trantor 0.18.35 → 0.18.37

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.35",
+  "version": "0.18.37",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/baton.mjs

@@ -17,6 +17,10 @@ import { writeHandoff, spawnBaton, resolveHandoffSurface } from "../hooks/lib/ha
 const cwd = process.cwd();
 const resolved = resolveHandoffSurface({ projectDir: process.env.CLAUDE_PROJECT_DIR || cwd, sessionId: process.env.CLAUDE_SESSION_ID || "" });
 const project = resolved.project;
+// #6218 — the transcript is found under the RESOLVED session directory (CLAUDE_PROJECT_DIR, the
+// dir the session was launched in — how Claude itself names ~/.claude/projects), never a shell
+// cwd that cd'd somewhere else: a handoff record must carry the transcript it was written from.
+const sessionDir = resolved.projectDir;
 
 // Model-authored handoffs ride THIS binary too (`trantor handoff` — always the global install's
 // CURRENT code, never the plugin-cache copy a session booted with, the stale-0.18.20 bug). A piped
@@ -38,10 +42,10 @@ if (stdinIsPipe() || process.argv.includes("--latest")) {
   autoBaton();
 }
 
-// The active session's transcript = newest *.jsonl directly in this project's Claude dir
-// (~/.claude/projects/<cwd-with-slashes-as-dashes>/), excluding the subagents/ subtree.
+// The active session's transcript = newest *.jsonl directly in the session dir's Claude dir
+// (~/.claude/projects/<sessionDir-with-slashes-as-dashes>/), excluding the subagents/ subtree.
 function findTranscript() {
-  const dashed = cwd.replace(/\//g, "-");
+  const dashed = sessionDir.replace(/\//g, "-");
   const base = join(homedir(), ".claude", "projects");
   let best = "", bestM = 0;
   let dirs = []; try { dirs = readdirSync(base).filter(d => d === dashed || d.endsWith(dashed)); } catch {}

package/bin/crew-runner.mjs

@@ -9,7 +9,7 @@
 // agent arrives it RESUMES the CLI session (native resume = full context kept) with that
 // message as the prompt. The model just works and ends its turn; the runner does the rest.
 import { execSync, spawnSync, spawn } from "node:child_process";
-import { readFileSync, writeFileSync, unlinkSync, existsSync, appendFileSync, mkdirSync } from "node:fs";
+import { readFileSync, writeFileSync, unlinkSync, existsSync, appendFileSync, mkdirSync, realpathSync } from "node:fs";
 import { join, basename } from "node:path";
 import { homedir } from "node:os";
 import { resolveProject, resolveHub, withEnvFiles, hostId } from "../lib/project.mjs";
@@ -24,7 +24,8 @@ import {
 } from "../lib/classify-failure.mjs";
 import { capWake, capBcast, pickLessons, composePrompt } from "./crew-payload.mjs";
 import {
-  cardRef, carriesWork, parseTurnTokens, parseResetAt, reasonWithBalances, PARKING_REASONS,
+  cardRef, carriesWork, parseTurnTokens, parseResetAt, reasonWithBalances, quotaResetAt, PARKING_REASONS,
+  senderProjectOf, isLinkedProject,
 } from "../lib/turn-policy.mjs";
 
 const AGENT = process.argv[2];
@@ -109,6 +110,26 @@ function ensureSeatWorktree(sourceDir) {
 }
 
 const TURN_DIR = ensureSeatWorktree(DIR);
+
+// #6154: opencode prints no session id on stdout, but it records every session in its own sqlite
+// DB with the directory the session was created in. The newest row for OUR worktree is the only
+// session a resume may pin — anything else in that DB belongs to another project on this machine,
+// which is exactly what `run -c` used to hand us. Read-only, fail-open: no DB or no row means the
+// next turn starts fresh, which is always safe, instead of resuming a stranger, which never is.
+const OC_DB = join(process.env.XDG_DATA_HOME || join(homedir(), ".local", "share"), "opencode", "opencode.db");
+function ocSid(dir) {
+  try {
+    // opencode stores the directory as IT sees its cwd, which on macOS can be the /private/var
+    // realpath of the /var/... path the runner holds — query both spellings.
+    const dirs = [dir];
+    try { const real = realpathSync(dir); if (real !== dir) dirs.push(real); } catch {}
+    const list = dirs.map((d) => `'${d.replaceAll("'", "''")}'`).join(", ");
+    const q = `SELECT id FROM session WHERE directory IN (${list}) ORDER BY time_updated DESC LIMIT 1;`;
+    const r = spawnSync("sqlite3", ["-readonly", OC_DB, q], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5000 });
+    const id = String(r.stdout || "").trim();
+    return /^ses_[A-Za-z0-9]+$/.test(id) ? id : "";
+  } catch { return ""; }
+}
 // RUNNER_SESSION override: an orchestrator seat (bin/orchestrate.mjs) runs the same CLI as a crew
 // seat but must live on the bus under its own name (claude-orch:proj), or it would collide with a
 // plain claude crew seat on the same project.
@@ -244,16 +265,25 @@ const CLI = {
   // --yolo in prompt mode (prompt mode auto-approves tools), and emits session_-prefixed ids.
   kimi:     { first: `kimi{M} -p "$(cat {P})" < /dev/null`,
               next:  `kimi{M} -r {SID} -p "$(cat {P})" < /dev/null`, mflag: " --model ", sid: /To resume this session: kimi -r (\S+)/ },
-  deepseek: { first: `opencode run{M} "$(cat {P})"`,
-              next:  `opencode run -c{M} "$(cat {P})"`, mflag: " -m ", env: join(homedir(), ".token-scrooge", ".env") },
-  opencode: { first: `opencode run{M} "$(cat {P})"`,
-              next:  `opencode run -c{M} "$(cat {P})"`, mflag: " -m ", env: join(homedir(), ".token-scrooge", ".env") },
+  // #6154: the opencode family never resumes blind. `run -c` continues the GLOBALLY last session
+  // on this machine — any project's (opencode.db showed a pr-os session interleaved between two
+  // trantor ones) — and the resumed session's stored directory becomes the Location every relative
+  // path resolves against. A seat then `cd desktop/src-tauri` inside its own worktree while
+  // opencode resolves it against a stranger's root, the bash tool reads it as external_directory
+  // and auto-rejects, and the turn dies mid-work with everything uncommitted. So: every spawn
+  // pins --dir to the seat worktree, and a resume pins -s to the session id looked up from
+  // opencode's own DB by directory — the session CREATED here (ocSid below). A missed lookup
+  // degrades to a fresh session, never to a foreign one.
+  deepseek: { first: `opencode run --dir {DIR}{M} "$(cat {P})"`,
+              next:  `opencode run --dir {DIR} -s {SID}{M} "$(cat {P})"`, mflag: " -m ", pinned: true, env: join(homedir(), ".token-scrooge", ".env") },
+  opencode: { first: `opencode run --dir {DIR}{M} "$(cat {P})"`,
+              next:  `opencode run --dir {DIR} -s {SID}{M} "$(cat {P})"`, mflag: " -m ", pinned: true, env: join(homedir(), ".token-scrooge", ".env") },
   // OpenRouter rides the opencode CLI exactly like deepseek/glm, but under its OWN agent label so
   // its bus identity is `openrouter:<project>` (RELAY_AGENT is set per-spawn) — never colliding with
   // the glm `opencode` seat. Model ids come pre-qualified (`openrouter/<vendor>/<model>`). Sources
   // the token-scrooge .env so an existing OPENROUTER_API_KEY authenticates with no extra wiring.
-  openrouter: { first: `opencode run{M} "$(cat {P})"`,
-              next:  `opencode run -c{M} "$(cat {P})"`, mflag: " -m ", env: join(homedir(), ".token-scrooge", ".env") },
+  openrouter: { first: `opencode run --dir {DIR}{M} "$(cat {P})"`,
+              next:  `opencode run --dir {DIR} -s {SID}{M} "$(cat {P})"`, mflag: " -m ", pinned: true, env: join(homedir(), ".token-scrooge", ".env") },
   claude:   { first: `claude{M} -p "$(cat {P})" --dangerously-skip-permissions`,
               next:  `claude -c{M} -p "$(cat {P})" --dangerously-skip-permissions`, mflag: " --model " },
   // DeepSeek Harness. Every turn is a FRESH session — headless has no resume yet — so the seat
@@ -275,7 +305,7 @@ if (!CLI[AGENT]) log(`'${AGENT}' is not a built-in seat — running it as an ope
 
 // RUNNER_RULES / RUNNER_KICKOFF env overrides: the runner is also the substrate for non-crew
 // always-on seats (the fleet DUTY agent, bin/duty.mjs) whose doctrine is not "work your card".
-const RULES = process.env.RUNNER_RULES || `Rules: you are ${SESSION} on the trantor crew. Before starting a card, read YOUR card: relay_board with card:<id> (the card, its deps, its notes, and the last five done cards whose title shares a word); never the whole board. Work your assigned file(s), report on the bus (relay_send, <280 chars), move your Kanban card as you go with a NOTE saying what you did (doing -> testing -> done; in 'testing' run YOUR OWN test file — never the full npm test, suites collide across seats — plus \`node bin/slop-gate.mjs\` when the repo has one: it lints ONLY your changed files against the anti-slop rules, and a card must not reach done with slop-gate failing; use 'failed' + a report if anything breaks). If you need something from another session, message THAT SESSION (relay_peers to find its id, relay_send to reach it) — never ask the human to pass it along; carrying messages between agents is the job this bus exists to remove. When your work for THIS message is finished, END YOUR TURN — do NOT park, do NOT loop relay_wait; the runner waits for you and will wake you with the next message.`;
+const RULES = process.env.RUNNER_RULES || `Rules: you are ${SESSION} on the trantor crew. Before starting a card, read YOUR card: relay_board with card:<id> (the card, its deps, its notes, and the last five done cards whose title shares a word); never the whole board. Work your assigned file(s), report on the bus (relay_send, <280 chars), move your Kanban card as you go with a NOTE saying what you did (doing -> testing -> done; in 'testing' run YOUR OWN test file — never the full npm test, suites collide across seats — plus \`node bin/slop-gate.mjs\` when the repo has one: it lints ONLY your changed files against the anti-slop rules, and a card must not reach done with slop-gate failing; use 'failed' + a report if anything breaks). If you need something from another session, message THAT SESSION (relay_peers to find its id, relay_send to reach it) — never ask the human to pass it along; carrying messages between agents is the job this bus exists to remove. When your work for THIS message is finished, END YOUR TURN — do NOT park, do NOT loop relay_wait; the runner waits for you and will wake you with the next message. Path discipline: build/test from your worktree root ${TURN_DIR} with absolute paths or --manifest-path/--prefix instead of cd-ing into subdirs, and put anything that must land outside the repo under ${TURN_DIR}/.agent-bus-out/ (gitignored) — never ~/.agent-bus. Cross-project action is a breach: never \`trantor up\` a crew, register a seat, or send a card/contract into a project other than ${PROJ} unless the operator ran \`trantor policy link ${PROJ} <other> --reason "<why>"\` first — the hub, the CLI and this runner all refuse it mechanically, so ask the operator to link the projects instead of routing around the refusal.`;
 
 // ---- the pulse (Scape's Lloyd/Argus loop, Trantor-shaped) --------------------
 // A message-driven seat is DEAF between messages. An orchestrator seat with a mission needs a
@@ -406,8 +436,10 @@ async function reportFailure(exit, trigger, undelivered = 0, reasonOverride = ""
 // redelivered to. So those two reasons PARK — the queue is kept, the ladder stops, and the room is
 // told once, with the reset time when the CLI printed one. `trantor up` (a restart) resumes.
 let parkAnnounced = false;
-async function parkSeat(reason, undelivered) {
-  const resetAt = parseResetAt(lastErrText);
+async function parkSeat(reason, undelivered, resetHint = 0) {
+  // A seat that went QUIET printed no wall message to parse (#6131), so its own balance row is the
+  // only place the reset time exists. Output first when there is any: it is this turn's evidence.
+  const resetAt = parseResetAt(lastErrText) || resetHint;
   const when = resetAt ? new Date(resetAt).toLocaleString() : "";
   if (!parkAnnounced) {
     parkAnnounced = true;
@@ -427,8 +459,12 @@ async function parkSeat(reason, undelivered) {
 async function balanceRows() {
   try {
     const { fetchBalances } = await import("../lib/balances.mjs");
+    // Same key sources the crew itself uses: QWEN_API_KEY (and most others) live in
+    // ~/.agent-bus/.env, not in the runner's inherited environment — reading bare process.env
+    // here would report "no key" and quietly leave every silent turn classified as a crash.
+    const { resolveKeys } = await import("../lib/provider-keys.mjs");
     return await Promise.race([
-      fetchBalances(process.env, { only: [AGENT] }),
+      fetchBalances(resolveKeys(process.env), { only: [AGENT] }),
       new Promise((r) => setTimeout(() => r([]), 4000)),
     ]);
   } catch { return []; }
@@ -520,9 +556,11 @@ async function runTurn(prompt, isFirst, trigger = "kickoff") {
   // exit-0 turn with real output must never be re-labelled "auth" by the #5405 escalation — the
   // qwen specimen committed aa3c340 while its captured stream still tripped the auth regex.
   const headBefore = gitOut(["rev-parse", "HEAD"], TURN_DIR);
-  let cmd = (isFirst || (cli.sid && !sid)) ? cli.first : cli.next;
+  // #6154: a pinned seat with no sid yet resumes as FRESH — the guard below fails open, because
+  // a resume without an id must fall back to a new session, never to `next`'s bare resume shape.
+  let cmd = (isFirst || ((cli.sid || cli.pinned) && !sid)) ? cli.first : cli.next;
   const mfrag = MODEL && cli.mflag ? `${cli.mflag}${MODEL}` : "";
-  cmd = cmd.replaceAll("{M}", mfrag).replaceAll("{P}", pf).replaceAll("{SID}", sid);
+  cmd = cmd.replaceAll("{M}", mfrag).replaceAll("{P}", pf).replaceAll("{SID}", sid).replaceAll("{DIR}", TURN_DIR);
   // PRECEDENCE, and it is easy to get backwards — this is the second time.
   // Each file is PREPENDED, so the one prepended LAST runs FIRST, and in shell the file that runs
   // LAST wins. To make ~/.agent-bus/.env (the CREW layer) win it must be prepended FIRST, i.e.
@@ -558,6 +596,10 @@ async function runTurn(prompt, isFirst, trigger = "kickoff") {
   // the window with no ERRF growth earns ONE direct stall report to the foreman, never a kill.
   const WD_MS = Number(process.env.TRANTOR_TURN_WATCHDOG_MS || 15 * 60 * 1000);
   const STAMPF = join(homedir(), ".agent-bus", `turnstamp-${AGENT}-${PROJ}.json`);
+  // Written by the shell's own time box (below) and read back here — the only honest signal that
+  // the turn was CUT rather than that the CLI failed on its own. Cleared before every turn.
+  const CUTF = join(homedir(), ".agent-bus", `turncut-${AGENT}-${PROJ}`);
+  try { unlinkSync(CUTF); } catch {}
   try {
     writeFileSync(STAMPF, JSON.stringify({ turn: TURN, startedAt: Date.now() }));
     const wd = spawn(process.execPath, [join(import.meta.dirname, "turn-watchdog.mjs"), STAMPF, ERRF, String(WD_MS), SESSION, PROJ, HUB],
@@ -567,8 +609,35 @@ async function runTurn(prompt, isFirst, trigger = "kickoff") {
   // Preserve the CLI's exit before waiting for the stderr process substitution. Without the
   // explicit wait, a short failing CLI can return while its error is still in the scrub pipe;
   // under load the classifier then reads an empty ERRF and reports the wrong failure reason.
-  const shell = `set -o pipefail; { ${inner} ; } 2> >(${SCRUB} --tee2 ${ERRF}); turn_exit=$?; wait; exit $turn_exit`;
-  const r = spawnSync("/bin/bash", ["-c", shell], {
+  // #6134-followup: the time box has to fire from INSIDE the shell, while the process tree is
+  // still standing. Killing the turn's process group from node missed a grandchild — codex runs
+  // its own commands via setsid, so `sleep 400` sat in a different group and survived
+  // process.kill(-pid). Worse, by the time node's timeout has killed bash the survivors have been
+  // reparented to init, so there is no tree left to walk and nothing to sweep.
+  //
+  // So bash boxes itself: at the deadline it walks its own descendants and kills them bottom-up.
+  // setsid changes a process's group and session but NEVER its parent, so `pgrep -P` recursion
+  // reaches exactly the children that a group signal cannot. Children first, then the parent, so
+  // nothing gets reparented mid-sweep and escapes the walk.
+  //
+  // The marker file is how node learns the turn was cut rather than merely failing: an exit status
+  // alone cannot tell "killed at the box" from "the CLI died on its own".
+  const sweep = `sweep() { local p; for p in $(pgrep -P $1 2>/dev/null); do sweep $p; done; kill -KILL $1 2>/dev/null; }`;
+  const box = TURN_MAX_MS ? `
+${sweep}
+( sleep ${Math.ceil(TURN_MAX_MS / 1000)}
+  kill -0 $job 2>/dev/null || exit 0
+  : > ${CUTF}
+  sweep $job
+) & boxpid=$!` : "boxpid=";
+  const shell = `set -o pipefail
+{ ${inner} ; } 2> >(${SCRUB} --tee2 ${ERRF}) &
+job=$!${box}
+wait $job; turn_exit=$?
+[ -n "$boxpid" ] && kill $boxpid 2>/dev/null
+wait
+exit $turn_exit`;
+  const spawnOpts = {
     // detached: bash leads its OWN process group, so the time box can kill the CLI and everything
     // it spawned with one signal instead of orphaning the model process behind a dead shell.
     // stdin is /dev/null for every seat (it already was for codex/kimi/dsh via `< /dev/null`):
@@ -576,9 +645,14 @@ async function runTurn(prompt, isFirst, trigger = "kickoff") {
     // takes SIGTTIN and stops forever. Nothing here runs interactively — every CLI is in -p /
     // exec / run mode — so closing stdin is what makes the group safe.
     detached: true,
-    ...(TURN_MAX_MS ? { timeout: TURN_MAX_MS, killSignal: "SIGKILL" } : {}),
     cwd: TURN_DIR, encoding: "utf8", stdio: cli.sid ? ["ignore", "pipe", "inherit"] : ["ignore", "inherit", "inherit"],
     env: { ...process.env, RELAY_URL: HUB, RELAY_AGENT: AGENT, RELAY_SESSION: SESSION, RELAY_PROJECT: PROJ,
+      // #6228: badges this seat's env as belonging to PROJ, distinctly from a one-off RELAY_PROJECT
+      // override (bin/crew.sh's own tests, and any deliberate `RELAY_PROJECT=x trantor up` from a
+      // plain shell, set RELAY_PROJECT alone and must keep working — only THIS marker means "the
+      // env I'm running in already has a project home"). crew.sh's `up` guard refuses to bring up a
+      // DIFFERENT project's crew from a shell carrying this badge, same as it refuses TRANTOR_ORCH.
+      TRANTOR_SEAT: PROJ,
       // A RUNNER-MANAGED SEAT MUST NEVER HAND ITSELF A BATON.
       //
       // The handoff machinery exists for an INTERACTIVE session: near its context limit it writes a
@@ -591,15 +665,22 @@ async function runTurn(prompt, isFirst, trigger = "kickoff") {
       // sitting there days later. To the operator that reads as "why are there two duty agents".
       TRANTOR_NO_HANDOFF_SPAWN: "1", TRANTOR_NO_BATON_SPAWN: "1" },
     maxBuffer: 16 * 1024 * 1024,
-  });
+  };
+  // A BACKSTOP only, deliberately later than the shell's own box: if bash itself wedges, node
+  // still ends the turn. When the in-shell box works — the normal path — this never fires, which
+  // is the point: the shell kills while the tree is still walkable, node cannot.
+  if (TURN_MAX_MS) { spawnOpts.timeout = TURN_MAX_MS + 30000; spawnOpts.killSignal = "SIGKILL"; }
+  const r = spawnSync("/bin/bash", ["-c", shell], spawnOpts);
   try { unlinkSync(STAMPF); } catch {}   // turn over — disarm the watchdog
-  // #6134: node's timeout signals only the shell it spawned. The CLI and its children share the
-  // detached group, so sweep the whole group — otherwise a boxed turn leaves a model still running
-  // (and still billing) against a runner that has moved on.
-  const cut = !!TURN_MAX_MS && (r.error?.code === "ETIMEDOUT" || (r.signal === "SIGKILL" && Date.now() - t0 >= TURN_MAX_MS));
-  if (cut && r.pid) {
-    try { process.kill(-r.pid, "SIGKILL"); } catch {}
-    log(`\x1b[33mturn cut at the ${Math.round(TURN_MAX_MS / 1000)}s time box — CLI process group ended\x1b[0m`);
+  // The shell's box leaves the marker; the backstop leaves an ETIMEDOUT. Either way the turn was
+  // cut, not merely failed.
+  const boxed = existsSync(CUTF);
+  const cut = !!TURN_MAX_MS && (boxed || r.error?.code === "ETIMEDOUT");
+  if (cut) {
+    // Belt and braces after the shell's descendant sweep: anything still sharing the turn's group.
+    if (r.pid) { try { process.kill(-r.pid, "SIGKILL"); } catch {} }
+    try { unlinkSync(CUTF); } catch {}
+    log(`\x1b[33mturn cut at the ${Math.round(TURN_MAX_MS / 1000)}s time box — CLI and every descendant ended${boxed ? "" : " (node backstop: bash itself was wedged)"}\x1b[0m`);
   }
   // #5869: scrub AT REST, synchronously, before anything reads the file back. The explicit shell
   // wait above drains the live stderr scrubber first; this pass is defense in depth for redaction.
@@ -612,6 +693,10 @@ async function runTurn(prompt, isFirst, trigger = "kickoff") {
   try { ownOut = stripPromptEcho(readFileSync(ERRF, "utf8"), readPromptText(pf)); } catch { ownOut = ""; }
   lastErrText = ownOut.slice(-4000);
   if (cli.sid && r.stdout) { const m = r.stdout.match(cli.sid); if (m) sid = m[1]; }
+  // #6154: the opencode family prints no sid on stdout — the id comes from opencode's own DB,
+  // keyed by the worktree the session was created in. Fail-open: nothing found leaves sid empty,
+  // and the next turn starts fresh rather than resuming whatever other project ran last.
+  if (cli.pinned) { const found = ocSid(TURN_DIR); if (found) sid = found; }
   const realExit = r.status;
   // A zero exit is NOT proof the turn ran: opencode prints "401 Unauthorized" / "Invalid API key"
   // and exits 0, so a bare 0 made the runner ack "✅ done", clear the pending queue and heartbeat
@@ -651,7 +736,10 @@ async function runTurn(prompt, isFirst, trigger = "kickoff") {
   // #6134: what the turn COST, from the CLI's own usage line. Zero means this CLI printed none —
   // never that the turn was free. `trantor seat-why` totals these into today's spend per seat.
   const tokens = parseTurnTokens(ownOut);
-  telemetry({ ts: Date.now(), agent: AGENT, project: PROJ, turn: TURN, trigger, model: MODEL || "cli-default", duration_ms: Date.now() - t0, exit: realExit, effExit, authFailed: effExit !== realExit, emptyOutput: lastEmptyOutput, verdict, ...(tokens ? { tokens } : {}), ...(cut ? { cut: true } : {}) });
+  const telemetryRow = { ts: Date.now(), agent: AGENT, project: PROJ, turn: TURN, trigger, model: MODEL || "cli-default", duration_ms: Date.now() - t0, exit: realExit, effExit, authFailed: effExit !== realExit, emptyOutput: lastEmptyOutput, verdict };
+  if (tokens) telemetryRow.tokens = tokens;
+  if (cut) telemetryRow.cut = true;
+  telemetry(telemetryRow);
   log(`turn ended (exit ${realExit}${effExit !== realExit ? ` → effective ${effExit} (${lastEmptyOutput ? "empty-output" : "auth"})` : ""}, ${((Date.now() - t0) / 1000).toFixed(0)}s)`);
   if (realExit === 0 && effExit === 0) { cmuxStatus("idle", "#8a94a6", "robot"); herdrAgent("idle"); }   // finished this turn, waiting for the next
   // #5965 — TURN END. A clean exit means the seat is idle again; say so right away so the app stops
@@ -756,6 +844,20 @@ function shouldWake(message) {
     && (message.text.includes(`@${AGENT}`) || message.text.toLowerCase().includes(`${AGENT}:`));
 }
 
+// #6228: the operator's declared project links, cached briefly so a burst of wakes doesn't hit
+// /policy per message. Fails CLOSED on an unreachable hub (keeps whatever was last known, empty
+// on a cold start) — the mechanical fence the hub enforces at write time must not go soft just
+// because the read-side cache call happened to miss.
+let linksCache = { at: 0, links: [] };
+async function currentLinks() {
+  if (Date.now() - linksCache.at < 60000) return linksCache.links;
+  try {
+    const r = await api("/policy");
+    linksCache = { at: Date.now(), links: Array.isArray(r?.links) ? r.links : [] };
+  } catch {}
+  return linksCache.links;
+}
+
 function askedExcerpt(message) {
   let text = String(message?.text || "").replace(/\s+/g, " ").trim();
   const nested = text.search(/\s+[·|]\s*asked\s*:/i);
@@ -861,7 +963,19 @@ function askedExcerpt(message) {
     // deafness problem: the seat would never learn what it was told (#6134).
     const bcast = [...rest.filter(m => !direct.includes(m) && !mentions.includes(m)), ...fyi];
     pendingBcast.push(...bcast);                      // wake-policy: plain broadcasts batch, they don't wake
-    const wake = [...direct, ...mentions];
+    const wakeCandidates = [...direct, ...mentions];
+    // #6228: a wake naming another project (its sender's home project, not this seat's, and the
+    // two are not `trantor policy link`ed) is dropped without acting — never queued, never folded
+    // into context. One report goes back to the sender so it does not just look like silence.
+    const links = wakeCandidates.length ? await currentLinks() : [];
+    const crossProject = wakeCandidates.filter(m => !isLinkedProject(senderProjectOf(m.from), PROJ, links));
+    for (const m of crossProject) {
+      const sp = senderProjectOf(m.from) || "?";
+      log(`\x1b[33mcross-project wake dropped\x1b[0m — ${m.from} (${sp}) is not ${PROJ}'s project and the two are not linked`);
+      api("/send", { from: SESSION, to: m.from, project: sp, kind: "status",
+        text: `⛔ cross-project: ${SESSION} is ${PROJ}'s seat, not ${sp}'s — dropped without acting. Link them first: trantor policy link ${PROJ} ${sp} --reason "<why>"` }).catch(() => {});
+    }
+    const wake = wakeCandidates.filter(m => !crossProject.includes(m));
     if (!wake.length) { if (bcast.length) { savePending(pendingWake, pendingBcast); log(`${bcast.length} broadcast(s) batched (no wake) — ${pendingBcast.length} pending`); } continue; }
     // Queue BEFORE running the turn, and persist immediately. Everything between here and a clean
     // exit 0 — the CLI dying, the machine losing power — now leaves a record of what this seat owes.
@@ -927,11 +1041,18 @@ function askedExcerpt(message) {
       // #6131: a silent turn on a seat whose plan reads spent is exhaustion wearing a crash's
       // clothes. Only that one reason is ever re-read, and only from the seat's own balance rows.
       let reason = classify(ec);
-      if (reason === "empty-output") reason = reasonWithBalances(reason, await balanceRows());
+      let quotaReset = 0;
+      if (reason === "empty-output") {
+        const rows = await balanceRows();
+        reason = reasonWithBalances(reason, rows);
+        // The rows that just proved the plan is spent also carry when it lifts — a park that names
+        // the reset is a wait, a park that cannot is a seat the operator has to remember by hand.
+        if (reason === "exhausted") quotaReset = quotaResetAt(rows);
+      }
       savePending(pendingWake, pendingBcast);
       await reportFailure(ec, "message", pendingWake.length, reason);
       if (PARKING_REASONS.has(reason)) {
-        retryAt = await parkSeat(reason, pendingWake.length);
+        retryAt = await parkSeat(reason, pendingWake.length, quotaReset);
         await notifyAssigners(assigners,
           `⛔ your contract is PARKED on ${SESSION} (${reason}) — not retrying · asked: "${asked}"`);
         lastTurnAt = Date.now();

package/bin/crew.sh

@@ -76,6 +76,40 @@ SEATDIR="$HOME/.agent-bus/seats"; mkdir -p "$SEATDIR"
 DRY="${CREW_DRY_RUN:-0}"
 run() { if [ "$DRY" = "1" ]; then echo "[dry] $*"; else eval "$*"; fi; }
 
+# ── cross-project guard (#6228) ────────────────────────────────────────────────────────────────────
+# The pr-os incident: an orchestrator pane badged TRANTOR_ORCH=pr-os ran `trantor up` while cd'd into
+# the crebral-com worktree and brought up seats there under its OWN session. TRANTOR_ORCH (set once by
+# `trantor open`, never per-invocation) and TRANTOR_SEAT (set once by crew-runner.mjs on every seat it
+# spawns, see bin/crew-runner.mjs) are both STABLE badges of "this shell already has a project home" —
+# unlike RELAY_PROJECT alone, which this same script's own tests legitimately override per-invocation
+# to name a target explicitly (a bare `RELAY_PROJECT=x trantor up` from an unbadged shell is the
+# operator, not a breach, and must keep working). A badged shell whose badge disagrees with the `up`
+# target refuses mechanically — the CLI belt to the hub's own 403 (hub.mjs crossProjectGuard).
+# A declared `trantor policy link` opens the door, same exception the hub and runner honor — so this
+# belt must check, not just refuse on sight. `policy.mjs check` asks the hub; CREW_TEST_POLICY_LINKS
+# is a hermetic override for test-crew.sh (comma-separated `a:b` pairs) so the drill never depends on
+# a real hub being reachable, or on nothing already listening on the default loopback port.
+if [ "$CMD" = "up" ]; then
+  BADGE="${TRANTOR_ORCH:-${TRANTOR_SEAT:-}}"
+  if [ -n "$BADGE" ] && [ "$BADGE" != "$PROJ" ]; then
+    LINKED=0
+    if [ -n "${CREW_TEST_POLICY_LINKS+x}" ]; then
+      case ",${CREW_TEST_POLICY_LINKS}," in
+        *",$BADGE:$PROJ,"*|*",$PROJ:$BADGE,"*) LINKED=1 ;;
+      esac
+    elif node "$BUS_DIR/bin/policy.mjs" check "$BADGE" "$PROJ" >/dev/null 2>&1; then
+      LINKED=1
+    fi
+    if [ "$LINKED" != "1" ]; then
+      echo "trantor: refused — this shell is badged for '$BADGE', not '$PROJ'." >&2
+      echo "  Cross-project action is a breach unless the operator linked the projects." >&2
+      echo "  Run: trantor policy link $BADGE $PROJ --reason \"<why>\"" >&2
+      exit 1
+    fi
+    echo "trantor: '$BADGE' ↔ '$PROJ' is policy-linked — proceeding." >&2
+  fi
+fi
+
 # ── STATE helpers ──────────────────────────────────────────────────────────────────────────────────
 # Row schema (TSV): PROJECT <TAB> KIND <TAB> AGENT <TAB> HANDLE
 #   KIND=win    HANDLE=Terminal window id           (one row per agent)

package/bin/policy.mjs

@@ -2,7 +2,10 @@
 // trantor policy — the autonomy ladder's admin surface (PRD §6): show levels + links,
 // set a project's level, declare that two projects are codependent.
 //   trantor policy show | set <project> <1-4> | link <a> <b> --reason "<why>" | unlink <a> <b>
+//   trantor policy check <a> <b>   — exit 0 (prints "yes") if linked or identical, else exit 1 ("no")
 // Drafted by scrooge (deepseek-v4-flash), integrated by the orchestrator.
+// `check` is what bin/crew.sh's cross-project guard (#6228) shells out to: the CLI belt needs to
+// know whether the operator already linked the two projects before it refuses `trantor up`.
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
@@ -30,7 +33,7 @@ const post = async (hub, payload) => {
 
 const legend = { 1: "1 observe", 2: "2 warn", 3: "3 gate", 4: "4 auto" };
 function usage() {
-  console.log('usage: trantor policy show | set <project> <1-4> | link <a> <b> --reason "<why>" | unlink <a> <b>');
+  console.log('usage: trantor policy show | set <project> <1-4> | link <a> <b> --reason "<why>" | unlink <a> <b> | check <a> <b>');
   process.exit(1);
 }
 
@@ -80,4 +83,21 @@ if (cmd === "unlink") {
   process.exit(0);
 }
 
+if (cmd === "check") {
+  if (!arg1 || !arg2) usage();
+  if (arg1 === arg2) { console.log("yes"); process.exit(0); }
+  let linked = false;
+  for (const hub of hubs) {
+    try {
+      const data = await get(hub);
+      if ((data.links || []).some((l) => {
+        const ps = (l.projects || []).map((p) => String(p).toLowerCase());
+        return ps.includes(arg1.toLowerCase()) && ps.includes(arg2.toLowerCase());
+      })) { linked = true; break; }
+    } catch { /* unreachable hub: fails closed, not linked */ }
+  }
+  console.log(linked ? "yes" : "no");
+  process.exit(linked ? 0 : 1);
+}
+
 usage();

package/bin/slop-gate.mjs

@@ -43,6 +43,21 @@ if (SURFACE) {
 // excluded legacy files (hub.mjs, mcp.mjs) stay excluded here too.
 const r = spawnSync("npx", ["oxlint", ...args], { encoding: "utf8", maxBuffer: 16 * 1024 * 1024 });
 const out = (r.stdout || "") + (r.stderr || "");
+// A gate that cannot run must not read as clean. Witnessed 2026-09-03: a seat worktree with no
+// node_modules made `npx oxlint` die with an npm error, the empty output had zero hits, and
+// "slop-gate clean" rode into main on 23 real anti-slop errors. the exit contract below is the
+// only proof it ran; without it, exit 2 and say so.
+// oxlint prints no run summary here (diagnostics only), so "it ran" is read from its exit
+// contract: 0 = clean, 1 = diagnostics printed. An npm error, a launch error, an exit code oxlint
+// never uses, a 1 with no diagnostic line, or "No files found" is not a verdict.
+const diag = /:\d+:\d+: (error|warning)\b/.test(out);
+const ran = !r.error && !/^npm (error|ERR!)/m.test(out) && !/No files found to lint/.test(out)
+  && (r.status === 0 || (r.status === 1 && diag));
+if (!ran) {
+  console.error(out.trim().split("\n").slice(-6).join("\n"));
+  console.error("\nslop-gate: could not run oxlint, so there is no verdict and this is NOT clean. Install deps in this checkout (pnpm install) and rerun.");
+  process.exit(2);
+}
 const hits = out.split("\n").filter(l => /error\s+anti-slop\(/.test(l));
 
 if (hits.length) {

package/hooks/lib/handoff.mjs

@@ -11,7 +11,7 @@
 // wall when we know the window size. Both paths share a per-session guard so we
 // never write/spawn twice for the same context window.
 import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync, statSync, openSync, readSync, fstatSync, closeSync, rmSync } from "node:fs";
-import { join, basename, dirname } from "node:path";
+import { join, basename, dirname, sep } from "node:path";
 import { homedir, hostname } from "node:os";
 import { execSync, spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
@@ -621,18 +621,52 @@ export function orchProjectForSession(sid) {
   return "";
 }
 
+// Does the cwd actually lie inside THIS project's ground (#6218)? Two true homes: a directory
+// named for the project (the project root or anything below it — the #6074 subfolder case), and
+// the project's agent-bus worktrees (<bus>/worktrees/<project>/<seat>). Pure + exported so the
+// drill can pin both without touching the operator's disk layout.
+export function cwdInsideProject(projectName, dir, bus = process.env.AGENT_BUS_DIR || process.env.RELAY_DATA_DIR || join(homedir(), ".agent-bus")) {
+  if (!projectName || !dir) return false;
+  const wt = join(bus, "worktrees", projectName);
+  if (dir === wt || dir.startsWith(wt + sep)) return true;
+  let cur = dir;
+  for (;;) {
+    if (basename(cur) === projectName) return true;
+    const parent = dirname(cur);
+    if (parent === cur) return false;
+    cur = parent;
+  }
+}
+
 // The one resolver. Returns { project, projectDir, pane, surface }:
 //   pane    — the session's own pane id ("" when it is not a hosted pane)
 //   surface — "pane" (the baton MUST take the pane leg) or "window" (today's behavior)
 //   project — the REGISTERED project name; a subfolder cwd never renames it
+// #6218 — the badge wins only where it is TRUE. Witnessed 2026-09-03: a run from a
+// trantor-badged shell in ~/development/tiny-timer wrote "handoff saved for trantor" with
+// tiny-timer's transcript inside. #6074's registration-before-cwd rule was written for a
+// subfolder cwd of the SAME project; a FOREIGN project dir is a different case and must not be
+// silently relabeled. So the badge (and the rest of the registration chain behind it) claims
+// this handoff only when the cwd lies inside the named project's directory or one of its
+// worktrees; a badged shell sitting elsewhere resolves from the cwd, and ONE warning line names
+// both — the badge that lied and the project the record actually went to.
 export function resolveHandoffSurface({ projectDir, sessionId, env = process.env } = {}) {
   const dir = projectDir || env.CLAUDE_PROJECT_DIR || process.cwd();
   const badge = String(env.TRANTOR_ORCH || "").trim();
   let project = "";
-  if (badge && badge !== "1") project = badge;                       // `trantor open` badge carries the name
-  if (!project && env.RELAY_PROJECT) project = String(env.RELAY_PROJECT).trim();
-  if (!project) project = orchProjectForSession(sessionId);
-  if (!project) project = resolveProject(dir);                       // last resort: cwd (git-root aware)
+  let foreignBadge = "";
+  if (badge && badge !== "1") {                                      // `trantor open` badge carries the name
+    if (cwdInsideProject(badge, dir)) project = badge;
+    else foreignBadge = badge;                                       // the badge lies about this cwd
+  }
+  if (!project && !foreignBadge && env.RELAY_PROJECT) project = String(env.RELAY_PROJECT).trim();
+  if (!project && !foreignBadge) project = orchProjectForSession(sessionId);
+  // Last resort: the cwd (git-root aware). With a foreign badge, the shell's own RELAY_PROJECT
+  // is scrubbed from the fallback's env — it is the same registration that just lied (#6218).
+  if (!project) project = resolveProject(dir, foreignBadge ? { ...env, RELAY_PROJECT: "" } : env);
+  if (foreignBadge) {
+    console.error(`trantor handoff: TRANTOR_ORCH=${foreignBadge} but the working directory (${dir}) is not inside ${foreignBadge}'s project or its worktrees — saving the handoff for ${project} (resolved from the cwd)`);
+  }
   return { project, projectDir: dir, pane: paneSurfaceEnv(env), surface: paneSurfaceEnv(env) ? "pane" : "window" };
 }
 

package/hub.mjs

@@ -10,7 +10,7 @@ import { homedir, hostname } from "node:os";
 import { join } from "node:path";
 import { timingSafeEqual, randomBytes } from "node:crypto";
 import { verifyRequest, verifyEndorsement, publicView } from "./lib/identity.mjs";
-import { DEFAULT_ORG } from "./lib/store-contract.mjs";
+import { DEFAULT_ORG, IDENTITY_KINDS } from "./lib/store-contract.mjs";
 import { assertNoSecrets } from "./lib/scrub.mjs";
 import { createPersistHealth } from "./lib/persist-health.mjs";
 
@@ -220,7 +220,12 @@ function normalizeState(loaded = {}) {
     // migrate old numeric form
     s.peers[session] = typeof v === "number"
       ? { lastSeen: v, status: "", project: "" }
-      : { lastSeen: v.lastSeen || 0, status: v.status || "", project: v.project || "", pubkey: v.pubkey || "", identity: v.identity || null, authWarning: v.authWarning || "", hookVersion: v.hookVersion || "", deliveredUpTo: v.deliveredUpTo || v.delivered_up_to || 0, _on: v._on === true || v.online === true };
+      // #6170: `kind` must be carried across the load. This normalizer rebuilds every peer from an
+      // explicit field list, so a field missing here is dropped no matter how faithfully the store
+      // returned it — which is exactly what happened: the column was added, Postgres held the right
+      // values, and the kinds still came back empty on the first live restart. llm/model stay
+      // out on purpose: those ARE in-memory presence, re-supplied by the next heartbeat.
+      : { lastSeen: v.lastSeen || 0, status: v.status || "", project: v.project || "", pubkey: v.pubkey || "", identity: v.identity || null, authWarning: v.authWarning || "", hookVersion: v.hookVersion || "", kind: v.kind || "", deliveredUpTo: v.deliveredUpTo || v.delivered_up_to || 0, _on: v._on === true || v.online === true };
   }
   return s;
 }
@@ -1096,6 +1101,61 @@ function projectFromRequest(P, q, b) {
   }
   return canon(String(b?.project || q?.project || "").slice(0, 80));
 }
+// --- Cross-project guard (#6228) -----------------------------------------------------------
+// scopeAllows/canRead answer "can this identity touch project P at all" — and most identities
+// are minted project:"*" role:"owner" by defaultScopesFor (any non-agent kind: an orchestrator,
+// genesis, a human). That is not a project fence; it is exactly the loophole the pr-os
+// orchestrator walked through to register seats and post contracts into crebral-com from its
+// own session, nothing it was ever working. This is the fence: does the CALLER's own project
+// (its identity name's "kind:project" suffix, the same convention defaultScopesFor reads) match
+// the project the request ACTS on. Only a declared `trantor policy link` (state.orgPolicy.links,
+// the same store /policy reads and writes — POST /policy is itself OWNER_ENDPOINTS-gated) or the
+// operator's own identity (kind "human", the key /instance/supersede already treats as owner)
+// opens the door. Applies to the five endpoints that reach across sessions or mint access:
+// /send, /task, /task/update, /register, /invite.
+const CROSS_PROJECT_ENDPOINTS = new Set(["/send", "/task", "/task/update", "/register", "/invite"]);
+function projectsLinked(a, b) {
+  if (!a || !b || a === b) return true;
+  return overseerPolicy().links.some(l => {
+    const ps = (l.projects || []).map(p => canon(p));
+    return ps.includes(a) && ps.includes(b);
+  });
+}
+// The caller's home project, by the SAME "name suffix after the colon" rule defaultScopesFor
+// uses to mint a fresh identity's default scope. An identity with no colon in its name (a bare
+// human alias, or a tool identity never given a project) has no home to fence — nothing to check.
+function callerProject(auth) {
+  const name = String(auth?.identity?.name || "");
+  return name.includes(":") ? canon(name.slice(name.lastIndexOf(":") + 1)) : "";
+}
+function crossProjectTarget(P, b) {
+  if (P === "/send") {
+    if (!b?.to || b.to === "all") return "";   // broadcast: existing hub-wide behavior, untouched
+    const to = String(b.to);
+    return canon(state.peers[to]?.project || (to.includes(":") ? to.slice(to.lastIndexOf(":") + 1) : ""));
+  }
+  if (P === "/task" || P === "/register") return canon(String(b?.project || "").slice(0, 80));
+  if (P === "/task/update") {
+    const t = state.tasks.find(x => x.id === Number(b?.id));
+    return t?.project || "";
+  }
+  if (P === "/invite") {
+    // an invite MINTS access into whatever project(s) its scopes name — a wildcard scope names none.
+    const scopes = Array.isArray(b?.scopes) ? b.scopes : [];
+    return scopes.map(s => canon(String(s?.project || ""))).find(p => p && p !== "*") || "";
+  }
+  return "";
+}
+function crossProjectGuard(auth, P, b) {
+  if (!CROSS_PROJECT_ENDPOINTS.has(P) || AUTH_MODE === "off" || !auth?.identity) return { ok: true };
+  if (auth.identity.kind === "human") return { ok: true };   // the operator's own key
+  const home = callerProject(auth);
+  if (!home) return { ok: true };
+  const target = crossProjectTarget(P, b);
+  if (!target || target === home || projectsLinked(home, target)) return { ok: true };
+  return { ok: false, code: 403,
+    error: `cross-project: ${home} may not act on ${target} — cross-project action is a breach unless the operator linked the projects. Run: trantor policy link ${home} ${target} --reason "<why>"` };
+}
 // Is a stored baton claim still worth honouring? The claim names the instance it spared
 // (`exceptInstanceId`), so we defer to THAT instance only while it is still being seen. A claimant
 // that died stops muzzling its twins; one that comes back starts again. Records claimed before
@@ -1447,6 +1507,10 @@ const server = http.createServer(async (req, res) => {
       const raw = req._rawBody || "";
       const verified = verifyRequest({ headers: req.headers, method: req.method, path: authPath(u), body: raw });
       if (!verified.ok) return json(res, 401, { error: verified.reason || "bad signature" });
+      const requestedKind = String(b0.kind || "agent").slice(0, 40);
+      if (!IDENTITY_KINDS.includes(requestedKind)) {
+        return json(res, 400, { error: `kind must be one of: ${IDENTITY_KINDS.join(", ")}`, allowedKinds: IDENTITY_KINDS });
+      }
       const existing = findIdentity(verified.pubkey);
       if (existing) return json(res, 200, { ok: true, identity: publicView(existing), scopes: existing.scopes || [] });
       let enrolledBy = "";
@@ -1482,7 +1546,7 @@ const server = http.createServer(async (req, res) => {
       }
       const identity = {
         name: String(b0.name || "").slice(0, 120) || verified.pubkey.slice(0, 16),
-        kind: String(b0.kind || "agent").slice(0, 40),
+        kind: requestedKind,
         pubkey: verified.pubkey,
         createdAt: now(),
         enrolledBy,
@@ -1501,14 +1565,20 @@ const server = http.createServer(async (req, res) => {
       const az = authorize(auth, req.method, P, "*");
       if (!az.ok) return json(res, az.code || 403, { error: az.error || "forbidden" });
       const bi = await body(req);
+      const invitedKind = String(bi.kind || "agent").slice(0, 40);
+      if (!IDENTITY_KINDS.includes(invitedKind)) {
+        return json(res, 400, { error: `kind must be one of: ${IDENTITY_KINDS.join(", ")}`, allowedKinds: IDENTITY_KINDS });
+      }
       const scopes = (Array.isArray(bi.scopes) ? bi.scopes : []).map(cleanScope).filter(Boolean).slice(0, 20);
       if (!scopes.length) return json(res, 400, { error: "scopes required" });
+      const cpg = crossProjectGuard(auth, P, { scopes });
+      if (!cpg.ok) return json(res, cpg.code, { error: cpg.error });
       // Honour the requested TTL. A 60s FLOOR here silently inflated `ttlSec: 1` to a minute, so a
       // token the caller asked to expire in a second stayed valid — and an expired-token test passed
       // a live token straight through /enroll. Cap the ceiling, never the floor.
       const ttlSec = Math.min(Math.max(Number(bi.ttlSec) || 86400, 1), 30 * 86400);
       const token = randomBytes(24).toString("hex");
-      state.inviteTokens[token] = { scopes, expiresAt: now() + ttlSec * 1000, used: false,
+      state.inviteTokens[token] = { scopes, kind: invitedKind, expiresAt: now() + ttlSec * 1000, used: false,
         createdBy: auth.identity?.pubkey || "", createdAt: now() };
       dirty = true;
       return json(res, 200, { ok: true, token, scopes, expiresAt: state.inviteTokens[token].expiresAt });
@@ -1517,7 +1587,10 @@ const server = http.createServer(async (req, res) => {
     const authz = authorize(auth, req.method, P, projectFromRequest(P, q, b0));
     if (!authz.ok) return json(res, authz.code || 403, { error: authz.error || "forbidden" });
     if (req.method === "POST" && P === "/register") {
-      const b = await body(req); touch(b.session, b.status, b.project, b.hookVersion, auth);
+      const b = await body(req);
+      const cpg = crossProjectGuard(auth, P, b);
+      if (!cpg.ok) return json(res, cpg.code, { error: cpg.error });
+      touch(b.session, b.status, b.project, b.hookVersion, auth);
       // WHO is this, really: the LLM brand + the exact model currently loaded. In-memory like the
       // rest of presence — the next heartbeat re-supplies it after a restart.
       const pr = state.peers[b.session];
@@ -1919,7 +1992,10 @@ const server = http.createServer(async (req, res) => {
     }
     // --- Kanban tasks ---
     if (req.method === "POST" && P === "/task") {           // create a card
-      const b = await body(req); touch(b.by, undefined, b.project, undefined, auth);
+      const b = await body(req);
+      const cpg = crossProjectGuard(auth, P, b);
+      if (!cpg.ok) return json(res, cpg.code, { error: cpg.error });
+      touch(b.by, undefined, b.project, undefined, auth);
       if (b.title !== undefined) b.title = stripNulText(b.title);
       if (b.note !== undefined) b.note = stripNulText(b.note);
       const st0 = ["todo","doing","testing","failed","done","blocked"].includes(b.status) ? b.status : "todo";
@@ -2075,6 +2151,8 @@ const server = http.createServer(async (req, res) => {
     if (req.method === "POST" && P === "/task/update") {    // move/edit a card
       const b = await body(req); const t = state.tasks.find(x => x.id === Number(b.id));
       if (!t) return json(res, 404, { error: "no such task" });
+      const cpg = crossProjectGuard(auth, P, b);
+      if (!cpg.ok) return json(res, cpg.code, { error: cpg.error });
       if (b.title !== undefined) b.title = stripNulText(b.title);
       if (b.note !== undefined) b.note = stripNulText(b.note);
       // Board integrity (#5406): a card can never change hands silently. The assignee is frozen once
@@ -2777,6 +2855,8 @@ const server = http.createServer(async (req, res) => {
       const secretCheck = assertNoSecrets(text);
       if (!secretCheck.ok) return json(res, 400, { error: "secret detected", kinds: secretCheck.kinds || [] });
       if (auth?.identity && String(b.from) !== String(auth.identity.name || "")) return json(res, 403, { error: "from must match signer" });
+      const cpg = crossProjectGuard(auth, P, b);
+      if (!cpg.ok) return json(res, cpg.code, { error: cpg.error });
       touch(b.from, undefined, undefined, undefined, auth);
       // attribute the message to a project so the dashboard can show it in that project's lane.
       // explicit b.project wins; else the sender's known project; else parsed from a "host:project" id.

package/lib/balances.mjs

@@ -152,8 +152,61 @@ export const ADAPTERS = [
       return { remainingPct, plan, resetTime: head?.nextResetTime || null, detail: "" };
     },
   },
+  {
+    // #6131. The token plan's graded remaining-% lives ONLY behind the QwenCloud console's
+    // cookie-authenticated API (platform-api.qianwenai.com/tokenplan/personal/api/v2/usage — the
+    // console SPA calls it with a browser session; an API key gets the login page back). What the
+    // KEY can read is the plan's WALL: the inference gateway answers 429 insufficient_quota with a
+    // retry-after and the reset time the moment the 7-day plan is spent. That is exactly the state
+    // this row exists for — a seat that is about to go quiet — so it reads the wall, not the gauge,
+    // and says "unknown" rather than inventing a percentage it never measured.
+    //
+    // The probe consumes NO tokens. `messages: []` is an invalid request the model never sees, but
+    // the quota gate runs BEFORE that validation. Captured live 2026-09-03 against the spent plan:
+    // a real model + empty messages → the same 429 as a real completion; an unknown model → 404
+    // model_not_found; a bad key → 401 invalid_api_key. So the gate sits between model lookup and
+    // request validation, and an empty-messages probe is the cheapest thing that can trip it.
+    provider: "qwen", label: "Qwen", kind: "quota", match: ["qwen"], envKeys: ["QWEN_API_KEY"],
+    async fetch(key, env = {}) {
+      const base = String(env.QWEN_BASE_URL || "https://token-plan.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1").replace(/\/+$/, "");
+      // Ask the plan which models it has rather than hard-coding an id that a rename would break
+      // (and this doubles as the auth check: a rejected key 401s here, before the probe).
+      const model = ((await getJSON(`${base}/models`, key)).data || [])[0]?.id;
+      if (!model) throw new Error("token plan lists no models");
+      const r = await fetch(`${base}/chat/completions`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${key}`, "content-type": "application/json", Accept: "application/json" },
+        body: JSON.stringify({ model, messages: [] }),
+        signal: AbortSignal.timeout(TIMEOUT),
+      });
+      let body; try { body = JSON.parse(await r.text()); } catch { body = null; }
+      const err = body?.error || {};
+      if (r.status === 401 || err.code === "invalid_api_key") throw new Error("invalid API key");
+      if (r.status === 429 || err.code === "insufficient_quota") {
+        // retry-after is authoritative (seconds, exact); the message carries the same instant as
+        // "MM-DD HH:MM:SS UTC" with no year, so it is only the fallback.
+        const secs = num(r.headers.get("retry-after"));
+        const resetTime = secs > 0 ? Date.now() + secs * 1000 : qwenResetFromMessage(err.message);
+        return { remainingPct: 0, plan: "token plan", resetTime, detail: "7-day token plan exhausted" };
+      }
+      // The gate let the request through, so the plan still has room — but how much is console-only.
+      return { remainingPct: null, plan: "token plan", resetTime: null, detail: "plan active (remaining % is console-only)" };
+    },
+  },
 ];
 
+/// "The quota will reset at 09-09 14:32:00 UTC." — Qwen omits the year, so assume the current one
+/// and roll forward when that lands in the past (the plan resets ahead of now, never behind it).
+export function qwenResetFromMessage(msg, now = Date.now()) {
+  const m = /reset at (\d{2})-(\d{2}) (\d{2}):(\d{2})(?::(\d{2}))? UTC/i.exec(String(msg || ""));
+  if (!m) return null;
+  const [, mo, d, h, mi, s] = m;
+  const at = (year) => Date.UTC(year, Number(mo) - 1, Number(d), Number(h), Number(mi), Number(s || 0));
+  const year = new Date(now).getUTCFullYear();
+  const t = at(year);
+  return Number.isFinite(t) ? (t >= now ? t : at(year + 1)) : null;
+}
+
 // thresholds: prepaid by currency, quota by percent-remaining. Override via config.json `lowBalance`
 // (currency keys) and `lowQuotaPct`.
 export const DEFAULT_LOW = { USD: 5, CNY: 35, EUR: 5 };
@@ -203,7 +256,8 @@ export async function fetchBalances(env = process.env, opts = {}) {
     const envKey = a.envKeys.find((k) => env[k]);
     if (!envKey && !a.keyless) return null;                      // configured but no key in env → can't query
     const base = { provider: a.provider, label: a.label, kind: a.kind, via: envKey || "oauth" };
-    try { return { ...base, ok: true, ...(await a.fetch(envKey ? env[envKey] : undefined)) }; }
+    // `env` rides along for adapters that read more than a key (Qwen's base URL); the rest ignore it.
+    try { return { ...base, ok: true, ...(await a.fetch(envKey ? env[envKey] : undefined, env)) }; }
     catch (e) { return { ...base, ok: false, error: String(e?.message || e) }; }
   });
   const rows = (await Promise.all(jobs)).filter(Boolean);
@@ -278,7 +332,7 @@ export function fmtBalance(e) {
 }
 
 function fmtReset(t) {
-  const ms = typeof t === "number" ? t : Date.parse(t);
+  const ms = Number.isFinite(t) ? t : Date.parse(t);
   if (!ms || isNaN(ms)) return "";
   const hrs = (ms - Date.now()) / 3600e3;
   if (hrs < 0) return "soon";

package/lib/enroll.mjs

@@ -45,9 +45,10 @@ export async function ensureEnrolled(hubUrl, identity, project, { timeoutMs = 40
   if (!owner?.privkey) return { ok: false, reason: "no-owner-key" };
 
   try {
+    const identityKind = kind || identity.kind || "agent";
     const inv = await sfetch(`${hubUrl}/invite`, {
       method: "POST", headers: { "content-type": "application/json" },
-      body: JSON.stringify({ scopes: [{ project, role: "write" }], ttlSec: 300 }),
+      body: JSON.stringify({ scopes: [{ project, role: "write" }], ttlSec: 300, kind: identityKind }),
       signal: AbortSignal.timeout(timeoutMs),
     }, owner);
     if (!inv.ok) return { ok: false, reason: `invite-${inv.status}` };
@@ -55,7 +56,7 @@ export async function ensureEnrolled(hubUrl, identity, project, { timeoutMs = 40
 
     const en = await sfetch(`${hubUrl}/enroll`, {
       method: "POST", headers: { "content-type": "application/json" },
-      body: JSON.stringify({ name: identity.name, kind: kind || identity.kind || "agent", token }),
+      body: JSON.stringify({ name: identity.name, kind: identityKind, token }),
       signal: AbortSignal.timeout(timeoutMs),
     }, identity);
     return en.ok ? { ok: true, reason: "enrolled" } : { ok: false, reason: `enroll-${en.status}` };

package/lib/project.mjs

@@ -18,8 +18,11 @@ export function gitRoot(dir) {
 }
 
 // Stable project key for a working directory. RELAY_PROJECT > git-root basename > cwd basename.
-export function resolveProject(cwd = process.cwd()) {
-  if (process.env.RELAY_PROJECT) return process.env.RELAY_PROJECT.slice(0, 80);
+// The env comes in as a parameter (#6218): the handoff resolver must be able to resolve the cwd
+// WITHOUT the shell's RELAY_PROJECT — a badge that lied about the cwd must not get a second
+// voice through the fallback's own env read.
+export function resolveProject(cwd = process.cwd(), env = process.env) {
+  if (env.RELAY_PROJECT) return env.RELAY_PROJECT.slice(0, 80);
   const root = gitRoot(cwd);
   // A LINKED WORKTREE must resolve to its MAIN repo's name, not its own directory name. Seat
   // worktrees live at ~/.agent-bus/worktrees/<project>/<agent>, so the old basename rule named the

package/lib/store-contract.mjs

@@ -20,6 +20,9 @@
 // an empty schema is free; adding it after 1,542 cards have migrated is surgery on live data.
 // ---------------------------------------------------------------------------------------------
 export const SCHEMA_VERSION = 1;
+export const IDENTITY_KINDS = Object.freeze(["human", "agent", "tool"]);
+
+const IDENTITY_KINDS_SQL = IDENTITY_KINDS.map(kind => `'${kind}'`).join(",");
 
 export const SCHEMA_SQL = `
 CREATE TABLE IF NOT EXISTS orgs (
@@ -41,13 +44,19 @@ CREATE TABLE IF NOT EXISTS identities (
   pubkey      TEXT PRIMARY KEY,
   org_id      TEXT REFERENCES orgs(id) ON DELETE CASCADE,
   name        TEXT NOT NULL,
-  kind        TEXT NOT NULL CHECK (kind IN ('human','agent')),
+  kind        TEXT NOT NULL CHECK (kind IN (${IDENTITY_KINDS_SQL})),
   scopes      JSONB NOT NULL DEFAULT '{}'::jsonb,   -- { "<project>": "owner"|"write"|"read" }
   enrolled_by TEXT,
   created_at  BIGINT NOT NULL,
   revoked_at  BIGINT                                 -- set, never deleted: revocation is audit
 );
 
+-- 2026-09-03: installs created under CHECK (kind IN ('human','agent')) widen on boot; the genesis
+-- identity enrols as 'tool' (#6068) and the narrower check poisoned every persist delta for 13 min.
+ALTER TABLE identities DROP CONSTRAINT IF EXISTS identities_kind_check;
+ALTER TABLE identities ADD CONSTRAINT identities_kind_check CHECK (kind IN (${IDENTITY_KINDS_SQL}));
+
+
 -- THE LOG. Append-only, never updated, never deleted except by retention. Everything else derives.
 CREATE TABLE IF NOT EXISTS events (
   id         BIGSERIAL PRIMARY KEY,
@@ -120,8 +129,19 @@ CREATE TABLE IF NOT EXISTS peers (
   last_seen       BIGINT,
   online          BOOLEAN DEFAULT FALSE,
   delivered_up_to BIGINT DEFAULT 0,
+  kind            TEXT,                  -- #6170: WHAT this session is — 'agent' (crew seat),
+                                         -- 'orch', 'genesis', 'tool'. The overseer's crew
+                                         -- exemption reads it (#6075/#6148), so when a restart
+                                         -- forgot it the hub warned about its own crew.
   PRIMARY KEY (org_id, session)
 );
+-- additive migration for hubs whose peers table predates the kind column (#6170)
+ALTER TABLE peers ADD COLUMN IF NOT EXISTS kind TEXT;
+-- DELIBERATELY no CHECK on peers.kind, unlike identities.kind above. The hub accepts whatever a
+-- client stamps (hub.mjs /register takes any string up to 40 chars) and the vocabulary grows with
+-- the product — 'genesis' arrived in #6068, 'orch' in #6075. #6169 is the cost of getting this
+-- wrong in the other direction: a CHECK narrower than the values in flight poisoned every persist
+-- delta for 13 minutes. A column that stores what it is given cannot fail that way.
 
 -- The fields that currently ride in-memory and are LOST on restart. This is the debt being paid.
 CREATE TABLE IF NOT EXISTS kv (

package/lib/store-pg.mjs

@@ -117,6 +117,7 @@ function peerFromRow(row) {
     lastSeen: row.last_seen == null ? 0 : Number(row.last_seen),
     online: !!row.online,
     deliveredUpTo: row.delivered_up_to == null ? 0 : Number(row.delivered_up_to),
+    kind: row.kind || "",   // #6170: survives the restart that used to forget who was crew
   };
 }
 
@@ -332,8 +333,8 @@ export class PgStore {
   async touchPeer(orgId, session, patch = {}) {
     if (!session || session === "all") return;
     await this.pool.query(
-      `INSERT INTO peers(session, org_id, pubkey, project, status, hook_version, last_seen, online, delivered_up_to)
-       VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9)
+      `INSERT INTO peers(session, org_id, pubkey, project, status, hook_version, last_seen, online, delivered_up_to, kind)
+       VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10)
        ON CONFLICT(org_id, session) DO UPDATE SET
          pubkey=COALESCE(EXCLUDED.pubkey, peers.pubkey),
          project=COALESCE(NULLIF(EXCLUDED.project,''), peers.project),
@@ -341,11 +342,17 @@ export class PgStore {
          hook_version=COALESCE(NULLIF(EXCLUDED.hook_version,''), peers.hook_version),
          last_seen=EXCLUDED.last_seen,
          online=EXCLUDED.online,
-         delivered_up_to=GREATEST(peers.delivered_up_to, EXCLUDED.delivered_up_to)`,
+         delivered_up_to=GREATEST(peers.delivered_up_to, EXCLUDED.delivered_up_to),
+         -- #6170: a KINDLESS beat must never demote a known peer. Most heartbeats carry no kind
+         -- (the MCP one only learns it under TRANTOR_ORCH), and plain last_seen refreshes are the
+         -- majority of writes here — overwriting on every one is how the orchestrator kept
+         -- reverting to a nameless agent between registrations.
+         kind=COALESCE(NULLIF(EXCLUDED.kind,''), peers.kind)`,
       [
         session, orgId, patch.pubkey || null, patch.project || "", patch.status ?? null,
         patch.hookVersion || patch.hook_version || "", ms(patch.lastSeen || patch.last_seen),
         patch.online ?? true, Number(patch.deliveredUpTo || patch.delivered_up_to || 0),
+        patch.kind || "",
       ],
     );
   }
@@ -474,11 +481,15 @@ export class PgStore {
       );
       for (const [session, p] of Object.entries(state.peers || {})) {
         await c.query(
-          `INSERT INTO peers(session, org_id, pubkey, project, status, hook_version, last_seen, online, delivered_up_to)
-           VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9)
+          `INSERT INTO peers(session, org_id, pubkey, project, status, hook_version, last_seen, online, delivered_up_to, kind)
+           VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10)
            ON CONFLICT(org_id, session) DO UPDATE SET pubkey=EXCLUDED.pubkey, project=EXCLUDED.project, status=EXCLUDED.status,
-             hook_version=EXCLUDED.hook_version, last_seen=EXCLUDED.last_seen, online=EXCLUDED.online, delivered_up_to=GREATEST(peers.delivered_up_to, EXCLUDED.delivered_up_to)`,
-          [session, orgId, p.pubkey || "", p.project || "", p.status || "", p.hookVersion || "", Number(p.lastSeen || 0), p._on === true || p.online === true, Number(p.deliveredUpTo || 0)],
+             hook_version=EXCLUDED.hook_version, last_seen=EXCLUDED.last_seen, online=EXCLUDED.online, delivered_up_to=GREATEST(peers.delivered_up_to, EXCLUDED.delivered_up_to),
+             -- #6170: same non-demoting rule as touchPeer. A snapshot is written from MEMORY, and
+             -- memory is exactly where the kind was being lost, so a blank in the snapshot means
+             -- "not known right now", never "this peer is nothing".
+             kind=COALESCE(NULLIF(EXCLUDED.kind,''), peers.kind)`,
+          [session, orgId, p.pubkey || "", p.project || "", p.status || "", p.hookVersion || "", Number(p.lastSeen || 0), p._on === true || p.online === true, Number(p.deliveredUpTo || 0), p.kind || ""],
         );
       }
       await c.query(
@@ -598,11 +609,15 @@ export class PgStore {
       if (messages.deletes.length) await c.query("DELETE FROM messages WHERE org_id=$1 AND id = ANY($2::bigint[])", [orgId, messages.deletes]);
       for (const p of peers.upserts) {
         await c.query(
-          `INSERT INTO peers(session, org_id, pubkey, project, status, hook_version, last_seen, online, delivered_up_to)
-           VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9)
+          `INSERT INTO peers(session, org_id, pubkey, project, status, hook_version, last_seen, online, delivered_up_to, kind)
+           VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10)
            ON CONFLICT(org_id, session) DO UPDATE SET pubkey=EXCLUDED.pubkey, project=EXCLUDED.project, status=EXCLUDED.status,
-             hook_version=EXCLUDED.hook_version, last_seen=EXCLUDED.last_seen, online=EXCLUDED.online, delivered_up_to=GREATEST(peers.delivered_up_to, EXCLUDED.delivered_up_to)`,
-          [p.session, orgId, p.pubkey || "", p.project || "", p.status || "", p.hookVersion || "", Number(p.lastSeen || 0), p._on === true || p.online === true, Number(p.deliveredUpTo || 0)],
+             hook_version=EXCLUDED.hook_version, last_seen=EXCLUDED.last_seen, online=EXCLUDED.online, delivered_up_to=GREATEST(peers.delivered_up_to, EXCLUDED.delivered_up_to),
+             -- #6170: THIS is the path a running hub actually persists through — saveDelta on the
+             -- persist tick, not touchPeer or saveSnapshot. Adding the column to the other two and
+             -- not this one is why the first live restart still came back with empty kinds.
+             kind=COALESCE(NULLIF(EXCLUDED.kind,''), peers.kind)`,
+          [p.session, orgId, p.pubkey || "", p.project || "", p.status || "", p.hookVersion || "", Number(p.lastSeen || 0), p._on === true || p.online === true, Number(p.deliveredUpTo || 0), p.kind || ""],
         );
       }
       if (peers.deletes.length) await c.query("DELETE FROM peers WHERE org_id=$1 AND session = ANY($2::text[])", [orgId, peers.deletes]);

package/lib/turn-policy.mjs

@@ -109,6 +109,42 @@ export function reasonWithBalances(reason, rows) {
   return reason === "empty-output" && quotaSpent(rows) ? "exhausted" : reason;
 }
 
+/// #6131: when the seat said nothing, its balance row is the only place the reset time exists —
+/// `parseResetAt` had no output to read. The EARLIEST spent row wins, because the seat is usable
+/// again the moment the first of its walls lifts. 0 when no spent row named a time.
+export function quotaResetAt(rows, now = Date.now()) {
+  const times = (Array.isArray(rows) ? rows : []).flatMap((r) => {
+    if (!r || !r.ok) return [];
+    if (r.kind === "quota") return r.remainingPct != null && r.remainingPct <= 0 ? [r.resetTime] : [];
+    if (r.kind === "windows") {
+      return (r.windows || []).filter((w) => w.locked || (w.usedPct != null && w.usedPct >= 100)).map((w) => w.resetsAt);
+    }
+    return [];
+  }).map((t) => (Number.isFinite(t) ? t : Date.parse(t))).filter((t) => Number.isFinite(t) && t > now);
+  return times.length ? Math.min(...times) : 0;
+}
+
 /// Seats that park rather than retry. A backend error is the provider having a bad minute and the
 /// ladder is exactly right for it; a spent plan or a rejected key will not fix itself on a timer.
 export const PARKING_REASONS = new Set(["exhausted", "auth"]);
+
+/// #6228: the sender's home project, by the same "name suffix after the last colon" convention
+/// every crew/orch identity is minted with (isRunnerSession in crew-runner.mjs uses the mirror
+/// check). A session id with no colon (a bare human alias) has no home project to fence.
+export function senderProjectOf(session) {
+  const s = String(session || "");
+  return s.includes(":") ? s.slice(s.lastIndexOf(":") + 1) : "";
+}
+
+/// #6228: is a wake from `senderProject` allowed to reach a seat whose own project is
+/// `seatProject`? Same project always is; a declared `trantor policy link` (the hub's own
+/// state.orgPolicy.links, mirrored to every seat via GET /policy) opens the door for two named
+/// projects; anything else is a cross-project wake and must be dropped, never worked — the
+/// runner's half of the guard the hub enforces at write time.
+export function isLinkedProject(senderProject, seatProject, links) {
+  if (!senderProject || !seatProject || senderProject === seatProject) return true;
+  return (Array.isArray(links) ? links : []).some((l) => {
+    const ps = (l?.projects || []).map((p) => String(p || "").toLowerCase());
+    return ps.includes(String(senderProject).toLowerCase()) && ps.includes(String(seatProject).toLowerCase());
+  });
+}

package/mcp.mjs

@@ -380,7 +380,7 @@ server.tool("relay_peers", "Find who you can talk to: the live agent sessions on
   return { content: [{ type: "text", text: lines.join("\n") || "no peers yet" }] };
 });
 
-server.tool("relay_send", "Send a live message to another agent session (or 'all' to broadcast). Reach the other agent YOURSELF: if you are about to ask the human to pass something along, tell the session directly instead — asking a person to carry a message between two agents is a failure, not politeness. Don't know the id? relay_peers lists them, linked projects included. Cross-project sends are allowed.",
+server.tool("relay_send", "Send a live message to another agent session (or 'all' to broadcast). Reach the other agent YOURSELF: if you are about to ask the human to pass something along, tell the session directly instead — asking a person to carry a message between two agents is a failure, not politeness. Don't know the id? relay_peers lists them, linked projects included. Cross-project action is a breach unless the operator linked the projects (`trantor policy link <a> <b> --reason \"<why>\"`) — the hub answers 403 for a send into an unlinked project.",
   { to: z.string().describe("target session id, or 'all'"), text: z.string().describe("message body"),
     wake: z.boolean().optional().describe("false = context, not a contract: the message batches into the target's next turn instead of buying it a whole CLI session. Use it for acks, FYIs and queue notes; leave it unset for anything you expect worked on.") },
   async ({ to, text, wake }) => {
@@ -480,8 +480,15 @@ const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
 const nonProjectReason = nonSeatReason(projectDir);
 const isHomeDirSession = !!nonProjectReason;
 
+// #6170: WHAT this session is, when it can know. sessionstart stamps kind "orch" on the
+// orchestrator pane, but that runs once — every MCP beat afterwards was kindless, and the hub's
+// crew exemption reads the peer row's kind, so the orchestrator kept being demoted by its own
+// heartbeat and then warned about as an intruder on its own project. Same test sessionstart uses:
+// TRANTOR_ORCH names the project this pane orchestrates.
+const KIND = process.env.TRANTOR_ORCH && process.env.TRANTOR_ORCH === PROJECT ? { kind: "orch" } : {};
+
 if (!isHomeDirSession) {
-  await api("POST", "/register", { session: SESSION, project: PROJECT, status: `active in ${PROJECT}`, hookVersion: MCP_VERSION })
+  await api("POST", "/register", { session: SESSION, project: PROJECT, status: `active in ${PROJECT}`, hookVersion: MCP_VERSION, ...KIND })
     .catch((err) => { process.stderr.write(`[trantor-mcp] initial register failed: ${err?.message || err}\n`); });
 
   // Heartbeat — keep this session's presence fresh for as long as the MCP process lives.
@@ -493,7 +500,7 @@ if (!isHomeDirSession) {
   // hub refreshes lastSeen but preserves the session's meaningful status. setInterval pauses during
   // sleep and fires on wake, so presence self-heals within one interval; .unref() lets the process
   // still exit cleanly when the agent closes the stdio transport (no phantom peers).
-  setInterval(() => { api("POST", "/register", { session: SESSION, project: PROJECT, hookVersion: MCP_VERSION }).catch(() => {}); }, HEARTBEAT_MS).unref?.();
+  setInterval(() => { api("POST", "/register", { session: SESSION, project: PROJECT, hookVersion: MCP_VERSION, ...KIND }).catch(() => {}); }, HEARTBEAT_MS).unref?.();
 } else {
   process.stderr.write(`[trantor-mcp] ${nonProjectReason} — not auto-registering on the bus (set RELAY_SESSION or RELAY_PROJECT to opt in)\n`);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.35",
+  "version": "0.18.37",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"

package/skills/crew/SKILL.md

@@ -46,6 +46,16 @@ explicit EVENT/INTERFACE CONTRACT — cross-agent bugs come from contract drift.
    request natively, which is the whole reason it exists. If it is missing: `trantor app install`.
 
 ## Phase 2 — fire up the crew (with the Advisor's models)
+**Cross-project action is a breach unless the operator linked the projects.** `trantor up` only
+ever targets the project you are already IN — never bring up seats in, register a seat into, or
+send a card/contract to a DIFFERENT project because an instruction reads that way ("build it where
+the answers are stored" is not a project name). If the work genuinely belongs to another project,
+name it and ask the operator once; do not infer it and do not route around the refusal. The hub
+403s a cross-project `/send`, `/task`, `/task/update`, `/register` or `/invite` on its own
+(`trantor policy link <a> <b> --reason "<why>"` is the only door), and a badged shell's `trantor up`
+refuses the same way — this is belt and braces, not the first line of defense; get the target
+project right before dispatching.
+
 **Each crew card from `relay_advise` carries a `launch` spec — run it VERBATIM; never invent a
 CLI invocation or run an agent "in a terminal" yourself.** Spawn every seat in one call:
 `trantor up <launch> <launch> … --task <kind> --difficulty <diff>`. The live roster + the

package/skills/prd-review/SKILL.md

@@ -149,6 +149,14 @@ The PRD card is done. Now one author writes the design and the same reviewers re
 
 The confirmed TDD is the gate. Do not ask the operator again merely to open its build cards.
 
+**But confirm the TARGET PROJECT before dispatching, always.** An ambiguous instruction ("build it
+where the answers are stored") is not a project name — it does not license bringing up seats in, or
+sending contracts into, a DIFFERENT project than the one you are reviewing. Name the project and ask
+the operator once if the brief points anywhere but here. Cross-project action is a breach unless the
+operator linked the projects (`trantor policy link <a> <b> --reason "<why>"`), and the hub, the
+`trantor up` CLI, and every seat's runner all refuse it mechanically — belt and braces, not a
+substitute for getting the target right in the first place.
+
 1. Move the TDD card through `testing` to `done` with the tally and the decision.
 2. `relay_advise` with the work breakdown's packages, then one `relay_task_add` per package:
    phase `build`, the advisor's assignee and `model`, its `difficulty`, `deps` on the packages it