trantor 0.18.62 → 0.18.63

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.62",
+  "version": "0.18.63",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/bridge.mjs

@@ -62,6 +62,7 @@ const saveMap = () => { try { mkdirSync(dirname(MAPFILE), { recursive: true });
 
 const cardBody = (t) => ({ project: PROJECT, title: t.title, status: t.status, assignee: t.assignee || "",
   difficulty: t.difficulty || undefined, model: t.model || undefined, phase: t.phase || undefined,
+  drill: t.drill || undefined,   // #6452: a mirror keeps its source's drill line
   by: t.by || "", source: "bridge" });
 
 async function tick() {

package/bin/crew/core.mjs

@@ -2,6 +2,7 @@ import { accessSync, constants, existsSync, mkdirSync, readFileSync } from "node
 import { basename, dirname, join } from "node:path";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
+import { STATE_FLAGS } from "../../lib/state/flags.mjs";
 
 export const ROOT = dirname(dirname(dirname(fileURLToPath(import.meta.url))));
 
@@ -132,14 +133,11 @@ export function gridColumns(size) {
   return columns;
 }
 
-// Operator flags the RUNNER itself reads, forwarded from whoever launched the seat.
-//
-// The Trantor State flags are read as `process.env` INSIDE crew-runner.mjs, not by the CLI it
-// spawns — so ~/.agent-bus/.env (the crew key layer) cannot set them: that file is applied to the
-// spawned command, one level too deep. Without this list the flags documented in TDD §11 have no
-// supported way to reach a seat at all, which is how Phase 2a came to be "enabled" with a schema
-// file that was never written and a runner still on the transcript path.
-const FORWARDED_ENV = ["TRANTOR_STATE", "TRANTOR_STATE_ASSEMBLE", "TRANTOR_STATE_HANDOFF", "TRANTOR_STATE_GATE"];
+// Operator flags the RUNNER itself reads, forwarded from whoever launched the seat. The list lives
+// in lib/state/flags.mjs beside the resolver: the launcher env stays the forwarder (the runner boots
+// before any file is sourced), and #7159 lets the runner fall back to ~/.agent-bus/.env itself, so a
+// flag documented there finally arms the seat that reads it.
+const FORWARDED_ENV = STATE_FLAGS;
 
 export function runnerCommand(ctx, agent, model = "", effort = null) {
   const forwarded = FORWARDED_ENV

package/bin/crew-payload.mjs

@@ -6,6 +6,8 @@
 export const PAYLOAD_CAPS = Object.freeze({
   wakeCount: 10,       // direct/@mention messages: keep the last ~10
   wakeMsgChars: 2000,  // per-message body cap (the hub caps card notes at 2000 too)
+  wakeHeadChars: 1200, // #7063: over the per-message cap, keep the head…
+  wakeTailChars: 700,  // #7063: …AND the tail — a work order is asks-last, the instructions live there
   bcastCount: 10,      // FYI broadcast context: keep the last ~10
   bcastMsgChars: 1000,
   lessonsCount: 15,    // top ~15 lessons, ranked by relevance to this turn's trigger
@@ -22,8 +24,17 @@ export function capWake(wake, caps = PAYLOAD_CAPS) {
   const kept = list.slice(-caps.wakeCount);
   const lines = kept.map(m => {
     let body = String(m?.text ?? "");
-    if (body.length > caps.wakeMsgChars)
-      body = body.slice(0, caps.wakeMsgChars) + ` …[+${n(body.length - caps.wakeMsgChars)} chars of this message dropped]`;
+    // #7063: a work order is written context-first, asks-last, so a HEAD cut deleted exactly the
+    // instructions ("so, do this: 1) … 2) …") and kept the rationale — two orders lost their item 2
+    // in one turn. Over the per-message cap, keep the head AND the tail with ONE marker line
+    // between, so a card id, a base: line and the closing asks all survive. The cap is per
+    // message, never a batch budget (body > wakeMsgChars ⇒ elided > 0, the marker is always true).
+    if (body.length > caps.wakeMsgChars) {
+      const elided = body.length - caps.wakeHeadChars - caps.wakeTailChars;
+      body = body.slice(0, caps.wakeHeadChars)
+        + `\n…[${n(elided)} chars of this message elided from the middle]\n`
+        + body.slice(-caps.wakeTailChars);
+    }
     return `[${m?.from}${m?.to === "all" ? " -> all (mentions you)" : ""}]: ${body}`;
   });
   return { text: lines.join("\n"), kept: kept.length, total: list.length };

package/bin/crew-runner.mjs

@@ -33,6 +33,7 @@ import {
   breakerVerdict, describeTurn, hasJsonSchemaFlag, parseEnvelope, renderCardTail, runStep,
 } from "../lib/state/driver.mjs";
 import { costLine } from "../lib/state/cost.mjs";
+import { resolveStateFlags } from "../lib/state/flags.mjs";
 
 const AGENT = process.argv[2];
 const DIR = process.argv[3] || process.cwd();
@@ -247,7 +248,7 @@ const EFFORT_FLAG = EFFORT ? cliEffortFlag(AGENT, EFFORT) : { flag: "", text: ""
 
 // RUNNER_RULES / RUNNER_KICKOFF env overrides: the runner is also the substrate for non-crew
 // always-on seats (the fleet DUTY agent, bin/duty.mjs) whose doctrine is not "work your card".
-const RULES = process.env.RUNNER_RULES || `Rules: you are ${SESSION} on the trantor crew. Before starting a card, read YOUR card: relay_board with card:<id> (the card, its deps, its notes, and the last five done cards whose title shares a word); never the whole board. If your wake names no card id (or cites only a message-card), make relay_board with mine:true your FIRST call — it lists the cards assigned to you (doing/testing/todo, newest first, full card shape); work your newest one (#7763). Work your assigned file(s), report on the bus (relay_send, <280 chars), move your Kanban card as you go with a NOTE saying what you did (doing -> testing -> done; in 'testing' run YOUR OWN test file — never the full npm test, suites collide across seats — plus \`node bin/slop-gate.mjs\` when the repo has one: it lints ONLY your changed files against the anti-slop rules, and a card must not reach done with slop-gate failing; use 'failed' + a report if anything breaks). If a contract omits a fact you cannot proceed without, ASK — never invent the value: relay_ask(<card>, <question>) blocks the card with your question, keeps the turn owed (no park, no failure), and resumes you when the assigner's answer lands; an invented value that reads as reasoned is the worst outcome this crew ships (#7756). If you need something from another session, message THAT SESSION (relay_peers to find its id, relay_send to reach it) — never ask the human to pass it along; carrying messages between agents is the job this bus exists to remove. When your work for THIS message is finished, END YOUR TURN — do NOT park, do NOT loop relay_wait; the runner waits for you and will wake you with the next message. Path discipline: build/test from your worktree root ${TURN_DIR} with absolute paths or --manifest-path/--prefix instead of cd-ing into subdirs, and put anything that must land outside the repo under ${TURN_DIR}/.agent-bus-out/ (gitignored) — never ~/.agent-bus. Realigning your seat branch after the orchestrator harvested your commits is \`trantor sync\` run from your worktree: it reads the harvest receipts and refuses when an unharvested commit would be lost, so never reset or rebase onto main by hand. A contract's \`base: <sha>\` line is the integration head: start your seat branch at that sha (\`git reset --hard <sha>\` on the fresh branch), never at origin/main, which trails the orchestrator's unpushed integration commits; the object is already here as the ref \`main\`. If \`git cat-file -e <sha>\` fails, say \`cannot resolve base <sha>\` on the bus and move the card to blocked instead of reasoning from origin/main. Every testing/done note names the sha you verified against as \`verified at <sha>\`; a note without it is flagged HOLLOW. Cross-project action is a breach: never \`trantor up\` a crew, register a seat, or send a card/contract into a project other than ${PROJ} unless the operator ran \`trantor policy link ${PROJ} <other> --reason "<why>"\` first — the hub, the CLI and this runner all refuse it mechanically, so ask the operator to link the projects instead of routing around the refusal.`;
+const RULES = process.env.RUNNER_RULES || `Rules: you are ${SESSION} on the trantor crew. Before starting a card, read YOUR card: relay_board with card:<id> (the card, its deps, its notes, and the last five done cards whose title shares a word); never the whole board. If your wake names no card id (or cites only a message-card), make relay_board with mine:true your FIRST call — it lists the cards assigned to you (doing/testing/todo, newest first, full card shape); work your newest one (#7763). Work your assigned file(s), report on the bus (relay_send, <280 chars), move your Kanban card as you go with a NOTE saying what you did (doing -> testing, then STOP: you never close your own card to done — the orchestrator runs the card's drill on the built artifact and closes it, and the hub refuses a move to done on a card with no drill line anyway; in 'testing' run YOUR OWN test file — never the full npm test, suites collide across seats — plus \`node bin/slop-gate.mjs\` when the repo has one: it lints ONLY your changed files against the anti-slop rules, and a card must not reach testing with slop-gate failing; use 'failed' + a report if anything breaks). If a contract omits a fact you cannot proceed without, ASK — never invent the value: relay_ask(<card>, <question>) blocks the card with your question, keeps the turn owed (no park, no failure), and resumes you when the assigner's answer lands; an invented value that reads as reasoned is the worst outcome this crew ships (#7756). If you need something from another session, message THAT SESSION (relay_peers to find its id, relay_send to reach it) — never ask the human to pass it along; carrying messages between agents is the job this bus exists to remove. When your work for THIS message is finished, END YOUR TURN — do NOT park, do NOT loop relay_wait; the runner waits for you and will wake you with the next message. Path discipline: build/test from your worktree root ${TURN_DIR} with absolute paths or --manifest-path/--prefix instead of cd-ing into subdirs, and put anything that must land outside the repo under ${TURN_DIR}/.agent-bus-out/ (gitignored) — never ~/.agent-bus. Realigning your seat branch after the orchestrator harvested your commits is \`trantor sync\` run from your worktree: it reads the harvest receipts and refuses when an unharvested commit would be lost, so never reset or rebase onto main by hand. A contract's \`base: <sha>\` line is the integration head: start your seat branch at that sha (\`git reset --hard <sha>\` on the fresh branch), never at origin/main, which trails the orchestrator's unpushed integration commits; the object is already here as the ref \`main\`. If \`git cat-file -e <sha>\` fails, say \`cannot resolve base <sha>\` on the bus and move the card to blocked instead of reasoning from origin/main. Every testing/done note names the sha you verified against as \`verified at <sha>\`; a note without it is flagged HOLLOW. Cross-project action is a breach: never \`trantor up\` a crew, register a seat, or send a card/contract into a project other than ${PROJ} unless the operator ran \`trantor policy link ${PROJ} <other> --reason "<why>"\` first — the hub, the CLI and this runner all refuse it mechanically, so ask the operator to link the projects instead of routing around the refusal.`;
 
 // ---- the pulse --------------------------------------------------------------
 // RUNNER_PULSE_MS re-runs an orchestrator seat's mission note on a cadence when the bus is silent;
@@ -543,8 +544,13 @@ async function reportHealthy() {
 }
 
 // ---- Trantor State Phase 2a — the flagged path (TDD §4.1, §4.6, §7.3) -----------------------
-// Off by default, and off means the transcript path runs unchanged. Reachable only when the operator
-// set TRANTOR_STATE_ASSEMBLE=1, the seat is `claude` (§7.3) and the CLI carries --json-schema (§6).
+// Off by default — off means the transcript path runs unchanged. #7159: the flags resolve through
+// the one place (lib/state/flags.mjs), launcher env first and ~/.agent-bus/.env filling the rest;
+// resolved values are applied fill-only to process.env so downstream reads (runGate's GATE) agree.
+const stateFlags = resolveStateFlags();
+for (const [name, flag] of Object.entries(stateFlags)) {
+  if (flag.value && process.env[name] === undefined) process.env[name] = flag.value;
+}
 const STATE_FLAG_ON = process.env[STATE_ENV] === "1";
 const STATE_SCHEMA_FILE = join(homedir(), ".agent-bus", `state-schema-${AGENT}-${PROJ}.json`);
 const STATE_MODE = (() => {
@@ -558,7 +564,7 @@ const STATE_MODE = (() => {
   } catch (e) { log(`\x1b[33mstate mode OFF — could not write ${STATE_SCHEMA_FILE}: ${e.message}\x1b[0m`); return false; }
   // #7060: the checks above prove CONFIGURATION, not the prompt, so say "armed" and name the one
   // thing that engages it; each turn then reports which path it took.
-  log(`\x1b[36mTrantor State: ASSEMBLE armed for this seat (schema ${STATE_SCHEMA_FILE})\x1b[0m`);
+  log(`\x1b[36mTrantor State: ASSEMBLE armed for this seat (${STATE_ENV}=${stateFlags[STATE_ENV].value} via ${stateFlags[STATE_ENV].layer}; schema ${STATE_SCHEMA_FILE})\x1b[0m`);
   log(`\x1b[36m  a turn is assembled only when a wake ASSIGNS it a card — the kickoff and every pulse run the transcript path, and each turn says which one it took\x1b[0m`);
   return true;
 })();
@@ -615,6 +621,14 @@ let statePromotedHash;
 // TRANTOR_TURN_MAX_MS ends the CLI's process group at the box and runs ONE follow-up turn in the
 // same session ("commit what is done, move the card, report") so a cut turn lands its work.
 const TURN_MAX_MS = Math.max(0, Number(process.env.TRANTOR_TURN_MAX_MS || 20 * 60 * 1000));
+// #7761: the box counts LIVENESS. At the deadline a turn that moved within the stall window is
+// extended one step (half the box: +10m at the default) up to TRANTOR_TURN_CEILING_MS, the one
+// knob (default 60m). A ceiling at or under the box disables extension; a silent turn still ends
+// at the #7752 stall window, extended or not. The watchdog owns the clock — see turn-watchdog.mjs.
+const TURN_CEILING_MS = TURN_MAX_MS ? Math.max(0, Number(process.env.TRANTOR_TURN_CEILING_MS || 60 * 60 * 1000)) : 0;
+const TURN_EXTEND_MS = Math.ceil(TURN_MAX_MS / 2);
+const TURN_EXTENSIONS_MAX = TURN_EXTEND_MS > 0 && TURN_CEILING_MS > TURN_MAX_MS
+  ? Math.floor((TURN_CEILING_MS - TURN_MAX_MS) / TURN_EXTEND_MS) : 0;
 const TIME_BOX_PROMPT = "your previous turn was cut at the time box; commit what is done, move the card with a note, report in one line";
 let inFollowUp = false;
 // #6289: whether the turn that just ended was CUT at the time box. The follow-up recursion
@@ -715,12 +729,23 @@ async function runTurn(prompt, isFirst, trigger = "kickoff", opts = {}) {
   // instead of burning the box. Unlinked at turn start and again with the cut cleanup.
   const STALLF = join(homedir(), ".agent-bus", `turnstall-${AGENT}-${PROJ}`);
   try { unlinkSync(STALLF); } catch {}
+  // #7761: the watchdog writes the extended deadline (epoch seconds) here for the shell box to
+  // re-read, and one row per extension to EXTF for the ledger. Both unlinked at turn start.
+  const DEADLINEF = join(homedir(), ".agent-bus", `turndeadline-${AGENT}-${PROJ}`);
+  const EXTF = join(homedir(), ".agent-bus", `turnext-${AGENT}-${PROJ}`);
+  try { unlinkSync(DEADLINEF); } catch {}
+  try { unlinkSync(EXTF); } catch {}
+  const boxPlan = TURN_EXTENSIONS_MAX ? {
+    maxMs: TURN_MAX_MS, extendMs: TURN_EXTEND_MS, ceilingMs: TURN_CEILING_MS, extensionsMax: TURN_EXTENSIONS_MAX,
+    deadlineFile: DEADLINEF, extFile: EXTF, card: sessionCard || 0,
+    assigners: (opts.assigners || []).map(a => ({ from: a.from, id: a.id })),
+  } : undefined;
   // Touched by the stderr scrubber as its LAST act (the shell below); node waits for it after
   // spawnSync before reading ERRF — see the drain note at the spawnSync call.
   const DRAINF = join(homedir(), ".agent-bus", `turndrain-${AGENT}-${PROJ}`);
   try { unlinkSync(DRAINF); } catch {}
   try {
-    writeFileSync(STAMPF, JSON.stringify({ turn: TURN, startedAt: Date.now(), runner: RUNNER_ID }));
+    writeFileSync(STAMPF, JSON.stringify({ turn: TURN, startedAt: Date.now(), runner: RUNNER_ID, box: boxPlan }));
     const wd = spawn(process.execPath, [join(import.meta.dirname, "turn-watchdog.mjs"), STAMPF, ERRF, String(WD_MS), SESSION, PROJ, HUB, TRANSCRIPT_DIR, TURN_DIR,
       // #7752: the stall marker only exists when a box does — with no box there is no sweep to
       // end the turn, so the watchdog stays report-only (reporting is the whole job, boxless).
@@ -742,6 +767,7 @@ ${sweep}
   deadline=$(( $(date +%s) + ${Math.ceil(TURN_MAX_MS / 1000)} ))
   while :; do
     [ -f "${STALLF}" ] && break
+    d=$(cat "${DEADLINEF}" 2>/dev/null); case "$d" in ""|*[!0-9]*) ;; *) deadline=$d;; esac
     [ "$(date +%s)" -ge "$deadline" ] && break
     sleep 1 & sleeppid=$!
     wait "$sleeppid"
@@ -777,7 +803,7 @@ exit $turn_exit`;
   // A BACKSTOP only, deliberately later than the shell's own box: if bash itself wedges, node
   // still ends the turn. When the in-shell box works — the normal path — this never fires, which
   // is the point: the shell kills while the tree is still walkable, node cannot.
-  if (TURN_MAX_MS) { spawnOpts.timeout = TURN_MAX_MS + 30000; spawnOpts.killSignal = "SIGKILL"; }
+  if (TURN_MAX_MS) { spawnOpts.timeout = (TURN_EXTENSIONS_MAX ? TURN_CEILING_MS : TURN_MAX_MS) + 30000; spawnOpts.killSignal = "SIGKILL"; }
   const r = spawnSync("/bin/bash", ["-c", shell], spawnOpts);
   // The shell's box leaves the marker; the backstop leaves an ETIMEDOUT. Either way the turn was
   // cut, not merely failed. A stall marker (#7752) outranks the box marker: a turn silent for
@@ -785,6 +811,13 @@ exit $turn_exit`;
   const boxed = existsSync(CUTF);
   const stallCut = existsSync(STALLF);
   const cut = !!TURN_MAX_MS && (boxed || stallCut || r.error?.code === "ETIMEDOUT");
+  // #7761: how far the watchdog moved the box, one EXTF row per extension. boxMs is the box the
+  // turn actually had, so a ceiling cut reads as the ceiling, never as the 20-minute default.
+  let extensions = 0;
+  try { extensions = readFileSync(EXTF, "utf8").split("\n").filter(Boolean).length; } catch {}
+  const boxMs = TURN_MAX_MS + extensions * TURN_EXTEND_MS;
+  try { unlinkSync(DEADLINEF); } catch {}
+  try { unlinkSync(EXTF); } catch {}
   // DRAIN before classifying, never on a CUT turn (the sweep killed the scrubber, its marker never
   // comes). bash 3.2 `wait` skips process substitutions, so wait for DRAINF, bounded.
   if (!cut) {
@@ -800,6 +833,7 @@ exit $turn_exit`;
     try { unlinkSync(CUTF); } catch {}
     try { unlinkSync(STALLF); } catch {}
     if (stallCut) log(`\x1b[33mturn STALLED — no bytes on either stream and no transcript advance for ${Math.round(WD_MS / 60000)}m; ended at the stall window, not the ${Math.round(TURN_MAX_MS / 1000)}s box\x1b[0m`);
+    else if (extensions) log(`\x1b[33mturn cut at the ${Math.round(boxMs / 1000)}s box after ${extensions} liveness extension(s) (ceiling ${Math.round(TURN_CEILING_MS / 1000)}s) — CLI and every descendant ended${boxed ? "" : " (node backstop: bash itself was wedged)"}\x1b[0m`);
     else log(`\x1b[33mturn cut at the ${Math.round(TURN_MAX_MS / 1000)}s time box — CLI and every descendant ended${boxed ? "" : " (node backstop: bash itself was wedged)"}\x1b[0m`);
   }
   lastTurnCut = cut;
@@ -883,6 +917,7 @@ exit $turn_exit`;
   const telemetryRow = { ts: Date.now(), agent: AGENT, project: PROJ, turn: TURN, trigger, card: sessionCard || 0, model: MODEL || "cli-default", duration_ms: Date.now() - t0, exit: realExit, effExit, authFailed: effExit !== realExit, emptyOutput: lastEmptyOutput, emptyTurn: lastEmptyTurn, verdict, outcome: finalOutcome, tokens };
   if (cut) telemetryRow.cut = true;
   if (stallCut) telemetryRow.stalled = true;
+  if (extensions) { telemetryRow.extensions = extensions; telemetryRow.boxMs = boxMs; }
   // #7752/#7099: a cut turn's 141/137 is the sweep's own signal (SIGPIPE/SIGKILL), recorded as
   // the cut signal — never read as a quota or crash pattern downstream.
   if (cut) { const sig = cutSignalFor(realExit); if (sig) telemetryRow.cutSignal = sig; }
@@ -920,7 +955,7 @@ async function stateTurn({ card, observation, trigger, assigners = [] }) {
       callCli: async (prompt) => {
         // isFirst=true every step ON PURPOSE: a state step carries no `-c`, so there is no session
         // to resume and a stale sid must never be handed to one.
-        const exit = await runTurn(prompt, true, trigger, { state: true });
+        const exit = await runTurn(prompt, true, trigger, { state: true, assigners });
         return { exit, stdout: lastEnvelope, cut: lastTurnCut };
       },
       executeAction: async (action) => {
@@ -1367,9 +1402,17 @@ async function resolveWakeCard(messages, { session }) {
     await loadLessons();
     const lessons = pickLessons(LESSONS_RAW, wakeCapped.text + " " + bcastCapped.text);
     const trigger = wakeForTurn.some(m => m.to === SESSION) ? "direct message" : "@mention";
-    // Who is owed an answer, captured BEFORE the turn: pendingWake is cleared on success.
+    // Who is owed an answer, captured BEFORE the turn: pendingWake is cleared on success. The id is
+    // the NEWEST wake this runner holds for that assigner (#6987): append order means first-wins
+    // threaded the receipt onto a PREVIOUS turn's id — the original contract, not the answer that
+    // released this turn — which kept the contract reading WAITING while the stop hook chased.
     const assigners = [];
-    for (const m of wakeForTurn) if (m.from && !assigners.some(a => a.from === m.from)) assigners.push({ from: m.from, id: m.id });
+    for (const m of wakeForTurn) {
+      if (!m.from) continue;
+      const held = assigners.find(a => a.from === m.from);
+      if (held) held.id = m.id;
+      else assigners.push({ from: m.from, id: m.id });
+    }
     const asked = askedExcerpt(wakeForTurn[0]);
     const tStart = Date.now();
     // #6134: ONE SESSION PER CARD; a different card starts a fresh CLI session and the seat is told.
@@ -1428,7 +1471,7 @@ async function resolveWakeCard(messages, { session }) {
           // dies quietly (§4.6).
           observation: [stateObservation, wakeText, ctxText, againText + freshText + baseText].filter(Boolean).join("\n"),
         })
-        : await runTurn(prompt, fresh, deliveryFails ? `${trigger} (redelivery)` : trigger, { judgeOutcome: askJudge });
+        : await runTurn(prompt, fresh, deliveryFails ? `${trigger} (redelivery)` : trigger, { judgeOutcome: askJudge, assigners });
     }
     finally { stopDutyNudgeWatcher(); }
     const secs = Math.round((Date.now() - tStart) / 1000);

package/bin/doctor.mjs

@@ -13,6 +13,7 @@ import { loadOrCreate } from "../lib/identity.mjs";
 import { sfetchJson } from "../lib/signed-fetch.mjs";
 import { scan } from "../lib/splitbrain.mjs";
 import { resolveSecrets, envFileSecrets, backendFor } from "../lib/secrets.mjs";
+import { resolveStateFlags } from "../lib/state/flags.mjs";
 
 const H = homedir();
 const ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
@@ -324,6 +325,17 @@ if (straggling.live.length && backendFor(process.env, { create: true }) !== "non
   ok(`secret store: ${storeNames.length} key(s) in the ${backendFor()} (${storeNames.join(", ")}), none left in .env`);
 }
 
+// ── Trantor State flags (#7159): the runners resolve these through ONE place — process env first,
+// ~/.agent-bus/.env second — and each line names the layer that answered, so a flag that LOOKED
+// applied can no longer pass for armed.
+section("trantor state flags");
+{
+  const resolved = resolveStateFlags();
+  const setFlags = Object.entries(resolved).filter(([, r]) => r.layer !== "unset");
+  for (const [name, r] of setFlags) ok(`${name}=${r.value} via ${r.layer}`);
+  if (!setFlags.length) note("no state flags set — Trantor State runs dark by default (TDD §11)");
+}
+
 // brain
 section("the brain");
 has("scrooge") || existsSync(join(H, ".local", "bin", "scrooge"))

package/bin/drill-report.mjs

@@ -68,7 +68,7 @@ export class DrillReport {
       if (!this.map[id].autoClose || result.status !== "pass" || this.closures[id]) continue;
       const response = await signedPost("/task/update", {
         id: Number(id), project: this.project, by: this.session, status: "done",
-        note: `trantor drill PASS\n${result.evidence.join("\n")}`.slice(0, 2000),
+        note: `Drill: trantor drill PASS\n${result.evidence.join("\n")}`.slice(0, 2000),   // "Drill:" prefix: the hub's done gate (#6452) reads it as the drill line
       }, { project: this.project, session: this.session, timeoutMs: 15000 });
       this.closures[id] = response.ok && response.json?.task?.status === "done"
         && response.json.task.id === Number(id) && response.json.task.project === this.project

package/bin/drill-report.test.mjs

@@ -51,6 +51,7 @@ test("signed closer on an enforce hub: complete evidence closes, partial/failure
     const card = (await signedGet("/tasks?project=trantor")).json.tasks[0];
     assert.equal(card.status, "done");
     assert.equal(card.workedBy, session);
+    assert.match(card.log.at(-1).text, /^Drill: trantor drill PASS/);   // #6452: the closer's note IS the drill line the hub gate requires
     assert.match(card.log.at(-1).text, /real evidence A/);
     assert.match(card.log.at(-1).text, /real evidence B/);
     assert.equal(JSON.parse(readFileSync(path, "utf8"))[id].closure, "done");

package/bin/reconcile.mjs

@@ -45,8 +45,25 @@ async function tasks() {
   const j = r.json;
   return Array.isArray(j) ? j : (j?.tasks || j?.cards || []);
 }
-async function move(id, status) {
-  await signedPost("/task/update", { id, status, by: "reconcile" }, { timeoutMs: 4000 }).catch(() => {});
+async function move(id, status, note) {
+  return signedPost("/task/update", { id, status, by: "reconcile", note }, { timeoutMs: 4000 })
+    .catch(e => ({ ok: false, status: 0, json: { error: e.message } }));
+}
+// #6452: the hub refuses done on a card with no drill line, and reconcile cannot claim a drill it
+// never ran. A card judged shipped closes when it already carries a drill line; otherwise it parks
+// at testing with the verdict on its log, and the orchestrator runs the drill and closes it.
+async function close(x) {
+  const note = `reconcile: judged shipped${x.commit ? ` at ${x.commit}` : ""}${x.reason ? ` — ${x.reason}` : ""}`;
+  const r = await move(x.t.id, "done", note);
+  if (r.ok) return "closed";
+  if (r.status === 409 && /drill/i.test(r.json?.error || "")) {
+    const parked = await move(x.t.id, "testing", `${note}; no drill line on the card, so it waits at testing for the orchestrator's drill`);
+    if (parked.ok) return "parked";
+    console.error(`    #${x.t.id}: hub ${parked.status} ${parked.json?.error || ""}`);
+    return "failed";
+  }
+  console.error(`    #${x.t.id}: hub ${r.status} ${r.json?.error || ""}`);
+  return "failed";
 }
 // the memory record for THIS project (Claude Code stores it per encoded-cwd); optional context.
 function memoryExcerpt() {
@@ -118,6 +135,7 @@ if (!doIt) {
   console.log(`\n  ${done.length} card(s) → done, ${stale.length} → stale. Re-run to apply:\n    trantor reconcile${val("--older", "-o") ? ` --older ${val("--older", "-o")}` : ""} --yes\n`);
   process.exit(0);
 }
-for (const x of done) await move(x.t.id, "done");
+const outcome = { closed: 0, parked: 0, failed: 0 };
+for (const x of done) outcome[await close(x)]++;
 for (const x of stale) await move(x.t.id, "stale");
-console.log(`\n  ✓ reconciled: ${done.length} closed as done, ${stale.length} moved to stale. ${active.length} left active.\n`);
+console.log(`\n  ✓ reconciled: ${outcome.closed} closed as done${outcome.parked ? `, ${outcome.parked} parked at testing (no drill line)` : ""}${outcome.failed ? `, ${outcome.failed} refused` : ""}, ${stale.length} moved to stale. ${active.length} left active.\n`);

package/bin/turn-watchdog.mjs

@@ -1,22 +1,9 @@
 #!/usr/bin/env node
-// Turn watchdog (#5684, reworked #6206). runTurn is spawnSync — the runner cannot watch its own
-// turn — so this DETACHED helper does: armed at turn start, disarmed by turn end. A turn past
-// the window with NO new activity earns ONE direct stall report to the foreman (episode, never a
-// timer storm). With no stall file (report-only mode) the turn is never killed — reporting is
-// the whole job. With one (#7752, kill mode) a turn silent on EVERY channel for the whole
-// window is also ENDED at the window: the marker tells the runner's shell box to sweep early,
-// so the kill itself still lives in exactly one place — the shell that owns $job.
-//
-// #6206: stdout silence is NOT a stall — `claude -p` prints nothing until the turn ends by
-// design, so a seat editing five files was reported STALLED while its transcript advanced.
-// Liveness is new activity in the seat's transcript (the CLI's session file), its worktree, or
-// stderr growth; silence on ALL of them for a whole window is the only thing reported. And a
-// watchdog never speaks for a runner it does not belong to: the stamp carries the runner's
-// instance id, so a survivor of a replaced runner exits on mismatch or runner death instead of
-// re-matching the NEW runner's turn number (the 09:47 false alarm was exactly that orphan).
-//
+// Turn watchdog (#5684, #6206, #7752, #7761): runTurn is spawnSync, so this DETACHED helper watches
+// the turn — liveness = transcript, worktree or stderr moving; a whole silent window earns ONE stall
+// report, and in kill mode (stall file given) also ends the turn via the shell box. Stamp-bound to one runner.
 //   node bin/turn-watchdog.mjs <stampFile> <errFile> <windowMs> <session> <project> <hubUrl> <transcriptDir> <workDir> [stallFile]
-import { readFileSync, writeFileSync, statSync, readdirSync } from "node:fs";
+import { readFileSync, writeFileSync, appendFileSync, statSync, readdirSync } from "node:fs";
 import { join } from "node:path";
 import { hostId } from "../lib/project.mjs";
 import { signedPost } from "../hooks/lib/api.mjs";
@@ -74,14 +61,29 @@ let baseErr = errSize();
 const armedAt = armed.startedAt || Date.now();
 const SLACK = 2000;   // timestamp granularity + scheduler drift under load
 
-// #7752 kill mode: poll liveness continuously and, on a whole window of silence on EVERY
-// channel, write the stall marker, report once, exit. The runner's shell box sweeps the CLI
-// when it sees the marker, so a silent turn ends at the window instead of burning the box.
-// stderr liveness is measured ROLLING here (growth since the last poll, not since arm): the
-// question is "any bytes in this window", not "any bytes ever".
+// #7752 kill mode: poll liveness; a whole window silent on EVERY channel writes the stall marker
+// (the shell box sweeps on it), reports once, exits; stderr is measured ROLLING (bytes this window).
+// #7761: `armed.box` (step, ceiling, assigners) exists only when a ceiling above the box does; a
+// deadline one poll away on a turn that moved within the window is pushed out one step.
+const box = stallFile && armed.box && Number(armed.box.extensionsMax) > 0 ? armed.box : null;
+const mins = (ms) => `${Math.max(1, Math.round(ms / 60000))}m`;
+const secsOrMins = (ms) => (ms >= 60000 ? mins(ms) : `${Math.round(ms / 1000)}s`);
+async function tellExtension(text) {
+  const orch = `${hostId()}:${project}`;
+  const seen = new Set();
+  for (const a of [...(box.assigners || []), { from: orch }]) {
+    const to = String(a?.from || "");
+    if (!to || to === "all" || to === session || to.startsWith("hub:") || seen.has(to)) continue;
+    seen.add(to);
+    try { await signedPost(`${hub}/send`, { from: session, to, text, project, kind: "status", wake: false }, { session }); } catch {}
+  }
+}
+
 if (stallFile) {
   const poll = Math.max(250, Math.min(windowMs / 4, 10000));
   let lastErrAt = armedAt;
+  let deadline = armedAt + (box ? Number(box.maxMs) : 0);
+  let extensions = 0;
   for (;;) {
     await sleep(poll);
     const s = readStamp();
@@ -93,7 +95,17 @@ if (stallFile) {
     const freshCut = Math.max(armedAt, now - windowMs - SLACK);
     const tr = transcriptDir ? newestMtime(transcriptDir) : 0;
     const wk = workDir ? newestMtime(workDir) : 0;
-    if (tr > freshCut || wk > freshCut || now - lastErrAt < windowMs) continue;   // producing work: alive
+    if (tr > freshCut || wk > freshCut || now - lastErrAt < windowMs) {           // producing work: alive
+      if (box && extensions < Number(box.extensionsMax) && now + poll + SLACK >= deadline) {
+        extensions++;
+        deadline += Number(box.extendMs);
+        try { writeFileSync(box.deadlineFile, String(Math.floor(deadline / 1000))); } catch {}
+        try { appendFileSync(box.extFile, JSON.stringify({ n: extensions, at: now, until: deadline }) + "\n"); } catch {}
+        const card = Number(box.card) > 0 ? ` on #${box.card}` : "";
+        await tellExtension(`⏳ ${session} turn extended +${secsOrMins(Number(box.extendMs))} (${extensions}/${box.extensionsMax})${card} — alive: ${describeLast({ tr, wk })}${now - lastErrAt < windowMs ? ", stderr moving" : ""}; box now ${secsOrMins(deadline - armedAt)} of a ${secsOrMins(Number(box.ceilingMs))} ceiling`);
+      }
+      continue;
+    }
     try { writeFileSync(stallFile, ""); } catch {}
     const mins = Math.round((now - armedAt) / 60000);
     const orch = `${hostId()}:${project}`;

package/docs/BUILD-DOCTRINE.md

@@ -0,0 +1,117 @@
+# Build doctrine
+
+How Trantor is built, and how every project run through Trantor is built. These are rules with
+a gate each, not advice. An orchestrator that cannot show the gate has not followed the rule.
+Operator ruling 2026-09-04, after a week in which the code was heavily tested and still broke on
+the real path four times.
+
+## 1. The real path is the gate
+
+- Every card names its drill: the exact thing a person does on the built artifact and what they
+  must see. A card without a drill line is not ready to be worked.
+- Nothing merges until the orchestrator has run that drill on the built artifact (the installed
+  app, the live hub, the real CLI on this machine) and written the result on the card.
+- Unit tests are necessary and never sufficient. "All tests green" is not evidence that the
+  operator will see the feature work.
+- The seat that wrote the code never closes its own card to done. Testing is the seat's last
+  move; done is the orchestrator's, after the drill.
+
+## 2. Red blocks merge
+
+- The whole suite runs on every push in CI. A red suite blocks merge, no exceptions.
+- A suite red for more than one day is an incident with a card, not debt to be gated around.
+- A flaky test is fixed or deleted within a week. Timing drills live in a quarantine lane that
+  cannot hide a real failure.
+- Tests never depend on the runner's own environment (identity badge, pane id, project). A test
+  that inherits the badge and passes is lying.
+
+## 3. One owner per subsystem
+
+- Every subsystem (runner, hub, hooks, crew launcher, desktop shell, chat, code, board) has one
+  named owner per wave. The owner reviews every change to it and may say no.
+- A cross-seat edit to a subsystem goes through its owner over the bus before it lands.
+- The orchestrator owns the gates and the merges. No seat merges to main.
+
+## 4. Causes, not symptoms
+
+- A fix names its cause in the commit message and adds the drill that fails without the fix.
+  "Made X not happen" without a why is bounced.
+- A second fix in the same seam within a week stops the line: the seam gets a contract document
+  (docs/CONTRACT-*.md) reviewed by the orchestrator before more code lands there.
+- Trace first. A bug report becomes a card only after the orchestrator has the trace, log, or
+  crash report line that shows the mechanism. Guessing is not a plan.
+
+## 5. Fewer parts
+
+- Prefer deleting to patching. A subsystem that has needed three fixes in a month is a candidate
+  for removal, not a fourth fix.
+- No hand-rolled protocol, transport, sync, or auth layer when a maintained library does the job.
+  If the library is installed, use it the way it is meant to be used; do not bypass it.
+- Look at the reference product first (the Orca rule). Adopt its shape, then adapt. Inventing is
+  the last option and needs a stated reason.
+
+## 6. Shape limits
+
+- A source file is at most 800 lines (Rust 1,000). A function is at most 80 lines. Past the
+  limit, split by feature before adding to it.
+- One language per layer. A shell script that parses JSON becomes a Node program.
+- A module has one reason to change. A file named after a card, a date, or a person is wrong.
+
+## 7. Comments and records
+
+- A code comment is one line of why. The incident story lives on the card or in docs, and the
+  comment links to it by number.
+- Contracts live in docs/CONTRACT-*.md and are the source of truth for a seam. Code that
+  contradicts a contract is the bug, whichever came second.
+- Memory records decisions and traps, not code structure. The repo records code.
+
+## 8. Rust and native boundaries
+
+- No `unwrap` or `expect` outside tests. Clippy denies `unwrap_used` and `expect_used`.
+- Every callback boundary into native code (extern "C", event handlers, window callbacks)
+  catches panics and logs them. A panic there aborts the app, and the crash report will not say
+  why.
+- A patched or vendored dependency carries the upstream issue link and an expiry date in its
+  directory. Past the expiry, it is re-evaluated, not kept by default.
+
+## 9. Dependencies and releases
+
+- Dependencies are pinned. An upgrade is a card with a drill, never a side effect.
+- A release is: version bump, build, install on the operator's machine, drill, card note, memory
+  line. Published is not shipped; installed and drilled is shipped.
+- Every substantive change reports with the four evidence blocks: code written, builds (command
+  and exit code), tested (command and counts), observed (the drill result). A report missing one
+  says which and why.
+
+## 10. Turn economy
+
+- A seat's turn ends with a commit. Work that is not committed does not exist.
+- A contract names the card, the files, the gate, and the drill. It never says "look into".
+- No acks over the bus. A message either carries a contract, a bounce, a delivery, or a question
+  that blocks work. Everything else is batched or not sent.
+- A seat that exits non-zero twice on one contract parks. The orchestrator reads why before
+  anything is redelivered.
+
+## 11. Anything that warns
+
+The monitoring doctrine applies: state, not event; episodes, not timers; never warn about what
+the operator declared; report duration, not repetition; quiet is not dead; every wake costs a
+turn.
+
+## 12. Seats never touch the operator's live surfaces
+
+- A seat never launches, quits, installs or replaces the installed app; never drives the running
+  app's UI; never logs the operator into or out of any provider; never runs `trantor up`, `down`
+  or `open` for any seat, its own included. These are the operator's surfaces and the
+  orchestrator's hands.
+- A seat's real-path evidence ends at: tests green, a build that exits 0 from its own worktree,
+  and a note naming the drill. The orchestrator runs the drill, with the operator when it touches
+  a live account.
+- A seat dispatches no sessions of its own outside its worktree. Work that leaves the worktree
+  does not exist.
+
+## 13. Audit
+
+A project is audited against this document before its next wave: file shape, test tree and CI,
+owners, real-path drills, dependency pins, comment policy. The audit produces a scorecard and a
+consolidation phase, and the wave waits for the phase where the scorecard says so.

package/hooks/sessionstart.mjs

@@ -16,6 +16,30 @@ import { getJSON, signedGet, signedPost, loadIdentity } from "./lib/api.mjs";
 import { ledgerPaths, ensureStart, anchorCursor, writeCursor } from "./lib/inbox-ledger.mjs";
 import { ensureEnrolled } from "../lib/enroll.mjs";
 
+// The build doctrine (docs/BUILD-DOCTRINE.md) in short form, one line per rule, injected for every
+// project's ORCHESTRATOR at boot (#6452): orchestrators that never opened the doc missed the ruling.
+// test/hooks/test.mjs checks every heading of the doc has a line here, so the two cannot drift.
+function buildDoctrineShortForm() {
+  const doc = join(dirname(dirname(fileURLToPath(import.meta.url))), "docs", "BUILD-DOCTRINE.md");
+  return `<trantor-build-doctrine>\n` +
+    `📐 **Build doctrine** (operator ruling 2026-09-04; rules with a gate each, not advice). Full text: ${doc}\n` +
+    `1. The real path is the gate — every card names its DRILL (what a person does on the built artifact and must see); nothing merges until you ran it and wrote the result on the card; unit tests are never sufficient; the seat that wrote the code never closes its own card to done (testing is the seat's last move, done is yours after the drill).\n` +
+    `2. Red blocks merge — a red suite blocks merge; red for a day is an incident with a card; a flaky test is fixed or deleted within a week; no test inherits the runner's identity.\n` +
+    `3. One owner per subsystem — one named owner per wave who reviews every change; cross-seat edits go through the owner over the bus; you own the gates and merges, no seat merges to main.\n` +
+    `4. Causes, not symptoms — a fix names its cause in the commit and adds the drill that fails without it; a second fix in one seam within a week stops the line for a docs/CONTRACT-*.md; trace first, a bug becomes a card only with the mechanism in hand.\n` +
+    `5. Fewer parts — prefer deleting to patching (three fixes in a month = removal candidate); no hand-rolled protocol/transport/sync/auth when a maintained library does it; look at the reference product first (the Orca rule).\n` +
+    `6. Shape limits — a file is at most 800 lines (Rust 1,000), a function at most 80; one language per layer; a module has one reason to change and is never named after a card, date or person.\n` +
+    `7. Comments and records — a code comment is one line of why linking the card; contracts live in docs/CONTRACT-*.md and code that contradicts one is the bug; memory records decisions and traps, the repo records code.\n` +
+    `8. Rust and native boundaries — no unwrap/expect outside tests (clippy denies them); every callback into native code catches and logs panics; a patched/vendored dependency carries its upstream link and an expiry date.\n` +
+    `9. Dependencies and releases — dependencies are pinned and an upgrade is a card with a drill; a release is bump, build, install on the operator's machine, drill, card note, memory line (published is not shipped); every report carries the four evidence blocks: code, build, tests, observed.\n` +
+    `10. Turn economy — a seat's turn ends with a commit (uncommitted work does not exist); a contract names card, files, gate and drill, never "look into"; no acks over the bus; a seat that exits non-zero twice on one contract parks.\n` +
+    `11. Anything that warns — the monitoring doctrine: state not event, episodes not timers, never warn about what the operator declared, report duration not repetition, quiet is not dead, every wake costs a turn.\n` +
+    `12. Seats never touch the operator's live surfaces — a seat never launches/quits/installs the app, drives its UI, logs into providers, or runs trantor up/down/open; its evidence ends at tests green, a build from its worktree and a note naming the drill; you run the drill.\n` +
+    `13. Audit — a project is audited against the doctrine before its next wave (file shape, tests and CI, owners, drills, pins, comments); the wave waits for the consolidation phase the scorecard demands.\n` +
+    `Mechanics: relay_task_add has a \`drill\` field; the hub refuses any move to done, yours included, when the card carries no drill line.\n` +
+    `</trantor-build-doctrine>\n`;
+}
+
 // Load the most recent UNCONSUMED handoff for this project; `claim` marks it consumed so exactly one
 // session takes it. A compaction-triggered start may show it but must NOT claim it from the new window.
 function loadPendingHandoff(projectName, { claim = true, freshSession = null } = {}) {
@@ -366,6 +390,7 @@ try {
         `- Check relay_inbox and the board before asking the operator anything a peer may already have answered.\n` +
         `- Dispatch rule: the target project is confirmed from the session's badge and cwd before any relay_send, relay_task_add or \`trantor up\` — an ambiguous instruction is not a project name; and a session asking the operator a question never triggers a wake (its messages batch until the answer).\n` +
         `</trantor-orchestrator-role>\n`;
+      additionalContext += buildDoctrineShortForm();
       process.stderr.write(`[trantor] injected orchestrator-role doctrine for ${project}\n`);
     }
   } catch {}

package/hub/routes/cards.mjs

@@ -26,7 +26,7 @@ export async function routeCards({ req, res, q, P, auth, ctx }) {
   const {
     state, body, json, crossProjectGuard, touch, canon, filterReadable,
     appendEvent, appendCardEvent, now, markDirty, stripNulText,
-    appendTaskLog, appendTaskNote, cleanChecklist, linkCommitToFocus,
+    appendTaskLog, appendTaskNote, cleanChecklist, cleanDrill, hasDrillLine, linkCommitToFocus,
     derivePhases, PROPOSAL_CAP, propFp, healthOf, REAP_GRACE_MS, subFp,
     prunePeers, canRead, HUB_VERSION, cmpSemver, isCardEvent, fmtAge, hubSend,
     ONLINE_MS,
@@ -177,6 +177,7 @@ export async function routeCards({ req, res, q, P, auth, ctx }) {
         by: b.by || "", ts: ts0, updated: ts0,
         history: [{ to: st0, by: b.by || "", ts: ts0 }] };
       { const cl = cleanChecklist(b.checklist); if (cl?.length) t.checklist = cl; }   // #5624 — rides `extra`, survives restarts
+      { const dr = cleanDrill(b.drill); if (dr) t.drill = dr; }                        // #6452 — the card's drill line, rides `extra`
       if (b.source === "cc-subagent") { t._fp = subFp(b.title); if (b.agentType) t._atype = String(b.agentType).slice(0, 40); if (b.agentId) t._aid = String(b.agentId).slice(0, 80); if (b.parent) t.parent = String(b.parent).slice(0, 120); t.count = 1; if (t.status === "doing") { t._everStarted = true; t._inflight = 1; } }
       appendTaskNote(t, b, ts0);
       state.tasks.push(t); if (state.tasks.length > 2000) state.tasks.splice(0, 500);
@@ -210,6 +211,12 @@ export async function routeCards({ req, res, q, P, auth, ctx }) {
           }
         }
       }
+      // The done gate (#6452, build doctrine rule 1): done only with a drill line (store.hasDrillLine),
+      // whoever moves it, the orchestrator included. Runs BEFORE any mutation so a refused close leaves
+      // the card as it was; a bridge mirror replicates a status its source hub already gated.
+      if (b.status === "done" && t.status !== "done" && t.source !== "bridge" && !hasDrillLine(t, b)) {
+        return json(res, 409, { error: `no drill line on card #${t.id}: a card names what a person does on the built artifact and must see before it can be done — set \`drill\`, add a checklist item or a note starting with "Drill:", or close with a note naming the gate command you ran (build doctrine rule 1)`, id: t.id, status: t.status });
+      }
       let eventType = "updated", eventFrom = null, eventTo = null;
       if (b.status && ["todo","doing","testing","failed","done","blocked","stale"].includes(b.status) && b.status !== t.status) {
         eventType = "moved"; eventFrom = t.status; eventTo = b.status;
@@ -238,6 +245,7 @@ export async function routeCards({ req, res, q, P, auth, ctx }) {
       // the narrative line a human reads on the board ("assigned — did"), written by the cheap
       // summarizer; rides the tasks.extra column, so it survives restarts everywhere
       if (b.summary !== undefined) t.summary = String(b.summary).slice(0, 220);
+      if (b.drill !== undefined) { const dr = cleanDrill(b.drill); if (dr) t.drill = dr; else delete t.drill; }   // #6452: set or clear the drill line
       // #5624: full checklist replace (null clears). Item-level toggles ride /task/checklist-toggle.
       if (b.checklist !== undefined) {
         const cl = cleanChecklist(b.checklist);