trantor 0.18.49 → 0.18.51

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.49",
+  "version": "0.18.51",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/baton-pane.mjs

@@ -10,13 +10,14 @@
 //
 // Env seams (the drill's off switches, same doctrine as TRANTOR_NO_HANDOFF_SPAWN):
 //   TRANTOR_BATON_IDLE_DEADLINE_S  give up waiting for idle after this many seconds (default 600)
+//   TRANTOR_BATON_AGENT_DROP_MS    give herdr this long to retire the ended agent (default 10000)
 //   TRANTOR_BATON_REOPEN           command to reopen the pane, instead of `trantor open`
 //                                  (the drill points this at its own herdr world)
 // Detached means nobody reads stdout: everything lands in <bus>/logs/baton-pane-<project>.log.
 import { readFileSync, existsSync, mkdirSync, appendFileSync } from "node:fs";
 import { join, basename } from "node:path";
 import { homedir } from "node:os";
-import { execFileSync, execSync } from "node:child_process";
+import { execFileSync, spawnSync } from "node:child_process";
 import { createConnection } from "node:net";
 
 const arg = (name) => { const i = process.argv.indexOf(name); return i > 0 ? process.argv[i + 1] : ""; };
@@ -67,8 +68,50 @@ function socketRequest(req, timeoutMs = 30_000) {
 
 const sleep = (ms) => new Promise(r => setTimeout(r, ms));
 const agentStatus = (pane) => herdrJson(["agent", "get", pane])?.result?.agent?.agent_status || null;
+const hasAgent = (pane) => Boolean(herdrJson(["agent", "get", pane])?.result?.agent);
 const alive = (pid) => { try { process.kill(pid, 0); return true; } catch { return false; } };
 
+// The shells a pane idles in once its agent is gone. Their pid is never the process to end.
+const SHELL_NAMES = new Set(["zsh", "bash", "sh", "fish", "dash", "ksh", "tcsh", "csh", "nu", "login"]);
+function isShellProcess(p) {
+  const raw = String(p?.name || p?.argv0 || "").trim();
+  const name = basename(raw.replace(/^-/, ""));   // login shells spell themselves "-zsh"
+  return SHELL_NAMES.has(name);
+}
+
+/** The pid the graceful end targets, from herdr's `pane process-info` result.process_info —
+ *  parity with lib.rs foreground_pid_from_process_info. #6668: the 09-07 12:35 chain would have
+ *  TERMed 80368, the pane's bare zsh, because foreground_process_group_id was taken as-is. The
+ *  shell (process_info.shell_pid, or any entry named like one) is never a candidate: with only
+ *  the shell in the foreground there is nothing to end, and the answer is null. */
+export function foregroundPid(info) {
+  if (!info) return null;
+  const procs = Array.isArray(info.foreground_processes) ? info.foreground_processes : [];
+  const shellPid = Number(info.shell_pid) || 0;
+  const byPid = (pid) => procs.find(p => Number(p?.pid) === pid);
+  const usable = (pid) => pid > 0 && pid !== shellPid && !isShellProcess(byPid(pid));
+  const group = Number(info.foreground_process_group_id) || 0;
+  if (usable(group)) return group;
+  const claude = procs.find(p => /claude/i.test([p?.name, p?.argv0, p?.cmdline].map(s => String(s || "")).join(" ")) && !isShellProcess(p));
+  if (claude && Number(claude.pid) > 0 && Number(claude.pid) !== shellPid) return Number(claude.pid);
+  for (let i = procs.length - 1; i >= 0; i--) {
+    const pid = Number(procs[i]?.pid) || 0;
+    if (usable(pid)) return pid;
+  }
+  return null;
+}
+
+export function agentDropStep(present, elapsedMs, deadlineMs) {
+  if (!present) return "dropped";
+  return elapsedMs >= deadlineMs ? "deadline" : "wait";
+}
+
+function summary(value, limit = 240) {
+  const oneLine = String(value || "").trim().replace(/\s+/g, " ");
+  if (!oneLine) return "<empty>";
+  return oneLine.length > limit ? `${oneLine.slice(0, limit - 1)}…` : oneLine;
+}
+
 async function main() {
   if (!handoffFile || !existsSync(handoffFile)) { log(`no handoff file (${handoffFile}) — abort`); process.exit(1); }
   const pane = arg("--pane") || orchPane((() => { try { return readFileSync(join(busDir, "crew-windows.txt"), "utf8"); } catch { return ""; } })(), projectName);
@@ -88,7 +131,7 @@ async function main() {
 
   // 2. Graceful end, mirroring end_process_gracefully: TERM, short wait, KILL.
   const info = herdrJson(["pane", "process-info", "--pane", pane])?.result?.process_info;
-  const pid = Number(info?.foreground_process_group_id) || Number(info?.foreground_processes?.[0]?.pid) || 0;
+  const pid = foregroundPid(info) || 0;
   if (pid > 0 && alive(pid)) {
     try { process.kill(pid, "SIGTERM"); } catch {}
     const killAt = Date.now() + 10_000;
@@ -96,18 +139,26 @@ async function main() {
     if (alive(pid)) { try { process.kill(pid, "SIGKILL"); } catch {} }
     log(`ended pid ${pid}`);
   } else {
-    log("no foreground process to end (already gone)");
+    log("no foreground process to end (already gone, or only the pane's shell is in the foreground)");
+  }
+
+  const dropStarted = Date.now();
+  const dropDeadline = Number(process.env.TRANTOR_BATON_AGENT_DROP_MS) || 10_000;
+  let dropOutcome;
+  while ((dropOutcome = agentDropStep(hasAgent(pane), Date.now() - dropStarted, dropDeadline)) === "wait") {
+    await sleep(200);
   }
+  log(`agent drop ${dropOutcome} after ${Date.now() - dropStarted}ms`);
 
   // 3. Reopen. `trantor open` rebinds orch-sessions.txt and restarts the pane's session — the
   //    bookkeeping the classic seam regression comes from skipping. The drill overrides this to
   //    stay inside its own herdr world.
   const reopen = process.env.TRANTOR_BATON_REOPEN || "trantor open";
-  try {
-    execSync(reopen, { cwd: projectDir, encoding: "utf8", timeout: 120_000, stdio: "pipe" });
-    log(`reopened via: ${reopen}`);
-  } catch (e) {
-    log(`reopen FAILED (${String(e?.message).slice(0, 200)}) — handoff waits on disk`);
+  log(`reopen starting via: ${reopen}`);
+  const reopened = spawnSync(reopen, { cwd: projectDir, encoding: "utf8", timeout: 120_000, stdio: "pipe", shell: true });
+  log(`reopen result: status=${reopened.status ?? "none"} stdout=${summary(reopened.stdout)} stderr=${summary(reopened.stderr)}`);
+  if (reopened.error || reopened.status !== 0) {
+    log(`reopen FAILED (${summary(reopened.error?.message || reopened.signal || `exit ${reopened.status}`)}) — handoff waits on disk`);
     process.exit(1);
   }
 
@@ -118,7 +169,9 @@ async function main() {
   }
   try {
     const raw = await socketRequest({ id: "trantor:agent.prompt", method: "agent.prompt", params: { target: pane, text: KICKOFF_PROMPT } });
-    log(`kickoff: ${String(JSON.parse(raw).result?.type)}`);
+    const response = JSON.parse(raw);
+    const result = response.result?.type || response.error?.code || "unexpected_response";
+    log(`kickoff result: ${result}${response.error?.message ? ` (${summary(response.error.message)})` : ""}`);
   } catch (e) {
     log(`kickoff FAILED (${String(e?.message).slice(0, 120)}) — successor may sit idle until spoken to`);
   }

package/bin/baton.mjs

@@ -8,7 +8,7 @@ import { join, basename, dirname } from "node:path";
 import { homedir } from "node:os";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { writeHandoff, spawnBaton, resolveHandoffSurface, armBaton, contextUsage, controllingTty, turnInFlight, armMaxMs } from "../hooks/lib/handoff.mjs";
+import { writeHandoff, spawnBaton, resolveHandoffSurface, armBaton, contextUsage, controllingTty, turnInFlight, armMaxMs, sessionProcessState } from "../hooks/lib/handoff.mjs";
 
 // #6074: the skill path (write-handoff.mjs) and this CLI path must share ONE resolution of which
 // project this is and where the session lives. Both call resolveHandoffSurface; the name comes
@@ -82,7 +82,13 @@ function autoBaton() {
   // a turn still in flight ARMS instead of writing: no record, no spawn, and the session's own
   // Stop hook fires the baton at the boundary, where the summary describes finished work.
   const force = process.argv.includes("--force");
-  if (!force && turnInFlight(transcript)) {
+  // #6668: a transcript whose session has NO live process is at its boundary, whatever its last
+  // row says. The 09-07 12:35 chain armed on a session that had exited at 12:16 (its tail was a
+  // tool_result "Connection closed"), then sat in the 17-minute boundary wait for a Stop hook no
+  // process would ever run. Write now; the record describes a session that is over.
+  const processState = sessionProcessState(sessionId);
+  if (processState === "dead") console.log(`session ${sessionId} has no live process — at its boundary, writing now`);
+  if (!force && processState !== "dead" && turnInFlight(transcript)) {
     armBaton(sessionId, {
       projectDir: cwd,
       transcript, reason: trigger, windowId: "", tty: controllingTty(),

package/bin/connect.mjs

@@ -16,6 +16,14 @@ import { fileURLToPath } from "node:url";
 const DRY = process.argv.includes("--dry-run");
 const MCP = join(dirname(dirname(fileURLToPath(import.meta.url))), "mcp.mjs");
 const URL_ = process.env.RELAY_URL || "http://127.0.0.1:4477";
+// Graft (github.com/NanoNets/context-graph-engine): a local Tree-sitter dependency graph served
+// over MCP (graft_find_code / _find_all / _trace_calls / _file_api / _repo_map). Wired next to
+// `relay` so a seat can locate code with one call instead of grep+read-many — the graph refreshes
+// itself before each query (no freshness hook) and serves the nearest ancestor with a graft/ index,
+// so it keys off the seat's cwd project. A project with no graft/ index simply returns empty tools,
+// never an error. `graft build` (or `graft init`) seeds a project's index; graft/ is gitignored.
+const GRAFT = (() => { try { return execSync("command -v graft", { encoding: "utf8", shell: "/bin/sh" }).trim(); } catch { return "graft"; } })();
+const HAS_GRAFT = GRAFT !== "graft" || (() => { try { execSync("command -v graft", { stdio: "ignore", shell: "/bin/sh" }); return true; } catch { return false; } })();
 const has = (cmd) => { try { execSync(`command -v ${cmd}`, { stdio: "ignore", shell: "/bin/sh" }); return true; } catch { return false; } };
 const stamp = new Date().toISOString().slice(0, 10);
 const backup = (p) => { const b = `${p}.bak-${stamp}`; if (!existsSync(b)) copyFileSync(p, b); return b; };
@@ -65,6 +73,16 @@ if (has("codex")) {
     if (!DRY) { if (existsSync(p)) backup(p); else mkdirSync(dirname(p), { recursive: true }); writeFileSync(p, cur + block); }
     report("codex", cur ? "wired" : "wired (new config)", p);
   }
+  // graft alongside relay
+  if (HAS_GRAFT) {
+    const g = existsSync(p) ? readFileSync(p, "utf8") : "";
+    if (g.includes("[mcp_servers.graft]")) report("codex", "graft already wired");
+    else {
+      const gblock = `\n# trantor — Graft code-graph tools (graft_find_code/_find_all/_trace_calls/_file_api/_repo_map)\n[mcp_servers.graft]\ncommand = "${GRAFT}"\nargs = ["mcp"]\n`;
+      if (!DRY) { if (existsSync(p)) backup(p); writeFileSync(p, g + gblock); }
+      report("codex", "graft wired", p);
+    }
+  }
 }
 
 // ---- Gemini CLI ----  (existing relay entries are never overwritten — user customization wins)
@@ -73,6 +91,7 @@ if (has("gemini")) {
   report("gemini", patchJson(p, d => {
     d.mcpServers ||= {};
     d.mcpServers.relay ||= { command: "node", args: [MCP], env: relayEnv("gemini") };
+    if (HAS_GRAFT) d.mcpServers.graft ||= { command: GRAFT, args: ["mcp"] };
   }), p);
 }
 
@@ -82,6 +101,7 @@ if (has("kimi")) {
   report("kimi", patchJson(p, d => {
     d.mcpServers ||= {};
     d.mcpServers.relay ||= { command: "node", args: [MCP], env: relayEnv("kimi") };
+    if (HAS_GRAFT) d.mcpServers.graft ||= { command: GRAFT, args: ["mcp"] };
   }), p);
 }
 
@@ -92,6 +112,7 @@ if (has("opencode")) {
     d.$schema ||= "https://opencode.ai/config.json";
     d.mcp ||= {};
     d.mcp.relay ||= { type: "local", command: ["node", MCP], enabled: true };
+    if (HAS_GRAFT) d.mcp.graft ||= { type: "local", command: [GRAFT, "mcp"], enabled: true };
     d.mcp.relay.environment ||= {};
     // Migrate the old generated pin too: `||=` alone left RELAY_AGENT=opencode in every existing
     // config forever, where OpenCode overlaid it on the qwen/glm/deepseek runner environment.
@@ -135,7 +156,7 @@ if (has("dsh")) {
     },
     dsh: { profile: { bundles: ["@deepseek-ai/dsh-base", "@deepseek-ai/dsh-headless"] } },
   };
-  const patch = `# trantor — generated by \`trantor connect\` (edits survive: regenerate by deleting this file)
+  const patch = `# trantor — generated by \`trantor connect\` (connect rewrites this file only when it is missing a row; delete it to force a full regen)
 - insert:
     - id: trantor-cc-hooks
       name: '@deepseek-ai/dsh-hooks-claude-code'
@@ -154,10 +175,29 @@ if (has("dsh")) {
           RELAY_AGENT: !!js process.env.RELAY_AGENT ?? 'dsh'
           RELAY_PROJECT: !!js process.env.RELAY_PROJECT ?? ''
           RELAY_SESSION: !!js process.env.RELAY_SESSION ?? ''
-`;
+${HAS_GRAFT ? `    - id: trantor-graft
+      name: '@deepseek-ai/dsh-mcp-client'
+      config:
+        serverName: graft
+        transport: stdio
+        command: ${GRAFT}
+        args: ['mcp']
+` : ""}`;
+  // "a profile exists" is not "a profile is current": connect grows rows over time (relay, then
+  // graft, then whatever comes next), and an existence check short-circuits on a profile written
+  // by an older connect forever — the seat silently never gets the new row. So the gate is
+  // CONTENT-based: every row id this connect would write must already be in the patch; a missing
+  // one regenerates the patch (backed up). Presence, not diff — user edits to rows that ARE there
+  // still win, the same rule as the gemini/kimi/opencode `||=` patches above.
+  const expectedIds = [...patch.matchAll(/- id: (\S+)/g)].map(m => m[1]);
+  const cur = existsSync(patchPath) ? readFileSync(patchPath, "utf8") : "";
+  const missing = expectedIds.filter(id => !cur.split("\n").some(l => l.trim() === `- id: ${id}`));
   const fresh = !existsSync(patchPath);
-  if (!fresh) report("dsh", "already wired", prof);
-  else {
+  if (!fresh && !missing.length) report("dsh", "already wired", prof);
+  else if (!fresh) {
+    if (!DRY) { backup(patchPath); writeFileSync(patchPath, patch); }
+    report("dsh", `regenerated — was missing: ${missing.join(", ")}`, prof);
+  } else {
     if (!DRY) {
       mkdirSync(prof, { recursive: true });
       // The seat runs the plugin's hooks MINUS SessionStart: the crew runner already owns

package/bin/crew/open.mjs

@@ -1,8 +1,10 @@
 import { randomUUID } from "node:crypto";
-import { existsSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { call } from "./core.mjs";
-import { createWorkspace, herdrCall, paneHasAgent, reportAgent, splitPane, workspaceList, workspacePane } from "./herdr.mjs";
+import { existsSync, openSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, join } from "node:path";
+import { spawn, execSync } from "node:child_process";
+import { call, parseJsonOutput } from "./core.mjs";
+import { createWorkspace, herdrCall, reportAgent, splitPane, workspaceList, workspacePane } from "./herdr.mjs";
 import { dropState, readRows, recordState } from "./state.mjs";
 import { resolveOrchestratorDir } from "./worktrees.mjs";
 
@@ -72,6 +74,19 @@ function orchestratorCommand(ctx, id) {
   return `${env} claude${harnessFlag(ctx)} ${action}`;
 }
 
+export function paneHasAgent(ctx, pane) {
+  const result = herdrCall(ctx, ["pane", "process-info", "--pane", pane]);
+  const info = parseJsonOutput(result.stdout)?.result?.process_info;
+  if (!result.ok || !info) return false;
+  const processes = Array.isArray(info.foreground_processes) ? info.foreground_processes : [];
+  return processes.some(process => {
+    const command = [process.name, process.argv0, process.cmdline, ...(Array.isArray(process.argv) ? process.argv : [])]
+      .filter(Boolean)
+      .join(" ");
+    return /(^|[/\s])claude(?:\.exe)?(?:$|\s)/i.test(command);
+  });
+}
+
 function tracked(ctx, live) {
   let workspace = "";
   let pane = "";
@@ -91,7 +106,8 @@ function reattach(ctx, workspace, pane, id) {
   const renamed = herdrCall(ctx, ["pane", "rename", pane, `orchestrator · ${ctx.project}`]);
   if (!renamed.ok) { dropState(ctx, ctx.project, "orch"); return false; }
   if (!paneHasAgent(ctx, pane)) {
-    herdrCall(ctx, ["pane", "run", pane, orchestratorCommand(ctx, id)]);
+    const started = herdrCall(ctx, ["pane", "run", pane, orchestratorCommand(ctx, id)]);
+    if (!started.ok) throw new Error(`trantor open: could not start the orchestrator in pane ${pane}`);
     reportAgent(ctx, pane, "claude");
     console.error(`— orchestrator pane was empty: resumed session ${id} in herdr:${workspace || "?"}/${pane} —`);
   } else console.error(`— orchestrator already hosted: reattached to herdr:${workspace || "?"}/${pane} —`);
@@ -136,6 +152,38 @@ function hostPane(ctx, chosen, id) {
   return pane;
 }
 
+// #6888: index the project once so its seats' Graft tools (graft_find_code, _trace_calls, …) have a
+// graph to serve. Non-blocking — the pane opens now, the ~7s build lands in the background; a no-op
+// if graft isn't installed or the index already exists (the graph self-refreshes per query after the
+// first build). Keeps the 20MB index out of the project's git.
+export function maybeBuildGraft(dir) {
+  if (!dir) return;
+  try { execSync("command -v graft", { stdio: "ignore", shell: "/bin/sh" }); } catch { return; }
+  try {
+    if (existsSync(join(dir, "graft", ".graph"))) return;
+    const gi = join(dir, ".gitignore");
+    try {
+      const cur = existsSync(gi) ? readFileSync(gi, "utf8") : "";
+      if (!/^graft\/?$/m.test(cur)) writeFileSync(gi, cur + (cur && !cur.endsWith("\n") ? "\n" : "") + "graft/\n");
+    } catch {}
+    // The build is backgrounded, so we cannot gate the pane on its exit code — but a failure has to
+    // land SOMEWHERE. It used to go to stdio:"ignore", which meant a graft whose native parsers were
+    // never built (npm v12 skips node-gyp by default; see deploy/setup.sh) failed in total silence
+    // while the line below still claimed an index was being built.
+    //
+    // The log goes to the OS temp dir rather than the project: nothing to gitignore, nothing to clean
+    // up, and no exit handler — after unref() the parent usually dies first, so an on-exit cleanup
+    // would be a promise we cannot keep. It is simply overwritten by the next open of this project.
+    const log = join(tmpdir(), `trantor-graft-build-${basename(dir)}.log`);
+    let fd = "ignore";
+    try { fd = openSync(log, "w"); } catch {}
+    const child = spawn("graft", ["build", dir], { cwd: dir, stdio: ["ignore", fd, fd], detached: true });
+    child.on("error", () => {});   // ENOENT/EACCES: the log and the absent index are the evidence
+    child.unref();
+    console.error(`— indexing this project for the seats' Graft tools in the background (failures land in ${log}) —`);
+  } catch {}
+}
+
 export function openOrchestrator(ctx, args) {
   let parsed;
   try { parsed = parseArgs(args); }
@@ -143,6 +191,7 @@ export function openOrchestrator(ctx, args) {
   if (parsed.help) { usage(); return 0; }
   try {
     Object.assign(ctx, resolveOrchestratorDir(ctx, parsed.project));
+    if (!ctx.dry) maybeBuildGraft(ctx.dir);
     if (!ctx.have.herdr) throw new Error("trantor open needs herdr (the pane host) — install: curl -fsSL https://herdr.dev/install.sh | sh");
     let id = sessionId(ctx);
     if (hasPendingHandoff(ctx)) {

package/bin/crew-runner.mjs

@@ -28,7 +28,8 @@ import {
   senderProjectOf, isLinkedProject,
 } from "../lib/turn-policy.mjs";
 import {
-  auditDutyNudges, claudeTranscriptDir, dutyNudgeDirective, observedDutyNudgeIds, planDutyNudges,
+  auditDutyNudges, claimDutyNudges, claudeTranscriptDir, dutyEscalations, dutyNudgeDirective,
+  observedDutyNudgeIds,
 } from "../lib/duty-nudges.mjs";
 
 const AGENT = process.argv[2];
@@ -468,10 +469,40 @@ async function parkSeat(reason, undelivered, resetHint = 0) {
     if (orch !== SESSION) await api("/send", { from: SESSION, to: orch, text, project: PROJ, kind: "alert" }).catch(() => {});
   }
   log(`\x1b[31mparked (${reason})${when ? ` — retrying after ${when}` : " — no reset time in the output; waiting for a restart"}\x1b[0m`);
+  // The two /send calls above are the whole escalation, and on 2026-09-09 that was not enough:
+  // the DUTY seat parked on a quota read, held 48 messages for 21.9 hours, and announced it over
+  // the very bus that had stopped moving, to an orchestrator that was idle and therefore could not
+  // receive it. The alarm for "the bus is stuck" cannot itself be a bus message. So park also
+  // rings a bell the operator can actually hear, out of band, once per park.
+  notifyOperator(`Trantor: ${SESSION} PARKED (${reason})`,
+    `${undelivered} message(s) held${when ? ` — retrying after ${when}` : ` — needs \`trantor up ${AGENT}\``}`);
   // No reset time means no timer can clear it: hold until the operator restarts the seat.
   return resetAt || Number.MAX_SAFE_INTEGER;
 }
 
+/**
+ * Reach the operator on a channel that does not depend on the bus, the hub, or a live session.
+ * Best-effort and strictly non-fatal: a seat must never die because a notifier is missing.
+ * Silence-able with TRANTOR_NO_DESKTOP_NOTIFY=1 for headless boxes and test runs.
+ */
+function notifyOperator(title, body) {
+  if (process.env.TRANTOR_NO_DESKTOP_NOTIFY === "1") return;
+  try {
+    // Always leave a durable trace first: a notification can be missed or suppressed, a file cannot.
+    // This is what `trantor doctor` reads, so the escalation survives a machine nobody was sitting at.
+    const alertsPath = join(homedir(), ".agent-bus", "alerts.jsonl");
+    appendFileSync(alertsPath, `${JSON.stringify({ ts: Date.now(), session: SESSION, title, body })}\n`);
+  } catch {}
+  try {
+    if (process.platform === "darwin") {
+      // osascript is present on every mac; no dependency to install and nothing to keep running.
+      const esc = (s) => String(s).replace(/["\\]/g, "\\$&");
+      spawnSync("osascript", ["-e", `display notification "${esc(body)}" with title "${esc(title)}"`],
+        { timeout: 5000, stdio: "ignore" });
+    }
+  } catch {}
+}
+
 // The seat's own balance rows, for the #6131 read: a stalled turn that printed nothing on a seat
 // whose plan is spent is exhaustion, not a crash. Bounded and best-effort — a slow provider API
 // must never hold up the failure path, and an unreachable one just leaves the reason as it was.
@@ -886,7 +917,24 @@ function isRunnerSession(session) {
   return /^[a-z0-9_.-]+$/.test(label) && !label.startsWith("hub:");
 }
 
+// A hub staleness alert describes a condition that was true for a moment: "#16909 has been
+// UNDELIVERED for 2m — go nudge someone". Acting on it 22 hours later is meaningless, and the queue
+// had no expiry, so on 2026-09-09 the duty seat's backlog became SELF-POISONING: the hub kept
+// noticing undelivered mail and sending more alerts, duty could not work them off, and a restart
+// faithfully redelivered 49 dead nudges and re-wedged the seat. 46 of those 49 were hub alerts, the
+// oldest 22.1 hours old, every one describing a two-minute condition.
+//
+// So these EXPIRE. Deliberately narrow: only messages the HUB generated about staleness, never a
+// message from a peer. A real contract is never dropped for being old — a seat that misses a
+// teammate's request is the failure this bus exists to prevent, and no backlog is worth causing it.
+const HUB_ALERT_TTL_MS = Number(process.env.TRANTOR_HUB_ALERT_TTL_MS || 30 * 60_000);
+const isExpiredHubAlert = (m) =>
+  m?.from === "hub:duty" &&
+  Number.isFinite(m?.ts) &&
+  Date.now() - m.ts > HUB_ALERT_TTL_MS;
+
 function shouldWake(message) {
+  if (isExpiredHubAlert(message)) return false;
   if (isReceipt(message) || isStatusBroadcast(message)) return false;
   // #6134: the SENDER decides. `wake:false` says "this is context, not a contract" — it batches
   // into the next turn's prompt like a broadcast and never buys a CLI session of its own.
@@ -956,8 +1004,14 @@ function askedExcerpt(message) {
   // broadcasts batched behind them. Restored from disk first: a runner that was killed mid-turn
   // (or a machine that rebooted) still owes those messages, and the hub will never send them again.
   const restored = loadPending();
+  // Say what the restore SHED, not just what it kept. A queue that quietly halves itself on restart
+  // is indistinguishable from one that lost real work, and this is the moment the expiry above
+  // actually bites — a wedged seat comes back carrying only what still means something.
+  const shed = restored.wake.filter(isExpiredHubAlert).length +
+               restored.bcast.filter(isExpiredHubAlert).length;
   let pendingWake = restored.wake.filter(shouldWake);
-  let pendingBcast = restored.bcast.filter(m => !isReceipt(m) && !isStatusBroadcast(m));
+  let pendingBcast = restored.bcast.filter(m => !isExpiredHubAlert(m) && !isReceipt(m) && !isStatusBroadcast(m));
+  if (shed) log(`\x1b[33mdropped ${shed} expired hub staleness alert(s) older than ${Math.round(HUB_ALERT_TTL_MS / 60000)}m — they describe conditions that have long since changed\x1b[0m`);
   let retryAt = 0;            // 0 = deliver at the next opportunity
   let deliveryFails = 0;      // consecutive failed attempts at the SAME pending batch
   if (pendingWake.length) log(`\x1b[33m${pendingWake.length} message(s) survived from a previous run — redelivering\x1b[0m`);
@@ -1067,10 +1121,30 @@ function askedExcerpt(message) {
   // queued, on disk, with a backoff — which is the whole point of the change.
   async function deliverWake() {
     const wake = pendingWake;
-    const wakeCapped = capWake(wake);
+    const dutyPlan = DUTY_NUDGES
+      ? await claimDutyNudges({
+        messages: wake,
+        statePath: DUTY_NUDGE_STATE,
+        owner: `${RUNNER_ID}:${TURN + 1}`,
+      })
+      : { items: [], targets: [], owner: "" };
+    const claimedIds = new Set(dutyPlan.items.map(item => item.id));
+    const wakeForTurn = DUTY_NUDGES
+      ? wake.filter(message => {
+        const escalation = dutyEscalations([message])[0];
+        return !escalation || claimedIds.has(escalation.id);
+      })
+      : wake;
+    if (!wakeForTurn.length) {
+      pendingWake = [];
+      savePending([], pendingBcast);
+      log("duty escalation already nudged or reserved by another turn — consumed without a duplicate model wake");
+      return;
+    }
+    const wakeCapped = capWake(wakeForTurn);
     const bcastCapped = capBcast(pendingBcast);
     const wakeText = wakeCapped.text
-      ? `NEW BUS MESSAGE${wake.length > 1 ? "S" : ""} for you:\n${wakeCapped.text}\n`
+      ? `NEW BUS MESSAGE${wakeForTurn.length > 1 ? "S" : ""} for you:\n${wakeCapped.text}\n`
       : "";
     const ctxText = bcastCapped.text
       ? `\nFYI broadcasts since your last turn (context only):\n${bcastCapped.text}\n`
@@ -1078,29 +1152,26 @@ function askedExcerpt(message) {
     // Say plainly that this is a second look. Without it the model re-reads an old escalation as
     // brand new and can redo work it already half-did before the turn died.
     const againText = deliveryFails
-      ? `\n(REDELIVERY, attempt ${deliveryFails + 1} — an earlier turn failed before acting on ${wake.length > 1 ? "these" : "this"}. Check what you already did before repeating it.)\n`
+      ? `\n(REDELIVERY, attempt ${deliveryFails + 1} — an earlier turn failed before acting on ${wakeForTurn.length > 1 ? "these" : "this"}. Check what you already did before repeating it.)\n`
       : "";
     await loadLessons();
     const lessons = pickLessons(LESSONS_RAW, wakeCapped.text + " " + bcastCapped.text);
-    const trigger = wake.some(m => m.to === SESSION) ? "direct message" : "@mention";
+    const trigger = wakeForTurn.some(m => m.to === SESSION) ? "direct message" : "@mention";
     // Who is owed an answer, captured BEFORE the turn: pendingWake is cleared on success.
     const assigners = [];
-    for (const m of wake) if (m.from && !assigners.some(a => a.from === m.from)) assigners.push({ from: m.from, id: m.id });
-    const asked = askedExcerpt(wake[0]);
+    for (const m of wakeForTurn) if (m.from && !assigners.some(a => a.from === m.from)) assigners.push({ from: m.from, id: m.id });
+    const asked = askedExcerpt(wakeForTurn[0]);
     const tStart = Date.now();
     // #6134: ONE SESSION PER CARD. A seat that resumes forever carries every card it ever worked
     // into every later turn — qwen's 85.7M tokens were 96.7% cached, i.e. replayed history. The
     // card that moved this wake decides: a different one starts a fresh CLI session, and the seat
     // is told so, because a fresh session remembers nothing and must be sent to its card.
-    const card = wake.map(m => cardRef(m.text)).find(Boolean) || 0;
+    const card = wakeForTurn.map(m => cardRef(m.text)).find(Boolean) || 0;
     const fresh = card > 0 && card !== sessionCard;
     if (card) sessionCard = card;
     const freshText = fresh
       ? `\n(FRESH SESSION for card #${card} — you are not the session that worked earlier cards and you remember none of them. Read your card first: relay_board with card:${card}.)\n`
       : "";
-    const dutyPlan = DUTY_NUDGES
-      ? planDutyNudges(wake, DUTY_NUDGE_STATE)
-      : { items: [], targets: [] };
     const prompt = composedTurn({
       wakeText, ctxText, againText: againText + freshText + dutyNudgeDirective(dutyPlan),
       tailText: "\nAct on what's addressed to you, then end your turn.\n\n",
@@ -1165,6 +1236,21 @@ function askedExcerpt(message) {
       const parkReason = PARKING_REASONS.has(reason) ? reason : (lastTurnCut ? "time-box" : "api-error");
       if (PARKING_REASONS.has(reason) || deliveryFails >= 2) {
         retryAt = await parkSeat(parkReason, pendingWake.length, quotaReset);
+        // A supervised seat does not have to sit parked until someone notices. RUNNER_PARK_MAX_MS
+        // is set only by `trantor duty up`, which runs the seat under a launchd keepalive: past the
+        // ceiling, exit and let the supervisor restart it clean — a fresh process re-reads auth and
+        // redelivers the queue from disk, which is exactly what un-wedged the 2026-09-09 incident
+        // when the operator finally ran `trantor duty up` by hand 21.9 hours late.
+        // Unsupervised seats keep the old behaviour: exiting would just kill them for good.
+        const parkMax = Number(process.env.RUNNER_PARK_MAX_MS || 0);
+        if (parkMax > 0) {
+          const wakeIn = Math.max(0, Math.min(retryAt - Date.now(), parkMax));
+          log(`\x1b[33msupervised seat: exiting in ${Math.round(wakeIn / 1000)}s so the keepalive restarts it clean\x1b[0m`);
+          setTimeout(() => {
+            log("parked past the ceiling — exiting for the keepalive to relaunch");
+            process.exit(0);   // 0, not 1: this is a deliberate hand-off, not a crash
+          }, wakeIn).unref?.();
+        }
         await notifyAssigners(assigners,
           `⛔ your contract is PARKED on ${SESSION} (${parkReason}) — not retrying · asked: "${asked}"`);
         lastTurnAt = Date.now();

package/bin/doctor.mjs

@@ -3,7 +3,7 @@
 // Checks: runtime, hub, plugin, each CLI (installed? wired? AUTHENTICATED?), API keys,
 // quota profile, optional Scrooge brain. Prints a checklist with copy-paste fixes.
 //   node bin/doctor.mjs
-import { readFileSync, existsSync } from "node:fs";
+import { readFileSync, readdirSync, existsSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { homedir } from "node:os";
 import { execSync } from "node:child_process";
@@ -304,6 +304,66 @@ prof?.providers && Object.keys(prof.providers).length
   ? ok(`quota profile set (${Object.entries(prof.providers).map(([k, v]) => `${k}=${v.plan}`).join(", ")})`)
   : warn("quota profile not set — the Advisor will assume API billing everywhere", `node ${join(ROOT, "bin", "profile.mjs")} set claude=max codex=plus deepseek=api …  (use YOUR real plans)`);
 
+// fleet — is the crew actually OPERATING, not just installed?
+//
+// Added 2026-09-09, because on that morning this command reported nine issues, every one about
+// provider keys and billing attribution, while the duty seat had been holding 48 undelivered
+// messages for 21.9 hours and the orchestrator had slept through a night of finished crew work.
+// Doctor checked whether credentials EXIST. Nothing checked whether the fleet was MOVING. These
+// two signals are both already on disk, written by the runner itself — nobody was reading them.
+section("the fleet (is it actually running?)");
+{
+  const busDir = join(H, ".agent-bus");
+  // 1. Undelivered queues. crew-runner persists pending-<agent>-<project>.json on every failed
+  //    delivery and unlinks it when the queue drains, so a file with an old head means mail is
+  //    stuck for that seat — whatever its process table says.
+  let stuck = 0;
+  const abandonedSeats = [];
+  try {
+    for (const f of readdirSync(busDir).filter(n => n.startsWith("pending-") && n.endsWith(".json"))) {
+      const j = read(join(busDir, f));
+      const held = [...(j?.wake || []), ...(j?.bcast || [])];
+      if (!held.length) continue;
+      const stamps = held.map(m => m?.ts).filter(Number.isFinite);
+      const oldest = stamps.length ? Math.min(...stamps) : j?.ts;
+      const hours = (Date.now() - oldest) / 3.6e6;
+      const seat = f.replace(/^pending-|\.json$/g, "");
+      // Three bands, because one flat warning per stuck queue is its own failure: this machine has
+      // leftovers from projects that ended weeks ago, and a doctor that cries about ten of them
+      // every run teaches you to skim past the one that matters. Under an hour is the retry ladder
+      // doing its job. Over a week is an abandoned seat, worth tidying, not worth alarming about.
+      // The band between is the live stall — the shape of the 2026-09-09 incident.
+      const abandoned = hours >= 24 * 7;
+      if (hours >= 1 && !abandoned) {
+        stuck++;
+        warn(`${seat}: ${held.length} message(s) undelivered, oldest ${hours.toFixed(1)}h old — mail is not moving`,
+          `the runner parks on quota/api failure and only a restart un-parks it: trantor up ${seat.split("-")[0]}   (duty: trantor duty up)`);
+      } else if (abandoned) {
+        abandonedSeats.push(`${seat} (${(hours / 24).toFixed(0)}d)`);
+      } else {
+        note(`${seat}: ${held.length} queued, oldest ${hours.toFixed(1)}h — within the retry ladder`);
+      }
+    }
+    if (abandonedSeats.length) {
+      note(`${abandonedSeats.length} abandoned queue(s) older than a week: ${abandonedSeats.join(", ")} — leftovers from finished work, safe to delete`);
+    }
+    if (!stuck) ok("no live seat is sitting on undelivered mail");
+  } catch { note(`no bus directory at ${busDir} yet — nothing has run`); }
+
+  // 2. Park alerts. notifyOperator appends one line per park, so a park that happened while nobody
+  //    was at the machine is still visible here afterwards — the point of writing it to disk.
+  try {
+    const alerts = readFileSync(join(busDir, "alerts.jsonl"), "utf8").trim().split("\n").filter(Boolean);
+    const recent = alerts.map(l => { try { return JSON.parse(l); } catch { return null; } })
+      .filter(a => a && Date.now() - a.ts < 24 * 3.6e6);
+    if (recent.length) {
+      const last = recent[recent.length - 1];
+      warn(`${recent.length} seat park alert(s) in the last 24h — most recent: ${last.title}`,
+        `read them: tail ~/.agent-bus/alerts.jsonl   — then restart the seat named above`);
+    } else ok("no seat has parked in the last 24h");
+  } catch { ok("no seat has parked in the last 24h"); }
+}
+
 say(issues ? `\n${issues} issue(s) — fix the → lines above, then re-run the doctor.` : "\nAll clear — open a claude session in any project and say: \"fire up the crew\".");
 // Must come BEFORE the exit — process.exit() here truncated the report entirely.
 if (JSON_MODE) console.log(JSON.stringify({ ...REPORT, issueCount: issues }));