trantor 0.18.57 → 0.18.59

package/hooks/lib/hollow-move.mjs

@@ -0,0 +1,53 @@
+// #7750 — seat-side hollow-move check: the hub is remote and cannot see a seat's worktree, so on
+// a move to testing/done mcp.mjs diffs the worktree against the sha recorded at `doing`, reads
+// checklist ticks and scans the note for a test command. All missing + no declared no-code
+// outcome → the move still lands, note prefixed HOLLOW:, assigner told on the bus.
+import { execFileSync } from "node:child_process";
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+// A "test command" is a command shape or a pass count — the note contract already demands both.
+const TEST_CMD_RE = /(node\s+test\/|npm\s+(run\s+)?test|pnpm\s+test|yarn\s+test|vitest|pytest|go\s+test|cargo\s+test|make\s+test|\b\d+\s*\/\s*\d+\b|\b\d+\s+passed\b)/i;
+// Declared no-code outcomes (#7750: docs, investigation, refusal, answered on the bus) — a card
+// that says one of these is NEVER flagged, however empty its worktree is.
+const NOCODE_RE = /\b(no[- ]code|docs?[- ]only|investigat\w*|read[- ]only|research[- ]only|analysis[- ]only|answered (on|in) the bus|refus\w+|declin\w+|won'?t fix)\b/i;
+
+export const hasTestCommand = (note) => TEST_CMD_RE.test(String(note || ""));
+export const declaresNoCode = (note) => NOCODE_RE.test(String(note || ""));
+
+function git(cwd, args) {
+  return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+}
+
+// Per-worktree, keyed by card id: <git-dir> is the worktree's OWN dir under a linked worktree
+// (…/.git/worktrees/<seat>), so seats never share each other's bases.
+const basePath = (cwd) => join(git(cwd, ["rev-parse", "--git-dir"]), "hollow-base.json");
+
+// Snapshot HEAD when a card is taken (doing); the testing/done check diffs against this sha.
+export function markDoing(cwd, id) {
+  try {
+    const p = basePath(cwd);
+    let map = {};
+    try { map = JSON.parse(readFileSync(p, "utf8")); } catch { /* first card in this worktree */ }
+    map[id] = git(cwd, ["rev-parse", "HEAD"]);
+    writeFileSync(p, JSON.stringify(map));
+  } catch { /* not a git worktree — no base recorded, and hollowVerdict fails open */ }
+}
+
+// Verdict for a testing/done move. checked:false = no usable base (pre-#7750 card, non-git cwd,
+// base sha lost to a rebase) — fail open rather than flag on a base we cannot trust.
+export function hollowVerdict(cwd, id, note, checklist) {
+  let base;
+  try { base = JSON.parse(readFileSync(basePath(cwd), "utf8"))[id]; } catch { return { checked: false, hollow: false, missing: [] }; }
+  if (!base) return { checked: false, hollow: false, missing: [] };
+  const missing = [];
+  try {
+    // `git diff <base>` covers committed AND uncommitted tracked changes vs the taken-sha.
+    if (!git(cwd, ["diff", "--name-only", base, "--"])) missing.push("diff");
+    if (!git(cwd, ["ls-files", "--others", "--exclude-standard"])) missing.push("new files");
+  } catch { return { checked: false, hollow: false, missing: [] }; }
+  if (!(checklist || []).some((c) => c.done)) missing.push("ticked checklist items");
+  if (!hasTestCommand(note)) missing.push("test command in the note");
+  const hollow = missing.length === 4 && !declaresNoCode(note);
+  return { checked: true, hollow, missing };
+}

package/hub/reaper.mjs

@@ -82,12 +82,10 @@ function appendReaperStaleLog(t, reason, ts) {
   const lastSeen = seen ? `${humanMs(ts - seen)} ago` : "never";
   appendTaskLog(t, "reaper", `${reason}; owner last seen ${lastSeen}`, ts);
 }
-// The general stale-card reaper prunePeers never was. Every 60s:
-//  (a) close a focus card once its session has been OFFLINE past FOCUS_OFFLINE_MS (not the old 6h peer TTL).
-//  (b) move an OFFLINE-owner doing card to "stale" once it's untouched past REAP_GRACE_MS.
-// Testing is waiting for the operator's verdict and is therefore outside the reaper's authority.
-// It NEVER touches a card whose owner is still online, so a live long task is safe; the owner-alive-but-idle
-// "forgot its card" case is left to the explicit /sweep path (preview + confirm).
+// The general stale-card reaper prunePeers never was. Every 60s: (a) close a focus card whose
+// session is OFFLINE past FOCUS_OFFLINE_MS; (b) stale an offline-owner doing card past REAP_GRACE_MS.
+// Testing (the operator's verdict) and online owners are NEVER touched — the owner-alive-but-idle
+// case belongs to the explicit /sweep path (preview + confirm).
 function reapStaleCards() {
   const onCut = now() - ONLINE_MS;
   const focusCut = now() - FOCUS_OFFLINE_MS;
@@ -133,20 +131,10 @@ function reapStaleCards() {
 }
 setInterval(reapStaleCards, REAP_INTERVAL_MS).unref?.();
 
-// ---- the contract ledger -------------------------------------------------------------------
-// ONE derivation, shared by GET /contracts and the reaper below. Two copies of this is how you get
-// an endpoint and a sweeper that disagree about what is open, which is the same "two names for one
-// intent" mistake the spawn guards made.
-//
-// A contract is a DIRECT message from `session` to one peer. It closes when that peer answers:
-// strictly by `re`, or, for seats that predate that column, oldest-open-first. Excluded outright,
-// because none of these can ever be answered and so would hang open forever:
-//   - broadcasts (`to === "all"`)
-//   - self-dispatch (`from === to`) — a reply from yourself is never counted as an answer
-//   - the hub's own pseudo-identities (`hub:*`) and hub-authored mail — nothing polls them (0.17.87)
-// Durations an agent READS and acts on, so they must not round to nonsense. Minutes are the useful
-// unit in production (the abandon window is an hour), but the drills run in seconds and "past the 0m
-// abandon window" is a sentence that tells the reader nothing.
+// ---- the contract ledger: ONE derivation shared by GET /contracts and the reaper below ---------
+// A contract is a DIRECT message from `session` to one peer, closed when that peer answers:
+// strictly by `re`, or, for seats that predate that column, oldest-open-first. Broadcasts,
+// self-dispatch and hub:* identities are excluded — none can ever be answered (0.17.87).
 function humanMs(ms) {
   const n = Math.max(0, Number(ms) || 0);
   if (n < 60000) return `${Math.max(1, Math.round(n / 1000))}s`;
@@ -158,11 +146,10 @@ function contractRecipientIsAnswerable(m) {
   return !!m.to && m.to !== "all" && m.from !== m.to && !m.to.startsWith("hub:") && !m.from.startsWith("hub:");
 }
 
-// A direct message the SENDER declared owes nothing back (#7079). `wake:false` is the sender saying
-// "context, not a contract" — the send result even prints "(batched — no turn)" — and a `receipt` or
-// `status` is a report, not a request. None of these ever buys the recipient a turn, so none can be
-// answered; counted as contracts they age into `stalled` and block the dispatcher's stop hook over
-// work that was never owed (four times in one day, every row an ack to an idle seat).
+// A direct message the SENDER declared owes nothing back (#7079): `wake:false` ("context, not a
+// contract"), a `receipt`, or a `status` never buys the recipient a turn, so none can be answered —
+// counted as contracts they age into `stalled` and block the dispatcher's stop hook over work that
+// was never owed.
 function contractIsAck(m) {
   return m.wake === false || m.kind === "receipt" || m.kind === "status";
 }
@@ -175,10 +162,12 @@ function contractsFor(session, { project = "", windowMs = CONTRACT_WINDOW_MS, ov
   const mine = state.messages.filter(m =>
     m.from === session && m.ts >= cutoff && contractRecipientIsAnswerable(m) && (!project || m.project === project));
   const replies = state.messages.filter(m => m.to === session && m.from !== session && m.ts >= cutoff);
+  // #7756: an ask (kind:"ask") rides `re` to name the contract it QUESTIONS — it is not the answer.
+  // Counted as one, the contract would read answered while the seat sits blocked waiting.
   const byRe = new Map();
-  for (const r of replies) if (r.re) byRe.set(Number(r.re), r);
+  for (const r of replies) if (r.re && r.kind !== "ask") byRe.set(Number(r.re), r);
   const looseByPeer = new Map();
-  for (const r of replies) if (!r.re) { if (!looseByPeer.has(r.from)) looseByPeer.set(r.from, []); looseByPeer.get(r.from).push(r); }
+  for (const r of replies) if (!r.re && r.kind !== "ask") { if (!looseByPeer.has(r.from)) looseByPeer.set(r.from, []); looseByPeer.get(r.from).push(r); }
   for (const arr of looseByPeer.values()) arr.sort((a, b) => a.ts - b.ts);
 
   const out = [];
@@ -227,17 +216,8 @@ function contractsFor(session, { project = "", windowMs = CONTRACT_WINDOW_MS, ov
 
   // ---- superseded: the terminal state for a row nobody will ever answer ------------------------
   // `abandoned` keys on the ASSIGNEE being gone, so a permanently HEALTHY seat could strand a
-  // contract forever: it can never be answered (that seat's replies all carry `re` for other
-  // contracts, so the loose-reply fallback above never claims this one) and it can never be
-  // abandoned (the seat is alive). The row then blocks its dispatcher's stop hook every single
-  // turn, for days — observed on #10573 across two consecutive sessions.
-  //
-  // TWO signals must agree, because either alone is wrong. "The peer answered something newer" on
-  // its own would punish honest out-of-order completion — a seat handed three jobs may finish the
-  // third first and still be working the second, which is a real pattern this suite already drills.
-  // Age on its own would punish a seat legitimately grinding one long job. Together they are only
-  // true when the assignee is alive, has moved on to later work, AND the row has sat unanswered
-  // past the window in which any genuine in-flight job would have reported.
+  // contract forever — unanswerable, yet never abandoned — blocking the stop hook for days (#10573).
+  // Two signals must agree (a newer answer AND age past the window) so out-of-order completion is safe.
   const newestAnswered = new Map();
   for (const c of out) {
     if (c.answered && c.ts > (newestAnswered.get(c.to) || 0)) newestAnswered.set(c.to, c.ts);
@@ -248,20 +228,9 @@ function contractsFor(session, { project = "", windowMs = CONTRACT_WINDOW_MS, ov
     if (c.ts < (newestAnswered.get(c.to) || 0)) c.disposition = "superseded";
   }
   // ---- superseded by a later DIRECT reply: the morning case (#11047/#11048) --------------------
-  // A row can be unanswerable by a seat that is perfectly healthy: its later replies all carry `re`
-  // for NEWER contracts (a re-dispatch, or an "ack by reference" threaded to the newer id), so
-  // neither byRe nor the loose fallback ever claims the old row — the two matchers above only ever
-  // see replies aimed at the NEWER work. The row then sits WAITING forever: it can never be
-  // answered, it can never be abandoned (the seat is alive), and the newestAnswered rule above
-  // misses it whenever the newer work was dispatched under a peer identity the old row never shares.
-  //
-  // The signal both matchers ignored is the DIRECT reply itself: if the assignee has sent this
-  // session ANY message after the row was dispatched, the assignee is alive, reachable, and has
-  // demonstrably moved on to later work — an older row that has then sat unanswered past the
-  // abandon window is dead weight, not in flight. Age still gates it, so honest out-of-order
-  // completion (a seat that answered a newer job while still working an older one) is never
-  // punished — the older row stays open until the window that any genuine in-flight job would have
-  // reported within has passed.
+  // Both matchers above only see replies aimed at NEWER work, so a healthy seat whose replies are
+  // all `re`-threaded to newer contracts strands the old row even when newestAnswered misses it.
+  // ANY later direct reply + past the abandon window = moved on; age gates out-of-order completion.
   const latestDirectReply = new Map();
   for (const r of replies) {
     if (r.ts > (latestDirectReply.get(r.from) || 0)) latestDirectReply.set(r.from, r.ts);
@@ -285,10 +254,8 @@ function contractDispatchers(windowMs = CONTRACT_WINDOW_MS) {
 }
 
 // The contract reaper. Records — never invents an answer for — a contract whose assignee has been
-// quiet past CONTRACT_ABANDON_MS, so the abandonment survives a hub restart (in-memory-only state is
-// exactly why the escalation backlog re-fires on every restart) and shows up once in the FEED.
-// After this the contract stops counting as open, so it stops nagging every future session; it stays
-// listed with its evidence, so `relay_contracts` can still show what died.
+// quiet past CONTRACT_ABANDON_MS, persisted so the abandonment survives a hub restart and shows once
+// in the FEED. It stops counting as open but stays listed with its evidence for `relay_contracts`.
 function reapAbandonedContracts() {
   let changed = false;
   for (const session of contractDispatchers()) {

package/hub/routes/messages.mjs

@@ -4,7 +4,7 @@ import { setTimeout, setInterval, clearInterval } from "node:timers";
 export async function routeMessages({ req, res, q, P, auth, ctx }) {
   const {
     state, body, json, stripNulText, crossProjectGuard, touch, pushToStreams,
-    appendEvent, markDelivered, contractsFor, canUseInboxSession, inboxWindow,
+    appendEvent, appendCardEvent, appendTaskLog, markDelivered, contractsFor, canUseInboxSession, inboxWindow,
     deliverable, inboxReadable, inboxResponse, filterReadable, streams, UI,
     AUTH_MODE, persistHealth, duty, now, markDirty, assertNoSecrets,
     CONTRACT_WINDOW_MS,
@@ -39,20 +39,28 @@ export async function routeMessages({ req, res, q, P, auth, ctx }) {
       // that field is the card-event key, and /card must keep counting card events only.
       const refs = [...new Set((msg.text.match(/#(\d{1,7})(?![0-9])/g) || []).map(s => Number(s.slice(1))))].slice(0, 8);
       appendEvent("message", msg.project, msg.from, { msgId: msg.id, toSession: msg.to, text: msg.text.slice(0, 2000), refs });
+      // #7756: the ask primitive's board half — a kind:ask blocks the card it cites (the question is
+      // the note, so the board reads why nothing moves); the answer (re = the ask's id) unblocks it.
+      const askCardMove = (cardId, to, noteText) => {
+        const t = cardId && state.tasks.find(x => x.id === cardId && x.project === msg.project);
+        if (!t || t.status === to || (to === "doing" && t.status !== "blocked")) return;
+        const from = t.status;
+        (t.history ||= []).push({ from, to, by: msg.from, ts: now() });
+        if (t.history.length > 40) t.history.splice(0, 10);
+        t.status = to; t.updated = now();
+        appendTaskLog(t, msg.from, noteText); appendCardEvent("moved", t, msg.from, from, to); markDirty();
+      };
+      if (kind === "ask") askCardMove(refs[0] || 0, "blocked", msg.text);
+      else if (re) {
+        const opened = state.messages.find(m => m.id === re && m.kind === "ask");
+        if (opened) askCardMove(Number((String(opened.text).match(/#(\d{1,7})(?![0-9])/) || [])[1] || 0), "doing", `answered: ${text}`);
+      }
       return json(res, 200, { ok: true, id: msg.id });
     }
     // ---- /contracts: what this session dispatched and has not been answered on ----------------
-    // A contract is a DIRECT message from you to one peer. It closes when that peer sends you an
-    // outcome: strictly by `re`, or, for seats that predate it, oldest-open-first. Broadcasts are
-    // never contracts. Each open one carries the assignee's presence, because the actionable half
-    // of "still waiting" is whether anyone is still on the other end.
-    // ---- /delivered: an endpoint that has actually READ its mail says so ----------------------
-    // The desktop app lists with peek=1 on purpose, so it never steals a message from a session's
-    // delivery hooks. For a HUMAN endpoint there are no hooks — the app is the only reader — so
-    // sasha@mac's deliveredUpTo sat at 0 forever while mail piled up. dutyTick then escalated every
-    // message the human had already read, told the duty seat about it, the seat messaged the human,
-    // and that was undelivered too: about six escalations a minute, all about mail already read.
-    // Peeking stays the default; this lets a reader record delivery explicitly instead.
+    // Open contracts carry the assignee's presence — the actionable half of "still waiting" is
+    // whether anyone is on the other end. /delivered lets a HUMAN endpoint (the app peeks, never
+    // steals) record delivery explicitly, so duty stops escalating mail the human already read.
     if (req.method === "POST" && P === "/delivered") {
       const b = await body(req);
       const session = String(b.session || "");
@@ -73,19 +81,10 @@ export async function routeMessages({ req, res, q, P, auth, ctx }) {
       const overdueMs = Number.isFinite(rawOverdue) ? Math.max(0, rawOverdue) : null;
       const all = contractsFor(session, { project: String(q.project || ""), windowMs, overdueMs });
       const by = (d) => all.filter(c => c.disposition === d).length;
-      // Abandoned contracts leave `contracts` entirely and ride in their own key.
-      //
-      // Not cosmetic. A session's hooks are PINNED at session start, so an older stop hook iterates
-      // `contracts` with its own predicate and knows nothing about `disposition` — it kept blocking on
-      // ghosts no matter what the hub called them. Keeping them in the array meant the fix only
-      // reached sessions that restarted, and a live one nagged its operator every single turn.
-      // Splitting them out fixes every running session the moment the hub redeploys, and the ledger
-      // still shows what died via `abandonedContracts`.
-      // `superseded` leaves `contracts` for exactly the reason `abandoned` does: a session's hooks
-      // are PINNED at session start, so an older stop hook filters this array with its own
-      // predicate and would keep blocking on a row the hub has already settled.
-      // `ack` leaves `contracts` too (#7079): a `wake:false` send, a `receipt` or a `status` is the
-      // sender declaring nothing is owed, so an old pinned hook must never see it as a row to block on.
+      // Abandoned/superseded/ack contracts leave `contracts` and ride in their own keys (#7079).
+      // Not cosmetic: a session's hooks are PINNED at session start, so an older stop hook filters
+      // this array with its own predicate and would keep blocking on rows the hub already settled —
+      // splitting them out fixes every running session the moment the hub redeploys.
       const out = all.filter(c => c.disposition !== "abandoned" && c.disposition !== "superseded" && c.disposition !== "ack");
       return json(res, 200, {
         session, contracts: out, abandonedContracts: all.filter(c => c.disposition === "abandoned"),

package/hub.mjs

@@ -88,6 +88,28 @@ const overseer = createOverseer({
 });
 store.startChangeSubscription(() => events.pushEventToStreams({ ts: Date.now(), type: "hub.reload", project: "", by: "" }));
 
+// #7755: a write carrying `_op` replays its stored outcome on a retry, and GET /_op answers
+// committed / rejected / unknown, so a client timeout never has to guess whether the write landed.
+const opOutcomes = new Map();
+const OP_OUTCOME_WINDOW_MS = 3600000;
+setInterval(() => {
+  const cutoff = Date.now() - OP_OUTCOME_WINDOW_MS;
+  for (const [id, o] of opOutcomes) { if (o.ts < cutoff) opOutcomes.delete(id); }
+}, 60000).unref?.();
+const opIdOf = (b) => String(b?._op || "").slice(0, 80) || null;
+// Only a definite answer is stored: 2xx is committed, 4xx is rejected, a 5xx stays unknown.
+function recordOpOutcome(res, op) {
+  const end = res.end.bind(res);
+  res.end = (chunk, ...rest) => {
+    const code = res.statusCode;
+    if (code < 500 && !opOutcomes.has(op)) {
+      let body = null; try { body = chunk ? JSON.parse(String(chunk)) : null; } catch {}
+      opOutcomes.set(op, { ts: Date.now(), code, status: code < 400 ? "committed" : "rejected", body });
+    }
+    return end(chunk, ...rest);
+  };
+}
+
 let UI = "";
 try { UI = readFileSync(new URL("./ui.html", import.meta.url), "utf8"); } catch {}
 const context = {
@@ -111,6 +133,14 @@ const server = http.createServer(async (req, res) => {
     if (!auth.ok) return authRuntime.json(res, auth.code || 401, { error: auth.error || "unauthorized" });
     const authorization = authRuntime.authorize(auth, req.method, P, authRuntime.projectFromRequest(P, q, b0));
     if (!authorization.ok) return authRuntime.json(res, authorization.code || 403, { error: authorization.error || "forbidden" });
+    if (req.method === "GET" && P === "/_op") {
+      const o = opOutcomes.get(String(q.id || "").slice(0, 80));
+      return authRuntime.json(res, 200, o ? { status: o.status, code: o.code, body: o.body } : { status: "unknown" });
+    }
+    const op = req.method === "POST" ? opIdOf(b0) : null;
+    const seen = op ? opOutcomes.get(op) : null;
+    if (seen) return authRuntime.json(res, seen.code, seen.body);
+    if (op) recordOpOutcome(res, op);
     for (const route of routes) if (await route({ req, res, q, P, auth, ctx: context })) return;
     authRuntime.json(res, 404, { error: "not found" });
   } catch (error) {

package/lib/classify-failure.mjs

@@ -37,6 +37,24 @@ export function stripPromptEcho(errText, promptText) {
  *  printed its whole failure in under a hundred characters and produced nothing else. */
 export const OWN_OUTPUT_ANSWER_MIN = 400;
 
+// ---- the hollow turn (#7759): exit 0, no worktree change, no substantive output ---------------
+// A CLI banner is bytes on a stream, not work. ANSI stripped, a line is CHROME when it is a pure
+// separator, decorative box/block art, or a label a CLI prints about itself (session, model,
+// provider, workdir, version, tokens) — metadata about the run, never the run's answer.
+const BANNER_RE = /[\u2500-\u257F\u2580-\u259F\u25A0-\u25FF]/;
+const SEPARATOR_RE = /^[-=*_~.#]{3,}$/;
+const CHROME_LABEL_RE = /^(?:session|model|provider|workdir|directory|version|tokens|thinking|truncating|truncated|hint|tip|ctrl|openai|opencode|codex|claude|gemini|kimi|deepseek|glm|qwen|dsh)\b/i;
+export const SUBSTANTIVE_MIN = 120;
+
+/** Whether the CLI's echo-stripped output carries anything beyond banner and hook noise: the
+ *  surviving signal lines must total at least SUBSTANTIVE_MIN chars — a sentence or two. A real
+ *  answer clears this easily; a banner contributes nothing once its chrome is dropped (#7759). */
+export function substantiveOutput(ownText) {
+  const lines = String(ownText || "").replace(/\x1b\[[0-9;]*[A-Za-z]/g, "").split("\n").map(l => l.trim()).filter(Boolean);
+  const signal = lines.filter(l => !BANNER_RE.test(l) && !SEPARATOR_RE.test(l) && !CHROME_LABEL_RE.test(l));
+  return signal.join("\n").length >= SUBSTANTIVE_MIN;
+}
+
 /** The #5405 rule, refined twice by #5868: exit 0 + an auth-shaped marker means FAILED only when
  *  the CLI's own output is short enough to be JUST the error — and NEVER when the turn did real
  *  work (newCommit, checked by the runner via git): a shipped commit is a live turn, whatever the
@@ -49,20 +67,22 @@ export function looksLikeAuthDeath(ownText, realWork = false) {
 /** The one-line verdict the seat's jsonl carries (#5868): why the runner judged the turn the way
  *  it did, phrased exactly like the runner's own "classified X because Y" log — so a pane that
  *  scrolls away loses nothing that the telemetry row needs to say. */
-export function verdictFor(realExit, effExit, emptyOutput, ownText) {
-  if (realExit === 0 && effExit === 0) return "classified success because exit 0 with CLI output";
+export function verdictFor(realExit, effExit, emptyOutput, ownText, emptyTurn = false) {
+  if (realExit === 0 && effExit === 0) return emptyTurn
+    ? "classified empty-turn because exit 0 with no worktree change, no substantive output, no bus activity"
+    : "classified success because exit 0 with CLI output";
   if (realExit === 0 && effExit === 1) {
     if (emptyOutput) return "classified empty-output because exit 0 with no output on either stream";
     const m = AUTH_MARKER_RE.exec(String(ownText || ""));
     return `classified auth because ${m ? m[0] : "auth marker"} in the CLI's own short output`;
   }
-  const { reason, matched } = classifyFailure(realExit, String(ownText || ""), emptyOutput);
+  const { reason, matched } = classifyFailure(realExit, String(ownText || ""), emptyOutput, emptyTurn);
   return `classified ${reason} because ${matched}`;
 }
 
 /** Classify one failed turn. Returns { reason, matched } — matched is the evidence excerpt the
  *  runner logs, so the next misclassification is diagnosable from the seat log alone. */
-export function classifyFailure(exit, errText, emptyOutput = false) {
+export function classifyFailure(exit, errText, emptyOutput = false, emptyTurn = false) {
   // #5481: silence with a clean exit is a failure shape, not success — see lastEmptyOutput.
   if (emptyOutput) return { reason: "empty-output", matched: "exit 0 with no output on either stream" };
   const t = String(errText || "").toLowerCase();
@@ -79,6 +99,10 @@ export function classifyFailure(exit, errText, emptyOutput = false) {
   if (m) return { reason: "exhausted", matched: m[0] };
   m = t.match(/unauthor|401|invalid[ _-]?api[ _-]?key|forbidden|403|token expired|expired/);
   if (m) return { reason: "auth", matched: m[0] };
+  // #7759: exit 0 with bytes on the stream but neither a changed worktree nor substantive output
+  // is a HOLLOW turn — the CLI printed its banner and quit. It ranks BELOW every real failure
+  // shape above: an auth-shaped or exhausted exit is that failure, never an empty turn.
+  if (emptyTurn) return { reason: "empty-turn", matched: "exit 0 with no worktree change, no substantive output, no bus activity" };
   return { reason: "crashed", matched: `exit ${exit} with no known failure pattern` };
 }
 

package/lib/harvest.mjs

@@ -0,0 +1,97 @@
+// Harvest receipts (#7748): a seat commit landed on main under a NEW sha (cherry-pick, squash)
+// diverges the seat branch for good. The receipt records seat sha -> main sha -> card so
+// `trantor sync` can realign the seat without anyone re-proving patch-equivalence.
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync, writeFileSync, renameSync, mkdirSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { busDir } from "./project.mjs";
+
+const SHA_RE = /^[0-9a-f]{7,40}$/;
+
+export function receiptsPath(project, root = busDir()) {
+  return join(root, `harvest-${project}.json`);
+}
+
+export function readReceipts(project, root = busDir()) {
+  const p = receiptsPath(project, root);
+  if (!existsSync(p)) return [];
+  try {
+    const j = JSON.parse(readFileSync(p, "utf8"));
+    return Array.isArray(j?.receipts) ? j.receipts : [];
+  } catch { return []; }
+}
+
+// A hand-typed receipt carries a short sha, so either side may be a prefix of the other.
+export function shaMatches(a, b) {
+  const x = String(a || "").toLowerCase(), y = String(b || "").toLowerCase();
+  return x.length >= 7 && y.length >= 7 && (x.startsWith(y) || y.startsWith(x));
+}
+
+export function recordHarvest(project, { seat, main, card = 0, branch = "", by = "" }, root = busDir()) {
+  const seatSha = String(seat || "").trim().toLowerCase();
+  const mainSha = String(main || "").trim().toLowerCase();
+  if (!SHA_RE.test(seatSha) || !SHA_RE.test(mainSha)) throw new Error("harvest: a sha is 7 to 40 hex characters");
+  const list = readReceipts(project, root).filter(r => !shaMatches(r.seat, seatSha));
+  const receipt = { seat: seatSha, main: mainSha, card: Number(card) || 0, branch: String(branch || ""), by: String(by || ""), ts: Date.now() };
+  list.push(receipt);
+  const p = receiptsPath(project, root);
+  mkdirSync(dirname(p), { recursive: true });
+  const tmp = `${p}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify({ project, receipts: list }, null, 2) + "\n");
+  renameSync(tmp, p);
+  return receipt;
+}
+
+export function run(cwd, args, { timeout = 15000 } = {}) {
+  const r = spawnSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout });
+  return { ok: r.status === 0, out: String(r.stdout || "").trim(), err: String(r.stderr || "").trim() };
+}
+const out = (cwd, args) => { const r = run(cwd, args); return r.ok ? r.out : ""; };
+
+// The runner persists branch.<seat>.base at worktree creation; a worktree made by hand means main.
+export function seatBase(dir, branch) {
+  return out(dir, ["config", "--get", `branch.${branch}.base`]) || "main";
+}
+
+// Realignment target: the remote base when origin carries it, else the local base branch.
+export function syncTarget(dir, base) {
+  const remote = out(dir, ["rev-parse", "--verify", "-q", `refs/remotes/origin/${base}`]);
+  if (remote) return { ref: `origin/${base}`, sha: remote };
+  const local = out(dir, ["rev-parse", "--verify", "-q", `refs/heads/${base}`]);
+  return { ref: base, sha: local };
+}
+
+// Every commit the seat branch carries that the target does not, split by whether a receipt covers it.
+export function auditSeat(dir, { branch, targetRef, receipts }) {
+  const log = out(dir, ["log", "--reverse", "--format=%H%x09%s", `${targetRef}..${branch}`]);
+  const harvested = [], unharvested = [];
+  for (const line of log.split("\n").filter(Boolean)) {
+    const [sha, ...rest] = line.split("\t");
+    const subject = rest.join("\t");
+    const receipt = receipts.find(r => shaMatches(r.seat, sha));
+    (receipt ? harvested : unharvested).push({ sha, subject, receipt });
+  }
+  return { harvested, unharvested };
+}
+
+// Refuses rather than loses: an unharvested commit stops the sync and is named. `reset --keep`
+// carries uncommitted edits across and refuses on its own when one touches a file main changed.
+export function syncSeat(dir, { branch = "", dryRun = false, fetch = true, receipts, root = busDir(), project = "" } = {}) {
+  const current = out(dir, ["rev-parse", "--abbrev-ref", "HEAD"]);
+  if (!current || current === "HEAD") return { ok: false, reason: `${dir} has no branch checked out (detached HEAD)` };
+  if (branch && branch !== current) return { ok: false, reason: `${dir} is on ${current}, not ${branch}` };
+  branch = current;
+  const base = seatBase(dir, branch);
+  if (fetch) run(dir, ["fetch", "-q", "origin", base], { timeout: 20000 });
+  const target = syncTarget(dir, base);
+  if (!target.sha) return { ok: false, reason: `no ${base} to sync to: neither origin/${base} nor a local ${base} exists` };
+  const audit = auditSeat(dir, { branch, targetRef: target.sha, receipts: receipts || readReceipts(project, root) });
+  const head = out(dir, ["rev-parse", "HEAD"]);
+  const result = { ok: true, branch, base, target, head, ...audit };
+  if (audit.unharvested.length) return { ...result, ok: false, refused: true, reason: `${audit.unharvested.length} unharvested commit(s) on ${branch} would be lost` };
+  if (head === target.sha) return { ...result, noop: true };
+  if (dryRun) return { ...result, dry: true };
+  const r = run(dir, ["reset", "--keep", target.sha]);
+  if (!r.ok) return { ...result, ok: false, reason: `git reset --keep refused: ${r.err || r.out}`.trim() };
+  return { ...result, from: head, to: target.sha };
+}

package/lib/turn-policy.mjs

@@ -95,8 +95,9 @@ export function hasImperative(text) {
   return IMPERATIVE_RE.test(String(text || ""));
 }
 
-/// The safety net for a sender that never set `wake`: a direct message with no card and no
-/// imperative is an ack, an FYI or a queue note, and it batches into the next turn's context.
+/// #7766: no longer a wake gate — on a direct message the sender's wake flag decides alone. What
+/// keeps this alive is the receipt side of #7079: a reply threaded onto a seat's own outcome is an
+/// ack only while it carries no work of its own.
 export function carriesWork(text) {
   return cardRef(text) > 0 || hasImperative(text);
 }