trantor 0.18.82 → 0.18.86

package/bin/crew-runner.mjs

@@ -2,11 +2,12 @@
 // trantor crew runner — keeps a crew agent alive without burning tokens: it long-polls the bus
 // (zero tokens) and resumes the CLI with each message. Usage: node crew-runner.mjs <agent> [dir]
 import { execSync, spawnSync, spawn } from "node:child_process";
-import { readFileSync, writeFileSync, unlinkSync, existsSync, appendFileSync, mkdirSync, realpathSync } from "node:fs";
+import { readFileSync, writeFileSync, unlinkSync, existsSync, appendFileSync, mkdirSync, realpathSync, statSync } from "node:fs";
 import { join, basename } from "node:path";
 import { homedir } from "node:os";
 import { resolveProject, resolveHub, withEnvFiles, hostId } from "../lib/project.mjs";
 import { resolveSecrets, shadowEnv, withSecretExports } from "../lib/secrets.mjs";
+import { runnerPersona } from "../lib/persona.mjs";
 import { loadOrCreate } from "../lib/identity.mjs";
 import { signedHeaders } from "../lib/signed-fetch.mjs";
 import { ensureEnrolled } from "../lib/enroll.mjs";
@@ -26,12 +27,14 @@ import {
   senderProjectOf, isLinkedProject, stateSkipReason, isMessageCardTitle, OPEN_CARD_STATUSES,
   CUT_CHAIN_PARK_MIN, cutChainEvidence, isBoundedPark, askDuringTurn, askedVerdict,
 } from "../lib/turn-policy.mjs";
+import { snapshotBeforeCut } from "./cut-snapshot.mjs";
 import { ocTurnUsage, dshTurnUsage, usageTotal } from "../lib/turn-usage.mjs";
 import { listContainers, newContainers, recordContainers, statePathFor as dockerStatePathFor, sweep as dockerSweep } from "../lib/docker-janitor.mjs";
 import {
   auditDutyNudges, claimDutyNudges, claudeTranscriptDir, dutyEscalations, dutyNudgeDirective,
-  observedDutyNudgeIds, requeueMissingWakeMessages, shedExpiredHubAlerts,
+  observedDutyNudgeIds, requeueMissingWakeMessages, releaseDutyNudgeClaims, shedExpiredHubAlerts,
 } from "../lib/duty-nudges.mjs";
+import { reserveNudgeIds, releaseNudgeIds } from "../lib/nudge-ledger.mjs";
 import { dutyRecipientResolver } from "../lib/duty-recipient.mjs";
 import { cliEffortFlag } from "../lib/model-catalog.mjs";
 import {
@@ -43,8 +46,37 @@ import { resolveStateFlags } from "../lib/state/flags.mjs";
 
 import { awaitSwapRelease } from "./crew/stage.mjs";
 
-await awaitSwapRelease();
-const AGENT = process.env.CREW_SWAP_AGENT || process.argv[2];
+const releaseState = process.env.CREW_RELEASE_STATE ? JSON.parse(process.env.CREW_RELEASE_STATE) : null;
+delete process.env.CREW_RELEASE_STATE;
+const packagePath = new URL("../package.json", import.meta.url);
+function installedVersion() {
+  try {
+    statSync(packagePath);
+    return JSON.parse(readFileSync(packagePath, "utf8")).version;
+  } catch { return ""; }
+}
+const bootVersion = installedVersion();
+const attemptedVersions = new Set(releaseState?.attempted || []);
+function newerVersion(next, previous) {
+  const parse = value => /^(\d+)\.(\d+)\.(\d+)(?:-([\w.-]+))?(?:\+[\w.-]+)?$/.exec(value || "");
+  const a = parse(next), b = parse(previous);
+  if (!a || !b) return false;
+  for (let i = 1; i <= 3; i++) if (+a[i] !== +b[i]) return +a[i] > +b[i];
+  if (!a[4] || !b[4]) return !!b[4] && !a[4];
+  const ap = a[4].split("."), bp = b[4].split(".");
+  for (let i = 0; i < Math.max(ap.length, bp.length); i++) {
+    if (ap[i] === bp[i]) continue;
+    if (ap[i] === undefined || bp[i] === undefined) return bp[i] === undefined;
+    const an = /^\d+$/.test(ap[i]), bn = /^\d+$/.test(bp[i]);
+    if (an && bn) return +ap[i] > +bp[i];
+    if (an !== bn) return bn;
+    return ap[i] > bp[i];
+  }
+  return false;
+}
+if (!releaseState) await awaitSwapRelease();
+const AGENT = process.env.CREW_SWAP_AGENT || process.env.CREW_AGENT || process.argv[2];
+const PERSONA = runnerPersona(process.env, AGENT);
 const DIR = process.argv[3] || process.cwd();
 // Crew agents MUST share the orchestrator's project key (one repo = one lane).
 // RELAY_PROJECT is inherited from crew.mjs (the host's resolved key); else fall
@@ -58,7 +90,7 @@ function gitOut(args, cwd = DIR) {
 }
 
 function seatWorktree(sourceDir) {
-  const wt = ensureSeatWorktree({ sourceDir, project: PROJ, agent: AGENT });
+  const wt = ensureSeatWorktree({ sourceDir, project: PROJ, agent: PERSONA });
   // #7760: a worktree is a git checkout — it lacks the gitignored files the build needs and cannot
   // resolve relative sibling packages. The project's declaration provides both before the first turn.
   if (wt.root) {
@@ -99,7 +131,7 @@ function ocSid(dir) {
 // RUNNER_SESSION override: an orchestrator seat (bin/orchestrate.mjs) runs the same CLI as a crew
 // seat but must live on the bus under its own name (claude-orch:proj), or it would collide with a
 // plain claude crew seat on the same project.
-const SESSION = process.env.RUNNER_SESSION || `${AGENT}:${PROJ}`;
+const SESSION = process.env.RUNNER_SESSION || `${PERSONA}:${PROJ}`;
 // One keypair per seat, so `deepseek:crebral` and `deepseek:trantor` are genuinely different
 // identities on the bus rather than one shared string label.
 const identity = loadOrCreate(SESSION, "agent");
@@ -126,10 +158,10 @@ process.on("unhandledRejection", (e) => { console.log(`\x1b[31m[runner] UNHANDLE
 const log = (s) => console.log(`\x1b[38;5;43m[runner]\x1b[0m ${redactKeys(String(s))}`);
 const LOGDIR = join(homedir(), ".agent-bus", "logs");
 try { mkdirSync(LOGDIR, { recursive: true }); } catch {}
-let TURN = 0;
-const telemetry = (rec) => { try { appendFileSync(join(LOGDIR, `${AGENT}-${PROJ}.jsonl`), JSON.stringify(rec) + "\n"); } catch {} };
+let TURN = releaseState?.turn || 0;
+const telemetry = (rec) => { try { appendFileSync(join(LOGDIR, `${PERSONA}-${PROJ}.jsonl`), JSON.stringify(rec) + "\n"); } catch {} };
 // The boot line records the HUB this runner bound to, so a split-brain is diagnosable from disk.
-telemetry({ ts: Date.now(), agent: AGENT, project: PROJ, boot: true, hub: HUB });
+telemetry({ ts: Date.now(), persona: PERSONA, agent: AGENT, project: PROJ, boot: true, hub: HUB, pid: process.pid, version: bootVersion });
 // A seat can open a terminal window on a machine whose owner never asked for one and does not know
 // what they are looking at. "◤ CLAUDE ◢ trantor crew · fleet" tells that person nothing: not what
 // started, not what it will do, not how to stop it. RUNNER_TITLE names it in full and RUNNER_ABOUT
@@ -176,7 +208,7 @@ function cmuxStatus(value, color, icon = "robot", opts = {}) {
   // Label with the REAL seat identity (this is the DISPLAY path, distinct from the bus identity).
   // Pill = "<agent> · <state>" in the agent's brand color; alerts keep their alarm color.
   const col = opts.alert ? color : (BRAND_HEX[AGENT.toLowerCase()] || color);
-  try { spawnSync(CMUX_BIN, ["set-status", SESSION, `${AGENT} · ${value}`, "--color", col, "--icon", icon, "--priority", String(opts.priority ?? 0)], { stdio: "ignore", timeout: 1500, env: { ...process.env, CMUX_QUIET: "1" } }); } catch {}
+  try { spawnSync(CMUX_BIN, ["set-status", SESSION, `${PERSONA} · ${AGENT} · ${value}`, "--color", col, "--icon", icon, "--priority", String(opts.priority ?? 0)], { stdio: "ignore", timeout: 1500, env: { ...process.env, CMUX_QUIET: "1" } }); } catch {}
 }
 // herdr drops a pane's agent registration when the process inside exits, and a seat's CLI exits
 // every turn, so re-report at each turn boundary. Argument order: pane id FIRST, then the flags.
@@ -186,7 +218,7 @@ function herdrAgent(state) {
     if (!existsSync(f)) return;
     const row = readFileSync(f, "utf8").split("\n")
       .map(l => l.split("\t"))
-      .filter(c => c.length >= 4 && c[0] === PROJ && c[1] === "herdr" && c[2] === AGENT)
+      .filter(c => c.length >= 4 && c[0] === PROJ && c[1] === "herdr" && c[2] === PERSONA)
       .pop();
     if (!row || !row[3]) return;
     spawnSync("herdr", ["pane", "report-agent", row[3], "--source", "crew", "--agent", AGENT, "--state", state],
@@ -258,7 +290,7 @@ const EFFORT_FLAG = EFFORT ? cliEffortFlag(DRIVER, EFFORT) : { flag: "", text: "
 
 // RUNNER_RULES / RUNNER_KICKOFF env overrides: the runner is also the substrate for non-crew
 // always-on seats (the fleet DUTY agent, bin/duty.mjs) whose doctrine is not "work your card".
-const RULES = process.env.RUNNER_RULES || `Rules: you are ${SESSION} on the trantor crew. Before starting a card, read YOUR card: relay_board with card:<id> (the card, its deps, its notes, and the last five done cards whose title shares a word); never the whole board. If your wake names no card id (or cites only a message-card), make relay_board with mine:true your FIRST call — it lists the cards assigned to you (doing/testing/todo, newest first, full card shape); work your newest one (#7763). Work your assigned file(s), report on the bus (relay_send, <280 chars), move your Kanban card as you go with a NOTE saying what you did (doing -> testing, then STOP: you never close your own card to done — the orchestrator runs the card's drill on the built artifact and closes it, and the hub refuses a move to done on a card with no drill line anyway; in 'testing' run YOUR OWN test file — never the full npm test, suites collide across seats — plus \`node bin/slop-gate.mjs\` when the repo has one: it lints ONLY your changed files against the anti-slop rules, and a card must not reach testing with slop-gate failing; use 'failed' + a report if anything breaks). If your work starts containers or a dev server (\`supabase start\`, \`docker run\`, a watch process), stop them before moving your card to testing and name them in the note — the runner also stops containers it saw your turn create when the card closes, but the first responsibility is yours (#9778). If a contract omits a fact you cannot proceed without, ASK — never invent the value: relay_ask(<card>, <question>) blocks the card with your question, keeps the turn owed (no park, no failure), and resumes you when the assigner's answer lands; an invented value that reads as reasoned is the worst outcome this crew ships (#7756). If you need something from another session, message THAT SESSION (relay_peers to find its id, relay_send to reach it) — never ask the human to pass it along; carrying messages between agents is the job this bus exists to remove. When your work for THIS message is finished, END YOUR TURN — do NOT park, do NOT loop relay_wait; the runner waits for you and will wake you with the next message. Path discipline: build/test from your worktree root ${TURN_DIR} with absolute paths or --manifest-path/--prefix instead of cd-ing into subdirs, and put anything that must land outside the repo under ${TURN_DIR}/.agent-bus-out/ (gitignored) — never ~/.agent-bus. Realigning your seat branch after the orchestrator harvested your commits is \`trantor sync\` run from your worktree: it reads the harvest receipts and refuses when an unharvested commit would be lost, so never reset or rebase onto main by hand. A contract's \`base: <sha>\` line is the integration head: start your seat branch at that sha (\`git reset --hard <sha>\` on the fresh branch), never at origin/main, which trails the orchestrator's unpushed integration commits; the object is already here as the ref \`main\`. If \`git cat-file -e <sha>\` fails, say \`cannot resolve base <sha>\` on the bus and move the card to blocked instead of reasoning from origin/main. Every testing/done note names the sha you verified against as \`verified at <sha>\`; a note without it is flagged HOLLOW. Cross-project action is a breach: never \`trantor up\` a crew, register a seat, or send a card/contract into a project other than ${PROJ} unless the operator ran \`trantor policy link ${PROJ} <other> --reason "<why>"\` first — the hub, the CLI and this runner all refuse it mechanically, so ask the operator to link the projects instead of routing around the refusal.`;
+const RULES = process.env.RUNNER_RULES || `Rules: you are ${SESSION} on the trantor crew. Before starting a card, read YOUR card: relay_board with card:<id> (the card, its deps, its notes, and the last five done cards whose title shares a word); never the whole board. If your wake names no card id (or cites only a message-card), make relay_board with mine:true your FIRST call — it lists the cards assigned to you (doing/testing/todo, newest first, full card shape); work your newest one (#7763). After long read-only recon, commit a WIP note with findings so the turn leaves evidence. Work your assigned file(s), report on the bus (relay_send, <280 chars), move your Kanban card as you go with a NOTE saying what you did (doing -> testing, then STOP: you never close your own card to done — the orchestrator runs the card's drill on the built artifact and closes it, and the hub refuses a move to done on a card with no drill line anyway; in 'testing' run YOUR OWN test file — never the full npm test, suites collide across seats — plus \`node bin/slop-gate.mjs\` when the repo has one: it lints ONLY your changed files against the anti-slop rules, and a card must not reach testing with slop-gate failing; use 'failed' + a report if anything breaks). If your work starts containers or a dev server (\`supabase start\`, \`docker run\`, a watch process), stop them before moving your card to testing and name them in the note — the runner also stops containers it saw your turn create when the card closes, but the first responsibility is yours (#9778). If a contract omits a fact you cannot proceed without, ASK — never invent the value: relay_ask(<card>, <question>) blocks the card with your question, keeps the turn owed (no park, no failure), and resumes you when the assigner's answer lands; an invented value that reads as reasoned is the worst outcome this crew ships (#7756). If you need something from another session, message THAT SESSION (relay_peers to find its id, relay_send to reach it) — never ask the human to pass it along; carrying messages between agents is the job this bus exists to remove. When your work for THIS message is finished, END YOUR TURN — do NOT park, do NOT loop relay_wait; the runner waits for you and will wake you with the next message. Path discipline: build/test from your worktree root ${TURN_DIR} with absolute paths or --manifest-path/--prefix instead of cd-ing into subdirs, and put anything that must land outside the repo under ${TURN_DIR}/.agent-bus-out/ (gitignored) — never ~/.agent-bus. Realigning your seat branch after the orchestrator harvested your commits is \`trantor sync\` run from your worktree: it reads the harvest receipts and refuses when an unharvested commit would be lost, so never reset or rebase onto main by hand. A contract's \`base: <sha>\` line is the integration head: start your seat branch at that sha (\`git reset --hard <sha>\` on the fresh branch), never at origin/main, which trails the orchestrator's unpushed integration commits; the object is already here as the ref \`main\`. If \`git cat-file -e <sha>\` fails, say \`cannot resolve base <sha>\` on the bus and move the card to blocked instead of reasoning from origin/main. Every testing/done note names the sha you verified against as \`verified at <sha>\`; a note without it is flagged HOLLOW. Cross-project action is a breach: never \`trantor up\` a crew, register a seat, or send a card/contract into a project other than ${PROJ} unless the operator ran \`trantor policy link ${PROJ} <other> --reason "<why>"\` first — the hub, the CLI and this runner all refuse it mechanically, so ask the operator to link the projects instead of routing around the refusal.`;
 
 // ---- the pulse --------------------------------------------------------------
 // RUNNER_PULSE_MS re-runs an orchestrator seat's mission note on a cadence when the bus is silent;
@@ -288,7 +320,7 @@ let lastEmptyTurn = false;
 // at turn end rides along so the assigner's notice can name it.
 let lastNoDelivery = false;
 let lastNoDeliveryStatus = "";
-const ERRF = join(homedir(), ".agent-bus", `err-${AGENT}-${PROJ}.txt`);
+const ERRF = join(homedir(), ".agent-bus", `err-${PERSONA}-${PROJ}.txt`);
 const DUTY_NUDGES = process.env.RUNNER_DUTY_NUDGES === "1";
 const DUTY_NUDGE_STATE = process.env.RUNNER_DUTY_NUDGE_STATE
   || join(homedir(), ".agent-bus", "duty-nudged.json");
@@ -309,15 +341,15 @@ function startDutyNudgeWatcher(plan, sinceMs) {
 // ---- undelivered wake messages (the runner owns delivery, not the hub) ----
 // The hub hands a message out exactly once, so a turn that died took its wake with it. Here a
 // message is consumed only when a turn exits 0; the queue lives on disk and retries on backoff.
-const PENDF = join(homedir(), ".agent-bus", `pending-${AGENT}-${PROJ}.json`);
+const PENDF = join(homedir(), ".agent-bus", `pending-${PERSONA}-${PROJ}.json`);
 // #7914: the park, on disk, for everyone who is not on the bus. A park announces itself once and
 // then the seat looks exactly like an idle one — which is how three seats sat 46 minutes while
 // `trantor seat-why` read "live, last turn failed". This file is the state behind that event, so a
 // reader who missed the message still finds the reason, the evidence and when it lifts.
-const PARKF = join(homedir(), ".agent-bus", `park-${AGENT}-${PROJ}.json`);
+const PARKF = join(homedir(), ".agent-bus", `park-${PERSONA}-${PROJ}.json`);
 // #9778: the seat's recorded containers, persisted per seat so a card close, a park or
 // `trantor down <seat>` can stop what the seat started even after this runner is gone.
-const DOCKERF = dockerStatePathFor(AGENT, PROJ);
+const DOCKERF = dockerStatePathFor(PERSONA, PROJ);
 // One bus line per sweep, naming what was stopped; docker absent sweeps stay silent by contract.
 async function janitorStop(why, card) {
   const r = dockerSweep({ path: DOCKERF, card });
@@ -373,7 +405,7 @@ function savePending(wake, bcast) {
     // the dedupe ledger outlives the deliveries it guards, and a restarted runner must wait for
     // the answer instead of redelivering the very contract the seat already asked about.
     if (!wake.length && !bcast.length && !seenLedger.length && !awaitingAsk) { try { unlinkSync(PENDF); } catch {} return; }
-    writeFileSync(PENDF, JSON.stringify({ agent: AGENT, project: PROJ, ts: Date.now(), wake, bcast, seen: seenLedger, ask: awaitingAsk?.id || 0, askTo: awaitingAsk?.to || "" }));
+    writeFileSync(PENDF, JSON.stringify({ persona: PERSONA, agent: AGENT, project: PROJ, ts: Date.now(), wake, bcast, seen: seenLedger, ask: awaitingAsk?.id || 0, askTo: awaitingAsk?.to || "" }));
   } catch {}
 }
 function loadPending() {
@@ -405,7 +437,7 @@ async function reportFailure(exit, trigger, undelivered = 0, reasonOverride = ""
   const reason = reasonOverride || classify(exit);
   const down = consecFails >= 2;
   const status = down ? `down: ${reason} · ${consecFails} fails` : `errored: ${reason}`;
-  await api("/register", { session: SESSION, project: PROJ, status, llm: AGENT, model: MODEL, kind: "agent" }).catch(() => {});
+  await api("/register", { session: SESSION, project: PROJ, status, persona: PERSONA, agent: AGENT, llm: AGENT, model: MODEL, kind: "agent" }).catch(() => {});
   const hint = reason === "exhausted" ? " — needs `trantor swap`"
     : reason === "stalled" ? " — CLI silent for the whole watchdog window: check the provider, or `trantor swap`"
     : reason === "auth" ? " — check credentials"
@@ -467,7 +499,7 @@ async function parkSeat(reason, undelivered, resetHint = 0, { evidence = "" } =
   parkState = { reason, until, evidence, held: undelivered, ts: Date.now(), bounded };
   // The park is a STATE, and every reader of it is off the bus: `trantor seat-why`, the app, the
   // operator at a terminal an hour later. The message below is the event; this file is the state.
-  try { writeFileSync(PARKF, JSON.stringify({ session: SESSION, agent: AGENT, project: PROJ, ...parkState })); } catch {}
+  try { writeFileSync(PARKF, JSON.stringify({ session: SESSION, persona: PERSONA, agent: AGENT, project: PROJ, ...parkState })); } catch {}
   if (!parkAnnounced) {
     parkAnnounced = true;
     // #7752: a stalled park names the CLI and its model — the swap decision needs both, and this
@@ -488,7 +520,7 @@ async function parkSeat(reason, undelivered, resetHint = 0, { evidence = "" } =
     `${undelivered} message(s) held${when ? ` — retrying after ${when}` : ` — needs \`trantor up ${AGENT}\``}`);
   // #7749: parked is a first-class phase — the file and the peer row both say so, so an
   // orchestrator stops confusing a quota-held seat with a working or a dead one.
-  writeTurnState(AGENT, PROJ, { phase: "parked", since: Date.now() });
+  writeTurnState(PERSONA, PROJ, { phase: "parked", since: Date.now() });
   await registerStatus(`parked (${reason})`, { phase: "parked", phaseSince: Date.now() });
   // #9778: a parked seat is done working for now — its recorded containers go down with it.
   await janitorStop(`seat parked (${reason})`);
@@ -551,7 +583,7 @@ async function balanceRows() {
 // #7749: the live phase + its start ride the same call, so /peers answers what the seat does NOW.
 async function registerStatus(status, extra = {}) {
   const url = HUB + "/register";
-  const body = JSON.stringify({ session: SESSION, project: PROJ, status, llm: AGENT, model: MODEL, ...extra });
+  const body = JSON.stringify({ session: SESSION, project: PROJ, status, persona: PERSONA, agent: AGENT, llm: AGENT, model: MODEL, ...extra });
   try {
     const opts = { method: "POST", headers: { "content-type": "application/json", connection: "close" }, body };
     await fetch(url, { ...opts, headers: { ...opts.headers, ...signedHeaders(identity, url, opts) }, signal: AbortSignal.timeout(5000) });
@@ -603,7 +635,7 @@ async function reportHealthy() {
   // Recovery is a change too, so the next failure is news again — a park included.
   announced = "";
   parkAnnounced = false;
-  await api("/register", { session: SESSION, project: PROJ, status: `active in ${PROJ}`, llm: AGENT, model: MODEL, kind: "agent" }).catch(() => {});
+  await api("/register", { session: SESSION, project: PROJ, status: `active in ${PROJ}`, persona: PERSONA, agent: AGENT, llm: AGENT, model: MODEL, kind: "agent" }).catch(() => {});
   await api("/send", { from: SESSION, to: "all", text: `✅ ${SESSION} recovered`, project: PROJ, kind: "status" }).catch(() => {});
   cmuxStatus("ok", "#14b8a6", "check"); herdrAgent("idle");
 }
@@ -617,7 +649,7 @@ for (const [name, flag] of Object.entries(stateFlags)) {
   if (flag.value && process.env[name] === undefined) process.env[name] = flag.value;
 }
 const STATE_FLAG_ON = process.env[STATE_ENV] === "1";
-const STATE_SCHEMA_FILE = join(homedir(), ".agent-bus", `state-schema-${AGENT}-${PROJ}.json`);
+const STATE_SCHEMA_FILE = join(homedir(), ".agent-bus", `state-schema-${PERSONA}-${PROJ}.json`);
 const STATE_MODE = (() => {
   if (!STATE_FLAG_ON) return false;
   if (AGENT !== "claude") { log(`${STATE_ENV}=1 but this seat is '${AGENT}' — state mode is claude-only (TDD §7.3); staying on the transcript path`); return false; }
@@ -713,9 +745,9 @@ let cutChain = [];
 const PARK_WINDOW_MS = Math.max(0, Number(process.env.TRANTOR_PARK_WINDOW_MS || 15 * 60 * 1000));
 // The card the CURRENT CLI session belongs to (#6134). 0 = the kickoff session, which belongs to
 // no card, so the first contract that names one starts a session of its own.
-let sessionCard = 0;
+let sessionCard = releaseState?.sessionCard || 0;
 
-let sid = "";
+let sid = releaseState?.sid || "";
 // #6206: the watchdog is DETACHED, so a runner that dies without ending it leaves an orphan
 // sleeping toward a false alarm against whatever runner comes next.
 // Every exit path therefore kills it, and the stamp carries this runner's instance id so any
@@ -741,8 +773,8 @@ async function runTurn(prompt, isFirst, trigger = "kickoff", opts = {}) {
   await registerStatus(`working · ${trigger}`, { phase: "working", phaseSince: t0 });
   // #7749: the same boundary on disk — the watchdog refreshes lastBytesAt/lastTranscriptAt while
   // the turn runs, so a live reader sees the turn advance without waiting for its end.
-  writeTurnState(AGENT, PROJ, { turn: TURN, phase: "working", since: t0, card: sessionCard || 0, lastBytesAt: t0, lastTranscriptAt: 0 });
-  const pf = join(homedir(), ".agent-bus", `turn-${AGENT}-${PROJ}.txt`);
+  writeTurnState(PERSONA, PROJ, { turn: TURN, phase: "working", since: t0, card: sessionCard || 0, lastBytesAt: t0, lastTranscriptAt: 0 });
+  const pf = join(homedir(), ".agent-bus", `turn-${PERSONA}-${PROJ}.txt`);
   appendFileSync(pf, "", { flag: "w" }); // truncate
   appendFileSync(pf, prompt);
   // #5868: where HEAD stood when the turn began. A turn that moved it shipped real work, and an
@@ -755,11 +787,12 @@ async function runTurn(prompt, isFirst, trigger = "kickoff", opts = {}) {
   // #10197: the card status snapshot the turn is judged against at its end — a move to
   // testing/done under the turn is delivery even without a commit. null = the hub read failed:
   // the delivery check stands down rather than claim no-delivery on a transport error.
-  let cardStatusBefore = null;
+  let cardStatusBefore = null, cardLogBefore = [];
   if (!opts.state && sessionCard > 0) {
     try {
       const { task } = await api(`/card?project=${encodeURIComponent(PROJ)}&id=${sessionCard}`);
       cardStatusBefore = task ? String(task.status || "") : null;
+      cardLogBefore = task?.log || [];
     } catch { cardStatusBefore = null; }
   }
   // #9778: the docker snapshot the turn is judged against — containers the CLI spawns are recorded
@@ -799,7 +832,7 @@ async function runTurn(prompt, isFirst, trigger = "kickoff", opts = {}) {
   // instead of prose, and the operator watches that window. So on a state step stdout goes to a
   // file and the runner prints the result line and the cost line itself. stderr still streams to
   // the window through the process substitution below, unchanged.
-  const ENVF = join(homedir(), ".agent-bus", `envelope-${AGENT}-${PROJ}.json`);
+  const ENVF = join(homedir(), ".agent-bus", `envelope-${PERSONA}-${PROJ}.json`);
   if (opts.state) { try { unlinkSync(ENVF); } catch {} }
   const inner = opts.state
     ? `${cmd} > ${ENVF}`
@@ -807,20 +840,20 @@ async function runTurn(prompt, isFirst, trigger = "kickoff", opts = {}) {
   // #5684: runTurn is spawnSync, so a DETACHED watchdog (stamp-armed) watches the turn and sends
   // ONE stall report, never a kill. #6206: floor 10 min, never derived from TRANTOR_TURN_MAX_MS.
   const WD_MS = Number(process.env.TRANTOR_TURN_WATCHDOG_MS) || 10 * 60 * 1000;
-  const STAMPF = join(homedir(), ".agent-bus", `turnstamp-${AGENT}-${PROJ}.json`);
+  const STAMPF = join(homedir(), ".agent-bus", `turnstamp-${PERSONA}-${PROJ}.json`);
   // #6206: the CLI's transcript dir (a missing dir is a quiet channel), exported so a drill's fake
   // CLI can write lines the watchdog sees. CUTF is written by the shell's time box: cut, not crashed.
-  const CUTF = join(homedir(), ".agent-bus", `turncut-${AGENT}-${PROJ}`);
+  const CUTF = join(homedir(), ".agent-bus", `turncut-${PERSONA}-${PROJ}`);
   try { unlinkSync(CUTF); } catch {}
   // #7752: written by the watchdog's kill mode when EVERY liveness channel has been quiet for
   // the whole window; the box sweeps on the marker, so a silent turn ends at the stall window
   // instead of burning the box. Unlinked at turn start and again with the cut cleanup.
-  const STALLF = join(homedir(), ".agent-bus", `turnstall-${AGENT}-${PROJ}`);
+  const STALLF = join(homedir(), ".agent-bus", `turnstall-${PERSONA}-${PROJ}`);
   try { unlinkSync(STALLF); } catch {}
   // #7761: the watchdog writes the extended deadline (epoch seconds) here for the shell box to
   // re-read, and one row per extension to EXTF for the ledger. Both unlinked at turn start.
-  const DEADLINEF = join(homedir(), ".agent-bus", `turndeadline-${AGENT}-${PROJ}`);
-  const EXTF = join(homedir(), ".agent-bus", `turnext-${AGENT}-${PROJ}`);
+  const DEADLINEF = join(homedir(), ".agent-bus", `turndeadline-${PERSONA}-${PROJ}`);
+  const EXTF = join(homedir(), ".agent-bus", `turnext-${PERSONA}-${PROJ}`);
   try { unlinkSync(DEADLINEF); } catch {}
   try { unlinkSync(EXTF); } catch {}
   const boxPlan = TURN_EXTENSIONS_MAX ? {
@@ -830,16 +863,20 @@ async function runTurn(prompt, isFirst, trigger = "kickoff", opts = {}) {
   } : undefined;
   // Touched by the stderr scrubber as its LAST act (the shell below); node waits for it after
   // spawnSync before reading ERRF — see the drain note at the spawnSync call.
-  const DRAINF = join(homedir(), ".agent-bus", `turndrain-${AGENT}-${PROJ}`);
+  const DRAINF = join(homedir(), ".agent-bus", `turndrain-${PERSONA}-${PROJ}`);
   try { unlinkSync(DRAINF); } catch {}
   try {
-    writeFileSync(STAMPF, JSON.stringify({ turn: TURN, startedAt: Date.now(), runner: RUNNER_ID, box: boxPlan }));
+    const activity = cli.pinned || ["kimi", "claude"].includes(AGENT) ? {
+      kind: cli.pinned ? "opencode" : AGENT, sid, db: OC_DB, workDir: TURN_DIR,
+      home: homedir(), startedAt: t0, transcriptDir: TRANSCRIPT_DIR,
+    } : undefined;
+    writeFileSync(STAMPF, JSON.stringify({ turn: TURN, startedAt: Date.now(), runner: RUNNER_ID, box: boxPlan, activity }));
     const wd = spawn(process.execPath, [join(import.meta.dirname, "turn-watchdog.mjs"), STAMPF, ERRF, String(WD_MS), SESSION, PROJ, HUB, TRANSCRIPT_DIR, TURN_DIR,
       // #7752: the stall marker only exists when a box does — with no box there is no sweep to
       // end the turn, so the watchdog stays report-only (reporting is the whole job, boxless).
       TURN_MAX_MS ? STALLF : "",
       // #7749: the turn-state file the watchdog refreshes mid-turn (lastBytesAt/lastTranscriptAt).
-      join(homedir(), ".agent-bus", `turnstate-${AGENT}-${PROJ}.json`)],
+      join(homedir(), ".agent-bus", `turnstate-${PERSONA}-${PROJ}.json`)],
       { detached: true, stdio: "ignore" });
     WD_CHILD = wd;
     wd.unref();
@@ -851,6 +888,8 @@ async function runTurn(prompt, isFirst, trigger = "kickoff", opts = {}) {
   // #7752: the box POLLS instead of one long sleep — the watchdog's stall marker (a silent
   // turn) breaks the loop at the stall window, the deadline breaks it at the full box, and only
   // the deadline path writes CUTF so the runner can tell the two cuts apart.
+  const shellArg = value => "'" + String(value).replaceAll("'", "'\"'\"'") + "'";
+  const snapshotCmd = [process.execPath, join(import.meta.dirname, "cut-snapshot.mjs"), TURN_DIR].map(shellArg).join(" ");
   const box = TURN_MAX_MS ? `
 ${sweep}
 ( trap 'kill "$sleeppid" 2>/dev/null; wait "$sleeppid" 2>/dev/null; exit 0' TERM
@@ -863,12 +902,25 @@ ${sweep}
     wait "$sleeppid"
   done
   kill -0 $job 2>/dev/null || exit 0
+  reason=stall
+  [ -f "${STALLF}" ] || reason=box
+  ${snapshotCmd} "$reason" 2>> ${ERRF}
   [ -f "${STALLF}" ] || : > ${CUTF}
   sweep $job
 ) >/dev/null 2>&1 & boxpid=$!` : "\nboxpid=";
+  const backstop = TURN_MAX_MS ? `
+${sweep}
+backstop() {
+  [ -n "$boxpid" ] && kill $boxpid 2>/dev/null
+  ${snapshotCmd} box 2>> ${ERRF}
+  : > ${CUTF}
+  sweep $job
+  exit 137
+}
+trap backstop TERM` : "";
   const shell = `set -o pipefail
 { ${inner} ; } 2> >(${SCRUB} --tee2 ${ERRF}; : >> "${DRAINF}") &
-job=$!${box}
+job=$!${box}${backstop}
 wait $job; turn_exit=$?
 [ -n "$boxpid" ] && kill $boxpid 2>/dev/null
 wait
@@ -890,10 +942,9 @@ exit $turn_exit`;
       TRANTOR_TRANSCRIPT_DIR: TRANSCRIPT_DIR },
     maxBuffer: 16 * 1024 * 1024,
   };
-  // A BACKSTOP only, deliberately later than the shell's own box: if bash itself wedges, node
-  // still ends the turn. When the in-shell box works — the normal path — this never fires, which
-  // is the point: the shell kills while the tree is still walkable, node cannot.
-  if (TURN_MAX_MS) { spawnOpts.timeout = (TURN_EXTENSIONS_MAX ? TURN_CEILING_MS : TURN_MAX_MS) + 30000; spawnOpts.killSignal = "SIGKILL"; }
+  // The timeout signals the shell to snapshot before sweeping, just like the normal box.
+  // Its 30s margin keeps it out of the normal cut path.
+  if (TURN_MAX_MS) { spawnOpts.timeout = (TURN_EXTENSIONS_MAX ? TURN_CEILING_MS : TURN_MAX_MS) + 30000; spawnOpts.killSignal = "SIGTERM"; }
   const r = spawnSync("/bin/bash", ["-c", shell], spawnOpts);
   // The shell's box leaves the marker; the backstop leaves an ETIMEDOUT. Either way the turn was
   // cut, not merely failed. A stall marker (#7752) outranks the box marker: a turn silent for
@@ -918,6 +969,8 @@ exit $turn_exit`;
   killWatchdog();                        // #6206: turn over — the watchdog dies NOW, it does not sleep on
   try { unlinkSync(STAMPF); } catch {}   // disarm any survivor: the stamp is gone
   if (cut) {
+    const saved = snapshotBeforeCut(TURN_DIR, stallCut ? "stall" : "box");
+    if (!saved.ok) log(`cut WIP snapshot failed: ${saved.error}`);
     // Belt and braces after the shell's descendant sweep: anything still sharing the turn's group.
     if (r.pid) { try { process.kill(-r.pid, "SIGKILL"); } catch {} }
     try { unlinkSync(CUTF); } catch {}
@@ -931,7 +984,7 @@ exit $turn_exit`;
   // #7749: the cut boundary lands on disk and on the peer row BEFORE the follow-up turn overwrites
   // it — a reader sampling mid-chain sees what actually just happened, not a stale "working".
   if (cut) {
-    writeTurnState(AGENT, PROJ, { phase: stallCut ? "stalled" : "cut", since: Date.now() });
+    writeTurnState(PERSONA, PROJ, { phase: stallCut ? "stalled" : "cut", since: Date.now() });
     await registerStatus(stallCut ? "stalled · no activity" : "cut at the time box", { phase: stallCut ? "stalled" : "cut", phaseSince: Date.now() });
   }
   // #5869: scrub AT REST, synchronously, before anything reads the file back. The explicit shell
@@ -1041,17 +1094,24 @@ exit $turn_exit`;
   // turn started, or the card moved to testing/done under it. The ibkr shape (exit 0, output, no
   // commit, card still todo) is NO-DELIVERY: the ledger names it and the contract stays owed.
   // Judged on hub reads of the card status; a failed read keeps today's label, never no-delivery.
-  let cardStatusAtEnd = "", noDelivery = false;
+  let cardStatusAtEnd = "", noDelivery = false, blockedVerdict = "";
   if (!cut && !opts.state && realExit === 0 && effExit === 0 && sessionCard > 0 && cardStatusBefore !== null) {
     let endStatus = null;
     try {
       const { task } = await api(`/card?project=${encodeURIComponent(PROJ)}&id=${sessionCard}`);
       endStatus = task ? String(task.status || "") : null;
+      const freshNote = (task?.log || []).filter(n => n.by === SESSION && n.ts >= t0
+        && !cardLogBefore.some(old => old.ts === n.ts && old.by === n.by && old.text === n.text)).at(-1);
+      if (endStatus === "blocked" && (cardStatusBefore !== "blocked" || freshNote)) {
+        const note = freshNote || (task?.log || []).at(-1);
+        blockedVerdict = `blocked: ${String(note?.text || "").split(/\r?\n/)[0]}`;
+        lastEmptyTurn = false;
+      }
     } catch { endStatus = null; }
     if (endStatus !== null) {
       cardStatusAtEnd = endStatus;
       const moved = ["testing", "done"].includes(endStatus) && !["testing", "done"].includes(cardStatusBefore);
-      noDelivery = !newCommit && !moved && !askVerdict;
+      noDelivery = !newCommit && !moved && !askVerdict && !blockedVerdict;
     }
   }
   lastNoDelivery = noDelivery;
@@ -1063,6 +1123,7 @@ exit $turn_exit`;
   // reads as the sweep's SIGKILL (#7099); a zero-usage turn names its own verdict too (#9724).
   const verdict = stallCut ? stallVerdict() : zeroUsage ? zeroUsageVerdict()
     : askVerdict ? askVerdict
+    : blockedVerdict ? blockedVerdict
     : noDelivery ? noDeliveryVerdict(sessionCard, cardStatusAtEnd || "unknown")
     : verdictFor(realExit, effExit, lastEmptyOutput, ownOut, lastEmptyTurn, cut);
   // #6289: every ledger row names in ONE field what happened to the turn — cut, stalled (#7752),
@@ -1070,8 +1131,8 @@ exit $turn_exit`;
   // binds the row to the card the turn worked (0 = kickoff/pulse) so the seat record attributes
   // empty/stalled turns to the card that produced nothing. `cut` stays too: the drills read it.
   const outcome = cut ? (stallCut ? "stalled" : "cut") : (effExit !== 0 ? "api-error" : noDelivery ? "no-delivery" : lastEmptyTurn ? "empty" : "completed");
-  const finalOutcome = askVerdict ? "asked" : outcome;
-  const telemetryRow = { ts: Date.now(), agent: AGENT, project: PROJ, turn: TURN, trigger, card: sessionCard || 0, model: MODEL || "cli-default", duration_ms: Date.now() - t0, exit: realExit, effExit, authFailed: effExit !== realExit, emptyOutput: lastEmptyOutput, emptyTurn: lastEmptyTurn, verdict, outcome: finalOutcome, tokens };
+  const finalOutcome = askVerdict ? "asked" : blockedVerdict ? "blocked" : outcome;
+  const telemetryRow = { ts: Date.now(), persona: PERSONA, agent: AGENT, project: PROJ, turn: TURN, trigger, card: sessionCard || 0, model: MODEL || "cli-default", duration_ms: Date.now() - t0, exit: realExit, effExit, authFailed: effExit !== realExit, emptyOutput: lastEmptyOutput, emptyTurn: lastEmptyTurn, verdict, outcome: finalOutcome, tokens };
   if (usage) telemetryRow.usage = usage;
   if (dockerNew.length) telemetryRow.containers = dockerNew.map(c => c.name || c.id);
   if (cut) telemetryRow.cut = true;
@@ -1090,7 +1151,7 @@ exit $turn_exit`;
   // #5965 — TURN END. A clean exit means the seat is idle again; say so right away so the app stops
   // pulsing it even before the next /poll heartbeat. Failure keeps reportFailure's down/errored.
   if (realExit === 0 && effExit === 0) {
-    writeTurnState(AGENT, PROJ, { phase: "idle", since: Date.now() });
+    writeTurnState(PERSONA, PROJ, { phase: "idle", since: Date.now() });
     await registerStatus("idle", { phase: "idle", phaseSince: Date.now() });
   }
   // The follow-up rides the SAME session, exactly once. A state step gets none: TIME_BOX_PROMPT
@@ -1255,7 +1316,7 @@ function shouldWake(message) {
   }
   return message?.to === "all"
     && isContract(message)
-    && (message.text.includes(`@${AGENT}`) || message.text.toLowerCase().includes(`${AGENT}:`));
+    && (message.text.includes(`@${PERSONA}`) || message.text.toLowerCase().includes(`${PERSONA.toLowerCase()}:`));
 }
 
 // #6228: the operator's declared project links, cached briefly so a burst of wakes doesn't hit
@@ -1311,13 +1372,14 @@ async function resolveWakeCard(messages, { session }) {
   await loadLessons();
   // start cursor at the CURRENT tip so we don't replay history
   let cursor = 0;
-  if (process.env.CREW_SWAP_STAGE) cursor = JSON.parse(readFileSync(`${process.env.CREW_SWAP_STAGE}.release`, "utf8")).cursor;
+  if (releaseState) cursor = releaseState.cursor;
+  else if (process.env.CREW_SWAP_STAGE) cursor = JSON.parse(readFileSync(`${process.env.CREW_SWAP_STAGE}.release`, "utf8")).cursor;
   else try { const r = await api(`/inbox?session=${encodeURIComponent(SESSION)}&since=0`); cursor = r.cursor || 0; } catch {}
   // kind "agent" on every beat (#6075): the peer row's kind is the hub's OWN record of what a
   // session is — the overseer's declared-crew exemption reads it, and on the remote hub there is
   // no crew-windows.txt to fall back to. /register preserves absent fields, so a seat running an
   // older runner never loses a kind an updated one stamped.
-  await api("/register", { session: SESSION, project: PROJ, status: "crew member booting", llm: AGENT, model: MODEL, kind: "agent" }).catch(() => {});
+  await api("/register", { session: SESSION, project: PROJ, status: "crew member booting", persona: PERSONA, agent: AGENT, llm: AGENT, model: MODEL, kind: "agent" }).catch(() => {});
   // Announce runner-side, signed as THIS seat: the runner process is per-seat by construction, so
   // its signature cannot be borrowed the way a shared opencode MCP daemon once borrowed identities.
   try {
@@ -1337,7 +1399,7 @@ async function resolveWakeCard(messages, { session }) {
   // #7914: a park belongs to the runner that made it. This process is starting fresh and will
   // re-park if the CLI is still cutting, so a record left by the runner before it is stale state —
   // and stale state in a health read is the same failure as no state at all.
-  try { unlinkSync(PARKF); } catch {}
+  if (!releaseState) { try { unlinkSync(PARKF); } catch {} }
   seenLedger = restored.seen;
   if (seenLedger.length) log(`\x1b[33m${seenLedger.length} consumed message id(s) restored from the pending file — the poll keeps standing down on them\x1b[0m`);
   if (restored.ask) {
@@ -1357,25 +1419,54 @@ async function resolveWakeCard(messages, { session }) {
     // disagreeing makes a health check lie.
     savePending(pendingWake, pendingBcast);
   }
-  let retryAt = 0;            // 0 = deliver at the next opportunity
-  let deliveryFails = 0;      // consecutive failed attempts at the SAME pending batch
-  let noDeliveryRetry = false;
+  let retryAt = releaseState?.retryAt || 0;            // 0 = deliver at the next opportunity
+  let deliveryFails = releaseState?.deliveryFails || 0;      // consecutive failed attempts at the SAME pending batch
+  let noDeliveryRetry = releaseState?.noDeliveryRetry || false;
+  askReleased = releaseState?.askReleased || false;
   if (pendingWake.length) log(`\x1b[33m${pendingWake.length} message(s) survived from a previous run — redelivering\x1b[0m`);
 
   // #7060: the turn the boot line was read as a promise about. It is a transcript turn by
   // construction and now says so, in the same breath as the line that armed the mode.
-  stateSkip("kickoff");
-  const ec0 = await runTurn(composedTurn({ base: KICKOFF, lessons: pickLessons(LESSONS_RAW, "") }), true, "kickoff");
-  if (ec0) await reportFailure(ec0, "kickoff", pendingWake.length);   // a failed kickoff = the "fired up, died, nobody knew" case
-  // #7778: the kickoff is a turn like any other — a message that landed mid-kickoff and was read
-  // through the session's own inbox is consumed by a successful kickoff, and the first poll must
-  // not wake on it. Same reconcile, same clean-boundary rule as deliverWake below.
-  else await reconcileSessionReads(cursor);
-  let lastTurnAt = Date.now();
+  if (!releaseState) {
+    stateSkip("kickoff");
+    const ec0 = await runTurn(composedTurn({ base: KICKOFF, lessons: pickLessons(LESSONS_RAW, "") }), true, "kickoff");
+    if (ec0) await reportFailure(ec0, "kickoff", pendingWake.length);   // a failed kickoff = the "fired up, died, nobody knew" case
+    // #7778: the kickoff is a turn like any other — a message that landed mid-kickoff and was read
+    // through the session's own inbox is consumed by a successful kickoff, and the first poll must
+    // not wake on it. Same reconcile, same clean-boundary rule as deliverWake below.
+    else await reconcileSessionReads(cursor);
+  } else {
+    const text = `runner restarted onto ${bootVersion}`;
+    log(text);
+    telemetry({ ts: Date.now(), text, version: bootVersion });
+    await api("/send", { from: SESSION, to: "all", project: PROJ, kind: "status", text }).catch(() => {});
+  }
+  let lastTurnAt = releaseState?.lastTurnAt || Date.now();
+  function restartForRelease() {
+    const version = installedVersion();
+    if (!newerVersion(version, bootVersion) || attemptedVersions.has(version)) return;
+    attemptedVersions.add(version);
+    // SAFETY: older supported Node releases lack in-place exec; never replace it with a duplicate runner.
+    // oxlint-disable-next-line anti-slop/no-runtime-typeof
+    if (typeof process.execve !== "function") {
+      log(`runner upgrade to ${version} requires Node with process.execve; restart manually`);
+      return;
+    }
+    try {
+      // Persist before exec: a held contract and a released ask both survive the boundary.
+      writeFileSync(PENDF, JSON.stringify({ persona: PERSONA, agent: AGENT, project: PROJ, ts: Date.now(),
+        wake: pendingWake, bcast: pendingBcast, seen: seenLedger, ask: awaitingAsk?.id || 0, askTo: awaitingAsk?.to || "" }));
+      const state = { cursor, turn: TURN, sid, sessionCard, retryAt, deliveryFails,
+        noDeliveryRetry, askReleased, lastTurnAt, attempted: [...attemptedVersions] };
+      process.execve(process.execPath, [process.execPath, ...process.execArgv, ...process.argv.slice(1)],
+        { ...process.env, CREW_RELEASE_STATE: JSON.stringify(state) });
+    } catch (error) { log(`runner restart failed: ${error.message}`); }
+  }
   if (PULSE_MS) log(`pulse armed — mission re-read every ${Math.round(PULSE_MS / 1000)}s (${MISSION_FILE})`);
   log(`parked — long-polling the bus as ${SESSION} (free; this poll is also the heartbeat)`);
 
   while (true) {
+    restartForRelease();
     // pulse first: a due mission beat runs even on a silent bus. Measured from the END of the
     // last turn, so a long turn doesn't stack an immediate pulse on top of itself.
     if (PULSE_MS && Date.now() - lastTurnAt >= PULSE_MS) {
@@ -1545,6 +1636,7 @@ async function resolveWakeCard(messages, { session }) {
     } catch { return 0; }
   }
   async function deliverWake() {
+    restartForRelease();
     noDeliveryRetry = false;
     // #7756: captured and cleared HERE so an early return below never leaks the flag into a
     // later turn — only the turn the answer released reads it.
@@ -1570,6 +1662,22 @@ async function resolveWakeCard(messages, { session }) {
         },
       })
       : { items: [], targets: [], owner: "" };
+    // #11355: the shared pre-send ledger — the wake daemon stamps the same files, so of the two
+    // orchestrator-wake nudgers exactly one send per unread id lands; skipped ids release this
+    // path's claim and never reach the seat, so the existing consumed-without-a-wake branch fires.
+    const dutyOwner = dutyPlan.owner;
+    const skippedNudgeIds = [];
+    for (const target of dutyPlan.targets) {
+      const reserve = await reserveNudgeIds({ recipient: target.recipient, ids: target.ids, owner: dutyOwner });
+      target.ids = reserve.allowed;
+      skippedNudgeIds.push(...reserve.skipped.map(s => s.id));
+    }
+    if (skippedNudgeIds.length) {
+      const skippedSet = new Set(skippedNudgeIds);
+      dutyPlan.items = dutyPlan.items.filter(item => !skippedSet.has(item.id));
+      dutyPlan.targets = dutyPlan.targets.filter(target => target.ids.length);
+      await releaseDutyNudgeClaims({ ids: skippedNudgeIds, statePath: DUTY_NUDGE_STATE, owner: dutyOwner });
+    }
     const claimedIds = new Set(dutyPlan.items.map(item => item.id));
     const wakeForTurn = DUTY_NUDGES
       ? wake.filter(message => {
@@ -1692,6 +1800,11 @@ async function resolveWakeCard(messages, { session }) {
         },
       });
       skippedNudges = audit.missing;
+      // #11355: the ledger mirrors the claim release — a duty turn that ended without the send
+      // must not silence the wake daemon for the TTL.
+      for (const target of audit.missing) {
+        await releaseNudgeIds({ recipient: target.recipient, ids: target.ids, owner: dutyOwner });
+      }
     }
     if (!ec && skippedNudges.length) {
       deliveryFails++;