"Terminal\" to get tty of (first window whose id is $wid)" 2>/dev/null)
-        [ -n "$TTY" ] && for pid in $(ps -t "${TTY#/dev/}" -o pid= 2>/dev/null); do kill -9 "$pid" 2>/dev/null; done
-        sleep 0.5
-        osascript -e "tell application \"Terminal\" to close (first window whose id is $wid)" 2>/dev/null
+# AppleScript fallback (cmux control socket off): same one-tab-per-project layout, minus native sidebar status.
+spawn_cmux_applescript() {   # $@ = specs
+  local first=1 SPEC tabid="" termid="" i=0
+  local dirs=(down right down right down right down right)
+  for SPEC in "$@"; do
+    resolve_spec "$SPEC"
+    local cmd launcher; cmd="$(RUN_CMD)"; launcher="$(_seat_launcher "$AGENT" "$cmd")"
+    if [ "$first" = "1" ]; then
+      if [ "$DRY" = "1" ]; then
+        echo "[dry] cmux(AppleScript): new tab (trantor:$PROJ) + run 'bash $launcher'"; tabid="%DRYTAB"; termid="%DRYT0"
       else
-        printf '%s\t%s\n' "$a" "$wid" >> "$tmp"
+        local out; out="$(osascript 2>/dev/null <<OSA
+tell application "cmux"
+  activate
+  if (count of windows) is 0 then
+    new window
+    delay 0.5
+  end if
+  set t to (new tab)
+  delay 0.4
+  set term1 to (focused terminal of t)
+  input text ("bash $launcher" & return) to term1
+  return (id of t) & "|" & (id of term1)
+end tell
+OSA
+)"
+        tabid="${out%%|*}"; termid="${out##*|}"
       fi
-    done < "$STATE"
-    mv "$tmp" "$STATE"
+      record_state "$PROJ" "cmuxws" "__ws__" "$tabid"
+      first=0
+    else
+      local dir="${dirs[$(( i % ${#dirs[@]} ))]}"
+      if [ "$DRY" = "1" ]; then
+        echo "[dry] cmux(AppleScript): split $dir + run 'bash $launcher'"; termid="%DRYT$i"
+      else
+        termid="$(osascript 2>/dev/null <<OSA
+tell application "cmux"
+  set theTab to missing value
+  repeat with w in windows
+    repeat with tt in tabs of w
+      if (id of tt) is "$tabid" then set theTab to tt
+    end repeat
+  end repeat
+  if theTab is missing value then return "ERR"
+  set newterm to (split (focused terminal of theTab) direction $dir)
+  delay 0.25
+  input text ("bash $launcher" & return) to newterm
+  return (id of newterm)
+end tell
+OSA
+)"
+      fi
+    fi
+    record_state "$PROJ" "cmux" "$AGENT" "$termid"
+    echo "  → $AGENT seat in cmux workspace ($PROJ)"
+    i=$(( i + 1 ))
+  done
+  echo "— crew grouped in cmux (AppleScript): ONE workspace tab for $PROJ, seats tiled. Teardown: trantor down —"
+}
+
+spawn_crew() {   # dispatch: cmux (preferred) → tmux → Terminal grid
+  if [ "$HAVE_CMUX" = "1" ]; then spawn_cmux "$@"
+  elif [ "$HAVE_TMUX" = "1" ]; then spawn_tmux "$@"
+  else
+    echo "— no cmux/tmux → per-agent Terminal windows. For ONE grouped, named window per crew (and"
+    echo "  bulletproof scoped teardown), install cmux, or run:  brew install tmux  —"
+    spawn_grid "$@"
   fi
+}
+
+# ── swap: replace a live seat (e.g. one reported exhausted) with a fresh live-selected one ────────────
+swap() {
+  local OLD="${1:-}" NEWSPEC="${2:-}"
+  [ -n "$OLD" ] && [ -n "$NEWSPEC" ] || { echo "usage: trantor swap <oldAgent> <newAgent[:provider[/model]]> [--task K --difficulty D]"; exit 1; }
+  echo "— tearing down old seat '$OLD' in $PROJ —"
+  down "$OLD"
   echo "— spawning replacement: $NEWSPEC ($TASK/$DIFF) —"
   local SWAP_EPOCH; SWAP_EPOCH=$(epoch_ms)
-  spawn_grid "$NEWSPEC"
+  spawn_crew "$NEWSPEC"
   local NEWAGENT="${NEWSPEC%%:*}"
   echo "— verifying replacement on the bus —"
-  node "$BUS_DIR/bin/crew-verify.mjs" "$PROJ" "$NEWAGENT" --since "$SWAP_EPOCH" --timeout 30
+  [ "$DRY" = "1" ] || node "$BUS_DIR/bin/crew-verify.mjs" "$PROJ" "$NEWAGENT" --since "$SWAP_EPOCH" --timeout 30
   echo "— swapped. RESEND the contract to '$NEWAGENT' (it joined fresh with no context). —"
 }
 
 if [ "$CMD" = "swap" ]; then swap "$@"; exit 0; fi
 
-# spec_for_agent <agent> <spec...>: echo the FULL original spec (agent:provider[/model]) whose
-# agent part matches — so a retry respawns on the SAME live-selected model, not the CLI default.
+# ── up ───────────────────────────────────────────────────────────────────────────────────────────────
+prune_dead_state
+# ensure the cmux CLI is on PATH (opt-in) so runner-side sidebar-status calls resolve from any shell.
+if [ "$DRY" != "1" ] && [ "$HAVE_CMUX" = "1" ] && ! command -v cmux >/dev/null 2>&1; then
+  mkdir -p "$HOME/.local/bin"
+  ln -sf "/Applications/cmux.app/Contents/Resources/bin/cmux" "$HOME/.local/bin/cmux" 2>/dev/null \
+    && echo "— linked cmux CLI → ~/.local/bin/cmux —"
+fi
+[ "$DRY" = "1" ] || node "$BUS_DIR/bin/connect.mjs" | tail -n +2   # one-time CLI wiring (idempotent)
+
 spec_for_agent() { local want="$1"; shift; local s; for s in "$@"; do [ "${s%%:*}" = "$want" ] && { printf '%s' "$s"; return; }; done; printf '%s' "$want"; }
 
-echo "— spawning crew (serialized) —"
+CREW_UI="Terminal windows"; [ "$HAVE_TMUX" = "1" ] && CREW_UI="tmux"; [ "$HAVE_CMUX" = "1" ] && CREW_UI="cmux"
+echo "— bringing up crew for $PROJ ($CREW_UI) —"
 SPAWN_EPOCH=$(epoch_ms)
-spawn_grid "$@"
+spawn_crew "$@"
 
+if [ "$DRY" = "1" ]; then echo "— dry run: no bus verify —"; exit 0; fi
 echo "— verifying on the bus (the spawn is not the truth; the bus is) —"
 AGENTS_ONLY=$(for a in "$@"; do printf "%s " "${a%%:*}"; done)
 VER=$(node "$BUS_DIR/bin/crew-verify.mjs" "$PROJ" $AGENTS_ONLY --since "$SPAWN_EPOCH" --timeout 30)
 echo "$VER"
 RETRY=$(echo "$VER" | grep "^FAILED:" | cut -d: -f2 | tr ',' ' ')
 if [ -n "${RETRY// }" ]; then
-  # map failed agent names back to their FULL specs (preserve provider/model on respawn)
   RETRY_SPECS=""; for a in $RETRY; do RETRY_SPECS="$RETRY_SPECS $(spec_for_agent "$a" "$@")"; done
   echo "— retrying failed spawns:$RETRY_SPECS —"
   RETRY_EPOCH=$(epoch_ms)
-  spawn_grid $RETRY_SPECS
+  spawn_crew $RETRY_SPECS
   VER2=$(node "$BUS_DIR/bin/crew-verify.mjs" "$PROJ" $RETRY --since "$RETRY_EPOCH" --timeout 30)
   echo "$VER2"
   STILL=$(echo "$VER2" | grep "^FAILED:" | cut -d: -f2)
   if [ -n "$STILL" ]; then
-    echo ""
-    echo "✗✗ CREW INCOMPLETE — these agents are NOT on the bus: $STILL"
-    echo "   Do NOT assign them work. Investigate their windows or run: crew.sh up ${STILL//,/ }"
+    echo ""; echo "✗✗ CREW INCOMPLETE — these agents are NOT on the bus: $STILL"
+    echo "   Do NOT assign them work. Investigate their panes/windows or run: crew.sh up ${STILL//,/ }"
     exit 1
   fi
 fi
-echo "— crew verified on the bus. Send contracts with relay_send; runners keep agents alive for free. Teardown: crew.sh down —"
+echo "— crew verified on the bus. Send contracts with relay_send; runners keep agents alive for free. Teardown (this project only): trantor down —"

package/bin/sweep.mjs

@@ -0,0 +1,62 @@
+#!/usr/bin/env node
+// trantor sweep — clear stuck IN-PROGRESS cards. The automatic hub reaper only stales cards whose OWNER is
+// OFFLINE (safe: it never touches live work). `trantor sweep` is the explicit "a live seat forgot its card"
+// broom: it moves EVERY doing/testing card idle past --older (default 30m) to the Stale lane. It PREVIEWS
+// first and changes NOTHING until you re-run with --yes.
+//   trantor sweep                 # preview this project's stuck cards
+//   trantor sweep --yes           # actually move them to Stale
+//   trantor sweep --older 2h      # widen/narrow the idle threshold (ms|s|m|h|d, default 30m)
+//   trantor sweep --all-projects  # every board, not just this one
+import { readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { resolveProject } from "../lib/project.mjs";
+
+function relayUrl() {
+  if (process.env.RELAY_URL) return process.env.RELAY_URL;
+  try { const c = join(homedir(), ".agent-bus", "config.json"); if (existsSync(c)) { const u = JSON.parse(readFileSync(c, "utf8")).url; if (u) return u; } } catch {}
+  return "http://127.0.0.1:4477";
+}
+function parseDur(s, def) {
+  if (!s) return def;
+  const m = String(s).match(/^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/i);
+  if (!m) return def;
+  const mult = { ms: 1, s: 1000, m: 60000, h: 3600000, d: 86400000 }[(m[2] || "m").toLowerCase()];
+  return Math.round(Number(m[1]) * mult);
+}
+const fmtAge = ms => { const m = Math.round(ms / 60000); return m >= 1440 ? `${Math.floor(m / 1440)}d` : m >= 90 ? `${Math.floor(m / 60)}h` : `${m}m`; };
+
+const argv = process.argv.slice(2);
+const has = (...f) => f.some(x => argv.includes(x));
+const val = (...f) => { for (const x of f) { const i = argv.indexOf(x); if (i >= 0) return argv[i + 1]; } return undefined; };
+const olderMs = parseDur(val("--older", "-o"), 30 * 60 * 1000);
+const doIt = has("--yes", "-y");
+const allProjects = has("--all-projects", "--all");
+const project = allProjects ? null : resolveProject(process.cwd());
+const url = relayUrl();
+
+async function sweep(dryRun) {
+  const body = { olderMs, dryRun, by: "cli-sweep" };
+  if (project) body.project = project;
+  const r = await fetch(`${url}/sweep`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body), signal: AbortSignal.timeout(6000) });
+  return r.json();
+}
+
+try {
+  const scope = project ? `project "${project}"` : "ALL projects";
+  const pre = await sweep(true);
+  const cand = pre.candidates || [];
+  console.log(`\n🧹 trantor sweep — ${scope} · idle > ${fmtAge(olderMs)}\n${"─".repeat(52)}`);
+  if (!cand.length) { console.log("  nothing stuck — every in-progress card is fresh or owned-live.\n"); process.exit(0); }
+  for (const c of cand) console.log(`  #${c.id} [${c.status}] ${String(c.title).slice(0, 58)}  · ${c.assignee || "?"} · idle ${fmtAge(c.ageMs)}${allProjects ? ` · ${c.project}` : ""}`);
+  if (!doIt) {
+    console.log(`\n  ${cand.length} card(s) would move to the Stale lane. Re-run to confirm:`);
+    console.log(`    trantor sweep${allProjects ? " --all-projects" : ""}${val("--older", "-o") ? ` --older ${val("--older", "-o")}` : ""} --yes\n`);
+    process.exit(0);
+  }
+  const res = await sweep(false);
+  console.log(`\n  ✓ swept ${res.swept} card(s) → Stale. Triage on the board (click a stale card to re-queue, or move it to Done).\n`);
+} catch (e) {
+  console.error(`could not reach hub at ${url}: ${e.message}`);
+  process.exit(1);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.17.49",
+  "version": "0.17.50",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"
@@ -10,7 +10,7 @@
     "zod": "^4.4.3"
   },
   "scripts": {
-    "test": "node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-handoff.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-balances.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && python3 engine/test-routing.py"
+    "test": "node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-handoff.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-balances.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-reaper.mjs && python3 engine/test-routing.py && bash test-crew.sh"
   },
   "description": "The hub-world for AI agent crews — orchestrate Claude Code, Codex, GLM, Kimi, DeepSeek & any OpenRouter model as live crews with a plan-aware Advisor, a Kanban/flow command center, a testing gate, and an economics brain (Scrooge).",
   "files": [

package/ui.html

@@ -91,16 +91,17 @@ main:not(.learn-open) .learn-body{display:none}
 .phase.planned{color:var(--mut)}
 .pbar{height:4px;border-radius:3px;background:#0d1320;margin:2px 16px 0;overflow:hidden}
 .pbar i{display:block;height:100%;background:linear-gradient(90deg,var(--grn2),var(--grn));border-radius:3px;transition:width .4s}
-.kanban{display:grid;grid-template-columns:repeat(5,1fr);gap:10px;padding:12px 16px}
+.kanban{display:grid;grid-template-columns:repeat(6,1fr);gap:10px;padding:12px 16px}
 .col{background:#0d1320;border:1px solid var(--line);border-radius:10px;padding:9px;min-height:140px;max-height:clamp(280px,58vh,1100px);overflow-y:auto}
 .col::-webkit-scrollbar{width:6px}.col::-webkit-scrollbar-thumb{background:#243049;border-radius:3px}
 .col h4{position:sticky;top:-9px;background:#0d1320;padding:9px 0 6px;margin-top:-9px;z-index:1}
 .col h4{margin:0 0 8px;font-size:10.5px;text-transform:uppercase;letter-spacing:.08em;color:var(--dim);display:flex;justify-content:space-between}
-.col.todo h4 i{color:var(--mut)}.col.doing h4 i{color:var(--blu)}.col.testing h4 i{color:var(--amb)}.col.done h4 i{color:var(--grn)}.col.blocked h4 i{color:var(--red)}
+.col.todo h4 i{color:var(--mut)}.col.doing h4 i{color:var(--blu)}.col.testing h4 i{color:var(--amb)}.col.done h4 i{color:var(--grn)}.col.blocked h4 i{color:var(--red)}.col.stale h4 i{color:#a99fd0}
 .col h4 i{font-style:normal}
 .tcard{background:var(--card);border:1px solid var(--line);border-left:3px solid var(--mut);border-radius:7px;padding:7px 9px;margin-bottom:7px;cursor:pointer;font-size:13px}
 .tcard:hover{background:var(--card2);border-color:#2c3a52}
-.col.doing .tcard{border-left-color:var(--blu)}.col.testing .tcard{border-left-color:var(--amb)}.col.done .tcard{border-left-color:var(--grn)}.col.blocked .tcard{border-left-color:var(--red)}
+.col.doing .tcard{border-left-color:var(--blu)}.col.testing .tcard{border-left-color:var(--amb)}.col.done .tcard{border-left-color:var(--grn)}.col.blocked .tcard{border-left-color:var(--red)}.col.stale .tcard{border-left-color:#8a7fb0;opacity:.82}
+.swp{cursor:pointer;font-size:11px;color:var(--dim);border:1px solid var(--line);border-radius:5px;padding:1px 7px;margin-left:6px;user-select:none}.swp:hover{color:var(--amb);border-color:#3a4458}.swp.arm{color:#0b1120;background:var(--amb);border-color:var(--amb)}
 .tcard.failed{border-left-color:var(--red);border-color:#5a2c2c;animation:failpulse 1.1s ease-in-out infinite}
 .tcard.failed .who{color:#ef6a6a}
 @keyframes failpulse{0%,100%{box-shadow:0 0 0 0 rgba(239,106,106,0)}50%{box-shadow:0 0 14px 2px rgba(239,106,106,.55);border-color:#ef6a6a}}
@@ -257,6 +258,7 @@ main:not(.learn-open) .learn-body{display:none}
 .tevent .tstatus.failed{color:var(--red)}
 .tevent .tstatus.done{color:var(--grn)}
 .tevent .tstatus.blocked{color:var(--red)}
+.tevent .tstatus.stale{color:#a99fd0}
 .tevent .arr{color:var(--dim);margin:0 2px}
 /* per-project inter-agent conversation lane */
 .proj-chat{margin:4px 16px 14px;border:1px solid var(--line);border-radius:10px;background:#0c111c}
@@ -320,7 +322,7 @@ const esc=s=>String(s).replace(/[&<>"]/g,c=>({'&':'&amp;','<':'&lt;','>':'&gt;',
 // number; `$usd()` prefixes the currency symbol.
 const usd=(n,dp=2)=>(Number(n)||0).toLocaleString('en-US',{minimumFractionDigits:dp,maximumFractionDigits:dp});
 const $usd=(n,sym='$',dp=2)=>sym+usd(n,dp);
-const COLS=[['todo','To Do'],['doing','In Progress'],['testing','Testing'],['done','Done'],['blocked','Blocked']];
+const COLS=[['todo','To Do'],['doing','In Progress'],['testing','Testing'],['done','Done'],['blocked','Blocked'],['stale','Stale']];
 let nmsg=0;
 // SOLO = single-project full-window mode via deep link ?project=<name>. Parsed once (search is static
 // per load). When set, render() shows ONLY that project's board/FLOW/TIMELINE and hides the side rails.
@@ -440,6 +442,7 @@ let PHASES = {};
 function setView(proj, v){ VIEWS[proj] = v; localStorage.setItem("abViews", JSON.stringify(VIEWS)); render(); }
 function toggleIdle(name){ if(!name)return; const s=new Set(JSON.parse(localStorage.getItem("abIdleOpen")||"[]")); s.has(name)?s.delete(name):s.add(name); localStorage.setItem("abIdleOpen",JSON.stringify([...s])); render(); }
 let armedDel=null,armedTs=0;   // pending ✕ confirmation (project name + when it was armed)
+let armedSwp=null,armedSwpTs=0,armedSwpCount=0;   // pending 🧹 sweep confirmation (project + when armed + previewed count)
 // ▲▼: snapshot the currently displayed order, swap, persist — manual order then wins until ↺ reset
 function moveProj(name,dir){
   const names=[...document.querySelectorAll('#boards [data-projname]')].map(d=>d.dataset.projname);
@@ -457,7 +460,7 @@ function flowHTML(pt, proj){
   const data = PHASES[proj];
   if (!data) return '<div class="pflowwrap"><div class="empty">loading flow…</div></div>';
   if (!data.phases || !data.phases.length) return '<div class="pflowwrap"><div class="empty">no cards yet</div></div>';
-  const SCOL = { todo:'#3a4458', doing:'#4a90d9', testing:'#f59e0b', failed:'#ef6a6a', blocked:'#ef6a6a', done:'#14b8a6' };
+  const SCOL = { todo:'#3a4458', doing:'#4a90d9', testing:'#f59e0b', failed:'#ef6a6a', blocked:'#ef6a6a', done:'#14b8a6', stale:'#8a7fb0' };
   const NW = 168, NH = 34, RG = 11, CG = 64, PGAP = 76, MT = 64, MB = 22;
   const MAXPC = 10;            // max nodes stacked per column before collapsing into a "+N more" node
   let pi0 = 0;                 // running id base so each phase's overflow nodes get unique negative ids
@@ -608,7 +611,7 @@ let cardEsc = null;
 async function openCard(id){
   let d; try { d = await (await fetch('/card?id=' + id)).json(); } catch { return; }
   const t = d.task; if (!t) return;
-  const SC = { todo:'var(--mut)', doing:'var(--blu)', testing:'var(--amb)', failed:'var(--red)', blocked:'var(--red)', done:'var(--grn)', deleted:'var(--dim)' };
+  const SC = { todo:'var(--mut)', doing:'var(--blu)', testing:'var(--amb)', failed:'var(--red)', blocked:'var(--red)', done:'var(--grn)', deleted:'var(--dim)', stale:'#a99fd0' };
   const items = [];
   for (const e of (d.events||[])) items.push({ ts:e.ts, ev:e });
   for (const m of (d.messages||[])) items.push({ ts:m.ts, m });
@@ -829,7 +832,7 @@ async function render(){
     const brief=p.brief?`<span class="brief">${esc(p.brief)}</span>`:`<span class="brief dim">— no brief yet · an agent sets it with relay_project_brief</span>`;
     const view = VIEWS[p.project] || "board";
     const vtog = `<div class="vtog"><span class="vlbl">view</span><button class="vbtn ${view==="board"?"on":""}" data-proj="${esc(p.project)}" data-view="board">BOARD</button><button class="vbtn ${view==="flow"?"on":""}" data-proj="${esc(p.project)}" data-view="flow">FLOW</button><button class="vbtn ${view==="timeline"?"on":""}" data-proj="${esc(p.project)}" data-view="timeline">TIMELINE</button></div>`;
-    const ctl=`<span class="mv"><b class="mvup" data-proj="${esc(p.project)}" title="move up">▲</b><b class="mvdn" data-proj="${esc(p.project)}" title="move down">▼</b></span>${p.idle===true?`<span class="pdel" data-proj="${esc(p.project)}" title="forget this project (cards, peers, brief) — it returns if an agent registers it again">✕</span>`:''}`;
+    const ctl=`<span class="swp" data-proj="${esc(p.project)}" title="sweep stuck in-progress cards (idle > 30m) to the Stale lane — first click previews the count, second click within 4s confirms">🧹 sweep</span><span class="mv"><b class="mvup" data-proj="${esc(p.project)}" title="move up">▲</b><b class="mvdn" data-proj="${esc(p.project)}" title="move down">▼</b></span>${p.idle===true?`<span class="pdel" data-proj="${esc(p.project)}" title="forget this project (cards, peers, brief) — it returns if an agent registers it again">✕</span>`:''}`;
 
     return `<div class="proj${p.idle===true?' idle':''}" data-projname="${esc(p.project)}"${p.idle===true?` data-idleproj="${esc(p.project)}"`:''}>`+
       `<div class="proj-h"><span class="pname">📁 <b>${esc(p.project)}</b></span><a class="popout" href="?project=${encodeURIComponent(p.project)}" target="_blank" rel="noopener" title="open this project in its own window" onclick="event.stopPropagation()">↗</a>${vtog}<div class="agents">${agents||'<span class="dim">no agents</span>'}</div><span class="spacer"></span><span class="prog">${done}/${pt.length} done · ${pct}%</span>${ctl}</div>`+
@@ -867,6 +870,19 @@ async function render(){
   // ▲▼ reorder (persists as a manual order); ✕ forget — armed two-step, no popup
   el.querySelectorAll('.mvup').forEach(b=>b.onclick=e=>{e.stopPropagation();moveProj(b.dataset.proj,-1);});
   el.querySelectorAll('.mvdn').forEach(b=>b.onclick=e=>{e.stopPropagation();moveProj(b.dataset.proj,1);});
+  // 🧹 sweep — armed two-step (no popup): first click previews the count via dryRun, second confirms.
+  el.querySelectorAll('.swp').forEach(b=>b.onclick=async e=>{
+    e.stopPropagation();
+    const p=b.dataset.proj;
+    if(!(armedSwp===p&&Date.now()-armedSwpTs<4000)){
+      const dry=await fetch('/sweep',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({project:p,olderMs:1800000,dryRun:true})}).then(r=>r.json()).catch(()=>({count:0}));
+      if(!dry.count){b.textContent='🧹 nothing idle';setTimeout(()=>{b.textContent='🧹 sweep';},1600);return;}
+      armedSwp=p;armedSwpTs=Date.now();armedSwpCount=dry.count;b.classList.add('arm');b.textContent=`🧹 sweep ${dry.count}?`;return;
+    }
+    armedSwp=null;b.classList.remove('arm');
+    await fetch('/sweep',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({project:p,olderMs:1800000,by:'dashboard'})});
+    render();
+  });
   el.querySelectorAll('.pdel').forEach(b=>b.onclick=async e=>{
     e.stopPropagation();
     const p=b.dataset.proj;
@@ -878,6 +894,7 @@ async function render(){
   // the 2.5s re-render rebuilds the DOM — re-apply a still-fresh armed state so the
   // "✕ sure?" confirmation survives until it expires instead of silently resetting
   if(armedDel&&Date.now()-armedTs<4000){const ab=el.querySelector(`.pdel[data-proj="${CSS.escape(armedDel)}"]`);if(ab){ab.classList.add('arm');ab.textContent='✕ sure?';}}
+  if(armedSwp&&Date.now()-armedSwpTs<4000){const sb=el.querySelector(`.swp[data-proj="${CSS.escape(armedSwp)}"]`);if(sb){sb.classList.add('arm');sb.textContent=`🧹 sweep ${armedSwpCount||''}?`;}}else{armedSwp=null;}
   const sr=$('#sortreset');if(sr)sr.onclick=()=>{localStorage.removeItem('abOrder');render();};
   wireFlow(el);wireTimeline(el);
   // keep each timeline scrolled to the latest event
@@ -885,7 +902,7 @@ async function render(){
   el.querySelectorAll('.tcard, .fnode').forEach(c=>c.onclick=async()=>{
     const id=+c.dataset.id,t=tasks.find(x=>x.id===id);if(!t)return;
     if(suppressClickId&&+suppressClickId===id)return;   // drag-end, not a click
-    const next={todo:'doing',doing:'testing',testing:'done',failed:'doing',done:'todo',blocked:'doing'}[t.status];
+    const next={todo:'doing',doing:'testing',testing:'done',failed:'doing',done:'todo',blocked:'doing',stale:'todo'}[t.status];
     await fetch('/task/update',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({id,status:next})});render();
   });
 }