trantor 0.18.117 → 0.18.119

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.117",
+  "version": "0.18.119",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/cli.mjs

@@ -169,15 +169,15 @@ switch (cmd) {
     break;
   }
   case "invite": {
-    const { loadOrCreate, signRequest } = await import(join(ROOT, "lib/identity.mjs"));
+    const { resolveOwnerIdentity, signRequest } = await import(join(ROOT, "lib/identity.mjs"));
     const nameIdx = args.indexOf("--name"), scopeIdx = args.indexOf("--scope");
     const name = nameIdx >= 0 ? args[nameIdx + 1] : "";
     const scopeRaw = scopeIdx >= 0 ? (args[scopeIdx + 1] || "") : "";
     if (!name || !scopeRaw) { console.error("usage: trantor invite --name <name> --scope <project>:<role>"); process.exit(1); }
     const [project, role = "write"] = scopeRaw.split(":");
-    let hub = "http://127.0.0.1:4477";
-    try { hub = JSON.parse(readFileSync(join(process.env.HOME || "", ".agent-bus", "config.json"), "utf8")).url || hub; } catch {}
-    const id = loadOrCreate("admin", "human");
+    const { resolveHubInfo } = await import(join(ROOT, "lib/project.mjs"));
+    const hub = resolveHubInfo().url;
+    const id = await resolveOwnerIdentity(hub);
     const payload = { scopes: [{ project, role }], ttlSec: 86400 };
     const body = JSON.stringify(payload);
     const sig = signRequest(id, { method: "POST", path: "/invite", body });

package/bin/crew/processes.mjs

@@ -4,7 +4,7 @@ import { call } from "./core.mjs";
 
 export const runnerRecord = (ctx, project, agent) => join(ctx.seatDir, `${project}-${agent}.runner.json`);
 
-export function seatProcesses(ctx, project, agent) {
+export function seatProcesses(ctx, project, agent, exec = call) {
   if (ctx.env.CREW_NO_PROC_KILL === "1") return [];
   let label = agent, dir = ctx.dir;
   try {
@@ -12,7 +12,9 @@ export function seatProcesses(ctx, project, agent) {
     label = record.label;
     dir = record.dir;
   } catch (error) { if (error.code !== "ENOENT") throw error; }
-  const rows = call("ps", ["-axo", "pid=,ppid=,command="]).stdout.split("\n").map(line => {
+  const snapshot = exec("ps", ["-axo", "pid=,ppid=,command="]);
+  if (snapshot.status !== 0) throw new Error("could not read crew processes");
+  const rows = snapshot.stdout.split("\n").map(line => {
     const match = line.trim().match(/^(\d+)\s+(\d+)\s+(.+)$/);
     return match ? { pid: Number(match[1]), parent: Number(match[2]), command: match[3] } : null;
   }).filter(Boolean);

package/bin/crew/state.mjs

@@ -3,6 +3,7 @@ import { dirname, join } from "node:path";
 import { seatProcesses, signalProcesses } from "./processes.mjs";
 import { call, listPids, run } from "./core.mjs";
 import { hostId } from "../../lib/project.mjs";
+import { removeSeatWorktree } from "../../lib/seat-worktree.mjs";
 import { signedPost } from "../../hooks/lib/api.mjs";
 import { statePathFor as dockerStatePathFor, sweep as dockerSweep } from "../../lib/docker-janitor.mjs";
 
@@ -130,7 +131,7 @@ async function unregisterSeat(ctx, project, persona) {
   return response.json;
 }
 
-export async function down(ctx, args, adapters, { unregister = unregisterSeat } = {}) {
+export async function down(ctx, args, adapters, { unregister = unregisterSeat, removeWorktree = removeSeatWorktree, processes = seatProcesses } = {}) {
   const options = parseDownArgs(ctx, args);
   if (options.help) return 0;
   if (options.error) return 1;
@@ -175,6 +176,27 @@ export async function down(ctx, args, adapters, { unregister = unregisterSeat }
         `${JSON.stringify({ ts: Date.now(), agent: row.persona, project: row.project, stopped: true })}\n`);
     }
   }
+  // #12269: a stopped seat's worktree goes with it — `git worktree remove`, branch kept; a tree
+  // with uncommitted changes stays on disk and is named here so the operator can recover it.
+  for (const row of seats.values()) {
+    if (!row.project) continue;
+    if (!ctx.dry) {
+      try {
+        const tracked = readRows(ctx).some(current => current.project === row.project && current.persona === row.persona);
+        if (tracked || processes(ctx, row.project, row.persona).length) {
+          console.log(`  worktree kept (crew row or process remains): ${row.persona}:${row.project}`);
+          continue;
+        }
+      } catch (error) {
+        console.log(`  worktree kept (crew liveness unknown: ${error.message}): ${row.persona}:${row.project}`);
+        continue;
+      }
+    }
+    const r = await removeWorktree({ project: row.project, agent: row.persona, home: ctx.home || undefined, env: ctx.env, dry: ctx.dry });
+    if (r.status === "removed") console.log(`  worktree removed: ${r.path} (branch seat/${row.persona} kept)`);
+    else if (r.status === "kept") console.log(`  worktree kept (${r.reason}): ${r.path}`);
+    else if (r.status === "would-remove") console.log(`  [dry] would remove worktree: ${r.path}`);
+  }
   if (failures.length) {
     console.log(`— hub row removal incomplete; retry Stop: ${failures.join("; ")}`);
     return 1;

package/bin/disk.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // trantor disk — report where the disk went; --clean runs the safe tier ONLY;
-// install wires a Monday 09:00 launchd job; --weekly is what that job runs
-// (safe clean, then exactly ONE summary message on the bus for the operator).
+// install wires a daily 09:00 launchd job; --daily (or the legacy --weekly) is what
+// that job runs (safe clean, then exactly ONE summary message on the bus for the operator).
 import { spawnSync } from "node:child_process";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -52,7 +52,7 @@ async function install() {
     // bootout+bootstrap can race an existing job; load -w is the legacy fallback.
     exec("launchctl", ["load", "-w", plistPath]);
   }
-  console.log(`installed: ${plistPath}\nruns every Monday 09:00 (safe tier only); result lands as one bus message. Log: ${logPath}`);
+  console.log(`installed: ${plistPath}\nruns every day at 09:00 (safe tier only); result lands as one bus message. Log: ${logPath}`);
 }
 
 function exec(file, args) {
@@ -64,19 +64,23 @@ if (args.includes("--help") || args.includes("-h") || args[0] === "help") {
   console.log(`trantor disk — where the space went, and the provably safe slice to reclaim
 
   trantor disk              report only (also prints exactly what the safe tier would delete)
-  trantor disk --dry-run    the same report, explicit
-  trantor disk --clean      run the SAFE tier: unavailable simulators, build output and
-                            stale scratch (.agent-bus-out/.scratch entries idle 2+ days) in
-                            seat worktrees with no live turn (ps + the runner's turn stamp),
-                            opencode sessions idle >14 days. Everything else stays.
+  trantor disk --dry-run    the same report, explicit — never cleans
+  trantor disk --clean      run the SAFE tier: unavailable simulators, whole seat worktrees
+                            idle 7+ days with no uncommitted changes (branch kept), build
+                            output (DerivedData, *.xcresult, target/) idle 3+ days, stale
+                            scratch (.agent-bus-out/.scratch entries idle 2+ days) and build
+                            dirs in seat worktrees with no live turn, opencode sessions idle
+                            >14 days. Everything else stays. Every removal is printed first.
   trantor disk --json       machine-readable report
-  trantor disk install      Monday 09:00 launchd job (runs --weekly: clean + one bus message)`);
+  trantor disk install      daily 09:00 launchd job (runs --daily: clean + one bus message)`);
   process.exit(0);
 }
 if (args[0] === "install") { await install(); process.exit(0); }
 
-const weekly = args.includes("--weekly");
-const passArgs = weekly ? [...args, "--clean"] : args;
+// #12269: daily cadence (--daily; --weekly kept as the old plist's flag). --dry-run wins.
+const periodic = args.includes("--weekly") || args.includes("--daily");
+const dryRun = args.includes("--dry-run");
+const passArgs = periodic && !dryRun ? [...args, "--clean"] : args;
 const { report, results, json } = await runDisk({ args: passArgs });
 if (json) {
   process.stdout.write(`${JSON.stringify({ report, results }, null, 2)}\n`);
@@ -87,4 +91,4 @@ if (json) {
     for (const r of results.filter((r) => !r.ok)) console.log(`  FAILED ${r.type} ${r.path || r.id || ""}: ${r.error}`);
   }
 }
-if (weekly) await sendWeeklyMessage(summaryLine(report, results));
+if (periodic) await sendWeeklyMessage(summaryLine(report, results));

package/bin/pair.mjs

@@ -21,15 +21,23 @@ if (!role || role.startsWith("--")) {
   process.exit(1);
 }
 
-const { load, signRequest } = await import(join(ROOT, "lib/identity.mjs"));
+const { resolveOwnerIdentity, phoneHubAddress, signRequest } = await import(join(ROOT, "lib/identity.mjs"));
 const { resolveHubInfo } = await import(join(ROOT, "lib/project.mjs"));
 
 const hub = resolveHubInfo().url.replace(/\/+$/, "");
-// The operator's owner key, the same one the desktop app signs with (hub.rs owner_identity).
-// Loaded, never minted: a fresh key is unknown to the hub and every invite would 401.
-const owner = process.env.TRANTOR_IDENTITY || "sasha@mac";
-const id = load(owner);
-if (!id) { console.error(`error: no key for the owner identity "${owner}". Set TRANTOR_IDENTITY, or run \`trantor keys status\``); process.exit(1); }
+let id, used;
+try {
+  const response = await fetch(`${hub}/health`, { signal: AbortSignal.timeout(8000) });
+  if (!response.ok) throw new Error(`hub health returned HTTP ${response.status}`);
+  const health = await response.json();
+  used = phoneHubAddress(hub, String(health.publicUrl || ""), forceTailnet);
+  id = await resolveOwnerIdentity(hub);
+} catch (error) {
+  const message = `Pairing failed: ${error.message}. Hub: ${hub}`;
+  if (asJson) console.log(JSON.stringify({ error: message }));
+  else console.error(message);
+  process.exit(1);
+}
 
 const payload = { scopes: [{ project: "*", role }], ttlSec: 600, kind: "human" };
 const body = JSON.stringify(payload);
@@ -64,21 +72,6 @@ if (!r.ok) {
   process.exit(1);
 }
 
-// v1.4: the link carries the hub's public address (Tailscale Funnel) so the phone pairs without
-// Tailscale. /invite itself always goes to the tailnet hub — owner routes never answer in public.
-// /health reports publicUrl; --tailnet forces the tailnet address. No publicUrl (or /health
-// unreachable — the invite already minted) falls back to the tailnet hub.
-const linkHub = (async () => {
-  if (forceTailnet) return { hub, public: false };
-  try {
-    const h = await fetch(`${hub}/health`).then((r) => r.json()).catch(() => ({}));
-    const pub = String(h.publicUrl || "").trim().replace(/\/+$/, "");
-    if (pub) return { hub: pub, public: true };
-  } catch {}
-  return { hub, public: false };
-})();
-
-const used = await linkHub;
 const link = `trantor://enroll?hub=${encodeURIComponent(used.hub)}&token=${j.token}`;
 const expiresAt = Number(j.expiresAt) || Date.now() + 600000;
 const mins = Math.max(0, Math.round((expiresAt - Date.now()) / 60000));

package/lib/disk.mjs

@@ -4,8 +4,10 @@
 // REPORT-only; our own deletions are fs.rm on paths asserted under $HOME, never rm -rf.
 import { spawnSync } from "node:child_process";
 import * as nodeFs from "node:fs";
-import { join, resolve, sep, basename, dirname } from "node:path";
+import { join, resolve, sep, basename, dirname, relative } from "node:path";
 import { homedir } from "node:os";
+import { readRows } from "../bin/crew/state.mjs";
+import { seatProcesses } from "../bin/crew/processes.mjs";
 
 export const DAY = 24 * 60 * 60 * 1000;
 export const BUILD_DIRS = [".next", "target", "desktop/src-tauri/target"];
@@ -14,6 +16,12 @@ export const SESSION_IDLE_MAX = 14 * DAY;
 // the 10-10 incident was 27 GB of it. Top-level entries untouched this long are safe tier.
 export const SCRATCH_DIRS = [".agent-bus-out", ".scratch"];
 export const SCRATCH_IDLE_MAX = 2 * DAY;
+// #12269: whole seat worktrees idle this long with no uncommitted changes are pruned;
+// build output parked inside the scratch dirs gets its own, shorter window.
+export const WORKTREE_IDLE_MAX = 7 * DAY;
+export const BUILD_OUTPUT_IDLE_MAX = 3 * DAY;
+export const BUILD_OUTPUT_NAMES = ["DerivedData", "target"];
+export const BUILD_OUTPUT_SUFFIX = ".xcresult";
 
 const GB = 1024 ** 3;
 const KB = 1024;
@@ -54,10 +62,17 @@ function defaults(d = {}) {
     home: d.home || homedir(),
     now: d.now || Date.now(),
     worktreesRoot: d.worktreesRoot || null,
+    log: d.log || console.log,
     entryBudget: d.entryBudget || 400_000,
   };
 }
 
+// The seat worktrees root: injected in tests, else the real one under HOME. Every delete
+// below this line re-checks its path is under this root before touching anything.
+export function worktreesRootFor(d) {
+  return d.worktreesRoot || join(d.home || homedir(), ".agent-bus", "worktrees");
+}
+
 // Recursive size walk. Skips symlinks entirely — a worktree symlink must not make
 // us measure (or later rm) outside its root. Budget caps pathological trees. Dirs are
 // statted too: a rename into an old tree updates the DIR mtime, not the file's, and
@@ -109,24 +124,26 @@ export function gitTracked(exec, worktree, rel) {
   return gitOut(exec, ["-C", worktree, "ls-files", "--", rel]).trim().length > 0;
 }
 
-// The runner writes ~/.agent-bus/turnstamp-<seat>-<project>.json at turn start and
-// unlinks it on every exit — a stamp younger than the scratch window IS a live (or
-// just-crashed) turn; a stamp that old cannot be one, since the time box kills in hours.
-export function turnStampPath(home, project, seat) {
-  return join(home, ".agent-bus", `turnstamp-${seat}-${project}.json`);
-}
-
-function seatTurnLive(fs, home, now, project, seat) {
+// #12269: a seat is dead only when both crew ownership and its runner processes are gone.
+function seatRetentionReason(d, project, seat, worktree) {
+  const bus = join(d.home, ".agent-bus");
   try {
-    const st = fs.statSync(turnStampPath(home, project, seat));
-    return now - Number(st.mtimeMs) < SCRATCH_IDLE_MAX;
-  } catch { return false; }
+    const ctx = { statePath: join(bus, "crew-windows.txt"), seatDir: join(bus, "seats"), env: {} };
+    if (readRows(ctx).some(row => row.project === project && row.persona === seat)) {
+      return `KEPT: ${seat}:${project} has a crew state row`;
+    }
+    const trees = gitOut(d.exec, ["-C", worktree, "worktree", "list", "--porcelain"]);
+    ctx.dir = trees.match(/^worktree (.+)$/m)?.[1] || worktree;
+    if (seatProcesses(ctx, project, seat, d.exec).length) return `KEPT: ${seat}:${project} has live crew processes`;
+    return "";
+  } catch (error) {
+    return `KEPT: cannot establish crew liveness for ${seat}:${project}: ${error.message}`;
+  }
 }
 
 export function scanSeatWorktrees(d) {
   const { fs, exec, home, now } = d;
-  const root = d.worktreesRoot || join(home, ".agent-bus", "worktrees");
-  const live = liveCommandLines(exec);
+  const root = worktreesRootFor(d);
   const seats = [], plan = [], kept = [];
   let projects;
   try { projects = fs.readdirSync(root, { withFileTypes: true }).filter((e) => e.isDirectory()); }
@@ -137,10 +154,8 @@ export function scanSeatWorktrees(d) {
     catch { continue; }
     for (const seat of seatDirs) {
       const wt = join(root, proj.name, seat.name);
-      const isLive = live.some((l) => l.includes(wt)) || seatTurnLive(fs, home, now, proj.name, seat.name);
-      const liveReason = live.some((l) => l.includes(wt))
-        ? "KEPT: a live seat process uses this worktree"
-        : "KEPT: the seat's turn stamp is fresh — a turn may be live";
+      const liveReason = seatRetentionReason(d, proj.name, seat.name, wt);
+      const isLive = Boolean(liveReason);
       const size = dirSize(fs, wt, d);
       seats.push({ project: proj.name, seat: seat.name, path: wt, bytes: size.bytes, live: isLive });
       for (const rel of BUILD_DIRS) {
@@ -180,6 +195,101 @@ export function scanSeatWorktrees(d) {
   return { root, seats, plan, kept };
 }
 
+// #12269: old clean worktrees can go only after crew state and processes both release the seat.
+export function scanStaleWorktrees(d) {
+  const { fs, exec, home, now } = d;
+  const root = worktreesRootFor(d);
+  const plan = [], kept = [];
+  let projects;
+  try { projects = fs.readdirSync(root, { withFileTypes: true }).filter((e) => e.isDirectory()); }
+  catch { return { root, plan, kept }; }
+  for (const proj of projects) {
+    let seatDirs;
+    try { seatDirs = fs.readdirSync(join(root, proj.name), { withFileTypes: true }).filter((e) => e.isDirectory()); }
+    catch { continue; }
+    for (const seat of seatDirs) {
+      const wt = join(root, proj.name, seat.name);
+      const reason = seatRetentionReason(d, proj.name, seat.name, wt);
+      if (reason) {
+        kept.push({ path: wt, reason });
+        continue;
+      }
+      if (gitOut(exec, ["-C", wt, "status", "--porcelain"]).trim()) {
+        kept.push({ path: wt, reason: `KEPT: ${proj.name}/${seat.name} has uncommitted changes` });
+        continue;
+      }
+      const size = dirSize(fs, wt, d);
+      if (size.maxMtime > now - WORKTREE_IDLE_MAX) {
+        kept.push({ path: wt, reason: `KEPT: ${proj.name}/${seat.name} was touched within ${WORKTREE_IDLE_MAX / DAY} days` });
+        continue;
+      }
+      plan.push({ type: "seat-worktree", path: wt, project: proj.name, seat: seat.name, bytes: size.bytes });
+    }
+  }
+  plan.sort((a, b) => b.bytes - a.bytes);
+  return { root, plan, kept };
+}
+
+// #12269: build output parked INSIDE a seat's scratch dirs — DerivedData, target/, *.xcresult —
+// idle past the build-output window is deletable even when it is not a top-level scratch entry
+// (that case the 2-day scratch rule already owns). Top-level entries are never matched here, so
+// the two scans cannot plan the same path. First match wins per subtree; git-tracked paths stay.
+export function scanNestedBuildOutput(d) {
+  const { fs, exec, home, now } = d;
+  const root = worktreesRootFor(d);
+  const plan = [], kept = [];
+  const isOutputDir = (name) => BUILD_OUTPUT_NAMES.includes(name) || name.endsWith(BUILD_OUTPUT_SUFFIX);
+  let projects;
+  try { projects = fs.readdirSync(root, { withFileTypes: true }).filter((e) => e.isDirectory()); }
+  catch { return { plan, kept }; }
+  for (const proj of projects) {
+    let seatDirs;
+    try { seatDirs = fs.readdirSync(join(root, proj.name), { withFileTypes: true }).filter((e) => e.isDirectory()); }
+    catch { continue; }
+    for (const seat of seatDirs) {
+      const wt = join(root, proj.name, seat.name);
+      const reason = seatRetentionReason(d, proj.name, seat.name, wt);
+      if (reason) { kept.push({ path: wt, reason }); continue; }
+      for (const scratch of SCRATCH_DIRS) {
+        const dir = join(wt, scratch);
+        const stack = [];
+        try {
+          for (const top of fs.readdirSync(dir, { withFileTypes: true })) {
+            if (!top.isDirectory()) continue;
+            let entries;
+            try { entries = fs.readdirSync(join(dir, top.name), { withFileTypes: true }); } catch { continue; }
+            for (const e of entries) if (e.isDirectory()) stack.push(join(dir, top.name, e.name));
+          }
+        } catch { continue; }
+        let seen = 0;
+        while (stack.length) {
+          if (seen++ > d.entryBudget) break;
+          const p = stack.pop();
+          if (!isOutputDir(basename(p))) {
+            let entries;
+            try { entries = fs.readdirSync(p, { withFileTypes: true }); } catch { continue; }
+            for (const e of entries) if (e.isDirectory()) stack.push(join(p, e.name));
+            continue;
+          }
+          let st;
+          try { st = fs.statSync(p); } catch { continue; }
+          if (!st.isDirectory()) continue;
+          const rel = relative(wt, p);
+          if (gitTracked(exec, wt, rel)) { kept.push({ path: p, reason: `KEPT: ${rel} is git-tracked in ${proj.name}/${seat.name}` }); continue; }
+          const stat = dirSize(fs, p, d);
+          if (stat.maxMtime > now - BUILD_OUTPUT_IDLE_MAX) {
+            kept.push({ path: p, reason: `KEPT: ${rel} was touched within ${BUILD_OUTPUT_IDLE_MAX / DAY} days` });
+            continue;
+          }
+          plan.push({ type: "build-output", path: p, worktree: wt, project: proj.name, seat: seat.name, bytes: stat.bytes });
+        }
+      }
+    }
+  }
+  plan.sort((a, b) => b.bytes - a.bytes);
+  return { plan, kept };
+}
+
 export function scanOpencodeSessions(d) {
   const { exec, now } = d;
   const live = liveCommandLines(exec);
@@ -345,6 +455,8 @@ export function buildDiskReport(d) {
   const { fs, home, now } = dep;
   const space = freeSpace(fs, "/");
   const seats = scanSeatWorktrees({ ...dep, entryBudget: dep.entryBudget });
+  const stale = scanStaleWorktrees({ ...dep, entryBudget: dep.entryBudget });
+  const nested = scanNestedBuildOutput({ ...dep, entryBudget: dep.entryBudget });
   const sessions = scanOpencodeSessions(dep);
   const sims = scanSimulators(dep);
   const dbPath = join(home, ".local", "share", "opencode", "opencode.db");
@@ -360,16 +472,17 @@ export function buildDiskReport(d) {
     hf: reportHfCache(dep),
     claudeWorktrees: reportClaudeWorktrees(dep),
     bigFiles: collectBigFiles(dep),
-    plan: [...sims.plan, ...seats.plan, ...sessions.plan],
-    kept: [...seats.kept, ...sessions.kept],
+    plan: [...sims.plan, ...seats.plan, ...stale.plan, ...nested.plan, ...sessions.plan],
+    kept: [...seats.kept, ...stale.kept, ...nested.kept, ...sessions.kept],
   };
   return report;
 }
 
-// Bytes the safe tier's ON-DISK items (build dirs, scratch entries) would free —
-// the summary line's number. simctl/opencode items free space inside their own stores.
+// Bytes the safe tier's ON-DISK items (build dirs, scratch entries, whole worktrees, nested
+// build output) would free — the summary line's number. simctl/opencode items free space
+// inside their own stores.
 export function freedOnDiskBytes(plan) {
-  return (plan || []).filter((p) => p.type === "build-dir" || p.type === "scratch-entry").reduce((n, p) => n + (p.bytes || 0), 0);
+  return (plan || []).filter((p) => ["build-dir", "scratch-entry", "seat-worktree", "build-output"].includes(p.type)).reduce((n, p) => n + (p.bytes || 0), 0);
 }
 
 function fileSize(fs, p) {
@@ -408,25 +521,44 @@ export function formatHuman(r) {
   return `${L.join("\n")}\n`;
 }
 
-// Execute the safe tier. simctl/opencode run as their own CLIs (injected in tests);
-// build dirs are removed by the injected `remove` (default fs.rmSync) only after
-// assertUnderHome AND an is-under-worktrees-root re-check on the exact path.
+// Execute the safe tier. Every planned item is PRINTED before it is acted on (#12269), so the
+// log is a receipt, not a mystery. simctl/opencode run as their own CLIs (injected in tests);
+// on-disk items are removed by the injected `remove` (default fs.rmSync) or `git worktree
+// remove`, only after assertUnderHome AND an is-under-worktrees-root re-check on the exact path.
 export async function runClean(r, d) {
   const dep = defaults(d);
-  const { exec, home } = dep;
+  const { exec, home, log } = dep;
   const remove = dep.remove || ((p, opts) => dep.fs.rmSync(p, opts));
+  const root = worktreesRootFor(dep);
   const results = [];
   for (const item of r.plan) {
+    const label = item.path || (item.type === "opencode-session" ? `session ${item.id}` : item.type === "simulators" ? "unavailable simulators" : item.type);
+    log(`janitor: removing ${item.type} ${label}${item.bytes ? ` (~${fmtBytes(item.bytes)})` : ""}`);
     try {
+      if (item.path) {
+        const p = assertUnderHome(item.path, home);
+        if (!isUnder(p, root)) throw new Error(`refused: ${p} is not under the seat worktrees root`);
+        const [project, seat] = relative(root, p).split(sep);
+        if (!project || !seat) throw new Error("refused: path does not identify a seat worktree");
+        const reason = seatRetentionReason(dep, project, seat, join(root, project, seat));
+        if (reason) throw new Error(reason);
+      }
       if (item.type === "simulators") {
         exec("xcrun", ["simctl", "delete", "unavailable"]);
         results.push({ type: item.type, ok: true });
       } else if (item.type === "opencode-session") {
         exec("opencode", ["session", "delete", item.id]);
         results.push({ type: item.type, id: item.id, ok: true });
-      } else if (item.type === "build-dir" || item.type === "scratch-entry") {
+      } else if (item.type === "seat-worktree") {
+        const p = assertUnderHome(item.path, home);
+        if (!isUnder(p, root)) throw new Error(`refused: ${p} is not under the seat worktrees root`);
+        if (gitOut(exec, ["-C", p, "status", "--porcelain"]).trim()) throw new Error("worktree has uncommitted changes");
+        const g = exec("git", ["-C", p, "worktree", "remove", p]);
+        if (g.status !== 0) throw new Error(String(g.stderr || "git worktree remove failed").trim().split("\n")[0] || "git worktree remove failed");
+        results.push({ type: item.type, path: p, bytes: item.bytes || 0, ok: true });
+      } else if (item.type === "build-dir" || item.type === "build-output" || item.type === "scratch-entry") {
         const p = assertUnderHome(item.path, home);
-        if (!isUnder(p, join(home, ".agent-bus", "worktrees"))) throw new Error(`refused: ${p} is not under the seat worktrees root`);
+        if (!isUnder(p, root)) throw new Error(`refused: ${p} is not under the seat worktrees root`);
         remove(p, { recursive: true, force: true });
         results.push({ type: item.type, path: p, bytes: item.bytes || 0, ok: true });
       }
@@ -438,6 +570,7 @@ export async function runClean(r, d) {
 }
 
 export function launchdPlist({ nodePath, scriptPath, logPath }) {
+  // #12269: daily at 09:00 — the weekly cadence lost the race against 100 GB/week of seat junk.
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -447,11 +580,10 @@ export function launchdPlist({ nodePath, scriptPath, logPath }) {
   <array>
     <string>${nodePath}</string>
     <string>${scriptPath}</string>
-    <string>--weekly</string>
+    <string>--daily</string>
   </array>
   <key>StartCalendarInterval</key>
   <dict>
-    <key>Weekday</key><integer>1</integer>
     <key>Hour</key><integer>9</integer>
     <key>Minute</key><integer>0</integer>
   </dict>
@@ -464,7 +596,8 @@ export function launchdPlist({ nodePath, scriptPath, logPath }) {
 
 export async function runDisk(d = {}) {
   const dep = defaults(d);
-  const clean = d.args?.includes("--clean");
+  // --dry-run always wins: report only, never clean — whichever flag asked for cleaning.
+  const clean = d.args?.includes("--clean") && !d.args?.includes("--dry-run");
   const json = d.args?.includes("--json");
   const report = buildDiskReport(dep);
   const results = clean ? await runClean(report, dep) : [];

package/lib/identity.mjs

@@ -5,6 +5,7 @@ import { readFileSync, writeFileSync, existsSync, mkdirSync, renameSync, chmodSy
 import { spawnSync } from "node:child_process";
 import { join } from "node:path";
 import { homedir } from "node:os";
+import { isIP } from "node:net";
 import { isTestIdentity } from "./test-identity-names.mjs";
 import { asFunction, asString } from "./decode.mjs";
 
@@ -207,6 +208,71 @@ export function publicView(identity) {
   return { name: identity.name, kind: identity.kind, pubkey: identity.pubkey, createdAt: identity.createdAt };
 }
 
+function loopbackHost(host) {
+  return ["localhost", "localhost.", "[::1]"].includes(host) || (isIP(host) === 4 && host.startsWith("127."));
+}
+
+export function loopbackHub(base) {
+  const url = new URL(base);
+  if (!/^https?:$/.test(url.protocol) || url.username || url.password || url.search || url.hash || url.pathname !== "/") return false;
+  return loopbackHost(url.hostname);
+}
+
+export function phoneHubAddress(base, publicUrl = "", forceTailnet = false) {
+  const hub = String(!forceTailnet && publicUrl || base).trim().replace(/\/+$/, "");
+  const url = new URL(hub);
+  if (!/^https?:$/.test(url.protocol) || loopbackHost(url.hostname) || ["0.0.0.0", "[::]"].includes(url.hostname)) {
+    throw new Error(`Your phone cannot reach ${hub}: this address only works on this Mac. Use Tailscale on the Mac and iPhone and configure the hub with the Mac's Tailscale address (then use trantor pair --tailnet), or configure a public hub URL.`);
+  }
+  return { hub, public: !forceTailnet && !!publicUrl };
+}
+
+// The hub's owner-only read verifies a candidate without minting an invite or changing scopes.
+export async function resolveOwnerIdentity(base) {
+  let config = {};
+  try { config = JSON.parse(readFileSync(join(busDir(), "config.json"), "utf8")); } catch {}
+  const explicit = process.env.TRANTOR_IDENTITY || process.env.RELAY_OWNER_IDENTITY || config.ownerIdentity;
+  const names = explicit ? [explicit] : listKeyNames().flatMap(file => {
+    try {
+      const record = JSON.parse(readFileSync(join(keysDir(), `${file}.json`), "utf8"));
+      return record.kind === "human" && record.name ? [record.name] : [];
+    } catch { return []; }
+  });
+  const request = async (id, path, payload) => {
+    const method = payload ? "POST" : "GET";
+    const body = payload ? JSON.stringify(payload) : undefined;
+    return fetch(`${base.replace(/\/+$/, "")}${path}`, {
+      method, body, redirect: "error", headers: { "content-type": "application/json", ...signRequest(id, { method, path, body }) },
+      signal: AbortSignal.timeout(8000),
+    });
+  };
+  let unavailable = "";
+  for (const name of names) {
+    const id = load(name);
+    if (!id) {
+      unavailable = `The key for "${name}" is unavailable on this Mac. Unlock the identity Keychain or restore this identity's key.`;
+      continue;
+    }
+    const response = await request(id, "/keys/usage");
+    if (response.ok) return id;
+    if (response.status === 401 && loopbackHub(base)) {
+      const error = await response.json();
+      if (error.error === "unknown identity") {
+        const enrolled = await request(id, "/enroll", { name: id.name, kind: "human" });
+        if (enrolled.ok && (await request(id, "/keys/usage")).ok) return id;
+      }
+    }
+  }
+  if (!names.length && loopbackHub(base)) {
+    const id = loadOrCreate("human", "human");
+    if (!id) throw new Error("The local human identity exists, but its key is unavailable. Unlock the identity Keychain or restore its key.");
+    const enrolled = await request(id, "/enroll", { name: id.name, kind: "human" });
+    if (enrolled.ok && (await request(id, "/keys/usage")).ok) return id;
+    throw new Error("The local hub refused owner enrollment. Ask its owner for an invite or configure the existing owner identity.");
+  }
+  throw new Error(unavailable || `No local owner identity is authorized on ${base}. Enroll this Mac with an owner invite, or select its existing owner key with TRANTOR_IDENTITY.`);
+}
+
 // --- migrate + status (`trantor keys …`) ---------------------------------------------------------
 // One <safe-name>.json per durable identity; the instances/ subdir holds per-session subkeys that
 // die with the session and stay files by design.

package/lib/seat-worktree.mjs

@@ -66,10 +66,24 @@ export function ensureSeatWorktree({ sourceDir, project, agent, home = homedir()
     }
   }
 
-  const r = spawnSync("git", ["-C", root, "worktree", "add", "--no-track", "-B", branch, seatDir, "HEAD"], {
+  // #12269: a branch that already exists is the seat's history — down removed the worktree, not
+  // the branch. Reset it to HEAD only when it holds nothing HEAD lacks (fully harvested); else
+  // re-create at the branch tip so a re-upped seat name reuses the freed worktree with its commits.
+  const branchTip = gitOut(["-C", root, "rev-parse", "--verify", "--quiet", `refs/heads/${branch}`], root);
+  const add = ["worktree", "add"];
+  let reuseBranch = false;
+  if (branchTip) {
+    const merged = spawnSync("git", ["-C", root, "merge-base", "--is-ancestor", branch, "HEAD"], { stdio: "ignore", timeout: 8000 }).status === 0;
+    if (merged) add.push("--no-track", "-B", branch, seatDir, "HEAD");
+    else { add.push(seatDir, branch); reuseBranch = true; }
+  } else {
+    add.push("--no-track", "-B", branch, seatDir, "HEAD");
+  }
+  const r = spawnSync("git", ["-C", root, ...add], {
     encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 30000,
   });
   if (r.status === 0) {
+    if (reuseBranch) log(`\x1b[2m[runner]\x1b[0m ${branch} re-created at its own tip (${branchTip.slice(0, 7)}) — unintegrated commits kept`);
     // branch.<b>.base names the real base for the Review lens; push.autoSetupRemote makes the
     // first plain push set its upstream (#5403).
     if (base) spawnSync("git", ["-C", seatDir, "config", `branch.${branch}.base`, base], { stdio: "ignore", timeout: 5000 });
@@ -77,10 +91,33 @@ export function ensureSeatWorktree({ sourceDir, project, agent, home = homedir()
     if (!pushAuto) spawnSync("git", ["-C", seatDir, "config", "push.autoSetupRemote", "true"], { stdio: "ignore", timeout: 5000 });
     return { dir: seatDir, created: true, root, dirty: false };
   }
+  if (reuseBranch) {
+    const reason = String(r.stderr || "").trim().split("\n")[0] || "git worktree add failed";
+    log(`\x1b[33m[runner]\x1b[0m ${branch} holds unintegrated commits and could not be re-created (${reason}) — using ${sourceDir} rather than resetting the branch`);
+    return { dir: sourceDir, created: false };
+  }
   log(`\x1b[33m[runner]\x1b[0m could not create ${branch} worktree — using ${sourceDir}`);
   return { dir: sourceDir, created: false };
 }
 
+// #12269: down/retire removes a stopped seat's worktree. The branch always stays; a tree with
+// uncommitted changes is kept and named — git's own refusal is the race-free dirty check.
+export function removeSeatWorktree({ project, agent, home = homedir(), env = process.env, dry = false }) {
+  const path = seatWorktreeDir(project, agent, home);
+  if (!existsSync(path)) return { status: "absent", path };
+  if (env?.CREW_NO_PROC_KILL === "1") return { status: "kept", path, reason: "CREW_NO_PROC_KILL=1 (process kill and removals guarded)" };
+  if (dry) return { status: "would-remove", path };
+  const r = spawnSync("git", ["-C", path, "worktree", "remove", path], {
+    encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 60000,
+  });
+  if (r.status === 0) return { status: "removed", path };
+  const dirty = spawnSync("git", ["-C", path, "status", "--porcelain"], {
+    encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 30000,
+  }).stdout || "";
+  if (dirty.trim()) return { status: "kept", path, reason: "uncommitted changes" };
+  return { status: "kept", path, reason: String(r.stderr || "git worktree remove failed").trim().split("\n")[0] };
+}
+
 // The declaration: { link: [<relative sibling path>], provision: [{ path, mode, template? }],
 // preflight: "<shell command>" }. null when the project declares nothing (unchanged behaviour).
 export function readWorktreeDeclaration(root) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.117",
+  "version": "0.18.119",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"