trantor 0.18.10 → 0.18.12

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.10",
+  "version": "0.18.12",
   "description": "Trantor \u2014 the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/README.md

@@ -371,7 +371,7 @@ rate, not work rate.
 
 ```
 trantor setup | doctor | connect | profile | provider | models
-        | up <agents…> | swap <old> <new> | down | ui | advise | hub | watch
+        | up <agents…> | swap <old> <new> | down | seat-why <agent> | ui | advise | hub | watch
         | adopt <project> | reconcile | duty | orchestrate | patrol | app | backfill | init-hooks
 ```
 
@@ -385,6 +385,10 @@ trantor setup | doctor | connect | profile | provider | models
   (`glm:zai-coding-plan --difficulty hard`); spawns are verified on the bus with one retry;
   geometry auto-detects the screen you're working on (`CREW_RECT="X,Y,W,H"` to override).
 - **`trantor swap <oldAgent> <newSpec>`** replaces an exhausted agent with a live-selected one.
+- **`trantor seat-why <agent> [--json]`** — WHY a seat is down, from evidence (the err file first,
+  then logs, tracked panes, live pids): `live`, `dead-quota`, `dead-auth`, `dead-crash`,
+  `no-runner`, or `no-pane`, each with the advice that actually fits. A quota-dead seat is
+  indistinguishable from a broken bus until you read the err file — this reads it for you.
 - **`trantor down`** kills crew processes via their ttys and closes windows without macOS
   "Terminate?" dialogs.
 

package/bin/adopt.mjs

@@ -1,150 +1,107 @@
 #!/usr/bin/env node
-// trantor adopt — graduate a project from the machine-local hub to a remote hub, in ONE command.
+// `trantor adopt` — take over a session that is already running in a Terminal.
 //
-//   trantor adopt <project> [--hub <url>] [--dry] [--force]
+// You cannot move a running pty into herdr. That is the wall this hits, and it is not going away.
+// But the pty was never the valuable part: the CONVERSATION is, and that lives in a transcript on
+// disk. So adopting is a two-step move — learn which session id is live, then reopen THAT
+// conversation inside Trantor with --resume. The terminal changes; the thread does not.
 //
-// The crm-platform lesson: a new project is born unpinned, lives on the local hub (by design —
-// TDD §12.1's fallback), and moving it to the shared hub was three separate ceremonies (enroll
-// identities, migrate data, write the pin) spread across two machines. This collapses them:
-//
-//   1. read the project's rows off the LOCAL hub state (tasks/events/messages)
-//   2. enroll this machine's identities for the project on the target hub (owner-signed invites):
-//      the orchestrator (<host>:<project>) as owner, every existing seat key as write
-//   3. POST /import (owner-signed) — the hub merges, remapping colliding card ids itself
-//   4. verify the count round-trip, THEN write the routing pin
-//
-// No ssh, no direct Postgres access: the hub's /import endpoint is the migration surface.
-// Live sessions keep their old routing until restarted — adopt SAYS so rather than pretending.
-import { readFileSync, writeFileSync, existsSync, readdirSync } from "node:fs";
-import { join } from "node:path";
+// Which session is live cannot be read from the process: macOS does not expose another process's
+// environment, so CLAUDE_CODE_SESSION_ID is unreachable. The transcript's modification time is the
+// evidence we do have, and it is good evidence but not proof — a session that just ended and one
+// still running look similar for a minute. So this SHOWS the candidates and defaults to the
+// newest, rather than asserting which one is yours.
+import { readdirSync, statSync, existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { join, dirname } from "node:path";
 import { homedir } from "node:os";
-import { hostId, DEFAULT_HUB_URL } from "../lib/project.mjs";
-import { loadOrCreate, signRequest } from "../lib/identity.mjs";
-import { sfetchJson } from "../lib/signed-fetch.mjs";
-import { scan } from "../lib/splitbrain.mjs";
-
-const argv = process.argv.slice(2);
-const PROJECT = argv.find(a => !a.startsWith("--")) || "";
-const arg = (k) => { const i = argv.indexOf(`--${k}`); return i >= 0 ? (argv[i + 1] ?? "") : ""; };
-const has = (k) => argv.includes(`--${k}`);
-if (!PROJECT) { console.error("usage: trantor adopt <project> [--hub <url>] [--dry] [--force]"); process.exit(1); }
-
-const BUS_DIR = process.env.AGENT_BUS_DIR || join(homedir(), ".agent-bus");
-const CONFIG_PATH = join(BUS_DIR, "config.json");
-let config = {}; try { config = JSON.parse(readFileSync(CONFIG_PATH, "utf8")); } catch {}
-const LOCAL = config.url || "http://127.0.0.1:4477";
-
-// target: --hub wins; else the hub most of the fleet already lives on
-const pinCounts = {};
-for (const u of Object.values(config.hubs || {})) if (!/127\.0\.0\.1|localhost/.test(u)) pinCounts[u] = (pinCounts[u] || 0) + 1;
-const TARGET = arg("hub") || Object.entries(pinCounts).sort((a, b) => b[1] - a[1])[0]?.[0] || "";
-if (!TARGET) { console.error("no remote hub known — pass --hub <url> (no non-local pins exist to infer one from)"); process.exit(1); }
-if ((config.hubs || {})[PROJECT] === TARGET) { console.log(`${PROJECT} is already pinned to ${TARGET} — nothing to do.`); process.exit(0); }
+import { resolveProject } from "../lib/project.mjs";
 
-// 1. the project's rows, straight from the local hub's state file (full fidelity, no pagination)
-const statePath = process.env.RELAY_STATE || join(BUS_DIR, "bus.json");
-let local = {}; try { local = JSON.parse(readFileSync(statePath, "utf8")); } catch {}
-const tasks = (local.tasks || []).filter(t => t.project === PROJECT);
-const events = (local.events || []).filter(e => e.project === PROJECT);
-const messages = (local.messages || []).filter(m => (m.project || "") === PROJECT);
-const livePeers = Object.entries(local.peers || {}).filter(([, p]) => p.project === PROJECT && Date.now() - (p.lastSeen || 0) < 5 * 60 * 1000);
+const D = "\x1b[2m", B = "\x1b[1m", Y = "\x1b[33m", G = "\x1b[32m", R = "\x1b[0m";
+const args = process.argv.slice(2);
+const flag = (n) => { const i = args.indexOf(n); return i >= 0 ? args[i + 1] : null; };
 
-const owner = String(config.ownerIdentity || "");
-if (!owner) { console.error("config.ownerIdentity is not set — enrolments need an owner to sign invites"); process.exit(1); }
+const project = args.find(a => !a.startsWith("--") && args[args.indexOf(a) - 1] !== "--session")
+  || resolveProject(process.cwd());
+const devRoot = process.env.TRANTOR_DEV_ROOT || join(homedir(), "development");
+const dir = join(devRoot, project);
+if (!existsSync(dir)) {
+  console.error(`no local checkout for ${project} (looked in ${devRoot})`);
+  process.exit(1);
+}
 
-// identities: the orchestrator as owner + every seat key that already exists for this project
-const safe = (s) => s.replace(/[^A-Za-z0-9_.-]/g, "_");
-const keyFiles = (() => { try { return readdirSync(join(BUS_DIR, "keys")); } catch { return []; } })();
-const orchestrator = `${hostId()}:${PROJECT}`;
-const seats = keyFiles
-  .filter(f => f.endsWith(`_${safe(PROJECT)}.json`))
-  .map(f => f.replace(/\.json$/, "").replace(`_${safe(PROJECT)}`, `:${PROJECT}`))
-  .filter(n => n !== safe(orchestrator).replace(`_${safe(PROJECT)}`, `:${PROJECT}`) && n !== orchestrator);
+/** claude keeps a project's transcripts under a slug of its working directory. */
+const slug = dir.replace(/[/.]/g, "-");
+const tdir = join(homedir(), ".claude", "projects", slug);
+if (!existsSync(tdir)) {
+  console.error(`no claude sessions have ever run in ${dir}`);
+  process.exit(1);
+}
 
-console.log(`adopt    : ${PROJECT}`);
-console.log(`from     : ${LOCAL} (${tasks.length} cards · ${events.length} events · ${messages.length} messages)`);
-console.log(`to       : ${TARGET}`);
-console.log(`enroll   : ${orchestrator} (owner)${seats.length ? ` + ${seats.join(", ")} (write)` : ""}`);
-if (livePeers.length) console.log(`⚠ LIVE   : ${livePeers.map(([s]) => s).join(", ")} — they keep the OLD routing until restarted`);
-if (has("dry")) { console.log("\n[dry run] nothing changed."); process.exit(0); }
+const RECENT_MS = 60 * 60 * 1000;
+const now = Date.now();
+const candidates = readdirSync(tdir)
+  .filter(f => f.endsWith(".jsonl"))
+  .map(f => {
+    const p = join(tdir, f);
+    const st = statSync(p);
+    return { id: f.replace(/\.jsonl$/, ""), mtime: st.mtimeMs, size: st.size };
+  })
+  .filter(c => now - c.mtime < RECENT_MS)
+  .sort((a, b) => b.mtime - a.mtime);
 
-const ownerId = loadOrCreate(owner, "human");
-async function enroll(name, role) {
-  const invBody = JSON.stringify({ scopes: [{ project: PROJECT, role }], ttlSec: 600 });
-  const invSig = signRequest(ownerId, { method: "POST", path: "/invite", body: invBody });
-  const inv = await (await fetch(`${TARGET}/invite`, { method: "POST", headers: { "content-type": "application/json", ...invSig }, body: invBody, signal: AbortSignal.timeout(8000) })).json();
-  if (!inv.token) throw new Error(`invite for ${name}: ${inv.error || "no token"}`);
-  const id = loadOrCreate(name, "agent");
-  const body = JSON.stringify({ token: inv.token, name, pubkey: id.pubkey, kind: "agent" });
-  const sig = signRequest(id, { method: "POST", path: "/enroll", body });
-  const r = await (await fetch(`${TARGET}/enroll`, { method: "POST", headers: { "content-type": "application/json", ...sig }, body, signal: AbortSignal.timeout(8000) })).json();
-  if (!r.ok) throw new Error(`enroll ${name}: ${r.error || "failed"}`);
-  console.log(`  ✓ enrolled ${name} (${role})`);
+if (!candidates.length) {
+  console.error(`no session has written to ${project} in the last hour — nothing to adopt`);
+  console.error(`${D}start a fresh one instead: trantor open ${project}${R}`);
+  process.exit(1);
 }
 
-try {
-  await enroll(orchestrator, "owner");
-  for (const s of seats) await enroll(s, "write");
+const chosen = flag("--session") || candidates[0].id;
+if (!candidates.some(c => c.id === chosen) && flag("--session")) {
+  console.error(`${chosen} has not written to ${project} recently`);
+  process.exit(1);
+}
 
-  const imp = await sfetchJson(`${TARGET}/import`, {
-    identity: ownerId,
-    payload: { project: PROJECT, tasks, events, messages, by: owner, force: has("force") },
-    signal: AbortSignal.timeout(60000),
-  });
-  const impJson = await imp.json();
-  if (!impJson.ok) throw new Error(`import: ${impJson.error || imp.status}${impJson.existing ? ` (${impJson.existing} cards already there — --force to merge anyway)` : ""}`);
-  console.log(`imported : ${impJson.tasks} cards · ${impJson.events} events · ${impJson.messages} messages${impJson.remapped ? ` · ${impJson.remapped} card id(s) remapped` : ""}`);
+const ago = (ms) => { const s = Math.round((now - ms) / 1000); return s < 90 ? `${s}s ago` : `${Math.round(s / 60)}m ago`; };
+const kb = (n) => (n > 1e6 ? `${(n / 1e6).toFixed(1)}MB` : `${Math.round(n / 1e3)}KB`);
 
-  // verify BEFORE pinning — a pin pointing at a hub that doesn't have the data is a data outage
-  const check = await (await sfetchJson(`${TARGET}/tasks?project=${encodeURIComponent(PROJECT)}`, { method: "GET", identity: ownerId })).json();
-  const remoteCount = (check.tasks || []).length;
-  if (remoteCount < tasks.length) throw new Error(`verify: target has ${remoteCount} cards, local has ${tasks.length} — NOT pinning`);
-  console.log(`verified : ${remoteCount} cards on target`);
+console.log(`${B}adopt${R} · ${project}`);
+for (const c of candidates.slice(0, 5)) {
+  const mark = c.id === chosen ? `${G}→${R}` : " ";
+  console.log(`  ${mark} ${c.id}  ${D}${ago(c.mtime).padEnd(9)} ${kb(c.size)}${R}`);
+}
+if (candidates.length > 1) {
+  console.log(`${D}the newest is assumed to be yours; pick another with --session <id>${R}`);
+}
 
-  config.hubs = config.hubs || {};
-  config.hubs[PROJECT] = TARGET;
-  writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2) + "\n");
-  console.log(`pinned   : ${PROJECT} → ${TARGET}`);
+// Record it where `trantor open` looks. Same file, same format the orchestrator pane already uses,
+// so adopting and opening fresh converge on one mechanism rather than two.
+const busDir = process.env.AGENT_BUS_DIR || join(homedir(), ".agent-bus");
+const store = join(busDir, "orch-sessions.txt");
+mkdirSync(dirname(store), { recursive: true });
+const rows = existsSync(store) ? readFileSync(store, "utf8").split("\n").filter(Boolean) : [];
+const kept = rows.filter(r => r.split("\t")[0] !== project);
+writeFileSync(store, [...kept, `${project}\t${chosen}`].join("\n") + "\n");
+console.log(`\n${G}recorded${R} ${chosen} as ${project}'s orchestrator session`);
 
-  // TELL the stale sessions, don't just print at a human who may never see this terminal again.
-  // A live session holds its hub URL for its whole life: its MCP server resolved the route at
-  // boot and nothing re-reads config.json. So the moment the pin is written, every one of these
-  // is recording onto a hub nobody reads any more — the exact split-brain crebral-health spent
-  // two sessions diagnosing. They are still listening on the OLD hub, so that is where the
-  // notice has to go.
-  if (livePeers.length) {
-    const notice = `📦 ${PROJECT} has MOVED to ${TARGET}. You are still bound to ${LOCAL}, so your cards and messages now land on a hub nobody is reading. RESTART to pick up the pin — crew seats: \`trantor down && trantor up\` · Claude sessions: restart the session.`;
-    let told = 0;
-    for (const [session] of livePeers) {
-      try {
-        await sfetchJson(`${LOCAL}/send`, { identity: ownerId, payload: { from: owner, to: session, project: PROJECT, text: notice }, signal: AbortSignal.timeout(8000) });
-        told++;
-      } catch (e) { console.log(`  ⚠ could not notify ${session}: ${e.message}`); }
-    }
-    // …and once to the room, for anything live that never registered as a peer.
-    try { await sfetchJson(`${LOCAL}/send`, { identity: ownerId, payload: { from: owner, to: "all", project: PROJECT, text: notice }, signal: AbortSignal.timeout(8000) }); } catch {}
-    console.log(`\n⚠ ${livePeers.length} live session(s) still route to the OLD hub — told ${told} of them to restart:`);
-    for (const [s] of livePeers) console.log(`    ${s}`);
-    console.log(`  crew seats: trantor down && trantor up · Claude sessions: restart them when convenient.`);
+// Two live claudes on one transcript is the one thing that must not happen: they would interleave
+// writes into the same file. So say plainly what has to happen first.
+let running = [];
+try {
+  const pids = execFileSync("/usr/bin/pgrep", ["-x", "claude"], { encoding: "utf8" }).split("\n").filter(Boolean);
+  for (const pid of pids) {
+    try {
+      const out = execFileSync("/usr/sbin/lsof", ["-a", "-d", "cwd", "-p", pid, "-Fn"], { encoding: "utf8" });
+      if (out.split("\n").some(l => l.startsWith("n") && l.slice(1) === dir)) running.push(pid);
+    } catch { /* process went away between listing and asking */ }
   }
-  console.log(`\n✓ adopted. New sessions on ${PROJECT} land on ${TARGET}.`);
+} catch { /* nothing running */ }
 
-  // Prove the move actually landed as one hub, rather than trusting that it did. A migration is
-  // precisely the moment a project is most likely to end up living in two places at once.
-  try {
-    const { findings, blind } = await scan(config, ownerId, { defaultUrl: DEFAULT_HUB_URL, timeoutMs: 6000 });
-    const mine = findings.filter(f => f.project === PROJECT);
-    if (mine.length) {
-      console.log(`\n⚠ split-brain check on ${PROJECT}:`);
-      for (const f of mine) { console.log(`    ${f.message}`); console.log(`      → ${f.fix}`); }
-    } else if (blind.length) {
-      console.log(`\nsplit-brain check: partial — could not read ${blind.map(b => b.url).join(", ")}`);
-    } else {
-      console.log(`split-brain check: clean — ${PROJECT} is live on one hub only.`);
-    }
-  } catch {}
-} catch (e) {
-  console.error(`\n✗ adopt failed: ${e.message}`);
-  console.error("nothing was pinned — routing is unchanged.");
-  process.exit(1);
+if (running.length) {
+  console.log(`\n${Y}A claude is still running in ${dir} (pid ${running.join(", ")}).${R}`);
+  console.log(`Quit that window first — two sessions writing one transcript will corrupt the thread.`);
+  console.log(`Then: ${B}cd ${dir} && trantor open${R}`);
+} else {
+  console.log(`\nNothing is running there. Continue it in Trantor with:`);
+  console.log(`  ${B}cd ${dir} && trantor open${R}`);
 }

package/bin/advise.mjs

@@ -90,14 +90,19 @@ export function loadWorld() {
 
 const tierOf = (profile, prov) => profile?.providers?.[prov]?.tier || "api";
 
+const FLASH_TIER = /(flash|turbo|lite|mini|highspeed|small)/i;
+
 // pick the cheapest Scrooge model that clears the difficulty floor for a task kind
 export function scroogeModelFor(registry, caps, kind = "code", difficulty = "easy") {
   const floor = { easy: 0, medium: 35, hard: 55 }[difficulty] ?? 0;
   const cands = Object.entries(registry.models || {})
     .filter(([, m]) => (m.good_for || []).includes(kind))
-    .filter(([id]) => (caps[id]?.coding ?? caps[id]?.intelligence ?? 40) >= floor)
-    .sort((a, b) => (a[1].cost_in + a[1].cost_out) - (b[1].cost_in + b[1].cost_out));
-  return cands[0] ? { model: cands[0][0], cost_in: cands[0][1].cost_in, cost_out: cands[0][1].cost_out } : null;
+    .filter(([id]) => (caps[id]?.coding ?? caps[id]?.intelligence ?? 40) >= floor);
+  const hard = difficulty === "hard";
+  const strong = hard ? cands.filter(([id]) => !FLASH_TIER.test(id)) : cands;
+  const pool = strong.length > 0 ? strong : cands;
+  pool.sort((a, b) => (a[1].cost_in + a[1].cost_out) - (b[1].cost_in + b[1].cost_out));
+  return pool[0] ? { model: pool[0][0], cost_in: pool[0][1].cost_in, cost_out: pool[0][1].cost_out } : null;
 }
 
 // crude per-package token forecast (input+output through the executor)

package/bin/autonomy.mjs

@@ -0,0 +1,83 @@
+#!/usr/bin/env node
+// `trantor autonomy` — read and set the three dials from the CLI.
+//
+// The app will grow a settings pane for this, but the CLI has to work on its own: crew.sh asks
+// this for the harness dial every time it starts your session, and a headless machine has no app.
+import { resolveAutonomy, setAutonomy, loadAutonomy, AUTONOMY_PATH } from "../lib/autonomy.mjs";
+import { resolveProject } from "../lib/project.mjs";
+
+const D = "\x1b[2m", B = "\x1b[1m", R = "\x1b[0m";
+const args = process.argv.slice(2);
+const cmd = args[0] || "show";
+
+function projectFlag() {
+  const i = args.indexOf("--project");
+  if (i >= 0 && args[i + 1]) return args[i + 1];
+  if (args.includes("--global")) return null;
+  return resolveProject(process.cwd());
+}
+
+const BOOLS = ["commit", "push", "deploy", "swapDeadSeat", "retryFailedTurn"];
+const ENUMS = { harness: ["prompt", "bypass"] };
+
+if (cmd === "get") {
+  // Machine-readable, one value, no decoration — crew.sh reads this.
+  const key = args[1];
+  const a = resolveAutonomy(projectFlag() || "");
+  if (!(key in a)) { console.error(`unknown dial '${key}'`); process.exit(1); }
+  console.log(String(a[key]));
+} else if (cmd === "set") {
+  const key = args[1];
+  let value = args[2];
+  const project = projectFlag();
+  if (BOOLS.includes(key)) {
+    if (!["on", "off", "true", "false"].includes(value)) {
+      console.error(`${key} takes on|off`); process.exit(1);
+    }
+    value = value === "on" || value === "true";
+  } else if (ENUMS[key]) {
+    if (!ENUMS[key].includes(value)) { console.error(`${key} takes ${ENUMS[key].join("|")}`); process.exit(1); }
+  } else {
+    console.error(`unknown dial '${key}' — one of: ${[...Object.keys(ENUMS), ...BOOLS].join(", ")}`);
+    process.exit(1);
+  }
+  const out = setAutonomy(project, { [key]: value });
+  console.log(`${key} = ${out[key]}${project ? ` for ${project}` : " (default for every project)"}`);
+  // The dependencies can quietly refuse what was just asked for, so say when that happened rather
+  // than letting the operator believe a dial is on.
+  if (key === "push" && value === true && out.push === false) {
+    console.log(`${D}push stayed off: it needs commit on first${R}`);
+  }
+  if (key === "deploy" && value === true && out.deploy === false) {
+    console.log(`${D}deploy stayed off: it needs push on first${R}`);
+  }
+} else if (cmd === "json") {
+  // The app reads through THIS, not by parsing autonomy.json itself. The dependency rules (push
+  // implies commit, deploy implies push) live in one place, and a second implementation in Rust
+  // would drift from it the first time either side changed.
+  const project = projectFlag();
+  const cfg = loadAutonomy();
+  console.log(JSON.stringify({
+    project,
+    resolved: resolveAutonomy(project || "", cfg),
+    defaults: resolveAutonomy("", { ...cfg, projects: {} }),
+    overridden: project && cfg.projects?.[project] ? Object.keys(cfg.projects[project]) : [],
+    path: AUTONOMY_PATH(),
+  }));
+} else if (cmd === "show" || cmd === "list") {
+  const project = projectFlag();
+  const a = resolveAutonomy(project || "");
+  const cfg = loadAutonomy();
+  const overridden = project && cfg.projects?.[project] ? Object.keys(cfg.projects[project]) : [];
+  const mark = k => (overridden.includes(k) ? `${D} (set for ${project})${R}` : "");
+  console.log(`${B}autonomy${R}${project ? ` · ${project}` : " · defaults"}`);
+  console.log(`\n  ${B}harness${R}    ${a.harness}${mark("harness")}    ${D}whether YOUR claude asks before acting${R}`);
+  console.log(`  ${D}what a crew AGENT may do unattended is the overseer's level, per project, on the hub${R}`);
+  console.log(`\n  ${D}what Trantor does on your behalf:${R}`);
+  for (const k of BOOLS) console.log(`  ${B}${k}${R}${" ".repeat(Math.max(1, 11 - k.length))}${a[k] ? "on" : "off"}${mark(k)}`);
+  console.log(`\n${D}${AUTONOMY_PATH()}${R}`);
+  console.log(`${D}trantor autonomy set commit on   ·   set harness bypass --global${R}`);
+} else {
+  console.log("usage: trantor autonomy [show] | get <dial> | set <dial> <value> [--project P | --global]");
+  process.exit(1);
+}

package/bin/baton.mjs

@@ -4,7 +4,7 @@
 // self-announcing session, and closes THIS window once it takes over. Run from inside the session you
 // want to hand off. (The richer MODEL-authored handoff is the /trantor:handoff skill.)
 import { readdirSync, statSync } from "node:fs";
-import { join } from "node:path";
+import { join, basename } from "node:path";
 import { homedir } from "node:os";
 import { resolveProject } from "../lib/project.mjs";
 import { writeHandoff, spawnBaton } from "../hooks/lib/handoff.mjs";
@@ -30,8 +30,18 @@ function findTranscript() {
 }
 
 const transcript = findTranscript();
-const { file } = writeHandoff({ projectDir: cwd, sessionId: "", transcript, trigger: "manual-cli", force: true });   // manual = intentional, bypass the storm guard
+// The transcript's filename IS the writing session's id — record it, or an orchestrator-thread
+// handoff carries no writer and the baton-hold + map-follow logic in sessionstart.mjs can't fire.
+const sessionId = transcript ? basename(transcript, ".jsonl") : "";
+const { file } = writeHandoff({ projectDir: cwd, sessionId, transcript, trigger: "manual-cli", force: true });   // manual = intentional, bypass the storm guard
 console.log(`📋 handoff saved for ${project}: ${file}`);
+// --write-only: the in-app flow (#5509). The app ends the pane's session itself and reopens it
+// through `trantor open`, which claims this handoff — a Terminal window here would be exactly the
+// wrong surface, so the flag writes, announces, and stops.
+if (process.argv.includes("--write-only")) {
+  console.log(`🔄 write-only: no window spawned — the pane takeover (trantor open) claims it next.`);
+  process.exit(0);
+}
 const { spawned, armed, windowId } = spawnBaton({ projectDir: cwd, handoffFile: file });
 console.log(spawned
   ? `🔄 baton: a fresh session is opening (it'll recap the handoff)${armed ? ` — this window (${windowId}) closes once it takes over` : " — couldn't detect this window; close it yourself once the new one is up"}`

package/bin/cli.mjs

@@ -23,6 +23,11 @@ switch (cmd) {
   case "advise":  run("bin/advise.mjs"); break;
   case "verify":  run("bin/crew-verify.mjs"); break;
   case "up":      process.argv.splice(2, 1); spawn("/bin/bash", [join(ROOT, "bin/crew.sh"), "up", ...args], { stdio: "inherit", cwd: process.cwd() }).on("exit", c => process.exit(c ?? 0)); break;
+  case "open":    spawn("/bin/bash", [join(ROOT, "bin/crew.sh"), "open", ...args], { stdio: "inherit", cwd: process.cwd() }).on("exit", c => process.exit(c ?? 0)); break;
+  case "herdr":   spawn(process.execPath, [join(ROOT, "bin/herdr-agent.mjs"), ...args], { stdio: "inherit", cwd: process.cwd() }).on("exit", c => process.exit(c ?? 0)); break;
+  case "autonomy": spawn(process.execPath, [join(ROOT, "bin/autonomy.mjs"), ...args], { stdio: "inherit", cwd: process.cwd() }).on("exit", c => process.exit(c ?? 0)); break;
+  case "adopt":   spawn(process.execPath, [join(ROOT, "bin/adopt.mjs"), ...args], { stdio: "inherit", cwd: process.cwd() }).on("exit", c => process.exit(c ?? 0)); break;
+  case "integrate": spawn(process.execPath, [join(ROOT, "bin/integrate.mjs"), ...args], { stdio: "inherit", cwd: process.cwd() }).on("exit", c => process.exit(c ?? 0)); break;
   case "down":    spawn("/bin/bash", [join(ROOT, "bin/crew.sh"), "down", ...args], { stdio: "inherit", cwd: process.cwd() }).on("exit", c => process.exit(c ?? 0)); break;
   case "swap":    spawn("/bin/bash", [join(ROOT, "bin/crew.sh"), "swap", ...args], { stdio: "inherit", cwd: process.cwd() }).on("exit", c => process.exit(c ?? 0)); break;
   case "prune":   spawn("/bin/bash", [join(ROOT, "bin/crew.sh"), "prune", ...args], { stdio: "inherit", cwd: process.cwd() }).on("exit", c => process.exit(c ?? 0)); break;
@@ -74,6 +79,7 @@ switch (cmd) {
   case "inbox": run("bin/inbox.mjs"); break;
   case "duty": run("bin/duty.mjs"); break;
   case "seats": case "seat": run("bin/seats.mjs"); break;
+  case "seat-why": case "why": run("bin/seat-why.mjs"); break;
   case "orchestrate": run("bin/orchestrate.mjs"); break;
   case "app": run("bin/app.mjs"); break;
   case "patrol": run("bin/patrol.mjs"); break;
@@ -185,6 +191,11 @@ switch (cmd) {
   trantor provider    bring ANY model (BYOM): list seats · add <name> --key … · remove <name>
   trantor models      browse live models behind each seat + the router's pick per difficulty
   trantor up …        spawn a crew here:   trantor up codex kimi deepseek:deepseek glm:zai-coding-plan
+  trantor open        host THIS session as the project's orchestrator pane (trantor down spares it)
+  trantor herdr       install|remove|status the login agent that keeps panes alive across a reboot
+  trantor autonomy    how much Trantor may do unasked: seats, your harness, commit/push/deploy
+  trantor adopt       take over a session already running in a Terminal, then open it here
+  trantor integrate   collect the crew's work, merge it, verify it, push it (--dry-run to rehearse)
   trantor down        tear the crew down (kills processes, closes windows, no dialogs)
   trantor prune       drop dead crew-window tracking rows (ghost workspaces/panes) without spawning anything
   trantor ui          open the live dashboard (board + flow views)
@@ -201,6 +212,7 @@ switch (cmd) {
   trantor hub         run the hub in the foreground (setup installs it as a service instead)
                       …or manage per-project hub pins: hub list · hub set <project> <url> · hub unset <project>
                       seats: which project lives in which directory — seats · seats add · seats up · seats login install
+  trantor seat-why    WHY a seat is down (err file, logs, pids): seat-why <agent> [--json] — quota, auth, crash, or just no pane
   trantor watch       live bus feed in the terminal
   trantor inbox       THIS session's unread bus messages, signed (works under enforce) — [--all] [--consume] [--json]
   trantor policy      the autonomy ladder: show | set <project> <1-4> | link <a> <b> --reason "<why>"

package/bin/crew-runner.mjs

@@ -44,7 +44,22 @@ function ensureSeatWorktree(sourceDir) {
   const branch = `seat/${AGENT}`;
   if (existsSync(seatDir)) {
     const ok = gitOut(["-C", seatDir, "rev-parse", "--is-inside-work-tree"], seatDir) === "true";
-    if (ok) return seatDir;
+    if (ok) {
+      // #5403: a worktree created once builds against THAT day's main forever — every wave since
+      // has needed a hand fast-forward. Refresh only when it is CLEAN: a dirty tree is a seat's
+      // unintegrated work and a diverged branch is a decision, and refreshing must never eat
+      // either. Failure to refresh is loud but non-fatal: stale beats broken.
+      const dirty = gitOut(["-C", seatDir, "status", "--porcelain"], seatDir);
+      if (dirty === "") {
+        const head = gitOut(["-C", root, "rev-parse", "HEAD"], root);
+        const ff = head && spawnSync("git", ["-C", seatDir, "merge", "--ff-only", head], { stdio: "ignore", timeout: 15000 });
+        if (ff && ff.status === 0) console.log(`\x1b[2m[runner]\x1b[0m ${branch} worktree refreshed to ${head.slice(0, 7)}`);
+        else console.log(`\x1b[33m[runner]\x1b[0m ${branch} worktree diverged from main HEAD — left as-is (integrate or reset it)`);
+      } else {
+        console.log(`\x1b[33m[runner]\x1b[0m ${branch} worktree has uncommitted work — not refreshed`);
+      }
+      return seatDir;
+    }
     console.log(`\x1b[33m[runner]\x1b[0m worktree path exists but is not a git worktree: ${seatDir} — using ${sourceDir}`);
     return sourceDir;
   }
@@ -150,6 +165,28 @@ function cmuxStatus(value, color, icon = "robot", opts = {}) {
   const col = opts.alert ? color : (BRAND_HEX[AGENT.toLowerCase()] || color);
   try { spawnSync(CMUX_BIN, ["set-status", SESSION, `${AGENT} · ${value}`, "--color", col, "--icon", icon, "--priority", String(opts.priority ?? 0)], { stdio: "ignore", timeout: 1500, env: { ...process.env, CMUX_QUIET: "1" } }); } catch {}
 }
+// herdr drops a pane's agent registration when the process inside it exits — and a seat's CLI
+// exits at the END OF EVERY TURN. Reporting once when the pane is created is therefore not enough:
+// the seat vanishes from `herdr agent list` after its first turn, `herdr agent attach` starts
+// answering agent_not_found, and the app renders that raw error where the terminal should be.
+// Observed 2026-08-27 on codex, which was crash-looping on an exhausted quota.
+//
+// So re-report at every turn boundary, which also gives herdr a truthful working/idle state.
+// NOTE the argument order: the pane id comes FIRST, before the flags.
+function herdrAgent(state) {
+  try {
+    const f = join(homedir(), ".agent-bus", "crew-windows.txt");
+    if (!existsSync(f)) return;
+    const row = readFileSync(f, "utf8").split("\n")
+      .map(l => l.split("\t"))
+      .filter(c => c.length >= 4 && c[0] === PROJ && c[1] === "herdr" && c[2] === AGENT)
+      .pop();
+    if (!row || !row[3]) return;
+    spawnSync("herdr", ["pane", "report-agent", row[3], "--source", "crew", "--agent", AGENT, "--state", state],
+      { stdio: "ignore", timeout: 1500 });
+  } catch { /* no herdr, or no row for this seat: the cmux/tmux paths do not need it */ }
+}
+
 function cmuxLog(message, level = "info") {
   if (!inCmux()) return;
   try { spawnSync(CMUX_BIN, ["log", String(message).slice(0, 200), "--level", level], { stdio: "ignore", timeout: 1500, env: { ...process.env, CMUX_QUIET: "1" } }); } catch {}
@@ -221,6 +258,12 @@ const PULSE_PROMPT = `[pulse] Re-read your mission note (${MISSION_FILE} in your
 // every non-zero turn to the bus in real time so the orchestrator (and `trantor swap`)
 // can react, and flip presence to errored/down.
 let consecFails = 0;
+// The failure STATE the room has already been told about. A seat that is down stays down, and
+// saying so again every retry is repetition, not news — the monitoring doctrine this project holds
+// everyone else to says report duration, not repetition. Observed cost: a permanently exhausted
+// codex seat broadcast "DOWN" to `all` 31 times over six hours, and every broadcast is a turn for
+// every live seat, so two working agents spent the evening reading the same sentence.
+let announced = "";
 let lastErrText = "";
 const ERRF = join(homedir(), ".agent-bus", `err-${AGENT}-${PROJ}.txt`);
 
@@ -262,6 +305,12 @@ function loadPending() {
   } catch { return { wake: [], bcast: [] }; }
 }
 
+// Auth-failure markers in TURN OUTPUT. opencode prints its auth error ("401 Unauthorized" /
+// "Invalid API key") and STILL exits 0, so a bare 0 from the CLI is not proof the turn ran
+// (card #5405). This regex gates the exit-0 path in runTurn; kept tighter than
+// classifyFailure's set (no bare /expired/) so a healthy transcript never trips it.
+const AUTH_MARKER_RE = /unauthor|401|403|forbidden|invalid[ _-]?api[ _-]?key|authentication? failed|token expired/i;
+
 function classifyFailure(exit, errText) {
   const t = (errText || "").toLowerCase();
   if (exit === 127) return "missing-cli";
@@ -287,8 +336,17 @@ async function reportFailure(exit, trigger, undelivered = 0) {
   const text = down
     ? `🛑 ${SESSION} DOWN — ${consecFails} consecutive failures (${reason}, exit ${exit})${hint}${held}`
     : `⚠️ ${SESSION} turn FAILED (${trigger}, exit ${exit} · ${reason})${hint}${held}`;
-  await api("/send", { from: SESSION, to: "all", text, project: PROJ }).catch(() => {});
-  cmuxStatus(down ? "down" : "error", "#ef6a6a", "alert", { alert: true, priority: 90 }); cmuxLog(`turn failed: ${reason} (exit ${exit})`, "error");
+  // Announce a CHANGE of state, never the continuation of one. The registered status above already
+  // carries "down: exhausted · N fails" for anyone who looks, which is state and costs nobody a
+  // turn; the broadcast is the event, and an unchanged state is not an event.
+  const state = `${down ? "down" : "error"}:${reason}`;
+  if (state !== announced) {
+    announced = state;
+    await api("/send", { from: SESSION, to: "all", text, project: PROJ }).catch(() => {});
+  } else {
+    log(`still ${state} (${consecFails} fails) — already announced, staying quiet`);
+  }
+  cmuxStatus(down ? "down" : "error", "#ef6a6a", "alert", { alert: true, priority: 90 }); herdrAgent("blocked"); cmuxLog(`turn failed: ${reason} (exit ${exit})`, "error");
   log(`\x1b[31mreported failure to bus: ${reason} (exit ${exit})\x1b[0m`);
 }
 
@@ -322,9 +380,11 @@ async function notifyAssigners(pairs, text) {
 async function reportHealthy() {
   if (consecFails === 0) return;        // already healthy — don't spam
   consecFails = 0;
+  // Recovery is a change too, so the next failure is news again.
+  announced = "";
   await api("/register", { session: SESSION, project: PROJ, status: `active in ${PROJ}`, llm: AGENT, model: MODEL }).catch(() => {});
   await api("/send", { from: SESSION, to: "all", text: `✅ ${SESSION} recovered`, project: PROJ }).catch(() => {});
-  cmuxStatus("ok", "#14b8a6", "check");
+  cmuxStatus("ok", "#14b8a6", "check"); herdrAgent("idle");
 }
 
 let sid = "";
@@ -348,7 +408,7 @@ function runTurn(prompt, isFirst, trigger = "kickoff") {
   const envs = [join(homedir(), ".agent-bus", ".env"), cli.env].filter(f => f && existsSync(f));
   cmd = withEnvFiles(cmd, envs);
   log(`turn starting (${isFirst ? "fresh session" : "resume"})${MODEL ? ` · model=${MODEL}` : ""}`);
-  cmuxStatus("building", "#4a90d9", "hammer", { priority: 50 });
+  cmuxStatus("building", "#4a90d9", "hammer", { priority: 50 }); herdrAgent("working");
   // inherit stdio so the window shows the agent working live; also capture for sid-parsing.
   // Tee stderr to ERRF (still shown live in the window) so a failed turn can be classified.
   try { appendFileSync(ERRF, "", { flag: "w" }); } catch {}
@@ -378,10 +438,21 @@ function runTurn(prompt, isFirst, trigger = "kickoff") {
   });
   try { lastErrText = readFileSync(ERRF, "utf8").slice(-4000); } catch { lastErrText = ""; }
   if (cli.sid && r.stdout) { const m = r.stdout.match(cli.sid); if (m) sid = m[1]; }
-  telemetry({ ts: Date.now(), agent: AGENT, project: PROJ, turn: TURN, trigger, model: MODEL || "default", duration_ms: Date.now() - t0, exit: r.status });
-  log(`turn ended (exit ${r.status}, ${((Date.now() - t0) / 1000).toFixed(0)}s)`);
-  if (r.status === 0) cmuxStatus("idle", "#8a94a6", "robot");   // finished this turn, waiting for the next
-  return r.status;
+  const realExit = r.status;
+  // A zero exit is NOT proof the turn ran: opencode prints "401 Unauthorized" / "Invalid API key"
+  // and exits 0, so a bare 0 made the runner ack "✅ done", clear the pending queue and heartbeat
+  // green through an auth outage (card #5405). Cross-check the turn output and treat an
+  // exit-0-with-auth turn as FAILED. Telemetry keeps the REAL exit; the returned code is the
+  // effective one every call site branches on (kickoff, pulse, deliverWake).
+  let effExit = realExit;
+  if (realExit === 0 && AUTH_MARKER_RE.test(lastErrText)) {
+    effExit = 1;
+    log("\x1b[31mexit 0 but turn output shows an auth failure — treating as FAILED (auth)\x1b[0m");
+  }
+  telemetry({ ts: Date.now(), agent: AGENT, project: PROJ, turn: TURN, trigger, model: MODEL || "default", duration_ms: Date.now() - t0, exit: realExit, effExit, authFailed: effExit !== realExit });
+  log(`turn ended (exit ${realExit}${effExit !== realExit ? ` → effective ${effExit} (auth)` : ""}, ${((Date.now() - t0) / 1000).toFixed(0)}s)`);
+  if (realExit === 0 && effExit === 0) { cmuxStatus("idle", "#8a94a6", "robot"); herdrAgent("idle"); }   // finished this turn, waiting for the next
+  return effExit;
 }
 
 // ---- main loop ----