trantor 0.18.31 → 0.18.33

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.28",
+  "version": "0.18.33",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/baton.mjs

@@ -1,16 +1,42 @@
 #!/usr/bin/env node
-// `trantor handoff` — one-command manual baton (auto-summary variant). Discovers the current session's
-// transcript, writes a whole-session handoff (auto-summary + verbatim in-flight tail), opens a fresh
-// self-announcing session, and closes THIS window once it takes over. Run from inside the session you
-// want to hand off. (The richer MODEL-authored handoff is the /trantor:handoff skill.)
-import { readdirSync, statSync } from "node:fs";
-import { join, basename } from "node:path";
+// `trantor handoff` — one-command manual baton. Discovers the current session's transcript, writes
+// a whole-session handoff (auto-summary + verbatim in-flight tail), opens a fresh self-announcing
+// session, and closes THIS window once it takes over. Run from inside the session you want to hand
+// off. (The richer MODEL-authored handoff is the /trantor:handoff skill.)
+import { readdirSync, statSync, fstatSync } from "node:fs";
+import { join, basename, dirname } from "node:path";
 import { homedir } from "node:os";
-import { resolveProject } from "../lib/project.mjs";
-import { writeHandoff, spawnBaton } from "../hooks/lib/handoff.mjs";
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { writeHandoff, spawnBaton, resolveHandoffSurface } from "../hooks/lib/handoff.mjs";
 
+// #6074: the skill path (write-handoff.mjs) and this CLI path must share ONE resolution of which
+// project this is and where the session lives. Both call resolveHandoffSurface; the name comes
+// from the session's registration (TRANTOR_ORCH / RELAY_PROJECT / orch-sessions.txt) before the
+// cwd — a subfolder cwd never renames the project.
 const cwd = process.cwd();
-const project = resolveProject(cwd);
+const resolved = resolveHandoffSurface({ projectDir: process.env.CLAUDE_PROJECT_DIR || cwd, sessionId: process.env.CLAUDE_SESSION_ID || "" });
+const project = resolved.project;
+
+// Model-authored handoffs ride THIS binary too (`trantor handoff` — always the global install's
+// CURRENT code, never the plugin-cache copy a session booted with, the stale-0.18.20 bug). A piped
+// stdin (a heredoc, a cat, `<<HANDOFF`) means "here is the handoff markdown" — exactly the skill's
+// contract — so forward to write-handoff.mjs in the SAME package (same version, same resolution)
+// and exit with its status. --latest forwards too. A true pipe is a FIFO; a TTY and /dev/null are
+// character devices, so a plain `trantor handoff` typed at a prompt (or run by a hook with stdin
+// at /dev/null) keeps the auto-summary behavior. Detection must NOT be `!process.stdin.isTTY` —
+// that misreads /dev/null as a handoff and errors where auto-summary used to work.
+function stdinIsPipe() {
+  try { return fstatSync(0).isFIFO(); } catch { return false; }
+}
+if (stdinIsPipe() || process.argv.includes("--latest")) {
+  const helper = join(dirname(fileURLToPath(import.meta.url)), "write-handoff.mjs");
+  const child = spawn(process.execPath, [helper, ...process.argv.slice(2)], { stdio: ["inherit", "inherit", "inherit"] });
+  child.on("exit", (c) => process.exit(c ?? 1));
+  child.on("error", () => process.exit(1));
+} else {
+  autoBaton();
+}
 
 // The active session's transcript = newest *.jsonl directly in this project's Claude dir
 // (~/.claude/projects/<cwd-with-slashes-as-dashes>/), excluding the subagents/ subtree.
@@ -29,20 +55,22 @@ function findTranscript() {
   return best;
 }
 
-const transcript = findTranscript();
-// The transcript's filename IS the writing session's id — record it, or an orchestrator-thread
-// handoff carries no writer and the baton-hold + map-follow logic in sessionstart.mjs can't fire.
-const sessionId = transcript ? basename(transcript, ".jsonl") : "";
-const { file } = writeHandoff({ projectDir: cwd, sessionId, transcript, trigger: "manual-cli", force: true });   // manual = intentional, bypass the storm guard
-console.log(`📋 handoff saved for ${project}: ${file}`);
-// --write-only: the in-app flow (#5509). The app ends the pane's session itself and reopens it
-// through `trantor open`, which claims this handoff — a Terminal window here would be exactly the
-// wrong surface, so the flag writes, announces, and stops.
-if (process.argv.includes("--write-only")) {
-  console.log(`🔄 write-only: no window spawned — the pane takeover (trantor open) claims it next.`);
-  process.exit(0);
+function autoBaton() {
+  const transcript = findTranscript();
+  // The transcript's filename IS the writing session's id — record it, or an orchestrator-thread
+  // handoff carries no writer and the baton-hold + map-follow logic in sessionstart.mjs can't fire.
+  const sessionId = transcript ? basename(transcript, ".jsonl") : "";
+  const { file } = writeHandoff({ projectDir: cwd, sessionId, transcript, trigger: "manual-cli", force: true, projectName: project });   // manual = intentional, bypass the storm guard
+  console.log(`📋 handoff saved for ${project}: ${file}`);
+  // --write-only: the in-app flow (#5509). The app ends the pane's session itself and reopens it
+  // through `trantor open`, which claims this handoff — a Terminal window here would be exactly the
+  // wrong surface, so the flag writes, announces, and stops.
+  if (process.argv.includes("--write-only")) {
+    console.log(`🔄 write-only: no window spawned — the pane takeover (trantor open) claims it next.`);
+    process.exit(0);
+  }
+  const { spawned, armed, windowId } = spawnBaton({ projectDir: cwd, handoffFile: file });
+  console.log(spawned
+    ? `🔄 baton: a fresh session is opening (it'll recap the handoff)${armed ? ` — this window (${windowId}) closes once it takes over` : " — couldn't detect this window; close it yourself once the new one is up"}`
+    : `handoff saved, but couldn't spawn a fresh session (non-macOS or spawn disabled) — open a new session here to take over`);
 }
-const { spawned, armed, windowId } = spawnBaton({ projectDir: cwd, handoffFile: file });
-console.log(spawned
-  ? `🔄 baton: a fresh session is opening (it'll recap the handoff)${armed ? ` — this window (${windowId}) closes once it takes over` : " — couldn't detect this window; close it yourself once the new one is up"}`
-  : `handoff saved, but couldn't spawn a fresh session (non-macOS or spawn disabled) — open a new session here to take over`);

package/bin/connect.mjs

@@ -40,6 +40,10 @@ function patchJson(path, mutate) {
 // while its runner sat on the pinned one — the residual split-brain mechanism (2026-08-20).
 // mcp.mjs resolves the hub from the session's project pin; that resolution must stay in charge.
 const relayEnv = (agent) => ({ RELAY_AGENT: agent });
+// OpenCode hosts several differently-named seats. Its global MCP environment must not stamp all
+// of them "opencode": ambient runner identity wins, while this fallback names a normal interactive
+// OpenCode session that has no RELAY_AGENT/RELAY_SESSION of its own.
+const hostedRelayEnv = (agent) => ({ RELAY_AGENT_FALLBACK: agent });
 
 // ---- Claude Code: plugin handles it; verify only ----
 if (has("claude")) {
@@ -87,7 +91,13 @@ if (has("opencode")) {
   report("opencode", patchJson(p, d => {
     d.$schema ||= "https://opencode.ai/config.json";
     d.mcp ||= {};
-    d.mcp.relay ||= { type: "local", command: ["node", MCP], enabled: true, environment: relayEnv("opencode") };
+    d.mcp.relay ||= { type: "local", command: ["node", MCP], enabled: true };
+    d.mcp.relay.environment ||= {};
+    // Migrate the old generated pin too: `||=` alone left RELAY_AGENT=opencode in every existing
+    // config forever, where OpenCode overlaid it on the qwen/glm/deepseek runner environment.
+    delete d.mcp.relay.environment.RELAY_AGENT;
+    delete d.mcp.relay.environment.RELAY_SESSION;
+    Object.assign(d.mcp.relay.environment, hostedRelayEnv("opencode"));
   }), p);
 }
 

package/bin/crew-runner.mjs

@@ -358,7 +358,7 @@ async function reportFailure(exit, trigger, undelivered = 0) {
   const reason = classify(exit);
   const down = consecFails >= 2;
   const status = down ? `down: ${reason} · ${consecFails} fails` : `errored: ${reason}`;
-  await api("/register", { session: SESSION, project: PROJ, status, llm: AGENT, model: MODEL }).catch(() => {});
+  await api("/register", { session: SESSION, project: PROJ, status, llm: AGENT, model: MODEL, kind: "agent" }).catch(() => {});
   const hint = reason === "exhausted" ? " — needs `trantor swap`"
     : reason === "auth" ? " — check credentials"
     : reason === "backend-error" ? " — provider backend error (NOT quota): retry, or `trantor swap` to another provider"
@@ -382,13 +382,13 @@ async function reportFailure(exit, trigger, undelivered = 0) {
   const state = `${down ? "down" : "error"}:${reason}`;
   if (state !== announced) {
     announced = state;
-    await api("/send", { from: SESSION, to: "all", text, project: PROJ }).catch(() => {});
+    await api("/send", { from: SESSION, to: "all", text, project: PROJ, kind: "status" }).catch(() => {});
     // #5684: a broadcast does not wake anyone — the incident is the operator spotting dead seats
     // before the foreman did, twice in one morning. The same state-change event now goes DIRECT
     // to the project's orchestrator (direct = wake), gated identically so a standing outage says
     // it once. A seat that IS the orchestrator's own runner has nobody above it to wake.
     const orch = `${hostId()}:${PROJ}`;
-    if (orch !== SESSION) await api("/send", { from: SESSION, to: orch, text, project: PROJ }).catch(() => {});
+    if (orch !== SESSION) await api("/send", { from: SESSION, to: orch, text, project: PROJ, kind: "alert" }).catch(() => {});
   } else {
     log(`still ${state} (${consecFails} fails) — already announced, staying quiet`);
   }
@@ -434,7 +434,7 @@ async function notifyAssigners(pairs, text) {
     seen.add(f);
     // `re` threads this outcome to the exact contract it answers, so the sender's ledger closes the
     // right one instead of guessing from timing.
-    const payload = { from: SESSION, to: f, text: text.slice(0, 280), project: PROJ };
+    const payload = { from: SESSION, to: f, text: text.slice(0, 280), project: PROJ, kind: "receipt" };
     if (id) payload.re = id;
     await api("/send", payload).catch(() => {});
   }
@@ -446,8 +446,8 @@ async function reportHealthy() {
   consecFails = 0;
   // Recovery is a change too, so the next failure is news again.
   announced = "";
-  await api("/register", { session: SESSION, project: PROJ, status: `active in ${PROJ}`, llm: AGENT, model: MODEL }).catch(() => {});
-  await api("/send", { from: SESSION, to: "all", text: `✅ ${SESSION} recovered`, project: PROJ }).catch(() => {});
+  await api("/register", { session: SESSION, project: PROJ, status: `active in ${PROJ}`, llm: AGENT, model: MODEL, kind: "agent" }).catch(() => {});
+  await api("/send", { from: SESSION, to: "all", text: `✅ ${SESSION} recovered`, project: PROJ, kind: "status" }).catch(() => {});
   cmuxStatus("ok", "#14b8a6", "check"); herdrAgent("idle");
 }
 
@@ -512,7 +512,7 @@ async function runTurn(prompt, isFirst, trigger = "kickoff") {
   } catch {}
   const r = spawnSync("/bin/bash", ["-c", `set -o pipefail; { ${inner} ; } 2> >(${SCRUB} --tee2 ${ERRF})`], {
     cwd: TURN_DIR, encoding: "utf8", stdio: cli.sid ? ["ignore", "pipe", "inherit"] : "inherit",
-    env: { ...process.env, RELAY_URL: HUB, RELAY_AGENT: AGENT, RELAY_PROJECT: PROJ,
+    env: { ...process.env, RELAY_URL: HUB, RELAY_AGENT: AGENT, RELAY_SESSION: SESSION, RELAY_PROJECT: PROJ,
       // A RUNNER-MANAGED SEAT MUST NEVER HAND ITSELF A BATON.
       //
       // The handoff machinery exists for an INTERACTIVE session: near its context limit it writes a
@@ -617,12 +617,67 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
   return built.prompt;
 }
 
+const RECEIPT_MARKER = "✅ done on";
+const CARD_REF_RE = /#\d{1,7}(?!\d)/;
+
+// Runner-authored metadata is bus state, not work. Typed messages are authoritative; `re` and the
+// stable text marker keep a mixed-version crew safe while older runners are still on the bus.
+function isReceipt(message) {
+  const text = String(message?.text || "").trimStart();
+  return message?.kind === "receipt" || Number(message?.re) > 0 || text.startsWith(RECEIPT_MARKER);
+}
+
+function isStatusBroadcast(message) {
+  if (message?.to !== "all") return false;
+  if (message?.kind === "status") return true;
+  const text = String(message?.text || "").trim();
+  return /^[A-Za-z0-9_.-]+ reporting — ready for a contract\b/.test(text)
+    || /^[✅⚠️🛑]\s+\S+\s+(?:recovered|turn FAILED|DOWN)\b/.test(text);
+}
+
+function isContract(message) {
+  const text = String(message?.text || "");
+  return message?.kind === "contract" || /^\s*contract\s*:/i.test(text) || CARD_REF_RE.test(text);
+}
+
+function isRunnerSession(session) {
+  const suffix = `:${PROJ}`;
+  const name = String(session || "");
+  if (!name.endsWith(suffix)) return false;
+  const label = name.slice(0, -suffix.length);
+  // Crew labels are CLI/provider slugs. Host sessions keep their machine-style identity and remain
+  // valid direct assigners; runner-to-runner prose needs `contract:` or a card reference.
+  return /^[a-z0-9_.-]+$/.test(label) && !label.startsWith("hub:");
+}
+
+function shouldWake(message) {
+  if (isReceipt(message) || isStatusBroadcast(message)) return false;
+  if (message?.to === SESSION) {
+    if (message?.kind === "status") return false;
+    return !isRunnerSession(message?.from) || isContract(message);
+  }
+  return message?.to === "all"
+    && isContract(message)
+    && (message.text.includes(`@${AGENT}`) || message.text.toLowerCase().includes(`${AGENT}:`));
+}
+
+function askedExcerpt(message) {
+  let text = String(message?.text || "").replace(/\s+/g, " ").trim();
+  const nested = text.search(/\s+[·|]\s*asked\s*:/i);
+  if (nested >= 0) text = text.slice(0, nested).trim();
+  return text.slice(0, 120);
+}
+
 (async () => {
   await loadLessons();
   // start cursor at the CURRENT tip so we don't replay history
   let cursor = 0;
   try { const r = await api(`/inbox?session=${encodeURIComponent(SESSION)}&since=0`); cursor = r.cursor || 0; } catch {}
-  await api("/register", { session: SESSION, project: PROJ, status: "crew member booting", llm: AGENT, model: MODEL }).catch(() => {});
+  // kind "agent" on every beat (#6075): the peer row's kind is the hub's OWN record of what a
+  // session is — the overseer's declared-crew exemption reads it, and on the remote hub there is
+  // no crew-windows.txt to fall back to. /register preserves absent fields, so a seat running an
+  // older runner never loses a kind an updated one stamped.
+  await api("/register", { session: SESSION, project: PROJ, status: "crew member booting", llm: AGENT, model: MODEL, kind: "agent" }).catch(() => {});
   // Announce runner-side, signed as THIS seat. Asking the seat to announce itself sent glm's hello
   // out under deepseek's identity whenever opencode seats shared one MCP daemon (lesson on the bus,
   // 2026-07-29): the runner process is per-seat by construction, so its signature cannot be borrowed.
@@ -631,7 +686,7 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
     const { loadOrCreate } = await import("../lib/identity.mjs");
     await sfetchJson(`${HUB}/send`, {
       identity: loadOrCreate(SESSION, "agent"),
-      payload: { from: SESSION, to: "all", project: PROJ, text: `${AGENT} reporting — ready for a contract${MODEL ? ` (${MODEL})` : ""}` },
+      payload: { from: SESSION, to: "all", project: PROJ, kind: "status", text: `${AGENT} reporting — ready for a contract${MODEL ? ` (${MODEL})` : ""}` },
       signal: AbortSignal.timeout(2500),
     });
   } catch {}
@@ -640,8 +695,8 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
   // broadcasts batched behind them. Restored from disk first: a runner that was killed mid-turn
   // (or a machine that rebooted) still owes those messages, and the hub will never send them again.
   const restored = loadPending();
-  let pendingWake = restored.wake;
-  let pendingBcast = restored.bcast;
+  let pendingWake = restored.wake.filter(shouldWake);
+  let pendingBcast = restored.bcast.filter(m => !isReceipt(m) && !isStatusBroadcast(m));
   let retryAt = 0;            // 0 = deliver at the next opportunity
   let deliveryFails = 0;      // consecutive failed attempts at the SAME pending batch
   if (pendingWake.length) log(`\x1b[33m${pendingWake.length} message(s) survived from a previous run — redelivering\x1b[0m`);
@@ -675,7 +730,12 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
     let msgs = [];
     try {
       const r = await api(`/poll?session=${encodeURIComponent(SESSION)}&since=${cursor}&wait=${holdS}`);
-      msgs = r.messages || []; cursor = r.cursor ?? cursor;
+      msgs = r.messages || [];
+      if (r.cursor !== undefined && r.cursor !== null && Number.isFinite(Number(r.cursor))) {
+        const reportedCursor = Number(r.cursor);
+        if (reportedCursor < cursor) log(`cursor rewound by hub ${cursor} -> ${reportedCursor}`);
+        cursor = reportedCursor;
+      }
     } catch (e) {
       // Deadline-abort on the LONG-POLL is not an outage — it means the hold expired with no hub
       // response (stalled event loop, napped machine, dead socket). Reconnect immediately and say
@@ -688,6 +748,10 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
     // never wake on your own broadcasts: a claude seat's report contains "claude:" and matched the
     // @mention filter, buying one echo turn per report (seen live on the first pulsed orchestrator)
     msgs = msgs.filter(m => m.from !== SESSION);
+    // A receipt is the terminal state of a contract, never a new contract. Consume typed receipts,
+    // reply-linked outcomes, and the old stable marker before direct-address logic sees them. Status
+    // broadcasts are presence chatter and are dropped rather than saved as future prompt context.
+    msgs = msgs.filter(m => !isReceipt(m) && !isStatusBroadcast(m));
     // #5760 (the night of 08-31): the hub's hourly "same-project-sessions" FYI woke every seat
     // into a real CLI turn — three wedged for hours mid-chatter, one on the metered pool. That
     // kind is pure coordination CONTEXT ("no human needs to relay this" — and no turn needs to
@@ -695,8 +759,8 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
     // warnings still wake — those are actionable by the seat right now.
     const fyi = msgs.filter(m => m.from === "hub:duty" && String(m.text || "").startsWith("🤝 OVERSEER same-project-sessions"));
     const rest = msgs.filter(m => !fyi.includes(m));
-    const direct = rest.filter(m => m.to === SESSION);
-    const mentions = rest.filter(m => m.to === "all" && (m.text.includes(`@${AGENT}`) || m.text.toLowerCase().includes(`${AGENT}:`)));
+    const direct = rest.filter(m => m.to === SESSION && shouldWake(m));
+    const mentions = rest.filter(m => m.to === "all" && shouldWake(m));
     const bcast = [...rest.filter(m => m.to === "all" && !mentions.includes(m)), ...fyi];
     pendingBcast.push(...bcast);                      // wake-policy: plain broadcasts batch, they don't wake
     const wake = [...direct, ...mentions];
@@ -708,7 +772,7 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
       const dropped = pendingWake.splice(0, pendingWake.length - PENDING_MAX);
       log(`\x1b[31mundelivered queue overflowed — dropped ${dropped.length} oldest message(s)\x1b[0m`);
       await api("/send", { from: SESSION, to: "all", project: PROJ,
-        text: `⚠️ ${SESSION} dropped ${dropped.length} undelivered message(s) — queue hit its ${PENDING_MAX} cap during a failure streak` }).catch(() => {});
+        kind: "status", text: `⚠️ ${SESSION} dropped ${dropped.length} undelivered message(s) — queue hit its ${PENDING_MAX} cap during a failure streak` }).catch(() => {});
     }
     savePending(pendingWake, pendingBcast);
     // Respect an active backoff: a new message during an outage joins the batch, it does not
@@ -741,7 +805,7 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
     // Who is owed an answer, captured BEFORE the turn: pendingWake is cleared on success.
     const assigners = [];
     for (const m of wake) if (m.from && !assigners.some(a => a.from === m.from)) assigners.push({ from: m.from, id: m.id });
-    const asked = String(wake[0]?.text || "").replace(/\s+/g, " ").trim().slice(0, 90);
+    const asked = askedExcerpt(wake[0]);
     const tStart = Date.now();
     const prompt = composedTurn({
       wakeText, ctxText, againText,

package/bin/crew.sh

@@ -352,7 +352,7 @@ spawn_herdr() {   # $@ = specs
   local surfs=()
   [ -n "$REUSE_WS" ] && wsid="$REUSE_WS"
   for SPEC in "$@"; do
-    resolve_spec "$SPEC"
+    resolve_spec "$SPEC" || continue
     local cmd; cmd="$(RUN_CMD)"
     if [ -n "$REUSE_WS" ]; then
       # replace-in-place: split the fresh pane FIRST (targeting the agent's old pane when tracked),
@@ -743,11 +743,19 @@ resolve_model() {
   else
     out="$(python3 "$SCROOGE" route --provider "$provider" -t "$task" -d "$diff" --json 2>/dev/null)"
   fi
-  [ -n "$out" ] || { echo "[crew] live model selection failed for $agent:$provider — refusing opencode global default" >&2; return 1; }
-  out="$(printf '%s' "$out" | python3 -c 'import json,sys
+  if [ -n "$out" ]; then
+    out="$(printf '%s' "$out" | python3 -c 'import json,sys
 try: print(json.load(sys.stdin).get("qualified") or "")
 except Exception: pass' 2>/dev/null)"
-  [ -n "$out" ] || { echo "[crew] router returned no model for $agent:$provider — refusing opencode global default" >&2; return 1; }
+  fi
+  # The router can be absent (a fresh machine, a dry run, scrooge without its registry). That must
+  # never hand the seat to opencode's GLOBAL default (#6068, the DeepSeek bill) and must not drop
+  # the seat either (#6110): fall back INSIDE the provider — the head of its own catalog — and say so.
+  if [ -z "$out" ] && [ -n "$cands" ]; then
+    out="$provider/${cands%% *}"
+    echo "[crew] router unavailable for $agent:$provider — using the provider's own catalog head ($out)" >&2
+  fi
+  [ -n "$out" ] || { echo "[crew] live model selection failed for $agent:$provider — no router and no catalog; refusing opencode global default" >&2; return 1; }
   [ "${out%%/*}" = "$provider" ] || {
     echo "[crew] router selected $out outside $provider — refusing cross-provider fallback" >&2
     return 1
@@ -758,7 +766,11 @@ except Exception: pass' 2>/dev/null)"
 epoch_ms() { python3 -c 'import time;print(int(time.time()*1000))'; }
 
 # resolve_spec <spec> -> sets AGENT + MODEL globals (live-selects a provider-only spec).
-AGENT=""; MODEL=""
+# On failure, returns 1 (AGENT is still set; MODEL is empty) instead of exiting the whole script —
+# callers are responsible for skipping that one seat and continuing the batch. SKIPPED_SEATS
+# accumulates "agent: reason" entries across every spawn path so `up` can report + exit non-zero
+# at the end without killing seats that already launched earlier in the loop.
+AGENT=""; MODEL=""; SKIPPED_SEATS=()
 resolve_spec() {
   local SPEC="$1" FIELD
   AGENT="${SPEC%%:*}"; MODEL=""
@@ -780,11 +792,26 @@ resolve_spec() {
   if [ -n "$FIELD" ]; then
     case "$FIELD" in
       */*) MODEL="$FIELD" ;;
-      *)   MODEL="$(resolve_model "$AGENT" "$FIELD" "$TASK" "$DIFF")" || exit 1
+      *)   MODEL="$(resolve_model "$AGENT" "$FIELD" "$TASK" "$DIFF")" || {
+             echo "[crew] ✗ skipping seat '$AGENT' — model resolution failed for $FIELD ($TASK/$DIFF); remaining seats still launch" >&2
+             SKIPPED_SEATS+=("$AGENT: model resolution failed for $FIELD ($TASK/$DIFF)")
+             return 1
+           }
            echo "  → $AGENT: live model $MODEL ($FIELD · $TASK/$DIFF)" ;;
     esac
   fi
 }
+# report_skipped_seats: prints a summary of every seat resolve_spec skipped this run (if any) and
+# returns 1 so callers can propagate a non-zero exit — the whole point is that a batch with some
+# skips still launched the rest of the crew, so this is a REPORT, not an abort.
+report_skipped_seats() {
+  [ "${#SKIPPED_SEATS[@]}" -gt 0 ] || return 0
+  echo ""
+  echo "✗✗ ${#SKIPPED_SEATS[@]} seat(s) skipped (model resolution failed) — the rest of the crew still launched:"
+  local s
+  for s in "${SKIPPED_SEATS[@]}"; do echo "   - $s"; done
+  return 1
+}
 # Kill any runner ALREADY serving this exact agent+project before starting another.
 #
 # Without this, `trantor up <agent>` ADDS a runner instead of replacing one — and every duplicate
@@ -816,7 +843,7 @@ spawn_tmux() {   # $@ = specs
   # a pre-existing session for THIS project = the crew is already up; add missing seats as new panes.
   tmux has-session -t "$TMUX_SESS" 2>/dev/null && first=0
   for SPEC in "$@"; do
-    resolve_spec "$SPEC"
+    resolve_spec "$SPEC" || continue
     local cmd; cmd="$(RUN_CMD)"
     local pane=""
     if [ "$first" = "1" ]; then
@@ -867,7 +894,7 @@ spawn_grid() {   # $@ = specs
   local ROWS=$(( (N + COLS - 1) / COLS ))
   local CW=$(( GW / COLS )) CH=$(( GH / ROWS )) i=0 SPEC
   for SPEC in "$@"; do
-    resolve_spec "$SPEC"
+    resolve_spec "$SPEC" || continue
     local cmd; cmd="$(RUN_CMD)"
     local C=$(( i % COLS )) R=$(( i / COLS )) X1 Y1 WID=""
     X1=$(( GX + C * CW )); Y1=$(( GY + R * CH ))
@@ -952,7 +979,7 @@ spawn_cmux() {   # $@ = specs
   local surfs=()
   [ -n "$REUSE_WS" ] && wsid="$REUSE_WS"
   for SPEC in "$@"; do
-    resolve_spec "$SPEC"
+    resolve_spec "$SPEC" || continue
     local cmd launcher; cmd="$(RUN_CMD)"; launcher="$(_seat_launcher "$AGENT" "$cmd")"
     if [ -n "$REUSE_WS" ]; then
       # replace-in-place: split the fresh pane FIRST (targeting the agent's old pane when tracked),
@@ -1054,7 +1081,7 @@ OSA
   fi
   [ -n "$REUSE_TAB" ] && { tabid="$REUSE_TAB"; echo "  → reusing existing crew workspace for $PROJ ($tabid)"; }
   for SPEC in "$@"; do
-    resolve_spec "$SPEC"
+    resolve_spec "$SPEC" || continue
     local cmd launcher; cmd="$(RUN_CMD)"; launcher="$(_seat_launcher "$AGENT" "$cmd")"
     # In REUSE mode, replace-in-place: split off the agent's old terminal when tracked, close it after.
     local OLD_SURF=""
@@ -1175,7 +1202,11 @@ echo "— bringing up crew for $PROJ ($CREW_UI) —"
 SPAWN_EPOCH=$(epoch_ms)
 spawn_crew "$@"
 
-if [ "$DRY" = "1" ]; then echo "— dry run: no bus verify —"; exit 0; fi
+if [ "$DRY" = "1" ]; then
+  echo "— dry run: no bus verify —"
+  report_skipped_seats
+  exit $?
+fi
 echo "— verifying on the bus (the spawn is not the truth; the bus is) —"
 AGENTS_ONLY=$(for a in "$@"; do printf "%s " "${a%%:*}"; done)
 VER=$(node "$BUS_DIR/bin/crew-verify.mjs" "$PROJ" $AGENTS_ONLY --since "$SPAWN_EPOCH" --timeout 30)
@@ -1196,3 +1227,5 @@ if [ -n "${RETRY// }" ]; then
   fi
 fi
 echo "— crew verified on the bus. Send contracts with relay_send; runners keep agents alive for free. Teardown (this project only): trantor down —"
+report_skipped_seats
+exit $?

package/bin/new.mjs

@@ -129,8 +129,14 @@ try {
   // way crew seats do: the operator's owner key mints a project-scoped write invite and the genesis
   // identity spends it. Only when NO owner key is configured (a loopback hub with no owner identity)
   // do we fall back to the plain TOFU enroll.
-  const viaOwner = await enrollViaOwnerInvite(hub, identity, name, { timeoutMs: 8000 });
-  if (!viaOwner.ok && viaOwner.reason === "no-owner-key") await enrollTofu(session, identity, name);
+  const viaOwner = await enrollViaOwnerInvite(hub, identity, name, { timeoutMs: 8000, kind: "tool" });
+  if (!viaOwner.ok && viaOwner.reason === "no-owner-key") await enrollTofu(session, identity, name, { kind: "tool" });
+  else if (!viaOwner.ok) console.error(`genesis: enrollment via owner invite failed: ${viaOwner.reason}`);
+  // #6068: say WHAT this session is. The genesis identity exists to post the brief — without a
+  // kind on its peer row the app's seat strip renders it as a seat ("no terminal pane — start it
+  // with trantor up genesis"). /register is presence, not speech: no message rides it, nobody
+  // wakes. The hub stamps kind on the session row and /peers returns it to the app.
+  await signedPost("/register", { session, kind: "tool" }, { session, project: name, timeoutMs: 8000 }).catch(() => {});
   const briefForHub = (brief || `Genesis of ${name} — created by trantor new.`).slice(0, 600);
   const r1 = await signedPost("/project", { project: name, brief: briefForHub, by: session }, { session, project: name, timeoutMs: 8000 });
   if (!r1.ok) throw new Error(`hub ${r1.status} on /project${r1.json?.error ? `: ${r1.json.error}` : ""}`);

package/bin/write-handoff.mjs

@@ -6,7 +6,7 @@ import { writeFileSync, readFileSync, existsSync, mkdirSync, readdirSync } from
 import { join, basename } from "node:path";
 import { homedir, hostname } from "node:os";
 import { execSync } from "node:child_process";
-import { spawnBaton, handoffMode } from "../hooks/lib/handoff.mjs";
+import { spawnBaton, handoffMode, resolveHandoffSurface } from "../hooks/lib/handoff.mjs";
 import { handoffDir } from "../lib/project.mjs";
 
 const baton = process.argv.includes("--baton");
@@ -14,8 +14,14 @@ const baton = process.argv.includes("--baton");
 // fresh one on stdin", so a session that had just written a 5KB handoff had to write it again to
 // hand it over — 2m28s of regenerated prose on a live scribe session, 2026-08-24.
 const latest = process.argv.includes("--latest");
-const project = process.env.CLAUDE_PROJECT_DIR || process.cwd();
-const name = basename(project);
+// #6074: ONE resolver for which project this is and where the session lives — shared with
+// bin/baton.mjs (the `trantor handoff` CLI path) so the two cannot diverge. The name comes from
+// the session's registration (TRANTOR_ORCH / RELAY_PROJECT / orch-sessions.txt) before the cwd;
+// the witnessed crebral-scribe/ios handoff recorded project "ios" from a subfolder cwd and never
+// found its pane.
+const resolved = resolveHandoffSurface({ sessionId: process.env.CLAUDE_SESSION_ID || "" });
+const project = resolved.projectDir;
+const name = resolved.project;
 let summary = "";
 if (!latest) {
   process.stdin.setEncoding("utf8");

package/deploy/restart-hub.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+# Guarded production restart: an unhealthy durable writer means RAM contains the only current copy.
+set -euo pipefail
+
+FORCE=0
+if [ "${1:-}" = "--force" ]; then
+  FORCE=1
+  shift
+fi
+if [ "$#" -ne 0 ]; then
+  echo "usage: deploy/restart-hub.sh [--force]" >&2
+  exit 2
+fi
+
+# The hub binds RELAY_HOST (the tailnet IP on netcup, where 127.0.0.1 refuses), so the guard reads the
+# same env the service does; RELAY_HUB_URL still overrides.
+ENV_FILE="${RELAY_ENV_FILE:-$(dirname "$0")/hub.env}"
+if [ -f "$ENV_FILE" ]; then
+  # shellcheck disable=SC1090
+  set -a; . "$ENV_FILE"; set +a
+fi
+HUB_URL="${RELAY_HUB_URL:-http://${RELAY_HOST:-127.0.0.1}:${RELAY_PORT:-4477}}"
+HEALTH=""
+if HEALTH="$(curl --fail --silent --show-error --max-time 5 "$HUB_URL/health")"; then
+  REFUSAL="$(node --input-type=module -e '
+    const chunks = [];
+    for await (const chunk of process.stdin) chunks.push(chunk);
+    let health;
+    try { health = JSON.parse(Buffer.concat(chunks).toString("utf8")); }
+    catch { process.stdout.write("hub health response was not valid JSON"); process.exit(0); }
+    const p = health.persist;
+    if (!p || p.ok !== false) process.exit(0);
+    const age = Number(p.failingSinceMs || 0);
+    const span = age >= 60000 ? `${Math.floor(age / 60000)}m ${Math.floor((age % 60000) / 1000)}s` : `${Math.floor(age / 1000)}s`;
+    process.stdout.write(`hub persistence has failed for ${span} (${Number(p.retries || 0)} retries): ${String(p.lastError || "unknown error")}. Restarting risks losing every state change since persistence stopped.`);
+  ' <<<"$HEALTH")"
+  if [ -n "$REFUSAL" ] && [ "$FORCE" -ne 1 ]; then
+    echo "REFUSED: $REFUSAL" >&2
+    echo "Resolve persistence first, or rerun with --force to accept the data-loss risk." >&2
+    exit 1
+  fi
+  if [ -n "$REFUSAL" ]; then
+    echo "WARNING: --force accepted: $REFUSAL" >&2
+  fi
+else
+  echo "WARNING: $HUB_URL/health was unreachable; proceeding because no running hub state can be inspected." >&2
+fi
+
+systemctl restart trantor-hub
+echo "restarted trantor-hub"

package/deploy/setup-netcup.sh

@@ -72,10 +72,15 @@ echo "  schema applied"
 # systemd unit
 cp deploy/trantor-hub.service /etc/systemd/system/trantor-hub.service
 systemctl daemon-reload
-systemctl enable --now trantor-hub
+systemctl enable trantor-hub
+if systemctl is-active --quiet trantor-hub; then
+  bash deploy/restart-hub.sh
+else
+  systemctl start trantor-hub
+fi
 
 # crons: daily backup + nightly retention
-chmod +x deploy/backup.sh deploy/retention.sh deploy/restore.sh
+chmod +x deploy/backup.sh deploy/retention.sh deploy/restore.sh deploy/restart-hub.sh
 echo "0 2 * * * root /opt/trantor/deploy/backup.sh" > /etc/cron.d/trantor
 echo "0 3 * * * root /opt/trantor/deploy/retention.sh" >> /etc/cron.d/trantor
 

package/hooks/lib/api.mjs

@@ -112,7 +112,7 @@ function enrolledPath(session) {
   const busDir = process.env.AGENT_BUS_DIR || join(homedir(), ".agent-bus");
   return join(busDir, "keys", `${String(session).replace(/[^A-Za-z0-9_.-]/g, "_")}.enrolled`);
 }
-export async function ensureEnrolled(session, identity, project) {
+export async function ensureEnrolled(session, identity, project, { kind = "agent" } = {}) {
   if (!identity?.pubkey) return;
   const hub = relayUrl(project);
   const stamp = enrolledPath(session);
@@ -126,7 +126,7 @@ export async function ensureEnrolled(session, identity, project) {
     // payload, sets content-type, and signs — so every hook signs identically with zero hand-rolling.
     const r = await sfetchJson(`${hub}/enroll`, {
       method: "POST",
-      payload: { pubkey: identity.pubkey, name: session, kind: "agent" },
+      payload: { pubkey: identity.pubkey, name: session, kind },
       identity,
       signal: AbortSignal.timeout(DEFAULT_TIMEOUT_MS),
     });