trantor 0.18.57 → 0.18.59

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.57",
+  "version": "0.18.59",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/cli.mjs

@@ -33,6 +33,8 @@ switch (cmd) {
   case "agent-settings": run("bin/agent-settings.mjs"); break;
   case "adopt":   spawn(process.execPath, [join(ROOT, "bin/adopt.mjs"), ...args], { stdio: "inherit", cwd: process.cwd() }).on("exit", c => process.exit(c ?? 0)); break;
   case "integrate": spawn(process.execPath, [join(ROOT, "bin/integrate.mjs"), ...args], { stdio: "inherit", cwd: process.cwd() }).on("exit", c => process.exit(c ?? 0)); break;
+  case "harvest": run("bin/harvest.mjs"); break;
+  case "sync": run("bin/sync.mjs"); break;
   case "down":    runCrew(); break;
   case "swap":    runCrew(); break;
   case "prune":   runCrew(); break;
@@ -207,6 +209,8 @@ switch (cmd) {
   trantor adopt       take over a session already running in a Terminal, then open it here
   trantor takeover    the whole move in one command: idle-gate the Terminal session, end it gracefully, adopt, open in the pane — [--force] [--session <id>] [--dry-run]
   trantor integrate   collect the crew's work, merge it, verify it, push it (--dry-run to rehearse)
+  trantor harvest     receipt for a seat commit you landed on main by hand: harvest <seat-sha> <main-sha> [--card N]
+  trantor sync        realign a seat branch with main from the receipts: sync [<seat>] [--dry-run] — refuses and names unharvested commits
   trantor down        tear the crew down (kills processes, closes windows, no dialogs)
   trantor prune       drop dead crew-window tracking rows (ghost workspaces/panes) without spawning anything
   trantor ui          open the live dashboard (board + flow views)

package/bin/crew-runner.mjs

@@ -12,7 +12,7 @@ import { ensureEnrolled } from "../lib/enroll.mjs";
 import { redactKeys } from "../lib/redact.mjs";
 import {
   AUTH_MARKER_RE, classifyFailure, looksLikeAuthDeath,
-  verdictFor,
+  verdictFor, substantiveOutput,
   readPromptText, stripPromptEcho,
 } from "../lib/classify-failure.mjs";
 import { capWake, capBcast, pickLessons, composePrompt } from "./crew-payload.mjs";
@@ -284,7 +284,7 @@ if (!CLI[AGENT]) log(`'${AGENT}' is not a built-in seat — running it as an ope
 
 // RUNNER_RULES / RUNNER_KICKOFF env overrides: the runner is also the substrate for non-crew
 // always-on seats (the fleet DUTY agent, bin/duty.mjs) whose doctrine is not "work your card".
-const RULES = process.env.RUNNER_RULES || `Rules: you are ${SESSION} on the trantor crew. Before starting a card, read YOUR card: relay_board with card:<id> (the card, its deps, its notes, and the last five done cards whose title shares a word); never the whole board. Work your assigned file(s), report on the bus (relay_send, <280 chars), move your Kanban card as you go with a NOTE saying what you did (doing -> testing -> done; in 'testing' run YOUR OWN test file — never the full npm test, suites collide across seats — plus \`node bin/slop-gate.mjs\` when the repo has one: it lints ONLY your changed files against the anti-slop rules, and a card must not reach done with slop-gate failing; use 'failed' + a report if anything breaks). If you need something from another session, message THAT SESSION (relay_peers to find its id, relay_send to reach it) — never ask the human to pass it along; carrying messages between agents is the job this bus exists to remove. When your work for THIS message is finished, END YOUR TURN — do NOT park, do NOT loop relay_wait; the runner waits for you and will wake you with the next message. Path discipline: build/test from your worktree root ${TURN_DIR} with absolute paths or --manifest-path/--prefix instead of cd-ing into subdirs, and put anything that must land outside the repo under ${TURN_DIR}/.agent-bus-out/ (gitignored) — never ~/.agent-bus. Cross-project action is a breach: never \`trantor up\` a crew, register a seat, or send a card/contract into a project other than ${PROJ} unless the operator ran \`trantor policy link ${PROJ} <other> --reason "<why>"\` first — the hub, the CLI and this runner all refuse it mechanically, so ask the operator to link the projects instead of routing around the refusal.`;
+const RULES = process.env.RUNNER_RULES || `Rules: you are ${SESSION} on the trantor crew. Before starting a card, read YOUR card: relay_board with card:<id> (the card, its deps, its notes, and the last five done cards whose title shares a word); never the whole board. Work your assigned file(s), report on the bus (relay_send, <280 chars), move your Kanban card as you go with a NOTE saying what you did (doing -> testing -> done; in 'testing' run YOUR OWN test file — never the full npm test, suites collide across seats — plus \`node bin/slop-gate.mjs\` when the repo has one: it lints ONLY your changed files against the anti-slop rules, and a card must not reach done with slop-gate failing; use 'failed' + a report if anything breaks). If a contract omits a fact you cannot proceed without, ASK — never invent the value: relay_ask(<card>, <question>) blocks the card with your question, keeps the turn owed (no park, no failure), and resumes you when the assigner's answer lands; an invented value that reads as reasoned is the worst outcome this crew ships (#7756). If you need something from another session, message THAT SESSION (relay_peers to find its id, relay_send to reach it) — never ask the human to pass it along; carrying messages between agents is the job this bus exists to remove. When your work for THIS message is finished, END YOUR TURN — do NOT park, do NOT loop relay_wait; the runner waits for you and will wake you with the next message. Path discipline: build/test from your worktree root ${TURN_DIR} with absolute paths or --manifest-path/--prefix instead of cd-ing into subdirs, and put anything that must land outside the repo under ${TURN_DIR}/.agent-bus-out/ (gitignored) — never ~/.agent-bus. Realigning your seat branch after the orchestrator harvested your commits is \`trantor sync\` run from your worktree: it reads the harvest receipts and refuses when an unharvested commit would be lost, so never reset or rebase onto main by hand. Cross-project action is a breach: never \`trantor up\` a crew, register a seat, or send a card/contract into a project other than ${PROJ} unless the operator ran \`trantor policy link ${PROJ} <other> --reason "<why>"\` first — the hub, the CLI and this runner all refuse it mechanically, so ask the operator to link the projects instead of routing around the refusal.`;
 
 // ---- the pulse --------------------------------------------------------------
 // RUNNER_PULSE_MS re-runs an orchestrator seat's mission note on a cadence when the bus is silent;
@@ -305,6 +305,10 @@ let lastErrText = "";
 // burned its whole max_tokens budget on internal reasoning and returned a null completion; the
 // runner used to read that silence as a clean turn while nothing was produced.
 let lastEmptyOutput = false;
+// #7759: exit 0 with bytes on the stream but neither a changed worktree nor substantive output —
+// the CLI printed its banner and quit. The both-streams-silent rule above stays; this is the
+// second, harder-to-see empty shape.
+let lastEmptyTurn = false;
 const ERRF = join(homedir(), ".agent-bus", `err-${AGENT}-${PROJ}.txt`);
 const DUTY_NUDGES = process.env.RUNNER_DUTY_NUDGES === "1";
 const DUTY_NUDGE_STATE = process.env.RUNNER_DUTY_NUDGE_STATE
@@ -327,6 +331,11 @@ function startDutyNudgeWatcher(plan, sinceMs) {
 // The hub hands a message out exactly once, so a turn that died took its wake with it. Here a
 // message is consumed only when a turn exits 0; the queue lives on disk and retries on backoff.
 const PENDF = join(homedir(), ".agent-bus", `pending-${AGENT}-${PROJ}.json`);
+// #7778: message ids this seat already consumed through its OWN inbox path (relay_inbox, the
+// PostToolUse hook) — reconciled from the hub's deliveredUpTo ledger at each clean turn boundary
+// and persisted in the pending file, so a message the session read mid-turn is never re-woken by
+// the poll, across turn AND process boundaries.
+let seenLedger = [];
 // A cap, so a long outage cannot grow the queue without bound. Overflow drops the OLDEST and says
 // so on the bus — a silent drop is the exact failure this whole mechanism exists to end.
 const PENDING_MAX = 50;
@@ -341,23 +350,51 @@ const RETRY_MS = (() => {
   const custom = raw ? raw.split(",").map(Number).filter(n => Number.isFinite(n) && n > 0) : [];
   return custom.length ? custom : [30e3, 60e3, 120e3, 300e3, 900e3];
 })();
+// #7756: while an ask awaits its answer the contract's wake stays owed but is NOT redelivered —
+// the answer (re = the ask's id, or any direct word from the assigner) is what releases it.
+let awaitingAsk = null;
+// The bus is the record of a turn that ended by ASKING: an open kind:ask contract from this
+// session. deliverWake judges each clean wake turn against /contracts — an open ask renames the
+// ledger row "asked" and HOLDS the wake (no failure count, no backoff, no park) until the answer.
+let turnAsk = null;
+async function askJudge() {
+  try {
+    const r = await api(`/contracts?session=${encodeURIComponent(SESSION)}&project=${encodeURIComponent(PROJ)}`);
+    // abandonedContracts included on purpose: an ask to a gone-quiet assigner is exactly the ask
+    // that must keep holding, and the hub files those rows under their own key (#7079).
+    const rows = [...(r?.contracts || []), ...(r?.abandonedContracts || [])];
+    const open = rows.filter(c => c.kind === "ask" && !c.answered);
+    turnAsk = open.length ? { id: open[open.length - 1].id, to: String(open[open.length - 1].to || "") } : null;
+    return turnAsk ? "asked" : null;
+  } catch { return null; }
+}
 function savePending(wake, bcast) {
   try {
-    if (!wake.length && !bcast.length) { try { unlinkSync(PENDF); } catch {} return; }
-    writeFileSync(PENDF, JSON.stringify({ agent: AGENT, project: PROJ, ts: Date.now(), wake, bcast }));
+    // the seen-set (#7778) and a held ask (#7756) keep the file alive even with both queues empty:
+    // the dedupe ledger outlives the deliveries it guards, and a restarted runner must wait for
+    // the answer instead of redelivering the very contract the seat already asked about.
+    if (!wake.length && !bcast.length && !seenLedger.length && !awaitingAsk) { try { unlinkSync(PENDF); } catch {} return; }
+    writeFileSync(PENDF, JSON.stringify({ agent: AGENT, project: PROJ, ts: Date.now(), wake, bcast, seen: seenLedger, ask: awaitingAsk?.id || 0, askTo: awaitingAsk?.to || "" }));
   } catch {}
 }
 function loadPending() {
   try {
     const j = JSON.parse(readFileSync(PENDF, "utf8"));
-    return { wake: Array.isArray(j.wake) ? j.wake : [], bcast: Array.isArray(j.bcast) ? j.bcast : [] };
-  } catch { return { wake: [], bcast: [] }; }
+    return {
+      wake: Array.isArray(j.wake) ? j.wake : [],
+      bcast: Array.isArray(j.bcast) ? j.bcast : [],
+      seen: Array.isArray(j.seen)
+        ? j.seen.filter(e => e && Number.isFinite(Number(e.id))).map(e => ({ id: Number(e.id), ts: Number(e.ts) || 0 }))
+        : [],
+      ask: Number(j.ask) || 0, askTo: String(j.askTo || ""),
+    };
+  } catch { return { wake: [], bcast: [], seen: [], ask: 0, askTo: "" }; }
 }
 
 // Auth failures in TURN OUTPUT: opencode prints its auth error and still exits 0 (#5405). The rules
 // live in lib/classify-failure.mjs (#5868); runTurn judges only the CLI's own output, not the echo.
 function classify(exit) {
-  const { reason, matched } = classifyFailure(exit, lastErrText, lastEmptyOutput);
+  const { reason, matched } = classifyFailure(exit, lastErrText, lastEmptyOutput, lastEmptyTurn);
   log(`classified ${reason} because ${matched}`);
   return reason;
 }
@@ -507,6 +544,20 @@ async function notifyAssigners(pairs, text) {
   if (seen.size) log(`reported outcome to ${[...seen].join(", ")}`);
 }
 
+// #7759: bus activity is work. The hub's unified log already records sends and card moves/notes
+// with the actor (`by`), and GET /events filters by it — so the runner can see, with no new
+// endpoint, that the seat answered on the bus even when it printed nothing and touched no file.
+// Fail-open: an unreachable or older hub yields "no activity", the pre-fix behaviour.
+async function latestBusEventId() {
+  try { const r = await api("/events?limit=1"); return Number(r?.latest) || 0; } catch { return 0; }
+}
+async function busActivitySince(seq) {
+  try {
+    const r = await api(`/events?by=${encodeURIComponent(SESSION)}&since=${seq}&limit=500`);
+    return Array.isArray(r?.events) && r.events.some(e => Number(e?.id) > seq);
+  } catch { return false; }
+}
+
 async function reportHealthy() {
   if (consecFails === 0) return;        // already healthy — don't spam
   consecFails = 0;
@@ -632,6 +683,12 @@ async function runTurn(prompt, isFirst, trigger = "kickoff", opts = {}) {
   // exit-0 turn with real output must never be re-labelled "auth" by the #5405 escalation — the
   // qwen specimen committed aa3c340 while its captured stream still tripped the auth regex.
   const headBefore = gitOut(["rev-parse", "HEAD"], TURN_DIR);
+  // #7759: the worktree snapshot the turn is judged against at its end — porcelain covers edits
+  // AND new untracked files, which a HEAD-only comparison misses.
+  const statusBefore = gitOut(["status", "--porcelain"], TURN_DIR);
+  // #7759: the bus event cursor the turn is judged against — anything the seat posts after this
+  // (relay_send, a card move or note) is bus activity, which counts as work.
+  const busSeqBefore = await latestBusEventId();
   // #6154: a pinned seat with no sid yet resumes as FRESH — the guard below fails open, because
   // a resume without an id must fall back to a new session, never to `next`'s bare resume shape.
   let cmd = (isFirst || ((cli.sid || cli.pinned) && !sid)) ? cli.first : cli.next;
@@ -786,9 +843,18 @@ exit $turn_exit`;
     lastEmptyOutput = true;
     log("\x1b[31mexit 0 but the turn produced NO output — treating as FAILED (empty-output)\x1b[0m");
   }
+  // #7759: the turn is HOLLOW when it exited 0 having neither changed the worktree (HEAD or
+  // porcelain vs the turn-start snapshot, untracked included), said anything beyond CLI chrome,
+  // nor posted to the bus. Computed LAST and only when the escalations above did not claim the
+  // turn: an auth death or a null completion is never re-labelled empty (#7759, #5405, #5481).
+  const worktreeChanged = newCommit || gitOut(["status", "--porcelain"], TURN_DIR) !== statusBefore;
+  const busActive = await busActivitySince(busSeqBefore);
+  lastEmptyTurn = !cut && realExit === 0 && effExit === 0 && !authHit && !opts.state
+    && !worktreeChanged && !busActive && !substantiveOutput(ownOut);
+  if (lastEmptyTurn) log("\x1b[33mexit 0 but the turn was EMPTY — no worktree change, no substantive output, no bus activity\x1b[0m");
   // #5868: the verdict rides the telemetry row so a classification survives the pane scrolling
   // away — the same "classified X because Y" shape the runner logs, in the seat's jsonl forever.
-  const verdict = verdictFor(realExit, effExit, lastEmptyOutput, ownOut);
+  const verdict = verdictFor(realExit, effExit, lastEmptyOutput, ownOut, lastEmptyTurn);
   // #6134: what the turn COST, from the CLI's own usage line. Zero means this CLI printed none —
   // never that the turn was free. `trantor seat-why` totals these into today's spend per seat.
   let tokens = parseTurnTokens(ownOut);
@@ -801,8 +867,14 @@ exit $turn_exit`;
   // #6289: every ledger row names in ONE field what happened to the turn — cut (the box ended it),
   // api-error (the CLI failed), completed — and what it cost in tokens, even when this CLI printed
   // no usage line (0 means "not reported", never "free"). `cut` stays too: the drills read it.
-  const outcome = cut ? "cut" : (effExit !== 0 ? "api-error" : "completed");
-  const telemetryRow = { ts: Date.now(), agent: AGENT, project: PROJ, turn: TURN, trigger, model: MODEL || "cli-default", duration_ms: Date.now() - t0, exit: realExit, effExit, authFailed: effExit !== realExit, emptyOutput: lastEmptyOutput, verdict, outcome, tokens };
+  const outcome = cut ? "cut" : (effExit !== 0 ? "api-error" : lastEmptyTurn ? "empty" : "completed");
+  // #7756: a clean turn that ASKED its assigner is demoted-but-owed, not "completed". The judge
+  // (deliverWake's /contracts read) renames the ledger row, so "asked" is what the log keeps.
+  let finalOutcome = outcome;
+  if (outcome === "completed" && opts.judgeOutcome) {
+    try { finalOutcome = (await opts.judgeOutcome()) || outcome; } catch {}
+  }
+  const telemetryRow = { ts: Date.now(), agent: AGENT, project: PROJ, turn: TURN, trigger, model: MODEL || "cli-default", duration_ms: Date.now() - t0, exit: realExit, effExit, authFailed: effExit !== realExit, emptyOutput: lastEmptyOutput, emptyTurn: lastEmptyTurn, verdict, outcome: finalOutcome, tokens };
   if (cut) telemetryRow.cut = true;
   telemetry(telemetryRow);
   log(`turn ended (exit ${realExit}${effExit !== realExit ? ` → effective ${effExit} (${lastEmptyOutput ? "empty-output" : "auth"})` : ""}, ${((Date.now() - t0) / 1000).toFixed(0)}s)`);
@@ -944,16 +1016,6 @@ function isContract(message) {
   return message?.kind === "contract" || /^\s*contract\s*:/i.test(text) || CARD_REF_RE.test(text);
 }
 
-function isRunnerSession(session) {
-  const suffix = `:${PROJ}`;
-  const name = String(session || "");
-  if (!name.endsWith(suffix)) return false;
-  const label = name.slice(0, -suffix.length);
-  // Crew labels are CLI/provider slugs. Host sessions keep their machine-style identity and remain
-  // valid direct assigners; runner-to-runner prose needs `contract:` or a card reference.
-  return /^[a-z0-9_.-]+$/.test(label) && !label.startsWith("hub:");
-}
-
 // A hub staleness alert describes a moment, so it EXPIRES; a peer's message never does, because a
 // seat missing a teammate's request is the failure this bus exists to prevent.
 const HUB_ALERT_TTL_MS = Number(process.env.TRANTOR_HUB_ALERT_TTL_MS || 30 * 60_000);
@@ -969,12 +1031,12 @@ function shouldWake(message) {
   // into the next turn's prompt like a broadcast and never buys a CLI session of its own.
   if (message?.wake === false) return false;
   if (message?.to === SESSION) {
+    // #7766: with wake unset or true the sender's flag IS the decision. No keyword, card or
+    // sender-shape heuristic on the body second-guesses a direct message any more, so a plain
+    // question buys its turn. kind:status stays chatter; what is still demoted tells the sender
+    // (see the demotion notice at the wake split).
     if (message?.kind === "status") return false;
-    // Safety net for senders that never set the flag: a direct message carrying no card and no
-    // instruction is context. Typed alerts and overseer warnings still wake (#5760).
-    const typed = message?.kind === "alert" || /^🤝 OVERSEER /.test(String(message?.text || ""));
-    if (!typed && !isContract(message) && !carriesWork(message?.text)) return false;
-    return !isRunnerSession(message?.from) || isContract(message);
+    return true;
   }
   return message?.to === "all"
     && isContract(message)
@@ -1028,6 +1090,12 @@ function askedExcerpt(message) {
   // broadcasts batched behind them. Restored from disk first: a runner that was killed mid-turn
   // (or a machine that rebooted) still owes those messages, and the hub will never send them again.
   const restored = loadPending();
+  seenLedger = restored.seen;
+  if (seenLedger.length) log(`\x1b[33m${seenLedger.length} consumed message id(s) restored from the pending file — the poll keeps standing down on them\x1b[0m`);
+  if (restored.ask) {
+    awaitingAsk = { id: restored.ask, to: restored.askTo };
+    log(`resuming a held ask (#${awaitingAsk.id}) — the queue stays owed until ${awaitingAsk.to || "the assigner"} answers`);
+  }
   // Say what the restore SHED, not just what it kept. A queue that quietly halves itself on restart
   // is indistinguishable from one that lost real work, and this is the moment the expiry above
   // actually bites — a wedged seat comes back carrying only what still means something.
@@ -1050,6 +1118,10 @@ function askedExcerpt(message) {
   stateSkip("kickoff");
   const ec0 = await runTurn(composedTurn({ base: KICKOFF, lessons: pickLessons(LESSONS_RAW, "") }), true, "kickoff");
   if (ec0) await reportFailure(ec0, "kickoff", pendingWake.length);   // a failed kickoff = the "fired up, died, nobody knew" case
+  // #7778: the kickoff is a turn like any other — a message that landed mid-kickoff and was read
+  // through the session's own inbox is consumed by a successful kickoff, and the first poll must
+  // not wake on it. Same reconcile, same clean-boundary rule as deliverWake below.
+  else await reconcileSessionReads(cursor);
   let lastTurnAt = Date.now();
   if (PULSE_MS) log(`pulse armed — mission re-read every ${Math.round(PULSE_MS / 1000)}s (${MISSION_FILE})`);
   log(`parked — long-polling the bus as ${SESSION} (free; this poll is also the heartbeat)`);
@@ -1060,18 +1132,21 @@ function askedExcerpt(message) {
     if (PULSE_MS && Date.now() - lastTurnAt >= PULSE_MS) {
       stateSkip("pulse");
       const ecp = await runTurn(composedTurn({ base: PULSE_PROMPT + "\n\n", rulesText: RULES, lessons: pickLessons(LESSONS_RAW, PULSE_PROMPT) }), false, "pulse");
-      if (ecp) await reportFailure(ecp, "pulse"); else await reportHealthy();
+      // #7778: a pulse turn is also a clean boundary when it succeeds — same reconcile rule.
+      if (ecp) await reportFailure(ecp, "pulse");
+      else { await reconcileSessionReads(cursor); await reportHealthy(); }
       lastTurnAt = Date.now();
       log("parked — waiting for the next message or pulse");
       continue;
     }
     // A due REDELIVERY runs before we go back to waiting — during an outage the bus is silent by
     // definition, so the retry timer is the only thing that will ever move these messages.
-    if (pendingWake.length && Date.now() >= retryAt) { await deliverWake(); continue; }
+    // #7756: a held ask is owed but NEVER redelivered — only the assigner's answer releases it.
+    if (pendingWake.length && !awaitingAsk && Date.now() >= retryAt) { await deliverWake(); continue; }
     // cap the long-poll hold so neither a due pulse nor a due redelivery waits out a silent 280s window
     const due = [];
     if (PULSE_MS) due.push(PULSE_MS - (Date.now() - lastTurnAt));
-    if (pendingWake.length) due.push(retryAt - Date.now());
+    if (pendingWake.length && !awaitingAsk) due.push(retryAt - Date.now());
     const holdS = due.length
       ? Math.max(5, Math.min(280, Math.ceil(Math.min(...due) / 1000)))
       : 280;
@@ -1100,12 +1175,43 @@ function askedExcerpt(message) {
     // reply-linked outcomes, and the old stable marker before direct-address logic sees them. Status
     // broadcasts are presence chatter and are dropped rather than saved as future prompt context.
     msgs = msgs.filter(m => !isReceipt(m) && !isStatusBroadcast(m));
+    // #7778: ids in the seen-set were already handed to the model through the session's own inbox
+    // read mid-turn (the reconcile at the last clean turn boundary recorded them). The poll still
+    // serves them — it filters by THIS runner's cursor, not the shared ledger — so the second
+    // reader stands down here, and the cursor adopts the consumed ids so the hub stops re-serving.
+    // Filtering BEFORE the wake/bcast split keeps a dupe out of the demoted-sender notice too:
+    // the seat DID turn on that message, and #7766's notice must not say otherwise.
+    if (seenLedger.length) {
+      const seenIds = new Set(seenLedger.map(e => e.id));
+      const dupes = msgs.filter(m => seenIds.has(m.id));
+      if (dupes.length) {
+        log(`duplicate delivery suppressed — ${dupes.map(m => `#${m.id}`).join(", ")} already consumed by the session's own inbox read`);
+        msgs = msgs.filter(m => !seenIds.has(m.id));
+        const top = Math.max(...dupes.map(m => m.id));
+        if (top > cursor) cursor = top;
+        seenLedger = seenLedger.filter(e => e.id > cursor);
+      }
+    }
     // #5760: the hub's hourly same-project-sessions FYI is coordination context, batched like a
     // broadcast; file-conflict and linked-activity overseer warnings still wake.
     const fyi = msgs.filter(m => m.from === "hub:duty" && String(m.text || "").startsWith("🤝 OVERSEER same-project-sessions"));
     const rest = msgs.filter(m => !fyi.includes(m));
     const direct = rest.filter(m => m.to === SESSION && shouldWake(m));
     const mentions = rest.filter(m => m.to === "all" && shouldWake(m));
+    // #7766: a direct message that is STILL demoted to context tells its SENDER in one line, so a
+    // dropped ask is visible instead of looking like a dead seat. Two demotions stay silent: the
+    // sender's own wake:false, and kind:status chatter — this notice is itself kind status, so
+    // answering one would loop. What remains today is the expired hub alert.
+    const demotedSenders = new Set();
+    for (const m of rest) {
+      if (m.to !== SESSION || direct.includes(m) || m.wake === false || m.kind === "status") continue;
+      const who = String(m.from || "");
+      if (!who || who === SESSION || demotedSenders.has(who)) continue;
+      demotedSenders.add(who);
+      log(`\x1b[33mdirect message demoted to context\x1b[0m — telling ${who}`);
+      api("/send", { from: SESSION, to: who, project: senderProjectOf(who) || PROJ, kind: "status",
+        text: `ℹ️ ${SESSION} did not turn on your direct message — demoted to context: "${askedExcerpt(m)}". Re-send citing a card if it still needs a turn` }).catch(() => {});
+    }
     // #6134: messages that do not earn a turn still become context, including direct acks.
     // #7430: stale hub alerts are shed HERE too, not only at boot — one that arrives already past
     // its TTL must not sit in every prompt until the next successful turn clears the batch.
@@ -1136,6 +1242,15 @@ function askedExcerpt(message) {
         kind: "status", text: `⚠️ ${SESSION} dropped ${dropped.length} undelivered message(s) — queue hit its ${PENDING_MAX} cap during a failure streak` }).catch(() => {});
     }
     savePending(pendingWake, pendingBcast);
+    // #7756: the assigner's answer releases a held ask — by `re` on the ask's id, or any direct
+    // word from the assigner (an older peer answers untagged). The owed contract is still queued
+    // ahead of it, so the resumed turn reads the contract re-attached above the answer.
+    if (awaitingAsk && wake.some(m => m.to === SESSION && (Number(m.re) === awaitingAsk.id || m.from === awaitingAsk.to))) {
+      log(`answer to ask #${awaitingAsk.id} landed — resuming with the contract re-attached`);
+      awaitingAsk = null;
+      savePending(pendingWake, pendingBcast);
+    }
+    if (awaitingAsk) { log(`holding for the answer to ask #${awaitingAsk.id} — ${wake.length} new message(s) queued behind it`); continue; }
     // Respect an active backoff: a new message during an outage joins the batch, it does not
     // reset the clock and hammer a CLI that is already failing.
     if (Date.now() < retryAt) { log(`queued — ${pendingWake.length} undelivered, next attempt in ${Math.max(0, Math.round((retryAt - Date.now()) / 1000))}s`); continue; }
@@ -1145,6 +1260,31 @@ function askedExcerpt(message) {
 
   // Run the pending batch. The messages are cleared ONLY on exit 0; any other outcome leaves them
   // queued, on disk, with a backoff — which is the whole point of the change.
+  // #7778 — one message, one delivery, whichever path sees it first. The session's own inbox read
+  // and this runner's /poll are two readers of one bus with no shared cursor: a message the seat
+  // read and answered MID-TURN was re-polled after the turn and woken AGAIN (seen live: a seat
+  // answered inside its turn, then a second turn 16s later re-quoted the same message verbatim).
+  // The hub's deliveredUpTo is the one ledger both paths already write, so at a CLEAN turn
+  // boundary every id above our poll cursor but at-or-below it was necessarily consumed by the
+  // session-side path. Those ids go into the persisted seen-set; the poll filter stands the
+  // second reader down. A failed, parked or hollow turn reconciles NOTHING — dedupe must never
+  // swallow a message the seat still owes, so only full success is trusted to mark history read.
+  async function reconcileSessionReads(upToCursor) {
+    try {
+      const peer = await api(`/peer?session=${encodeURIComponent(SESSION)}`);
+      const readUpTo = Number(peer?.deliveredUpTo || 0);
+      // A delta wider than one turn could plausibly carry is a corrupt or rewound ledger: mark
+      // nothing. Non-marking only risks the duplicate this fixes, never a lost message.
+      if (!(readUpTo > upToCursor) || readUpTo - upToCursor > 10000) return 0;
+      for (let id = upToCursor + 1; id <= readUpTo; id++) seenLedger.push({ id, ts: Date.now() });
+      seenLedger = seenLedger.filter(e => e.id > upToCursor).slice(-500);
+      // persist HERE, at every caller: a runner killed seconds after the boundary is exactly the
+      // restart the restored seen-set exists for.
+      savePending(pendingWake, pendingBcast);
+      log(`dedupe: message id(s) ${upToCursor + 1}..${readUpTo} were consumed by the session's own inbox read — the poll will not wake on them again`);
+      return readUpTo - upToCursor;
+    } catch { return 0; }
+  }
   async function deliverWake() {
     const wake = pendingWake;
     const dutyPlan = DUTY_NUDGES
@@ -1220,6 +1360,7 @@ function askedExcerpt(message) {
     });
     const stopDutyNudgeWatcher = startDutyNudgeWatcher(dutyPlan, tStart);
     let ec;
+    turnAsk = null;   // #7756: the judge reads THIS turn's ending, never a previous turn's ask
     const stateStep = !stateSkip("wake", card);
     try {
       ec = stateStep
@@ -1231,7 +1372,7 @@ function askedExcerpt(message) {
           // dies quietly (§4.6).
           observation: [stateObservation, wakeText, ctxText, againText + freshText].filter(Boolean).join("\n"),
         })
-        : await runTurn(prompt, fresh, deliveryFails ? `${trigger} (redelivery)` : trigger);
+        : await runTurn(prompt, fresh, deliveryFails ? `${trigger} (redelivery)` : trigger, { judgeOutcome: askJudge });
     }
     finally { stopDutyNudgeWatcher(); }
     const secs = Math.round((Date.now() - tStart) / 1000);
@@ -1313,8 +1454,36 @@ function askedExcerpt(message) {
       await notifyAssigners(assigners,
         `⚠️ your contract FAILED on ${SESSION} (exit ${ec}, ${reason}) · retrying in ${Math.round(wait / 1000)}s · asked: "${asked}"`);
       log(`\x1b[31m${pendingWake.length} message(s) still UNDELIVERED — next attempt in ${Math.round(wait / 1000)}s\x1b[0m`);
+    } else if (turnAsk) {
+      // #7756: a clean exit that ASKED is not "done". The wake stays owed — queued on disk with
+      // the ask's id, so a restart keeps holding — and the failure ladder never sees it. The
+      // assigner is NOT notified here: the kind:ask message itself is already that notification.
+      awaitingAsk = turnAsk; turnAsk = null;
+      savePending(pendingWake, pendingBcast);
+      await reportHealthy();
+      log(`turn asked its assigner — holding the contract until ask #${awaitingAsk.id} is answered`);
+    } else if (lastEmptyTurn) {
+      // #7759: the turn exited 0 but was HOLLOW — a banner is not work. The wake is NOT
+      // consumed: the queue is kept and the ladder retries, and the assigner hears EMPTY,
+      // never "done". Second hollow attempt in a row parks the seat, like a failed turn.
+      deliveryFails++;
+      savePending(pendingWake, pendingBcast);
+      if (deliveryFails >= 2) {
+        retryAt = await parkSeat("empty-turn", pendingWake.length);
+        await notifyAssigners(assigners,
+          `⛔ your contract is PARKED on ${SESSION} (empty-turn: two exit-0 turns with no worktree change, substantive output or bus activity) · asked: "${asked}"`);
+        lastTurnAt = Date.now();
+        return;
+      }
+      const wait = RETRY_MS[Math.min(deliveryFails - 1, RETRY_MS.length - 1)];
+      retryAt = Date.now() + wait;
+      log(`\x1b[33mturn was EMPTY — wake not consumed, ${pendingWake.length} message(s) stay owed; retrying in ${Math.round(wait / 1000)}s\x1b[0m`);
+      await notifyAssigners(assigners,
+        `🫥 EMPTY turn on ${SESSION} (exit 0, ${secs}s — no worktree change, no substantive output, no bus activity) · wake stays owed · retrying in ${Math.round(wait / 1000)}s · asked: "${asked}"`);
     } else {
       pendingWake = []; pendingBcast = []; deliveryFails = 0; retryAt = 0;
+      // #7778: reconcile BEFORE the write below so the persisted snapshot carries the seen-set.
+      await reconcileSessionReads(cursor);
       savePending([], []);
       await reportHealthy();
       await notifyAssigners(assigners,

package/bin/harvest.mjs

@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+// `trantor harvest <seat-sha> <main-sha> [--card N]` (#7748): the receipt for a hand-made cherry-pick
+// or squash. The receipt is what lets `trantor sync` realign the seat branch later.
+import { resolveProject, hostId } from "../lib/project.mjs";
+import { recordHarvest, receiptsPath, run } from "../lib/harvest.mjs";
+import { signedPost } from "../hooks/lib/api.mjs";
+
+const args = process.argv.slice(2);
+const flag = (name) => { const i = args.indexOf(`--${name}`); return i >= 0 ? args[i + 1] : ""; };
+const positional = args.filter((a, i) => !a.startsWith("--") && !(i > 0 && args[i - 1].startsWith("--") && !args[i - 1].startsWith("--no-")));
+const [seatArg, mainArg] = positional;
+if (!seatArg || !mainArg || args.includes("--help")) {
+  console.error("usage: trantor harvest <seat-sha> <main-sha> [--card N] [--seat <agent>] [--project <p>] [--no-note]");
+  process.exit(seatArg && mainArg ? 0 : 1);
+}
+
+const repo = process.cwd();
+const project = flag("project") || resolveProject(repo);
+const resolve = (s) => run(repo, ["rev-parse", "--verify", "-q", `${s}^{commit}`]).out || String(s).trim();
+const seat = resolve(seatArg), main = resolve(mainArg);
+if (!run(repo, ["rev-parse", "--verify", "-q", `${mainArg}^{commit}`]).ok) {
+  console.error(`harvest: ${mainArg} is not a commit in ${repo}`);
+  process.exit(1);
+}
+let branch = flag("seat") ? `seat/${flag("seat")}` : "";
+if (!branch) {
+  const holders = run(repo, ["branch", "--list", "seat/*", "--contains", seat, "--format=%(refname:short)"]).out;
+  branch = holders.split("\n").filter(Boolean)[0] || "";
+}
+
+let receipt;
+try { receipt = recordHarvest(project, { seat, main, card: flag("card"), branch, by: "harvest" }); }
+catch (e) { console.error(`harvest: ${e.message}`); process.exit(1); }
+const line = `harvested ${receipt.seat.slice(0, 7)} as ${receipt.main.slice(0, 7)}`;
+console.log(`${line}${branch ? ` (${branch})` : ""}${receipt.card ? ` · card #${receipt.card}` : ""} → ${receiptsPath(project)}`);
+
+if (receipt.card && !args.includes("--no-note")) {
+  const me = `${hostId()}:${project}`;
+  const r = await signedPost("/task/update", { id: receipt.card, note: line, by: me, project }, { session: me, project });
+  if (r.ok) console.log(`card #${receipt.card} noted: ${line}`);
+  else console.error(`warning: card #${receipt.card} not noted (${r.status || r.reason || "hub unreachable"}); the receipt is recorded`);
+}

package/bin/integrate.mjs

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 // `trantor integrate` — collect the crew's work, prove it, ship it.
-//
 // The steps are the ones the orchestrator already performs by hand. The dials decide how far it is
 // allowed to go on its own, and every stop says which dial stopped it, so "why didn't it push"
 // always has an answer.
 import { resolveProject } from "../lib/project.mjs";
 import { resolveAutonomy } from "../lib/autonomy.mjs";
 import { seatWorktrees, commitSeatWork, seatAhead, mergeSeat, verify, git } from "../lib/integrate.mjs";
+import { recordHarvest } from "../lib/harvest.mjs";
 
 const D = "\x1b[2m", B = "\x1b[1m", G = "\x1b[32m", Y = "\x1b[33m", RED = "\x1b[31m", R = "\x1b[0m";
 const args = process.argv.slice(2);
@@ -53,7 +53,14 @@ for (const w of seats) {
     blocked = true;
     continue;
   }
-  if (m.merged) { console.log(`  ${G}merged ${branch} (${ahead} commit(s))${R}`); merged.push(branch); }
+  if (m.merged) {
+    console.log(`  ${G}merged ${branch} (${ahead} commit(s))${R}`);
+    merged.push(branch);
+    // #7748: the receipt `trantor sync` reads later; a merge keeps the seat shas, so this one is
+    // the seat tip -> the merge commit.
+    try { recordHarvest(project, { seat: git(w.dir, ["rev-parse", branch]), main: git(repo, ["rev-parse", "HEAD"]), branch, by: "integrate" }); }
+    catch (e) { console.log(`  ${Y}${branch}: receipt not written (${e.message})${R}`); }
+  }
 }
 
 if (blocked) {

package/bin/sync.mjs

@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+// `trantor sync [<seat>]` (#7748): realign a seat branch with main from the harvest receipts.
+// Every commit main lacks must carry a receipt; otherwise the sync refuses and names them.
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { resolveProject, busDir } from "../lib/project.mjs";
+import { syncSeat, receiptsPath } from "../lib/harvest.mjs";
+
+const D = "\x1b[2m", G = "\x1b[32m", Y = "\x1b[33m", RED = "\x1b[31m", R = "\x1b[0m";
+const args = process.argv.slice(2);
+const flag = (name) => { const i = args.indexOf(`--${name}`); return i >= 0 ? args[i + 1] : ""; };
+const seat = args.find((a, i) => !a.startsWith("--") && !(i > 0 && args[i - 1] === "--project"));
+if (args.includes("--help")) {
+  console.log("usage: trantor sync [<seat>] [--project <p>] [--dry-run] [--no-fetch]   (no seat: the worktree you are in)");
+  process.exit(0);
+}
+
+const project = flag("project") || resolveProject(process.cwd());
+const dir = seat ? join(busDir(), "worktrees", project, seat) : process.cwd();
+if (seat && !existsSync(join(dir, ".git"))) {
+  console.error(`sync: no worktree for seat '${seat}' at ${dir}`);
+  process.exit(1);
+}
+
+const r = syncSeat(dir, { dryRun: args.includes("--dry-run"), fetch: !args.includes("--no-fetch"), project });
+const short = (s) => String(s || "").slice(0, 7);
+if (r.refused) {
+  console.log(`${RED}sync refused${R} · ${r.branch} carries ${r.unharvested.length} commit(s) ${r.target.ref} does not, with no harvest receipt:`);
+  for (const c of r.unharvested) console.log(`  ${short(c.sha)}  ${c.subject}`);
+  if (r.harvested.length) console.log(`${D}${r.harvested.length} other commit(s) are receipted and would be dropped once these are.${R}`);
+  console.log(`${D}Harvest them (trantor harvest <seat-sha> <main-sha> --card N) or park them on another branch first. Receipts: ${receiptsPath(project)}${R}`);
+  process.exit(1);
+}
+if (!r.ok) { console.error(`${RED}sync failed${R}: ${r.reason}`); process.exit(1); }
+if (r.noop) { console.log(`${D}${r.branch} already at ${r.target.ref} (${short(r.head)})${R}`); process.exit(0); }
+const dropped = r.harvested.map(c => `${short(c.sha)}→${short(c.receipt.main)}`).join(", ");
+if (r.dry) {
+  console.log(`${Y}[dry]${R} would move ${r.branch} ${short(r.head)} → ${r.target.ref} ${short(r.target.sha)}${dropped ? ` ${D}(receipted: ${dropped})${R}` : ""}`);
+  process.exit(0);
+}
+console.log(`${G}synced${R} ${r.branch} ${short(r.from)} → ${r.target.ref} ${short(r.to)}${dropped ? ` ${D}(receipted: ${dropped})${R}` : ""}`);

package/hooks/lib/api.mjs

@@ -10,6 +10,7 @@ import { loadOrCreate, loadOrCreateInstance } from "../../lib/identity.mjs";
 import { sfetchJson } from "../../lib/signed-fetch.mjs";
 
 export const DEFAULT_TIMEOUT_MS = 1500;
+export const WRITE_TIMEOUT_MS = 8000;   // #7755: writes get their own budget above the read default
 
 // Hub URL, PER-PROJECT (TDD §12.1): env RELAY_URL, then config `hubs[project]`, then the legacy global
 // `url`, then the local default. Never throws, keeping hooks fail-open.
@@ -175,12 +176,25 @@ export async function signedGet(pathOrUrl, { timeoutMs = DEFAULT_TIMEOUT_MS, ses
 }
 
 // Signed POST → { ok, status, json|null }. Never throws.
-export async function signedPost(pathOrUrl, payload, { timeoutMs = DEFAULT_TIMEOUT_MS, session, instance, project } = {}) {
+// #7755: writes keep their own timeout, and a write carrying `_op` resolves a timeout through
+// one GET /_op — committed returns the stored body as success, rejected returns the stored refusal,
+// unknown reads "ambiguous: timed out, outcome unknown". Never a bare failure for a write that landed.
+export async function signedPost(pathOrUrl, payload, { timeoutMs = WRITE_TIMEOUT_MS, session, instance, project } = {}) {
   const proj = projectOf(project, payload, pathOrUrl);
   const sess = session || sessionFor(proj);
   const durable = loadIdentity(sess);
   const id = instance ? loadInstance(sess, instance) : durable;
   await ensureEnrolled(sess, durable, proj);     // instances never enroll — the DURABLE key does
+  const resolveOp = async (f) => {
+    const op = String(payload?._op || "");
+    if (!f.timedOut || !op) return f;
+    const base = new URL(toUrl(pathOrUrl, proj)).origin;
+    const q = await signedGet(`${base}/_op?id=${encodeURIComponent(op)}`, { session: sess, instance, project: proj });
+    const st = q.ok ? q.json?.status : "unknown";
+    if (st === "committed") return { ok: true, status: q.json.code || 200, json: q.json.body, resolved: "committed" };
+    if (st === "rejected") return { ok: false, status: q.json.code || 400, json: q.json.body, resolved: "rejected" };
+    return { ...f, ambiguous: true, reason: "ambiguous: timed out, outcome unknown" };
+  };
   try {
     // sfetchJson (FROZEN) stringifies the payload + signs with `id` in one call — the single shape
     // every client uses (lib/signed-fetch.mjs). We pass our memoised identity so it doesn't re-load.
@@ -200,5 +214,5 @@ export async function signedPost(pathOrUrl, payload, { timeoutMs = DEFAULT_TIMEO
     const text = await r.text();
     let json = null; try { json = text ? JSON.parse(text) : null; } catch {}
     return { ok: true, status: r.status, json };
-  } catch (e) { return failure(e, timeoutMs); }
+  } catch (e) { return resolveOp(failure(e, timeoutMs)); }
 }