trantor 0.18.62 → 0.18.64

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.62",
+  "version": "0.18.64",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/bridge.mjs

@@ -62,6 +62,7 @@ const saveMap = () => { try { mkdirSync(dirname(MAPFILE), { recursive: true });
 
 const cardBody = (t) => ({ project: PROJECT, title: t.title, status: t.status, assignee: t.assignee || "",
   difficulty: t.difficulty || undefined, model: t.model || undefined, phase: t.phase || undefined,
+  drill: t.drill || undefined,   // #6452: a mirror keeps its source's drill line
   by: t.by || "", source: "bridge" });
 
 async function tick() {

package/bin/cli.mjs

@@ -132,6 +132,7 @@ switch (cmd) {
   case "orchestrate": run("bin/orchestrate.mjs"); break;
   case "app": run("bin/app.mjs"); break;
   case "patrol": run("bin/patrol.mjs"); break;
+  case "retire": run("bin/retire.mjs"); break;
   case "identity": {
     const { load, publicView, generate, keyPath } = await import(join(ROOT, "lib/identity.mjs"));
     const sub = args[0], name = args[1] || "human";
@@ -271,6 +272,7 @@ switch (cmd) {
   trantor duty        the always-on fleet duty agent: up | down | status — hub-escalated triage so you are not the switchboard
                       runs on sonnet by default (it never writes code); duty up --model <m> to pick, or --model inherit for the CLI default
   trantor orchestrate a per-project ORCHESTRATOR with a MISSION.md and a pulse: up [--every 10m] | down | status — the loop-orchestrator pattern
+  trantor retire      retire orchestrator panes nothing is using — preview by default [--hours N] [--yes] [--json]
   trantor patrol      machine-wide resource sweep: crews/runners/workspaces/orphans — [--json] [--reap] (reap = dead rows + stale artifacts ONLY)
 
 Claude Code plugin (the orchestrator side):

package/bin/crew/core.mjs

@@ -2,6 +2,7 @@ import { accessSync, constants, existsSync, mkdirSync, readFileSync } from "node
 import { basename, dirname, join } from "node:path";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
+import { STATE_FLAGS } from "../../lib/state/flags.mjs";
 
 export const ROOT = dirname(dirname(dirname(fileURLToPath(import.meta.url))));
 
@@ -132,14 +133,11 @@ export function gridColumns(size) {
   return columns;
 }
 
-// Operator flags the RUNNER itself reads, forwarded from whoever launched the seat.
-//
-// The Trantor State flags are read as `process.env` INSIDE crew-runner.mjs, not by the CLI it
-// spawns — so ~/.agent-bus/.env (the crew key layer) cannot set them: that file is applied to the
-// spawned command, one level too deep. Without this list the flags documented in TDD §11 have no
-// supported way to reach a seat at all, which is how Phase 2a came to be "enabled" with a schema
-// file that was never written and a runner still on the transcript path.
-const FORWARDED_ENV = ["TRANTOR_STATE", "TRANTOR_STATE_ASSEMBLE", "TRANTOR_STATE_HANDOFF", "TRANTOR_STATE_GATE"];
+// Operator flags the RUNNER itself reads, forwarded from whoever launched the seat. The list lives
+// in lib/state/flags.mjs beside the resolver: the launcher env stays the forwarder (the runner boots
+// before any file is sourced), and #7159 lets the runner fall back to ~/.agent-bus/.env itself, so a
+// flag documented there finally arms the seat that reads it.
+const FORWARDED_ENV = STATE_FLAGS;
 
 export function runnerCommand(ctx, agent, model = "", effort = null) {
   const forwarded = FORWARDED_ENV

package/bin/crew-payload.mjs

@@ -6,6 +6,8 @@
 export const PAYLOAD_CAPS = Object.freeze({
   wakeCount: 10,       // direct/@mention messages: keep the last ~10
   wakeMsgChars: 2000,  // per-message body cap (the hub caps card notes at 2000 too)
+  wakeHeadChars: 1200, // #7063: over the per-message cap, keep the head…
+  wakeTailChars: 700,  // #7063: …AND the tail — a work order is asks-last, the instructions live there
   bcastCount: 10,      // FYI broadcast context: keep the last ~10
   bcastMsgChars: 1000,
   lessonsCount: 15,    // top ~15 lessons, ranked by relevance to this turn's trigger
@@ -22,8 +24,17 @@ export function capWake(wake, caps = PAYLOAD_CAPS) {
   const kept = list.slice(-caps.wakeCount);
   const lines = kept.map(m => {
     let body = String(m?.text ?? "");
-    if (body.length > caps.wakeMsgChars)
-      body = body.slice(0, caps.wakeMsgChars) + ` …[+${n(body.length - caps.wakeMsgChars)} chars of this message dropped]`;
+    // #7063: a work order is written context-first, asks-last, so a HEAD cut deleted exactly the
+    // instructions ("so, do this: 1) … 2) …") and kept the rationale — two orders lost their item 2
+    // in one turn. Over the per-message cap, keep the head AND the tail with ONE marker line
+    // between, so a card id, a base: line and the closing asks all survive. The cap is per
+    // message, never a batch budget (body > wakeMsgChars ⇒ elided > 0, the marker is always true).
+    if (body.length > caps.wakeMsgChars) {
+      const elided = body.length - caps.wakeHeadChars - caps.wakeTailChars;
+      body = body.slice(0, caps.wakeHeadChars)
+        + `\n…[${n(elided)} chars of this message elided from the middle]\n`
+        + body.slice(-caps.wakeTailChars);
+    }
     return `[${m?.from}${m?.to === "all" ? " -> all (mentions you)" : ""}]: ${body}`;
   });
   return { text: lines.join("\n"), kept: kept.length, total: list.length };

package/bin/crew-runner.mjs

@@ -33,6 +33,7 @@ import {
   breakerVerdict, describeTurn, hasJsonSchemaFlag, parseEnvelope, renderCardTail, runStep,
 } from "../lib/state/driver.mjs";
 import { costLine } from "../lib/state/cost.mjs";
+import { resolveStateFlags } from "../lib/state/flags.mjs";
 
 const AGENT = process.argv[2];
 const DIR = process.argv[3] || process.cwd();
@@ -247,7 +248,7 @@ const EFFORT_FLAG = EFFORT ? cliEffortFlag(AGENT, EFFORT) : { flag: "", text: ""
 
 // RUNNER_RULES / RUNNER_KICKOFF env overrides: the runner is also the substrate for non-crew
 // always-on seats (the fleet DUTY agent, bin/duty.mjs) whose doctrine is not "work your card".
-const RULES = process.env.RUNNER_RULES || `Rules: you are ${SESSION} on the trantor crew. Before starting a card, read YOUR card: relay_board with card:<id> (the card, its deps, its notes, and the last five done cards whose title shares a word); never the whole board. If your wake names no card id (or cites only a message-card), make relay_board with mine:true your FIRST call — it lists the cards assigned to you (doing/testing/todo, newest first, full card shape); work your newest one (#7763). Work your assigned file(s), report on the bus (relay_send, <280 chars), move your Kanban card as you go with a NOTE saying what you did (doing -> testing -> done; in 'testing' run YOUR OWN test file — never the full npm test, suites collide across seats — plus \`node bin/slop-gate.mjs\` when the repo has one: it lints ONLY your changed files against the anti-slop rules, and a card must not reach done with slop-gate failing; use 'failed' + a report if anything breaks). If a contract omits a fact you cannot proceed without, ASK — never invent the value: relay_ask(<card>, <question>) blocks the card with your question, keeps the turn owed (no park, no failure), and resumes you when the assigner's answer lands; an invented value that reads as reasoned is the worst outcome this crew ships (#7756). If you need something from another session, message THAT SESSION (relay_peers to find its id, relay_send to reach it) — never ask the human to pass it along; carrying messages between agents is the job this bus exists to remove. When your work for THIS message is finished, END YOUR TURN — do NOT park, do NOT loop relay_wait; the runner waits for you and will wake you with the next message. Path discipline: build/test from your worktree root ${TURN_DIR} with absolute paths or --manifest-path/--prefix instead of cd-ing into subdirs, and put anything that must land outside the repo under ${TURN_DIR}/.agent-bus-out/ (gitignored) — never ~/.agent-bus. Realigning your seat branch after the orchestrator harvested your commits is \`trantor sync\` run from your worktree: it reads the harvest receipts and refuses when an unharvested commit would be lost, so never reset or rebase onto main by hand. A contract's \`base: <sha>\` line is the integration head: start your seat branch at that sha (\`git reset --hard <sha>\` on the fresh branch), never at origin/main, which trails the orchestrator's unpushed integration commits; the object is already here as the ref \`main\`. If \`git cat-file -e <sha>\` fails, say \`cannot resolve base <sha>\` on the bus and move the card to blocked instead of reasoning from origin/main. Every testing/done note names the sha you verified against as \`verified at <sha>\`; a note without it is flagged HOLLOW. Cross-project action is a breach: never \`trantor up\` a crew, register a seat, or send a card/contract into a project other than ${PROJ} unless the operator ran \`trantor policy link ${PROJ} <other> --reason "<why>"\` first — the hub, the CLI and this runner all refuse it mechanically, so ask the operator to link the projects instead of routing around the refusal.`;
+const RULES = process.env.RUNNER_RULES || `Rules: you are ${SESSION} on the trantor crew. Before starting a card, read YOUR card: relay_board with card:<id> (the card, its deps, its notes, and the last five done cards whose title shares a word); never the whole board. If your wake names no card id (or cites only a message-card), make relay_board with mine:true your FIRST call — it lists the cards assigned to you (doing/testing/todo, newest first, full card shape); work your newest one (#7763). Work your assigned file(s), report on the bus (relay_send, <280 chars), move your Kanban card as you go with a NOTE saying what you did (doing -> testing, then STOP: you never close your own card to done — the orchestrator runs the card's drill on the built artifact and closes it, and the hub refuses a move to done on a card with no drill line anyway; in 'testing' run YOUR OWN test file — never the full npm test, suites collide across seats — plus \`node bin/slop-gate.mjs\` when the repo has one: it lints ONLY your changed files against the anti-slop rules, and a card must not reach testing with slop-gate failing; use 'failed' + a report if anything breaks). If a contract omits a fact you cannot proceed without, ASK — never invent the value: relay_ask(<card>, <question>) blocks the card with your question, keeps the turn owed (no park, no failure), and resumes you when the assigner's answer lands; an invented value that reads as reasoned is the worst outcome this crew ships (#7756). If you need something from another session, message THAT SESSION (relay_peers to find its id, relay_send to reach it) — never ask the human to pass it along; carrying messages between agents is the job this bus exists to remove. When your work for THIS message is finished, END YOUR TURN — do NOT park, do NOT loop relay_wait; the runner waits for you and will wake you with the next message. Path discipline: build/test from your worktree root ${TURN_DIR} with absolute paths or --manifest-path/--prefix instead of cd-ing into subdirs, and put anything that must land outside the repo under ${TURN_DIR}/.agent-bus-out/ (gitignored) — never ~/.agent-bus. Realigning your seat branch after the orchestrator harvested your commits is \`trantor sync\` run from your worktree: it reads the harvest receipts and refuses when an unharvested commit would be lost, so never reset or rebase onto main by hand. A contract's \`base: <sha>\` line is the integration head: start your seat branch at that sha (\`git reset --hard <sha>\` on the fresh branch), never at origin/main, which trails the orchestrator's unpushed integration commits; the object is already here as the ref \`main\`. If \`git cat-file -e <sha>\` fails, say \`cannot resolve base <sha>\` on the bus and move the card to blocked instead of reasoning from origin/main. Every testing/done note names the sha you verified against as \`verified at <sha>\`; a note without it is flagged HOLLOW. Cross-project action is a breach: never \`trantor up\` a crew, register a seat, or send a card/contract into a project other than ${PROJ} unless the operator ran \`trantor policy link ${PROJ} <other> --reason "<why>"\` first — the hub, the CLI and this runner all refuse it mechanically, so ask the operator to link the projects instead of routing around the refusal.`;
 
 // ---- the pulse --------------------------------------------------------------
 // RUNNER_PULSE_MS re-runs an orchestrator seat's mission note on a cadence when the bus is silent;
@@ -543,8 +544,13 @@ async function reportHealthy() {
 }
 
 // ---- Trantor State Phase 2a — the flagged path (TDD §4.1, §4.6, §7.3) -----------------------
-// Off by default, and off means the transcript path runs unchanged. Reachable only when the operator
-// set TRANTOR_STATE_ASSEMBLE=1, the seat is `claude` (§7.3) and the CLI carries --json-schema (§6).
+// Off by default — off means the transcript path runs unchanged. #7159: the flags resolve through
+// the one place (lib/state/flags.mjs), launcher env first and ~/.agent-bus/.env filling the rest;
+// resolved values are applied fill-only to process.env so downstream reads (runGate's GATE) agree.
+const stateFlags = resolveStateFlags();
+for (const [name, flag] of Object.entries(stateFlags)) {
+  if (flag.value && process.env[name] === undefined) process.env[name] = flag.value;
+}
 const STATE_FLAG_ON = process.env[STATE_ENV] === "1";
 const STATE_SCHEMA_FILE = join(homedir(), ".agent-bus", `state-schema-${AGENT}-${PROJ}.json`);
 const STATE_MODE = (() => {
@@ -558,7 +564,7 @@ const STATE_MODE = (() => {
   } catch (e) { log(`\x1b[33mstate mode OFF — could not write ${STATE_SCHEMA_FILE}: ${e.message}\x1b[0m`); return false; }
   // #7060: the checks above prove CONFIGURATION, not the prompt, so say "armed" and name the one
   // thing that engages it; each turn then reports which path it took.
-  log(`\x1b[36mTrantor State: ASSEMBLE armed for this seat (schema ${STATE_SCHEMA_FILE})\x1b[0m`);
+  log(`\x1b[36mTrantor State: ASSEMBLE armed for this seat (${STATE_ENV}=${stateFlags[STATE_ENV].value} via ${stateFlags[STATE_ENV].layer}; schema ${STATE_SCHEMA_FILE})\x1b[0m`);
   log(`\x1b[36m  a turn is assembled only when a wake ASSIGNS it a card — the kickoff and every pulse run the transcript path, and each turn says which one it took\x1b[0m`);
   return true;
 })();
@@ -615,6 +621,14 @@ let statePromotedHash;
 // TRANTOR_TURN_MAX_MS ends the CLI's process group at the box and runs ONE follow-up turn in the
 // same session ("commit what is done, move the card, report") so a cut turn lands its work.
 const TURN_MAX_MS = Math.max(0, Number(process.env.TRANTOR_TURN_MAX_MS || 20 * 60 * 1000));
+// #7761: the box counts LIVENESS. At the deadline a turn that moved within the stall window is
+// extended one step (half the box: +10m at the default) up to TRANTOR_TURN_CEILING_MS, the one
+// knob (default 60m). A ceiling at or under the box disables extension; a silent turn still ends
+// at the #7752 stall window, extended or not. The watchdog owns the clock — see turn-watchdog.mjs.
+const TURN_CEILING_MS = TURN_MAX_MS ? Math.max(0, Number(process.env.TRANTOR_TURN_CEILING_MS || 60 * 60 * 1000)) : 0;
+const TURN_EXTEND_MS = Math.ceil(TURN_MAX_MS / 2);
+const TURN_EXTENSIONS_MAX = TURN_EXTEND_MS > 0 && TURN_CEILING_MS > TURN_MAX_MS
+  ? Math.floor((TURN_CEILING_MS - TURN_MAX_MS) / TURN_EXTEND_MS) : 0;
 const TIME_BOX_PROMPT = "your previous turn was cut at the time box; commit what is done, move the card with a note, report in one line";
 let inFollowUp = false;
 // #6289: whether the turn that just ended was CUT at the time box. The follow-up recursion
@@ -715,12 +729,23 @@ async function runTurn(prompt, isFirst, trigger = "kickoff", opts = {}) {
   // instead of burning the box. Unlinked at turn start and again with the cut cleanup.
   const STALLF = join(homedir(), ".agent-bus", `turnstall-${AGENT}-${PROJ}`);
   try { unlinkSync(STALLF); } catch {}
+  // #7761: the watchdog writes the extended deadline (epoch seconds) here for the shell box to
+  // re-read, and one row per extension to EXTF for the ledger. Both unlinked at turn start.
+  const DEADLINEF = join(homedir(), ".agent-bus", `turndeadline-${AGENT}-${PROJ}`);
+  const EXTF = join(homedir(), ".agent-bus", `turnext-${AGENT}-${PROJ}`);
+  try { unlinkSync(DEADLINEF); } catch {}
+  try { unlinkSync(EXTF); } catch {}
+  const boxPlan = TURN_EXTENSIONS_MAX ? {
+    maxMs: TURN_MAX_MS, extendMs: TURN_EXTEND_MS, ceilingMs: TURN_CEILING_MS, extensionsMax: TURN_EXTENSIONS_MAX,
+    deadlineFile: DEADLINEF, extFile: EXTF, card: sessionCard || 0,
+    assigners: (opts.assigners || []).map(a => ({ from: a.from, id: a.id })),
+  } : undefined;
   // Touched by the stderr scrubber as its LAST act (the shell below); node waits for it after
   // spawnSync before reading ERRF — see the drain note at the spawnSync call.
   const DRAINF = join(homedir(), ".agent-bus", `turndrain-${AGENT}-${PROJ}`);
   try { unlinkSync(DRAINF); } catch {}
   try {
-    writeFileSync(STAMPF, JSON.stringify({ turn: TURN, startedAt: Date.now(), runner: RUNNER_ID }));
+    writeFileSync(STAMPF, JSON.stringify({ turn: TURN, startedAt: Date.now(), runner: RUNNER_ID, box: boxPlan }));
     const wd = spawn(process.execPath, [join(import.meta.dirname, "turn-watchdog.mjs"), STAMPF, ERRF, String(WD_MS), SESSION, PROJ, HUB, TRANSCRIPT_DIR, TURN_DIR,
       // #7752: the stall marker only exists when a box does — with no box there is no sweep to
       // end the turn, so the watchdog stays report-only (reporting is the whole job, boxless).
@@ -742,6 +767,7 @@ ${sweep}
   deadline=$(( $(date +%s) + ${Math.ceil(TURN_MAX_MS / 1000)} ))
   while :; do
     [ -f "${STALLF}" ] && break
+    d=$(cat "${DEADLINEF}" 2>/dev/null); case "$d" in ""|*[!0-9]*) ;; *) deadline=$d;; esac
     [ "$(date +%s)" -ge "$deadline" ] && break
     sleep 1 & sleeppid=$!
     wait "$sleeppid"
@@ -777,7 +803,7 @@ exit $turn_exit`;
   // A BACKSTOP only, deliberately later than the shell's own box: if bash itself wedges, node
   // still ends the turn. When the in-shell box works — the normal path — this never fires, which
   // is the point: the shell kills while the tree is still walkable, node cannot.
-  if (TURN_MAX_MS) { spawnOpts.timeout = TURN_MAX_MS + 30000; spawnOpts.killSignal = "SIGKILL"; }
+  if (TURN_MAX_MS) { spawnOpts.timeout = (TURN_EXTENSIONS_MAX ? TURN_CEILING_MS : TURN_MAX_MS) + 30000; spawnOpts.killSignal = "SIGKILL"; }
   const r = spawnSync("/bin/bash", ["-c", shell], spawnOpts);
   // The shell's box leaves the marker; the backstop leaves an ETIMEDOUT. Either way the turn was
   // cut, not merely failed. A stall marker (#7752) outranks the box marker: a turn silent for
@@ -785,6 +811,13 @@ exit $turn_exit`;
   const boxed = existsSync(CUTF);
   const stallCut = existsSync(STALLF);
   const cut = !!TURN_MAX_MS && (boxed || stallCut || r.error?.code === "ETIMEDOUT");
+  // #7761: how far the watchdog moved the box, one EXTF row per extension. boxMs is the box the
+  // turn actually had, so a ceiling cut reads as the ceiling, never as the 20-minute default.
+  let extensions = 0;
+  try { extensions = readFileSync(EXTF, "utf8").split("\n").filter(Boolean).length; } catch {}
+  const boxMs = TURN_MAX_MS + extensions * TURN_EXTEND_MS;
+  try { unlinkSync(DEADLINEF); } catch {}
+  try { unlinkSync(EXTF); } catch {}
   // DRAIN before classifying, never on a CUT turn (the sweep killed the scrubber, its marker never
   // comes). bash 3.2 `wait` skips process substitutions, so wait for DRAINF, bounded.
   if (!cut) {
@@ -800,6 +833,7 @@ exit $turn_exit`;
     try { unlinkSync(CUTF); } catch {}
     try { unlinkSync(STALLF); } catch {}
     if (stallCut) log(`\x1b[33mturn STALLED — no bytes on either stream and no transcript advance for ${Math.round(WD_MS / 60000)}m; ended at the stall window, not the ${Math.round(TURN_MAX_MS / 1000)}s box\x1b[0m`);
+    else if (extensions) log(`\x1b[33mturn cut at the ${Math.round(boxMs / 1000)}s box after ${extensions} liveness extension(s) (ceiling ${Math.round(TURN_CEILING_MS / 1000)}s) — CLI and every descendant ended${boxed ? "" : " (node backstop: bash itself was wedged)"}\x1b[0m`);
     else log(`\x1b[33mturn cut at the ${Math.round(TURN_MAX_MS / 1000)}s time box — CLI and every descendant ended${boxed ? "" : " (node backstop: bash itself was wedged)"}\x1b[0m`);
   }
   lastTurnCut = cut;
@@ -883,6 +917,7 @@ exit $turn_exit`;
   const telemetryRow = { ts: Date.now(), agent: AGENT, project: PROJ, turn: TURN, trigger, card: sessionCard || 0, model: MODEL || "cli-default", duration_ms: Date.now() - t0, exit: realExit, effExit, authFailed: effExit !== realExit, emptyOutput: lastEmptyOutput, emptyTurn: lastEmptyTurn, verdict, outcome: finalOutcome, tokens };
   if (cut) telemetryRow.cut = true;
   if (stallCut) telemetryRow.stalled = true;
+  if (extensions) { telemetryRow.extensions = extensions; telemetryRow.boxMs = boxMs; }
   // #7752/#7099: a cut turn's 141/137 is the sweep's own signal (SIGPIPE/SIGKILL), recorded as
   // the cut signal — never read as a quota or crash pattern downstream.
   if (cut) { const sig = cutSignalFor(realExit); if (sig) telemetryRow.cutSignal = sig; }
@@ -920,7 +955,7 @@ async function stateTurn({ card, observation, trigger, assigners = [] }) {
       callCli: async (prompt) => {
         // isFirst=true every step ON PURPOSE: a state step carries no `-c`, so there is no session
         // to resume and a stale sid must never be handed to one.
-        const exit = await runTurn(prompt, true, trigger, { state: true });
+        const exit = await runTurn(prompt, true, trigger, { state: true, assigners });
         return { exit, stdout: lastEnvelope, cut: lastTurnCut };
       },
       executeAction: async (action) => {
@@ -1367,9 +1402,17 @@ async function resolveWakeCard(messages, { session }) {
     await loadLessons();
     const lessons = pickLessons(LESSONS_RAW, wakeCapped.text + " " + bcastCapped.text);
     const trigger = wakeForTurn.some(m => m.to === SESSION) ? "direct message" : "@mention";
-    // Who is owed an answer, captured BEFORE the turn: pendingWake is cleared on success.
+    // Who is owed an answer, captured BEFORE the turn: pendingWake is cleared on success. The id is
+    // the NEWEST wake this runner holds for that assigner (#6987): append order means first-wins
+    // threaded the receipt onto a PREVIOUS turn's id — the original contract, not the answer that
+    // released this turn — which kept the contract reading WAITING while the stop hook chased.
     const assigners = [];
-    for (const m of wakeForTurn) if (m.from && !assigners.some(a => a.from === m.from)) assigners.push({ from: m.from, id: m.id });
+    for (const m of wakeForTurn) {
+      if (!m.from) continue;
+      const held = assigners.find(a => a.from === m.from);
+      if (held) held.id = m.id;
+      else assigners.push({ from: m.from, id: m.id });
+    }
     const asked = askedExcerpt(wakeForTurn[0]);
     const tStart = Date.now();
     // #6134: ONE SESSION PER CARD; a different card starts a fresh CLI session and the seat is told.
@@ -1428,7 +1471,7 @@ async function resolveWakeCard(messages, { session }) {
           // dies quietly (§4.6).
           observation: [stateObservation, wakeText, ctxText, againText + freshText + baseText].filter(Boolean).join("\n"),
         })
-        : await runTurn(prompt, fresh, deliveryFails ? `${trigger} (redelivery)` : trigger, { judgeOutcome: askJudge });
+        : await runTurn(prompt, fresh, deliveryFails ? `${trigger} (redelivery)` : trigger, { judgeOutcome: askJudge, assigners });
     }
     finally { stopDutyNudgeWatcher(); }
     const secs = Math.round((Date.now() - tStart) / 1000);

package/bin/doctor.mjs

@@ -13,6 +13,7 @@ import { loadOrCreate } from "../lib/identity.mjs";
 import { sfetchJson } from "../lib/signed-fetch.mjs";
 import { scan } from "../lib/splitbrain.mjs";
 import { resolveSecrets, envFileSecrets, backendFor } from "../lib/secrets.mjs";
+import { resolveStateFlags } from "../lib/state/flags.mjs";
 
 const H = homedir();
 const ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
@@ -324,6 +325,17 @@ if (straggling.live.length && backendFor(process.env, { create: true }) !== "non
   ok(`secret store: ${storeNames.length} key(s) in the ${backendFor()} (${storeNames.join(", ")}), none left in .env`);
 }
 
+// ── Trantor State flags (#7159): the runners resolve these through ONE place — process env first,
+// ~/.agent-bus/.env second — and each line names the layer that answered, so a flag that LOOKED
+// applied can no longer pass for armed.
+section("trantor state flags");
+{
+  const resolved = resolveStateFlags();
+  const setFlags = Object.entries(resolved).filter(([, r]) => r.layer !== "unset");
+  for (const [name, r] of setFlags) ok(`${name}=${r.value} via ${r.layer}`);
+  if (!setFlags.length) note("no state flags set — Trantor State runs dark by default (TDD §11)");
+}
+
 // brain
 section("the brain");
 has("scrooge") || existsSync(join(H, ".local", "bin", "scrooge"))

package/bin/drill-report.mjs

@@ -68,7 +68,7 @@ export class DrillReport {
       if (!this.map[id].autoClose || result.status !== "pass" || this.closures[id]) continue;
       const response = await signedPost("/task/update", {
         id: Number(id), project: this.project, by: this.session, status: "done",
-        note: `trantor drill PASS\n${result.evidence.join("\n")}`.slice(0, 2000),
+        note: `Drill: trantor drill PASS\n${result.evidence.join("\n")}`.slice(0, 2000),   // "Drill:" prefix: the hub's done gate (#6452) reads it as the drill line
       }, { project: this.project, session: this.session, timeoutMs: 15000 });
       this.closures[id] = response.ok && response.json?.task?.status === "done"
         && response.json.task.id === Number(id) && response.json.task.project === this.project

package/bin/drill-report.test.mjs

@@ -51,6 +51,7 @@ test("signed closer on an enforce hub: complete evidence closes, partial/failure
     const card = (await signedGet("/tasks?project=trantor")).json.tasks[0];
     assert.equal(card.status, "done");
     assert.equal(card.workedBy, session);
+    assert.match(card.log.at(-1).text, /^Drill: trantor drill PASS/);   // #6452: the closer's note IS the drill line the hub gate requires
     assert.match(card.log.at(-1).text, /real evidence A/);
     assert.match(card.log.at(-1).text, /real evidence B/);
     assert.equal(JSON.parse(readFileSync(path, "utf8"))[id].closure, "done");

package/bin/reconcile.mjs

@@ -45,8 +45,25 @@ async function tasks() {
   const j = r.json;
   return Array.isArray(j) ? j : (j?.tasks || j?.cards || []);
 }
-async function move(id, status) {
-  await signedPost("/task/update", { id, status, by: "reconcile" }, { timeoutMs: 4000 }).catch(() => {});
+async function move(id, status, note) {
+  return signedPost("/task/update", { id, status, by: "reconcile", note }, { timeoutMs: 4000 })
+    .catch(e => ({ ok: false, status: 0, json: { error: e.message } }));
+}
+// #6452: the hub refuses done on a card with no drill line, and reconcile cannot claim a drill it
+// never ran. A card judged shipped closes when it already carries a drill line; otherwise it parks
+// at testing with the verdict on its log, and the orchestrator runs the drill and closes it.
+async function close(x) {
+  const note = `reconcile: judged shipped${x.commit ? ` at ${x.commit}` : ""}${x.reason ? ` — ${x.reason}` : ""}`;
+  const r = await move(x.t.id, "done", note);
+  if (r.ok) return "closed";
+  if (r.status === 409 && /drill/i.test(r.json?.error || "")) {
+    const parked = await move(x.t.id, "testing", `${note}; no drill line on the card, so it waits at testing for the orchestrator's drill`);
+    if (parked.ok) return "parked";
+    console.error(`    #${x.t.id}: hub ${parked.status} ${parked.json?.error || ""}`);
+    return "failed";
+  }
+  console.error(`    #${x.t.id}: hub ${r.status} ${r.json?.error || ""}`);
+  return "failed";
 }
 // the memory record for THIS project (Claude Code stores it per encoded-cwd); optional context.
 function memoryExcerpt() {
@@ -118,6 +135,7 @@ if (!doIt) {
   console.log(`\n  ${done.length} card(s) → done, ${stale.length} → stale. Re-run to apply:\n    trantor reconcile${val("--older", "-o") ? ` --older ${val("--older", "-o")}` : ""} --yes\n`);
   process.exit(0);
 }
-for (const x of done) await move(x.t.id, "done");
+const outcome = { closed: 0, parked: 0, failed: 0 };
+for (const x of done) outcome[await close(x)]++;
 for (const x of stale) await move(x.t.id, "stale");
-console.log(`\n  ✓ reconciled: ${done.length} closed as done, ${stale.length} moved to stale. ${active.length} left active.\n`);
+console.log(`\n  ✓ reconciled: ${outcome.closed} closed as done${outcome.parked ? `, ${outcome.parked} parked at testing (no drill line)` : ""}${outcome.failed ? `, ${outcome.failed} refused` : ""}, ${stale.length} moved to stale. ${active.length} left active.\n`);

package/bin/retire.mjs

@@ -0,0 +1,67 @@
+#!/usr/bin/env node
+// `trantor retire` — retire orchestrator panes that nothing is using (#8017). Previews by default;
+// --yes performs it. Liveness, never age alone, decides: a pane mid-turn or holding an in-flight
+// contract is held open whatever its idle age.
+import { execFileSync } from "node:child_process";
+import { turnInFlight, buildSummary, writeHandoff, sessionProcessState } from "../hooks/lib/handoff.mjs";
+import { hostId, resolveHub } from "../lib/project.mjs";
+import { sfetchJson } from "../lib/signed-fetch.mjs";
+import {
+  retireHours, retireEnabled, collectPanes, retireDecision, retirePane,
+  isRetired, humanHours, retiredLedgerPath,
+} from "../lib/retire-panes.mjs";
+
+const D = "\x1b[2m", B = "\x1b[1m", Y = "\x1b[33m", G = "\x1b[32m", R = "\x1b[0m";
+const args = process.argv.slice(2);
+const flag = n => { const i = args.indexOf(n); return i >= 0 ? args[i + 1] : null; };
+const APPLY = args.includes("--yes");
+const JSON_OUT = args.includes("--json");
+
+const hours = flag("--hours") !== null ? Number(flag("--hours")) : retireHours();
+if (!retireEnabled(hours)) {
+  console.log(`retirement disabled (threshold ${hours}h) — set TRANTOR_PANE_RETIRE_HOURS or config.paneRetireHours`);
+  process.exit(0);
+}
+
+const host = hostId();
+// Fail CLOSED on the hub: a contract count we could not read must never be taken as zero, or an
+// unreachable hub would retire a pane that is holding work.
+async function contractsFor(session) {
+  try {
+    const res = await sfetchJson(`${resolveHub("")}/contracts?session=${encodeURIComponent(session)}`,
+      { method: "GET", name: session });
+    if (!res.ok) return 1;
+    return Number((await res.json())?.open) || 0;
+  } catch { return 1; }
+}
+
+const panes = collectPanes({ turnInFlight, sessionProcessState, hostId: host }).filter(p => !isRetired(p.sid));
+for (const p of panes) p.openContracts = await contractsFor(`${host}:${p.project}`);
+const decided = panes.map(p => retireDecision(p, { hours }));
+const due = decided.filter(d => d.retire);
+
+if (JSON_OUT) {
+  console.log(JSON.stringify({ hours, applied: APPLY, panes: decided }, null, 2));
+}
+
+if (!JSON_OUT) {
+  console.log(`${B}retire${R} ${D}· threshold ${hours}h · ledger ${retiredLedgerPath()}${R}`);
+  for (const d of decided) {
+    const mark = d.retire ? `${Y}retire${R}` : `${G}hold  ${R}`;
+    const age = d.idleMs === null ? "?" : humanHours(d.idleMs);
+    console.log(`  ${mark} ${d.project.padEnd(18)} ${D}idle ${age.padEnd(7)} ${d.reason}${R}`);
+  }
+  if (!decided.length) console.log(`  ${D}no orchestrator panes in the session map${R}`);
+}
+
+if (!due.length) process.exit(0);
+if (!APPLY) {
+  if (!JSON_OUT) console.log(`\n${D}preview only — rerun with --yes to retire ${due.length} pane(s)${R}`);
+  process.exit(0);
+}
+
+for (const d of due) {
+  const out = await retirePane(d, { by: `retire@${host}`, exec: execFileSync, writeHandoff, buildSummary });
+  console.log(`  ${G}retired${R} ${d.project} ${D}${out.steps.join(" · ")}${R}`);
+  console.log(`    ${D}resume the thread with: claude --resume ${d.sid}${R}`);
+}

package/bin/state-bench.mjs

@@ -616,6 +616,13 @@ export function turnsBeforeCut(rows) {
   return cut >= 0 ? cut : (rows || []).length;
 }
 
+/** Was this run STOPPED, or did it reach its own end? §8.7 is a runway metric and runway only means
+ *  something for a run something cut short (#8066). Kept separate from turnsBeforeCut so that
+ *  function's return shape — and every caller reading it as a number — stays as it was. */
+export function wasCut(rows) {
+  return (rows || []).some(r => r?.cut === true);
+}
+
 /**
  * §8.7 — median turns-per-card on the state path vs the baseline path, over n ≥ MIN_CARDS.
  *
@@ -625,16 +632,35 @@ export function turnsBeforeCut(rows) {
  */
 export function turnsGate(pairs, { minCards = MIN_CARDS } = {}) {
   const usable = (pairs || []).filter(p => p.state?.length && p.baseline?.length)
-    .map(p => ({ card: p.card, state: turnsBeforeCut(p.state), baseline: turnsBeforeCut(p.baseline) }));
+    .map(p => ({
+      card: p.card,
+      state: turnsBeforeCut(p.state), baseline: turnsBeforeCut(p.baseline),
+      state_cut: wasCut(p.state), baseline_cut: wasCut(p.baseline),
+    }));
   const out = { cards: usable, n: usable.length, state_median: median(usable.map(u => u.state)), baseline_median: median(usable.map(u => u.baseline)), ok: false, code: null, message: "" };
   if (usable.length < minCards) {
     out.code = "CARRY_FORWARD";
     out.message = `n=${usable.length} card(s) with both paths recorded; §8.7 wants ≥${minCards}. The medians are recorded on the card and this gate CARRIES FORWARD to the next phase — it is not waived.`;
     return out;
   }
+  // Runway is only a question for a run something STOPPED. A state run that reached its own end has
+  // no runway problem, and scoring it against a baseline that WAS stopped inverts the metric — the
+  // better the state path does, the worse this reads. That is not hypothetical: the first real
+  // Phase-2a run finished card #6448 in ONE turn against a 149-turn baseline that never finished,
+  // and this gate called it FEWER_TURNS (#8066). The regression §8.7 exists to catch is the state
+  // path being cut EARLIER than the prose path, and that still fails below.
+  const stopped = usable.filter(u => u.state_cut);
+  out.cut_n = stopped.length;
+  if (!stopped.length) {
+    out.ok = true;
+    out.message = `no state run was forced to cut across n=${usable.length} card(s) — every card reached its own end, so there is no runway to compare (state median ${out.state_median} turns vs baseline ${out.baseline_median})`;
+    return out;
+  }
+  out.state_median = median(stopped.map(u => u.state));
+  out.baseline_median = median(stopped.map(u => u.baseline));
   out.ok = out.state_median >= out.baseline_median;
   out.code = out.ok ? null : "FEWER_TURNS";
-  out.message = `median turns before a forced cut — state ${out.state_median} vs baseline ${out.baseline_median} over n=${usable.length}`;
+  out.message = `median turns before a forced cut, over the ${stopped.length} card(s) whose state run WAS cut — state ${out.state_median} vs baseline ${out.baseline_median} (n=${usable.length} recorded)`;
   return out;
 }
 
@@ -645,7 +671,14 @@ export function evaluateRun({ project, card, repo = REPO, ...opts }) {
   const gates = [];
   const base = requireBaseline({ project, card, repo });
   gates.push({ n: 1, name: "baseline committed (§7.5)", ok: base.ok, code: base.code ?? null, message: base.ok ? `${base.doc} in HEAD · ${base.rows.length} baseline turns` : base.message });
-  if (!base.ok) return { ok: false, gates, halted: "gate 1", project, card };
+  // §7.5 exists so the >=5x CLAIM cannot be made against a number recorded after the fact, and that
+  // still holds: with no baseline the phase does NOT open and this run cannot pass. But halting here
+  // also blocked gates 3, 5 and 6 — which read the state run alone and never touch the baseline — so
+  // "does the evidence pipeline work at all" was unanswerable for any card without prose-path
+  // history. Since every card that HAS a baseline is now done, that was every card worth asking
+  // about. The unfalsifiability guard is kept where it belongs (gates 4 and 7, the comparisons) and
+  // the mechanism gates are allowed to report.
+  const noBaseline = !base.ok;
 
   const steps = readJsonl(runPath(project, card));
   if (!steps || !steps.length) {
@@ -658,8 +691,15 @@ export function evaluateRun({ project, card, repo = REPO, ...opts }) {
   const cache = checkCache(steps);
   gates.push({ n: 3, name: "cache read > 0 after the first step (§8.3)", ok: cache.ok, code: cache.code, message: cache.message });
 
-  const cost = costGate(steps, base.rows, { weights: opts.weights || null });
-  gates.push({ n: 4, name: `cost: flat curve, ≥${COST_FACTOR}× below baseline (§8.4)`, ok: cost.ok, code: cost.code, message: cost.message, numbers: cost });
+  // The ONE gate §7.5's guard actually protects: no recorded-first baseline, no ratio, no claim.
+  const cost = noBaseline ? null : costGate(steps, base.rows, { weights: opts.weights || null });
+  gates.push({ n: 4, name: `cost: flat curve, ≥${COST_FACTOR}× below baseline (§8.4)`,
+    ok: noBaseline ? false : cost.ok,
+    code: noBaseline ? "NO_BASELINE" : cost.code,
+    message: noBaseline
+      ? "no committed baseline for this card — the ≥5× claim is measured against a number recorded BEFORE the thing that judges it (§7.5), and there is none, so no ratio is computed and none is guessed"
+      : cost.message,
+    numbers: cost });
 
   const dist = disturbanceCheck(steps);
   gates.push({ n: 5, name: "zero recovery after a mid-run disturbance (§8.5)", ok: dist.ok, code: dist.code, message: dist.message, cases: dist.cases });
@@ -673,7 +713,7 @@ export function evaluateRun({ project, card, repo = REPO, ...opts }) {
 
   // §8.4's "at equal-or-better task success": the cache claim can hold while the card gets less far.
   const turns = turnsGate(collectTurnPairs(project));
-  gates.push({ n: 7, name: `turns per card, median over n≥${MIN_CARDS} (§8.7)`, ok: turns.ok, code: turns.code, message: turns.message, numbers: turns });
+  gates.push({ n: 7, name: `turns per card, median over n≥${MIN_CARDS} (§8.7)`, ok: noBaseline ? false : turns.ok, code: noBaseline ? "NO_BASELINE" : turns.code, message: noBaseline ? "no committed baseline for this card — §8.7 pairs the state path against the prose path and has nothing to pair with" : turns.message, numbers: turns });
 
   return { ok: gates.every(g => g.ok), gates, project, card, baseline: base, steps: steps.length };
 }

package/bin/turn-watchdog.mjs

@@ -1,22 +1,9 @@
 #!/usr/bin/env node
-// Turn watchdog (#5684, reworked #6206). runTurn is spawnSync — the runner cannot watch its own
-// turn — so this DETACHED helper does: armed at turn start, disarmed by turn end. A turn past
-// the window with NO new activity earns ONE direct stall report to the foreman (episode, never a
-// timer storm). With no stall file (report-only mode) the turn is never killed — reporting is
-// the whole job. With one (#7752, kill mode) a turn silent on EVERY channel for the whole
-// window is also ENDED at the window: the marker tells the runner's shell box to sweep early,
-// so the kill itself still lives in exactly one place — the shell that owns $job.
-//
-// #6206: stdout silence is NOT a stall — `claude -p` prints nothing until the turn ends by
-// design, so a seat editing five files was reported STALLED while its transcript advanced.
-// Liveness is new activity in the seat's transcript (the CLI's session file), its worktree, or
-// stderr growth; silence on ALL of them for a whole window is the only thing reported. And a
-// watchdog never speaks for a runner it does not belong to: the stamp carries the runner's
-// instance id, so a survivor of a replaced runner exits on mismatch or runner death instead of
-// re-matching the NEW runner's turn number (the 09:47 false alarm was exactly that orphan).
-//
+// Turn watchdog (#5684, #6206, #7752, #7761): runTurn is spawnSync, so this DETACHED helper watches
+// the turn — liveness = transcript, worktree or stderr moving; a whole silent window earns ONE stall
+// report, and in kill mode (stall file given) also ends the turn via the shell box. Stamp-bound to one runner.
 //   node bin/turn-watchdog.mjs <stampFile> <errFile> <windowMs> <session> <project> <hubUrl> <transcriptDir> <workDir> [stallFile]
-import { readFileSync, writeFileSync, statSync, readdirSync } from "node:fs";
+import { readFileSync, writeFileSync, appendFileSync, statSync, readdirSync } from "node:fs";
 import { join } from "node:path";
 import { hostId } from "../lib/project.mjs";
 import { signedPost } from "../hooks/lib/api.mjs";
@@ -74,14 +61,29 @@ let baseErr = errSize();
 const armedAt = armed.startedAt || Date.now();
 const SLACK = 2000;   // timestamp granularity + scheduler drift under load
 
-// #7752 kill mode: poll liveness continuously and, on a whole window of silence on EVERY
-// channel, write the stall marker, report once, exit. The runner's shell box sweeps the CLI
-// when it sees the marker, so a silent turn ends at the window instead of burning the box.
-// stderr liveness is measured ROLLING here (growth since the last poll, not since arm): the
-// question is "any bytes in this window", not "any bytes ever".
+// #7752 kill mode: poll liveness; a whole window silent on EVERY channel writes the stall marker
+// (the shell box sweeps on it), reports once, exits; stderr is measured ROLLING (bytes this window).
+// #7761: `armed.box` (step, ceiling, assigners) exists only when a ceiling above the box does; a
+// deadline one poll away on a turn that moved within the window is pushed out one step.
+const box = stallFile && armed.box && Number(armed.box.extensionsMax) > 0 ? armed.box : null;
+const mins = (ms) => `${Math.max(1, Math.round(ms / 60000))}m`;
+const secsOrMins = (ms) => (ms >= 60000 ? mins(ms) : `${Math.round(ms / 1000)}s`);
+async function tellExtension(text) {
+  const orch = `${hostId()}:${project}`;
+  const seen = new Set();
+  for (const a of [...(box.assigners || []), { from: orch }]) {
+    const to = String(a?.from || "");
+    if (!to || to === "all" || to === session || to.startsWith("hub:") || seen.has(to)) continue;
+    seen.add(to);
+    try { await signedPost(`${hub}/send`, { from: session, to, text, project, kind: "status", wake: false }, { session }); } catch {}
+  }
+}
+
 if (stallFile) {
   const poll = Math.max(250, Math.min(windowMs / 4, 10000));
   let lastErrAt = armedAt;
+  let deadline = armedAt + (box ? Number(box.maxMs) : 0);
+  let extensions = 0;
   for (;;) {
     await sleep(poll);
     const s = readStamp();
@@ -93,7 +95,17 @@ if (stallFile) {
     const freshCut = Math.max(armedAt, now - windowMs - SLACK);
     const tr = transcriptDir ? newestMtime(transcriptDir) : 0;
     const wk = workDir ? newestMtime(workDir) : 0;
-    if (tr > freshCut || wk > freshCut || now - lastErrAt < windowMs) continue;   // producing work: alive
+    if (tr > freshCut || wk > freshCut || now - lastErrAt < windowMs) {           // producing work: alive
+      if (box && extensions < Number(box.extensionsMax) && now + poll + SLACK >= deadline) {
+        extensions++;
+        deadline += Number(box.extendMs);
+        try { writeFileSync(box.deadlineFile, String(Math.floor(deadline / 1000))); } catch {}
+        try { appendFileSync(box.extFile, JSON.stringify({ n: extensions, at: now, until: deadline }) + "\n"); } catch {}
+        const card = Number(box.card) > 0 ? ` on #${box.card}` : "";
+        await tellExtension(`⏳ ${session} turn extended +${secsOrMins(Number(box.extendMs))} (${extensions}/${box.extensionsMax})${card} — alive: ${describeLast({ tr, wk })}${now - lastErrAt < windowMs ? ", stderr moving" : ""}; box now ${secsOrMins(deadline - armedAt)} of a ${secsOrMins(Number(box.ceilingMs))} ceiling`);
+      }
+      continue;
+    }
     try { writeFileSync(stallFile, ""); } catch {}
     const mins = Math.round((now - armedAt) / 60000);
     const orch = `${hostId()}:${project}`;