A Ctrl-K command bar in both the web UI and the TUI: fuzzy-jump to a session, run any bound command, spawn into a directory, and act on a matched session. One key everywhere — TUI normal and insert mode, web sidebar and terminal focus — with the leader sending a literal Ctrl-K to the pane. Contract lives in docs/COMMAND-BAR.md (issue #1 of this milestone). Serves PRODUCT.md design principle 3, fast and keyboard-literate.
Migrate the web SPA from vanilla TypeScript to React + Zustand + Tailwind. Big-bang rewrite: scaffold alongside, port module by module, delete the old code when done. See DESIGN.md for the visual contract; docs/SIDEBAR.md, docs/PREVIEW.md, docs/COMMAND-BAR.md, docs/STRUCTURED-VIEW.md, docs/RESTART.md for feature contracts.
Sessions survive a daemon restart today but not a host reboot: tmux dies with the machine and recover() only adopts live tmux sessions, so every session disappears while its sidecar is left orphaned on disk. This milestone makes a rebooted host come back with its sessions listed as dormant and resumable in place — same id, name, worktree ownership, and agent conversation.
Rebuild session creation in both the web UI and the TUI around inline draft panes instead of modals, backed by daemon-side project discovery.
The operator spawns almost every session inside a git repository, as a worktree off it. Today both clients make them type the path: the web modal (web/src/spawn.ts) has a recent-dirs picker and a finicky autocomplete, and the TUI overlay (crates/maestro-tui/src/overlays.rs) has two raw text fields and no cursor motion at all. This milestone replaces both with a form that lives in an ordinary pane — focusable like a session, several drafts open at once, nothing overlaying the screen — fed by a scanned list of known projects sorted by recency.
See PRODUCT.md (Design Principles 1 and 3: the scan is the product; fast and keyboard-literate) and DESIGN.md (Components), which this milestone amends: the spawn modal stops being one of the three surfaces.
Redesign how the daemon creates, guards and disposes of git worktrees.
Five of the six Spawn v2 review rounds had their worst finding in this one area, each caused by the previous round's fix: a cleanup guard that made every unpushed branch a one-shot, nested worktrees whose removal destroyed a sibling's work, a guarded leftover that burned its branch permanently, and finally an adoption path that could take over and delete a worktree the operator had made by hand.
The root causes are structural, not individual bugs. The path served as both the human-friendly location and the daemon's identity key, so derived paths collided and predictable ones collided with what people already had. Ownership was inferred from (path, branch) rather than recorded. Cleanup was unconditional, which removed the operator's control and forced a heuristic guard to answer an unanswerable question.
This milestone replaces that with: never adopt anything, sidestep collisions with a numeric suffix, move the guard from the worktree to the kill so an unfinished session stays alive as the handle to its own work, and give retained worktrees a store, an endpoint and a reclaim action in every client. The lifecycle is written down at the end, because this area has never had a written contract.