agent-coord-mcp 0.26.19 → 0.26.20

package/src/tools/records.ts

@@ -70,10 +70,85 @@ const readDoc = (repo: string, rel: string): { text: string; doc: WorkDoc } | nu
  * Returns what it stamped so the caller can report it rather than leaving an
  * absorbing writer to find it in a diff.
  */
-function writeDoc(repo: string, rel: string, doc: WorkDoc, original: string): { written: boolean; stamped: string[] } {
+/**
+ * A WRITE WHOSE BASE MOVED UNDER IT. Thrown, never returned, because a refusal
+ * that can be ignored is how the silent loss happened in the first place.
+ */
+export class StaleWriteError extends Error {
+  constructor(
+    readonly rel: string,
+    readonly detail: string,
+    readonly alreadyWritten: string[],
+  ) {
+    super(
+      `refusing to write ${rel}: it changed on disk after this call read it (${detail}). ` +
+        `Nothing was overwritten. Re-read and retry.` +
+        (alreadyWritten.length ? ` ALREADY WRITTEN by this call: ${alreadyWritten.join(", ")} — that write stands.` : ""),
+    );
+    this.name = "StaleWriteError";
+  }
+}
+
+/** What moved, in terms a caller can act on without diffing the file itself. */
+function describeDrift(original: string, current: string): string {
+  const ol = original.split("\n");
+  const cl = current.split("\n");
+  let i = 0;
+  while (i < ol.length && i < cl.length && ol[i] === cl[i]) i++;
+  return (
+    `${ol.length} → ${cl.length} line(s), ${original.length} → ${current.length} byte(s)` +
+    (i < Math.max(ol.length, cl.length) ? `, first difference at line ${i + 1}` : "")
+  );
+}
+
+/**
+ * ⛔ COMPARE-AND-SWAP, AND THE RE-READ IS THE WHOLE POINT.
+ *
+ * This function used to compare the rendered text against `original` — the
+ * caller's IN-MEMORY snapshot from when it read — and then write. It never looked
+ * at the file again. Anything written in between was clobbered with no error, no
+ * diff, and nothing in the return value: `{ written: true }` came back for a
+ * write that had destroyed someone else's row.
+ *
+ * Measured before fixing: two writers taking the same original and both
+ * committing leave TWO rows where three should be, and the first writer's row is
+ * simply gone. This is not hypothetical — four processes write these documents
+ * (the aide from its own clone, `claim`, `land`, worker seats), and `land --write`
+ * ran six times in one afternoon against a queue the aide was editing.
+ *
+ * So the file is re-read immediately before the write and must still match what
+ * the caller read. On a mismatch this REFUSES — loudly, by throwing — and names
+ * what moved. A refused write is recoverable; a silent overwrite is not, and the
+ * loser of the race never learns it lost.
+ *
+ * What this does NOT claim: it is not a lock. Two processes can still interleave
+ * between this re-read and the `writeFileSync` a few microseconds later. The
+ * window goes from "the whole duration of the caller's work" — parsing, git
+ * calls, composing a line — down to two adjacent statements. That is a large
+ * reduction and not zero, and a lock is the stronger fix if this ever proves
+ * insufficient.
+ *
+ * EXPORTED FOR TESTS, deliberately. The race it guards is BETWEEN PROCESSES —
+ * the aide's clone, `claim`, `land` — and `landTool` runs synchronously from its
+ * read to its write, so no in-process test can interleave them. An end-to-end
+ * attempt passed identically with the guard removed, i.e. it proved nothing. A
+ * data-loss guard is worth a narrow export to be testable at the level it lives.
+ */
+export function writeDoc(
+  repo: string,
+  rel: string,
+  doc: WorkDoc,
+  original: string,
+  alreadyWritten: string[] = [],
+): { written: boolean; stamped: string[] } {
   const { text, stamped } = renderWorkDocForWrite(doc);
   if (text === original) return { written: false, stamped: [] };
-  writeFileSync(path.join(repo, rel), text);
+  const p = path.join(repo, rel);
+  const current = existsSync(p) ? readFileSync(p, "utf8") : "";
+  if (current !== original) {
+    throw new StaleWriteError(rel, describeDrift(original, current), alreadyWritten);
+  }
+  writeFileSync(p, text);
   return { written: true, stamped };
 }
 
@@ -151,6 +226,15 @@ export function summarize(text: string, max = 96): string {
  * the queue SAYS it waits on this", never "nothing waits on this".
  */
 export function noDownstream(items: QueueItem[]): QueueItem[] {
+  // ⚠ THE SECOND `!i.done` IN THIS FILE, AND IT IS DELIBERATE — the reconciliation
+  // asked for by ⟨q-7d2e04b8⟩. `nextUnblockedTool` passes an ALREADY-FILTERED
+  // list, so this re-filter is a no-op on that path; it is kept because this
+  // function is EXPORTED and its contract is "given items, which have nothing
+  // waiting on them", which must hold for a caller that hands it raw items.
+  //
+  // The two are not the same predicate and must not be merged: this one is
+  // `!done`, while the router's also subtracts the delivery join. Collapsing
+  // them would make an exported helper inherit a routing policy.
   const open = items.filter((i) => !i.done);
   const named = new Set<string>();
   for (const i of open) {
@@ -235,43 +319,53 @@ function boardHoldsItem(rows: WorkstreamsV1Row[], id: string, text: string): boo
  * Is this DONE entry the RECORD OF THIS ITEM CLOSING, rather than an entry that
  * merely MENTIONS it?
  *
- * `DONE.md` has no status cells, so the board's answer does not transfer and
- * this needs its own — and the item's own words for what it needs are that "the
- * canon rule must name its citations in a form the join can tell apart".
+ * ⛔ THE SIGIL ARM WAS REMOVED ⟨q-4a1e70c5⟩. It answered yes whenever `⟨id⟩`
+ * appeared ANYWHERE in an entry, on a census that had inverted: today
+ * `docs/DONE.md` carries more sigil mentions than bare ones, because `⟨id⟩` is the
+ * house spelling everything else teaches — so the COMPLIANT way to cite an item
+ * became the spelling that meant "delivered". Measured before removal, on 143
+ * open rows: ELEVEN false positives, ZERO independent true positives (every row
+ * it correctly excluded was already excluded by `!i.done`, which runs first), and
+ * a MISS on its own founding case — the row recorded as q-b4e7c209 had its work
+ * merged under a different row's citation, stayed `[ ]`, and was offered as top
+ * P1 twice.
+ *
+ * ⚠ THE SPELLING RULE DID NOT FAIL BECAUSE THE SPELLING FLIPPED. IT FAILED
+ * BECAUSE SPELLING WAS NEVER THE SIGNAL. Entries name item ids for several
+ * reasons this repo's own canon REQUIRES — a residual gap must cite its queue
+ * item — so no reading of that file separates a closure from a mention. Three
+ * replacements were measured and each was worse or equal: position does not
+ * discriminate (a known-false and a known-true entry are structurally identical,
+ * and only 2 of 252 entries lead with a sigil); `DoneEntry.id` is a derived `d-`
+ * id, not the item's; and the citation-slot tie `queue-done-loop` uses gives 23
+ * false positives, because open rows cite refs as EVIDENCE.
  *
- * MEASURED ON THE REAL `DONE.md` @17b72ff, which settles which form is which:
- * BRACKETED ids appear ZERO times; all ELEVEN id mentions are BARE, in prose,
- * inside backticks — every one of them a citation. So:
+ * ✅ WHAT SURVIVES IS THE COMPOSED-SUMMARY ARM, and it is a DIFFERENT EVIDENCE
+ * CLASS — the same distinction that keeps `boardHoldsItem`. It does not infer
+ * delivery from prose: it requires the entry to carry the item's own
+ * deterministically composed text, `summarize(item.text)`, which a VERB writes.
+ * A citation cannot accidentally satisfy it.
  *
- *   DELIVERY  the entry carries the item's own COMPOSED SUMMARY — the
- *             deterministic form `land` writes, `summarize(item.text)` — or it
- *             names the item in the recorded-id sigil `⟨id⟩`, which is this
- *             corpus's "this IS that item" marker (it is how QUEUE.md records
- *             identity, and a human writing it in DONE.md means exactly that).
- *   CITATION  a BARE `q-xxxxxxxx` anywhere. This is the form our own shipped
- *             canon (q-912a67e8) produces: a `DONE` entry may name a residual
- *             gap but MUST CITE A QUEUE ITEM for it. Obeying that rule wrote an
- *             open item's id into `DONE.md`, and the substring join read the
- *             citation as delivery — a canon rule and a code path in direct
- *             contradiction, where COMPLIANCE with the canon triggered the
- *             defect. LIVE on origin/main, not latent: the part (a) entry for
- *             q-507e80c4 cites it exactly this way while part (b) is open work.
+ * ⚠ IT IS CURRENTLY UNEXERCISED BY THIS REPO'S CORPUS — 0 of 143 open, 0 of 9
+ * closed — AND THAT IS NOT EVIDENCE THAT IT IS DEAD. The cause is practice, not
+ * code: rows here are closed with `land --write` and the composed line is then
+ * OVERWRITTEN with hand-written prose, so the structural record it would match is
+ * destroyed within the minute. **Do not re-derive "dead code" from another zero
+ * count.** Its input returns the moment a closing entry keeps what `land` wrote.
  *
- * Note what is deliberately NOT the rule: a shared PR ref. `land` never writes
- * the item id into `DONE.md` at all (the summary excludes the `⟨id⟩` token), and
- * the live entry for q-507e80c4 cites `#219` while the item's own line cites no
- * PR — so a ref-tie would have marked a genuinely-open part (b) as delivered.
+ * ⛔ AND WHAT IS NO LONGER GUARDED, because a removal that does not name its own
+ * cost is worse than the guard: A ROW WHOSE WORK MERGED UNDER ANOTHER ROW'S
+ * CITATION IS ELIGIBLE AGAIN, AND NOTHING IN `next_unblocked` WILL NOTICE.
+ * Accepted knowingly — the arm that claimed to cover it did not, on the one live
+ * instance it had. Closing such a row is coordinator discipline, not a predicate.
  */
 function doneRecordsDelivery(entries: DoneEntry[], id: string, text: string): boolean {
   const norm = (v: string) => v.replace(/\s+/g, " ").replace(/\*\*/g, "").trim();
   const target = norm(summarize(text)).replace(/…$/, "");
-  const sigil = `⟨${id}⟩`;
   return entries.some((e) => {
-    const t = String(e.text);
-    if (t.includes(sigil)) return true;
     // A leading recorded-id token is stripped before comparing, so an entry
     // written as `⟨id⟩ <summary>` and one written as `<summary>` agree.
-    const body = norm(t).replace(/^⟨q-[0-9a-f]{8}⟩\s*/, "");
+    const body = norm(String(e.text)).replace(/^⟨q-[0-9a-f]{8}⟩\s*/, "");
     return target.length >= 12 && body.startsWith(target);
   });
 }
@@ -296,6 +390,9 @@ export async function nextUnblockedTool(args: { project: string; repo?: string }
   const q = readDoc(repo, QUEUE_DOC);
   if (!q) return { ok: false as const, error: `no ${QUEUE_DOC} under '${repo}'` };
   const items = queueItemsOf(q.doc);
+  // The seam's own count of unticked rows — the number every axis must add back
+  // up to. Taken BEFORE any exclusion so it cannot inherit one.
+  const parsedOpen = items.filter((i) => !i.done).length;
 
   // ALREADY-DELIVERED ITEMS ARE NEVER RE-OFFERED, and `!i.done` alone does not
   // establish that.
@@ -313,17 +410,66 @@ export async function nextUnblockedTool(args: { project: string; repo?: string }
   // (Task 21.1) are what make this join reliable — with a content-hash id the
   // board row and the DONE entry stopped matching the moment anyone reworded
   // the item, which is how the memory was lost in the first place.
-  const delivered = new Set<string>();
+  // ⛔⛆ `delivered` IS A REASON, NOT AN ERASURE (⟨q-7d2e04b8⟩). This set used to
+  // be subtracted from `open` BEFORE any axis ran, so an item it excluded could
+  // appear on NO axis by construction — the one guarantee this verb's contract
+  // makes is that it never skips silently, and this was the one path that did.
+  //
+  // MEASURED on the live queue at `a032069`: the file held 143 open rows, the
+  // seam parsed all 143, and this verb reported `open: 129`. Its declared axes
+  // accounted for ONE. Fourteen rows were outside the router's universe and
+  // nothing in the response said so — invisible from the only seat that would
+  // notice, because a worker asking for the next item still gets a real one.
+  //
+  // ⚠ THE REASON IS NOW CARRIED, so exclusion and explanation cannot drift apart:
+  // a row is excluded BY a named cause, and the cause is what gets reported.
+  const deliveredBy = new Map<string, "board" | "done">();
   const doneDoc = readDoc(repo, DONE_DOC);
   const boardDoc = readDoc(repo, BOARD_DOC);
   const boardText = boardDoc?.text ?? "";
   const doneEntries = doneDoc ? doneEntriesOf(doneDoc.doc) : [];
   const boardRows = boardDoc ? workstreamsV1RowsOf(boardDoc.doc) : [];
   for (const i of items) {
-    if (boardHoldsItem(boardRows, i.id, String(i.text)) || doneRecordsDelivery(doneEntries, i.id, String(i.text))) delivered.add(i.id);
+    if (i.done) continue; // already off `open` by the checkbox; not an exclusion this axis owns
+    // Board first, and the order is load-bearing for the REPORT rather than the
+    // routing: both causes exclude, but a live 🚧 row is a different remedy
+    // (wait, or ask its owner) from a landed delivery (close the row).
+    if (boardHoldsItem(boardRows, i.id, String(i.text))) deliveredBy.set(i.id, "board");
+    else if (doneRecordsDelivery(doneEntries, i.id, String(i.text))) deliveredBy.set(i.id, "done");
   }
 
-  const open = items.filter((i) => !i.done && !delivered.has(i.id));
+  const open = items.filter((i) => !i.done && !deliveredBy.has(i.id));
+
+  // THE AXIS THE SUBTRACTION USED TO SKIP. Every row absent from `open` for this
+  // reason is named here, INCLUDING correctly-delivered ones: a correct exclusion
+  // reported silently is the same defect as an incorrect one.
+  const delivered = items
+    .filter((i) => !i.done && deliveredBy.has(i.id))
+    .map((i) => ({ item: keyOf(i), id: i.id, reason: deliveredBy.get(i.id)! }));
+
+  // ⛔⛆ A DUPLICATED ID IS A SILENT DOUBLE-EXCLUSION, AND IT IS THIS ROW'S OWN
+  // DEFECT ONE LEVEL DOWN. Queue ids are STABLE, derived from the row's text, so
+  // two rows with identical text carry the SAME id — verified: `- [ ] (P1) an
+  // identical row` twice yields `q-c9f3ded8` twice.
+  //
+  // Everything downstream is keyed by id, so ONE delivery record then excludes
+  // BOTH rows: measured on a fixture, a single DONE entry took `parsedOpen: 3`
+  // to `offered: 1`. The accounting still reconciles — both are named — so the
+  // self-check above CANNOT catch it, which is exactly why it needs its own axis
+  // rather than a flag on `reconciles`.
+  //
+  // ⭐ WHY THIS AXIS AND NOT A COUNT: a MISSING row can always be argued to be a
+  // filter working as designed; a row reported TWICE cannot be anything but the
+  // accounting. It is the one symptom here that does not rest on a count.
+  const idCounts = new Map<string, number>();
+  for (const i of items) if (!i.done) idCounts.set(i.id, (idCounts.get(i.id) ?? 0) + 1);
+  const duplicateIds = [...idCounts.entries()]
+    .filter(([, n]) => n > 1)
+    .map(([id, rows]) => ({
+      id,
+      rows,
+      why: `${rows} open rows share the id ${id} — stable ids are derived from row TEXT, so identical rows collide. Every axis here is keyed by id, so one delivery record excludes all ${rows}. Reword one row to separate them.`,
+    }));
   const ranked = open
     .map((i, idx) => ({ i, idx }))
     .sort((a, b) => (PRIORITY_ORDER[a.i.priority ?? "P3"] ?? 3) - (PRIORITY_ORDER[b.i.priority ?? "P3"] ?? 3) || a.idx - b.idx);
@@ -390,6 +536,26 @@ export async function nextUnblockedTool(args: { project: string; repo?: string }
     ok: true as const,
     project: args.project,
     open: open.length,
+    // ⛔ THE SELF-CHECK, because the defect this replaces was a NUMBER NOTHING
+    // EXPLAINED and the only thing that ever caught it was someone counting the
+    // file by hand. `parsedOpen` is every unticked row the seam sees; `offered`
+    // is what routing considered; `excluded` is what the axes account for. When
+    // `reconciles` is false, rows have left the universe with no named cause —
+    // the exact condition that was previously unobservable from the response.
+    //
+    // ⚠ IT REPORTS RATHER THAN THROWS: a router that refuses to hand out work
+    // because its own bookkeeping is off strands every lane, which is worse than
+    // the miscount. The caller gets a real item AND the discrepancy.
+    accounting: {
+      parsedOpen,
+      offered: open.length,
+      excluded: delivered.length,
+      reconciles: parsedOpen === open.length + delivered.length,
+    },
+    // A NAMED AXIS, not a subtraction. See the comment at `deliveredBy`.
+    delivered,
+    // A ROW REPORTED TWICE CANNOT BE A FILTER WORKING AS DESIGNED. See above.
+    duplicateIds,
     next: pick ? { id: pick.id, priority: pick.priority, text: pick.text } : null,
     skipped,
     // A SEPARATE AXIS from `skipped` (blocked) — this is "not this caller's
@@ -406,6 +572,12 @@ export async function nextUnblockedTool(args: { project: string; repo?: string }
       ...skipped.map((s) => `⏭ skipped — blocked by ${s.blockedBy}`),
       ...notClaimable.map((s) => `⏭ skipped — not worker-claimable (${s.sweepTag})`),
       ...awaitingDecision.map((a) => `⏸ skipped — awaiting decision from ${a.who} (${a.id})`),
+      ...duplicateIds.map((d) => `⚠ ${d.rows} open rows share the id ${d.id} — one record excludes all of them`),
+      ...delivered.map((d) =>
+        d.reason === "board"
+          ? `⏭ not offered — already on the board (${d.id})`
+          : `⏭ not offered — delivery recorded in DONE.md (${d.id})`,
+      ),
     ],
     // A SEPARATE AXIS, deliberately. See noDownstream().
     noDownstream: undiscriminating
@@ -789,9 +961,14 @@ export async function landTool(args: {
   // an entry added to the record model renders through the pinned glyph contract.
   const wrote: string[] = [];
   let stampedNotSupplied: string[] = [];
+  // A stale-base refusal is a RESULT, not a crash: the caller needs to know
+  // nothing was clobbered, what moved, and what this call had already written
+  // before it stopped. Thrown inside writeDoc so it cannot be ignored; converted
+  // here so the verb still answers.
+  try {
   if (args.write) {
     if (queueChanged) {
-      const w = writeDoc(repo, QUEUE_DOC, q.doc, q.text);
+      const w = writeDoc(repo, QUEUE_DOC, q.doc, q.text, wrote);
       if (w.written) wrote.push(QUEUE_DOC);
       // Rows stamped that this call did not ask to touch. `queueItemId` is the
       // one item the caller supplied, so anything else here is a row that
@@ -816,8 +993,18 @@ export async function landTool(args: {
         return { ok: false as const, error: `the composed DONE line does not parse as done.v1: ${doneLine}` };
       }
       block.entries.push(entry);
-      if (writeDoc(repo, DONE_DOC, d.doc, d.text).written) wrote.push(DONE_DOC);
+      if (writeDoc(repo, DONE_DOC, d.doc, d.text, wrote).written) wrote.push(DONE_DOC);
+    }
+  }
+  } catch (e) {
+    if (e instanceof StaleWriteError) {
+      return {
+        ok: false as const,
+        error: e.message,
+        staleWrite: { doc: e.rel, drift: e.detail, alreadyWritten: e.alreadyWritten },
+      };
     }
+    throw e;
   }
 
   // 6.2 — EMIT ONLY AS A CONSEQUENCE OF THE RECORD CHANGING.

package/src/tools/registry.ts

@@ -1,4 +1,5 @@
 import { detachAgentTool } from "./transport.js";
+import { isLocallyProbeable, isRemoteTmuxKind, targetOf } from "../transports/index.js";
 import { readAway, secondCoordinatorRefusal } from "./away.js";
 import { randomUUID } from "node:crypto";
 import { existsSync, openSync, watch } from "node:fs";
@@ -419,6 +420,36 @@ export async function listAgentsTool() {
   return { agents, evicted, proseOnly };
 }
 
+/**
+ * EVERY marker on disk, READ-ONLY.
+ *
+ * `loadLiveTransports` below deletes any marker it judges not-live, which is
+ * right for the delivery paths that own that garbage collection and WRONG for a
+ * diagnostic: `capabilities` must be able to describe the fleet without changing
+ * it. Using the reaping loader from a read-only verb made a mixed-fleet check
+ * delete the very marker it was reporting (caught by its own test — the second
+ * disagreeing agent vanished between write and read).
+ *
+ * Liveness is reported per marker rather than filtered on, because a STALE marker
+ * naming a different transport is more alarming than a live one, not less: it is
+ * a seat that may come back on the wrong transport. Filtering it out would make
+ * the remote kind — whose liveness is heartbeat-based and therefore absent
+ * without a registry entry — systematically invisible to this check.
+ */
+export async function readAllTransportMarkers(): Promise<
+  { marker: TransportMarker; live: boolean }[]
+> {
+  const out: { marker: TransportMarker; live: boolean }[] = [];
+  const reg = await readJson<AgentRegistry>(AGENTS_FILE, {});
+  const now = Date.now();
+  for (const fname of await listTransportFiles()) {
+    const marker = await readJson<TransportMarker | null>(path.join(TRANSPORT_DIR, fname), null);
+    if (!marker) continue; // unparseable: nothing to attribute, and not ours to delete
+    out.push({ marker, live: isMarkerLive(marker, reg, now) });
+  }
+  return out;
+}
+
 export async function loadLiveTransports(): Promise<Map<string, TransportMarker>> {
   const out = new Map<string, TransportMarker>();
   const reg = await readJson<AgentRegistry>(AGENTS_FILE, {});
@@ -439,7 +470,7 @@ export async function loadLiveTransports(): Promise<Map<string, TransportMarker>
 // remote markers (tmux-push-remote, pid 0 on a foreign host) can't be — so we
 // trust the registry heartbeat the remote pusher refreshes (within STALE_MS).
 export function isMarkerLive(marker: TransportMarker, reg: AgentRegistry, now: number): boolean {
-  if (marker.transport === "tmux-push-remote") {
+  if (isRemoteTmuxKind(marker.transport)) {
     const entry = reg[marker.agentId];
     return !!entry && now - entry.lastHeartbeat < STALE_MS;
   }
@@ -523,13 +554,13 @@ export async function liveClaimEvidence(agentId: string, now: number): Promise<C
   if (marker && isMarkerLive(marker, reg, now)) {
     markerLive = true;
     reasons.push(
-      `live ${marker.transport} transport (pid ${marker.pid}${marker.tmuxTarget ? `, pane ${marker.tmuxTarget}` : ""})`,
+      `live ${marker.transport} transport (pid ${marker.pid}${targetOf(marker) ? `, pane ${targetOf(marker)}` : ""})`,
     );
     if (
-      marker.transport === "tmux-push" &&
-      marker.tmuxTarget &&
+      isLocallyProbeable(marker.transport) &&
+      targetOf(marker) &&
       process.env.TMUX_PANE &&
-      marker.tmuxTarget === process.env.TMUX_PANE
+      targetOf(marker) === process.env.TMUX_PANE
     ) {
       samePane = true;
     }

package/src/tools/shared.ts

@@ -88,42 +88,18 @@ export type AgentEntry = {
   proseOnly?: { since: number; reason?: string };
 };
 
-export type TransportMarker = {
-  agentId: string;
-  transport: string;
-  pid: number;
-  tmuxTarget?: string;
-  since: number;
-  // Remote pushers run on a different machine; the local pid is meaningless,
-  // so we tag the host and use heartbeat-based liveness instead of pidAlive.
-  host?: string;
-  // mtime of the pusher script the daemon loaded into memory at spawn time
-  // (epoch ms). When the on-disk script is upgraded but the daemon isn't
-  // restarted, doctor() compares this to the current mtime to flag a stale
-  // pusher — the class of bug that silently dropped /clear /compact in v0.8.1.
-  // Absent on markers written by older versions (treated as "unknown, skip").
-  scriptMtime?: number;
-  // Build identity (newest dist mtime, sampled at that server's module load)
-  // of the MCP server whose attach_agent stamped this marker. A marker
-  // stamped by a server predating the current on-disk build was written by
-  // attach/stamp logic the rebuild replaced — doctor's provenance check flags
-  // it for a session restart + re-attach. Absent on markers written by older
-  // versions (treated as "unknown, skip", deliberately mirroring scriptMtime).
-  serverBuildMtime?: number;
-  // Does this transport carry ROOM traffic, or DMs only?
-  //
-  // A pusher started with `--no-room` delivers inbox messages and nothing
-  // else, and until this field existed the marker looked identical to a full
-  // one — so `status` said `attached: true` and an agent sat with its room
-  // feed off while every reading said healthy. That is how worker-2 missed
-  // its channel traffic.
-  //
-  // ABSENT MEANS UNKNOWN, NEVER "ON" — deliberately mirroring scriptMtime and
-  // serverBuildMtime above. A marker from an older pusher cannot tell us, and
-  // reporting an unasked question as full capability is the defect this field
-  // exists to remove.
-  rooms?: boolean;
-};
+/**
+ * THE MARKER TYPE NOW LIVES IN THE SEAM, and is re-exported here so the dozens
+ * of `from "./shared.js"` imports keep working.
+ *
+ * It was defined here, and the transport extraction gave it a second definition
+ * in `transports/types.ts` — two structurally-similar types that a consumer
+ * could satisfy while missing a field, which is the duplication this task exists
+ * to remove rather than double. One definition, one home: the transport layer,
+ * which is what the field describes. The nine fields and their comments moved
+ * with it verbatim, including `target`'s dual-write rule.
+ */
+export type { TransportMarker } from "../transports/types.js";
 
 /**
  * How to REPORT a transport's room capability.

package/src/tools/stall.ts

@@ -15,6 +15,7 @@
  * from "nothing ran". A check that only speaks when it fires cannot be told from
  * a broken one.
  */
+import { isLocallyProbeable } from "../transports/index.js";
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { execFileSync } from "node:child_process";
 import path from "node:path";
@@ -311,7 +312,7 @@ export async function stallCheckTool(args: { repo?: string; stallMinutes?: numbe
       // agent with no transport, or a REMOTE one where the heartbeat genuinely
       // is the liveness mechanism, still HITs on a dead heartbeat.
       const marker = liveTransports.get(agentId);
-      if (age > limit && marker && marker.transport === "tmux-push") {
+      if (age > limit && marker && isLocallyProbeable(marker.transport)) {
         unmeasurable.push({
           agentId,
           value: marker.transport,