trantor 0.18.116 → 0.18.118

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.116",
+  "version": "0.18.118",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/crew/processes.mjs

@@ -4,7 +4,7 @@ import { call } from "./core.mjs";
 
 export const runnerRecord = (ctx, project, agent) => join(ctx.seatDir, `${project}-${agent}.runner.json`);
 
-export function seatProcesses(ctx, project, agent) {
+export function seatProcesses(ctx, project, agent, exec = call) {
   if (ctx.env.CREW_NO_PROC_KILL === "1") return [];
   let label = agent, dir = ctx.dir;
   try {
@@ -12,7 +12,9 @@ export function seatProcesses(ctx, project, agent) {
     label = record.label;
     dir = record.dir;
   } catch (error) { if (error.code !== "ENOENT") throw error; }
-  const rows = call("ps", ["-axo", "pid=,ppid=,command="]).stdout.split("\n").map(line => {
+  const snapshot = exec("ps", ["-axo", "pid=,ppid=,command="]);
+  if (snapshot.status !== 0) throw new Error("could not read crew processes");
+  const rows = snapshot.stdout.split("\n").map(line => {
     const match = line.trim().match(/^(\d+)\s+(\d+)\s+(.+)$/);
     return match ? { pid: Number(match[1]), parent: Number(match[2]), command: match[3] } : null;
   }).filter(Boolean);

package/bin/crew/state.mjs

@@ -3,6 +3,7 @@ import { dirname, join } from "node:path";
 import { seatProcesses, signalProcesses } from "./processes.mjs";
 import { call, listPids, run } from "./core.mjs";
 import { hostId } from "../../lib/project.mjs";
+import { removeSeatWorktree } from "../../lib/seat-worktree.mjs";
 import { signedPost } from "../../hooks/lib/api.mjs";
 import { statePathFor as dockerStatePathFor, sweep as dockerSweep } from "../../lib/docker-janitor.mjs";
 
@@ -130,7 +131,7 @@ async function unregisterSeat(ctx, project, persona) {
   return response.json;
 }
 
-export async function down(ctx, args, adapters, { unregister = unregisterSeat } = {}) {
+export async function down(ctx, args, adapters, { unregister = unregisterSeat, removeWorktree = removeSeatWorktree, processes = seatProcesses } = {}) {
   const options = parseDownArgs(ctx, args);
   if (options.help) return 0;
   if (options.error) return 1;
@@ -175,6 +176,27 @@ export async function down(ctx, args, adapters, { unregister = unregisterSeat }
         `${JSON.stringify({ ts: Date.now(), agent: row.persona, project: row.project, stopped: true })}\n`);
     }
   }
+  // #12269: a stopped seat's worktree goes with it — `git worktree remove`, branch kept; a tree
+  // with uncommitted changes stays on disk and is named here so the operator can recover it.
+  for (const row of seats.values()) {
+    if (!row.project) continue;
+    if (!ctx.dry) {
+      try {
+        const tracked = readRows(ctx).some(current => current.project === row.project && current.persona === row.persona);
+        if (tracked || processes(ctx, row.project, row.persona).length) {
+          console.log(`  worktree kept (crew row or process remains): ${row.persona}:${row.project}`);
+          continue;
+        }
+      } catch (error) {
+        console.log(`  worktree kept (crew liveness unknown: ${error.message}): ${row.persona}:${row.project}`);
+        continue;
+      }
+    }
+    const r = await removeWorktree({ project: row.project, agent: row.persona, home: ctx.home || undefined, env: ctx.env, dry: ctx.dry });
+    if (r.status === "removed") console.log(`  worktree removed: ${r.path} (branch seat/${row.persona} kept)`);
+    else if (r.status === "kept") console.log(`  worktree kept (${r.reason}): ${r.path}`);
+    else if (r.status === "would-remove") console.log(`  [dry] would remove worktree: ${r.path}`);
+  }
   if (failures.length) {
     console.log(`— hub row removal incomplete; retry Stop: ${failures.join("; ")}`);
     return 1;

package/bin/disk.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // trantor disk — report where the disk went; --clean runs the safe tier ONLY;
-// install wires a Monday 09:00 launchd job; --weekly is what that job runs
-// (safe clean, then exactly ONE summary message on the bus for the operator).
+// install wires a daily 09:00 launchd job; --daily (or the legacy --weekly) is what
+// that job runs (safe clean, then exactly ONE summary message on the bus for the operator).
 import { spawnSync } from "node:child_process";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -52,7 +52,7 @@ async function install() {
     // bootout+bootstrap can race an existing job; load -w is the legacy fallback.
     exec("launchctl", ["load", "-w", plistPath]);
   }
-  console.log(`installed: ${plistPath}\nruns every Monday 09:00 (safe tier only); result lands as one bus message. Log: ${logPath}`);
+  console.log(`installed: ${plistPath}\nruns every day at 09:00 (safe tier only); result lands as one bus message. Log: ${logPath}`);
 }
 
 function exec(file, args) {
@@ -64,19 +64,23 @@ if (args.includes("--help") || args.includes("-h") || args[0] === "help") {
   console.log(`trantor disk — where the space went, and the provably safe slice to reclaim
 
   trantor disk              report only (also prints exactly what the safe tier would delete)
-  trantor disk --dry-run    the same report, explicit
-  trantor disk --clean      run the SAFE tier: unavailable simulators, build output and
-                            stale scratch (.agent-bus-out/.scratch entries idle 2+ days) in
-                            seat worktrees with no live turn (ps + the runner's turn stamp),
-                            opencode sessions idle >14 days. Everything else stays.
+  trantor disk --dry-run    the same report, explicit — never cleans
+  trantor disk --clean      run the SAFE tier: unavailable simulators, whole seat worktrees
+                            idle 7+ days with no uncommitted changes (branch kept), build
+                            output (DerivedData, *.xcresult, target/) idle 3+ days, stale
+                            scratch (.agent-bus-out/.scratch entries idle 2+ days) and build
+                            dirs in seat worktrees with no live turn, opencode sessions idle
+                            >14 days. Everything else stays. Every removal is printed first.
   trantor disk --json       machine-readable report
-  trantor disk install      Monday 09:00 launchd job (runs --weekly: clean + one bus message)`);
+  trantor disk install      daily 09:00 launchd job (runs --daily: clean + one bus message)`);
   process.exit(0);
 }
 if (args[0] === "install") { await install(); process.exit(0); }
 
-const weekly = args.includes("--weekly");
-const passArgs = weekly ? [...args, "--clean"] : args;
+// #12269: daily cadence (--daily; --weekly kept as the old plist's flag). --dry-run wins.
+const periodic = args.includes("--weekly") || args.includes("--daily");
+const dryRun = args.includes("--dry-run");
+const passArgs = periodic && !dryRun ? [...args, "--clean"] : args;
 const { report, results, json } = await runDisk({ args: passArgs });
 if (json) {
   process.stdout.write(`${JSON.stringify({ report, results }, null, 2)}\n`);
@@ -87,4 +91,4 @@ if (json) {
     for (const r of results.filter((r) => !r.ok)) console.log(`  FAILED ${r.type} ${r.path || r.id || ""}: ${r.error}`);
   }
 }
-if (weekly) await sendWeeklyMessage(summaryLine(report, results));
+if (periodic) await sendWeeklyMessage(summaryLine(report, results));

package/hub/auth.mjs

@@ -1,19 +1,60 @@
 /* oxlint-disable anti-slop/no-runtime-typeof -- SAFETY: Auth normalizes untrusted request and persisted identity shapes at their established hub boundary; this split preserves those guards unchanged. */
-import { verifyRequest, verifyEndorsement } from "../lib/identity.mjs";
+import { verifyRequest, verifyEndorsement, HDR } from "../lib/identity.mjs";
 import { readFileSync } from "node:fs";
+import { StringDecoder } from "node:string_decoder";
 import { timingSafeEqual, randomBytes } from "node:crypto";
 import { publicView } from "../lib/identity.mjs";
 import { IDENTITY_KINDS } from "../lib/store-contract.mjs";
 
 export function createAuthRuntime({ state, markDirty, AUTH_MODE, SUPERSEDE_GRACE_MS, LOOPBACK_BIND, ENROLL_MODE, seenNonces = new Map() }) {
 const now = () => Date.now();
-function rawBody(req) {
+// Route measurements and supported envelopes: docs/REQUEST-BODY-LIMITS.md.
+const BODY_CAP_DEFAULT = 4 * 1024 * 1024;
+const BODY_CAP_PROMPT = 16 * 1024 * 1024;
+// More than 100x the measured 115,194-byte desktop snapshot.
+const BODY_CAP_OWNER_CHAT = 16 * 1024 * 1024;
+// About 6x the measured 10,659,828-byte real state.
+const BODY_CAP_OWNER_IMPORT = 64 * 1024 * 1024;
+const OWNER_BODY_CAPS = new Map([
+  ["/session/chat", BODY_CAP_OWNER_CHAT],
+  ["/import", BODY_CAP_OWNER_IMPORT],
+  ["/handoff", BODY_CAP_DEFAULT], ["/task", BODY_CAP_DEFAULT], ["/task/update", BODY_CAP_DEFAULT],
+]);
+function bodyCap(P) { return P === "/session/prompt" ? BODY_CAP_PROMPT : BODY_CAP_DEFAULT; }
+function ownerBodyCap(req, P) {
+  const cap = OWNER_BODY_CAPS.get(P) || bodyCap(P);
+  if (cap <= bodyCap(P) || !Object.values(HDR).every(h => req.headers[h])) return bodyCap(P);
+  // Header identity is only a read-budget hint. Larger bodies require strict owner auth before parsing.
+  const identity = findIdentity(req.headers[HDR.pubkey]) || findIdentity(req.headers["x-trantor-durable"]);
+  return identity?.scopes?.some(s => s.role === "owner") ? cap : bodyCap(P);
+}
+function rawBody(req, maxBytes = BODY_CAP_DEFAULT) {
+  if (req._bodyTooLarge) return Promise.resolve(undefined);
   if (req._rawBody !== undefined) return Promise.resolve(req._rawBody);
-  return new Promise(r => { let d = ""; req.on("data", c => (d += c)); req.on("end", () => { req._rawBody = d; r(d); }); });
+  return new Promise(r => {
+    let d = "", bytes = 0, done = false;
+    const decoder = new StringDecoder("utf8");
+    const finish = (v) => { if (!done) { done = true; r(v); } };
+    req.on("data", c => {
+      if (done) return;
+      bytes += c.length;
+      if (bytes > maxBytes) {
+        req._bodyTooLarge = true;
+        finish(undefined);
+        req.resume();   // keep draining (and discarding) so the socket can close cleanly
+        return;
+      }
+      d += decoder.write(c);
+    });
+    req.on("end", () => { if (!req._bodyTooLarge) { req._bodyBytes = bytes; req._rawBody = d + decoder.end(); finish(req._rawBody); } });
+    req.on("error", () => finish(undefined));
+  });
 }
-async function body(req) {
+async function body(req, maxBytes = BODY_CAP_DEFAULT) {
+  if (req._bodyTooLarge) return undefined;
   if (req._jsonBody !== undefined) return req._jsonBody;
-  const d = await rawBody(req);
+  const d = await rawBody(req, maxBytes);
+  if (d === undefined) return undefined;
   try { req._jsonBody = d ? JSON.parse(d) : {}; } catch { req._jsonBody = {}; }
   return req._jsonBody;
 }
@@ -53,7 +94,7 @@ function cmpSemver(a, b) {
 }
 const AUTH_HEADERS = ["x-trantor-pubkey", "x-trantor-sig", "x-trantor-ts", "x-trantor-nonce"];
 const PUBLIC_ENDPOINTS = new Set(["/", "/ui", "/health", "/enroll"]);
-const OWNER_ENDPOINTS = new Set(["/project/delete", "/sweep", "/reconcile", "/invite", "/import", "/policy", "/session/prompts", "/session/prompt/claim", "/session/prompt/ack"]);
+const OWNER_ENDPOINTS = new Set(["/project/delete", "/sweep", "/reconcile", "/invite", "/import", "/policy", "/session/prompts", "/session/prompt/claim", "/session/prompt/ack", "/session/attachment"]);
 const DEVICE_ENDPOINTS = new Set(["/device/register", "/device/unregister", "/devices"]);
 const READ_ENDPOINTS = new Set(["/peers", "/tasks", "/events", "/inbox", "/peer", "/card", "/stream", "/history", "/projects", "/catchup", "/phases", "/recent", "/handoffs", "/verify-gates", "/claims", "/proposals", "/grants", "/overseer/context", "/overseer/status", "/session/chat", "/session/prompt", "/crew/roster"]);
 const roleRank = { read: 1, write: 2, approver: 3, owner: 4 };
@@ -99,7 +140,7 @@ function isDutyIdentity(auth) {
 const canRead = (auth, project) => AUTH_MODE !== "enforce" && !auth?.identity
   ? true
   : isDutyIdentity(auth) || scopeAllows(auth?.identity, project, "read");
-function projectFromRequest(P, q, b) {
+function projectFromRequest(P, q, b, method) {
   if (P === "/task/update" || P === "/card") {
     const t = state.tasks.find(x => x.id === Number(b?.id ?? q?.id));
     return t?.project || "";
@@ -117,8 +158,11 @@ function projectFromRequest(P, q, b) {
     return p?.project || "";
   }
   // claim/ack and the single-prompt GET carry only an id — authorization runs against the
-  // PROMPT's project, or a project-scoped key could claim any project's queued prompt (#12129).
-  if (P === "/session/prompt" || P === "/session/prompt/claim" || P === "/session/prompt/ack") {
+  // PROMPT's project (#12129); the attachment download is keyed the same way. POST
+  // /session/prompt is the exception: it CREATES a row in b.project, so an id in the body must
+  // not borrow an existing row's project to write elsewhere (#12161 review).
+  if (P === "/session/prompt" || P === "/session/prompt/claim" || P === "/session/prompt/ack" || P === "/session/attachment") {
+    if (P === "/session/prompt" && method === "POST") return canon(String(b?.project || q?.project || "").slice(0, 80));
     const pr = (state.sessionPrompts || []).find(x => x.id === Number(b?.id ?? q?.id));
     if (pr) return pr.project || "";
     if (P !== "/session/prompt") return "";
@@ -198,11 +242,11 @@ function supersessionActive(rec) {
   }
   return insts.some(i => i !== rec && i.name === rec.name && !i.superseded && (i.lastSeen || 0) > cut);
 }
-async function authenticate(req, path) {
-  if (AUTH_MODE === "off") return { ok: true, mode: AUTH_MODE, trusted: true };
+async function authenticate(req, path, strict = false) {
+  if (AUTH_MODE === "off" && !strict) return { ok: true, mode: AUTH_MODE, trusted: true };
   const signed = hasAuthHeaders(req);
   if (!signed) {
-    if (AUTH_MODE === "warn") {
+    if (AUTH_MODE === "warn" && !strict) {
       process.stderr.write(`[trantor] auth warn: unsigned ${req.method} ${path}\n`);
       return { ok: true, mode: AUTH_MODE, trusted: false, warning: "unsigned" };
     }
@@ -210,7 +254,7 @@ async function authenticate(req, path) {
   }
   const raw = req.method === "GET" || req.method === "HEAD" ? undefined : await rawBody(req);
   // Auth warn mode annotates signature, replay and enrollment failures; enforce mode rejects them.
-  const soft = (warning) => AUTH_MODE === "warn"
+  const soft = (warning) => AUTH_MODE === "warn" && !strict
     ? { ok: true, mode: AUTH_MODE, trusted: false, warning }
     : { ok: false, code: 401, error: warning };
   const verified = verifyRequest({ headers: req.headers, method: req.method, path, body: raw });
@@ -351,7 +395,7 @@ function canUseInboxSession(auth, session) {
   }
 
   return {
-    PUBLIC_ENDPOINTS, authPath, authenticate, authorize, body, rawBody, json,
+    PUBLIC_ENDPOINTS, authPath, authenticate, authorize, body, bodyCap, ownerBodyCap, rawBody, json,
     canon, cleanScope, defaultScopesFor, findIdentity, scopeAllows, canRead, isDutyIdentity,
     projectFromRequest, crossProjectGuard, filterReadable, filterDiscoverable,
     inboxReadable, canUseInboxSession, overseerPolicy, subFp, PROPOSAL_CAP,

package/hub/public.mjs

@@ -1,4 +1,5 @@
 import { isIP } from "node:net";
+import { HDR } from "../lib/identity.mjs";
 
 const ALLOWED = new Set([
   ...["/health", "/projects", "/catchup", "/tasks", "/card", "/events", "/stream",
@@ -31,7 +32,7 @@ export function publicClientIP(req) {
   return normalizedIP(forwarded) || socket;
 }
 
-export function createPublicGate({ now = Date.now, log = line => process.stderr.write(`${line}\n`) } = {}) {
+export function createPublicGate({ now = Date.now, log = line => process.stderr.write(`${line}\n`), canUpload = () => false } = {}) {
   const clients = new Map();
   const admissions = new WeakMap();
   const refusals = new Map();
@@ -92,6 +93,18 @@ export function createPublicGate({ now = Date.now, log = line => process.stderr.
         count("auth");
       } else if (res.statusCode === 403) count(path === "/enroll" ? "enrollment" : "authorization");
     });
+    // Only health is unsigned; reject absent signature fields before the handler reads a body.
+    if (path !== "/health" && Object.values(HDR).some(header => !req.headers[header])) {
+      res.writeHead(401, { "content-type": "application/json", "connection": "close" });
+      res.end(JSON.stringify({ error: "signature required" }));
+      return false;
+    }
+    // The photo endpoint has a larger body budget; unknown or read-only keys get no read budget.
+    if (req.method === "POST" && path === "/session/prompt" && !canUpload(req.headers[HDR.pubkey])) {
+      res.writeHead(401, { "content-type": "application/json", "connection": "close" });
+      res.end(JSON.stringify({ error: "enrolled phone write scope required" }));
+      return false;
+    }
     return true;
   }
 

package/hub/routes/session.mjs

@@ -2,6 +2,8 @@
 // is MEMORY-ONLY (a restart answers have:0, the desktop resends its window); the prompt queue
 // lives in state so a restart never strands a queued prompt. Live frames ride pushEventToStreams
 // (scope-filtered, never logged); only chat.prompt.queued/.delivered/.failed are audit-appended.
+import { mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 import { setInterval } from "node:timers";
 
 const CHAT_CAP = 400;            // turns kept per project, highest idx wins
@@ -10,11 +12,22 @@ const PROMPT_CAP = 200;
 const PROMPT_TEXT_MAX = 8000;
 const EVENT_TEXT_MAX = 500;
 const PROMPT_TTL_MS = Number(process.env.RELAY_PROMPT_TTL_MS || 120000);
+// Claims cover the desktop's 240s crew timeout plus ack slack; heartbeats cover lock waits.
+const CLAIM_TTL_MS = 300000;
 const PROMPT_SWEEP_MS = Number(process.env.RELAY_PROMPT_SWEEP_MS || 30000);
 const EXPIRED_REASON = "No Mac is relaying this project. Is the Trantor app open?";
+const CLAIMED_EXPIRED_REASON = "The Mac claimed this prompt but never delivered it. Try sending it again.";
 const ACK_OUTCOMES = new Set(["delivered", "blocked", "not_ready", "stalled", "no_agent", "stale"]);
 const ANSWER_PICKS_MAX = 10;
 const ANSWER_OTHER_MAX = 2000;
+// #12161: photo attachments ride POST /session/prompt as base64 JPEGs. The phone downscales to
+// the byte cap; the hub stores the bytes on disk next to its state (never in bus.json) and hands
+// metadata to the claiming desktop, which downloads them through GET /session/attachment.
+const ATTACHMENTS_MAX = 4;
+const PROJECT_ATTACHMENT_BYTES_MAX = 64 * 1024 * 1024;
+const ATTACHMENT_BYTES_MAX = 2 * 1024 * 1024;
+const ATTACHMENT_B64_MAX = Math.ceil(ATTACHMENT_BYTES_MAX / 3) * 4;
+const JPEG_MAGIC = Buffer.from([0xff, 0xd8, 0xff]);
 // #12140: crew commands from the phone. The hub validates and queues; the desktop relay runs the
 // trantor CLI and acks done|failed with the output tail. A seat spec is "agent[:project]".
 const CREW_SPEC = /^[a-z][a-z0-9-]{0,30}(:[A-Za-z0-9._/-]{1,80})?$/;
@@ -24,7 +37,7 @@ const CREW_CLAUDE_REFUSAL = "The claude seat draws your own Claude quota; start
 // oxlint-disable-next-line no-control-regex -- stripping ANSI escape sequences IS matching control characters
 const stripAnsi = (s) => String(s).replace(/\x1B(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~])/g, "");
 
-export function createSessionRuntime({ state, markDirty, appendEvent, pushEventToStreams, notifier }) {
+export function createSessionRuntime({ state, markDirty, appendEvent, pushEventToStreams, notifier, attachmentsDir }) {
   const now = () => Date.now();
   const mirrors = new Map();     // project -> { session, total, turns: Map(idx->turn), have, meta, updatedAt, host }
   state.sessionPrompts ||= [];
@@ -32,21 +45,93 @@ export function createSessionRuntime({ state, markDirty, appendEvent, pushEventT
 
   const findPrompt = (id) => state.sessionPrompts.find(p => p.id === Number(id));
 
-  // A prompt still queued past the TTL means no desktop relay claimed it. Expiry is lazy (on
-  // read) plus a sweep that is a no-op when nothing is queued, so an idle hub does no work.
+  // ---- attachments (#12161): bytes live on disk as <id>-<n>.jpg; the row keeps metadata ----
+  function attachmentPath(file) { return join(attachmentsDir, file); }
+  function unlinkAttachments(p) {
+    if (!attachmentsDir) return;
+    for (const a of p.attachments || []) { try { unlinkSync(attachmentPath(a.file)); } catch {} }
+  }
+  // Startup/sweep GC: remove files no queued-or-claimed row references (evicted rows, restarts,
+  // lost races). Cheap: a directory listing every sweep.
+  function sweepAttachments() {
+    if (!attachmentsDir) return;
+    let live;
+    try { live = new Set(state.sessionPrompts.filter(p => p.status === "queued" || p.status === "claimed")
+      .flatMap(p => (p.attachments || []).map(a => a.file))); } catch { return; }
+    let entries;
+    try { entries = readdirSync(attachmentsDir); } catch { return; }
+    for (const name of entries) {
+      if (!live.has(name)) { try { unlinkSync(attachmentPath(name)); } catch {} }
+    }
+  }
+  try { mkdirSync(attachmentsDir, { recursive: true }); } catch {}
+  sweepAttachments();
+  // Validate and decode the wire shape: [{name, data(base64 JPEG)}]. Returns rows for the prompt
+  // (files not yet written) or { error }.
+  function parseAttachments(raw) {
+    if (raw == null) return { attachments: [] };
+    if (!Array.isArray(raw) || raw.length > ATTACHMENTS_MAX) return { error: `at most ${ATTACHMENTS_MAX} attachments` };
+    const attachments = [];
+    for (const a of raw) {
+      const name = String(a?.name || "photo.jpg").slice(0, 120);
+      // Coerce, then judge the value: any non-base64 or non-JPEG bytes dies at the magic check,
+      // so the wire shape never needs a runtime type probe.
+      const data = String(a?.data ?? "");
+      if (!data.length || data.length > ATTACHMENT_B64_MAX || !/^[A-Za-z0-9+/=\s]+$/.test(data)) {
+        return { error: "attachment must be base64 JPEG of 2 MB or less" };
+      }
+      const bytes = Buffer.from(data, "base64");
+      if (!bytes.length || bytes.length > ATTACHMENT_BYTES_MAX || !bytes.subarray(0, 3).equals(JPEG_MAGIC)) {
+        return { error: "attachment must be a JPEG of 2 MB or less" };
+      }
+      attachments.push({ name, size: bytes.length, bytes });
+    }
+    return { attachments };
+  }
+  function storeAttachments(id, attachments) {
+    if (!attachmentsDir) {
+      if (attachments.length) throw new Error("attachment storage is not configured");
+      return [];
+    }
+    mkdirSync(attachmentsDir, { recursive: true });
+    return attachments.map((a, n) => {
+      const file = `${id}-${n}.jpg`;
+      writeFileSync(attachmentPath(file), a.bytes);
+      return { name: a.name, size: a.size, file };
+    });
+  }
+
+  // Queued work expires quickly; claimed work keeps its bytes while the relay renews its lease.
   function expireQueued() {
     let changed = false;
     for (const p of state.sessionPrompts) {
-      if (p.status !== "queued" || now() - p.ts <= PROMPT_TTL_MS) continue;
-      p.status = "expired"; p.outcome = "expired"; p.error = EXPIRED_REASON;
-      appendEvent("chat.prompt.failed", p.project, p.by, { promptId: p.id, outcome: "expired", error: EXPIRED_REASON });
+      const claimed = p.status === "claimed";
+      const from = p.status === "queued" ? p.ts : claimed ? (p.renewedAt || p.claimedAt) : 0;
+      if (!from || now() - from <= (claimed ? CLAIM_TTL_MS : PROMPT_TTL_MS)) continue;
+      p.status = "expired"; p.outcome = "expired";
+      p.error = claimed ? CLAIMED_EXPIRED_REASON : EXPIRED_REASON;
+      unlinkAttachments(p);
+      appendEvent("chat.prompt.failed", p.project, p.by, { promptId: p.id, outcome: "expired", error: p.error });
       changed = true;
     }
     if (changed) markDirty();
     return changed;
   }
+  // Only terminal rows can be discarded; live work keeps its queue slot and attachment bytes.
+  function trimPrompts() {
+    while (state.sessionPrompts.length > PROMPT_CAP) {
+      const ti = state.sessionPrompts.findIndex(x => x.status !== "queued" && x.status !== "claimed");
+      if (ti < 0) break;
+      const [evicted] = state.sessionPrompts.splice(ti, 1);
+      unlinkAttachments(evicted);
+    }
+  }
+  function queueFull() {
+    return state.sessionPrompts.filter(p => p.status === "queued" || p.status === "claimed").length >= PROMPT_CAP;
+  }
   const sweep = setInterval(() => {
-    if (state.sessionPrompts.some(p => p.status === "queued")) expireQueued();
+    sweepAttachments();
+    if (state.sessionPrompts.some(p => p.status === "queued" || p.status === "claimed")) expireQueued();
   }, PROMPT_SWEEP_MS);
   sweep.unref?.();
 
@@ -140,10 +225,11 @@ export function createSessionRuntime({ state, markDirty, appendEvent, pushEventT
     const isChat = P === "/session/chat";
     const isPrompts = P === "/session/prompts";
     const isPrompt = P === "/session/prompt" || P === "/session/prompt/claim" || P === "/session/prompt/ack";
+    const isAttachment = P === "/session/attachment";
     const isAnswer = P === "/session/answer";
     const isCrewCommand = P === "/crew/command";
     const isCrewRoster = P === "/crew/roster";
-    if (!isChat && !isPrompts && !isPrompt && !isAnswer && !isCrewCommand && !isCrewRoster) return false;
+    if (!isChat && !isPrompts && !isPrompt && !isAttachment && !isAnswer && !isCrewCommand && !isCrewRoster) return false;
     const { body, json, canon, scopeAllows } = ctx;
 
     // #12137: the phone's answer to an AskUserQuestion joins the SAME queue as a plain prompt,
@@ -161,15 +247,13 @@ export function createSessionRuntime({ state, markDirty, appendEvent, pushEventT
       const other = String(b.other || "").slice(0, ANSWER_OTHER_MAX);
       if (!picks.length && !other.trim()) return json(res, 400, { error: "picks or other required" });
       expireQueued();
+      if (queueFull()) return json(res, 429, { error: "prompt queue full; try again after pending work finishes" });
       state.sessionPromptSeq += 1;
       const text = other.trim() ? other : `picks ${picks.join(", ")}`;
       const p = { id: state.sessionPromptSeq, project, kind: "answer", session, toolId, picks, other,
         text, by: String(auth?.identity?.name || "").slice(0, 120), ts: now(), status: "queued" };
       state.sessionPrompts.push(p);
-      while (state.sessionPrompts.length > PROMPT_CAP) {
-        const ti = state.sessionPrompts.findIndex(x => x.status !== "queued" && x.status !== "claimed");
-        state.sessionPrompts.splice(ti >= 0 ? ti : 0, 1);
-      }
+      trimPrompts();
       markDirty();
       appendEvent("chat.prompt.queued", project, p.by, { promptId: p.id, kind: "answer", toolId, text: text.slice(0, EVENT_TEXT_MAX) });
       pushEventToStreams({ ts: p.ts, type: "chat.prompt", id: p.id, project });
@@ -201,6 +285,7 @@ export function createSessionRuntime({ state, markDirty, appendEvent, pushEventT
       if (action === "up" && !seats.length) return json(res, 400, { error: "up needs at least one seat" });
       if (action === "swap" && (!from || !to)) return json(res, 400, { error: "swap needs from and to" });
       expireQueued();
+      if (queueFull()) return json(res, 429, { error: "prompt queue full; try again after pending work finishes" });
       state.sessionPromptSeq += 1;
       // down with an empty seat list means the whole project.
       const text = action === "swap" ? `swap ${from} ${to}` : seats.length ? `${action} ${seats.join(" ")}` : `${action} ${project}`;
@@ -209,10 +294,7 @@ export function createSessionRuntime({ state, markDirty, appendEvent, pushEventT
       if (from) p.from = from;
       if (to) p.to = to;
       state.sessionPrompts.push(p);
-      while (state.sessionPrompts.length > PROMPT_CAP) {
-        const ti = state.sessionPrompts.findIndex(x => x.status !== "queued" && x.status !== "claimed");
-        state.sessionPrompts.splice(ti >= 0 ? ti : 0, 1);
-      }
+      trimPrompts();
       markDirty();
       appendEvent("chat.prompt.queued", project, p.by, { promptId: p.id, kind: "crew", action, text: text.slice(0, EVENT_TEXT_MAX) });
       pushEventToStreams({ ts: p.ts, type: "chat.prompt", id: p.id, project });
@@ -268,26 +350,41 @@ export function createSessionRuntime({ state, markDirty, appendEvent, pushEventT
       const text = String(b.text || "");
       if (!project || !text.trim()) return json(res, 400, { error: "project and non-empty text required" });
       if (text.length > PROMPT_TEXT_MAX) return json(res, 400, { error: `text must be <= ${PROMPT_TEXT_MAX} chars` });
+      const parsed = parseAttachments(b.attachments);
+      if (parsed.error) return json(res, 400, { error: parsed.error });
       expireQueued();
+      if (queueFull()) return json(res, 429, { error: "prompt queue full; try again after pending work finishes" });
+      const liveBytes = state.sessionPrompts
+        .filter(p => p.project === project && (p.status === "queued" || p.status === "claimed"))
+        .reduce((total, p) => total + (p.attachments || []).reduce((sum, a) => sum + a.size, 0), 0);
+      const incomingBytes = parsed.attachments.reduce((sum, a) => sum + a.bytes.length, 0);
+      if (liveBytes + incomingBytes > PROJECT_ATTACHMENT_BYTES_MAX) {
+        return json(res, 413, { error: "project queued and claimed attachments exceed 64 MiB" });
+      }
       state.sessionPromptSeq += 1;
       const p = { id: state.sessionPromptSeq, project, text, by: String(auth?.identity?.name || "").slice(0, 120), ts: now(), status: "queued" };
-      state.sessionPrompts.push(p);
-      // Cap: evict oldest terminal rows first so live work is never the first casualty.
-      while (state.sessionPrompts.length > PROMPT_CAP) {
-        const ti = state.sessionPrompts.findIndex(x => x.status !== "queued" && x.status !== "claimed");
-        state.sessionPrompts.splice(ti >= 0 ? ti : 0, 1);
+      try {
+        p.attachments = storeAttachments(p.id, parsed.attachments);
+      } catch (error) {
+        return json(res, 500, { error: String(error?.message || error) });
       }
+      state.sessionPrompts.push(p);
+      trimPrompts();
       markDirty();
-      appendEvent("chat.prompt.queued", project, p.by, { promptId: p.id, text: text.slice(0, EVENT_TEXT_MAX) });
+      if (p.attachments.length) appendEvent("chat.prompt.queued", project, p.by,
+        { promptId: p.id, text: text.slice(0, EVENT_TEXT_MAX), attachments: p.attachments.length });
+      else appendEvent("chat.prompt.queued", project, p.by, { promptId: p.id, text: text.slice(0, EVENT_TEXT_MAX) });
       pushEventToStreams({ ts: p.ts, type: "chat.prompt", id: p.id, project });
       return json(res, 200, { id: p.id, status: "queued" });
     }
 
     // The public view of a queue row: plain prompts are kind "prompt"; answers carry their
     // session, toolId, picks and other; crew commands carry action, seats, from and to —
-    // so the claiming desktop has everything it needs.
+    // so the claiming desktop has everything it needs. Attachments ride as metadata only;
+    // the bytes go to the claimer through GET /session/attachment.
     const promptView = (p) => {
       const view = { id: p.id, project: p.project, text: p.text, by: p.by, ts: p.ts, status: p.status, kind: p.kind || "prompt" };
+      if (p.attachments?.length) view.attachments = p.attachments.map(({ name, size }) => ({ name, size }));
       if (p.kind === "answer") {
         view.session = p.session; view.toolId = p.toolId; view.picks = p.picks;
         if (p.other && p.other.trim()) view.other = p.other;   // absent, never "", when nothing was typed
@@ -315,6 +412,15 @@ export function createSessionRuntime({ state, markDirty, appendEvent, pushEventT
       expireQueued();
       const p = findPrompt(b.id);
       if (!p) return json(res, 404, { error: "prompt not found" });
+      // Renewal never grants a second delivery; only the original host can extend a live claim.
+      if (b.renew === true) {
+        if (p.status !== "claimed" || p.host !== String(b.host || "").slice(0, 120)) {
+          return json(res, 409, { error: "no matching live claim", status: p.status });
+        }
+        p.renewedAt = now();
+        markDirty();
+        return json(res, 200, { ok: true });
+      }
       // The first claim wins; a second claim — even from the same host — gets 409.
       if (p.status !== "queued") return json(res, 409, { error: `prompt already ${p.status}`, status: p.status });
       p.status = "claimed"; p.host = String(b.host || "").slice(0, 120); p.claimedAt = now();
@@ -327,6 +433,9 @@ export function createSessionRuntime({ state, markDirty, appendEvent, pushEventT
       const b = await body(req);
       const p = findPrompt(b.id);
       if (!p) return json(res, 404, { error: "prompt not found" });
+      if (p.status !== "claimed" || p.host !== b.host) {
+        return json(res, 409, { error: "no matching live claim", status: p.status });
+      }
       const outcome = String(b.outcome || "");
       // #12140: a crew command acks done|failed with the CLI output tail, and the status IS the
       // outcome — never "delivered". Other kinds keep the delivered/blocked/… vocabulary.
@@ -335,9 +444,6 @@ export function createSessionRuntime({ state, markDirty, appendEvent, pushEventT
       } else if (!ACK_OUTCOMES.has(outcome)) {
         return json(res, 400, { error: `outcome must be one of: ${[...ACK_OUTCOMES].join(", ")}` });
       }
-      if (p.status === "delivered" || p.status === "done" || p.status === "failed" || p.status === "expired") {
-        return json(res, 409, { error: `prompt already ${p.status}`, status: p.status });
-      }
       const error = String(b.error || "").slice(0, EVENT_TEXT_MAX);
       p.outcome = outcome; p.error = error; p.ackedAt = now();
       if (p.kind === "crew") {
@@ -346,6 +452,8 @@ export function createSessionRuntime({ state, markDirty, appendEvent, pushEventT
       } else {
         p.status = outcome === "delivered" ? "delivered" : "failed";
       }
+      // A terminal row will never be claimed or downloaded again: its bytes go now.
+      unlinkAttachments(p);
       markDirty();
       const extra = { promptId: p.id, outcome };
       if (error) extra.error = error;
@@ -361,6 +469,21 @@ export function createSessionRuntime({ state, markDirty, appendEvent, pushEventT
       return json(res, 200, { id: p.id, status: p.status, outcome: p.outcome || "", output: p.output || "", error: p.error || "" });
     }
 
+    // The claiming desktop fetches one attachment's bytes. Owner-gated in auth.mjs, absent from
+    // the public listener's allowlist — phones upload, they never read back.
+    if (req.method === "GET" && P === "/session/attachment") {
+      const p = findPrompt(q.id);
+      const n = Number(q.n);
+      const meta = p && Number.isInteger(n) ? (p.attachments || [])[n] : null;
+      let bytes = null;
+      if (meta && attachmentsDir) { try { bytes = readFileSync(attachmentPath(meta.file)); } catch {} }
+      if (!bytes) return json(res, 404, { error: "attachment not found" });
+      if (res.headersSent || res.writableEnded || res.destroyed) return true;
+      res.writeHead(200, { "content-type": "image/jpeg", "content-length": bytes.length });
+      res.end(bytes);
+      return true;
+    }
+
     return false;
   }
 

package/hub.mjs

@@ -134,6 +134,7 @@ const context = {
 const sessionChat = createSessionRuntime({
   state: store.state, markDirty: store.markDirty,
   appendEvent: events.appendEvent, pushEventToStreams: events.pushEventToStreams, notifier,
+  attachmentsDir: join(DATA_DIR, "attachments"),
 });
 const routes = [routeDevices, routeAdmin, routeCards, routeInsights, routeMessages, sessionChat.route];
 
@@ -150,14 +151,27 @@ function requestHandler(runtime, ctx, gate = null) {
       const q = Object.fromEntries(u.searchParams);
       const P = u.pathname;
       if (gate && !gate.admit(req, res, P)) return;
+      const cap = gate ? runtime.bodyCap(P) : runtime.ownerBodyCap(req, P);
+      let ownerAuth;
+      if (req.method === "POST") {
+        const raw = await runtime.rawBody(req, cap);
+        if (raw === undefined) return runtime.json(res, 413, { error: `request body over the ${cap} byte cap` });
+        if (req._bodyBytes > runtime.bodyCap(P)) {
+          ownerAuth = await runtime.authenticate(req, runtime.authPath(u), true);
+          if (!ownerAuth.ok) return runtime.json(res, ownerAuth.code || 401, { error: ownerAuth.error });
+        }
+      }
       const b0 = req.method === "POST" ? await runtime.body(req) : {};
+      if (ownerAuth && !runtime.scopeAllows(ownerAuth.identity, runtime.projectFromRequest(P, q, b0, req.method), "owner")) {
+        return runtime.json(res, 403, { error: "large request body requires a project owner" });
+      }
       if (runtime.handleEnrollment({ req, res, P, u, b0, inviteOnly: !!gate })) return;
-      const auth = runtime.PUBLIC_ENDPOINTS.has(P)
+      const auth = ownerAuth || (runtime.PUBLIC_ENDPOINTS.has(P)
         ? { ok: true, mode: ctx.AUTH_MODE, trusted: false }
-        : await runtime.authenticate(req, runtime.authPath(u));
+        : await runtime.authenticate(req, runtime.authPath(u)));
       if (runtime.handleInvite({ req, res, P, auth, b0 })) return;
       if (!auth.ok) return runtime.json(res, auth.code || 401, { error: auth.error || "unauthorized" });
-      const authorization = runtime.authorize(auth, req.method, P, runtime.projectFromRequest(P, q, b0));
+      const authorization = runtime.authorize(auth, req.method, P, runtime.projectFromRequest(P, q, b0, req.method));
       if (!authorization.ok) return runtime.json(res, authorization.code || 403, { error: authorization.error || "forbidden" });
       if (gate && P === "/stream" && !gate.openStream(req, res)) return;
       if (req.method === "GET" && P === "/_op") {
@@ -181,6 +195,8 @@ server.listen(PORT, HOST, () => console.error(`[trantor] hub on http://${HOST}:$
 
 if (process.env.RELAY_PUBLIC_PORT) {
   const publicPort = Number(process.env.RELAY_PUBLIC_PORT);
-  const publicServer = http.createServer(requestHandler(publicAuth, publicContext, createPublicGate()));
+  const publicGate = createPublicGate({ canUpload: pubkey =>
+    publicAuth.scopeAllows(publicAuth.findIdentity(pubkey), "", "write") });
+  const publicServer = http.createServer(requestHandler(publicAuth, publicContext, publicGate));
   publicServer.listen(publicPort, "127.0.0.1", () => console.error(`[trantor] public hub on http://127.0.0.1:${publicServer.address().port} (auth: enforce)`));
 }

package/lib/disk.mjs

@@ -4,8 +4,10 @@
 // REPORT-only; our own deletions are fs.rm on paths asserted under $HOME, never rm -rf.
 import { spawnSync } from "node:child_process";
 import * as nodeFs from "node:fs";
-import { join, resolve, sep, basename, dirname } from "node:path";
+import { join, resolve, sep, basename, dirname, relative } from "node:path";
 import { homedir } from "node:os";
+import { readRows } from "../bin/crew/state.mjs";
+import { seatProcesses } from "../bin/crew/processes.mjs";
 
 export const DAY = 24 * 60 * 60 * 1000;
 export const BUILD_DIRS = [".next", "target", "desktop/src-tauri/target"];
@@ -14,6 +16,12 @@ export const SESSION_IDLE_MAX = 14 * DAY;
 // the 10-10 incident was 27 GB of it. Top-level entries untouched this long are safe tier.
 export const SCRATCH_DIRS = [".agent-bus-out", ".scratch"];
 export const SCRATCH_IDLE_MAX = 2 * DAY;
+// #12269: whole seat worktrees idle this long with no uncommitted changes are pruned;
+// build output parked inside the scratch dirs gets its own, shorter window.
+export const WORKTREE_IDLE_MAX = 7 * DAY;
+export const BUILD_OUTPUT_IDLE_MAX = 3 * DAY;
+export const BUILD_OUTPUT_NAMES = ["DerivedData", "target"];
+export const BUILD_OUTPUT_SUFFIX = ".xcresult";
 
 const GB = 1024 ** 3;
 const KB = 1024;
@@ -54,10 +62,17 @@ function defaults(d = {}) {
     home: d.home || homedir(),
     now: d.now || Date.now(),
     worktreesRoot: d.worktreesRoot || null,
+    log: d.log || console.log,
     entryBudget: d.entryBudget || 400_000,
   };
 }
 
+// The seat worktrees root: injected in tests, else the real one under HOME. Every delete
+// below this line re-checks its path is under this root before touching anything.
+export function worktreesRootFor(d) {
+  return d.worktreesRoot || join(d.home || homedir(), ".agent-bus", "worktrees");
+}
+
 // Recursive size walk. Skips symlinks entirely — a worktree symlink must not make
 // us measure (or later rm) outside its root. Budget caps pathological trees. Dirs are
 // statted too: a rename into an old tree updates the DIR mtime, not the file's, and
@@ -109,24 +124,26 @@ export function gitTracked(exec, worktree, rel) {
   return gitOut(exec, ["-C", worktree, "ls-files", "--", rel]).trim().length > 0;
 }
 
-// The runner writes ~/.agent-bus/turnstamp-<seat>-<project>.json at turn start and
-// unlinks it on every exit — a stamp younger than the scratch window IS a live (or
-// just-crashed) turn; a stamp that old cannot be one, since the time box kills in hours.
-export function turnStampPath(home, project, seat) {
-  return join(home, ".agent-bus", `turnstamp-${seat}-${project}.json`);
-}
-
-function seatTurnLive(fs, home, now, project, seat) {
+// #12269: a seat is dead only when both crew ownership and its runner processes are gone.
+function seatRetentionReason(d, project, seat, worktree) {
+  const bus = join(d.home, ".agent-bus");
   try {
-    const st = fs.statSync(turnStampPath(home, project, seat));
-    return now - Number(st.mtimeMs) < SCRATCH_IDLE_MAX;
-  } catch { return false; }
+    const ctx = { statePath: join(bus, "crew-windows.txt"), seatDir: join(bus, "seats"), env: {} };
+    if (readRows(ctx).some(row => row.project === project && row.persona === seat)) {
+      return `KEPT: ${seat}:${project} has a crew state row`;
+    }
+    const trees = gitOut(d.exec, ["-C", worktree, "worktree", "list", "--porcelain"]);
+    ctx.dir = trees.match(/^worktree (.+)$/m)?.[1] || worktree;
+    if (seatProcesses(ctx, project, seat, d.exec).length) return `KEPT: ${seat}:${project} has live crew processes`;
+    return "";
+  } catch (error) {
+    return `KEPT: cannot establish crew liveness for ${seat}:${project}: ${error.message}`;
+  }
 }
 
 export function scanSeatWorktrees(d) {
   const { fs, exec, home, now } = d;
-  const root = d.worktreesRoot || join(home, ".agent-bus", "worktrees");
-  const live = liveCommandLines(exec);
+  const root = worktreesRootFor(d);
   const seats = [], plan = [], kept = [];
   let projects;
   try { projects = fs.readdirSync(root, { withFileTypes: true }).filter((e) => e.isDirectory()); }
@@ -137,10 +154,8 @@ export function scanSeatWorktrees(d) {
     catch { continue; }
     for (const seat of seatDirs) {
       const wt = join(root, proj.name, seat.name);
-      const isLive = live.some((l) => l.includes(wt)) || seatTurnLive(fs, home, now, proj.name, seat.name);
-      const liveReason = live.some((l) => l.includes(wt))
-        ? "KEPT: a live seat process uses this worktree"
-        : "KEPT: the seat's turn stamp is fresh — a turn may be live";
+      const liveReason = seatRetentionReason(d, proj.name, seat.name, wt);
+      const isLive = Boolean(liveReason);
       const size = dirSize(fs, wt, d);
       seats.push({ project: proj.name, seat: seat.name, path: wt, bytes: size.bytes, live: isLive });
       for (const rel of BUILD_DIRS) {
@@ -180,6 +195,101 @@ export function scanSeatWorktrees(d) {
   return { root, seats, plan, kept };
 }
 
+// #12269: old clean worktrees can go only after crew state and processes both release the seat.
+export function scanStaleWorktrees(d) {
+  const { fs, exec, home, now } = d;
+  const root = worktreesRootFor(d);
+  const plan = [], kept = [];
+  let projects;
+  try { projects = fs.readdirSync(root, { withFileTypes: true }).filter((e) => e.isDirectory()); }
+  catch { return { root, plan, kept }; }
+  for (const proj of projects) {
+    let seatDirs;
+    try { seatDirs = fs.readdirSync(join(root, proj.name), { withFileTypes: true }).filter((e) => e.isDirectory()); }
+    catch { continue; }
+    for (const seat of seatDirs) {
+      const wt = join(root, proj.name, seat.name);
+      const reason = seatRetentionReason(d, proj.name, seat.name, wt);
+      if (reason) {
+        kept.push({ path: wt, reason });
+        continue;
+      }
+      if (gitOut(exec, ["-C", wt, "status", "--porcelain"]).trim()) {
+        kept.push({ path: wt, reason: `KEPT: ${proj.name}/${seat.name} has uncommitted changes` });
+        continue;
+      }
+      const size = dirSize(fs, wt, d);
+      if (size.maxMtime > now - WORKTREE_IDLE_MAX) {
+        kept.push({ path: wt, reason: `KEPT: ${proj.name}/${seat.name} was touched within ${WORKTREE_IDLE_MAX / DAY} days` });
+        continue;
+      }
+      plan.push({ type: "seat-worktree", path: wt, project: proj.name, seat: seat.name, bytes: size.bytes });
+    }
+  }
+  plan.sort((a, b) => b.bytes - a.bytes);
+  return { root, plan, kept };
+}
+
+// #12269: build output parked INSIDE a seat's scratch dirs — DerivedData, target/, *.xcresult —
+// idle past the build-output window is deletable even when it is not a top-level scratch entry
+// (that case the 2-day scratch rule already owns). Top-level entries are never matched here, so
+// the two scans cannot plan the same path. First match wins per subtree; git-tracked paths stay.
+export function scanNestedBuildOutput(d) {
+  const { fs, exec, home, now } = d;
+  const root = worktreesRootFor(d);
+  const plan = [], kept = [];
+  const isOutputDir = (name) => BUILD_OUTPUT_NAMES.includes(name) || name.endsWith(BUILD_OUTPUT_SUFFIX);
+  let projects;
+  try { projects = fs.readdirSync(root, { withFileTypes: true }).filter((e) => e.isDirectory()); }
+  catch { return { plan, kept }; }
+  for (const proj of projects) {
+    let seatDirs;
+    try { seatDirs = fs.readdirSync(join(root, proj.name), { withFileTypes: true }).filter((e) => e.isDirectory()); }
+    catch { continue; }
+    for (const seat of seatDirs) {
+      const wt = join(root, proj.name, seat.name);
+      const reason = seatRetentionReason(d, proj.name, seat.name, wt);
+      if (reason) { kept.push({ path: wt, reason }); continue; }
+      for (const scratch of SCRATCH_DIRS) {
+        const dir = join(wt, scratch);
+        const stack = [];
+        try {
+          for (const top of fs.readdirSync(dir, { withFileTypes: true })) {
+            if (!top.isDirectory()) continue;
+            let entries;
+            try { entries = fs.readdirSync(join(dir, top.name), { withFileTypes: true }); } catch { continue; }
+            for (const e of entries) if (e.isDirectory()) stack.push(join(dir, top.name, e.name));
+          }
+        } catch { continue; }
+        let seen = 0;
+        while (stack.length) {
+          if (seen++ > d.entryBudget) break;
+          const p = stack.pop();
+          if (!isOutputDir(basename(p))) {
+            let entries;
+            try { entries = fs.readdirSync(p, { withFileTypes: true }); } catch { continue; }
+            for (const e of entries) if (e.isDirectory()) stack.push(join(p, e.name));
+            continue;
+          }
+          let st;
+          try { st = fs.statSync(p); } catch { continue; }
+          if (!st.isDirectory()) continue;
+          const rel = relative(wt, p);
+          if (gitTracked(exec, wt, rel)) { kept.push({ path: p, reason: `KEPT: ${rel} is git-tracked in ${proj.name}/${seat.name}` }); continue; }
+          const stat = dirSize(fs, p, d);
+          if (stat.maxMtime > now - BUILD_OUTPUT_IDLE_MAX) {
+            kept.push({ path: p, reason: `KEPT: ${rel} was touched within ${BUILD_OUTPUT_IDLE_MAX / DAY} days` });
+            continue;
+          }
+          plan.push({ type: "build-output", path: p, worktree: wt, project: proj.name, seat: seat.name, bytes: stat.bytes });
+        }
+      }
+    }
+  }
+  plan.sort((a, b) => b.bytes - a.bytes);
+  return { plan, kept };
+}
+
 export function scanOpencodeSessions(d) {
   const { exec, now } = d;
   const live = liveCommandLines(exec);
@@ -345,6 +455,8 @@ export function buildDiskReport(d) {
   const { fs, home, now } = dep;
   const space = freeSpace(fs, "/");
   const seats = scanSeatWorktrees({ ...dep, entryBudget: dep.entryBudget });
+  const stale = scanStaleWorktrees({ ...dep, entryBudget: dep.entryBudget });
+  const nested = scanNestedBuildOutput({ ...dep, entryBudget: dep.entryBudget });
   const sessions = scanOpencodeSessions(dep);
   const sims = scanSimulators(dep);
   const dbPath = join(home, ".local", "share", "opencode", "opencode.db");
@@ -360,16 +472,17 @@ export function buildDiskReport(d) {
     hf: reportHfCache(dep),
     claudeWorktrees: reportClaudeWorktrees(dep),
     bigFiles: collectBigFiles(dep),
-    plan: [...sims.plan, ...seats.plan, ...sessions.plan],
-    kept: [...seats.kept, ...sessions.kept],
+    plan: [...sims.plan, ...seats.plan, ...stale.plan, ...nested.plan, ...sessions.plan],
+    kept: [...seats.kept, ...stale.kept, ...nested.kept, ...sessions.kept],
   };
   return report;
 }
 
-// Bytes the safe tier's ON-DISK items (build dirs, scratch entries) would free —
-// the summary line's number. simctl/opencode items free space inside their own stores.
+// Bytes the safe tier's ON-DISK items (build dirs, scratch entries, whole worktrees, nested
+// build output) would free — the summary line's number. simctl/opencode items free space
+// inside their own stores.
 export function freedOnDiskBytes(plan) {
-  return (plan || []).filter((p) => p.type === "build-dir" || p.type === "scratch-entry").reduce((n, p) => n + (p.bytes || 0), 0);
+  return (plan || []).filter((p) => ["build-dir", "scratch-entry", "seat-worktree", "build-output"].includes(p.type)).reduce((n, p) => n + (p.bytes || 0), 0);
 }
 
 function fileSize(fs, p) {
@@ -408,25 +521,44 @@ export function formatHuman(r) {
   return `${L.join("\n")}\n`;
 }
 
-// Execute the safe tier. simctl/opencode run as their own CLIs (injected in tests);
-// build dirs are removed by the injected `remove` (default fs.rmSync) only after
-// assertUnderHome AND an is-under-worktrees-root re-check on the exact path.
+// Execute the safe tier. Every planned item is PRINTED before it is acted on (#12269), so the
+// log is a receipt, not a mystery. simctl/opencode run as their own CLIs (injected in tests);
+// on-disk items are removed by the injected `remove` (default fs.rmSync) or `git worktree
+// remove`, only after assertUnderHome AND an is-under-worktrees-root re-check on the exact path.
 export async function runClean(r, d) {
   const dep = defaults(d);
-  const { exec, home } = dep;
+  const { exec, home, log } = dep;
   const remove = dep.remove || ((p, opts) => dep.fs.rmSync(p, opts));
+  const root = worktreesRootFor(dep);
   const results = [];
   for (const item of r.plan) {
+    const label = item.path || (item.type === "opencode-session" ? `session ${item.id}` : item.type === "simulators" ? "unavailable simulators" : item.type);
+    log(`janitor: removing ${item.type} ${label}${item.bytes ? ` (~${fmtBytes(item.bytes)})` : ""}`);
     try {
+      if (item.path) {
+        const p = assertUnderHome(item.path, home);
+        if (!isUnder(p, root)) throw new Error(`refused: ${p} is not under the seat worktrees root`);
+        const [project, seat] = relative(root, p).split(sep);
+        if (!project || !seat) throw new Error("refused: path does not identify a seat worktree");
+        const reason = seatRetentionReason(dep, project, seat, join(root, project, seat));
+        if (reason) throw new Error(reason);
+      }
       if (item.type === "simulators") {
         exec("xcrun", ["simctl", "delete", "unavailable"]);
         results.push({ type: item.type, ok: true });
       } else if (item.type === "opencode-session") {
         exec("opencode", ["session", "delete", item.id]);
         results.push({ type: item.type, id: item.id, ok: true });
-      } else if (item.type === "build-dir" || item.type === "scratch-entry") {
+      } else if (item.type === "seat-worktree") {
+        const p = assertUnderHome(item.path, home);
+        if (!isUnder(p, root)) throw new Error(`refused: ${p} is not under the seat worktrees root`);
+        if (gitOut(exec, ["-C", p, "status", "--porcelain"]).trim()) throw new Error("worktree has uncommitted changes");
+        const g = exec("git", ["-C", p, "worktree", "remove", p]);
+        if (g.status !== 0) throw new Error(String(g.stderr || "git worktree remove failed").trim().split("\n")[0] || "git worktree remove failed");
+        results.push({ type: item.type, path: p, bytes: item.bytes || 0, ok: true });
+      } else if (item.type === "build-dir" || item.type === "build-output" || item.type === "scratch-entry") {
         const p = assertUnderHome(item.path, home);
-        if (!isUnder(p, join(home, ".agent-bus", "worktrees"))) throw new Error(`refused: ${p} is not under the seat worktrees root`);
+        if (!isUnder(p, root)) throw new Error(`refused: ${p} is not under the seat worktrees root`);
         remove(p, { recursive: true, force: true });
         results.push({ type: item.type, path: p, bytes: item.bytes || 0, ok: true });
       }
@@ -438,6 +570,7 @@ export async function runClean(r, d) {
 }
 
 export function launchdPlist({ nodePath, scriptPath, logPath }) {
+  // #12269: daily at 09:00 — the weekly cadence lost the race against 100 GB/week of seat junk.
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -447,11 +580,10 @@ export function launchdPlist({ nodePath, scriptPath, logPath }) {
   <array>
     <string>${nodePath}</string>
     <string>${scriptPath}</string>
-    <string>--weekly</string>
+    <string>--daily</string>
   </array>
   <key>StartCalendarInterval</key>
   <dict>
-    <key>Weekday</key><integer>1</integer>
     <key>Hour</key><integer>9</integer>
     <key>Minute</key><integer>0</integer>
   </dict>
@@ -464,7 +596,8 @@ export function launchdPlist({ nodePath, scriptPath, logPath }) {
 
 export async function runDisk(d = {}) {
   const dep = defaults(d);
-  const clean = d.args?.includes("--clean");
+  // --dry-run always wins: report only, never clean — whichever flag asked for cleaning.
+  const clean = d.args?.includes("--clean") && !d.args?.includes("--dry-run");
   const json = d.args?.includes("--json");
   const report = buildDiskReport(dep);
   const results = clean ? await runClean(report, dep) : [];

package/lib/seat-worktree.mjs

@@ -66,10 +66,24 @@ export function ensureSeatWorktree({ sourceDir, project, agent, home = homedir()
     }
   }
 
-  const r = spawnSync("git", ["-C", root, "worktree", "add", "--no-track", "-B", branch, seatDir, "HEAD"], {
+  // #12269: a branch that already exists is the seat's history — down removed the worktree, not
+  // the branch. Reset it to HEAD only when it holds nothing HEAD lacks (fully harvested); else
+  // re-create at the branch tip so a re-upped seat name reuses the freed worktree with its commits.
+  const branchTip = gitOut(["-C", root, "rev-parse", "--verify", "--quiet", `refs/heads/${branch}`], root);
+  const add = ["worktree", "add"];
+  let reuseBranch = false;
+  if (branchTip) {
+    const merged = spawnSync("git", ["-C", root, "merge-base", "--is-ancestor", branch, "HEAD"], { stdio: "ignore", timeout: 8000 }).status === 0;
+    if (merged) add.push("--no-track", "-B", branch, seatDir, "HEAD");
+    else { add.push(seatDir, branch); reuseBranch = true; }
+  } else {
+    add.push("--no-track", "-B", branch, seatDir, "HEAD");
+  }
+  const r = spawnSync("git", ["-C", root, ...add], {
     encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 30000,
   });
   if (r.status === 0) {
+    if (reuseBranch) log(`\x1b[2m[runner]\x1b[0m ${branch} re-created at its own tip (${branchTip.slice(0, 7)}) — unintegrated commits kept`);
     // branch.<b>.base names the real base for the Review lens; push.autoSetupRemote makes the
     // first plain push set its upstream (#5403).
     if (base) spawnSync("git", ["-C", seatDir, "config", `branch.${branch}.base`, base], { stdio: "ignore", timeout: 5000 });
@@ -77,10 +91,33 @@ export function ensureSeatWorktree({ sourceDir, project, agent, home = homedir()
     if (!pushAuto) spawnSync("git", ["-C", seatDir, "config", "push.autoSetupRemote", "true"], { stdio: "ignore", timeout: 5000 });
     return { dir: seatDir, created: true, root, dirty: false };
   }
+  if (reuseBranch) {
+    const reason = String(r.stderr || "").trim().split("\n")[0] || "git worktree add failed";
+    log(`\x1b[33m[runner]\x1b[0m ${branch} holds unintegrated commits and could not be re-created (${reason}) — using ${sourceDir} rather than resetting the branch`);
+    return { dir: sourceDir, created: false };
+  }
   log(`\x1b[33m[runner]\x1b[0m could not create ${branch} worktree — using ${sourceDir}`);
   return { dir: sourceDir, created: false };
 }
 
+// #12269: down/retire removes a stopped seat's worktree. The branch always stays; a tree with
+// uncommitted changes is kept and named — git's own refusal is the race-free dirty check.
+export function removeSeatWorktree({ project, agent, home = homedir(), env = process.env, dry = false }) {
+  const path = seatWorktreeDir(project, agent, home);
+  if (!existsSync(path)) return { status: "absent", path };
+  if (env?.CREW_NO_PROC_KILL === "1") return { status: "kept", path, reason: "CREW_NO_PROC_KILL=1 (process kill and removals guarded)" };
+  if (dry) return { status: "would-remove", path };
+  const r = spawnSync("git", ["-C", path, "worktree", "remove", path], {
+    encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 60000,
+  });
+  if (r.status === 0) return { status: "removed", path };
+  const dirty = spawnSync("git", ["-C", path, "status", "--porcelain"], {
+    encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 30000,
+  }).stdout || "";
+  if (dirty.trim()) return { status: "kept", path, reason: "uncommitted changes" };
+  return { status: "kept", path, reason: String(r.stderr || "git worktree remove failed").trim().split("\n")[0] };
+}
+
 // The declaration: { link: [<relative sibling path>], provision: [{ path, mode, template? }],
 // preflight: "<shell command>" }. null when the project declares nothing (unchanged behaviour).
 export function readWorktreeDeclaration(root) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.116",
+  "version": "0.18.118",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"