hivecode-mcp 0.14.2 → 0.14.4

package/hive-room-watcher.js

@@ -22,6 +22,7 @@
 import fs from 'fs'
 import os from 'os'
 import path from 'path'
+import * as SEEN from './hive-seen.js' // replies since the post, by Yjs id (0.14.4)
 import { startSync, parseLink } from './sync.js'
 import * as ACT from './hive-activity.js'
 import { LABEL, HUMAN_LABEL, PUSHERS } from './hive-github.js'
@@ -68,7 +69,7 @@ export function saveRoomState(file, s) {
 export function makeRoomWatcher(o) {
   const {
     gh, link, branch, label = LABEL, stateFile, deps,
-    ackMinutes = 10, maxMinutes = 120, maxRuns = 6, maxRunsPerDay = 20, soloGraceMinutes = 2,
+    ackMinutes = 10, maxMinutes = 120, maxRuns = 6, maxRunsPerDay = 20, soloGraceMinutes = 2, refusalRetryMinutes = 10,
     fallbackAgent = '', host = os.hostname(),
     now = () => Date.now(), log = () => {},
   } = o
@@ -100,10 +101,23 @@ export function makeRoomWatcher(o) {
     .split(roomId).join('[room id removed]')
     .replace(/wss?:\/\/[^\s|)'"`]+(\|[^\s)'"`]*)?/g, '[relay link removed]')
     .replace(/\broom-[A-Za-z0-9_-]{12,}/g, '[room id removed]')
+    // LOCAL PATHS: a refusal's "why" names files on the watcher's machine (a home folder, a temp
+    // checkout); the issue is public (0.14.3 P0-2, Claude's review). Not inside URLs.
+    .replace(/(?<![\w.:/\\-])(?:[A-Za-z]:[\\/]|\\\\|\/(?:home|Users|tmp|var|root|private|opt|mnt|srv|workspace|data)\/)[^\s'"`)\]]*/g, '[local path removed]')
   const comment = (n, body) => { try { gh.comment(n, scrubRoom(body)) } catch (e) { log(`#${n}: could not comment on GitHub: ${e.message}`) } }
   const today = () => new Date(now()).toISOString().slice(0, 10)
   const runsToday = () => { if (state.day.date !== today()) state.day = { date: today(), runs: 0 }; return state.day.runs }
 
+  // A room line that may not arrive: deps.say is roomSay, confirmed by a second client. When it is
+  // not confirmed (or throws) the watcher logs it and carries on; the caller has already put the
+  // same news on GitHub, so nobody is left with neither (0.14.3 P0-2).
+  async function sayChecked(n, text) {
+    let r = null
+    try { r = await deps.say(text) } catch (e) { r = { ok: false, why: e && e.message } }
+    if (!r || !r.ok) log(`#${n}: could not confirm the room heard it (${(r && (r.why || r.code)) || 'no answer'}); the GitHub comment stands`)
+    return r
+  }
+
   function needsHuman(n, why, lines = []) {
     const it = state.issues[n]
     if (it) it.status = 'needs-human'
@@ -180,7 +194,7 @@ export function makeRoomWatcher(o) {
       log(`#${n}: withdrawn`)
       return
     }
-    const peek = await deps.peek({ issueNumber: n, taskId: a.taskId, since: a.postedAt })
+    const peek = await deps.peek({ issueNumber: n, taskId: a.taskId, since: a.postedAt, postFrontier: a.postFrontier || null })
     if (peek && peek.ok && peek.engaged && !a.engagedAt) a.engagedAt = now()
 
     // A LONE AGENT CANNOT GET A SECOND AGENT'S REVIEW. When the work is done and the only thing
@@ -197,9 +211,15 @@ export function makeRoomWatcher(o) {
     const solo = (a.agentsSeen || []).length <= 1
     const graceMs = (solo ? soloGraceMinutes : ackMinutes) * 60000
     const allowUnreviewed = !!(a.unreviewedSince && now() - a.unreviewedSince >= graceMs && peek && peek.ok && peek.reachable.length <= 1)
-    const r = await deps.landIssue({ taskId: a.taskId, issue: { number: n, title: it.title }, lastFailedFingerprint: a.lastFailedFingerprint || '', allowUnreviewed })
+    // A REFUSAL IS TRIED AGAIN AFTER A PAUSE even when nothing changed (a push answered 503, a lock
+    // on the remote): once per refusalRetryMinutes, never every tick, and a repeat of the same
+    // refusal is neither said again nor counted again (antigravity-VM's attack 1). Failing tests
+    // are not retried this way: they wait for the room to change.
+    let lastFp = a.lastFailedFingerprint || ''
+    if (lastFp && a.lastRefusal && now() - (a.refusalTriedAt || a.lastRefusal.at) >= refusalRetryMinutes * 60000) { lastFp = ''; a.refusalTriedAt = now() }
+    const r = await deps.landIssue({ taskId: a.taskId, issue: { number: n, title: it.title }, lastFailedFingerprint: lastFp, allowUnreviewed })
     if (r && !r.ok && r.blocked === 'unreviewed') {
-      if (!a.unreviewedSince) {
+      if (!a.unreviewedSince && !a.unreviewedSaid) {
         a.unreviewedSince = now()
         const files = (r.files || []).slice(0, 6).join(', ') || 'the changed files'
         if (solo) {
@@ -208,8 +228,16 @@ export function makeRoomWatcher(o) {
         } else {
           await deps.say(`@all issue #${n} is done and waiting for a review of ${files} by someone who did not write them (hive_review). Nothing lands until then.`)
         }
+        a.unreviewedSaid = true
       }
-    } else if (r && !r.ok) a.unreviewedSince = 0
+      if (!a.unreviewedSince) a.unreviewedSince = now()
+    } else if (r && !r.ok && !r.skipped && !r.code && !r.fingerprint) {
+      // Only "not ready" (work reopened, a claim taken) restarts the review wait. A refusal or a
+      // skipped landing is not a change in the work: resetting here made a refused solo landing
+      // re-announce "nobody else to review" every grace period (antigravity-VM's attack 3).
+      a.unreviewedSince = 0
+      a.unreviewedSaid = false
+    }
     if (r && r.state && 'lastFailedFingerprint' in r.state) a.lastFailedFingerprint = r.state.lastFailedFingerprint || ''
     if (r && r.ok && a.kind === 'review') {
       const pr = r.pr || {}
@@ -234,8 +262,38 @@ export function makeRoomWatcher(o) {
     }
     if (r && r.code === 'Q576' && !r.skipped) {
       a.runs = (a.runs || 0) + 1
+      a.lastRefusal = null // failing tests wait for the room to change; they are not retried on a timer
       if (a.runs >= maxRuns) return needsHuman(n, `the tests failed ${a.runs} times in a row (the limit is ${maxRuns}).`, (peek && peek.lastLines) || [])
       comment(n, `The tests failed on the agents' work, so nothing was pushed. It went back to the room (attempt ${a.runs} of ${maxRuns}).\n\n${MARK('room', { kind: 'tests-failed', run: a.runs })}`)
+      // SAID BY THE WATCHER, CONFIRMED: landIssue's own room line went through a connection that
+      // whenDone had already stopped, so the room never heard its tests failed (0.14.3 P0-2).
+      await sayChecked(n, `@all the tests failed when landing issue #${n} (attempt ${a.runs} of ${maxRuns}): ${oneLine(r.why, 300)} Nothing was pushed. Fix them in the room; the landing is tried again when the room's files or the branch change.`)
+    }
+    // A LANDING REFUSED FOR ANY OTHER REASON IS SAID, never swallowed (0.14.3 P0-2). On 0.14.2 a
+    // refusal (Q506, a push refused, no git identity...) matched no branch here: nothing in the
+    // room, nothing on the issue, and the next tick's identical fingerprint was a silent skip, so
+    // issue #9 sat "done" and landed nothing with no word anywhere. Said once per refusal (same
+    // code, same fingerprint), counted like failing tests, then a person. The issue comment goes
+    // FIRST: an unreachable room must never mean nobody heard (Claude's review).
+    if (r && !r.ok && !r.skipped && r.blocked !== 'unreviewed' && r.code !== 'Q576' && (r.code || r.fingerprint)) {
+      const fp = r.fingerprint || (r.state && r.state.lastFailedFingerprint) || ''
+      const key = `${r.code || ''}|${fp || oneLine(r.why, 120)}`
+      if (a.refusedKey !== key) {
+        a.refusedKey = key
+        a.refusals = (a.refusals || 0) + 1
+        const code = r.code || 'refused'
+        const why = oneLine(r.why, 300) || 'no reason given'
+        a.lastRefusal = { code, why, at: now() }
+        log(`#${n}: landing refused (${code}): ${why}`)
+        if (a.refusals >= maxRuns) return needsHuman(n, `the landing was refused ${a.refusals} times (the limit is ${maxRuns}); the last time ${code}: ${why}`, (peek && peek.lastLines) || [])
+        comment(a.kind === 'review' ? a.pr : n, `The agents' work is done, but Hivecode refused to land it (${code}): ${oneLine(r.why, 400) || 'no reason given'} Nothing was pushed. It went back to the room (refusal ${a.refusals} of ${maxRuns}); it is tried again when the room's files or the branch change.\n\n${MARK('room', { kind: 'refused', code })}`)
+        await sayChecked(n, `@all issue #${n} is done, but its landing was REFUSED (${code}): ${why} Nothing was pushed. Fix the cause in the room; the landing is tried again when the room's files or the branch change.`)
+      } else if (a.lastRefusal) {
+        // The same refusal again (a retry after the pause): not said or counted again, but
+        // `github status` shows it is still happening, so a silent wait is never mistaken for
+        // progress (Claude's review).
+        a.lastRefusal.seen = now()
+      }
     }
     if (now() - a.postedAt > maxMinutes * 60000) return needsHuman(n, `the room worked on it for more than ${maxMinutes} minutes without a landing.`, (peek && peek.lastLines) || [])
 
@@ -338,7 +396,7 @@ export function makeRoomWatcher(o) {
         return { postFailed: n }
       }
       it.status = 'active'
-      state.active = { n, taskId: p.taskId, postedAt: now(), engagedAt: 0, runs: 0, fallback: null, lastFailedFingerprint: '' }
+      state.active = { n, taskId: p.taskId, postedAt: now(), postFrontier: p.postFrontier || null, engagedAt: 0, runs: 0, fallback: null, lastFailedFingerprint: '' }
       // Commands already on the issue (a "/hivecode stop" from before this run) are history: only
       // what is said from now on stops it.
       try { await commands(n, 0) } catch { /* read again next tick */ }
@@ -395,6 +453,10 @@ export function describeRoomState(s, { now = Date.now(), maxRunsPerDay = (s && s
     out.push(`  working on ${what} for ${mins(a.postedAt)} min; ${a.engagedAt ? 'an agent has taken it' : 'NO agent has taken it yet'}${a.runs ? `; tests failed ${a.runs} time(s)` : ''}`)
     if (a.fallback) out.push(`  fallback agent started ${mins(a.fallback.at)} min ago (${a.fallback.why})`)
     if (a.unreviewedSince) out.push(`  done, waiting ${mins(a.unreviewedSince)} min for a review by an agent that did not write it`)
+    if (a.lastRefusal) {
+      const still = a.lastRefusal.seen ? `; still refused (same reason) for ${mins(a.lastRefusal.at)} min, last tried ${mins(a.lastRefusal.seen)} min ago` : ''
+      out.push(`  landing refused ${mins(a.lastRefusal.at)} min ago (${a.lastRefusal.code}): ${oneLine(a.lastRefusal.why, 200)}${still}`)
+    }
   } else if (s.openPr) {
     out.push(`  waiting for PR #${s.openPr} to be merged or closed before the next issue (one open PR per room)`)
   } else {
@@ -522,7 +584,30 @@ export async function runRoomMode({ f, opt, gh, id, info, root, gitDir, label, l
 }
 
 /** A passive look at the room: who can hear, and whether anyone has engaged with this issue. */
-export async function peekRoom({ link, issueNumber, taskId, since = 0, token = '', timeoutMs = 60000 }) {
+/**
+ * Has an agent said something about this issue since the room's post of it?
+ *
+ * BY IDENTITY WHEN WE CAN (0.14.4). "After the post" by POSITION missed an agent reply that was in
+ * flight when the issue was posted: it integrates BEFORE the post and read as "nobody replied". With
+ * the frontier the poster held right after posting (postIssue returns it), a reply counts if its Yjs id
+ * is not in it, wherever it landed. A run posted by an older build has no frontier and keeps the
+ * position rule: lines after the LAST post of this issue (a retry is "Issue #12 (attempt 2): ...").
+ */
+export function agentRepliedSince({ chat, issueNumber, taskId = '', postFrontier = null }) {
+  const ref = new RegExp(`#${Number(issueNumber)}(?!\\d)`)
+  const isAgent = (m) => m && m.kind !== 'human' && !/^GitHub/.test(String(m.by || ''))
+  const replies = (m) => isAgent(m) && (ref.test(String(m.text || '')) || (taskId && String(m.text || '').includes(taskId)))
+  if (postFrontier && typeof postFrontier === 'object' && SEEN.isYArray(chat)) {
+    return SEEN.itemsOf(chat).some(({ id, value }) => !SEEN.covers(postFrontier, id) && replies(value))
+  }
+  const list = SEEN.isYArray(chat) ? chat.toArray() : (Array.isArray(chat) ? chat : [])
+  const posted = new RegExp(`Issue #${Number(issueNumber)}(?: \\(attempt \\d+\\))?:`)
+  let from = -1
+  for (let i = list.length - 1; i >= 0; i--) if (/^GitHub/.test(String(list[i].by || '')) && posted.test(String(list[i].text || ''))) { from = i; break }
+  return from >= 0 && list.slice(from + 1).some(replies)
+}
+
+export async function peekRoom({ link, issueNumber, taskId, since = 0, postFrontier = null, token = '', timeoutMs = 60000 }) {
   const { relay, room } = parseLink(link)
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'hive-room-peek-'))
   const peek = startSync({ relay, room, dir, name: 'GitHub-peek', kind: 'ai', passive: true, syncFiles: false, token, log: () => {} })
@@ -537,15 +622,9 @@ export async function peekRoom({ link, issueNumber, taskId, since = 0, token = '
     const members = peek.members().filter((m) => m && m.name && !/^GitHub/.test(m.name) && m.kind !== 'human' && !m.passive)
     const reachable = members.filter((m) => ACT.describe(activity.get(m.name), { present: true, listener: m.listener, app: m.app, now: Date.now() }).reachable).map((m) => m.name)
     const chat = peek.doc.getArray('chat').toArray()
-    // Chat times are clock strings ("21:04:39") with no date, so "since the issue was posted" is
-    // told by POSITION: lines after the room's own post of this issue.
-    const ref = new RegExp(`#${Number(issueNumber)}(?!\\d)`)
-    const isAgent = (m) => m && m.kind !== 'human' && !/^GitHub/.test(String(m.by || ''))
-    let from = -1
-    // The LAST post of this issue: a retry is posted as "Issue #12 (attempt 2): ...".
-    const posted = new RegExp(`Issue #${Number(issueNumber)}(?: \\(attempt \\d+\\))?:`)
-    for (let i = chat.length - 1; i >= 0; i--) if (/^GitHub/.test(String(chat[i].by || '')) && posted.test(String(chat[i].text || ''))) { from = i; break }
-    const said = from >= 0 && chat.slice(from + 1).some((m) => isAgent(m) && (ref.test(String(m.text || '')) || (taskId && String(m.text || '').includes(taskId))))
+    // Chat times are clock strings ("21:04:39") with no date, so "since the issue was posted" is told
+    // by Yjs identity when the post's frontier is known, else by position (agentRepliedSince).
+    const said = agentRepliedSince({ chat: peek.doc.getArray('chat'), issueNumber, taskId, postFrontier })
     const t = peek.doc.getMap('tasks').get(taskId)
     const claimed = [...peek.doc.getMap('claims').values()].some((c) => c && c.by && Number(c.since || c.at || 0) >= since)
     return {

package/hive-seen.js

@@ -0,0 +1,135 @@
+// hive-seen.js -- which chat messages has this reader seen? Answered by IDENTITY, never by position.
+//
+// THE DEFECT THIS EXISTS FOR (9 Nov 2026, found live in room-6UlP…; reproduced by Opus-Cloud and
+// Claude-cloud on real Yjs at d5b6f56, urgent mail missed in 15 of 40 trials). Every "how far have I
+// read" marker in Hivecode was a COUNT or an ARRAY POSITION: the mailbox behind hive_wait/hive_check
+// and the [!] gate, the room read cursors behind hive_delivered, hive-await's cursor file, the stop
+// hook's watermark, hive-notify, the room watcher, the Slack bridge. But a Y.Array is not append-only.
+// A peer that pushed while its update was still in flight (offline, a stuck long-poll outbox, a crash
+// and rejoin) carries its own clock, and Yjs orders concurrent inserts by (clientID, clock), not by
+// arrival -- so the late message integrates BEHIND messages everyone already read. A position reader
+// never looks there again: it re-delivers a shifted old message and silently drops the new one.
+// antigravity-VM's "@Opus-Cloud … env variables" was stamped 10:22, reached the relay at 11:05 and
+// landed at #818, behind 13 messages the whole room had read. Nobody's reader delivered it.
+//
+// THE IDENTITY. Every element of a Y.Array has a global id {client, clock}: the client that inserted
+// it and that client's clock at the insert. It never changes, wherever the element ends up.
+//
+// "SEEN" IS A FRONTIER: per client, the HIGHEST clock this reader has seen. An id is seen iff
+// frontier[client] >= clock. A late element from a client carries a clock above that client's
+// frontier, so it is unseen wherever Yjs places it. A frontier is exact because one client's inserts
+// into one array integrate in clock order: Yjs never surfaces clock k+1 of a client before clock k.
+//
+// NOT A STATE VECTOR. Yjs's own state vector (Y.encodeStateVector) stores the NEXT clock it expects,
+// highest + 1. This stores the highest SEEN. Building one from the other is off by one and drops
+// exactly one message per client, silently -- so nothing here reads or writes a Yjs state vector, and
+// tests/mail-identity-test.mjs pins the difference. (Claude-cloud's review, attack 2.)
+//
+// PRUNED. Every MCP restart is a new Y.Doc clientID, so a long-lived room accumulates writers. A
+// frontier is pruned to clients that still have an undeleted element in the array. That only ever
+// costs a re-read, never a skip: a later element from a pruned client is unseen and is delivered.
+//
+// THE ONE INTERNAL. `itemsOf` walks the array's item list (`yarr._start`, `item.right`) because Yjs
+// has no public API that pairs a value with its id. yjs is pinned in package.json, and the test
+// asserts `itemsOf(a)` yields exactly `a.toArray()` in order, so a yjs change that breaks the walk
+// fails CI instead of silently mis-reading mail.
+
+/** Is this a Y.Array (or anything with Yjs item structure), as opposed to a plain JS array? */
+export function isYArray(x) {
+  return !!x && !Array.isArray(x) && typeof x.toArray === 'function' && '_start' in x
+}
+
+/**
+ * The array's elements in order, each with its Yjs id: [{ id: { client, clock }, value }].
+ * Deleted elements are skipped, as toArray() skips them. Element k of an item carries clock + k.
+ */
+export function itemsOf(yarr) {
+  const out = []
+  if (!isYArray(yarr)) return out
+  for (let it = yarr._start; it; it = it.right) {
+    if (it.deleted || !it.countable) continue
+    const vals = it.content.getContent()
+    for (let k = 0; k < vals.length; k++) out.push({ id: { client: it.id.client, clock: it.id.clock + k }, value: vals[k] })
+  }
+  return out
+}
+
+/** The clients that still have an undeleted element in the array. */
+export function liveClients(yarr) {
+  const s = new Set()
+  for (const { id } of itemsOf(yarr)) s.add(id.client)
+  return s
+}
+
+/** id as a short string, "client:clock" -- what HIVE_CHAT.md carries for readers without Yjs. */
+export const idKey = (id) => `${id.client}:${id.clock}`
+export function parseIdKey(s) {
+  const m = /^(\d+):(\d+)$/.exec(String(s || '').trim())
+  return m ? { client: Number(m[1]), clock: Number(m[2]) } : null
+}
+
+/** Does a serialized frontier ({ "client": clock }) cover this id? Absent or malformed covers nothing. */
+export function covers(json, id) {
+  if (!json || typeof json !== 'object' || !id) return false
+  const v = json[String(id.client)]
+  return Number.isFinite(Number(v)) && Number(v) >= id.clock
+}
+
+/**
+ * A mutable frontier. `version` counts real advances, so a publisher can tell "nothing new" from
+ * "something new" without comparing two objects.
+ */
+export function makeFrontier(json = null) {
+  const m = new Map()
+  let version = 0
+  const add = (id) => {
+    if (!id || !Number.isFinite(id.clock)) return false
+    const cur = m.has(id.client) ? m.get(id.client) : -1
+    if (id.clock <= cur) return false
+    m.set(id.client, id.clock); version++
+    return true
+  }
+  const merge = (other) => {
+    if (!other || typeof other !== 'object') return false
+    let changed = false
+    for (const [c, v] of Object.entries(other)) {
+      const client = Number(c), clock = Number(v)
+      if (Number.isFinite(client) && Number.isFinite(clock) && add({ client, clock })) changed = true
+    }
+    return changed
+  }
+  if (json) merge(json)
+  return {
+    has: (id) => !!id && m.has(id.client) && m.get(id.client) >= id.clock,
+    add,
+    merge,
+    get version() { return version },
+    get size() { return m.size },
+    /** Serialize. With `prune` (a Y.Array), keep only clients that still have an element in it. */
+    toJSON({ prune = null } = {}) {
+      const keep = prune ? liveClients(prune) : null
+      const o = {}
+      for (const [c, v] of m) if (!keep || keep.has(c)) o[String(c)] = v
+      return o
+    },
+  }
+}
+
+/** The frontier that covers the array's first n elements -- the one-time migration from a count. */
+export function frontierOfPrefix(yarr, n) {
+  const f = makeFrontier()
+  const items = itemsOf(yarr)
+  for (let i = 0; i < Math.min(Math.max(0, Number(n) || 0), items.length); i++) f.add(items[i].id)
+  return f
+}
+
+/**
+ * How many leading elements a frontier covers without a gap. Published beside the frontier as `at`,
+ * so a peer on an older build -- which only knows counts -- is never told more than was really read.
+ * It can go DOWN when a late element integrates inside the prefix, and that is the honest answer.
+ */
+export function coveredPrefix(yarr, json) {
+  let n = 0
+  for (const { id } of itemsOf(yarr)) { if (!covers(json, id)) break; n++ }
+  return n
+}

package/hive-slack.js

@@ -31,6 +31,7 @@ import path from 'path'
 import WebSocket from 'ws'
 import { startSync, parseLink } from './sync.js'
 import { scrub } from './hive-webhook.js'
+import * as SEEN from './hive-seen.js' // what was already forwarded, by Yjs id (0.14.4)
 import { realpathSync as __hiveRealpath } from 'fs'
 import { resolve as __hiveResolve } from 'path'
 import { fileURLToPath as __hiveFileURLToPath } from 'url'
@@ -38,6 +39,25 @@ import { fileURLToPath as __hiveFileURLToPath } from 'url'
 const DEFAULT_API = 'https://slack.com/api'
 const ROOM_THREAD_KEY = '__room__'
 const CURSOR_KEY = '__cursor__'
+
+/**
+ * The room->Slack observer: hands `onChat` every chat message not yet forwarded, by Yjs id, wherever it
+ * integrated (0.14.4; see runBridge for why not by count). `forwarded` is a Y.Map of frontiers keyed by
+ * channel, `at` the old count cursor (used to seed a frontier once, when none was saved), `threads` the
+ * map that keeps that count for older bridges. Returns the function to pass to chat.observe.
+ */
+export function makeChatForwarder({ chat, forwarded, key, at, threads, onChat }) {
+  const saved = forwarded.get(key)
+  const fwd = saved && typeof saved === 'object' ? SEEN.makeFrontier(saved) : SEEN.frontierOfPrefix(chat, at)
+  return () => {
+    const fresh = []
+    for (const { id, value } of SEEN.itemsOf(chat)) { if (fwd.has(id)) continue; fwd.add(id); fresh.push(value) }
+    if (!fresh.length) return
+    onChat(fresh)
+    try { forwarded.set(key, fwd.toJSON({ prune: chat })) } catch { }
+    try { const n = SEEN.coveredPrefix(chat, fwd.toJSON()); if (n > (Number(threads.get(CURSOR_KEY)) || 0)) threads.set(CURSOR_KEY, n) } catch { }
+  }
+}
 const MAX_SEEN_EVENTS = 500
 
 export const USAGE = `usage:
@@ -180,6 +200,28 @@ export function makeQueue({
 
 export const SLACK_TIMEOUT_MS = 15000
 
+// HOW SLACK READS A CALL'S ARGUMENTS (0.14.3 P0-4). Read methods take their arguments only from the
+// query string or a form body: a JSON body is ignored, so on 0.14.2 conversations.info answered
+// invalid_arguments and users.info user_not_found in a real workspace (measured 9 Nov 2026), which
+// broke `slack check`, the --slack-channel preflight, inbound stop/retry and stop verification.
+// Every fake Slack in the tests accepted JSON, so all of it was green. Write methods (chat.*,
+// agents.*, reactions.*...) take JSON and stay JSON: their blocks and metadata are nested objects.
+const FORM_METHOD = /^(?:(?:conversations|users|team|bots)\.[A-Za-z.]+|auth\.test)$/
+export function slackEncoding(method) {
+  return FORM_METHOD.test(String(method || '')) ? 'form' : 'json'
+}
+
+/** A form body Slack reads: undefined and null are LEFT OUT (never the text "undefined", which Slack
+ *  would read as a real channel or user id); a nested value is JSON inside its field, as Slack takes it. */
+export function slackForm(body = {}) {
+  const p = new URLSearchParams()
+  for (const [k, v] of Object.entries(body || {})) {
+    if (v === undefined || v === null) continue
+    p.append(k, typeof v === 'object' ? JSON.stringify(v) : String(v))
+  }
+  return p.toString()
+}
+
 /** POST to Slack's Web API. Kept tiny and injectable so the bridge can be tested without a
  *  workspace -- the thing worth testing is our routing, not Slack's HTTP.
  *  Applies a 15s AbortSignal timeout by default so a hung TCP socket never stalls the queue. */
@@ -191,10 +233,14 @@ export async function slackPost(
   apiBase = process.env.HIVE_SLACK_API || DEFAULT_API,
   timeoutMs = Number(process.env.HIVE_SLACK_TIMEOUT_MS) || SLACK_TIMEOUT_MS,
 ) {
+  const form = slackEncoding(method) === 'form'
   const r = await fetchImpl(`${apiBase}/${method}`, {
     method: 'POST',
-    headers: { 'Content-Type': 'application/json; charset=utf-8', Authorization: `Bearer ${token}` },
-    body: JSON.stringify(body),
+    headers: {
+      'Content-Type': form ? 'application/x-www-form-urlencoded; charset=utf-8' : 'application/json; charset=utf-8',
+      Authorization: `Bearer ${token}`,
+    },
+    body: form ? slackForm(body) : JSON.stringify(body),
     signal: AbortSignal.timeout(timeoutMs),
   })
   const retryHeader = r.headers && typeof r.headers.get === 'function' ? Number(r.headers.get('retry-after') || 0) : 0
@@ -2120,6 +2166,13 @@ export async function runSlackCheck({
     clearTimeout(waitTimer)
 
     if (!arrived) {
+      // Over HTTPS polling nothing is subscribed: the bridge reads the thread itself, and its read
+      // scopes were checked above. So no reply means nobody replied in time, and sending the person
+      // off to reinstall the app was wrong (9 Nov, the first real check: 0 replies in the thread).
+      if (pollInbound) {
+        logErr(`Q634 no reply arrived in the thread within ${Math.round(timeoutMs / 1000)} s. Replies are read over HTTPS, which needs no event subscription, and the read scopes are in place: reply anything in the thread of "Hivecode check: reply anything in this thread" in #${channelName} while the check waits (raise --timeout for more time).`)
+        return 1
+      }
       const manifestName = agent ? 'slack-app-manifest-agent.json' : 'slack-app-manifest-inbound.json'
       logErr(`Q634 replies did not arrive. Event subscriptions are probably missing: reinstall from ${manifestName}`)
       return 1
@@ -2363,8 +2416,13 @@ export async function main(argv = process.argv.slice(2), { log = console.log, lo
   }
   const chat = hive.doc.getArray('chat')
   const savedCursor = Number(bridge.threads.get(CURSOR_KEY)) || 0
-  let at = savedCursor > 0 && savedCursor <= chat.length ? savedCursor : chat.length
-  chat.observe(() => { const all = chat.toArray(); bridge.onChat(all.slice(at), at); at = all.length })
+  const at = savedCursor > 0 && savedCursor <= chat.length ? savedCursor : chat.length
+  // FORWARDED BY IDENTITY, NOT BY COUNT (0.14.4). `all.slice(at)` never looked behind `at`, so a message
+  // a peer pushed while its update was in flight -- which integrates BEHIND what was already counted --
+  // was never sent to Slack (hive-seen.js has the incident). What was forwarded is now a frontier of
+  // Yjs ids, kept in its own room map: the thread map's other keys are Slack thread ids, and an older
+  // bridge would try to poll any new key there as a thread. The count stays beside it, for those.
+  chat.observe(makeChatForwarder({ chat, forwarded: hive.doc.getMap('slack_forwarded'), key: String(CHANNEL), at, threads: bridge.threads, onChat: bridge.onChat }))
   await bridge.watchRoom()
   log(`READY: [hive-slack] @${pre.botUser} bridging ${room} -> #${pre.channelName} (${CHANNEL}) — resume: ${allowParsed.ids.length ? allowParsed.ids.join(', ') : 'off'}`)
   return 0

package/hive-stop-hook.js

@@ -55,6 +55,7 @@
  */
 import fs from 'fs'
 import path from 'path'
+import crypto from 'crypto'
 import { mentionsName, unansweredFor } from './hive-mailbox.js'
 import { isArmed, listenCommand, listenHow, listenOrder } from './hive-listen.js'
 import { readAgents, agentForHook } from './hive-session.js'
@@ -128,32 +129,46 @@ export function decide(o) {
   return { ...d, block: true, reason: d.block ? `${d.reason}\n\n${listenLine}` : listenLine, listenBlocks: listenBlocks + 1 }
 }
 
-function obligations({ chat, tasks, me, seen, taskBlocks, nudged = [] }) {
+// WHICH MENTIONS WERE ALREADY BLOCKED ON, BY IDENTITY, NOT BY LINE (0.14.4). The watermark was a line
+// count, `seen`: everything after line N was new. But the room's chat is a Y.Array, and a message a
+// peer pushed while its update was in flight integrates at its ORIGINAL position, behind lines already
+// counted -- so a late mention was rendered mid-file and this hook never blocked on it (hive-seen.js
+// has the incident). This file has no Yjs, so a mention is identified by what HIVE_CHAT.md carries:
+// author, time and text. The only messages that can share that are exact duplicates -- the same author
+// saying the same words in the same second -- and blocking once for both is the right answer anyway.
+const fingerprint = (m) => crypto.createHash('sha1').update(`${m.by}\u0000${m.at}\u0000${m.text}`).digest('hex').slice(0, 16)
+
+function obligations({ chat, tasks, me, seen, handled = null, taskBlocks, nudged = [] }) {
   const msgs = parseChat(chat)
   const nowSeen = msgs.length
-  // A cursor past the end means this is a different (rebuilt or switched) room -- start over
-  // rather than treating the whole history as unread and blocking on all of it.
-  const from = seen > nowSeen ? 0 : seen
-  const fresh = msgs.slice(from)
-
-  const mail = fresh.filter((m) =>
+  const isMail = (m) =>
     m.kind !== 'system' &&
     String(m.by).toLowerCase() !== String(me).toLowerCase() &&  // never block on our own post
-    mentionsName(m.text, me))
+    mentionsName(m.text, me)
+  // `handled` (0.14.4): the fingerprints of every mention already blocked on. A state written by an
+  // older build has only the count; it is migrated once, as the prefix it described. A count past the
+  // end means a different (rebuilt or switched) room: start over rather than block on its history.
+  let done
+  if (Array.isArray(handled)) done = new Set(handled)
+  else done = new Set(msgs.slice(0, seen > nowSeen ? 0 : seen).filter(isMail).map(fingerprint))
+  const mail = msgs.filter((m) => isMail(m) && !done.has(fingerprint(m)))
+  // After this decision every mention in the file is handled: blocked on now, or before. Kept to what
+  // the file holds, so it is bounded by the room's history and a rebuilt room sheds the old ones.
+  const nextHandled = [...new Set(msgs.filter(isMail).map(fingerprint))]
 
   if (mail.length) {
     const quoted = mail.slice(0, 5).map((m) => `  ${m.by}: ${m.text.replace(/\s+/g, ' ').slice(0, 220)}`)
     const more = mail.length > 5 ? `\n  ... and ${mail.length - 5} more` : ''
     return {
-      block: true, seen: nowSeen, taskBlocks: 0,
+      block: true, seen: nowSeen, handled: nextHandled, taskBlocks: 0,
       // Blocking here also spends this message's ONE nudge, so the debt branch below cannot
       // charge for the same message a second time. One block per message, whatever the reason.
       nudged: [...nudged, ...mail.map((m) => m.by + '|' + m.at)].slice(-200),
       reason: `You are in a Hivecode room and ${mail.length} message${mail.length > 1 ? 's' : ''} ` +
         `addressed to you arrived while you were working:\n\n${quoted.join('\n')}${more}\n\n` +
         `Do not stop -- they are waiting on a reply from you. Answer with hive_say (put @Name on ` +
-        `it), then go back to hive_wait. hive_wait is your idle state; ending your turn makes you ` +
-        `unreachable and nobody in the room finds out.`,
+        `it), then stay reachable the way this client does it (your listener, or hive_wait): a ` +
+        `participant who stops hearing still looks present, and nobody in the room finds out.`,
     }
   }
 
@@ -172,7 +187,7 @@ function obligations({ chat, tasks, me, seen, taskBlocks, nudged = [] }) {
   if (unnudged.length) {
     const quoted = unnudged.slice(0, 3).map((o) => `  ${o.from}: ${o.text.replace(/\s+/g, ' ').slice(0, 200)}`)
     return {
-      block: true, seen: nowSeen, taskBlocks,
+      block: true, seen: nowSeen, handled: nextHandled, taskBlocks,
       // Recorded BEFORE returning, exactly as the watermark is, so a question cannot block a
       // second time even if whatever happens next goes wrong. Capped so the state file cannot
       // grow without bound in a long-lived room.
@@ -181,7 +196,7 @@ function obligations({ chat, tasks, me, seen, taskBlocks, nudged = [] }) {
         `still waiting on a reply from you:\n\n${quoted.join('\n')}\n\n` +
         `Answer with hive_say and name them. "Not yet — I am on X, I will come back to you" is a ` +
         `complete answer; silence is the one thing they cannot act on, and nothing tells them you ` +
-        `stopped. Then call hive_wait.`,
+        `stopped. Then stay reachable (your listener, or hive_wait).`,
     }
   }
 
@@ -189,11 +204,11 @@ function obligations({ chat, tasks, me, seen, taskBlocks, nudged = [] }) {
   if (open.length && taskBlocks < MAX_TASK_BLOCKS) {
     const quoted = open.slice(0, 3).map((t) => `  [${t.id}] from ${t.from}: ${t.text.replace(/\s+/g, ' ').slice(0, 220)}`)
     return {
-      block: true, seen: nowSeen, taskBlocks: taskBlocks + 1, nudged,
+      block: true, seen: nowSeen, handled: nextHandled, taskBlocks: taskBlocks + 1, nudged,
       reason: `You are in a Hivecode room with ${open.length} accepted task${open.length > 1 ? 's' : ''} ` +
         `still open:\n\n${quoted.join('\n')}\n\n` +
         `Finish the work and call hive_complete with the task id, or say why you are blocked with ` +
-        `hive_say (@ the person who assigned it). Then call hive_wait. If you genuinely cannot ` +
+        `hive_say (@ the person who assigned it). Then stay reachable. If you genuinely cannot ` +
         `proceed, say so in the room first -- do not just stop, nobody would learn that you had.`,
     }
   }
@@ -202,7 +217,7 @@ function obligations({ chat, tasks, me, seen, taskBlocks, nudged = [] }) {
   // as it being resolved, so hold the counter rather than resetting it while it is still there.
   // Debts and tasks share the counter deliberately: they are the same kind of obligation, and
   // two separate counters would let an agent be pinned for 2x MAX_TASK_BLOCKS turns.
-  return { block: false, seen: nowSeen, taskBlocks: open.length ? taskBlocks : 0, nudged }
+  return { block: false, seen: nowSeen, handled: nextHandled, taskBlocks: open.length ? taskBlocks : 0, nudged }
 }
 
 /** Walk up from `start` looking for the session file; the hook's cwd is usually but not always
@@ -266,7 +281,7 @@ async function main() {
 
     const d = decide({
       chat, tasks: read('HIVE_TASKS.md'), me: session.name,
-      seen: Number(st.seen) || 0, taskBlocks: Number(st.taskBlocks) || 0,
+      seen: Number(st.seen) || 0, handled: Array.isArray(st.handled) ? st.handled : null, taskBlocks: Number(st.taskBlocks) || 0,
       nudged: Array.isArray(st.nudged) ? st.nudged : [],
       listening, listenLine, listenBlocks: Number(st.listenBlocks) || 0,
     })
@@ -274,7 +289,7 @@ async function main() {
     // GUARD 2: write the watermark BEFORE returning the block, so this message can never block a
     // second time even if what happens next goes wrong.
     try {
-      prev[key] = { seen: d.seen, taskBlocks: d.taskBlocks, nudged: d.nudged || [], listenBlocks: d.listenBlocks, at: Date.now() }
+      prev[key] = { seen: d.seen, handled: d.handled, taskBlocks: d.taskBlocks, nudged: d.nudged || [], listenBlocks: d.listenBlocks, at: Date.now() }
       fs.writeFileSync(statePath, JSON.stringify(prev, null, 2))
     } catch { /* a watermark we cannot persist is a reason to allow, never to fail */ }