trantor 0.18.32 → 0.18.34

package/hooks/lib/handoff.mjs

@@ -18,6 +18,7 @@ import { fileURLToPath } from "node:url";
 import { deriveSubagentManifest } from "../../lib/subagent-manifest.mjs";
 import { signedPost } from "./api.mjs";
 import { loadAutonomy, resolveAutonomy } from "../../lib/autonomy.mjs";
+import { resolveProject, orchSessionsPath } from "../../lib/project.mjs";
 
 // Writer and reader MUST resolve the same directory — see lib/project.mjs busDir(). This used to
 // honour only RELAY_DATA_DIR while the reader honoured neither override.
@@ -389,8 +390,10 @@ export function appendHandoffState(id, state, by = "") {
   } catch { return false; }
 }
 
-export function writeHandoff({ projectDir, sessionId, transcript, trigger, summary, force = false }) {
-  const projectName = basename(projectDir);
+export function writeHandoff({ projectDir, sessionId, transcript, trigger, summary, force = false, projectName: projectNameArg }) {
+  // #6074: the NAME may come from the session's registration (resolveHandoffSurface), not from
+  // this directory's basename — a subfolder cwd must not rename the project on the record.
+  const projectName = projectNameArg || basename(projectDir);
   // Server-side storm guard: a session running OLD hooks (before the local markHandedOff guard) re-fires
   // context-warn handoffs every few minutes — the crebral-cortex storm (9 in 49 min, each spawning a
   // window). Ask the hub for clearance (rate-limit per project+session); a non-forced handoff inside the
@@ -541,6 +544,12 @@ export function maybeSpawn(projectDir, conf = readConfig()) {
   try {
     if (process.platform !== "darwin") return false;
     if (process.env.TRANTOR_NO_HANDOFF_SPAWN === "1") return false;
+    // #6074: a session in a hosted pane never gets a Terminal window — the pane is the successor
+    // surface, and the pane claims the handoff (trantor open) on its own.
+    if (paneSurfaceEnv()) {
+      process.stderr.write(`[trantor] session lives in herdr pane ${paneSurfaceEnv()} — no Terminal window; the pane claims the handoff\n`);
+      return false;
+    }
     if (conf.autoHandoffPrompt === false) return false;
     if (hasOrchPane(basename(projectDir))) {
       process.stderr.write(`[trantor] orch pane hosts ${basename(projectDir)} — no Terminal window; the pane claims the handoff on its next open\n`);
@@ -585,9 +594,52 @@ export function hasOrchPane(projectName) {
   } catch { return false; }
 }
 
+// ---- #6074: WHERE the session lives, and WHICH project it is ----------------
+// Witnessed 2026-09-02 (crebral-scribe/ios): a pane session ran the handoff skill with its shell
+// cwd in a subfolder. The project name came from basename(cwd) = "ios", the pane lookup found no
+// "ios" row, and the baton fell to the window leg — whose front-Terminal-window fallback picked a
+// window the pane session never owned, spawned a stray Terminal session, and armed a close on a
+// stranger's window. Two facts the code ignored: a session's OWN env knows where it lives
+// (HERDR_PANE_ID — herdr sets it in every pane), and the project's REGISTRATION knows its name
+// (the `trantor open` badge, RELAY_PROJECT, the orch-sessions map) long before cwd is worth
+// consulting. One resolver, shared by write-handoff.mjs --baton AND bin/baton.mjs, so the skill
+// path and the CLI path cannot diverge.
+export function paneSurfaceEnv(env = process.env) {
+  return String(env.HERDR_PANE_ID || "").trim();
+}
+
+// Reverse orch-sessions.txt lookup: which project recorded THIS session id as its orchestrator
+// thread. One row per project, "<project>\t<sid>" — written by `trantor open` / adopt / claim.
+export function orchProjectForSession(sid) {
+  try {
+    if (!sid) return "";
+    for (const line of readFileSync(orchSessionsPath(), "utf8").split("\n")) {
+      const [p, s] = line.split("\t");
+      if (p && s && s.trim() === String(sid).trim()) return p.trim();
+    }
+  } catch {}
+  return "";
+}
+
+// The one resolver. Returns { project, projectDir, pane, surface }:
+//   pane    — the session's own pane id ("" when it is not a hosted pane)
+//   surface — "pane" (the baton MUST take the pane leg) or "window" (today's behavior)
+//   project — the REGISTERED project name; a subfolder cwd never renames it
+export function resolveHandoffSurface({ projectDir, sessionId, env = process.env } = {}) {
+  const dir = projectDir || env.CLAUDE_PROJECT_DIR || process.cwd();
+  const badge = String(env.TRANTOR_ORCH || "").trim();
+  let project = "";
+  if (badge && badge !== "1") project = badge;                       // `trantor open` badge carries the name
+  if (!project && env.RELAY_PROJECT) project = String(env.RELAY_PROJECT).trim();
+  if (!project) project = orchProjectForSession(sessionId);
+  if (!project) project = resolveProject(dir);                       // last resort: cwd (git-root aware)
+  return { project, projectDir: dir, pane: paneSurfaceEnv(env), surface: paneSurfaceEnv(env) ? "pane" : "window" };
+}
+
 export function spawnFresh(projectDir) {
   try {
     if (process.platform !== "darwin" || spawnSuppressed()) return false;
+    if (paneSurfaceEnv()) return false;                    // #6074: pane sessions never open windows
     if (hasOrchPane(basename(projectDir))) return false;   // the pane is the successor surface (#5509)
     const script = join(HERE, "..", "..", "bin", "open-session.sh");
     if (!existsSync(script)) return false;
@@ -624,11 +676,15 @@ export function resolveOriginalWindow() {
 // window machinery (resolve/arm-close) is deliberately absent here: there is no window to close,
 // and the old path's answer ("spawn disabled — open manually") left the operator doing the
 // machine's job by hand.
-export function spawnPaneBaton(projectDir, handoffFile) {
+export function spawnPaneBaton(projectDir, handoffFile, paneId = "") {
   try {
     const script = join(HERE, "..", "..", "bin", "baton-pane.mjs");
     if (!existsSync(script)) return false;
-    const child = spawn(process.execPath, [script, "--project", projectDir, "--handoff", handoffFile], { detached: true, stdio: "ignore" });
+    // #6074: when the dying session KNOWS its pane (HERDR_PANE_ID), pass it — the driver must
+    // replace THAT pane, not guess one from a crew-windows row keyed by a cwd-derived name.
+    const args = [script, "--project", projectDir, "--handoff", handoffFile];
+    if (paneId) args.push("--pane", paneId);
+    const child = spawn(process.execPath, args, { detached: true, stdio: "ignore" });
     child.unref();
     return true;
   } catch { return false; }
@@ -643,15 +699,30 @@ export function spawnPaneBaton(projectDir, handoffFile) {
 // regression-tested headlessly.
 export function spawnBaton({ projectDir, handoffFile, conf = readConfig(),
   _resolveWindow = resolveOriginalWindow, _spawnFresh = spawnFresh, _armClose = armBatonClose,
-  _hasPane = hasOrchPane, _spawnPane = spawnPaneBaton }) {
+  _hasPane = hasOrchPane, _spawnPane = spawnPaneBaton, _env = process.env }) {
   // A DRILL MUST BE ABLE TO SAY NO. There was no such switch, so exercising the baton path in a
   // test opened real Terminal windows running real `claude` sessions in temp directories the test
   // then deleted, each parked on a "do you trust this folder?" prompt. Five of them were found by
   // the operator on 2026-08-24. A code path that spawns windows needs an off switch, or it cannot
-  // be tested honestly and someone will fake one that does not exist.
-  if (spawnSuppressed() || conf.batonSpawn === false) {
+  // be tested honestly and someone will fake one that does not exist. The check reads the REAL env
+  // (spawnSuppressed) AND the injected one (_env) — a crew runner exports TRANTOR_NO_*_SPAWN for
+  // its seats, and a drill that inherits that must still be able to exercise each branch by
+  // passing its own env, not by mutating the runner's.
+  const suppressed = spawnSuppressed()
+    || String(_env.TRANTOR_NO_HANDOFF_SPAWN || "") === "1" || String(_env.TRANTOR_NO_BATON_SPAWN || "") === "1";
+  if (suppressed || conf.batonSpawn === false) {
     return { spawned: false, armed: false, windowId: "", suppressed: true };
   }
+  // #6074, checked FIRST: the session's OWN env is the truth about where it lives. HERDR_PANE_ID
+  // set means the pane leg, keyed by THAT pane id — regardless of cwd or project name — and the
+  // whole window machinery (resolve + spawn + arm-close) is forbidden here: a pane session has no
+  // Terminal window, so the front-window fallback can only ever pick a stranger's (the witnessed
+  // crebral-scribe/ios incident armed a close on a window this session never owned).
+  const paneId = paneSurfaceEnv(_env);
+  if (paneId) {
+    const spawned = _spawnPane(projectDir, handoffFile, paneId);
+    return { spawned, armed: false, windowId: "", pane: true, paneId };
+  }
   // Hosted pane (#5643): the pane IS the successor surface — no window is resolved, spawned, or
   // armed for closing. The detached driver replaces the session at the turn boundary.
   if (_hasPane(basename(projectDir))) {

package/hooks/sessionstart.mjs

@@ -221,8 +221,15 @@ try {
   // instead of silently routing to the default.
   const { url, via: hubVia } = resolveHubInfo(project);
 
-  // register self + post an initial presence status (no LLM turn — instant for others to read)
-  await jpost(`${url}/register`, { session, project, status: `active in ${project}` }, session).catch(() => {});
+  // register self + post an initial presence status (no LLM turn — instant for others to read).
+  // kind "orch" when `trantor open` badged THIS session as the project's orchestrator pane
+  // (#6075): the peer row's kind is the hub's own record of what a session is — the overseer's
+  // declared-crew exemption reads it, and on the remote hub there is no local crew-windows.txt.
+  // Strict match (badge === project), same rule the doctrine gate below uses; a badge of "1"
+  // carries no name, so it stamps nothing. Absent kind is preserved by /register, so the MCP's
+  // kindless heartbeats never erase this.
+  const orchBadge = process.env.TRANTOR_ORCH || "";
+  await jpost(`${url}/register`, { session, project, status: `active in ${project}`, ...(orchBadge === project ? { kind: "orch" } : {}) }, session).catch(() => {});
 
   // fetch roster of OTHER online sessions
   let peers = [], hubAnswered = false;

package/hooks/stop-inbox.mjs

@@ -21,12 +21,12 @@
 //   * Only claim delivery once we have actually decided to surface it (peek first). Marking a message
 //     delivered and then letting the stop through would hide it from the waker too — a silent hole.
 //   * Any error, or a hub that is down -> allow the stop. Never trap a session because of us.
-import { readFileSync, writeFileSync, existsSync, unlinkSync } from "node:fs";
+import { readFileSync, writeFileSync, existsSync, unlinkSync, mkdirSync, renameSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { homedir } from "node:os";
-import { resolveProject, hostId, handoffDir } from "../lib/project.mjs";
+import { resolveProject, hostId, handoffDir, busDir } from "../lib/project.mjs";
 import { signedGet } from "./lib/api.mjs";   // signed: enforce hubs 401 unsigned reads — unsigned, T2 delivery is silently dead
 import { ledgerPaths, ensureStart, anchorCursor, writeCursor } from "./lib/inbox-ledger.mjs";
 import { readArm, clearArm, markHandedOff, appendHandoffState } from "./lib/handoff.mjs";
@@ -71,6 +71,32 @@ const OVERDUE_MS = (() => {
   return Number.isFinite(n) && n >= 0 ? n : 10 * 60 * 1000;
 })();
 
+function stalledSeenPath(session) {
+  const safe = String(session).replace(/[^A-Za-z0-9_.-]/g, "_");
+  return join(busDir(), `stop-stalled-seen-${safe}.json`);
+}
+
+function readStalledSeen(session) {
+  try {
+    const ids = JSON.parse(readFileSync(stalledSeenPath(session), "utf8"));
+    return new Set(Array.isArray(ids) ? ids.map(String) : []);
+  } catch { return new Set(); }
+}
+
+function writeStalledSeen(session, seen) {
+  const path = stalledSeenPath(session);
+  const tmp = `${path}.${process.pid}.tmp`;
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(tmp, JSON.stringify([...seen]) + "\n");
+    renameSync(tmp, path);
+    return true;
+  } catch {
+    try { unlinkSync(tmp); } catch {}
+    return false;
+  }
+}
+
 async function stalledContractCheck({ session, project, instanceId }) {
   if (process.env.RELAY_STOP_CONTRACTS === "0") return allow();
   let contracts = [];
@@ -89,8 +115,19 @@ async function stalledContractCheck({ session, project, instanceId }) {
   const abandoned = contracts.filter(c => c.disposition === "abandoned");
   if (!stalled.length) return allow();
 
+  const seen = readStalledSeen(session);
+  const fresh = stalled.filter(c => !seen.has(String(c.id)));
+  if (!fresh.length) {
+    process.stderr.write(`[trantor] ${stalled.length} stalled contract(s) already surfaced for ${sanitize(session)}; allowing stop\n`);
+    return allow();
+  }
+  for (const contract of stalled) seen.add(String(contract.id));
+  // Persist before blocking: if the harness stops this process immediately after reading stdout,
+  // the next Stop must still know this exact stalled episode was already surfaced.
+  if (!writeStalledSeen(session, seen)) return allow();
+
   const mins = (ms) => (ms >= 60000 ? `${Math.round(ms / 60000)}m` : `${Math.round(ms / 1000)}s`);
-  const lines = stalled.slice(0, 6).map(c => {
+  const lines = fresh.slice(0, 6).map(c => {
     const health = c.assigneeOnline ? `online, status "${sanitize(c.assigneeStatus || "?")}"`
       : c.assigneeLastSeenMs == null ? "never seen on the bus"
       : `LAST SEEN ${mins(c.assigneeLastSeenMs)} ago`;
@@ -104,7 +141,7 @@ async function stalledContractCheck({ session, project, instanceId }) {
     : "";
 
   const reason =
-    `You dispatched ${stalled.length} contract(s) that have gone quiet, and you were about to go idle:\n` +
+    `You dispatched ${fresh.length} NEW contract(s) that have gone quiet, and you were about to go idle:\n` +
     lines + ghosts + `\n\n` +
     `Do not just wait, and do not ask the human to check. Use relay_contracts to see everything you are owed, ` +
     `relay_peers to see whether the seat is alive, and relay_send to ask it directly. If a seat is down, say so and ` +

package/hub.mjs

@@ -6,12 +6,13 @@
 // private network, or add auth first. See "Always-on / remote hub" in the README (roadmap).
 import http from "node:http";
 import { readFileSync, writeFileSync, existsSync, mkdirSync, statSync, readdirSync } from "node:fs";
-import { homedir } from "node:os";
+import { homedir, hostname } from "node:os";
 import { join } from "node:path";
 import { timingSafeEqual, randomBytes } from "node:crypto";
 import { verifyRequest, verifyEndorsement, publicView } from "./lib/identity.mjs";
 import { DEFAULT_ORG } from "./lib/store-contract.mjs";
 import { assertNoSecrets } from "./lib/scrub.mjs";
+import { createPersistHealth } from "./lib/persist-health.mjs";
 
 const PORT = Number(process.env.RELAY_PORT || 4477);
 const HOST = process.env.RELAY_HOST || "127.0.0.1";
@@ -125,6 +126,7 @@ function emptyState() {
 const CARD_LOG_MAX = 40;
 const CARD_LOG_TEXT_MAX = 2000;
 const CARD_LOG_BY_MAX = 120;
+const stripNulText = (value) => String(value ?? "").replace(/\u0000/g, "");
 function normalizeTaskLog(t) {
   if (!Array.isArray(t.log)) { if (t.log !== undefined) delete t.log; return false; }
   const before = JSON.stringify(t.log);
@@ -133,7 +135,7 @@ function normalizeTaskLog(t) {
     .map(e => ({
       ts: Number.isFinite(Number(e.ts)) && Number(e.ts) > 0 ? Math.floor(Number(e.ts)) : Date.now(),
       by: String(e.by || "").slice(0, CARD_LOG_BY_MAX),
-      text: String(e.text || "").slice(0, CARD_LOG_TEXT_MAX),
+      text: stripNulText(e.text).slice(0, CARD_LOG_TEXT_MAX),
     }))
     .slice(-CARD_LOG_MAX);
   if (!t.log.length) delete t.log;
@@ -144,7 +146,7 @@ function appendTaskLog(t, by, text, ts = Date.now()) {
   const entry = {
     ts: Number.isFinite(Number(ts)) && Number(ts) > 0 ? Math.floor(Number(ts)) : Date.now(),
     by: String(by || "").slice(0, CARD_LOG_BY_MAX),
-    text: String(text).slice(0, CARD_LOG_TEXT_MAX),
+    text: stripNulText(text).slice(0, CARD_LOG_TEXT_MAX),
   };
   const log = Array.isArray(t.log) ? t.log : [];
   log.push(entry);
@@ -251,6 +253,11 @@ let dirty = false;
 // `cardEvents` key — so downgrading to a pre-0.17.54 hub still boots with its full TIMELINE
 // instead of a silently empty history. Cheap insurance on a live hub; drop the mirror later.
 let persisting = false;
+const persistHealth = createPersistHealth({
+  baseMs: process.env.RELAY_PERSIST_RETRY_BASE_MS,
+  maxMs: process.env.RELAY_PERSIST_RETRY_MAX_MS,
+  logIntervalMs: process.env.RELAY_PERSIST_LOG_INTERVAL_MS,
+});
 const snapshotState = () => JSON.parse(JSON.stringify({ ...state, cardEvents: state.events.filter(e => ["created", "moved", "updated"].includes(e?.type)) }));
 // This hub's writer id: saveDelta stamps it into every NOTIFY so we can tell our own change
 // notifications apart from a second writer's (importer, admin psql, another hub instance).
@@ -260,25 +267,38 @@ const HUB_SRC = `hub-${process.pid}-${randomBytes(4).toString("hex")}`;
 // survive our persist ticks (the old saveSnapshot wholesale delete+rewrite destroyed them).
 let lastPersisted = durableStore ? snapshotState() : null;
 if (runTaskBootMigrations()) dirty = true;
+const recordPersistFailure = (kind, error) => {
+  dirty = true;
+  const failure = persistHealth.failed(error);
+  if (failure.shouldLog) {
+    process.stderr.write(`[trantor] ${kind} persist failing: ${failure.health.retries} retries over ${failure.health.failingSinceMs}ms; last error: ${failure.health.lastError}\n`);
+  }
+};
 const persist = () => {
-  if (!dirty || persisting) return;
+  if (!dirty || persisting || !persistHealth.canAttempt()) return;
   if (durableStore) {
     const snapshot = snapshotState();
     dirty = false; persisting = true;
     durableStore.saveDelta(ORG_ID, lastPersisted, snapshot, { src: HUB_SRC }).then(() => {
       lastPersisted = snapshot;
+      persistHealth.succeeded();
     }).catch(e => {
-      dirty = true;
-      process.stderr.write(`[trantor] Postgres persist failed: ${e.message || e}\n`);
+      recordPersistFailure("Postgres", e);
     }).finally(() => {
       persisting = false;
-      if (dirty) persist();
     });
     return;
   }
-  try { writeFileSync(DATA, JSON.stringify(snapshotState())); dirty = false; } catch {}
+  try {
+    writeFileSync(DATA, JSON.stringify(snapshotState()));
+    dirty = false;
+    persistHealth.succeeded();
+  } catch (e) {
+    recordPersistFailure("JSON", e);
+  }
 };
-setInterval(persist, 1000).unref?.();
+const persistTickMs = Math.min(1000, Math.max(10, Number(process.env.RELAY_PERSIST_RETRY_BASE_MS) || 1000));
+setInterval(persist, persistTickMs).unref?.();
 
 // --- reload on external change (the boot-cache fix) -------------------------------------------
 // A NOTIFY from any writer that isn't us means Postgres has rows our in-memory projection has
@@ -320,6 +340,14 @@ async function reloadFromStore() {
 // not spam the feed; at level >= 3 a file-conflict opens a verify gate (the go/no-go primitive).
 let _overseer = null;
 import("./lib/overseer.mjs").then(m => { _overseer = m; }).catch(() => {});
+// #5760: the same-project episode rule (lib/same-project.mjs, pure) — lazy like the detector, so
+// a hub booted before the module lands still runs (the same-project branch fails QUIET until it
+// arrives: a missing rule must never re-instate the hourly metronome).
+let _sameProject = null;
+import("./lib/same-project.mjs").then(m => { _sameProject = m; }).catch(() => {});
+// This hub runs on the operator's machine, so the machine's own sessions ("<host>:<project>") ARE
+// the orchestrator side of every declared crew.
+const HOST_NAME = hostname().split(".")[0];
 const OVERSEER_TICK_MS = Number(process.env.RELAY_OVERSEER_TICK_MS || 30 * 1000);
 // How long a condition must be ABSENT before we consider the episode over. This is NOT a re-warn
 // timer: see overseerTick.
@@ -353,6 +381,37 @@ function overseerInputs() {
     now: now(),
   };
 }
+
+// --- #5760: the same-project warning is an EPISODE keyed by the MEMBER SET -------------------
+// The night of 08-31 the same-project DM re-fired hourly for a membership that never changed and
+// woke every seat into metered chatter turns. The rule (lib/same-project.mjs, pure) decides
+// fire-or-not from (previous set, current set, declared crew, last-fired-at): a declared crew is
+// the NORMAL state of a project and is not a collision at all; a set that never changed re-warns
+// never. The warn itself rides the SAME episode machinery as every other kind (#5350: one warn at
+// open, newcomer-only intros while standing, a genuine clear ends it) — the record below only
+// feeds the pure rule the set it judged last, so "unchanged" is one hash comparison and the
+// record line reports DURATION ("same-project for 6h"), never a count of warnings.
+const sameProjectFired = new Map(); // project -> { hash, sessions, ts } — the set as of the last verdict
+
+// The declared crew: HUB state, never a file on the operator's machine (#6075). The production
+// hub runs on netcup, where ~/.agent-bus/crew-windows.txt does not exist — the file describes the
+// OPERATOR'S machine (it is written by `trantor up` there), so on the remote hub the old reader
+// found nothing and every same-project set looked like intruders: the crew-only exemption simply
+// never held remotely. What the hub itself knows is the peer row's `kind` (#6148): "agent" is a
+// crew seat — crew-runner stamps it on every /register its seats make — and "orch" is the
+// project's orchestrator pane (sessionstart stamps it when TRANTOR_ORCH names this project).
+// The HOST_NAME exemption is gone with the file: the hub's hostname is the hub machine's
+// (netcup), never the operator's, so `<HOST_NAME>:<project>` exempted a session that cannot
+// exist. Genesis is deliberately NOT crew (#6068: a bookkeeping identity, not a seat).
+function declaredCrewFor(project) {
+  const crew = new Set();
+  for (const [sid, p] of Object.entries(state.peers)) {
+    if ((p.project || "") !== project) continue;
+    if (p.kind === "agent" || p.kind === "orch") crew.add(sid);
+  }
+  return [...crew];
+}
+
 function overseerTick() {
   if (!_overseer?.detectCollisions) return;
   let collisions = [];
@@ -365,8 +424,8 @@ function overseerTick() {
   // sessions to "coordinate over the bus" is useless if neither knows the other's id, and the
   // warning alone went only to the duty seat and the log — so coordination needed a human to carry
   // the ids across. Shared by the episode-start branch (all parties) and the standing branch
-  // (newcomers only): existing members never re-hear it, so a standing condition must not re-wake
-  // every party every tick.
+  // (newcomers only, same-project included): existing members never
+  // re-hear it, so a standing condition must not re-wake every party every tick.
   const intro = (c, me, others) => {
     const rest = others.filter(p => p !== me);
     if (rest.length === 0) return;
@@ -374,7 +433,58 @@ function overseerTick() {
       `🤝 OVERSEER ${c.kind}: you and ${rest.join(", ")} are working on overlapping ground${c.files?.length ? ` (${c.files.slice(0, 3).join(", ")})` : ""}. ${c.detail || ""} Coordinate directly — relay_send to ${rest[0]} — and split the work between you. No human needs to relay this.`,
       c.project);
   };
+  // #5760: same-project sets judged crew-only are dropped entirely — the normal state of a
+  // project, not a collision — so not even the context feed narrates them.
+  const kept = [];
   for (const c of collisions) {
+    // #5760: same-project gets the pure episode rule (lib/same-project.mjs) ON TOP of the shared
+    // episode machinery below: a crew-only set is not a collision at all (dropped — no warn, no
+    // context, no state); a standing set re-warns never (a liveness flap replays the SAME set —
+    // 08-31's metronome — and must stay silent, only genuine newcomers hear the intro once); and
+    // the record line reports DURATION. Without the rule module this branch is invisible and
+    // same-project rides the generic loop exactly as before — a missing rule must never
+    // re-instate the hourly metronome, so the fallback is the pre-#5760 behavior, never stricter.
+    if (c.kind === "same-project-sessions" && _sameProject?.sameProjectDecision) {
+      const prior = sameProjectFired.get(c.project) || null;
+      const d = _sameProject.sameProjectDecision({
+        previous: prior?.sessions ?? null,
+        current: c.sessions,
+        declaredCrew: declaredCrewFor(c.project),
+        lastFiredAt: prior?.ts ?? null,
+        now: t,
+      });
+      if (d.reason === "crew-only") continue;
+      const key = `${c.project} ${c.kind}`;
+      c.key = key;
+      seen.add(key);
+      kept.push(c);
+      const parties = [...new Set(c.sessions || [])].filter(s => s && s !== DUTY_SESSION);
+      const standing = overseerActive.get(key);
+      if (standing) {
+        // The episode HOLDS: no new warn, whoever was introed once is never re-heard.
+        standing.lastTick = t;
+        c.since = standing.since;
+        if (_sameProject.durationLabel) c.detail = `${c.detail || ""} (same-project for ${_sameProject.durationLabel(t - standing.since)})`.trim();
+        for (const me of parties) if (!standing.sessions.has(me)) intro(c, me, parties);
+        for (const me of parties) standing.sessions.add(me);
+        // The record tracks the live membership (ts stays at the last warn) so a later open
+        // judges the true previous set and can say how long the old one held.
+        if (d.fire && prior) sameProjectFired.set(c.project, { hash: _sameProject.memberSetHash(c.sessions), sessions: c.sessions, ts: prior.ts });
+        continue;
+      }
+      // The episode OPENS and the pure rule said fire — first sighting, or a membership change
+      // on a remembered set; the record line states how long the previous state held.
+      overseerActive.set(key, { since: t, lastTick: t, sessions: new Set(parties) });
+      c.since = t;
+      if (d.reason === "membership-changed") c.detail = `${c.detail || ""} (same-project for ${_sameProject.durationLabel(d.durationMs)})`.trim();
+      sameProjectFired.set(c.project, { hash: _sameProject.memberSetHash(c.sessions), sessions: c.sessions, ts: t });
+      appendEvent("overseer.warn", c.project, "overseer",
+        { kind: c.kind, sessions: c.sessions || [], files: c.files || [], detail: c.detail || "", narrated: false });
+      if (DUTY_SESSION) hubSend(DUTY_SESSION, `⚠️ OVERSEER ${c.kind} [${c.project}]: ${c.detail || ""} — if the parties are not already coordinating, message them.`, c.project);
+      if (parties.length > 1) for (const me of parties) intro(c, me, parties);
+      continue;
+    }
+    kept.push(c);
     // Episode identity is the CONDITION (project+kind+files), never the session list (#5350):
     // membership is volatile — a third seat bouncing in and out of a standing collision minted a
     // fresh key, so a fresh episode, so a fresh warn (+ duty wake + party intros) per permutation.
@@ -413,9 +523,14 @@ function overseerTick() {
   // Episode end: a condition gone for the whole clear window is over, so a LATER recurrence is a
   // new episode and warns again. Without this the map would grow forever and nothing could re-fire.
   for (const [k, v] of overseerActive) {
-    if (!seen.has(k) && t - v.lastTick > OVERSEER_CLEAR_MS) overseerActive.delete(k);
+    if (!seen.has(k) && t - v.lastTick > OVERSEER_CLEAR_MS) {
+      overseerActive.delete(k);
+      // #5760: the same-project verdict record dies WITH its episode — a set that returns after a
+      // genuine clear is a new episode (it warns again, first sighting), not the old one continuing.
+      if (k.endsWith(" same-project-sessions")) sameProjectFired.delete(k.slice(0, -" same-project-sessions".length));
+    }
   }
-  overseerLastCollisions = collisions;
+  overseerLastCollisions = kept;
 }
 setInterval(overseerTick, OVERSEER_TICK_MS).unref?.();
 // setInterval waits a FULL period before its first call, so for 30s after every restart the watcher
@@ -1173,6 +1288,22 @@ function markDelivered(session, upTo) {
 function pushToStreams(msg) {
   for (const s of streams) if (deliverable(msg, s.session)) { try { s.res.write(`data: ${JSON.stringify(msg)}\n\n`); } catch {} }
 }
+// A live runner can outlast the durable snapshot it was polling. If its cursor is now beyond the
+// message high-water mark, echoing that impossible value leaves it deaf forever. Clamp it to the
+// current tip and say explicitly that time moved backwards so clients can adopt the lower cursor.
+function inboxWindow(value) {
+  const parsed = Number(value || 0);
+  const requested = Number.isFinite(parsed) ? Math.max(0, parsed) : 0;
+  const tip = Math.max(Number(state.seq || 0), Number(state.messages[state.messages.length - 1]?.id || 0));
+  const rewound = requested > tip;
+  return { since: rewound ? tip : requested, tip, rewound };
+}
+function inboxResponse(auth, messages, cursor, rewound = false) {
+  const response = { messages, cursor };
+  if (rewound) response.rewound = true;
+  if (auth?.superseded) response.superseded = true;
+  return response;
+}
 // Live push for the FEED. Sent ONLY to streams that opted in with /stream?events=1, and as a NAMED
 // SSE event ("event: ev") so an existing consumer's default onmessage handler — which expects a bus
 // message and nothing else — can never see it. Backwards-safe by construction.
@@ -1390,7 +1521,9 @@ const server = http.createServer(async (req, res) => {
       // WHO is this, really: the LLM brand + the exact model currently loaded. In-memory like the
       // rest of presence — the next heartbeat re-supplies it after a restart.
       const pr = state.peers[b.session];
-      if (pr) { if (b.model) pr.model = String(b.model).slice(0, 80); if (b.llm) pr.llm = String(b.llm).slice(0, 40); }
+      // #6148: WHAT a session is rides its peer row (kind "genesis" = the CLI's brief-poster,
+      // "agent" = a crew seat) — /peers hands it to the app so the seat strip can tell them apart.
+      if (pr) { if (b.model) pr.model = String(b.model).slice(0, 80); if (b.llm) pr.llm = String(b.llm).slice(0, 40); if (b.kind) pr.kind = String(b.kind).slice(0, 40); }
       return json(res, 200, { ok: true, session: b.session, peers: Object.keys(state.peers) });
     }
     if (req.method === "POST" && P === "/status") { const b = await body(req); touch(b.session, b.status ?? "", b.project, b.hookVersion, auth); return json(res, 200, { ok: true }); }
@@ -1558,8 +1691,29 @@ const server = http.createServer(async (req, res) => {
       const inflight = [...fileClaims.values()].filter(c => c.project === proj)
         .map(c => ({ file: c.file, session: c.session, agoSec: Math.round((now() - c.ts) / 1000) }));
       let warnings = [];
-      try { warnings = (_overseer?.detectCollisions ? _overseer.detectCollisions(overseerInputs()) : [])
-        .filter(c => c.project === proj || linked.has(c.project)); } catch {}
+      try {
+        warnings = (_overseer?.detectCollisions ? _overseer.detectCollisions(overseerInputs()) : [])
+          .filter(c => c.project === proj || linked.has(c.project));
+        // #5760: a declared crew is the NORMAL state of a project, not a collision — the tick
+        // loop drops crew-only sets before they ever become episodes, and this live view must
+        // agree with it: the SessionStart hook narrates exactly these lines, so a crew-only leak
+        // here would re-wake every booting seat into a metered turn for no membership change.
+        warnings = warnings.filter(c => !(c.kind === "same-project-sessions" && _sameProject?.sameProjectDecision &&
+          _sameProject.sameProjectDecision({
+            current: c.sessions,
+            declaredCrew: declaredCrewFor(c.project),
+            now: now(),
+          }).reason === "crew-only"));
+        // The record line reports DURATION ("same-project for 6h"), never a count of warnings.
+        for (const c of warnings) {
+          if (c.kind !== "same-project-sessions") continue;
+          const ep = overseerActive.get(`${c.project} same-project-sessions`);
+          if (ep) {
+            c.since = ep.since;
+            if (_sameProject?.durationLabel) c.detail = `${c.detail || ""} (same-project for ${_sameProject.durationLabel(now() - ep.since)})`.trim();
+          }
+        }
+      } catch {}
       return json(res, 200, { level, links: links.map(l => ({ projects: l.projects, reason: l.reason })), peers: peersOut, inflight, warnings });
     }
     // Supersession (docs/INSTANCE-KEYS-CONTRACT.md): EXPLICIT, never automatic — the baton-claim
@@ -1639,7 +1793,7 @@ const server = http.createServer(async (req, res) => {
       const peerRows = filterDiscoverable(auth, Object.entries(state.peers), ([, v]) => v.project || "");
       return json(res, 200, { hubVersion: HUB_VERSION, authMode: AUTH_MODE, peers: peerRows.map(([s, v]) => ({ session: s, lastSeen: v.lastSeen, online: v.lastSeen > cutoff, status: v.status || "", health: healthOf(v.status), project: v.project || "",
         pubkey: v.pubkey || "", identity: v.identity || null, authWarning: v.authWarning || "",
-        llm: v.llm || "", model: v.model || "", hookVersion: v.hookVersion || "", staleHooks: !!(v.lastSeen > cutoff && v.hookVersion && HUB_VERSION && cmpSemver(v.hookVersion, HUB_VERSION) < 0) })) });
+        kind: v.kind || v.identity?.kind || "", llm: v.llm || "", model: v.model || "", hookVersion: v.hookVersion || "", staleHooks: !!(v.lastSeen > cutoff && v.hookVersion && HUB_VERSION && cmpSemver(v.hookVersion, HUB_VERSION) < 0) })) });
     }
     // --- Provider balances (prepaid credit) ---
     // The hub runs under launchd with no provider keys, so it can't fetch balances itself. Env-having
@@ -1766,6 +1920,8 @@ const server = http.createServer(async (req, res) => {
     // --- Kanban tasks ---
     if (req.method === "POST" && P === "/task") {           // create a card
       const b = await body(req); touch(b.by, undefined, b.project, undefined, auth);
+      if (b.title !== undefined) b.title = stripNulText(b.title);
+      if (b.note !== undefined) b.note = stripNulText(b.note);
       const st0 = ["todo","doing","testing","failed","done","blocked"].includes(b.status) ? b.status : "todo";
       // optional historical ts (backfill from git/import) — accept a past epoch-ms; else now().
       const ts0 = (Number.isFinite(b.ts) && b.ts > 0 && b.ts <= now() + 864e5) ? Math.floor(b.ts) : now();
@@ -1919,6 +2075,8 @@ const server = http.createServer(async (req, res) => {
     if (req.method === "POST" && P === "/task/update") {    // move/edit a card
       const b = await body(req); const t = state.tasks.find(x => x.id === Number(b.id));
       if (!t) return json(res, 404, { error: "no such task" });
+      if (b.title !== undefined) b.title = stripNulText(b.title);
+      if (b.note !== undefined) b.note = stripNulText(b.note);
       // Board integrity (#5406): a card can never change hands silently. The assignee is frozen once
       // set; a mutation is legitimate only as a HANDOFF (the current assignee reassigning to someone
       // else) or an EXPLICIT reassign (reassign:true — e.g. the orchestrator re-routing work after a
@@ -2279,7 +2437,7 @@ const server = http.createServer(async (req, res) => {
     // --- lessons: cross-agent learning from failures. scope = "global" or an agent brand ("kimi") ---
     if (req.method === "POST" && P === "/lesson") {
       const b = await body(req);
-      const text = String(b.text || "").trim().slice(0, 400);
+      const text = stripNulText(b.text).trim().slice(0, 400);
       const scope = String(b.scope || "global").toLowerCase().slice(0, 40);
       if (!text) return json(res, 400, { error: "text required" });
       if (state.lessons.some(l => l.scope === scope && l.text === text)) return json(res, 200, { ok: true, dedup: true });
@@ -2614,7 +2772,7 @@ const server = http.createServer(async (req, res) => {
     }
     if (req.method === "POST" && P === "/send") {
       const b = await body(req);
-      const text = String(b.text ?? "");
+      const text = stripNulText(b.text);
       if (!b.from || !text.trim()) return json(res, 400, { error: "from and non-empty text required" });
       const secretCheck = assertNoSecrets(text);
       if (!secretCheck.ok) return json(res, 400, { error: "secret detected", kinds: secretCheck.kinds || [] });
@@ -2693,7 +2851,8 @@ const server = http.createServer(async (req, res) => {
 
     if (req.method === "GET" && P === "/inbox") {
       if (!canUseInboxSession(auth, q.session)) return json(res, 403, { error: "forbidden" });
-      touch(q.session, undefined, undefined, undefined, auth); const since = Number(q.since || 0);
+      touch(q.session, undefined, undefined, undefined, auth); const window = inboxWindow(q.since);
+      const { since, rewound } = window;
       const msgs = state.messages.filter(m => m.id > since && deliverable(m, q.session) && inboxReadable(auth, m, q.session));
       const cursor = msgs.length ? msgs[msgs.length - 1].id : since;
       // peek=1 -> LOOK without claiming delivery. The Stop hook has to ask "is anything waiting?" before
@@ -2703,16 +2862,21 @@ const server = http.createServer(async (req, res) => {
       if (q.peek !== "1") markDelivered(q.session, cursor);
       // superseded (instance-keys contract): a baton twin that lost the claim learns it HERE, via
       // its own read — its hooks turn this into a stand-down note for the model. Never a block.
-      return json(res, 200, auth?.superseded ? { messages: msgs, cursor, superseded: true } : { messages: msgs, cursor });
+      return json(res, 200, inboxResponse(auth, msgs, cursor, rewound));
     }
     if (req.method === "GET" && P === "/poll") {
       if (!canUseInboxSession(auth, q.session)) return json(res, 403, { error: "forbidden" });
-      touch(q.session, undefined, undefined, undefined, auth); const since = Number(q.since || 0);
+      touch(q.session, undefined, undefined, undefined, auth); const window = inboxWindow(q.since);
+      const { since, rewound } = window;
+      if (rewound) {
+        markDelivered(q.session, window.tip);
+        return json(res, 200, inboxResponse(auth, [], window.tip, true));
+      }
       const waitMs = Math.min(Number(q.wait || 25), 290) * 1000;   // allow long idle-park
       const deadline = now() + waitMs;
       const tick = () => {
         const msgs = state.messages.filter(m => m.id > since && deliverable(m, q.session) && inboxReadable(auth, m, q.session));
-        if (msgs.length || now() >= deadline) { touch(q.session, undefined, undefined, undefined, auth); const cursor = msgs.length ? msgs[msgs.length - 1].id : since; markDelivered(q.session, cursor); return json(res, 200, auth?.superseded ? { messages: msgs, cursor, superseded: true } : { messages: msgs, cursor }); }
+        if (msgs.length || now() >= deadline) { touch(q.session, undefined, undefined, undefined, auth); const cursor = msgs.length ? msgs[msgs.length - 1].id : since; markDelivered(q.session, cursor); return json(res, 200, inboxResponse(auth, msgs, cursor)); }
         setTimeout(tick, 300);
       };
       return tick();
@@ -2738,6 +2902,7 @@ const server = http.createServer(async (req, res) => {
       res.writeHead(200, { "content-type": "text/html; charset=utf-8" }); return res.end(UI || "<h1>trantor</h1><p>dashboard unavailable</p>");
     }
     if (P === "/health") return json(res, 200, { ok: true, authMode: AUTH_MODE, peers: Object.keys(state.peers).length, messages: state.messages.length, streams: streams.length,
+      persist: persistHealth.view(),
       // #5686: duty liveness rides /health so the app's Home strip and doctor read one truth.
       duty: { ...dutyLiveness(), darkSinceMs: dutyDarkSince ? now() - dutyDarkSince : 0, queuedEscalations: dutyQueuedEscalations() } });
     json(res, 404, { error: "not found" });

package/lib/enroll.mjs

@@ -32,7 +32,7 @@ export function ownerIdentity() {
 
 // Returns { ok, reason }. NEVER throws and never blocks a turn — a hub that is down, or an operator
 // key that is absent, must degrade to "unenrolled" rather than take the seat with it.
-export async function ensureEnrolled(hubUrl, identity, project, { timeoutMs = 4000 } = {}) {
+export async function ensureEnrolled(hubUrl, identity, project, { timeoutMs = 4000, kind } = {}) {
   if (!hubUrl || !identity?.pubkey) return { ok: false, reason: "no-identity" };
   try {
     // Cheapest possible probe that the hub authorises: if we are already known this is a no-op.
@@ -55,7 +55,7 @@ export async function ensureEnrolled(hubUrl, identity, project, { timeoutMs = 40
 
     const en = await sfetch(`${hubUrl}/enroll`, {
       method: "POST", headers: { "content-type": "application/json" },
-      body: JSON.stringify({ name: identity.name, kind: identity.kind || "agent", token }),
+      body: JSON.stringify({ name: identity.name, kind: kind || identity.kind || "agent", token }),
       signal: AbortSignal.timeout(timeoutMs),
     }, identity);
     return en.ok ? { ok: true, reason: "enrolled" } : { ok: false, reason: `enroll-${en.status}` };