trantor 0.18.71 → 0.18.73

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.71",
+  "version": "0.18.73",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/crew-runner.mjs

@@ -16,6 +16,7 @@ import { applyWorktreeDeclaration, ensureSeatWorktree, provisioningLines, readWo
 import {
   AUTH_MARKER_RE, classifyFailure, looksLikeAuthDeath,
   verdictFor, substantiveOutput, stallVerdict, cutSignalFor,
+  BILLING_RE, looksLikeBillingDeath, usageSaysNoWork, zeroUsageVerdict,
   readPromptText, stripPromptEcho,
 } from "../lib/classify-failure.mjs";
 import { capWake, capBcast, pickLessons, composePrompt, contractBase, baseLine } from "./crew-payload.mjs";
@@ -928,6 +929,14 @@ exit $turn_exit`;
     authHit = AUTH_MARKER_RE.exec(ownOut)[0];
     log(`\x1b[31mexit 0 but the turn output IS an auth failure — treating as FAILED (auth, "${authHit}")\x1b[0m`);
   }
+  // #9724: the same trap in the quota family — opencode printed the OpenRouter credit error and
+  // exited 0, and exit 0 + output read as success over a turn where nothing ran. A billing
+  // rejection on a clean exit lifts effExit like the auth death does; classifyFailure names it
+  // exhausted and the existing ladder parks the seat (exhausted is in PARKING_REASONS).
+  if (realExit === 0 && effExit === 0 && looksLikeBillingDeath(ownOut, newCommit)) {
+    effExit = 1;
+    log(`\x1b[31mexit 0 but the turn output IS a provider billing rejection — treating as FAILED (exhausted, "${BILLING_RE.exec(ownOut)[0]}")\x1b[0m`);
+  }
   // #5481: exit 0 with an empty ERRF (the TOTAL capture, both streams) is the null-completion trap,
   // judged on echo-stripped text (#5868). #6969: on a state step ERRF is stderr only, so silence is normal.
   if (realExit === 0 && effExit === 0 && !lastErrText.trim() && !lastEnvelope.trim()) {
@@ -944,11 +953,6 @@ exit $turn_exit`;
   lastEmptyTurn = !cut && realExit === 0 && effExit === 0 && !authHit && !opts.state
     && !worktreeChanged && !busActive && !substantiveOutput(ownOut);
   if (lastEmptyTurn) log("\x1b[33mexit 0 but the turn was EMPTY — no worktree change, no substantive output, no bus activity\x1b[0m");
-  // #5868: the verdict rides the telemetry row so a classification survives the pane scrolling
-  // away — the same "classified X because Y" shape the runner logs, in the seat's jsonl forever.
-  // A silent cut names its own verdict (#7752): the exit under it is the sweep's SIGPIPE, never
-  // a provider failure. A box cut passes `cut` so its 137 reads as the sweep's SIGKILL (#7099).
-  const verdict = stallCut ? stallVerdict() : verdictFor(realExit, effExit, lastEmptyOutput, ownOut, lastEmptyTurn, cut);
   // #6134: what the turn COST, from the CLI's own usage line. Zero means this CLI printed none —
   // never that the turn was free. `trantor seat-why` totals these into today's spend per seat.
   let tokens = parseTurnTokens(ownOut);
@@ -965,6 +969,18 @@ exit $turn_exit`;
     : AGENT === "dsh" ? dshTurnUsage(join(homedir(), ".dsh", "sessions"), TURN_DIR, t0, Date.now())
     : null;
   if (usage) tokens = usageTotal(usage);
+  // #9724: usage RESOLVED to all zeros means no model work happened — never success; null stays
+  // unknown, never failure, and a shipped commit is real work (stale record, not the turn).
+  const zeroUsage = realExit === 0 && effExit === 0 && !newCommit && usageSaysNoWork(usage);
+  if (zeroUsage) {
+    effExit = 1;
+    log("\x1b[31mexit 0 but the session usage record resolved to all zeros — no model work happened; treating as FAILED\x1b[0m");
+  }
+  // #5868: the verdict rides the telemetry row so a classification survives the pane scrolling
+  // away — the same "classified X because Y" shape the runner logs. A silent cut names its own
+  // verdict (#7752): the exit under it is the sweep's SIGPIPE. A box cut passes `cut` so its 137
+  // reads as the sweep's SIGKILL (#7099); a zero-usage turn names its own verdict too (#9724).
+  const verdict = stallCut ? stallVerdict() : zeroUsage ? zeroUsageVerdict() : verdictFor(realExit, effExit, lastEmptyOutput, ownOut, lastEmptyTurn, cut);
   // #6289: every ledger row names in ONE field what happened to the turn — cut, stalled (#7752),
   // api-error, completed — and what it cost (0 means "not reported", never "free"). #7762: `card`
   // binds the row to the card the turn worked (0 = kickoff/pulse) so the seat record attributes

package/hooks/heartbeat.mjs

@@ -153,12 +153,18 @@ async function main(stdinRaw) {
   // Write the stamp BEFORE the network call so rapid concurrent tool calls don't all fire.
   try { writeFileSync(stamp, String(Date.now())); } catch {}
 
-  // POST /register with no status -> hub refreshes lastSeen + project, preserves status.
-  // llm from the seat brand when a dialect bridge runs us (RELAY_AGENT=kimi-orch etc.), else claude.
-  await signedPost("/register", { session, project,
+  // POST /register with no status -> hub refreshes lastSeen + project, preserves status; llm from
+  // the seat brand when a dialect bridge runs us (RELAY_AGENT=kimi-orch etc.), else claude.
+  // #8723 bounce-3: the beat carries the kind too — "orch" for the orchestrator pane (the same
+  // strict test sessionstart.mjs uses), "agent" when the runner's TRANTOR_SEAT says crew seat.
+  const beatKind = process.env.TRANTOR_ORCH && process.env.TRANTOR_ORCH === project ? "orch"
+    : process.env.TRANTOR_SEAT ? "agent" : "";
+  const beatBody = { session, project,
     llm: process.env.RELAY_LLM || (process.env.RELAY_AGENT ? process.env.RELAY_AGENT.replace(/-orch$/, "") : "claude"),
     model: modelFromTranscript(stdinRaw),
-    hookVersion: (() => { try { return installedVersion(); } catch { return ""; } })() }, { session, timeoutMs: Number(process.env.RELAY_HEARTBEAT_TIMEOUT_MS || 1500) });
+    hookVersion: (() => { try { return installedVersion(); } catch { return ""; } })() };
+  if (beatKind) beatBody.kind = beatKind;
+  await signedPost("/register", beatBody, { session, timeoutMs: Number(process.env.RELAY_HEARTBEAT_TIMEOUT_MS || 1500) });
 
   // Ambient narratives: once an hour (machine-wide stamp), spawn the summarizer detached — the
   // board's machine-titled cards gain a plain-language "assigned — did" line without anyone asking.

package/hooks/subagent-cost.mjs

@@ -109,8 +109,8 @@ try {
     phase: "sub-agents",
   }, { timeoutMs: 2500 });
   process.stderr.write(`[trantor] subagent-cost: ${agentType} ${model} ~$${usd == null ? "?" : usd.toFixed(4)} (${tokens.input + tokens.output + tokens.cacheWrite + tokens.cacheRead} tok) → ${project}\n`);
-  // surface it back to the parent's Claude inline
-  process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: "SubagentStop", additionalContext: `[trantor] logged sub-agent ${agentType} — notional $${usd == null ? "?" : usd.toFixed(4)}` } }));
+  // #9707: log only. CC 2.1.280 feeds SubagentStop additionalContext back to the sub-agent as input, which re-woke it in a loop.
+  process.stdout.write("{}");
 } catch (e) {
   process.stderr.write(`[trantor] subagent-cost error: ${e?.message || e}\n`);
   process.stdout.write("{}");

package/hub/overseer.mjs

@@ -12,11 +12,9 @@ const OVERSEER_TICK_MS = Number(process.env.RELAY_OVERSEER_TICK_MS || 30 * 1000)
 // timer: see overseerTick.
 const OVERSEER_CLEAR_MS = Number(process.env.RELAY_OVERSEER_CLEAR_MS || process.env.RELAY_OVERSEER_DEDUP_MS || 10 * 60 * 1000);
 // Standing conditions, keyed by collision identity -> { since, lastTick }. A collision is a STATE,
-// not an event: it persists. Emitting on a 10-minute timer turned the watcher into a metronome —
-// 500 events for 4 distinct conditions (2026-08-12 audit), each one also waking the duty seat for a
-// full turn. Now an episode fires ONCE when it starts and stays quiet while it holds; the entry is
-// forgotten only after the condition has been gone for OVERSEER_CLEAR_MS, so a genuine recurrence
-// warns again.
+// not an event: it persists (#5350 doctrine). It fires ONCE when it starts, stays quiet while it
+// holds (a metronome woke duty on 500 events for 4 conditions once), and the entry is forgotten
+// only after OVERSEER_CLEAR_MS of absence, so a genuine recurrence warns again.
 const overseerActive = new Map();
 // Heartbeat for the WATCHER itself: /overseer/status must distinguish "fleet is clear" from "the
 // overseer stopped ticking" — a monitor that cannot prove it is alive reads as clear when dead.
@@ -48,31 +46,29 @@ function overseerInputs() {
 }
 
 // --- #5760: the same-project warning is an EPISODE keyed by the MEMBER SET -------------------
-// The night of 08-31 the same-project DM re-fired hourly for a membership that never changed and
-// woke every seat into metered chatter turns. The rule (lib/same-project.mjs, pure) decides
-// fire-or-not from (previous set, current set, declared crew, last-fired-at): a declared crew is
-// the NORMAL state of a project and is not a collision at all; a set that never changed re-warns
-// never. The warn itself rides the SAME episode machinery as every other kind (#5350: one warn at
-// open, newcomer-only intros while standing, a genuine clear ends it) — the record below only
-// feeds the pure rule the set it judged last, so "unchanged" is one hash comparison and the
-// record line reports DURATION ("same-project for 6h"), never a count of warnings.
+// lib/same-project.mjs (pure) decides from (previous set, current set, declared crew,
+// last-fired-at): a declared crew is the NORMAL state of a project and not a collision at all,
+// an unchanged set never re-warns (#5350 machinery), and the record reports DURATION.
 const sameProjectFired = new Map(); // project -> { hash, sessions, ts } — the set as of the last verdict
 
-// The declared crew: HUB state, never a file on the operator's machine (#6075). The production
-// hub runs on netcup, where ~/.agent-bus/crew-windows.txt does not exist — the file describes the
-// OPERATOR'S machine (it is written by `trantor up` there), so on the remote hub the old reader
-// found nothing and every same-project set looked like intruders: the crew-only exemption simply
-// never held remotely. What the hub itself knows is the peer row's `kind` (#6148): "agent" is a
-// crew seat — crew-runner stamps it on every /register its seats make — and "orch" is the
-// project's orchestrator pane (sessionstart stamps it when TRANTOR_ORCH names this project).
-// The HOST_NAME exemption is gone with the file: the hub's hostname is the hub machine's
-// (netcup), never the operator's, so `<HOST_NAME>:<project>` exempted a session that cannot
-// exist. Genesis is deliberately NOT crew (#6068: a bookkeeping identity, not a seat).
+// #8723 bounce-4: peerKindOf is the ONE answer to "what is this peer" — the row's own kind,
+// nothing else — shared with /peers, so roster and overseer can never disagree. The enrolled
+// identity is NOT a fallback (every identity defaults kind "agent", which made every peer crew
+// and hid real intruders): the beats stamp orch/agent and pg COALESCE keeps the kind instead.
+function peerKindOf(p) {
+  return p && typeof p === "object" ? String(p.kind || "") : "";
+}
+
+// The declared crew is HUB state: the peer row's kind (#6148, #6075) — "agent" is a crew seat
+// (crew-runner stamps every /register its seats make), "orch" the project's orchestrator pane
+// (sessionstart stamps it when TRANTOR_ORCH names this project). A local crew-windows.txt reader
+// would describe the OPERATOR's machine, never this hub's. Genesis is deliberately NOT crew (#6068).
 function declaredCrewFor(project) {
   const crew = new Set();
   for (const [sid, p] of Object.entries(state.peers)) {
     if ((p.project || "") !== project) continue;
-    if (p.kind === "agent" || p.kind === "orch") crew.add(sid);
+    const k = peerKindOf(p);
+    if (k === "agent" || k === "orch") crew.add(sid);
   }
   return [...crew];
 }
@@ -85,12 +81,10 @@ function overseerTick() {
   overseerLastTick = t;
   const pol = overseerPolicy();
   const seen = new Set();
-  // Hand each party the others' session ids at the moment coordination is warranted. Telling two
-  // sessions to "coordinate over the bus" is useless if neither knows the other's id, and the
-  // warning alone went only to the duty seat and the log — so coordination needed a human to carry
-  // the ids across. Shared by the episode-start branch (all parties) and the standing branch
-  // (newcomers only, same-project included): existing members never
-  // re-hear it, so a standing condition must not re-wake every party every tick.
+  // The intro hands each party the others' session ids at the moment coordination is warranted —
+  // the warning alone went only to duty, and ids never cross the bus by themselves. Shared by the
+  // episode-start branch (all parties) and the standing branch (newcomers only, same-project
+  // included): existing members never re-hear it, so a standing condition cannot re-wake every tick.
   const intro = (c, me, others) => {
     const rest = others.filter(p => p !== me);
     if (rest.length === 0) return;
@@ -102,13 +96,10 @@ function overseerTick() {
   // project, not a collision — so not even the context feed narrates them.
   const kept = [];
   for (const c of collisions) {
-    // #5760: same-project gets the pure episode rule (lib/same-project.mjs) ON TOP of the shared
-    // episode machinery below: a crew-only set is not a collision at all (dropped — no warn, no
-    // context, no state); a standing set re-warns never (a liveness flap replays the SAME set —
-    // 08-31's metronome — and must stay silent, only genuine newcomers hear the intro once); and
-    // the record line reports DURATION. Without the rule module this branch is invisible and
-    // same-project rides the generic loop exactly as before — a missing rule must never
-    // re-instate the hourly metronome, so the fallback is the pre-#5760 behavior, never stricter.
+    // #5760: the pure episode rule rides ON TOP of the shared machinery — a crew-only set is not
+    // a collision at all (dropped, no context), a liveness flap replays the SAME set and stays
+    // silent, the record reports DURATION. Without the rule module the fallback is the pre-#5760
+    // generic loop: a missing rule must never re-instate the metronome, only loosen it.
     if (c.kind === "same-project-sessions" && _sameProject?.sameProjectDecision) {
       const prior = sameProjectFired.get(c.project) || null;
       const d = _sameProject.sameProjectDecision({
@@ -205,7 +196,7 @@ setInterval(overseerTick, OVERSEER_TICK_MS).unref?.();
 setTimeout(overseerTick, 2000).unref?.();
 
   return {
-    overseerTick, overseerPolicy, overseerInputs, declaredCrewFor,
+    overseerTick, overseerPolicy, overseerInputs, declaredCrewFor, peerKindOf,
     active: overseerActive,
     get engine() { return _overseer; },
     get sameProject() { return _sameProject; },

package/hub/reaper.mjs

@@ -1,6 +1,6 @@
 export function createReaper({
   state, now, canon, appendCardEvent, appendEvent, appendTaskLog, markDirty, sweepPresence,
-  ONLINE_MS, PEER_TTL_MS, FOCUS_OFFLINE_MS, FOCUS_IDLE_MS,
+  ONLINE_MS, PEER_TTL_MS, PEER_FORGET_MS, FOCUS_OFFLINE_MS, FOCUS_IDLE_MS,
   REAP_GRACE_MS, TODO_STALE_MS, REAP_INTERVAL_MS,
   CONTRACT_ABANDON_MS, CONTRACT_WINDOW_MS,
 }) {
@@ -49,11 +49,25 @@ function linkCommitToFocus(commitCard, by) {
 }
 function prunePeers() {
   const cutoff = now() - PEER_TTL_MS;
-  let removed = false;
+  const forgetCut = now() - PEER_FORGET_MS;
+  let changed = false;
   for (const [session, peer] of Object.entries(state.peers)) {
-    if ((peer.lastSeen || 0) < cutoff) { if (closeFocus(session)) removed = true; delete state.peers[session]; removed = true; }
+    const seen = peer.lastSeen || 0;
+    if (seen < forgetCut) {                       // #8723: the memory row itself is forgotten after RELAY_PEER_FORGET_MS
+      if (closeFocus(session)) changed = true;
+      delete state.peers[session];
+      changed = true;
+      continue;
+    }
+    if (seen >= cutoff) continue;
+    // #8723: a TTL-expired peer is a memory row, not a deleted one — deleting dropped `kind`
+    // (the overseer then warned about the crew's own returning seats) and `deliveredUpTo`
+    // (duty then escalated consumed mail as UNDELIVERED, "last seen never"). Presence readers
+    // already filter by lastSeen freshness, so only the offline edge is pinned here.
+    if (closeFocus(session)) changed = true;
+    if (peer._on === true) { peer._on = false; changed = true; }
   }
-  if (removed) markDirty();
+  if (changed) markDirty();
 }
 setInterval(prunePeers, 60000).unref?.();
 setInterval(sweepPresence, 60000).unref?.();

package/hub/routes/admin.mjs

@@ -10,11 +10,11 @@ const fileReads = new Map();
 export async function routeAdmin({ req, res, q, P, auth, ctx }) {
   const {
     state, body, json, crossProjectGuard, touch, canon, filterReadable,
-    appendEvent, EVENT_CAP, overseer, ONLINE_MS, pruneClaims, fileClaims,
+    appendEvent, EVENT_CAP, overseer, ONLINE_MS, PEER_TTL_MS, pruneClaims, fileClaims,
     scopeAllows, duty, markDirty, HUB_VERSION, cmpSemver, prunePeers,
     filterDiscoverable, healthOf, now, canRead, AUTH_MODE, CLAIM_TTL_MS, subFp,
   } = ctx;
-  const { overseerPolicy, overseerInputs, declaredCrewFor } = overseer;
+  const { overseerPolicy, overseerInputs, declaredCrewFor, peerKindOf } = overseer;
     if (req.method === "POST" && P === "/register") {
       const b = await body(req);
       const cpg = crossProjectGuard(auth, P, b);
@@ -29,7 +29,8 @@ export async function routeAdmin({ req, res, q, P, auth, ctx }) {
       // #7749: the runner's live turn phase (working/idle/cut/stalled/parked) + its start ride the
       // presence row, so /peers answers "what is the seat doing now" without inferring it from durations.
       if (pr && b.phase) { pr.phase = String(b.phase).slice(0, 20); pr.phaseSince = Number(b.phaseSince) || now(); }
-      return json(res, 200, { ok: true, session: b.session, peers: Object.keys(state.peers) });
+      // #8723: memory rows (quiet past PEER_TTL_MS) are internal state — a peer listing never shows them.
+      return json(res, 200, { ok: true, session: b.session, peers: Object.keys(state.peers).filter(s => (state.peers[s]?.lastSeen || 0) >= now() - PEER_TTL_MS) });
     }
     if (req.method === "POST" && P === "/status") { const b = await body(req); touch(b.session, b.status ?? "", b.project, b.hookVersion, auth); return json(res, 200, { ok: true }); }
     // Single-peer lookup, including the read receipt (how far this session's inbox has actually been
@@ -318,10 +319,12 @@ export async function routeAdmin({ req, res, q, P, auth, ctx }) {
     if (req.method === "GET" && P === "/peers") {
       prunePeers();
       const cutoff = now() - ONLINE_MS;
-      const peerRows = filterDiscoverable(auth, Object.entries(state.peers), ([, v]) => v.project || "");
+      const ttlCut = now() - PEER_TTL_MS;   // #8723: memory rows are for declaredCrewFor + duty only, never a listing
+      const peerRows = filterDiscoverable(auth, Object.entries(state.peers), ([, v]) => v.project || "").filter(([, v]) => (v.lastSeen || 0) >= ttlCut);
       return json(res, 200, { hubVersion: HUB_VERSION, authMode: AUTH_MODE, peers: peerRows.map(([s, v]) => ({ session: s, lastSeen: v.lastSeen, online: v.lastSeen > cutoff, status: v.status || "", health: healthOf(v.status), project: v.project || "", phase: v.phase || "", phaseSince: v.phaseSince || 0,
         pubkey: v.pubkey || "", identity: v.identity || null, authWarning: v.authWarning || "",
-        kind: v.kind || v.identity?.kind || "", llm: v.llm || "", model: v.model || "", hookVersion: v.hookVersion || "", staleHooks: !!(v.lastSeen > cutoff && v.hookVersion && HUB_VERSION && cmpSemver(v.hookVersion, HUB_VERSION) < 0) })) });
+        kind: peerKindOf(v),   // #8723 bounce-3: same resolver declaredCrewFor reads — never a roster-only answer
+        llm: v.llm || "", model: v.model || "", hookVersion: v.hookVersion || "", staleHooks: !!(v.lastSeen > cutoff && v.hookVersion && HUB_VERSION && cmpSemver(v.hookVersion, HUB_VERSION) < 0) })) });
     }
     // --- Provider balances (prepaid credit) ---
     // The hub runs under launchd with no provider keys, so it can't fetch balances itself. Env-having

package/hub/routes/cards.mjs

@@ -29,7 +29,7 @@ export async function routeCards({ req, res, q, P, auth, ctx }) {
     appendTaskLog, appendTaskNote, cleanChecklist, cleanDrill, hasDrillLine, linkCommitToFocus,
     derivePhases, PROPOSAL_CAP, propFp, healthOf, REAP_GRACE_MS, subFp,
     prunePeers, canRead, HUB_VERSION, cmpSemver, isCardEvent, fmtAge, hubSend,
-    ONLINE_MS,
+    ONLINE_MS, PEER_TTL_MS,
   } = ctx;
     if (req.method === "POST" && P === "/task") {           // create a card
       const b = await body(req);
@@ -544,7 +544,9 @@ export async function routeCards({ req, res, q, P, auth, ctx }) {
       const cutoff = now() - ONLINE_MS; const byProj = {};
       const proj = p => canon(p) || "(unassigned)";
       const mk = k => (byProj[k] ||= { project: k, brief: (state.projectMeta[k]?.brief) || "", agents: [], tasks: { todo:0,doing:0,testing:0,failed:0,done:0,blocked:0 }, doingTitles: [], lastActivity: 0 });
+      const ttlCut = now() - PEER_TTL_MS;   // #8723: a memory row (quiet past PEER_TTL_MS) never lists as a board agent…
       for (const [s, v] of filterReadable(auth, Object.entries(state.peers), ([, v]) => v.project || "")) {
+        if ((v.lastSeen || 0) < ttlCut) continue;   // …declaredCrewFor and the duty watermark still read it from state.
         const k = proj(v.project); const e = mk(k); e.agents.push({ session: s, online: v.lastSeen > cutoff, status: v.status || "", health: healthOf(v.status),
           llm: v.llm || "", model: v.model || "", hookVersion: v.hookVersion || "", staleHooks: !!(v.lastSeen > cutoff && v.hookVersion && HUB_VERSION && cmpSemver(v.hookVersion, HUB_VERSION) < 0) });
         if ((v.lastSeen || 0) > e.lastActivity) e.lastActivity = v.lastSeen;

package/hub/routes/messages.mjs

@@ -6,7 +6,7 @@ export async function routeMessages({ req, res, q, P, auth, ctx }) {
     state, body, json, stripNulText, crossProjectGuard, touch, pushToStreams,
     appendEvent, appendCardEvent, appendTaskLog, markDelivered, contractsFor, canUseInboxSession, inboxWindow,
     deliverable, inboxReadable, inboxResponse, filterReadable, streams, UI,
-    AUTH_MODE, persistHealth, duty, now, markDirty, assertNoSecrets,
+    AUTH_MODE, persistHealth, duty, now, markDirty, assertNoSecrets, PEER_TTL_MS,
     CONTRACT_WINDOW_MS,
   } = ctx;
     if (req.method === "POST" && P === "/send") {
@@ -157,7 +157,8 @@ export async function routeMessages({ req, res, q, P, auth, ctx }) {
     if (req.method === "GET" && (P === "/" || P === "/ui")) {
       res.writeHead(200, { "content-type": "text/html; charset=utf-8" }); return res.end(UI || "<h1>trantor</h1><p>dashboard unavailable</p>");
     }
-    if (P === "/health") return json(res, 200, { ok: true, authMode: AUTH_MODE, peers: Object.keys(state.peers).length, messages: state.messages.length, streams: streams.length,
+    // #8723: the count is a listing in aggregate — memory rows (past PEER_TTL_MS) never count.
+    if (P === "/health") return json(res, 200, { ok: true, authMode: AUTH_MODE, peers: Object.values(state.peers).filter(v => (v.lastSeen || 0) >= now() - PEER_TTL_MS).length, messages: state.messages.length, streams: streams.length,
       persist: persistHealth.view(),
       // #5686: duty liveness rides /health so the app's Home strip and doctor read one truth.
       duty: { ...duty.dutyLiveness(), darkSinceMs: duty.darkSince ? now() - duty.darkSince : 0, queuedEscalations: duty.dutyQueuedEscalations() } });

package/hub.mjs

@@ -33,6 +33,11 @@ const ONLINE_MS = Number(process.env.RELAY_ONLINE_MS || 5 * 60 * 1000);
 const PEER_TTL_DEFAULT_MS = 21600000;
 const peerTtlRaw = Number(process.env.RELAY_PEER_TTL_MS || PEER_TTL_DEFAULT_MS);
 const PEER_TTL_MS = Math.max(Number.isFinite(peerTtlRaw) ? peerTtlRaw : PEER_TTL_DEFAULT_MS, ONLINE_MS);
+// #8723: the memory row a TTL-expired peer becomes is not immortal either — after this long quiet
+// it is forgotten outright. Floored at PEER_TTL_MS so every row gets its memory phase before deletion.
+const PEER_FORGET_DEFAULT_MS = 30 * 24 * 60 * 60 * 1000;
+const forgetRaw = Number(process.env.RELAY_PEER_FORGET_MS || PEER_FORGET_DEFAULT_MS);
+const PEER_FORGET_MS = Math.max(Number.isFinite(forgetRaw) ? forgetRaw : PEER_FORGET_DEFAULT_MS, PEER_TTL_MS);
 const REAP_GRACE_MS = Number(process.env.RELAY_REAP_GRACE_MS || 15 * 60 * 1000);
 const SUPERSEDE_GRACE_MS = Number(process.env.RELAY_SUPERSEDE_GRACE_MS || REAP_GRACE_MS);
 const TODO_STALE_DEFAULT_MS = 14 * 24 * 60 * 60 * 1000;
@@ -73,8 +78,8 @@ if (process.argv.includes("--smoke")) {
 const reaper = createReaper({
   state: store.state, markDirty: store.markDirty, canon: authRuntime.canon,
   now: events.now, appendCardEvent: events.appendCardEvent, appendEvent: events.appendEvent,
-  appendTaskLog: store.appendTaskLog, sweepPresence: events.sweepPresence, ONLINE_MS, PEER_TTL_MS, FOCUS_OFFLINE_MS,
-  FOCUS_IDLE_MS, REAP_GRACE_MS, TODO_STALE_MS, REAP_INTERVAL_MS,
+  appendTaskLog: store.appendTaskLog, sweepPresence: events.sweepPresence, ONLINE_MS, PEER_TTL_MS, PEER_FORGET_MS,
+  FOCUS_OFFLINE_MS, FOCUS_IDLE_MS, REAP_GRACE_MS, TODO_STALE_MS, REAP_INTERVAL_MS,
   CONTRACT_ABANDON_MS, CONTRACT_WINDOW_MS,
 });
 const duty = createDuty({
@@ -114,7 +119,7 @@ let UI = "";
 try { UI = readFileSync(new URL("./ui.html", import.meta.url), "utf8"); } catch {}
 const context = {
   ...store, ...authRuntime, ...events, ...reaper, duty, overseer, derivePhases,
-  hubSend: duty.hubSend, assertNoSecrets, UI, AUTH_MODE, ONLINE_MS,
+  hubSend: duty.hubSend, assertNoSecrets, UI, AUTH_MODE, ONLINE_MS, PEER_TTL_MS,
   REAP_GRACE_MS, CONTRACT_WINDOW_MS,
 };
 const routes = [routeAdmin, routeCards, routeInsights, routeMessages];

package/lib/classify-failure.mjs

@@ -84,11 +84,27 @@ export function looksLikeAuthDeath(ownText, realWork = false) {
  *  it did, phrased exactly like the runner's own "classified X because Y" log — so a pane that
  *  scrolls away loses nothing that the telemetry row needs to say. */
 export function verdictFor(realExit, effExit, emptyOutput, ownText, emptyTurn = false, cut = false) {
-  if (realExit === 0 && effExit === 0) return emptyTurn
+  if (realExit === 0 && effExit === 0) {
+    // #9724: the quota family's exit-0 trap — opencode printed the OpenRouter credit error and
+    // quit clean, so exit 0 + bytes read as success over a turn where nothing ran. A billing
+    // rejection on a clean exit is the provider refusing the turn; a shipped commit is still
+    // real work (checked by the runner via git), and it stands above the captured stream.
+    const bl = looksLikeBillingDeath(ownText);
+    if (bl) return `classified exhausted because ${BILLING_RE.exec(String(ownText || ""))[0]} in the CLI's own output on a clean exit`;
+    return emptyTurn
     ? "classified empty-turn because exit 0 with no worktree change, no substantive output, no bus activity"
     : "classified success because exit 0 with CLI output";
+  }
   if (realExit === 0 && effExit === 1) {
     if (emptyOutput) return "classified empty-output because exit 0 with no output on either stream";
+    // #8778: the exit-0 escalation must not relabel a provider-side rejection as "auth" — codex
+    // prints the chatgpt-backend 401 and exits 0, so the real specimen rode this exact path.
+    const pr = providerRejected(String(ownText || ""));
+    if (pr) return `classified ${pr.reason} because ${pr.matched}`;
+    // #9724: the runner's billing escalation rides this branch too — the OpenRouter specimen's
+    // credit error must read exhausted here, never fall through to the auth label.
+    const bl = String(ownText || "").match(BILLING_RE);
+    if (bl) return `classified exhausted because ${bl[0]} in the CLI's own output on a clean exit`;
     const m = AUTH_MARKER_RE.exec(String(ownText || ""));
     return `classified auth because ${m ? m[0] : "auth marker"} in the CLI's own short output`;
   }
@@ -96,6 +112,52 @@ export function verdictFor(realExit, effExit, emptyOutput, ownText, emptyTurn =
   return `classified ${reason} because ${matched}`;
 }
 
+// ---- the provider-rejected 401 (#8778) ---------------------------------------------------------
+// chatgpt.com/backend-api is the ChatGPT-SUBSCRIPTION backend codex hits while logged in with no
+// API key stored, so a 401 naming it is OpenAI rejecting its own server-side key — the specimen's
+// sk-svcacct key existed in no env file, keychain or process env on the machine.
+const REQUEST_ID_RE = /request id:\s*([a-z0-9][a-z0-9-]*)/i;
+
+/** The #8778 rule: a 401 whose url is the chatgpt.com/backend-api endpoint classifies
+ *  provider-rejected — the verdict names the request id and steers to waiting or the OpenAI
+ *  account, never a re-login. Returns null for any other shape, so a 401 from an API-key
+ *  endpoint (or one naming no endpoint) stays "auth". */
+export function providerRejected(errText) {
+  const t = String(errText || "");
+  if (!/\b401\b/.test(t) || !/chatgpt\.com\/backend-api/i.test(t)) return null;
+  const rid = (t.match(REQUEST_ID_RE) || [])[1] || "";
+  return {
+    reason: "provider-rejected",
+    matched: `401 from https://chatgpt.com/backend-api${rid ? ` (request id ${rid})` : ""} — OpenAI rejected its own subscription key server-side; wait or check the OpenAI account, logging in again will not help`,
+  };
+}
+
+// ---- the provider billing rejection on a clean exit (#9724) ------------------------------------
+// The OpenRouter specimen: opencode printed "This request requires more credits, or fewer
+// max_tokens. You requested up to 32000 tokens, but can only afford 16." and exited 0 — the
+// runner read exit 0 + bytes as success and posted "✅ done" over a turn where nothing ran.
+export const BILLING_RE = /requires more credits|can only afford|http 402|insufficient balance|payment required/i;
+
+/** #9724: a billing rejection on a clean exit is the provider refusing the turn. Same doctrine as
+ *  looksLikeAuthDeath: a shipped commit (realWork, checked by the runner via git) is a live turn. */
+export function looksLikeBillingDeath(ownText, realWork = false) {
+  if (realWork) return false;
+  return BILLING_RE.test(String(ownText || ""));
+}
+
+/** #9724/#8234: a usage record that RESOLVED (the #8234 lookup found the session's record) to all
+ *  zeros means no model work happened. Null usage — the CLI prints none and keeps none — stays
+ *  unknown and is never failure. */
+export function usageSaysNoWork(usage) {
+  const vals = Object.values(usage || {});
+  return vals.length > 0 && vals.every(v => Number(v) === 0);
+}
+
+/** The verdict line for a resolved-zero-usage turn — named here so the drill pins the string. */
+export function zeroUsageVerdict() {
+  return "classified zero-usage because the session usage record resolved to all zeros — no model work happened";
+}
+
 /** Classify one failed turn. Returns { reason, matched } — matched is the evidence excerpt the
  *  runner logs, so the next misclassification is diagnosable from the seat log alone. `cut` is the
  *  runner's box/stall marker: 137 reads as the sweep's SIGKILL only under it — without the marker
@@ -118,12 +180,18 @@ export function classifyFailure(exit, errText, emptyOutput = false, emptyTurn =
   // #5684: a provider BACKEND failure is not quota — it wants retry/swap, not a window wait.
   // The specimen (#5683): codex's "unexpected status 404 Not Found … /responses/compact" was
   // labelled "exhausted" and the operator was advised to wait out a window that did not exist.
-  // 401/403/429 deliberately fall through to the auth/exhausted branches below.
+  // 401/403/429 deliberately fall through to the provider-rejected/auth/exhausted branches below.
   let m = t.match(/unexpected status (?:404|408|410|5\d\d)|internal server error|bad gateway|service unavailable|gateway time.?out|econnrefused|connection refused|socket hang ?up|network is unreachable/);
   if (m) return { reason: "backend-error", matched: m[0] };
+  // #8778: ranked ABOVE the quota/auth patterns — the specimen text itself carries an "API key"
+  // phrase, and either pattern reading first would relabel the same provider-side rejection.
+  const pr = providerRejected(String(errText || ""));
+  if (pr) return pr;
   // "reached your … limit" / "usage limit" catch the subscription CLIs (Claude's "You've reached
   // your Fable 5 limit"), which say nothing about quota or credits and would otherwise read as a crash.
-  m = t.match(/quota|payment required|402|429|too many requests|rate.?limit|usage limit|exceeded your|reached your [^.\n]*limit|insufficient (?:credits?|funds)|out of (?:credits?|quota)/);
+  // #9724: the OpenRouter billing phrasing — "requires more credits … can only afford 16" — and
+  // "insufficient balance" name the same wall without any of the older tokens.
+  m = t.match(/quota|payment required|requires more credits|can only afford|insufficient balance|402|429|too many requests|rate.?limit|usage limit|exceeded your|reached your [^.\n]*limit|insufficient (?:credits?|funds)|out of (?:credits?|quota)/);
   if (m) return { reason: "exhausted", matched: m[0] };
   m = t.match(/unauthor|401|invalid[ _-]?api[ _-]?key|forbidden|403|token expired|expired/);
   if (m) return { reason: "auth", matched: m[0] };

package/lib/state/derive.mjs

@@ -170,11 +170,10 @@ export function deriveState({ project, seat, card, worktree, handoffText, cardTi
     now: Number.isInteger(now) ? now : Math.floor(Date.now() / 1000),
     by: author,
     files: deriveFiles(worktree),
-    // This build is RECONSTRUCTION, not a seat asserting completion (#8068): a ✅ bullet in the
-    // predecessor's handoff records what it reported done. The evidence rule guards a live claim,
-    // and applying it here would drop the handoff's items on the floor. Credit is withheld the way
-    // the contract already says — deriveFiles marks every path verified:false and `verify` stays
-    // empty — so the successor must still re-earn evidence before anything NEW moves to done.
+    // RECONSTRUCTION, not a live claim (#8068): a ✅ bullet records what the predecessor reported
+    // done, so the arrival-in-done gate must not fire on this path — CONTRACT-state.md, "Derive".
+    // Credit is still withheld (verified:false everywhere), so the successor re-earns evidence
+    // before anything NEW moves to done.
     reconstructing: true,
   };
 

package/lib/state/driver.mjs

@@ -277,12 +277,10 @@ export async function runStep({
   // Per attempt, not per step (#7226): a cut on the first attempt belongs to that attempt's row.
   let stepCut = cut === true;
 
-  // §7.3's fallback ladder: a MALFORMED patch earns exactly one retry, with the rejection message
-  // as the observation. An EVIDENCE rejection is not retried in-turn — the code was wrong, not the
-  // grammar, and the seat needs a whole step to fix the code (§4.8).
-  // Where HEAD sat before this step ran anything (#8069). Captured ONCE, outside the retry loop:
-  // a malformed-output retry re-runs the CLI, and commits the first attempt already made are still
-  // this step's work — re-reading HEAD per attempt would silently drop them.
+  // Two seams, both in CONTRACT-state.md: (1) §7.3's ladder — a MALFORMED patch earns exactly one
+  // retry with the rejection as the observation; an EVIDENCE rejection is not retried in-turn,
+  // the code was wrong, not the grammar (#8068). (2) HEAD captured ONCE, outside the retry loop:
+  // the first attempt's commits are still this step's work (#8069).
   const headAtStart = (D.gitHead || gitHead)(cwd);
 
   for (;;) {

package/lib/state/store.mjs

@@ -91,12 +91,9 @@ export function gitHead(cwd) {
   return /^[0-9a-f]{40}$/.test(sha) ? sha : null;
 }
 
-/** Paths changed by the COMMITS made since `sha`, NUL-separated (#8069). The two commands §4.8 named
- *  — `git status --porcelain` and `git diff --name-only HEAD` — both measure the working tree against
- *  HEAD, so a seat that commits moves HEAD along with its work and both come back empty. That is not a
- *  corner case: every seat is told to commit early and often so a cut cannot erase it, which made tier 1
- *  blind on the ordinary flow. A card that rewrote 8,000 lines across 4 commits recorded files:{}.
- *  Degrades to [] on any git error, exactly like the other readers — recovery never throws. */
+/** Paths changed by the COMMITS made since `sha`, NUL-separated (#8069). The §4.8 status/diff pair
+ *  measures the tree against HEAD, so a seat that commits (the ordinary flow) reads empty from
+ *  both — CONTRACT-state.md, "Tier 1". Degrades to [] on any git error, like the other readers. */
 export function gitCommittedSince(sha, cwd) {
   if (!sha || !cwd) return [];
   const out = git(["diff", "--name-only", "-z", `${sha}..HEAD`], cwd);

package/lib/state/validate.mjs

@@ -49,21 +49,16 @@ export function hasEvidence(state, item, ctx = {}) {
   return paths.every(p => ({ ...(state.files[p] || {}), ...(ctxFiles[p] || {}) }).verified === true);
 }
 
-/** The evidence gate for an item ARRIVING in `done`, by whichever op put it there (#8068). Returns the
- *  rejection, or null when the item may land. `move → done` had this inline and `add … list:"done"` had
- *  nothing at all, so a seat that completed an item in the turn it did the work — the ordinary flow —
- *  walked past the verified-done rule entirely. Both doors now lead through this one check; `at` is the
- *  only thing that differs, so the seat's rejection still names the op it actually wrote. */
+/** The evidence gate for an item ARRIVING in `done`, by whichever op put it there (#8068). Returns
+ *  the rejection, or null when the item may land. Both doors — `move → done` and
+ *  `add … list:"done"` — lead through this one check (CONTRACT-state.md, "Schema and validation");
+ *  only `at` differs, so the rejection names the op the seat actually wrote. */
 function arrivalInDone(state, item, ctx, at) {
   if (!item || hasEvidence(state, item, ctx)) return null;
-  // The one exception, and it is reconstruction rather than assertion: derive.mjs rebuilds a
-  // WorkingState from a predecessor's prose handoff, where a ✅ bullet is a RECORD of what was
-  // reported done, not this seat claiming it now. Gating that would delete the handoff's content —
-  // #6528's failure exactly — and the rule it would be enforcing is already kept another way:
-  // CONTRACT-state.md, "a derived state carries no credit … the successor must re-earn its evidence
-  // before anything moves to done". The items arrive uncredited, so the successor still cannot ride
-  // route (b) on them. `ctx` is harness-supplied and a patch cannot write it (§3.0 write matrix),
-  // so a seat cannot set this for itself — which is the only reason a flag is safe here at all.
+  // The one exception is RECONSTRUCTION, not assertion (#8068): derive.mjs's ✅ bullets are records
+  // of what the predecessor reported done, and gating them would delete the handoff's content
+  // (#6528's failure). The skipped rule is kept another way (CONTRACT-state.md, "Derive"); ctx is
+  // harness-supplied, so a seat cannot set this flag for itself.
   if (ctx.reconstructing === true) return null;
   // The split that makes §4.8's one-retry bound a fact: a gate that ran and failed looks
   // exactly like a gate that never ran, unless the driver says which happened.

package/lib/turn-policy.mjs

@@ -207,8 +207,9 @@ export function quotaResetAt(rows, now = Date.now()) {
 }
 
 /// Seats that park rather than retry. A backend error is the provider having a bad minute and the
-/// ladder is exactly right for it; a spent plan or a rejected key will not fix itself on a timer.
-export const PARKING_REASONS = new Set(["exhausted", "auth"]);
+/// ladder is exactly right for it; a spent plan, a rejected key, or a provider-side key rejection
+/// (#8778: the chatgpt-backend 401 on a seat whose login is valid) will not fix itself on a timer.
+export const PARKING_REASONS = new Set(["exhausted", "auth", "provider-rejected"]);
 
 /// #6228: the sender's home project, by the same "name suffix after the last colon" convention
 /// every crew/orch identity is minted with (isRunnerSession in crew-runner.mjs uses the mirror

package/mcp.mjs

@@ -594,11 +594,12 @@ const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
 const nonProjectReason = nonSeatReason(projectDir);
 const isHomeDirSession = !!nonProjectReason;
 
-// #6170: WHAT this session is, when it can know. sessionstart stamps kind "orch" on the
-// orchestrator pane, but that runs once — every MCP beat afterwards was kindless, and the hub's
-// crew exemption reads the peer row's kind, so the orchestrator kept being demoted by its own
-// heartbeat, then warned about as an intruder on its own project. Same test sessionstart uses.
-const KIND = process.env.TRANTOR_ORCH && process.env.TRANTOR_ORCH === PROJECT ? { kind: "orch" } : {};
+// #6170: WHAT this session is, when it can know — sessionstart stamps kind "orch" once, but every
+// MCP beat afterwards was kindless, so the hub's crew exemption read the demoted row and the
+// orchestrator was warned as an intruder on its own project. Same test sessionstart uses.
+// #8723 bounce-3: a crew seat stamps "agent" the same way (TRANTOR_SEAT, set by bin/crew-runner.mjs).
+const KIND = process.env.TRANTOR_ORCH && process.env.TRANTOR_ORCH === PROJECT ? { kind: "orch" }
+  : process.env.TRANTOR_SEAT ? { kind: "agent" } : {};
 
 if (!isHomeDirSession) {
   await api("POST", "/register", { session: SESSION, project: PROJECT, status: `active in ${PROJECT}`, hookVersion: MCP_VERSION, ...KIND })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.71",
+  "version": "0.18.73",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"