trantor 0.18.69 → 0.18.71

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.69",
+  "version": "0.18.71",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/baton.mjs

@@ -3,12 +3,12 @@
 // a whole-session handoff (auto-summary + verbatim in-flight tail), opens a fresh self-announcing
 // session, and closes THIS window once it takes over. Run from inside the session you want to hand
 // off. (The richer MODEL-authored handoff is the /trantor:handoff skill.)
-import { readdirSync, statSync, fstatSync } from "node:fs";
+import { readdirSync, statSync } from "node:fs";
 import { join, basename, dirname } from "node:path";
 import { homedir } from "node:os";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { writeHandoff, spawnBaton, resolveHandoffSurface, armBaton, contextUsage, controllingTty, turnInFlight, armMaxMs, sessionProcessState } from "../hooks/lib/handoff.mjs";
+import { writeHandoff, spawnBaton, resolveHandoffSurface, armBaton, contextUsage, controllingTty, turnInFlight, armMaxMs, sessionProcessState, stdinCarriesMarkdown } from "../hooks/lib/handoff.mjs";
 
 // #6074: the skill path (write-handoff.mjs) and this CLI path must share ONE resolution of which
 // project this is and where the session lives. Both call resolveHandoffSurface; the name comes
@@ -22,18 +22,11 @@ const project = resolved.project;
 // cwd that cd'd somewhere else: a handoff record must carry the transcript it was written from.
 const sessionDir = resolved.projectDir;
 
-// Model-authored handoffs ride THIS binary too (`trantor handoff` — always the global install's
-// CURRENT code, never the plugin-cache copy a session booted with, the stale-0.18.20 bug). A piped
-// stdin (a heredoc, a cat, `<<HANDOFF`) means "here is the handoff markdown" — exactly the skill's
-// contract — so forward to write-handoff.mjs in the SAME package (same version, same resolution)
-// and exit with its status. --latest forwards too. A true pipe is a FIFO; a TTY and /dev/null are
-// character devices, so a plain `trantor handoff` typed at a prompt (or run by a hook with stdin
-// at /dev/null) keeps the auto-summary behavior. Detection must NOT be `!process.stdin.isTTY` —
-// that misreads /dev/null as a handoff and errors where auto-summary used to work.
-function stdinIsPipe() {
-  try { return fstatSync(0).isFIFO(); } catch { return false; }
-}
-if (stdinIsPipe() || process.argv.includes("--latest")) {
+// Model-authored handoffs ride THIS binary too — always the global install's CURRENT code, never
+// the plugin-cache copy a session booted with (the stale-0.18.20 bug). Markdown on stdin means
+// "here is the handoff", so forward to write-handoff.mjs in the SAME package; --latest forwards too.
+// What counts as markdown, and why /dev/null must not: stdinCarriesMarkdown in hooks/lib (#8459).
+if (stdinCarriesMarkdown() || process.argv.includes("--latest")) {
   const helper = join(dirname(fileURLToPath(import.meta.url)), "write-handoff.mjs");
   const child = spawn(process.execPath, [helper, ...process.argv.slice(2)], { stdio: ["inherit", "inherit", "inherit"] });
   child.on("exit", (c) => process.exit(c ?? 1));
@@ -64,12 +57,10 @@ function autoBaton() {
   // The transcript's filename IS the writing session's id — record it, or an orchestrator-thread
   // handoff carries no writer and the baton-hold + map-follow logic in sessionstart.mjs can't fire.
   const sessionId = transcript ? basename(transcript, ".jsonl") : "";
-  // #6528: WHO pulled the trigger. A TTY stdin means a human typed `trantor handoff` at a prompt;
-  // the app chain (lib.rs handoff_now) and hooks spawn this binary with piped stdio. The operator's
-  // own typed command keeps the storm-guard bypass (force:true — "manual = intentional"); every
-  // invoked path goes through the boundary gate and the hub's storm guard like any auto handoff.
-  // --reason rides through from the app (`--reason clicked|countdown|unattended`) so the RECORD
-  // finally names the real trigger instead of laundering every banner fire into "manual-cli".
+  // #6528: WHO pulled the trigger. A TTY stdin is a human typing it; the app chain (handoff_now)
+  // and hooks spawn this with piped stdio. Only the typed command keeps the storm-guard bypass
+  // (manual = intentional); every invoked path goes through the boundary gate like an auto handoff.
+  // --reason rides through from the app so the record names the real trigger, not "manual-cli".
   const reasonArg = (() => {
     const i = process.argv.indexOf("--reason");
     const v = i >= 0 ? String(process.argv[i + 1] || "").trim() : "";

package/bin/crew-runner.mjs

@@ -11,6 +11,7 @@ import { loadOrCreate } from "../lib/identity.mjs";
 import { signedHeaders } from "../lib/signed-fetch.mjs";
 import { ensureEnrolled } from "../lib/enroll.mjs";
 import { redactKeys } from "../lib/redact.mjs";
+import { writeTurnState } from "../lib/turnstate.mjs";
 import { applyWorktreeDeclaration, ensureSeatWorktree, provisioningLines, readWorktreeDeclaration } from "../lib/seat-worktree.mjs";
 import {
   AUTH_MARKER_RE, classifyFailure, looksLikeAuthDeath,
@@ -23,6 +24,7 @@ import {
   senderProjectOf, isLinkedProject, stateSkipReason, isMessageCardTitle, OPEN_CARD_STATUSES,
   CUT_CHAIN_PARK_MIN, cutChainEvidence, isBoundedPark,
 } from "../lib/turn-policy.mjs";
+import { ocTurnUsage, dshTurnUsage, usageTotal } from "../lib/turn-usage.mjs";
 import {
   auditDutyNudges, claimDutyNudges, claudeTranscriptDir, dutyEscalations, dutyNudgeDirective,
   observedDutyNudgeIds, requeueMissingWakeMessages, shedExpiredHubAlerts,
@@ -459,6 +461,10 @@ async function parkSeat(reason, undelivered, resetHint = 0, { evidence = "" } =
   // the operator can hear out of band, once per park.
   notifyOperator(`Trantor: ${SESSION} PARKED (${reason})`,
     `${undelivered} message(s) held${when ? ` — retrying after ${when}` : ` — needs \`trantor up ${AGENT}\``}`);
+  // #7749: parked is a first-class phase — the file and the peer row both say so, so an
+  // orchestrator stops confusing a quota-held seat with a working or a dead one.
+  writeTurnState(AGENT, PROJ, { phase: "parked", since: Date.now() });
+  await registerStatus(`parked (${reason})`, { phase: "parked", phaseSince: Date.now() });
   return until;
 }
 
@@ -515,9 +521,10 @@ async function balanceRows() {
 // ---- activity truth (#5965): the RUNNER is the source for this seat ----------------
 // herdr cannot see a runner-driven CLI mid-turn, so the runner reports turn boundaries to the hub:
 // `working · <trigger>` at start, `idle` on a clean landing. Bounded 5s, one call per transition.
-async function registerStatus(status) {
+// #7749: the live phase + its start ride the same call, so /peers answers what the seat does NOW.
+async function registerStatus(status, extra = {}) {
   const url = HUB + "/register";
-  const body = JSON.stringify({ session: SESSION, project: PROJ, status, llm: AGENT, model: MODEL });
+  const body = JSON.stringify({ session: SESSION, project: PROJ, status, llm: AGENT, model: MODEL, ...extra });
   try {
     const opts = { method: "POST", headers: { "content-type": "application/json", connection: "close" }, body };
     await fetch(url, { ...opts, headers: { ...opts.headers, ...signedHeaders(identity, url, opts) }, signal: AbortSignal.timeout(5000) });
@@ -703,7 +710,10 @@ async function runTurn(prompt, isFirst, trigger = "kickoff", opts = {}) {
   // #5965 — TURN START. The hub peer row is where the app reads activity from, and the runner is
   // the only one who knows a turn is starting, so say so before the CLI spawn (awaited: the spawn
   // below blocks the loop, an unawaited fetch would not leave the machine until the turn ended).
-  await registerStatus(`working · ${trigger}`);
+  await registerStatus(`working · ${trigger}`, { phase: "working", phaseSince: t0 });
+  // #7749: the same boundary on disk — the watchdog refreshes lastBytesAt/lastTranscriptAt while
+  // the turn runs, so a live reader sees the turn advance without waiting for its end.
+  writeTurnState(AGENT, PROJ, { turn: TURN, phase: "working", since: t0, card: sessionCard || 0, lastBytesAt: t0, lastTranscriptAt: 0 });
   const pf = join(homedir(), ".agent-bus", `turn-${AGENT}-${PROJ}.txt`);
   appendFileSync(pf, "", { flag: "w" }); // truncate
   appendFileSync(pf, prompt);
@@ -786,7 +796,9 @@ async function runTurn(prompt, isFirst, trigger = "kickoff", opts = {}) {
     const wd = spawn(process.execPath, [join(import.meta.dirname, "turn-watchdog.mjs"), STAMPF, ERRF, String(WD_MS), SESSION, PROJ, HUB, TRANSCRIPT_DIR, TURN_DIR,
       // #7752: the stall marker only exists when a box does — with no box there is no sweep to
       // end the turn, so the watchdog stays report-only (reporting is the whole job, boxless).
-      TURN_MAX_MS ? STALLF : ""],
+      TURN_MAX_MS ? STALLF : "",
+      // #7749: the turn-state file the watchdog refreshes mid-turn (lastBytesAt/lastTranscriptAt).
+      join(homedir(), ".agent-bus", `turnstate-${AGENT}-${PROJ}.json`)],
       { detached: true, stdio: "ignore" });
     WD_CHILD = wd;
     wd.unref();
@@ -875,6 +887,12 @@ exit $turn_exit`;
   }
   lastTurnCut = cut;
   lastTurnStalled = cut && stallCut;
+  // #7749: the cut boundary lands on disk and on the peer row BEFORE the follow-up turn overwrites
+  // it — a reader sampling mid-chain sees what actually just happened, not a stale "working".
+  if (cut) {
+    writeTurnState(AGENT, PROJ, { phase: stallCut ? "stalled" : "cut", since: Date.now() });
+    await registerStatus(stallCut ? "stalled · no activity" : "cut at the time box", { phase: stallCut ? "stalled" : "cut", phaseSince: Date.now() });
+  }
   // #5869: scrub AT REST, synchronously, before anything reads the file back. The explicit shell
   // wait above drains the live stderr scrubber first; this pass is defense in depth for redaction.
   try { writeFileSync(ERRF, redactKeys(readFileSync(ERRF, "utf8"))); } catch {}
@@ -940,6 +958,13 @@ exit $turn_exit`;
     // actually carried counts.
     if (c) tokens = c.input + c.output + c.cache_read + c.cache_creation;
   }
+  // #8234: the CLIs that print no usage on stdout keep the counts in their own session records —
+  // opencode's db, the session resolved for this turn exactly like the `-s` resume id. Sum this
+  // turn's window there; null (unknown) leaves the stdout paths above standing — never 0 ("free").
+  const usage = cli.pinned && sid ? ocTurnUsage(OC_DB, sid, t0, Date.now())
+    : AGENT === "dsh" ? dshTurnUsage(join(homedir(), ".dsh", "sessions"), TURN_DIR, t0, Date.now())
+    : null;
+  if (usage) tokens = usageTotal(usage);
   // #6289: every ledger row names in ONE field what happened to the turn — cut, stalled (#7752),
   // api-error, completed — and what it cost (0 means "not reported", never "free"). #7762: `card`
   // binds the row to the card the turn worked (0 = kickoff/pulse) so the seat record attributes
@@ -952,6 +977,7 @@ exit $turn_exit`;
     try { finalOutcome = (await opts.judgeOutcome()) || outcome; } catch {}
   }
   const telemetryRow = { ts: Date.now(), agent: AGENT, project: PROJ, turn: TURN, trigger, card: sessionCard || 0, model: MODEL || "cli-default", duration_ms: Date.now() - t0, exit: realExit, effExit, authFailed: effExit !== realExit, emptyOutput: lastEmptyOutput, emptyTurn: lastEmptyTurn, verdict, outcome: finalOutcome, tokens };
+  if (usage) telemetryRow.usage = usage;
   if (cut) telemetryRow.cut = true;
   if (stallCut) telemetryRow.stalled = true;
   if (extensions) { telemetryRow.extensions = extensions; telemetryRow.boxMs = boxMs; }
@@ -967,7 +993,10 @@ exit $turn_exit`;
   if (realExit === 0 && effExit === 0) { cmuxStatus("idle", "#8a94a6", "robot"); herdrAgent("idle"); }   // finished this turn, waiting for the next
   // #5965 — TURN END. A clean exit means the seat is idle again; say so right away so the app stops
   // pulsing it even before the next /poll heartbeat. Failure keeps reportFailure's down/errored.
-  if (realExit === 0 && effExit === 0) await registerStatus("idle");
+  if (realExit === 0 && effExit === 0) {
+    writeTurnState(AGENT, PROJ, { phase: "idle", since: Date.now() });
+    await registerStatus("idle", { phase: "idle", phaseSince: Date.now() });
+  }
   // The follow-up rides the SAME session, exactly once. A state step gets none: TIME_BOX_PROMPT
   // would break the byte-identical prefix, and §4.4 says a cut turn never partially applied a patch.
   if (cut && !inFollowUp && !opts.state) {
@@ -1055,24 +1084,10 @@ async function loadLessons() {
 // #5683: every prompt section is capped (bin/crew-payload.mjs) and the payload has ONE hard total
 // cap; below the caps the composition is byte-identical to the old concatenation.
 function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "", tailText = "", rulesText = "", lessons = null }) {
-  // STABLE FIRST, VOLATILE LAST — this order is a COST decision, not a stylistic one (#8199).
-  // Every provider we send this to caches on an exact prefix match from token 0: DeepSeek's docs say
-  // "only requests with identical prefixes (starting from the 0th token) will be considered
-  // duplicates, and partial matches in the middle of the input will not trigger a cache hit", and a
-  // hit bills at roughly a tenth of a miss. This array used to open with `base` and then the
-  // per-turn WAKE, with the big unchanging blocks (RULES, lessons) buried at the end. On an ordinary
-  // turn `base` is empty — the sha rides inside `again` — so token 0 was the wake text itself, which
-  // is different every turn by definition. No cache could ever hit, and ~4,800 tokens of identical preamble were re-bought at full rate per turn,
-  // on every foreign-CLI seat: dsh, codex, kimi and every opencode/BYOM seat. The state path had
-  // known this for weeks — lib/state/assemble.mjs: "the bytes before STATE_DELIM are the caller's
-  // preamble and NOTHING else, or prefix caching never engages" — and it was never carried across.
-  //
-  // Reading order improves with it rather than suffering: rules and lessons are the standing brief,
-  // then context and history, and the ASK lands last, which is what #7063 found a work order wants.
-  //
-  // The `order` field is UNRELATED to this and deliberately unchanged: it ranks what gets trimmed
-  // when the payload busts its total cap, and wake is trimmed last there because losing the
-  // instruction is worse than losing the cache on that one turn.
+  // STABLE FIRST, VOLATILE LAST — a COST decision, not style (#8199): providers cache on an exact
+  // prefix from token 0, and the old order opened with the per-turn wake, so no cache could ever
+  // hit and ~4,800 identical preamble tokens re-bought at full rate per turn on every seat. The
+  // `order` field is the unrelated trim ranking under the total cap (#5683).
   const built = composePrompt([
     { name: "rules", text: rulesText, trim: "drop", order: 3 },
     { name: "lessons", text: lessons?.text || "", trim: "drop", order: 2 },

package/bin/seat-why.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // trantor seat-why <agent> [--json] — explain why a crew seat is (not) working, straight from
 // local ~/.agent-bus evidence. No hub needed; works even when the whole fleet is down.
-import { seatWhy, fmtSpend } from "../lib/seat-why.mjs";
+import { seatWhy, fmtSpend, dur } from "../lib/seat-why.mjs";
 import { resolveProject } from "../lib/project.mjs";
 
 const args = process.argv.slice(2);
@@ -22,6 +22,12 @@ if (asJson) {
   console.log(JSON.stringify({ agent, project, ...out }, null, 2));
 } else {
   console.log(`seat ${agent}:${project} -> ${out.state}`);
+  // #7749: the live phase line — what the seat is doing NOW and for how long, from the
+  // turn-state file, not inferred from the last ledger row.
+  if (out.turnState?.phase) {
+    const t = out.turnState;
+    console.log(`turn:   ${t.phase} for ${dur(Date.now() - t.since)} (turn ${t.turn}${t.card ? `, card #${t.card}` : ""})`);
+  }
   console.log(`why:    ${out.why}`);
   console.log(`today:  ${fmtSpend(out.today)}`);
   console.log(`advice: ${out.advice}`);

package/bin/seats.mjs

@@ -1,21 +1,14 @@
 #!/usr/bin/env node
 // trantor seats — declare which project lives in which directory, see which ones are missing, and
-// put them back. The answer to "a reboot reopened every window in $HOME and un-seated the crew".
-//
-//   trantor seats                     status of every declared seat
-//   trantor seats add <project> [dir] declare one (dir defaults to the cwd)
-//   trantor seats remove <project>    undeclare one
-//   trantor seats adopt [workspace]   declare every pinned project found under a workspace root
-//   trantor seats up [project…]       open a window for each MISSING seat, in its own directory
-//   trantor seats login install       bring missing seats back automatically after a reboot
-//   trantor seats login uninstall|status
+// put them back after a reboot that reopened every window in $HOME. Run with no arguments for the
+// full command list.
 import { existsSync, writeFileSync, unlinkSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { homedir } from "node:os";
 import { execFileSync } from "node:child_process";
 import {
-  readSeats, declareSeat, undeclareSeat, seatStatus, missingSeats,
-  launchSeat, suggestSeats, projectForDir,
+  readSeats, declareSeat, undeclareSeat, seatStatus,
+  launchSeat, suggestSeats, projectForDir, waitForHerdr,
 } from "../lib/seats.mjs";
 
 const args = process.argv.slice(2);
@@ -38,19 +31,24 @@ function printStatus() {
   const w = Math.max(...rows.map(r => r.project.length), 7);
   console.log(`${D}seat${" ".repeat(Math.max(0, w - 4))}  status              directory${R}`);
   for (const r of rows) {
-    const status = r.live ? `${G}live${R} ${D}(${r.agent} ${r.pid})${R}`
+    const status = r.live ? `${G}live${R} ${D}(${r.agent} ${r.pid !== null ? r.pid : `pane ${r.pane}`})${R}`
+      : r.state === "unknown" ? `${O}UNKNOWN${R}`
       : r.exists ? `${O}MISSING${R}` : `${O}NO DIR${R}`;
     // (why is printed below for anything not live)
     const pad = " ".repeat(Math.max(0, w - r.project.length));
-    console.log(`${r.project}${pad}  ${status}${" ".repeat(Math.max(1, 20 - (r.live ? 4 + String(r.pid).length + r.agent.length + 4 : 7)))}${D}${r.dir}${R}`);
+    console.log(`${r.project}${pad}  ${status}${" ".repeat(Math.max(1, 20 - (r.live ? 4 + String(r.pid !== null ? r.pid : `pane ${r.pane}`).length + r.agent.length + 4 : 7)))}${D}${r.dir}${R}`);
     if (!r.live && r.why) console.log(`${" ".repeat(w + 2)}${D}${r.why}${R}`);
     if (r.via !== "pin") console.log(`${" ".repeat(w + 2)}${O}⚠ hub not pinned${R} ${D}— resolves to ${r.hub} via ${r.via}; pin it: trantor hub set ${r.project} <url>${R}`);
   }
-  const miss = rows.filter(r => !r.live && r.exists);
+  const miss = rows.filter(r => r.state === "missing" && r.exists);
+  const unk = rows.filter(r => r.state === "unknown");
   console.log("");
   if (miss.length) {
     console.log(`${O}${miss.length} seat(s) not running${R}: ${miss.map(m => m.project).join(", ")}`);
     console.log(`Bring them back:  ${O}trantor seats up${R}`);
+  } else if (unk.length) {
+    console.log(`${O}${unk.length} seat(s) in an unknown state${R}: ${unk.map(u => u.project).join(", ")}`);
+    console.log(`${D}Unknown is not missing — nothing is launched for them until the state is provable.${R}`);
   } else {
     console.log(`${G}every declared seat is live${R}`);
   }
@@ -63,9 +61,8 @@ function trantorBin() {
 }
 
 // One-shot login job. Deliberately NOT KeepAlive: a KeepAlive job whose command fails relaunches
-// every ThrottleInterval forever, which is precisely how this machine ended up at load 490 on
-// 2026-08-21 (four portless services rebuilding every 10s). It runs once, after a delay that lets
-// the desktop settle, and exits.
+// every ThrottleInterval forever (it once drove this machine to load 490, four portless services
+// rebuilding every 10s). It runs once, after a delay that lets the desktop settle, and exits.
 function plistBody(delay) {
   const bin = trantorBin();
   return `<?xml version="1.0" encoding="UTF-8"?>
@@ -129,28 +126,37 @@ switch (sub) {
 
   case "up": {
     const only = rest;
-    let miss = missingSeats();
-    if (only.length) miss = miss.filter(m => only.includes(m.project));
     const login = flag("login");
+    // #8716: the login job races herdr's pane restore — a seat judged missing before its pane is
+    // back gets launched as a second Terminal window. Wait bounded, then never launch on UNKNOWN.
+    const herdr = login ? await waitForHerdr() : undefined;
+    if (herdr && !herdr.ok) {
+      console.log(`[${new Date().toISOString()}] herdr is installed but did not answer within 120s — its panes may still be restoring, so no seat can be judged missing; launching nothing`);
+      break;
+    }
+    const rows = seatStatus(undefined, herdr).filter(r => !only.length || only.includes(r.project));
+    const unknowns = rows.filter(r => r.state === "unknown");
+    const miss = rows.filter(r => r.state === "missing" && r.exists);
+    const when = login ? `[${new Date().toISOString()}] ` : "";
+    for (const u of unknowns) console.log(`${when}${O}unknown, not launching${R}: ${u.project} — ${u.why}`);
     if (!miss.length) {
-      if (!login) console.log(`${G}nothing to do — every declared seat is live${R}`);
-      else console.log(`[${new Date().toISOString()}] all declared seats live; nothing launched`);
+      if (!login) console.log(`${G}nothing to do — every declared seat is live or unknown${R}`);
+      else console.log(`${when}nothing launched${unknowns.length ? ` — ${unknowns.length} seat(s) unknown, see above` : "; every declared seat is live"}`);
       break;
     }
-    // A guard rail, not a policy: launching a dozen agent windows at once is never what anyone
-    // meant, and at login it would be actively hostile.
+    // A guard rail, not a policy: restoring a dozen seats at once is never what anyone meant, and
+    // at login it would be actively hostile.
     const CAP = 6;
     if (miss.length > CAP && !flag("force")) {
-      console.error(`${O}${miss.length} seats are missing — refusing to open that many windows at once.${R}`);
+      console.error(`${O}${miss.length} seats are missing — refusing to restore that many at once.${R}`);
       console.error(`Name the ones you want (trantor seats up <project>…), or pass --force.`);
       process.exit(1);
     }
     for (const m of miss) {
       const r = launchSeat(m, { dryRun: flag("dry-run") });
-      const when = login ? `[${new Date().toISOString()}] ` : "";
-      if (r.launched) console.log(`${when}${G}opened${R} ${m.project} — ${m.dir}`);
+      if (r.launched) console.log(`${when}${G}restored${R} ${m.project} — ${m.dir}`);
       else if (flag("dry-run")) console.log(`${when}would run: ${r.command}`);
-      else console.log(`${when}${O}could not open a window${R} for ${m.project}; run it yourself: ${r.command}${r.error ? ` (${r.error})` : ""}`);
+      else console.log(`${when}${O}not launched${R} for ${m.project} — run it yourself: ${r.command}${r.error ? ` (${r.error})` : ""}`);
     }
     break;
   }
@@ -162,11 +168,10 @@ switch (sub) {
       const delay = Number(rest[1] || 60);
       writeFileSync(PLIST, plistBody(Number.isFinite(delay) && delay >= 0 ? delay : 60));
       try { execFileSync("/bin/launchctl", ["bootout", `gui/${process.getuid()}/${LABEL}`], { stdio: "ignore" }); } catch {}
-      // Deliberately NOT bootstrapped here. RunAtLoad fires on bootstrap, not only at login, so
-      // `seats login install` would immediately open a window for every missing seat — which is
-      // never what installing a RECOVERY job means, and on 2026-08-23 it very nearly reopened two
-      // sessions the operator was deliberately holding closed. The plist on disk is the install;
-      // launchd loads it at the next login. --now is the explicit opt-in for right this second.
+      // Deliberately NOT bootstrapped here: RunAtLoad fires on bootstrap, and installing a RECOVERY
+      // job must never immediately reopen the very sessions the operator is holding closed (it once
+      // very nearly did). The plist on disk is the install; launchd loads it at the next login.
+      // --now is the explicit opt-in for right this second.
       if (flag("now")) {
         try {
           execFileSync("/bin/launchctl", ["bootstrap", `gui/${process.getuid()}`, PLIST], { stdio: "ignore" });
@@ -204,12 +209,13 @@ switch (sub) {
   add <project> [dir]       declare a seat (dir defaults to cwd; --agent=claude|codex|opencode)
   remove <project>          undeclare a seat
   adopt [workspace] --yes   declare every pinned project that has a directory there
-  up [project…]             open a window for each missing seat, in its own directory
+  up [project…]             restore each missing seat as a herdr pane, in its own directory
                             (--dry-run to see the commands, --force past the 6-seat cap)
   login install [delay]     reopen missing seats automatically after a reboot (--now to start it immediately)
   login uninstall|status
 
 Seats live in ~/.agent-bus/config.json alongside the hub pins. A seat is "live" when a real agent
-process is standing in its directory — not when something on the hub claims that name.`);
+process (or its herdr pane) is standing in its directory — not when something on the hub claims
+that name. A seat whose holder cannot be proven absent is UNKNOWN: recovery never launches into it.`);
     process.exit(readSeats() ? 0 : 0);
 }

package/bin/turn-watchdog.mjs

@@ -2,13 +2,14 @@
 // Turn watchdog (#5684, #6206, #7752, #7761): runTurn is spawnSync, so this DETACHED helper watches
 // the turn — liveness = transcript, worktree or stderr moving; a whole silent window earns ONE stall
 // report, and in kill mode (stall file given) also ends the turn via the shell box. Stamp-bound to one runner.
-//   node bin/turn-watchdog.mjs <stampFile> <errFile> <windowMs> <session> <project> <hubUrl> <transcriptDir> <workDir> [stallFile]
+//   node bin/turn-watchdog.mjs <stampFile> <errFile> <windowMs> <session> <project> <hubUrl> <transcriptDir> <workDir> [stallFile] [turnStateFile]
 import { readFileSync, writeFileSync, appendFileSync, statSync, readdirSync } from "node:fs";
 import { join } from "node:path";
 import { hostId } from "../lib/project.mjs";
 import { signedPost } from "../hooks/lib/api.mjs";
+import { refreshTurnLiveness } from "../lib/turnstate.mjs";
 
-const [stampFile, errFile, windowMsRaw, session, project, hub, transcriptDir = "", workDir = "", stallFile = ""] = process.argv.slice(2);
+const [stampFile, errFile, windowMsRaw, session, project, hub, transcriptDir = "", workDir = "", stallFile = "", turnStateFile = ""] = process.argv.slice(2);
 // SAFETY: the 10-minute floor lives in crew-runner.mjs (the default when TRANTOR_TURN_WATCHDOG_MS
 // is unset); this fallback only covers a missing argument. Drills pass tiny windows on purpose.
 const windowMs = Number(windowMsRaw) || 10 * 60 * 1000;
@@ -61,6 +62,21 @@ let baseErr = errSize();
 const armedAt = armed.startedAt || Date.now();
 const SLACK = 2000;   // timestamp granularity + scheduler drift under load
 
+// #7749: mid-turn liveness lands in the seat's turn-state file — any new stderr byte moves
+// lastBytesAt, a newer transcript file moves lastTranscriptAt. The refresh never writes phase
+// (the runner owns transitions) and refuses a file whose turn or phase has moved on.
+let prevSize = baseErr;
+let prevTr = 0;
+function reportLiveness(now, tr) {
+  if (!turnStateFile) return;
+  const size = errSize();
+  const grew = size > prevSize;
+  prevSize = size;
+  const trGrew = tr > prevTr;
+  if (trGrew) prevTr = tr;
+  if (grew || trGrew) refreshTurnLiveness(turnStateFile, { turn: armed.turn, bytesAt: grew ? now : 0, transcriptAt: trGrew ? tr : 0 });
+}
+
 // #7752 kill mode: poll liveness; a whole window silent on EVERY channel writes the stall marker
 // (the shell box sweeps on it), reports once, exits; stderr is measured ROLLING (bytes this window).
 // #7761: `armed.box` (step, ceiling, assigners) exists only when a ceiling above the box does; a
@@ -95,6 +111,7 @@ if (stallFile) {
     const freshCut = Math.max(armedAt, now - windowMs - SLACK);
     const tr = transcriptDir ? newestMtime(transcriptDir) : 0;
     const wk = workDir ? newestMtime(workDir) : 0;
+    reportLiveness(now, tr);
     if (tr > freshCut || wk > freshCut || now - lastErrAt < windowMs) {           // producing work: alive
       if (box && extensions < Number(box.extensionsMax) && now + poll + SLACK >= deadline) {
         extensions++;
@@ -129,6 +146,7 @@ for (;;) {
   const freshCut = Math.max(armedAt, Date.now() - windowMs - SLACK);
   const tr = transcriptDir ? newestMtime(transcriptDir) : 0;
   const wk = workDir ? newestMtime(workDir) : 0;
+  reportLiveness(Date.now(), tr);
   if (errSize() > baseErr + 200 || tr > freshCut || wk > freshCut) continue;   // producing work: alive, re-arm
   const mins = Math.round((Date.now() - armedAt) / 60000);
   const orch = `${hostId()}:${project}`;

package/hooks/lib/handoff.mjs

@@ -888,6 +888,14 @@ export function pathsReadIn(transcriptPath, paths) {
   return { read, missed: want.filter(p => !read.includes(p)) };
 }
 
+/** Markdown on stdin, or a bare `trantor handoff`? A heredoc is a TEMP FILE, not a FIFO, and an
+ *  isFIFO()-only check discarded the model's handoff while printing "handoff armed" (#8459).
+ *  Character devices stay out: that is the TTY and the /dev/null a hook runs with.
+ */
+export function stdinCarriesMarkdown(fd = 0) {
+  try { const st = fstatSync(fd); return st.isFIFO() || st.isFile(); } catch { return false; }
+}
+
 // The self-announcing fresh session command (single-quoted so it survives osascript→shell un-escaped).
 // Brevity is the point, but #8162 found it had become permission not to READ: the summary is injected
 // at SessionStart, so a 3-sentence recap is producible without opening a file. The order is now

package/hub/routes/admin.mjs

@@ -26,6 +26,9 @@ export async function routeAdmin({ req, res, q, P, auth, ctx }) {
       // #6148: WHAT a session is rides its peer row (kind "genesis" = the CLI's brief-poster,
       // "agent" = a crew seat) — /peers hands it to the app so the seat strip can tell them apart.
       if (pr) { if (b.model) pr.model = String(b.model).slice(0, 80); if (b.llm) pr.llm = String(b.llm).slice(0, 40); if (b.kind) pr.kind = String(b.kind).slice(0, 40); }
+      // #7749: the runner's live turn phase (working/idle/cut/stalled/parked) + its start ride the
+      // presence row, so /peers answers "what is the seat doing now" without inferring it from durations.
+      if (pr && b.phase) { pr.phase = String(b.phase).slice(0, 20); pr.phaseSince = Number(b.phaseSince) || now(); }
       return json(res, 200, { ok: true, session: b.session, peers: Object.keys(state.peers) });
     }
     if (req.method === "POST" && P === "/status") { const b = await body(req); touch(b.session, b.status ?? "", b.project, b.hookVersion, auth); return json(res, 200, { ok: true }); }
@@ -316,7 +319,7 @@ export async function routeAdmin({ req, res, q, P, auth, ctx }) {
       prunePeers();
       const cutoff = now() - ONLINE_MS;
       const peerRows = filterDiscoverable(auth, Object.entries(state.peers), ([, v]) => v.project || "");
-      return json(res, 200, { hubVersion: HUB_VERSION, authMode: AUTH_MODE, peers: peerRows.map(([s, v]) => ({ session: s, lastSeen: v.lastSeen, online: v.lastSeen > cutoff, status: v.status || "", health: healthOf(v.status), project: v.project || "",
+      return json(res, 200, { hubVersion: HUB_VERSION, authMode: AUTH_MODE, peers: peerRows.map(([s, v]) => ({ session: s, lastSeen: v.lastSeen, online: v.lastSeen > cutoff, status: v.status || "", health: healthOf(v.status), project: v.project || "", phase: v.phase || "", phaseSince: v.phaseSince || 0,
         pubkey: v.pubkey || "", identity: v.identity || null, authWarning: v.authWarning || "",
         kind: v.kind || v.identity?.kind || "", llm: v.llm || "", model: v.model || "", hookVersion: v.hookVersion || "", staleHooks: !!(v.lastSeen > cutoff && v.hookVersion && HUB_VERSION && cmpSemver(v.hookVersion, HUB_VERSION) < 0) })) });
     }

package/lib/seat-why.mjs

@@ -5,6 +5,7 @@ import { join } from "node:path";
 import { homedir } from "node:os";
 import { execSync } from "node:child_process";
 import { asNumber, asRecord } from "./decode.mjs";
+import { readTurnState } from "./turnstate.mjs";
 
 const busDir = () => process.env.AGENT_BUS_DIR || join(homedir(), ".agent-bus");
 
@@ -73,6 +74,29 @@ const rel = (ts) => {
   if (s < 3600) return `${Math.round(s / 60)}m ago`;
   return `${Math.round(s / 3600)}h ago`;
 };
+// A duration ("working for 4m"), the counterpart to rel's "4m ago".
+const dur = (ms) => {
+  const s = Math.max(0, Math.round(ms / 1000));
+  if (s < 60) return `${s}s`;
+  if (s < 3600) return `${Math.floor(s / 60)}m`;
+  return `${Math.floor(s / 3600)}h${Math.floor((s % 3600) / 60)}m`;
+};
+
+// #7749: when the turn-state file exists the advice IS the phase — "watch it or swap" is what you
+// say when a turn cannot be seen; now it can. Returns null without a phase so the caller falls
+// back to the last-ledger-row reading.
+function phaseAdvice(t) {
+  if (!t?.phase || !t.since) return null;
+  const on = t.card ? ` on #${t.card}` : "";
+  switch (t.phase) {
+    case "working": return `working for ${dur(Date.now() - t.since)}${on} — the turn is live; nothing to do.`;
+    case "idle": return `idle since ${fmt(t.since)} — waiting for the next message; nothing to do.`;
+    case "cut": return `cut at the time box at ${fmt(t.since)}${on} — the runner continues in a follow-up turn; swap only if the cuts repeat.`;
+    case "stalled": return `stalled since ${fmt(t.since)}${on} — the watchdog cut a silent turn; watch the pane if the next turn stalls too.`;
+    case "parked": return `parked since ${fmt(t.since)} — it holds its queue until the reset time or \`trantor up\`; the park reason is on the bus.`;
+    default: return null;
+  }
+}
 
 // What this seat has SPENT today (#6134). The turn count is the number that mattered on 09-02:
 // 151 turns and ~16 agentic hours across the fleet, most of it redelivery and coordination noise.
@@ -104,6 +128,8 @@ export function seatWhy(project, agent, opts = {}) {
   const dir = opts.dir || busDir();
   const errText = readF(join(dir, `err-${agent}-${project}.txt`));
   const telemetry = readTelemetry(join(dir, "logs", `${agent}-${project}.jsonl`));
+  // #7749: the runner's LIVE turn state — written at every transition, refreshed mid-turn.
+  const turnState = readTurnState(agent, project, dir);
   const pane = findPane(dir, project, agent);
   const pids = opts.pidCheck ? opts.pidCheck(project, agent) : scanPids(project, agent);
   const last = [...telemetry].reverse().find(r => asNumber(r.turn) !== null) || null;
@@ -132,16 +158,24 @@ export function seatWhy(project, agent, opts = {}) {
       why = `crew-runner pid ${pidList} alive for ${agent}:${project}, but crew-windows.txt has no pane row — the seat is headless.`;
       advice = "give the seat a window it can be read in: `trantor up <agent>` (or attach via herdr/cmux).";
     } else {
-      const health = last
-        ? (last.effExit || last.exit)
-          ? `last turn ${rel(last.ts)} (${last.trigger}) FAILED (exit ${last.effExit ?? last.exit}${last.authFailed ? ", auth" : ""})`
-          : `last turn ${rel(last.ts)} (${last.trigger}) clean (exit 0)`
-        : `no completed turn yet (${boots} boot record${boots === 1 ? "" : "s"})`;
+      // #7749: the live phase beats the ledger row — a seat mid-turn reads "working for 4m" with
+      // its last-output age, not "last turn ended N minutes ago" (which a dead seat also says).
+      const health = turnState?.phase
+        ? `turn ${turnState.turn} ${turnState.phase} for ${dur(Date.now() - turnState.since)}${turnState.card ? ` (card #${turnState.card})` : ""}${turnState.phase === "working" && turnState.lastBytesAt ? `, last output ${rel(turnState.lastBytesAt)}` : ""}`
+        : last
+          ? (last.effExit || last.exit)
+            ? `last turn ${rel(last.ts)} (${last.trigger}) FAILED (exit ${last.effExit ?? last.exit}${last.authFailed ? ", auth" : ""})`
+            : `last turn ${rel(last.ts)} (${last.trigger}) clean (exit 0)`
+          : `no completed turn yet (${boots} boot record${boots === 1 ? "" : "s"})`;
       state = "live";
       why = `crew-runner pid ${pidList} alive, pane ${pane.source}/${pane.pane}; ${health}.`;
-      advice = last && (last.effExit || last.exit)
-        ? `seat is up but its last turn failed${last.authFailed ? " — auth: check the provider key" : ""}. Watch it or swap.`
-        : "seat is healthy — nothing to do.";
+      // #7749: a live phase replaces the generic advice — a seat mid-turn is not "watch it or
+      // swap", it is "working for 4m on #7749". The ledger fallback covers a seat whose runner
+      // predates the turn-state file.
+      advice = phaseAdvice(turnState)
+        || (last && (last.effExit || last.exit)
+          ? `seat is up but its last turn failed${last.authFailed ? " — auth: check the provider key" : ""}. Watch it or swap.`
+          : "seat is healthy — nothing to do.");
     }
   } else {
     const bits = [];
@@ -169,7 +203,7 @@ export function seatWhy(project, agent, opts = {}) {
     }
   }
 
-  return { state, why, advice, today: todaySpend(telemetry, opts.now) };
+  return { state, why, advice, today: todaySpend(telemetry, opts.now), turnState: turnState || null };
 }
 
-export { fmt, rel };
+export { fmt, rel, dur };

package/lib/seats.mjs

@@ -47,7 +47,8 @@ export function undeclareSeat(project) {
 
 // ── liveness ────────────────────────────────────────────────────────────────────
 // A seat is live when a real process is STANDING IN ITS DIRECTORY (ps + lsof, bounded, fail-soft),
-// never by the hub's presence list: a name is assertable, a cwd is not.
+// never by the hub's presence list. Two blind spots read as UNKNOWN, never missing (#8716): a
+// process whose cwd lsof could not read could be standing in any seat, and so could a dark herdr.
 export function liveAgentDirs(binaries = ["claude", "codex", "opencode"]) {
   const out = [];   // [{ pid, comm, cwd }]
   let rows = "";
@@ -62,21 +63,58 @@ export function liveAgentDirs(binaries = ["claude", "codex", "opencode"]) {
     if (pid === self) continue;
     const base = comm.split("/").pop();
     if (!binaries.includes(base)) continue;
-    let cwd = "";
+    let cwd = null;
     try {
       const fn = execFileSync("/usr/sbin/lsof", ["-a", "-p", pid, "-d", "cwd", "-Fn"],
         { encoding: "utf8", timeout: 4000, stdio: ["ignore", "pipe", "ignore"] });
       const hit = fn.split("\n").find(l => l.startsWith("n"));
       if (hit) cwd = hit.slice(1);
-    } catch { /* process died, or lsof is unavailable — treat as unknown, never as live */ }
-    if (cwd) out.push({ pid: Number(pid), comm: base, cwd });
+    } catch { /* the process died, or lsof starved: the cwd is UNKNOWN, never live, never absent */ }
+    out.push({ pid: Number(pid), comm: base, cwd });
   }
   return out;
 }
 
-// Status of every declared seat: live (with the pid holding it) or missing (with why).
-// `live` is injectable so a drill can pin the mapping without spawning processes named "claude".
-export function seatStatus(live = liveAgentDirs()) {
+// herdr restores its panes at boot, before any Terminal window could exist, so a herdr agent
+// standing in the seat's directory holds the seat exactly as a bare process would (#8716).
+// Installed but unreachable reads { installed: true, ok: false } — uncertainty, not absence; not
+// installed is SKIP: the probe holds nothing and blinds nothing.
+export function herdrAgents(exec = execFileSync) {
+  let bin = "";
+  try { bin = exec("/usr/bin/which", ["herdr"], { encoding: "utf8", timeout: 4000 }).trim(); } catch { return { installed: false, ok: true, agents: [] }; }
+  if (!bin) return { installed: false, ok: true, agents: [] };
+  try {
+    const parsed = JSON.parse(exec(bin, ["agent", "list"], { encoding: "utf8", timeout: 4000, stdio: ["ignore", "pipe", "ignore"] }));
+    const rows = asRecord(parsed?.result)?.agents;
+    if (!Array.isArray(rows)) return { installed: true, ok: false, agents: [] };
+    const agents = rows.map(a => ({
+      agent: asString(asRecord(a)?.agent) ?? "",
+      cwd: asString(asRecord(a)?.cwd) ?? "",
+      pane: asString(asRecord(a)?.pane_id) ?? "",
+      status: asString(asRecord(a)?.agent_status) ?? "",
+    })).filter(a => a.agent && a.cwd);
+    return { installed: true, ok: true, agents };
+  } catch { return { installed: true, ok: false, agents: [] }; }
+}
+
+// The login job races herdr's restore: panes land over the first seconds after boot, and a seat
+// judged missing before its pane returns is launched twice. Bounded: herdr that never answers
+// inside the window reads { installed: true, ok: false }, and the caller launches nothing (#8716).
+export async function waitForHerdr({ timeoutMs = 120000, everyMs = 5000, probe = herdrAgents } = {}) {
+  const deadline = Date.now() + timeoutMs;
+  let h = probe();
+  while (h.installed && !h.ok && Date.now() < deadline) {
+    await new Promise(r => setTimeout(r, everyMs));
+    h = probe();
+  }
+  return h;
+}
+
+// Status of every declared seat: live (held by a process or a herdr pane standing in its
+// directory), unknown (a blind spot could be hiding the holder — launched over by nothing), or
+// missing (with why). `live` and `herdr` are injectable so a drill pins the mapping without
+// spawning processes named "claude" or a real herdr.
+export function seatStatus(live = liveAgentDirs(), herdr = herdrAgents()) {
   const seats = readSeats();
   return Object.entries(seats).map(([project, { dir, agent }]) => {
     // The seat is held only by the agent it was DECLARED for. A crew seat (opencode, codex) working
@@ -87,34 +125,67 @@ export function seatStatus(live = liveAgentDirs()) {
     const holder = inDir.find(p => p.comm === agent);
     const others = inDir.filter(p => p.comm !== agent);
     const exists = existsSync(dir);
+    let pane = null;
+    if (herdr.ok) {
+      for (const a of herdr.agents) {
+        if (a.cwd !== dir) continue;
+        if (a.agent === agent) { if (!holder) pane = a.pane || "herdr pane"; }
+        else others.push({ pid: null, comm: a.agent, cwd: dir, pane: a.pane });
+      }
+    }
+    // UNKNOWN (#8716): an agent process whose cwd lsof could not read could be standing in this
+    // directory, and a herdr that is installed but would not answer could be holding this seat.
+    // Either way the holder is unprovable in both directions — the seat is not live, and it is
+    // never missing, because launching into an occupied seat is the harm this file prevents.
+    const unreadable = live.filter(p => p.cwd === null && p.comm === agent);
+    const herdrDark = herdr.installed && !herdr.ok;
+    const unknown = exists && !holder && !pane && (unreadable.length > 0 || herdrDark);
+    const why = holder || pane ? ""
+      : !exists ? "directory does not exist"
+      : unknown ? (unreadable.length
+        ? `lsof could not read the cwd of ${unreadable.map(p => `${agent} ${p.pid}`).join(", ")} — it could be this seat`
+        : "herdr is installed but would not answer — a restored pane could be standing here")
+      : others.length ? `no ${agent} here (${others.map(o => o.pane ? `${o.comm} pane ${o.pane}` : `${o.comm} ${o.pid}`).join(", ")} is, but that is not this seat)`
+      : `no ${agent} process in this directory`;
     return {
       project, dir, exists, agent,
-      live: !!holder,
+      live: !!holder || !!pane,
+      state: holder || pane ? "live" : unknown ? "unknown" : "missing",
       pid: holder?.pid || null,
+      pane,
       others,
       hub: resolveHubInfo(project).url,
       via: resolveHubInfo(project).via,
-      why: holder ? ""
-        : !exists ? "directory does not exist"
-        : others.length ? `no ${agent} here (${others.map(o => `${o.comm} ${o.pid}`).join(", ")} is, but that is not this seat)`
-        : `no ${agent} process in this directory`,
+      why,
     };
   }).sort((a, b) => a.project.localeCompare(b.project));
 }
 
-// Seats that are declared, whose directory exists, and that nothing is standing in.
-export function missingSeats(live) { return seatStatus(live).filter(s => !s.live && s.exists); }
+// Seats a recovery may LAUNCH: declared, directory present, and provably held by nothing. An
+// unknown seat is never here (#8716) — the one failure this file exists to prevent is opening a
+// second window into a seat that is already held.
+export function missingSeats(live, herdr) {
+  return seatStatus(live, herdr).filter(s => s.state === "missing" && s.exists);
+}
 
 // ── recovery ────────────────────────────────────────────────────────────────────
-// Open a NEW terminal window in the seat's directory running the agent. macOS-only by design (the
-// same osascript bin/open-session.sh has always used); elsewhere we print the command instead of
-// pretending. Returns { launched, command }.
-export function launchSeat(seat, { command, dryRun = false } = {}) {
-  const cmd = `cd ${JSON.stringify(seat.dir)} && ${command || seat.agent || "claude"}`;
-  if (dryRun || process.platform !== "darwin") return { launched: false, command: cmd };
-  const osa = `tell application "Terminal"\n  do script ${JSON.stringify(cmd)}\nend tell\n`;
+// Restore a missing seat as a herdr pane: `trantor open <project>` run in the seat's own
+// directory — never a Terminal.app window, whose twin once ran for hours beside the seat it
+// duplicated (#8716). Herdr absent: return the command for the caller to print, spawn nothing.
+const SESSION_IDENTITY_ENV = ["TRANTOR_ORCH", "HERDR_PANE_ID", "HERDR_TAB_ID", "HERDR_WORKSPACE_ID", "CLAUDE_CODE_CHILD_SESSION", "CLAUDECODE"];
+export function launchSeat(seat, { dryRun = false, spawnFn = spawn, env = process.env, which = execFileSync } = {}) {
+  let trantor = "trantor";
+  try { trantor = which("/usr/bin/which", ["trantor"], { encoding: "utf8", timeout: 4000 }).trim() || "trantor"; } catch {}
+  const cmd = `cd ${JSON.stringify(seat.dir)} && ${trantor} open ${seat.project}`;
+  let herdr = false;
+  try { herdr = !!which("/usr/bin/which", ["herdr"], { encoding: "utf8", timeout: 4000 }).trim(); } catch {}
+  if (dryRun || !herdr) return { launched: false, command: cmd };
+  // The recovery job may itself run inside a pane or a Claude session; its identity env must not
+  // leak into the restored one (#7414), and trantor open's own badge check would refuse it anyway.
+  const clean = { ...env };
+  for (const k of SESSION_IDENTITY_ENV) delete clean[k];
   try {
-    const kid = spawn("/usr/bin/osascript", ["-e", osa], { detached: true, stdio: "ignore" });
+    const kid = spawnFn(trantor, ["open", seat.project], { cwd: seat.dir, env: clean, detached: true, stdio: "ignore" });
     kid.unref();
     return { launched: true, command: cmd };
   } catch (e) {

package/lib/turn-usage.mjs

@@ -0,0 +1,116 @@
+// #8234: seat turn rows carried tokens 0 for every CLI that prints no usage line (the opencode
+// family, dsh) — a ledger that records that a turn happened, never what it cost. The counts live
+// in each provider's OWN session record; read them there, never from stdout.
+// Usage shape: { input, output, cacheRead, cacheWrite } — null means "could not read", never 0.
+import { spawnSync } from "node:child_process";
+import { readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
+
+export function usageTotal(u) {
+  if (!u) return 0;
+  return (u.input || 0) + (u.output || 0) + (u.cacheRead || 0) + (u.cacheWrite || 0);
+}
+
+// Absent = the provider did not report this field (0); present but not a non-negative integer =
+// a corrupt read, which poisons the whole sum to null.
+const field = (v) => {
+  if (v === "" || v === null || v === undefined) return 0;
+  const n = Number(v);
+  return Number.isInteger(n) && n >= 0 ? n : null;
+};
+const blank = () => ({ input: 0, output: 0, cacheRead: 0, cacheWrite: 0 });
+
+// ---- opencode: per-message usage in opencode.db, message.data JSON on assistant rows ----------
+// The reader emits one `input|output|cacheRead|cacheWrite` row per in-window assistant message;
+// this parser sums them. No rows at all = unknown, not zero.
+export function sumOcRows(text) {
+  const rows = String(text || "").split("\n").filter((l) => l.trim() !== "");
+  if (!rows.length) return null;
+  const sum = blank();
+  for (const line of rows) {
+    const cols = line.split("|");
+    if (cols.length !== 4) return null;
+    const vals = cols.map(field);
+    if (vals.some((v) => v === null)) return null;
+    sum.input += vals[0]; sum.output += vals[1]; sum.cacheRead += vals[2]; sum.cacheWrite += vals[3];
+  }
+  return sum;
+}
+
+// The one sqlite read, ocSid's mechanics exactly: sqlite3 CLI, -readonly, fail-open. Window is
+// the turn (a resumed session's older messages carry older time_created values and drop out).
+export function ocTurnUsage(dbPath, sessionId, sinceMs, untilMs, run = spawnSync) {
+  if (!dbPath || !/^ses_[A-Za-z0-9]+$/.test(String(sessionId || ""))) return null;
+  if (![sinceMs, untilMs].every(Number.isFinite) || untilMs < sinceMs) return null;
+  const q = `SELECT json_extract(data,'$.tokens.input'), json_extract(data,'$.tokens.output'),`
+    + ` json_extract(data,'$.tokens.cache.read'), json_extract(data,'$.tokens.cache.write')`
+    + ` FROM message WHERE session_id='${String(sessionId).replaceAll("'", "''")}'`
+    + ` AND json_extract(data,'$.role')='assistant'`
+    + ` AND time_created>=${Math.floor(sinceMs)} AND time_created<=${Math.ceil(untilMs)};`;
+  let r;
+  try { r = run("sqlite3", ["-readonly", dbPath, q], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5000 }); }
+  catch { return null; }
+  if (!r || r.error || r.status !== 0) return null;
+  return sumOcRows(r.stdout);
+}
+
+// ---- dsh: usage rides assistant/message events in session.jsonl.zstd ---------------------------
+const USAGE_KEYS = ["inputTokens", "outputTokens", "cacheReadTokens", "cacheWriteTokens"];
+// dsh logs every step's usage TWICE (assistant/chunk and assistant/message carry the same
+// numbers), so only the assistant/message copy counts — the chunk copy would bill double. The
+// session's own turn counter is unrelated to the runner's, so the time window is the only filter.
+export function dshUsageFromEvent(ev) {
+  const u = ev && ev.type === "assistant/message" && ev.data ? ev.data.usage : null;
+  // A usage RECORD carries at least one of the four counts; anything else (null, an array, a
+  // bare number from a mangled log) is not one and drops out.
+  if (!u || !USAGE_KEYS.some((k) => Object.prototype.hasOwnProperty.call(u, k))) return null;
+  const g = (k) => { const n = Number(u[k]); return Number.isFinite(n) && n >= 0 ? n : 0; };
+  return { input: g("inputTokens"), output: g("outputTokens"), cacheRead: g("cacheReadTokens"), cacheWrite: g("cacheWriteTokens") };
+}
+
+export function sumDshLog(text, sinceMs, untilMs) {
+  let sum = null;
+  for (const line of String(text || "").split("\n")) {
+    const s = line.trim();
+    if (!s) continue;
+    let ev; try { ev = JSON.parse(s); } catch { continue; }
+    const t = Number(ev.time);
+    if (!Number.isFinite(t) || t < sinceMs || t > untilMs) continue;
+    const u = dshUsageFromEvent(ev);
+    if (!u) continue;
+    if (!sum) sum = blank();
+    sum.input += u.input; sum.output += u.output; sum.cacheRead += u.cacheRead; sum.cacheWrite += u.cacheWrite;
+  }
+  return sum;
+}
+
+// dsh names a session dir after the cwd it ran in, "/" spelled "-" and a trailing "/" added
+// before the wrap: /a/b/dsh -> --a-b-dsh-- (observed on live ~/.dsh/sessions dirs).
+export const dshSessionDirName = (cwd) => `-${String(cwd + "/").replaceAll("/", "-")}-`;
+
+// Whether dsh resumed or started fresh is its own business, so scan every session log for this
+// cwd and keep only in-window events. A log last written before the window opened can hold none.
+export function dshTurnUsage(sessionsRoot, cwd, sinceMs, untilMs, run = spawnSync) {
+  if (!sessionsRoot || !cwd || ![sinceMs, untilMs].every(Number.isFinite) || untilMs < sinceMs) return null;
+  const dir = join(sessionsRoot, dshSessionDirName(cwd));
+  let names;
+  try { names = readdirSync(dir); } catch { return null; }
+  const sum = blank();
+  let found = false;
+  for (const name of names) {
+    if (!name.startsWith("session-")) continue;
+    const f = join(dir, name, "session.jsonl.zstd");
+    let mtime;
+    try { mtime = statSync(f).mtimeMs; } catch { continue; }
+    if (mtime < sinceMs) continue;
+    let r;
+    try { r = run("zstd", ["-dc", f], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 15000, maxBuffer: 64 * 1024 * 1024 }); }
+    catch { continue; }
+    if (!r || r.status !== 0) continue;
+    const s = sumDshLog(r.stdout, sinceMs, untilMs);
+    if (!s) continue;
+    found = true;
+    sum.input += s.input; sum.output += s.output; sum.cacheRead += s.cacheRead; sum.cacheWrite += s.cacheWrite;
+  }
+  return found ? sum : null;
+}

package/lib/turnstate.mjs

@@ -0,0 +1,49 @@
+// #7749: a seat's LIVE turn state, one JSON file per seat — turnstate-<agent>-<project>.json in
+// the bus dir. The runner writes it at every phase transition, its watchdog refreshes liveness
+// mid-turn, so seat-why and the hub presence row read a fact, not an inference from ledger rows.
+// Shape: { turn, phase: idle|working|cut|stalled|parked, since, card, lastBytesAt, lastTranscriptAt }.
+import { readFileSync, writeFileSync, renameSync, mkdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { homedir } from "node:os";
+
+const busDir = () => process.env.AGENT_BUS_DIR || join(homedir(), ".agent-bus");
+export const turnStatePath = (agent, project, dir = busDir()) => join(dir, `turnstate-${agent}-${project}.json`);
+
+export function readTurnStateFile(path) {
+  try {
+    const j = JSON.parse(readFileSync(path, "utf8"));
+    return j && j.constructor === Object ? j : null;
+  } catch { return null; }
+}
+export function readTurnState(agent, project, dir = busDir()) {
+  return readTurnStateFile(turnStatePath(agent, project, dir));
+}
+
+// tmp + rename: a reader mid-write sees the last whole file, never a torn one.
+export function writeTurnStateFile(path, state) {
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = `${path}.tmp-${process.pid}`;
+    writeFileSync(tmp, JSON.stringify(state));
+    renameSync(tmp, path);
+    return true;
+  } catch { return false; }
+}
+
+// Merge onto the last write: the runner's transition sets phase/since, everything else rides along.
+export function writeTurnState(agent, project, patch, dir = busDir()) {
+  const path = turnStatePath(agent, project, dir);
+  return writeTurnStateFile(path, { ...(readTurnStateFile(path) || {}), ...patch });
+}
+
+// The watchdog's mid-turn refresh. It NEVER writes phase: transitions belong to the runner, and
+// a poll landing after the turn ended must not resurrect "working" over the runner's idle —
+// the turn-number + phase guard is what keeps a slow poll from lying.
+export function refreshTurnLiveness(path, { turn, bytesAt = 0, transcriptAt = 0 }) {
+  const cur = readTurnStateFile(path);
+  if (!cur || cur.turn !== turn || cur.phase !== "working") return false;
+  const patch = {};
+  if (bytesAt) patch.lastBytesAt = bytesAt;
+  if (transcriptAt) patch.lastTranscriptAt = transcriptAt;
+  return Object.keys(patch).length ? writeTurnStateFile(path, { ...cur, ...patch }) : false;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.69",
+  "version": "0.18.71",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"