trantor 0.17.69 → 0.17.72

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.17.69",
+  "version": "0.17.72",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/adopt.mjs

@@ -18,9 +18,10 @@
 import { readFileSync, writeFileSync, existsSync, readdirSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
-import { hostId } from "../lib/project.mjs";
+import { hostId, DEFAULT_HUB_URL } from "../lib/project.mjs";
 import { loadOrCreate, signRequest } from "../lib/identity.mjs";
 import { sfetchJson } from "../lib/signed-fetch.mjs";
+import { scan } from "../lib/splitbrain.mjs";
 
 const argv = process.argv.slice(2);
 const PROJECT = argv.find(a => !a.startsWith("--")) || "";
@@ -104,12 +105,44 @@ try {
   config.hubs[PROJECT] = TARGET;
   writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2) + "\n");
   console.log(`pinned   : ${PROJECT} → ${TARGET}`);
+
+  // TELL the stale sessions, don't just print at a human who may never see this terminal again.
+  // A live session holds its hub URL for its whole life: its MCP server resolved the route at
+  // boot and nothing re-reads config.json. So the moment the pin is written, every one of these
+  // is recording onto a hub nobody reads any more — the exact split-brain crebral-health spent
+  // two sessions diagnosing. They are still listening on the OLD hub, so that is where the
+  // notice has to go.
   if (livePeers.length) {
-    console.log(`\n⚠ live sessions still route to the OLD hub until restarted:`);
+    const notice = `📦 ${PROJECT} has MOVED to ${TARGET}. You are still bound to ${LOCAL}, so your cards and messages now land on a hub nobody is reading. RESTART to pick up the pin — crew seats: \`trantor down && trantor up\` · Claude sessions: restart the session.`;
+    let told = 0;
+    for (const [session] of livePeers) {
+      try {
+        await sfetchJson(`${LOCAL}/send`, { identity: ownerId, payload: { from: owner, to: session, project: PROJECT, text: notice }, signal: AbortSignal.timeout(8000) });
+        told++;
+      } catch (e) { console.log(`  ⚠ could not notify ${session}: ${e.message}`); }
+    }
+    // …and once to the room, for anything live that never registered as a peer.
+    try { await sfetchJson(`${LOCAL}/send`, { identity: ownerId, payload: { from: owner, to: "all", project: PROJECT, text: notice }, signal: AbortSignal.timeout(8000) }); } catch {}
+    console.log(`\n⚠ ${livePeers.length} live session(s) still route to the OLD hub — told ${told} of them to restart:`);
     for (const [s] of livePeers) console.log(`    ${s}`);
     console.log(`  crew seats: trantor down && trantor up · Claude sessions: restart them when convenient.`);
   }
   console.log(`\n✓ adopted. New sessions on ${PROJECT} land on ${TARGET}.`);
+
+  // Prove the move actually landed as one hub, rather than trusting that it did. A migration is
+  // precisely the moment a project is most likely to end up living in two places at once.
+  try {
+    const { findings, blind } = await scan(config, ownerId, { defaultUrl: DEFAULT_HUB_URL, timeoutMs: 6000 });
+    const mine = findings.filter(f => f.project === PROJECT);
+    if (mine.length) {
+      console.log(`\n⚠ split-brain check on ${PROJECT}:`);
+      for (const f of mine) { console.log(`    ${f.message}`); console.log(`      → ${f.fix}`); }
+    } else if (blind.length) {
+      console.log(`\nsplit-brain check: partial — could not read ${blind.map(b => b.url).join(", ")}`);
+    } else {
+      console.log(`split-brain check: clean — ${PROJECT} is live on one hub only.`);
+    }
+  } catch {}
 } catch (e) {
   console.error(`\n✗ adopt failed: ${e.message}`);
   console.error("nothing was pinned — routing is unchanged.");

package/bin/crew-runner.mjs

@@ -9,7 +9,7 @@
 // agent arrives it RESUMES the CLI session (native resume = full context kept) with that
 // message as the prompt. The model just works and ends its turn; the runner does the rest.
 import { execSync, spawnSync } from "node:child_process";
-import { readFileSync, existsSync, appendFileSync } from "node:fs";
+import { readFileSync, writeFileSync, unlinkSync, existsSync, appendFileSync } from "node:fs";
 import { join, basename } from "node:path";
 import { homedir } from "node:os";
 import { resolveProject, resolveHub } from "../lib/project.mjs";
@@ -174,6 +174,39 @@ let consecFails = 0;
 let lastErrText = "";
 const ERRF = join(homedir(), ".agent-bus", `err-${AGENT}-${PROJ}.txt`);
 
+// ---- undelivered wake messages (the runner owns delivery, not the hub) ----
+// The hub hands a message out exactly ONCE: the poll cursor advances the instant we read it, and
+// nothing ever re-fires. So a turn that died — API outage, quota wall, crashed CLI — used to take
+// its wake message down with it, and an escalation addressed to this seat was gone forever with
+// no trace anywhere. The queue below makes delivery the runner's job: a message is not consumed
+// until a turn actually exits 0. It survives a runner restart on disk, retries on its own backoff
+// so a silent bus still gets it through, and says how many are outstanding every time it reports.
+const PENDF = join(homedir(), ".agent-bus", `pending-${AGENT}-${PROJ}.json`);
+// A cap, so a long outage cannot grow the queue without bound. Overflow drops the OLDEST and says
+// so on the bus — a silent drop is the exact failure this whole mechanism exists to end.
+const PENDING_MAX = 50;
+// Backoff between redelivery attempts. Starts fast (a blip clears in 30s) and lands at 15 minutes,
+// which is the cadence for "this seat is properly down" rather than a retry storm against a hub
+// that is already refusing us.
+// TRANTOR_RETRY_MS (comma-separated ms) shortens the ladder so the redelivery drill can exercise
+// a real backoff in seconds instead of waiting out the production one.
+const RETRY_MS = (() => {
+  const custom = String(process.env.TRANTOR_RETRY_MS || "").split(",").map(Number).filter(n => Number.isFinite(n) && n >= 0);
+  return custom.length ? custom : [30e3, 60e3, 120e3, 300e3, 900e3];
+})();
+function savePending(wake, bcast) {
+  try {
+    if (!wake.length && !bcast.length) { try { unlinkSync(PENDF); } catch {} return; }
+    writeFileSync(PENDF, JSON.stringify({ agent: AGENT, project: PROJ, ts: Date.now(), wake, bcast }));
+  } catch {}
+}
+function loadPending() {
+  try {
+    const j = JSON.parse(readFileSync(PENDF, "utf8"));
+    return { wake: Array.isArray(j.wake) ? j.wake : [], bcast: Array.isArray(j.bcast) ? j.bcast : [] };
+  } catch { return { wake: [], bcast: [] }; }
+}
+
 function classifyFailure(exit, errText) {
   const t = (errText || "").toLowerCase();
   if (exit === 127) return "missing-cli";
@@ -184,7 +217,7 @@ function classifyFailure(exit, errText) {
   return "crashed";
 }
 
-async function reportFailure(exit, trigger) {
+async function reportFailure(exit, trigger, undelivered = 0) {
   consecFails++;
   const reason = classifyFailure(exit, lastErrText);
   const down = consecFails >= 2;
@@ -193,9 +226,12 @@ async function reportFailure(exit, trigger) {
   const hint = reason === "exhausted" ? " — needs `trantor swap`"
     : reason === "auth" ? " — check credentials"
     : reason === "missing-cli" ? " — CLI not on PATH" : "";
+  // The count of messages this seat is HOLDING is the operator-actionable half of a failure: a
+  // crashed pulse costs nothing, a crashed turn sitting on three escalations is someone waiting.
+  const held = undelivered ? ` · holding ${undelivered} undelivered message${undelivered > 1 ? "s" : ""} (will retry)` : "";
   const text = down
-    ? `🛑 ${SESSION} DOWN — ${consecFails} consecutive failures (${reason}, exit ${exit})${hint}`
-    : `⚠️ ${SESSION} turn FAILED (${trigger}, exit ${exit} · ${reason})${hint}`;
+    ? `🛑 ${SESSION} DOWN — ${consecFails} consecutive failures (${reason}, exit ${exit})${hint}${held}`
+    : `⚠️ ${SESSION} turn FAILED (${trigger}, exit ${exit} · ${reason})${hint}${held}`;
   await api("/send", { from: SESSION, to: "all", text, project: PROJ }).catch(() => {});
   cmuxStatus(down ? "down" : "error", "#ef6a6a", "alert", { alert: true, priority: 90 }); cmuxLog(`turn failed: ${reason} (exit ${exit})`, "error");
   log(`\x1b[31mreported failure to bus: ${reason} (exit ${exit})\x1b[0m`);
@@ -278,9 +314,18 @@ async function loadLessons() {
     });
   } catch {}
 
-  let pendingBcast = [];
+  // Wake messages this seat has PULLED off the bus but not yet worked successfully, plus the
+  // broadcasts batched behind them. Restored from disk first: a runner that was killed mid-turn
+  // (or a machine that rebooted) still owes those messages, and the hub will never send them again.
+  const restored = loadPending();
+  let pendingWake = restored.wake;
+  let pendingBcast = restored.bcast;
+  let retryAt = 0;            // 0 = deliver at the next opportunity
+  let deliveryFails = 0;      // consecutive failed attempts at the SAME pending batch
+  if (pendingWake.length) log(`\x1b[33m${pendingWake.length} message(s) survived from a previous run — redelivering\x1b[0m`);
+
   const ec0 = runTurn(KICKOFF + LESSONS, true, "kickoff");
-  if (ec0) await reportFailure(ec0, "kickoff");   // a failed kickoff = the "fired up, died, nobody knew" case
+  if (ec0) await reportFailure(ec0, "kickoff", pendingWake.length);   // a failed kickoff = the "fired up, died, nobody knew" case
   let lastTurnAt = Date.now();
   if (PULSE_MS) log(`pulse armed — mission re-read every ${Math.round(PULSE_MS / 1000)}s (${MISSION_FILE})`);
   log(`parked — long-polling the bus as ${SESSION} (free; this poll is also the heartbeat)`);
@@ -295,9 +340,15 @@ async function loadLessons() {
       log("parked — waiting for the next message or pulse");
       continue;
     }
-    // cap the long-poll hold so a due pulse never waits out a full silent 280s window
-    const holdS = PULSE_MS
-      ? Math.max(5, Math.min(280, Math.ceil((PULSE_MS - (Date.now() - lastTurnAt)) / 1000)))
+    // A due REDELIVERY runs before we go back to waiting — during an outage the bus is silent by
+    // definition, so the retry timer is the only thing that will ever move these messages.
+    if (pendingWake.length && Date.now() >= retryAt) { await deliverWake(); continue; }
+    // cap the long-poll hold so neither a due pulse nor a due redelivery waits out a silent 280s window
+    const due = [];
+    if (PULSE_MS) due.push(PULSE_MS - (Date.now() - lastTurnAt));
+    if (pendingWake.length) due.push(retryAt - Date.now());
+    const holdS = due.length
+      ? Math.max(5, Math.min(280, Math.ceil(Math.min(...due) / 1000)))
       : 280;
     let msgs = [];
     try {
@@ -320,15 +371,51 @@ async function loadLessons() {
     const bcast = msgs.filter(m => m.to === "all" && !mentions.includes(m));
     pendingBcast.push(...bcast);                      // wake-policy: plain broadcasts batch, they don't wake
     const wake = [...direct, ...mentions];
-    if (!wake.length) { if (bcast.length) log(`${bcast.length} broadcast(s) batched (no wake) — ${pendingBcast.length} pending`); continue; }
+    if (!wake.length) { if (bcast.length) { savePending(pendingWake, pendingBcast); log(`${bcast.length} broadcast(s) batched (no wake) — ${pendingBcast.length} pending`); } continue; }
+    // Queue BEFORE running the turn, and persist immediately. Everything between here and a clean
+    // exit 0 — the CLI dying, the machine losing power — now leaves a record of what this seat owes.
+    pendingWake.push(...wake);
+    if (pendingWake.length > PENDING_MAX) {
+      const dropped = pendingWake.splice(0, pendingWake.length - PENDING_MAX);
+      log(`\x1b[31mundelivered queue overflowed — dropped ${dropped.length} oldest message(s)\x1b[0m`);
+      await api("/send", { from: SESSION, to: "all", project: PROJ,
+        text: `⚠️ ${SESSION} dropped ${dropped.length} undelivered message(s) — queue hit its ${PENDING_MAX} cap during a failure streak` }).catch(() => {});
+    }
+    savePending(pendingWake, pendingBcast);
+    // Respect an active backoff: a new message during an outage joins the batch, it does not
+    // reset the clock and hammer a CLI that is already failing.
+    if (Date.now() < retryAt) { log(`queued — ${pendingWake.length} undelivered, next attempt in ${Math.max(0, Math.round((retryAt - Date.now()) / 1000))}s`); continue; }
+    await deliverWake();
+    log("parked — waiting for the next message");
+  }
+
+  // Run the pending batch. The messages are cleared ONLY on exit 0; any other outcome leaves them
+  // queued, on disk, with a backoff — which is the whole point of the change.
+  async function deliverWake() {
+    const wake = pendingWake;
     const ctx = pendingBcast.length ? `\nFYI broadcasts since your last turn (context only):\n${pendingBcast.map(m => `[${m.from} -> all]: ${m.text}`).join("\n")}\n` : "";
-    pendingBcast = [];
     const lines = wake.map(m => `[${m.from}${m.to === "all" ? " -> all (mentions you)" : ""}]: ${m.text}`).join("\n");
-    const prompt = `NEW BUS MESSAGE${wake.length > 1 ? "S" : ""} for you:\n${lines}\n${ctx}\nAct on what's addressed to you, then end your turn.\n\n${RULES}`;
+    // Say plainly that this is a second look. Without it the model re-reads an old escalation as
+    // brand new and can redo work it already half-did before the turn died.
+    const again = deliveryFails
+      ? `\n(REDELIVERY, attempt ${deliveryFails + 1} — an earlier turn failed before acting on ${wake.length > 1 ? "these" : "this"}. Check what you already did before repeating it.)\n`
+      : "";
+    const prompt = `NEW BUS MESSAGE${wake.length > 1 ? "S" : ""} for you:\n${lines}\n${ctx}${again}\nAct on what's addressed to you, then end your turn.\n\n${RULES}`;
     await loadLessons();
-    const ec = runTurn(prompt + LESSONS, false, direct.length ? "direct message" : "@mention");
-    if (ec) await reportFailure(ec, "message"); else await reportHealthy();
+    const trigger = wake.some(m => m.to === SESSION) ? "direct message" : "@mention";
+    const ec = runTurn(prompt + LESSONS, false, deliveryFails ? `${trigger} (redelivery)` : trigger);
+    if (ec) {
+      deliveryFails++;
+      const wait = RETRY_MS[Math.min(deliveryFails - 1, RETRY_MS.length - 1)];
+      retryAt = Date.now() + wait;
+      savePending(pendingWake, pendingBcast);
+      await reportFailure(ec, "message", pendingWake.length);
+      log(`\x1b[31m${pendingWake.length} message(s) still UNDELIVERED — next attempt in ${Math.round(wait / 1000)}s\x1b[0m`);
+    } else {
+      pendingWake = []; pendingBcast = []; deliveryFails = 0; retryAt = 0;
+      savePending([], []);
+      await reportHealthy();
+    }
     lastTurnAt = Date.now();
-    log("parked — waiting for the next message");
   }
 })();

package/bin/doctor.mjs

@@ -8,6 +8,9 @@ import { join, dirname } from "node:path";
 import { homedir } from "node:os";
 import { execSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
+import { resolveProject, resolveHub, DEFAULT_HUB_URL } from "../lib/project.mjs";
+import { loadOrCreate } from "../lib/identity.mjs";
+import { scan } from "../lib/splitbrain.mjs";
 
 const H = homedir();
 const ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
@@ -39,7 +42,11 @@ say("TRANTOR DOCTOR\n");
 section("core");
 Number(process.versions.node.split(".")[0]) >= 18 ? ok(`node ${process.versions.node}`) : warn(`node ${process.versions.node} too old`, "install node >= 18");
 const cfg = read(join(H, ".agent-bus", "config.json")) || {};
-const HUB = process.env.RELAY_URL || cfg.url || "http://127.0.0.1:4477";
+// The hub THIS directory's project actually routes to — pins first. Reading only the global
+// default meant the doctor could report a healthy local hub while every session in the project
+// was talking to netcup, which is exactly the blindness the routing section below exists to end.
+const PROJECT = resolveProject(process.cwd());
+const HUB = resolveHub(PROJECT);
 try {
   const h = await (await fetch(`${HUB}/health`, { signal: AbortSignal.timeout(2000) })).json();
   ok(`hub up at ${HUB} (${h.peers} peers known)`);
@@ -56,6 +63,30 @@ if (pkg?.version) {
   tooOld ? warn(`trantor v${pkg.version} too old — heartbeat/presence requires v0.17.0+`, "npm update -g trantor") : ok(`trantor v${pkg.version}`);
 } else warn("could not read trantor version", "reinstall: npm install -g trantor");
 
+// ── hub routing: is any project split across two hubs? ───────────────────────────────────────
+// Cards, messages and collision detection only work over ONE hub. A project split across two
+// breaks silently — every seat reports healthy and half the work records where nobody looks.
+section("hub routing");
+{
+  const pin = (cfg.hubs || {})[PROJECT] || "";
+  say(`  ${PROJECT} → ${HUB}${pin ? "  (pinned)" : process.env.RELAY_URL ? "  (RELAY_URL override)" : "  (unpinned — falls back to the default)"}`);
+  const owner = String(cfg.ownerIdentity || "");
+  // Unsigned, an enforce hub answers "signature required" and a full hub reads as deserted. Sign
+  // as the owner when we have one, and say plainly when we cannot rather than guessing.
+  const identity = owner ? (() => { try { return loadOrCreate(owner, "human"); } catch { return null; } })() : null;
+  if (!identity) note("no owner identity in config — hubs are probed UNSIGNED, so an enforce hub will refuse the read");
+  let scanned = null;
+  try { scanned = await scan(cfg, identity, { defaultUrl: DEFAULT_HUB_URL, timeoutMs: 6000 }); }
+  catch (e) { note(`split-brain check could not run (${e?.message || e})`); }
+  if (scanned) {
+    REPORT.splitbrain = { findings: scanned.findings, blind: scanned.blind, checked: scanned.checked };
+    for (const b of scanned.blind) warn(`hub ${b.url} could not be read — ${b.reason}`, "detection is PARTIAL until this hub answers; a split hiding behind it will not be reported");
+    for (const f of scanned.findings) f.severity === "warn" ? warn(f.message, f.fix) : warn(`SPLIT-BRAIN — ${f.message}`, f.fix);
+    if (!scanned.findings.length && !scanned.blind.length) ok(`no split-brain — every live project sits on exactly one hub (${scanned.checked} hub${scanned.checked === 1 ? "" : "s"} cross-checked)`);
+    else if (!scanned.findings.length) ok(`no split-brain among the ${scanned.checked} hub${scanned.checked === 1 ? "" : "s"} that answered`);
+  }
+}
+
 // claude plugin
 section("claude (the orchestrator)");
 if (!has("claude")) warn("claude CLI not found", "install Claude Code: https://claude.com/claude-code");

package/bin/focus-title.mjs

@@ -0,0 +1,57 @@
+#!/usr/bin/env node
+// trantor focus-title — give a session's focus card a title a human can skim, written by a CHEAP model.
+//
+//   node bin/focus-title.mjs --id <cardId> --hub <url> --prompt-file <path> [--project <p>]
+//
+// The focus card is titled from the user's raw prompt by a regex in hooks/prompt-focus.mjs. That is
+// the right thing to do IN the turn — a hook that waits on an LLM delays every prompt the user
+// types — but a raw prompt makes a poor board card: it is long, it is addressed to Claude rather
+// than describing work, and half of it is context the board does not need. So the hook posts the
+// heuristic title instantly and hands the rewrite to this, DETACHED: the card is on the board in
+// milliseconds and gets its readable line a few seconds later.
+//
+// Economics (the Scrooge doctrine): one `-t summarize -d easy` call, only for prompts the heuristic
+// actually mangles — the hook does not even spawn this for a short, already-clear prompt. The
+// result lands in `summary`, the same field the board already prefers over `title`, and the hub
+// clears it on every refocus so a stale line can never shadow live work.
+import { execSync, spawnSync } from "node:child_process";
+import { readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { loadOrCreate } from "../lib/identity.mjs";
+import { sfetchJson } from "../lib/signed-fetch.mjs";
+
+const argv = process.argv.slice(2);
+const val = (k) => { const i = argv.indexOf(`--${k}`); return i >= 0 ? (argv[i + 1] ?? "") : ""; };
+const ID = Number(val("id"));
+const HUB = val("hub");
+const PROMPT_FILE = val("prompt-file");
+if (!ID || !HUB || !PROMPT_FILE) process.exit(0);          // nothing to do; never a visible failure
+
+const scroogeBin = () => process.env.SCROOGE_BIN
+  || (() => { try { return execSync("command -v scrooge", { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim(); } catch { return ""; } })()
+  || (existsSync(new URL("../engine/bin/scrooge", import.meta.url)) ? new URL("../engine/bin/scrooge", import.meta.url).pathname : "");
+
+try {
+  const raw = readFileSync(PROMPT_FILE, "utf8").replace(/\s+/g, " ").trim();
+  if (!raw) process.exit(0);
+  const bin = scroogeBin();
+  if (!bin) process.exit(0);                               // no economics engine installed — heuristic title stands
+
+  const ask = `Rewrite this message to an AI coding assistant as a Kanban card title: what the WORK is, action first, in plain words a human skims. At most 70 characters. No quotes, no trailing period, no "the user wants". If it is several requests, name the main one. Return ONLY the title.
+
+${raw.slice(0, 1800)}`;
+  const res = spawnSync(bin, ["-t", "summarize", "-d", "easy"], { input: ask, encoding: "utf8", timeout: 60000 });
+  if (res.error || !res.stdout) process.exit(0);
+  // A cheap model sometimes wraps or explains. Take the first non-empty line and strip the wrapper.
+  const line = String(res.stdout).split("\n").map(l => l.trim()).find(l => l && !/^```/.test(l)) || "";
+  const title = line.replace(/^["'`]+|["'`.]+$/g, "").replace(/^(title|card)\s*:\s*/i, "").trim().slice(0, 70);
+  // Guard against the failure modes that would make the board WORSE than the heuristic: an empty
+  // answer, a refusal, or the model echoing the prompt back at us.
+  if (title.length < 8 || /^(sorry|i can|as an ai)/i.test(title) || title.toLowerCase() === raw.toLowerCase().slice(0, title.length)) process.exit(0);
+
+  const owner = (() => { try { return JSON.parse(readFileSync(join(process.env.AGENT_BUS_DIR || join(homedir(), ".agent-bus"), "config.json"), "utf8")).ownerIdentity; } catch { return ""; } })();
+  const identity = loadOrCreate(owner || "admin", "human");
+  await sfetchJson(`${HUB}/task/update`, { identity, payload: { id: ID, summary: title, by: "scrooge-focus-title" }, signal: AbortSignal.timeout(8000) });
+} catch { /* a board title is never worth surfacing an error for */ }
+process.exit(0);

package/hooks/heartbeat.mjs

@@ -106,7 +106,10 @@ async function maybeEarlyWarn(stdinRaw, session) {
 }
 
 async function main(stdinRaw) {
-  const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+  // input.cwd FIRST — every hook must derive the project the SAME way, or two hooks in one
+  // session resolve two projects, two hubs, and half the work records where nobody reads.
+  let _in = {}; try { _in = JSON.parse(stdinRaw || "{}"); } catch {}
+  const projectDir = _in.cwd || process.env.CLAUDE_PROJECT_DIR || process.cwd();
   // Mirror sessionstart.mjs: home-directory sessions aren't project work — don't register
   // them (would spawn a phantom "<username>" board). Opt in with RELAY_SESSION/RELAY_PROJECT.
   if (!process.env.RELAY_SESSION && !process.env.RELAY_PROJECT && projectDir === homedir()) return;

package/hooks/inbox-deliver.mjs

@@ -33,20 +33,28 @@ const FETCH_TIMEOUT_MS = Number(process.env.RELAY_INBOX_TIMEOUT_MS || 1500);
 // additionalContext payload (the model still gets the readable message).
 function sanitize(s) { return String(s == null ? "" : s).replace(/[\x00-\x1f\x7f-\x9f]/g, " "); }
 
-async function getInbox(session, since, instance) {
-  const { ok, json } = await signedGet(`/inbox?session=${encodeURIComponent(session)}&since=${since}`, { timeoutMs: FETCH_TIMEOUT_MS, session, instance });
+async function getInbox(session, since, instance, project) {
+  const { ok, json } = await signedGet(`/inbox?session=${encodeURIComponent(session)}&since=${since}`, { timeoutMs: FETCH_TIMEOUT_MS, session, instance, project });
   if (!ok || !json) throw new Error("hub unreachable");
   return json;   // { messages: [...], cursor, superseded? }
 }
 
-// PostToolUse hands us the tool-input JSON on stdin. We don't need it, but we must DRAIN it:
-// a large tool input (e.g. a big Write) can exceed the 64KB pipe buffer and block the parent's
-// write if nobody reads. Consume + discard, with a short timeout so we never hang.
+// PostToolUse hands us the tool-input JSON on stdin, and we MUST drain it: a large tool input
+// (e.g. a big Write) can exceed the 64KB pipe buffer and block the parent's write if nobody reads.
+// It used to drain into the void and resolve with NOTHING, so `main(stdinRaw)` always got
+// undefined — which silently cost two things: `session_id` (so the per-instance cursor in
+// docs/INSTANCE-KEYS-CONTRACT.md never actually keyed by instance) and `cwd` (so this hook could
+// only ever guess its project from the process directory). Draining and KEEPING the bytes is the
+// same protection, minus the amnesia.
 function drainStdin() {
   return new Promise(res => {
-    try { process.stdin.resume(); process.stdin.on("data", () => {}); process.stdin.on("end", res); }
-    catch { res(); }
-    setTimeout(res, 80);
+    let d = "";
+    try {
+      process.stdin.setEncoding("utf8"); process.stdin.resume();
+      process.stdin.on("data", c => (d += c));
+      process.stdin.on("end", () => res(d));
+    } catch { res(d); }
+    setTimeout(() => res(d), 80);
   });
 }
 
@@ -64,7 +72,10 @@ async function main(stdinRaw) {
   // name, different session_id) has its own ledger and can't eat this session's messages.
   let instanceId = "";
   try { instanceId = String(JSON.parse(stdinRaw || "{}").session_id || ""); } catch {}
-  const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+  // input.cwd FIRST — every hook must derive the project the SAME way, or two hooks in one
+  // session resolve two projects, two hubs, and half the work records where nobody reads.
+  let _in = {}; try { _in = JSON.parse(stdinRaw || "{}"); } catch {}
+  const projectDir = _in.cwd || process.env.CLAUDE_PROJECT_DIR || process.cwd();
   // Mirror heartbeat.mjs / sessionstart.mjs: a home-directory session isn't project work and
   // isn't on the bus — nothing to deliver. Opt in with RELAY_SESSION / RELAY_PROJECT.
   if (!process.env.RELAY_SESSION && !process.env.RELAY_PROJECT && projectDir === homedir()) return "{}";
@@ -94,7 +105,7 @@ async function main(stdinRaw) {
   // so we start listening "from now" instead of replaying the whole backlog of old broadcasts.
   if (!existsSync(cursorFile)) {
     try {
-      const { cursor } = await getInbox(session, 0, instanceId);
+      const { cursor } = await getInbox(session, 0, instanceId, project);
       writeFileSync(cursorFile, String(cursor || 0));
     } catch {}
     return "{}";
@@ -105,7 +116,7 @@ async function main(stdinRaw) {
 
   let messages = [], next = cursor, superseded = false;
   try {
-    const res = await getInbox(session, cursor, instanceId);
+    const res = await getInbox(session, cursor, instanceId, project);
     messages = Array.isArray(res.messages) ? res.messages : [];
     next = res.cursor || cursor;
     superseded = res.superseded === true;

package/hooks/lib/api.mjs

@@ -49,6 +49,32 @@ export function sessionContext(projectDir) {
   return { session, project, projectDir: dir };
 }
 
+// THE PROJECT A REQUEST IS ABOUT, which is not always the project the hook process is standing in.
+//
+// This distinction cost two diagnosis sessions. A hook stamps its payload with the project from
+// Claude's session cwd (`input.cwd`), but the hub URL used to come from the HOOK PROCESS's cwd.
+// Launch a session from ~/development and those disagree: every card says "crebral-health" and
+// every one of them lands on the LOCAL hub, because "development" has no pin and falls through to
+// the global default. Nothing errors, the seat looks healthy, and half the work records where
+// nobody reads. So: the project travels WITH the request, explicit > payload > query > cwd.
+function projectFromQuery(pathOrUrl) {
+  const m = String(pathOrUrl).match(/[?&]project=([^&]*)/);
+  try { return m ? decodeURIComponent(m[1]) : ""; } catch { return m ? m[1] : ""; }
+}
+function projectOf(explicit, payload, pathOrUrl) {
+  if (explicit) return explicit;
+  if (payload && typeof payload === "object" && payload.project) return String(payload.project);
+  return projectFromQuery(pathOrUrl);
+}
+// The signing identity for a request about `project`. An explicit RELAY_SESSION/RELAY_AGENT still
+// wins (crew seats inherit them); otherwise the peer is named for the project being written, not
+// for wherever the hook happens to be running.
+function sessionFor(project) {
+  if (process.env.RELAY_SESSION) return process.env.RELAY_SESSION;
+  const p = project || sessionContext().project;
+  return process.env.RELAY_AGENT ? `${process.env.RELAY_AGENT}:${p}` : `${hostId()}:${p}`;
+}
+
 // The keypair for a session name, memoised per process. loadOrCreate is itself idempotent + atomic,
 // but a hook may sign several requests in one run — avoid re-reading the file each time.
 const _idCache = new Map();
@@ -86,14 +112,19 @@ function enrolledPath(session) {
   const busDir = process.env.AGENT_BUS_DIR || join(homedir(), ".agent-bus");
   return join(busDir, "keys", `${String(session).replace(/[^A-Za-z0-9_.-]/g, "_")}.enrolled`);
 }
-export async function ensureEnrolled(session, identity) {
+export async function ensureEnrolled(session, identity, project) {
   if (!identity?.pubkey) return;
+  const hub = relayUrl(project);
   const stamp = enrolledPath(session);
-  try { if (existsSync(stamp) && readFileSync(stamp, "utf8").trim() === identity.pubkey) return; } catch {}
+  // The stamp records the HUB as well as the key. It used to record only the key, so a session
+  // enrolled on one hub was considered enrolled everywhere — and its first request to a second
+  // hub went out as an unknown identity.
+  const mark = `${identity.pubkey}\t${hub}`;
+  try { if (existsSync(stamp) && readFileSync(stamp, "utf8").trim() === mark) return; } catch {}
   try {
     // sfetchJson is the FROZEN single call-site shape (lib/signed-fetch.mjs): it stringifies the
     // payload, sets content-type, and signs — so every hook signs identically with zero hand-rolling.
-    const r = await sfetchJson(`${relayUrl()}/enroll`, {
+    const r = await sfetchJson(`${hub}/enroll`, {
       method: "POST",
       payload: { pubkey: identity.pubkey, name: session, kind: "agent" },
       identity,
@@ -101,7 +132,7 @@ export async function ensureEnrolled(session, identity) {
     });
     if (r.ok) {
       try { mkdirSync(join((process.env.AGENT_BUS_DIR || join(homedir(), ".agent-bus")), "keys"), { recursive: true }); } catch {}
-      try { writeFileSync(stamp, identity.pubkey, { mode: 0o600 }); } catch {}
+      try { writeFileSync(stamp, mark, { mode: 0o600 }); } catch {}
     }
   } catch {}
 }
@@ -109,8 +140,8 @@ export async function ensureEnrolled(session, identity) {
 // Accept either a full URL (rare — a caller that already built one) or a hub-relative path. We do
 // NOT fold the origin into the signature (signed-fetch signs path+query only), so a request proxied
 // through a different host still verifies.
-function toUrl(pathOrUrl) {
-  return /^https?:\/\//.test(pathOrUrl) ? pathOrUrl : `${relayUrl()}${pathOrUrl}`;
+function toUrl(pathOrUrl, project) {
+  return /^https?:\/\//.test(pathOrUrl) ? pathOrUrl : `${relayUrl(project || projectFromQuery(pathOrUrl))}${pathOrUrl}`;
 }
 
 // Unsigned GET → { ok, status, json|null }. Never throws.
@@ -123,8 +154,8 @@ function toUrl(pathOrUrl) {
 // /peers roster. So reads stay unsigned: accepted+flagged under the default `warn` mode, and the
 // roster stays global. Flipping individual reads to signed later is a one-liner once a read needs
 // enforce-mode attribution (add a signedGet that passes `identity` through sfetchJson with GET).
-export async function getJSON(pathOrUrl, { timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
-  const url = toUrl(pathOrUrl);
+export async function getJSON(pathOrUrl, { timeoutMs = DEFAULT_TIMEOUT_MS, project } = {}) {
+  const url = toUrl(pathOrUrl, projectOf(project, null, pathOrUrl));
   try {
     const r = await fetch(url, { method: "GET", signal: AbortSignal.timeout(timeoutMs) });
     // parse the body on FAILURE too — a refusal's payload (denial note, queue guidance,
@@ -145,13 +176,14 @@ export async function getJSON(pathOrUrl, { timeoutMs = DEFAULT_TIMEOUT_MS } = {}
 // First user: the overseer-warn hook's /overseer/context — a project-scoped read, so the
 // enforce hub's own-project scope filtering is the correct behavior, not a loss. Roster-style
 // reads (/peers, /catchup cross-project discovery) stay on getJSON on purpose — see above.
-export async function signedGet(pathOrUrl, { timeoutMs = DEFAULT_TIMEOUT_MS, session, instance } = {}) {
-  const sess = session || sessionContext().session;
+export async function signedGet(pathOrUrl, { timeoutMs = DEFAULT_TIMEOUT_MS, session, instance, project } = {}) {
+  const proj = projectOf(project, null, pathOrUrl);
+  const sess = session || sessionFor(proj);
   const durable = loadIdentity(sess);
   const id = instance ? loadInstance(sess, instance) : durable;
-  await ensureEnrolled(sess, durable);           // instances never enroll — the DURABLE key does
+  await ensureEnrolled(sess, durable, proj);     // instances never enroll — the DURABLE key does
   try {
-    const r = await sfetchJson(toUrl(pathOrUrl), {
+    const r = await sfetchJson(toUrl(pathOrUrl, proj), {
       method: "GET",
       identity: id,
       signal: AbortSignal.timeout(timeoutMs),
@@ -170,15 +202,16 @@ export async function signedGet(pathOrUrl, { timeoutMs = DEFAULT_TIMEOUT_MS, ses
 }
 
 // Signed POST → { ok, status, json|null }. Never throws.
-export async function signedPost(pathOrUrl, payload, { timeoutMs = DEFAULT_TIMEOUT_MS, session, instance } = {}) {
-  const sess = session || sessionContext().session;
+export async function signedPost(pathOrUrl, payload, { timeoutMs = DEFAULT_TIMEOUT_MS, session, instance, project } = {}) {
+  const proj = projectOf(project, payload, pathOrUrl);
+  const sess = session || sessionFor(proj);
   const durable = loadIdentity(sess);
   const id = instance ? loadInstance(sess, instance) : durable;
-  await ensureEnrolled(sess, durable);           // instances never enroll — the DURABLE key does
+  await ensureEnrolled(sess, durable, proj);     // instances never enroll — the DURABLE key does
   try {
     // sfetchJson (FROZEN) stringifies the payload + signs with `id` in one call — the single shape
     // every client uses (lib/signed-fetch.mjs). We pass our memoised identity so it doesn't re-load.
-    const r = await sfetchJson(toUrl(pathOrUrl), {
+    const r = await sfetchJson(toUrl(pathOrUrl, proj), {
       method: "POST",
       payload,
       identity: id,

package/hooks/precompact.mjs

@@ -18,7 +18,9 @@ function readStdin() {
 
 try {
   const input = JSON.parse((await readStdin()) || "{}");
-  const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+  // input.cwd FIRST — every hook must derive the project the SAME way, or two hooks in one
+  // session resolve two projects, two hubs, and half the work records where nobody reads.
+  const projectDir = input.cwd || process.env.CLAUDE_PROJECT_DIR || process.cwd();
   const projectName = basename(projectDir);
   const transcript = input.transcript_path || "";
   const trigger = input.trigger || "auto";

package/hooks/prompt-focus.mjs

@@ -3,11 +3,17 @@
 // so a REGULAR (non-crew) Claude session's OWN work shows IN PROGRESS on the board as it happens — not only
 // when it commits or dispatches a sub-agent. ONE rolling card per session (the hub re-titles it as the focus
 // shifts and closes it to "done" when the session goes offline). Trivial acks ("yes", "go ahead") don't
-// refocus. Fail-silent + fast: NO LLM call (the title is a heuristic clean of the prompt; Scrooge-summarized
-// titles are a follow-up). Never blocks or delays the turn.
+// refocus. Fail-silent + fast: NO LLM call ON THE TURN PATH — the title is a heuristic clean of the
+// prompt, posted immediately. A long prompt then hands its rewrite to bin/focus-title.mjs, spawned
+// DETACHED so a cheap model can produce a readable board line a few seconds later without the user
+// ever waiting on it. Never blocks or delays the turn.
 import { homedir } from "node:os";
+import { join, dirname } from "node:path";
+import { writeFileSync, mkdirSync } from "node:fs";
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
 import { resolveProject, hostId } from "../lib/project.mjs";
-import { signedPost } from "./lib/api.mjs";
+import { signedPost, relayUrl } from "./lib/api.mjs";
 
 function readStdin() {
   return new Promise(res => { let d = ""; process.stdin.setEncoding("utf8");
@@ -42,7 +48,29 @@ try {
   const project = resolveProject(cwd);
   const session = process.env.RELAY_SESSION
     || (process.env.RELAY_AGENT ? `${process.env.RELAY_AGENT}:${project}` : `${hostId()}:${project}`);
-  await signedPost("/focus", { session, project, title: titleFrom(trimmed), by: session }, { session });
+  // The Claude Code session UUID. `session` above is a BUS id — per host+project — so without this
+  // two Claude sessions in one project share (and fight over) a single focus card, and sub-agent
+  // cards, whose `parent` is exactly this UUID, have nothing to nest under.
+  const cc = String(input.session_id || "").slice(0, 120);
+  const r = await signedPost("/focus", { session, project, title: titleFrom(trimmed), by: session, cc }, { session });
+
+  // Only pay a model when the heuristic actually mangles the prompt. A short, already-clear ask
+  // ("fix the login redirect") reads fine as-is and buying a rewrite for it is exactly the kind of
+  // reflexive spend the economics doctrine exists to stop.
+  const id = r?.json?.id;
+  if (id && trimmed.length > 90 && process.env.TRANTOR_NO_SCROOGE_TITLES !== "1") {
+    try {
+      const busDir = process.env.AGENT_BUS_DIR || join(homedir(), ".agent-bus");
+      mkdirSync(busDir, { recursive: true });
+      const pf = join(busDir, `focus-prompt-${String(cc || session).replace(/[^A-Za-z0-9_.-]/g, "_")}.txt`);
+      writeFileSync(pf, trimmed);
+      const worker = join(dirname(dirname(fileURLToPath(import.meta.url))), "bin", "focus-title.mjs");
+      // Detached + unref'd + stdio ignored: the hook returns NOW. Nothing downstream waits on this,
+      // and a worker that dies takes the heuristic title with it, which is a fine outcome.
+      spawn(process.execPath, [worker, "--id", String(id), "--hub", relayUrl(project), "--prompt-file", pf, "--project", project],
+        { detached: true, stdio: "ignore" }).unref();
+    } catch {}
+  }
 } catch (e) {
   process.stderr.write(`[trantor] prompt-focus error: ${e?.message || e}\n`);
 }

package/hooks/sessionstart.mjs

@@ -129,7 +129,10 @@ try {
   let source = "", stdinObj = {};
   try { stdinObj = JSON.parse((await readStdin()) || "{}"); source = stdinObj.source || ""; } catch {}
   userTitle = (stdinObj && stdinObj.session_title) ? String(stdinObj.session_title) : "";   // user already named it
-  const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+  // input.cwd FIRST, matching hooks/prompt-focus.mjs. When they disagreed, two hooks in ONE
+  // session resolved two different projects — and therefore two different hubs — so half a
+  // session's work recorded on a hub nobody was reading.
+  const projectDir = stdinObj.cwd || process.env.CLAUDE_PROJECT_DIR || process.cwd();
   // Sessions started in the home directory itself aren't project work — registering
   // them spawns a phantom "<username>" project board on the dashboard. Set
   // RELAY_SESSION (or RELAY_PROJECT) to deliberately put a home-dir session on the bus.
@@ -142,7 +145,9 @@ try {
   sessionTitle = project;   // baseline — enriched with the current work item after the catch-up fetch below
   const session = process.env.RELAY_SESSION
     || (process.env.RELAY_AGENT ? `${process.env.RELAY_AGENT}:${project}` : `${hostId()}:${project}`);
-  const url = relayUrl();
+  // relayUrl() with no project resolves from the hook process's cwd, which is not always the
+  // project the session is about. Pass it, or every call below can address the wrong hub.
+  const url = relayUrl(project);
 
   // register self + post an initial presence status (no LLM turn — instant for others to read)
   await jpost(`${url}/register`, { session, project, status: `active in ${project}` }, session).catch(() => {});

package/hooks/stop-inbox.mjs

@@ -78,7 +78,7 @@ async function main() {
   let messages = [];
   try {
     // PEEK: look without claiming delivery. We may yet decide to let the stop through.
-    const peek = await signedGet(`/inbox?session=${encodeURIComponent(session)}&since=${cursor}&peek=1`, { timeoutMs: FETCH_TIMEOUT_MS, session, instance: instanceId });
+    const peek = await signedGet(`/inbox?session=${encodeURIComponent(session)}&since=${cursor}&peek=1`, { timeoutMs: FETCH_TIMEOUT_MS, session, instance: instanceId, project });
     if (!peek.ok) return allow();
     // Superseded twin (instance-keys contract): a newer instance claimed the baton — this session
     // stands down. Blocking ITS stop over messages the new instance will handle would trap it.
@@ -92,7 +92,7 @@ async function main() {
   // Committed now: claim delivery for real so neither inbox-deliver nor the deferred waker repeats it.
   let next = cursor;
   try {
-    const claim = await signedGet(`/inbox?session=${encodeURIComponent(session)}&since=${cursor}`, { timeoutMs: FETCH_TIMEOUT_MS, session, instance: instanceId });
+    const claim = await signedGet(`/inbox?session=${encodeURIComponent(session)}&since=${cursor}`, { timeoutMs: FETCH_TIMEOUT_MS, session, instance: instanceId, project });
     if (claim.ok) next = claim.json?.cursor || cursor;
   } catch {}
   try { writeFileSync(cursorFile, String(next)); } catch {}

package/hooks/subagent-start.mjs

@@ -53,8 +53,11 @@ try {
     // with the SubagentStop "done" card on any client that predates agent_id pairing (legacy fallback).
     const task = String(ti.prompt || ti.description || agentType).replace(/\s+/g, " ").trim().slice(0, 90);
     const title = `${agentType}: ${task}`.slice(0, 180);
+    // parent at CREATE time too, not only on the SubagentStart enrich — a card that spends its
+    // whole doing-life unparented is un-nestable exactly while it is the interesting one.
     await signedPost("/task", {
       project, title, status: "doing", agentType,
+      parent: String(input.session_id || "").slice(0, 120),
       assignee: `${agentType}:${project}`, by: `${hostId()}:${project}`,
       source: "cc-subagent", costKind: "subagent-notional", phase: "sub-agents",
     });

package/hooks/todo-sync.mjs

@@ -3,8 +3,8 @@
 // so SOLO work (no crew fired up) shows up live and accrues timeline history. The hub reconciles by
 // todo text (pending/in_progress/completed -> todo/doing/done). Fail-silent by contract: a bad hub,
 // a home-dir session, or any error must never block or break the tool flow.
-import { basename } from "node:path";
-import { homedir, hostname } from "node:os";
+import { homedir } from "node:os";
+import { resolveProject, hostId } from "../lib/project.mjs";
 import { signedPost } from "./lib/api.mjs";
 function readStdin() {
   return new Promise(res => { let d = ""; process.stdin.setEncoding("utf8");
@@ -13,21 +13,26 @@ function readStdin() {
 }
 
 async function main() {
-  const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+  // stdin FIRST: input.cwd is the session's own directory and it decides both the project and the
+  // hub, so it has to be read before either is resolved.
+  let input = {};
+  try { input = JSON.parse((await readStdin()) || "{}"); } catch { return; }
+  const projectDir = input.cwd || process.env.CLAUDE_PROJECT_DIR || process.cwd();
   // Mirror sessionstart/heartbeat: home-directory sessions aren't project work — don't card them
   // (would spawn a phantom "<username>" board). Opt in with RELAY_SESSION/RELAY_PROJECT.
   if (!process.env.RELAY_SESSION && !process.env.RELAY_PROJECT && projectDir === homedir()) return;
-
-  let input = {};
-  try { input = JSON.parse((await readStdin()) || "{}"); } catch { return; }
   if (input.tool_name && input.tool_name !== "TodoWrite") return;   // the matcher should scope us, but be safe
   const todos = input.tool_input?.todos;
   if (!Array.isArray(todos) || !todos.length) return;
 
   // Identity EXACTLY as mcp.mjs/heartbeat resolve it, so we card the same peer the relay registered.
-  const project = process.env.RELAY_PROJECT || basename(projectDir);
+  // This said `basename(projectDir)` and `hostname()`, which is not the same thing at all:
+  // resolveProject keys off the GIT ROOT (a subdirectory forked its own lane) and hostId is the
+  // stable machine id, where hostname() drifts to "MacBook-Pro-M1.local" on some networks and
+  // splits one machine into two peers.
+  const project = resolveProject(projectDir);
   const session = process.env.RELAY_SESSION
-    || (process.env.RELAY_AGENT ? `${process.env.RELAY_AGENT}:${project}` : `${hostname()}:${project}`);
+    || (process.env.RELAY_AGENT ? `${process.env.RELAY_AGENT}:${project}` : `${hostId()}:${project}`);
 
   await signedPost("/todos", { session, project, by: session, todos: todos.map(t => ({ content: t.content, status: t.status })) });
 }

package/hub.mjs

@@ -36,6 +36,11 @@ const PEER_TTL_MS = Math.max(Number.isFinite(_peerTtlRaw) ? _peerTtlRaw : PEER_T
 // long-running task is never touched — the owner-alive-but-idle case is handled by the manual /sweep path.
 const REAP_GRACE_MS = Number(process.env.RELAY_REAP_GRACE_MS || 15 * 60 * 1000);    // 15m offline + untouched
 const FOCUS_OFFLINE_MS = Number(process.env.RELAY_FOCUS_OFFLINE_MS || ONLINE_MS);   // close a focus card once its session is offline (not the old 6h)
+// Backstop for the case the peer heartbeat cannot see: several Claude sessions share ONE bus
+// identity (it is per host+project), so a sibling that is still alive keeps the whole assignee
+// "online" and a dead session's focus card would hang in `doing` forever. Long, because a card
+// untouched for an hour is routine — a big task runs a long time between prompts.
+const FOCUS_IDLE_MS = Number(process.env.RELAY_FOCUS_IDLE_MS || 6 * 60 * 60 * 1000);
 const REAP_INTERVAL_MS = Number(process.env.RELAY_REAP_INTERVAL_MS || 60000);       // how often the reaper sweeps (env-tunable; tests set it low)
 if (!existsSync(DATA_DIR)) mkdirSync(DATA_DIR, { recursive: true });
 const isLoopbackHost = (host) => {
@@ -429,15 +434,49 @@ backfillCardEvents();
 // A session's live "focus" card (source:"session") tracks what a REGULAR session is working on RIGHT NOW
 // (set from each user prompt by hooks/prompt-focus.mjs). When the session ends (pruned offline), close its
 // open focus card to "done" so the board doesn't keep a dead session "in progress" forever.
-function closeFocus(session) {
-  const t = state.tasks.find(x => x.source === "session" && x.assignee === session && x.status !== "done");
-  if (!t) return false;
-  (t.history ||= []).push({ from: t.status, to: "done", by: session, ts: now() });
+function closeFocusCard(t, by) {
+  if (!t || t.status === "done") return false;
+  (t.history ||= []).push({ from: t.status, to: "done", by, ts: now() });
   if (t.history.length > 60) t.history.splice(0, 20);
-  appendCardEvent("moved", t, session, t.status, "done");
+  appendCardEvent("moved", t, by, t.status, "done");
   t.status = "done"; t.updated = now();
   return true;
 }
+// A bus session id is per (host, project), so ONE assignee can own SEVERAL open focus cards — one
+// per live Claude session in that project. Close every one of them when the peer goes away; the
+// old single-card `find` left the rest sitting in `doing` forever.
+function closeFocus(session) {
+  let closed = false;
+  for (const t of state.tasks) {
+    if (t.source === "session" && t.assignee === session && t.status !== "done") closed = closeFocusCard(t, session) || closed;
+  }
+  return closed;
+}
+// A git card and a focus card meet on the same bus id (`${hostId()}:${project}`), which is what the
+// backfill posts as its assignee. One bus id can own several open focus cards now, so close the
+// most recently active one — the session that just committed is the one that most recently spoke.
+const COMMIT_FOCUS_WINDOW_MS = Number(process.env.RELAY_COMMIT_FOCUS_MS || 10 * 60 * 1000);
+function linkCommitToFocus(commitCard, by) {
+  // A HISTORICAL backfill (`--since "14 days ago"`) posts dozens of old commits at once and must
+  // never close whatever a session happens to be doing today. Only a fresh commit closes a focus.
+  if (Math.abs(now() - (commitCard.ts || 0)) > COMMIT_FOCUS_WINDOW_MS) return false;
+  const owner = commitCard.assignee || by || "";
+  if (!owner) return false;
+  const proj = canon(commitCard.project || "");
+  const open = state.tasks
+    .filter(x => x.source === "session" && x.status !== "done" && x.assignee === owner && canon(x.project) === proj)
+    .sort((a, b2) => (b2.updated || 0) - (a.updated || 0));
+  const focus = open[0];
+  if (!focus) return false;
+  focus.commitCard = commitCard.id;                 // the two halves point at each other, so the
+  commitCard.focusCard = focus.id;                  // card drawer can walk either way
+  (focus.history ||= []).push({ from: focus.status, to: "done", by: owner, ts: now(), note: `closed by commit — ${String(commitCard.title || "").slice(0, 80)}` });
+  if (focus.history.length > 60) focus.history.splice(0, 20);
+  appendCardEvent("moved", focus, owner, focus.status, "done");
+  focus.status = "done"; focus.updated = now();
+  appendEvent("focus", focus.project, owner, { taskId: focus.id, closedBy: commitCard.id, reason: "commit" });
+  return true;
+}
 function prunePeers() {
   const cutoff = now() - PEER_TTL_MS;
   let removed = false;
@@ -469,13 +508,18 @@ function cardOwnerOnline(t, cutoff) {
 function reapStaleCards() {
   const onCut = now() - ONLINE_MS;
   const focusCut = now() - FOCUS_OFFLINE_MS;
+  const idleCut = now() - FOCUS_IDLE_MS;
   const graceCut = now() - REAP_GRACE_MS;
   let changed = false;
   for (const t of state.tasks) {
     if (t.status === "done" || t.status === "stale") continue;
     if (t.source === "session") {                                  // (a) focus cards → done when session offline
       const p = state.peers[t.assignee];
-      if (!p || (p.lastSeen || 0) < focusCut) { if (closeFocus(t.assignee)) changed = true; }
+      const peerGone = !p || (p.lastSeen || 0) < focusCut;
+      // …or when THIS card has gone quiet for a very long time, which is the only signal available
+      // for a dead Claude session whose bus identity a living sibling keeps warm.
+      const longIdle = (t.updated || t.ts || 0) < idleCut;
+      if (peerGone || longIdle) { if (closeFocusCard(t, peerGone ? t.assignee : "reaper")) changed = true; }
       continue;
     }
     if ((t.status === "doing" || t.status === "testing")           // (b) offline-owner work cards → stale
@@ -1459,6 +1503,11 @@ const server = http.createServer(async (req, res) => {
       if (b.source === "cc-subagent") { t._fp = subFp(b.title); if (b.agentType) t._atype = String(b.agentType).slice(0, 40); if (b.agentId) t._aid = String(b.agentId).slice(0, 80); if (b.parent) t.parent = String(b.parent).slice(0, 120); t.count = 1; if (t.status === "doing") { t._everStarted = true; t._inflight = 1; } }
       state.tasks.push(t); if (state.tasks.length > 2000) state.tasks.splice(0, 500);
       appendCardEvent("created", t, b.by, null, st0);
+      // A COMMIT closes the focus. A focus card says "this session is working on X right now"; the
+      // commit is X arriving, so the card that was rolling forever now completes with the commit
+      // attached to it — the board finally shows a finished unit of work instead of an open card
+      // whose title keeps changing. The next prompt opens a fresh one.
+      if (b.source === "git" && st0 === "done") linkCommitToFocus(t, b.by);
       dirty = true; return json(res, 200, { ok: true, task: t });
     }
     if (req.method === "POST" && P === "/task/update") {    // move/edit a card
@@ -1556,20 +1605,38 @@ const server = http.createServer(async (req, res) => {
       const session = String(b.session || b.by || "").slice(0, 120);
       const project = canon(String(b.project || "").slice(0, 80));
       const title = String(b.title || "").replace(/\s+/g, " ").trim().slice(0, 200);
+      // `cc` = the Claude Code session UUID (hooks/prompt-focus.mjs passes session_id). It is the
+      // ONLY per-session key on the board: `assignee` is a bus id, which is per host+project, so
+      // two Claude sessions in one project used to fight over a single rolling card — and every
+      // sub-agent card, whose `parent` is that same UUID, had nothing to join to (measured over
+      // 431 live cards, joining on the bus id resolved 0 of them). With `cc` stored here, a
+      // sub-agent nests under the session that actually spawned it.
+      const cc = String(b.cc || "").slice(0, 120);
       if (!session || !project || !title) return json(res, 400, { error: "session, project, title required" });
       touch(session, undefined, project, undefined, auth);
-      let t = state.tasks.find(x => x.source === "session" && x.assignee === session && canon(x.project) === project && x.status !== "done");
+      // Match on cc when the client sends one — but never let a cc-bearing prompt adopt a card
+      // from a DIFFERENT session. A client too old to send cc keeps the original assignee match.
+      let t = cc
+        ? state.tasks.find(x => x.source === "session" && x.cc === cc && canon(x.project) === project && x.status !== "done")
+          || state.tasks.find(x => x.source === "session" && !x.cc && x.assignee === session && canon(x.project) === project && x.status !== "done")
+        : state.tasks.find(x => x.source === "session" && x.assignee === session && canon(x.project) === project && x.status !== "done");
       if (t) {
         if (t.title !== title) {            // refocus: re-title in place + record the shift (keeps the trail)
           (t.history ||= []).push({ from: t.status, to: t.status, by: session, ts: now(), note: title.slice(0, 90) });
           if (t.history.length > 60) t.history.splice(0, 20);
+          // A rolling card's narrative describes the OLD focus. The board renders `summary ||
+          // title`, so leaving it would let a stale one-liner shadow what the session is doing
+          // right now — the summarizer (or bin/focus-title.mjs) writes a fresh one.
+          if (t.summary) t.summary = "";
           t.title = title; appendCardEvent("updated", t, session, null, null);
           appendEvent("focus", project, session, { taskId: t.id, title, shift: true });
         }
+        if (cc && !t.cc) t.cc = cc;          // an in-flight card from an older client gets its key
         t.status = "doing"; t.updated = now();
       } else {
         t = { id: ++state.taskSeq, project, title, assignee: session, status: "doing", source: "session",
           difficulty: "", model: "", deps: [], by: session, ts: now(), updated: now(),
+          cc: cc || undefined,
           history: [{ to: "doing", by: session, ts: now() }] };
         state.tasks.push(t); appendCardEvent("created", t, session, null, "doing");
         appendEvent("focus", project, session, { taskId: t.id, title, shift: false });
@@ -1579,7 +1646,11 @@ const server = http.createServer(async (req, res) => {
     }
     if (req.method === "GET" && P === "/focus") {     // the session's open focus card (for sub-agent nesting)
       const session = String(q.session || "");
-      const t = state.tasks.find(x => x.source === "session" && x.assignee === session && x.status !== "done");
+      const cc = String(q.cc || "");
+      // ?cc= is the precise lookup (one Claude session); ?session= stays the coarse one.
+      const t = cc
+        ? state.tasks.find(x => x.source === "session" && x.cc === cc && x.status !== "done")
+        : state.tasks.find(x => x.source === "session" && x.assignee === session && x.status !== "done");
       if (t && !canRead(auth, t.project || "")) return json(res, 404, { id: null, task: null });
       return json(res, 200, { id: t ? t.id : null, task: t || null });
     }

package/lib/splitbrain.mjs

@@ -0,0 +1,130 @@
+// trantor — hub split-brain detection.
+//
+// A project lives on exactly ONE hub (TDD §12.1). When that stops being true nothing errors: the
+// crew registers on hub A, the orchestrator and the board read hub B, every seat reports healthy,
+// and the work simply lands somewhere nobody is looking. It cost two full diagnosis sessions in
+// crebral-health (2026-08-14 and again 2026-08-18) before anyone thought to compare the two hubs.
+// Nothing on the machine was wrong; the two halves just never met.
+//
+// So detection is a cross-check, not a health check: probe every hub this machine knows about, ask
+// each one who is LIVE on it, and compare that against the pins in ~/.agent-bus/config.json.
+//
+// THE TRAP THIS LIB EXISTS TO AVOID: an unsigned read of an enforce hub answers
+// `{"error":"signature required"}` with HTTP 401, and `(body.peers || [])` turns that refusal into
+// a confident empty list — a hub full of agents reads as deserted. That nearly got called a fleet
+// outage. probeHub() therefore reports a REASON, never a silent empty roster, and analyze() carries
+// unreadable hubs through to the caller as `blind` so a partial answer can never be printed as a
+// clean bill of health.
+import { sfetch } from "./signed-fetch.mjs";
+
+/** Compare hub URLs the way a human would: trailing slash and loopback spelling are not identity. */
+export function normalizeHub(url) {
+  let u = String(url || "").trim().replace(/\/+$/, "");
+  return u.replace(/^http:\/\/localhost(?=[:/]|$)/i, "http://127.0.0.1");
+}
+export const isLocalHub = (url) => /^https?:\/\/(127\.0\.0\.1|localhost|\[::1\])(?=[:/]|$)/i.test(String(url || ""));
+
+/** Every hub this machine could be talking to: the global default, and every per-project pin. */
+export function hubsFromConfig(config = {}, defaultUrl = "http://127.0.0.1:4477") {
+  const seen = new Map();
+  const add = (url, source) => {
+    const u = normalizeHub(url);
+    if (!/^https?:\/\//.test(u)) return;
+    if (!seen.has(u)) seen.set(u, { url: u, sources: [] });
+    seen.get(u).sources.push(source);
+  };
+  add(config.url || defaultUrl, "config.url");
+  for (const [project, url] of Object.entries(config.hubs || {})) add(url, `pin:${project}`);
+  return [...seen.values()];
+}
+
+/** Ask one hub who is live on it. Never conflates "refused us" with "nobody home". */
+export async function probeHub(url, identity, { timeoutMs = 6000, fetchImpl = null } = {}) {
+  const u = normalizeHub(url);
+  const base = { url: u, ok: false, reason: "", authMode: "", hubVersion: "", peers: [] };
+  let res, text;
+  try {
+    const doFetch = fetchImpl || ((p, o, id) => sfetch(p, o, id));
+    res = await doFetch(`${u}/peers`, { signal: AbortSignal.timeout(timeoutMs) }, identity);
+    text = await res.text();
+  } catch (e) {
+    return { ...base, reason: `unreachable (${e?.message || e})` };
+  }
+  let body;
+  try { body = JSON.parse(text); } catch { return { ...base, reason: `unreadable response (HTTP ${res.status})` }; }
+  // The refusal case, spelled out. Both shapes matter: an enforce hub 401s with {error}, and a
+  // scope-limited identity can get a 200 whose roster is filtered — only the first is a blind spot.
+  if (!res.ok || body?.error) {
+    const why = body?.error || `HTTP ${res.status}`;
+    return { ...base, reason: /signature|unauthor|forbidden|401|403/i.test(why) ? `not authorized (${why})` : `refused (${why})` };
+  }
+  if (!Array.isArray(body?.peers)) return { ...base, reason: "no peer roster in the response" };
+  return { url: u, ok: true, reason: "", authMode: body.authMode || "", hubVersion: body.hubVersion || "",
+    peers: body.peers.map(p => ({ session: p.session, project: p.project || "", online: !!p.online, lastSeen: p.lastSeen || 0, llm: p.llm || "" })) };
+}
+
+/**
+ * Cross-check live presence against the pins.
+ *
+ * @param probes   probeHub() results, one per hub
+ * @param config   the raw ~/.agent-bus/config.json
+ * @returns {{findings: Array, blind: Array, checked: number}}
+ */
+export function analyze(probes = [], config = {}, defaultUrl = "http://127.0.0.1:4477") {
+  const pins = Object.fromEntries(Object.entries(config.hubs || {}).map(([p, u]) => [p, normalizeHub(u)]));
+  const fallback = normalizeHub(config.url || defaultUrl);
+  const readable = probes.filter(p => p.ok);
+  const blind = probes.filter(p => !p.ok).map(p => ({ url: p.url, reason: p.reason }));
+
+  // project -> hubs it is LIVE on
+  const liveOn = new Map();
+  for (const probe of readable) {
+    for (const peer of probe.peers) {
+      if (!peer.online || !peer.project) continue;
+      if (!liveOn.has(peer.project)) liveOn.set(peer.project, new Map());
+      const byHub = liveOn.get(peer.project);
+      if (!byHub.has(probe.url)) byHub.set(probe.url, []);
+      byHub.get(probe.url).push(peer.session);
+    }
+  }
+
+  const findings = [];
+  for (const [project, byHub] of [...liveOn.entries()].sort()) {
+    const hubs = [...byHub.keys()];
+    const pin = pins[project] || "";
+    const expected = pin || fallback;
+    if (hubs.length > 1) {
+      findings.push({ kind: "split", project, severity: "critical", hubs, expected,
+        sessions: Object.fromEntries([...byHub].map(([h, s]) => [h, s])),
+        message: `${project} has LIVE sessions on ${hubs.length} hubs at once — ${hubs.map(h => `${h} (${byHub.get(h).join(", ")})`).join(" and ")}. They cannot see each other's cards or messages.`,
+        fix: pin
+          ? `everything must be on ${pin}: restart the sessions on the other hub (crew: trantor down && trantor up · Claude sessions: restart them)`
+          : `pin it first — trantor hub set ${project} <url> — then restart every session so they all follow the pin` });
+    } else if (pin && hubs[0] !== pin) {
+      findings.push({ kind: "off-pin", project, severity: "critical", hubs, expected: pin,
+        sessions: Object.fromEntries([...byHub].map(([h, s]) => [h, s])),
+        message: `${project} is pinned to ${pin} but its live sessions (${byHub.get(hubs[0]).join(", ")}) are on ${hubs[0]} — their work records where nobody is reading.`,
+        fix: `restart them so they pick up the pin (crew: trantor down && trantor up · Claude sessions: restart them)` });
+    } else if (!pin && !isLocalHub(hubs[0])) {
+      findings.push({ kind: "unpinned-remote", project, severity: "warn", hubs, expected: fallback,
+        sessions: Object.fromEntries([...byHub].map(([h, s]) => [h, s])),
+        message: `${project} is live on ${hubs[0]} but has no pin — the next session started here falls back to ${fallback} and splits the project in two.`,
+        fix: `trantor hub set ${project} ${hubs[0]}` });
+    }
+  }
+  // A pin aimed at a hub we could not read is its own fault: sessions will route there and go quiet.
+  for (const [project, url] of Object.entries(pins)) {
+    const dead = blind.find(b => b.url === url);
+    if (dead) findings.push({ kind: "pin-unreachable", project, severity: "critical", hubs: [], expected: url,
+      message: `${project} is pinned to ${url}, which this machine cannot read (${dead.reason}) — sessions on it will look alive and record nothing here.`,
+      fix: `check the hub is up and this machine is enrolled on it, or re-pin: trantor hub set ${project} <url>` });
+  }
+  return { findings, blind, checked: readable.length };
+}
+
+/** Probe + analyze in one call. Hubs are probed concurrently — a dead one must not stall the rest. */
+export async function scan(config = {}, identity, { defaultUrl = "http://127.0.0.1:4477", timeoutMs = 6000 } = {}) {
+  const hubs = hubsFromConfig(config, defaultUrl);
+  const probes = await Promise.all(hubs.map(h => probeHub(h.url, identity, { timeoutMs })));
+  return { ...analyze(probes, config, defaultUrl), probes };
+}

package/mcp.mjs

@@ -99,10 +99,12 @@ async function seedCursor() {
 // mints a random id at boot — its lifetime ≈ the session's. The endorsed subkey it keys signs all
 // traffic; the durable identity keeps enrollment and attribution.
 const INSTANCE_ID = `mcp-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
-async function api(method, path, payload) {
+async function api(method, path, payload, { timeoutMs } = {}) {
+  // PROJECT explicitly, never the client's cwd fallback: this server's project is fixed at boot,
+  // and letting the hub be re-derived per call is how a session ends up writing to two hubs.
   const r = method.toUpperCase() === "GET"
-    ? await signedGet(path, { session: SESSION, instance: INSTANCE_ID })
-    : await signedPost(path, payload, { session: SESSION, instance: INSTANCE_ID });
+    ? await signedGet(path, { session: SESSION, instance: INSTANCE_ID, project: PROJECT, timeoutMs })
+    : await signedPost(path, payload, { session: SESSION, instance: INSTANCE_ID, project: PROJECT, timeoutMs });
   if (!r.ok) throw new Error(`hub ${r.status} on ${path}`);
   return r.json;
 }
@@ -310,7 +312,11 @@ server.tool("relay_wait", "Block up to `timeout` seconds waiting for the next me
     // resolves inline on every current client instead of being shipped to the background.
     const w = Math.min(timeout ?? 25, 110);
     await seedCursor();
-    const { messages, cursor: c } = await api("GET", `/poll?session=${encodeURIComponent(SESSION)}&since=${cursor}&wait=${w}`);
+    // The client-side deadline must OUTLIVE the hub's hold. Since reads moved onto the shared
+    // signed client, this call inherited its 1.5s default — so every long-poll that had no message
+    // already waiting was aborted at 1.5s and surfaced as "hub 0 on /poll". Parking was dead: the
+    // tool erred on every quiet wait and only ever "worked" when a message beat the abort.
+    const { messages, cursor: c } = await api("GET", `/poll?session=${encodeURIComponent(SESSION)}&since=${cursor}&wait=${w}`, undefined, { timeoutMs: (w + 15) * 1000 });
     cursor = c;
     return { content: [{ type: "text", text: messages.length ? messages.map(fmt).join("\n") : "(timed out, no message)" }] };
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.17.69",
+  "version": "0.17.72",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"
@@ -11,7 +11,7 @@
     "pg": "^8.22.0"
   },
   "scripts": {
-    "test": "node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-handoff.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-balances.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-reaper.mjs && node test-events.mjs && node test-proposals.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-inbox-delivery.mjs && node test-hub-routing.mjs && python3 engine/test-routing.py && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && node test-bridge.mjs && bash test-crew.sh"
+    "test": "node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-redelivery.mjs && node test-handoff.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-balances.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-reaper.mjs && node test-events.mjs && node test-proposals.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-splitbrain.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-inbox-delivery.mjs && node test-hub-routing.mjs && node test-hook-routing.mjs && node test-relay-wait.mjs && python3 engine/test-routing.py && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && node test-bridge.mjs && bash test-crew.sh"
   },
   "description": "The hub-world for AI agent crews \u2014 orchestrate Claude Code, Codex, GLM, Kimi, DeepSeek & any OpenRouter model as live crews with a plan-aware Advisor, a Kanban/flow command center, a testing gate, and an economics brain (Scrooge).",
   "files": [
@@ -54,4 +54,4 @@
   "engines": {
     "node": ">=18"
   }
-}
+}