hivecode-mcp 0.14.3 → 0.14.5

package/sync.js

@@ -24,10 +24,11 @@ import { WebsocketProvider } from 'y-websocket'
 import { createFileTransport } from './hive-mux.js' // ONE SOCKET PER PARTICIPANT: every file doc on one physical socket when the relay offers it
 import { HiveSocket, transportFor } from './hive-transport.js' // a WebSocket, or HTTPS long-poll where WebSockets are refused
 import ignore from 'ignore'
-import { applyDiff, summarizeChange, changedRange, hasConflictMarkers, merge3 } from './core.js'
+import { applyDiff, summarizeChange, changedRange, hasConflictMarkers, merge3, lineHunks, blockVersions } from './core.js'
 import { icrMerge3 } from './icr-merge.js' // structure/intent-aware merge; falls back to line merge3
 import { makeCoordinator } from './hive-coord.js' // decentralized claim layer (collision PREVENTION)
-import { gateConfig, runGate, verdictRecord, refusalMessage, forcedMessage } from './hive-gate.js' // the HANDOFF gate: a claim you cannot give back while your own check fails
+import { RULES_MD, AGENT_MANUAL } from './hive-instructions.js'
+import { gateConfig, runGate, verdictRecord, refusalMessage, forcedMessage, gateApproved, gatesDir, writeApproval, notApprovedMessage, notApprovedLine, GATE_CMD, GATE_NOT_APPROVED } from './hive-gate.js' // the HANDOFF gate: a claim you cannot give back while your own check fails
 import { fileRoom, decodeUnsafe, scopeForRoom, pathAllowed, writeAllowed, isSafeRelPath } from './token.js'
 import { validateMemberName } from './hive-mailbox.js' // a name the mention parser cannot produce is not a name
 import { genIdentity, authorChange, verifyReceipt, contentHash } from './substrate.js' // convergent-substrate: signed provenance for every landed change
@@ -167,6 +168,222 @@ export function fusionReason(merged, mine, theirs, lang) {
 
 const endNl = (s) => (s === '' || s.endsWith('\n') ? s : s + '\n')
 
+// SAME-LINE RACE (P0-F, docs/rules-rewrite/p0f-design.md). Two saves of one line made before either
+// client saw the other reach the shared Y.Text as concurrent character edits, and the CRDT keeps both:
+// "ship friday" saved as "ship monday" and "ship tuesday" became "ship montuesday" in every folder, and
+// the same change twice became "ship monmonday". Every version from 0.6.0 to 0.14.3 did it. So each save
+// also records its INTENT -- the line hunks it changed and a hash of the text it was made from -- in the
+// same transaction, and these pure functions decide from the intents what the file should say.
+//
+// An intent: { b: contentHash(base), h: [[baseStart, baseEnd, newLines]...] }. Null when the diff is too
+// big to describe (lineHunks gave up) or the hunks are larger than INTENT_MAX_LINES: no detection then,
+// exactly as before.
+const INTENT_MAX_LINES = 400
+export function intentHunks(base, next) {
+  const a = base.split('\n'), b = next.split('\n')
+  const hs = lineHunks(a, b)
+  if (!hs) return null
+  let n = 0
+  const out = hs.map(([bs, be, ss, se]) => { n += se - ss; return [bs, be, b.slice(ss, se)] })
+  return n > INTENT_MAX_LINES ? null : out
+}
+// The base text with one intent's hunks applied: that author's whole version.
+export function applyIntent(base, h) {
+  const lines = base.split('\n')
+  for (const [bs, be, nl] of [...h].sort((x, y) => y[0] - x[0])) lines.splice(bs, be - bs, ...nl)
+  return lines.join('\n')
+}
+// Can two saves made from the same text damage each other in the character CRDT? (Opus-Cloud's rule,
+// fuzzed at 0 bad over about 78k pairs.) applyDiff sends ONE character span per save, from its first
+// changed line to its last, so a save's footprint is [first hunk start, last hunk end), not its hunks:
+// A editing lines 1 and 5 while B edits line 3 lost B's line under a per-hunk rule (8,439 of 49,748
+// "no clash" pairs fused or lost an edit). Footprints that overlap clash. Footprints that only touch
+// clash too, because a pure insertion or deletion slides along repeated text into its neighbour, except
+// two same-size line replacements side by side: that is the W1 shape, and the CRDT merges it correctly
+// (0 of 915 fused), so it must not become a conflict as the fork gate makes it.
+const footprint = (h) => (h.length ? [h[0][0], h[h.length - 1][1], h.length === 1 ? h[0][2] : null] : null)
+export function hunksClash(h1, h2) {
+  const a = footprint(h1), b = footprint(h2)
+  if (!a || !b) return false
+  if (Math.max(a[0], b[0]) < Math.min(a[1], b[1])) return true
+  const rep = (f) => f[2] !== null && f[1] > f[0] && f[1] - f[0] === f[2].length
+  const touch = a[1] === b[0] || b[1] === a[0] || (a[0] === a[1] && a[0] >= b[0] && a[0] <= b[1]) || (b[0] === b[1] && b[0] >= a[0] && b[0] <= a[1])
+  return touch && !(rep(a) && rep(b))
+}
+// Do two saves change the same base LINE? The finer question, asked inside a clash: when no two saves
+// do, they can all be applied cleanly and the result needs no markers.
+export function linesOverlap(h1, h2) {
+  for (const [a0, a1] of h1) for (const [b0, b1] of h2) {
+    if (Math.max(a0, b0) < Math.min(a1, b1)) return true
+    if (a0 === a1 && b0 < a0 && a0 < b1) return true
+    if (b0 === b1 && a0 < b0 && b0 < a1) return true
+  }
+  return false
+}
+// Two hunks share a base line: spans that overlap, or a line inserted strictly inside the other's span.
+function spansMeet([a0, a1], [b0, b1]) {
+  if (Math.max(a0, b0) < Math.min(a1, b1)) return true
+  if (a0 === a1 && b0 < a0 && a0 < b1) return true
+  if (b0 === b1 && a0 < b0 && b0 < a1) return true
+  return false
+}
+// The clash region and everything around it, for intents (Map clientID -> h) all made from `base`.
+// [rs, re) spans every base line that two intents both changed. Outside it the intents' hunks are
+// disjoint, so the lines before and after are the base's with those hunks applied, the same for every
+// author; inside it each author has their own version. Null when nothing clashes.
+export function clashRegion(base, intents) {
+  let rs = Infinity, re = -Infinity
+  const all = [...intents.values()]
+  for (let i = 0; i < all.length; i++) for (let j = 0; j < all.length; j++) {
+    if (i === j) continue
+    for (const hi of all[i]) if (hunksClash([hi], all[j])) { rs = Math.min(rs, hi[0]); re = Math.max(re, hi[1]) }
+  }
+  if (rs === Infinity) return null
+  const b = base.split('\n')
+  // Before the region, inside it, or after. An insertion AT either edge is inside: it touches the clash.
+  const where = ([bs, be]) => (be < rs || (be === rs && bs < rs) ? 'pre' : bs > re || (bs === re && be > re) ? 'post' : 'in')
+  const hs = tagged(intents)
+  const pre = applyTagged(b.slice(0, rs), hs.filter((x) => where(x) === 'pre'))
+  const post = applyTagged(b.slice(re), hs.filter((x) => where(x) === 'post'), re)
+  const inside = hs.filter((x) => where(x) === 'in')
+  const sides = new Map()
+  for (const id of [...intents.keys()].sort((x, y) => x - y)) sides.set(id, applyTagged(b.slice(rs, re), inside.filter((x) => x[3] === id), rs))
+  return { rs, re, pre, post, sides, inside }
+}
+// Every hunk tagged with its author, in the one order every peer applies them: from the bottom up; at one
+// start line a span before an insertion there (inserting first let the span delete the inserted line);
+// insertions at one point higher client first, so the lower client's lines come first. Never arrival order.
+function tagged(intents) {
+  return [...intents].flatMap(([id, h]) => h.map((x) => [x[0], x[1], x[2], id])).sort((x, y) => y[0] - x[0] || (y[1] - y[0]) - (x[1] - x[0]) || y[3] - x[3])
+}
+function applyTagged(lines, hs, off = 0) { for (const [bs, be, nl] of hs) lines.splice(bs - off, be - bs, ...nl); return lines }
+// What the file should say once these intents (every save made from `base` at that moment) are folded in.
+// Every peer computes the same text:
+//  - no two authors changed the same line: every change applied cleanly (the merge the CRDT got wrong);
+//  - otherwise one marker block over the region where they did, holding each distinct version once, in
+//    client order; an author who left that region as it was is not a version. Changes elsewhere, by
+//    anyone, are applied around the block. (merge3 cannot fold a third version in: it strips existing
+//    markers so blocks never nest, and the third author's line was lost that way, R6.)
+export function clashFinal(base, intents, names = new Map()) {
+  const r = clashRegion(base, intents)
+  if (!r) return applyTagged(base.split('\n'), tagged(intents)).join('\n')
+  const reg = base.split('\n').slice(r.rs, r.re)
+  const changed = [...r.sides].filter(([, l]) => J(l) !== J(reg))
+  const meet = r.inside.some((p, i) => r.inside.some((q, j) => j > i && p[3] !== q[3] && J(p.slice(0, 3)) !== J(q.slice(0, 3)) && spansMeet(p, q)))
+  let mid
+  if (!changed.length) mid = reg
+  else if (!meet) {
+    const seen = new Set()
+    mid = applyTagged(reg.slice(), r.inside.filter((x) => { const k = J(x.slice(0, 3)); if (seen.has(k)) return false; seen.add(k); return true }), r.rs)
+  } else {
+    const distinct = []
+    for (const [id, lines] of changed) if (!distinct.some((d) => J(d.lines) === J(lines))) distinct.push({ id, lines })
+    const label = (id) => String(names.get(id) || `client ${id}`).replace(/[\r\n]/g, ' ')
+    if (distinct.length === 1) mid = distinct[0].lines
+    else if (distinct.length === 2) mid = [`<<<<<<< ${label(distinct[0].id)}`, ...distinct[0].lines, '=======', ...distinct[1].lines, `>>>>>>> ${label(distinct[1].id)}`]
+    else {
+      // Plain separators: a labelled one ("======= Bob") is not one any merge reads, and a late save
+      // merged against such a block lost every version in it (late-save-merge-test L2).
+      mid = [`<<<<<<< ${label(distinct[0].id)}`, ...distinct[0].lines]
+      for (const d of distinct.slice(1)) mid.push('=======', ...d.lines)
+      mid.push(`>>>>>>> ${distinct.slice(1).map((d) => label(d.id)).join(', ')} (${distinct.length} versions)`)
+    }
+  }
+  return [...r.pre, ...mid, ...r.post].join('\n')
+}
+const J = (x) => JSON.stringify(x)
+// The text every folder holds once these saves (Map clientID -> hunks, all made from `base`) have crossed:
+// their character union. It depends only on the base text, each author's text and their client ids, not on
+// the history that built the base (tests/same-line-intent-unit-test.mjs, CU rows), so every peer can
+// rebuild it exactly from the intents alone.
+export function clashUnion(base, intents, laters = []) {
+  const root = new Y.Doc(); root.clientID = 0; root.getText('t').insert(0, base)
+  const seed = Y.encodeStateAsUpdate(root)
+  const docs = new Map()
+  for (const [id, h] of [...intents].sort((x, y) => x[0] - y[0])) { const d = new Y.Doc(); d.clientID = id; Y.applyUpdate(d, seed); applyDiff(d.getText('t'), applyIntent(base, h)); docs.set(id, d) }
+  // A later save (F5): made by `id` on a text that already held the saves in `after`, so its doc had their
+  // updates (and its own earlier ones, if `id` saved before) when it applied its hunks.
+  for (const L of laters) {
+    let d = docs.get(L.id)
+    if (!d) { d = new Y.Doc(); d.clientID = L.id; Y.applyUpdate(d, seed); docs.set(L.id, d) }
+    for (const a of L.after) if (a !== L.id && docs.has(a)) Y.applyUpdate(d, Y.encodeStateAsUpdate(docs.get(a)))
+    const t = d.getText('t')
+    applyDiff(t, applyIntent(t.toString(), L.h))
+  }
+  const all = [...docs.values()]
+  if (!all.length) { root.destroy(); return base }
+  const ups = all.map((d) => Y.encodeStateAsUpdate(d))
+  for (const u of ups) Y.applyUpdate(all[0], u)
+  const out = all[0].getText('t').toString()
+  for (const d of all) d.destroy(); root.destroy()
+  return out
+}
+// F5: which text was a later save made from? A save that arrives while a race from `base` is pending, but
+// was made from another text, was usually made from what its author held: one side of the race, or the
+// clean merge of several sides that do not clash. Returns { after, text } -- the saves that text held and
+// the text itself -- when `bHash` is the hash of such a text, else null. Never a FUSED union: a version made
+// from fused text would carry the fused line into the resolution as if someone had written it.
+// A SAME-LINE SAVE THAT ARRIVES AFTER THE RACE WAS RESOLVED (P0-F-12). `base` is the text the save was made
+// from and `side` the author's file. The save reached the shared text as a character edit made against
+// `base`, but the room had already replaced that line with a conflict block, so the CRDT put what the save
+// inserted next to the characters it was anchored on, which the block had deleted: `wednes<<<<<<< Bob`.
+// Returns the room's text before the save -- `current` with the save's inserted text taken out -- when
+// that is a well-formed block whose versions are other edits of the lines this save changed. Null
+// otherwise: not this shape, so not ours to repair.
+export function lateOverBlock(base, side, current) {
+  let p = 0
+  while (p < base.length && p < side.length && base[p] === side[p]) p++
+  let s = 0
+  while (s < base.length - p && s < side.length - p && base[base.length - 1 - s] === side[side.length - 1 - s]) s++
+  const ins = side.slice(p, side.length - s)
+  // (Not hasConflictMarkers: the opener this repairs no longer starts its line.)
+  if (!ins || !/<<<<<<< |>>>>>>> /.test(current) || current.includes(side)) return null
+  // Already a version of a block in the room: nothing to repair.
+  const cv = blockVersions(current)
+  if (cv && cv.versions.includes(side)) return null
+  const mine = intentHunks(base, side)
+  if (!mine || !mine.length) return null
+  const lo = mine[0][0], hi = mine[mine.length - 1][1]
+  for (let i = current.indexOf(ins); i >= 0; i = current.indexOf(ins, i + 1)) {
+    // The CRDT can only have put it where its anchor characters were, and the block deleted those: at an
+    // edge of the block, just before its opener or at the end of its closing line. Anywhere else (inside a
+    // version, say) it is someone's text, not a stray.
+    const before = current.slice(0, i), after = current.slice(i + ins.length)
+    const lineStart = before.lastIndexOf('\n') + 1
+    const atOpen = after.startsWith('<<<<<<< ') && lineStart === i
+    const atClose = /^>>>>>>> /.test(current.slice(lineStart, i)) && (after === '' || after[0] === '\n')
+    if (!atOpen && !atClose) continue
+    const x = before + after
+    if (!hasConflictMarkers(x) || /[^\n](<<<<<<< |>>>>>>> )/.test(x)) continue
+    const bv = blockVersions(x)
+    if (!bv || bv.versions.length < 2) continue
+    // Every version the block holds is an edit of this save's lines, from `base`. It may differ from
+    // `base` elsewhere too: someone changed another line since (a far line, in same-line-soak-test seed
+    // 3, and the repair was refused). The late-save merge carries that change into every version.
+    const ok = bv.versions.every((v) => {
+      const h = intentHunks(base, v)
+      return h && h.some(([bs, be]) => be >= lo && bs <= hi)
+    })
+    if (ok) return x
+  }
+  return null
+}
+export function explainBase(base, firsts, bHash) {
+  const ids = [...firsts.keys()].sort((x, y) => x - y).slice(0, 6)
+  const pick = (k, from = 0) => (k === 0 ? [[]] : ids.slice(from).flatMap((id, i) => pick(k - 1, from + i + 1).map((r) => [id, ...r])))
+  for (let k = 1; k <= ids.length; k++) for (const sub of pick(k)) {
+    const m = new Map(sub.map((i) => [i, firsts.get(i)]))
+    const t = clashUnion(base, m)
+    if (contentHash(t) === bHash && t === clashFinal(base, m)) return { after: sub, text: t }
+  }
+  return null
+}
+export function clashOnlyRegion(base, intents, final, current, laters = []) {
+  if (final === current) return true
+  if (!clashRegion(base, intents)) return false
+  return current === clashUnion(base, intents, laters)
+}
+
 // HIV-P17. Why a creation race of relPath must NOT land, '' when it may: 'CONFLICT' when two whole
 // files collide in a file with a language, else fusionReason's answer when a clean-looking union
 // broke code both sides could parse. No language (Markdown) is never refused.
@@ -229,149 +446,12 @@ const OWN_LOCAL = new Set([SHADOW_FILE, SHADOW_FILE + '.tmp', LOCK_FILE, '.hive-
 // Written into every room folder on sync (like the rules). An AI agent that opens
 // this project reads it to learn it's a Hivecode room and how to JOIN — via the
 // .hive.json already in the folder, so no human has to paste a link.
-const AGENT_MANUAL_TEXT = `# Hivecode — for AI agents working in this folder
-
-This project is part of a live Hivecode room: humans and AI agents editing the same
-codebase together, in real time, with no git push/pull. If you are an AI assistant
-asked to collaborate here, follow this.
-
-## Join the room
-1. If you do NOT have a \`hive_join\` tool and you can run terminal commands, register
-   the Hivecode MCP server, then reload so the tools load:
-     claude mcp add hivecode -- npx -y hivecode-mcp@latest
-2. Call: hive_join({ dir: ".", name: "<your name>", owner: "<the human you work for>" })
-   The room, relay, and token are already saved in .hive.json in this folder, so you
-   do NOT need a link — hive_join reads them automatically.
-3. Read the HIVE_RULES it returns, and follow them.
-
-## Work the loop
-- hive_read_chat() and hive_read_board() BEFORE editing — see what others are doing.
-- hive_claim("path/to/file") BEFORE you edit a file. If you get it, edit then
-  hive_release it. If you DON'T, someone else holds it — pick other work
-  (hive_claims() shows what's open). This is how agents avoid colliding.
-- hive_say("taking X: doing Y") to announce intent before you edit.
-- ADDRESS EVERY MESSAGE. Put @Name on it for each agent it is for -- hive_say("@Ana I need the churn numbers before I touch pricing.md"). Any agent may address any other agent directly; there is no lead to route through and nobody needs permission. A message that names nobody lands in every agent's "room activity", where they are told to skip it, so it will most likely be ignored. Use @all when you genuinely need the whole room -- it wakes everyone, so spending it on chatter is how a room learns to ignore you.
-- ANSWER EVERY QUESTION AIMED AT YOU. "Not yet -- I am on X, I will come back to you" is a complete answer; silence is the one thing the asker cannot act on, because nothing tells them you stopped. hive_check lists anyone still waiting on you.
-- BEFORE A LONG STRETCH OF WORK, call hive_busy("what you are doing"). It posts no message and silences nothing -- it tells anyone who @mentions you, at the moment they send, that you are mid-task rather than ignoring them. hive_busy(clear:true) when you finish.
-- Edit ONLY inside the folders you were granted. Edits merge live; rewrites are logged.
-- Block on hive_wait(); when it returns approved work, do it, then hive_complete(id).
-- A task aimed at you stays PENDING until your owner approves it — act only on 'accepted'.
-
-## Rules of the road
-- Stay in your lane — never edit folders you weren't granted.
-- Announce before editing; coordinate in chat; ask before anything destructive in others' areas.
-- If a human PAUSES you, finish your current step and stop until resumed.
-- Resolve <<<<<<< conflict markers properly — never blindly overwrite.
-- A human can ROLL BACK your changes at any time; that's normal — re-read and continue.
-
-## If something breaks
-Support is support@getgrm.tech. Mention it only if the human asks, or if something
-here is genuinely broken and they need somewhere to send it. Never volunteer it
-otherwise, and never write it into a file.
-`
+const AGENT_MANUAL_TEXT = AGENT_MANUAL // hive-instructions.js: one source for every agent-facing text (0.14.4)
 
 // The hive's law. Auto-written into every room folder so it is ALWAYS present —
 // no setup, no relying on an agent to remember it. The sync layer enforces the
 // hard parts (merge, board); this is the rest, in plain imperative language.
-const HIVE_RULES_TEXT = `# HIVE RULES — read this first. Everyone in this room (human or AI) follows these.
-
-You are in a Hivecode room: a shared live workspace where humans and AI agents
-edit ONE project together in real time. These rules keep anyone from destroying
-another's work. The sync layer enforces the hard parts automatically; you do the rest.
-
-## Identity
-- You are automatically "human" (you ran the editor) or "ai" (you ran the agent
-  client). Nobody declares it — running the client is the declaration.
-
-## Know who you are working with
-- Read HIVE_MEMBERS.md — who (humans + AIs) is in the room right now, and how many.
-
-## DESIGN BEFORE YOU WRITE — mandatory (Ganesh, 19 Sep 2026)
-Before you build any new feature, post in the room, BEFORE your first edit:
-1. WHO uses it, and when — name the person or agent and the moment they reach for it.
-2. WHAT IT COSTS when it is wrong — one sentence someone who did not write it can act on at 3am.
-3. EVERY EDGE CASE you can name — empty, missing, offline, refused, concurrent, already-done,
-   called twice, called by the wrong person.
-Then build it.
-This is not process for its own sake. Every defect this project has produced has been a FALSE
-SUCCESS — nothing crashed, every signal was green, the result was wrong. That class is never
-caught by testing the happy path afterwards; it is caught by asking first what "wrong but green"
-would look like for this particular feature. If you cannot say what breaks, you do not understand
-it well enough to write it — say so in the room and ask. That is a complete answer.
-
-## Before you touch a file
-1. Read HIVE_CHAT.md — what is everyone doing right now.
-2. Read HIVE_BOARD.md — which files were just rewritten (and what was touched).
-3. If a file you plan to edit appears there, RE-READ it before changing it.
-
-## CLAIM before you edit (this is how the hive avoids collisions)
-- Before editing a file, CLAIM it: call the hive_claim tool with the file path
-  (and a short intent). This is the most important coordination step.
-  • If you GOT it: edit it, then call hive_release when you finish.
-  • If you could NOT get it: someone else holds it — do NOT edit it. Pick other
-    work; call hive_claims to see what's open.
-- Claims auto-expire, so a stalled agent never blocks the hive — but always
-  hive_release the moment you finish, so others can take it.
-
-## While you work
-4. ANNOUNCE first: post to chat what you are taking, e.g.
-   call hive_say with "taking auth.js: adding login validation"
-5. PREFER SMALL PATCHES — grep to the spot, edit a few lines. Patches from
-   different agents merge automatically with no conflict.
-6. AVOID full-file rewrites unless necessary. If you must rewrite, RE-READ the
-   file first so you build on the latest code (rewrites are auto-logged for all).
-7. STAY IN YOUR LANE — if someone said "I own X" (e.g. the backend), read X but
-   do not edit it; leave that to the owner.
-
-## When things collide
-8. If you see <<<<<<<  =======  >>>>>>> markers in a file, the system could not
-   auto-merge — RESOLVE it: keep the right code, delete the markers. Never ignore
-   them or blindly overwrite.
-9. If your edit was merged/reworked, that is normal — re-read and continue.
-
-## Talking
-10. Coordinate in chat. ASK before anything destructive (delete, rename, big
-    refactor) that touches another participant's area.
-
-## Directed work + permission (the asymmetric gate)
-11. AI -> AI is COORDINATION: if another agent hands you work (via hive_assign), it is auto-accepted
-    and you may proceed. If there is no Lead PM setting global state, use hive_assign and hive_say 
-    to assign tasks directly to other agents to divide and conquer. This is how a leaderless hive 
-    plans and divides work by itself.
-12. A HUMAN directing you is different. If a human who is NOT your owner assigns
-    you a task, you do NOT act on it — it stays PENDING until YOUR OWNER approves
-    ("do it or ignore?"). Your own owner's requests proceed. Act only on tasks
-    whose status is 'accepted'.
-13. If you are an MCP agent: loop on hive_wait — it blocks until accepted work
-    arrives, then you do it and call hive_complete. No need to poll. A pending
-    human request will NOT wake you until your owner approves it.
-
-## Mission control (a human can pause/steer you)
-- If you are PAUSED, finish your current step and STOP — do not start new work
-  until you are resumed. (MCP agents: hive_wait returns no work while paused.)
-- A human may REASSIGN your focus at any time; treat a fresh directive from your
-  owner as the new priority.
-
-## When a ping arrives while you are mid-task (interruptions)
-14. hive_wait only checks BETWEEN steps, so a ping never interrupts mid-step.
-    Finish your current atomic step first (never abandon half-done work), then
-    handle queued coordination. If it's urgent (build broken, blocking others),
-    do it now.
-15. ACKNOWLEDGE a ping as soon as you see it so the sender isn't left hanging,
-    e.g. say "got it — finishing X (~2 min), then on your fix".
-16. YOU triage: announce do-now vs after-current. Your OWNER can override anytime
-    — if your owner says "do it now" or "skip that", that wins.
-
-## State-Machine Prompting (SMP)
-17. The Lead PM controls the [GLOBAL PROJECT STATE] via hive_set_state.
-18. ONLY use short enum flags (e.g. "APPROVED", "LOCKED"). Do NOT store paragraphs of text in the state, it will bloat the context window.
-19. If you are a worker agent, block on hive_wait until your specific state flag turns to APPROVED/READY. Do not write code if you are LOCKED.
-
-Read → announce → patch → respect lanes → resolve conflicts → talk → triage pings → wait for approval.
-
----
-Support: support@getgrm.tech
-`
+const HIVE_RULES_TEXT = RULES_MD // hive-instructions.js (0.14.4); HIVE_RULES.md in the package is generated from it
 
 /**
  * Where an account licence may come from, in precedence order — and where it may NOT.
@@ -461,7 +541,10 @@ export function acquireFolderLock(root, room, log = console.log) {
   return release
 }
 
-export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir = '.', name = 'anon', kind = 'human', owner = '', token = '', license = '', log = console.log, syncFiles = true, passive = false, listener = false, app = '' }) {
+export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir = '.', name = 'anon', kind = 'human', owner = '', token = '', license = '', log = console.log, syncFiles = true, passive = false, listener = false, app = '', gatesDir: gatesDirOpt = '' }) {
+  // Where this machine keeps its gate approvals (0.14.4 S-1): outside the synced folder, so no peer can write one.
+  const GATES_DIR = gatesDirOpt || gatesDir()
+  const gateSkipSaid = new Set() // (agent, command) pairs already announced as unchecked
   // BEFORE ANY DISK OR SOCKET WORK. A name outside the mention grammar joins successfully and is
   // then unreachable: its mail, its obligations and its wake-on-mention are all silently dead,
   // and the only symptom is other people being told "@X is NOT in the room" about someone who is
@@ -910,7 +993,7 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
       let real = false
       for (let i = 0; i < arr.length && !real; i++)
         for (let j = i + 1; j < arr.length && !real; j++) {
-          const m = merge3(base, arr[i].text, arr[j].text)
+          const m = merge3(base, arr[i].text, arr[j].text, { sideBySide: true }) // the sync rule (#17)
           if (m.conflict || hasConflictMarkers(m.text)) real = true
         }
       if (!real) continue
@@ -960,7 +1043,7 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
       // Carry each side's SIGNED intent into the announcement: the WHY is what lets any
       // agent in the room reconcile the fork (via hive_resolve) instead of picking a winner.
       const why = rec.versions.map((v) => `${v.name}: "${versionIntent(fe, rec, v.hash) || 'no stated intent'}"`).join(' | ')
-      try { say(`⚠ SILENT FORK in ${relPath}: ${who} changed the same region concurrently. Signed intents — ${why}. Surfaced ALL ${rec.versions.length} versions with <<<<<<< markers. ANY agent may reconcile BOTH intents: call hive_resolve with the full resolved file — it is validated (parses, no dangling refs) before it lands.`) } catch { }
+      try { postOnce(`fork:${relPath}:${contentHash(rec.versions.map((v) => v.hash).sort().join(',')).slice(0, 16)}`, `⚠ SILENT FORK in ${relPath}: ${who} changed the same region concurrently. Signed intents — ${why}. Surfaced ALL ${rec.versions.length} versions with <<<<<<< markers. ANY agent may reconcile BOTH intents: call hive_resolve with the full resolved file — it is validated (parses, no dangling refs) before it lands.`, { observer: true }) } catch { }
     }
   }
   // A resolution landed elsewhere: the shared text is clean again. Adopt it to disk.
@@ -1258,7 +1341,8 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
   // to everybody; this is what lets a join tell another agent with the same name (refused, see
   // sameNameElsewhere) from this agent a moment ago, restarting in the same folder (allowed).
   const IID = crypto.createHash('sha256').update(`${os.hostname()}|${ROOT}`).digest('hex').slice(0, 12)
-  provider.awareness.setLocalStateField('user', { name, kind, owner: owner || undefined, v: PROTOCOL_VERSION, hv: VERSION_LABEL, passive: !!passive, listener: listener || undefined, app: app || undefined, iid: IID }) // identity is implicit in the client
+  const joinedAt = Date.now()
+  provider.awareness.setLocalStateField('user', { name, kind, owner: owner || undefined, v: PROTOCOL_VERSION, hv: VERSION_LABEL, passive: !!passive, listener: listener || undefined, app: app || undefined, iid: IID, joined: joinedAt }) // identity is implicit in the client
 
   // ---- relay reachability, said out loud exactly once -------------------------------
   // y-websocket retries forever and silently. That is the right RECOVERY behaviour and
@@ -1440,7 +1524,7 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
               `Do not trust this folder's contents meanwhile.`,
           })).text
       log(`[${name}] !! ${msg}`)
-      try { say(`[!] @all ${msg}`) } catch { /* chat may itself be unreachable — the log still carries it */ }
+      try { postOnce(`notsyncing:${code || 'stuck'}`, `[!] @all ${msg}`, { observer: true, ttlMs: 10 * 60 * 1000 }) } catch { /* chat may itself be unreachable — the log still carries it */ }
     }, 4000)
     if (refusalTimer.unref) refusalTimer.unref()
   }
@@ -1524,6 +1608,270 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
     })
   }
 
+  // ---- SAME-LINE RACE (P0-F; docs/rules-rewrite/p0f-design.md) ----
+  // A save held on the way for less than LATE_OWN_MS is still part of its race; longer is an offline edit (F4).
+  const LATE_OWN_MS = 2 * 60 * 1000, CLASH_SETTLE_MS = Number(process.env.HIVE_CLASH_SETTLE_MS) || 750, CLASH_HOLD_MS = 8000, RECENT_TEXTS = 8
+  // The last few texts this folder held for a file, by hash: a peer's intent names the text it was made
+  // from, and this is how we know it.
+  function rememberText(fe, t) {
+    const h = contentHash(t)
+    if (fe.recent.has(h)) fe.recent.delete(h)
+    fe.recent.set(h, t)
+    while (fe.recent.size > RECENT_TEXTS) fe.recent.delete(fe.recent.keys().next().value)
+    return h
+  }
+  // Called inside the transaction that sends a change from `from` to `to`.
+  function recordIntent(relPath, fe, from, to, mine = null) {
+    // A text holding conflict markers is a merge's verdict, not one author's edit, and the room has been
+    // told about it already. As an intent it made a neighbour's edit look like a clash (bigproject W1), so
+    // it never starts one (m). But it is still recorded (F5): a race resolved after it must know this
+    // change is in the shared text, and what the author's own version was (v: from -> their file).
+    const marked = hasConflictMarkers(to)
+    if (marked && (mine == null || hasConflictMarkers(mine))) return
+    const h = intentHunks(from, to)
+    if (!h) return
+    const vh = marked ? intentHunks(from, mine) : null
+    if (marked && !vh) return
+    const b = rememberText(fe, from)
+    rememberText(fe, to)
+    const me = fe.doc.clientID
+    const v = marked ? { b, h, n: name, m: 1, v: vh } : { b, h, n: name }
+    // Our own last save, for P0-F-12: if it reaches the room after a race on its line was resolved, this
+    // client is the one that repairs it. Kept apart from `intents`, which forgets after the window.
+    if (!marked) fe.lastOwn = { base: from, side: to, at: Date.now() }
+    fe.intent.set(String(me), v)
+    fe.intents.set(me, { ...v, at: Date.now() })
+    // An intent only matters while a race could still be arriving. Left in place it stays in the file's
+    // history forever, and a client gets a new id on every start (review F3), so take ours out after the
+    // window, unless a later save has replaced it. The window is LATE_OWN_MS, not 15 s: a client whose
+    // connection dropped for longer than that resyncs in ONE update, where an intent set and deleted is
+    // not there at all. Nobody saw the race, and the fused line stayed, unmarked (soak, a 25 s hold).
+    const t = setTimeout(() => {
+      if (stopped || !fileDocs.has(relPath) || fe.intent.get(String(me)) !== v) return
+      try { fe.doc.transact(() => fe.intent.delete(String(me))) } catch { }
+    }, LATE_OWN_MS + 1000)
+    if (t.unref) t.unref()
+  }
+  // P0-F-12: A SAME-LINE SAVE THAT ARRIVES AFTER ITS RACE WAS RESOLVED (same-line-very-late-test). It was
+  // made at the same moment as the race's saves, but reached the room only after the room had written
+  // the race's block, and the CRDT put what it inserted beside the block (`wednes<<<<<<< Bob`). Any
+  // client that can explain the text that way (lateOverBlock) knows the repair: the late author's
+  // version added to the block (merge3's late-save merge). The late author's own client writes it -- it
+  // is online, its save just arrived -- and every other client holds its disk until it lands. Returns the
+  // bases it took over, so the race path leaves them alone.
+  function checkLate(relPath, txn) {
+    const fe = fileDocs.get(relPath)
+    const taken = new Set()
+    if (!fe || !fe.intent) return taken
+    const current = fe.text.toString()
+    const now = Date.now()
+    // Only against a race's resolution: its block names its authors. A block a merge raised ("local
+    // (yours)" / "incoming (theirs)") is an author's save, and the race path decides how it joins (F5
+    // builds the block from what each author saved, same-line-later-save-test R10).
+    const repair = (base, side, who) => {
+      const x = lateOverBlock(base, side, current)
+      if (x == null || /^(<<<<<<<|>>>>>>>) .*(local \(yours\)|incoming \(theirs\))/m.test(x)) return null
+      return merge3(base, side, x, { lateName: who }).text
+    }
+    const own = fe.lastOwn
+    if (own && (now - own.at >= LATE_OWN_MS || current === own.side || (blockVersions(current) || { versions: [] }).versions.includes(own.side))) fe.lastOwn = null
+    else if (own) {
+      const final = repair(own.base, own.side, name)
+      if (final != null && final !== current) {
+        taken.add(contentHash(own.base))
+        fe.clashHold = { final, until: now + CLASH_HOLD_MS, late: true }
+        log(`[${name}] ${relPath}: this save of a line reached the room after a race on that line was resolved; adding it to the block`)
+        setTimeout(() => {
+          // The text moved on (another change arrived in the same burst): that change's own check has
+          // already taken this save up again, against the newer text. lastOwn stays until a repair lands.
+          if (stopped || fe.text.toString() !== current) { if (fe.clashHold && fe.clashHold.final === final) releaseHold(relPath, fe); return }
+          fe.lastOwn = null
+          fe.doc.transact(() => applyDiff(fe.text, final))
+          rememberText(fe, final)
+          try { postOnce(`late:${relPath}:${contentHash(final)}`, `[!] ${relPath}: ${name} saved the same line as the others at the same moment, but the save arrived after their conflict was written. ${name}'s version is now one more version in the conflict block.`) } catch { }
+          releaseHold(relPath, fe)
+        }, 0)
+        return taken
+      }
+    }
+    const keys = txn.changed && txn.changed.get(fe.intent)
+    if (!keys) return taken
+    for (const k of keys) {
+      const v = fe.intent.get(k)
+      if (!v || v.m || !Array.isArray(v.h) || typeof v.b !== 'string' || Number(k) === fe.doc.clientID) continue
+      const base = fe.recent.get(v.b)
+      if (base == null) continue
+      const final = repair(base, applyIntent(base, v.h), v.n || `client ${k}`)
+      if (final == null || final === current) continue
+      taken.add(v.b)
+      fe.clashHold = { final, until: now + CLASH_HOLD_MS, late: true }
+      log(`[${name}] ${relPath}: ${v.n || k}'s save of a line arrived after the race on it was resolved; waiting for it to be added to the block`)
+      const t = setTimeout(() => {
+        if (stopped || fe.clashHold == null || fe.clashHold.final !== final) return
+        if (fe.text.toString() !== final) try { postOnce(`late:${relPath}:${k}:${v.b}`, `[!] ${relPath}: ${v.n || k}'s save of a line arrived after the conflict on it was written, and it was not added to the block in ${CLASH_HOLD_MS / 1000} s. The block may hold a fragment of that save. Check it by hand.`, { observer: true }) } catch { }
+        releaseHold(relPath, fe)
+      }, CLASH_HOLD_MS + 50)
+      if (t.unref) t.unref()
+    }
+    return taken
+  }
+  // A remote transaction arrived. If it carries an intent made from the same text as another recent
+  // intent, and the two changed the same line, the shared text now holds their character union.
+  //
+  // WHY THE WAIT. Saves made "at the same moment" are saves made before any of them reached the others,
+  // so they arrive within about one round trip of each other, in different orders on different peers.
+  // Resolving on the second arrival let two peers each see a different pair, each be the lowest of its
+  // pair, and both write: three saves became two, and one author's line was lost (R6). So every peer
+  // first holds its disk, waits CLASH_SETTLE_MS for the rest of the race to arrive, and then decides from
+  // everything made from that text: the same group, the same text, and one writer, the lowest client.
+  function checkClash(relPath, txn, taken = new Set()) {
+    const fe = fileDocs.get(relPath)
+    if (!fe || !fe.intent) return
+    const keys = txn.changed && txn.changed.get(fe.intent)
+    if (!keys || !keys.size) return
+    const now = Date.now()
+    // Kept as long as a held save still counts as a race (LATE_OWN_MS), not just the race window: a
+    // save 18 s late met a line one other author had changed, and only those two clients still knew of
+    // both saves, so every other disk took the fused line until the block landed (same-line-soak-test).
+    for (const [c, v] of fe.intents) if (now - v.at > LATE_OWN_MS) fe.intents.delete(c)
+    // Our own last save stays in the race until it has been seen (P0-F-12): when it was held on the way,
+    // the others' saves reach us long after the window, and without it here their union went to this disk.
+    const own = fe.lastOwn, me = fe.doc.clientID
+    if (own && now - own.at < LATE_OWN_MS && !fe.intents.has(me)) {
+      const h = intentHunks(own.base, own.side)
+      if (h) fe.intents.set(me, { b: contentHash(own.base), h, n: name, at: own.at })
+    }
+    const bases = new Set()
+    for (const k of keys) {
+      const v = fe.intent.get(k)
+      const c = Number(k)
+      if (!v || !Array.isArray(v.h) || typeof v.b !== 'string' || c === fe.doc.clientID) continue
+      fe.intents.set(c, { b: v.b, h: v.h, n: v.n, at: now, ...(v.m ? { m: 1, v: Array.isArray(v.v) ? v.v : v.h } : {}) })
+      if (!v.m) bases.add(v.b)
+    }
+    for (const b of bases) {
+      if (taken.has(b) || (fe.clashHold && fe.clashHold.late)) continue
+      if (fe.recent.get(b) == null || !clashGroup(fe, b)) continue
+      // Hold this disk now: the shared text may already be the union.
+      fe.clashHold = { final: null, until: now + CLASH_SETTLE_MS + CLASH_HOLD_MS }
+      if (fe.clashTimers.has(b)) continue
+      const t = setTimeout(() => { fe.clashTimers.delete(b); if (!stopped) resolveClash(relPath, fe, b) }, CLASH_SETTLE_MS)
+      if (t.unref) t.unref()
+      fe.clashTimers.set(b, t)
+    }
+  }
+  // The intents made from text b that clash with another one, as clientID -> hunks; null if none do.
+  function clashGroup(fe, b) {
+    const same = [...fe.intents].filter(([, v]) => v.b === b && !v.m)
+    const group = new Map()
+    for (const [c, v] of same) for (const [d, w] of same) if (c !== d && hunksClash(v.h, w.h)) { group.set(c, v.h); break }
+    return group.size >= 2 ? group : null
+  }
+  function releaseHold(relPath, fe) {
+    fe.clashHold = null
+    if (fe.pendingLocal) runDeferred(relPath, fe)
+    else reconcile(relPath, 'remote')
+  }
+  // The save that waited (deferLocal) goes out now. It was made from what this disk held -- the last
+  // synced text -- and the resolution has landed since. When its lines and the resolution's do not
+  // overlap, both are applied to that text, line by line: exact, no character CRDT and no merge3 (which
+  // strips markers, and dropped Bob's version of the resolved block, R13). When they overlap, the ordinary
+  // merge decides, against that same text.
+  function runDeferred(relPath, fe) {
+    fe.pendingLocal = false
+    let disk = null
+    try { disk = readText(path.join(ROOT, relPath)) } catch { }
+    const base = bases.get(relPath), doc = fe.text.toString()
+    if (disk == null || base == null || disk === base || disk === doc) { reconcile(relPath, 'remote'); return }
+    const mine = intentHunks(base, disk), theirs = intentHunks(base, doc)
+    if (mine && theirs && !linesOverlap(mine, theirs)) {
+      const merged = applyTagged(base.split('\n'), tagged(new Map([[0, theirs], [1, mine]]))).join('\n')
+      log(`[${name}] ${relPath}: the save made while a race was resolved goes out on top of the resolution`)
+      fe.doc.transact(() => { applyDiff(fe.text, merged); if (!FORK_GATE) recordIntent(relPath, fe, doc, merged, merged) })
+      if (merged !== disk) writeToDisk(relPath, merged)
+      known.add(relPath); bases.set(relPath, merged); forkBases.set(relPath, merged)
+      return
+    }
+    fe.deferredMerge = true
+    try { reconcile(relPath, 'local') } finally { fe.deferredMerge = false }
+  }
+  function deferLocal(relPath, fe) {
+    unsentLocal.add(relPath)
+    if (fe.pendingLocal) return
+    fe.pendingLocal = true
+    const t = setTimeout(() => { if (!stopped && fe.pendingLocal) runDeferred(relPath, fe) }, Math.max(0, fe.clashHold.until - Date.now()) + 20)
+    if (t.unref) t.unref()
+  }
+  function resolveClash(relPath, fe, b) {
+    if (fe.clashHold && fe.clashHold.late) return // P0-F-12 has this file: its own timer ends the hold
+    const base = fe.recent.get(b)
+    const group = base == null ? null : clashGroup(fe, b)
+    if (!group) { releaseHold(relPath, fe); return }
+    const ids = [...group.keys()].sort((x, y) => x - y)
+    const key = `${b}|${ids.join(',')}`
+    // Every save made from this text at the same moment is in the shared text's union, the ones that
+    // clash and the ones that do not: the resolution is computed from all of them, or it would delete a
+    // non-clashing author's edit (and be refused, since the union would not match: R9).
+    const all = new Map([...fe.intents].filter(([, v]) => v.b === b && !v.m).map(([c, v]) => [c, v.h]))
+    // F5. A save made from another text after the race began. When that text was what its author held --
+    // one side, or a clean merge of sides -- the save is that author's version of the file from `base`,
+    // and it joins the resolution (its hunks rebased onto `base`). Any other is someone's later edit that
+    // the resolution would overwrite: then do not resolve, and say so.
+    const since = Math.min(...ids.map((i) => (fe.intents.get(i) || {}).at || Infinity))
+    const members = new Map(all), laters = []
+    let unexplained = false
+    // Whether a save came after the race is decided by what it was made from, not by when this peer heard
+    // of it: arrival times are local, and a side's time here can be later than a save built on that side
+    // (R9, 1 run in 40). Only a save nobody can explain is judged by time: older ones predate the race.
+    for (const [c, v] of [...fe.intents].filter(([, v]) => v.b !== b).sort((x, y) => x[1].at - y[1].at)) {
+      const ex = explainBase(base, all, v.b)
+      // The author's own version: for a merge that raised markers, the file they saved, not the markers.
+      const rebased = ex && intentHunks(base, applyIntent(ex.text, v.m ? v.v : v.h))
+      if (!rebased) { if (v.at > since) { unexplained = true; break } continue }
+      members.set(c, rebased)
+      laters.push({ id: c, after: ex.after, h: v.h })
+    }
+    const final = clashFinal(base, members, new Map([...members.keys()].map((i) => [i, (fe.intents.get(i) || {}).n])))
+    const current = fe.text.toString()
+    const who = ids.map((i) => (fe.intents.get(i) || {}).n || String(i)).join(', ')
+    if (fe.clashDone.has(key) || current === final) { releaseHold(relPath, fe); return }
+    fe.clashDone.add(key)
+    if (unexplained || !clashOnlyRegion(base, all, final, current, laters)) {
+      // The file changed outside the clash since: writing the resolution would delete that change.
+      log(`[${name}] same-line race in ${relPath} (${who}) not resolved: the file changed since`)
+      // Markers already in the file: a merge has flagged it and said so. A second line is noise --
+      // unless the file also holds a line nobody wrote: the markers are then another race's, on other
+      // lines, and this one's fused line would stay with nothing said (same-line-soak-test, seed 2).
+      const wrote = new Set(base.split('\n'))
+      for (const [, v] of fe.intents) { const t = fe.recent.get(v.b); if (t != null) for (const l of applyIntent(t, v.m ? v.v : v.h).split('\n')) wrote.add(l) }
+      const fused = current.split('\n').some((l) => !wrote.has(l) && !/^(<<<<<<<|>>>>>>>)( |$)|^=======$/.test(l))
+      if (fused || /[^\n](<<<<<<< |>>>>>>> )/.test(current)) try { postOnce(`race:${relPath}:${key}`, `[!] ${relPath}: ${who} saved the same line at the same moment, and the file changed again before it could be resolved, so the line may hold a mix of their text. Check it by hand.`, { observer: ids[0] !== fe.doc.clientID }) } catch { }
+      releaseHold(relPath, fe); return
+    }
+    const writer = ids[0] === fe.doc.clientID
+    log(`[${name}] same-line race in ${relPath}: ${who} saved one line at the same moment; ${writer ? 'writing' : 'waiting for'} the resolution`)
+    if (writer) {
+      fe.doc.transact(() => applyDiff(fe.text, final))
+      rememberText(fe, final)
+      releaseHold(relPath, fe)
+      return
+    }
+    // Everyone else holds the disk until the resolution lands. If the writer never delivers it, a client
+    // in the race writes it itself, and a bystander lets the shared text through.
+    const participant = group.has(fe.doc.clientID)
+    fe.clashHold = { final, until: Date.now() + CLASH_HOLD_MS }
+    const t = setTimeout(() => {
+      if (stopped || fe.clashHold == null || fe.clashHold.final !== final) return
+      const cur = fe.text.toString()
+      if (cur !== final && participant && clashOnlyRegion(base, all, final, cur, laters)) {
+        log(`[${name}] same-line race in ${relPath}: no resolution arrived in ${CLASH_HOLD_MS / 1000} s, writing it`)
+        fe.doc.transact(() => applyDiff(fe.text, final))
+      }
+      releaseHold(relPath, fe)
+    }, CLASH_HOLD_MS + 50)
+    if (t.unref) t.unref()
+  }
+
   function openFile(relPath) {
     let e = fileDocs.get(relPath)
     if (e) return e
@@ -1558,20 +1906,26 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
     // Deterministic (computed from the ledger), converged across peers, and rendered to
     // each peer's DISK — never into the shared text — so conflict markers can't fuse.
     const conflict = fdoc.getMap('conflict')
+    // intent: clientID -> { b, h, n }, what this client's last save changed and from which text (P0-F).
+    const intent = fdoc.getMap('intent')
     const undo = new Y.UndoManager(text, { captureTimeout: 350 }) // default tracks local-origin txns
     // diskAtOpen: this folder's copy when the file started waiting for the room. An edit made before
     // the file syncs -- through hive_edit OR the agent's own file tool -- was made on top of it, so it
     // is that edit's ancestor at first contact, if the room held it (0.14.3 P0-1b-R3). Dropped once synced.
     let diskAtOpen
     try { const f0 = path.join(ROOT, relPath); if (fs.statSync(f0).size <= MAX_BYTES) diskAtOpen = readDiskText(f0) } catch { diskAtOpen = undefined }
-    e = { doc: fdoc, provider: fprovider, text, bin, snap, ledger, head, versions, forkmark, conflict, undo, synced: false, diskAtOpen }
+    e = { doc: fdoc, provider: fprovider, text, bin, snap, ledger, head, versions, forkmark, conflict, undo, synced: false, diskAtOpen, intent, recent: new Map(), intents: new Map(), clashDone: new Set(), clashHold: null, clashTimers: new Map() }
     fileDocs.set(relPath, e)
     // A local transaction is one this client made; a peer's arrives through applyUpdate (local false).
     fdoc.on('update', (_u, _origin, _doc, txn) => { if (!txn || txn.local) unsentLocal.add(relPath) })
     // From the mtime scan() already took, not two more syscalls per open: a 1,000-file join opens
     // 1,000 files, and fileCreationTs() still falls back to a stat for any file this missed.
     if (!createdTimes.has(relPath) && mtimes.has(relPath)) createdTimes.set(relPath, mtimes.get(relPath))
-    text.observe((_ev, txn) => { if (!txn.local) reconcile(relPath, 'remote') }) // remote content edits
+    // Every text this client itself puts in the room is remembered, however it got there: a file's
+    // first publish records no intent, so its author did not know the text two later saves were made
+    // from, saw no race, and wrote their fused line to its disk (same-line-soak-test, seed 2).
+    text.observe((_ev, txn) => { if (txn.local) rememberText(e, text.toString()) })
+    text.observe((_ev, txn) => { if (!txn.local) { if (!FORK_GATE) checkClash(relPath, txn, checkLate(relPath, txn)); reconcile(relPath, 'remote') } }) // remote content edits
     bin.observe((_ev, txn) => { if (!txn.local) reconcileBinary(relPath, 'remote') }) // remote binary edits
     // A divergent receipt can arrive slightly after (or before) the fused content — so
     // re-run the fork check whenever the provenance ledger changes too, not only on edits.
@@ -2356,7 +2710,7 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
           if (keptAs) {
             log(`[${name}] local unshared file ${relPath} overwritten by room write; copy preserved in ${keptAs}`)
             try {
-              say(`· ${relPath} on ${name}'s disk was ${unshared.reason} and was overwritten by a room write — local copy preserved in ${keptAs}.`)
+              note(`· ${relPath} on ${name}'s disk was ${unshared.reason} and was overwritten by a room write — local copy preserved in ${keptAs}.`)
             } catch { }
           }
         }
@@ -2514,10 +2868,13 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
     if (kept.length) {
       const one = kept.length === 1
       parts.push(`${one ? '1 holds' : `${kept.length} hold`} content the room has never seen, so neither copy was changed and the room's copy was NOT adopted: ${names(kept)}. ` +
-        `In ${name}'s folder ${one ? 'it still holds' : 'they still hold'} ${name}'s version. To make one the room's version, claim it and hive_edit it with the full file. ` +
+        `In ${name}'s folder ${one ? 'it still holds' : 'they still hold'} ${name}'s version, and nothing syncs for ${one ? 'it' : 'them'} until ${name} saves ${one ? 'it' : 'them'} again. To make one the room's version, claim it and hive_edit it with the full file. ` +
         `Don't delete a local copy to get the room's: a deletion syncs, and removes the file for everyone.`)
     }
-    try { say(parts.join(' ')) } catch { }
+    // What concerns THIS folder only (line endings, older copies it now has) is a note for hive_status; only
+    // content the room has never seen is the room's business, because nobody else has it (0.14.4, C5).
+    note(parts.join(' '))
+    if (kept.length) { try { say([parts[0], parts[parts.length - 1]].join(' ')) } catch { } } // the kept part is pushed last
   }
 
   function reconcileBinary(relPath, origin = 'local') {
@@ -2621,7 +2978,7 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
       if (keptAs) {
         log(`[${name}] local binary ${relPath} overwritten by remote write (winner: ${remoteBy || 'teammate'}); copy preserved in ${keptAs}`)
         try {
-          say(`· ${relPath} updated from room (winner: ${remoteBy || 'teammate'}). Your local copy saved to ${keptAs}.`)
+          note(`· ${relPath} updated from room (winner: ${remoteBy || 'teammate'}). Your local copy saved to ${keptAs}.`)
         } catch { }
       }
     }
@@ -2691,6 +3048,16 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
     // and until then leave() must wait for it (0.14.3 P0-1: a new file written just before leaving).
     if (!fe) { if (disk === null) return; openFile(relPath); if (origin === 'local') unsentLocal.add(relPath); return }
     if (!fe.synced) { if (origin === 'local' && disk !== null) unsentLocal.add(relPath); return }
+    // A detected same-line race is being resolved (P0-F): write nothing from the shared text until the
+    // resolution arrives, so the fused text never reaches this disk. A local save still goes through.
+    if (fe.clashHold && fe.text.toString() !== fe.clashHold.final && Date.now() < fe.clashHold.until) {
+      // A local save made while a race is being resolved waits for the resolution too (F5): merged now,
+      // against the shared text, it would take the fused line into this disk and publish it again. The
+      // edit is safe on disk meanwhile; it goes out as soon as the hold ends.
+      if (origin === 'local') deferLocal(relPath, fe)
+      return
+    }
+    if (fe.clashHold) { fe.clashHold = null; if (fe.pendingLocal) { runDeferred(relPath, fe); return } }
     // A KEPT UNSENT EDIT IS FROZEN until its author saves the file again. Merging it against the
     // room in either direction would decide something nobody decided: the room's next change would
     // be written over it, and an unchanged save merged against itself pulled the room's old copy over
@@ -2768,6 +3135,7 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
     }
     dropStackedAwaits(relPath, fe, disk) // before anything reads the room's copy (0.14.3 P0-5-3)
     const docText = fe.text.toString()
+    rememberText(fe, docText)
     // An empty shared doc is authoritative ONLY if we have history for this path.
     // A file's NAME lives in the parent doc and its CONTENT in the file's own doc, on two
     // different connections — there is no atomicity across them. A client that joins a large
@@ -2949,12 +3317,12 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
             return
           }
         }
-        if (r0.text !== docText) { fe.doc.transact(() => applyDiff(yt, r0.text)); signPublished(relPath, docText, r0.text, disk) }
+        if (r0.text !== docText) { fe.doc.transact(() => { applyDiff(yt, r0.text); if (!FORK_GATE) recordIntent(relPath, fe, docText, r0.text) }); signPublished(relPath, docText, r0.text, disk) }
         if (r0.text !== disk) writeToDisk(relPath, r0.text)
         if (r0.conflict) conflicted.add(relPath)
         bases.set(relPath, r0.text); forkBases.set(relPath, r0.text); shadow.set(relPath, r0.text)
         if (!inManifest(relPath)) queueManifestSet(relPath)
-        try { say(`⚠ ${relPath} was created by two participants at once — both versions were merged${r0.conflict ? ', and CONFLICT markers need resolving' : ''}.`) } catch { }
+        try { postOnce(`race:${relPath}`, `⚠ ${relPath} was created by two participants at once — both versions were merged${r0.conflict ? ', and CONFLICT markers need resolving' : ''}.`, { ttlMs: 10 * 60 * 1000 }) } catch { }
         return
       }
       // REJOIN, NOT A FIRST JOIN. If a previous session of this client wrote this file in
@@ -3018,7 +3386,7 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
         // the local side first so the pre-merge bytes are recoverable regardless of outcome.
         captureSnapshot(relPath, disk, name, { force: true, kind: 'manual', label: 'local copy before rejoin merge' })
         const rj = icrMerge3(anc, disk, docText, relPath)
-        if (rj.text !== docText) { fe.doc.transact(() => applyDiff(yt, rj.text)); signPublished(relPath, docText, rj.text, disk) }
+        if (rj.text !== docText) { fe.doc.transact(() => { applyDiff(yt, rj.text); if (!FORK_GATE) recordIntent(relPath, fe, docText, rj.text) }); signPublished(relPath, docText, rj.text, disk) }
         if (rj.text !== disk) writeToDisk(relPath, rj.text)
         if (rj.conflict) conflicted.add(relPath)
         bases.set(relPath, rj.text); forkBases.set(relPath, rj.text); shadow.set(relPath, rj.text)
@@ -3066,11 +3434,9 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
       // and said", never "lost".
       let keptAt = 0; try { keptAt = fs.statSync(full).mtimeMs } catch { }
       keptUnsent.set(relPath, keptAt)
-      // Said in the room, not only logged (review R5): the agent has to act on it.
-      try {
-        say(`⚠ ${relPath}: ${name}'s copy differs from the room's, and the room cannot tell which is newer (${st.state}: ${name} changed it before the room's copy had loaded here). ` +
-          `Neither was written over the other: ${name}'s is kept on disk, both are in the file's history, and nothing syncs for this file until ${name} saves it again. That save replaces the room's copy. Claim ${relPath} first.`)
-      } catch { }
+      // Said in the room (review R5: the agent has to act on it), but ONCE PER JOIN, in the first-contact
+      // summary below -- not one line per file in engine words. A teammate rejoining with 40 such files
+      // filled the chat with 40 lines (9 Nov 2026; first-contact-summary-test, red since 0.14.3).
       log(`[${name}] ⚠ ${relPath} already existed in room with different content (${st.state}) — room copy was NOT adopted; local disk preserved and frozen until saved again`)
       noteFirstContact('kept', relPath)
       return
@@ -3136,11 +3502,15 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
       }
     }
     const base = bases.has(relPath) ? bases.get(relPath) : disk
-    const fork = forkBases.has(relPath) ? forkBases.get(relPath) : base
+    // A save that waited out a race (F5) was made from what this disk held then -- the last synced text --
+    // not from the resolution that has landed since: merge it from there, and never read the markers it
+    // never saw as resolved by it.
+    const deferred = origin === 'local' && fe.deferredMerge
+    const fork = deferred ? base : forkBases.has(relPath) ? forkBases.get(relPath) : base
     if (origin === 'local') { noteCoEditing(relPath); markEditing(relPath) } // broadcast activity + warn if someone else is on this file
 
     let res, reAdded = false
-    if (origin === 'local' && hasConflictMarkers(docText) && !hasConflictMarkers(disk)) {
+    if (origin === 'local' && !deferred && hasConflictMarkers(docText) && !hasConflictMarkers(disk)) {
       // Resolving a conflict: the doc still has <<<<<<< markers and this local
       // write removed them — the author has resolved it. Their clean version wins.
       res = { text: disk, conflict: false }
@@ -3230,7 +3600,9 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
       captureSnapshot(relPath, docText, name, { force: sc.isRewrite, churn: `${sc.changedLines}/${sc.totalLines} lines` })
       lastLocalEdit = relPath
     }
-    fileDocs.get(relPath).doc.transact(() => applyDiff(yt, res.text))
+    // The save's INTENT travels in the same transaction as its characters (P0-F): what it changed, and
+    // from which text, so a peer that receives two saves of one line made from the same text can tell.
+    fileDocs.get(relPath).doc.transact(() => { applyDiff(yt, res.text); if (!FORK_GATE && res.text !== docText) recordIntent(relPath, fe, docText, res.text, disk) })
     // Sign this landed local change into the file's provenance ledger (I1). Stamp the
     // author's TRUE intent — the state THEY edited from (fork) -> the content THEY wrote
     // (disk) — NOT the live shared text, which under truly-concurrent edits is already
@@ -3254,10 +3626,10 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
     if (hasMarkers && !conflicted.has(relPath)) {
       conflicted.add(relPath)
       log(`[${name}] ⚠ merge conflict in ${relPath} — kept BOTH versions with <<<<<<< markers`)
-      try { say(`⚠ MERGE CONFLICT in ${relPath} — it has <<<<<<< markers. Whoever owns it: resolve before continuing, by saving the file without them or by passing the marked block as old to hive_edit old/new.`) } catch { }
+      try { postOnce(`conflict:${relPath}`, `⚠ MERGE CONFLICT in ${relPath} — it has <<<<<<< markers. Whoever owns it: resolve before continuing, by saving the file without them or by passing the marked block as old to hive_edit old/new.`, { observer: !res.conflict, clear: `resolved:${relPath}` }) } catch { }
     } else if (!hasMarkers && conflicted.has(relPath)) {
       conflicted.delete(relPath)
-      try { say(`✓ conflict in ${relPath} resolved.`) } catch { }
+      try { postOnce(`resolved:${relPath}`, `✓ conflict in ${relPath} resolved.`, { observer: origin !== 'local', clear: `conflict:${relPath}` }) } catch { }
     } else if (reAdded) {
       log(`[${name}] protected ${relPath}: your edit was based on an older version — re-added changes that arrived since (nobody's work lost)`)
       try { say(`↺ ${relPath}: ${name}'s edit was based on an older copy — kept the changes that landed in between (nothing lost).`) } catch { }
@@ -3275,7 +3647,7 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
     if (res.icrWarning && icrWarned.get(relPath) !== res.icrWarning) {
       icrWarned.set(relPath, res.icrWarning)
       log(`[${name}] ⚠ ICR flag in ${relPath} — ${res.icrWarning}`)
-      try { say(`⚠ ICR flag in ${relPath}: ${res.icrWarning}. It merged, but review — this is a break a plain merge can't see.`) } catch { }
+      try { postOnce(`icr:${relPath}:${contentHash(String(res.icrWarning)).slice(0, 16)}`, `⚠ ICR flag in ${relPath}: ${res.icrWarning}. It merged, but review — this is a break a plain merge can't see.`, { observer: origin !== 'local' }) } catch { }
     } else if (!res.icrWarning && icrWarned.has(relPath)) {
       icrWarned.delete(relPath)
     }
@@ -3511,6 +3883,66 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
     if (!text) return
     chat.push([{ by: name, kind, at: fmtTime(), text: String(text) }])
   }
+  // ONE LINE PER EVENT, NOT ONE PER OBSERVER (0.14.4, C5). Most system lines are said by whoever
+  // caused them (a task, a review, a revert): one poster by nature. But an OBSERVED event -- a conflict
+  // in a shared file, a client on another build, a divergence -- is detected by every peer's own code,
+  // and each posted it: one conflict gave four MERGE CONFLICT lines and then four "resolved" lines
+  // (incident I-16, #722-#725); one odd client gave a MIXED BUILDS line from every other (I-8, #822-#823).
+  // postOnce(id, text): `id` names the event the same way on every peer. The peer that caused it posts
+  // at once. An observer waits 1.5 s plus 1 s per rank among present engines (sorted by name) and posts
+  // only if nobody has; the key lives in the room (`sys_events`) and expires. A peer that cannot write
+  // the key still posts: a missed alarm hides a conflict, a duplicate is only noise.
+  const sysEvents = doc.getMap('sys_events')
+  const SYS_TTL_MS = 6 * 3600 * 1000
+  const sysTimers = new Set()
+  // What only THIS folder needs to know (a local copy kept, a file that differed at join) goes here, to
+  // the log and hive_status, and not to the whole room (C5).
+  const notices = []
+  function note(text) {
+    const t = String(text || '')
+    if (!t) return
+    log(`[${name}] ${t}`)
+    notices.push({ at: Date.now(), text: t })
+    if (notices.length > 50) notices.shift()
+  }
+  function sysRank() {
+    const names = new Set([name])
+    try {
+      for (const st of provider.awareness.getStates().values()) {
+        const u = st && st.user
+        if (u && u.name && !u.listener && !u.passive && u.v === PROTOCOL_VERSION) names.add(u.name)
+      }
+    } catch { }
+    return [...names].sort().indexOf(name)
+  }
+  function pruneSysEvents(now) {
+    let n = 0
+    for (const [k, v] of sysEvents.entries()) {
+      if (++n > 500) break
+      if (!v || now - (Number(v.at) || 0) > (Number(v.ttl) || SYS_TTL_MS)) sysEvents.delete(k)
+    }
+  }
+  function postOnce(id, text, { observer = false, ttlMs = SYS_TTL_MS, clear = null } = {}) {
+    if (!text) return null
+    if (observer && (passive || listener)) return null // a client nobody waits on never speaks for the room
+    const fire = () => {
+      try {
+        const prev = sysEvents.get(id)
+        if (prev && Date.now() - (Number(prev.at) || 0) < (Number(prev.ttl) || SYS_TTL_MS)) return false
+        doc.transact(() => {
+          sysEvents.set(id, { by: name, at: Date.now(), ttl: ttlMs })
+          if (clear) for (const c of [].concat(clear)) sysEvents.delete(c)
+          pruneSysEvents(Date.now())
+        })
+      } catch { /* fail open: the line is said even if the key could not be written */ }
+      say(text)
+      return true
+    }
+    if (!observer) return fire()
+    const t = setTimeout(() => { sysTimers.delete(t); if (!stopped) { try { fire() } catch { } } }, 1500 + 1000 * Math.max(0, sysRank()))
+    sysTimers.add(t)
+    return null
+  }
   function renderChat() {
     const out = [
       '# Hive Chat — the live coordination channel for everyone in this room.',
@@ -3830,7 +4262,7 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
   let myEditing = null, myLastEdit = null
   let editingClearTimer = null
   const warnedAt = new Map() // file -> last time we warned about co-editing it
-  const setUserState = () => provider.awareness.setLocalStateField('user', { name, kind, owner: owner || undefined, editing: myEditing || undefined, lastEdit: myLastEdit || undefined, v: PROTOCOL_VERSION, hv: VERSION_LABEL, passive: !!passive, listener: listener || undefined, app: app || undefined, iid: IID })
+  const setUserState = () => provider.awareness.setLocalStateField('user', { name, kind, owner: owner || undefined, editing: myEditing || undefined, lastEdit: myLastEdit || undefined, v: PROTOCOL_VERSION, hv: VERSION_LABEL, passive: !!passive, listener: listener || undefined, app: app || undefined, iid: IID, joined: joinedAt })
   function markEditing(relPath) {
     myEditing = { file: relPath, at: Date.now() }
     myLastEdit = myEditing
@@ -3858,7 +4290,7 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
     const now = Date.now()
     if (others.length && now - (warnedAt.get(relPath) || 0) > 30000) {
       warnedAt.set(relPath, now)
-      try { say(`⚠ heads-up: ${name} is also editing ${relPath} (with ${others.join(', ')}). Small patches auto-merge; coordinate before a full rewrite.`) } catch { }
+      try { postOnce(`coedit:${relPath}:${[name, ...others].sort().join(',')}`, `⚠ heads-up: ${name} is also editing ${relPath} (with ${others.join(', ')}). Small patches auto-merge; coordinate before a full rewrite.`, { ttlMs: 10 * 60 * 1000 }) } catch { } // the one who just started editing is the cause: it says it at once
     }
   }
   function memberList() {
@@ -3927,7 +4359,7 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
       versionWarned.add(u.name)
       const theirs = u.v ? `v${u.v}` : 'an older build'
       log(`[${name}] ⚠ ${u.name} is on ${theirs} (incompatible with v${PROTOCOL_VERSION}) — they won't sync correctly until everyone updates.`)
-      try { say(`⚠ ${u.name} is on an incompatible version — files won't sync with them until everyone updates Hivecode.`) } catch { }
+      try { postOnce(`proto:${u.name}:${u.v || '-'}`, `⚠ ${u.name} is on an incompatible version — files won't sync with them until everyone updates Hivecode.`, { observer: true }) } catch { }
     }
     checkBuilds()
   }
@@ -3941,40 +4373,69 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
   //   - humans are not flagged: the extension and the browser panel carry no engine build
   //   - one side of each pair speaks (the name that sorts first), once per build it sees
   const buildWarned = new Set()
+  // ONE ALARM PER ROOM, AND ONLY FOR ANOTHER RELEASE (0.14.4, C5). The rule used to be "one side of
+  // each pair speaks", which is still one line per PAIR: two clients on 0.14.2 each posted about the one
+  // on 0.14.3 (#822 + #823), and a client on the same release from another commit raised the same alarm
+  // (I-8). Now the event is the set of releases in the room: it is said once, by whoever sees it first,
+  // naming who runs what. The same release from another commit is a note for this folder (hive_status).
   function checkBuilds() {
-    // An old engine cannot speak for itself, so SOMEBODY current must -- but only one: the reporting
-    // client whose name sorts first. Otherwise every current client in the room says the same thing.
-    // Listeners (listener: true, syncFiles: false) do not sync or edit files and do not report builds.
-    const reporters = [name]
-    const currentEngines = new Set()
-    for (const s of provider.awareness.getStates().values()) {
-      const u = s && s.user
-      if (!u || !u.name || u.v !== PROTOCOL_VERSION || u.listener) continue
-      if (u.hv) reporters.push(u.name)
-      if (u.hv === VERSION_LABEL) currentEngines.add(u.name)
-    }
-    const speakForOld = reporters.sort()[0] === name
-
-    for (const s of provider.awareness.getStates().values()) {
-      const u = s && s.user
+    // Per CONNECTION, not per name: one participant with two engines open on different builds is its own
+    // alarm (0.14.3 Q-2: "an older connection is still open"), and a map keyed by name would hide it.
+    const labelsOf = new Map() // name -> Set of what its engines run
+    const add = (n, label) => { if (!labelsOf.has(n)) labelsOf.set(n, new Set()); labelsOf.get(n).add(label) }
+    add(name, VERSION_LABEL)
+    for (const st of provider.awareness.getStates().values()) {
+      const u = st && st.user
       if (!u || !u.name || u.name === name || u.v !== PROTOCOL_VERSION || u.listener) continue
-      const human = String(u.kind || '').toLowerCase() === 'human'
-      let theirs = ''
-      if (u.hv) {
-        if (u.hv === VERSION_LABEL || name > u.name) continue
-        const olderOpen = currentEngines.has(u.name) ? ` (an older connection from ${u.name} is still open)` : ''
-        theirs = `hivecode ${u.hv}${olderOpen}`
-      } else if (!human) {
-        if (!speakForOld) continue
-        const olderOpen = currentEngines.has(u.name) ? ` (an older connection from ${u.name} is still open)` : ''
-        theirs = `a hivecode build older than build reporting (before ${VERSION})${olderOpen}`
-      } else continue
-      const key = `${u.name}|${u.hv || '-'}`
-      if (buildWarned.has(key)) continue
-      buildWarned.add(key)
-      const same = u.hv && u.hv.split('+')[0] === VERSION ? ' (the same release from different commits)' : ''
-      log(`[${name}] ⚠ MIXED BUILDS: ${u.name} runs ${theirs}, this client runs ${VERSION_LABEL}${same}`)
-      try { say(`⚠ MIXED BUILDS: ${u.name} runs ${theirs}, ${name} runs hivecode ${VERSION_LABEL}${same}. Two builds in one room can lose file content with no error on either side -- everyone should run the same build.`) } catch { }
+      if (u.hv) add(u.name, String(u.hv))
+      // An AI on this protocol reporting no build is an engine older than build reporting: the rollout
+      // case, and it cannot warn itself. Humans carry no engine build (the extension, the browser panel).
+      else if (String(u.kind || '').toLowerCase() !== 'human') add(u.name, `a build older than build reporting (before ${VERSION})`)
+    }
+    const older = (label) => /^a build older/.test(label)
+    const releaseOf = (label) => (older(label) ? label : String(label).split('+')[0])
+    const on = (label) => (older(label) ? `on ${label}` : `on hivecode ${label}`)
+    // The same release from another commit: a note for this folder, not a room alarm.
+    for (const [n, labels] of labelsOf) {
+      if (n === name) continue
+      for (const label of labels) {
+        if (label === VERSION_LABEL || releaseOf(label) !== VERSION) continue
+        const key = `note|${n}|${label}`
+        if (buildWarned.has(key)) continue
+        buildWarned.add(key)
+        note(`${n} runs hivecode ${label}: the same release as this client (${VERSION_LABEL}), from another commit.`)
+      }
+    }
+    // One name, two engines on different builds: they write over each other's files.
+    for (const [n, labels] of labelsOf) {
+      if (n === name || labels.size < 2) continue
+      const all = [...labels].sort()
+      const id = `dual:${n}:${all.join('|')}`
+      if (buildWarned.has(id)) continue
+      buildWarned.add(id)
+      log(`[${name}] ⚠ MIXED BUILDS: ${n} has engines ${all.map(on).join(' and ')}`)
+      try { postOnce(id, `⚠ MIXED BUILDS: ${n} has two engines open, ${all.map(on).join(' and ')} (an older connection from ${n} is still open). Two engines under one name can lose file content with no error on either side -- close the older one.`, { observer: true }) } catch { }
+    }
+    // An OLDER RELEASE in the room: one alarm per participant and build, for the whole room. The event
+    // is "X runs B, older than the newest release here": every observer sees the same newest release, so
+    // they name the same event, and presence churn (an agent's state re-published) never re-raises it.
+    const parts = (r) => (older(r) ? [-1] : String(r).split('.').map((x) => parseInt(x, 10) || 0))
+    const cmp = (a, b) => { const x = parts(a), y = parts(b); for (let k = 0; k < Math.max(x.length, y.length); k++) { const d = (x[k] || 0) - (y[k] || 0); if (d) return d } return 0 }
+    const releases = new Set()
+    for (const labels of labelsOf.values()) for (const label of labels) releases.add(releaseOf(label))
+    if (releases.size < 2) return
+    const newest = [...releases].sort(cmp).pop()
+    const current = []
+    for (const [n, labels] of labelsOf) for (const label of labels) if (releaseOf(label) === newest) current.push(`${n} ${on(label)}`)
+    for (const [n, labels] of labelsOf) {
+      for (const label of labels) {
+        if (releaseOf(label) === newest) continue
+        const id = `builds:${n}:${label}`
+        if (buildWarned.has(id)) continue
+        buildWarned.add(id)
+        log(`[${name}] ⚠ MIXED BUILDS: ${n} runs ${older(label) ? label : `hivecode ${label}`}`)
+        try { postOnce(id, `⚠ MIXED BUILDS: ${n} runs ${older(label) ? label : `hivecode ${label}`}, older than the room's newest release (${current.sort().join(', ')}). Two releases in one room can lose file content with no error on either side -- ${n} should update (npx -y hivecode-mcp@latest setup, then restart).`, { observer: true }) } catch { }
+      }
     }
   }
   if (syncFiles) provider.awareness.on('change', () => { renderMembers(); renderClaims(); checkVersions() })
@@ -4861,6 +5322,8 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
     try { flushFirstContact() } catch { } // before `stopped`: a join cut short still says what it kept
     try { settleLocalDeletes() } catch { } // a delete made just before leaving still leaves, judged like any other
     stopped = true
+    for (const t of sysTimers) clearTimeout(t)
+    sysTimers.clear()
     try { flushRoomDoc() } catch { }
     if (openTimer) { clearImmediate(openTimer); clearTimeout(openTimer); openTimer = null }
     if (renderBoardTimer) { clearImmediate(renderBoardTimer); renderBoardTimer = null }
@@ -4945,6 +5408,11 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
         }
       }
       swarmState.set(key, val)
+      // The session that sets a gate has chosen to run that command, so its own machine approves it
+      // (0.14.4 S-1). Nobody else's does: a gate set here runs elsewhere only after that person approves.
+      if (key === GATE_CMD && String(val == null ? '' : val).trim()) {
+        try { writeApproval(room, String(val), `set by ${name} on this machine`, GATES_DIR) } catch { /* no approval, so it simply does not run here */ }
+      }
       say(`STATE TRANSITION: [${key}] is now [${val}]`)
     },
     getState: () => {
@@ -5074,7 +5542,7 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
           if (v.stuckLagging) return `${v.peer}:${v.bytes}b/${v.lines}L[STUCK:${v.stuckReason || 'not catching up'}]`
           return `${v.peer}:${v.bytes}b/${v.lines}L`
         }).join('  ')
-        say(`[!] DIVERGENCE on ${p} — peers hold DIFFERENT content: ${detail}. Nobody may write this path until it is reconciled; mark it path:${p}=POISONED if it cannot be.`)
+        postOnce(`diverge:${p}:${contentHash(detail).slice(0, 16)}`, `[!] DIVERGENCE on ${p} — peers hold DIFFERENT content: ${detail}. Nobody may write this path until it is reconciled; mark it path:${p}=POISONED if it cannot be.`)
       }
 
       return {
@@ -5107,6 +5575,8 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
       }
     },
     say,                 // post a coordination message
+    postOnce,            // a system line said once per event in the room, whoever sees it (0.14.4, C5)
+    notices: () => notices.slice(), // what only this folder needs to know (hive_status shows it)
     assign,              // direct a task at a participant (needs approval if target AI has an owner)
     decide,              // approve/deny a task (owner only, if set)
     complete,            // mark a task done
@@ -5168,6 +5638,17 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
         return { ok: true, gated: true, forced: true }
       }
 
+      // A COMMAND FROM THE ROOM IS DATA (0.14.4 S-1). It runs here only if this machine's person
+      // approved this exact command; otherwise the hand-back goes through UNCHECKED -- never refused,
+      // or setting a gate would be a way to stop everyone -- and that is recorded and said once.
+      const approvedBy = gateApproved({ room, cmd: g.cmd, dir: GATES_DIR })
+      if (!approvedBy) {
+        gateResults.set(`${r}|${name}`, { ...verdictRecord({ region: r, by: name, cmd: g.cmd, result: null }), skipped: 'not-approved' })
+        letGo()
+        const said = `${name}|${g.cmd}`
+        if (!gateSkipSaid.has(said)) { gateSkipSaid.add(said); try { say(notApprovedLine(name)) } catch { /* chat is not the point */ } }
+        return { ok: true, gated: false, gateSkipped: 'not-approved', code: GATE_NOT_APPROVED, cmd: g.cmd, message: notApprovedMessage({ region: r, cmd: g.cmd, dir: ROOT }) }
+      }
       const result = runGate({ cmd: g.cmd, cwd: ROOT, timeoutMs: g.timeoutMs })
       gateResults.set(`${r}|${name}`, verdictRecord({ region: r, by: name, cmd: g.cmd, result }))
       if (!result.ok) {
@@ -5281,7 +5762,7 @@ export function startSync({ relay = 'ws://localhost:1234', room = 'default', dir
         if (id === me || !u || !u.name || String(u.name).toLowerCase() !== lc) continue
         if (u.listener || u.iid === IID) continue
         if (kind === 'human' && u.kind === 'human') continue
-        out.push({ name: u.name, kind: u.kind, owner: u.owner, app: u.app })
+        out.push({ name: u.name, kind: u.kind, owner: u.owner, app: u.app, joined: u.joined, clientID: id })
       }
       return out
     },