trantor 0.18.78 → 0.18.80

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.78",
+  "version": "0.18.80",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/crew/cmux.mjs

@@ -55,6 +55,7 @@ function tracked(ctx) {
 
 function prepare(ctx, prune) {
   const result = tracked(ctx);
+  if (ctx.swap) return result.reuse;
   for (const id of result.stale) {
     console.log(`  → closing stale stacked crew workspace for ${ctx.project} (${id})`);
     closeWorkspace(ctx, id);
@@ -178,6 +179,7 @@ function spawnAppleScript(ctx, specs, resolve) {
 function prepareAppleScriptWorkspace(ctx) {
   const ids = readRows(ctx).filter(row => row.project === ctx.project && row.kind === "cmuxws").map(row => row.handle);
   const reuse = ids.at(-1) || "";
+  if (ctx.swap) return reuse;
   for (const id of ids.slice(0, -1)) {
     console.log(`  → closing stale stacked crew workspace for ${ctx.project} (${id})`);
     closeWorkspace(ctx, id);

package/bin/crew/core.mjs

@@ -146,8 +146,9 @@ export function runnerCommand(ctx, agent, model = "", effort = null) {
     .join("");
   // #7777: the launcher resolved the catalog's per-difficulty effort for this seat; the runner
   // reads CREW_EFFORT, applies what the CLI accepts and logs the one-line summary.
+  const swapEnv = ctx.swap ? ` CREW_SWAP_STAGE=${shellQuote(ctx.swap.path)} CREW_SWAP_LABEL=${shellQuote(ctx.swap.label)} CREW_SWAP_AGENT=${shellQuote(ctx.swap.agent)} CREW_SWAP_DRIVER=${shellQuote(ctx.swap.driver || "")}` : "";
   const effortEnv = effort ? ` CREW_EFFORT=${shellQuote(JSON.stringify(effort))}` : "";
-  return `cd ${shellQuote(ctx.dir)} && ${forwarded}CREW_MODEL=${shellQuote(model)}${effortEnv} RELAY_PROJECT=${shellQuote(ctx.project)} RELAY_URL=${shellQuote(ctx.hub)} node ${shellQuote(join(ROOT, "bin/crew-runner.mjs"))} ${shellQuote(agent)} ${shellQuote(ctx.dir)}`;
+  return `cd ${shellQuote(ctx.dir)} && ${forwarded}CREW_MODEL=${shellQuote(model)}${effortEnv}${swapEnv} RELAY_PROJECT=${shellQuote(ctx.project)} RELAY_URL=${shellQuote(ctx.hub)} node ${shellQuote(join(ROOT, "bin/crew-runner.mjs"))} ${shellQuote(agent)} ${shellQuote(ctx.dir)}`;
 }
 
 export function listPids(pattern) {

package/bin/crew/herdr.mjs

@@ -121,6 +121,7 @@ function orchPaneWorkspaces(ctx) {
 
 function prepareWorkspace(ctx, prune) {
   const tracked = trackedWorkspace(ctx);
+  if (ctx.swap) return tracked.reuse;
   const orchSpaces = orchPaneWorkspaces(ctx);
   for (const id of tracked.stale) {
     // #7285: never close reuse itself, nor a workspace hosting the tracked orch pane — `up` once

package/bin/crew/models.mjs

@@ -1,7 +1,6 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { call } from "./core.mjs";
-import { reapSeat } from "./state.mjs";
 import { resolveEffort } from "../../lib/model-catalog.mjs";
 
 function routeModel(ctx, provider, candidates, task, difficulty) {
@@ -21,7 +20,8 @@ export function resolveModel(ctx, agent, provider, task, difficulty) {
   const candidates = result.ok ? result.stdout.split(/\s+/).filter(Boolean).join(" ") : "";
   let model = routeModel(ctx, provider, candidates, task, difficulty);
   if (!model && candidates) {
-    model = `${provider}/${candidates.split(" ")[0]}`;
+    const first = candidates.split(" ")[0];
+    model = first.startsWith(`${provider}/`) ? first : `${provider}/${first}`;
     console.error(`[crew] router unavailable for ${agent}:${provider} — using the provider's own catalog head (${model})`);
   }
   if (!model) throw new Error(`[crew] live model selection failed for ${agent}:${provider} — no router and no catalog; refusing opencode global default`);
@@ -31,7 +31,6 @@ export function resolveModel(ctx, agent, provider, task, difficulty) {
 
 export function resolveSpec(ctx, spec, task, difficulty, skipped) {
   const [agent, ...rest] = spec.split(":");
-  reapSeat(ctx, agent);
   let field = rest.join(":");
   if (!field) {
     if (agent === "glm") field = "zai-coding-plan";

package/bin/crew/processes.mjs

@@ -0,0 +1,29 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { call } from "./core.mjs";
+
+export const runnerRecord = (ctx, project, agent) => join(ctx.seatDir, `${project}-${agent}.runner.json`);
+
+export function seatProcesses(ctx, project, agent) {
+  if (ctx.env.CREW_NO_PROC_KILL === "1") return [];
+  let label = agent, dir = ctx.dir;
+  try {
+    const record = JSON.parse(readFileSync(runnerRecord(ctx, project, agent), "utf8"));
+    label = record.label;
+    dir = record.dir;
+  } catch (error) { if (error.code !== "ENOENT") throw error; }
+  const rows = call("ps", ["-axo", "pid=,ppid=,command="]).stdout.split("\n").map(line => {
+    const match = line.trim().match(/^(\d+)\s+(\d+)\s+(.+)$/);
+    return match ? { pid: Number(match[1]), parent: Number(match[2]), command: match[3] } : null;
+  }).filter(Boolean);
+  const ids = new Set(rows.filter(row => row.command.endsWith(`crew-runner.mjs ${label} ${dir}`)).map(row => row.pid));
+  let before;
+  do { before = ids.size; for (const row of rows) if (ids.has(row.parent)) ids.add(row.pid); } while (ids.size > before);
+  return [...ids];
+}
+
+export function signalProcesses(pids, signal) {
+  for (const pid of pids) {
+    try { process.kill(pid, signal); } catch (error) { if (error.code !== "ESRCH") throw error; }
+  }
+}

package/bin/crew/stage.mjs

@@ -0,0 +1,28 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { setTimeout } from "node:timers/promises";
+import { loadOrCreate } from "../../lib/identity.mjs";
+import { ensureEnrolled } from "../../lib/enroll.mjs";
+import { sfetchJson } from "../../lib/signed-fetch.mjs";
+
+// A replacement registers before it touches the old runner's worktree or queue.
+export async function awaitSwapRelease(env = process.env) {
+  if (!env.CREW_SWAP_STAGE) return;
+  const stage = env.CREW_SWAP_STAGE;
+  const session = `${env.CREW_SWAP_LABEL}:${env.RELAY_PROJECT}`;
+  const identity = loadOrCreate(session, "agent");
+  const enrollment = await ensureEnrolled(env.RELAY_URL, identity, env.RELAY_PROJECT);
+  if (!enrollment.ok) throw new Error(`replacement enrollment failed: ${enrollment.reason}`);
+  const response = await sfetchJson(`${env.RELAY_URL}/register`, {
+    identity, payload: { session, project: env.RELAY_PROJECT, kind: "agent", status: "replacement ready; awaiting handoff" },
+    signal: AbortSignal.timeout(8000),
+  });
+  if (!response.ok) throw new Error(`replacement registration failed: ${response.status}`);
+  writeFileSync(`${stage}.ready`, JSON.stringify({ pid: process.pid, session }));
+  const deadline = Date.now() + 120000;
+  while (!existsSync(`${stage}.release`)) {
+    if (Date.now() > deadline) throw new Error("swap handoff timed out; replacement stopped before taking work");
+    await setTimeout(100);
+  }
+  const handoff = JSON.parse(readFileSync(`${stage}.release`, "utf8"));
+  if (handoff.agent !== env.CREW_SWAP_AGENT) throw new Error("swap release names a different seat");
+}

package/bin/crew/state.mjs

@@ -1,4 +1,5 @@
 import { existsSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { seatProcesses, signalProcesses } from "./processes.mjs";
 import { call, listPids, run } from "./core.mjs";
 import { hostId } from "../../lib/project.mjs";
 import { statePathFor as dockerStatePathFor, sweep as dockerSweep } from "../../lib/docker-janitor.mjs";
@@ -61,6 +62,7 @@ async function stopSeatContainers(ctx, project, agent) {
 async function killSeatProcesses(ctx, project, agent) {
   if (ctx.env.CREW_NO_PROC_KILL === "1" || !project || !agent) return;
   await stopSeatContainers(ctx, project, agent);
+  if (!ctx.dry) signalProcesses(seatProcesses(ctx, project, agent), "SIGKILL");
   const patterns = [`seats/${project}-${agent}\\.sh`, `crew-runner\\.mjs ${agent} .*/${project}$`];
   for (const pattern of patterns) {
     for (const pid of listPids(pattern)) run(ctx, "kill", ["-9", pid], { rendered: `kill -9 ${pid} 2>/dev/null` });

package/bin/crew/swap.mjs

@@ -0,0 +1,163 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { setTimeout } from "node:timers/promises";
+import { call, commandExists } from "./core.mjs";
+import { resolveSpec } from "./models.mjs";
+import { runnerRecord, seatProcesses, signalProcesses } from "./processes.mjs";
+import { down, readRows, writeRows } from "./state.mjs";
+import { providerStatus } from "../../lib/providers.mjs";
+import { lookup } from "../../lib/model-catalog.mjs";
+import { resolveKeys } from "../../lib/provider-keys.mjs";
+import { resolveSecrets } from "../../lib/secrets.mjs";
+import { signedGet, signedPost } from "../../hooks/lib/api.mjs";
+
+const NATIVE = new Set(["codex", "kimi", "claude", "gemini", "dsh"]);
+
+export function swapOptions(args) {
+  const positional = [];
+  const options = { task: "code", difficulty: "medium", provider: "", model: "" };
+  for (let i = 0; i < args.length; i++) {
+    const key = { "--task": "task", "--difficulty": "difficulty", "--diff": "difficulty", "--provider": "provider", "--model": "model" }[args[i]];
+    if (key) {
+      if (!args[i + 1] || args[i + 1].startsWith("--")) throw new Error(`missing value for ${args[i]}`);
+      options[key] = args[++i];
+    } else if (args[i].startsWith("--")) throw new Error(`unknown swap flag ${args[i]}`);
+    else positional.push(args[i]);
+  }
+  const [from, replacement = options.provider ? from : ""] = positional;
+  if (!from || !replacement || positional.length > 2) throw new Error("usage: trantor swap <old> [new[:provider/model]] [--provider P] [--model M] [--json]");
+  const agent = replacement.split(":")[0];
+  if (![from, agent].every(value => /^[A-Za-z0-9_-]+$/.test(value))) throw new Error("invalid seat name");
+  return { ...options, from, replacement, agent };
+}
+
+export async function validateReplacement(ctx, options, status = providerStatus) {
+  const explicit = options.provider;
+  const field = options.replacement.split(":").slice(1).join(":");
+  const native = NATIVE.has(options.agent) && !explicit;
+  const provider = native ? options.agent : (explicit || field.split("/")[0] || (options.agent === "glm" ? "zai-coding-plan" : options.agent));
+  const binary = native ? options.agent : "opencode";
+  if (!commandExists(binary, ctx.env)) throw new Error(`${binary} CLI not found on PATH; old seat unchanged`);
+  const registryName = provider === "zai-coding-plan" ? "zai" : provider;
+  const env = resolveKeys(ctx.env, [join(ctx.home, ".token-scrooge/.env"), join(ctx.home, ".agent-bus/.env")], resolveSecrets(ctx.env));
+  const rows = await status({ env, path: env.PATH, only: [registryName] });
+  const row = rows[0];
+  if (!row || row.state !== "connected") throw new Error(`${provider}: ${row?.reason || "no credential validator available"}; old seat unchanged`);
+  const spec = explicit ? `${options.agent}-provider:${provider}${options.model ? `/${options.model}` : ""}` : options.model ? `${options.agent}:${options.model}` : options.replacement;
+  const skipped = [];
+  const seat = resolveSpec({ ...ctx, env }, spec, options.task, options.difficulty, skipped);
+  if (!seat) throw new Error(skipped.join("; "));
+  if (native && seat.model && !lookup(seat.model).found) {
+    let models = [];
+    const cache = join(ctx.home, ".codex/models_cache.json");
+    if (options.agent === "codex" && existsSync(cache)) models = JSON.parse(readFileSync(cache, "utf8")).models || [];
+    if (!models.some(model => model.slug === seat.model)) throw new Error(`cannot validate native model ${seat.model}; old seat unchanged`);
+  }
+  if (!native) {
+    const catalog = call("opencode", ["models", provider], { env });
+    const models = catalog.stdout.split(/\s+/).filter(Boolean).map(m => m.startsWith(`${provider}/`) ? m : `${provider}/${m}`);
+    if (!catalog.ok || !models.includes(seat.model)) throw new Error(`model ${seat.model} is not in ${provider}'s available catalog; old seat unchanged`);
+  }
+  return { ...seat, agent: options.agent, driver: native ? "" : "opencode" };
+}
+
+export function pendingPath(ctx, agent) { return join(ctx.home, ".agent-bus", `pending-${agent}-${ctx.project}.json`); }
+
+function readPending(ctx, agent) {
+  const file = pendingPath(ctx, agent);
+  if (!existsSync(file)) return { wake: [], bcast: [], seen: [], ask: 0, askTo: "" };
+  return JSON.parse(readFileSync(file, "utf8"));
+}
+
+function savePending(ctx, agent, pending) {
+  const file = pendingPath(ctx, agent);
+  writeFileSync(`${file}.swap`, JSON.stringify({ ...pending, agent, project: ctx.project, ts: Date.now() }));
+  renameSync(`${file}.swap`, file);
+}
+
+async function hubRequest(ctx, path, body) {
+  const response = body
+    ? await signedPost(`${ctx.hub}${path}`, body, { project: ctx.project })
+    : await signedGet(`${ctx.hub}${path}`, { project: ctx.project });
+  if (!response.ok || !response.json?.ok) throw new Error(response.json?.error || response.reason || `hub handoff failed (${response.status})`);
+  return response.json;
+}
+
+export function swapRuntime(ctx, adapters, spawn) {
+  let pids = [];
+  let replacementPid;
+  return {
+    validate: options => {
+      if (options.agent !== options.from && readRows(ctx).some(row => row.project === ctx.project && row.agent === options.agent)) throw new Error(`replacement seat ${options.agent} already exists; old seat unchanged`);
+      return validateReplacement(ctx, options);
+    },
+    async start(seat, stage) {
+      const staged = { ...ctx, swap: { ...stage, agent: seat.agent, driver: seat.driver } };
+      spawn(staged, { ...seat, agent: stage.label });
+    },
+    async ready(stage) {
+      const deadline = Date.now() + 30000;
+      while (!existsSync(`${stage.path}.ready`)) {
+        if (Date.now() > deadline) throw new Error("replacement did not join the bus within 30s; old seat unchanged");
+        await setTimeout(100);
+      }
+      const ready = JSON.parse(readFileSync(`${stage.path}.ready`, "utf8"));
+      const response = await signedGet(`${ctx.hub}/peers?project=${encodeURIComponent(ctx.project)}`, { project: ctx.project });
+      if (!response.ok || !response.json?.peers?.some(p => p.session === ready.session)) throw new Error("replacement registration is not visible on the bus");
+      process.kill(ready.pid, 0);
+      replacementPid = ready.pid;
+      return ready.session;
+    },
+    freeze(agent) { pids = seatProcesses(ctx, ctx.project, agent); signalProcesses(pids, "SIGSTOP"); },
+    resume() { signalProcesses(pids, "SIGCONT"); },
+    transfer: body => hubRequest(ctx, "/contracts/transfer", body),
+    async stop(agent) {
+      process.kill(replacementPid, 0);
+      await down(ctx, [agent], adapters);
+      signalProcesses(pids, "SIGKILL");
+    },
+    async cancel(stage) { await down(ctx, [stage.label], adapters); },
+    release(stage, agent, cursor) {
+      writeRows(ctx, readRows(ctx).map(row => row.project === ctx.project && row.agent === stage.label ? { ...row, agent } : row));
+      writeFileSync(runnerRecord(ctx, ctx.project, agent), JSON.stringify({ label: stage.label, dir: ctx.dir }));
+      writeFileSync(`${stage.path}.release`, JSON.stringify({ agent, cursor }));
+    },
+  };
+}
+
+export async function performSwap(ctx, options, runtime) {
+  const result = { ok: false, action: "swap", seat: options.from, to: options.agent, moved: [] };
+  let stage, frozen = false, transferred = false;
+  try {
+    const seat = await runtime.validate(options);
+    const label = `${options.agent}-swap-${randomUUID().slice(0, 8)}`;
+    mkdirSync(ctx.seatDir, { recursive: true });
+    stage = { label, path: join(ctx.seatDir, label) };
+    await runtime.start(seat, stage);
+    const readySession = await runtime.ready(stage);
+    frozen = true;
+    await runtime.freeze(options.from);
+    const pending = readPending(ctx, options.from);
+    const target = options.agent === options.from ? pending : readPending(ctx, options.agent);
+    const from = `${options.from}:${ctx.project}`, to = `${options.agent}:${ctx.project}`;
+    const handoff = await runtime.transfer({ from, to, project: ctx.project, readySession, _op: `swap-${stage.label}`, heldAsk: pending.ask || 0, pendingIds: pending.wake.map(m => m.id) });
+    transferred = true;
+    result.moved = [...new Set([...pending.wake.map(m => m.id), ...handoff.moved])];
+    const wake = new Map([...target.wake, ...pending.wake, ...handoff.messages].map(m => [m.id, { ...m, to }]));
+    savePending(ctx, options.agent, { ...target, wake: [...wake.values()], bcast: [...new Map([...target.bcast, ...pending.bcast].map(m => [m.id, m])).values()], ask: handoff.messages.some(m => m.re === pending.ask) ? 0 : pending.ask || target.ask, askTo: pending.askTo || target.askTo });
+    await runtime.stop(options.from);
+    frozen = false;
+    if (options.agent !== options.from) savePending(ctx, options.from, { ...pending, wake: [], bcast: [], ask: 0, askTo: "" });
+    await runtime.release(stage, options.agent, handoff.cursor);
+    return { ...result, ok: true };
+  } catch (error) {
+    if (!transferred) {
+      if (frozen) await runtime.resume();
+      if (stage) await runtime.cancel(stage);
+    }
+    result.reason = error.message;
+    if (transferred) result.reason += "; handoff recorded on hub; old seat held for recovery";
+    return result;
+  }
+}

package/bin/crew-runner.mjs

@@ -24,7 +24,7 @@ import { capWake, capBcast, pickLessons, composePrompt, contractBase, baseLine }
 import {
   cardRefs, servedContractCard, carriesWork, parseTurnTokens, parseResetAt, reasonWithBalances, quotaResetAt, PARKING_REASONS,
   senderProjectOf, isLinkedProject, stateSkipReason, isMessageCardTitle, OPEN_CARD_STATUSES,
-  CUT_CHAIN_PARK_MIN, cutChainEvidence, isBoundedPark,
+  CUT_CHAIN_PARK_MIN, cutChainEvidence, isBoundedPark, askDuringTurn, askedVerdict,
 } from "../lib/turn-policy.mjs";
 import { ocTurnUsage, dshTurnUsage, usageTotal } from "../lib/turn-usage.mjs";
 import { listContainers, newContainers, recordContainers, statePathFor as dockerStatePathFor, sweep as dockerSweep } from "../lib/docker-janitor.mjs";
@@ -41,7 +41,10 @@ import {
 import { costLine } from "../lib/state/cost.mjs";
 import { resolveStateFlags } from "../lib/state/flags.mjs";
 
-const AGENT = process.argv[2];
+import { awaitSwapRelease } from "./crew/stage.mjs";
+
+await awaitSwapRelease();
+const AGENT = process.env.CREW_SWAP_AGENT || process.argv[2];
 const DIR = process.argv[3] || process.cwd();
 // Crew agents MUST share the orchestrator's project key (one repo = one lane).
 // RELAY_PROJECT is inherited from crew.mjs (the host's resolved key); else fall
@@ -241,7 +244,8 @@ const CLI = {
 // <label>:<provider>` for any opencode vendor the user configured — run with no per-provider code
 // here; its model id arrives pre-qualified (`<provider>/<model>`) as CREW_MODEL.
 const NATIVE = new Set(["codex", "gemini", "kimi", "claude", "dsh"]);
-const cli = CLI[AGENT] || (NATIVE.has(AGENT) ? null : CLI.opencode);
+const DRIVER = process.env.CREW_SWAP_DRIVER || AGENT;
+const cli = CLI[DRIVER] || (NATIVE.has(AGENT) ? null : CLI.opencode);
 if (!cli) { console.error(`unknown agent '${AGENT}' (native: ${[...NATIVE].join(", ")}; any other name = an opencode provider seat)`); process.exit(1); }
 if (!CLI[AGENT]) log(`'${AGENT}' is not a built-in seat — running it as an opencode provider (BYOM)`);
 
@@ -250,7 +254,7 @@ if (!CLI[AGENT]) log(`'${AGENT}' is not a built-in seat — running it as an ope
 // parameters the CLI can carry (codex -c model_reasoning_effort / claude --effort / opencode
 // --variant) and logs ONE line saying what it set — or that the model is uncatalogued.
 const EFFORT = (() => { try { return JSON.parse(process.env.CREW_EFFORT || "null"); } catch { return null; } })();
-const EFFORT_FLAG = EFFORT ? cliEffortFlag(AGENT, EFFORT) : { flag: "", text: "" };
+const EFFORT_FLAG = EFFORT ? cliEffortFlag(DRIVER, EFFORT) : { flag: "", text: "" };
 
 // RUNNER_RULES / RUNNER_KICKOFF env overrides: the runner is also the substrate for non-crew
 // always-on seats (the fleet DUTY agent, bin/duty.mjs) whose doctrine is not "work your card".
@@ -352,17 +356,17 @@ let askReleased = false;
 // session. deliverWake judges each clean wake turn against /contracts — an open ask renames the
 // ledger row "asked" and HOLDS the wake (no failure count, no backoff, no park) until the answer.
 let turnAsk = null;
-async function askJudge() {
+async function askJudge(startedAt) {
   try {
     const r = await api(`/contracts?session=${encodeURIComponent(SESSION)}&project=${encodeURIComponent(PROJ)}`);
-    // abandonedContracts included on purpose: an ask to a gone-quiet assigner is exactly the ask
-    // that must keep holding, and the hub files those rows under their own key (#7079).
-    const rows = [...(r?.contracts || []), ...(r?.abandonedContracts || [])];
-    const open = rows.filter(c => c.kind === "ask" && !c.answered);
-    turnAsk = open.length ? { id: open[open.length - 1].id, to: String(open[open.length - 1].to || "") } : null;
-    return turnAsk ? "asked" : null;
+    const rows = [...(r?.contracts || []), ...(r?.abandonedContracts || []),
+      ...(r?.supersededContracts || []), ...(r?.ackContracts || [])];
+    const ask = askDuringTurn(rows, startedAt);
+    turnAsk = ask && !ask.answered ? { id: ask.id, to: String(ask.to || "") } : null;
+    return ask ? redactKeys(askedVerdict(ask)) : null;
   } catch { return null; }
 }
+
 function savePending(wake, bcast) {
   try {
     // the seen-set (#7778) and a held ask (#7756) keep the file alive even with both queues empty:
@@ -617,6 +621,7 @@ const STATE_SCHEMA_FILE = join(homedir(), ".agent-bus", `state-schema-${AGENT}-$
 const STATE_MODE = (() => {
   if (!STATE_FLAG_ON) return false;
   if (AGENT !== "claude") { log(`${STATE_ENV}=1 but this seat is '${AGENT}' — state mode is claude-only (TDD §7.3); staying on the transcript path`); return false; }
+  if (DRIVER !== "claude") return false;
   const probe = hasJsonSchemaFlag((bin, args) => spawnSync(bin, args, { encoding: "utf8", timeout: 20000 }));
   if (!probe) { log(`\x1b[33m${STATE_ENV}=1 but this claude CLI has no --json-schema — state mode stays OFF (TDD §6)\x1b[0m`); return false; }
   try {
@@ -1026,6 +1031,12 @@ exit $turn_exit`;
     effExit = 1;
     log("\x1b[31mexit 0 but the session usage record resolved to all zeros — no model work happened; treating as FAILED\x1b[0m");
   }
+  // #11230: asking is delivery even without a commit or a completed card move.
+  let askVerdict = null;
+  if (!cut && realExit === 0 && effExit === 0 && opts.judgeOutcome) {
+    askVerdict = await opts.judgeOutcome(t0);
+    if (askVerdict) lastEmptyTurn = false;
+  }
   // #10197: a turn BOUND to a card contract reads done only on DELIVERY — a NEW commit since the
   // turn started, or the card moved to testing/done under it. The ibkr shape (exit 0, output, no
   // commit, card still todo) is NO-DELIVERY: the ledger names it and the contract stays owed.
@@ -1040,7 +1051,7 @@ exit $turn_exit`;
     if (endStatus !== null) {
       cardStatusAtEnd = endStatus;
       const moved = ["testing", "done"].includes(endStatus) && !["testing", "done"].includes(cardStatusBefore);
-      noDelivery = !newCommit && !moved;
+      noDelivery = !newCommit && !moved && !askVerdict;
     }
   }
   lastNoDelivery = noDelivery;
@@ -1051,6 +1062,7 @@ exit $turn_exit`;
   // verdict (#7752): the exit under it is the sweep's SIGPIPE. A box cut passes `cut` so its 137
   // reads as the sweep's SIGKILL (#7099); a zero-usage turn names its own verdict too (#9724).
   const verdict = stallCut ? stallVerdict() : zeroUsage ? zeroUsageVerdict()
+    : askVerdict ? askVerdict
     : noDelivery ? noDeliveryVerdict(sessionCard, cardStatusAtEnd || "unknown")
     : verdictFor(realExit, effExit, lastEmptyOutput, ownOut, lastEmptyTurn, cut);
   // #6289: every ledger row names in ONE field what happened to the turn — cut, stalled (#7752),
@@ -1058,12 +1070,7 @@ exit $turn_exit`;
   // binds the row to the card the turn worked (0 = kickoff/pulse) so the seat record attributes
   // empty/stalled turns to the card that produced nothing. `cut` stays too: the drills read it.
   const outcome = cut ? (stallCut ? "stalled" : "cut") : (effExit !== 0 ? "api-error" : noDelivery ? "no-delivery" : lastEmptyTurn ? "empty" : "completed");
-  // #7756: a clean turn that ASKED its assigner is demoted-but-owed, not "completed". The judge
-  // (deliverWake's /contracts read) renames the ledger row, so "asked" is what the log keeps.
-  let finalOutcome = outcome;
-  if (outcome === "completed" && opts.judgeOutcome) {
-    try { finalOutcome = (await opts.judgeOutcome()) || outcome; } catch {}
-  }
+  const finalOutcome = askVerdict ? "asked" : outcome;
   const telemetryRow = { ts: Date.now(), agent: AGENT, project: PROJ, turn: TURN, trigger, card: sessionCard || 0, model: MODEL || "cli-default", duration_ms: Date.now() - t0, exit: realExit, effExit, authFailed: effExit !== realExit, emptyOutput: lastEmptyOutput, emptyTurn: lastEmptyTurn, verdict, outcome: finalOutcome, tokens };
   if (usage) telemetryRow.usage = usage;
   if (dockerNew.length) telemetryRow.containers = dockerNew.map(c => c.name || c.id);
@@ -1304,7 +1311,8 @@ async function resolveWakeCard(messages, { session }) {
   await loadLessons();
   // start cursor at the CURRENT tip so we don't replay history
   let cursor = 0;
-  try { const r = await api(`/inbox?session=${encodeURIComponent(SESSION)}&since=0`); cursor = r.cursor || 0; } catch {}
+  if (process.env.CREW_SWAP_STAGE) cursor = JSON.parse(readFileSync(`${process.env.CREW_SWAP_STAGE}.release`, "utf8")).cursor;
+  else try { const r = await api(`/inbox?session=${encodeURIComponent(SESSION)}&since=0`); cursor = r.cursor || 0; } catch {}
   // kind "agent" on every beat (#6075): the peer row's kind is the hub's OWN record of what a
   // session is — the overseer's declared-crew exemption reads it, and on the remote hub there is
   // no crew-windows.txt to fall back to. /register preserves absent fields, so a seat running an
@@ -1769,6 +1777,7 @@ async function resolveWakeCard(messages, { session }) {
       // the ask's id, so a restart keeps holding — and the failure ladder never sees it. The
       // assigner is NOT notified here: the kind:ask message itself is already that notification.
       awaitingAsk = turnAsk; turnAsk = null;
+      deliveryFails = 0; retryAt = 0; noDeliveryRetry = false;
       savePending(pendingWake, pendingBcast);
       await reportHealthy();
       log(`turn asked its assigner — holding the contract until ask #${awaitingAsk.id} is answered`);

package/bin/crew.mjs

@@ -5,7 +5,9 @@ import { createCmuxAdapter, spawnCmux } from "./crew/cmux.mjs";
 import { createHerdrAdapter, spawnHerdr } from "./crew/herdr.mjs";
 import { resolveSpec, reportSkipped } from "./crew/models.mjs";
 import { openOrchestrator } from "./crew/open.mjs";
-import { down, prune } from "./crew/state.mjs";
+import { performSwap, swapOptions, swapRuntime } from "./crew/swap.mjs";
+import { redactKeys } from "../lib/redact.mjs";
+import { reapSeat, down, prune } from "./crew/state.mjs";
 import { spawnTerminal, spawnTmux } from "./crew/tmux.mjs";
 import { epochMs, failedAgents, verifyCrew } from "./crew/verify.mjs";
 import { guardCrossProjectUp } from "./crew/worktrees.mjs";
@@ -13,10 +15,21 @@ import { preflightFirstSeat } from "./crew/preflight.mjs";
 import { resolveAgentLaunchSpecs } from "../lib/agent-preferences.mjs";
 import { readConfig } from "../lib/project.mjs";
 
-const [command = "up", ...rawArgs] = process.argv.slice(2);
+const [command = "up", ...inputArgs] = process.argv.slice(2);
+const jsonMode = inputArgs.includes("--json");
+const rawArgs = inputArgs.filter(arg => arg !== "--json");
+const output = console.log.bind(console);
+const diagnostics = [];
+if (jsonMode) console.log = (...parts) => {
+  const line = redactKeys(parts.join(" "));
+  diagnostics.push(line);
+  console.error(line);
+};
+const jsonResult = (code, extra = {}) => ({ ok: code === 0, action: command, seat: resultSeat, moved: [], ...extra });
+let resultSeat = rawArgs.filter(a => !a.startsWith("--")).join(",");
 let ctx;
 try { ctx = createContext(command); }
-catch (error) { console.error(error.message); process.exit(1); }
+catch (error) { if (jsonMode) output(JSON.stringify(jsonResult(1, { reason: redactKeys(error.message) }))); else console.error(error.message); process.exit(1); }
 
 const adapters = {
   cmux: createCmuxAdapter(ctx),
@@ -39,7 +52,11 @@ function parseUpArgs(args) {
 }
 
 function spawnCrew(options, skipped) {
-  const resolve = spec => resolveSpec(ctx, spec, options.task, options.difficulty, skipped);
+  const resolve = spec => {
+    const seat = resolveSpec(ctx, spec, options.task, options.difficulty, skipped);
+    if (seat) reapSeat(ctx, seat.agent);
+    return seat;
+  };
   const pruneNow = () => prune(ctx, adapters);
   if (ctx.mux === "herdr") spawnHerdr(ctx, options.specs, resolve, pruneNow);
   else if (ctx.mux === "cmux") spawnCmux(ctx, options.specs, resolve, pruneNow);
@@ -56,6 +73,7 @@ async function runUp(args, verify = true) {
   const options = parseUpArgs(args);
   const requested = resolveAgentLaunchSpecs(options.specs, readConfig());
   options.specs = requested.specs;
+  resultSeat = options.specs.map(spec => spec.split(":")[0]).join(",");
   if (!options.specs.length) {
     console.log("usage: crew.mjs up [--task K --difficulty D] codex glm kimi deepseek (or set a default in Settings → Agents)");
     return 1;
@@ -95,25 +113,42 @@ async function runUp(args, verify = true) {
   return reportSkipped(skipped);
 }
 
+function spawnReplacement(context, seat) {
+  const resolve = () => seat;
+  const specs = [seat.agent];
+  const noPrune = () => {};
+  if (context.mux === "herdr") spawnHerdr(context, specs, resolve, noPrune);
+  else if (context.mux === "cmux") spawnCmux(context, specs, resolve, noPrune);
+  else if (context.mux === "tmux") spawnTmux(context, specs, resolve);
+  else spawnTerminal(context, specs, resolve);
+}
+
 async function swap(args) {
-  const [oldAgent, replacement, ...flags] = args;
-  if (!oldAgent || !replacement) {
-    console.log("usage: trantor swap <oldAgent> <newAgent[:provider[/model]]> [--task K --difficulty D]");
-    return 1;
-  }
-  console.log(`— tearing down old seat '${oldAgent}' in ${ctx.project} —`);
-  await down(ctx, [oldAgent], adapters);
-  console.log(`— spawning replacement: ${replacement} —`);
-  const code = await runUp([...flags, replacement]);
-  if (!code) console.log(`— swapped. RESEND the contract to '${replacement.split(":")[0]}' (it joined fresh with no context). —`);
-  return code;
+  const options = swapOptions(args);
+  resultSeat = options.from;
+  if (resolveAgentLaunchSpecs([options.replacement], readConfig()).disabled.length) throw new Error(`replacement ${options.agent} is disabled in agent settings`);
+  if (!guardCrossProjectUp(ctx)) throw new Error("cross-project swap refused");
+  if (ctx.dry) throw new Error("swap requires a live bus; dry-run cannot verify a handoff");
+  return performSwap(ctx, options, swapRuntime(ctx, adapters, spawnReplacement));
 }
 
 let code = 0;
-if (command === "down") code = await down(ctx, rawArgs, adapters);
-else if (command === "prune") { prune(ctx, adapters); console.log(`— pruned dead crew rows (${ctx.statePath}) —`); }
-else if (command === "open") code = openOrchestrator(ctx, rawArgs);
-else if (command === "swap") code = await swap(rawArgs);
-else if (command === "up") code = guardCrossProjectUp(ctx) ? await runUp(rawArgs) : 1;
-else { usage(); code = 1; }
+let result;
+try {
+  if (command === "down") code = await down(ctx, rawArgs, adapters);
+  else if (command === "prune") { prune(ctx, adapters); console.log(`— pruned dead crew rows (${ctx.statePath}) —`); }
+  else if (command === "open") code = openOrchestrator(ctx, rawArgs);
+  else if (command === "swap") { result = await swap(rawArgs); code = result.ok ? 0 : 1; }
+  else if (command === "up") code = guardCrossProjectUp(ctx) ? await runUp(rawArgs) : 1;
+  else { usage(); code = 1; }
+} catch (error) {
+  code = 1;
+  result = jsonResult(code, { reason: redactKeys(error.message) });
+}
+if (!result) result = jsonResult(code);
+if (!result.ok && !result.reason) result.reason = diagnostics.at(-1) || `${command} failed; see stderr`;
+if (result.reason) result.reason = redactKeys(result.reason);
+if (jsonMode) output(JSON.stringify(result));
+else if (result.reason) console.error(result.reason);
+else if (command === "swap") console.log(`— swapped ${result.seat} → ${result.to}; moved contracts: ${result.moved.join(", ") || "none"} —`);
 process.exit(code);

package/hooks/lib/handoff-claims.mjs

@@ -0,0 +1,121 @@
+import { asString, asRecord } from "../../lib/decode.mjs";
+import { readFileSync, writeFileSync, renameSync, symlinkSync, readlinkSync, unlinkSync, statSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { handoffDir } from "../../lib/project.mjs";
+import { readFirstPaths, pathsReadIn } from "./handoff.mjs";
+
+export const CLAIM_TTL_SECONDS = 600;
+
+export function claimHandoff(record, session, now, transcriptBytes = 0, token = "") {
+  if (record.consumed || !session?.session_id) return null;
+  if (record.claim && record.claim.expiresAt > now) return null;
+  const claim = { ...session, at: now, expiresAt: now + CLAIM_TTL_SECONDS, transcriptBytes, token };
+  return { ...record, consumed: false, claim,
+    states: [...(record.states || []), { state: "claimed", ts: now, by: session.session_id }] };
+}
+
+export function recapHandoff(record, { sessionId, token, replied, missed }, now) {
+  if (record.consumed || record.claim?.session_id !== sessionId || record.claim?.token !== token) return null;
+  if (!replied || missed.length) return null;
+  return { ...record, consumed: true, consumedAt: now, consumedBy: record.claim,
+    states: [...(record.states || []), { state: "recapped", ts: now, by: sessionId }] };
+}
+
+export function hasAssistantReply(body, claimedAt) {
+  return body.split("\n").some(line => {
+    let row;
+    try { row = asRecord(JSON.parse(line)); } catch { return false; }
+    if (row?.type !== "assistant" || row.isSidechain) return false;
+    const timestamp = asString(row.timestamp);
+    if (timestamp && Date.parse(timestamp) < claimedAt * 1000) return false;
+    const content = asRecord(row.message)?.content;
+    const text = asString(content);
+    if (text !== null) return text.trim().length > 0;
+    return Array.isArray(content) && content.some(block => {
+      const b = asRecord(block);
+      return b?.type === "text" && !!asString(b.text)?.trim();
+    });
+  });
+}
+
+// Serialize claim and recap writes; a killed hook's PID lock can be reclaimed (#11223).
+function updateRecord(path, update) {
+  const lock = `${path}.lock`;
+  try { symlinkSync(String(process.pid), lock); }
+  catch {
+    try {
+      const owner = readlinkSync(lock);
+      try { process.kill(Number(owner), 0); return null; }
+      catch (error) { if (error.code !== "ESRCH") return null; }
+      if (readlinkSync(lock) !== owner) return null;
+      unlinkSync(lock);
+      symlinkSync(String(process.pid), lock);
+    } catch { return null; }
+  }
+  try {
+    const next = update(JSON.parse(readFileSync(path, "utf8")));
+    if (!next) return null;
+    const tmp = `${path}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify(next, null, 2));
+    renameSync(tmp, path);
+    return next;
+  } finally { unlinkSync(lock); }
+}
+
+export function claimHandoffFile(path, session, now = Math.floor(Date.now() / 1000)) {
+  let bytes = 0;
+  try { bytes = statSync(session.transcript_path).size; } catch {}
+  return updateRecord(path, record => claimHandoff(record, session, now, bytes, randomUUID()));
+}
+
+export function loadPendingHandoff(project, { claim = true, freshSession = null, dir = handoffDir(), now = Math.floor(Date.now() / 1000) } = {}) {
+  const prefix = `${project}-`;
+  let files;
+  try {
+    files = readdirSync(dir).filter(f => f.startsWith(prefix) && /^\d+\.json$/.test(f.slice(prefix.length)))
+      .sort((a, b) => Number(b.slice(prefix.length, -5)) - Number(a.slice(prefix.length, -5)));
+  } catch { return null; }
+  for (const file of files) {
+    try {
+      const path = join(dir, file);
+      const record = JSON.parse(readFileSync(path, "utf8"));
+      if (record.consumed) continue;
+      if (record.claim?.expiresAt > now) return null;
+      if (!claim) return record;
+      const next = claimHandoffFile(path, freshSession, now);
+      if (!next) return null;
+      const readFirst = readFirstPaths(next.summary || "");
+      writeFileSync(recapStampPath(dir, freshSession.session_id), JSON.stringify({
+        handoffId: next.id, file, token: next.claim.token, ts: now,
+        mode: next.mode === "unattended" ? "unattended" : "attended", readFirst,
+      }));
+      return next;
+    } catch { return null; }
+  }
+  return null;
+}
+
+export function recapStampPath(dir, sid) {
+  return join(dir, `recap-pending-${String(sid).replace(/[^A-Za-z0-9_.-]/g, "_")}.json`);
+}
+
+export function completeHandoffRecap({ sessionId, transcriptPath, dir = handoffDir(), now = Math.floor(Date.now() / 1000) }) {
+  const stampPath = recapStampPath(dir, sessionId);
+  try {
+    const stamp = JSON.parse(readFileSync(stampPath, "utf8"));
+    const file = stamp.file || `${stamp.handoffId}.json`;
+    if (file.includes("/") || file.includes("\\")) return null;
+    let missed = [];
+    const next = updateRecord(join(dir, file), record => {
+      if (record.claim?.session_id !== sessionId || record.claim?.token !== stamp.token) return null;
+      if (record.claim.transcript_path !== transcriptPath) return null;
+      const body = readFileSync(transcriptPath).subarray(record.claim.transcriptBytes).toString("utf8");
+      missed = pathsReadIn(transcriptPath, stamp.readFirst || []).missed;
+      return recapHandoff(record, { sessionId, token: stamp.token, missed,
+        replied: hasAssistantReply(body, record.claim.at) }, now);
+    });
+    if (next) unlinkSync(stampPath);
+    return { recapped: !!next, missed };
+  } catch { return null; }
+}

package/hooks/sessionstart.mjs

@@ -2,7 +2,7 @@
 // trantor SessionStart hook — every session registers with the hub and gets a roster of OTHER live
 // sessions injected, so independent sessions discover each other. Config: env RELAY_URL →
 // ~/.agent-bus/config.json → http://127.0.0.1:4477. Identity: RELAY_SESSION → "<hostname>:<basename(cwd)>".
-import { readFileSync, writeFileSync, existsSync, readdirSync } from "node:fs";
+import { readFileSync, existsSync } from "node:fs";
 import { join, basename, dirname } from "node:path";
 import { homedir, hostname } from "node:os";
 import { execSync, spawn } from "node:child_process";
@@ -10,7 +10,8 @@ import { fileURLToPath } from "node:url";
 import { resolveProject, hostId, resolveHubInfo, knownProjects, nonSeatReason, nestedProjects, handoffDir, readOrchSession, writeOrchSession } from "../lib/project.mjs";
 import { formatSubagentManifest } from "../lib/subagent-manifest.mjs";
 import { updateAvailable, maybeNotifyDesktop, readConfig } from "./lib/update-check.mjs";
-import { renderStateBlock, readFirstPaths, capSummary } from "./lib/handoff.mjs";
+import { renderStateBlock, capSummary } from "./lib/handoff.mjs";
+import { loadPendingHandoff } from "./lib/handoff-claims.mjs";
 import { maybeCheckBalances } from "./lib/balance-check.mjs";
 import { getJSON, signedGet, signedPost, loadIdentity } from "./lib/api.mjs";
 import { ledgerPaths, ensureStart, anchorCursor, writeCursor } from "./lib/inbox-ledger.mjs";
@@ -40,59 +41,6 @@ function buildDoctrineShortForm() {
     `</trantor-build-doctrine>\n`;
 }
 
-// Load the most recent UNCONSUMED handoff for this project; `claim` marks it consumed so exactly one
-// session takes it. A compaction-triggered start may show it but must NOT claim it from the new window.
-function loadPendingHandoff(projectName, { claim = true, freshSession = null } = {}) {
-  try {
-    const dir = handoffDir();   // NEVER join(homedir(), …) here: a drill pointed at a temp bus dir must not claim the real handoffs
-    if (!existsSync(dir)) return null;
-    // Match ONLY "<projectName>-<numeric stamp>.json" (a loose startsWith caught leaked fixtures), and
-    // sort by the numeric stamp, newest first, since a string sort could pick a stale handoff.
-    const re = new RegExp("^" + projectName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "-(\\d+)\\.json$");
-    const files = readdirSync(dir)
-      .map(f => { const m = re.exec(f); return m ? { f, stamp: Number(m[1]) } : null; })
-      .filter(Boolean)
-      .sort((a, b) => b.stamp - a.stamp)
-      .map(x => x.f);
-    for (const f of files) {
-      const p = join(dir, f);
-      const rec = JSON.parse(readFileSync(p, "utf8"));
-      if (!rec.consumed) {
-        if (claim) {
-          // `consumed` is set at hook time, BEFORE the model has read anything, so also record WHO is
-          // taking over: baton-close waits for the successor's first assistant turn before closing the original.
-          rec.consumed = true;
-          rec.consumedAt = nowSec();
-          if (freshSession && (freshSession.session_id || freshSession.transcript_path)) {
-            rec.consumedBy = {
-              session_id: freshSession.session_id || "",
-              transcript_path: freshSession.transcript_path || "",
-            };
-          }
-          // §5 CLAIMED on the machine's ledger (SYSTEM-CONTRACT) and the recap net armed: a recap-pending
-          // stamp names this successor, so a successor that never recaps is mechanically impossible.
-          if (!Array.isArray(rec.states)) rec.states = [];
-          rec.states.push({ state: "claimed", ts: nowSec(), by: freshSession?.session_id || "" });
-          writeFileSync(p, JSON.stringify(rec, null, 2));
-          if (freshSession?.session_id) {
-            try {
-              // #5645: the mandate rides the stamp too, so prompt-focus's recap reminder pins
-              // the SAME rec.mode the injection below announces (attended=WAIT / unattended=RESUME).
-              // #8162: the READ-FIRST list rides the stamp as DATA, so the Stop hook can check the
-              // successor opened it instead of accepting a reply as proof it understood anything.
-              const readFirst = readFirstPaths(rec.summary || "");
-              writeFileSync(join(dir, `recap-pending-${String(freshSession.session_id).replace(/[^A-Za-z0-9_.-]/g, "_")}.json`),
-                JSON.stringify({ handoffId: rec.id, ts: nowSec(), mode: rec.mode === "unattended" ? "unattended" : "attended", readFirst }));
-            } catch {}
-          }
-        }
-        return rec;
-      }
-    }
-  } catch {}
-  return null;
-}
-
 function nowSec() { try { return Number(execSync("date +%s", { encoding: "utf8" }).trim()) || 0; } catch { return 0; } }
 
 function readStdin() {

package/hooks/stop-inbox.mjs

@@ -8,10 +8,12 @@ import { join, dirname } from "node:path";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { homedir } from "node:os";
-import { resolveProject, hostId, handoffDir, busDir } from "../lib/project.mjs";
+import { resolveProject, hostId, busDir } from "../lib/project.mjs";
 import { signedGet } from "./lib/api.mjs";   // signed: enforce hubs 401 unsigned reads — unsigned, T2 delivery is silently dead
 import { ledgerPaths, ensureStart, anchorCursor, writeCursor } from "./lib/inbox-ledger.mjs";
-import { readArm, clearArm, markHandedOff, appendHandoffState, subagentsActive, pathsReadIn} from "./lib/handoff.mjs";
+import { readArm, clearArm, markHandedOff, subagentsActive } from "./lib/handoff.mjs";
+
+import { completeHandoffRecap } from "./lib/handoff-claims.mjs";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 
@@ -125,10 +127,14 @@ async function main() {
   let input = {};
   try { input = JSON.parse(raw || "{}"); } catch {}
 
-  // Loop guard FIRST, before any work: if we already blocked once this stop-cycle, the model has had
-  // its chance to deal with the inbox and is entitled to stop.
-  if (input.stop_hook_active) return allow();
   if (process.env.RELAY_STOP_INBOX === "0") return allow();
+  const recap = completeHandoffRecap({ sessionId: String(input.session_id || ""), transcriptPath: input.transcript_path || "" });
+  if (recap?.missed.length && !input.stop_hook_active) {
+    process.stdout.write(JSON.stringify({ decision: "block", reason: `Read these handoff files before recapping: ${recap.missed.join(", ")}` }));
+    return;
+  }
+  // A retry may satisfy the recap evidence, but must never loop the inbox block (#11223).
+  if (input.stop_hook_active) return allow();
 
   const projectDir = input.cwd || process.env.CLAUDE_PROJECT_DIR || process.cwd();
 
@@ -151,41 +157,6 @@ async function main() {
       process.stderr.write("[trantor] turn boundary reached — firing the armed baton\n");
     }
   } catch {}
-  // §5 RECAPPED (SYSTEM-CONTRACT): this session's FIRST turn boundary after claiming a handoff.
-  // By Stop time an assistant reply exists, and every prompt of that first turn carried the
-  // recap reminder (prompt-focus) — so the reply had the instruction in front of it. Record the
-  // transition on the handoff's own ledger and disarm the net.
-  try {
-    const sid = String(input.session_id || "");
-    if (sid) {
-      const stampPath = join(handoffDir(), `recap-pending-${sid.replace(/[^A-Za-z0-9_.-]/g, "_")}.json`);
-      if (existsSync(stampPath)) {
-        try {
-          const stamp = JSON.parse(readFileSync(stampPath, "utf8"));
-          // #8162: RECAPPED used to mean "a reply exists by Stop time", which a successor satisfies
-          // from the injected summary alone — so a handoff naming read-first files certified a
-          // takeover that opened none of them, three days running. Now the ledger asks the same
-          // question the state gate learned to ask: ground truth, not testimony. A Read/Grep tool
-          // call naming the path is evidence; the successor's own say-so is not.
-          const want = Array.isArray(stamp.readFirst) ? stamp.readFirst : [];
-          const { missed } = want.length
-            ? pathsReadIn(input.transcript_path || "", want)
-            : { missed: [] };
-          if (missed.length) {
-            // The stamp STAYS. Not recapped, so the next boundary asks again — and the successor is
-            // told exactly what it skipped rather than left to discover it when the operator does.
-            process.stderr.write(
-              `[trantor] handoff ${stamp.handoffId}: NOT recapped — the handoff named ${want.length} file(s) to read first and ${missed.length} ${missed.length === 1 ? "was" : "were"} never opened: ${missed.join(", ")}. Read them before going further; this is the context the handoff exists to carry.\n`);
-          } else {
-            appendHandoffState(stamp.handoffId, "recapped", sid);
-            try { unlinkSync(stampPath); } catch {}
-          }
-        } catch {
-          try { unlinkSync(stampPath); } catch {}
-        }
-      }
-    }
-  } catch {}
   // Mirror the other hooks: a home-directory session isn't project work and isn't on the bus.
   if (!process.env.RELAY_SESSION && !process.env.RELAY_PROJECT && projectDir === homedir()) return allow();
 

package/hub/routes/cards.mjs

@@ -6,6 +6,15 @@ const SLIM_DROP = new Set(["log", "history", "checklist"]);
 // #7968: the shape hollow-move.mjs posts — { base, changed[], unindexed[], dependents } or
 // { unavailable: true }; anything else is dropped so a stray payload cannot bloat the log.
 const BLAST_PATHS_MAX = 40;
+// #11142: the fleet-wide cap evicts done/stale cards oldest-first, never an open one.
+const TASK_CAP = 2000, TASK_TRIM_TO = 1750;
+const EVICTABLE = new Set(["done", "stale"]);
+function trimTasks(state) {
+  if (state.tasks.length <= TASK_CAP) return;
+  let drop = state.tasks.length - TASK_TRIM_TO;
+  state.tasks = state.tasks.filter(t => drop <= 0 || !EVICTABLE.has(t.status) || (drop--, false));
+}
+
 function cleanBlast(v) {
   if (!v || typeof v !== "object" || Array.isArray(v)) return null;
   if (v.unavailable) return { unavailable: true };
@@ -153,7 +162,7 @@ export async function routeCards({ req, res, q, P, auth, ctx }) {
           by: b.by || "", ts: ts0, updated: ts0, history: [{ to: target, by: b.by || "", ts: ts0 }] };
         if (bgId) bt._aid = bgId; if (b.agentType) bt._atype = String(b.agentType).slice(0, 40);
         appendTaskNote(bt, b, ts0);
-        state.tasks.push(bt); if (state.tasks.length > 2000) state.tasks.splice(0, 500);
+        state.tasks.push(bt); trimTasks(state);
         appendCardEvent("created", bt, b.by, null, target);
         markDirty(); return json(res, 200, { ok: true, task: bt, created: true });
       }
@@ -180,7 +189,7 @@ export async function routeCards({ req, res, q, P, auth, ctx }) {
       { const dr = cleanDrill(b.drill); if (dr) t.drill = dr; }                        // #6452 — the card's drill line, rides `extra`
       if (b.source === "cc-subagent") { t._fp = subFp(b.title); if (b.agentType) t._atype = String(b.agentType).slice(0, 40); if (b.agentId) t._aid = String(b.agentId).slice(0, 80); if (b.parent) t.parent = String(b.parent).slice(0, 120); t.count = 1; if (t.status === "doing") { t._everStarted = true; t._inflight = 1; } }
       appendTaskNote(t, b, ts0);
-      state.tasks.push(t); if (state.tasks.length > 2000) state.tasks.splice(0, 500);
+      state.tasks.push(t); trimTasks(state);
       appendCardEvent("created", t, b.by, null, st0);
       // A COMMIT closes the focus. A focus card says "this session is working on X right now"; the
       // commit is X arriving, so the card that was rolling forever now completes with the commit
@@ -330,7 +339,7 @@ export async function routeCards({ req, res, q, P, auth, ctx }) {
         if (seen.has(t.todoKey) || t.status === "done") continue;   // keep accomplished work on the board
         state.tasks = state.tasks.filter(x => x.id !== t.id); appendCardEvent("deleted", t, session, null, null); markDirty();
       }
-      if (state.tasks.length > 2000) state.tasks.splice(0, state.tasks.length - 2000);
+      trimTasks(state);
       return json(res, 200, { ok: true, count: todos.length });
     }
     // A REGULAR session's live "focus" card — what THIS session is working on right now, set from each
@@ -375,7 +384,7 @@ export async function routeCards({ req, res, q, P, auth, ctx }) {
           history: [{ to: "doing", by: session, ts: now() }] };
         state.tasks.push(t); appendCardEvent("created", t, session, null, "doing");
         appendEvent("focus", project, session, { taskId: t.id, title, shift: false });
-        if (state.tasks.length > 2000) state.tasks.splice(0, state.tasks.length - 2000);
+        trimTasks(state);
       }
       markDirty(); return json(res, 200, { ok: true, id: t.id, task: t });
     }

package/hub/routes/contract-transfer.mjs

@@ -0,0 +1,58 @@
+function heldMessages(ctx, source, project, pendingIds) {
+  const ids = new Set(pendingIds);
+  const senders = new Set(ctx.state.messages.filter(m => m.to === source && m.project === project).map(m => m.from));
+  for (const sender of senders) {
+    for (const contract of ctx.contractsFor(sender, { project, windowMs: Number.MAX_SAFE_INTEGER })) {
+      if (contract.to !== source) continue;
+      if (!contract.answered && !["ack", "superseded"].includes(contract.disposition)) ids.add(contract.id);
+    }
+  }
+  return ctx.state.messages.filter(m => ids.has(m.id) && m.to === source && m.project === project);
+}
+
+export async function routeContractTransfer({ req, res, q, P, auth, ctx }) {
+  if (P !== "/contracts/transfer") return false;
+  if (!["GET", "POST"].includes(req.method)) return ctx.json(res, 405, { error: "GET or POST required" });
+  const b = req.method === "POST" ? await ctx.body(req) : q;
+  const { from, to, project } = b;
+  if (!project || !from || !to || !from.endsWith(`:${project}`) || !to.endsWith(`:${project}`)) {
+    return ctx.json(res, 400, { error: "source and replacement must belong to the named project" });
+  }
+  const signer = auth?.identity?.name;
+  if (signer && !signer.endsWith(`:${project}`) && auth.identity.kind !== "human") {
+    return ctx.json(res, 403, { error: "swap must be requested from its project" });
+  }
+  // #11221: a seat may never move another seat's work; only the orchestrator or a human swaps.
+  if (signer && auth.identity.kind !== "human" && ctx.state.peers[signer]?.kind !== "orch") {
+    return ctx.json(res, 403, { error: "only the project's orchestrator or a human can swap seats" });
+  }
+  const messages = heldMessages(ctx, from, project, b.pendingIds || []);
+  if (req.method === "GET") return ctx.json(res, 200, { ok: true, messages });
+  if (!ctx.state.peers[b.readySession]?.lastSeen || ctx.state.peers[b.readySession].project !== project) {
+    return ctx.json(res, 409, { error: "replacement has not registered on this project's bus" });
+  }
+  // IDs and original senders survive the move, so replies settle the assigner's original ledger.
+  for (const message of messages) message.to = to;
+  const ids = new Set(messages.map(m => m.id));
+  for (const message of ctx.state.messages) {
+    if (message.project !== project) continue;
+    if (message.kind === "ask" && message.from === from && (ids.has(message.re) || message.id === b.heldAsk)) {
+      message.from = to;
+      for (const answer of ctx.state.messages) {
+        if (answer.re !== message.id || answer.to !== from) continue;
+        answer.to = to;
+        if (!ids.has(answer.id)) { messages.push(answer); ids.add(answer.id); }
+      }
+    }
+  }
+  for (const card of ctx.state.tasks) {
+    if (card.project !== project || card.assignee !== from || !["todo", "doing", "testing", "blocked", "failed"].includes(card.status)) continue;
+    card.assignee = to;
+    card.updated = ctx.now();
+    ctx.appendTaskLog(card, signer || from, `swap reassigned ${from} → ${to}`);
+    ctx.appendCardEvent("updated", card, signer || from);
+  }
+  ctx.appendEvent("crew.swap", project, signer || from, { from, to, moved: [...ids] });
+  ctx.markDirty();
+  return ctx.json(res, 200, { ok: true, moved: [...ids], messages, cursor: ctx.state.seq });
+}

package/hub/routes/messages.mjs

@@ -1,7 +1,9 @@
 /* oxlint-disable anti-slop/no-conditional-empty-object-spread -- SAFETY: Optional message fields must remain absent, not undefined; preserving the existing spread keeps the signed wire shape identical. */
+import { routeContractTransfer } from "./contract-transfer.mjs";
 import { setTimeout, setInterval, clearInterval } from "node:timers";
 
 export async function routeMessages({ req, res, q, P, auth, ctx }) {
+  if (await routeContractTransfer({ req, res, q, P, auth, ctx })) return true;
   const {
     state, body, json, stripNulText, crossProjectGuard, touch, pushToStreams,
     appendEvent, appendCardEvent, appendTaskLog, markDelivered, contractsFor, canUseInboxSession, inboxWindow,

package/lib/turn-policy.mjs

@@ -287,3 +287,15 @@ export function cutChainEvidence(rows) {
 export function isBoundedPark(reason) {
   return !PARKING_REASONS.has(reason);
 }
+
+// #11230: only an ask posted in this turn is delivery; an older unanswered ask cannot excuse it.
+export function askDuringTurn(rows, startedAt) {
+  const asks = rows.filter(row => Number(row.ts) >= startedAt
+    && (row.kind === "ask" || /^❓\s/.test(String(row.text || ""))));
+  return asks.sort((a, b) => Number(b.id) - Number(a.id))[0] || null;
+}
+
+export function askedVerdict(ask) {
+  const firstLine = String(ask.text || "").trim().split(/\r?\n/)[0];
+  return `asked: ${firstLine.replace(/^❓\s*(?:ask(?:s)?(?: on #[0-9]+)?\s*:\s*)?/, "")}`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.78",
+  "version": "0.18.80",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"