hivecode-mcp 0.14.2 → 0.14.3

package/docs/TROUBLESHOOTING.md

@@ -95,6 +95,7 @@ This guide explains every error code (`Qxxx`) emitted by Hivecode CLI commands,
 | `Q584` | `hive-repos.js` | Looking up registered repository for room | Repository registration is stale (folder moved/deleted) or multiple local clones are registered for the same room. | Re-bind the correct repository clone using `npx hivecode-mcp branch <branch>`, or remove obsolete entries in `~/.hivecode/repos.json`. |
 | `Q585` | `hive-repos.js` | Calling `hive_pr` | Not currently connected to a room (`hive_join` has not been called). | Join a room first using `hive_join` before calling `hive_pr`. |
 | `Q586` | `hive-repos.js` | Calling `hive_pr` | Room connection is currently offline or disconnected from relay. | Wait for the room connection to reconnect to the relay before running `hive_pr`. |
+| `Q587` | `hive-land.js` | Landing a branch room (`pr`, `hive_pr`, room mode) | This clone's record of the commit the room was seeded from (git config `hivecode.<branch>.base`) differs from the room's own record. Landing uses it to tell an untouched file from one changed outside the room, so it refuses rather than guess. | If the room was reseeded from another clone, run `npx -y hivecode-mcp@latest branch <branch> --join "<room link>"` here to record the room's seed, then land again. |
 | `Q650` | `hive-room-mode.js` | Starting room-mode watcher (`github start --room "<link>"`) | Missing, empty, or malformed room join link. | Provide a valid room join link (`wss://<relay>|room-<id>`) or use `github start --branch <name>`. |
 | `Q651` | `hive-room-mode.js` | Starting room-mode watcher | Target directory is not a git repository root (or is the user's home directory). | Run the watcher from inside a valid git repository checkout. |
 | `Q652` | `hive-room-mode.js` | Starting room-mode watcher | The specified room is not bound to a git branch in this repository, or multiple branches match. | Run `npx hivecode-mcp branch <branch>` to bind the branch, or launch with `github start --branch <branch>`. |

package/hive-branch.js

@@ -385,6 +385,67 @@ async function roomSeed(link, you) {
   }
 }
 
+// A NEW BRANCH IS CUT FROM WHAT THE TEAM HAS, NOT FROM A STALE COPY OF IT (P1-7, 9 Nov 2026).
+// `branch fix-x` cuts from HEAD, and HEAD is usually a local main that was last pulled days ago: the
+// room was then seeded with old files, agents worked on them, and landing met the newer main as a
+// conflict (or a Q506) nobody had caused. So when the source is a LOCAL branch, its remote copy is
+// fetched first, and:
+//   - local strictly BEHIND remote: cut from the remote. Nothing is lost (the remote holds every
+//     local commit) and the note says so, with the count.
+//   - local AHEAD of remote: cut from local. Those commits are the developer's own work.
+//   - DIVERGED: cut from local, and the note says how far behind and how to choose the remote.
+//   - the fetch failed (offline, no access): cut from local, and the note says it could not check.
+// A sha or a remote ref (`origin/main`) is taken exactly as given: whoever names one chose it, and
+// the GitHub watcher fetches before it passes one. HIVE_BRANCH_FETCH=0 skips the fetch and compares
+// against the remote ref as last fetched.
+function fetchBranch(root, remote, rb) {
+  if (process.env.HIVE_BRANCH_FETCH === '0') return { ok: false, skipped: true, err: 'HIVE_BRANCH_FETCH=0' }
+  const r = spawnSync('git', ['fetch', '--quiet', '--no-tags', remote, `+refs/heads/${rb}:refs/remotes/${remote}/${rb}`], {
+    cwd: root, encoding: 'utf8', timeout: 30000, windowsHide: true, env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
+  })
+  if (r.error) return { ok: false, err: r.error.code === 'ETIMEDOUT' ? 'timed out after 30 s' : r.error.message }
+  if (r.status === 0) return { ok: true }
+  const err = String(r.stderr || '').trim()
+  // The remote has no such branch (a main never pushed): nothing to be behind, nothing to say.
+  if (/couldn't find remote ref|could not find remote ref/i.test(err)) return { ok: false, absent: true, err }
+  return { ok: false, err: err.split('\n').pop() || `exit ${r.status}` }
+}
+
+/** Where a new branch is cut from: { sha, src, note }. See the comment above. */
+export function freshCutPoint(root, from = '') {
+  const src = from || 'HEAD'
+  const sha = revParse(root, `${src}^{commit}`)
+  if (!sha) return { sha: '', src, note: '' }
+  let local = ''
+  if (src === 'HEAD') { const c = git(root, ['symbolic-ref', '--quiet', '--short', 'HEAD']); local = c.code === 0 ? c.out : '' }
+  else if (!/^[0-9a-f]{7,40}$/i.test(src) && revParse(root, `refs/heads/${src}`)) local = src
+  if (!local) return { sha, src, note: '' } // detached HEAD, a sha, a tag or a remote ref: exactly as given
+  // Its remote copy: the configured upstream, else the same name on origin.
+  let remote = '', rb = ''
+  const up = git(root, ['for-each-ref', '--format=%(upstream:remotename)%09%(upstream:short)', `refs/heads/${local}`])
+  const [upRemote, upShort] = (up.code === 0 ? up.out : '').split('\t')
+  if (upRemote && upShort && upShort.startsWith(`${upRemote}/`)) { remote = upRemote; rb = upShort.slice(upRemote.length + 1) }
+  else if (git(root, ['remote']).out.split('\n').includes('origin')) { remote = 'origin'; rb = local }
+  if (!remote) return { sha, src, note: '' } // a repository with no remote: local is all there is
+  const rref = `${remote}/${rb}`
+  const f = fetchBranch(root, remote, rb)
+  const rsha = revParse(root, `refs/remotes/${rref}^{commit}`)
+  if (!rsha) {
+    return { sha, src, note: f.ok || f.skipped || f.absent ? '' : `could not fetch ${rref} (${f.err}), so ${local} was not checked against it.` }
+  }
+  const unchecked = f.ok || f.skipped ? '' : ` (could not fetch it just now: ${f.err}; this is ${rref} as last fetched)`
+  if (rsha === sha) return { sha, src, note: unchecked ? `${local} matches ${rref}${unchecked}.` : '' }
+  const isAnc = (a, b) => git(root, ['merge-base', '--is-ancestor', a, b]).code === 0
+  const count = (range) => Number(git(root, ['rev-list', '--count', range]).out) || 0
+  if (isAnc(sha, rsha)) {
+    const n = count(`${sha}..${rsha}`)
+    return { sha: rsha, src: rref, behind: n, note: `your ${local} was ${n} commit(s) behind ${rref}${unchecked}, so the branch was cut from ${rref} (${rsha.slice(0, 7)}) instead. Nothing of yours is left out: ${rref} has every commit your ${local} has.` }
+  }
+  if (isAnc(rsha, sha)) return { sha, src, ahead: count(`${rsha}..${sha}`), note: unchecked ? `cut from your ${local}${unchecked}.` : '' }
+  const behind = count(`${sha}..${rsha}`), ahead = count(`${rsha}..${sha}`)
+  return { sha, src, behind, ahead, note: `your ${local} and ${rref} have diverged (${behind} behind, ${ahead} ahead)${unchecked}. The branch was cut from your ${local}; to cut from ${rref} instead, delete the branch and the room binding and run again with --from ${rref}.` }
+}
+
 /** The branch a PR from `name` goes into: the checkout's current branch, else origin's default. */
 function defaultBase(root, name) {
   const cur = git(root, ['symbolic-ref', '--quiet', '--short', 'HEAD'])
@@ -461,9 +522,13 @@ export async function bindBranch({ cwd, branch, from = '', relay = '', you = '',
   let tip = revParse(root, `refs/heads/${name}`)
   // The PR's base is a BRANCH NAME for `gh`: a sha names no branch, and origin/main means main.
   let fromName = from && !/^[0-9a-f]{7,40}$/i.test(from) ? from.replace(/^origin\//, '') : ''
+  let cutNote = ''
   if (!tip) {
     const src = from || 'HEAD'
-    const sha = revParse(root, `${src}^{commit}`)
+    const cut = freshCutPoint(root, from)
+    const sha = cut.sha
+    cutNote = cut.note || ''
+    if (cutNote) log(cutNote)
     if (!sha) {
       if (src === 'HEAD' && !revParse(root, 'HEAD')) {
         throw coded('Q562', `repository "${root}" has no commits yet, so there's nothing to put in a room. Commit your files first, then run this again.`)
@@ -502,7 +567,7 @@ export async function bindBranch({ cwd, branch, from = '', relay = '', you = '',
   }
   writeBinding(root, name, { room: link, from: fromName, base: tip, seed: seeded.dir, files: String(seeded.count) })
   await registerLocal(root, name, link)
-  return { root, branch: name, link, you: me, from: fromName, commit: tip, created, reseeded: reseed, files: seeded.count, total: seeded.total, seedDir: seeded.dir }
+  return { root, branch: name, link, you: me, from: fromName, commit: tip, created, cutNote, reseeded: reseed, files: seeded.count, total: seeded.total, seedDir: seeded.dir }
 }
 
 // ---- landing: the room's work becomes commits on the branch ---------------------------------
@@ -594,6 +659,7 @@ export async function main(argv, { cwd = process.cwd(), log = console.log, logEr
       const shown = dirtyFiles.slice(0, 5).join(', ')
       const more = dirtyFiles.length > 5 ? ` (+${dirtyFiles.length - 5} more)` : ''
       const uncommittedPart = dirtyFiles.length ? `\n  ${dirtyFiles.length} file(s) with uncommitted changes are not in the room: ${shown}${more}` : ''
+      if (r.cutNote) log(`Note: ${r.cutNote}`)
       log(`${r.reseeded ? 'Room refilled' : 'Room ready'} for branch ${r.branch} @ ${r.commit.slice(0, 7)}${r.created ? ` (new branch, cut from ${r.from || 'HEAD'}; your checkout was not switched)` : ''}\n  ${r.files} file(s) in the room: the branch as committed${uncommittedPart}${r.total > r.files ? `\n  ${r.total - r.files} more (binary, over 1 MB, or never synced) are filled in from git for agents on this machine` : ''}\n  room: ${r.link}`)
       if (/onrender\.com/.test(r.link)) log('  This is the public relay: anyone who has this link can read these files.')
       const roomName = parseLink(r.link).room

package/hive-land.js

@@ -185,6 +185,15 @@ export async function landAndOpen(opts = {}) {
     if (b.base && !HB.revParse(root, `${b.base}^{commit}`)) {
       return refuse('Q563', `the commit this room was seeded from (${short(b.base)}) is not in this clone, so the room's deletions cannot be accounted for. Fetch it (git fetch origin), then land again. Nothing was changed.`)
     }
+    // THE SEED THIS CLONE RECORDED MUST BE THE ONE THE ROOM RECORDED (0.14.3 P0-3-H). --seed tells
+    // hive-pr that a branch file still equal to the seed's copy is one the room started from. If this
+    // clone's record (git config, written when the room was made or joined here) names another commit
+    // -- the room was reseeded from another clone, or the record was edited -- a file a person changed
+    // on the branch after the room's real seed could match it and be landed over without a word.
+    // Two records that disagree are not resolved by guessing which is right.
+    if (b.base && snap.seed && snap.seed !== b.base) {
+      return refuse('Q587', `this clone records that the room for ${name} was seeded from ${short(b.base)}, but the room records ${short(snap.seed)}. Landing trusts that record to tell an untouched file from one changed outside the room, so it will not guess which is right. Nothing was changed.\nIf the room was reseeded elsewhere, record the room's seed here, then land again:\n  npx -y hivecode-mcp@latest branch ${name} --join "<the room link>"`)
+    }
     if (!b.base) {
       // A binding with no seed record (a `--join` made before 0.13.1, or a room seeded before it):
       // deletions cannot be told from files added to the branch later, so none are landed -- and
@@ -206,6 +215,7 @@ export async function landAndOpen(opts = {}) {
     if (dry) args.push('--dry-run')
     if (o.force) args.push('--force', String(o.force))
     if (o.only) args.push('--only', String(o.only))
+    if (b.base) args.push('--seed', String(b.base)) // a file unchanged since the seed is one the room started from (0.14.3 P0-3)
     // ASYNC, not spawnSync: inside the hive_pr tool this runs in the agent's MCP server, and a landing
     // that blocked its event loop for minutes would freeze that agent's own room connection too.
     const r = await runNode(args, { cwd: tmp, env: HB.noHooksEnv({ ...process.env, HIVE_PROVENANCE: 'on' }) })
@@ -460,7 +470,11 @@ async function roomSnapshot(link) {
     const holders = makeCoordinator(peek.doc.getMap('claims'), 'hive-land-peek').board()
       .filter((c) => c && c.by)
       .map((c) => ({ file: c.region, by: c.by, intent: c.intent || 'edit', leftSec: Math.max(0, Math.round(((Number(c.at) || 0) + (Number(c.ttl) || 0) - now) / 1000)) }))
-    return { paths: new Set(peek.doc.getMap('manifest').keys()), holders }
+    // The commit the room records it was seeded from (hive-branch seedRoom writes it): checked against
+    // this clone's binding before --seed is trusted (0.14.3 P0-3-H).
+    const sc = peek.doc.getMap('seed').get('commit')
+    const seed = typeof sc === 'string' && /^[0-9a-f]{40}$/i.test(sc) ? sc : ''
+    return { paths: new Set(peek.doc.getMap('manifest').keys()), holders, seed }
   } finally {
     try { peek.stop() } catch { }
     try { fs.rmSync(dir, { recursive: true, force: true }) } catch { }

package/hive-mcp.js

@@ -1779,9 +1779,14 @@ Nothing was written. This tool exists to guarantee the change syncs to every pee
           firstTime('withheld:' + r.file) // said here, so the next hive_wait does not say it again
           return text(`⛔ wrote ${r.file} in YOUR folder only. It was NOT shared, because it contains ${r.withheld}, and Hivecode does not send keys to the room or the relay. Nobody else has this change. Read the key from the environment instead (put it in .env, which is never shared); the file is shared on its next save without the key.`)
         }
-        return text(r.conflicted
-          ? `wrote ${r.file}, but it now carries <<<<<<< conflict markers (a concurrent edit collided). Read the file and resolve before continuing.`
-          : `✓ wrote ${r.file} through the medium — your intent is signed into its provenance ledger and the change is syncing to every peer.`)
+        if (r.conflicted) return text(`wrote ${r.file}, but it now carries <<<<<<< conflict markers (a concurrent edit collided). Read the file and resolve before continuing.`)
+        // SAY WHETHER IT REACHED THE RELAY, never just "syncing" (0.14.3 P0-1). Over HTTPS long-poll an
+        // edit waits in this process until the relay accepts it; an agent that left on "syncing" lost it.
+        const hiveS = requireSession().hive
+        const sent = typeof hiveS.whenSent === 'function' ? await hiveS.whenSent(r.file, 3000) : true
+        return text(sent
+          ? `✓ wrote ${r.file} through the medium — your intent is signed into its provenance ledger and the relay has the change; every peer gets it from there.`
+          : `⏳ wrote ${r.file} in your folder, but the relay has NOT accepted the change yet (slow or reconnecting link). It is still being sent: stay in the room (do not exit or leave) and check hive_status before you report it done.`)
       }
       case 'hive_fork': {
         const file = String(args.file || ''); if (!file) return err('need a file path')
@@ -1876,7 +1881,17 @@ Nothing was written. This tool exists to guarantee the change syncs to every pee
       // row is dropped rather than left to read as GONE. GONE means "stopped without saying so",
       // and diluting it with agents that signed off correctly is how a signal stops being read.
       case 'hive_pr': return text(await runHivePr(args))
-      case 'hive_leave': { try { ACT.forget(activityMap(), requireSession().name) } catch { }; requireSession().hive.stop(); session = null; forgetSession(); return text('left the room') }
+      case 'hive_leave': {
+        try { ACT.forget(activityMap(), requireSession().name) } catch { }
+        const h = requireSession().hive
+        // Leave waits until the relay has every edit and message (0.14.3 P0-1), and names what it did not get.
+        const r = typeof h.leave === 'function' ? await h.leave({ timeoutMs: 10000 }) : (h.stop(), null)
+        session = null; forgetSession()
+        const missed = r ? [...r.unsent, ...(r.roomUnsent ? ['your last room messages'] : [])] : []
+        return missed.length
+          ? text(`left the room, but the relay had NOT accepted these when it stopped waiting (10 s): ${missed.join(', ')}. Nobody else has those changes. Rejoin and check them before you report the work done.`)
+          : text('left the room')
+      }
       default: return err(`unknown tool: ${name}`)
     }
   } catch (e) { return err(`error: ${e.message}`) }
@@ -2006,9 +2021,37 @@ function missingRequired(req) {
   return lines.join('\n')
 }
 
+// [!] MEANS "BEFORE YOU CONTINUE", SO IT IS CHECKED BEFORE THE CALL, NOT AFTER IT (P1-8, 9 Nov 2026).
+// Mail reached an agent only as a notice appended to a tool's RESULT, after the tool had run. In the
+// 9 Nov mock run Claude sent "[!] @antigravity-VM Stand down on test.js: ... Don't edit it."; the
+// agent's next call was hive_edit test.js, the file was written, and "[!] URGENT MAIL" came back in
+// the reply to that very write. The room read it as "delivered to one of two agents". So a call that
+// writes, takes work or lands it is refused while urgent mail addressed to this agent is unread, and
+// the refusal shows the message. Reading it (hive_check or hive_wait) is the decision; then retry.
+// Releasing, talking and reading are never held: a stand-down usually asks for exactly those.
+const URGENT_GATED = new Set(['hive_edit', 'hive_claim', 'hive_resolve', 'hive_fork', 'hive_pr', 'hive_set_state'])
+function urgentGate(name) {
+  try {
+    if (!URGENT_GATED.has(name) || !session || !session.mailbox) return ''
+    catchUp(session)
+    const m = session.mailbox.peek(chatArray())
+    const urgent = (m.mentions || []).filter((x) => x && priorityOf(x.text) === 'stop')
+    if (!urgent.length) return ''
+    const shown = urgent.slice(-3).map((x) => `  ${formatMessage(x)}`.slice(0, 600)).join('\n')
+    return [
+      `REFUSED -- ${urgent.length} URGENT message(s) ([!]) addressed to you are unread, and [!] means: handle it before you continue.`,
+      `Nothing was done. This ${name} call did NOT happen.`,
+      shown,
+      `Read it with hive_check (that marks it read), do what it asks, then call ${name} again if it still applies.`,
+    ].join('\n')
+  } catch { return '' }
+}
+
 server.setRequestHandler(CallToolRequestSchema, async (req) => {
   const bad = missingRequired(req)
   if (bad) return { content: [{ type: 'text', text: bad }], isError: true }
+  const held = urgentGate(req.params && req.params.name)
+  if (held) return { content: [{ type: 'text', text: held }], isError: true }
   const res = await dispatch(req)
   // Never let the banner break a tool: append only to a well-formed text result, and skip the two
   // tools that already deliver mail themselves (appending would double-report the same messages).
@@ -2078,8 +2121,18 @@ if (isEntryPoint && process.argv[2] === 'setup') {
   // room and exit. The SDK kept this process alive on its open sockets instead, holding a seat
   // and a presence entry for a member that was gone, until something killed it.
   server.onclose = () => {
-    try { if (session) session.hive.stop() } catch { /* leaving is best-effort; exiting is not */ }
-    setTimeout(() => process.exit(0), 500)
+    // Leave, not stop: the last edits and messages go out before the process does (0.14.3 P0-1). Over
+    // HTTPS long-poll they are still in this process; a 500 ms exit dropped them. Capped, so a dead
+    // link cannot hold a departed agent's seat for long; whatever did not go is named on stderr.
+    const done = () => process.exit(0)
+    setTimeout(done, 12000).unref()
+    const s = session
+    if (!s) return setTimeout(done, 500)
+    Promise.resolve()
+      .then(() => (typeof s.hive.leave === 'function' ? s.hive.leave({ timeoutMs: 10000 }) : (s.hive.stop(), null)))
+      .then((r) => { if (r && (r.unsent.length || r.roomUnsent)) console.error(`[hive-mcp] left before the relay accepted: ${[...r.unsent, ...(r.roomUnsent ? ['(room messages)'] : [])].join(', ')}`) })
+      .catch(() => { /* leaving is best-effort; exiting is not */ })
+      .finally(() => setTimeout(done, 200))
   }
   await server.connect(transport)
   startUpdateCheck() // background, short timeout; hive_join and hive_status show what it finds

package/hive-mux.js

@@ -36,11 +36,13 @@ class FileProvider extends ObservableV2 {
   }
   get synced() { return !!(this._impl && this._impl.synced) }
   get wsconnected() { return !!(this._impl && this._impl.wsconnected) }
+  /** Bytes handed to this file's socket that the relay has not accepted yet (0.14.3 P0-1). */
+  get bufferedAmount() { return (this._impl && this._impl.bufferedAmount) || 0 }
   get transport() { return this._impl ? this._impl.transport : 'pending' }
   _bindLegacy(relay, wsOpts) {
     const p = new WebsocketProvider(relay, this.docName, this.doc, wsOpts)
     for (const ev of ['sync', 'status', 'connection-error', 'connection-close']) p.on(ev, (...args) => this.emit(ev, args))
-    this._impl = { transport: 'socket', get synced() { return p.synced }, get wsconnected() { return p.wsconnected }, destroy: () => p.destroy() }
+    this._impl = { transport: 'socket', get synced() { return p.synced }, get wsconnected() { return p.wsconnected }, get bufferedAmount() { return (p.ws && p.ws.bufferedAmount) || 0 }, destroy: () => p.destroy() }
   }
   destroy() {
     if (this.destroyed) return
@@ -73,6 +75,7 @@ class Channel {
     doc.on('update', this._onUpdate)
   }
   get wsconnected() { return this.opened && this.mux.connected }
+  get bufferedAmount() { return (this.mux.ws && this.mux.ws.bufferedAmount) || 0 }
   sendOpen() {
     if (this.destroyed || !this.mux.connected) return
     clearTimeout(this.retryTimer); this.retryTimer = null

package/hive-pr.js

@@ -36,7 +36,7 @@ import path from 'path'
 import { spawnSync } from 'child_process'
 import { fileURLToPath } from 'url'
 import { startSync, parseLink } from './sync.js'
-import { accountFor, verdict, explain, DIVERGED, sameText } from './hive-pr-staleness.js'
+import { accountFor, verdict, explain, DIVERGED, DESCENDS, UNPROVEN, sameText } from './hive-pr-staleness.js'
 const toLF = (s) => (typeof s === 'string' && s.indexOf('\r\n') !== -1 ? s.replace(/\r\n/g, '\n') : s)
 import { contentHash } from './substrate.js'
 
@@ -48,6 +48,8 @@ const has = (k) => argv.includes('--' + k)
 // required reason has to be written down, ends up in the PR body, and is the thing somebody asks
 // about later. hive_release already works this way for exactly the same argument.
 const FORCE = flag('force')
+// --seed <commit>: the commit a branch room was seeded from (hive-land passes the binding's record).
+const SEED = flag('seed')
 
 const REPO = flag('repo')
 const DRY = has('dry-run')
@@ -107,7 +109,20 @@ export function sanitizeIntent(raw) {
   return clean.length > 200 ? clean.slice(0, 200).trim() : clean
 }
 
+// An intent that already starts with the agent's own name ("Claude-cloud: Issue #6 ...", the way
+// agents often phrase them) must not be prefixed again: the mock run's commit read
+// "Claude-cloud: Claude-cloud: Issue #6 ..." (0.14.3 P1-9). Case-insensitive, repeated prefixes too.
+export function withoutOwnName(agent, intent) {
+  let s = String(intent || '')
+  const a = String(agent || '').trim()
+  if (!a) return s
+  const re = new RegExp(`^\\s*@?${a.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*:\\s*`, 'i')
+  for (let i = 0; i < 5 && re.test(s); i++) s = s.replace(re, '')
+  return s.trim() || String(intent || '').trim()
+}
+
 export function truncateSubject(agent, intent, max = 72) {
+  intent = withoutOwnName(agent, intent)
   const prefix = `${agent}: `
   const full = `${prefix}${intent}`
   if (full.length <= max) return full
@@ -230,7 +245,7 @@ export function commitMessage(g, room) {
       lines.push(`  - ${intent}`)
     }
     for (const ci of coauthorIntents) {
-      lines.push(`  - ${ci.name}: ${ci.intent}`)
+      lines.push(`  - ${ci.name}: ${withoutOwnName(ci.name, ci.intent)}`)
     }
     lines.push('')
     lines.push('Files:')
@@ -391,7 +406,21 @@ if (isMain) {
         const sha = git(['rev-parse', `${base}:${f.rel}`])
         const branchText = sha.code === 0 ? gitRaw(['cat-file', 'blob', sha.out]).out : null
         const roomText = toLF(fs.readFileSync(f.abs, 'utf8'))
-        decisions.push({ ...accountFor({ rel: f.rel, branchText, roomText, receipts: hive.provenanceOf(f.rel) || [] }), _f: f })
+        let d = accountFor({ rel: f.rel, branchText, roomText, receipts: hive.provenanceOf(f.rel) || [] })
+        // UNCHANGED ON THE BRANCH SINCE THE ROOM WAS SEEDED FROM IT (0.14.3 P0-3). A branch room
+        // starts as the branch at the seed commit, so a file whose branch copy is still that exact blob
+        // is one the room provably held at its start: writing the room's copy over it deletes nothing
+        // the room has not seen, whatever its receipts say. demo-3 (9 Nov) was refused here (Q506) on
+        // an untouched branch because one unsigned edit had cut test.js's chain off from the seed.
+        // Only a broken or missing chain is overruled; a file the branch changed since is still judged
+        // by its chain alone, so a real change under the room is still refused.
+        if (SEED && (d.state === DIVERGED || d.state === UNPROVEN) && sha.code === 0) {
+          const atSeed = git(['rev-parse', `${SEED}:${f.rel}`])
+          if (atSeed.code === 0 && atSeed.out === sha.out) {
+            d = { ...d, state: DESCENDS, why: `unchanged on the branch since the room was seeded from it (${SEED.slice(0, 7)}), so the room started from exactly this copy` }
+          }
+        }
+        decisions.push({ ...d, _f: f })
       }
     }
     const v = verdict(decisions)
@@ -417,7 +446,7 @@ if (isMain) {
       }
     }
 
-    if (DRY) {
+    if (DRY && !groups.length) {
       writePlanJson()
       console.log('\n--dry-run: nothing written')
       return finish(0)
@@ -428,6 +457,9 @@ if (isMain) {
       return finish(1)
     }
 
+    // A DRY RUN ANSWERS WHAT THE REAL ONE WILL (0.14.3). It used to return "would land" before this
+    // check, so the watcher's dry pass went green and the real landing then refused with Q506, and
+    // nobody heard (9 Nov, issue #9). The same verdict, the same refusal, nothing written either way.
     if (!v.ok) {
       writePlanJson()
       const lastTouch = (rel) => git(['log', '-1', '--format=%h %an %ad %s', '--date=short', base, '--', rel]).out
@@ -437,7 +469,12 @@ if (isMain) {
       // A forced run is still reported in full, and the reason travels into the PR body. The
       // point is not to make forcing hard, it is to make it visible.
       console.error('')
-      console.error(`--force given: "${FORCE}" -- overwriting ${v.blocked.length} file(s) anyway. This is recorded in the PR body.`)
+      console.error(`--force given: "${FORCE}" -- ${DRY ? 'would overwrite' : 'overwriting'} ${v.blocked.length} file(s) anyway. This is recorded in the PR body.`)
+    }
+    if (DRY) {
+      writePlanJson()
+      console.log('\n--dry-run: nothing written')
+      return finish(0)
     }
 
     const co = git(['checkout', '-b', BRANCH, base])

package/hive-room-mode.js

@@ -460,7 +460,11 @@ export function filterRoomMembers(rawMembers = []) {
 
   for (const m of rawMembers) {
     if (!m || !m.name) continue
-    if (m.name === 'GitHub' || m.passive || m.listener) continue
+    // A LISTENER IS THE AGENT, NOT A BOT (P1-6, 9 Nov 2026). hive-await joins under the agent's own
+    // name, tagged `listener` and deliberately NOT passive, and presence is merged by name: every
+    // agent that keeps its listener armed (the room's rule) came back with listener: true and was
+    // dropped here, so the first issue comment said "In the room now: none yet" with agents present.
+    if (m.name === 'GitHub' || m.passive) continue
     // Exclude Recorder or ControlRoom viewer
     if (/recorder|control[-_ ]?room/i.test(m.name) || /control[-_ ]?room/i.test(m.app || '')) continue
 
@@ -842,6 +846,76 @@ function evaluateFileReview(hive, rel, plan = [], hashes = null) {
   }
 }
 
+/**
+ * The passive "GitHub-done" connection whenDone reads the room through. Its own function so that
+ * landIssue can open it, hand it to whenDone, and keep it open for the Q576 fix task: whenDone
+ * stops a connection it opened itself, and 0.14.2 then wrote the fix task and the room warning
+ * into that stopped doc, so the room never got them (0.14.3 P0-2 (b)).
+ */
+export async function openDoneHive({ link, token } = {}) {
+  const parsed = parseLink(link)
+  if (!parsed || !parsed.room) return { error: 'invalid room link' }
+  const tempDir = path.join(os.tmpdir(), `hive-done-${crypto.randomBytes(6).toString('hex')}`)
+  fs.mkdirSync(tempDir, { recursive: true })
+  const hive = startSync({
+    relay: parsed.relay,
+    room: parsed.room,
+    dir: tempDir,
+    name: 'GitHub-done',
+    kind: 'ai',
+    passive: true,
+    syncFiles: false,
+    token: parsed.token || token,
+    log: () => {},
+  })
+  // Wait for sync to establish
+  await new Promise((res) => {
+    const timer = setTimeout(res, 15000)
+    if (hive.provider) {
+      if (hive.provider.synced) {
+        clearTimeout(timer)
+        return res()
+      }
+      hive.provider.on('sync', (synced) => {
+        if (synced) {
+          clearTimeout(timer)
+          res()
+        }
+      })
+    } else {
+      res()
+    }
+  })
+  const close = async ({ settleMs = 0 } = {}) => {
+    // A write made just before close must get the chance to leave this process (the same family
+    // as P0-1); the watcher's own confirmed room line is the guarantee, this is best effort.
+    if (settleMs > 0) await new Promise((r) => setTimeout(r, settleMs))
+    try { hive.stop() } catch {}
+    try { fs.rmSync(tempDir, { recursive: true, force: true }) } catch {}
+  }
+  return { hive, tempDir, close }
+}
+
+/**
+ * The branch's head on origin, for the landing fingerprint: a Q506 says the branch moved, and a
+ * push that fixes the branch must earn a new landing even when the room did not change (0.14.3
+ * P0-2, Claude's review). ls-remote first (the local ref is only as new as the last fetch), the
+ * local origin ref when the network does not answer, '' when neither exists.
+ */
+export function branchHeadOf(root, branch) {
+  if (!root || !branch) return ''
+  const env = { ...process.env, GIT_TERMINAL_PROMPT: '0', GCM_INTERACTIVE: 'never' }
+  try {
+    const r = spawnSync('git', ['ls-remote', '--heads', 'origin', `refs/heads/${branch}`], { cwd: root, encoding: 'utf8', timeout: 15000, windowsHide: true, env })
+    const m = r.status === 0 && String(r.stdout || '').match(/^([0-9a-f]{40,64})\s/m)
+    if (m) return m[1]
+    const l = spawnSync('git', ['rev-parse', '--verify', '--quiet', `refs/remotes/origin/${branch}`], { cwd: root, encoding: 'utf8', timeout: 15000, windowsHide: true, env })
+    return l.status === 0 ? String(l.stdout || '').trim() : ''
+  } catch {
+    return ''
+  }
+}
+
 /**
  * B3: Done Detection
  * Evaluates whether an issue task in the room is ready for landing.
@@ -872,42 +946,13 @@ export async function whenDone(opts = {}) {
     if (syncRunner) {
       hive = await syncRunner()
     } else {
-      const parsed = parseLink(link)
-      if (!parsed || !parsed.room) {
-        return { ready: false, why: 'invalid room link', reasons: ['invalid room link'] }
+      const opened = await openDoneHive({ link, token })
+      if (opened.error) {
+        return { ready: false, why: opened.error, reasons: [opened.error] }
       }
-      tempDir = path.join(os.tmpdir(), `hive-done-${crypto.randomBytes(6).toString('hex')}`)
-      fs.mkdirSync(tempDir, { recursive: true })
-      hive = startSync({
-        relay: parsed.relay,
-        room: parsed.room,
-        dir: tempDir,
-        name: 'GitHub-done',
-        kind: 'ai',
-        passive: true,
-        syncFiles: false,
-        token: parsed.token || token,
-        log: () => {},
-      })
+      hive = opened.hive
+      tempDir = opened.tempDir
       ownedHive = true
-      // Wait for sync to establish
-      await new Promise((res) => {
-        const timer = setTimeout(res, 15000)
-        if (hive.provider) {
-          if (hive.provider.synced) {
-            clearTimeout(timer)
-            return res()
-          }
-          hive.provider.on('sync', (synced) => {
-            if (synced) {
-              clearTimeout(timer)
-              res()
-            }
-          })
-        } else {
-          res()
-        }
-      })
     }
 
     // 1. Task check
@@ -975,6 +1020,11 @@ export async function whenDone(opts = {}) {
       const why = dryRes ? dryRes.why : 'dry landing returned false'
       return {
         ready: false,
+        // A DRY REFUSAL IS A REFUSAL, with its code. Once the dry run answers what the real one will
+        // (0.14.3 P0-3), Q506 arrives HERE, before any real landing: dropping the code made it read as
+        // "not ready yet", and the watcher stays quiet on that by design, so issue #9's silence came
+        // back by the other door (Claude-cloud's review of P0-3).
+        ...(dryRes && dryRes.code ? { refused: true, code: dryRes.code } : {}),
         why: `dry landing check refused: ${why}`,
         reasons: [why],
         task,
@@ -988,6 +1038,9 @@ export async function whenDone(opts = {}) {
     // 4. Review status check for every planned file
     const reasons = []
     const unreviewedFiles = []
+    // Who reviewed each landing file, from the reviews bound to the exact content that lands: the PR
+    // body names them (0.14.3 P1-10; the mock run's PR #7 did not say who reviewed it).
+    const reviewed = []
     let hasHardBlock = false
 
     for (const rel of plannedFiles) {
@@ -1004,6 +1057,9 @@ export async function whenDone(opts = {}) {
           unreviewedFiles.push(rel)
           if (!allowUnreviewed) reasons.push(`${rel} has not been reviewed`)
         }
+      } else if (revStatus.verdict === 'pass') {
+        const by = [...new Set((revStatus.reviews || []).filter((r) => r && r.verdict === 'pass' && r.by).map((r) => String(r.by)))]
+        reviewed.push({ file: rel, by })
       } else if (revStatus.verdict === 'fail') {
         hasHardBlock = true
         reasons.push(`${rel} has an unresolved fail review`)
@@ -1038,6 +1094,7 @@ export async function whenDone(opts = {}) {
     return {
       ready: true,
       unreviewedFiles,
+      reviewed,
       files: plannedFiles,
       deletions,
       task,
@@ -1062,6 +1119,19 @@ export async function whenDone(opts = {}) {
  * Implements plan fingerprint caching to avoid retry loops on failing tests.
  */
 export async function landIssue(opts = {}) {
+  if (opts.syncRunner) return await landIssueOn(opts)
+  const opened = await openDoneHive({ link: opts.link, token: opts.token })
+  if (opened.error) return { ok: false, why: `Not ready to land: ${opened.error}`, reasons: [opened.error] }
+  let res = null
+  try {
+    res = await landIssueOn({ ...opts, syncRunner: async () => opened.hive })
+    return res
+  } finally {
+    await opened.close({ settleMs: res && res.toldRoom ? 1500 : 0 })
+  }
+}
+
+async function landIssueOn(opts = {}) {
   const {
     link,
     taskId,
@@ -1073,6 +1143,7 @@ export async function landIssue(opts = {}) {
     allowUnreviewed = false,
     state = {},
     token,
+    headOf = branchHeadOf,
   } = opts
 
   // 1. Check readiness
@@ -1088,6 +1159,11 @@ export async function landIssue(opts = {}) {
   })
 
   if (!wd.ready) {
+    // Refused at the dry run (a coded refusal, not "not done yet"): handed back WITH its code, so the
+    // watcher says it once, on the issue and in the room, like a refusal of the real landing.
+    if (wd.refused && wd.code) {
+      return { ok: false, code: wd.code, why: wd.why, reasons: wd.reasons, refusedAt: 'dry' }
+    }
     return {
       ok: false,
       ...(wd.blocked === 'unreviewed' ? { blocked: 'unreviewed', files: wd.unreviewedFiles || wd.files || [] } : {}),
@@ -1098,7 +1174,10 @@ export async function landIssue(opts = {}) {
 
   // 2. Plan fingerprint (Claude addition a: NO RETRY LOOP)
   const hive = wd.hive
-  const fingerprint = computePlanFingerprint(wd.plan, wd.files, hive, wd.hashes)
+  // The branch head is part of it: the same room work against a branch that moved (or was fixed)
+  // is a new landing, not a repeat of the failed one.
+  const head = (() => { try { return headOf(root, branch) || '' } catch { return '' } })()
+  const fingerprint = `${computePlanFingerprint(wd.plan, wd.files, hive, wd.hashes)}${head ? `@${head}` : ''}`
 
   if (state.lastFailedFingerprint === fingerprint) {
     return {
@@ -1128,6 +1207,13 @@ export async function landIssue(opts = {}) {
   if (wd.unreviewedFiles && wd.unreviewedFiles.length > 0) {
     summary += `\n\nNot reviewed by a second agent: ${wd.unreviewedFiles.join(', ')}`
   }
+  if (wd.reviewed && wd.reviewed.length > 0) {
+    // Names in code spans with any leading @ dropped: a room name like "@someone" must not ping a
+    // GitHub user from a PR body.
+    const who = (n) => `\`${String(n).replace(/^@+/, '').replace(/`/g, "'").slice(0, 60)}\``
+    summary += '\n\nReviewed in the room (hive_review, bound to the exact content that lands):\n' +
+      wd.reviewed.map((r) => `- ${r.file}: ${r.by.length ? r.by.map(who).join(', ') : 'a reviewer the room could not name'}`).join('\n')
+  }
 
   const landFn = landRunner || landAndOpen
 
@@ -1159,6 +1245,7 @@ export async function landIssue(opts = {}) {
         why: landRes.why,
         fingerprint,
         state: nextState,
+        toldRoom: Boolean(hive && (hive.assign || hive.say)),
       }
     }
 
@@ -1296,7 +1383,13 @@ export function collectPrFeedback(opts = {}) {
     )
   }
   if (issueNumber) {
-    streams.push(['ic', () => (gh && gh.comments ? gh.comments(issueNumber) : []), 'comment on the issue'])
+    // A DELETED ISSUE answers 404 on its comments forever; 0.14.2 threw here on every tick, so the
+    // watcher jammed with Q603 until restart while the PR was still open (0.14.3 P1). Gone means
+    // no comments; any other failure (rate limit, 5xx) still throws and is retried next tick.
+    streams.push(['ic', () => {
+      if (!gh || !gh.comments) return []
+      try { return gh.comments(issueNumber) } catch (e) { if (e && e.status === 404) return []; throw e }
+    }, 'comment on the issue'])
   }
 
   const fresh = []