trantor 0.18.33 → 0.18.35

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.33",
+  "version": "0.18.35",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/README.md

@@ -399,9 +399,15 @@ trantor setup | doctor | connect | profile | provider | models
 
 - **`trantor new <name>`** — project genesis in one command: makes the dir under your dev root
   (`TRANTOR_DEV_ROOT` or `~/development`), git on main (or `--from <git-url>`, or `--adopt` an
-  existing folder), seeds CLAUDE.md from `--brief <file>`, installs the auto-card hook, posts
-  the brief to the hub, and opens the first card "genesis: <name>". `--json` for machines.
-  It never spawns a session — firing the crew stays your call.
+  existing folder), installs the auto-card hook, posts the brief to the hub, and opens the first
+  card "genesis: <name>". `--json` for machines. It never spawns a session — firing the crew
+  stays your call. Two paths in: **blank** (no brief) wakes the orchestrator plainly and you work
+  with it iteratively; **from a brief** (`--brief <file>`, or a PRD dropped on the app's Genesis
+  sheet) stores it in `docs/PRD.md` with a small CLAUDE.md pointer, and the wake runs
+  **`/trantor:prd-review`**: every live crew seat plus two Scrooge readers review the PRD
+  independently against one rubric, the orchestrator synthesizes the consensus and asks you,
+  the TDD gets the same review, and only then do the build cards open. A parked project with
+  `docs/PRD.md` and no build cards takes the same path on its next Wake.
 
 - **`trantor provider`** — `list` every crew seat (built-in + brought) with availability + tier ·
   `add <name> --key … [--plan api] [--base-url <url> --models a,b]` to bring any provider (custom

package/bin/cli.mjs

@@ -70,6 +70,7 @@ switch (cmd) {
   case "reconcile": run("bin/reconcile.mjs"); break;
   case "init-hooks": run("bin/init-hooks.mjs"); break;
   case "new": run("bin/new.mjs"); break;
+  case "genesis-kickoff": run("bin/genesis-kickoff.mjs"); break;
   case "balances": case "balance": case "credits": run("bin/balances.mjs"); break;
   case "recost": run("bin/recost.mjs"); break;
   case "handoff": run("bin/baton.mjs"); break;
@@ -209,7 +210,8 @@ switch (cmd) {
   trantor gates       verification gates: "must verify before shipping" claims that survive handoffs — [--all] [--json]
   trantor backfill    card past GIT work onto the board (solo commits that were never carded) — [--since "14 days ago"] [--dry-run]
   trantor init-hooks  install a git post-commit hook so EVERY commit auto-cards on the board (reliable solo-work backstop) — [--uninstall]
-  trantor new         project genesis: new <name> [--from <git-url>] [--brief <file>] [--dir <parent>] [--adopt] [--json] — creates <parent>/<name>, git main, CLAUDE.md from the brief, hooks, hub brief + first card (never spawns a session)
+  trantor new         project genesis: new <name> [--from <git-url>] [--brief <file>] [--dir <parent>] [--adopt] [--json] — creates <parent>/<name>, git main, docs/PRD.md + small CLAUDE.md, hooks, hub brief + first card (never spawns a session)
+  trantor genesis-kickoff  internal wake prompt selector from the checkout + signed project board
   trantor balances    how much credit is left on each CONFIGURED provider (from your profile) — refill before you stall — [--json]
   trantor recost      recompute sub-agent notional cost from on-disk transcripts + reseed the board (repair after upgrade) — [--dry-run]
   trantor handoff     finish this session NOW: write a handoff, open a fresh session that takes over, and close this one (manual baton)

package/bin/crew-runner.mjs

@@ -23,6 +23,9 @@ import {
   readPromptText, stripPromptEcho,
 } from "../lib/classify-failure.mjs";
 import { capWake, capBcast, pickLessons, composePrompt } from "./crew-payload.mjs";
+import {
+  cardRef, carriesWork, parseTurnTokens, parseResetAt, reasonWithBalances, PARKING_REASONS,
+} from "../lib/turn-policy.mjs";
 
 const AGENT = process.argv[2];
 const DIR = process.argv[3] || process.cwd();
@@ -272,7 +275,7 @@ if (!CLI[AGENT]) log(`'${AGENT}' is not a built-in seat — running it as an ope
 
 // RUNNER_RULES / RUNNER_KICKOFF env overrides: the runner is also the substrate for non-crew
 // always-on seats (the fleet DUTY agent, bin/duty.mjs) whose doctrine is not "work your card".
-const RULES = process.env.RUNNER_RULES || `Rules: you are ${SESSION} on the trantor crew. Before starting a card, query the board for related PAST cards and lessons (relay_board — 1900+ cards of tribal knowledge; prior work may already answer half of it). Work your assigned file(s), report on the bus (relay_send, <280 chars), move your Kanban card as you go with a NOTE saying what you did (doing -> testing -> done; in 'testing' run YOUR OWN test file — never the full npm test, suites collide across seats — plus \`node bin/slop-gate.mjs\` when the repo has one: it lints ONLY your changed files against the anti-slop rules, and a card must not reach done with slop-gate failing; use 'failed' + a report if anything breaks). If you need something from another session, message THAT SESSION (relay_peers to find its id, relay_send to reach it) — never ask the human to pass it along; carrying messages between agents is the job this bus exists to remove. When your work for THIS message is finished, END YOUR TURN — do NOT park, do NOT loop relay_wait; the runner waits for you and will wake you with the next message.`;
+const RULES = process.env.RUNNER_RULES || `Rules: you are ${SESSION} on the trantor crew. Before starting a card, read YOUR card: relay_board with card:<id> (the card, its deps, its notes, and the last five done cards whose title shares a word); never the whole board. Work your assigned file(s), report on the bus (relay_send, <280 chars), move your Kanban card as you go with a NOTE saying what you did (doing -> testing -> done; in 'testing' run YOUR OWN test file — never the full npm test, suites collide across seats — plus \`node bin/slop-gate.mjs\` when the repo has one: it lints ONLY your changed files against the anti-slop rules, and a card must not reach done with slop-gate failing; use 'failed' + a report if anything breaks). If you need something from another session, message THAT SESSION (relay_peers to find its id, relay_send to reach it) — never ask the human to pass it along; carrying messages between agents is the job this bus exists to remove. When your work for THIS message is finished, END YOUR TURN — do NOT park, do NOT loop relay_wait; the runner waits for you and will wake you with the next message.`;
 
 // ---- the pulse (Scape's Lloyd/Argus loop, Trantor-shaped) --------------------
 // A message-driven seat is DEAF between messages. An orchestrator seat with a mission needs a
@@ -353,9 +356,9 @@ function classify(exit) {
   return reason;
 }
 
-async function reportFailure(exit, trigger, undelivered = 0) {
+async function reportFailure(exit, trigger, undelivered = 0, reasonOverride = "") {
   consecFails++;
-  const reason = classify(exit);
+  const reason = reasonOverride || classify(exit);
   const down = consecFails >= 2;
   const status = down ? `down: ${reason} · ${consecFails} fails` : `errored: ${reason}`;
   await api("/register", { session: SESSION, project: PROJ, status, llm: AGENT, model: MODEL, kind: "agent" }).catch(() => {});
@@ -394,6 +397,41 @@ async function reportFailure(exit, trigger, undelivered = 0) {
   }
   cmuxStatus(down ? "down" : "error", "#ef6a6a", "alert", { alert: true, priority: 90 }); herdrAgent("blocked"); cmuxLog(`turn failed: ${reason} (exit ${exit})`, "error");
   log(`\x1b[31mreported failure to bus: ${reason} (exit ${exit})\x1b[0m`);
+  return reason;
+}
+
+// ---- a dead seat is not retried (#6134) -------------------------------------------------------
+// The redelivery ladder assumes the next attempt might work. Against a spent plan or a rejected
+// key it never will, and the cost is real: codex burned 60 turns on 09-02 doing nothing but being
+// redelivered to. So those two reasons PARK — the queue is kept, the ladder stops, and the room is
+// told once, with the reset time when the CLI printed one. `trantor up` (a restart) resumes.
+let parkAnnounced = false;
+async function parkSeat(reason, undelivered) {
+  const resetAt = parseResetAt(lastErrText);
+  const when = resetAt ? new Date(resetAt).toLocaleString() : "";
+  if (!parkAnnounced) {
+    parkAnnounced = true;
+    const text = redactKeys(`⛔ ${SESSION} PARKED (${reason}) — holding ${undelivered} message(s), redelivery stopped ${when ? `until ${when}` : `until \`trantor up ${AGENT}\``}`);
+    await api("/send", { from: SESSION, to: "all", text, project: PROJ, kind: "status" }).catch(() => {});
+    const orch = `${hostId()}:${PROJ}`;
+    if (orch !== SESSION) await api("/send", { from: SESSION, to: orch, text, project: PROJ, kind: "alert" }).catch(() => {});
+  }
+  log(`\x1b[31mparked (${reason})${when ? ` — retrying after ${when}` : " — no reset time in the output; waiting for a restart"}\x1b[0m`);
+  // No reset time means no timer can clear it: hold until the operator restarts the seat.
+  return resetAt || Number.MAX_SAFE_INTEGER;
+}
+
+// The seat's own balance rows, for the #6131 read: a stalled turn that printed nothing on a seat
+// whose plan is spent is exhaustion, not a crash. Bounded and best-effort — a slow provider API
+// must never hold up the failure path, and an unreachable one just leaves the reason as it was.
+async function balanceRows() {
+  try {
+    const { fetchBalances } = await import("../lib/balances.mjs");
+    return await Promise.race([
+      fetchBalances(process.env, { only: [AGENT] }),
+      new Promise((r) => setTimeout(() => r([]), 4000)),
+    ]);
+  } catch { return []; }
 }
 
 // ---- activity truth (#5965): the RUNNER is the source for this seat ----------------
@@ -444,17 +482,33 @@ async function notifyAssigners(pairs, text) {
 async function reportHealthy() {
   if (consecFails === 0) return;        // already healthy — don't spam
   consecFails = 0;
-  // Recovery is a change too, so the next failure is news again.
+  // Recovery is a change too, so the next failure is news again — a park included.
   announced = "";
+  parkAnnounced = false;
   await api("/register", { session: SESSION, project: PROJ, status: `active in ${PROJ}`, llm: AGENT, model: MODEL, kind: "agent" }).catch(() => {});
   await api("/send", { from: SESSION, to: "all", text: `✅ ${SESSION} recovered`, project: PROJ, kind: "status" }).catch(() => {});
   cmuxStatus("ok", "#14b8a6", "check"); herdrAgent("idle");
 }
 
+// ---- the time box (#6134) --------------------------------------------------------------------
+// A turn with no ceiling is how a seat spends an afternoon on one card: the 09-02 baseline was 151
+// turns and ~16 agentic hours across the fleet. TRANTOR_TURN_MAX_MS ends the CLI's process group
+// at the box and runs ONE follow-up turn in the SAME session — "commit what is done, move the
+// card, report in one line" — so a cut turn lands its work instead of losing it.
+const TURN_MAX_MS = Math.max(0, Number(process.env.TRANTOR_TURN_MAX_MS || 20 * 60 * 1000));
+const TIME_BOX_PROMPT = "your previous turn was cut at the time box; commit what is done, move the card with a note, report in one line";
+let inFollowUp = false;
+// The card the CURRENT CLI session belongs to (#6134). 0 = the kickoff session, which belongs to
+// no card, so the first contract that names one starts a session of its own.
+let sessionCard = 0;
+
 let sid = "";
 async function runTurn(prompt, isFirst, trigger = "kickoff") {
   TURN++; banner(trigger);
   const t0 = Date.now();
+  // A fresh session must not resume the old one's id: `first` is chosen by isFirst OR a missing
+  // sid, so a stale sid would quietly resume the session this turn exists to leave behind.
+  if (isFirst) sid = "";
   // #5965 — TURN START. The hub peer row is where the app reads activity from, and the runner is
   // the only one who knows a turn is starting, so say so before the CLI spawn (awaited: the spawn
   // below blocks the loop, an unawaited fetch would not leave the machine until the turn ended).
@@ -510,8 +564,20 @@ async function runTurn(prompt, isFirst, trigger = "kickoff") {
       { detached: true, stdio: "ignore" });
     wd.unref();
   } catch {}
-  const r = spawnSync("/bin/bash", ["-c", `set -o pipefail; { ${inner} ; } 2> >(${SCRUB} --tee2 ${ERRF})`], {
-    cwd: TURN_DIR, encoding: "utf8", stdio: cli.sid ? ["ignore", "pipe", "inherit"] : "inherit",
+  // Preserve the CLI's exit before waiting for the stderr process substitution. Without the
+  // explicit wait, a short failing CLI can return while its error is still in the scrub pipe;
+  // under load the classifier then reads an empty ERRF and reports the wrong failure reason.
+  const shell = `set -o pipefail; { ${inner} ; } 2> >(${SCRUB} --tee2 ${ERRF}); turn_exit=$?; wait; exit $turn_exit`;
+  const r = spawnSync("/bin/bash", ["-c", shell], {
+    // detached: bash leads its OWN process group, so the time box can kill the CLI and everything
+    // it spawned with one signal instead of orphaning the model process behind a dead shell.
+    // stdin is /dev/null for every seat (it already was for codex/kimi/dsh via `< /dev/null`):
+    // a detached group is a BACKGROUND group, and a background process that reads the terminal
+    // takes SIGTTIN and stops forever. Nothing here runs interactively — every CLI is in -p /
+    // exec / run mode — so closing stdin is what makes the group safe.
+    detached: true,
+    ...(TURN_MAX_MS ? { timeout: TURN_MAX_MS, killSignal: "SIGKILL" } : {}),
+    cwd: TURN_DIR, encoding: "utf8", stdio: cli.sid ? ["ignore", "pipe", "inherit"] : ["ignore", "inherit", "inherit"],
     env: { ...process.env, RELAY_URL: HUB, RELAY_AGENT: AGENT, RELAY_SESSION: SESSION, RELAY_PROJECT: PROJ,
       // A RUNNER-MANAGED SEAT MUST NEVER HAND ITSELF A BATON.
       //
@@ -527,9 +593,16 @@ async function runTurn(prompt, isFirst, trigger = "kickoff") {
     maxBuffer: 16 * 1024 * 1024,
   });
   try { unlinkSync(STAMPF); } catch {}   // turn over — disarm the watchdog
-  // #5869: scrub AT REST, synchronously, before anything reads the file back. The stderr hop is
-  // a process substitution bash does not wait for, so this pass also catches its tail — the
-  // auth classifier and the empty-output check below must judge REDACTED text and a settled file.
+  // #6134: node's timeout signals only the shell it spawned. The CLI and its children share the
+  // detached group, so sweep the whole group — otherwise a boxed turn leaves a model still running
+  // (and still billing) against a runner that has moved on.
+  const cut = !!TURN_MAX_MS && (r.error?.code === "ETIMEDOUT" || (r.signal === "SIGKILL" && Date.now() - t0 >= TURN_MAX_MS));
+  if (cut && r.pid) {
+    try { process.kill(-r.pid, "SIGKILL"); } catch {}
+    log(`\x1b[33mturn cut at the ${Math.round(TURN_MAX_MS / 1000)}s time box — CLI process group ended\x1b[0m`);
+  }
+  // #5869: scrub AT REST, synchronously, before anything reads the file back. The explicit shell
+  // wait above drains the live stderr scrubber first; this pass is defense in depth for redaction.
   try { writeFileSync(ERRF, redactKeys(readFileSync(ERRF, "utf8"))); } catch {}
   // #5868: classify only what the CLI itself said. The transcript replays the whole turn prompt
   // (rules, lessons, the wake text) — and those lines once classified healthy codex turns as
@@ -575,12 +648,23 @@ async function runTurn(prompt, isFirst, trigger = "kickoff") {
   // #5868: the verdict rides the telemetry row so a classification survives the pane scrolling
   // away — the same "classified X because Y" shape the runner logs, in the seat's jsonl forever.
   const verdict = verdictFor(realExit, effExit, lastEmptyOutput, ownOut);
-  telemetry({ ts: Date.now(), agent: AGENT, project: PROJ, turn: TURN, trigger, model: MODEL || "cli-default", duration_ms: Date.now() - t0, exit: realExit, effExit, authFailed: effExit !== realExit, emptyOutput: lastEmptyOutput, verdict });
+  // #6134: what the turn COST, from the CLI's own usage line. Zero means this CLI printed none —
+  // never that the turn was free. `trantor seat-why` totals these into today's spend per seat.
+  const tokens = parseTurnTokens(ownOut);
+  telemetry({ ts: Date.now(), agent: AGENT, project: PROJ, turn: TURN, trigger, model: MODEL || "cli-default", duration_ms: Date.now() - t0, exit: realExit, effExit, authFailed: effExit !== realExit, emptyOutput: lastEmptyOutput, verdict, ...(tokens ? { tokens } : {}), ...(cut ? { cut: true } : {}) });
   log(`turn ended (exit ${realExit}${effExit !== realExit ? ` → effective ${effExit} (${lastEmptyOutput ? "empty-output" : "auth"})` : ""}, ${((Date.now() - t0) / 1000).toFixed(0)}s)`);
   if (realExit === 0 && effExit === 0) { cmuxStatus("idle", "#8a94a6", "robot"); herdrAgent("idle"); }   // finished this turn, waiting for the next
   // #5965 — TURN END. A clean exit means the seat is idle again; say so right away so the app stops
   // pulsing it even before the next /poll heartbeat. Failure keeps reportFailure's down/errored.
   if (realExit === 0 && effExit === 0) await registerStatus("idle");
+  // The follow-up rides the SAME session, so the model still has the turn it was cut out of and
+  // only has to land it. Exactly one — a follow-up that runs long is itself boxed, and boxing a
+  // boxed turn forever is the loop this card exists to end.
+  if (cut && !inFollowUp) {
+    inFollowUp = true;
+    try { return await runTurn(TIME_BOX_PROMPT, false, "time-box follow-up"); }
+    finally { inFollowUp = false; }
+  }
   return effExit;
 }
 
@@ -652,8 +736,19 @@ function isRunnerSession(session) {
 
 function shouldWake(message) {
   if (isReceipt(message) || isStatusBroadcast(message)) return false;
+  // #6134: the SENDER decides. `wake:false` says "this is context, not a contract" — it batches
+  // into the next turn's prompt like a broadcast and never buys a CLI session of its own.
+  if (message?.wake === false) return false;
   if (message?.to === SESSION) {
     if (message?.kind === "status") return false;
+    // The safety net for every sender that never set the flag: a direct message carrying no card
+    // and no instruction is an ack, an FYI or a queue note. Those made up most of the 09-02 burn.
+    // Two exemptions, both because the shape net reads WORDS and these carry their meaning in
+    // their type: a typed alert (a failure escalation, a bounce), and an OVERSEER warning that got
+    // this far — the one chatty overseer kind is already batched by name upstream, so anything
+    // still here is file-conflict or linked-activity, which #5760 deliberately kept waking.
+    const typed = message?.kind === "alert" || /^🤝 OVERSEER /.test(String(message?.text || ""));
+    if (!typed && !isContract(message) && !carriesWork(message?.text)) return false;
     return !isRunnerSession(message?.from) || isContract(message);
   }
   return message?.to === "all"
@@ -761,7 +856,10 @@ function askedExcerpt(message) {
     const rest = msgs.filter(m => !fyi.includes(m));
     const direct = rest.filter(m => m.to === SESSION && shouldWake(m));
     const mentions = rest.filter(m => m.to === "all" && shouldWake(m));
-    const bcast = [...rest.filter(m => m.to === "all" && !mentions.includes(m)), ...fyi];
+    // Everything that did not earn a turn still becomes CONTEXT — including a DIRECT message that
+    // batched (wake:false, or an ack by shape). Dropping those would trade a token problem for a
+    // deafness problem: the seat would never learn what it was told (#6134).
+    const bcast = [...rest.filter(m => !direct.includes(m) && !mentions.includes(m)), ...fyi];
     pendingBcast.push(...bcast);                      // wake-policy: plain broadcasts batch, they don't wake
     const wake = [...direct, ...mentions];
     if (!wake.length) { if (bcast.length) { savePending(pendingWake, pendingBcast); log(`${bcast.length} broadcast(s) batched (no wake) — ${pendingBcast.length} pending`); } continue; }
@@ -807,22 +905,43 @@ function askedExcerpt(message) {
     for (const m of wake) if (m.from && !assigners.some(a => a.from === m.from)) assigners.push({ from: m.from, id: m.id });
     const asked = askedExcerpt(wake[0]);
     const tStart = Date.now();
+    // #6134: ONE SESSION PER CARD. A seat that resumes forever carries every card it ever worked
+    // into every later turn — qwen's 85.7M tokens were 96.7% cached, i.e. replayed history. The
+    // card that moved this wake decides: a different one starts a fresh CLI session, and the seat
+    // is told so, because a fresh session remembers nothing and must be sent to its card.
+    const card = wake.map(m => cardRef(m.text)).find(Boolean) || 0;
+    const fresh = card > 0 && card !== sessionCard;
+    if (card) sessionCard = card;
+    const freshText = fresh
+      ? `\n(FRESH SESSION for card #${card} — you are not the session that worked earlier cards and you remember none of them. Read your card first: relay_board with card:${card}.)\n`
+      : "";
     const prompt = composedTurn({
-      wakeText, ctxText, againText,
+      wakeText, ctxText, againText: againText + freshText,
       tailText: "\nAct on what's addressed to you, then end your turn.\n\n",
       rulesText: RULES, lessons,
     });
-    const ec = await runTurn(prompt, false, deliveryFails ? `${trigger} (redelivery)` : trigger);
+    const ec = await runTurn(prompt, fresh, deliveryFails ? `${trigger} (redelivery)` : trigger);
     const secs = Math.round((Date.now() - tStart) / 1000);
     if (ec) {
       deliveryFails++;
+      // #6131: a silent turn on a seat whose plan reads spent is exhaustion wearing a crash's
+      // clothes. Only that one reason is ever re-read, and only from the seat's own balance rows.
+      let reason = classify(ec);
+      if (reason === "empty-output") reason = reasonWithBalances(reason, await balanceRows());
+      savePending(pendingWake, pendingBcast);
+      await reportFailure(ec, "message", pendingWake.length, reason);
+      if (PARKING_REASONS.has(reason)) {
+        retryAt = await parkSeat(reason, pendingWake.length);
+        await notifyAssigners(assigners,
+          `⛔ your contract is PARKED on ${SESSION} (${reason}) — not retrying · asked: "${asked}"`);
+        lastTurnAt = Date.now();
+        return;
+      }
       const wait = RETRY_MS[Math.min(deliveryFails - 1, RETRY_MS.length - 1)];
       retryAt = Date.now() + wait;
-      savePending(pendingWake, pendingBcast);
-      await reportFailure(ec, "message", pendingWake.length);
       // The room hears the broadcast above; the one who is actually blocked hears it directly.
       await notifyAssigners(assigners,
-        `⚠️ your contract FAILED on ${SESSION} (exit ${ec}, ${classify(ec)}) · retrying in ${Math.round(wait / 1000)}s · asked: "${asked}"`);
+        `⚠️ your contract FAILED on ${SESSION} (exit ${ec}, ${reason}) · retrying in ${Math.round(wait / 1000)}s · asked: "${asked}"`);
       log(`\x1b[31m${pendingWake.length} message(s) still UNDELIVERED — next attempt in ${Math.round(wait / 1000)}s\x1b[0m`);
     } else {
       pendingWake = []; pendingBcast = []; deliveryFails = 0; retryAt = 0;

package/bin/crew.sh

@@ -792,12 +792,16 @@ resolve_spec() {
   if [ -n "$FIELD" ]; then
     case "$FIELD" in
       */*) MODEL="$FIELD" ;;
-      *)   MODEL="$(resolve_model "$AGENT" "$FIELD" "$TASK" "$DIFF")" || {
+      # A NATIVE CLI takes its model id verbatim: `claude:opus`, `codex:o3`, `kimi:k2`. The router
+      # only knows opencode providers, so it refused `claude:opus` outright (2026-09-03) and the
+      # seat silently ran the CLI default, which for claude was the most expensive model on the plan.
+      *)   if [[ "$AGENT" =~ ^(claude|codex|kimi|gemini)$ ]]; then MODEL="$FIELD"; echo "  → $AGENT: model $MODEL (native pin)"; else
+           MODEL="$(resolve_model "$AGENT" "$FIELD" "$TASK" "$DIFF")" || {
              echo "[crew] ✗ skipping seat '$AGENT' — model resolution failed for $FIELD ($TASK/$DIFF); remaining seats still launch" >&2
              SKIPPED_SEATS+=("$AGENT: model resolution failed for $FIELD ($TASK/$DIFF)")
              return 1
            }
-           echo "  → $AGENT: live model $MODEL ($FIELD · $TASK/$DIFF)" ;;
+           echo "  → $AGENT: live model $MODEL ($FIELD · $TASK/$DIFF)"; fi ;;
     esac
   fi
 }

package/bin/genesis-kickoff.mjs

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+// trantor genesis-kickoff [<project>] — which boot prompt a WOKEN orchestrator gets (#6112).
+//
+// Two paths into a project (operator ruling 2026-09-02 23:15). Path A, blank: the orchestrator
+// wakes plainly and works iteratively with the operator. Path B, from a brief: the PRD sits in
+// docs/PRD.md and the wake CONVENES the crew review (/trantor:prd-review) before anything is
+// built. Waking an adopted project that has docs/PRD.md and no build cards takes path B too, so
+// a project that parked with its PRD in place needs no re-genesis: the next Wake convenes it.
+//
+// The decision needs two facts only the CLI holds together — the checkout's durable docs/PRD.md
+// and the project's SIGNED board — so it lives here. The desktop app (genesis sheet, sidebar
+// Wake, workspace open) runs this in the checkout and relays the one line it prints; on exit 1
+// the app types its own plain wake instead. A board that cannot be read therefore fails CLOSED
+// to the plain wake, never to a review nobody verified was due: the plain-woken orchestrator
+// still sees docs/PRD.md and the CLAUDE.md pointer and can convene by hand.
+import { existsSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { loadIdentity, signedGet } from "../hooks/lib/api.mjs";
+import { ensureEnrolled as enrollViaOwnerInvite } from "../lib/enroll.mjs";
+import { hostId, resolveHub, resolveProject } from "../lib/project.mjs";
+
+export const PRD_REVIEW_KICKOFF = "docs/PRD.md is the brief; run /trantor:prd-review";
+// Word for word the app's WAKE_KICKOFF_PROMPT (desktop terminal.rs): a project without a brief to
+// review gets exactly the wake it always got.
+export const PLAIN_WAKE_KICKOFF = "You were just woken via Trantor. Catch up from your context — the handoff you were handed if one exists, otherwise the project board and memory — then recap where things stand in at most 3 sentences and wait.";
+
+// Cards that exist BEFORE a build starts, and must not be mistaken for one: the genesis card
+// `trantor new` opens, the review cards this flow opens, and the auto-cards a session sheds
+// (operator prompts, sub-agents) which say a conversation happened, not that work was cut.
+const PRE_BUILD_PHASES = new Set(["genesis", "prd", "tdd"]);
+const PRE_BUILD_TITLE = /^(genesis:|prd review:|tdd review:)/i;
+const CONVERSATION_SOURCES = new Set(["session", "cc-subagent", "cc-bg-agent"]);
+
+export function isBuildCard(task) {
+  if (!task || typeof task !== "object") return false;
+  const phase = String(task.phase || "").trim().toLowerCase();
+  if (phase === "build") return true;
+  if (PRE_BUILD_PHASES.has(phase)) return false;
+  if (CONVERSATION_SOURCES.has(String(task.source || "").trim().toLowerCase())) return false;
+  const title = String(task.title || "").trim();
+  return Boolean(title) && !PRE_BUILD_TITLE.test(title);
+}
+
+// The pure decision: dir = the checkout, tasks = the board (an array), or null when it could not
+// be read. Exported so the drill can pin every branch without a hub.
+export function selectGenesisKickoff({ dir, tasks }) {
+  if (!existsSync(join(dir, "docs", "PRD.md"))) return PLAIN_WAKE_KICKOFF;
+  if (!Array.isArray(tasks)) return PLAIN_WAKE_KICKOFF;
+  return tasks.some(isBuildCard) ? PLAIN_WAKE_KICKOFF : PRD_REVIEW_KICKOFF;
+}
+
+async function readBoard(project) {
+  const hub = resolveHub(project);
+  // Sign as the identity the orchestrator in this checkout will use (RELAY_SESSION when a runner
+  // set one, else host:project). On an enforce hub that identity may be brand new for a project
+  // `trantor new` made seconds ago, and TOFU is refused there — so enrol the way crew seats and
+  // genesis itself do: the operator's owner key mints a project-scoped invite and this identity
+  // spends it. A no-op when the hub already knows us; a soft failure when it does not, in which
+  // case the signed read below reports the refusal and the caller falls back.
+  const session = process.env.RELAY_SESSION
+    || (process.env.RELAY_AGENT ? `${process.env.RELAY_AGENT}:${project}` : `${hostId()}:${project}`);
+  const identity = loadIdentity(session);
+  const enrolment = await enrollViaOwnerInvite(hub, identity, project, { timeoutMs: 4000 });
+  if (!enrolment.ok && enrolment.reason !== "no-owner-key") {
+    console.error(`genesis kickoff: enrolment on ${hub} did not succeed (${enrolment.reason}); trying the read anyway`);
+  }
+  const response = await signedGet(`/tasks?project=${encodeURIComponent(project)}`, { session, project, timeoutMs: 4000 });
+  if (!response.ok) {
+    return { ok: false, hub, reason: response.status ? `hub ${response.status}${response.json?.error ? `: ${response.json.error}` : ""}` : "unreachable" };
+  }
+  const tasks = Array.isArray(response.json) ? response.json : response.json?.tasks;
+  return Array.isArray(tasks) ? { ok: true, hub, tasks } : { ok: false, hub, reason: "malformed /tasks response" };
+}
+
+async function main() {
+  const dir = process.cwd();
+  const project = process.argv[2] || resolveProject(dir);
+  if (!existsSync(join(dir, "docs", "PRD.md"))) {
+    console.log(PLAIN_WAKE_KICKOFF);
+    return;
+  }
+  const board = await readBoard(project);
+  if (!board.ok) {
+    console.error(`genesis kickoff: docs/PRD.md is present but ${project}'s board on ${board.hub} could not be read (${board.reason}) — the app falls back to the plain wake`);
+    process.exitCode = 1;
+    return;
+  }
+  console.log(selectGenesisKickoff({ dir, tasks: board.tasks }));
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) await main();

package/bin/new.mjs

@@ -6,8 +6,8 @@
 // It makes the project directory at <parent>/<name> — --dir names the PARENT, never the project
 // directory itself (default parent: TRANTOR_DEV_ROOT or ~/development). The name is always
 // appended under it, so `--dir P` with name N creates P/N. Starts git on main (or clones --from,
-// or adopts an existing folder with --adopt), seeds CLAUDE.md from the
-// brief (verbatim brief + the trantor conventions block), installs the same auto-card hook as
+// or adopts an existing folder with --adopt), stores the brief in docs/PRD.md and seeds a small
+// CLAUDE.md pointer plus the trantor conventions block, installs the same auto-card hook as
 // `trantor init-hooks`, posts the brief as the hub project brief (POST /project — the same call
 // relay_project_brief makes), and opens the first card "genesis: <name>" on the new board.
 //
@@ -17,7 +17,7 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync, appendFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, isAbsolute, join, resolve } from "node:path";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { ensureEnrolled as enrollTofu, loadIdentity, signedPost } from "../hooks/lib/api.mjs";
 import { ensureEnrolled as enrollViaOwnerInvite } from "../lib/enroll.mjs";
@@ -28,7 +28,7 @@ const ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
 
 // The trantor conventions block — what every trantor-wired project's CLAUDE.md carries so the
 // first session knows the board, the crew, and the gates exist. Kept SHORT and factual; the
-// brief above it is the project's own voice.
+// project brief stays in docs/PRD.md so a large PRD cannot exceed the harness instruction limit.
 const CONVENTIONS = [
   "",
   "## Trantor conventions",
@@ -94,13 +94,22 @@ if (from) {
   branch = git(["branch", "--show-current"]).stdout.trim() || "main";
 }
 
-// ── CLAUDE.md — verbatim brief + the conventions block ──────────────────────────────────────────
+// ── durable brief + small CLAUDE.md pointer ─────────────────────────────────────────────────────
+if (brief) {
+  const docs = join(dir, "docs");
+  mkdirSync(docs, { recursive: true });
+  writeFileSync(join(docs, "PRD.md"), `${brief}\n`);
+}
+
 const claude = join(dir, "CLAUDE.md");
 if (existsSync(claude)) {
   const current = readFileSync(claude, "utf8");
   if (!current.includes("## Trantor conventions")) appendFileSync(claude, `\n${CONVENTIONS}\n`);
 } else {
-  const head = brief ? `${brief}\n` : `# ${name}\n\n(Genesis — no brief was given. Add this project's what/why/goal here.)\n`;
+  const importedFrom = briefFile ? ` (imported from \`${basename(briefFile)}\`)` : "";
+  const head = brief
+    ? `# ${name}\n\nThe project brief is stored at \`docs/PRD.md\`${importedFrom}. Read and maintain it there.\n`
+    : `# ${name}\n\nNo project brief was supplied. Begin with the operator's first instruction.\n`;
   writeFileSync(claude, `${head}${CONVENTIONS}`);
 }
 
@@ -161,7 +170,9 @@ if (json) {
   console.log(JSON.stringify({ name, parent: devRoot, dir, branch, hub, card }));
 } else {
   console.log(`✓ ${dir} (${branch}${from ? ", cloned" : adopt ? ", adopted" : ""})`);
-  console.log(`✓ CLAUDE.md seeded${brief ? " from the brief" : " (no brief — add the project's what/why/goal)"}`);
+  console.log(brief
+    ? "✓ docs/PRD.md seeded from the brief; CLAUDE.md kept small"
+    : "✓ blank project seeded; CLAUDE.md kept small");
   console.log(`✓ auto-card hook installed (trantor init-hooks)`);
   if (card !== null) console.log(`✓ hub ${hub}: brief posted, card #${card} ("genesis: ${name}")`);
   else if (hubError) console.log(`! hub ${hub}: brief/card not posted (${hubError})`);

package/bin/seat-why.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // trantor seat-why <agent> [--json] — explain why a crew seat is (not) working, straight from
 // local ~/.agent-bus evidence. No hub needed; works even when the whole fleet is down.
-import { seatWhy } from "../lib/seat-why.mjs";
+import { seatWhy, fmtSpend } from "../lib/seat-why.mjs";
 import { resolveProject } from "../lib/project.mjs";
 
 const args = process.argv.slice(2);
@@ -23,5 +23,6 @@ if (asJson) {
 } else {
   console.log(`seat ${agent}:${project} -> ${out.state}`);
   console.log(`why:    ${out.why}`);
+  console.log(`today:  ${fmtSpend(out.today)}`);
   console.log(`advice: ${out.advice}`);
 }

package/hub.mjs

@@ -2786,7 +2786,11 @@ const server = http.createServer(async (req, res) => {
       // side, which is how an orchestrator ends up waiting forever on a dead peer.
       const re = Number.isFinite(Number(b.re)) && Number(b.re) > 0 ? Number(b.re) : 0;
       const kind = String(b.kind || "").slice(0, 40);
-      const msg = { id: ++state.seq, ts: now(), from: b.from || "anon", to: b.to || "all", text, project: String(b.project || fromProj || "").slice(0, 80), ...(re ? { re } : {}), ...(kind ? { kind } : {}) };
+      // `wake:false` is the SENDER saying this message is context, not a contract: the receiving
+      // runner batches it into that seat's next turn instead of spending a whole CLI session on
+      // it (#6134). Stored only when false — absent means wake, so every older client is unchanged.
+      const wake = b.wake === false ? { wake: false } : {};
+      const msg = { id: ++state.seq, ts: now(), from: b.from || "anon", to: b.to || "all", text, project: String(b.project || fromProj || "").slice(0, 80), ...(re ? { re } : {}), ...(kind ? { kind } : {}), ...wake };
       state.messages.push(msg); if (state.messages.length > 5000) state.messages.splice(0, 1000);
       dirty = true; pushToStreams(msg);               // <-- instant push to live watchers
       // Mirror onto the unified log. `refs` = the card ids this message cites (#3701), which is what

package/lib/seat-why.mjs

@@ -61,6 +61,32 @@ const rel = (ts) => {
   return `${Math.round(s / 3600)}h ago`;
 };
 
+// What this seat has SPENT today (#6134). The turn count is the number that mattered on 09-02:
+// 151 turns and ~16 agentic hours across the fleet, most of it redelivery and coordination noise.
+// Tokens come from each CLI's own usage line (the runner parses it onto the turn's row); CLIs that
+// print none contribute 0, which is why the count is reported alongside — "3 of 7 turns reported".
+export function todaySpend(telemetry, now = Date.now()) {
+  const midnight = new Date(now); midnight.setHours(0, 0, 0, 0);
+  const rows = telemetry.filter(r => typeof r.turn === "number" && r.ts >= midnight.getTime());
+  const withTokens = rows.filter(r => Number(r.tokens) > 0);
+  return {
+    turns: rows.length,
+    minutes: Math.round(rows.reduce((a, r) => a + (Number(r.duration_ms) || 0), 0) / 60000),
+    tokens: withTokens.reduce((a, r) => a + Number(r.tokens), 0),
+    reported: withTokens.length,
+    cut: rows.filter(r => r.cut).length,
+  };
+}
+
+export function fmtSpend(s) {
+  const bits = [`${s.turns} turn${s.turns === 1 ? "" : "s"}`, `${s.minutes}m`];
+  bits.push(s.reported
+    ? `${s.tokens.toLocaleString("en-US")} tokens (${s.reported}/${s.turns} turns reported)`
+    : "tokens not reported by this CLI");
+  if (s.cut) bits.push(`${s.cut} cut at the time box`);
+  return bits.join(" · ");
+}
+
 export function seatWhy(project, agent, opts = {}) {
   const dir = opts.dir || busDir();
   const errText = readF(join(dir, `err-${agent}-${project}.txt`));
@@ -117,7 +143,7 @@ export function seatWhy(project, agent, opts = {}) {
     }
   }
 
-  return { state, why, advice };
+  return { state, why, advice, today: todaySpend(telemetry, opts.now) };
 }
 
 export { fmt, rel };

package/lib/turn-policy.mjs

@@ -0,0 +1,114 @@
+// Per-turn policy for a crew seat (#6134) — the rules that decide whether a bus message is worth
+// a CLI turn at all, which card a session belongs to, what a turn cost, and when an exhausted seat
+// is allowed to be woken again.
+//
+// These live here rather than in bin/crew-runner.mjs because the runner is a self-executing script
+// (top-level await, spawns turns on import), so nothing in it can be unit-tested directly. The
+// drill still drives the REAL runner end to end; these functions are what it can assert on cheaply.
+//
+// The burn this exists to stop: on 09-02 the fleet spent 151 turns and ~16 agentic hours, codex
+// alone taking 60 turns of pure redelivery, and qwen 85.7M tokens at 96.7% cached — i.e. the same
+// history replayed over and over. Every rule below removes one class of turn that never had work
+// in it.
+
+/// The first card a message cites. A turn belongs to exactly one card, and this is how the runner
+/// knows when a wake has moved to a different one.
+export const CARD_REF_RE = /#(\d{1,7})(?!\d)/;
+
+/// Words that make a direct message an instruction rather than conversation. Deliberately short:
+/// the point is to catch a contract that forgot to cite its card, not to parse English.
+export const IMPERATIVE_RE = /\b(deliver|fix|bounce|contract|next|resume)\b/i;
+
+export function cardRef(text) {
+  const m = CARD_REF_RE.exec(String(text || ""));
+  return m ? Number(m[1]) : 0;
+}
+
+export function hasImperative(text) {
+  return IMPERATIVE_RE.test(String(text || ""));
+}
+
+/// The safety net for a sender that never set `wake`: a direct message with no card and no
+/// imperative is an ack, an FYI or a queue note, and it batches into the next turn's context.
+export function carriesWork(text) {
+  return cardRef(text) > 0 || hasImperative(text);
+}
+
+// ---- what a turn cost -------------------------------------------------------------------------
+// Each CLI reports its own usage in its own words, and some report none at all. Ordered most
+// specific first; the LAST match of the first pattern that hits wins, because a CLI that prints a
+// running total prints the real one last. Zero means "this CLI said nothing", never "free".
+const TOKEN_PATTERNS = [
+  /tokens used[:\s]+([\d,]+)/gi,        // codex
+  /\btotal tokens[:\s]+([\d,]+)/gi,     // opencode / glm / deepseek summaries
+  /\btokens[:\s]+([\d,]+)/gi,           // "Tokens: 12,345"
+  /([\d,]+)\s+tokens\b/gi,              // "12,345 tokens"
+];
+
+export function parseTurnTokens(text) {
+  const s = String(text || "");
+  for (const re of TOKEN_PATTERNS) {
+    re.lastIndex = 0;
+    let last = 0;
+    for (const m of s.matchAll(re)) {
+      const n = Number(String(m[1]).replace(/,/g, ""));
+      if (Number.isFinite(n)) last = n;
+    }
+    if (last) return last;
+  }
+  return 0;
+}
+
+// ---- when an exhausted seat may be woken again ------------------------------------------------
+// A CLI that hits its plan wall usually says when the wall lifts. Parsing it turns a blind retry
+// ladder (60 redelivery turns on codex, 09-02) into one wait.
+const MONTHS = "jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec";
+const RESET_ABS_RE = new RegExp(
+  String.raw`try again (?:at|on|after)\s+((?:${MONTHS})[a-z]*\.?\s+\d{1,2}(?:st|nd|rd|th)?,?\s+\d{4},?\s+\d{1,2}:\d{2}(?::\d{2})?\s*(?:am|pm)?)`,
+  "i",
+);
+const RESET_REL_RE = /try again in\s+(\d+)\s*(second|minute|hour|day)s?/i;
+
+/// The epoch ms at which this seat may be retried, or 0 when the output named no time.
+export function parseResetAt(text, now = Date.now()) {
+  const s = String(text || "");
+
+  const abs = RESET_ABS_RE.exec(s);
+  if (abs) {
+    // "Sep 3rd, 2026 3:34 AM" — Date.parse rejects the ordinal suffix, so drop it.
+    const t = Date.parse(abs[1].replace(/(\d{1,2})(st|nd|rd|th)/i, "$1"));
+    if (Number.isFinite(t) && t > now) return t;
+  }
+
+  const rel = RESET_REL_RE.exec(s);
+  if (rel) {
+    const unit = { second: 1e3, minute: 60e3, hour: 3600e3, day: 86400e3 }[rel[2].toLowerCase()];
+    if (unit) return now + Number(rel[1]) * unit;
+  }
+
+  return 0;
+}
+
+/// #6131: a qwen seat whose token plan is spent does not error — it stalls and returns nothing, so
+/// the runner classified it `empty-output` and kept the ladder running against a wall. A silent
+/// turn on a seat whose own balance row reads spent IS exhaustion, and parks like one.
+export function quotaSpent(rows) {
+  return (Array.isArray(rows) ? rows : []).some((r) => {
+    if (!r || !r.ok) return false;
+    if (r.kind === "quota") return r.remainingPct != null && r.remainingPct <= 0;
+    if (r.kind === "windows") {
+      return (r.windows || []).some((w) => w.locked || (w.usedPct != null && w.usedPct >= 100));
+    }
+    return r.remaining != null && r.remaining <= 0;
+  });
+}
+
+/// The failure reason a turn should be treated as, given what the seat's balances say. Only
+/// `empty-output` is ever re-read this way: every other reason already carries its own evidence.
+export function reasonWithBalances(reason, rows) {
+  return reason === "empty-output" && quotaSpent(rows) ? "exhausted" : reason;
+}
+
+/// Seats that park rather than retry. A backend error is the provider having a bad minute and the
+/// ladder is exactly right for it; a spent plan or a rejected key will not fix itself on a timer.
+export const PARKING_REASONS = new Set(["exhausted", "auth"]);

package/mcp.mjs

@@ -314,12 +314,55 @@ server.tool("relay_withdraw_proposal", "Withdraw one of THIS session's PENDING p
     return { content: [{ type: "text", text: `proposal #${id} withdrawn — one queue slot free` }] };
   });
 
+// ONE card, not the board (#6134). A seat used to be told to "query the board for related PAST
+// cards and lessons — 1900+ cards of tribal knowledge", and it did: the whole board, every turn,
+// almost all of it other people's work. This is the same intent at a thousandth of the tokens —
+// the card, what it waits on, its own notes, and the handful of done cards that actually rhyme
+// with it. Client-side on /tasks, so no hub change and it works against any hub version.
+const STOPWORDS = new Set(["the","a","an","and","or","of","to","in","on","for","with","is","it","its","that","this","not","but","by","at","as","from","into","out","up","down","when","then","than","so","no","new","one","two","every","all","any"]);
+function titleWords(title) {
+  return new Set(String(title || "").toLowerCase().match(/[a-z][a-z0-9_-]{2,}/g)?.filter(w => !STOPWORDS.has(w)) || []);
+}
+function cardView(tasks, id, proj) {
+  const card = tasks.find(t => t.id === id);
+  if (!card) return `${proj}: no card #${id}`;
+  const out = [`#${card.id} ${card.title}`,
+    `status: ${card.status}${card.assignee ? ` · @${card.assignee}` : ""}${card.difficulty ? ` · ${card.difficulty}` : ""}${card.model ? ` · ${card.model}` : ""}`];
+
+  const deps = (Array.isArray(card.deps) ? card.deps : []).map(d => {
+    const t = tasks.find(x => x.id === d);
+    return t ? `#${t.id} ${t.title} [${t.status}]` : `#${d} (not on this board)`;
+  });
+  if (deps.length) out.push(`depends on:\n  ${deps.join("\n  ")}`);
+
+  if (Array.isArray(card.checklist) && card.checklist.length) {
+    out.push(`checklist:\n  ${card.checklist.map((c, i) => `[${c.done ? "x" : " "}] ${i}. ${c.text || c}`).join("\n  ")}`);
+  }
+
+  const log = Array.isArray(card.log) ? card.log : [];
+  if (log.length) out.push(`notes (${log.length}):\n  ${log.map(e => `${e.by || "?"}: ${String(e.text || "").replace(/\s+/g, " ")}`).join("\n  ")}`);
+
+  // The prior art that is actually prior art: done cards whose title shares a real word with this
+  // one. Five, newest first — enough to catch "we already did this", short enough to stay cheap.
+  const mine = titleWords(card.title);
+  const kin = tasks
+    .filter(t => t.status === "done" && t.id !== card.id && [...titleWords(t.title)].some(w => mine.has(w)))
+    .sort((a, b) => (b.updated || b.ts || 0) - (a.updated || a.ts || 0))
+    .slice(0, 5)
+    .map(t => `#${t.id} ${t.title}${t.log?.length ? ` ·${t.log.length}` : ""}`);
+  if (kin.length) out.push(`related done cards:\n  ${kin.join("\n  ")}`);
+
+  return out.join("\n");
+}
+
 server.tool("relay_board", "Show a project's Kanban board (all cards + their status + assignee). Defaults to THIS project; pass `project` to read a crew board you orchestrate from elsewhere. Cards carrying log notes show a ·N count (the card's note-log size).",
-  { project: z.string().optional().describe("board to show (default: this session's project)") },
-  async ({ project }) => {
+  { project: z.string().optional().describe("board to show (default: this session's project)"),
+    card: z.number().optional().describe("read ONE card instead of the board: the card itself, its notes, and the last five done cards whose title shares a word with it. This is what a seat starting a card should call — the whole board is 1900+ cards of someone else's work.") },
+  async ({ project, card }) => {
   const proj = project || PROJECT;
   const { tasks } = await api("GET", `/tasks?project=${encodeURIComponent(proj)}`);
   if (!tasks.length) return { content: [{ type: "text", text: `${proj}: no cards yet` }] };
+  if (card) return { content: [{ type: "text", text: cardView(tasks, card, proj) }] };
   const by = { todo: [], doing: [], testing: [], failed: [], done: [], blocked: [] };
   for (const t of tasks) (by[t.status] || by.todo).push(`#${t.id} ${t.title}${t.assignee ? ` (@${t.assignee})` : ""}${t.log?.length ? ` ·${t.log.length}` : ""}`);
   const cols = Object.entries(by).filter(([, v]) => v.length).map(([k, v]) => `${k.toUpperCase()}:\n  ${v.join("\n  ")}`);
@@ -338,16 +381,17 @@ server.tool("relay_peers", "Find who you can talk to: the live agent sessions on
 });
 
 server.tool("relay_send", "Send a live message to another agent session (or 'all' to broadcast). Reach the other agent YOURSELF: if you are about to ask the human to pass something along, tell the session directly instead — asking a person to carry a message between two agents is a failure, not politeness. Don't know the id? relay_peers lists them, linked projects included. Cross-project sends are allowed.",
-  { to: z.string().describe("target session id, or 'all'"), text: z.string().describe("message body") },
-  async ({ to, text }) => {
+  { to: z.string().describe("target session id, or 'all'"), text: z.string().describe("message body"),
+    wake: z.boolean().optional().describe("false = context, not a contract: the message batches into the target's next turn instead of buying it a whole CLI session. Use it for acks, FYIs and queue notes; leave it unset for anything you expect worked on.") },
+  async ({ to, text, wake }) => {
     // The event log is append-only — a secret in it is unrecoverable, so refuse BEFORE
     // anything reaches the hub. Returns the offending kinds so the caller can fix it.
     const scrub = assertNoSecrets(text);
     if (!scrub.ok) {
       return { content: [{ type: "text", text: `REFUSED — not sent. Credential-shaped string(s) detected: ${scrub.kinds.join(", ")}. Remove them and resend.` }], isError: true };
     }
-    const { id } = await api("POST", "/send", { from: SESSION, to, text });
-    return { content: [{ type: "text", text: `sent #${id} to ${to}` }] };
+    const { id } = await api("POST", "/send", { from: SESSION, to, text, ...(wake === false ? { wake: false } : {}) });
+    return { content: [{ type: "text", text: `sent #${id} to ${to}${wake === false ? " (batched — no turn)" : ""}` }] };
   });
 
 server.tool("relay_status", "Set this session's one-line status on the presence board (what you're working on / idle). Cheap — other sessions read it instantly via relay_peers without messaging you.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.33",
+  "version": "0.18.35",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"
@@ -11,7 +11,7 @@
     "zod": "^4.4.3"
   },
   "scripts": {
-    "test": "node bin/slop-gate.mjs --surface desktop/src && node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-redelivery.mjs && node test-crew-completion.mjs && node test-contracts.mjs && node test-autonomy.mjs && node test-integrate.mjs && node test-handoff.mjs && node test-handoff-summarizer.mjs && node test-baton-turn-boundary.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-baton-latest.mjs && node test-balances.mjs && node test-usage-live.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-cursor-rewind.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-cardlog.mjs && node test-checklist.mjs && node test-relay-note.mjs && node test-reaper.mjs && node test-events.mjs && node test-proposals.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-persist-safety.mjs && node test-message-re.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-duty-dark.mjs && node test-duty-seat.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-crew-env.mjs && node test-desktop-transport.mjs && node test-crew-worktree.mjs && node test-crew-redact.mjs && node test-crew-classify.mjs && bash test-crew-herdr.sh && npm --prefix desktop run test --silent && node test-splitbrain.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-provider-cli.mjs && node test-crew-model-defaults.mjs && node test-inbox-delivery.mjs && node test-identity-drift.mjs && node test-inbox-staleness.mjs && node test-seats.mjs && node test-seat-identity.mjs && node test-hub-routing.mjs && node test-hook-routing.mjs && node test-relay-wait.mjs && node test-dsh-seat.mjs && node test-kimi-bridge.mjs && node test-kimi-events.mjs && python3 engine/test-routing.py && node test-new.mjs && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && node test-bridge.mjs && bash test-crew.sh"
+    "test": "node bin/slop-gate.mjs --surface desktop/src && node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-redelivery.mjs && node test-crew-completion.mjs && node test-contracts.mjs && node test-autonomy.mjs && node test-integrate.mjs && node test-handoff.mjs && node test-handoff-summarizer.mjs && node test-baton-turn-boundary.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-baton-latest.mjs && node test-balances.mjs && node test-usage-live.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-cursor-rewind.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-cardlog.mjs && node test-checklist.mjs && node test-relay-note.mjs && node test-reaper.mjs && node test-events.mjs && node test-proposals.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-persist-safety.mjs && node test-message-re.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-duty-dark.mjs && node test-duty-seat.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-crew-env.mjs && node test-desktop-transport.mjs && node test-crew-worktree.mjs && node test-crew-redact.mjs && node test-crew-classify.mjs && bash test-crew-herdr.sh && npm --prefix desktop run test --silent && node test-splitbrain.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-provider-cli.mjs && node test-crew-model-defaults.mjs && node test-inbox-delivery.mjs && node test-identity-drift.mjs && node test-inbox-staleness.mjs && node test-seats.mjs && node test-seat-identity.mjs && node test-hub-routing.mjs && node test-hook-routing.mjs && node test-relay-wait.mjs && node test-dsh-seat.mjs && node test-kimi-bridge.mjs && node test-kimi-events.mjs && python3 engine/test-routing.py && node test-new.mjs && node test-prd-review.mjs && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && node test-bridge.mjs && bash test-crew.sh"
   },
   "description": "The hub-world for AI agent crews — orchestrate Claude Code, Codex, GLM, Kimi, DeepSeek & any OpenRouter model as live crews with a plan-aware Advisor, a Kanban/flow command center, a testing gate, and an economics brain (Scrooge).",
   "files": [

package/skills/prd-review/SKILL.md

@@ -0,0 +1,159 @@
+---
+name: prd-review
+description: |
+  Convene the crew's review of a project's brief (docs/PRD.md) and then of its design
+  (docs/TDD.md): every live crew seat plus two Scrooge readers review the document independently
+  against one rubric, the orchestrator synthesizes their verdicts into one consensus and puts it
+  to the operator, and the build cards open only after the TDD passes. Use when a wake says
+  "docs/PRD.md is the brief; run /trantor:prd-review", when asked to have the crew review a PRD
+  or a TDD, or to resume at the TDD phase. Trigger: /trantor:prd-review [prd|tdd]
+user-invocable: true
+argument-hint: "[prd|tdd]"
+---
+
+# PRD review: the crew reads the brief before anyone builds
+
+Ruled by the operator on 2026-09-02: every PRD that gets ingested is reviewed by as many members
+of the crew as are live, the crew reaches consensus on whether it is good enough to move on to the
+TDD, the TDD gets the same review, and only then does the build start. A solo orchestrator that
+recaps the brief and proposes a plan is exactly what this replaces: one reader's blind spots become
+the product's. Lateral cross-review is the reliability argument, so the reviews are INDEPENDENT.
+
+You are the project's ORCHESTRATOR. You convene, you dispatch, you synthesize, you record. You do
+not review the document yourself and you never vote: a verdict of yours would be one more opinion
+from the one seat that also decides what the opinions mean.
+
+Phase argument: none or `prd` runs the PRD phase and continues into the TDD phase on a pass;
+`tdd` resumes at the TDD phase when the PRD card is already done (a turn or a session ended in
+between).
+
+## 0. The board first
+
+1. `relay_board`. A card titled `PRD review: <project>` (for `tdd`: `TDD review: <project>`)
+   that is not done is THE card: continue on it, never open a second one. Its notes hold the
+   roster and every verdict so far.
+2. `docs/PRD.md` must exist in the checkout. If it does not, say so and stop: there is nothing to
+   review, and a review of a brief that is not written down is not a review.
+
+## 1. Establish the reviewers
+
+The reviewers are, by the ruling, every live seat of the project's crew plus two Scrooge readers
+on two different models.
+
+1. **Crew seats.** `relay_peers` lists the live sessions. A reviewer is every online
+   `<cli>:<project>` seat of THIS project (`codex:<project>`, `glm:<project>`, `kimi:<project>`,
+   …). Not reviewers: you, the operator's host session (`<host>:<project>`), and tool
+   identities such as `genesis:<project>`.
+2. **No crew live?** Bring one up FIRST through `/trantor:crew`: `relay_advise` with the review
+   as the work, then `trantor up …` with the SUBSCRIPTION seats the operator's profile declares
+   (`trantor profile`), and read the launcher's verdict: only a seat that verified on the bus
+   reviews. Choosing the brief path already authorized a review crew; do not ask again, and do
+   not substitute metered API seats the profile did not select.
+3. **Two Scrooge readers.** `relay_scrooge` twice with the identical rubric and the full text of
+   `docs/PRD.md` in the prompt (the cheap model sees only the prompt; use `task: "reason"`, or
+   `task: "long-context"` for a brief beyond about 40k characters). Each receipt names its
+   `provider/model`; the two must differ. If the second lands on the same model, retry it at a
+   different `difficulty` (the router escalates to a different model). If two distinct models
+   cannot be had, proceed with one and say so on the card: never describe one model twice as two
+   independent readers.
+
+The roster (seat ids plus the two `provider/model` receipts) goes into the review card's opening
+note and is FROZEN: the TDD phase uses the same seats and the same two models. A seat that dies
+between phases is restored with `trantor up`, not replaced by a different reviewer.
+
+## 2. The rubric
+
+One rubric for every reviewer, in this order, in these words:
+
+1. **completeness** — what the brief covers and what it leaves unsaid;
+2. **ambiguity** — statements that two builders would implement differently;
+3. **feasibility and risk** — what is hard, what could fail, what depends on the unknown;
+4. **missing requirements** — what the brief needs and does not contain;
+5. **a proposed scope cut** — the one thing to drop or defer first;
+6. **VERDICT: READY** or **VERDICT: REVISE**, with the gaps listed.
+
+A review note that lacks any of the six parts is incomplete: bounce it to the reviewer with a
+direct message naming the missing part. Never fill a part in on a reviewer's behalf.
+
+## 3. One card, one item per reviewer
+
+Run the two Scrooge reads first (they are stateless and need no card id), then open the card with
+`relay_task_add`:
+
+- title `PRD review: <project>`, phase `PRD`, difficulty `hard`, assigned to you, status `doing`;
+- `checklist`: exactly ONE item per reviewer, labelled with the reviewer's identity
+  (`codex:<project>`, `glm:<project>`, `scrooge deepseek/deepseek-v4-flash`, …);
+- the opening `note`: the document path, the frozen roster, the six-part rubric, and the consensus
+  rule from §4.
+
+Append each Scrooge verdict UNCHANGED as a card note prefixed with its receipt's model, then tick
+that model's item. Carrying a reader's verdict onto the card is transport, not a vote of yours.
+
+Then `relay_send` every crew seat the same contract, as a DIRECT message (broadcasts do not wake
+a seat), under 280 characters:
+
+> PRD review card #<id>: read docs/PRD.md in your worktree. Note on the card, in order:
+> completeness, ambiguity, feasibility+risk, missing requirements, one proposed scope cut, then
+> VERDICT READY|REVISE with the gaps. Tick your item (index <n>). No file edits.
+
+A seat records its review with `relay_task_move` to the card's CURRENT status carrying the note
+(the note is the review; the move is how a note lands), then ticks only its own checklist item
+with `relay_task_check`. Reviews are independent: a seat that quotes another seat's note gets a
+bounce, not a tick.
+
+## 4. Consensus, then the operator
+
+Supervise as the crew skill's foreman loop: `relay_wait`, sweep the card and `relay_peers`, nudge
+a silent seat by direct message, `trantor up` a dead one and resend its contract. The review is
+in when every checklist item is ticked and every note has the six parts.
+
+- **All READY** = the crew's pass.
+- **Any REVISE** = you merge every gap from every reviewer, READY ones included, into ONE
+  revision request: deduplicated, attributed, ordered by how many reviewers raised it.
+
+Either way the outcome goes to the OPERATOR in ask mode: this gate is always asked, never
+auto-fired. Present the roster, one line per verdict, the merged revision request when there is
+one, and the crew's outcome, then ask (`AskUserQuestion` when the harness offers it, plain chat
+otherwise). The operator may confirm the consensus, override a REVISE into a pass, or send a
+unanimous READY back for revision. Record the decision and its reason as a card note.
+
+- **Pass:** move the card to `testing` with the tally (`n READY / m REVISE`, the decision), then
+  to `done`. Continue with the TDD phase.
+- **Revise:** hand the operator the revision request; the operator revises `docs/PRD.md` or asks
+  you to draft the revision for their approval. When the file changes, untick every item
+  (`relay_task_check` with `done: false`), re-dispatch the same roster on the SAME card, and
+  repeat §3 and §4.
+
+## 5. TDD phase (`/trantor:prd-review tdd` resumes here)
+
+The PRD card is done. Now one author writes the design and the same reviewers review it.
+
+1. **Author.** Pick ONE live crew seat as the author (the strongest coding seat the profile
+   gives you; say which and why on the card). Its contract: write `docs/TDD.md` from the accepted
+   PRD, covering architecture, the interfaces and data flow (the event/interface contract between
+   agents), file ownership as one file-set per seat, dependencies, the verification plan, risks,
+   and a work breakdown of build packages each tagged `easy|medium|hard`. The author does not
+   review its own design.
+2. **Card.** Open or reuse exactly one `TDD review: <project>` card in phase `TDD`. Its checklist
+   starts with `author <seat>: docs/TDD.md written`, followed by one item per reviewer of the
+   frozen roster minus the author. The author ticks its item only once the file exists.
+3. **Rubric, adapted to a design:** completeness (every PRD requirement has a home in the design),
+   ambiguity, feasibility and risk, missing design pieces (interfaces, ownership, verification),
+   a proposed scope cut, `VERDICT: READY` or `VERDICT: REVISE` with the gaps. Same Scrooge reads
+   with `docs/TDD.md` in the prompt, same direct contracts to the seats, same note shape, same
+   ticking rule.
+4. **Same consensus, same operator gate** as §4, on the TDD card. A revision goes back to the
+   author, not to the operator to write.
+
+## 6. On a TDD pass: the build cards open themselves
+
+The confirmed TDD is the gate. Do not ask the operator again merely to open its build cards.
+
+1. Move the TDD card through `testing` to `done` with the tally and the decision.
+2. `relay_advise` with the work breakdown's packages, then one `relay_task_add` per package:
+   phase `build`, the advisor's assignee and `model`, its `difficulty`, `deps` on the packages it
+   needs first, and a `checklist` of its acceptance tests from the TDD's verification plan. A
+   build card without its model set is a defect.
+3. Start the build as the crew skill's phase 3: contracts over the bus, one file-set per seat.
+   How far the build may go on its own (commit, push, deploy, handing off) is the project's
+   autonomy dial (`trantor autonomy`); the dial governs the build, not the opening of its cards.