trantor 0.18.52 → 0.18.53

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.52",
+  "version": "0.18.53",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/crew/core.mjs

@@ -132,8 +132,21 @@ export function gridColumns(size) {
   return columns;
 }
 
+// Operator flags the RUNNER itself reads, forwarded from whoever launched the seat.
+//
+// The Trantor State flags are read as `process.env` INSIDE crew-runner.mjs, not by the CLI it
+// spawns — so ~/.agent-bus/.env (the crew key layer) cannot set them: that file is applied to the
+// spawned command, one level too deep. Without this list the flags documented in TDD §11 have no
+// supported way to reach a seat at all, which is how Phase 2a came to be "enabled" with a schema
+// file that was never written and a runner still on the transcript path.
+const FORWARDED_ENV = ["TRANTOR_STATE", "TRANTOR_STATE_ASSEMBLE", "TRANTOR_STATE_HANDOFF", "TRANTOR_STATE_GATE"];
+
 export function runnerCommand(ctx, agent, model = "") {
-  return `cd ${shellQuote(ctx.dir)} && CREW_MODEL=${shellQuote(model)} RELAY_PROJECT=${shellQuote(ctx.project)} RELAY_URL=${shellQuote(ctx.hub)} node ${shellQuote(join(ROOT, "bin/crew-runner.mjs"))} ${shellQuote(agent)} ${shellQuote(ctx.dir)}`;
+  const forwarded = FORWARDED_ENV
+    .filter((name) => process.env[name])
+    .map((name) => `${name}=${shellQuote(process.env[name])} `)
+    .join("");
+  return `cd ${shellQuote(ctx.dir)} && ${forwarded}CREW_MODEL=${shellQuote(model)} RELAY_PROJECT=${shellQuote(ctx.project)} RELAY_URL=${shellQuote(ctx.hub)} node ${shellQuote(join(ROOT, "bin/crew-runner.mjs"))} ${shellQuote(agent)} ${shellQuote(ctx.dir)}`;
 }
 
 export function listPids(pattern) {

package/bin/crew-runner.mjs

@@ -24,8 +24,8 @@ import {
 } from "../lib/classify-failure.mjs";
 import { capWake, capBcast, pickLessons, composePrompt } from "./crew-payload.mjs";
 import {
-  cardRef, carriesWork, parseTurnTokens, parseResetAt, reasonWithBalances, quotaResetAt, PARKING_REASONS,
-  senderProjectOf, isLinkedProject,
+  cardRefs, wakeCard, carriesWork, parseTurnTokens, parseResetAt, reasonWithBalances, quotaResetAt, PARKING_REASONS,
+  senderProjectOf, isLinkedProject, stateSkipReason,
 } from "../lib/turn-policy.mjs";
 import {
   auditDutyNudges, claimDutyNudges, claudeTranscriptDir, dutyEscalations, dutyNudgeDirective,
@@ -611,10 +611,33 @@ const STATE_MODE = (() => {
     mkdirSync(join(homedir(), ".agent-bus"), { recursive: true, mode: 0o700 });
     writeFileSync(STATE_SCHEMA_FILE, JSON.stringify(TURN_RESULT_SCHEMA), { mode: 0o600 });
   } catch (e) { log(`\x1b[33mstate mode OFF — could not write ${STATE_SCHEMA_FILE}: ${e.message}\x1b[0m`); return false; }
-  log(`\x1b[36mTrantor State: ASSEMBLE mode ON for this seat (schema ${STATE_SCHEMA_FILE})\x1b[0m`);
+  // #7060: this line used to read "ASSEMBLE mode ON for this seat", which is a claim about the
+  // PROMPT that nothing here established. What the four checks above prove is CONFIGURATION, and
+  // the two come apart on the literal next turn: the kickoff runs before any message exists, so it
+  // belongs to no card and cannot be a state step. So say what was proved — armed — and name the
+  // one thing that engages it. Each turn then reports which path it actually took.
+  log(`\x1b[36mTrantor State: ASSEMBLE armed for this seat (schema ${STATE_SCHEMA_FILE})\x1b[0m`);
+  log(`\x1b[36m  a turn is assembled only when a wake ASSIGNS it a card — the kickoff and every pulse run the transcript path, and each turn says which one it took\x1b[0m`);
   return true;
 })();
 
+// #7060: the one place a turn decides whether it is a state step, and the one place a skip is
+// spoken. Returns the reason the turn is NOT assembled (already logged), or null when it is — so
+// the runner reads `if (!stateSkip(...))` and cannot drift from what the operator was just told.
+//
+// It speaks on CHANGE, not on repetition. A pulse fires on a timer and skips for the same reason
+// every time; printing that line forever is the repetition the monitoring doctrine rules out, and
+// it would bury the turn where the path actually flipped. Assembling a turn clears the memory, so
+// the next skip after real work always speaks. Silent when state mode is off: the IIFE above
+// already said why, once, and a transcript seat has no claim here to mistake for proof.
+let spokenStateSkip = null;
+const stateSkip = (kind, card = 0) => {
+  const why = stateSkipReason({ mode: STATE_MODE, kind, breakerTripped, card });
+  if (STATE_MODE && why && why !== spokenStateSkip) log(`\x1b[33mTrantor State: this turn is NOT assembled — ${why}\x1b[0m`);
+  spokenStateSkip = why;
+  return why;
+};
+
 // The PREAMBLE, and it is the whole cost claim in one constant: the bytes before STATE_DELIM must
 // be identical on every step or provider prefix caching never engages and the curve stays O(T).
 // So it is computed ONCE, from things that do not vary per turn — no clock, no turn number, no
@@ -1201,6 +1224,9 @@ function askedExcerpt(message) {
   let deliveryFails = 0;      // consecutive failed attempts at the SAME pending batch
   if (pendingWake.length) log(`\x1b[33m${pendingWake.length} message(s) survived from a previous run — redelivering\x1b[0m`);
 
+  // #7060: the turn the boot line was read as a promise about. It is a transcript turn by
+  // construction and now says so, in the same breath as the line that armed the mode.
+  stateSkip("kickoff");
   const ec0 = await runTurn(composedTurn({ base: KICKOFF, lessons: pickLessons(LESSONS_RAW, "") }), true, "kickoff");
   if (ec0) await reportFailure(ec0, "kickoff", pendingWake.length);   // a failed kickoff = the "fired up, died, nobody knew" case
   let lastTurnAt = Date.now();
@@ -1211,6 +1237,7 @@ function askedExcerpt(message) {
     // pulse first: a due mission beat runs even on a silent bus. Measured from the END of the
     // last turn, so a long turn doesn't stack an immediate pulse on top of itself.
     if (PULSE_MS && Date.now() - lastTurnAt >= PULSE_MS) {
+      stateSkip("pulse");
       const ecp = await runTurn(composedTurn({ base: PULSE_PROMPT + "\n\n", rulesText: RULES, lessons: pickLessons(LESSONS_RAW, PULSE_PROMPT) }), false, "pulse");
       if (ecp) await reportFailure(ecp, "pulse"); else await reportHealthy();
       lastTurnAt = Date.now();
@@ -1362,12 +1389,20 @@ function askedExcerpt(message) {
     // into every later turn — qwen's 85.7M tokens were 96.7% cached, i.e. replayed history. The
     // card that moved this wake decides: a different one starts a fresh CLI session, and the seat
     // is told so, because a fresh session remembers nothing and must be sent to its card.
-    const card = wakeForTurn.map(m => cardRef(m.text)).find(Boolean) || 0;
+    // #7061: bound by SHAPE, not by position. `cardRef` alone took the earliest id in the wake
+    // TEXT, and an order that opens with what shipped ("#7037 is merged as a01f629 … YOUR CARD:
+    // #6983") binds the turn — its state sidecar, its card log, its run record — to a done card.
+    const card = wakeCard(wakeForTurn, { session: SESSION });
     const fresh = card > 0 && card !== sessionCard;
     if (card) sessionCard = card;
+    const cited = [...new Set(wakeForTurn.flatMap(m => cardRefs(m.text)))];
     const freshText = fresh
       ? `\n(FRESH SESSION for card #${card} — you are not the session that worked earlier cards and you remember none of them. Read your card first: relay_board with card:${card}.)\n`
-      : "";
+      // A wake naming several cards used to leave the seat guessing which one the machine believed
+      // — the prompt named two and committed to neither. Say it, even when the session continues.
+      : (card && cited.length > 1
+        ? `\n(This turn is card #${card} — the wake cites ${cited.length} cards; the rest are context.)\n`
+        : "");
     const prompt = composedTurn({
       wakeText, ctxText, againText: againText + freshText + dutyNudgeDirective(dutyPlan),
       tailText: "\nAct on what's addressed to you, then end your turn.\n\n",
@@ -1375,7 +1410,7 @@ function askedExcerpt(message) {
     });
     const stopDutyNudgeWatcher = startDutyNudgeWatcher(dutyPlan, tStart);
     let ec;
-    const stateStep = STATE_MODE && !breakerTripped && card > 0;
+    const stateStep = !stateSkip("wake", card);
     try {
       ec = stateStep
         ? await stateTurn({

package/bin/state-bench.mjs

@@ -206,6 +206,15 @@ function isToolResult(row) {
   return c.some(part => part && typeof part === "object" && part.type === "tool_result");
 }
 
+/** The rows a MEASUREMENT gate may read: every row except one the time box cut short (#7135).
+ *  A cut row is honest — recordStep keeps its absent cost null and its cache_read 0 — and §8.7
+ *  needs it to find the cut, but it measured nothing: its 0 is not a cache miss and its null is
+ *  not a price. Gates 3, 4 and 5 filter through here so one boxed turn neither reads as preamble
+ *  drift nor voids a whole run's cost basis; §8.6 and §8.7 keep the full record. */
+export function measurableSteps(steps) {
+  return (Array.isArray(steps) ? steps : []).filter(s => s?.cut !== true);
+}
+
 /** Sum rows into the totals the ratio is computed from. `cost_usd` stays null unless EVERY row
  *  carried one: a partial sum compared against a full one is a fake ratio. */
 export function totals(rows) {
@@ -299,22 +308,25 @@ export function baselineMarkdown({ project, card, transcript, rows, capturedAt,
  * assembled preamble drifted between turns, prefix caching never engaged, and the cost claim is
  * void even when the totals happen to look fine — which they can, on a short run, for entirely
  * unrelated reasons. The first step is exempt because there is nothing before it to have cached.
+ * Cut rows are excluded before any of this (measurableSteps): a boxed turn's cache_read 0 is an
+ * absence of measurement, not a miss.
  */
 export function checkCache(steps) {
-  if (!Array.isArray(steps) || steps.length < 2) {
-    return { ok: false, code: "TOO_FEW_STEPS", checked: steps?.length ?? 0, violations: [], message: "fewer than two steps: the cache property has no second turn to hold on and was not observed" };
+  const rows = measurableSteps(steps);
+  if (rows.length < 2) {
+    return { ok: false, code: "TOO_FEW_STEPS", checked: rows.length, violations: [], message: "fewer than two steps: the cache property has no second turn to hold on and was not observed" };
   }
   const violations = [];
-  for (let i = 1; i < steps.length; i++) {
-    const read = tokens(steps[i].cache_read);
-    if (read <= 0) violations.push({ turn: steps[i].turn ?? i + 1, cache_read: read });
+  for (let i = 1; i < rows.length; i++) {
+    const read = tokens(rows[i].cache_read);
+    if (read <= 0) violations.push({ turn: rows[i].turn ?? i + 1, cache_read: read });
   }
   return {
     ok: violations.length === 0, code: violations.length ? "CACHE_MISS" : null,
-    checked: steps.length - 1, violations,
+    checked: rows.length - 1, violations,
     message: violations.length
-      ? `${violations.length} of ${steps.length - 1} steps read 0 cached tokens — the preamble drifted, prefix caching never engaged, and the ≥${COST_FACTOR}× claim is VOID regardless of the totals`
-      : `all ${steps.length - 1} steps after the first read cached prefix tokens`,
+      ? `${violations.length} of ${rows.length - 1} steps read 0 cached tokens — the preamble drifted, prefix caching never engaged, and the ≥${COST_FACTOR}× claim is VOID regardless of the totals`
+      : `all ${rows.length - 1} steps after the first read cached prefix tokens`,
   };
 }
 
@@ -327,11 +339,16 @@ export function checkCache(steps) {
  * problem worth knowing about; a bench that only knows how to agree is not a gate. When no row
  * carries a price the ratio is computed on total tokens and says so in `basis`, because tokens are
  * a real measurement and a price derived from a rate card we did not record is not.
+ *
+ * Cut rows are excluded first (measurableSteps): one boxed turn's null price used to void
+ * `cost_usd` for the ENTIRE run through totals(), silently downgrading a measured-dollar result
+ * to an estimate — the unfalsifiability the PRD forbids (#7135).
  */
 export function costGate(steps, baselineRows, opts = {}) {
   const factor = opts.factor ?? COST_FACTOR;
   const minTurns = opts.minTurns ?? MIN_TURNS;
-  const run = totals(steps || []);
+  const measured = measurableSteps(steps);
+  const run = totals(measured);
   const base = totals(baselineRows || []);
   const out = { ok: false, code: null, run, base, turns: run.turns, slope: null, slope_ratio: null, ratio: null, basis: null, message: "" };
 
@@ -353,12 +370,12 @@ export function costGate(steps, baselineRows, opts = {}) {
   out.basis = priced ? "cost_usd" : "weighted";
   const weigh = (r) => tokens(r.input) * weights.input + tokens(r.cache_read) * weights.cache_read
     + tokens(r.cache_creation) * weights.cache_creation + tokens(r.output) * weights.output;
-  const perTurn = steps.map(s => (priced ? finite(s.cost_usd) : weigh(s)));
+  const perTurn = measured.map(s => (priced ? finite(s.cost_usd) : weigh(s)));
   out.slope = fitSlope(perTurn);
   const mean = perTurn.reduce((a, b) => a + (b ?? 0), 0) / perTurn.length;
   out.slope_ratio = out.slope === null || mean === 0 ? null : Math.abs(out.slope) * (perTurn.length - 1) / mean;
 
-  const runTotal = priced ? run.cost_usd : steps.reduce((a, r) => a + weigh(r), 0);
+  const runTotal = priced ? run.cost_usd : measured.reduce((a, r) => a + weigh(r), 0);
   const baseTotal = priced ? base.cost_usd : (baselineRows || []).reduce((a, r) => a + weigh(r), 0);
   out.ratio = runTotal > 0 ? baseTotal / runTotal : null;
 
@@ -381,18 +398,23 @@ export function costGate(steps, baselineRows, opts = {}) {
  * that quietly re-read half the worktree), and the action check catches the cheaper failure the
  * bound cannot see: one small `Read` that says the state block did not carry, so the seat went
  * back to the filesystem to find out where it was.
+ *
+ * Cut rows are excluded first (measurableSteps): a boxed turn's zeroed measurements are not a
+ * recovery step — if the row after a disturbance was cut, this check reports NO_NEXT_STEP rather
+ * than passing on a turn that never ran.
  */
 export function disturbanceCheck(steps, opts = {}) {
-  const marks = (steps || []).map((s, i) => (s.disturbed ? i : -1)).filter(i => i >= 0);
+  const rows = measurableSteps(steps);
+  const marks = rows.map((s, i) => (s.disturbed ? i : -1)).filter(i => i >= 0);
   if (!marks.length) {
     return { ok: false, code: "NO_DISTURBANCE", cases: [], message: "no step is marked `disturbed` — §8.5 was never exercised on this run, so it did not pass it" };
   }
   const factor = opts.factor ?? DISTURB_INPUT_FACTOR;
   const cases = [];
   for (const i of marks) {
-    const next = steps[i + 1];
-    if (!next) { cases.push({ at: steps[i].turn ?? i + 1, ok: false, code: "NO_NEXT_STEP", detail: "the run ended at the disturbance — the recovery step was never taken" }); continue; }
-    const priorMedian = median(steps.slice(0, i + 1).map(s => tokens(s.input)));
+    const next = rows[i + 1];
+    if (!next) { cases.push({ at: rows[i].turn ?? i + 1, ok: false, code: "NO_NEXT_STEP", detail: "the run ended at the disturbance — the recovery step was never taken" }); continue; }
+    const priorMedian = median(rows.slice(0, i + 1).map(s => tokens(s.input)));
     const bound = priorMedian === null ? null : priorMedian * factor;
     const input = tokens(next.input);
     const tool = next.action && typeof next.action === "object" ? next.action.tool : null;
@@ -630,7 +652,8 @@ export function evaluateRun({ project, card, repo = REPO, ...opts }) {
     gates.push({ n: 2, name: "state-mode run recorded", ok: false, code: "NO_RUN", message: `no run steps at ${runPath(project, card)} — the state-mode driver (P6) has not recorded a run for this card, so there is nothing to measure. This is an UNKNOWN, and an unknown is not a pass.` });
     return { ok: false, gates, halted: "no run", project, card, baseline: base };
   }
-  gates.push({ n: 2, name: "state-mode run recorded", ok: true, code: null, message: `${steps.length} steps at ${runPath(project, card)}` });
+  const cutRows = steps.length - measurableSteps(steps).length;
+  gates.push({ n: 2, name: "state-mode run recorded", ok: true, code: null, message: `${steps.length} steps at ${runPath(project, card)}${cutRows ? ` · ${cutRows} cut row${cutRows === 1 ? "" : "s"} excluded from the measurement gates (3–5); §8.7 still counts ${cutRows === 1 ? "it" : "them"}` : ""}` });
 
   const cache = checkCache(steps);
   gates.push({ n: 3, name: "cache read > 0 after the first step (§8.3)", ok: cache.ok, code: cache.code, message: cache.message });

package/hooks/lib/handoff.mjs

@@ -16,7 +16,9 @@ import { homedir, hostname } from "node:os";
 import { execSync, spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { deriveSubagentManifest } from "../../lib/subagent-manifest.mjs";
-import { signedPost } from "./api.mjs";
+import { signedPost, loadIdentity } from "./api.mjs";
+// #7037: signedHeaders is SYNCHRONOUS, which is why this path can sign at all — see hubCallSync.
+import { signedHeaders } from "../../lib/signed-fetch.mjs";
 import { loadAutonomy, resolveAutonomy } from "../../lib/autonomy.mjs";
 import { resolveProject, orchSessionsPath, hostId } from "../../lib/project.mjs";
 // Trantor State (TDD §4.5). Dark behind TRANTOR_STATE_HANDOFF: these are imported unconditionally
@@ -473,23 +475,89 @@ export function resolveSeat(projectName, env = process.env) {
   return env.RELAY_SESSION || (env.RELAY_AGENT ? `${env.RELAY_AGENT}:${projectName}` : `${hostId()}:${projectName}`);
 }
 
+// ── #7037: one SIGNED, synchronous hub call, and an error that cannot be mistaken for data ──────
+//
+// Three reads on this path curl'd the hub UNSIGNED and read the refusal as an answer. The hub
+// replies 401 {"error":"signature required"}; a 401 body is VALID JSON, so `JSON.parse(out).tasks
+// || []` parses fine, finds no `tasks` key, and hands back an empty list. The catch never fires
+// because nothing threw. Silently, on every handoff: the card id resolved to 0, the verify-gate
+// list to [], and the storm guard — which exists because an old-hook session once fired 9 handoffs
+// in 49 minutes — read a refusal as "allowed" and stopped guarding.
+//
+// So the shape matters more than the signature: this returns { ok, status, json, reason } and NEVER
+// a bare list. A caller has to look at `ok` before it can reach the data, which is the property the
+// old code lacked. An auth failure must not be spellable as an empty result.
+//
+// Synchronous on purpose — this whole path is (see the state imports above), so api.mjs's async
+// signedGet is unavailable. signedHeaders IS synchronous, so only the transport differs.
+function hubCallSync(path, { project, session, method = "GET", body, timeoutMs = 2500 } = {}) {
+  const url = relayUrl(project) + path;
+  let headers = {};
+  try {
+    headers = signedHeaders(loadIdentity(session || resolveSeat(project || "")), url, { method, body });
+  } catch { /* unsigned is still worth attempting — the hub decides, not us */ }
+  const args = Object.entries(headers).map(([k, v]) => `-H ${JSON.stringify(`${k}: ${v}`)}`);
+  if (method !== "GET") args.push("-X", method);
+  if (body !== undefined) args.push("-H 'content-type: application/json'", "-d", JSON.stringify(body));
+  try {
+    // maxBuffer is NOT decoration: /tasks on this project is 1.6MB across 941 cards, and execSync's
+    // 1MB default turns that into ENOBUFS — which the old catch would have swallowed straight back
+    // into the same silent 0. A fix that only signed the request would still have failed here.
+    const out = execSync(
+      `curl -s --max-time ${Math.ceil(timeoutMs / 1000)} ${args.join(" ")} -w '\\n%{http_code}' ${JSON.stringify(url)}`,
+      { encoding: "utf8", timeout: timeoutMs + 500, maxBuffer: 32 * 1024 * 1024 });
+    const cut = out.lastIndexOf("\n");
+    const status = Number(out.slice(cut + 1).trim()) || 0;
+    const text = cut >= 0 ? out.slice(0, cut) : out;
+    let json = null; try { json = text ? JSON.parse(text) : null; } catch {}
+    if (status < 200 || status >= 300) {
+      return { ok: false, status, json, reason: json?.error ? `HTTP ${status}: ${json.error}` : `HTTP ${status}` };
+    }
+    return { ok: true, status, json, reason: "" };
+  } catch (e) {
+    return { ok: false, status: 0, json: null, reason: e?.message || "unreachable" };
+  }
+}
+
+// A refusal is worth exactly one line on stderr, and it must name the endpoint and the reason — the
+// whole cost of this bug was that it made no sound at all. Never throws into the handoff path: a
+// session losing its baton over a warning is a worse failure than the one being reported.
+function warnHubRead(what, r) {
+  try { process.stderr.write(`[trantor] handoff: ${what} unavailable — ${r.reason || "unknown"}; continuing without it\n`); } catch {}
+}
+
 /**
  * Which card this handoff belongs to. `TRANTOR_CARD` wins — the crew runner knows the answer for
  * certain and a lookup cannot beat being told. Otherwise ask the hub for this seat's newest open
  * card, on the same 2s best-effort budget as the verify-gates fetch: a hub that is down costs the
  * handoff a card number, never the handoff.
+ *
+ * #7037: reads /catchup, not /tasks. /tasks is the whole board with every card's full log — 1.6MB
+ * here, 625-961ms typical, and it already blew a 1500ms budget once today (#6983). /catchup answers
+ * the question actually being asked in a few hundred bytes. Its buckets are capped at 8, so "my
+ * card is not in the list" and "the list was truncated before it got to me" are different answers,
+ * and the second is reported as UNKNOWN rather than quietly resolving to 0 — which is the same
+ * defect this card exists to remove, one layer up.
  */
 export function resolveHandoffCard({ projectName, seat, env = process.env } = {}) {
   const told = Number(env.TRANTOR_CARD);
   if (Number.isInteger(told) && told > 0) return told;
-  try {
-    const out = execSync(`curl -s --max-time 2 ${JSON.stringify(relayUrl() + "/tasks?project=" + encodeURIComponent(projectName))}`, { encoding: "utf8", timeout: 2500 });
-    const tasks = JSON.parse(out).tasks || [];
-    const mine = tasks
-      .filter(t => t && Number.isInteger(t.id) && t.assignee === seat && ["doing", "testing"].includes(t.status))
-      .sort((a, b) => (a.status === b.status ? (b.updated || b.ts || 0) - (a.updated || a.ts || 0) : a.status === "doing" ? -1 : 1));
-    return mine.length ? mine[0].id : 0;
-  } catch { return 0; }
+  const r = hubCallSync(`/catchup?project=${encodeURIComponent(projectName)}`, { project: projectName, session: seat });
+  if (!r.ok) { warnHubRead(`card lookup for ${projectName}`, r); return 0; }
+  const CAP = 8;                       // hub-side pick() limit; keep in step with /catchup
+  for (const status of ["doing", "testing"]) {
+    const bucket = Array.isArray(r.json?.[status]) ? r.json[status] : [];
+    const mine = bucket
+      .filter(t => t && Number.isInteger(t.id) && t.assignee === seat)
+      .sort((a, b) => (b.updated || 0) - (a.updated || 0));
+    if (mine.length) return mine[0].id;
+    if (bucket.length >= CAP) {
+      warnHubRead(`card lookup for ${projectName}`,
+        { reason: `/catchup ${status} list truncated at ${CAP} — this seat's card may exist but was not returned` });
+      return 0;
+    }
+  }
+  return 0;
 }
 
 /**
@@ -625,12 +693,16 @@ export function writeHandoff({ projectDir, sessionId, transcript, trigger, summa
   // cooldown is SKIPPED — no file, no spawn. Manual (/trantor:handoff) + at-wall (precompact) handoffs
   // force through. Fail-OPEN if the hub is unreachable, so a legit handoff is never blocked.
   if (!force) {
-    try {
-      const body = JSON.stringify({ project: projectName, session: sessionId || "", trigger: trigger || "auto" });
-      const out = execSync(`curl -s --max-time 2 -X POST -H 'content-type: application/json' -d ${JSON.stringify(body)} ${JSON.stringify(relayUrl() + "/handoff")}`, { encoding: "utf8", timeout: 2500 });
-      const r = JSON.parse(out);
-      if (r && r.allow === false) return { skipped: true, reason: r.reason || "storm-guard", sinceSec: r.sinceSec };
-    } catch {}
+    // #7037: this is the costliest of the three unsigned reads. A 401 body parses, `r.allow` comes
+    // back undefined, `undefined === false` is false — so the guard said "go" on every handoff and
+    // the storm it exists to stop had nothing standing in its way. Signed now, and a REFUSAL is
+    // distinguished from a DENIAL: only a hub that answered gets to allow or deny.
+    const r = hubCallSync("/handoff", {
+      project: projectName, session: sessionId || "", method: "POST",
+      body: { project: projectName, session: sessionId || "", trigger: trigger || "auto" },
+    });
+    if (!r.ok) warnHubRead("storm guard", r);   // fail-OPEN, but never silently
+    else if (r.json && r.json.allow === false) return { skipped: true, reason: r.json.reason || "storm-guard", sinceSec: r.json.sinceSec };
   }
   if (!existsSync(HANDOFF_DIR)) mkdirSync(HANDOFF_DIR, { recursive: true });
   // #5648: an automatic digest must never recompose+supersede a FRESH model-authored handoff.
@@ -655,11 +727,14 @@ export function writeHandoff({ projectDir, sessionId, transcript, trigger, summa
   // MUST survive the handoff (a narrative line gets skimmed past; this is what the v0.17.31 incident
   // taught — the "verify Gail coefficients" intent vanished into prose). Fetched synchronously from
   // the local hub; best-effort, never blocks the handoff.
+  // #7037: signed, and an unreadable list is reported rather than rendered as "no open gates" —
+  // a record that silently claims zero gates is worse than one that admits it could not ask.
   let verifyGates = [];
-  try {
-    const out = execSync(`curl -s --max-time 2 ${JSON.stringify(relayUrl() + "/verify-gates?project=" + encodeURIComponent(projectName))}`, { encoding: "utf8", timeout: 2500 });
-    verifyGates = JSON.parse(out).gates || [];
-  } catch {}
+  {
+    const r = hubCallSync(`/verify-gates?project=${encodeURIComponent(projectName)}`, { project: projectName, session: sessionId || "" });
+    if (r.ok) verifyGates = Array.isArray(r.json?.gates) ? r.json.gates : [];
+    else warnHubRead(`verify gates for ${projectName}`, r);
+  }
   const record = {
     id: `${projectName}-${stamp}`,
     project: projectDir, projectName, machine: hostname(),

package/hub/overseer.mjs

@@ -36,6 +36,12 @@ function overseerInputs() {
       llm: v.llm || "", model: v.model || "", status: v.status || "",
     })),
     claims: [...fileClaims.values()],
+    // #7029: linked-activity needs an EVENT, and a card held from both sides of a link is one of
+    // the two the hub already has. Only cards in hand travel — the board is 950+ rows and 99% of
+    // them are done, so shipping the open ones keeps this tick as cheap as it was.
+    cards: state.tasks
+      .filter(t => t.status === "doing" || t.status === "testing")
+      .map(t => ({ id: t.id, project: t.project || "", status: t.status, assignee: t.assignee || "", workedBy: t.workedBy || "" })),
     ...overseerPolicy(),
     now: now(),
   };
@@ -160,6 +166,10 @@ function overseerTick() {
       // intro only to newly arrived sessions, and remember them so they are not re-introduced.
       standing.lastTick = t;
       c.since = standing.since;
+      // Every standing kind reports DURATION, not a count — the doctrine's rule, and until #7029 only
+      // same-project obeyed it. "held for 4h" is the line that tells an operator whether a collision
+      // is a moment or a stuck seat; "warned 40 times" tells them only that the watcher is loud.
+      if (_sameProject?.durationLabel) c.detail = `${c.detail || ""} (standing for ${_sameProject.durationLabel(t - standing.since)})`.trim();
       for (const me of parties) if (!standing.sessions.has(me)) intro(c, me, parties);
       for (const me of parties) standing.sessions.add(me);
       continue;

package/hub/reaper.mjs

@@ -158,6 +158,15 @@ function contractRecipientIsAnswerable(m) {
   return !!m.to && m.to !== "all" && m.from !== m.to && !m.to.startsWith("hub:") && !m.from.startsWith("hub:");
 }
 
+// A direct message the SENDER declared owes nothing back (#7079). `wake:false` is the sender saying
+// "context, not a contract" — the send result even prints "(batched — no turn)" — and a `receipt` or
+// `status` is a report, not a request. None of these ever buys the recipient a turn, so none can be
+// answered; counted as contracts they age into `stalled` and block the dispatcher's stop hook over
+// work that was never owed (four times in one day, every row an ack to an idle seat).
+function contractIsAck(m) {
+  return m.wake === false || m.kind === "receipt" || m.kind === "status";
+}
+
 function contractsFor(session, { project = "", windowMs = CONTRACT_WINDOW_MS, overdueMs = null } = {}) {
   const t = now();
   const cutoff = t - windowMs;
@@ -174,8 +183,12 @@ function contractsFor(session, { project = "", windowMs = CONTRACT_WINDOW_MS, ov
 
   const out = [];
   for (const c of mine.sort((a, b) => a.ts - b.ts)) {
+    const ack = contractIsAck(c);
     let answer = byRe.get(c.id) || null;
-    if (!answer) {
+    // An ack never claims a LOOSE reply: it is older than the real contract more often than not, and
+    // letting it consume the seat's untagged "done" would leave the real row WAITING — a false stall
+    // manufactured by the very row that was supposed to owe nothing.
+    if (!answer && !ack) {
       const pool = looseByPeer.get(c.to) || [];
       const i = pool.findIndex(r => r.ts > c.ts);
       if (i >= 0) answer = pool.splice(i, 1)[0];
@@ -190,6 +203,7 @@ function contractsFor(session, { project = "", windowMs = CONTRACT_WINDOW_MS, ov
     // tombstone. A seat that comes back and reports still closes its own contract.
     let disposition;
     if (answer) disposition = "answered";
+    else if (ack) disposition = "ack";                          // nothing owed: never waits, never stalls
     else if (seen < abandonCut) disposition = "abandoned";     // covers never-seen (seen === 0)
     else if (!online || (overdueMs != null && ageMs >= overdueMs)) disposition = "stalled";
     else disposition = "waiting";
@@ -224,7 +238,7 @@ function contractsFor(session, { project = "", windowMs = CONTRACT_WINDOW_MS, ov
     if (c.answered && c.ts > (newestAnswered.get(c.to) || 0)) newestAnswered.set(c.to, c.ts);
   }
   for (const c of out) {
-    if (c.answered || c.disposition === "abandoned") continue;
+    if (c.answered || c.disposition === "abandoned" || c.disposition === "ack") continue;
     if (c.ageMs < CONTRACT_ABANDON_MS) continue;
     if (c.ts < (newestAnswered.get(c.to) || 0)) c.disposition = "superseded";
   }
@@ -248,7 +262,7 @@ function contractsFor(session, { project = "", windowMs = CONTRACT_WINDOW_MS, ov
     if (r.ts > (latestDirectReply.get(r.from) || 0)) latestDirectReply.set(r.from, r.ts);
   }
   for (const c of out) {
-    if (c.answered || c.disposition === "abandoned") continue;
+    if (c.answered || c.disposition === "abandoned" || c.disposition === "ack") continue;
     if (c.ageMs < CONTRACT_ABANDON_MS) continue;
     const latest = latestDirectReply.get(c.to);
     if (latest != null && c.ts < latest) c.disposition = "superseded";

package/hub/routes/admin.mjs

@@ -215,14 +215,15 @@ export async function routeAdmin({ req, res, q, P, auth, ctx }) {
             declaredCrew: declaredCrewFor(c.project),
             now: now(),
           }).reason === "crew-only"));
-        // The record line reports DURATION ("same-project for 6h"), never a count of warnings.
+        // The record line reports DURATION ("standing for 6h"), never a count of warnings. Episode
+        // identity is project+kind+files, exactly as the tick loop keys it, so this view says the
+        // same thing the warning did  for every kind, not just same-project (#7029).
         for (const c of warnings) {
-          if (c.kind !== "same-project-sessions") continue;
-          const ep = overseer.active.get(`${c.project} same-project-sessions`);
-          if (ep) {
-            c.since = ep.since;
-            if (overseer.sameProject?.durationLabel) c.detail = `${c.detail || ""} (same-project for ${overseer.sameProject.durationLabel(now() - ep.since)})`.trim();
-          }
+          const ep = overseer.active.get(`${c.project} ${c.kind}${c.kind === "same-project-sessions" ? "" : ` ${(c.files || []).join(",")}`}`);
+          if (!ep) continue;
+          c.since = ep.since;
+          const label = c.kind === "same-project-sessions" ? "same-project" : "standing";
+          if (overseer.sameProject?.durationLabel) c.detail = `${c.detail || ""} (${label} for ${overseer.sameProject.durationLabel(now() - ep.since)})`.trim();
         }
       } catch {}
       return json(res, 200, { level, links: links.map(l => ({ projects: l.projects, reason: l.reason })), peers: peersOut, inflight, warnings });

package/hub/routes/cards.mjs

@@ -1,4 +1,16 @@
 /* oxlint-disable anti-slop/no-runtime-typeof, anti-slop/no-conditional-empty-object-spread -- SAFETY: Card wire envelopes and omission semantics are a compatibility contract; this module is a mechanical extraction with unchanged suites. */
+// The three fields that make a card heavy (#6983): its note log, its status history, and its
+// checklist. All three are per-card detail nobody reads off a board — a board shows how many notes
+// a card carries, never their text. Dropping them is what turns a 1.55MB read into 0.26MB.
+const SLIM_DROP = new Set(["log", "history", "checklist"]);
+function slimCard(t) {
+  const out = {};
+  for (const k of Object.keys(t)) if (!SLIM_DROP.has(k)) out[k] = t[k];
+  // Keep the ·N the board renders, so slimming costs a reader nothing visible.
+  out.logCount = Array.isArray(t.log) ? t.log.length : 0;
+  return out;
+}
+
 export async function routeCards({ req, res, q, P, auth, ctx }) {
   const {
     state, body, json, crossProjectGuard, touch, canon, filterReadable,
@@ -361,9 +373,22 @@ export async function routeCards({ req, res, q, P, auth, ctx }) {
       if (t && !canRead(auth, t.project || "")) return json(res, 404, { id: null, task: null });
       return json(res, 200, { id: t ? t.id : null, task: t || null });
     }
+    // #6983 fixes 2+3. /tasks is the hot read — every seat pays it several times a session — and on
+    // trantor it had grown to 1.55MB across 958 cards: 625-961ms against a 1500ms budget, and past
+    // execSync's 1MB pipe. Measured, the weight is not the cards, it is what hangs off them: log
+    // 56.3%, history 11.8%, checklist 4.4%. `fields=slim` drops exactly those three and keeps every
+    // column a reader actually renders (log becomes logCount) — 16.8% of full. `card=<id>` then
+    // re-attaches the ONE card the caller opened, so reading a card costs an index, not the board.
+    // Both are opt-in and additive: a client that sends neither gets the unchanged full payload, so
+    // this does not move the cliff for anyone, and old clients keep working against a new hub.
     if (req.method === "GET" && P === "/tasks") {
       const proj = q.project ? canon(q.project) : ""; const ts = filterReadable(auth, proj ? state.tasks.filter(t => canon(t.project) === proj) : state.tasks, t => t.project || "");
-      return json(res, 200, { tasks: ts });
+      if (String(q.fields || "") !== "slim") return json(res, 200, { tasks: ts });
+      const keep = Number(q.card);
+      const tasks = ts.map(t => (Number.isInteger(keep) && t.id === keep ? t : slimCard(t)));
+      // Echo the projection back. Without it a client cannot tell "hub honored slim" from "old hub
+      // ignored the param and sent everything", and would have to guess from a missing field.
+      return json(res, 200, { tasks, fields: "slim" });
     }
     if (req.method === "GET" && P === "/history") {
       const requestedLimit = Number(q.limit || 200);

package/hub/routes/messages.mjs

@@ -84,13 +84,16 @@ export async function routeMessages({ req, res, q, P, auth, ctx }) {
       // `superseded` leaves `contracts` for exactly the reason `abandoned` does: a session's hooks
       // are PINNED at session start, so an older stop hook filters this array with its own
       // predicate and would keep blocking on a row the hub has already settled.
-      const out = all.filter(c => c.disposition !== "abandoned" && c.disposition !== "superseded");
+      // `ack` leaves `contracts` too (#7079): a `wake:false` send, a `receipt` or a `status` is the
+      // sender declaring nothing is owed, so an old pinned hook must never see it as a row to block on.
+      const out = all.filter(c => c.disposition !== "abandoned" && c.disposition !== "superseded" && c.disposition !== "ack");
       return json(res, 200, {
         session, contracts: out, abandonedContracts: all.filter(c => c.disposition === "abandoned"),
         supersededContracts: all.filter(c => c.disposition === "superseded"),
+        ackContracts: all.filter(c => c.disposition === "ack"),
         open: out.filter(c => !c.answered).length,
         waiting: by("waiting"), stalled: by("stalled"), abandoned: by("abandoned"),
-        superseded: by("superseded"), answered: by("answered"),
+        superseded: by("superseded"), ack: by("ack"), answered: by("answered"),
       });
     }
 

package/lib/overseer.mjs

@@ -3,12 +3,10 @@
 // so the episode-recurrence path was untestable and therefore unproven.
 const PEER_LIVE_MS = Number(process.env.RELAY_OVERSEER_PEER_LIVE_MS || 5 * 60 * 1000);
 const CLAIM_LIVE_MS = Number(process.env.RELAY_OVERSEER_CLAIM_LIVE_MS || 10 * 60 * 1000);
-// "Actively executing", not merely "window open" — the same 90s bar the desktop app calls `busy`
-// (the heartbeat fires on tool calls, so a fresher-than-90s peer is mid-turn). Presence alone is
-// too weak a signal to call a collision: see the linked-activity note below.
-const WORK_LIVE_MS = Number(process.env.RELAY_OVERSEER_WORK_LIVE_MS || 90 * 1000);
-
 const KINDS = new Set(["same-project-sessions", "file-conflict", "linked-activity"]);
+// A card in `todo` is queued, not held; `done`/`failed`/`blocked` are nobody's hands. Only these
+// two mean a session has it open right now.
+const HELD_STATUSES = new Set(["doing", "testing"]);
 
 const asArray = (v) => Array.isArray(v) ? v : [];
 const clean = (v) => String(v ?? "").trim();
@@ -66,7 +64,7 @@ function sortCollisions(collisions) {
   );
 }
 
-export function detectCollisions({ peers = [], claims = [], links = [], autonomy = {}, now } = {}) {
+export function detectCollisions({ peers = [], claims = [], links = [], cards = [], autonomy = {}, now } = {}) {
   const at = finiteNumber(now) ?? 0;
   const out = [];
 
@@ -102,6 +100,11 @@ export function detectCollisions({ peers = [], claims = [], links = [], autonomy
   }
 
   const claimSessionsByFile = new Map();
+  // The same claims indexed by PATH ALONE, project dropped. A claim's `project` is the CLAIMANT's
+  // project, not the file's, so one path claimed under two project names is two sessions on one
+  // file — the cross-project overlap that claimSessionsByFile, keyed on project+file, structurally
+  // cannot see. linked-activity reads this one.
+  const claimProjectsByPath = new Map();
   for (const claim of asArray(claims)) {
     const project = clean(claim?.project);
     const file = clean(claim?.file);
@@ -111,6 +114,9 @@ export function detectCollisions({ peers = [], claims = [], links = [], autonomy
     const sessions = claimSessionsByFile.get(key) ?? new Set();
     sessions.add(session);
     claimSessionsByFile.set(key, sessions);
+    const byProject = claimProjectsByPath.get(file) ?? new Map();
+    byProject.set(project, (byProject.get(project) ?? new Set()).add(session));
+    claimProjectsByPath.set(file, byProject);
   }
 
   for (const key of [...claimSessionsByFile.keys()].sort()) {
@@ -126,40 +132,75 @@ export function detectCollisions({ peers = [], claims = [], links = [], autonomy
     });
   }
 
-  // A link is DECLARED — the operator already told us these projects move together. Warning merely
-  // because both have a session OPEN restates that declaration, and it stays true for hours:
-  // crebral-health ↔ crebral-scribe produced 468 identical warnings across 8 days (2026-08-12
-  // audit), which is how a monitor teaches you to ignore it. The signal worth raising is
-  // CONCURRENT WORK — each side actually executing (heartbeat inside WORK_LIVE_MS) or holding a
-  // fresh file claim. Two idle-open windows are not a collision.
-  const workingByProject = new Map();
-  for (const peer of livePeers) {
-    if (!isFresh(peer?.lastSeen, at, WORK_LIVE_MS)) continue;
-    const sessions = workingByProject.get(peer.project) ?? [];
-    sessions.push(peer.session);
-    workingByProject.set(peer.project, sessions);
-  }
-  for (const claim of asArray(claims)) {
-    const project = clean(claim?.project);
-    const session = clean(claim?.session);
-    if (!project || !session || !isFresh(claim?.ts, at, CLAIM_LIVE_MS)) continue;
-    const sessions = workingByProject.get(project) ?? [];
-    sessions.push(session);
-    workingByProject.set(project, sessions);
+  // A link is DECLARED — the operator already told us these projects move together, so two sessions
+  // being LIVE on both sides restates the operator's own declaration and stays true for as long as
+  // the machine is on. crebral-health ↔ crebral-scribe produced 468 identical warnings across 8 days
+  // (2026-08-12 audit); trantor ↔ trantor-duty is codependent by policy, so on that machine the
+  // condition is permanent (#7029: it woke a seat that then spent a full turn proving a negative).
+  // Presence is a STATE. Narrowing it to "both sides are executing" was still a state — a busier
+  // one. The only thing worth a wake is an EVENT: two sessions actually on the same thing. There
+  // are exactly two the hub already holds, so neither has to be invented —
+  //   (1) one FILE PATH claimed live from both sides of the link (file claims exist for this; the
+  //       file-conflict kind keys on project+file and so is blind across projects), and
+  //   (2) one CARD ID held (doing/testing) by live sessions from both sides — `assignee` is intent
+  //       and `workedBy` is the signed evidence of who actually moved it, so a card wearing two
+  //       live faces from two linked projects is two sessions on one piece of work.
+  // No event, no warning. This under-warns by construction and that is the intended bias: a warning
+  // that fires on a permanent condition teaches its readers to ignore it.
+  const projectOfSession = new Map();
+  for (const peer of livePeers) if (!projectOfSession.has(peer.session)) projectOfSession.set(peer.session, peer.project);
+
+  const heldCards = [];
+  for (const card of asArray(cards)) {
+    const id = finiteNumber(card?.id);
+    if (id == null || !HELD_STATUSES.has(clean(card?.status))) continue;
+    // Only LIVE sessions count. A card assigned to a seat that went home is not a collision.
+    const holders = sortedStrings([card?.assignee, card?.workedBy]).filter((s) => projectOfSession.has(s));
+    if (holders.length < 2) continue;
+    heldCards.push({ id, holders });
   }
 
   for (const link of asArray(links)) {
     const projects = sortedStrings(link?.projects ?? []);
     if (projects.length < 2) continue;
-    const activeProjects = projects.filter((project) => (workingByProject.get(project) ?? []).length > 0);
-    if (activeProjects.length < 2) continue;
-    const sessions = sortedStrings(activeProjects.flatMap((project) => workingByProject.get(project) ?? []));
+    const inLink = new Set(projects);
+    const files = [];
+    const sessions = new Set();
+    const contested = new Set();
+    const evidence = [];
+
+    for (const path of [...claimProjectsByPath.keys()].sort()) {
+      const claimSides = [...claimProjectsByPath.get(path).entries()].filter(([project]) => inLink.has(project));
+      if (claimSides.length < 2) continue;
+      const claimants = sortedStrings(claimSides.flatMap(([, ss]) => [...ss]));
+      if (claimants.length < 2) continue;
+      files.push(path);
+      for (const [project] of claimSides) contested.add(project);
+      for (const s of claimants) sessions.add(s);
+      evidence.push(`${path} is claimed by ${claimants.join(", ")}`);
+    }
+
+    for (const card of heldCards) {
+      const holders = card.holders.filter((s) => inLink.has(projectOfSession.get(s)));
+      const holderProjects = new Set(holders.map((s) => projectOfSession.get(s)));
+      if (holderProjects.size < 2) continue;
+      for (const project of holderProjects) contested.add(project);
+      for (const s of holders) sessions.add(s);
+      evidence.push(`card #${card.id} is held by ${holders.join(", ")}`);
+    }
+
+    if (evidence.length === 0) continue;
+    // ONE collision per link, evidence and all. The episode key downstream is project+kind+files, so
+    // per-file splitting would mint a fresh episode (and a fresh wake) every time the evidence set
+    // shifted — the same volatility that made membership a bad episode key (#5350). A second
+    // contended card inside a standing episode therefore stays silent; under-warning is the bias.
+    const sides = sortedStrings(contested);
     pushCollision(out, {
-      project: activeProjects[0],
+      project: sides[0] ?? projects[0],
       kind: "linked-activity",
-      sessions,
-      files: [],
-      detail: `Linked projects ${activeProjects.join(", ")} are being worked on at the same time by ${sessions.join(", ")}.`,
+      sessions: [...sessions],
+      files,
+      detail: `Linked projects ${sides.join(", ")} are on the same work: ${evidence.join("; ")}.`,
     });
   }
 

package/lib/turn-policy.mjs

@@ -14,6 +14,22 @@
 /// The first card a message cites. A turn belongs to exactly one card, and this is how the runner
 /// knows when a wake has moved to a different one.
 export const CARD_REF_RE = /#(\d{1,7})(?!\d)/;
+const CARD_REF_RE_G = /#(\d{1,7})(?!\d)/g;
+
+/// #7061: a citation that HANDS THE CARD OVER, as opposed to one that merely mentions it. A work
+/// order naturally opens with what shipped since the seat's last turn — "#7037 is merged as
+/// a01f629 … YOUR CARD: #6983" — so the earliest id in the prose is routinely a DONE card. Binding
+/// to it wrote the state sidecar, the card log and the run record against a card nobody worked.
+/// Shape is what separates the two roles; position never did. Deliberately narrow: an assignment
+/// verb or label immediately before the id, never a general parse of English.
+const ASSIGN_CARD_RE = new RegExp([
+  // a label: "YOUR CARD: #6983", "card #7010", "contract: #7061", "work order — #6897"
+  String.raw`\b(?:your\s+card|card|contract|work\s+order|assignment)\s*(?:is\s*)?[:\u2014\u2013-]?\s*#(\d{1,7})(?!\d)`,
+  // a verb that hands it over: "take #7061", "take card #6897", "work on #7001", "bounce on #6134"
+  String.raw`\b(?:take|work|pick\s+up|resume|start|finish|bounced?)\s+(?:on\s+)?(?:card\s+)?#(\d{1,7})(?!\d)`,
+  // the card as the subject of a hand-over: "#7061 is yours", "#7002 is bounced"
+  String.raw`#(\d{1,7})(?!\d)\s+(?:is|are)\s+(?:yours|bounced|reopened|back)\b`,
+].join("|"), "i");
 
 /// Words that make a direct message an instruction rather than conversation. Deliberately short:
 /// the point is to catch a contract that forgot to cite its card, not to parse English.
@@ -24,6 +40,84 @@ export function cardRef(text) {
   return m ? Number(m[1]) : 0;
 }
 
+/// Every card a message cites, in the order it cites them — what the runner uses to tell a wake
+/// that names ONE card from one that names several.
+export function cardRefs(text) {
+  return [...String(text || "").matchAll(CARD_REF_RE_G)].map((m) => Number(m[1]));
+}
+
+/// The card this text ASSIGNS, or 0 when it only mentions cards. Leftmost assignment wins: an
+/// order says what it wants first and explains itself after.
+export function assignedCardRef(text) {
+  const m = ASSIGN_CARD_RE.exec(String(text || ""));
+  return m ? Number(m.slice(1).find((g) => g != null)) : 0;
+}
+
+/// #7061: the card a wake batch binds its turn to. Messages addressed to THIS seat outrank
+/// @mentions (a mention is someone else's contract that named you), and within them the NEWEST
+/// assignment wins, because a later order supersedes an earlier one. Only when no message in the
+/// batch is assignment-shaped does this fall back to the newest message's first citation — the
+/// pre-#7061 behaviour, narrowed from "first id anywhere in the batch" to one message.
+export function wakeCard(messages, { session = "" } = {}) {
+  const all = (Array.isArray(messages) ? messages : []).filter(Boolean);
+  if (!all.length) return 0;
+  const direct = session ? all.filter((m) => m.to === session) : [];
+  const pool = newestLast(direct.length ? direct : all);
+  for (let i = pool.length - 1; i >= 0; i--) {
+    const c = assignedCardRef(pool[i].text);
+    if (c) return c;
+  }
+  for (let i = pool.length - 1; i >= 0; i--) {
+    const c = cardRef(pool[i].text);
+    if (c) return c;
+  }
+  // A batch whose only citation sits in an @mention still names a card; nothing is worse than 0.
+  return all.map((m) => cardRef(m.text)).find(Boolean) || 0;
+}
+
+/// Chronological order, by whichever field EVERY message in the batch actually has. Mixing hub ids
+/// with wall-clock ts across messages would sort by two different scales and silently misorder, so
+/// a batch that is not uniform keeps the order the runner queued it in.
+function newestLast(msgs) {
+  for (const key of ["id", "ts"]) {
+    if (msgs.every((m) => Number.isFinite(Number(m?.[key])))) {
+      return msgs.map((m, i) => ({ m, i }))
+        .sort((a, b) => (Number(a.m[key]) - Number(b.m[key])) || (a.i - b.i))
+        .map((x) => x.m);
+    }
+  }
+  return msgs;
+}
+
+/// Turn kinds that exist BEFORE or WITHOUT a wake message. Neither can carry a card, so neither
+/// can ever be a state step. That is a fact about the SHAPE of the turn, not about configuration,
+/// which is exactly why no amount of correct config makes it come out differently.
+const NO_CARD_TURNS = {
+  kickoff: "a kickoff runs before any message arrives, so it belongs to no card",
+  pulse: "a pulse is a timer rather than a message, so it belongs to no card",
+};
+
+/// #7060: why THIS turn is not assembled from a WorkingState, or null when it is. The runner's
+/// boot line only ever proved CONFIGURATION — the flag, an eligible seat, a CLI carrying
+/// `--json-schema`, the schema on disk — and an operator read it as a claim about the PROMPT. The
+/// two came apart on the very next turn: the kickoff runs before any message exists, so it belongs
+/// to no card and can never be a state step, and it said nothing at all about that. The seat that
+/// hit it had confirmed flags, a valid schema and an unassembled prompt, and the only way to tell
+/// a skip from proof was to read the source. A skip must not be mistaken for proof — the same rule
+/// the drill's SKIP already keeps (bin/drill-surface.mjs:39) — so the runner asks this every turn
+/// and prints the answer.
+///
+/// Reasons are ordered by which constraint actually BINDS. A pulse belongs to no card whether or
+/// not the breaker tripped, so on those turns the structural fact is the honest answer.
+export function stateSkipReason({ mode = false, kind = "wake", breakerTripped = false, card = 0 } = {}) {
+  if (!mode) return "state mode is off for this seat";
+  const structural = NO_CARD_TURNS[String(kind)];
+  if (structural) return structural;
+  if (breakerTripped) return "the state-mode breaker tripped earlier this run, so the seat is back on the transcript path";
+  if (!(Number(card) > 0)) return "this wake assigns no card, and a state turn is bound to exactly one";
+  return null;
+}
+
 export function hasImperative(text) {
   return IMPERATIVE_RE.test(String(text || ""));
 }

package/mcp.mjs

@@ -154,7 +154,7 @@ server.tool("relay_contracts", "What you dispatched and are still owed. Lists ev
     catch (e) { return { content: [{ type: "text", text: `could not reach the hub: ${e?.message || e}` }] }; }
     // The hub keeps abandoned contracts in their own key so older stop hooks stop blocking on them.
     // The ledger still wants to SHOW them, so put the two halves back together here.
-    const all = [...(r?.contracts || []), ...(r?.abandonedContracts || []), ...(r?.supersededContracts || [])]
+    const all = [...(r?.contracts || []), ...(r?.abandonedContracts || []), ...(r?.supersededContracts || []), ...(r?.ackContracts || [])]
       .sort((a, b) => a.ts - b.ts);
     if (!all.length) return { content: [{ type: "text", text: "You have not dispatched any contracts in the last 24h." }] };
     // Fall back to the pre-disposition shape when talking to an older hub.
@@ -162,8 +162,9 @@ server.tool("relay_contracts", "What you dispatched and are still owed. Lists ev
     const open = all.filter(c => disp(c) === "waiting" || disp(c) === "stalled");
     const abandoned = all.filter(c => disp(c) === "abandoned");
     const superseded = all.filter(c => disp(c) === "superseded");
+    const acks = all.filter(c => disp(c) === "ack");
     const mins = (ms) => (ms >= 60000 ? `${Math.round(ms / 60000)}m` : `${Math.round(ms / 1000)}s`);
-    const MARK = { answered: "✅", waiting: "⏳", stalled: "⚠️", abandoned: "🪦", superseded: "⤳" };
+    const MARK = { answered: "✅", waiting: "⏳", stalled: "⚠️", abandoned: "🪦", superseded: "⤳", ack: "·" };
     const line = (c) => {
       const d = disp(c);
       const health = d === "answered" ? "" :
@@ -184,9 +185,13 @@ server.tool("relay_contracts", "What you dispatched and are still owed. Lists ev
     if (superseded.length) {
       notes.push(`⤳ ${superseded.length} SUPERSEDED: the assignee is alive and has since answered a newer contract from you, so these were never going to be answered. Nothing is owed — do not chase them.`);
     }
-    const text = `${open.length} outstanding of ${all.length} contract(s) in the last 24h`
+    if (acks.length) {
+      notes.push(`· ${acks.length} ACK: sent with wake:false, or as a receipt/status. You declared nothing was owed on these, so they never wait and never stall.`);
+    }
+    const text = `${open.length} outstanding of ${all.length - acks.length} contract(s) in the last 24h`
       + (abandoned.length ? ` (plus ${abandoned.length} abandoned)` : "")
-      + (superseded.length ? ` (plus ${superseded.length} superseded)` : "") + `:\n`
+      + (superseded.length ? ` (plus ${superseded.length} superseded)` : "")
+      + (acks.length ? ` (plus ${acks.length} acks, nothing owed)` : "") + `:\n`
       + all.slice(-25).map(line).join("\n")
       + (notes.length ? "\n\n" + notes.join("\n") : "");
     return { content: [{ type: "text", text }] };
@@ -332,6 +337,10 @@ const STOPWORDS = new Set(["the","a","an","and","or","of","to","in","on","for","
 function titleWords(title) {
   return new Set(String(title || "").toLowerCase().match(/[a-z][a-z0-9_-]{2,}/g)?.filter(w => !STOPWORDS.has(w)) || []);
 }
+// How many notes a card carries, whichever shape the hub sent (#6983). A slim card has been stripped
+// of its log and carries logCount instead; a full card — an older hub, or the one card we asked for
+// in full — still has the log itself. Read both so the ·N is right against any hub version.
+const noteCount = (t) => (Array.isArray(t.log) ? t.log.length : Number(t.logCount) || 0);
 function cardView(tasks, id, proj) {
   const card = tasks.find(t => t.id === id);
   if (!card) return `${proj}: no card #${id}`;
@@ -358,7 +367,7 @@ function cardView(tasks, id, proj) {
     .filter(t => t.status === "done" && t.id !== card.id && [...titleWords(t.title)].some(w => mine.has(w)))
     .sort((a, b) => (b.updated || b.ts || 0) - (a.updated || a.ts || 0))
     .slice(0, 5)
-    .map(t => `#${t.id} ${t.title}${t.log?.length ? ` ·${t.log.length}` : ""}`);
+    .map(t => `#${t.id} ${t.title}${noteCount(t) ? ` ·${noteCount(t)}` : ""}`);
   if (kin.length) out.push(`related done cards:\n  ${kin.join("\n  ")}`);
 
   return out.join("\n");
@@ -369,11 +378,16 @@ server.tool("relay_board", "Show a project's Kanban board (all cards + their sta
     card: z.number().optional().describe("read ONE card instead of the board: the card itself, its notes, and the last five done cards whose title shares a word with it. This is what a seat starting a card should call — the whole board is 1900+ cards of someone else's work.") },
   async ({ project, card }) => {
   const proj = project || PROJECT;
-  const { tasks } = await api("GET", `/tasks?project=${encodeURIComponent(proj)}`);
+  // #6983: ask for the SLIM projection, and when opening one card ask for that card full. The board
+  // needs titles and a note COUNT, never every card's note text — on trantor that was 1.55MB and
+  // 625-961ms against a 1500ms budget, which is why this tool intermittently answered "hub 0" when
+  // the hub was 200 OK and merely slow. An older hub ignores both params and returns the full board,
+  // which still renders — so this asks for cheap and works either way, rather than requiring a deploy.
+  const { tasks } = await api("GET", `/tasks?project=${encodeURIComponent(proj)}&fields=slim${card ? `&card=${encodeURIComponent(card)}` : ""}`);
   if (!tasks.length) return { content: [{ type: "text", text: `${proj}: no cards yet` }] };
   if (card) return { content: [{ type: "text", text: cardView(tasks, card, proj) }] };
   const by = { todo: [], doing: [], testing: [], failed: [], done: [], blocked: [] };
-  for (const t of tasks) (by[t.status] || by.todo).push(`#${t.id} ${t.title}${t.assignee ? ` (@${t.assignee})` : ""}${t.log?.length ? ` ·${t.log.length}` : ""}`);
+  for (const t of tasks) (by[t.status] || by.todo).push(`#${t.id} ${t.title}${t.assignee ? ` (@${t.assignee})` : ""}${noteCount(t) ? ` ·${noteCount(t)}` : ""}`);
   const cols = Object.entries(by).filter(([, v]) => v.length).map(([k, v]) => `${k.toUpperCase()}:\n  ${v.join("\n  ")}`);
   return { content: [{ type: "text", text: `${proj} board\n${cols.join("\n")}` }] };
 });
@@ -391,8 +405,9 @@ server.tool("relay_peers", "Find who you can talk to: the live agent sessions on
 
 server.tool("relay_send", "Send a live message to another agent session (or 'all' to broadcast). Reach the other agent YOURSELF: if you are about to ask the human to pass something along, tell the session directly instead — asking a person to carry a message between two agents is a failure, not politeness. Don't know the id? relay_peers lists them, linked projects included. Cross-project action is a breach unless the operator linked the projects (`trantor policy link <a> <b> --reason \"<why>\"`) — the hub answers 403 for a send into an unlinked project.",
   { to: z.string().describe("target session id, or 'all'"), text: z.string().describe("message body"),
-    wake: z.boolean().optional().describe("false = context, not a contract: the message batches into the target's next turn instead of buying it a whole CLI session. Use it for acks, FYIs and queue notes; leave it unset for anything you expect worked on.") },
-  async ({ to, text, wake }) => {
+    wake: z.boolean().optional().describe("false = context, not a contract: the message batches into the target's next turn instead of buying it a whole CLI session. Use it for acks, FYIs and queue notes; leave it unset for anything you expect worked on."),
+    re: z.number().optional().describe("the message id you are ANSWERING. Set it whenever you reply to a specific message. Without it the hub matches your reply to the peer's OLDEST outstanding contract, so answering their newest question silently closes their oldest one and leaves the real one reading WAITING forever — which is how seats end up chasing contracts that were answered long ago.") },
+  async ({ to, text, wake, re }) => {
     // The event log is append-only — a secret in it is unrecoverable, so refuse BEFORE
     // anything reaches the hub. Returns the offending kinds so the caller can fix it.
     const scrub = assertNoSecrets(text);
@@ -401,7 +416,7 @@ server.tool("relay_send", "Send a live message to another agent session (or 'all
     }
     let sent;
     try {
-      sent = await api("POST", "/send", { from: SESSION, to, text, ...(wake === false ? { wake: false } : {}) });
+      sent = await api("POST", "/send", { from: SESSION, to, text, ...(wake === false ? { wake: false } : {}), ...(Number.isFinite(re) ? { re: Number(re) } : {}) });
     } catch (error) {
       // A duty relay refusal is itself a fleet incident. Record it on the target lane before the
       // tool returns the 403; the model must not interpret a failed report as permission to skip

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.52",
+  "version": "0.18.53",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"

package/skills/crew/SKILL.md

@@ -122,6 +122,20 @@ Loop until the board is done — you are a foreman, not a mailbox:
    - **ABANDONED** — the assignee has been gone long enough that the contract can never be
      answered. Nobody is coming back. **Reassign the work or drop it deliberately** — it will not
      block you again, and it will not resolve itself.
+   - **SUPERSEDED** — the assignee is alive and has since answered a NEWER contract from you, so
+     this row was never going to be answered on its own. Nothing is owed. Do not chase it.
+   - **ACK** — you sent it with `wake:false`, or as a `receipt`/`status`. You declared that nothing
+     was owed, so it never waits and never stalls. It stays in the ledger as a record that you said
+     the thing; it is not work you are waiting on.
+
+   Two sizing rules that cost real money to learn:
+   - **A turn is killed at 20 minutes** (`TURN_MAX_MS`), so write a contract that can FINISH inside
+     one. A seat cut at the box loses the turn, and on the state path nothing salvages it. If a
+     seat reports a "crash", check `duration_ms` against 1200000 before believing it — SIGKILL at
+     the box exits 137 and reads like a fault.
+   - **A wake is capped at 2000 characters and truncated HEAD-first**, which eats your instructions
+     and keeps your rationale. Put the ask in the FIRST sentence, keep it short, and split a long
+     order into two sends rather than one long one.
    A contract is never closed on the assignee's behalf: quiet is not an outcome. An abandoned one
    stays in the ledger with the evidence, and a seat that revives still closes its own contract.
 4. Grunt sub-tasks that appear mid-build (a regex, a config block, a doc paragraph) →