trantor 0.18.117 → 0.18.118

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.117",
+  "version": "0.18.118",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/crew/processes.mjs

@@ -4,7 +4,7 @@ import { call } from "./core.mjs";
 
 export const runnerRecord = (ctx, project, agent) => join(ctx.seatDir, `${project}-${agent}.runner.json`);
 
-export function seatProcesses(ctx, project, agent) {
+export function seatProcesses(ctx, project, agent, exec = call) {
   if (ctx.env.CREW_NO_PROC_KILL === "1") return [];
   let label = agent, dir = ctx.dir;
   try {
@@ -12,7 +12,9 @@ export function seatProcesses(ctx, project, agent) {
     label = record.label;
     dir = record.dir;
   } catch (error) { if (error.code !== "ENOENT") throw error; }
-  const rows = call("ps", ["-axo", "pid=,ppid=,command="]).stdout.split("\n").map(line => {
+  const snapshot = exec("ps", ["-axo", "pid=,ppid=,command="]);
+  if (snapshot.status !== 0) throw new Error("could not read crew processes");
+  const rows = snapshot.stdout.split("\n").map(line => {
     const match = line.trim().match(/^(\d+)\s+(\d+)\s+(.+)$/);
     return match ? { pid: Number(match[1]), parent: Number(match[2]), command: match[3] } : null;
   }).filter(Boolean);

package/bin/crew/state.mjs

@@ -3,6 +3,7 @@ import { dirname, join } from "node:path";
 import { seatProcesses, signalProcesses } from "./processes.mjs";
 import { call, listPids, run } from "./core.mjs";
 import { hostId } from "../../lib/project.mjs";
+import { removeSeatWorktree } from "../../lib/seat-worktree.mjs";
 import { signedPost } from "../../hooks/lib/api.mjs";
 import { statePathFor as dockerStatePathFor, sweep as dockerSweep } from "../../lib/docker-janitor.mjs";
 
@@ -130,7 +131,7 @@ async function unregisterSeat(ctx, project, persona) {
   return response.json;
 }
 
-export async function down(ctx, args, adapters, { unregister = unregisterSeat } = {}) {
+export async function down(ctx, args, adapters, { unregister = unregisterSeat, removeWorktree = removeSeatWorktree, processes = seatProcesses } = {}) {
   const options = parseDownArgs(ctx, args);
   if (options.help) return 0;
   if (options.error) return 1;
@@ -175,6 +176,27 @@ export async function down(ctx, args, adapters, { unregister = unregisterSeat }
         `${JSON.stringify({ ts: Date.now(), agent: row.persona, project: row.project, stopped: true })}\n`);
     }
   }
+  // #12269: a stopped seat's worktree goes with it — `git worktree remove`, branch kept; a tree
+  // with uncommitted changes stays on disk and is named here so the operator can recover it.
+  for (const row of seats.values()) {
+    if (!row.project) continue;
+    if (!ctx.dry) {
+      try {
+        const tracked = readRows(ctx).some(current => current.project === row.project && current.persona === row.persona);
+        if (tracked || processes(ctx, row.project, row.persona).length) {
+          console.log(`  worktree kept (crew row or process remains): ${row.persona}:${row.project}`);
+          continue;
+        }
+      } catch (error) {
+        console.log(`  worktree kept (crew liveness unknown: ${error.message}): ${row.persona}:${row.project}`);
+        continue;
+      }
+    }
+    const r = await removeWorktree({ project: row.project, agent: row.persona, home: ctx.home || undefined, env: ctx.env, dry: ctx.dry });
+    if (r.status === "removed") console.log(`  worktree removed: ${r.path} (branch seat/${row.persona} kept)`);
+    else if (r.status === "kept") console.log(`  worktree kept (${r.reason}): ${r.path}`);
+    else if (r.status === "would-remove") console.log(`  [dry] would remove worktree: ${r.path}`);
+  }
   if (failures.length) {
     console.log(`— hub row removal incomplete; retry Stop: ${failures.join("; ")}`);
     return 1;

package/bin/disk.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // trantor disk — report where the disk went; --clean runs the safe tier ONLY;
-// install wires a Monday 09:00 launchd job; --weekly is what that job runs
-// (safe clean, then exactly ONE summary message on the bus for the operator).
+// install wires a daily 09:00 launchd job; --daily (or the legacy --weekly) is what
+// that job runs (safe clean, then exactly ONE summary message on the bus for the operator).
 import { spawnSync } from "node:child_process";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -52,7 +52,7 @@ async function install() {
     // bootout+bootstrap can race an existing job; load -w is the legacy fallback.
     exec("launchctl", ["load", "-w", plistPath]);
   }
-  console.log(`installed: ${plistPath}\nruns every Monday 09:00 (safe tier only); result lands as one bus message. Log: ${logPath}`);
+  console.log(`installed: ${plistPath}\nruns every day at 09:00 (safe tier only); result lands as one bus message. Log: ${logPath}`);
 }
 
 function exec(file, args) {
@@ -64,19 +64,23 @@ if (args.includes("--help") || args.includes("-h") || args[0] === "help") {
   console.log(`trantor disk — where the space went, and the provably safe slice to reclaim
 
   trantor disk              report only (also prints exactly what the safe tier would delete)
-  trantor disk --dry-run    the same report, explicit
-  trantor disk --clean      run the SAFE tier: unavailable simulators, build output and
-                            stale scratch (.agent-bus-out/.scratch entries idle 2+ days) in
-                            seat worktrees with no live turn (ps + the runner's turn stamp),
-                            opencode sessions idle >14 days. Everything else stays.
+  trantor disk --dry-run    the same report, explicit — never cleans
+  trantor disk --clean      run the SAFE tier: unavailable simulators, whole seat worktrees
+                            idle 7+ days with no uncommitted changes (branch kept), build
+                            output (DerivedData, *.xcresult, target/) idle 3+ days, stale
+                            scratch (.agent-bus-out/.scratch entries idle 2+ days) and build
+                            dirs in seat worktrees with no live turn, opencode sessions idle
+                            >14 days. Everything else stays. Every removal is printed first.
   trantor disk --json       machine-readable report
-  trantor disk install      Monday 09:00 launchd job (runs --weekly: clean + one bus message)`);
+  trantor disk install      daily 09:00 launchd job (runs --daily: clean + one bus message)`);
   process.exit(0);
 }
 if (args[0] === "install") { await install(); process.exit(0); }
 
-const weekly = args.includes("--weekly");
-const passArgs = weekly ? [...args, "--clean"] : args;
+// #12269: daily cadence (--daily; --weekly kept as the old plist's flag). --dry-run wins.
+const periodic = args.includes("--weekly") || args.includes("--daily");
+const dryRun = args.includes("--dry-run");
+const passArgs = periodic && !dryRun ? [...args, "--clean"] : args;
 const { report, results, json } = await runDisk({ args: passArgs });
 if (json) {
   process.stdout.write(`${JSON.stringify({ report, results }, null, 2)}\n`);
@@ -87,4 +91,4 @@ if (json) {
     for (const r of results.filter((r) => !r.ok)) console.log(`  FAILED ${r.type} ${r.path || r.id || ""}: ${r.error}`);
   }
 }
-if (weekly) await sendWeeklyMessage(summaryLine(report, results));
+if (periodic) await sendWeeklyMessage(summaryLine(report, results));

package/lib/disk.mjs

@@ -4,8 +4,10 @@
 // REPORT-only; our own deletions are fs.rm on paths asserted under $HOME, never rm -rf.
 import { spawnSync } from "node:child_process";
 import * as nodeFs from "node:fs";
-import { join, resolve, sep, basename, dirname } from "node:path";
+import { join, resolve, sep, basename, dirname, relative } from "node:path";
 import { homedir } from "node:os";
+import { readRows } from "../bin/crew/state.mjs";
+import { seatProcesses } from "../bin/crew/processes.mjs";
 
 export const DAY = 24 * 60 * 60 * 1000;
 export const BUILD_DIRS = [".next", "target", "desktop/src-tauri/target"];
@@ -14,6 +16,12 @@ export const SESSION_IDLE_MAX = 14 * DAY;
 // the 10-10 incident was 27 GB of it. Top-level entries untouched this long are safe tier.
 export const SCRATCH_DIRS = [".agent-bus-out", ".scratch"];
 export const SCRATCH_IDLE_MAX = 2 * DAY;
+// #12269: whole seat worktrees idle this long with no uncommitted changes are pruned;
+// build output parked inside the scratch dirs gets its own, shorter window.
+export const WORKTREE_IDLE_MAX = 7 * DAY;
+export const BUILD_OUTPUT_IDLE_MAX = 3 * DAY;
+export const BUILD_OUTPUT_NAMES = ["DerivedData", "target"];
+export const BUILD_OUTPUT_SUFFIX = ".xcresult";
 
 const GB = 1024 ** 3;
 const KB = 1024;
@@ -54,10 +62,17 @@ function defaults(d = {}) {
     home: d.home || homedir(),
     now: d.now || Date.now(),
     worktreesRoot: d.worktreesRoot || null,
+    log: d.log || console.log,
     entryBudget: d.entryBudget || 400_000,
   };
 }
 
+// The seat worktrees root: injected in tests, else the real one under HOME. Every delete
+// below this line re-checks its path is under this root before touching anything.
+export function worktreesRootFor(d) {
+  return d.worktreesRoot || join(d.home || homedir(), ".agent-bus", "worktrees");
+}
+
 // Recursive size walk. Skips symlinks entirely — a worktree symlink must not make
 // us measure (or later rm) outside its root. Budget caps pathological trees. Dirs are
 // statted too: a rename into an old tree updates the DIR mtime, not the file's, and
@@ -109,24 +124,26 @@ export function gitTracked(exec, worktree, rel) {
   return gitOut(exec, ["-C", worktree, "ls-files", "--", rel]).trim().length > 0;
 }
 
-// The runner writes ~/.agent-bus/turnstamp-<seat>-<project>.json at turn start and
-// unlinks it on every exit — a stamp younger than the scratch window IS a live (or
-// just-crashed) turn; a stamp that old cannot be one, since the time box kills in hours.
-export function turnStampPath(home, project, seat) {
-  return join(home, ".agent-bus", `turnstamp-${seat}-${project}.json`);
-}
-
-function seatTurnLive(fs, home, now, project, seat) {
+// #12269: a seat is dead only when both crew ownership and its runner processes are gone.
+function seatRetentionReason(d, project, seat, worktree) {
+  const bus = join(d.home, ".agent-bus");
   try {
-    const st = fs.statSync(turnStampPath(home, project, seat));
-    return now - Number(st.mtimeMs) < SCRATCH_IDLE_MAX;
-  } catch { return false; }
+    const ctx = { statePath: join(bus, "crew-windows.txt"), seatDir: join(bus, "seats"), env: {} };
+    if (readRows(ctx).some(row => row.project === project && row.persona === seat)) {
+      return `KEPT: ${seat}:${project} has a crew state row`;
+    }
+    const trees = gitOut(d.exec, ["-C", worktree, "worktree", "list", "--porcelain"]);
+    ctx.dir = trees.match(/^worktree (.+)$/m)?.[1] || worktree;
+    if (seatProcesses(ctx, project, seat, d.exec).length) return `KEPT: ${seat}:${project} has live crew processes`;
+    return "";
+  } catch (error) {
+    return `KEPT: cannot establish crew liveness for ${seat}:${project}: ${error.message}`;
+  }
 }
 
 export function scanSeatWorktrees(d) {
   const { fs, exec, home, now } = d;
-  const root = d.worktreesRoot || join(home, ".agent-bus", "worktrees");
-  const live = liveCommandLines(exec);
+  const root = worktreesRootFor(d);
   const seats = [], plan = [], kept = [];
   let projects;
   try { projects = fs.readdirSync(root, { withFileTypes: true }).filter((e) => e.isDirectory()); }
@@ -137,10 +154,8 @@ export function scanSeatWorktrees(d) {
     catch { continue; }
     for (const seat of seatDirs) {
       const wt = join(root, proj.name, seat.name);
-      const isLive = live.some((l) => l.includes(wt)) || seatTurnLive(fs, home, now, proj.name, seat.name);
-      const liveReason = live.some((l) => l.includes(wt))
-        ? "KEPT: a live seat process uses this worktree"
-        : "KEPT: the seat's turn stamp is fresh — a turn may be live";
+      const liveReason = seatRetentionReason(d, proj.name, seat.name, wt);
+      const isLive = Boolean(liveReason);
       const size = dirSize(fs, wt, d);
       seats.push({ project: proj.name, seat: seat.name, path: wt, bytes: size.bytes, live: isLive });
       for (const rel of BUILD_DIRS) {
@@ -180,6 +195,101 @@ export function scanSeatWorktrees(d) {
   return { root, seats, plan, kept };
 }
 
+// #12269: old clean worktrees can go only after crew state and processes both release the seat.
+export function scanStaleWorktrees(d) {
+  const { fs, exec, home, now } = d;
+  const root = worktreesRootFor(d);
+  const plan = [], kept = [];
+  let projects;
+  try { projects = fs.readdirSync(root, { withFileTypes: true }).filter((e) => e.isDirectory()); }
+  catch { return { root, plan, kept }; }
+  for (const proj of projects) {
+    let seatDirs;
+    try { seatDirs = fs.readdirSync(join(root, proj.name), { withFileTypes: true }).filter((e) => e.isDirectory()); }
+    catch { continue; }
+    for (const seat of seatDirs) {
+      const wt = join(root, proj.name, seat.name);
+      const reason = seatRetentionReason(d, proj.name, seat.name, wt);
+      if (reason) {
+        kept.push({ path: wt, reason });
+        continue;
+      }
+      if (gitOut(exec, ["-C", wt, "status", "--porcelain"]).trim()) {
+        kept.push({ path: wt, reason: `KEPT: ${proj.name}/${seat.name} has uncommitted changes` });
+        continue;
+      }
+      const size = dirSize(fs, wt, d);
+      if (size.maxMtime > now - WORKTREE_IDLE_MAX) {
+        kept.push({ path: wt, reason: `KEPT: ${proj.name}/${seat.name} was touched within ${WORKTREE_IDLE_MAX / DAY} days` });
+        continue;
+      }
+      plan.push({ type: "seat-worktree", path: wt, project: proj.name, seat: seat.name, bytes: size.bytes });
+    }
+  }
+  plan.sort((a, b) => b.bytes - a.bytes);
+  return { root, plan, kept };
+}
+
+// #12269: build output parked INSIDE a seat's scratch dirs — DerivedData, target/, *.xcresult —
+// idle past the build-output window is deletable even when it is not a top-level scratch entry
+// (that case the 2-day scratch rule already owns). Top-level entries are never matched here, so
+// the two scans cannot plan the same path. First match wins per subtree; git-tracked paths stay.
+export function scanNestedBuildOutput(d) {
+  const { fs, exec, home, now } = d;
+  const root = worktreesRootFor(d);
+  const plan = [], kept = [];
+  const isOutputDir = (name) => BUILD_OUTPUT_NAMES.includes(name) || name.endsWith(BUILD_OUTPUT_SUFFIX);
+  let projects;
+  try { projects = fs.readdirSync(root, { withFileTypes: true }).filter((e) => e.isDirectory()); }
+  catch { return { plan, kept }; }
+  for (const proj of projects) {
+    let seatDirs;
+    try { seatDirs = fs.readdirSync(join(root, proj.name), { withFileTypes: true }).filter((e) => e.isDirectory()); }
+    catch { continue; }
+    for (const seat of seatDirs) {
+      const wt = join(root, proj.name, seat.name);
+      const reason = seatRetentionReason(d, proj.name, seat.name, wt);
+      if (reason) { kept.push({ path: wt, reason }); continue; }
+      for (const scratch of SCRATCH_DIRS) {
+        const dir = join(wt, scratch);
+        const stack = [];
+        try {
+          for (const top of fs.readdirSync(dir, { withFileTypes: true })) {
+            if (!top.isDirectory()) continue;
+            let entries;
+            try { entries = fs.readdirSync(join(dir, top.name), { withFileTypes: true }); } catch { continue; }
+            for (const e of entries) if (e.isDirectory()) stack.push(join(dir, top.name, e.name));
+          }
+        } catch { continue; }
+        let seen = 0;
+        while (stack.length) {
+          if (seen++ > d.entryBudget) break;
+          const p = stack.pop();
+          if (!isOutputDir(basename(p))) {
+            let entries;
+            try { entries = fs.readdirSync(p, { withFileTypes: true }); } catch { continue; }
+            for (const e of entries) if (e.isDirectory()) stack.push(join(p, e.name));
+            continue;
+          }
+          let st;
+          try { st = fs.statSync(p); } catch { continue; }
+          if (!st.isDirectory()) continue;
+          const rel = relative(wt, p);
+          if (gitTracked(exec, wt, rel)) { kept.push({ path: p, reason: `KEPT: ${rel} is git-tracked in ${proj.name}/${seat.name}` }); continue; }
+          const stat = dirSize(fs, p, d);
+          if (stat.maxMtime > now - BUILD_OUTPUT_IDLE_MAX) {
+            kept.push({ path: p, reason: `KEPT: ${rel} was touched within ${BUILD_OUTPUT_IDLE_MAX / DAY} days` });
+            continue;
+          }
+          plan.push({ type: "build-output", path: p, worktree: wt, project: proj.name, seat: seat.name, bytes: stat.bytes });
+        }
+      }
+    }
+  }
+  plan.sort((a, b) => b.bytes - a.bytes);
+  return { plan, kept };
+}
+
 export function scanOpencodeSessions(d) {
   const { exec, now } = d;
   const live = liveCommandLines(exec);
@@ -345,6 +455,8 @@ export function buildDiskReport(d) {
   const { fs, home, now } = dep;
   const space = freeSpace(fs, "/");
   const seats = scanSeatWorktrees({ ...dep, entryBudget: dep.entryBudget });
+  const stale = scanStaleWorktrees({ ...dep, entryBudget: dep.entryBudget });
+  const nested = scanNestedBuildOutput({ ...dep, entryBudget: dep.entryBudget });
   const sessions = scanOpencodeSessions(dep);
   const sims = scanSimulators(dep);
   const dbPath = join(home, ".local", "share", "opencode", "opencode.db");
@@ -360,16 +472,17 @@ export function buildDiskReport(d) {
     hf: reportHfCache(dep),
     claudeWorktrees: reportClaudeWorktrees(dep),
     bigFiles: collectBigFiles(dep),
-    plan: [...sims.plan, ...seats.plan, ...sessions.plan],
-    kept: [...seats.kept, ...sessions.kept],
+    plan: [...sims.plan, ...seats.plan, ...stale.plan, ...nested.plan, ...sessions.plan],
+    kept: [...seats.kept, ...stale.kept, ...nested.kept, ...sessions.kept],
   };
   return report;
 }
 
-// Bytes the safe tier's ON-DISK items (build dirs, scratch entries) would free —
-// the summary line's number. simctl/opencode items free space inside their own stores.
+// Bytes the safe tier's ON-DISK items (build dirs, scratch entries, whole worktrees, nested
+// build output) would free — the summary line's number. simctl/opencode items free space
+// inside their own stores.
 export function freedOnDiskBytes(plan) {
-  return (plan || []).filter((p) => p.type === "build-dir" || p.type === "scratch-entry").reduce((n, p) => n + (p.bytes || 0), 0);
+  return (plan || []).filter((p) => ["build-dir", "scratch-entry", "seat-worktree", "build-output"].includes(p.type)).reduce((n, p) => n + (p.bytes || 0), 0);
 }
 
 function fileSize(fs, p) {
@@ -408,25 +521,44 @@ export function formatHuman(r) {
   return `${L.join("\n")}\n`;
 }
 
-// Execute the safe tier. simctl/opencode run as their own CLIs (injected in tests);
-// build dirs are removed by the injected `remove` (default fs.rmSync) only after
-// assertUnderHome AND an is-under-worktrees-root re-check on the exact path.
+// Execute the safe tier. Every planned item is PRINTED before it is acted on (#12269), so the
+// log is a receipt, not a mystery. simctl/opencode run as their own CLIs (injected in tests);
+// on-disk items are removed by the injected `remove` (default fs.rmSync) or `git worktree
+// remove`, only after assertUnderHome AND an is-under-worktrees-root re-check on the exact path.
 export async function runClean(r, d) {
   const dep = defaults(d);
-  const { exec, home } = dep;
+  const { exec, home, log } = dep;
   const remove = dep.remove || ((p, opts) => dep.fs.rmSync(p, opts));
+  const root = worktreesRootFor(dep);
   const results = [];
   for (const item of r.plan) {
+    const label = item.path || (item.type === "opencode-session" ? `session ${item.id}` : item.type === "simulators" ? "unavailable simulators" : item.type);
+    log(`janitor: removing ${item.type} ${label}${item.bytes ? ` (~${fmtBytes(item.bytes)})` : ""}`);
     try {
+      if (item.path) {
+        const p = assertUnderHome(item.path, home);
+        if (!isUnder(p, root)) throw new Error(`refused: ${p} is not under the seat worktrees root`);
+        const [project, seat] = relative(root, p).split(sep);
+        if (!project || !seat) throw new Error("refused: path does not identify a seat worktree");
+        const reason = seatRetentionReason(dep, project, seat, join(root, project, seat));
+        if (reason) throw new Error(reason);
+      }
       if (item.type === "simulators") {
         exec("xcrun", ["simctl", "delete", "unavailable"]);
         results.push({ type: item.type, ok: true });
       } else if (item.type === "opencode-session") {
         exec("opencode", ["session", "delete", item.id]);
         results.push({ type: item.type, id: item.id, ok: true });
-      } else if (item.type === "build-dir" || item.type === "scratch-entry") {
+      } else if (item.type === "seat-worktree") {
+        const p = assertUnderHome(item.path, home);
+        if (!isUnder(p, root)) throw new Error(`refused: ${p} is not under the seat worktrees root`);
+        if (gitOut(exec, ["-C", p, "status", "--porcelain"]).trim()) throw new Error("worktree has uncommitted changes");
+        const g = exec("git", ["-C", p, "worktree", "remove", p]);
+        if (g.status !== 0) throw new Error(String(g.stderr || "git worktree remove failed").trim().split("\n")[0] || "git worktree remove failed");
+        results.push({ type: item.type, path: p, bytes: item.bytes || 0, ok: true });
+      } else if (item.type === "build-dir" || item.type === "build-output" || item.type === "scratch-entry") {
         const p = assertUnderHome(item.path, home);
-        if (!isUnder(p, join(home, ".agent-bus", "worktrees"))) throw new Error(`refused: ${p} is not under the seat worktrees root`);
+        if (!isUnder(p, root)) throw new Error(`refused: ${p} is not under the seat worktrees root`);
         remove(p, { recursive: true, force: true });
         results.push({ type: item.type, path: p, bytes: item.bytes || 0, ok: true });
       }
@@ -438,6 +570,7 @@ export async function runClean(r, d) {
 }
 
 export function launchdPlist({ nodePath, scriptPath, logPath }) {
+  // #12269: daily at 09:00 — the weekly cadence lost the race against 100 GB/week of seat junk.
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -447,11 +580,10 @@ export function launchdPlist({ nodePath, scriptPath, logPath }) {
   <array>
     <string>${nodePath}</string>
     <string>${scriptPath}</string>
-    <string>--weekly</string>
+    <string>--daily</string>
   </array>
   <key>StartCalendarInterval</key>
   <dict>
-    <key>Weekday</key><integer>1</integer>
     <key>Hour</key><integer>9</integer>
     <key>Minute</key><integer>0</integer>
   </dict>
@@ -464,7 +596,8 @@ export function launchdPlist({ nodePath, scriptPath, logPath }) {
 
 export async function runDisk(d = {}) {
   const dep = defaults(d);
-  const clean = d.args?.includes("--clean");
+  // --dry-run always wins: report only, never clean — whichever flag asked for cleaning.
+  const clean = d.args?.includes("--clean") && !d.args?.includes("--dry-run");
   const json = d.args?.includes("--json");
   const report = buildDiskReport(dep);
   const results = clean ? await runClean(report, dep) : [];

package/lib/seat-worktree.mjs

@@ -66,10 +66,24 @@ export function ensureSeatWorktree({ sourceDir, project, agent, home = homedir()
     }
   }
 
-  const r = spawnSync("git", ["-C", root, "worktree", "add", "--no-track", "-B", branch, seatDir, "HEAD"], {
+  // #12269: a branch that already exists is the seat's history — down removed the worktree, not
+  // the branch. Reset it to HEAD only when it holds nothing HEAD lacks (fully harvested); else
+  // re-create at the branch tip so a re-upped seat name reuses the freed worktree with its commits.
+  const branchTip = gitOut(["-C", root, "rev-parse", "--verify", "--quiet", `refs/heads/${branch}`], root);
+  const add = ["worktree", "add"];
+  let reuseBranch = false;
+  if (branchTip) {
+    const merged = spawnSync("git", ["-C", root, "merge-base", "--is-ancestor", branch, "HEAD"], { stdio: "ignore", timeout: 8000 }).status === 0;
+    if (merged) add.push("--no-track", "-B", branch, seatDir, "HEAD");
+    else { add.push(seatDir, branch); reuseBranch = true; }
+  } else {
+    add.push("--no-track", "-B", branch, seatDir, "HEAD");
+  }
+  const r = spawnSync("git", ["-C", root, ...add], {
     encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 30000,
   });
   if (r.status === 0) {
+    if (reuseBranch) log(`\x1b[2m[runner]\x1b[0m ${branch} re-created at its own tip (${branchTip.slice(0, 7)}) — unintegrated commits kept`);
     // branch.<b>.base names the real base for the Review lens; push.autoSetupRemote makes the
     // first plain push set its upstream (#5403).
     if (base) spawnSync("git", ["-C", seatDir, "config", `branch.${branch}.base`, base], { stdio: "ignore", timeout: 5000 });
@@ -77,10 +91,33 @@ export function ensureSeatWorktree({ sourceDir, project, agent, home = homedir()
     if (!pushAuto) spawnSync("git", ["-C", seatDir, "config", "push.autoSetupRemote", "true"], { stdio: "ignore", timeout: 5000 });
     return { dir: seatDir, created: true, root, dirty: false };
   }
+  if (reuseBranch) {
+    const reason = String(r.stderr || "").trim().split("\n")[0] || "git worktree add failed";
+    log(`\x1b[33m[runner]\x1b[0m ${branch} holds unintegrated commits and could not be re-created (${reason}) — using ${sourceDir} rather than resetting the branch`);
+    return { dir: sourceDir, created: false };
+  }
   log(`\x1b[33m[runner]\x1b[0m could not create ${branch} worktree — using ${sourceDir}`);
   return { dir: sourceDir, created: false };
 }
 
+// #12269: down/retire removes a stopped seat's worktree. The branch always stays; a tree with
+// uncommitted changes is kept and named — git's own refusal is the race-free dirty check.
+export function removeSeatWorktree({ project, agent, home = homedir(), env = process.env, dry = false }) {
+  const path = seatWorktreeDir(project, agent, home);
+  if (!existsSync(path)) return { status: "absent", path };
+  if (env?.CREW_NO_PROC_KILL === "1") return { status: "kept", path, reason: "CREW_NO_PROC_KILL=1 (process kill and removals guarded)" };
+  if (dry) return { status: "would-remove", path };
+  const r = spawnSync("git", ["-C", path, "worktree", "remove", path], {
+    encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 60000,
+  });
+  if (r.status === 0) return { status: "removed", path };
+  const dirty = spawnSync("git", ["-C", path, "status", "--porcelain"], {
+    encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 30000,
+  }).stdout || "";
+  if (dirty.trim()) return { status: "kept", path, reason: "uncommitted changes" };
+  return { status: "kept", path, reason: String(r.stderr || "git worktree remove failed").trim().split("\n")[0] };
+}
+
 // The declaration: { link: [<relative sibling path>], provision: [{ path, mode, template? }],
 // preflight: "<shell command>" }. null when the project declares nothing (unchanged behaviour).
 export function readWorktreeDeclaration(root) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.117",
+  "version": "0.18.118",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"