trantor 0.17.98 → 0.18.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.17.98",
+  "version": "0.18.0",
   "description": "Trantor \u2014 the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/hooks/stop-inbox.mjs

@@ -54,10 +54,17 @@ function readStdin() {
 // complaint this exists to answer. So before letting a stop through we ask the hub what this
 // session is still owed, and refuse ONCE if any of it has gone quiet.
 //
-// Deliberately narrow: only a contract whose assignee is offline, or one that is overdue, blocks.
-// An open contract with a healthy seat working on it is exactly what "in progress" looks like, and
-// nagging about it every stop would be worse than saying nothing. Fail-open throughout: a hub that
-// is down or slow must never trap a session.
+// Deliberately narrow: only a contract the hub calls `stalled` blocks — assignee offline, or overdue
+// while online. An open contract with a healthy seat working on it is exactly what "in progress"
+// looks like, and nagging about it every stop would be worse than saying nothing. Fail-open
+// throughout: a hub that is down or slow must never trap a session.
+//
+// `abandoned` deliberately does NOT block. Its assignee has been quiet so long the contract can no
+// longer resolve itself, and blocking on it would nag every future session forever about a seat that
+// is never coming back — the ghost problem this hook was accused of causing. The lifecycle guarantees
+// the dispatcher was already told: a contract is always `stalled` (and blocking) for a long while
+// before it can become `abandoned`. After that the hub keeps it in the ledger, and relay_contracts
+// still shows it, but it stops trapping anyone.
 const OVERDUE_MS = (() => {
   const raw = process.env.TRANTOR_CONTRACT_OVERDUE_MS;
   const n = raw === undefined || raw === "" ? NaN : Number(raw);
@@ -68,13 +75,18 @@ async function stalledContractCheck({ session, project, instanceId }) {
   if (process.env.RELAY_STOP_CONTRACTS === "0") return allow();
   let contracts = [];
   try {
-    const r = await signedGet(`/contracts?session=${encodeURIComponent(session)}&project=${encodeURIComponent(project)}`,
+    const r = await signedGet(`/contracts?session=${encodeURIComponent(session)}&project=${encodeURIComponent(project)}&overdueMs=${OVERDUE_MS}`,
       { timeoutMs: FETCH_TIMEOUT_MS, session, instance: instanceId, project });
     if (!r.ok) return allow();
     contracts = r.json?.contracts || [];
   } catch { return allow(); }
 
-  const stalled = contracts.filter(c => !c.answered && (!c.assigneeOnline || c.ageMs >= OVERDUE_MS));
+  // The hub owns the verdict now (it also knows the abandon window). An older hub that does not send
+  // `disposition` falls back to the original predicate, so a new hook against an old hub is unchanged.
+  const stalled = contracts.filter(c => c.disposition
+    ? c.disposition === "stalled"
+    : (!c.answered && (!c.assigneeOnline || c.ageMs >= OVERDUE_MS)));
+  const abandoned = contracts.filter(c => c.disposition === "abandoned");
   if (!stalled.length) return allow();
 
   const mins = (ms) => (ms >= 60000 ? `${Math.round(ms / 60000)}m` : `${Math.round(ms / 1000)}s`);
@@ -85,9 +97,15 @@ async function stalledContractCheck({ session, project, instanceId }) {
     return `- ${sanitize(c.to)} (${health}) — asked ${mins(c.ageMs)} ago: "${sanitize(String(c.text).slice(0, 120))}"`;
   }).join("\n");
 
+  const ghosts = abandoned.length
+    ? `\n\nAlso ${abandoned.length} contract(s) are ABANDONED — their assignee has been gone long enough ` +
+      `that they can never be answered (${abandoned.slice(0, 3).map(c => sanitize(c.to)).join(", ")}). ` +
+      `They no longer block you and you will not be told again. If that work still matters, reassign it.`
+    : "";
+
   const reason =
     `You dispatched ${stalled.length} contract(s) that have gone quiet, and you were about to go idle:\n` +
-    lines + `\n\n` +
+    lines + ghosts + `\n\n` +
     `Do not just wait, and do not ask the human to check. Use relay_contracts to see everything you are owed, ` +
     `relay_peers to see whether the seat is alive, and relay_send to ask it directly. If a seat is down, say so and ` +
     `either swap it (\`trantor swap <agent>\`) or reassign the work. If the work is genuinely still running, say that ` +

package/hub.mjs

@@ -46,6 +46,22 @@ const FOCUS_OFFLINE_MS = Number(process.env.RELAY_FOCUS_OFFLINE_MS || ONLINE_MS)
 // untouched for an hour is routine — a big task runs a long time between prompts.
 const FOCUS_IDLE_MS = Number(process.env.RELAY_FOCUS_IDLE_MS || 6 * 60 * 60 * 1000);
 const REAP_INTERVAL_MS = Number(process.env.RELAY_REAP_INTERVAL_MS || 60000);       // how often the reaper sweeps (env-tunable; tests set it low)
+// Contract lifecycle. A contract closes when the ASSIGNEE answers — so a seat that does the work and
+// then dies never closes one, and a session found 16 such ghosts in a day, every one with its files
+// already on disk. The dispatcher then gets nagged about them at every stop, forever, and the human
+// becomes the one who remembers. That is the complaint this whole area exists to answer.
+//
+// The fix is the stale-card lane's shape, not an auto-close: quiet is NOT proof of death, so the hub
+// never marks a contract answered on the assignee's behalf. Instead a contract walks a lifecycle —
+//   waiting   assignee online and inside the overdue window; this is what progress looks like
+//   stalled   assignee offline, or overdue while online; ACTIONABLE, and what blocks a stop
+//   abandoned assignee quiet past CONTRACT_ABANDON_MS; it can no longer resolve itself
+// — and only the middle state nags. Abandoned ones stay in the ledger with their evidence so
+// `relay_contracts` can still show what died, but they stop trapping every future session.
+// The window is deliberately much longer than the stop hook's overdue window, so a contract is
+// always surfaced as `stalled` (and acted on) BEFORE it can go quiet as `abandoned`.
+const CONTRACT_ABANDON_MS = Number(process.env.RELAY_CONTRACT_ABANDON_MS || 60 * 60 * 1000);
+const CONTRACT_WINDOW_MS = Number(process.env.RELAY_CONTRACT_WINDOW_MS || 24 * 60 * 60 * 1000);
 if (!existsSync(DATA_DIR)) mkdirSync(DATA_DIR, { recursive: true });
 const isLoopbackHost = (host) => {
   const h = String(host || "").toLowerCase();
@@ -95,7 +111,7 @@ function scanTelemetry() {
 // TIMELINE view are untouched; every NEW type is dotted ("message", "presence.online", …) and is
 // filtered OUT of /history. Loads from the old `cardEvents` key when `events` is absent.
 function emptyState() {
-  return { messages: [], peers: {}, seq: 0, tasks: [], taskSeq: 0, projectMeta: {}, lessons: [], events: [], cardEventsBackfilled: false, aliases: {}, phaseMeta: {}, verifyGates: [], verifyGateSeq: 0, proposals: [], proposalSeq: 0, balances: { ts: 0, by: "", entries: [] }, subagentCostReset: false, handoffLog: [], identities: {}, inviteTokens: {}, focus: {}, orgPolicy: {}, instances: {}, dutySession: "" };
+  return { messages: [], peers: {}, seq: 0, tasks: [], taskSeq: 0, projectMeta: {}, lessons: [], events: [], cardEventsBackfilled: false, aliases: {}, phaseMeta: {}, verifyGates: [], verifyGateSeq: 0, proposals: [], proposalSeq: 0, balances: { ts: 0, by: "", entries: [] }, subagentCostReset: false, handoffLog: [], identities: {}, inviteTokens: {}, focus: {}, orgPolicy: {}, instances: {}, dutySession: "", contractReap: {}, eventSeq: 0 };
 }
 
 const CARD_LOG_MAX = 40;
@@ -171,6 +187,15 @@ function normalizeState(loaded = {}) {
   s.focus = loaded.focus && typeof loaded.focus === "object" ? loaded.focus : {};
   s.orgPolicy = loaded.orgPolicy && typeof loaded.orgPolicy === "object" ? loaded.orgPolicy : {};
   s.dutySession = String(loaded.dutySession || "");
+  s.contractReap = loaded.contractReap && typeof loaded.contractReap === "object" ? loaded.contractReap : {};
+  // The event id high-water mark. Seeded from the store's own MAX(id) where it supplied one, and
+  // otherwise from the largest id in the array — never from the array TAIL, which is exactly the
+  // assumption that let a clobbered id mint colliding event ids and kill the log.
+  s.eventSeq = Math.max(
+    Number(loaded.eventSeq || 0),
+    ...s.events.map(e => Number(e?.id) || 0),
+    0,
+  );
   for (const [session, v] of Object.entries(loaded.peers || {})) {
     // migrate old numeric form
     s.peers[session] = typeof v === "number"
@@ -186,6 +211,11 @@ if (STORE_KIND === "pg" || STORE_KIND === "postgres") {
   try {
     const { createPgStore } = await import("./lib/store-pg.mjs");
     durableStore = createPgStore({ url: PG_URL });
+    // An event insert that hits ON CONFLICT DO NOTHING is a LOST append, not a no-op. Silence here
+    // hid a dead log for 18 days. Never let it be quiet again.
+    durableStore.onDroppedEvent = ({ id, type }) => {
+      process.stderr.write(`[trantor] EVENT DROPPED: id ${id} (${type}) already exists — the append-only log is not appending. This is a bug, not routine.\n`);
+    };
     await durableStore.init();
     if (ORG_ID !== DEFAULT_ORG) await durableStore.createOrg({ id: ORG_ID, name: ORG_ID, ownerPubkey: "local-owner" });
     state = normalizeState(await durableStore.loadSnapshot(ORG_ID));
@@ -605,6 +635,124 @@ function reapStaleCards() {
 }
 setInterval(reapStaleCards, REAP_INTERVAL_MS).unref?.();
 
+// ---- the contract ledger -------------------------------------------------------------------
+// ONE derivation, shared by GET /contracts and the reaper below. Two copies of this is how you get
+// an endpoint and a sweeper that disagree about what is open, which is the same "two names for one
+// intent" mistake the spawn guards made.
+//
+// A contract is a DIRECT message from `session` to one peer. It closes when that peer answers:
+// strictly by `re`, or, for seats that predate that column, oldest-open-first. Excluded outright,
+// because none of these can ever be answered and so would hang open forever:
+//   - broadcasts (`to === "all"`)
+//   - self-dispatch (`from === to`) — a reply from yourself is never counted as an answer
+//   - the hub's own pseudo-identities (`hub:*`) and hub-authored mail — nothing polls them (0.17.87)
+// Durations an agent READS and acts on, so they must not round to nonsense. Minutes are the useful
+// unit in production (the abandon window is an hour), but the drills run in seconds and "past the 0m
+// abandon window" is a sentence that tells the reader nothing.
+function humanMs(ms) {
+  const n = Math.max(0, Number(ms) || 0);
+  if (n < 60000) return `${Math.max(1, Math.round(n / 1000))}s`;
+  if (n < 3600000) return `${Math.round(n / 60000)}m`;
+  return `${(n / 3600000).toFixed(n < 36000000 ? 1 : 0)}h`;
+}
+
+function contractRecipientIsAnswerable(m) {
+  return !!m.to && m.to !== "all" && m.from !== m.to && !m.to.startsWith("hub:") && !m.from.startsWith("hub:");
+}
+
+function contractsFor(session, { project = "", windowMs = CONTRACT_WINDOW_MS, overdueMs = null } = {}) {
+  const t = now();
+  const cutoff = t - windowMs;
+  const abandonCut = t - CONTRACT_ABANDON_MS;
+  const onCut = t - ONLINE_MS;
+  const mine = state.messages.filter(m =>
+    m.from === session && m.ts >= cutoff && contractRecipientIsAnswerable(m) && (!project || m.project === project));
+  const replies = state.messages.filter(m => m.to === session && m.from !== session && m.ts >= cutoff);
+  const byRe = new Map();
+  for (const r of replies) if (r.re) byRe.set(Number(r.re), r);
+  const looseByPeer = new Map();
+  for (const r of replies) if (!r.re) { if (!looseByPeer.has(r.from)) looseByPeer.set(r.from, []); looseByPeer.get(r.from).push(r); }
+  for (const arr of looseByPeer.values()) arr.sort((a, b) => a.ts - b.ts);
+
+  const out = [];
+  for (const c of mine.sort((a, b) => a.ts - b.ts)) {
+    let answer = byRe.get(c.id) || null;
+    if (!answer) {
+      const pool = looseByPeer.get(c.to) || [];
+      const i = pool.findIndex(r => r.ts > c.ts);
+      if (i >= 0) answer = pool.splice(i, 1)[0];
+    }
+    const peer = state.peers[c.to] || null;
+    const seen = peer?.lastSeen || 0;
+    const online = !!seen && seen > onCut;
+    const ageMs = t - c.ts;
+    const reaped = state.contractReap?.[String(c.id)] || null;
+
+    // An answer ALWAYS wins, including over a recorded abandonment: the reap is evidence, not a
+    // tombstone. A seat that comes back and reports still closes its own contract.
+    let disposition;
+    if (answer) disposition = "answered";
+    else if (seen < abandonCut) disposition = "abandoned";     // covers never-seen (seen === 0)
+    else if (!online || (overdueMs != null && ageMs >= overdueMs)) disposition = "stalled";
+    else disposition = "waiting";
+
+    out.push({
+      id: c.id, to: c.to, text: c.text, ts: c.ts, ageMs,
+      answered: !!answer,
+      answer: answer ? { id: answer.id, ts: answer.ts, text: answer.text } : null,
+      disposition,
+      assigneeOnline: online,
+      assigneeStatus: String(peer?.status || ""),
+      assigneeLastSeenMs: seen ? t - seen : null,
+      reaped: reaped ? { ts: reaped.ts, reason: reaped.reason } : null,
+    });
+  }
+  return out;
+}
+
+// Every session that has dispatched inside the ledger window. The reaper needs all of them; the
+// endpoint only ever asks about one.
+function contractDispatchers(windowMs = CONTRACT_WINDOW_MS) {
+  const cutoff = now() - windowMs;
+  const set = new Set();
+  for (const m of state.messages) if (m.ts >= cutoff && contractRecipientIsAnswerable(m)) set.add(m.from);
+  return set;
+}
+
+// The contract reaper. Records — never invents an answer for — a contract whose assignee has been
+// quiet past CONTRACT_ABANDON_MS, so the abandonment survives a hub restart (in-memory-only state is
+// exactly why the escalation backlog re-fires on every restart) and shows up once in the FEED.
+// After this the contract stops counting as open, so it stops nagging every future session; it stays
+// listed with its evidence, so `relay_contracts` can still show what died.
+function reapAbandonedContracts() {
+  let changed = false;
+  for (const session of contractDispatchers()) {
+    for (const c of contractsFor(session)) {
+      if (c.disposition !== "abandoned") continue;
+      const key = String(c.id);
+      if (state.contractReap[key]) continue;
+      const quiet = c.assigneeLastSeenMs == null
+        ? "never seen on the bus"
+        : `last seen ${humanMs(c.assigneeLastSeenMs)} ago`;
+      const reason = `assignee ${c.to} ${quiet}, past the ${humanMs(CONTRACT_ABANDON_MS)} abandon window`;
+      state.contractReap[key] = { ts: now(), from: session, to: c.to, reason, dispatchedTs: c.ts };
+      appendEvent("contract.abandoned", "", "reaper", {
+        msgId: c.id, fromSession: session, toSession: c.to, reason,
+        text: String(c.text || "").slice(0, 500),
+      });
+      changed = true;
+    }
+  }
+  // Forget reap records whose contract has aged out of the ledger window entirely — nothing can
+  // read them any more and the map would grow without bound.
+  const cutoff = now() - CONTRACT_WINDOW_MS;
+  for (const [key, r] of Object.entries(state.contractReap)) {
+    if ((r?.dispatchedTs || 0) < cutoff) { delete state.contractReap[key]; changed = true; }
+  }
+  if (changed) dirty = true;
+}
+setInterval(reapAbandonedContracts, REAP_INTERVAL_MS).unref?.();
+
 // dashboard HTML (read once at startup)
 let UI = "";
 try { UI = readFileSync(new URL("./ui.html", import.meta.url), "utf8"); } catch {}
@@ -904,8 +1052,13 @@ const CARD_TYPES = new Set(["created", "moved", "updated"]);
 const isCardEvent = e => CARD_TYPES.has(e?.type);
 
 function appendEvent(type, project, by, extra = {}) {
+  // The id comes from a monotonic high-water mark, NOT from the tail of the array. Trusting the tail
+  // meant one bad id anywhere in the log made every future append collide, and ON CONFLICT DO NOTHING
+  // then dropped them all without a word. `extra` is spread FIRST so a stray id in a payload can
+  // never take over the event's own identity.
   const last = state.events[state.events.length - 1];
-  const ev = { id: (last?.id || 0) + 1, ts: now(), type, project: project || "", by: by || "", ...extra };
+  state.eventSeq = Math.max(Number(state.eventSeq || 0), Number(last?.id) || 0) + 1;
+  const ev = { ...extra, id: state.eventSeq, ts: now(), type, project: project || "", by: by || "" };
   state.events.push(ev);
   if (state.events.length > EVENT_CAP) state.events.splice(0, state.events.length - EVENT_CAP);
   pushEventToStreams(ev);
@@ -1172,7 +1325,11 @@ const server = http.createServer(async (req, res) => {
       }
       for (const e of (Array.isArray(b.events) ? b.events : [])) {
         const last = state.events[state.events.length - 1];
-        const ev = { ...e, id: (last?.id || 0) + 1, project: proj };
+        // Spread the incoming event FIRST, then stamp OUR id and project over it. The incoming `id`
+        // belongs to the other hub's log and must not survive in any form: carried into the payload
+        // it comes back on load and overwrites the real row id.
+        state.eventSeq = Math.max(Number(state.eventSeq || 0), Number(last?.id) || 0) + 1;
+        const ev = { ...e, id: state.eventSeq, project: proj };
         if (ev.taskId != null && remap.has(Number(ev.taskId))) ev.taskId = remap.get(Number(ev.taskId));
         state.events.push(ev); added.events++;
       }
@@ -2288,36 +2445,25 @@ const server = http.createServer(async (req, res) => {
     if (req.method === "GET" && P === "/contracts") {
       const session = String(q.session || "");
       if (!session) return json(res, 400, { error: "session required" });
-      const proj = String(q.project || "");
-      const windowMs = Math.max(60000, Number(q.windowMs || 24 * 3600 * 1000));
-      const cutoff = now() - windowMs;
-      const mine = state.messages.filter(m => m.from === session && m.to && m.to !== "all" && m.ts >= cutoff && (!proj || m.project === proj));
-      const replies = state.messages.filter(m => m.to === session && m.from !== session && m.ts >= cutoff);
-      const byRe = new Map();
-      for (const r of replies) if (r.re) byRe.set(Number(r.re), r);
-      const looseByPeer = new Map();
-      for (const r of replies) if (!r.re) { if (!looseByPeer.has(r.from)) looseByPeer.set(r.from, []); looseByPeer.get(r.from).push(r); }
-      for (const arr of looseByPeer.values()) arr.sort((a, b) => a.ts - b.ts);
-      const out = [];
-      for (const c of mine.sort((a, b) => a.ts - b.ts)) {
-        let answer = byRe.get(c.id) || null;
-        if (!answer) {
-          const pool = looseByPeer.get(c.to) || [];
-          const i = pool.findIndex(r => r.ts > c.ts);
-          if (i >= 0) answer = pool.splice(i, 1)[0];
-        }
-        const peer = state.peers[c.to] || null;
-        const seen = peer?.lastSeen || 0;
-        out.push({
-          id: c.id, to: c.to, text: c.text, ts: c.ts, ageMs: now() - c.ts,
-          answered: !!answer,
-          answer: answer ? { id: answer.id, ts: answer.ts, text: answer.text } : null,
-          assigneeOnline: !!seen && (now() - seen) < ONLINE_MS,
-          assigneeStatus: String(peer?.status || ""),
-          assigneeLastSeenMs: seen ? now() - seen : null,
-        });
-      }
-      return json(res, 200, { session, contracts: out, open: out.filter(c => !c.answered).length });
+      const windowMs = Math.max(60000, Number(q.windowMs || CONTRACT_WINDOW_MS));
+      const rawOverdue = q.overdueMs === undefined || q.overdueMs === "" ? null : Number(q.overdueMs);
+      const overdueMs = Number.isFinite(rawOverdue) ? Math.max(0, rawOverdue) : null;
+      const all = contractsFor(session, { project: String(q.project || ""), windowMs, overdueMs });
+      const by = (d) => all.filter(c => c.disposition === d).length;
+      // Abandoned contracts leave `contracts` entirely and ride in their own key.
+      //
+      // Not cosmetic. A session's hooks are PINNED at session start, so an older stop hook iterates
+      // `contracts` with its own predicate and knows nothing about `disposition` — it kept blocking on
+      // ghosts no matter what the hub called them. Keeping them in the array meant the fix only
+      // reached sessions that restarted, and a live one nagged its operator every single turn.
+      // Splitting them out fixes every running session the moment the hub redeploys, and the ledger
+      // still shows what died via `abandonedContracts`.
+      const out = all.filter(c => c.disposition !== "abandoned");
+      return json(res, 200, {
+        session, contracts: out, abandonedContracts: all.filter(c => c.disposition === "abandoned"),
+        open: out.filter(c => !c.answered).length,
+        waiting: by("waiting"), stalled: by("stalled"), abandoned: by("abandoned"), answered: by("answered"),
+      });
     }
 
     if (req.method === "GET" && P === "/inbox") {

package/lib/store-contract.mjs

@@ -126,7 +126,7 @@ CREATE TABLE IF NOT EXISTS peers (
 -- The fields that currently ride in-memory and are LOST on restart. This is the debt being paid.
 CREATE TABLE IF NOT EXISTS kv (
   org_id TEXT NOT NULL,
-  key    TEXT NOT NULL,        -- 'verifyGates'|'balances'|'handoffLog'|'aliases'|'phaseMeta'|'focus'|'projectMeta'|'lessons'|'orgPolicy'|'meta'
+  key    TEXT NOT NULL,        -- 'verifyGates'|'balances'|'handoffLog'|'aliases'|'phaseMeta'|'focus'|'projectMeta'|'lessons'|'orgPolicy'|'meta'|'contractReap'
   value  JSONB NOT NULL,
   PRIMARY KEY (org_id, key)
 );
@@ -138,9 +138,12 @@ CREATE TABLE IF NOT EXISTS schema_meta (version INT PRIMARY KEY, applied_at BIGI
 // `proposals` (agent-proposed permissions, v0.17.68) especially: a denied proposal is a MEMORY —
 // the hub refuses near-duplicate re-proposals against it, and a restart that forgets denials
 // silently re-opens every door the operator closed.
+// `contractReap` likewise: it records that a dispatched contract's assignee went quiet for good.
+// Held only in memory it would be rebuilt from scratch on every restart, and the whole ghost backlog
+// would re-announce itself — the same shape of bug as the in-memory escalation set.
 export const KV_KEYS = ["verifyGates", "balances", "handoffLog", "aliases", "phaseMeta", "focus",
                         "projectMeta", "lessons", "orgPolicy", "meta", "subagentCostReset", "seq",
-                        "proposals"];
+                        "proposals", "contractReap"];
 
 // ---------------------------------------------------------------------------------------------
 // INVARIANTS — carried forward from 0.17.54. Breaking one silently corrupts the board.

package/lib/store-pg.mjs

@@ -10,24 +10,34 @@ const ms = (v, fallback = Date.now()) => {
 };
 const num = (v) => (v == null ? v : Number(v));
 
+const EVENT_COLUMN_KEYS = ["id", "ts", "type", "project", "by", "by_session", "taskId", "task_id", "payload"];
 function stripEventPayload(evt = {}) {
   const payload = { ...(evt.payload && typeof evt.payload === "object" ? evt.payload : {}) };
+  // The nested payload gets the same treatment as the top level. It used to be copied in wholesale,
+  // so a column key riding inside it (an `id` from an imported event) was stored and then clobbered
+  // the real column on the way back out.
+  for (const k of EVENT_COLUMN_KEYS) delete payload[k];
   for (const [k, v] of Object.entries(evt)) {
-    if (["id", "ts", "type", "project", "by", "by_session", "taskId", "task_id", "payload"].includes(k)) continue;
+    if (EVENT_COLUMN_KEYS.includes(k)) continue;
     payload[k] = v;
   }
   return payload;
 }
 
+// The COLUMNS are the truth; the payload is only the fields that have no column. Spreading payload
+// LAST let a stored `id` overwrite the row id, and that silently killed the append-only log for 18
+// days: 1198 rows (8706..9903 on the production hub) carried a shadow payload id, so on load the
+// array tail reported id 4655 instead of 9903, appendEvent then minted 4656 and every insert after
+// that hit ON CONFLICT (id) DO NOTHING. Payload first, columns after: a column can never be clobbered.
 function eventFromRow(row) {
   const payload = row.payload && typeof row.payload === "object" ? row.payload : {};
   const ev = {
+    ...payload,
     id: Number(row.id),
     ts: Number(row.ts),
     type: row.type,
     project: row.project || "",
     by: row.by_session || "",
-    ...payload,
   };
   if (row.task_id != null) ev.taskId = Number(row.task_id);
   return ev;
@@ -123,11 +133,13 @@ function kvFromState(state) {
     lessons: state.lessons || [],
     orgPolicy: state.orgPolicy || {},
     proposals: state.proposals || [],
+    contractReap: state.contractReap || {},
     meta: {
       taskSeq: Number(state.taskSeq || 0),
       verifyGateSeq: Number(state.verifyGateSeq || 0),
       proposalSeq: Number(state.proposalSeq || 0),
       cardEventsBackfilled: !!state.cardEventsBackfilled,
+      eventSeq: Number(state.eventSeq || 0),
       inviteTokens: state.inviteTokens || {},
       instances: state.instances || {},
     },
@@ -541,12 +553,18 @@ export class PgStore {
       }
       if (tasks.deletes.length) await c.query("DELETE FROM tasks WHERE org_id=$1 AND id = ANY($2::bigint[])", [orgId, tasks.deletes]);
       for (const e of events.upserts) {
-        await c.query(
+        const r = await c.query(
           `INSERT INTO events(id, org_id, ts, type, project, by_session, task_id, payload)
            VALUES($1,$2,$3,$4,$5,$6,$7,$8::jsonb)
            ON CONFLICT (id) DO NOTHING`,
           [Number(e.id), orgId, ms(e.ts), e.type || "", e.project || "", e.by || "", e.taskId ?? null, JSON.stringify(stripEventPayload(e))],
         );
+        // DO NOTHING protects a foreign row, but it also swallows a REAL append when the id collides.
+        // That is what hid the dead log for 18 days: every event was dropped and nothing said a word.
+        // A conflict here is never routine, so say so.
+        if (r?.rowCount === 0) {
+          this.onDroppedEvent?.({ id: Number(e.id), type: e.type || "", orgId });
+        }
       }
       if (events.deletes.length) await c.query("DELETE FROM events WHERE org_id=$1 AND id = ANY($2::bigint[])", [orgId, events.deletes]);
       if (events.upserts.length) await c.query("SELECT setval(pg_get_serial_sequence('events','id'), GREATEST((SELECT COALESCE(MAX(id),0) FROM events), 1), true)");
@@ -633,13 +651,18 @@ export class PgStore {
   }
 
   async loadSnapshot(orgId) {
-    const [tasks, peersRows, eventsRows, messagesRows, identitiesRows, kvRows] = await Promise.all([
+    const [tasks, peersRows, eventsRows, messagesRows, identitiesRows, kvRows, eventMaxRow] = await Promise.all([
       this.pool.query("SELECT * FROM tasks WHERE org_id=$1 ORDER BY id ASC", [orgId]),
       this.pool.query("SELECT * FROM peers WHERE org_id=$1 ORDER BY session ASC", [orgId]),
       this.pool.query("SELECT * FROM events WHERE org_id=$1 ORDER BY id ASC", [orgId]),
       this.pool.query("SELECT * FROM messages WHERE org_id=$1 ORDER BY id ASC", [orgId]),
       this.pool.query("SELECT * FROM identities WHERE org_id=$1 ORDER BY created_at ASC", [orgId]),
       this.pool.query("SELECT key, value FROM kv WHERE org_id=$1", [orgId]),
+      // The authoritative high-water mark for event ids. Deriving it from the loaded array is what
+      // broke: a clobbered tail reported a lower id than the table actually held. Ask the table.
+      // Deliberately NOT scoped to org: the events primary key is (id) alone, so the id space is
+      // global and a per-org max would still collide across orgs.
+      this.pool.query("SELECT COALESCE(MAX(id),0) AS max_id FROM events"),
     ]);
     const kv = Object.fromEntries(kvRows.rows.map(r => [r.key, r.value]));
     const peers = {};
@@ -681,6 +704,8 @@ export class PgStore {
       instances: meta.instances && typeof meta.instances === "object" ? meta.instances : {},
       focus: kv.focus && typeof kv.focus === "object" ? kv.focus : {},
       orgPolicy: kv.orgPolicy && typeof kv.orgPolicy === "object" ? kv.orgPolicy : {},
+      contractReap: kv.contractReap && typeof kv.contractReap === "object" ? kv.contractReap : {},
+      eventSeq: Math.max(Number(eventMaxRow?.rows?.[0]?.max_id || 0), Number(meta.eventSeq || 0)),
     };
   }
 }

package/mcp.mjs

@@ -136,26 +136,42 @@ server.tool("relay_whoami", "Show this session's relay identity, project, hub UR
   return { content: [{ type: "text", text }] };
 });
 
-server.tool("relay_contracts", "What you dispatched and are still owed. Lists every DIRECT message you sent to another session that has not been answered yet, with how long it has been outstanding, whether that session is still alive, and its last known status. Call this before concluding a crew is idle, stuck, or done — silence on the bus is not evidence either way. Answered contracts carry the outcome text.", {},
+server.tool("relay_contracts", "What you dispatched and are still owed. Lists every DIRECT message you sent to another session, with how long it has been outstanding, whether that session is still alive, and its last known status. Each one carries a disposition: WAITING (assignee alive and working — normal), STALLED (assignee offline or overdue — poke it, swap it, or reassign), ABANDONED (assignee gone so long the contract can never be answered — the work needs reassigning, nobody is coming back), or answered, with the outcome text. Call this before concluding a crew is idle, stuck, or done — silence on the bus is not evidence either way.", {},
   async () => {
     let r;
     try { r = await api("GET", `/contracts?session=${encodeURIComponent(SESSION)}&project=${encodeURIComponent(PROJECT)}`); }
     catch (e) { return { content: [{ type: "text", text: `could not reach the hub: ${e?.message || e}` }] }; }
-    const all = r?.contracts || [];
-    const open = all.filter(c => !c.answered);
+    // The hub keeps abandoned contracts in their own key so older stop hooks stop blocking on them.
+    // The ledger still wants to SHOW them, so put the two halves back together here.
+    const all = [...(r?.contracts || []), ...(r?.abandonedContracts || [])].sort((a, b) => a.ts - b.ts);
     if (!all.length) return { content: [{ type: "text", text: "You have not dispatched any contracts in the last 24h." }] };
+    // Fall back to the pre-disposition shape when talking to an older hub.
+    const disp = (c) => c.disposition || (c.answered ? "answered" : (c.assigneeOnline ? "waiting" : "stalled"));
+    const open = all.filter(c => disp(c) === "waiting" || disp(c) === "stalled");
+    const abandoned = all.filter(c => disp(c) === "abandoned");
     const mins = (ms) => (ms >= 60000 ? `${Math.round(ms / 60000)}m` : `${Math.round(ms / 1000)}s`);
+    const MARK = { answered: "✅", waiting: "⏳", stalled: "⚠️", abandoned: "🪦" };
     const line = (c) => {
-      const health = c.answered ? "" :
+      const d = disp(c);
+      const health = d === "answered" ? "" :
         c.assigneeOnline ? ` · alive (${c.assigneeStatus || "no status"})`
         : c.assigneeLastSeenMs == null ? " · NEVER SEEN on the bus"
         : ` · LAST SEEN ${mins(c.assigneeLastSeenMs)} ago`;
-      const out = c.answered ? ` → ${String(c.answer?.text || "").slice(0, 120)}` : "";
-      return `${c.answered ? "✅" : "⏳"} #${c.id} → ${c.to} (${mins(c.ageMs)} ago)${health}: "${String(c.text).slice(0, 100)}"${out}`;
+      const out = d === "answered" ? ` → ${String(c.answer?.text || "").slice(0, 120)}` : "";
+      const tag = d === "answered" ? "" : ` [${d.toUpperCase()}]`;
+      return `${MARK[d] || "⏳"} #${c.id} → ${c.to} (${mins(c.ageMs)} ago)${tag}${health}: "${String(c.text).slice(0, 100)}"${out}`;
     };
-    const text = `${open.length} outstanding of ${all.length} contract(s) in the last 24h:\n`
+    const notes = [];
+    if (open.some(c => disp(c) === "stalled")) {
+      notes.push("⚠️ A STALLED contract's assignee is offline or overdue. Waiting will not finish the work — check it, swap it (`trantor swap <agent>`), or reassign.");
+    }
+    if (abandoned.length) {
+      notes.push(`🪦 ${abandoned.length} ABANDONED: the assignee has been gone too long for these to ever be answered. Nobody is coming back — reassign the work or drop it deliberately.`);
+    }
+    const text = `${open.length} outstanding of ${all.length} contract(s) in the last 24h`
+      + (abandoned.length ? ` (plus ${abandoned.length} abandoned)` : "") + `:\n`
       + all.slice(-25).map(line).join("\n")
-      + (open.some(c => !c.assigneeOnline) ? "\n\n⚠️ At least one assignee is not alive on the bus. Waiting on it will not finish the work — check it, swap it, or reassign." : "");
+      + (notes.length ? "\n\n" + notes.join("\n") : "");
     return { content: [{ type: "text", text }] };
   });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.17.98",
+  "version": "0.18.0",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"

package/skills/crew/SKILL.md

@@ -92,6 +92,17 @@ Loop until the board is done — you are a foreman, not a mailbox:
 3. ACT within one cycle: failed card → read the report, send a fix contract, card back to
    doing · dead agent → `trantor up <agent>` (re-verifies) + resend contract · silent-but-alive
    → direct-message nudge naming the card.
+   Use `relay_contracts` for the ledger of what you dispatched and are still owed. Every contract
+   carries a **disposition**, and each one means a different action:
+   - **WAITING** — assignee alive, inside the overdue window. This is what progress looks like. Do
+     nothing; do not nudge it just because it is quiet.
+   - **STALLED** — assignee offline, or overdue while online. Act NOW: check the seat, `trantor up`
+     / `trantor swap` it, or reassign. This is also the only disposition that blocks your stop.
+   - **ABANDONED** — the assignee has been gone long enough that the contract can never be
+     answered. Nobody is coming back. **Reassign the work or drop it deliberately** — it will not
+     block you again, and it will not resolve itself.
+   A contract is never closed on the assignee's behalf: quiet is not an outcome. An abandoned one
+   stays in the ledger with the evidence, and a seat that revives still closes its own contract.
 4. Grunt sub-tasks that appear mid-build (a regex, a config block, a doc paragraph) →
    `relay_scrooge`, don't burn a crew seat or your own window.
 5. Record lessons as you diagnose (`relay_lesson(text, scope)` — global or per-agent quirks);