trantor 0.18.19 → 0.18.21

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.19",
+  "version": "0.18.21",
   "description": "Trantor \u2014 the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/README.md

@@ -230,6 +230,14 @@ project's workspace, so when you run several sessions each driving its own crew,
 can't nuke another's. `trantor down <agent>` drops a single seat; `trantor down --all --yes` tears down
 every project's crew.
 
+Since 0.18.20, **seat trouble wakes the foreman instead of hoping someone looks**: a failing or
+dead seat direct-messages the project's orchestrator (broadcasts wake nobody), a detached
+watchdog reports a turn running silent past 15 minutes — once, without killing it — and the
+failure classifier tells a provider backend error ("retry or swap") from real quota exhaustion
+("wait the window out"). The duty seat itself now runs under a launchd keepalive, so the fleet's
+janitor relaunches after a crash or reboot instead of dying silently, and the hub routes
+escalations back to their senders whenever the janitor goes dark.
+
 **One-time setup:**
 - Install cmux — `brew install --cask cmux` (or grab it from **[cmux.com](https://cmux.com)**).
 - Trantor drives cmux over its control socket, which is off to outside processes by default. Enable it in

package/bin/crew-runner.mjs

@@ -8,11 +8,11 @@
 // over plain HTTP (zero tokens, doubles as a heartbeat), and when a message addressed to this
 // agent arrives it RESUMES the CLI session (native resume = full context kept) with that
 // message as the prompt. The model just works and ends its turn; the runner does the rest.
-import { execSync, spawnSync } from "node:child_process";
+import { execSync, spawnSync, spawn } from "node:child_process";
 import { readFileSync, writeFileSync, unlinkSync, existsSync, appendFileSync, mkdirSync } from "node:fs";
 import { join, basename } from "node:path";
 import { homedir } from "node:os";
-import { resolveProject, resolveHub, withEnvFiles } from "../lib/project.mjs";
+import { resolveProject, resolveHub, withEnvFiles, hostId } from "../lib/project.mjs";
 import { loadOrCreate } from "../lib/identity.mjs";
 import { signedHeaders } from "../lib/signed-fetch.mjs";
 import { ensureEnrolled } from "../lib/enroll.mjs";
@@ -314,6 +314,11 @@ const AUTH_MARKER_RE = /unauthor|401|403|forbidden|invalid[ _-]?api[ _-]?key|aut
 function classifyFailure(exit, errText) {
   const t = (errText || "").toLowerCase();
   if (exit === 127) return "missing-cli";
+  // #5684: a provider BACKEND failure is not quota — it wants retry/swap, not a window wait.
+  // The specimen (#5683): codex's "unexpected status 404 Not Found … /responses/compact" was
+  // labelled "exhausted" and the operator was advised to wait out a window that did not exist.
+  // 401/403/429 deliberately fall through to the auth/exhausted branches below.
+  if (/unexpected status (404|408|410|5\d\d)|internal server error|bad gateway|service unavailable|gateway time.?out|econnrefused|connection refused|socket hang ?up|network is unreachable/.test(t)) return "backend-error";
   // "reached your … limit" / "usage limit" catch the subscription CLIs (Claude's "You've reached
   // your Fable 5 limit"), which say nothing about quota or credits and would otherwise read as a crash.
   if (/quota|insufficient|credit|balance|payment required|402|429|too many requests|rate.?limit|exceeded your|reached your [^.\n]*limit|usage limit|out of (credit|quota)/.test(t)) return "exhausted";
@@ -329,6 +334,7 @@ async function reportFailure(exit, trigger, undelivered = 0) {
   await api("/register", { session: SESSION, project: PROJ, status, llm: AGENT, model: MODEL }).catch(() => {});
   const hint = reason === "exhausted" ? " — needs `trantor swap`"
     : reason === "auth" ? " — check credentials"
+    : reason === "backend-error" ? " — provider backend error (NOT quota): retry, or `trantor swap` to another provider"
     : reason === "missing-cli" ? " — CLI not on PATH" : "";
   // The count of messages this seat is HOLDING is the operator-actionable half of a failure: a
   // crashed pulse costs nothing, a crashed turn sitting on three escalations is someone waiting.
@@ -343,6 +349,12 @@ async function reportFailure(exit, trigger, undelivered = 0) {
   if (state !== announced) {
     announced = state;
     await api("/send", { from: SESSION, to: "all", text, project: PROJ }).catch(() => {});
+    // #5684: a broadcast does not wake anyone — the incident is the operator spotting dead seats
+    // before the foreman did, twice in one morning. The same state-change event now goes DIRECT
+    // to the project's orchestrator (direct = wake), gated identically so a standing outage says
+    // it once. A seat that IS the orchestrator's own runner has nobody above it to wake.
+    const orch = `${hostId()}:${PROJ}`;
+    if (orch !== SESSION) await api("/send", { from: SESSION, to: orch, text, project: PROJ }).catch(() => {});
   } else {
     log(`still ${state} (${consecFails} fails) — already announced, staying quiet`);
   }
@@ -420,6 +432,17 @@ function runTurn(prompt, isFirst, trigger = "kickoff") {
   // `tee /dev/stderr`; the rest now tee straight into ERRF. A real pipeline (not a process
   // substitution) so bash waits for tee to flush before we read the file back.
   const inner = cli.sid ? `${cmd} | tee /dev/stderr` : `${cmd} | tee -a ${ERRF}`;
+  // #5684: runTurn is spawnSync, so the runner cannot watch its own turn — a DETACHED watchdog
+  // does. Armed by a stamp file, disarmed when the turn ends (stamp removed below); a turn past
+  // the window with no ERRF growth earns ONE direct stall report to the foreman, never a kill.
+  const WD_MS = Number(process.env.TRANTOR_TURN_WATCHDOG_MS || 15 * 60 * 1000);
+  const STAMPF = join(homedir(), ".agent-bus", `turnstamp-${AGENT}-${PROJ}.json`);
+  try {
+    writeFileSync(STAMPF, JSON.stringify({ turn: TURN, startedAt: Date.now() }));
+    const wd = spawn(process.execPath, [join(import.meta.dirname, "turn-watchdog.mjs"), STAMPF, ERRF, String(WD_MS), SESSION, PROJ, HUB],
+      { detached: true, stdio: "ignore" });
+    wd.unref();
+  } catch {}
   const r = spawnSync("/bin/bash", ["-c", `set -o pipefail; { ${inner} ; } 2> >(tee -a ${ERRF} >&2)`], {
     cwd: TURN_DIR, encoding: "utf8", stdio: cli.sid ? ["ignore", "pipe", "inherit"] : "inherit",
     env: { ...process.env, RELAY_URL: HUB, RELAY_AGENT: AGENT, RELAY_PROJECT: PROJ,
@@ -436,6 +459,7 @@ function runTurn(prompt, isFirst, trigger = "kickoff") {
       TRANTOR_NO_HANDOFF_SPAWN: "1", TRANTOR_NO_BATON_SPAWN: "1" },
     maxBuffer: 16 * 1024 * 1024,
   });
+  try { unlinkSync(STAMPF); } catch {}   // turn over — disarm the watchdog
   try { lastErrText = readFileSync(ERRF, "utf8").slice(-4000); } catch { lastErrText = ""; }
   if (cli.sid && r.stdout) { const m = r.stdout.match(cli.sid); if (m) sid = m[1]; }
   const realExit = r.status;

package/bin/crew.sh

@@ -244,26 +244,31 @@ _orch_cmd() {   # $1=dir $2=sid
 }
 
 # A recorded thread that HANDED OFF has ended: resuming it replays a dead conversation while the
-# handoff waits for a successor (the 2026-08-27 seam — "Trantor resumes the wrong thread"). When the
-# newest unconsumed handoff for the project was written BY the recorded session, open must start a
-# FRESH id instead; the sessionstart hook then claims the baton and records the fresh id in
-# orch-sessions.txt (single writer for the map: the hook + adopt — this function writes nothing).
+# handoff waits for a successor (the 2026-08-27 seam — "Trantor resumes the wrong thread").
+# ANY unconsumed handoff for the project means a successor is OWED a fresh window — open must
+# start a FRESH id so the sessionstart hook claims the baton (it then records the fresh id in
+# orch-sessions.txt; single writer: the hook + adopt — this function writes nothing).
+# The old predicate required the handoff to be written BY the recorded session (session_id match)
+# — but MANUAL handoffs carry no session_id at all, so on 2026-08-31 the reboot flow resumed the
+# same maxed-out conversation TWICE while its handoff sat unclaimed, and the injected recap
+# banner made each resume LOOK like a clean takeover. Who wrote it doesn't matter; that it is
+# unclaimed does.
 _orch_takeover_sid() {   # $1=project $2=recorded-sid → prints the sid open should use
   local fresh
   if node -e '
 const fs=require("fs"),path=require("path"),os=require("os");
 const dir=path.join(process.env.AGENT_BUS_DIR||process.env.RELAY_DATA_DIR||path.join(os.homedir(),".agent-bus"),"handoffs");
-const [proj,sid]=process.argv.slice(1);
+const [proj]=process.argv.slice(1);
 try{
   const re=new RegExp("^"+proj.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")+"-(\\d+)\\.json$");
   const files=fs.readdirSync(dir).map(f=>{const m=re.exec(f);return m?{f,s:Number(m[1])}:null}).filter(Boolean).sort((a,b)=>b.s-a.s);
   for(const {f} of files){
     const r=JSON.parse(fs.readFileSync(path.join(dir,f),"utf8"));
     if(r.consumed) continue;
-    process.exit(r.session_id&&r.session_id===sid?0:1);   // newest UNCONSUMED decides
+    process.exit(0);   // newest UNCONSUMED exists → a successor is owed a fresh window
   }
 }catch(e){}
-process.exit(1);' "$1" "$2" 2>/dev/null; then
+process.exit(1);' "$1" 2>/dev/null; then
     fresh="$(uuidgen 2>/dev/null | tr 'A-Z' 'a-z')"
     [ -n "$fresh" ] && { echo "— recorded session $2 handed off: starting fresh as $fresh to claim it —" >&2; printf '%s' "$fresh"; return 0; }
   fi

package/bin/doctor.mjs

@@ -10,6 +10,7 @@ import { execSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { resolveProject, resolveHub, DEFAULT_HUB_URL } from "../lib/project.mjs";
 import { loadOrCreate } from "../lib/identity.mjs";
+import { sfetchJson } from "../lib/signed-fetch.mjs";
 import { scan } from "../lib/splitbrain.mjs";
 
 const H = homedir();
@@ -87,6 +88,55 @@ section("hub routing");
   }
 }
 
+// ── duty seat: is the fleet's watcher actually alive? ────────────────────────────────────────
+// The duty seat sat dead for four days (2026-08-27→31) while everything else reported green.
+// A dead watcher raises no error of its own — it just stops producing nudges — so this row makes
+// that state loud: process, keepalive, hub registration and the freshness of the seat's last hub
+// beat, each with its fix.
+section("duty seat (the fleet watcher)");
+{
+  const BUSD = join(H, ".agent-bus");
+  const DUTY_PLIST = join(H, "Library", "LaunchAgents", "com.trantor.duty.plist");
+  const FIX_UP = "trantor duty up   (installs the launchd keepalive com.trantor.duty, which relaunches the seat after a crash or reboot)";
+  let pid = 0;
+  try { pid = Number(readFileSync(join(BUSD, "duty.pid"), "utf8")) || 0; if (pid) process.kill(pid, 0); else pid = 0; } catch { pid = 0; }
+  const keepalive = existsSync(DUTY_PLIST);
+  // The seat watches the FLEET hub — the most common project hub in config, the exact pick
+  // bin/duty.mjs makes — not necessarily THIS project's hub.
+  const counts = new Map();
+  for (const u of Object.values(cfg.hubs || {})) counts.set(u, (counts.get(u) || 0) + 1);
+  const fleet = [...counts.entries()].sort((a, b) => b[1] - a[1])[0]?.[0] || cfg.url || "";
+  const signed = cfg.ownerIdentity ? (() => { try { return loadOrCreate(cfg.ownerIdentity, "human"); } catch { return null; } })() : null;
+  const hubGet = (path) => sfetchJson(`${fleet}${path}`, { method: "GET", identity: signed, signal: AbortSignal.timeout(4000) })
+    .then((r) => (r?.ok ? r.json() : null)).catch(() => null);
+  if (!fleet) {
+    note("duty seat: no hub pinned — cannot check the fleet feed");
+  } else {
+    const st = await hubGet("/overseer/status");
+    const peers = await hubGet("/peers");
+    const dutySession = st?.dutySession || "";
+    const beat = dutySession ? (peers?.sessions || []).find((p) => p.session === dutySession)?.lastSeen || 0 : 0;
+    const ageMin = beat ? Math.floor((Date.now() - beat) / 60000) : null;
+    const age = ageMin == null ? "no beat yet" : ageMin < 1 ? "beat just now" : ageMin < 60 ? `last beat ${ageMin}m ago` : `last beat ${Math.floor(ageMin / 60)}h ago`;
+    if (!st || !peers) {
+      // The core section already flags a dead hub; here we only refuse to guess.
+      note(`duty seat: hub feed UNKNOWN — ${fleet} did not answer the duty read${cfg.ownerIdentity ? "" : " (no owner identity to sign with)"}`);
+      pid ? ok(`duty seat: process running (pid ${pid})`) : warn("duty seat: not running and its hub feed cannot be checked", FIX_UP);
+    } else if (pid && dutySession && ageMin != null && ageMin > 5) {
+      warn(`duty seat: process up (pid ${pid}) but the hub heard nothing for ${Math.floor(ageMin / 60) >= 1 ? Math.floor(ageMin / 60) + "h " : ""}${ageMin % 60}m — it is running deaf`, "trantor duty down && trantor duty up");
+    } else if (pid) {
+      ok(`duty seat: running (pid ${pid}${dutySession ? `, ${dutySession} on the fleet hub` : ""}, ${age})`);
+      if (process.platform === "darwin" && !keepalive) warn("duty seat: running WITHOUT a keepalive — a crash or reboot leaves it down", FIX_UP);
+    } else if (dutySession) {
+      warn(`duty seat: the hub still points at ${dutySession} but no seat process is running — escalations go into a hole`, FIX_UP);
+    } else if (keepalive) {
+      warn("duty seat: keepalive installed but the seat is down — launchd should have relaunched it", `launchctl list | grep com.trantor.duty   then: trantor duty down && trantor duty up`);
+    } else {
+      warn("duty seat: none — nobody is watching the fleet (undelivered mail and dead seats go unnudged)", FIX_UP);
+    }
+  }
+}
+
 // claude plugin
 section("claude (the orchestrator)");
 if (!has("claude")) warn("claude CLI not found", "install Claude Code: https://claude.com/claude-code");

package/bin/duty.mjs

@@ -6,14 +6,20 @@
 //   trantor duty down                                  stop
 //   trantor duty status                                pid + last turns + presence
 //
+// Keepalive (the 4-day silent death, 2026-08-27→31): by default the seat runs HEADLESS under a
+// launchd service (label com.trantor.duty, KeepAlive=true) — launchd relaunches it after a crash
+// and at every login, so the watcher stops being one bad afternoon away from silently gone.
+// `--window` opts into the visible cmux/Terminal surface instead; a window CANNOT be kept alive
+// by launchd, so that mode says plainly that nothing will bring it back.
+//
 // Division of labor (the overseer doctrine, extended): DETECTION stays mechanical and hub-side —
 // RELAY_DUTY_SESSION makes the hub DM this seat when a direct message sits undelivered past
 // RELAY_DUTY_UNDELIVERED_MS or the overseer emits a warning. The SEAT only triages: relay, wake,
 // annotate, and only involves the human when a real decision is needed. It runs under the same
 // crew-runner that keeps crew seats alive (long-poll wake, turn telemetry, failure reporting) —
 // just with a triage doctrine instead of "work your card" (RUNNER_RULES / CREW_KICKOFF).
-import { spawn, execSync } from "node:child_process";
-import { readFileSync, writeFileSync, existsSync, mkdirSync, openSync, rmSync } from "node:fs";
+import { spawn, execSync, execFileSync } from "node:child_process";
+import { readFileSync, writeFileSync, existsSync, mkdirSync, openSync, rmSync, unlinkSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
@@ -25,6 +31,9 @@ const BUS = process.env.AGENT_BUS_DIR || join(homedir(), ".agent-bus");
 const DIR = join(BUS, "trantor-duty");           // the seat's cwd, and therefore its bus id
 const PIDF = join(BUS, "duty.pid");
 const LOGF = join(BUS, "duty.log");
+const LAUNCHER = join(BUS, "duty-launch.sh");
+const DUTY_LABEL = "com.trantor.duty";
+const DUTY_PLIST = join(homedir(), "Library", "LaunchAgents", `${DUTY_LABEL}.plist`);
 
 const argv = process.argv.slice(2);
 const cmd = argv[0] || "status";
@@ -46,8 +55,12 @@ function fleetHub() {
 // a patrol script, send a templated nudge, post 280 chars. Nobody chose that; it was inherited.
 // Precedence: --model flag > CREW_MODEL env > sonnet. `--model inherit` restores the old behaviour.
 const DUTY_MODEL = val("model", "") || process.env.CREW_MODEL || "sonnet";
-// Visible by default; --headless keeps the old background behaviour for launchd and CI.
-const WINDOW = !argv.includes("--headless") && process.platform === "darwin";
+// Headless is the DEFAULT now, and it rides the launchd keepalive. The old default — a visible
+// window, headless only as a silent fallback — is exactly how the seat died quietly on
+// 2026-08-27: the osascript window-open failed, the fallback printed one line into a log nobody
+// reads, and the fleet had no watcher for four days. Headless+keepalive is the honest default;
+// `--window` is the explicit choice of a surface launchd cannot keep alive.
+const WINDOW = argv.includes("--window") && process.platform === "darwin";
 const AGENT = val("agent", "claude");
 // Named, not inherited. It used to be "claude:fleet" purely because the seat's directory was
 // called fleet and identity is derived from directory basename — the same identity-by-position
@@ -134,6 +147,71 @@ function cmuxBinary() {
   return "";
 }
 
+// launchd, invoked by NAME so a drill can stub it on PATH (seats.mjs hardcodes /bin/launchctl,
+// which is why its install has no drill). Every call swallows its error: on a machine without
+// launchd the keepalive path is simply unavailable and the caller says so.
+const bootoutDuty = () => { try { execFileSync("launchctl", ["bootout", `gui/${process.getuid()}/${DUTY_LABEL}`], { stdio: "ignore", timeout: 8000 }); return true; } catch { return false; } };
+const bootstrapDuty = () => { try { execFileSync("launchctl", ["bootstrap", `gui/${process.getuid()}`, DUTY_PLIST], { stdio: "ignore", timeout: 8000 }); return true; } catch { return false; } };
+const dutyLoaded = () => { try { return execFileSync("launchctl", ["list"], { encoding: "utf8", timeout: 8000 }).split("\n").some((l) => l.includes(DUTY_LABEL)); } catch { return false; } };
+
+// Same service shape as the hub (deploy/com.trantor.hub.plist): the long-running process is the
+// job, RunAtLoad + KeepAlive bring it back after a crash and at every login. One deliberate
+// addition, ThrottleInterval=30: a seat that exits because the hub is down must not hot-loop —
+// a KeepAlive job retrying every 10s forever is how this machine hit load 490 on 2026-08-21.
+function keepalivePlistBody() {
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!-- trantor duty seat as an always-on launchd service. \`trantor duty up\` rewrites this;
+     \`trantor duty down\` removes it. -->
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>${DUTY_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array><string>/bin/bash</string><string>${LAUNCHER}</string></array>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key><true/>
+  <key>ThrottleInterval</key><integer>30</integer>
+  <key>StandardOutPath</key><string>${LOGF}</string>
+  <key>StandardErrorPath</key><string>${LOGF}</string>
+</dict>
+</plist>
+`;
+}
+
+// The rules are ~4KB of prose with backticks, quotes and $ in them, so they cannot ride a
+// command line or an AppleScript string. A launcher script carries them instead. The values ride
+// SINGLE QUOTES (apostrophes escaped as '"'"'): backticks, $( ), parens and newlines are then all
+// literal. The previous form — $(cat <<'EOF' … EOF) — silently broke under macOS bash 3.2 the
+// moment a value contained a backtick (the rules do): the export failed, the seat started without
+// its kickoff text, and the only symptom was a syntax-error line in a log nobody reads.
+function writeLauncher(env) {
+  const shquote = (v) => `'${String(v).replace(/'/g, `'\\''`)}'`;
+  const exports = Object.entries(env).map(([k, v]) => `export ${k}=${shquote(v)}`).join("\n");
+  writeFileSync(LAUNCHER, `#!/bin/bash\n# written by \`trantor duty up\` — safe to delete when the seat is down\n${exports}\nexec ${JSON.stringify(process.execPath)} ${JSON.stringify(join(ROOT, "bin", "crew-runner.mjs"))} ${AGENT} ${JSON.stringify(DIR)}\n`, { mode: 0o700 });
+}
+
+// The old headless start: a detached child of whoever ran `up`. No keepalive — it dies with a
+// reboot and nothing brings it back. Kept for non-darwin and as the loud last fallback.
+function startDetached(env) {
+  const out = openSync(LOGF, "a");
+  const child = spawn(process.execPath, [join(ROOT, "bin", "crew-runner.mjs"), AGENT, DIR], {
+    detached: true, stdio: ["ignore", out, out], env: { ...process.env, ...env },
+  });
+  child.unref();
+  return child.pid;
+}
+
+// Find the runner's pid once a surface (window or launchd) should have started it, and park it
+// in the pidfile `down`/`status` read. Terminal/launchd take a moment, so poll briefly.
+function pollRunnerPid(max = 25) {
+  let pid = 0;
+  for (let i = 0; i < max && !pid; i++) {
+    try { pid = Number(execSync(`pgrep -f "crew-runner.mjs ${AGENT} ${DIR}" | head -1`, { encoding: "utf8" }).trim()) || 0; } catch {}
+    if (!pid) execSync("sleep 0.2");
+  }
+  return pid;
+}
+
 /** Close every workspace this seat owns. No-op when cmux is absent or its socket is off. */
 function closeDutyWorkspace() {
   const bin = cmuxBinary();
@@ -166,77 +244,94 @@ if (cmd === "up") {
   if (!(await ensureFleetIdentity(hub))) process.exit(1);
   const env = (() => {
     const e = { RELAY_URL: hub, RUNNER_RULES: RULES, CREW_KICKOFF: KICKOFF,
-                RUNNER_TITLE: "Trantor Duty Agent", RUNNER_ABOUT: ABOUT };
+                RUNNER_TITLE: "Trantor Duty Agent", RUNNER_ABOUT: ABOUT,
+                // launchd starts jobs with a MINIMAL Path — the resurrected seat could not find
+                // `claude` and every turn died exit 127 "missing-cli" (found live 2026-08-31,
+                // duty's own triage caught it). Bake the operator's PATH from `up` time into the
+                // launcher, exactly like every other value it carries.
+                PATH: process.env.PATH || "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin" };
     if (DUTY_MODEL !== "inherit") e.CREW_MODEL = DUTY_MODEL;
     return e;
   })();
 
+  writeLauncher(env);
+
   let pid = 0;
+  let how = "";
+
   if (WINDOW) {
-    // A WINDOW, by default. Headless was the old behaviour and it hid the thing: an always-on agent
-    // nobody can see is exactly what unsettles a person who finds the process, and the seat's own
-    // introduction (RUNNER_ABOUT) is worthless printed into a log file nobody opens. Crew seats have
-    // always opened windows; the duty seat now does too.
-    //
-    // The rules are ~4KB of prose with backticks, quotes and $ in them, so they cannot ride a
-    // command line or an AppleScript string. A launcher script carries them instead: a quoted
-    // heredoc means the shell expands nothing, and osascript only ever sees the path.
-    const launcher = join(BUS, "duty-launch.sh");
-    const exports = Object.entries(env).map(([k, v]) =>
-      `export ${k}=$(cat <<'TRANTOR_${k}_EOF'\n${v}\nTRANTOR_${k}_EOF\n)`).join("\n");
-    writeFileSync(launcher, `#!/bin/bash\n# written by \`trantor duty up\` — safe to delete when the seat is down\n${exports}\nexec ${JSON.stringify(process.execPath)} ${JSON.stringify(join(ROOT, "bin", "crew-runner.mjs"))} ${AGENT} ${JSON.stringify(DIR)}\n`, { mode: 0o700 });
-    // PREFER CMUX. Terminal.app was the only surface here, and a plain window is stacking by
-    // construction: every `duty up` opens another one and nothing closes the last, so restarts
-    // accumulate windows that all look like live duty agents. cmux gives the seat ONE named
-    // workspace that gets REPLACED on each up — the same "replace, never stack" rule bin/crew.sh
-    // already applies to crew seats, which is why they never pile up and this did.
-    //
-    // Terminal remains the fallback: no cmux, or its control socket off, and nothing changes.
+    // --window: the visible surface. cmux first (ONE named workspace, replaced on each up — the
+    // same "replace, never stack" rule bin/crew.sh applies to crew seats), Terminal as fallback.
+    // A window cannot be kept alive by launchd, so `how` says plainly that nothing will bring
+    // the seat back if it dies.
     const cmuxBin = cmuxBinary();
-
-    let openedInCmux = false;
+    let opened = false;
     if (cmuxBin) {
       try {
         // Replace, never stack: take the previous duty workspace away before opening this one.
         // Closing first is safe here (unlike a crew pane swap) — the seat is a single surface with
         // nothing to preserve.
         closeDutyWorkspace();
-        execSync(`${cmuxBin} new-workspace --name ${JSON.stringify(CMUX_WS_NAME)} --cwd ${JSON.stringify(DIR)} --command ${JSON.stringify(`bash ${launcher}`)} --focus false`,
+        execSync(`${cmuxBin} new-workspace --name ${JSON.stringify(CMUX_WS_NAME)} --cwd ${JSON.stringify(DIR)} --command ${JSON.stringify(`bash ${LAUNCHER}`)} --focus false`,
           { stdio: "ignore", timeout: 8000, env: { ...process.env, CMUX_QUIET: "1" } });
-        openedInCmux = true;
+        opened = true;
       } catch (e) {
         console.error(`cmux launch failed (${e?.message || e}) — falling back to a Terminal window`);
       }
     }
-
-    if (!openedInCmux) {
-      const osa = `tell application "Terminal"\n  do script ${JSON.stringify(`bash ${launcher}`)}\n  activate\nend tell\n`;
-      try { execSync(`osascript -e ${JSON.stringify(osa)}`, { stdio: "ignore", timeout: 8000 }); }
-      catch (e) { console.error(`could not open a window (${e?.message || e}) — falling back to headless`); }
+    if (!opened) {
+      const osa = `tell application "Terminal"\n  do script ${JSON.stringify(`bash ${LAUNCHER}`)}\n  activate\nend tell\n`;
+      try { execSync(`osascript -e ${JSON.stringify(osa)}`, { stdio: "ignore", timeout: 8000 }); opened = true; }
+      catch (e) {
+        // The 2026-08-27 incident: this printed one quiet line, fell back headless, and the fleet
+        // had no watcher for four days. Now it is loud, and the keepalive path below takes over.
+        console.error(`  ⚠️  could not open a window (${e?.message || e}) — falling back to the headless launchd keepalive`);
+      }
     }
-    // The runner lives inside Terminal, so its pid is not ours to know: find it the same way `down`
-    // does. Poll briefly, since Terminal takes a moment to start the shell.
-    for (let i = 0; i < 25 && !pid; i++) {
-      try { pid = Number(execSync(`pgrep -f "crew-runner.mjs ${AGENT} ${DIR}" | head -1`, { encoding: "utf8" }).trim()) || 0; } catch {}
-      if (!pid) execSync("sleep 0.2");
+    if (opened) {
+      pid = pollRunnerPid();
+      writeFileSync(PIDF, String(pid));
+      how = "in a window (NO keepalive — if it dies or the Mac reboots, it stays down)";
     }
   }
-  if (!pid) {
-    const out = openSync(LOGF, "a");
-    const child = spawn(process.execPath, [join(ROOT, "bin", "crew-runner.mjs"), AGENT, DIR], {
-      detached: true, stdio: ["ignore", out, out], env: { ...process.env, ...env },
-    });
-    child.unref();
-    pid = child.pid;
+
+  if (!how) {
+    if (process.platform === "darwin") {
+      // The honest default: headless under launchd, so a crashed seat relaunches itself instead
+      // of dying silently (the seat sat dead 2026-08-27→31 before anyone noticed).
+      mkdirSync(dirname(DUTY_PLIST), { recursive: true });   // a fresh machine has no LaunchAgents dir yet
+      writeFileSync(DUTY_PLIST, keepalivePlistBody());
+      bootoutDuty();
+      if (bootstrapDuty()) {
+        pid = pollRunnerPid(15);
+        writeFileSync(PIDF, String(pid));
+        how = `headless under the launchd keepalive ${DUTY_LABEL} (relaunched after a crash or reboot)`;
+        if (!pid) console.error(`  ⚠️  keepalive installed but no runner seen after 3s — check: launchctl list | grep ${DUTY_LABEL}`);
+      } else {
+        console.error("  ⚠️  launchctl bootstrap failed — starting a plain headless seat with NO keepalive");
+        pid = startDetached(env);
+        writeFileSync(PIDF, String(pid));
+        how = "headless, NO keepalive (launchd refused the job)";
+      }
+    } else {
+      pid = startDetached(env);
+      writeFileSync(PIDF, String(pid));
+      how = `headless, NO keepalive (launchd is macOS-only; ${process.platform} gets a plain background seat)`;
+    }
   }
-  writeFileSync(PIDF, String(pid));
-  console.log(`— duty agent up: ${SESSION} (pid ${pid})${WINDOW ? " in a window" : " headless"} on ${DUTY_MODEL === "inherit" ? "the CLI default model" : DUTY_MODEL} watching ${hub} — log: ${LOGF}`);
+
+  console.log(`— duty agent up: ${SESSION} (pid ${pid}) ${how} on ${DUTY_MODEL === "inherit" ? "the CLI default model" : DUTY_MODEL} watching ${hub} — log: ${LOGF}`);
   const fed = await registerDutySeat(hub, SESSION);
   if (fed) console.log(`  hub feeds it: undelivered DMs (>${Math.round(Number(process.env.RELAY_DUTY_UNDELIVERED_MS || 600000) / 60000)}m) + overseer warnings.`);
   process.exit(0);   // the seat IS up; a hub that won't feed it is a warning, not a failed start
 }
 
 if (cmd === "down") {
+  const hadKeepalive = existsSync(DUTY_PLIST);
+  // Unload the keepalive FIRST (bootout kills the job's process), then remove the plist so a
+  // reboot cannot resurrect the seat behind a `down`. `up` rewrites both.
+  bootoutDuty();
+  if (hadKeepalive) { try { unlinkSync(DUTY_PLIST); } catch {} }
   const pid = alivePid();
   if (pid) { try { process.kill(pid); } catch {} console.log(`— duty seat stopped (pid ${pid}) —`); }
   else console.log("no duty seat running");
@@ -249,6 +344,18 @@ if (cmd === "down") {
   // Clear the hub's pointer too — escalations aimed at a seat that no longer exists are messages
   // sent into a hole, and the hub has no other way to learn the seat went away.
   await registerDutySeat(fleetHub(), "");
+  // GOING LOUD. A quiet `down` is how the seat sat dead for four days (2026-08-27→31) while every
+  // other surface reported green: nothing errors when the watcher is gone, it just stops watching.
+  // Anyone turning the watcher off must see, in that moment, exactly what they are leaving dark.
+  if (pid || hadKeepalive) {
+    console.log(`
+────────────────────────────────────────────────────────────
+  ⚠️  DUTY IS DOWN. Nobody is watching the fleet now.
+  Undelivered mail and dead seats will go unnudged — last time
+  that silence lasted four days (Aug 27→31) before anyone noticed.
+  Bring it back:  trantor duty up
+────────────────────────────────────────────────────────────`);
+  }
   process.exit(0);
 }
 
@@ -263,6 +370,9 @@ if (cmd === "down") {
   console.log("  and never edits your project files.  Stop it with: trantor duty down");
   console.log("");
   console.log(pid ? `RUNNING (pid ${pid}) as ${SESSION}` : "NOT running");
+  console.log(existsSync(DUTY_PLIST)
+    ? `keepalive: installed (${DUTY_LABEL}${process.platform === "darwin" ? (dutyLoaded() ? ", loaded" : ", not loaded in this session") : ""}) — launchd relaunches the seat after a crash or reboot`
+    : "keepalive: NOT installed — a crash or reboot leaves the seat down (trantor duty up installs it)");
   // A running seat the hub isn't feeding looks identical to a working one from the outside — which
   // is the whole failure mode this command exists to make visible. So ask the hub, don't assume.
   const hub = fleetHub();

package/bin/turn-watchdog.mjs

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+// Turn watchdog (#5684). runTurn is spawnSync — the runner cannot watch its own turn — so this
+// DETACHED helper does: armed at turn start, disarmed by turn end (the stamp file vanishes or
+// its turn number moves on). A turn that runs past the window with NO output growth earns ONE
+// direct stall report to the foreman (episode, never a timer storm), and the turn is never
+// killed — reporting is the whole job. The operator's 2026-08-31 complaint is the incident:
+// seats sat visibly dead in their panes while every signal channel stayed quiet.
+//
+//   node bin/turn-watchdog.mjs <stampFile> <errFile> <windowMs> <session> <project> <hubUrl>
+import { readFileSync, existsSync, statSync } from "node:fs";
+import { hostId } from "../lib/project.mjs";
+import { signedPost } from "../hooks/lib/api.mjs";
+
+const [stampFile, errFile, windowMsRaw, session, project, hub] = process.argv.slice(2);
+const windowMs = Number(windowMsRaw) || 15 * 60 * 1000;   // no floor: drills pass tiny windows, and one report per turn caps the damage anyway
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+const readStamp = () => { try { return JSON.parse(readFileSync(stampFile, "utf8")); } catch { return null; } };
+const errSize = () => { try { return statSync(errFile).size; } catch { return 0; } };
+
+const armed = readStamp();
+if (!armed) process.exit(0);
+let baseline = errSize();
+
+for (;;) {
+  await sleep(windowMs);
+  const s = readStamp();
+  if (!s || s.turn !== armed.turn) process.exit(0);          // turn ended — nothing to say
+  const size = errSize();
+  if (size > baseline + 200) { baseline = size; continue; }  // producing output: working, re-arm
+  const mins = Math.round((Date.now() - (s.startedAt || Date.now())) / 60000);
+  const orch = `${hostId()}:${project}`;
+  const text = `⏱ ${session} turn STALLED — running ${mins}m with no output (turn ${s.turn}). Not killed; check its pane, or \`trantor swap\`.`;
+  // Direct = wake. The foreman first; if this seat IS the foreman's own runner, say it to all.
+  const to = orch === session ? "all" : orch;
+  try { await signedPost(`${hub}/send`, { from: session, to, text, project }, { session }); } catch {}
+  process.exit(0);                                            // one report per turn, by construction
+}

package/hooks/sessionstart.mjs

@@ -441,6 +441,11 @@ try {
   // The hold LAPSES (default 30m) so an unclaimed baton never strands every other session.
   // Any other handoff keeps first-fresh-session-wins.
   const isCompact = source === "compact";
+  // A RESUMED session must never claim a handoff (2026-08-31, twice in one afternoon): it
+  // already carries its whole history, so claiming injects the takeover banner into the same
+  // maxed-out context — the recap LOOKS right while the window never reset, which is worse
+  // than failing loudly. The successor is whatever fresh session `trantor open` starts.
+  const isResume = source === "resume";
   const orchEnv = process.env.TRANTOR_ORCH || "";
   const isOrchPane = !!orchEnv && (orchEnv === "1" || orchEnv === project);   // project-matched: a child claude in another dir must not inherit the badge
   const orchSid = readOrchSession(project);
@@ -450,12 +455,12 @@ try {
   const ageMs = peek ? Date.now() - (Number(peek.stamp) || 0) * 1000 : 0;
   const held = orchOrigin && !isOrchPane && !isCompact && ageMs < holdMs;
   const handoff = !peek ? null
-    : (isCompact || held) ? peek
+    : (isCompact || held || isResume) ? peek
     : loadPendingHandoff(basename(projectDir), {
         claim: true,
         freshSession: { session_id: stdinObj.session_id || "", transcript_path: stdinObj.transcript_path || "" },
       });
-  const claimed = !!handoff && !isCompact && !held;
+  const claimed = !!handoff && !isCompact && !held && !isResume;
   // Follow the thread: claiming the orchestrator's baton makes THIS session the orchestrator
   // thread, so the map `trantor open` resumes and the app's chat reads moves with it. The pane
   // also records itself on every fresh start — that keeps the map honest even if a future
@@ -468,6 +473,13 @@ try {
     additionalContext += `<trantor-handoff-held id="${sanitize(handoff.id)}" from="${sanitize(handoff.machine)}">\n`;
     additionalContext += `🔒 A handoff from this project's ORCHESTRATOR thread is pending, and it is being HELD for the Trantor orchestrator pane (\`trantor open\` claims it on start). This session did NOT claim it and does not have its content — do not act as the successor. If the user wants THIS session to take over instead: \`trantor adopt\`, then restart this session. Unclaimed, the hold lapses in ~${mins} minute(s) and the handoff becomes first-come.\n`;
     additionalContext += `</trantor-handoff-held>\n`;
+  } else if (handoff && isResume) {
+    // No takeover banner here — injecting it into a resumed session is exactly the failure this
+    // guard exists for: the recap reads like a clean handoff while the context never reset.
+    process.stderr.write(`[trantor] pending handoff ${handoff.id} NOT claimed — this session was RESUMED, not started fresh\n`);
+    additionalContext += `<trantor-handoff-unclaimed id="${sanitize(handoff.id)}" reason="resumed-session">\n`;
+    additionalContext += `⚠️ An unclaimed handoff (${sanitize(handoff.id)}) is waiting for this project, but THIS session was RESUMED (\`--resume\`) — it already carries its own history and is NOT the successor. Do not act on the handoff. Tell the user plainly: a fresh session must claim it — \`trantor open\` starts one. If they want THIS resumed session to continue instead, they can ignore the handoff or clear it.\n`;
+    additionalContext += `</trantor-handoff-unclaimed>\n`;
   } else if (handoff) {
     process.stderr.write(`[trantor] ${isCompact ? "showing (not claiming, compact)" : "loaded"} pending handoff ${handoff.id}\n`);
     // Baton claimed → supersede every OTHER instance of this durable identity (instance-keys

package/hooks/statusline.mjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+// USAGE v2 — the Claude statusline sidechannel (docs/RESEARCH-orca-usage.md §1.1).
+// Claude Code >=2.1.80 pipes a JSON blob (with `rate_limits`) into the statusLine command on
+// every turn, piggybacked on the Messages API response — live usage that costs zero API budget.
+// This forwarder reads that stdin, POSTs the windows to the hub's /usage/claude (signed), and
+// prints NOTHING: it is designed to be tee'd ahead of the operator's real statusline command,
+// never to be one. Every failure is swallowed — a usage forwarder must never break a statusline.
+//
+// Floor: one POST per session per 15s (stamp file) — the statusline ticks ~3x/sec while
+// streaming, and the hub dedupes same-value posts inside 30s anyway.
+import { readFileSync, writeFileSync, statSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+
+const FLOOR_MS = 15_000;
+
+async function main() {
+  let raw = "";
+  for await (const c of process.stdin) raw += c;
+  const j = JSON.parse(raw);
+  const rl = j.rate_limits;
+  if (!rl || typeof rl !== "object") return;               // most ticks carry none — free exit
+  const sid = String(j.session_id || j.sessionId || "nosession").replace(/[^A-Za-z0-9_.-]/g, "_").slice(0, 80);
+  const dir = join(homedir(), ".agent-bus");
+  const stamp = join(dir, `usage-claude-${sid}.stamp`);
+  try { if (Date.now() - statSync(stamp).mtimeMs < FLOOR_MS) return; } catch {}
+  try { mkdirSync(dir, { recursive: true }); writeFileSync(stamp, ""); } catch {}
+
+  const payload = {
+    configDir: process.env.CLAUDE_CONFIG_DIR || null,
+    fiveHour: rl.five_hour ?? rl.fiveHour ?? null,
+    sevenDay: rl.seven_day ?? rl.sevenDay ?? null,
+    // The fable/model-scoped window normally arrives via the OAuth poller, but accept the
+    // statusline-shaped variants too — schema drift degrades instead of going dark.
+    fable: rl.fable_weekly ?? rl.fable ?? null,
+  };
+  if (!payload.fiveHour && !payload.sevenDay && !payload.fable) return;
+  // PRIMARY: the local live cache — lib/balances.mjs merges it and skips the OAuth poll while
+  // it is fresh (Orca's isLiveClaudeUsageFresh, docs/RESEARCH-orca-usage.md §2). This is the
+  // path the app's footer actually reads (it shells the local CLI, not the hub).
+  try { writeFileSync(join(dir, "usage-claude-live.json"), JSON.stringify({ ts: Date.now(), ...payload })); } catch {}
+  // SECONDARY, best-effort: the hub copy, for dashboard surfaces that read hub state.
+  const { signedPost } = await import("./lib/api.mjs");
+  await signedPost("/usage/claude", payload, { timeoutMs: 2500 });
+}
+
+main().catch(() => {}).finally(() => process.exit(0));

package/hub.mjs

@@ -437,6 +437,26 @@ setTimeout(overseerTick, 2000).unref?.();
 let DUTY_SESSION = String(process.env.RELAY_DUTY_SESSION || state.dutySession || "");
 const DUTY_UNDELIVERED_MS = Number(process.env.RELAY_DUTY_UNDELIVERED_MS || 10 * 60 * 1000);
 const dutyEscalated = new Set();
+// #5686: the janitor died 08-27 and NOTHING noticed for 4 days — the hub kept escalating to a
+// corpse. Duty liveness is now a first-class state: dark = configured but no heartbeat inside
+// DUTY_DARK_MS. Episode semantics (one event per transition, a standing flag on /health), and
+// while dark, escalations go to the party owed the reply instead of the dead seat.
+const DUTY_DARK_MS = Number(process.env.RELAY_DUTY_DARK_MS || 10 * 60 * 1000);
+let dutyDarkSince = 0;
+// A freshly appointed seat has no heartbeat yet and is NOT a corpse: the dark clock starts at
+// appointment (boot or POST /overseer/duty), so a newborn gets one full window to first-poll.
+let dutySeenFloor = Date.now();
+function dutyLiveness() {
+  if (!DUTY_SESSION) return { configured: false, online: false, lastSeenMs: 0 };
+  const seen = Math.max(state.peers[DUTY_SESSION]?.lastSeen || 0, dutySeenFloor);
+  const lastSeenMs = now() - seen;
+  return { configured: true, online: lastSeenMs < DUTY_DARK_MS, lastSeenMs: Math.max(0, lastSeenMs) };
+}
+function dutyQueuedEscalations() {
+  if (!DUTY_SESSION) return 0;
+  const upTo = state.peers[DUTY_SESSION]?.deliveredUpTo || 0;
+  return state.messages.reduce((n, m) => n + (m.to === DUTY_SESSION && m.id > upTo ? 1 : 0), 0);
+}
 function hubSend(to, text, project) {
   const msg = { id: ++state.seq, ts: now(), from: "hub:duty", to, text: String(text).slice(0, 2000), project: String(project || "").slice(0, 80) };
   state.messages.push(msg); if (state.messages.length > 5000) state.messages.splice(0, 1000);
@@ -446,6 +466,15 @@ function hubSend(to, text, project) {
 }
 function dutyTick() {
   if (!DUTY_SESSION) return;
+  // #5686: track the dark episode BEFORE escalating, so this tick already routes around a corpse.
+  const live = dutyLiveness();
+  if (!live.online && !dutyDarkSince) {
+    dutyDarkSince = now();
+    appendEvent("duty-dark", "", "hub:duty", { text: `duty seat ${DUTY_SESSION} has no heartbeat — seat trouble is not being triaged (trantor duty up)` });
+  } else if (live.online && dutyDarkSince) {
+    appendEvent("duty-back", "", "hub:duty", { text: `duty seat ${DUTY_SESSION} is back after ${Math.round((now() - dutyDarkSince) / 60000)}m dark` });
+    dutyDarkSince = 0;
+  }
   const cutoff = now() - DUTY_UNDELIVERED_MS;
   const floor = now() - 24 * 3600 * 1000;                 // never escalate ancient history
   for (const m of state.messages) {
@@ -460,7 +489,10 @@ function dutyTick() {
     if (dutyEscalated.has(m.id)) continue;
     if ((state.peers[m.to]?.deliveredUpTo || 0) >= m.id) continue;
     dutyEscalated.add(m.id);
-    hubSend(DUTY_SESSION,
+    // #5686: a dark janitor must not eat escalations. Route to the SENDER — the party who
+    // believes they were heard and are owed the reply — with the duty outage named, so the
+    // failure is visible to someone who can act instead of queued on a corpse.
+    hubSend(dutyDarkSince ? m.from : DUTY_SESSION,
       `⚠️ UNDELIVERED for ${Math.round((now() - m.ts) / 60000)}m: #${m.id} ${m.from} -> ${m.to} — "${String(m.text).slice(0, 280)}" — the recipient has not been handed this (recipient last seen ${state.peers[m.to]?.lastSeen ? Math.round((now() - state.peers[m.to].lastSeen) / 60000) + "m ago" : "never"}). Triage: is the recipient's session idle, deaf (wrong hub / old hooks), or gone? Relay, wake, or note it on their board.`,
       m.project || "");
   }
@@ -1549,6 +1581,8 @@ const server = http.createServer(async (req, res) => {
       const session = String(b.session).slice(0, 120);
       DUTY_SESSION = session;
       state.dutySession = session;
+      dutySeenFloor = Date.now();   // #5686: appointment restarts the dark clock — a newborn is not a corpse
+      if (dutyDarkSince) { dutyDarkSince = 0; }   // fresh seat, fresh episode accounting
       dirty = true;
       return json(res, 200, { ok: true, dutySession: DUTY_SESSION });
     }
@@ -1608,6 +1642,29 @@ const server = http.createServer(async (req, res) => {
       if (ts >= (state.balances?.ts || 0)) { state.balances = { ts, by: String(b.by || "").slice(0, 120), entries }; dirty = true; }
       return json(res, 200, { ok: true });
     }
+    // USAGE v2: the Claude statusline sidechannel. Claude Code >=2.1.80 pipes rate_limits into
+    // the statusLine command on every turn; hooks/statusline.mjs forwards it here (floored 15s
+    // client-side). The live windows PATCH the cached balances snapshot — free usage between
+    // `trantor balances` runs, and the poller can skip Claude while liveTs is fresh (Orca's
+    // lesson, docs/RESEARCH-orca-usage.md §1.1: the OAuth endpoint 429s under polling).
+    if (req.method === "POST" && P === "/usage/claude") {
+      const b = await body(req);
+      const win = (w, name) => (w && (w.used_percentage ?? w.utilization) != null)
+        ? { name, usedPct: Math.round(Number(w.used_percentage ?? w.utilization)), resetsAt: w.resets_at ?? null } : null;
+      const wins = [["fiveHour", "5h"], ["sevenDay", "7d"], ["fable", "Fable"]]
+        .map(([k, n]) => win(b[k], n)).filter(Boolean);
+      if (!wins.length) return json(res, 400, { error: "no usable windows" });
+      state.balances ||= { ts: 0, by: "", entries: [] };
+      let e = state.balances.entries.find(x => x.provider === "claude");
+      if (!e) { e = { provider: "claude", label: "Claude", kind: "windows", ok: true, windows: [] }; state.balances.entries.push(e); }
+      // Same-value posts inside 30s are dropped (the statusline ticks ~3x/sec while streaming).
+      const sig = JSON.stringify(wins);
+      if (e._liveSig === sig && now() - (e.liveTs || 0) < 30_000) return json(res, 200, { ok: true, deduped: true });
+      for (const w of wins) { const cur = (e.windows ||= []).find(x => x.name === w.name); if (cur) Object.assign(cur, w); else e.windows.push(w); }
+      e.ok = true; e.liveTs = now(); e._liveSig = sig; e.liveSource = "statusline";
+      dirty = true;
+      return json(res, 200, { ok: true, windows: wins.length });
+    }
     if (req.method === "GET" && P === "/balances") {
       let cfg = {}; try { cfg = JSON.parse(readFileSync(join(homedir(), ".agent-bus", "config.json"), "utf8")); } catch {}
       const low = { USD: 5, CNY: 35, EUR: 5, ...(cfg.lowBalance || {}) };
@@ -2646,7 +2703,9 @@ const server = http.createServer(async (req, res) => {
     if (req.method === "GET" && (P === "/" || P === "/ui")) {
       res.writeHead(200, { "content-type": "text/html; charset=utf-8" }); return res.end(UI || "<h1>trantor</h1><p>dashboard unavailable</p>");
     }
-    if (P === "/health") return json(res, 200, { ok: true, authMode: AUTH_MODE, peers: Object.keys(state.peers).length, messages: state.messages.length, streams: streams.length });
+    if (P === "/health") return json(res, 200, { ok: true, authMode: AUTH_MODE, peers: Object.keys(state.peers).length, messages: state.messages.length, streams: streams.length,
+      // #5686: duty liveness rides /health so the app's Home strip and doctor read one truth.
+      duty: { ...dutyLiveness(), darkSinceMs: dutyDarkSince ? now() - dutyDarkSince : 0, queuedEscalations: dutyQueuedEscalations() } });
     json(res, 404, { error: "not found" });
   } catch (e) { json(res, 500, { error: String(e?.message || e) }); }
 });

package/lib/balances.mjs

@@ -11,6 +11,10 @@
 // ARCHITECTURE NOTE: the hub runs under launchd with a minimal env (no keys), so it can't fetch these
 // itself. The env-having clients fetch + POST /balances; the hub caches + serves the dashboard.
 
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+
 const TIMEOUT = 8000;
 
 async function getJSON(url, key, extraHeaders = {}) {
@@ -40,13 +44,40 @@ export const ADAPTERS = [
     provider: "claude", label: "Claude", kind: "windows", match: ["claude", "anthropic"], envKeys: [],
     keyless: true,
     async fetch() {
+      // USAGE v2: the statusline sidechannel (hooks/statusline.mjs) keeps a live local cache —
+      // Claude Code pipes rate_limits to the statusLine every turn, free. When the OAuth
+      // endpoint fails (it 429s under polling — Orca's lesson, docs/RESEARCH-orca-usage.md
+      // §1.1), a fresh live capture answers instead of an error row. OAuth stays primary
+      // because only it carries the model-scoped (Fable) window.
+      const live = (() => {
+        try {
+          const l = JSON.parse(readFileSync(join(homedir(), ".agent-bus", "usage-claude-live.json"), "utf8"));
+          return l && Date.now() - (l.ts || 0) < 15 * 60 * 1000 ? l : null;
+        } catch { return null; }
+      })();
+      const liveWin = (w, name) => (w && (w.used_percentage ?? w.utilization) != null)
+        ? { name, usedPct: Math.round(Number(w.used_percentage ?? w.utilization)), resetsAt: w.resets_at || null, locked: null }
+        : null;
+      const liveWindows = () => [liveWin(live?.fiveHour, "5h"), liveWin(live?.sevenDay, "7d")].filter(Boolean);
       const tok = await claudeOAuthToken();
-      if (!tok) throw new Error("no Claude Code OAuth token found");
-      const r = await fetch("https://api.anthropic.com/api/oauth/usage", {
-        headers: { authorization: `Bearer ${tok}`, "anthropic-beta": "oauth-2025-04-20" },
-        signal: AbortSignal.timeout(8000),
-      });
-      if (!r.ok) throw new Error(`usage endpoint ${r.status}`);
+      if (!tok) {
+        if (live && liveWindows().length) return { windows: liveWindows(), live: true };
+        throw new Error("no Claude Code OAuth token found");
+      }
+      let r;
+      try {
+        r = await fetch("https://api.anthropic.com/api/oauth/usage", {
+          headers: { authorization: `Bearer ${tok}`, "anthropic-beta": "oauth-2025-04-20" },
+          signal: AbortSignal.timeout(8000),
+        });
+      } catch (e) {
+        if (live && liveWindows().length) return { windows: liveWindows(), live: true };
+        throw e;
+      }
+      if (!r.ok) {
+        if (live && liveWindows().length) return { windows: liveWindows(), live: true };
+        throw new Error(`usage endpoint ${r.status}`);
+      }
       const d = await r.json();
       const win = (w, name) => (w && w.utilization != null)
         ? { name, usedPct: Math.round(w.utilization), resetsAt: w.resets_at || null, locked: w.locked_reason || null }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.19",
+  "version": "0.18.21",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"
@@ -11,7 +11,7 @@
     "zod": "^4.4.3"
   },
   "scripts": {
-    "test": "node bin/slop-gate.mjs --surface desktop/src && node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-redelivery.mjs && node test-crew-completion.mjs && node test-contracts.mjs && node test-autonomy.mjs && node test-integrate.mjs && node test-handoff.mjs && node test-handoff-summarizer.mjs && node test-baton-turn-boundary.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-baton-latest.mjs && node test-balances.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-cardlog.mjs && node test-checklist.mjs && node test-relay-note.mjs && node test-reaper.mjs && node test-events.mjs && node test-proposals.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-message-re.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-duty-seat.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-crew-env.mjs && node test-desktop-transport.mjs && node test-crew-worktree.mjs && bash test-crew-herdr.sh && npm --prefix desktop run test --silent && node test-splitbrain.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-inbox-delivery.mjs && node test-identity-drift.mjs && node test-inbox-staleness.mjs && node test-seats.mjs && node test-seat-identity.mjs && node test-hub-routing.mjs && node test-hook-routing.mjs && node test-relay-wait.mjs && node test-dsh-seat.mjs && node test-kimi-bridge.mjs && node test-kimi-events.mjs && python3 engine/test-routing.py && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && node test-bridge.mjs && bash test-crew.sh"
+    "test": "node bin/slop-gate.mjs --surface desktop/src && node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-redelivery.mjs && node test-crew-completion.mjs && node test-contracts.mjs && node test-autonomy.mjs && node test-integrate.mjs && node test-handoff.mjs && node test-handoff-summarizer.mjs && node test-baton-turn-boundary.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-baton-latest.mjs && node test-balances.mjs && node test-usage-live.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-cardlog.mjs && node test-checklist.mjs && node test-relay-note.mjs && node test-reaper.mjs && node test-events.mjs && node test-proposals.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-message-re.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-duty-dark.mjs && node test-duty-seat.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-crew-env.mjs && node test-desktop-transport.mjs && node test-crew-worktree.mjs && bash test-crew-herdr.sh && npm --prefix desktop run test --silent && node test-splitbrain.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-inbox-delivery.mjs && node test-identity-drift.mjs && node test-inbox-staleness.mjs && node test-seats.mjs && node test-seat-identity.mjs && node test-hub-routing.mjs && node test-hook-routing.mjs && node test-relay-wait.mjs && node test-dsh-seat.mjs && node test-kimi-bridge.mjs && node test-kimi-events.mjs && python3 engine/test-routing.py && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && node test-bridge.mjs && bash test-crew.sh"
   },
   "description": "The hub-world for AI agent crews \u2014 orchestrate Claude Code, Codex, GLM, Kimi, DeepSeek & any OpenRouter model as live crews with a plan-aware Advisor, a Kanban/flow command center, a testing gate, and an economics brain (Scrooge).",
   "files": [