trantor 0.18.67 → 0.18.68

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.67",
+  "version": "0.18.68",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/README.md

@@ -378,9 +378,11 @@ agent via `relay_handoff`. Optional macOS auto-prompt (`autoHandoffPrompt` in
 Since 0.18.18 the succession is a machine, not a ritual: at 90% context the running agent is
 told to finish or checkpoint and author the boundary handoff itself; the app's banner counts
 down ("handing off in 10s") when the dial allows; an automatic digest defers to a fresh
-model-authored handoff instead of superseding it; the successor is injected a capped ≤4KB recap
-(the verbatim tail stays on disk, one path away) and gets a kickoff prompt so it recaps without
-being spoken to; and a session hosted in a Workspace pane is replaced in place by a detached
+model-authored handoff instead of superseding it; the record on disk keeps the author's summary
+whole and the ~4KB budget applies only to what is injected, where the cut is section-aware so the
+successor's open threads survive it (0.18.68 — before that the cut ran at write time and ate the
+middle, which is exactly where a work order sits); the successor gets a kickoff prompt so it recaps
+without being spoken to; and a session hosted in a Workspace pane is replaced in place by a detached
 driver — the same chain the app's [Hand off now] button runs.
 
 Waking works the same way from the other end: hover a sleeping project in the app's sidebar and

package/bin/crew-runner.mjs

@@ -21,6 +21,7 @@ import { capWake, capBcast, pickLessons, composePrompt, contractBase, baseLine }
 import {
   cardRefs, wakeCard, carriesWork, parseTurnTokens, parseResetAt, reasonWithBalances, quotaResetAt, PARKING_REASONS,
   senderProjectOf, isLinkedProject, stateSkipReason, isMessageCardTitle, OPEN_CARD_STATUSES,
+  CUT_CHAIN_PARK_MIN, cutChainEvidence, isBoundedPark,
 } from "../lib/turn-policy.mjs";
 import {
   auditDutyNudges, claimDutyNudges, claudeTranscriptDir, dutyEscalations, dutyNudgeDirective,
@@ -295,6 +296,11 @@ function startDutyNudgeWatcher(plan, sinceMs) {
 // The hub hands a message out exactly once, so a turn that died took its wake with it. Here a
 // message is consumed only when a turn exits 0; the queue lives on disk and retries on backoff.
 const PENDF = join(homedir(), ".agent-bus", `pending-${AGENT}-${PROJ}.json`);
+// #7914: the park, on disk, for everyone who is not on the bus. A park announces itself once and
+// then the seat looks exactly like an idle one — which is how three seats sat 46 minutes while
+// `trantor seat-why` read "live, last turn failed". This file is the state behind that event, so a
+// reader who missed the message still finds the reason, the evidence and when it lifts.
+const PARKF = join(homedir(), ".agent-bus", `park-${AGENT}-${PROJ}.json`);
 // #7778: message ids this seat already consumed through its OWN inbox path (relay_inbox, the
 // PostToolUse hook) — reconciled from the hub's deliveredUpTo ledger at each clean turn boundary
 // and persisted in the pending file, so a message the session read mid-turn is never re-woken by
@@ -418,28 +424,53 @@ async function reportFailure(exit, trigger, undelivered = 0, reasonOverride = ""
 // Against a spent plan or a rejected key the ladder never succeeds, so those two reasons PARK:
 // queue kept, ladder stopped, room told once with the reset time. `trantor up` resumes.
 let parkAnnounced = false;
-async function parkSeat(reason, undelivered, resetHint = 0) {
+// #7914: the park this seat is currently sitting in, or null. Read by the poll loop, which ends a
+// bounded one the moment somebody sends a direct message, and cleared by any turn that lands.
+let parkState = null;
+async function parkSeat(reason, undelivered, resetHint = 0, { evidence = "" } = {}) {
   // A seat that went QUIET printed no wall message to parse (#6131), so its own balance row is the
   // only place the reset time exists. Output first when there is any: it is this turn's evidence.
   const resetAt = parseResetAt(lastErrText) || resetHint;
-  const when = resetAt ? new Date(resetAt).toLocaleString() : "";
+  // #7914: a park a timer can clear resumes on its own. The box ending a turn twice says nothing
+  // about the plan or the key, so holding that queue until `trantor up` was the seat going silent;
+  // exhaustion and auth keep the old shape, because no window makes a spent plan usable.
+  const bounded = isBoundedPark(reason) && PARK_WINDOW_MS > 0;
+  const until = bounded ? Date.now() + PARK_WINDOW_MS : (resetAt || Number.MAX_SAFE_INTEGER);
+  const when = bounded || resetAt ? new Date(bounded ? until : resetAt).toLocaleString() : "";
+  parkState = { reason, until, evidence, held: undelivered, ts: Date.now(), bounded };
+  // The park is a STATE, and every reader of it is off the bus: `trantor seat-why`, the app, the
+  // operator at a terminal an hour later. The message below is the event; this file is the state.
+  try { writeFileSync(PARKF, JSON.stringify({ session: SESSION, agent: AGENT, project: PROJ, ...parkState })); } catch {}
   if (!parkAnnounced) {
     parkAnnounced = true;
     // #7752: a stalled park names the CLI and its model — the swap decision needs both, and this
     // line is the one place the room reads them together.
     const named = reason === "stalled" ? ` — ${AGENT}${MODEL ? `, model ${MODEL}` : " (cli default model)"}` : "";
-    const text = redactKeys(`⛔ ${SESSION} PARKED (${reason}${named}) — holding ${undelivered} message(s), redelivery stopped ${when ? `until ${when}` : `until \`trantor up ${AGENT}\``}`);
+    // #7914: the notice carries its own evidence. A reader who has to open three logs to learn
+    // which turns died and how is a reader who does not look, which is how 46 minutes passed.
+    const why = evidence ? ` · ${evidence}` : "";
+    const text = redactKeys(`⛔ ${SESSION} PARKED (${reason}${named}) — holding ${undelivered} message(s), redelivery stopped ${when ? `until ${when}` : `until \`trantor up ${AGENT}\``}${bounded ? " · a direct message ends the park now" : ""}${why}`);
     await api("/send", { from: SESSION, to: "all", text, project: PROJ, kind: "status" }).catch(() => {});
     const orch = `${hostId()}:${PROJ}`;
     if (orch !== SESSION) await api("/send", { from: SESSION, to: orch, text, project: PROJ, kind: "alert" }).catch(() => {});
   }
-  log(`\x1b[31mparked (${reason})${when ? ` — retrying after ${when}` : " — no reset time in the output; waiting for a restart"}\x1b[0m`);
+  log(`\x1b[31mparked (${reason})${when ? ` — retrying after ${when}` : " — no reset time in the output; waiting for a restart"}${evidence ? `\n  evidence: ${evidence}` : ""}\x1b[0m`);
   // The alarm for "the bus is stuck" cannot itself be a bus message, so a park also rings a bell
   // the operator can hear out of band, once per park.
   notifyOperator(`Trantor: ${SESSION} PARKED (${reason})`,
     `${undelivered} message(s) held${when ? ` — retrying after ${when}` : ` — needs \`trantor up ${AGENT}\``}`);
-  // No reset time means no timer can clear it: hold until the operator restarts the seat.
-  return resetAt || Number.MAX_SAFE_INTEGER;
+  return until;
+}
+
+// #7914: the park is over — because a direct message asked for a turn now, or because one landed.
+// The record goes with it, and the announce latch reopens so the NEXT park is heard too (a latch
+// that never reopens turns a repeating park into one message and then silence).
+function unpark(why) {
+  if (!parkState) return;
+  log(`\x1b[33mpark ended (${parkState.reason}) — ${why}\x1b[0m`);
+  parkState = null;
+  parkAnnounced = false;
+  try { unlinkSync(PARKF); } catch {}
 }
 
 /**
@@ -639,6 +670,12 @@ let lastTurnCut = false;
 // liveness channel quiet for the whole window), not the box. Same overwrite semantics as
 // lastTurnCut: the follow-up's own ending is what the ladder reads.
 let lastTurnStalled = false;
+// #7914: one row per CUT turn in the CURRENT chain — the evidence a time-box park owes the
+// orchestrator (which turns died, their exit codes, how the sweep ended them). Any turn that was
+// not cut empties it, so the rows always describe the chain that is parking and never a cut from
+// an hour ago. TRANTOR_PARK_WINDOW_MS is how long that park lasts before the seat resumes itself.
+let cutChain = [];
+const PARK_WINDOW_MS = Math.max(0, Number(process.env.TRANTOR_PARK_WINDOW_MS || 15 * 60 * 1000));
 // The card the CURRENT CLI session belongs to (#6134). 0 = the kickoff session, which belongs to
 // no card, so the first contract that names one starts a session of its own.
 let sessionCard = 0;
@@ -922,6 +959,10 @@ exit $turn_exit`;
   // the cut signal — never read as a quota or crash pattern downstream.
   if (cut) { const sig = cutSignalFor(realExit); if (sig) telemetryRow.cutSignal = sig; }
   telemetry(telemetryRow);
+  // #7914: the same facts the ledger row keeps, held in memory for the park notice. Only a BOX cut
+  // joins the chain — a turn the stall watchdog ended has its own ladder and park reason (#7752).
+  if (cut && !stallCut) cutChain.push({ turn: TURN, trigger, exit: realExit, signal: cutSignalFor(realExit) || "", boxMs, extensions });
+  else cutChain = [];
   log(`turn ended (exit ${realExit}${effExit !== realExit ? ` → effective ${effExit} (${lastEmptyOutput ? "empty-output" : "auth"})` : ""}, ${((Date.now() - t0) / 1000).toFixed(0)}s)`);
   if (realExit === 0 && effExit === 0) { cmuxStatus("idle", "#8a94a6", "robot"); herdrAgent("idle"); }   // finished this turn, waiting for the next
   // #5965 — TURN END. A clean exit means the seat is idle again; say so right away so the app stops
@@ -1179,6 +1220,10 @@ async function resolveWakeCard(messages, { session }) {
   // broadcasts batched behind them. Restored from disk first: a runner that was killed mid-turn
   // (or a machine that rebooted) still owes those messages, and the hub will never send them again.
   const restored = loadPending();
+  // #7914: a park belongs to the runner that made it. This process is starting fresh and will
+  // re-park if the CLI is still cutting, so a record left by the runner before it is stale state —
+  // and stale state in a health read is the same failure as no state at all.
+  try { unlinkSync(PARKF); } catch {}
   seenLedger = restored.seen;
   if (seenLedger.length) log(`\x1b[33m${seenLedger.length} consumed message id(s) restored from the pending file — the poll keeps standing down on them\x1b[0m`);
   if (restored.ask) {
@@ -1339,6 +1384,18 @@ async function resolveWakeCard(messages, { session }) {
       savePending(pendingWake, pendingBcast);
     }
     if (awaitingAsk) { log(`holding for the answer to ask #${awaitingAsk.id} — ${wake.length} new message(s) queued behind it`); continue; }
+    // #7914: a fresh DIRECT message to a parked seat is somebody asking for a turn now, so it ends
+    // a bounded park instead of queueing behind the window; a mention does not, because the room
+    // talking is not a request. An exhausted or auth park is a wall and stands anyway (#6134).
+    const directWake = wake.filter(m => m.to === SESSION);
+    if (parkState && directWake.length) {
+      if (isBoundedPark(parkState.reason)) {
+        unpark(`direct message from ${directWake[0].from || "?"}`);
+        retryAt = 0; deliveryFails = 0; cutChain = [];
+      } else {
+        log(`\x1b[33mparked (${parkState.reason}) — a direct message cannot clear this park; it holds until the reset or \`trantor up ${AGENT}\`\x1b[0m`);
+      }
+    }
     // Respect an active backoff: a new message during an outage joins the batch, it does not
     // reset the clock and hammer a CLI that is already failing.
     if (Date.now() < retryAt) { log(`queued — ${pendingWake.length} undelivered, next attempt in ${Math.max(0, Math.round((retryAt - Date.now()) / 1000))}s`); continue; }
@@ -1552,8 +1609,12 @@ async function resolveWakeCard(messages, { session }) {
       // silent chain (#7752), time-box when the chain died to cuts, api-error otherwise —
       // holding the queue until `trantor up`.
       const parkReason = lastTurnStalled ? "stalled" : (PARKING_REASONS.has(reason) ? reason : (lastTurnCut ? "time-box" : "api-error"));
+      // #7914: the park owes its evidence — which turns the box killed, their exits, the box that
+      // ended them — whatever rung fired it. The THRESHOLD is #6289's and stays #6289's: a chain
+      // retries once and the second failed chain parks, never the first (its drill B pins that).
+      const evidence = cutChain.length >= CUT_CHAIN_PARK_MIN ? cutChainEvidence(cutChain) : "";
       if (PARKING_REASONS.has(reason) || deliveryFails >= 2) {
-        retryAt = await parkSeat(parkReason, pendingWake.length, quotaReset);
+        retryAt = await parkSeat(parkReason, pendingWake.length, quotaReset, { evidence });
         // RUNNER_PARK_MAX_MS is set only by `trantor duty up` (launchd keepalive): past the ceiling,
         // exit so the supervisor restarts clean. Unsupervised seats stay parked; exiting would kill them.
         const parkMax = Number(process.env.RUNNER_PARK_MAX_MS || 0);
@@ -1565,10 +1626,17 @@ async function resolveWakeCard(messages, { session }) {
             process.exit(0);   // 0, not 1: this is a deliberate hand-off, not a crash
           }, wakeIn).unref?.();
         }
+        // #7914: what the park is, when it lifts, and the evidence it rests on — in the message
+        // that reaches the one who is actually blocked, not only in the card log they never read.
+        const lifts = parkState?.bounded
+          ? ` · resumes ${new Date(parkState.until).toLocaleTimeString()} (a direct message ends it now)`
+          : " — not retrying";
+        // The lift time goes BEFORE the evidence: the transport caps the line, and what the reader
+        // has to act on must never be the part that gets eaten.
         await notifyAssigners(assigners,
           reason === "stalled"
-            ? `⛔ your contract is PARKED on ${SESSION} (stalled: two turns silent for the whole watchdog window) — not retrying · asked: "${asked}"`
-            : `⛔ your contract is PARKED on ${SESSION} (${parkReason}) — not retrying · asked: "${asked}"`);
+            ? `⛔ your contract is PARKED on ${SESSION} (stalled: two turns silent for the whole watchdog window)${lifts} · asked: "${asked}"`
+            : `⛔ your contract is PARKED on ${SESSION} (${parkReason})${lifts}${evidence ? ` · ${evidence}` : ""} · asked: "${asked}"`);
         lastTurnAt = Date.now();
         return;
       }
@@ -1608,6 +1676,7 @@ async function resolveWakeCard(messages, { session }) {
         `🫥 EMPTY turn on ${SESSION} (exit 0, ${secs}s — no worktree change, no substantive output, no bus activity) · wake stays owed · retrying in ${Math.round(wait / 1000)}s · asked: "${asked}"`);
     } else {
       pendingWake = []; pendingBcast = []; deliveryFails = 0; retryAt = 0;
+      unpark("a turn landed");   // #7914: the seat is working again — the park record must not outlive it
       // #7778: reconcile BEFORE the write below so the persisted snapshot carries the seen-set.
       await reconcileSessionReads(cursor);
       savePending([], []);

package/hooks/lib/handoff.mjs

@@ -340,7 +340,7 @@ export function buildSummary(transcriptPath) {
   let convo = "";
   try { convo = digest(collectTurns(transcriptPath)); } catch { convo = ""; }
   if (!convo) return "*(transcript unreadable)*";
-  const sys = "You are writing a SESSION HANDOFF so a fresh Claude Code session can take over without losing context. The text spans an entire (possibly multi-hour) session: opening turns, an even sample of the middle, and the recent tail. Produce a concise but COMPLETE markdown handoff with these sections: TASK (what we're doing + the goal), STATE (done / in-progress), KEY DECISIONS, OPEN THREADS & NEXT STEPS (concrete actions), KEY FILES & locations (exact paths). Be specific. Cover the whole arc, not just the end. The finished handoff must fit ~3500 characters — anything longer is capped with an elision marker and the elided middle (usually STATE) is exactly what the successor needed (#6528), so compress the arc, never drop a section. Do not pad.";
+  const sys = "You are writing a SESSION HANDOFF so a fresh Claude Code session can take over without losing context. The text spans an entire (possibly multi-hour) session: opening turns, an even sample of the middle, and the recent tail. Produce a concise but COMPLETE markdown handoff with these sections: TASK (what we're doing + the goal), STATE (done / in-progress), READ FIRST (the files a successor must open before acting — name the project's memory index and, where it has them, its PRD and its TDD, by exact path), KEY DECISIONS, OPEN THREADS & NEXT STEPS (concrete actions), KEY FILES & locations (exact paths). Be specific. Cover the whole arc, not just the end. The finished handoff must fit ~3500 characters — anything longer is capped with an elision marker and the elided middle (usually STATE) is exactly what the successor needed (#6528), so compress the arc, never drop a section. Do not pad.";
   // Cut the raw tail on a TURN boundary: a blind slice opens mid-sentence, and a successor cannot
   // tell a truncated thought from a complete one.
   const tail = (n) => {
@@ -382,19 +382,59 @@ export function verbatimRecentTail(transcript, chars = 7000) {
   try { return collectTurns(transcript).join("\n\n").slice(-chars); } catch { return ""; }
 }
 
-// ---- #5648: handoff writer discipline. The inline summary is the RECAP, not the record: capped at
-// ~4KB, keeping BOTH ends (goal framing and current state) cut on paragraph boundaries with an elision marker.
+// ---- #5648: the inline summary is the RECAP, not the record; #8222: the ~4KB budget is an
+// INJECTION budget — the record persists the text UNCAPPED, this cut runs only at render time
+// (sessionstart.mjs). Section-aware: every handoff shares the five-section shape, so a head+tail
+// cut elides the middle — TASK / STATE / OPEN THREADS survive in full, KEY DECISIONS / KEY FILES elide.
+const IS_SECTION_HEADER = /^\s*#{1,6}\s+\S/;
+const MUST_KEEP_SECTION = /^\s*#{1,6}\s*(task|state|open threads|next steps|read[\s-]?first)\b/i;
+
+// `cap` bounds the ELIDABLE sections, not the return value: must-keeps are never cut (#8222).
 export function capSummary(text, cap = 4096) {
   const s = String(text || "");
   if (s.length <= cap) return s;
   const elide = "\n\n[…]\n\n";
-  const headRaw = s.slice(0, Math.max(0, cap - elide.length - 2048));
-  const hCut = headRaw.lastIndexOf("\n\n");
-  const head = hCut > 200 ? headRaw.slice(0, hCut) : headRaw;
-  let tail = s.slice(s.length - (cap - head.length - elide.length));
-  const tCut = tail.indexOf("\n\n");
-  if (tCut > 0 && tCut < 2000) tail = tail.slice(tCut + 2);   // drop the partial opening line
-  return head + elide + tail;
+  // Split into blocks at markdown headers; text before the first header is the title block.
+  const blocks = [];
+  let cur = null;
+  for (const line of s.split("\n")) {
+    if (IS_SECTION_HEADER.test(line)) { cur = { title: line, lines: [] }; blocks.push(cur); }
+    else { if (!cur) { cur = { title: "", lines: [] }; blocks.push(cur); } cur.lines.push(line); }
+  }
+  const render = (b) => ((b.title ? `${b.title}\n` : "") + b.lines.join("\n")).replace(/^\n+/, "").replace(/\n+$/, "");
+  // Must-keeps claim the budget first and are never cut (the leading H1 title rides with them);
+  // headerless text has no sections to protect, so it is one elidable block like any other.
+  const kept = new Map();
+  let budget = cap;
+  blocks.forEach((b, i) => {
+    if ((i === 0 && b.title) || MUST_KEEP_SECTION.test(b.title)) {
+      const r = render(b);
+      kept.set(i, r);
+      budget -= r.length + 2;   // the "\n\n" join
+    }
+  });
+  // Elidables (KEY DECISIONS, KEY FILES, anything unrecognized) fill what remains, in order; past
+  // the first one that does not fit, the marker stands for the rest. Must-keeps after that point
+  // still render — a work order is never dropped for sitting behind a KEY DECISIONS.
+  const parts = [];
+  let over = false;
+  blocks.forEach((b, i) => {
+    if (kept.has(i)) { parts.push(kept.get(i)); return; }
+    if (over) return;
+    const r = render(b);
+    if (r.length + 2 <= budget) { parts.push(r); budget -= r.length + 2; return; }
+    over = true;
+    let acc = "";
+    for (const p of r.split("\n\n")) {
+      if (acc.length + p.length + 2 > budget - elide.length) break;
+      acc = acc ? `${acc}\n\n${p}` : p;
+    }
+    // One unbreakable paragraph bigger than the whole budget (a pathological summary) still keeps
+    // its opening — a hard slice beats injecting nothing but the marker.
+    if (!acc) acc = r.slice(0, Math.max(0, budget - elide.length));
+    if (acc) parts.push(acc);
+  });
+  return parts.join("\n\n") + (over ? elide : "");
 }
 
 // Trantor State — the structured field on the record (TDD §4.5). `summary` is written as before;
@@ -617,10 +657,19 @@ export function writeHandoff({ projectDir, sessionId, transcript, trigger, summa
   const stamp = nowSec() || Date.now();
   let gitStatus = "";
   try { gitStatus = execSync("git -C " + JSON.stringify(projectDir) + " status --short 2>/dev/null | head -30", { encoding: "utf8" }).trim(); } catch {}
-  // Cap the composed narrative to the injection budget (~4KB). The verbatim tail is deliberately
-  // NOT embedded anymore: the record's transcript_path points at the full exchange, and embedding
-  // it here doubled the successor's read for state that was already one path away (#5648).
-  const narrative = capSummary(summary ?? buildSummary(transcript));
+  // #8222: persist the narrative UNCAPPED — a record has no context budget, and cutting here
+  // DESTROYS the work order rather than hiding it (trantor-1789869270 lost its numbered OPEN
+  // THREADS this way). The ~4KB budget is enforced at injection (sessionstart.mjs); the verbatim
+  // tail is not embedded — transcript_path points at the full exchange (#5648).
+  let narrative = summary ?? buildSummary(transcript);
+  // #8232 floor: readFirstPaths short-circuits on an empty list, so a summary naming no read-first
+  // paths disarms the #8162 gate — every check downstream passes vacuously, and the summarizer
+  // produced exactly that before #8232 asked it for the section. The memory index is knowable
+  // without the model; PRD and TDD stay the summarizer's to find (only it knows they exist).
+  if (!readFirstPaths(narrative).length) {
+    const mem = memoryIndexPath(projectDir);
+    if (mem) narrative += `\n\n## READ FIRST\n${mem}`;
+  }
   // Sub-agent manifest SNAPSHOT (fallback). The successor should re-derive it LIVE via
   // `trantor agents <sid>` (catches files an agent finished that were clobbered AFTER this
   // snapshot — the kill that motivated this corrupted a completed 30KB lib post-handoff). This
@@ -640,7 +689,8 @@ export function writeHandoff({ projectDir, sessionId, transcript, trigger, summa
     project: projectDir, projectName, machine: hostname(),
     session_id: sessionId || "", trigger: trigger || "auto",
     transcript_path: transcript || "", stamp: Number(stamp) || 0,
-    // recap-sufficient inline summary, capped ~4KB — the full story lives at transcript_path
+    // model-authored summary, persisted UNCAPPED (#8222) — the ~4KB cap lives at injection time;
+    // the full story also lives at transcript_path
     summary: narrative,
     // attended|unattended — who pulls the baton trigger (resolved autonomy `baton` dial)
     mode: handoffMode(projectName),
@@ -751,14 +801,10 @@ export function maybeSpawn(projectDir, conf = readConfig(), handoffFile = "", de
   try {
     if (_platform !== "darwin") return false;
     if (_env.TRANTOR_NO_HANDOFF_SPAWN === "1") return false;
-    // #8089 REVERTED 2026-09-19, and the revert is the point. A pane session gets NO Terminal
-    // window AND no baton driver from here: the APP owns the replacement. app handoff_now runs
-    // `trantor handoff --write-only`, waits for the record (including the armed-mid-turn case it
-    // explicitly handles), then does its OWN idle gate, kill and reopen (#6081, #5509). Making this
-    // spawn a pane baton put a SECOND driver on the same pane, racing the app's — which broke the
-    // chat handoff button and the skill, both of which had been working. The stranding this was
-    // meant to fix is real but lives in the SKILL path, where no app driver exists; fixing it here
-    // cannot tell the two flows apart, so it must be fixed where the flows are distinguishable.
+    // #8089 REVERTED — the APP owns pane replacement: handoff_now runs `trantor handoff --write-only`
+    // then its OWN idle gate/kill/reopen (#6081, #5509). A pane gets no Terminal window and no baton
+    // driver from here; spawning one put a SECOND driver on the pane, racing the app's and breaking
+    // the chat button + skill. #8089's stranding lives in the SKILL path — fix it there or not at all.
     if (_pane(_env)) {
       _log(`[trantor] session lives in herdr pane ${_pane(_env)} — no Terminal window and no baton driver from here; the app (or the skill path) owns the replacement\n`);
       return false;
@@ -772,30 +818,31 @@ export function maybeSpawn(projectDir, conf = readConfig(), handoffFile = "", de
     const script = join(HERE, "..", "..", "bin", "handoff-prompt.sh");
     if (!existsSync(script)) { _log(`[trantor] handoff-prompt.sh missing\n`); return false; }
     const timeout = String(conf.handoffPromptTimeout || 25);
-    // Injectable for the same reason the pane legs are: this line opens a REAL Terminal window, and
-    // a drill that reaches it opens one per run. That is not hypothetical — test-pane-baton-spawn's
-    // "no pane" case fell through to here and opened a window on every `npm test`, with a comment
-    // above it claiming the drill did not exercise this leg. Four of them were sitting on the
-    // operator's desktop before anyone noticed, and only a non-existent fixture path stopped each
-    // one from starting a live billable session.
+    // Injectable (deps.spawnPrompt): this line opens a REAL Terminal window, and a drill reaching it
+    // opens one per run — test-pane-baton-spawn's "no pane" case fell through here on every npm test
+    // and four windows landed on the operator's desktop before anyone noticed; only a non-existent
+    // fixture path stopped each from starting a live billable session.
     const child = (deps.spawnPrompt || spawn)("/bin/bash", [script, projectDir, timeout], { detached: true, stdio: "ignore" });
-    if (child && typeof child.unref === "function") child.unref();
+    if (child?.unref) child.unref();
     return true;
   } catch (e) { process.stderr.write(`[trantor] maybeSpawn error: ${e?.message}\n`); return false; }
 }
 
-/** The files a handoff tells its successor to read before doing anything (#8162).
- *
- *  A handoff has always been able to SAY "read these first" — crebral-health's named three memory
- *  files on 2026-09-19 and the successor opened none of them. Saying it was the whole mechanism.
- *  This pulls the list out as data so something downstream can check it.
- *
- *  Recognised: a `READ FIRST` / `READ-FIRST` / `Read first:` heading or line, and every path-looking
- *  token on it and the lines beneath it until the next blank line or heading. Deliberately narrow —
- *  a handoff that mentions a file in passing is not asking anyone to read it, and a gate that fires
- *  on every path in a 4k summary would be noise the successor learns to ignore.
- *  @returns {string[]} project-relative or absolute paths, de-duplicated, capped
- */
+/** #8232: the one read-first path knowable WITHOUT the model — the project's own memory index, at
+ *  the encoded-cwd location Claude Code keeps it (the same resolver bin/reconcile.mjs reads).
+ *  "" when the project has none: naming a file that does not exist would arm a gate no successor
+ *  could ever satisfy, and the stamp would nag at every Stop forever. */
+export function memoryIndexPath(projectDir) {
+  try {
+    const p = join(homedir(), ".claude", "projects", String(projectDir || "").replaceAll("/", "-"), "memory", "MEMORY.md");
+    return existsSync(p) ? p : "";
+  } catch { return ""; }
+}
+
+/** The files a handoff tells its successor to READ FIRST (#8162) as DATA, so something downstream
+ *  can check it. Recognised: a `READ FIRST`/`READ-FIRST`/`Read first:` heading or line, and every
+ *  path-looking token until the next blank line or heading — narrow on purpose: a path in passing
+ *  is not a reading order. @returns {string[]} paths, deduped, capped */
 export function readFirstPaths(summary, { max = 12 } = {}) {
   const text = String(summary || "");
   const out = [];
@@ -817,14 +864,9 @@ export function readFirstPaths(summary, { max = 12 } = {}) {
   return out;
 }
 
-/** Which of `paths` this session actually OPENED, read off its own transcript (#8162).
- *
- *  Ground truth rather than testimony, the same rule the state gate learned the hard way: a
- *  successor saying "I have read the handoff" is not evidence that it did. A Read/Grep/Glob tool
- *  call naming the path is. Matches on basename as well as full path, because a handoff written by
- *  a model may name `revenue-integrity-build.md` where the Read call carries the absolute path.
- *  @returns {{read: string[], missed: string[]}}
- */
+/** Which of `paths` this session actually OPENED, read off its own transcript (#8162) — ground
+ *  truth, not testimony: a Read/Grep/Glob tool call naming the path is evidence, "I have read the
+ *  handoff" is not. Matches basename as well as full path. @returns {{read: string[], missed: string[]}} */
 export function pathsReadIn(transcriptPath, paths) {
   const want = (paths || []).filter(Boolean);
   if (!want.length) return { read: [], missed: [] };
@@ -846,11 +888,9 @@ export function pathsReadIn(transcriptPath, paths) {
 }
 
 // The self-announcing fresh session command (single-quoted so it survives osascript→shell un-escaped).
-// Brevity is part of the prompt: a takeover that answers with 5k-character status dumps loses the
-// operator. But brevity is about what you SAY, and #8162 found it had quietly become permission not
-// to READ: the summary is injected at SessionStart, so a 3-sentence recap is producible without
-// opening a file, and a successor doing exactly as asked never opened one. Three days of takeovers
-// went straight to code off a summary. So the order is now read-then-recap, and the recap stays short.
+// Brevity is the point, but #8162 found it had become permission not to READ: the summary is injected
+// at SessionStart, so a 3-sentence recap is producible without opening a file. The order is now
+// read-then-recap, and the recap stays short.
 export const RECAP_CMD = "claude 'You have just taken over via handoff. FIRST open every file the handoff names as read-first — its memory files, its PRD and TDD — and do not answer until you have. They are the context the handoff exists to carry, and the summary is a pointer to them, not a substitute. THEN recap in at most 3 sentences: task, state, next step. Then wait for me. Keep all replies short by default: no status tables, no headers, no walls of text unless I explicitly ask for detail.'";
 
 // ONE suppression check for every path that can open a terminal window: two names for it once let a

package/hooks/sessionstart.mjs

@@ -10,7 +10,7 @@ import { fileURLToPath } from "node:url";
 import { resolveProject, hostId, resolveHubInfo, knownProjects, nonSeatReason, nestedProjects, handoffDir, readOrchSession, writeOrchSession } from "../lib/project.mjs";
 import { formatSubagentManifest } from "../lib/subagent-manifest.mjs";
 import { updateAvailable, maybeNotifyDesktop, readConfig } from "./lib/update-check.mjs";
-import { renderStateBlock, readFirstPaths} from "./lib/handoff.mjs";
+import { renderStateBlock, readFirstPaths, capSummary } from "./lib/handoff.mjs";
 import { maybeCheckBalances } from "./lib/balance-check.mjs";
 import { getJSON, signedGet, signedPost, loadIdentity } from "./lib/api.mjs";
 import { ledgerPaths, ensureStart, anchorCursor, writeCursor } from "./lib/inbox-ledger.mjs";
@@ -118,20 +118,19 @@ function sanitize(s) {
   return out;
 }
 
-// #5645 injection cap: the handoff injection is a POINTER, not a payload. The writer (#5648) caps
-// rec.summary at ~4KB; this reader enforces the same bound against older records and points at the file.
+// #5645 injection cap — #8222: the writer persists rec.summary UNCAPPED (a JSON record has no
+// context budget), so this reader is the ONLY place the ~4KB injection budget is enforced. The cut
+// is section-aware (TASK / STATE / OPEN THREADS survive; KEY DECISIONS / KEY FILES elide) and the
+// pointer names the full record for whatever was dropped.
 const HANDOFF_INJECT_CAP = 4096;
 function capHandoffSummary(handoff) {
   let s = String(handoff?.summary || "");
   const marker = s.indexOf("\n---\n## Verbatim recent exchange");
   if (marker > 0) s = s.slice(0, marker);
   if (s.length <= HANDOFF_INJECT_CAP) return s;
-  const cut = s.slice(0, HANDOFF_INJECT_CAP);
-  const nl = cut.lastIndexOf("\n");
-  s = (nl > HANDOFF_INJECT_CAP * 0.6 ? cut.slice(0, nl) : cut).trimEnd();
   let ptr = `\n\n…(summary capped at ${HANDOFF_INJECT_CAP} chars — full record: ${join(handoffDir(), `${handoff.id}.json`)}`;
   if (handoff.transcript_path) ptr += ` · full transcript: ${handoff.transcript_path}`;
-  return s + ptr + ")";
+  return capSummary(s, HANDOFF_INJECT_CAP) + ptr;
 }
 
 // Fail-silent wrapper for the optional #4214 resources detection lib (hooks/lib/resources.mjs).

package/lib/seat-why.mjs

@@ -24,6 +24,18 @@ function readTelemetry(file) {
   return out;
 }
 
+// #7914: the park record the runner writes while it is holding a queue. Present and unexpired = the
+// seat is PARKED, which is a different answer from "live, last turn failed, watch it or swap" — one
+// says what is happening and when it ends, the other tells the operator to go and watch a seat that
+// was never going to move. Anything unreadable reads as no park: a live seat is the safe default.
+function readPark(dir, project, agent, now) {
+  try {
+    const rec = JSON.parse(readF(join(dir, `park-${agent}-${project}.json`)));
+    if (!rec || !rec.reason) return null;
+    return Number(rec.until) > now ? rec : null;
+  } catch { return null; }
+}
+
 function findPane(dir, project, agent) {
   const row = readF(join(dir, "crew-windows.txt")).split("\n")
     .map(l => l.split("\t"))
@@ -48,6 +60,13 @@ function scanPids(project, agent) {
 }
 
 const fmt = (ts) => { try { return new Date(ts).toLocaleTimeString([], { hour: "2-digit", minute: "2-digit" }); } catch { return String(ts); } };
+// rel() reads backwards ("4m ago"); a park's resume time is the one timestamp here that is ahead.
+const untilFmt = (ts, now = Date.now()) => {
+  const s = Math.max(0, Math.round((ts - now) / 1000));
+  if (s < 60) return `in ${s}s`;
+  if (s < 3600) return `in ${Math.round(s / 60)}m`;
+  return `in ${Math.round(s / 3600)}h`;
+};
 const rel = (ts) => {
   const s = Math.max(0, Math.round((Date.now() - ts) / 1000));
   if (s < 60) return `${s}s ago`;
@@ -93,9 +112,22 @@ export function seatWhy(project, agent, opts = {}) {
 
   let state, why, advice;
 
+  const now = opts.now || Date.now();
+  const park = readPark(dir, project, agent, now);
+
   if (pids.length) {
     const pidList = pids.join(", ");
-    if (!pane) {
+    if (park) {
+      // A parked seat is parked whether or not it has a pane — the queue is held either way, and
+      // the resume time is the one fact the operator needs before deciding to swap it.
+      const held = Number(park.held) || 0;
+      state = "parked";
+      why = `crew-runner pid ${pidList} alive${pane ? `, pane ${pane.source}/${pane.pane}` : " (headless)"}; PARKED (${park.reason}) `
+        + `holding ${held} message${held === 1 ? "" : "s"} since ${fmt(park.ts)}${park.evidence ? ` — ${park.evidence}` : ""}.`;
+      advice = park.bounded
+        ? `parked until ${fmt(park.until)} (${untilFmt(park.until, now)}) — it resumes itself; a direct message to ${agent}:${project} ends the park now.`
+        : `park has no timer (${park.reason}) — it holds until the wall lifts or \`trantor up ${agent}\`.`;
+    } else if (!pane) {
       state = "no-pane";
       why = `crew-runner pid ${pidList} alive for ${agent}:${project}, but crew-windows.txt has no pane row — the seat is headless.`;
       advice = "give the seat a window it can be read in: `trantor up <agent>` (or attach via herdr/cmux).";

package/lib/turn-policy.mjs

@@ -227,3 +227,39 @@ export function isLinkedProject(senderProject, seatProject, links) {
     return ps.includes(String(senderProject).toLowerCase()) && ps.includes(String(seatProject).toLowerCase());
   });
 }
+
+/// #7914: how many CUT turns a chain needs before the park notice owes evidence for them. The
+/// threshold that PARKS is #6289's (a chain retries once, the second failed chain parks); this is
+/// the point at which "PARKED (time-box)" stops being enough on its own and has to name which
+/// turns the box killed and how.
+export const CUT_CHAIN_PARK_MIN = 2;
+
+/// #7914: what a park notice owes its reader — "PARKED (time-box)" alone sends them to three logs
+/// to find out which turns died and how. notifyAssigners caps the line at 280 chars and the ask
+/// sits at its tail, so the chain is named by its COUNT plus its most recent turn; the full chain
+/// stays in the runner log and the ledger rows.
+export const CUT_CHAIN_EVIDENCE_MAX = 1;
+export function cutChainEvidence(rows) {
+  const all = Array.isArray(rows) ? rows : [];
+  const shown = all.slice(-CUT_CHAIN_EVIDENCE_MAX);
+  const head = all.length > shown.length ? `${all.length} cut turns, last: ` : "";
+  return head + shown.map((r) => {
+    const exit = `exit ${r.exit ?? "?"}${r.signal ? ` (${r.signal})` : ""}`;
+    // The box is named in the unit it was set in — a drill's seconds-long box must not round to
+    // "the 0m box", which is the evidence line lying about the very number it exists to carry.
+    const ms = Number(r.boxMs) || 0;
+    const box = ms >= 60000 ? `${Math.round(ms / 60000)}m` : `${Math.round(ms / 1000)}s`;
+    // Every row here is a BOX cut by construction — a stall never joins the chain — so the clause
+    // names the box, and the extensions that bought the turn more of it.
+    const how = `cut at the ${box} box${r.extensions ? ` after ${r.extensions} liveness extension(s)` : ""}`;
+    return `turn ${r.turn} (${r.trigger || "?"}) ${exit} — ${how}`;
+  }).join(" · ");
+}
+
+/// #7914: a park that a TIMER can clear. The box cutting a turn twice says nothing about the plan
+/// or the key, so that park is a wait: it carries a window, resumes itself, and a direct message
+/// ends it early. Exhaustion and a rejected key are walls — the ladder never succeeds against them
+/// (#6134), so those parks hold until the reset or `trantor up`, whoever knocks.
+export function isBoundedPark(reason) {
+  return !PARKING_REASONS.has(reason);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.67",
+  "version": "0.18.68",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"