trantor 0.18.50 → 0.18.52

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.50",
+  "version": "0.18.52",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/cli.mjs

@@ -90,6 +90,7 @@ switch (cmd) {
   case "proposals": case "proposal": run("bin/proposals.mjs"); break;
   case "inbox": run("bin/inbox.mjs"); break;
   case "duty": run("bin/duty.mjs"); break;
+  case "state": run("bin/state.mjs"); break;
   case "seats": case "seat": run("bin/seats.mjs"); break;
   case "seat-why": case "why": run("bin/seat-why.mjs"); break;
   case "orchestrate": run("bin/orchestrate.mjs"); break;
@@ -227,6 +228,7 @@ switch (cmd) {
   trantor hub         run the hub in the foreground (setup installs it as a service instead)
                       …or manage per-project hub pins: hub list · hub set <project> <url> · hub unset <project>
                       seats: which project lives in which directory — seats · seats add · seats up · seats login install
+  trantor state       a seat's working memory: show <seat> <card> [--json] · validate · reset --force · gc [--apply]
   trantor seat-why    WHY a seat is down (err file, logs, pids): seat-why <agent> [--json] — quota, auth, crash, or just no pane
   trantor watch       live bus feed in the terminal
   trantor inbox       THIS session's unread bus messages, signed (works under enforce) — [--all] [--consume] [--json]

package/bin/crew-runner.mjs

@@ -31,6 +31,11 @@ import {
   auditDutyNudges, claimDutyNudges, claudeTranscriptDir, dutyEscalations, dutyNudgeDirective,
   observedDutyNudgeIds,
 } from "../lib/duty-nudges.mjs";
+import {
+  BREAKER_WINDOW, STATE_ENV, TURN_RESULT_SCHEMA,
+  breakerVerdict, describeTurn, hasJsonSchemaFlag, parseEnvelope, renderCardTail, runStep,
+} from "../lib/state/driver.mjs";
+import { costLine } from "../lib/state/cost.mjs";
 
 const AGENT = process.argv[2];
 const DIR = process.argv[3] || process.cwd();
@@ -289,7 +294,19 @@ const CLI = {
   openrouter: { first: `opencode run --dir {DIR}{M} "$(cat {P})"`,
               next:  `opencode run --dir {DIR} -s {SID}{M} "$(cat {P})"`, mflag: " -m ", pinned: true, env: join(homedir(), ".token-scrooge", ".env") },
   claude:   { first: `claude{M} -p "$(cat {P})" --dangerously-skip-permissions`,
-              next:  `claude -c{M} -p "$(cat {P})" --dangerously-skip-permissions`, mflag: " --model " },
+              next:  `claude -c{M} -p "$(cat {P})" --dangerously-skip-permissions`,
+              // TRANTOR_STATE_ASSEMBLE=1 — Trantor State Phase 2a (TDD §4.6). Note what is GONE:
+              // `-c`. The resumed transcript is the thing this path exists to stop re-sending, so a
+              // state step is a fresh `claude -p` carrying the assembled prefix instead, and
+              // `--json-schema` holds the seat to the TurnResult grammar. Used for the first step
+              // of a card too: with no `-c` it IS the `first` shape, and a first step that returned
+              // no TurnResult would leave the run recorder a hole on turn 1.
+              //
+              // The flag is off by default and nothing above changes, so the transcript path stays
+              // byte-identical — test/state/test-runner-state.mjs asserts that against these very
+              // strings rather than against a reading of this comment.
+              stateNext: `claude{M} -p "$(cat {P})" --dangerously-skip-permissions --output-format json --json-schema "$(cat {S})"`,
+              mflag: " --model " },
   // DeepSeek Harness. Every turn is a FRESH session — headless has no resume yet — so the seat
   // relies on the wake prompt + the board (via the relay tools its profile mounts) rather than
   // conversation memory. `trantor connect` builds the ~/.dsh/profiles/trantor composition: their
@@ -469,10 +486,40 @@ async function parkSeat(reason, undelivered, resetHint = 0) {
     if (orch !== SESSION) await api("/send", { from: SESSION, to: orch, text, project: PROJ, kind: "alert" }).catch(() => {});
   }
   log(`\x1b[31mparked (${reason})${when ? ` — retrying after ${when}` : " — no reset time in the output; waiting for a restart"}\x1b[0m`);
+  // The two /send calls above are the whole escalation, and on 2026-09-09 that was not enough:
+  // the DUTY seat parked on a quota read, held 48 messages for 21.9 hours, and announced it over
+  // the very bus that had stopped moving, to an orchestrator that was idle and therefore could not
+  // receive it. The alarm for "the bus is stuck" cannot itself be a bus message. So park also
+  // rings a bell the operator can actually hear, out of band, once per park.
+  notifyOperator(`Trantor: ${SESSION} PARKED (${reason})`,
+    `${undelivered} message(s) held${when ? ` — retrying after ${when}` : ` — needs \`trantor up ${AGENT}\``}`);
   // No reset time means no timer can clear it: hold until the operator restarts the seat.
   return resetAt || Number.MAX_SAFE_INTEGER;
 }
 
+/**
+ * Reach the operator on a channel that does not depend on the bus, the hub, or a live session.
+ * Best-effort and strictly non-fatal: a seat must never die because a notifier is missing.
+ * Silence-able with TRANTOR_NO_DESKTOP_NOTIFY=1 for headless boxes and test runs.
+ */
+function notifyOperator(title, body) {
+  if (process.env.TRANTOR_NO_DESKTOP_NOTIFY === "1") return;
+  try {
+    // Always leave a durable trace first: a notification can be missed or suppressed, a file cannot.
+    // This is what `trantor doctor` reads, so the escalation survives a machine nobody was sitting at.
+    const alertsPath = join(homedir(), ".agent-bus", "alerts.jsonl");
+    appendFileSync(alertsPath, `${JSON.stringify({ ts: Date.now(), session: SESSION, title, body })}\n`);
+  } catch {}
+  try {
+    if (process.platform === "darwin") {
+      // osascript is present on every mac; no dependency to install and nothing to keep running.
+      const esc = (s) => String(s).replace(/["\\]/g, "\\$&");
+      spawnSync("osascript", ["-e", `display notification "${esc(body)}" with title "${esc(title)}"`],
+        { timeout: 5000, stdio: "ignore" });
+    }
+  } catch {}
+}
+
 // The seat's own balance rows, for the #6131 read: a stalled turn that printed nothing on a seat
 // whose plan is spent is exhaustion, not a crash. Bounded and best-effort — a slow provider API
 // must never hold up the failure path, and an unreachable one just leaves the reason as it was.
@@ -546,6 +593,66 @@ async function reportHealthy() {
   cmuxStatus("ok", "#14b8a6", "check"); herdrAgent("idle");
 }
 
+// ---- Trantor State Phase 2a — the flagged path (TDD §4.1, §4.6, §7.3) -----------------------
+//
+// OFF BY DEFAULT, and off means the transcript path runs unchanged. Three things have to be true
+// before a single byte of this is reachable: the operator set TRANTOR_STATE_ASSEMBLE=1, the seat is
+// `claude` (§7.3 — it is the only row whose CLI can enforce the grammar), and the installed CLI
+// actually carries `--json-schema` (§6 — the minimum version is unconfirmed, so this PROBES rather
+// than assuming; no flag, no state mode, and the runner says so once).
+const STATE_FLAG_ON = process.env[STATE_ENV] === "1";
+const STATE_SCHEMA_FILE = join(homedir(), ".agent-bus", `state-schema-${AGENT}-${PROJ}.json`);
+const STATE_MODE = (() => {
+  if (!STATE_FLAG_ON) return false;
+  if (AGENT !== "claude") { log(`${STATE_ENV}=1 but this seat is '${AGENT}' — state mode is claude-only (TDD §7.3); staying on the transcript path`); return false; }
+  const probe = hasJsonSchemaFlag((bin, args) => spawnSync(bin, args, { encoding: "utf8", timeout: 20000 }));
+  if (!probe) { log(`\x1b[33m${STATE_ENV}=1 but this claude CLI has no --json-schema — state mode stays OFF (TDD §6)\x1b[0m`); return false; }
+  try {
+    mkdirSync(join(homedir(), ".agent-bus"), { recursive: true, mode: 0o700 });
+    writeFileSync(STATE_SCHEMA_FILE, JSON.stringify(TURN_RESULT_SCHEMA), { mode: 0o600 });
+  } catch (e) { log(`\x1b[33mstate mode OFF — could not write ${STATE_SCHEMA_FILE}: ${e.message}\x1b[0m`); return false; }
+  log(`\x1b[36mTrantor State: ASSEMBLE mode ON for this seat (schema ${STATE_SCHEMA_FILE})\x1b[0m`);
+  return true;
+})();
+
+// The PREAMBLE, and it is the whole cost claim in one constant: the bytes before STATE_DELIM must
+// be identical on every step or provider prefix caching never engages and the curve stays O(T).
+// So it is computed ONCE, from things that do not vary per turn — no clock, no turn number, no
+// wake text. Everything that changes rides in the state block, the card log, or the observation.
+const STATE_PREAMBLE = `You are running on Trantor State. Your working memory for this card is the STATE block below — it is carried for you, so you do not have to re-read the conversation or the worktree to know where you are.
+
+Answer with ONE JSON object matching the schema you were given: { "patch": Op[], "action": Action }.
+
+  { "set":    { "field": "task"|"notes"|"ext.<key>", "value": ... } }
+  { "add":    { "list": "done"|"in_flight"|"next"|"blockers", "item": { "id", "text", "paths"? } } }
+  { "remove": { "list": ..., "id": ... } }
+  { "move":   { "id": ..., "from": ..., "to": ... } }
+
+action is exactly one of { "done": true } (the card is finished), { "ask": "<question>" }, or { "continue": true } (you did real work this step and are not finished).
+
+Rules the harness enforces, so that you do not have to guess at them:
+  · verify, files, cursor, rev, card and the counters are HARNESS-WRITTEN. A patch touching them is rejected.
+  · An item may only reach "done" with evidence. Cite the files it rests on inline — "wire the promoter @lib/x.mjs,test/test-x.mjs" — and the harness runs the gate for you. A red gate hands you the failing assertion as your next observation; it does not mark your work done and it does not mark it failed.
+  · Do the actual work with your own tools during this step. The patch describes what you did; it is not a plan.
+
+${RULES}`;
+
+// The card log the state block is read against (§4.1's `tail`). One board read per step, the same
+// call hooks/lib/handoff.mjs already makes.
+async function cardTail(card) {
+  try {
+    const r = await api(`/tasks?project=${encodeURIComponent(PROJ)}`);
+    return renderCardTail(Array.isArray(r?.tasks) ? r.tasks : r, card);
+  } catch { return ""; }
+}
+
+// The patch-outcome ledger the breaker reads back. Kept in memory for this runner AND appended to
+// disk by the driver, because the breaker is a per-seat rolling window and a runner restart should
+// not hand a misbehaving seat a clean slate it did not earn.
+let patchLedger = [];
+let breakerTripped = false;
+let statePromotedHash;
+
 // ---- the time box (#6134) --------------------------------------------------------------------
 // A turn with no ceiling is how a seat spends an afternoon on one card: the 09-02 baseline was 151
 // turns and ~16 agentic hours across the fleet. TRANTOR_TURN_MAX_MS ends the CLI's process group
@@ -572,8 +679,12 @@ let WD_CHILD = null;
 function killWatchdog() { if (WD_CHILD) { try { WD_CHILD.kill("SIGTERM"); } catch {} WD_CHILD = null; } }
 process.on("exit", killWatchdog);
 
-async function runTurn(prompt, isFirst, trigger = "kickoff") {
+// #6969: `opts.state` is the ONLY way this function behaves differently, and it is set from one
+// place (stateTurn). With it unset every line below is the path that shipped before Phase 2a.
+let lastEnvelope = "";
+async function runTurn(prompt, isFirst, trigger = "kickoff", opts = {}) {
   TURN++; banner(trigger);
+  lastEnvelope = "";
   const t0 = Date.now();
   // A fresh session must not resume the old one's id: `first` is chosen by isFirst OR a missing
   // sid, so a stale sid would quietly resume the session this turn exists to leave behind.
@@ -592,8 +703,12 @@ async function runTurn(prompt, isFirst, trigger = "kickoff") {
   // #6154: a pinned seat with no sid yet resumes as FRESH — the guard below fails open, because
   // a resume without an id must fall back to a new session, never to `next`'s bare resume shape.
   let cmd = (isFirst || ((cli.sid || cli.pinned) && !sid)) ? cli.first : cli.next;
+  // The flagged row (TDD §4.6). `{S}` exists only in `stateNext`, so the replaceAll below is a
+  // no-op on every other path — which is what "flag off = byte-identical" has to mean.
+  if (opts.state && cli.stateNext) cmd = cli.stateNext;
   const mfrag = MODEL && cli.mflag ? `${cli.mflag}${MODEL}` : "";
-  cmd = cmd.replaceAll("{M}", mfrag).replaceAll("{P}", pf).replaceAll("{SID}", sid).replaceAll("{DIR}", TURN_DIR);
+  cmd = cmd.replaceAll("{M}", mfrag).replaceAll("{P}", pf).replaceAll("{SID}", sid).replaceAll("{DIR}", TURN_DIR)
+    .replaceAll("{S}", STATE_SCHEMA_FILE);
   // PRECEDENCE, and it is easy to get backwards — this is the second time.
   // Each file is PREPENDED, so the one prepended LAST runs FIRST, and in shell the file that runs
   // LAST wins. To make ~/.agent-bus/.env (the CREW layer) win it must be prepended FIRST, i.e.
@@ -623,7 +738,15 @@ async function runTurn(prompt, isFirst, trigger = "kickoff") {
   // topology is load-bearing (#5481): stdout+stderr must still BOTH land in ERRF, and the sid
   // path still folds stdout in via /dev/stderr → the --tee2 hop below.
   const SCRUB = `node ${join(import.meta.dirname, "..", "lib", "redact.mjs")}`;
-  const inner = cli.sid ? `${cmd} | tee /dev/stderr` : `${cmd} | ${SCRUB} --tee ${ERRF}`;
+  // §4.6 names a real cost of `--output-format json`: the seat's window would print a JSON blob
+  // instead of prose, and the operator watches that window. So on a state step stdout goes to a
+  // file and the runner prints the result line and the cost line itself. stderr still streams to
+  // the window through the process substitution below, unchanged.
+  const ENVF = join(homedir(), ".agent-bus", `envelope-${AGENT}-${PROJ}.json`);
+  if (opts.state) { try { unlinkSync(ENVF); } catch {} }
+  const inner = opts.state
+    ? `${cmd} > ${ENVF}`
+    : (cli.sid ? `${cmd} | tee /dev/stderr` : `${cmd} | ${SCRUB} --tee ${ERRF}`);
   // #5684: runTurn is spawnSync, so the runner cannot watch its own turn — a DETACHED watchdog
   // does. Armed by a stamp file, disarmed when the turn ends (stamp removed below); a turn past
   // the window with no activity (transcript, worktree, or stderr — #6206: stdout silence alone
@@ -754,6 +877,12 @@ exit $turn_exit`;
   let ownOut = "";
   try { ownOut = stripPromptEcho(readFileSync(ERRF, "utf8"), readPromptText(pf)); } catch { ownOut = ""; }
   lastErrText = ownOut.slice(-4000);
+  if (opts.state) {
+    try { lastEnvelope = redactKeys(readFileSync(ENVF, "utf8")); } catch { lastEnvelope = ""; }
+    const env = parseEnvelope(lastEnvelope);
+    if (env.turn) log(`state step: ${describeTurn(env.turn)} · ${costLine(env.cost)}`);
+    else log(`\x1b[33mstate step: no TurnResult — ${env.error}\x1b[0m`);
+  }
   if (cli.sid && r.stdout) { const m = r.stdout.match(cli.sid); if (m) sid = m[1]; }
   // #6154: the opencode family prints no sid on stdout — the id comes from opencode's own DB,
   // keyed by the worktree the session was created in. Fail-open: nothing found leaves sid empty,
@@ -787,7 +916,10 @@ exit $turn_exit`;
   // never fired — the tee topology is the load-bearing fact; keep this comment with it.)
   // The judgment now runs on the ECHO-STRIPPED text (#5868): a CLI that replays the prompt but
   // does no work has still produced nothing of its own.
-  if (realExit === 0 && effExit === 0 && !lastErrText.trim()) {
+  // #6969: on a state step the CLI's whole answer is the envelope, so ERRF holds only stderr and
+  // silence there is the NORMAL shape of a healthy turn. Judging it "empty-output" would park a
+  // working seat on its first clean state step.
+  if (realExit === 0 && effExit === 0 && !lastErrText.trim() && !lastEnvelope.trim()) {
     effExit = 1;
     lastEmptyOutput = true;
     log("\x1b[31mexit 0 but the turn produced NO output — treating as FAILED (empty-output)\x1b[0m");
@@ -797,7 +929,13 @@ exit $turn_exit`;
   const verdict = verdictFor(realExit, effExit, lastEmptyOutput, ownOut);
   // #6134: what the turn COST, from the CLI's own usage line. Zero means this CLI printed none —
   // never that the turn was free. `trantor seat-why` totals these into today's spend per seat.
-  const tokens = parseTurnTokens(ownOut);
+  let tokens = parseTurnTokens(ownOut);
+  if (opts.state && lastEnvelope) {
+    const c = parseEnvelope(lastEnvelope).cost;
+    // 0 means "this CLI printed no usage", never "free" — so only overwrite when the envelope
+    // actually carried counts.
+    if (c) tokens = c.input + c.output + c.cache_read + c.cache_creation;
+  }
   // #6289: every ledger row names in ONE field what happened to the turn — cut (the box ended it),
   // api-error (the CLI failed), completed — and what it cost in tokens, even when this CLI printed
   // no usage line (0 means "not reported", never "free"). `cut` stays too: the drills read it.
@@ -813,7 +951,12 @@ exit $turn_exit`;
   // The follow-up rides the SAME session, so the model still has the turn it was cut out of and
   // only has to land it. Exactly one — a follow-up that runs long is itself boxed, and boxing a
   // boxed turn forever is the loop this card exists to end.
-  if (cut && !inFollowUp) {
+  // A state step gets no prose follow-up: TIME_BOX_PROMPT is not a TurnResult prompt, and feeding
+  // it would break the byte-identical prefix the cost claim rests on. It is also unnecessary —
+  // §4.4 is explicit that a cut turn has never partially applied a patch, so what was lost is the
+  // dead turn's observations, and store.recover() rebuilds those from git on the next readState.
+  // The step is recorded with `cut: true` so §8.7 can still count it.
+  if (cut && !inFollowUp && !opts.state) {
     inFollowUp = true;
     try { return await runTurn(TIME_BOX_PROMPT, false, "time-box follow-up"); }
     finally { inFollowUp = false; }
@@ -821,6 +964,70 @@ exit $turn_exit`;
   return effExit;
 }
 
+// What the NEXT state step opens with when the last one was rejected (§4.8: the seat's next step
+// begins with the actual failing assertion). Cleared on every accepted patch.
+let stateObservation = "";
+
+// ---- Phase 2a: one state step, driven by lib/state/driver.mjs -------------------------------
+//
+// The runner's whole job here is transport and side effects: it hands the driver a way to run the
+// CLI and a way to act on the returned action, and the driver holds the §4.1 order. Returns an
+// exit code so deliverWake's success/failure ladder is untouched.
+async function stateTurn({ card, observation, trigger, assigners = [] }) {
+  const tail = await cardTail(card);
+  const r = await runStep({
+    seat: SESSION, card, project: PROJ, cwd: TURN_DIR,
+    preamble: STATE_PREAMBLE, tail, observation,
+    promoted: statePromotedHash,
+    now: Date.now(),
+    deps: {
+      callCli: async (prompt) => {
+        // isFirst=true every step ON PURPOSE: a state step carries no `-c`, so there is no session
+        // to resume and a stale sid must never be handed to one.
+        const exit = await runTurn(prompt, true, trigger, { state: true });
+        return { exit, stdout: lastEnvelope, cut: lastTurnCut };
+      },
+      executeAction: async (action) => {
+        // `ask` is the one action with an outside effect. State does NOT move cards (§4.7) — the
+        // seat calls relay_task_move itself — so `done` and `continue` are recorded and nothing else.
+        const ask = String(action?.ask ?? "").trim();
+        if (ask) await notifyAssigners(assigners, `❓ ${SESSION} asks on #${card}: ${ask}`);
+      },
+    },
+  });
+
+  statePromotedHash = r.promoted;
+  if (r.patchRecord) patchLedger.push(r.patchRecord);
+
+  // §7.3's breaker: a seat whose rolling MALFORMED rate is over budget goes back to the transcript
+  // path, and the room is told ONCE. Never repeated — a warning repeated every turn is the thing
+  // the monitoring doctrine calls noise, and the condition is a state, not an event.
+  if (!breakerTripped) {
+    const v = breakerVerdict(patchLedger, SESSION, { window: BREAKER_WINDOW });
+    if (v.tripped) {
+      breakerTripped = true;
+      log(`\x1b[31mstate-mode CIRCUIT BREAKER tripped — ${v.message}; falling back to the transcript path\x1b[0m`);
+      await api("/send", {
+        from: SESSION, to: "all", project: PROJ, kind: "status",
+        text: `⚠️ ${SESSION} left Trantor State: ${v.message} (TDD §7.3 breaker) — back on the transcript path`,
+      }).catch(() => {});
+    }
+  }
+
+  if (!r.ok) {
+    // A rejection is NOT a failed turn. The patch was refused, the state is untouched, and the
+    // rejection is the next step's observation — which is the loop working, not the seat dying.
+    // Only the transport's own exit decides the runner's ladder, and a rejected patch on an exit-0
+    // CLI is an exit-0 turn.
+    log(`state step rejected (${r.code}): ${String(r.message).slice(0, 200)}`);
+    stateObservation = r.observation;
+    return r.step && r.step.exit ? r.step.exit : 0;
+  }
+  stateObservation = "";
+  return 0;
+}
+
+
 // ---- main loop ----
 const KICKOFF = process.env.CREW_KICKOFF ||
   `You just joined (your arrival was already announced on the bus). 1) relay_inbox — if a contract for you is already waiting, do it now per the Rules. 2) End your turn.\n\n${RULES}`;
@@ -887,7 +1094,24 @@ function isRunnerSession(session) {
   return /^[a-z0-9_.-]+$/.test(label) && !label.startsWith("hub:");
 }
 
+// A hub staleness alert describes a condition that was true for a moment: "#16909 has been
+// UNDELIVERED for 2m — go nudge someone". Acting on it 22 hours later is meaningless, and the queue
+// had no expiry, so on 2026-09-09 the duty seat's backlog became SELF-POISONING: the hub kept
+// noticing undelivered mail and sending more alerts, duty could not work them off, and a restart
+// faithfully redelivered 49 dead nudges and re-wedged the seat. 46 of those 49 were hub alerts, the
+// oldest 22.1 hours old, every one describing a two-minute condition.
+//
+// So these EXPIRE. Deliberately narrow: only messages the HUB generated about staleness, never a
+// message from a peer. A real contract is never dropped for being old — a seat that misses a
+// teammate's request is the failure this bus exists to prevent, and no backlog is worth causing it.
+const HUB_ALERT_TTL_MS = Number(process.env.TRANTOR_HUB_ALERT_TTL_MS || 30 * 60_000);
+const isExpiredHubAlert = (m) =>
+  m?.from === "hub:duty" &&
+  Number.isFinite(m?.ts) &&
+  Date.now() - m.ts > HUB_ALERT_TTL_MS;
+
 function shouldWake(message) {
+  if (isExpiredHubAlert(message)) return false;
   if (isReceipt(message) || isStatusBroadcast(message)) return false;
   // #6134: the SENDER decides. `wake:false` says "this is context, not a contract" — it batches
   // into the next turn's prompt like a broadcast and never buys a CLI session of its own.
@@ -957,8 +1181,22 @@ function askedExcerpt(message) {
   // broadcasts batched behind them. Restored from disk first: a runner that was killed mid-turn
   // (or a machine that rebooted) still owes those messages, and the hub will never send them again.
   const restored = loadPending();
+  // Say what the restore SHED, not just what it kept. A queue that quietly halves itself on restart
+  // is indistinguishable from one that lost real work, and this is the moment the expiry above
+  // actually bites — a wedged seat comes back carrying only what still means something.
+  const shed = restored.wake.filter(isExpiredHubAlert).length +
+               restored.bcast.filter(isExpiredHubAlert).length;
   let pendingWake = restored.wake.filter(shouldWake);
-  let pendingBcast = restored.bcast.filter(m => !isReceipt(m) && !isStatusBroadcast(m));
+  let pendingBcast = restored.bcast.filter(m => !isExpiredHubAlert(m) && !isReceipt(m) && !isStatusBroadcast(m));
+  if (shed) {
+    log(`\x1b[33mdropped ${shed} expired hub staleness alert(s) older than ${Math.round(HUB_ALERT_TTL_MS / 60000)}m — they describe conditions that have long since changed\x1b[0m`);
+    // Write the shed queue back NOW rather than waiting for the next failed delivery to persist it.
+    // Caught live on 2026-09-09: after a restart shed 3 of 4, `trantor duty status` still reported
+    // 4 held, because status reads the FILE and the file was still the pre-shed one. Disk and memory
+    // disagreeing is the whole class of bug this day was about — a health check cannot be honest if
+    // the state it reads is stale.
+    savePending(pendingWake, pendingBcast);
+  }
   let retryAt = 0;            // 0 = deliver at the next opportunity
   let deliveryFails = 0;      // consecutive failed attempts at the SAME pending batch
   if (pendingWake.length) log(`\x1b[33m${pendingWake.length} message(s) survived from a previous run — redelivering\x1b[0m`);
@@ -1073,6 +1311,17 @@ function askedExcerpt(message) {
         messages: wake,
         statePath: DUTY_NUDGE_STATE,
         owner: `${RUNNER_ID}:${TURN + 1}`,
+        // Has the recipient already read it? /peer — SINGULAR — is the only endpoint that serialises
+        // deliveredUpTo (/peers does not, a gap that already cost one wrong diagnosis today). The
+        // cursor is monotonic, so `>= id` means the message was handed over and there is nothing to
+        // nudge about. Best-effort by design: any failure here leaves the nudge standing, because a
+        // missed nudge is worse than a redundant one.
+        isDelivered: async ({ id, recipient }) => {
+          if (!recipient || !/^\d+$/.test(String(id))) return false;
+          const r = await api(`/peer?session=${encodeURIComponent(recipient)}`).catch(() => null);
+          const upTo = Number(r?.deliveredUpTo || 0);
+          return upTo > 0 && upTo >= Number(id);
+        },
       })
       : { items: [], targets: [], owner: "" };
     const claimedIds = new Set(dutyPlan.items.map(item => item.id));
@@ -1126,7 +1375,19 @@ function askedExcerpt(message) {
     });
     const stopDutyNudgeWatcher = startDutyNudgeWatcher(dutyPlan, tStart);
     let ec;
-    try { ec = await runTurn(prompt, fresh, deliveryFails ? `${trigger} (redelivery)` : trigger); }
+    const stateStep = STATE_MODE && !breakerTripped && card > 0;
+    try {
+      ec = stateStep
+        ? await stateTurn({
+          card, trigger: deliveryFails ? `${trigger} (redelivery)` : trigger, assigners,
+          // The observation is everything that CHANGED since the last step — the wake, the
+          // broadcasts, the redelivery note, and any rejection the last step earned. None of it
+          // may reach the preamble, or the prefix stops being byte-identical and the cache claim
+          // dies quietly (§4.6).
+          observation: [stateObservation, wakeText, ctxText, againText + freshText].filter(Boolean).join("\n"),
+        })
+        : await runTurn(prompt, fresh, deliveryFails ? `${trigger} (redelivery)` : trigger);
+    }
     finally { stopDutyNudgeWatcher(); }
     const secs = Math.round((Date.now() - tStart) / 1000);
     let skippedNudges = [];
@@ -1183,6 +1444,21 @@ function askedExcerpt(message) {
       const parkReason = PARKING_REASONS.has(reason) ? reason : (lastTurnCut ? "time-box" : "api-error");
       if (PARKING_REASONS.has(reason) || deliveryFails >= 2) {
         retryAt = await parkSeat(parkReason, pendingWake.length, quotaReset);
+        // A supervised seat does not have to sit parked until someone notices. RUNNER_PARK_MAX_MS
+        // is set only by `trantor duty up`, which runs the seat under a launchd keepalive: past the
+        // ceiling, exit and let the supervisor restart it clean — a fresh process re-reads auth and
+        // redelivers the queue from disk, which is exactly what un-wedged the 2026-09-09 incident
+        // when the operator finally ran `trantor duty up` by hand 21.9 hours late.
+        // Unsupervised seats keep the old behaviour: exiting would just kill them for good.
+        const parkMax = Number(process.env.RUNNER_PARK_MAX_MS || 0);
+        if (parkMax > 0) {
+          const wakeIn = Math.max(0, Math.min(retryAt - Date.now(), parkMax));
+          log(`\x1b[33msupervised seat: exiting in ${Math.round(wakeIn / 1000)}s so the keepalive restarts it clean\x1b[0m`);
+          setTimeout(() => {
+            log("parked past the ceiling — exiting for the keepalive to relaunch");
+            process.exit(0);   // 0, not 1: this is a deliberate hand-off, not a crash
+          }, wakeIn).unref?.();
+        }
         await notifyAssigners(assigners,
           `⛔ your contract is PARKED on ${SESSION} (${parkReason}) — not retrying · asked: "${asked}"`);
         lastTurnAt = Date.now();

package/bin/doctor.mjs

@@ -3,7 +3,7 @@
 // Checks: runtime, hub, plugin, each CLI (installed? wired? AUTHENTICATED?), API keys,
 // quota profile, optional Scrooge brain. Prints a checklist with copy-paste fixes.
 //   node bin/doctor.mjs
-import { readFileSync, existsSync } from "node:fs";
+import { readFileSync, readdirSync, existsSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { homedir } from "node:os";
 import { execSync } from "node:child_process";
@@ -304,6 +304,66 @@ prof?.providers && Object.keys(prof.providers).length
   ? ok(`quota profile set (${Object.entries(prof.providers).map(([k, v]) => `${k}=${v.plan}`).join(", ")})`)
   : warn("quota profile not set — the Advisor will assume API billing everywhere", `node ${join(ROOT, "bin", "profile.mjs")} set claude=max codex=plus deepseek=api …  (use YOUR real plans)`);
 
+// fleet — is the crew actually OPERATING, not just installed?
+//
+// Added 2026-09-09, because on that morning this command reported nine issues, every one about
+// provider keys and billing attribution, while the duty seat had been holding 48 undelivered
+// messages for 21.9 hours and the orchestrator had slept through a night of finished crew work.
+// Doctor checked whether credentials EXIST. Nothing checked whether the fleet was MOVING. These
+// two signals are both already on disk, written by the runner itself — nobody was reading them.
+section("the fleet (is it actually running?)");
+{
+  const busDir = join(H, ".agent-bus");
+  // 1. Undelivered queues. crew-runner persists pending-<agent>-<project>.json on every failed
+  //    delivery and unlinks it when the queue drains, so a file with an old head means mail is
+  //    stuck for that seat — whatever its process table says.
+  let stuck = 0;
+  const abandonedSeats = [];
+  try {
+    for (const f of readdirSync(busDir).filter(n => n.startsWith("pending-") && n.endsWith(".json"))) {
+      const j = read(join(busDir, f));
+      const held = [...(j?.wake || []), ...(j?.bcast || [])];
+      if (!held.length) continue;
+      const stamps = held.map(m => m?.ts).filter(Number.isFinite);
+      const oldest = stamps.length ? Math.min(...stamps) : j?.ts;
+      const hours = (Date.now() - oldest) / 3.6e6;
+      const seat = f.replace(/^pending-|\.json$/g, "");
+      // Three bands, because one flat warning per stuck queue is its own failure: this machine has
+      // leftovers from projects that ended weeks ago, and a doctor that cries about ten of them
+      // every run teaches you to skim past the one that matters. Under an hour is the retry ladder
+      // doing its job. Over a week is an abandoned seat, worth tidying, not worth alarming about.
+      // The band between is the live stall — the shape of the 2026-09-09 incident.
+      const abandoned = hours >= 24 * 7;
+      if (hours >= 1 && !abandoned) {
+        stuck++;
+        warn(`${seat}: ${held.length} message(s) undelivered, oldest ${hours.toFixed(1)}h old — mail is not moving`,
+          `the runner parks on quota/api failure and only a restart un-parks it: trantor up ${seat.split("-")[0]}   (duty: trantor duty up)`);
+      } else if (abandoned) {
+        abandonedSeats.push(`${seat} (${(hours / 24).toFixed(0)}d)`);
+      } else {
+        note(`${seat}: ${held.length} queued, oldest ${hours.toFixed(1)}h — within the retry ladder`);
+      }
+    }
+    if (abandonedSeats.length) {
+      note(`${abandonedSeats.length} abandoned queue(s) older than a week: ${abandonedSeats.join(", ")} — leftovers from finished work, safe to delete`);
+    }
+    if (!stuck) ok("no live seat is sitting on undelivered mail");
+  } catch { note(`no bus directory at ${busDir} yet — nothing has run`); }
+
+  // 2. Park alerts. notifyOperator appends one line per park, so a park that happened while nobody
+  //    was at the machine is still visible here afterwards — the point of writing it to disk.
+  try {
+    const alerts = readFileSync(join(busDir, "alerts.jsonl"), "utf8").trim().split("\n").filter(Boolean);
+    const recent = alerts.map(l => { try { return JSON.parse(l); } catch { return null; } })
+      .filter(a => a && Date.now() - a.ts < 24 * 3.6e6);
+    if (recent.length) {
+      const last = recent[recent.length - 1];
+      warn(`${recent.length} seat park alert(s) in the last 24h — most recent: ${last.title}`,
+        `read them: tail ~/.agent-bus/alerts.jsonl   — then restart the seat named above`);
+    } else ok("no seat has parked in the last 24h");
+  } catch { ok("no seat has parked in the last 24h"); }
+}
+
 say(issues ? `\n${issues} issue(s) — fix the → lines above, then re-run the doctor.` : "\nAll clear — open a claude session in any project and say: \"fire up the crew\".");
 // Must come BEFORE the exit — process.exit() here truncated the report entirely.
 if (JSON_MODE) console.log(JSON.stringify({ ...REPORT, issueCount: issues }));

package/bin/drill-surface.mjs

@@ -35,6 +35,9 @@ export const CARD_STEPS = {
   6668: { steps: ["S6-handoff"], autoClose: true },
   6317: { steps: ["S6-key-post", "S6-key-throw"], autoClose: false, recipe: "covered by in-app Drill Mode: open a real Workspace with a live terminal pane and exercise key dispatch in the terminal and composer" },
   6667: { steps: ["S4b", "S7"], autoClose: true },
+  // P9 (#6965): the Phase-1 handoff carries a WorkingState and it carries NO credit. Never
+  // auto-closes — with the flag off the step SKIPs, and a skip must not be mistaken for proof.
+  6965: { steps: ["S4c"], autoClose: false, recipe: "set TRANTOR_STATE_HANDOFF=1 on a dogfood card, run `trantor drill`, and read S4c: the carried state must show 0 credited paths" },
   6587: { steps: ["S8"], autoClose: false, recipe: "needs live duty probe: operator removes the trantor/trantor-duty link, DMs the idle orchestrator, and checks for a socket nudge within 3 minutes" },
   6481: { steps: ["S9"], autoClose: true },
   6483: { steps: ["S10"], autoClose: false, recipe: "covered by in-app Drill Mode (#6800): operator checks Accounts with the CLI below the app minimum, then restores the CLI" },
@@ -346,6 +349,50 @@ step("S4 · handoff machine: warn → arm → fire → WRITTEN → successor cla
     }, { timeoutMs: 120_000, everyMs: 2_000 });
     if (recapped) PASS("first Stop recorded RECAPPED and cleared the net", recapped.states.map(s => s.state).join("→"));
     else FAIL("first Stop recorded RECAPPED and cleared the net", stamp() ? "stamp still present" : "no recapped state");
+
+    // ---------- S4c · the handoff carries a WorkingState, and it carries NO CREDIT ----------
+    // Rides S4's machine deliberately: the record above is a REAL handoff, written by the real Stop
+    // path and claimed by a real successor. Everything else about Phase 1 is proven against
+    // fixtures, and today taught us what that gap costs — a defect that survived two review rounds,
+    // five reviewers and 264 assertions was found only when something finally ran the live path.
+    //
+    // The load-bearing assertion is the second one. A derived state carries NO credit, because no
+    // gate ran: every path must be verified:false, so the successor has to re-earn its evidence
+    // before anything moves to done. If that ever came back true, the handoff path would be a
+    // laundering route for unverified work — a hole in the verified-done rule shaped exactly like a
+    // session boundary. P4's unit tests hold the same property (flipping it kills 4 assertions);
+    // this is that property on a real record.
+    //
+    // Flag OFF is the norm today, and then the correct outcome is a SKIP: the state block must be
+    // absent and the prose path untouched. A step that only passes with the feature on would go red
+    // for everyone until it ships, and a red nobody can act on is noise.
+    const carried = (() => {
+      try { return JSON.parse(readFileSync(handoffFile, "utf8")).state ?? null; }
+      catch { return null; }
+    })();
+    if (!carried) {
+      SKIP("S4c · handoff carries WorkingState",
+        "TRANTOR_STATE_HANDOFF is off — no state block on the record, and the prose path is unchanged. Turn the flag on for a dogfood card to exercise this.");
+    } else {
+      // oxlint-disable-next-line anti-slop/no-runtime-typeof -- SAFETY: `carried` is JSON.parse of a handoff record read off disk — an untrusted I/O boundary, and this is its decode. A record written by an older schema, or a truncated write, can put anything in `files`; Object.keys on a non-object would throw and turn a real drill run into a crash rather than a verdict.
+      const files = (carried.files && typeof carried.files === "object") ? carried.files : {};
+      const paths = Object.keys(files);
+      const credited = paths.filter(p => files[p]?.verified === true);
+      if (credited.length === 0) {
+        PASS("S4c · the carried state grants NO credit (every path verified:false)",
+          `${paths.length} path(s), 0 credited`);
+      } else {
+        FAIL("S4c · the carried state grants NO credit (every path verified:false)",
+          `CREDITED: ${credited.join(", ")} — the handoff is laundering unverified work`);
+      }
+      // verify is a harness field; a derived state must not arrive claiming a gate ran either.
+      const v = carried.verify || {};
+      if (v.tested === true) FAIL("S4c · the carried state claims no gate ran", `verify.tested=true cmd=${v.cmd || "?"}`);
+      else PASS("S4c · the carried state claims no gate ran", `verify.tested=${v.tested ?? "absent"}`);
+
+      if (carried.schema_version) PASS("S4c · the carried state is schema-stamped", `v${carried.schema_version}`);
+      else FAIL("S4c · the carried state is schema-stamped", "no schema_version on the record");
+    }
   }
 }