trantor 0.18.61 → 0.18.63

package/bin/crew-runner.mjs

@@ -6,6 +6,7 @@ import { readFileSync, writeFileSync, unlinkSync, existsSync, appendFileSync, mk
 import { join, basename } from "node:path";
 import { homedir } from "node:os";
 import { resolveProject, resolveHub, withEnvFiles, hostId } from "../lib/project.mjs";
+import { resolveSecrets, shadowEnv, withSecretExports } from "../lib/secrets.mjs";
 import { loadOrCreate } from "../lib/identity.mjs";
 import { signedHeaders } from "../lib/signed-fetch.mjs";
 import { ensureEnrolled } from "../lib/enroll.mjs";
@@ -19,7 +20,7 @@ import {
 import { capWake, capBcast, pickLessons, composePrompt, contractBase, baseLine } from "./crew-payload.mjs";
 import {
   cardRefs, wakeCard, carriesWork, parseTurnTokens, parseResetAt, reasonWithBalances, quotaResetAt, PARKING_REASONS,
-  senderProjectOf, isLinkedProject, stateSkipReason,
+  senderProjectOf, isLinkedProject, stateSkipReason, isMessageCardTitle, OPEN_CARD_STATUSES,
 } from "../lib/turn-policy.mjs";
 import {
   auditDutyNudges, claimDutyNudges, claudeTranscriptDir, dutyEscalations, dutyNudgeDirective,
@@ -32,6 +33,7 @@ import {
   breakerVerdict, describeTurn, hasJsonSchemaFlag, parseEnvelope, renderCardTail, runStep,
 } from "../lib/state/driver.mjs";
 import { costLine } from "../lib/state/cost.mjs";
+import { resolveStateFlags } from "../lib/state/flags.mjs";
 
 const AGENT = process.argv[2];
 const DIR = process.argv[3] || process.cwd();
@@ -246,7 +248,7 @@ const EFFORT_FLAG = EFFORT ? cliEffortFlag(AGENT, EFFORT) : { flag: "", text: ""
 
 // RUNNER_RULES / RUNNER_KICKOFF env overrides: the runner is also the substrate for non-crew
 // always-on seats (the fleet DUTY agent, bin/duty.mjs) whose doctrine is not "work your card".
-const RULES = process.env.RUNNER_RULES || `Rules: you are ${SESSION} on the trantor crew. Before starting a card, read YOUR card: relay_board with card:<id> (the card, its deps, its notes, and the last five done cards whose title shares a word); never the whole board. Work your assigned file(s), report on the bus (relay_send, <280 chars), move your Kanban card as you go with a NOTE saying what you did (doing -> testing -> done; in 'testing' run YOUR OWN test file — never the full npm test, suites collide across seats — plus \`node bin/slop-gate.mjs\` when the repo has one: it lints ONLY your changed files against the anti-slop rules, and a card must not reach done with slop-gate failing; use 'failed' + a report if anything breaks). If a contract omits a fact you cannot proceed without, ASK — never invent the value: relay_ask(<card>, <question>) blocks the card with your question, keeps the turn owed (no park, no failure), and resumes you when the assigner's answer lands; an invented value that reads as reasoned is the worst outcome this crew ships (#7756). If you need something from another session, message THAT SESSION (relay_peers to find its id, relay_send to reach it) — never ask the human to pass it along; carrying messages between agents is the job this bus exists to remove. When your work for THIS message is finished, END YOUR TURN — do NOT park, do NOT loop relay_wait; the runner waits for you and will wake you with the next message. Path discipline: build/test from your worktree root ${TURN_DIR} with absolute paths or --manifest-path/--prefix instead of cd-ing into subdirs, and put anything that must land outside the repo under ${TURN_DIR}/.agent-bus-out/ (gitignored) — never ~/.agent-bus. Realigning your seat branch after the orchestrator harvested your commits is \`trantor sync\` run from your worktree: it reads the harvest receipts and refuses when an unharvested commit would be lost, so never reset or rebase onto main by hand. A contract's \`base: <sha>\` line is the integration head: start your seat branch at that sha (\`git reset --hard <sha>\` on the fresh branch), never at origin/main, which trails the orchestrator's unpushed integration commits; the object is already here as the ref \`main\`. If \`git cat-file -e <sha>\` fails, say \`cannot resolve base <sha>\` on the bus and move the card to blocked instead of reasoning from origin/main. Every testing/done note names the sha you verified against as \`verified at <sha>\`; a note without it is flagged HOLLOW. Cross-project action is a breach: never \`trantor up\` a crew, register a seat, or send a card/contract into a project other than ${PROJ} unless the operator ran \`trantor policy link ${PROJ} <other> --reason "<why>"\` first — the hub, the CLI and this runner all refuse it mechanically, so ask the operator to link the projects instead of routing around the refusal.`;
+const RULES = process.env.RUNNER_RULES || `Rules: you are ${SESSION} on the trantor crew. Before starting a card, read YOUR card: relay_board with card:<id> (the card, its deps, its notes, and the last five done cards whose title shares a word); never the whole board. If your wake names no card id (or cites only a message-card), make relay_board with mine:true your FIRST call — it lists the cards assigned to you (doing/testing/todo, newest first, full card shape); work your newest one (#7763). Work your assigned file(s), report on the bus (relay_send, <280 chars), move your Kanban card as you go with a NOTE saying what you did (doing -> testing, then STOP: you never close your own card to done — the orchestrator runs the card's drill on the built artifact and closes it, and the hub refuses a move to done on a card with no drill line anyway; in 'testing' run YOUR OWN test file — never the full npm test, suites collide across seats — plus \`node bin/slop-gate.mjs\` when the repo has one: it lints ONLY your changed files against the anti-slop rules, and a card must not reach testing with slop-gate failing; use 'failed' + a report if anything breaks). If a contract omits a fact you cannot proceed without, ASK — never invent the value: relay_ask(<card>, <question>) blocks the card with your question, keeps the turn owed (no park, no failure), and resumes you when the assigner's answer lands; an invented value that reads as reasoned is the worst outcome this crew ships (#7756). If you need something from another session, message THAT SESSION (relay_peers to find its id, relay_send to reach it) — never ask the human to pass it along; carrying messages between agents is the job this bus exists to remove. When your work for THIS message is finished, END YOUR TURN — do NOT park, do NOT loop relay_wait; the runner waits for you and will wake you with the next message. Path discipline: build/test from your worktree root ${TURN_DIR} with absolute paths or --manifest-path/--prefix instead of cd-ing into subdirs, and put anything that must land outside the repo under ${TURN_DIR}/.agent-bus-out/ (gitignored) — never ~/.agent-bus. Realigning your seat branch after the orchestrator harvested your commits is \`trantor sync\` run from your worktree: it reads the harvest receipts and refuses when an unharvested commit would be lost, so never reset or rebase onto main by hand. A contract's \`base: <sha>\` line is the integration head: start your seat branch at that sha (\`git reset --hard <sha>\` on the fresh branch), never at origin/main, which trails the orchestrator's unpushed integration commits; the object is already here as the ref \`main\`. If \`git cat-file -e <sha>\` fails, say \`cannot resolve base <sha>\` on the bus and move the card to blocked instead of reasoning from origin/main. Every testing/done note names the sha you verified against as \`verified at <sha>\`; a note without it is flagged HOLLOW. Cross-project action is a breach: never \`trantor up\` a crew, register a seat, or send a card/contract into a project other than ${PROJ} unless the operator ran \`trantor policy link ${PROJ} <other> --reason "<why>"\` first — the hub, the CLI and this runner all refuse it mechanically, so ask the operator to link the projects instead of routing around the refusal.`;
 
 // ---- the pulse --------------------------------------------------------------
 // RUNNER_PULSE_MS re-runs an orchestrator seat's mission note on a cadence when the bus is silent;
@@ -315,6 +317,10 @@ const RETRY_MS = (() => {
 // #7756: while an ask awaits its answer the contract's wake stays owed but is NOT redelivered —
 // the answer (re = the ask's id, or any direct word from the assigner) is what releases it.
 let awaitingAsk = null;
+// #7756: set the moment an answer releases a held ask, consumed by the next deliverWake — the
+// released turn RESUMES the held contract's session, so it is never "fresh" however the batch
+// cites cards (the session already belongs to the contract the ask was holding).
+let askReleased = false;
 // The bus is the record of a turn that ended by ASKING: an open kind:ask contract from this
 // session. deliverWake judges each clean wake turn against /contracts — an open ask renames the
 // ledger row "asked" and HOLDS the wake (no failure count, no backoff, no park) until the answer.
@@ -356,7 +362,9 @@ function loadPending() {
 // Auth failures in TURN OUTPUT: opencode prints its auth error and still exits 0 (#5405). The rules
 // live in lib/classify-failure.mjs (#5868); runTurn judges only the CLI's own output, not the echo.
 function classify(exit) {
-  const { reason, matched } = classifyFailure(exit, lastErrText, lastEmptyOutput, lastEmptyTurn);
+  // lastTurnCut lets a boxed turn's 137 read as the sweep's SIGKILL (#7099); without the cut
+  // marker the same exit stays a crash, exactly as classifyFailure's cut rule draws it.
+  const { reason, matched } = classifyFailure(exit, lastErrText, lastEmptyOutput, lastEmptyTurn, lastTurnCut);
   log(`classified ${reason} because ${matched}`);
   return reason;
 }
@@ -465,9 +473,9 @@ async function balanceRows() {
     // Same key sources the crew itself uses: QWEN_API_KEY (and most others) live in
     // ~/.agent-bus/.env, not in the runner's inherited environment — reading bare process.env
     // here would report "no key" and quietly leave every silent turn classified as a crash.
-    const { resolveKeys } = await import("../lib/provider-keys.mjs");
+    const { resolveKeys, keyFiles } = await import("../lib/provider-keys.mjs");
     return await Promise.race([
-      fetchBalances(resolveKeys(process.env), { only: [AGENT] }),
+      fetchBalances(resolveKeys(process.env, keyFiles(), resolveSecrets(process.env)), { only: [AGENT] }),
       new Promise((r) => setTimeout(() => r([]), 4000)),
     ]);
   } catch { return []; }
@@ -536,8 +544,13 @@ async function reportHealthy() {
 }
 
 // ---- Trantor State Phase 2a — the flagged path (TDD §4.1, §4.6, §7.3) -----------------------
-// Off by default, and off means the transcript path runs unchanged. Reachable only when the operator
-// set TRANTOR_STATE_ASSEMBLE=1, the seat is `claude` (§7.3) and the CLI carries --json-schema (§6).
+// Off by default — off means the transcript path runs unchanged. #7159: the flags resolve through
+// the one place (lib/state/flags.mjs), launcher env first and ~/.agent-bus/.env filling the rest;
+// resolved values are applied fill-only to process.env so downstream reads (runGate's GATE) agree.
+const stateFlags = resolveStateFlags();
+for (const [name, flag] of Object.entries(stateFlags)) {
+  if (flag.value && process.env[name] === undefined) process.env[name] = flag.value;
+}
 const STATE_FLAG_ON = process.env[STATE_ENV] === "1";
 const STATE_SCHEMA_FILE = join(homedir(), ".agent-bus", `state-schema-${AGENT}-${PROJ}.json`);
 const STATE_MODE = (() => {
@@ -551,7 +564,7 @@ const STATE_MODE = (() => {
   } catch (e) { log(`\x1b[33mstate mode OFF — could not write ${STATE_SCHEMA_FILE}: ${e.message}\x1b[0m`); return false; }
   // #7060: the checks above prove CONFIGURATION, not the prompt, so say "armed" and name the one
   // thing that engages it; each turn then reports which path it took.
-  log(`\x1b[36mTrantor State: ASSEMBLE armed for this seat (schema ${STATE_SCHEMA_FILE})\x1b[0m`);
+  log(`\x1b[36mTrantor State: ASSEMBLE armed for this seat (${STATE_ENV}=${stateFlags[STATE_ENV].value} via ${stateFlags[STATE_ENV].layer}; schema ${STATE_SCHEMA_FILE})\x1b[0m`);
   log(`\x1b[36m  a turn is assembled only when a wake ASSIGNS it a card — the kickoff and every pulse run the transcript path, and each turn says which one it took\x1b[0m`);
   return true;
 })();
@@ -608,6 +621,14 @@ let statePromotedHash;
 // TRANTOR_TURN_MAX_MS ends the CLI's process group at the box and runs ONE follow-up turn in the
 // same session ("commit what is done, move the card, report") so a cut turn lands its work.
 const TURN_MAX_MS = Math.max(0, Number(process.env.TRANTOR_TURN_MAX_MS || 20 * 60 * 1000));
+// #7761: the box counts LIVENESS. At the deadline a turn that moved within the stall window is
+// extended one step (half the box: +10m at the default) up to TRANTOR_TURN_CEILING_MS, the one
+// knob (default 60m). A ceiling at or under the box disables extension; a silent turn still ends
+// at the #7752 stall window, extended or not. The watchdog owns the clock — see turn-watchdog.mjs.
+const TURN_CEILING_MS = TURN_MAX_MS ? Math.max(0, Number(process.env.TRANTOR_TURN_CEILING_MS || 60 * 60 * 1000)) : 0;
+const TURN_EXTEND_MS = Math.ceil(TURN_MAX_MS / 2);
+const TURN_EXTENSIONS_MAX = TURN_EXTEND_MS > 0 && TURN_CEILING_MS > TURN_MAX_MS
+  ? Math.floor((TURN_CEILING_MS - TURN_MAX_MS) / TURN_EXTEND_MS) : 0;
 const TIME_BOX_PROMPT = "your previous turn was cut at the time box; commit what is done, move the card with a note, report in one line";
 let inFollowUp = false;
 // #6289: whether the turn that just ended was CUT at the time box. The follow-up recursion
@@ -671,7 +692,10 @@ async function runTurn(prompt, isFirst, trigger = "kickoff", opts = {}) {
   // PRECEDENCE: each file is PREPENDED, so the list is iterated in written order, highest priority
   // first, and the CREW layer (~/.agent-bus/.env) wins. test-crew-env.mjs runs the real shell.
   const envs = [join(homedir(), ".agent-bus", ".env"), cli.env].filter(f => f && existsSync(f));
-  cmd = withEnvFiles(cmd, envs);
+  // #6393: the store's keys ride the spawn env under shadow names and the shell re-exports them
+  // AFTER the sources ran, so the keychain wins over a stale .env line and no file is ever copied.
+  const secrets = resolveSecrets(process.env);
+  cmd = withEnvFiles(withSecretExports(cmd, Object.keys(secrets)), envs);
   log(`turn starting (${isFirst ? "fresh session" : "resume"})${MODEL ? ` · model=${MODEL}` : ""}`);
   // #7777: the one effort line — which effort parameters were set, or that the model is uncatalogued.
   if (EFFORT && EFFORT_FLAG.text) log(EFFORT_FLAG.text);
@@ -705,12 +729,23 @@ async function runTurn(prompt, isFirst, trigger = "kickoff", opts = {}) {
   // instead of burning the box. Unlinked at turn start and again with the cut cleanup.
   const STALLF = join(homedir(), ".agent-bus", `turnstall-${AGENT}-${PROJ}`);
   try { unlinkSync(STALLF); } catch {}
+  // #7761: the watchdog writes the extended deadline (epoch seconds) here for the shell box to
+  // re-read, and one row per extension to EXTF for the ledger. Both unlinked at turn start.
+  const DEADLINEF = join(homedir(), ".agent-bus", `turndeadline-${AGENT}-${PROJ}`);
+  const EXTF = join(homedir(), ".agent-bus", `turnext-${AGENT}-${PROJ}`);
+  try { unlinkSync(DEADLINEF); } catch {}
+  try { unlinkSync(EXTF); } catch {}
+  const boxPlan = TURN_EXTENSIONS_MAX ? {
+    maxMs: TURN_MAX_MS, extendMs: TURN_EXTEND_MS, ceilingMs: TURN_CEILING_MS, extensionsMax: TURN_EXTENSIONS_MAX,
+    deadlineFile: DEADLINEF, extFile: EXTF, card: sessionCard || 0,
+    assigners: (opts.assigners || []).map(a => ({ from: a.from, id: a.id })),
+  } : undefined;
   // Touched by the stderr scrubber as its LAST act (the shell below); node waits for it after
   // spawnSync before reading ERRF — see the drain note at the spawnSync call.
   const DRAINF = join(homedir(), ".agent-bus", `turndrain-${AGENT}-${PROJ}`);
   try { unlinkSync(DRAINF); } catch {}
   try {
-    writeFileSync(STAMPF, JSON.stringify({ turn: TURN, startedAt: Date.now(), runner: RUNNER_ID }));
+    writeFileSync(STAMPF, JSON.stringify({ turn: TURN, startedAt: Date.now(), runner: RUNNER_ID, box: boxPlan }));
     const wd = spawn(process.execPath, [join(import.meta.dirname, "turn-watchdog.mjs"), STAMPF, ERRF, String(WD_MS), SESSION, PROJ, HUB, TRANSCRIPT_DIR, TURN_DIR,
       // #7752: the stall marker only exists when a box does — with no box there is no sweep to
       // end the turn, so the watchdog stays report-only (reporting is the whole job, boxless).
@@ -732,6 +767,7 @@ ${sweep}
   deadline=$(( $(date +%s) + ${Math.ceil(TURN_MAX_MS / 1000)} ))
   while :; do
     [ -f "${STALLF}" ] && break
+    d=$(cat "${DEADLINEF}" 2>/dev/null); case "$d" in ""|*[!0-9]*) ;; *) deadline=$d;; esac
     [ "$(date +%s)" -ge "$deadline" ] && break
     sleep 1 & sleeppid=$!
     wait "$sleeppid"
@@ -752,7 +788,7 @@ exit $turn_exit`;
     // spawned. stdin is /dev/null: a background group that reads the terminal stops on SIGTTIN.
     detached: true,
     cwd: TURN_DIR, encoding: "utf8", stdio: cli.sid ? ["ignore", "pipe", "inherit"] : ["ignore", "inherit", "inherit"],
-    env: { ...process.env, RELAY_URL: HUB, RELAY_AGENT: AGENT, RELAY_SESSION: SESSION, RELAY_PROJECT: PROJ,
+    env: { ...process.env, ...shadowEnv(secrets), RELAY_URL: HUB, RELAY_AGENT: AGENT, RELAY_SESSION: SESSION, RELAY_PROJECT: PROJ,
       // #6228: marks this env as belonging to PROJ, unlike a one-off RELAY_PROJECT override; crew.mjs's
       // `up` guard refuses to bring up another project's crew from a shell carrying this badge.
       TRANTOR_SEAT: PROJ,
@@ -767,7 +803,7 @@ exit $turn_exit`;
   // A BACKSTOP only, deliberately later than the shell's own box: if bash itself wedges, node
   // still ends the turn. When the in-shell box works — the normal path — this never fires, which
   // is the point: the shell kills while the tree is still walkable, node cannot.
-  if (TURN_MAX_MS) { spawnOpts.timeout = TURN_MAX_MS + 30000; spawnOpts.killSignal = "SIGKILL"; }
+  if (TURN_MAX_MS) { spawnOpts.timeout = (TURN_EXTENSIONS_MAX ? TURN_CEILING_MS : TURN_MAX_MS) + 30000; spawnOpts.killSignal = "SIGKILL"; }
   const r = spawnSync("/bin/bash", ["-c", shell], spawnOpts);
   // The shell's box leaves the marker; the backstop leaves an ETIMEDOUT. Either way the turn was
   // cut, not merely failed. A stall marker (#7752) outranks the box marker: a turn silent for
@@ -775,6 +811,13 @@ exit $turn_exit`;
   const boxed = existsSync(CUTF);
   const stallCut = existsSync(STALLF);
   const cut = !!TURN_MAX_MS && (boxed || stallCut || r.error?.code === "ETIMEDOUT");
+  // #7761: how far the watchdog moved the box, one EXTF row per extension. boxMs is the box the
+  // turn actually had, so a ceiling cut reads as the ceiling, never as the 20-minute default.
+  let extensions = 0;
+  try { extensions = readFileSync(EXTF, "utf8").split("\n").filter(Boolean).length; } catch {}
+  const boxMs = TURN_MAX_MS + extensions * TURN_EXTEND_MS;
+  try { unlinkSync(DEADLINEF); } catch {}
+  try { unlinkSync(EXTF); } catch {}
   // DRAIN before classifying, never on a CUT turn (the sweep killed the scrubber, its marker never
   // comes). bash 3.2 `wait` skips process substitutions, so wait for DRAINF, bounded.
   if (!cut) {
@@ -790,6 +833,7 @@ exit $turn_exit`;
     try { unlinkSync(CUTF); } catch {}
     try { unlinkSync(STALLF); } catch {}
     if (stallCut) log(`\x1b[33mturn STALLED — no bytes on either stream and no transcript advance for ${Math.round(WD_MS / 60000)}m; ended at the stall window, not the ${Math.round(TURN_MAX_MS / 1000)}s box\x1b[0m`);
+    else if (extensions) log(`\x1b[33mturn cut at the ${Math.round(boxMs / 1000)}s box after ${extensions} liveness extension(s) (ceiling ${Math.round(TURN_CEILING_MS / 1000)}s) — CLI and every descendant ended${boxed ? "" : " (node backstop: bash itself was wedged)"}\x1b[0m`);
     else log(`\x1b[33mturn cut at the ${Math.round(TURN_MAX_MS / 1000)}s time box — CLI and every descendant ended${boxed ? "" : " (node backstop: bash itself was wedged)"}\x1b[0m`);
   }
   lastTurnCut = cut;
@@ -848,8 +892,8 @@ exit $turn_exit`;
   // #5868: the verdict rides the telemetry row so a classification survives the pane scrolling
   // away — the same "classified X because Y" shape the runner logs, in the seat's jsonl forever.
   // A silent cut names its own verdict (#7752): the exit under it is the sweep's SIGPIPE, never
-  // a provider failure.
-  const verdict = stallCut ? stallVerdict() : verdictFor(realExit, effExit, lastEmptyOutput, ownOut, lastEmptyTurn);
+  // a provider failure. A box cut passes `cut` so its 137 reads as the sweep's SIGKILL (#7099).
+  const verdict = stallCut ? stallVerdict() : verdictFor(realExit, effExit, lastEmptyOutput, ownOut, lastEmptyTurn, cut);
   // #6134: what the turn COST, from the CLI's own usage line. Zero means this CLI printed none —
   // never that the turn was free. `trantor seat-why` totals these into today's spend per seat.
   let tokens = parseTurnTokens(ownOut);
@@ -859,12 +903,10 @@ exit $turn_exit`;
     // actually carried counts.
     if (c) tokens = c.input + c.output + c.cache_read + c.cache_creation;
   }
-  // #6289: every ledger row names in ONE field what happened to the turn — cut (the box ended
-  // it), stalled (the watchdog window ended it, #7752), api-error (the CLI failed), completed —
-  // and what it cost in tokens, even when this CLI printed no usage line (0 means "not
-  // reported", never "free"). `cut` stays too: the drills read it. #7762: `card` binds the row
-  // to the card the turn was working (0 = kickoff/pulse, no card) so the seat record can
-  // attribute empty/stalled turns to the card that produced nothing.
+  // #6289: every ledger row names in ONE field what happened to the turn — cut, stalled (#7752),
+  // api-error, completed — and what it cost (0 means "not reported", never "free"). #7762: `card`
+  // binds the row to the card the turn worked (0 = kickoff/pulse) so the seat record attributes
+  // empty/stalled turns to the card that produced nothing. `cut` stays too: the drills read it.
   const outcome = cut ? (stallCut ? "stalled" : "cut") : (effExit !== 0 ? "api-error" : lastEmptyTurn ? "empty" : "completed");
   // #7756: a clean turn that ASKED its assigner is demoted-but-owed, not "completed". The judge
   // (deliverWake's /contracts read) renames the ledger row, so "asked" is what the log keeps.
@@ -875,8 +917,9 @@ exit $turn_exit`;
   const telemetryRow = { ts: Date.now(), agent: AGENT, project: PROJ, turn: TURN, trigger, card: sessionCard || 0, model: MODEL || "cli-default", duration_ms: Date.now() - t0, exit: realExit, effExit, authFailed: effExit !== realExit, emptyOutput: lastEmptyOutput, emptyTurn: lastEmptyTurn, verdict, outcome: finalOutcome, tokens };
   if (cut) telemetryRow.cut = true;
   if (stallCut) telemetryRow.stalled = true;
-  // #7752: a cut turn's 141 is the sweep's SIGPIPE, recorded as the cut signal — never read as
-  // a quota or crash pattern downstream.
+  if (extensions) { telemetryRow.extensions = extensions; telemetryRow.boxMs = boxMs; }
+  // #7752/#7099: a cut turn's 141/137 is the sweep's own signal (SIGPIPE/SIGKILL), recorded as
+  // the cut signal — never read as a quota or crash pattern downstream.
   if (cut) { const sig = cutSignalFor(realExit); if (sig) telemetryRow.cutSignal = sig; }
   telemetry(telemetryRow);
   log(`turn ended (exit ${realExit}${effExit !== realExit ? ` → effective ${effExit} (${lastEmptyOutput ? "empty-output" : "auth"})` : ""}, ${((Date.now() - t0) / 1000).toFixed(0)}s)`);
@@ -912,7 +955,7 @@ async function stateTurn({ card, observation, trigger, assigners = [] }) {
       callCli: async (prompt) => {
         // isFirst=true every step ON PURPOSE: a state step carries no `-c`, so there is no session
         // to resume and a stale sid must never be handed to one.
-        const exit = await runTurn(prompt, true, trigger, { state: true });
+        const exit = await runTurn(prompt, true, trigger, { state: true, assigners });
         return { exit, stdout: lastEnvelope, cut: lastTurnCut };
       },
       executeAction: async (action) => {
@@ -1066,6 +1109,32 @@ function askedExcerpt(message) {
   return text.slice(0, 120);
 }
 
+// #7763/#7765: the card a wake binds to, with message-cards out of the race — a transcript of a
+// bus message parked on the board is never work, and chasing one (or a phantom id) is how a turn
+// burns on bookkeeping. Only a CONFIRMED message-card title reroutes, to the seat's OWN newest
+// open card (same statuses/ordering as relay_board's mine view); a phantom binds nothing.
+async function newestOwnCard(session, why) {
+  try {
+    const { tasks } = await api(`/tasks?project=${encodeURIComponent(PROJ)}`);
+    const own = (Array.isArray(tasks) ? tasks : [])
+      .filter((t) => t.assignee === session && OPEN_CARD_STATUSES.includes(t.status) && !isMessageCardTitle(t.title))
+      .sort((a, b) => (b.updated || b.ts || 0) - (a.updated || a.ts || 0));
+    if (own.length) log(`${why} — resolved to the seat's own #${own[0].id} (${own[0].status})`);
+    else log(`${why} — and the seat has no open card, so this turn carries no card binding`);
+    return own.length ? own[0].id : 0;
+  } catch { return 0; }   // board unreadable: no binding beats a guessed one
+}
+async function resolveWakeCard(messages, { session }) {
+  const cited = wakeCard(messages, { session });
+  if (!(cited > 0)) return 0;
+  try {
+    const { task } = await api(`/card?project=${encodeURIComponent(PROJ)}&id=${cited}`);
+    if (!task) { log(`#${cited}: the wake cites a card this board does not have — no card binding; the mine view is the first call`); return 0; }
+    if (isMessageCardTitle(task.title)) return newestOwnCard(session, `#${cited} is a message-card ("${String(task.title).slice(0, 60)}")`);
+    return cited;
+  } catch { return cited; }   // hub unreachable: keep the pre-#7763 reading rather than drop a contract
+}
+
 (async () => {
   await loadLessons();
   // start cursor at the CURRENT tip so we don't replay history
@@ -1248,6 +1317,7 @@ function askedExcerpt(message) {
     if (awaitingAsk && wake.some(m => m.to === SESSION && (Number(m.re) === awaitingAsk.id || m.from === awaitingAsk.to))) {
       log(`answer to ask #${awaitingAsk.id} landed — resuming with the contract re-attached`);
       awaitingAsk = null;
+      askReleased = true;
       savePending(pendingWake, pendingBcast);
     }
     if (awaitingAsk) { log(`holding for the answer to ask #${awaitingAsk.id} — ${wake.length} new message(s) queued behind it`); continue; }
@@ -1279,6 +1349,10 @@ function askedExcerpt(message) {
     } catch { return 0; }
   }
   async function deliverWake() {
+    // #7756: captured and cleared HERE so an early return below never leaks the flag into a
+    // later turn — only the turn the answer released reads it.
+    const resumedAfterAsk = askReleased;
+    askReleased = false;
     const wake = pendingWake;
     const dutyPlan = DUTY_NUDGES
       ? await claimDutyNudges({
@@ -1328,22 +1402,33 @@ function askedExcerpt(message) {
     await loadLessons();
     const lessons = pickLessons(LESSONS_RAW, wakeCapped.text + " " + bcastCapped.text);
     const trigger = wakeForTurn.some(m => m.to === SESSION) ? "direct message" : "@mention";
-    // Who is owed an answer, captured BEFORE the turn: pendingWake is cleared on success.
+    // Who is owed an answer, captured BEFORE the turn: pendingWake is cleared on success. The id is
+    // the NEWEST wake this runner holds for that assigner (#6987): append order means first-wins
+    // threaded the receipt onto a PREVIOUS turn's id — the original contract, not the answer that
+    // released this turn — which kept the contract reading WAITING while the stop hook chased.
     const assigners = [];
-    for (const m of wakeForTurn) if (m.from && !assigners.some(a => a.from === m.from)) assigners.push({ from: m.from, id: m.id });
+    for (const m of wakeForTurn) {
+      if (!m.from) continue;
+      const held = assigners.find(a => a.from === m.from);
+      if (held) held.id = m.id;
+      else assigners.push({ from: m.from, id: m.id });
+    }
     const asked = askedExcerpt(wakeForTurn[0]);
     const tStart = Date.now();
     // #6134: ONE SESSION PER CARD; a different card starts a fresh CLI session and the seat is told.
     // #7061: bound by SHAPE, not position, so an order opening with what shipped binds the right card.
-    const card = wakeCard(wakeForTurn, { session: SESSION });
-    // #7754: the contract carries the integration head as `base: <sha>` — the wake's own line if it
-    // has one, else local main. A sha this worktree cannot resolve is never worked from origin/main:
-    // the card goes to blocked and the assigner is told, and no model turn is spent on it.
+    // #7763: a message-card (or phantom) citation never binds — the seat's own newest card does.
+    const card = await resolveWakeCard(wakeForTurn, { session: SESSION });
+    // #7754: a `base:` sha this worktree cannot resolve is never worked from origin/main — the card
+    // goes to blocked, the assigner is told, and no model turn is spent. The check keeps the id the
+    // wake cites in its text: #7763's rebinding covers confirmed message-card ids only, never a
+    // card cited in the text, so the unresolvable-base branch blocks the cited card.
+    const baseCard = card || wakeCard(wakeForTurn, { session: SESSION });
     const base = contractBase(wakeForTurn) || localMainHead();
-    if (base && card && !resolvesHere(base)) {
-      const text = `cannot resolve base ${base} in ${TURN_DIR} (git cat-file -e failed) — #${card} moved to blocked; push or fetch that sha, or name one this worktree can reach`;
+    if (base && baseCard && !resolvesHere(base)) {
+      const text = `cannot resolve base ${base} in ${TURN_DIR} (git cat-file -e failed) — #${baseCard} moved to blocked; push or fetch that sha, or name one this worktree can reach`;
       log(text);
-      await api("/task/update", { id: card, status: "blocked", note: text, by: SESSION }).catch(() => {});
+      await api("/task/update", { id: baseCard, status: "blocked", note: text, by: SESSION }).catch(() => {});
       const owed = assigners.map(a => a.from).filter(f => f && f !== SESSION);
       for (const to of (owed.length ? owed : ["all"]))
         await api("/send", { from: SESSION, to, text, project: PROJ, kind: "alert" }).catch(() => {});
@@ -1352,7 +1437,12 @@ function askedExcerpt(message) {
       return;
     }
     const baseText = base ? `\n${baseLine(base)}\n` : "";
-    const fresh = card > 0 && card !== sessionCard;
+    // #6289: the card the SESSION belongs to reads the citation when the rebinding binds nothing —
+    // #7763 decides WHICH card work binds to, never the turn shape. #7756: the turn an ask's
+    // ANSWER releases is the exception — it resumes the session the held contract already owns,
+    // whatever card the batch cites; only a new contract for a different card opens fresh.
+    const sessionCardForTurn = card || baseCard;
+    const fresh = !resumedAfterAsk && sessionCardForTurn > 0 && sessionCardForTurn !== sessionCard;
     if (card) sessionCard = card;
     const cited = [...new Set(wakeForTurn.flatMap(m => cardRefs(m.text)))];
     const freshText = fresh
@@ -1381,7 +1471,7 @@ function askedExcerpt(message) {
           // dies quietly (§4.6).
           observation: [stateObservation, wakeText, ctxText, againText + freshText + baseText].filter(Boolean).join("\n"),
         })
-        : await runTurn(prompt, fresh, deliveryFails ? `${trigger} (redelivery)` : trigger, { judgeOutcome: askJudge });
+        : await runTurn(prompt, fresh, deliveryFails ? `${trigger} (redelivery)` : trigger, { judgeOutcome: askJudge, assigners });
     }
     finally { stopDutyNudgeWatcher(); }
     const secs = Math.round((Date.now() - tStart) / 1000);

package/bin/doctor.mjs

@@ -4,14 +4,16 @@
 // quota profile, optional Scrooge brain. Prints a checklist with copy-paste fixes.
 //   node bin/doctor.mjs
 import { readFileSync, readdirSync, existsSync } from "node:fs";
-import { join, dirname } from "node:path";
+import { join, dirname, basename } from "node:path";
 import { homedir } from "node:os";
 import { execSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { resolveProject, resolveHub, DEFAULT_HUB_URL } from "../lib/project.mjs";
+import { resolveProject, resolveProjectInfo, resolveHub, DEFAULT_HUB_URL, gitRoot, readProjectId, checkoutFor, orchSessionsPath, PROJECT_MARKER } from "../lib/project.mjs";
 import { loadOrCreate } from "../lib/identity.mjs";
 import { sfetchJson } from "../lib/signed-fetch.mjs";
 import { scan } from "../lib/splitbrain.mjs";
+import { resolveSecrets, envFileSecrets, backendFor } from "../lib/secrets.mjs";
+import { resolveStateFlags } from "../lib/state/flags.mjs";
 
 const H = homedir();
 const ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
@@ -64,6 +66,36 @@ if (pkg?.version) {
   tooOld ? warn(`trantor v${pkg.version} too old — heartbeat/presence requires v0.17.0+`, "npm update -g trantor") : ok(`trantor v${pkg.version}`);
 } else warn("could not read trantor version", "reinstall: npm install -g trantor");
 
+// ── project identity (#6724): a directory rename left every record under the old name and minted
+// an empty twin. The id in .trantor/project.json survives a rename; this section says whether THIS
+// checkout has one and names every orchestrated project whose checkout is gone, with the fix.
+section("project identity");
+{
+  const root = gitRoot(process.cwd()) || process.cwd();
+  const label = basename(root);
+  const { via } = resolveProjectInfo(process.cwd());
+  const marked = readProjectId(root);
+  if (marked) ok(`${marked} recorded in ${PROJECT_MARKER}${marked !== label ? ` — directory "${label}" is a label; the identity survived a rename` : ""}`);
+  else if (via === "env" || via === "worktree") note(`${PROJECT} named by ${via === "env" ? "RELAY_PROJECT" : "the seat worktree path"}; the checkout itself is unmarked`);
+  else note(`${PROJECT} is named by its directory; a rename would orphan its pin, board and orchestrator row → trantor project ${PROJECT}   (records ${PROJECT_MARKER}; commit it)`);
+  // An orphan is a name with an orchestrator row (a session ran HERE) and no checkout. A pin alone
+  // is not evidence: projects that live on another machine are pinned here too, so pins get a note.
+  const orchRows = (() => { try { return [...new Set(readFileSync(orchSessionsPath(), "utf8").split("\n").map(l => l.split("\t")[0]).filter(Boolean))]; } catch { return []; } })();
+  const pinned = Object.keys(cfg.hubs || {});
+  const claim = (name) => marked
+    ? `if that project was renamed, claim it inside its checkout: cd <its dir> && trantor project ${name}`
+    : `if "${label}" is that project renamed: trantor project ${name}   (the pin, board and orchestrator row then follow the id)`;
+  let orphans = 0;
+  for (const name of orchRows) {
+    if (checkoutFor(name)) continue;
+    orphans++;
+    warn(`orphaned identity: ${name} has an orchestrator session row${pinned.includes(name) ? " and a hub pin" : ""} but no checkout on this machine carries it`, claim(name));
+  }
+  const pinnedOnly = pinned.filter(n => !orchRows.includes(n) && !checkoutFor(n));
+  if (pinnedOnly.length) note(`${pinnedOnly.length} pinned project(s) with no checkout here (${pinnedOnly.slice(0, 8).join(", ")}${pinnedOnly.length > 8 ? ", …" : ""}) — fine when they live on another machine`);
+  if (!orphans) ok("every orchestrated project still has its checkout");
+}
+
 // ── hub routing: is any project split across two hubs? ───────────────────────────────────────
 // Cards, messages and collision detection only work over ONE hub. A project split across two
 // breaks silently — every seat reports healthy and half the work records where nobody looks.
@@ -89,10 +121,9 @@ section("hub routing");
 }
 
 // ── duty seat: is the fleet's watcher actually alive? ────────────────────────────────────────
-// The duty seat sat dead for four days (2026-08-27→31) while everything else reported green.
-// A dead watcher raises no error of its own — it just stops producing nudges — so this row makes
-// that state loud: process, keepalive, hub registration and the freshness of the seat's last hub
-// beat, each with its fix.
+// A dead watcher raises no error of its own, it just stops producing nudges (it once sat dead for
+// four days while everything else reported green), so this row makes that state loud: process,
+// keepalive, hub registration and the freshness of the seat's last hub beat, each with its fix.
 section("duty seat (the fleet watcher)");
 {
   const BUSD = join(H, ".agent-bus");
@@ -163,7 +194,7 @@ const CLIS = [
     auth: () => !!process.env.ANTHROPIC_API_KEY || existsSync(join(H, ".claude", ".credentials.json")) || keychainHas("Claude Code-credentials"),
     login: "claude   (sign in with your Anthropic account on first run)" },
   { name: "codex",  bin: "codex",  wired: () => (readFileSync(join(H, ".codex", "config.toml"), "utf8")).includes("[mcp_servers.relay]"), auth: () => existsSync(join(H, ".codex", "auth.json")), login: "codex   (sign in with your ChatGPT account on first run)" },
-  // Gemini CLI was retired 2026-06-18 for free/Pro/Ultra (Google → Antigravity `agy`). Kept as an
+  // Gemini CLI was retired for free/Pro/Ultra (Google → Antigravity `agy`). Kept as an
   // optional seat for enterprise/paid-key holders; for everyone else the seat moved to GLM/opencode,
   // and Gemini lives on only as a Scrooge cheap-model via GEMINI_API_KEY (the API/models aren't retired).
   { name: "gemini (CLI retired 2026-06-18)", bin: "gemini",   wired: () => !!read(join(H, ".gemini", "settings.json"))?.mcpServers?.relay, auth: () => existsSync(join(H, ".gemini", "oauth_creds.json")) || !!process.env.GEMINI_API_KEY || !!process.env.GOOGLE_API_KEY, login: "Gemini CLI retired 2026-06-18 (free/Pro/Ultra). Crew seat → GLM (opencode) or Antigravity `agy`. Gemini still serves as a Scrooge cheap-model via GEMINI_API_KEY." },
@@ -212,28 +243,15 @@ section("providers");
 }
 
 // ---- key attribution: WHICH key does each surface actually spend on? ------------------------
-// Provider keys resolve through a LAYERED lookup and nothing ever showed which layer won. On
-// 2026-08-25 a $14 DeepSeek day could not be explained: ~/.token-scrooge/.env held the only
-// DEEPSEEK_API_KEY, so Scrooge's `dev-infra` key was ALSO authenticating every crew seat (the
-// runner sources that file). Scrooge turned out to be 0.15% of the tokens on that key and the
-// crew was the other 99.85%, but the bill could not say so — one key, two jobs, one line item.
-//
-// The layers, highest priority first — this MIRRORS bin/crew-runner.mjs, which sources
-// ~/.agent-bus/.env last so it wins:
-//   1. the process environment
-//   2. ~/.agent-bus/.env      — the CREW layer (seats: opencode/deepseek/openrouter/dsh)
-//   3. ~/.token-scrooge/.env  — the SCROOGE layer (cheap-model grunt routing)
+// A layered lookup with nothing showing which layer won once let Scrooge's key authenticate every
+// crew seat (a $14 day the bill could not attribute). Precedence, highest first, mirroring the
+// runner: the secret store (keychain, #6393), ~/.agent-bus/.env, ~/.token-scrooge/.env, process env.
 section("provider keys (who spends on what)");
 const KEY_VARS = ["DEEPSEEK_API_KEY", "OPENROUTER_API_KEY", "MOONSHOT_API_KEY", "ZAI_API_KEY", "OPENAI_API_KEY", "GEMINI_API_KEY", "XAI_API_KEY", "INCEPTION_API_KEY"];
-// Only some of these are a CREW credential. A seat that authenticates through its own config never
-// reads the env var at all, so a shared value there costs nothing and flagging it is noise:
-//   glm    → opencode.json provider["zai-coding-plan"].options.apiKey  (and a coding plan is flat
-//            rate, so there is no per-token bill to attribute even in principle)
-//   kimi   → ~/.kimi/credentials      codex → its own login      gemini → retired
-// The opencode-driven seats that DO take their key from the env layer are deepseek and openrouter,
-// and even then only when opencode.json has not already given that provider its own key.
-// Getting this wrong cries wolf: the first version flagged all seven and five were false positives,
-// which is how a doctor becomes something you skip.
+// Only some of these are a CREW credential: glm reads opencode.json, kimi its own credentials,
+// codex its own login, so a shared value in their env var costs nothing and flagging it is noise.
+// deepseek and openrouter DO take the env layer, and only when opencode.json gave them no literal
+// key. The first version flagged all seven, five were false positives; a doctor gets skipped that way.
 const OPENCODE_CFG = read(join(H, ".config", "opencode", "opencode.json")) || {};
 const SEAT_ENV_VARS = { DEEPSEEK_API_KEY: "deepseek", OPENROUTER_API_KEY: "openrouter" };
 const ENV_TEMPLATE = /\{env:([A-Z0-9_]+)\}/;
@@ -269,14 +287,15 @@ const readEnvFile = (f) => {
 // Never print a key. The suffix is enough to match a line item in a provider console.
 const mask = (v) => (!v ? "" : v.length <= 12 ? "****" : `${v.slice(0, 5)}…${v.slice(-4)}`);
 const crewEnv = readEnvFile(CREW_ENV), scroogeEnv = readEnvFile(SCROOGE_ENV);
+const storeEnv = resolveSecrets();
 let anyKey = false, shared = 0; const sharedVars = [];
-for (const v of KEY_VARS) {
-  const crew = process.env[v] || crewEnv[v] || "";
-  const scrooge = process.env[v] || scroogeEnv[v] || "";
-  if (!crew && !scrooge) continue;
+for (const v of [...new Set([...KEY_VARS, ...Object.keys(storeEnv)])]) {
+  // The layer that answers is named on the line, in the runner's precedence.
+  const answered = storeEnv[v] ? ["keychain", storeEnv[v]] : crewEnv[v] ? ["~/.agent-bus/.env (crew)", crewEnv[v]]
+    : scroogeEnv[v] ? ["~/.token-scrooge/.env (FALLBACK)", scroogeEnv[v]] : process.env[v] ? ["process env", process.env[v]] : null;
+  if (!answered) continue;
   anyKey = true;
-  const crewSrc = process.env[v] ? "process env" : crewEnv[v] ? "~/.agent-bus/.env (crew)" : scroogeEnv[v] ? "~/.token-scrooge/.env (FALLBACK)" : "none";
-  const crewKey = crew || scrooge;
+  const [crewSrc, crewKey] = answered;
   const scroogeFileKey = scroogeEnv[v] || "";
   if (!crewUsesVar(v)) {
     ok(`${v}: Scrooge only ${mask(scroogeFileKey || crewKey)} — no crew seat reads this var`);
@@ -287,11 +306,34 @@ for (const v of KEY_VARS) {
     ok(`${v}: crew ${mask(crewKey)} via ${crewSrc}${scroogeFileKey && scroogeFileKey !== crewKey ? ` · scrooge ${mask(scroogeFileKey)} via ~/.token-scrooge/.env` : ""}`);
   }
 }
-if (!anyKey) note("no provider API keys found in env, ~/.agent-bus/.env or ~/.token-scrooge/.env");
+if (!anyKey) note("no provider API keys found in the keychain, env, ~/.agent-bus/.env or ~/.token-scrooge/.env");
 else if (!shared) ok("crew and Scrooge spend on separate keys — each shows up as its own line item");
 else {
   warn(`${shared} provider key(s) do double duty (${sharedVars.join(", ")}) — a spike on the bill cannot be attributed to the crew or to Scrooge`,
-    `mint a second key per provider and give the CREW its own, e.g.: echo 'DEEPSEEK_API_KEY=<new-crew-key>' >> ~/.agent-bus/.env   (Scrooge keeps ~/.token-scrooge/.env; the runner sources ~/.agent-bus/.env last, so it wins)`);
+    `mint a second key per provider and give the CREW its own, e.g.: printf '%s' '<new-crew-key>' | trantor secrets set DEEPSEEK_API_KEY   (Scrooge keeps ~/.token-scrooge/.env; the store wins over every file)`);
+}
+// Keys still living in the file (#6393): a mode-600 file is still a file any process of yours can
+// read; the store is the keychain. Named by key so the fix is one command.
+const straggling = envFileSecrets();
+const storeNames = Object.keys(storeEnv);
+if (straggling.live.length && backendFor(process.env, { create: true }) !== "none") {
+  warn(`${straggling.live.length} key(s) still live in ~/.agent-bus/.env (${straggling.live.join(", ")})`,
+    "trantor secrets migrate   (each moves to the keychain; the line becomes a `# NAME -> keychain` stub)");
+} else if (straggling.live.length) {
+  note(`${straggling.live.length} key(s) live in ~/.agent-bus/.env (${straggling.live.join(", ")}) — no keychain on this platform; TRANTOR_SECRETS_BACKEND=file opts into a file store`);
+} else if (storeNames.length) {
+  ok(`secret store: ${storeNames.length} key(s) in the ${backendFor()} (${storeNames.join(", ")}), none left in .env`);
+}
+
+// ── Trantor State flags (#7159): the runners resolve these through ONE place — process env first,
+// ~/.agent-bus/.env second — and each line names the layer that answered, so a flag that LOOKED
+// applied can no longer pass for armed.
+section("trantor state flags");
+{
+  const resolved = resolveStateFlags();
+  const setFlags = Object.entries(resolved).filter(([, r]) => r.layer !== "unset");
+  for (const [name, r] of setFlags) ok(`${name}=${r.value} via ${r.layer}`);
+  if (!setFlags.length) note("no state flags set — Trantor State runs dark by default (TDD §11)");
 }
 
 // brain
@@ -304,13 +346,10 @@ prof?.providers && Object.keys(prof.providers).length
   ? ok(`quota profile set (${Object.entries(prof.providers).map(([k, v]) => `${k}=${v.plan}`).join(", ")})`)
   : warn("quota profile not set — the Advisor will assume API billing everywhere", `node ${join(ROOT, "bin", "profile.mjs")} set claude=max codex=plus deepseek=api …  (use YOUR real plans)`);
 
-// fleet — is the crew actually OPERATING, not just installed?
-//
-// Added 2026-09-09, because on that morning this command reported nine issues, every one about
-// provider keys and billing attribution, while the duty seat had been holding 48 undelivered
-// messages for 21.9 hours and the orchestrator had slept through a night of finished crew work.
-// Doctor checked whether credentials EXIST. Nothing checked whether the fleet was MOVING. These
-// two signals are both already on disk, written by the runner itself — nobody was reading them.
+// fleet — is the crew actually OPERATING, not just installed? Doctor once reported nine key and
+// billing issues while the duty seat had held 48 undelivered messages for 22 hours and finished
+// crew work went unread overnight: credentials EXIST is not the fleet is MOVING. Both signals are
+// already on disk, written by the runner itself.
 section("the fleet (is it actually running?)");
 {
   const busDir = join(H, ".agent-bus");
@@ -328,11 +367,10 @@ section("the fleet (is it actually running?)");
       const oldest = stamps.length ? Math.min(...stamps) : j?.ts;
       const hours = (Date.now() - oldest) / 3.6e6;
       const seat = f.replace(/^pending-|\.json$/g, "");
-      // Three bands, because one flat warning per stuck queue is its own failure: this machine has
-      // leftovers from projects that ended weeks ago, and a doctor that cries about ten of them
-      // every run teaches you to skim past the one that matters. Under an hour is the retry ladder
-      // doing its job. Over a week is an abandoned seat, worth tidying, not worth alarming about.
-      // The band between is the live stall — the shape of the 2026-09-09 incident.
+      // Three bands, because one flat warning per stuck queue is its own failure: leftovers from
+      // projects that ended weeks ago would drown the one that matters. Under an hour is the retry
+      // ladder doing its job; over a week is an abandoned seat, worth tidying, not alarming about;
+      // the band between is the live stall.
       const abandoned = hours >= 24 * 7;
       if (hours >= 1 && !abandoned) {
         stuck++;

package/bin/drill-report.mjs

@@ -68,7 +68,7 @@ export class DrillReport {
       if (!this.map[id].autoClose || result.status !== "pass" || this.closures[id]) continue;
       const response = await signedPost("/task/update", {
         id: Number(id), project: this.project, by: this.session, status: "done",
-        note: `trantor drill PASS\n${result.evidence.join("\n")}`.slice(0, 2000),
+        note: `Drill: trantor drill PASS\n${result.evidence.join("\n")}`.slice(0, 2000),   // "Drill:" prefix: the hub's done gate (#6452) reads it as the drill line
       }, { project: this.project, session: this.session, timeoutMs: 15000 });
       this.closures[id] = response.ok && response.json?.task?.status === "done"
         && response.json.task.id === Number(id) && response.json.task.project === this.project

package/bin/drill-report.test.mjs

@@ -51,6 +51,7 @@ test("signed closer on an enforce hub: complete evidence closes, partial/failure
     const card = (await signedGet("/tasks?project=trantor")).json.tasks[0];
     assert.equal(card.status, "done");
     assert.equal(card.workedBy, session);
+    assert.match(card.log.at(-1).text, /^Drill: trantor drill PASS/);   // #6452: the closer's note IS the drill line the hub gate requires
     assert.match(card.log.at(-1).text, /real evidence A/);
     assert.match(card.log.at(-1).text, /real evidence B/);
     assert.equal(JSON.parse(readFileSync(path, "utf8"))[id].closure, "done");