trantor 0.18.82 → 0.18.85

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.82",
+  "version": "0.18.85",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/cli.mjs

@@ -103,6 +103,7 @@ switch (cmd) {
   case "watch":   run("bin/relay-watch.mjs"); break;
   case "catchup": run("bin/catchup.mjs"); break;
   case "agents":  run("bin/agents.mjs"); break;
+  case "gate":    run("bin/gate.mjs"); break;
   case "gates":   run("bin/gates.mjs"); break;
   case "backfill": run("bin/git-backfill.mjs"); break;
   case "sweep": run("bin/sweep.mjs"); break;
@@ -250,6 +251,7 @@ switch (cmd) {
   trantor app         the DESKTOP app: status | install | update — pulls the latest DMG from GitHub Releases
   trantor catchup     "where are we?" — the continuous board + git, with a synthesized brief
   trantor agents      what this session's sub-agents did (task · returned? · files written · survived on disk) — [<sessionId>] [--json]
+  trantor gate go|nogo <id>   decide a conflicting file edit
   trantor gates       verification gates: "must verify before shipping" claims that survive handoffs — [--all] [--json]
   trantor backfill    card past GIT work onto the board (solo commits that were never carded) — [--since "14 days ago"] [--dry-run]
   trantor init-hooks  install a git post-commit hook so EVERY commit auto-cards on the board (reliable solo-work backstop) — [--uninstall]

package/bin/crew/state.mjs

@@ -1,4 +1,5 @@
-import { existsSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
 import { seatProcesses, signalProcesses } from "./processes.mjs";
 import { call, listPids, run } from "./core.mjs";
 import { hostId } from "../../lib/project.mjs";
@@ -142,7 +143,21 @@ export async function down(ctx, args, adapters) {
   const removed = new Set(scoped.map(row => `${row.project}|${row.kind}|${row.agent}|${row.handle}`));
   const kept = rows.filter(row => !removed.has(`${row.project}|${row.kind}|${row.agent}|${row.handle}`) || (orchProjects.has(row.project) && ["herdrws", "cmuxws", "orch"].includes(row.kind)));
   writeRows(ctx, kept);
-  console.log(`— crew torn down (${scope})`);
+  const seatRows = scoped.filter(row => !["attach", "cmuxws", "herdrws", "orch"].includes(row.kind));
+  if (!ctx.dry) {
+    const logDir = join(dirname(ctx.statePath), "logs");
+    mkdirSync(logDir, { recursive: true });
+    for (const row of new Map(seatRows.map(row => [`${row.project}/${row.agent}`, row])).values()) {
+      appendFileSync(join(logDir, `${row.agent}-${row.project}.jsonl`),
+        `${JSON.stringify({ ts: Date.now(), agent: row.agent, project: row.project, stopped: true })}\n`);
+    }
+  }
+  if (options.agents.length) {
+    const stopped = [...new Set(seatRows.map(row => row.agent))];
+    const remaining = [...new Set(kept.filter(row => row.project === ctx.project &&
+      !["attach", "cmuxws", "herdrws", "orch"].includes(row.kind)).map(row => row.agent))];
+    console.log(`— ${stopped.join(", ") || options.agents.join(", ")} stopped${remaining.length ? ` (${remaining.join(", ")} still running)` : ""} (${scope})`);
+  } else console.log(`— crew torn down (${scope})`);
   return 0;
 }
 

package/bin/crew-runner.mjs

@@ -2,7 +2,7 @@
 // trantor crew runner — keeps a crew agent alive without burning tokens: it long-polls the bus
 // (zero tokens) and resumes the CLI with each message. Usage: node crew-runner.mjs <agent> [dir]
 import { execSync, spawnSync, spawn } from "node:child_process";
-import { readFileSync, writeFileSync, unlinkSync, existsSync, appendFileSync, mkdirSync, realpathSync } from "node:fs";
+import { readFileSync, writeFileSync, unlinkSync, existsSync, appendFileSync, mkdirSync, realpathSync, statSync } from "node:fs";
 import { join, basename } from "node:path";
 import { homedir } from "node:os";
 import { resolveProject, resolveHub, withEnvFiles, hostId } from "../lib/project.mjs";
@@ -26,12 +26,14 @@ import {
   senderProjectOf, isLinkedProject, stateSkipReason, isMessageCardTitle, OPEN_CARD_STATUSES,
   CUT_CHAIN_PARK_MIN, cutChainEvidence, isBoundedPark, askDuringTurn, askedVerdict,
 } from "../lib/turn-policy.mjs";
+import { snapshotBeforeCut } from "./cut-snapshot.mjs";
 import { ocTurnUsage, dshTurnUsage, usageTotal } from "../lib/turn-usage.mjs";
 import { listContainers, newContainers, recordContainers, statePathFor as dockerStatePathFor, sweep as dockerSweep } from "../lib/docker-janitor.mjs";
 import {
   auditDutyNudges, claimDutyNudges, claudeTranscriptDir, dutyEscalations, dutyNudgeDirective,
-  observedDutyNudgeIds, requeueMissingWakeMessages, shedExpiredHubAlerts,
+  observedDutyNudgeIds, requeueMissingWakeMessages, releaseDutyNudgeClaims, shedExpiredHubAlerts,
 } from "../lib/duty-nudges.mjs";
+import { reserveNudgeIds, releaseNudgeIds } from "../lib/nudge-ledger.mjs";
 import { dutyRecipientResolver } from "../lib/duty-recipient.mjs";
 import { cliEffortFlag } from "../lib/model-catalog.mjs";
 import {
@@ -43,7 +45,35 @@ import { resolveStateFlags } from "../lib/state/flags.mjs";
 
 import { awaitSwapRelease } from "./crew/stage.mjs";
 
-await awaitSwapRelease();
+const releaseState = process.env.CREW_RELEASE_STATE ? JSON.parse(process.env.CREW_RELEASE_STATE) : null;
+delete process.env.CREW_RELEASE_STATE;
+const packagePath = new URL("../package.json", import.meta.url);
+function installedVersion() {
+  try {
+    statSync(packagePath);
+    return JSON.parse(readFileSync(packagePath, "utf8")).version;
+  } catch { return ""; }
+}
+const bootVersion = installedVersion();
+const attemptedVersions = new Set(releaseState?.attempted || []);
+function newerVersion(next, previous) {
+  const parse = value => /^(\d+)\.(\d+)\.(\d+)(?:-([\w.-]+))?(?:\+[\w.-]+)?$/.exec(value || "");
+  const a = parse(next), b = parse(previous);
+  if (!a || !b) return false;
+  for (let i = 1; i <= 3; i++) if (+a[i] !== +b[i]) return +a[i] > +b[i];
+  if (!a[4] || !b[4]) return !!b[4] && !a[4];
+  const ap = a[4].split("."), bp = b[4].split(".");
+  for (let i = 0; i < Math.max(ap.length, bp.length); i++) {
+    if (ap[i] === bp[i]) continue;
+    if (ap[i] === undefined || bp[i] === undefined) return bp[i] === undefined;
+    const an = /^\d+$/.test(ap[i]), bn = /^\d+$/.test(bp[i]);
+    if (an && bn) return +ap[i] > +bp[i];
+    if (an !== bn) return bn;
+    return ap[i] > bp[i];
+  }
+  return false;
+}
+if (!releaseState) await awaitSwapRelease();
 const AGENT = process.env.CREW_SWAP_AGENT || process.argv[2];
 const DIR = process.argv[3] || process.cwd();
 // Crew agents MUST share the orchestrator's project key (one repo = one lane).
@@ -126,10 +156,10 @@ process.on("unhandledRejection", (e) => { console.log(`\x1b[31m[runner] UNHANDLE
 const log = (s) => console.log(`\x1b[38;5;43m[runner]\x1b[0m ${redactKeys(String(s))}`);
 const LOGDIR = join(homedir(), ".agent-bus", "logs");
 try { mkdirSync(LOGDIR, { recursive: true }); } catch {}
-let TURN = 0;
+let TURN = releaseState?.turn || 0;
 const telemetry = (rec) => { try { appendFileSync(join(LOGDIR, `${AGENT}-${PROJ}.jsonl`), JSON.stringify(rec) + "\n"); } catch {} };
 // The boot line records the HUB this runner bound to, so a split-brain is diagnosable from disk.
-telemetry({ ts: Date.now(), agent: AGENT, project: PROJ, boot: true, hub: HUB });
+telemetry({ ts: Date.now(), agent: AGENT, project: PROJ, boot: true, hub: HUB, pid: process.pid, version: bootVersion });
 // A seat can open a terminal window on a machine whose owner never asked for one and does not know
 // what they are looking at. "◤ CLAUDE ◢ trantor crew · fleet" tells that person nothing: not what
 // started, not what it will do, not how to stop it. RUNNER_TITLE names it in full and RUNNER_ABOUT
@@ -258,7 +288,7 @@ const EFFORT_FLAG = EFFORT ? cliEffortFlag(DRIVER, EFFORT) : { flag: "", text: "
 
 // RUNNER_RULES / RUNNER_KICKOFF env overrides: the runner is also the substrate for non-crew
 // always-on seats (the fleet DUTY agent, bin/duty.mjs) whose doctrine is not "work your card".
-const RULES = process.env.RUNNER_RULES || `Rules: you are ${SESSION} on the trantor crew. Before starting a card, read YOUR card: relay_board with card:<id> (the card, its deps, its notes, and the last five done cards whose title shares a word); never the whole board. If your wake names no card id (or cites only a message-card), make relay_board with mine:true your FIRST call — it lists the cards assigned to you (doing/testing/todo, newest first, full card shape); work your newest one (#7763). Work your assigned file(s), report on the bus (relay_send, <280 chars), move your Kanban card as you go with a NOTE saying what you did (doing -> testing, then STOP: you never close your own card to done — the orchestrator runs the card's drill on the built artifact and closes it, and the hub refuses a move to done on a card with no drill line anyway; in 'testing' run YOUR OWN test file — never the full npm test, suites collide across seats — plus \`node bin/slop-gate.mjs\` when the repo has one: it lints ONLY your changed files against the anti-slop rules, and a card must not reach testing with slop-gate failing; use 'failed' + a report if anything breaks). If your work starts containers or a dev server (\`supabase start\`, \`docker run\`, a watch process), stop them before moving your card to testing and name them in the note — the runner also stops containers it saw your turn create when the card closes, but the first responsibility is yours (#9778). If a contract omits a fact you cannot proceed without, ASK — never invent the value: relay_ask(<card>, <question>) blocks the card with your question, keeps the turn owed (no park, no failure), and resumes you when the assigner's answer lands; an invented value that reads as reasoned is the worst outcome this crew ships (#7756). If you need something from another session, message THAT SESSION (relay_peers to find its id, relay_send to reach it) — never ask the human to pass it along; carrying messages between agents is the job this bus exists to remove. When your work for THIS message is finished, END YOUR TURN — do NOT park, do NOT loop relay_wait; the runner waits for you and will wake you with the next message. Path discipline: build/test from your worktree root ${TURN_DIR} with absolute paths or --manifest-path/--prefix instead of cd-ing into subdirs, and put anything that must land outside the repo under ${TURN_DIR}/.agent-bus-out/ (gitignored) — never ~/.agent-bus. Realigning your seat branch after the orchestrator harvested your commits is \`trantor sync\` run from your worktree: it reads the harvest receipts and refuses when an unharvested commit would be lost, so never reset or rebase onto main by hand. A contract's \`base: <sha>\` line is the integration head: start your seat branch at that sha (\`git reset --hard <sha>\` on the fresh branch), never at origin/main, which trails the orchestrator's unpushed integration commits; the object is already here as the ref \`main\`. If \`git cat-file -e <sha>\` fails, say \`cannot resolve base <sha>\` on the bus and move the card to blocked instead of reasoning from origin/main. Every testing/done note names the sha you verified against as \`verified at <sha>\`; a note without it is flagged HOLLOW. Cross-project action is a breach: never \`trantor up\` a crew, register a seat, or send a card/contract into a project other than ${PROJ} unless the operator ran \`trantor policy link ${PROJ} <other> --reason "<why>"\` first — the hub, the CLI and this runner all refuse it mechanically, so ask the operator to link the projects instead of routing around the refusal.`;
+const RULES = process.env.RUNNER_RULES || `Rules: you are ${SESSION} on the trantor crew. Before starting a card, read YOUR card: relay_board with card:<id> (the card, its deps, its notes, and the last five done cards whose title shares a word); never the whole board. If your wake names no card id (or cites only a message-card), make relay_board with mine:true your FIRST call — it lists the cards assigned to you (doing/testing/todo, newest first, full card shape); work your newest one (#7763). After long read-only recon, commit a WIP note with findings so the turn leaves evidence. Work your assigned file(s), report on the bus (relay_send, <280 chars), move your Kanban card as you go with a NOTE saying what you did (doing -> testing, then STOP: you never close your own card to done — the orchestrator runs the card's drill on the built artifact and closes it, and the hub refuses a move to done on a card with no drill line anyway; in 'testing' run YOUR OWN test file — never the full npm test, suites collide across seats — plus \`node bin/slop-gate.mjs\` when the repo has one: it lints ONLY your changed files against the anti-slop rules, and a card must not reach testing with slop-gate failing; use 'failed' + a report if anything breaks). If your work starts containers or a dev server (\`supabase start\`, \`docker run\`, a watch process), stop them before moving your card to testing and name them in the note — the runner also stops containers it saw your turn create when the card closes, but the first responsibility is yours (#9778). If a contract omits a fact you cannot proceed without, ASK — never invent the value: relay_ask(<card>, <question>) blocks the card with your question, keeps the turn owed (no park, no failure), and resumes you when the assigner's answer lands; an invented value that reads as reasoned is the worst outcome this crew ships (#7756). If you need something from another session, message THAT SESSION (relay_peers to find its id, relay_send to reach it) — never ask the human to pass it along; carrying messages between agents is the job this bus exists to remove. When your work for THIS message is finished, END YOUR TURN — do NOT park, do NOT loop relay_wait; the runner waits for you and will wake you with the next message. Path discipline: build/test from your worktree root ${TURN_DIR} with absolute paths or --manifest-path/--prefix instead of cd-ing into subdirs, and put anything that must land outside the repo under ${TURN_DIR}/.agent-bus-out/ (gitignored) — never ~/.agent-bus. Realigning your seat branch after the orchestrator harvested your commits is \`trantor sync\` run from your worktree: it reads the harvest receipts and refuses when an unharvested commit would be lost, so never reset or rebase onto main by hand. A contract's \`base: <sha>\` line is the integration head: start your seat branch at that sha (\`git reset --hard <sha>\` on the fresh branch), never at origin/main, which trails the orchestrator's unpushed integration commits; the object is already here as the ref \`main\`. If \`git cat-file -e <sha>\` fails, say \`cannot resolve base <sha>\` on the bus and move the card to blocked instead of reasoning from origin/main. Every testing/done note names the sha you verified against as \`verified at <sha>\`; a note without it is flagged HOLLOW. Cross-project action is a breach: never \`trantor up\` a crew, register a seat, or send a card/contract into a project other than ${PROJ} unless the operator ran \`trantor policy link ${PROJ} <other> --reason "<why>"\` first — the hub, the CLI and this runner all refuse it mechanically, so ask the operator to link the projects instead of routing around the refusal.`;
 
 // ---- the pulse --------------------------------------------------------------
 // RUNNER_PULSE_MS re-runs an orchestrator seat's mission note on a cadence when the bus is silent;
@@ -713,9 +743,9 @@ let cutChain = [];
 const PARK_WINDOW_MS = Math.max(0, Number(process.env.TRANTOR_PARK_WINDOW_MS || 15 * 60 * 1000));
 // The card the CURRENT CLI session belongs to (#6134). 0 = the kickoff session, which belongs to
 // no card, so the first contract that names one starts a session of its own.
-let sessionCard = 0;
+let sessionCard = releaseState?.sessionCard || 0;
 
-let sid = "";
+let sid = releaseState?.sid || "";
 // #6206: the watchdog is DETACHED, so a runner that dies without ending it leaves an orphan
 // sleeping toward a false alarm against whatever runner comes next.
 // Every exit path therefore kills it, and the stamp carries this runner's instance id so any
@@ -755,11 +785,12 @@ async function runTurn(prompt, isFirst, trigger = "kickoff", opts = {}) {
   // #10197: the card status snapshot the turn is judged against at its end — a move to
   // testing/done under the turn is delivery even without a commit. null = the hub read failed:
   // the delivery check stands down rather than claim no-delivery on a transport error.
-  let cardStatusBefore = null;
+  let cardStatusBefore = null, cardLogBefore = [];
   if (!opts.state && sessionCard > 0) {
     try {
       const { task } = await api(`/card?project=${encodeURIComponent(PROJ)}&id=${sessionCard}`);
       cardStatusBefore = task ? String(task.status || "") : null;
+      cardLogBefore = task?.log || [];
     } catch { cardStatusBefore = null; }
   }
   // #9778: the docker snapshot the turn is judged against — containers the CLI spawns are recorded
@@ -833,7 +864,11 @@ async function runTurn(prompt, isFirst, trigger = "kickoff", opts = {}) {
   const DRAINF = join(homedir(), ".agent-bus", `turndrain-${AGENT}-${PROJ}`);
   try { unlinkSync(DRAINF); } catch {}
   try {
-    writeFileSync(STAMPF, JSON.stringify({ turn: TURN, startedAt: Date.now(), runner: RUNNER_ID, box: boxPlan }));
+    const activity = cli.pinned || ["kimi", "claude"].includes(AGENT) ? {
+      kind: cli.pinned ? "opencode" : AGENT, sid, db: OC_DB, workDir: TURN_DIR,
+      home: homedir(), startedAt: t0, transcriptDir: TRANSCRIPT_DIR,
+    } : undefined;
+    writeFileSync(STAMPF, JSON.stringify({ turn: TURN, startedAt: Date.now(), runner: RUNNER_ID, box: boxPlan, activity }));
     const wd = spawn(process.execPath, [join(import.meta.dirname, "turn-watchdog.mjs"), STAMPF, ERRF, String(WD_MS), SESSION, PROJ, HUB, TRANSCRIPT_DIR, TURN_DIR,
       // #7752: the stall marker only exists when a box does — with no box there is no sweep to
       // end the turn, so the watchdog stays report-only (reporting is the whole job, boxless).
@@ -851,6 +886,8 @@ async function runTurn(prompt, isFirst, trigger = "kickoff", opts = {}) {
   // #7752: the box POLLS instead of one long sleep — the watchdog's stall marker (a silent
   // turn) breaks the loop at the stall window, the deadline breaks it at the full box, and only
   // the deadline path writes CUTF so the runner can tell the two cuts apart.
+  const shellArg = value => "'" + String(value).replaceAll("'", "'\"'\"'") + "'";
+  const snapshotCmd = [process.execPath, join(import.meta.dirname, "cut-snapshot.mjs"), TURN_DIR].map(shellArg).join(" ");
   const box = TURN_MAX_MS ? `
 ${sweep}
 ( trap 'kill "$sleeppid" 2>/dev/null; wait "$sleeppid" 2>/dev/null; exit 0' TERM
@@ -863,12 +900,25 @@ ${sweep}
     wait "$sleeppid"
   done
   kill -0 $job 2>/dev/null || exit 0
+  reason=stall
+  [ -f "${STALLF}" ] || reason=box
+  ${snapshotCmd} "$reason" 2>> ${ERRF}
   [ -f "${STALLF}" ] || : > ${CUTF}
   sweep $job
 ) >/dev/null 2>&1 & boxpid=$!` : "\nboxpid=";
+  const backstop = TURN_MAX_MS ? `
+${sweep}
+backstop() {
+  [ -n "$boxpid" ] && kill $boxpid 2>/dev/null
+  ${snapshotCmd} box 2>> ${ERRF}
+  : > ${CUTF}
+  sweep $job
+  exit 137
+}
+trap backstop TERM` : "";
   const shell = `set -o pipefail
 { ${inner} ; } 2> >(${SCRUB} --tee2 ${ERRF}; : >> "${DRAINF}") &
-job=$!${box}
+job=$!${box}${backstop}
 wait $job; turn_exit=$?
 [ -n "$boxpid" ] && kill $boxpid 2>/dev/null
 wait
@@ -890,10 +940,9 @@ exit $turn_exit`;
       TRANTOR_TRANSCRIPT_DIR: TRANSCRIPT_DIR },
     maxBuffer: 16 * 1024 * 1024,
   };
-  // A BACKSTOP only, deliberately later than the shell's own box: if bash itself wedges, node
-  // still ends the turn. When the in-shell box works — the normal path — this never fires, which
-  // is the point: the shell kills while the tree is still walkable, node cannot.
-  if (TURN_MAX_MS) { spawnOpts.timeout = (TURN_EXTENSIONS_MAX ? TURN_CEILING_MS : TURN_MAX_MS) + 30000; spawnOpts.killSignal = "SIGKILL"; }
+  // The timeout signals the shell to snapshot before sweeping, just like the normal box.
+  // Its 30s margin keeps it out of the normal cut path.
+  if (TURN_MAX_MS) { spawnOpts.timeout = (TURN_EXTENSIONS_MAX ? TURN_CEILING_MS : TURN_MAX_MS) + 30000; spawnOpts.killSignal = "SIGTERM"; }
   const r = spawnSync("/bin/bash", ["-c", shell], spawnOpts);
   // The shell's box leaves the marker; the backstop leaves an ETIMEDOUT. Either way the turn was
   // cut, not merely failed. A stall marker (#7752) outranks the box marker: a turn silent for
@@ -918,6 +967,8 @@ exit $turn_exit`;
   killWatchdog();                        // #6206: turn over — the watchdog dies NOW, it does not sleep on
   try { unlinkSync(STAMPF); } catch {}   // disarm any survivor: the stamp is gone
   if (cut) {
+    const saved = snapshotBeforeCut(TURN_DIR, stallCut ? "stall" : "box");
+    if (!saved.ok) log(`cut WIP snapshot failed: ${saved.error}`);
     // Belt and braces after the shell's descendant sweep: anything still sharing the turn's group.
     if (r.pid) { try { process.kill(-r.pid, "SIGKILL"); } catch {} }
     try { unlinkSync(CUTF); } catch {}
@@ -1041,17 +1092,24 @@ exit $turn_exit`;
   // turn started, or the card moved to testing/done under it. The ibkr shape (exit 0, output, no
   // commit, card still todo) is NO-DELIVERY: the ledger names it and the contract stays owed.
   // Judged on hub reads of the card status; a failed read keeps today's label, never no-delivery.
-  let cardStatusAtEnd = "", noDelivery = false;
+  let cardStatusAtEnd = "", noDelivery = false, blockedVerdict = "";
   if (!cut && !opts.state && realExit === 0 && effExit === 0 && sessionCard > 0 && cardStatusBefore !== null) {
     let endStatus = null;
     try {
       const { task } = await api(`/card?project=${encodeURIComponent(PROJ)}&id=${sessionCard}`);
       endStatus = task ? String(task.status || "") : null;
+      const freshNote = (task?.log || []).filter(n => n.by === SESSION && n.ts >= t0
+        && !cardLogBefore.some(old => old.ts === n.ts && old.by === n.by && old.text === n.text)).at(-1);
+      if (endStatus === "blocked" && (cardStatusBefore !== "blocked" || freshNote)) {
+        const note = freshNote || (task?.log || []).at(-1);
+        blockedVerdict = `blocked: ${String(note?.text || "").split(/\r?\n/)[0]}`;
+        lastEmptyTurn = false;
+      }
     } catch { endStatus = null; }
     if (endStatus !== null) {
       cardStatusAtEnd = endStatus;
       const moved = ["testing", "done"].includes(endStatus) && !["testing", "done"].includes(cardStatusBefore);
-      noDelivery = !newCommit && !moved && !askVerdict;
+      noDelivery = !newCommit && !moved && !askVerdict && !blockedVerdict;
     }
   }
   lastNoDelivery = noDelivery;
@@ -1063,6 +1121,7 @@ exit $turn_exit`;
   // reads as the sweep's SIGKILL (#7099); a zero-usage turn names its own verdict too (#9724).
   const verdict = stallCut ? stallVerdict() : zeroUsage ? zeroUsageVerdict()
     : askVerdict ? askVerdict
+    : blockedVerdict ? blockedVerdict
     : noDelivery ? noDeliveryVerdict(sessionCard, cardStatusAtEnd || "unknown")
     : verdictFor(realExit, effExit, lastEmptyOutput, ownOut, lastEmptyTurn, cut);
   // #6289: every ledger row names in ONE field what happened to the turn — cut, stalled (#7752),
@@ -1070,7 +1129,7 @@ exit $turn_exit`;
   // binds the row to the card the turn worked (0 = kickoff/pulse) so the seat record attributes
   // empty/stalled turns to the card that produced nothing. `cut` stays too: the drills read it.
   const outcome = cut ? (stallCut ? "stalled" : "cut") : (effExit !== 0 ? "api-error" : noDelivery ? "no-delivery" : lastEmptyTurn ? "empty" : "completed");
-  const finalOutcome = askVerdict ? "asked" : outcome;
+  const finalOutcome = askVerdict ? "asked" : blockedVerdict ? "blocked" : outcome;
   const telemetryRow = { ts: Date.now(), agent: AGENT, project: PROJ, turn: TURN, trigger, card: sessionCard || 0, model: MODEL || "cli-default", duration_ms: Date.now() - t0, exit: realExit, effExit, authFailed: effExit !== realExit, emptyOutput: lastEmptyOutput, emptyTurn: lastEmptyTurn, verdict, outcome: finalOutcome, tokens };
   if (usage) telemetryRow.usage = usage;
   if (dockerNew.length) telemetryRow.containers = dockerNew.map(c => c.name || c.id);
@@ -1311,7 +1370,8 @@ async function resolveWakeCard(messages, { session }) {
   await loadLessons();
   // start cursor at the CURRENT tip so we don't replay history
   let cursor = 0;
-  if (process.env.CREW_SWAP_STAGE) cursor = JSON.parse(readFileSync(`${process.env.CREW_SWAP_STAGE}.release`, "utf8")).cursor;
+  if (releaseState) cursor = releaseState.cursor;
+  else if (process.env.CREW_SWAP_STAGE) cursor = JSON.parse(readFileSync(`${process.env.CREW_SWAP_STAGE}.release`, "utf8")).cursor;
   else try { const r = await api(`/inbox?session=${encodeURIComponent(SESSION)}&since=0`); cursor = r.cursor || 0; } catch {}
   // kind "agent" on every beat (#6075): the peer row's kind is the hub's OWN record of what a
   // session is — the overseer's declared-crew exemption reads it, and on the remote hub there is
@@ -1337,7 +1397,7 @@ async function resolveWakeCard(messages, { session }) {
   // #7914: a park belongs to the runner that made it. This process is starting fresh and will
   // re-park if the CLI is still cutting, so a record left by the runner before it is stale state —
   // and stale state in a health read is the same failure as no state at all.
-  try { unlinkSync(PARKF); } catch {}
+  if (!releaseState) { try { unlinkSync(PARKF); } catch {} }
   seenLedger = restored.seen;
   if (seenLedger.length) log(`\x1b[33m${seenLedger.length} consumed message id(s) restored from the pending file — the poll keeps standing down on them\x1b[0m`);
   if (restored.ask) {
@@ -1357,25 +1417,54 @@ async function resolveWakeCard(messages, { session }) {
     // disagreeing makes a health check lie.
     savePending(pendingWake, pendingBcast);
   }
-  let retryAt = 0;            // 0 = deliver at the next opportunity
-  let deliveryFails = 0;      // consecutive failed attempts at the SAME pending batch
-  let noDeliveryRetry = false;
+  let retryAt = releaseState?.retryAt || 0;            // 0 = deliver at the next opportunity
+  let deliveryFails = releaseState?.deliveryFails || 0;      // consecutive failed attempts at the SAME pending batch
+  let noDeliveryRetry = releaseState?.noDeliveryRetry || false;
+  askReleased = releaseState?.askReleased || false;
   if (pendingWake.length) log(`\x1b[33m${pendingWake.length} message(s) survived from a previous run — redelivering\x1b[0m`);
 
   // #7060: the turn the boot line was read as a promise about. It is a transcript turn by
   // construction and now says so, in the same breath as the line that armed the mode.
-  stateSkip("kickoff");
-  const ec0 = await runTurn(composedTurn({ base: KICKOFF, lessons: pickLessons(LESSONS_RAW, "") }), true, "kickoff");
-  if (ec0) await reportFailure(ec0, "kickoff", pendingWake.length);   // a failed kickoff = the "fired up, died, nobody knew" case
-  // #7778: the kickoff is a turn like any other — a message that landed mid-kickoff and was read
-  // through the session's own inbox is consumed by a successful kickoff, and the first poll must
-  // not wake on it. Same reconcile, same clean-boundary rule as deliverWake below.
-  else await reconcileSessionReads(cursor);
-  let lastTurnAt = Date.now();
+  if (!releaseState) {
+    stateSkip("kickoff");
+    const ec0 = await runTurn(composedTurn({ base: KICKOFF, lessons: pickLessons(LESSONS_RAW, "") }), true, "kickoff");
+    if (ec0) await reportFailure(ec0, "kickoff", pendingWake.length);   // a failed kickoff = the "fired up, died, nobody knew" case
+    // #7778: the kickoff is a turn like any other — a message that landed mid-kickoff and was read
+    // through the session's own inbox is consumed by a successful kickoff, and the first poll must
+    // not wake on it. Same reconcile, same clean-boundary rule as deliverWake below.
+    else await reconcileSessionReads(cursor);
+  } else {
+    const text = `runner restarted onto ${bootVersion}`;
+    log(text);
+    telemetry({ ts: Date.now(), text, version: bootVersion });
+    await api("/send", { from: SESSION, to: "all", project: PROJ, kind: "status", text }).catch(() => {});
+  }
+  let lastTurnAt = releaseState?.lastTurnAt || Date.now();
+  function restartForRelease() {
+    const version = installedVersion();
+    if (!newerVersion(version, bootVersion) || attemptedVersions.has(version)) return;
+    attemptedVersions.add(version);
+    // SAFETY: older supported Node releases lack in-place exec; never replace it with a duplicate runner.
+    // oxlint-disable-next-line anti-slop/no-runtime-typeof
+    if (typeof process.execve !== "function") {
+      log(`runner upgrade to ${version} requires Node with process.execve; restart manually`);
+      return;
+    }
+    try {
+      // Persist before exec: a held contract and a released ask both survive the boundary.
+      writeFileSync(PENDF, JSON.stringify({ agent: AGENT, project: PROJ, ts: Date.now(),
+        wake: pendingWake, bcast: pendingBcast, seen: seenLedger, ask: awaitingAsk?.id || 0, askTo: awaitingAsk?.to || "" }));
+      const state = { cursor, turn: TURN, sid, sessionCard, retryAt, deliveryFails,
+        noDeliveryRetry, askReleased, lastTurnAt, attempted: [...attemptedVersions] };
+      process.execve(process.execPath, [process.execPath, ...process.execArgv, ...process.argv.slice(1)],
+        { ...process.env, CREW_RELEASE_STATE: JSON.stringify(state) });
+    } catch (error) { log(`runner restart failed: ${error.message}`); }
+  }
   if (PULSE_MS) log(`pulse armed — mission re-read every ${Math.round(PULSE_MS / 1000)}s (${MISSION_FILE})`);
   log(`parked — long-polling the bus as ${SESSION} (free; this poll is also the heartbeat)`);
 
   while (true) {
+    restartForRelease();
     // pulse first: a due mission beat runs even on a silent bus. Measured from the END of the
     // last turn, so a long turn doesn't stack an immediate pulse on top of itself.
     if (PULSE_MS && Date.now() - lastTurnAt >= PULSE_MS) {
@@ -1545,6 +1634,7 @@ async function resolveWakeCard(messages, { session }) {
     } catch { return 0; }
   }
   async function deliverWake() {
+    restartForRelease();
     noDeliveryRetry = false;
     // #7756: captured and cleared HERE so an early return below never leaks the flag into a
     // later turn — only the turn the answer released reads it.
@@ -1570,6 +1660,22 @@ async function resolveWakeCard(messages, { session }) {
         },
       })
       : { items: [], targets: [], owner: "" };
+    // #11355: the shared pre-send ledger — the wake daemon stamps the same files, so of the two
+    // orchestrator-wake nudgers exactly one send per unread id lands; skipped ids release this
+    // path's claim and never reach the seat, so the existing consumed-without-a-wake branch fires.
+    const dutyOwner = dutyPlan.owner;
+    const skippedNudgeIds = [];
+    for (const target of dutyPlan.targets) {
+      const reserve = await reserveNudgeIds({ recipient: target.recipient, ids: target.ids, owner: dutyOwner });
+      target.ids = reserve.allowed;
+      skippedNudgeIds.push(...reserve.skipped.map(s => s.id));
+    }
+    if (skippedNudgeIds.length) {
+      const skippedSet = new Set(skippedNudgeIds);
+      dutyPlan.items = dutyPlan.items.filter(item => !skippedSet.has(item.id));
+      dutyPlan.targets = dutyPlan.targets.filter(target => target.ids.length);
+      await releaseDutyNudgeClaims({ ids: skippedNudgeIds, statePath: DUTY_NUDGE_STATE, owner: dutyOwner });
+    }
     const claimedIds = new Set(dutyPlan.items.map(item => item.id));
     const wakeForTurn = DUTY_NUDGES
       ? wake.filter(message => {
@@ -1692,6 +1798,11 @@ async function resolveWakeCard(messages, { session }) {
         },
       });
       skippedNudges = audit.missing;
+      // #11355: the ledger mirrors the claim release — a duty turn that ended without the send
+      // must not silence the wake daemon for the TTL.
+      for (const target of audit.missing) {
+        await releaseNudgeIds({ recipient: target.recipient, ids: target.ids, owner: dutyOwner });
+      }
     }
     if (!ec && skippedNudges.length) {
       deliveryFails++;

package/bin/cut-snapshot.mjs

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+// The shell calls this before every destructive turn sweep (#10497).
+import { spawnSync } from "node:child_process";
+import { realpathSync } from "node:fs";
+import { pathToFileURL } from "node:url";
+
+export function snapshotBeforeCut(workDir, reason = "stall") {
+  const git = args => {
+    const r = spawnSync("git", args, { cwd: workDir, encoding: "utf8", timeout: 20000 });
+    if (r.status !== 0) throw new Error(String(r.stderr || r.error || "git failed").trim());
+    return r.stdout;
+  };
+  try {
+    // Never capture a parent checkout when a CLI was launched in a nested scratch directory.
+    const top = git(["rev-parse", "--show-toplevel"]).trim();
+    if (realpathSync(top) !== realpathSync(workDir)) return { ok: true, files: 0 };
+    const branch = git(["symbolic-ref", "--short", "HEAD"]).trim();
+    const status = git(["status", "--porcelain=v1", "-z", "--untracked-files=all"]);
+    if (!status) return { ok: true, files: 0 };
+    if (!branch.startsWith("seat/")) return { ok: false, error: `dirty branch ${branch} is not a seat branch` };
+    let files = 0;
+    const rows = status.split("\0");
+    for (let i = 0; i < rows.length; i++) {
+      if (!rows[i]) continue;
+      files++;
+      if (/^[RC]|^.[RC]/.test(rows[i])) i++;
+    }
+    git(["add", "-A"]);
+    git(["-c", "core.hooksPath=/dev/null", "-c", "commit.gpgsign=false", "commit", "-m", `wip: cut at ${reason}, ${files} files`]);
+    return { ok: true, files, sha: git(["rev-parse", "HEAD"]).trim() };
+  } catch (e) { return { ok: false, error: e.message }; }
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const result = snapshotBeforeCut(process.argv[2], process.argv[3]);
+  if (!result.ok) console.error(`cut snapshot failed: ${result.error}`);
+  process.exit(result.ok ? 0 : 1);
+}

package/bin/gate.mjs

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { loadOrCreate } from "../lib/identity.mjs";
+import { sfetchJson } from "../lib/signed-fetch.mjs";
+import { resolveProject } from "../lib/project.mjs";
+import { relayUrl } from "../hooks/lib/api.mjs";
+
+const [status, rawId] = process.argv.slice(2);
+const id = Number(rawId);
+if (!["go", "nogo"].includes(status) || !Number.isInteger(id) || id <= 0) {
+  console.error("usage: trantor gate go|nogo <id>");
+  process.exit(1);
+}
+let config = {};
+try { config = JSON.parse(readFileSync(join(process.env.AGENT_BUS_DIR || join(homedir(), ".agent-bus"), "config.json"), "utf8")); } catch {}
+const identity = loadOrCreate(config.ownerIdentity || "admin", "human");
+try {
+  const project = resolveProject(process.cwd());
+  const r = await sfetchJson(`${relayUrl(project)}/hold/decide`, {
+    method: "POST", identity, payload: { id, status, project }, signal: AbortSignal.timeout(8000),
+  });
+  const result = await r.json();
+  if (!r.ok) throw new Error(result.error || `HTTP ${r.status}`);
+  console.log(`#${id}: ${status} — ${result.hold.file}`);
+} catch (error) {
+  console.error(error.message);
+  process.exit(1);
+}

package/bin/turn-watchdog.mjs

@@ -5,6 +5,7 @@
 //   node bin/turn-watchdog.mjs <stampFile> <errFile> <windowMs> <session> <project> <hubUrl> <transcriptDir> <workDir> [stallFile] [turnStateFile]
 import { readFileSync, writeFileSync, appendFileSync, statSync, readdirSync } from "node:fs";
 import { join } from "node:path";
+import { sessionActivityReader } from "../lib/session-liveness.mjs";
 import { hostId } from "../lib/project.mjs";
 import { signedPost } from "../hooks/lib/api.mjs";
 import { refreshTurnLiveness } from "../lib/turnstate.mjs";
@@ -41,6 +42,7 @@ function newestMtime(dir) {
 
 const armed = readStamp();
 if (!armed) process.exit(0);
+const sessionActivity = armed.activity ? sessionActivityReader(armed.activity) : () => 0;
 // The runner instance that armed us (pid + boot ts, so a recycled pid cannot impersonate it).
 // A stamp without a runner id (only possible mid-upgrade) skips the liveness check; the id
 // match in the loop still guards it.
@@ -56,6 +58,7 @@ const describeLast = (b) => {
   const parts = [];
   if (b.wk) parts.push(`worktree ${ago(b.wk)}`);
   if (b.tr) parts.push(`transcript ${ago(b.tr)}`);
+  if (b.cli) parts.push(`CLI session ${ago(b.cli)}`);
   return parts.length ? parts.join(", ") : "nothing";
 };
 let baseErr = errSize();
@@ -109,24 +112,25 @@ if (stallFile) {
     const size = errSize();
     if (size > baseErr + 200) { baseErr = size; lastErrAt = now; }   // new bytes: alive
     const freshCut = Math.max(armedAt, now - windowMs - SLACK);
-    const tr = transcriptDir ? newestMtime(transcriptDir) : 0;
+    const tr = transcriptDir && !armed.activity ? newestMtime(transcriptDir) : 0;
+    const cli = sessionActivity();
     const wk = workDir ? newestMtime(workDir) : 0;
-    reportLiveness(now, tr);
-    if (tr > freshCut || wk > freshCut || now - lastErrAt < windowMs) {           // producing work: alive
+    reportLiveness(now, Math.max(tr, cli));
+    if (tr > freshCut || cli > freshCut || wk > freshCut || now - lastErrAt < windowMs) {           // producing work: alive
       if (box && extensions < Number(box.extensionsMax) && now + poll + SLACK >= deadline) {
         extensions++;
         deadline += Number(box.extendMs);
         try { writeFileSync(box.deadlineFile, String(Math.floor(deadline / 1000))); } catch {}
         try { appendFileSync(box.extFile, JSON.stringify({ n: extensions, at: now, until: deadline }) + "\n"); } catch {}
         const card = Number(box.card) > 0 ? ` on #${box.card}` : "";
-        await tellExtension(`⏳ ${session} turn extended +${secsOrMins(Number(box.extendMs))} (${extensions}/${box.extensionsMax})${card} — alive: ${describeLast({ tr, wk })}${now - lastErrAt < windowMs ? ", stderr moving" : ""}; box now ${secsOrMins(deadline - armedAt)} of a ${secsOrMins(Number(box.ceilingMs))} ceiling`);
+        await tellExtension(`⏳ ${session} turn extended +${secsOrMins(Number(box.extendMs))} (${extensions}/${box.extensionsMax})${card} — alive: ${describeLast({ tr, wk, cli })}${now - lastErrAt < windowMs ? ", stderr moving" : ""}; box now ${secsOrMins(deadline - armedAt)} of a ${secsOrMins(Number(box.ceilingMs))} ceiling`);
       }
       continue;
     }
     try { writeFileSync(stallFile, ""); } catch {}
     const mins = Math.round((now - armedAt) / 60000);
     const orch = `${hostId()}:${project}`;
-    const text = `⏱ ${session} turn STALLED — ${mins}m with no activity (turn ${s.turn}; last seen: ${describeLast({ tr, wk })}, stderr ${baseErr > 0 ? `${baseErr}B` : "silent"}); ending the turn at the stall window, not the box.`;
+    const text = `⏱ ${session} turn STALLED — ${mins}m with no activity (turn ${s.turn}; last seen: ${describeLast({ tr, wk, cli })}, stderr ${baseErr > 0 ? `${baseErr}B` : "silent"}); ending the turn at the stall window, not the box.`;
     // Direct = wake. The foreman first; if this seat IS the foreman's own runner, say it to all.
     const to = orch === session ? "all" : orch;
     try { await signedPost(`${hub}/send`, { from: session, to, text, project }, { session }); } catch {}
@@ -144,13 +148,14 @@ for (;;) {
   // count (they predate arm), and absolute freshness cannot drift the way a probe-to-probe
   // delta does when the seat writes coarsely or the machine loads (the +1130ms false alarm).
   const freshCut = Math.max(armedAt, Date.now() - windowMs - SLACK);
-  const tr = transcriptDir ? newestMtime(transcriptDir) : 0;
+  const tr = transcriptDir && !armed.activity ? newestMtime(transcriptDir) : 0;
+  const cli = sessionActivity();
   const wk = workDir ? newestMtime(workDir) : 0;
-  reportLiveness(Date.now(), tr);
-  if (errSize() > baseErr + 200 || tr > freshCut || wk > freshCut) continue;   // producing work: alive, re-arm
+  reportLiveness(Date.now(), Math.max(tr, cli));
+  if (errSize() > baseErr + 200 || tr > freshCut || cli > freshCut || wk > freshCut) continue;   // producing work: alive, re-arm
   const mins = Math.round((Date.now() - armedAt) / 60000);
   const orch = `${hostId()}:${project}`;
-  const text = `⏱ ${session} turn STALLED — running ${mins}m with no activity (turn ${s.turn}; last seen: ${describeLast({ tr, wk })}, stderr ${baseErr > 0 ? `${baseErr}B` : "silent"}). Not killed; check its pane, or \`trantor swap\`.`;
+  const text = `⏱ ${session} turn STALLED — running ${mins}m with no activity (turn ${s.turn}; last seen: ${describeLast({ tr, wk, cli })}, stderr ${baseErr > 0 ? `${baseErr}B` : "silent"}). Not killed; check its pane, or \`trantor swap\`.`;
   // Direct = wake. The foreman first; if this seat IS the foreman's own runner, say it to all.
   const to = orch === session ? "all" : orch;
   try { await signedPost(`${hub}/send`, { from: session, to, text, project }, { session }); } catch {}

package/bin/wake-nudge.mjs

@@ -23,7 +23,8 @@ import { load } from "../lib/identity.mjs";
 import { sfetchJson } from "../lib/signed-fetch.mjs";
 import { busDir, hostId, readConfig } from "../lib/project.mjs";
 import { ledgerPaths } from "../hooks/lib/inbox-ledger.mjs";
-import { dutyEscalations, claimDutyNudges, auditDutyNudges } from "../lib/duty-nudges.mjs";
+import { dutyEscalations, claimDutyNudges, auditDutyNudges, releaseDutyNudgeClaims } from "../lib/duty-nudges.mjs";
+import { reserveNudgeIds, releaseNudgeIds } from "../lib/nudge-ledger.mjs";
 import { recipientPanes } from "../lib/duty-recipient.mjs";
 
 const SELF = fileURLToPath(import.meta.url);
@@ -107,7 +108,7 @@ export function postNudge({ socketPath, token, sid }, ids, timeoutMs = 1500) {
   });
 }
 
-export async function wakeOnce({ api, bus = busDir(), resolver = recipient => resolveRecipient(recipient, { bus }), verifyMs = 10000, now = Date.now(), attempted = new Set(), cursor = { id: 0, ts: 0 } }) {
+export async function wakeOnce({ api, bus = busDir(), resolver = recipient => resolveRecipient(recipient, { bus }), verifyMs = 10000, now = Date.now(), attempted = new Set(), cursor = { id: 0, ts: 0 }, log = m => console.error(m) }) {
   const feed = await api(`/events?type=message&by=hub%3Aduty&since=${cursor.id}${cursor.id ? "" : "&limit=2000"}`);
   if (Number.isFinite(feed.latest) && feed.latest < cursor.id) {
     cursor.id = 0; cursor.ts = 0;
@@ -132,6 +133,18 @@ export async function wakeOnce({ api, bus = busDir(), resolver = recipient => re
     const peer = await api(`/peer?session=${encodeURIComponent(recipient)}`);
     return Number(peer.deliveredUpTo || 0) >= Number(id);
   } });
+  // #11355: the shared pre-send ledger — the duty path stamps the same files, so of the two
+  // orchestrator-wake nudgers exactly one send per unread id lands; the loser logs and stands down.
+  const skipped = [];
+  for (const target of plan.targets) {
+    const reserve = await reserveNudgeIds({ recipient: target.recipient, ids: target.ids, owner: `wake:${process.pid}`, bus, log });
+    target.ids = reserve.allowed;
+    skipped.push(...reserve.skipped.map(s => s.id));
+  }
+  plan.items = plan.items.filter(item => !skipped.includes(item.id));
+  plan.targets = plan.targets.filter(target => target.ids.length);
+  await releaseDutyNudgeClaims({ ids: skipped, statePath, owner: plan.owner });
+  if (!plan.targets.length) return { nudged: [], missing: [] };
   const observedIds = new Set();
   let result;
   try {
@@ -150,6 +163,12 @@ export async function wakeOnce({ api, bus = busDir(), resolver = recipient => re
         await sleep(100);
       }
     }));
+    // #11355: a tick that ends with unverified sends releases their stamps — the ledger must
+    // mirror the claim release below, or a failed send would silence the duty path for the TTL.
+    for (const target of plan.targets) {
+      const unverified = target.ids.filter(id => !observedIds.has(id));
+      if (unverified.length) await releaseNudgeIds({ recipient: target.recipient, ids: unverified, owner: plan.owner, bus });
+    }
   } finally {
     // #7429: release unverified claims so the duty seat retains its triage path.
     result = await auditDutyNudges({ plan, observedIds, statePath, reportFailure: async () => {} });