trantor 0.18.18 → 0.18.20

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.18",
+  "version": "0.18.20",
   "description": "Trantor \u2014 the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/README.md

@@ -230,6 +230,14 @@ project's workspace, so when you run several sessions each driving its own crew,
 can't nuke another's. `trantor down <agent>` drops a single seat; `trantor down --all --yes` tears down
 every project's crew.
 
+Since 0.18.20, **seat trouble wakes the foreman instead of hoping someone looks**: a failing or
+dead seat direct-messages the project's orchestrator (broadcasts wake nobody), a detached
+watchdog reports a turn running silent past 15 minutes — once, without killing it — and the
+failure classifier tells a provider backend error ("retry or swap") from real quota exhaustion
+("wait the window out"). The duty seat itself now runs under a launchd keepalive, so the fleet's
+janitor relaunches after a crash or reboot instead of dying silently, and the hub routes
+escalations back to their senders whenever the janitor goes dark.
+
 **One-time setup:**
 - Install cmux — `brew install --cask cmux` (or grab it from **[cmux.com](https://cmux.com)**).
 - Trantor drives cmux over its control socket, which is off to outside processes by default. Enable it in
@@ -370,6 +378,7 @@ rate, not work rate.
 | `relay_project_brief(text)` | The project's what/why on the dashboard |
 | `relay_task_add(title, …, difficulty, model, deps, note?, project?)` | Cards with difficulty/model badges + DAG edges; `note` seeds the card's **permanent log**; `project` targets another board when you orchestrate from elsewhere |
 | `relay_task_move(id, status, note?)` | `todo → doing → testing → done` (the gate), `failed`, `blocked` — moves to testing/done should carry a `note`: what you did + the evidence, stored on the card forever |
+| `relay_task_check(id, index, done?)` | Tick one acceptance item on a card's checklist (seeded via `relay_task_add`'s `checklist`) — checked/total is the card's one honest progress denominator |
 | `relay_board` | The project's full board, as text |
 | `relay_scrooge(prompt, task?, difficulty?)` | Fractal cheap-model delegation, with the ledger receipt |
 | `relay_lesson(text, scope?)` | Record a failure lesson — auto-injected into all future crews |

package/bin/crew-runner.mjs

@@ -8,11 +8,11 @@
 // over plain HTTP (zero tokens, doubles as a heartbeat), and when a message addressed to this
 // agent arrives it RESUMES the CLI session (native resume = full context kept) with that
 // message as the prompt. The model just works and ends its turn; the runner does the rest.
-import { execSync, spawnSync } from "node:child_process";
+import { execSync, spawnSync, spawn } from "node:child_process";
 import { readFileSync, writeFileSync, unlinkSync, existsSync, appendFileSync, mkdirSync } from "node:fs";
 import { join, basename } from "node:path";
 import { homedir } from "node:os";
-import { resolveProject, resolveHub, withEnvFiles } from "../lib/project.mjs";
+import { resolveProject, resolveHub, withEnvFiles, hostId } from "../lib/project.mjs";
 import { loadOrCreate } from "../lib/identity.mjs";
 import { signedHeaders } from "../lib/signed-fetch.mjs";
 import { ensureEnrolled } from "../lib/enroll.mjs";
@@ -314,6 +314,11 @@ const AUTH_MARKER_RE = /unauthor|401|403|forbidden|invalid[ _-]?api[ _-]?key|aut
 function classifyFailure(exit, errText) {
   const t = (errText || "").toLowerCase();
   if (exit === 127) return "missing-cli";
+  // #5684: a provider BACKEND failure is not quota — it wants retry/swap, not a window wait.
+  // The specimen (#5683): codex's "unexpected status 404 Not Found … /responses/compact" was
+  // labelled "exhausted" and the operator was advised to wait out a window that did not exist.
+  // 401/403/429 deliberately fall through to the auth/exhausted branches below.
+  if (/unexpected status (404|408|410|5\d\d)|internal server error|bad gateway|service unavailable|gateway time.?out|econnrefused|connection refused|socket hang ?up|network is unreachable/.test(t)) return "backend-error";
   // "reached your … limit" / "usage limit" catch the subscription CLIs (Claude's "You've reached
   // your Fable 5 limit"), which say nothing about quota or credits and would otherwise read as a crash.
   if (/quota|insufficient|credit|balance|payment required|402|429|too many requests|rate.?limit|exceeded your|reached your [^.\n]*limit|usage limit|out of (credit|quota)/.test(t)) return "exhausted";
@@ -329,6 +334,7 @@ async function reportFailure(exit, trigger, undelivered = 0) {
   await api("/register", { session: SESSION, project: PROJ, status, llm: AGENT, model: MODEL }).catch(() => {});
   const hint = reason === "exhausted" ? " — needs `trantor swap`"
     : reason === "auth" ? " — check credentials"
+    : reason === "backend-error" ? " — provider backend error (NOT quota): retry, or `trantor swap` to another provider"
     : reason === "missing-cli" ? " — CLI not on PATH" : "";
   // The count of messages this seat is HOLDING is the operator-actionable half of a failure: a
   // crashed pulse costs nothing, a crashed turn sitting on three escalations is someone waiting.
@@ -343,6 +349,12 @@ async function reportFailure(exit, trigger, undelivered = 0) {
   if (state !== announced) {
     announced = state;
     await api("/send", { from: SESSION, to: "all", text, project: PROJ }).catch(() => {});
+    // #5684: a broadcast does not wake anyone — the incident is the operator spotting dead seats
+    // before the foreman did, twice in one morning. The same state-change event now goes DIRECT
+    // to the project's orchestrator (direct = wake), gated identically so a standing outage says
+    // it once. A seat that IS the orchestrator's own runner has nobody above it to wake.
+    const orch = `${hostId()}:${PROJ}`;
+    if (orch !== SESSION) await api("/send", { from: SESSION, to: orch, text, project: PROJ }).catch(() => {});
   } else {
     log(`still ${state} (${consecFails} fails) — already announced, staying quiet`);
   }
@@ -420,6 +432,17 @@ function runTurn(prompt, isFirst, trigger = "kickoff") {
   // `tee /dev/stderr`; the rest now tee straight into ERRF. A real pipeline (not a process
   // substitution) so bash waits for tee to flush before we read the file back.
   const inner = cli.sid ? `${cmd} | tee /dev/stderr` : `${cmd} | tee -a ${ERRF}`;
+  // #5684: runTurn is spawnSync, so the runner cannot watch its own turn — a DETACHED watchdog
+  // does. Armed by a stamp file, disarmed when the turn ends (stamp removed below); a turn past
+  // the window with no ERRF growth earns ONE direct stall report to the foreman, never a kill.
+  const WD_MS = Number(process.env.TRANTOR_TURN_WATCHDOG_MS || 15 * 60 * 1000);
+  const STAMPF = join(homedir(), ".agent-bus", `turnstamp-${AGENT}-${PROJ}.json`);
+  try {
+    writeFileSync(STAMPF, JSON.stringify({ turn: TURN, startedAt: Date.now() }));
+    const wd = spawn(process.execPath, [join(import.meta.dirname, "turn-watchdog.mjs"), STAMPF, ERRF, String(WD_MS), SESSION, PROJ, HUB],
+      { detached: true, stdio: "ignore" });
+    wd.unref();
+  } catch {}
   const r = spawnSync("/bin/bash", ["-c", `set -o pipefail; { ${inner} ; } 2> >(tee -a ${ERRF} >&2)`], {
     cwd: TURN_DIR, encoding: "utf8", stdio: cli.sid ? ["ignore", "pipe", "inherit"] : "inherit",
     env: { ...process.env, RELAY_URL: HUB, RELAY_AGENT: AGENT, RELAY_PROJECT: PROJ,
@@ -436,6 +459,7 @@ function runTurn(prompt, isFirst, trigger = "kickoff") {
       TRANTOR_NO_HANDOFF_SPAWN: "1", TRANTOR_NO_BATON_SPAWN: "1" },
     maxBuffer: 16 * 1024 * 1024,
   });
+  try { unlinkSync(STAMPF); } catch {}   // turn over — disarm the watchdog
   try { lastErrText = readFileSync(ERRF, "utf8").slice(-4000); } catch { lastErrText = ""; }
   if (cli.sid && r.stdout) { const m = r.stdout.match(cli.sid); if (m) sid = m[1]; }
   const realExit = r.status;

package/bin/doctor.mjs

@@ -10,6 +10,7 @@ import { execSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { resolveProject, resolveHub, DEFAULT_HUB_URL } from "../lib/project.mjs";
 import { loadOrCreate } from "../lib/identity.mjs";
+import { sfetchJson } from "../lib/signed-fetch.mjs";
 import { scan } from "../lib/splitbrain.mjs";
 
 const H = homedir();
@@ -87,6 +88,55 @@ section("hub routing");
   }
 }
 
+// ── duty seat: is the fleet's watcher actually alive? ────────────────────────────────────────
+// The duty seat sat dead for four days (2026-08-27→31) while everything else reported green.
+// A dead watcher raises no error of its own — it just stops producing nudges — so this row makes
+// that state loud: process, keepalive, hub registration and the freshness of the seat's last hub
+// beat, each with its fix.
+section("duty seat (the fleet watcher)");
+{
+  const BUSD = join(H, ".agent-bus");
+  const DUTY_PLIST = join(H, "Library", "LaunchAgents", "com.trantor.duty.plist");
+  const FIX_UP = "trantor duty up   (installs the launchd keepalive com.trantor.duty, which relaunches the seat after a crash or reboot)";
+  let pid = 0;
+  try { pid = Number(readFileSync(join(BUSD, "duty.pid"), "utf8")) || 0; if (pid) process.kill(pid, 0); else pid = 0; } catch { pid = 0; }
+  const keepalive = existsSync(DUTY_PLIST);
+  // The seat watches the FLEET hub — the most common project hub in config, the exact pick
+  // bin/duty.mjs makes — not necessarily THIS project's hub.
+  const counts = new Map();
+  for (const u of Object.values(cfg.hubs || {})) counts.set(u, (counts.get(u) || 0) + 1);
+  const fleet = [...counts.entries()].sort((a, b) => b[1] - a[1])[0]?.[0] || cfg.url || "";
+  const signed = cfg.ownerIdentity ? (() => { try { return loadOrCreate(cfg.ownerIdentity, "human"); } catch { return null; } })() : null;
+  const hubGet = (path) => sfetchJson(`${fleet}${path}`, { method: "GET", identity: signed, signal: AbortSignal.timeout(4000) })
+    .then((r) => (r?.ok ? r.json() : null)).catch(() => null);
+  if (!fleet) {
+    note("duty seat: no hub pinned — cannot check the fleet feed");
+  } else {
+    const st = await hubGet("/overseer/status");
+    const peers = await hubGet("/peers");
+    const dutySession = st?.dutySession || "";
+    const beat = dutySession ? (peers?.sessions || []).find((p) => p.session === dutySession)?.lastSeen || 0 : 0;
+    const ageMin = beat ? Math.floor((Date.now() - beat) / 60000) : null;
+    const age = ageMin == null ? "no beat yet" : ageMin < 1 ? "beat just now" : ageMin < 60 ? `last beat ${ageMin}m ago` : `last beat ${Math.floor(ageMin / 60)}h ago`;
+    if (!st || !peers) {
+      // The core section already flags a dead hub; here we only refuse to guess.
+      note(`duty seat: hub feed UNKNOWN — ${fleet} did not answer the duty read${cfg.ownerIdentity ? "" : " (no owner identity to sign with)"}`);
+      pid ? ok(`duty seat: process running (pid ${pid})`) : warn("duty seat: not running and its hub feed cannot be checked", FIX_UP);
+    } else if (pid && dutySession && ageMin != null && ageMin > 5) {
+      warn(`duty seat: process up (pid ${pid}) but the hub heard nothing for ${Math.floor(ageMin / 60) >= 1 ? Math.floor(ageMin / 60) + "h " : ""}${ageMin % 60}m — it is running deaf`, "trantor duty down && trantor duty up");
+    } else if (pid) {
+      ok(`duty seat: running (pid ${pid}${dutySession ? `, ${dutySession} on the fleet hub` : ""}, ${age})`);
+      if (process.platform === "darwin" && !keepalive) warn("duty seat: running WITHOUT a keepalive — a crash or reboot leaves it down", FIX_UP);
+    } else if (dutySession) {
+      warn(`duty seat: the hub still points at ${dutySession} but no seat process is running — escalations go into a hole`, FIX_UP);
+    } else if (keepalive) {
+      warn("duty seat: keepalive installed but the seat is down — launchd should have relaunched it", `launchctl list | grep com.trantor.duty   then: trantor duty down && trantor duty up`);
+    } else {
+      warn("duty seat: none — nobody is watching the fleet (undelivered mail and dead seats go unnudged)", FIX_UP);
+    }
+  }
+}
+
 // claude plugin
 section("claude (the orchestrator)");
 if (!has("claude")) warn("claude CLI not found", "install Claude Code: https://claude.com/claude-code");

package/bin/duty.mjs

@@ -6,14 +6,20 @@
 //   trantor duty down                                  stop
 //   trantor duty status                                pid + last turns + presence
 //
+// Keepalive (the 4-day silent death, 2026-08-27→31): by default the seat runs HEADLESS under a
+// launchd service (label com.trantor.duty, KeepAlive=true) — launchd relaunches it after a crash
+// and at every login, so the watcher stops being one bad afternoon away from silently gone.
+// `--window` opts into the visible cmux/Terminal surface instead; a window CANNOT be kept alive
+// by launchd, so that mode says plainly that nothing will bring it back.
+//
 // Division of labor (the overseer doctrine, extended): DETECTION stays mechanical and hub-side —
 // RELAY_DUTY_SESSION makes the hub DM this seat when a direct message sits undelivered past
 // RELAY_DUTY_UNDELIVERED_MS or the overseer emits a warning. The SEAT only triages: relay, wake,
 // annotate, and only involves the human when a real decision is needed. It runs under the same
 // crew-runner that keeps crew seats alive (long-poll wake, turn telemetry, failure reporting) —
 // just with a triage doctrine instead of "work your card" (RUNNER_RULES / CREW_KICKOFF).
-import { spawn, execSync } from "node:child_process";
-import { readFileSync, writeFileSync, existsSync, mkdirSync, openSync, rmSync } from "node:fs";
+import { spawn, execSync, execFileSync } from "node:child_process";
+import { readFileSync, writeFileSync, existsSync, mkdirSync, openSync, rmSync, unlinkSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
@@ -25,6 +31,9 @@ const BUS = process.env.AGENT_BUS_DIR || join(homedir(), ".agent-bus");
 const DIR = join(BUS, "trantor-duty");           // the seat's cwd, and therefore its bus id
 const PIDF = join(BUS, "duty.pid");
 const LOGF = join(BUS, "duty.log");
+const LAUNCHER = join(BUS, "duty-launch.sh");
+const DUTY_LABEL = "com.trantor.duty";
+const DUTY_PLIST = join(homedir(), "Library", "LaunchAgents", `${DUTY_LABEL}.plist`);
 
 const argv = process.argv.slice(2);
 const cmd = argv[0] || "status";
@@ -46,8 +55,12 @@ function fleetHub() {
 // a patrol script, send a templated nudge, post 280 chars. Nobody chose that; it was inherited.
 // Precedence: --model flag > CREW_MODEL env > sonnet. `--model inherit` restores the old behaviour.
 const DUTY_MODEL = val("model", "") || process.env.CREW_MODEL || "sonnet";
-// Visible by default; --headless keeps the old background behaviour for launchd and CI.
-const WINDOW = !argv.includes("--headless") && process.platform === "darwin";
+// Headless is the DEFAULT now, and it rides the launchd keepalive. The old default — a visible
+// window, headless only as a silent fallback — is exactly how the seat died quietly on
+// 2026-08-27: the osascript window-open failed, the fallback printed one line into a log nobody
+// reads, and the fleet had no watcher for four days. Headless+keepalive is the honest default;
+// `--window` is the explicit choice of a surface launchd cannot keep alive.
+const WINDOW = argv.includes("--window") && process.platform === "darwin";
 const AGENT = val("agent", "claude");
 // Named, not inherited. It used to be "claude:fleet" purely because the seat's directory was
 // called fleet and identity is derived from directory basename — the same identity-by-position
@@ -134,6 +147,71 @@ function cmuxBinary() {
   return "";
 }
 
+// launchd, invoked by NAME so a drill can stub it on PATH (seats.mjs hardcodes /bin/launchctl,
+// which is why its install has no drill). Every call swallows its error: on a machine without
+// launchd the keepalive path is simply unavailable and the caller says so.
+const bootoutDuty = () => { try { execFileSync("launchctl", ["bootout", `gui/${process.getuid()}/${DUTY_LABEL}`], { stdio: "ignore", timeout: 8000 }); return true; } catch { return false; } };
+const bootstrapDuty = () => { try { execFileSync("launchctl", ["bootstrap", `gui/${process.getuid()}`, DUTY_PLIST], { stdio: "ignore", timeout: 8000 }); return true; } catch { return false; } };
+const dutyLoaded = () => { try { return execFileSync("launchctl", ["list"], { encoding: "utf8", timeout: 8000 }).split("\n").some((l) => l.includes(DUTY_LABEL)); } catch { return false; } };
+
+// Same service shape as the hub (deploy/com.trantor.hub.plist): the long-running process is the
+// job, RunAtLoad + KeepAlive bring it back after a crash and at every login. One deliberate
+// addition, ThrottleInterval=30: a seat that exits because the hub is down must not hot-loop —
+// a KeepAlive job retrying every 10s forever is how this machine hit load 490 on 2026-08-21.
+function keepalivePlistBody() {
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!-- trantor duty seat as an always-on launchd service. \`trantor duty up\` rewrites this;
+     \`trantor duty down\` removes it. -->
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>${DUTY_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array><string>/bin/bash</string><string>${LAUNCHER}</string></array>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key><true/>
+  <key>ThrottleInterval</key><integer>30</integer>
+  <key>StandardOutPath</key><string>${LOGF}</string>
+  <key>StandardErrorPath</key><string>${LOGF}</string>
+</dict>
+</plist>
+`;
+}
+
+// The rules are ~4KB of prose with backticks, quotes and $ in them, so they cannot ride a
+// command line or an AppleScript string. A launcher script carries them instead. The values ride
+// SINGLE QUOTES (apostrophes escaped as '"'"'): backticks, $( ), parens and newlines are then all
+// literal. The previous form — $(cat <<'EOF' … EOF) — silently broke under macOS bash 3.2 the
+// moment a value contained a backtick (the rules do): the export failed, the seat started without
+// its kickoff text, and the only symptom was a syntax-error line in a log nobody reads.
+function writeLauncher(env) {
+  const shquote = (v) => `'${String(v).replace(/'/g, `'\\''`)}'`;
+  const exports = Object.entries(env).map(([k, v]) => `export ${k}=${shquote(v)}`).join("\n");
+  writeFileSync(LAUNCHER, `#!/bin/bash\n# written by \`trantor duty up\` — safe to delete when the seat is down\n${exports}\nexec ${JSON.stringify(process.execPath)} ${JSON.stringify(join(ROOT, "bin", "crew-runner.mjs"))} ${AGENT} ${JSON.stringify(DIR)}\n`, { mode: 0o700 });
+}
+
+// The old headless start: a detached child of whoever ran `up`. No keepalive — it dies with a
+// reboot and nothing brings it back. Kept for non-darwin and as the loud last fallback.
+function startDetached(env) {
+  const out = openSync(LOGF, "a");
+  const child = spawn(process.execPath, [join(ROOT, "bin", "crew-runner.mjs"), AGENT, DIR], {
+    detached: true, stdio: ["ignore", out, out], env: { ...process.env, ...env },
+  });
+  child.unref();
+  return child.pid;
+}
+
+// Find the runner's pid once a surface (window or launchd) should have started it, and park it
+// in the pidfile `down`/`status` read. Terminal/launchd take a moment, so poll briefly.
+function pollRunnerPid(max = 25) {
+  let pid = 0;
+  for (let i = 0; i < max && !pid; i++) {
+    try { pid = Number(execSync(`pgrep -f "crew-runner.mjs ${AGENT} ${DIR}" | head -1`, { encoding: "utf8" }).trim()) || 0; } catch {}
+    if (!pid) execSync("sleep 0.2");
+  }
+  return pid;
+}
+
 /** Close every workspace this seat owns. No-op when cmux is absent or its socket is off. */
 function closeDutyWorkspace() {
   const bin = cmuxBinary();
@@ -166,77 +244,94 @@ if (cmd === "up") {
   if (!(await ensureFleetIdentity(hub))) process.exit(1);
   const env = (() => {
     const e = { RELAY_URL: hub, RUNNER_RULES: RULES, CREW_KICKOFF: KICKOFF,
-                RUNNER_TITLE: "Trantor Duty Agent", RUNNER_ABOUT: ABOUT };
+                RUNNER_TITLE: "Trantor Duty Agent", RUNNER_ABOUT: ABOUT,
+                // launchd starts jobs with a MINIMAL Path — the resurrected seat could not find
+                // `claude` and every turn died exit 127 "missing-cli" (found live 2026-08-31,
+                // duty's own triage caught it). Bake the operator's PATH from `up` time into the
+                // launcher, exactly like every other value it carries.
+                PATH: process.env.PATH || "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin" };
     if (DUTY_MODEL !== "inherit") e.CREW_MODEL = DUTY_MODEL;
     return e;
   })();
 
+  writeLauncher(env);
+
   let pid = 0;
+  let how = "";
+
   if (WINDOW) {
-    // A WINDOW, by default. Headless was the old behaviour and it hid the thing: an always-on agent
-    // nobody can see is exactly what unsettles a person who finds the process, and the seat's own
-    // introduction (RUNNER_ABOUT) is worthless printed into a log file nobody opens. Crew seats have
-    // always opened windows; the duty seat now does too.
-    //
-    // The rules are ~4KB of prose with backticks, quotes and $ in them, so they cannot ride a
-    // command line or an AppleScript string. A launcher script carries them instead: a quoted
-    // heredoc means the shell expands nothing, and osascript only ever sees the path.
-    const launcher = join(BUS, "duty-launch.sh");
-    const exports = Object.entries(env).map(([k, v]) =>
-      `export ${k}=$(cat <<'TRANTOR_${k}_EOF'\n${v}\nTRANTOR_${k}_EOF\n)`).join("\n");
-    writeFileSync(launcher, `#!/bin/bash\n# written by \`trantor duty up\` — safe to delete when the seat is down\n${exports}\nexec ${JSON.stringify(process.execPath)} ${JSON.stringify(join(ROOT, "bin", "crew-runner.mjs"))} ${AGENT} ${JSON.stringify(DIR)}\n`, { mode: 0o700 });
-    // PREFER CMUX. Terminal.app was the only surface here, and a plain window is stacking by
-    // construction: every `duty up` opens another one and nothing closes the last, so restarts
-    // accumulate windows that all look like live duty agents. cmux gives the seat ONE named
-    // workspace that gets REPLACED on each up — the same "replace, never stack" rule bin/crew.sh
-    // already applies to crew seats, which is why they never pile up and this did.
-    //
-    // Terminal remains the fallback: no cmux, or its control socket off, and nothing changes.
+    // --window: the visible surface. cmux first (ONE named workspace, replaced on each up — the
+    // same "replace, never stack" rule bin/crew.sh applies to crew seats), Terminal as fallback.
+    // A window cannot be kept alive by launchd, so `how` says plainly that nothing will bring
+    // the seat back if it dies.
     const cmuxBin = cmuxBinary();
-
-    let openedInCmux = false;
+    let opened = false;
     if (cmuxBin) {
       try {
         // Replace, never stack: take the previous duty workspace away before opening this one.
         // Closing first is safe here (unlike a crew pane swap) — the seat is a single surface with
         // nothing to preserve.
         closeDutyWorkspace();
-        execSync(`${cmuxBin} new-workspace --name ${JSON.stringify(CMUX_WS_NAME)} --cwd ${JSON.stringify(DIR)} --command ${JSON.stringify(`bash ${launcher}`)} --focus false`,
+        execSync(`${cmuxBin} new-workspace --name ${JSON.stringify(CMUX_WS_NAME)} --cwd ${JSON.stringify(DIR)} --command ${JSON.stringify(`bash ${LAUNCHER}`)} --focus false`,
           { stdio: "ignore", timeout: 8000, env: { ...process.env, CMUX_QUIET: "1" } });
-        openedInCmux = true;
+        opened = true;
       } catch (e) {
         console.error(`cmux launch failed (${e?.message || e}) — falling back to a Terminal window`);
       }
     }
-
-    if (!openedInCmux) {
-      const osa = `tell application "Terminal"\n  do script ${JSON.stringify(`bash ${launcher}`)}\n  activate\nend tell\n`;
-      try { execSync(`osascript -e ${JSON.stringify(osa)}`, { stdio: "ignore", timeout: 8000 }); }
-      catch (e) { console.error(`could not open a window (${e?.message || e}) — falling back to headless`); }
+    if (!opened) {
+      const osa = `tell application "Terminal"\n  do script ${JSON.stringify(`bash ${LAUNCHER}`)}\n  activate\nend tell\n`;
+      try { execSync(`osascript -e ${JSON.stringify(osa)}`, { stdio: "ignore", timeout: 8000 }); opened = true; }
+      catch (e) {
+        // The 2026-08-27 incident: this printed one quiet line, fell back headless, and the fleet
+        // had no watcher for four days. Now it is loud, and the keepalive path below takes over.
+        console.error(`  ⚠️  could not open a window (${e?.message || e}) — falling back to the headless launchd keepalive`);
+      }
     }
-    // The runner lives inside Terminal, so its pid is not ours to know: find it the same way `down`
-    // does. Poll briefly, since Terminal takes a moment to start the shell.
-    for (let i = 0; i < 25 && !pid; i++) {
-      try { pid = Number(execSync(`pgrep -f "crew-runner.mjs ${AGENT} ${DIR}" | head -1`, { encoding: "utf8" }).trim()) || 0; } catch {}
-      if (!pid) execSync("sleep 0.2");
+    if (opened) {
+      pid = pollRunnerPid();
+      writeFileSync(PIDF, String(pid));
+      how = "in a window (NO keepalive — if it dies or the Mac reboots, it stays down)";
     }
   }
-  if (!pid) {
-    const out = openSync(LOGF, "a");
-    const child = spawn(process.execPath, [join(ROOT, "bin", "crew-runner.mjs"), AGENT, DIR], {
-      detached: true, stdio: ["ignore", out, out], env: { ...process.env, ...env },
-    });
-    child.unref();
-    pid = child.pid;
+
+  if (!how) {
+    if (process.platform === "darwin") {
+      // The honest default: headless under launchd, so a crashed seat relaunches itself instead
+      // of dying silently (the seat sat dead 2026-08-27→31 before anyone noticed).
+      mkdirSync(dirname(DUTY_PLIST), { recursive: true });   // a fresh machine has no LaunchAgents dir yet
+      writeFileSync(DUTY_PLIST, keepalivePlistBody());
+      bootoutDuty();
+      if (bootstrapDuty()) {
+        pid = pollRunnerPid(15);
+        writeFileSync(PIDF, String(pid));
+        how = `headless under the launchd keepalive ${DUTY_LABEL} (relaunched after a crash or reboot)`;
+        if (!pid) console.error(`  ⚠️  keepalive installed but no runner seen after 3s — check: launchctl list | grep ${DUTY_LABEL}`);
+      } else {
+        console.error("  ⚠️  launchctl bootstrap failed — starting a plain headless seat with NO keepalive");
+        pid = startDetached(env);
+        writeFileSync(PIDF, String(pid));
+        how = "headless, NO keepalive (launchd refused the job)";
+      }
+    } else {
+      pid = startDetached(env);
+      writeFileSync(PIDF, String(pid));
+      how = `headless, NO keepalive (launchd is macOS-only; ${process.platform} gets a plain background seat)`;
+    }
   }
-  writeFileSync(PIDF, String(pid));
-  console.log(`— duty agent up: ${SESSION} (pid ${pid})${WINDOW ? " in a window" : " headless"} on ${DUTY_MODEL === "inherit" ? "the CLI default model" : DUTY_MODEL} watching ${hub} — log: ${LOGF}`);
+
+  console.log(`— duty agent up: ${SESSION} (pid ${pid}) ${how} on ${DUTY_MODEL === "inherit" ? "the CLI default model" : DUTY_MODEL} watching ${hub} — log: ${LOGF}`);
   const fed = await registerDutySeat(hub, SESSION);
   if (fed) console.log(`  hub feeds it: undelivered DMs (>${Math.round(Number(process.env.RELAY_DUTY_UNDELIVERED_MS || 600000) / 60000)}m) + overseer warnings.`);
   process.exit(0);   // the seat IS up; a hub that won't feed it is a warning, not a failed start
 }
 
 if (cmd === "down") {
+  const hadKeepalive = existsSync(DUTY_PLIST);
+  // Unload the keepalive FIRST (bootout kills the job's process), then remove the plist so a
+  // reboot cannot resurrect the seat behind a `down`. `up` rewrites both.
+  bootoutDuty();
+  if (hadKeepalive) { try { unlinkSync(DUTY_PLIST); } catch {} }
   const pid = alivePid();
   if (pid) { try { process.kill(pid); } catch {} console.log(`— duty seat stopped (pid ${pid}) —`); }
   else console.log("no duty seat running");
@@ -249,6 +344,18 @@ if (cmd === "down") {
   // Clear the hub's pointer too — escalations aimed at a seat that no longer exists are messages
   // sent into a hole, and the hub has no other way to learn the seat went away.
   await registerDutySeat(fleetHub(), "");
+  // GOING LOUD. A quiet `down` is how the seat sat dead for four days (2026-08-27→31) while every
+  // other surface reported green: nothing errors when the watcher is gone, it just stops watching.
+  // Anyone turning the watcher off must see, in that moment, exactly what they are leaving dark.
+  if (pid || hadKeepalive) {
+    console.log(`
+────────────────────────────────────────────────────────────
+  ⚠️  DUTY IS DOWN. Nobody is watching the fleet now.
+  Undelivered mail and dead seats will go unnudged — last time
+  that silence lasted four days (Aug 27→31) before anyone noticed.
+  Bring it back:  trantor duty up
+────────────────────────────────────────────────────────────`);
+  }
   process.exit(0);
 }
 
@@ -263,6 +370,9 @@ if (cmd === "down") {
   console.log("  and never edits your project files.  Stop it with: trantor duty down");
   console.log("");
   console.log(pid ? `RUNNING (pid ${pid}) as ${SESSION}` : "NOT running");
+  console.log(existsSync(DUTY_PLIST)
+    ? `keepalive: installed (${DUTY_LABEL}${process.platform === "darwin" ? (dutyLoaded() ? ", loaded" : ", not loaded in this session") : ""}) — launchd relaunches the seat after a crash or reboot`
+    : "keepalive: NOT installed — a crash or reboot leaves the seat down (trantor duty up installs it)");
   // A running seat the hub isn't feeding looks identical to a working one from the outside — which
   // is the whole failure mode this command exists to make visible. So ask the hub, don't assume.
   const hub = fleetHub();

package/bin/turn-watchdog.mjs

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+// Turn watchdog (#5684). runTurn is spawnSync — the runner cannot watch its own turn — so this
+// DETACHED helper does: armed at turn start, disarmed by turn end (the stamp file vanishes or
+// its turn number moves on). A turn that runs past the window with NO output growth earns ONE
+// direct stall report to the foreman (episode, never a timer storm), and the turn is never
+// killed — reporting is the whole job. The operator's 2026-08-31 complaint is the incident:
+// seats sat visibly dead in their panes while every signal channel stayed quiet.
+//
+//   node bin/turn-watchdog.mjs <stampFile> <errFile> <windowMs> <session> <project> <hubUrl>
+import { readFileSync, existsSync, statSync } from "node:fs";
+import { hostId } from "../lib/project.mjs";
+import { signedPost } from "../hooks/lib/api.mjs";
+
+const [stampFile, errFile, windowMsRaw, session, project, hub] = process.argv.slice(2);
+const windowMs = Number(windowMsRaw) || 15 * 60 * 1000;   // no floor: drills pass tiny windows, and one report per turn caps the damage anyway
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+const readStamp = () => { try { return JSON.parse(readFileSync(stampFile, "utf8")); } catch { return null; } };
+const errSize = () => { try { return statSync(errFile).size; } catch { return 0; } };
+
+const armed = readStamp();
+if (!armed) process.exit(0);
+let baseline = errSize();
+
+for (;;) {
+  await sleep(windowMs);
+  const s = readStamp();
+  if (!s || s.turn !== armed.turn) process.exit(0);          // turn ended — nothing to say
+  const size = errSize();
+  if (size > baseline + 200) { baseline = size; continue; }  // producing output: working, re-arm
+  const mins = Math.round((Date.now() - (s.startedAt || Date.now())) / 60000);
+  const orch = `${hostId()}:${project}`;
+  const text = `⏱ ${session} turn STALLED — running ${mins}m with no output (turn ${s.turn}). Not killed; check its pane, or \`trantor swap\`.`;
+  // Direct = wake. The foreman first; if this seat IS the foreman's own runner, say it to all.
+  const to = orch === session ? "all" : orch;
+  try { await signedPost(`${hub}/send`, { from: session, to, text, project }, { session }); } catch {}
+  process.exit(0);                                            // one report per turn, by construction
+}

package/hooks/lib/handoff.mjs

@@ -96,13 +96,17 @@ export function guardContextTokens(rows) {
 }
 
 // The transcript logs the model WITHOUT the [1m] marker, so we cannot tell a
-// 200k window from a 1M one. There is therefore no safe universal default — the
-// window must be declared (env RELAY_CONTEXT_WINDOW or config.contextWindow) for
-// the proactive early-warning to activate. Returns 0 when unknown (→ no warning).
+// 200k window from a 1M one in general. Fable is the known exception (#5503):
+// its window is 1M and the name is all the transcript ever gives us — the
+// undeclared window kept the early-warning off and the session hit the wall
+// silently. An explicit declaration (env RELAY_CONTEXT_WINDOW or
+// config.contextWindow) always wins over any name-based inference. Returns 0
+// when unknown (→ no warning).
 export function resolveWindow(model = "", conf = readConfig()) {
   const explicit = Number(process.env.RELAY_CONTEXT_WINDOW || conf.contextWindow || 0);
   if (explicit > 0) return explicit;
   if (/\[1m\]|-1m\b|:1m\b/i.test(model)) return 1_000_000; // honored if ever present
+  if (/fable/i.test(model)) return 1_000_000;              // #5503: fable is 1M by name
   return 0;
 }
 

package/hub.mjs

@@ -156,6 +156,16 @@ function appendTaskNote(t, b, ts = Date.now()) {
   if (!b || typeof b.note !== "string") return false;
   return appendTaskLog(t, b.by || "", b.note, ts);
 }
+// Card checklists (#5624): acceptance items are the one honest denominator for a progress bar.
+// Accepts plain strings (fresh items) or {text,done} (round-trips); caps 20 items x 200 chars.
+// Returns null for a non-array so callers can distinguish "not sent" from "sent empty".
+function cleanChecklist(v) {
+  if (!Array.isArray(v)) return null;
+  return v.slice(0, 20)
+    .map(it => typeof it === "string" ? { text: it.slice(0, 200), done: false }
+      : { text: String(it?.text ?? "").slice(0, 200), done: !!it?.done })
+    .filter(it => it.text);
+}
 function runTaskBootMigrations() {
   let changed = false;
   const bootNow = Date.now();
@@ -427,6 +437,26 @@ setTimeout(overseerTick, 2000).unref?.();
 let DUTY_SESSION = String(process.env.RELAY_DUTY_SESSION || state.dutySession || "");
 const DUTY_UNDELIVERED_MS = Number(process.env.RELAY_DUTY_UNDELIVERED_MS || 10 * 60 * 1000);
 const dutyEscalated = new Set();
+// #5686: the janitor died 08-27 and NOTHING noticed for 4 days — the hub kept escalating to a
+// corpse. Duty liveness is now a first-class state: dark = configured but no heartbeat inside
+// DUTY_DARK_MS. Episode semantics (one event per transition, a standing flag on /health), and
+// while dark, escalations go to the party owed the reply instead of the dead seat.
+const DUTY_DARK_MS = Number(process.env.RELAY_DUTY_DARK_MS || 10 * 60 * 1000);
+let dutyDarkSince = 0;
+// A freshly appointed seat has no heartbeat yet and is NOT a corpse: the dark clock starts at
+// appointment (boot or POST /overseer/duty), so a newborn gets one full window to first-poll.
+let dutySeenFloor = Date.now();
+function dutyLiveness() {
+  if (!DUTY_SESSION) return { configured: false, online: false, lastSeenMs: 0 };
+  const seen = Math.max(state.peers[DUTY_SESSION]?.lastSeen || 0, dutySeenFloor);
+  const lastSeenMs = now() - seen;
+  return { configured: true, online: lastSeenMs < DUTY_DARK_MS, lastSeenMs: Math.max(0, lastSeenMs) };
+}
+function dutyQueuedEscalations() {
+  if (!DUTY_SESSION) return 0;
+  const upTo = state.peers[DUTY_SESSION]?.deliveredUpTo || 0;
+  return state.messages.reduce((n, m) => n + (m.to === DUTY_SESSION && m.id > upTo ? 1 : 0), 0);
+}
 function hubSend(to, text, project) {
   const msg = { id: ++state.seq, ts: now(), from: "hub:duty", to, text: String(text).slice(0, 2000), project: String(project || "").slice(0, 80) };
   state.messages.push(msg); if (state.messages.length > 5000) state.messages.splice(0, 1000);
@@ -436,6 +466,15 @@ function hubSend(to, text, project) {
 }
 function dutyTick() {
   if (!DUTY_SESSION) return;
+  // #5686: track the dark episode BEFORE escalating, so this tick already routes around a corpse.
+  const live = dutyLiveness();
+  if (!live.online && !dutyDarkSince) {
+    dutyDarkSince = now();
+    appendEvent("duty-dark", "", "hub:duty", { text: `duty seat ${DUTY_SESSION} has no heartbeat — seat trouble is not being triaged (trantor duty up)` });
+  } else if (live.online && dutyDarkSince) {
+    appendEvent("duty-back", "", "hub:duty", { text: `duty seat ${DUTY_SESSION} is back after ${Math.round((now() - dutyDarkSince) / 60000)}m dark` });
+    dutyDarkSince = 0;
+  }
   const cutoff = now() - DUTY_UNDELIVERED_MS;
   const floor = now() - 24 * 3600 * 1000;                 // never escalate ancient history
   for (const m of state.messages) {
@@ -450,7 +489,10 @@ function dutyTick() {
     if (dutyEscalated.has(m.id)) continue;
     if ((state.peers[m.to]?.deliveredUpTo || 0) >= m.id) continue;
     dutyEscalated.add(m.id);
-    hubSend(DUTY_SESSION,
+    // #5686: a dark janitor must not eat escalations. Route to the SENDER — the party who
+    // believes they were heard and are owed the reply — with the duty outage named, so the
+    // failure is visible to someone who can act instead of queued on a corpse.
+    hubSend(dutyDarkSince ? m.from : DUTY_SESSION,
       `⚠️ UNDELIVERED for ${Math.round((now() - m.ts) / 60000)}m: #${m.id} ${m.from} -> ${m.to} — "${String(m.text).slice(0, 280)}" — the recipient has not been handed this (recipient last seen ${state.peers[m.to]?.lastSeen ? Math.round((now() - state.peers[m.to].lastSeen) / 60000) + "m ago" : "never"}). Triage: is the recipient's session idle, deaf (wrong hub / old hooks), or gone? Relay, wake, or note it on their board.`,
       m.project || "");
   }
@@ -1539,6 +1581,8 @@ const server = http.createServer(async (req, res) => {
       const session = String(b.session).slice(0, 120);
       DUTY_SESSION = session;
       state.dutySession = session;
+      dutySeenFloor = Date.now();   // #5686: appointment restarts the dark clock — a newborn is not a corpse
+      if (dutyDarkSince) { dutyDarkSince = 0; }   // fresh seat, fresh episode accounting
       dirty = true;
       return json(res, 200, { ok: true, dutySession: DUTY_SESSION });
     }
@@ -1826,6 +1870,7 @@ const server = http.createServer(async (req, res) => {
         deps: Array.isArray(b.deps) ? [...new Set(b.deps.map(Number).filter(n => Number.isInteger(n) && n > 0))].slice(0, 20) : [],
         by: b.by || "", ts: ts0, updated: ts0,
         history: [{ to: st0, by: b.by || "", ts: ts0 }] };
+      { const cl = cleanChecklist(b.checklist); if (cl?.length) t.checklist = cl; }   // #5624 — rides `extra`, survives restarts
       if (b.source === "cc-subagent") { t._fp = subFp(b.title); if (b.agentType) t._atype = String(b.agentType).slice(0, 40); if (b.agentId) t._aid = String(b.agentId).slice(0, 80); if (b.parent) t.parent = String(b.parent).slice(0, 120); t.count = 1; if (t.status === "doing") { t._everStarted = true; t._inflight = 1; } }
       appendTaskNote(t, b, ts0);
       state.tasks.push(t); if (state.tasks.length > 2000) state.tasks.splice(0, 500);
@@ -1862,11 +1907,29 @@ const server = http.createServer(async (req, res) => {
       // the narrative line a human reads on the board ("assigned — did"), written by the cheap
       // summarizer; rides the tasks.extra column, so it survives restarts everywhere
       if (b.summary !== undefined) t.summary = String(b.summary).slice(0, 220);
+      // #5624: full checklist replace (null clears). Item-level toggles ride /task/checklist-toggle.
+      if (b.checklist !== undefined) {
+        const cl = cleanChecklist(b.checklist);
+        if (cl) { if (cl.length) t.checklist = cl; else delete t.checklist; }
+        else if (b.checklist === null) delete t.checklist;
+      }
       appendTaskNote(t, b);
       if (b.delete) { eventType = "deleted"; eventFrom = null; eventTo = null; state.tasks = state.tasks.filter(x => x.id !== t.id); }
       appendCardEvent(eventType, t, b.by, eventFrom, eventTo);
       t.updated = now(); dirty = true; return json(res, 200, { ok: true, task: t });
     }
+    // #5624: toggle ONE acceptance item. Index-addressed against the card's current checklist —
+    // a stale index 400s instead of silently toggling the wrong item.
+    if (req.method === "POST" && P === "/task/checklist-toggle") {
+      const b = await body(req); const t = state.tasks.find(x => x.id === Number(b.id));
+      if (!t) return json(res, 404, { error: "no such task" });
+      const i = Number(b.index);
+      if (!Array.isArray(t.checklist) || !Number.isInteger(i) || i < 0 || i >= t.checklist.length) {
+        return json(res, 400, { error: "no such checklist item" });
+      }
+      t.checklist[i].done = !!b.done;
+      t.updated = now(); dirty = true; return json(res, 200, { ok: true, task: t });
+    }
     // Manual board sweep — the aggressive companion to the automatic reaper. The reaper only touches
     // OFFLINE-owner cards (no false positives on live work); /sweep is the explicit "this live seat forgot
     // its card" path: it stales EVERY doing/testing card untouched past `olderMs`, regardless of owner
@@ -2617,7 +2680,9 @@ const server = http.createServer(async (req, res) => {
     if (req.method === "GET" && (P === "/" || P === "/ui")) {
       res.writeHead(200, { "content-type": "text/html; charset=utf-8" }); return res.end(UI || "<h1>trantor</h1><p>dashboard unavailable</p>");
     }
-    if (P === "/health") return json(res, 200, { ok: true, authMode: AUTH_MODE, peers: Object.keys(state.peers).length, messages: state.messages.length, streams: streams.length });
+    if (P === "/health") return json(res, 200, { ok: true, authMode: AUTH_MODE, peers: Object.keys(state.peers).length, messages: state.messages.length, streams: streams.length,
+      // #5686: duty liveness rides /health so the app's Home strip and doctor read one truth.
+      duty: { ...dutyLiveness(), darkSinceMs: dutyDarkSince ? now() - dutyDarkSince : 0, queuedEscalations: dutyQueuedEscalations() } });
     json(res, 404, { error: "not found" });
   } catch (e) { json(res, 500, { error: String(e?.message || e) }); }
 });

package/mcp.mjs

@@ -182,11 +182,19 @@ server.tool("relay_contracts", "What you dispatched and are still owed. Lists ev
   });
 
 server.tool("relay_task_add", "Add a Kanban card to a project's board on the dashboard (what you're about to work on). Defaults: THIS project, assigned to you, status 'todo'. Pass `project` to target another board — e.g. when you orchestrate a crew that runs in a different directory than the one you launched Claude from. Keep the team's progress visible. Attach a `note` whenever context isn't obvious from the title — it lands on the card's permanent log ({ts,by,text}, kept: last 40).",
-  { title: z.string().describe("short task title"), status: z.enum(["todo","doing","testing","failed","done","blocked"]).optional(), assignee: z.string().optional().describe("session id to assign (default: you)"), difficulty: z.enum(["easy","medium","hard"]).optional().describe("difficulty tag — drives model/agent routing (relay_advise) and shows on the board"), model: z.string().optional().describe("the model this card is routed to (from relay_advise routing, or the CLI default) — shown on the card"), deps: z.array(z.number()).optional().describe("card ids this card depends on — drawn as branch edges in the Flow view (e.g. integration depends on every crew card)"), phase: z.string().optional().describe("phase/milestone this card belongs to (e.g. 'P5', 'Auth', 'Launch') — groups it in the Flow view's phase flowchart. Optional; otherwise inferred from the title prefix + time."), note: z.string().max(2000).optional().describe("optional card-log entry (<=2000 chars): context, the plan, or a link — stored on the card as {ts,by,text}"), project: z.string().optional().describe("board to add to (default: this session's project). Set to the crew's project when you orchestrate from a different directory") },
-  async ({ title, status, assignee, difficulty, model, deps, phase, note, project }) => {
+  { title: z.string().describe("short task title"), status: z.enum(["todo","doing","testing","failed","done","blocked"]).optional(), assignee: z.string().optional().describe("session id to assign (default: you)"), difficulty: z.enum(["easy","medium","hard"]).optional().describe("difficulty tag — drives model/agent routing (relay_advise) and shows on the board"), model: z.string().optional().describe("the model this card is routed to (from relay_advise routing, or the CLI default) — shown on the card"), deps: z.array(z.number()).optional().describe("card ids this card depends on — drawn as branch edges in the Flow view (e.g. integration depends on every crew card)"), phase: z.string().optional().describe("phase/milestone this card belongs to (e.g. 'P5', 'Auth', 'Launch') — groups it in the Flow view's phase flowchart. Optional; otherwise inferred from the title prefix + time."), note: z.string().max(2000).optional().describe("optional card-log entry (<=2000 chars): context, the plan, or a link — stored on the card as {ts,by,text}"), project: z.string().optional().describe("board to add to (default: this session's project). Set to the crew's project when you orchestrate from a different directory"), checklist: z.array(z.string().max(200)).max(20).optional().describe("acceptance items for the card — the honest denominator for its progress bar. Tick them off with relay_task_check as each is truly met") },
+  async ({ title, status, assignee, difficulty, model, deps, phase, note, project, checklist }) => {
     const proj = project || PROJECT;
-    const { task } = await api("POST", "/task", { project: proj, title, status: status || "todo", assignee: assignee || SESSION, difficulty, model, deps, phase, note, by: SESSION });
-    return { content: [{ type: "text", text: `card #${task.id} added to ${proj}: "${title}" [${task.status}]${phase?` · phase ${phase}`:""}` }] };
+    const { task } = await api("POST", "/task", { project: proj, title, status: status || "todo", assignee: assignee || SESSION, difficulty, model, deps, phase, note, checklist, by: SESSION });
+    return { content: [{ type: "text", text: `card #${task.id} added to ${proj}: "${title}" [${task.status}]${phase?` · phase ${phase}`:""}${task.checklist?.length?` · ${task.checklist.length} acceptance item(s)`:""}` }] };
+  });
+
+server.tool("relay_task_check", "Tick (or untick) ONE acceptance item on a card's checklist — the card's progress bar reads checked/total, so tick an item only when it is genuinely met (tests run, behavior observed), never to make the bar move. Items are 0-indexed in the order relay_task_add listed them.",
+  { id: z.number().describe("card id"), index: z.number().int().min(0).describe("0-based checklist item index"), done: z.boolean().optional().describe("default true; pass false to untick") },
+  async ({ id, index, done }) => {
+    const { task } = await api("POST", "/task/checklist-toggle", { id, index, done: done !== false, by: SESSION });
+    const n = task.checklist.filter(c => c.done).length;
+    return { content: [{ type: "text", text: `card #${id} checklist: [${done !== false ? "x" : " "}] "${task.checklist[index].text}" — ${n}/${task.checklist.length} done` }] };
   });
 
 server.tool("relay_phase_goal", "Set what a PHASE is for — its goal — shown as the phase header in the Flow view (overrides the theme auto-derived from card titles). Capture this when you plan a phase so the board says what each milestone needs to do, not just 'P5'. Phase keys match relay_task_add's `phase` (or the inferred title-prefix family like 'P5').",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.18",
+  "version": "0.18.20",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"
@@ -11,7 +11,7 @@
     "zod": "^4.4.3"
   },
   "scripts": {
-    "test": "node bin/slop-gate.mjs --surface desktop/src && node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-redelivery.mjs && node test-crew-completion.mjs && node test-contracts.mjs && node test-autonomy.mjs && node test-integrate.mjs && node test-handoff.mjs && node test-handoff-summarizer.mjs && node test-baton-turn-boundary.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-baton-latest.mjs && node test-balances.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-cardlog.mjs && node test-relay-note.mjs && node test-reaper.mjs && node test-events.mjs && node test-proposals.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-message-re.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-duty-seat.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-crew-env.mjs && node test-desktop-transport.mjs && node test-crew-worktree.mjs && bash test-crew-herdr.sh && npm --prefix desktop run test --silent && node test-splitbrain.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-inbox-delivery.mjs && node test-identity-drift.mjs && node test-inbox-staleness.mjs && node test-seats.mjs && node test-seat-identity.mjs && node test-hub-routing.mjs && node test-hook-routing.mjs && node test-relay-wait.mjs && node test-dsh-seat.mjs && node test-kimi-bridge.mjs && node test-kimi-events.mjs && python3 engine/test-routing.py && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && node test-bridge.mjs && bash test-crew.sh"
+    "test": "node bin/slop-gate.mjs --surface desktop/src && node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-redelivery.mjs && node test-crew-completion.mjs && node test-contracts.mjs && node test-autonomy.mjs && node test-integrate.mjs && node test-handoff.mjs && node test-handoff-summarizer.mjs && node test-baton-turn-boundary.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-baton-latest.mjs && node test-balances.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-cardlog.mjs && node test-checklist.mjs && node test-relay-note.mjs && node test-reaper.mjs && node test-events.mjs && node test-proposals.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-message-re.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-duty-dark.mjs && node test-duty-seat.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-crew-env.mjs && node test-desktop-transport.mjs && node test-crew-worktree.mjs && bash test-crew-herdr.sh && npm --prefix desktop run test --silent && node test-splitbrain.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-inbox-delivery.mjs && node test-identity-drift.mjs && node test-inbox-staleness.mjs && node test-seats.mjs && node test-seat-identity.mjs && node test-hub-routing.mjs && node test-hook-routing.mjs && node test-relay-wait.mjs && node test-dsh-seat.mjs && node test-kimi-bridge.mjs && node test-kimi-events.mjs && python3 engine/test-routing.py && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && node test-bridge.mjs && bash test-crew.sh"
   },
   "description": "The hub-world for AI agent crews \u2014 orchestrate Claude Code, Codex, GLM, Kimi, DeepSeek & any OpenRouter model as live crews with a plan-aware Advisor, a Kanban/flow command center, a testing gate, and an economics brain (Scrooge).",
   "files": [