trantor 0.18.81 → 0.18.85

package/hooks/file-claim.mjs

@@ -1,12 +1,15 @@
 #!/usr/bin/env node
+import { gitCheckoutRoot } from "./lib/git-checkout.mjs";
 // trantor PreToolUse file-claim — before every file edit the session posts a claim and the hub answers
 // with any LIVE claim on the same file by another session, handed to the model as context.
 // Informational, never blocking: a lock server that fails open is worse than no lock. Fail-open and
 // cheap: tight timeout, per-(session,file) stamp throttles re-claims; the FIRST touch always goes out.
 import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
-import { join, relative, isAbsolute } from "node:path";
+import { join, relative, resolve } from "node:path";
 import { homedir } from "node:os";
 import { relayUrl, sessionContext, signedPost } from "./lib/api.mjs";
+import { writeOverseerLevel } from "./lib/overseer-level-cache.mjs";
+import { overlapsFor } from "../lib/remote-overlap.mjs";
 
 const FETCH_TIMEOUT_MS = Number(process.env.RELAY_CLAIM_TIMEOUT_MS || 900);
 const RECLAIM_MS = Number(process.env.RELAY_RECLAIM_MS || 60 * 1000);
@@ -41,26 +44,35 @@ try {
   const ctx = sessionContext(input.cwd);
   if (!ctx.project) allow();
   // claims compare by path, and absolute paths differ per machine — store repo-relative
-  const file = isAbsolute(abs) && !relative(ctx.projectDir, abs).startsWith("..")
-    ? relative(ctx.projectDir, abs)
-    : abs;
+  const gitRoot = gitCheckoutRoot(ctx.projectDir);
+  const absolute = resolve(ctx.projectDir, abs);
+  const rel = relative(gitRoot || ctx.projectDir, absolute);
+  const file = !rel.startsWith("..") ? rel : absolute;
 
   // throttle re-claims of the same file; never throttle its first touch
   const stampDir = join(process.env.AGENT_BUS_DIR || join(homedir(), ".agent-bus"), "claims");
-  const stamp = join(stampDir, `${ctx.session} ${file}`.replace(/[^A-Za-z0-9_.-]/g, "_"));
+  const stamp = join(stampDir, `${ctx.session} ${gitRoot} ${file}`.replace(/[^A-Za-z0-9_.-]/g, "_"));
   try {
     const last = Number(readFileSync(stamp, "utf8"));
     if (Date.now() - last < RECLAIM_MS) allow();
   } catch {}
 
+  // #11311: open-PR evidence, computed HERE from this session's own checkout (the hub's gh is not
+  // logged in and its cwd is the wrong repo). Cache file makes the normal call a stat+read; off
+  // when gh is missing. Fail-open like everything else in this hook.
+  let remote = [];
+  try { remote = overlapsFor({ gitRoot, files: [file] }); } catch {}
+
   const r = await signedPost(`${relayUrl(ctx.project)}/claim`,
-    { project: ctx.project, file, session: ctx.session },
+    { project: ctx.project, file, session: ctx.session, gitRoot, remote },
     { timeoutMs: FETCH_TIMEOUT_MS, session: ctx.session });
 
   try { mkdirSync(stampDir, { recursive: true }); writeFileSync(stamp, String(Date.now())); } catch {}
 
+  if (r.ok) writeOverseerLevel({ project: ctx.project, hub: relayUrl(ctx.project) }, r.json?.level);
+
   const conflicts = r.ok ? r.json?.conflicts ?? [] : [];
-  if (!conflicts.length) allow();
+  if (Number(r.json?.level ?? 2) < 2 || !conflicts.length) allow();
 
   const who = conflicts.map(c => `${c.session} (${ago(c.agoSec)} ago)`).join(", ");
   // NO permissionDecision on purpose: additionalContext reaches the model on its own, and an "allow"

package/hooks/file-hold.mjs

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+import { gitCheckoutRoot } from "./lib/git-checkout.mjs";
+import { relative, resolve } from "node:path";
+import { relayUrl, sessionContext, signedPost } from "./lib/api.mjs";
+import { readOverseerLevel, writeOverseerLevel } from "./lib/overseer-level-cache.mjs";
+
+function deny(reason) {
+  process.stdout.write(JSON.stringify({ hookSpecificOutput: {
+    hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: reason,
+  } }));
+}
+
+function unavailable() {
+  process.stderr.write("trantor: file hold could not be checked; allowing this edit.\n");
+  process.stdout.write("{}");
+}
+
+try {
+  let raw = "";
+  for await (const chunk of process.stdin) raw += chunk;
+  const input = JSON.parse(raw || "{}");
+  const path = input.tool_name === "NotebookEdit" ? input.tool_input?.notebook_path : input.tool_input?.file_path;
+  const ctx = sessionContext(input.cwd);
+  if (!path || !ctx.project) process.stdout.write("{}");
+  else {
+    const cache = { project: ctx.project, hub: relayUrl(ctx.project) };
+    const level = readOverseerLevel(cache);
+    if (level !== null && level < 3) {
+      process.stdout.write("{}");
+      process.exit(0);
+    }
+    const gitRoot = gitCheckoutRoot(ctx.projectDir);
+    const absolute = resolve(ctx.projectDir, path);
+    const rel = relative(gitRoot || ctx.projectDir, absolute);
+    const file = !rel.startsWith("..") ? rel : absolute;
+    // Register and check atomically: parallel PreToolUse hooks cannot race the first claim.
+    const r = await signedPost(`${cache.hub}/hold/check`,
+      { project: ctx.project, file, session: ctx.session, gitRoot },
+      { timeoutMs: 2500, session: ctx.session });
+    if (!r.ok || !r.json?.ok) unavailable();
+    else {
+      writeOverseerLevel(cache, r.json.level);
+      if (r.json.hold) deny(r.json.hold.reason);
+      else process.stdout.write("{}");
+    }
+  }
+} catch {
+  unavailable();
+}

package/hooks/heartbeat.mjs

@@ -12,6 +12,7 @@ import { armBaton, readArm, clearArm, readConfig, contextUsage, warnFrac, alread
 import { resolveProject, hostId } from "../lib/project.mjs";
 import { installedVersion } from "./lib/update-check.mjs";   // report our hook version so the hub can flag stale sessions
 import { signedPost } from "./lib/api.mjs";
+import { gitCheckoutRoot } from "./lib/git-checkout.mjs";
 
 const HEARTBEAT_MS = Number(process.env.RELAY_HEARTBEAT_MS || 60 * 1000);
 const FETCH_TIMEOUT_MS = Number(process.env.RELAY_HEARTBEAT_TIMEOUT_MS || 1500);
@@ -161,7 +162,7 @@ async function main(stdinRaw) {
   // strict test sessionstart.mjs uses), "agent" when the runner's TRANTOR_SEAT says crew seat.
   const beatKind = process.env.TRANTOR_ORCH && process.env.TRANTOR_ORCH === project ? "orch"
     : process.env.TRANTOR_SEAT ? "agent" : "";
-  const beatBody = { session, project,
+  const beatBody = { session, project, gitRoot: gitCheckoutRoot(projectDir),
     llm: process.env.RELAY_LLM || (process.env.RELAY_AGENT ? process.env.RELAY_AGENT.replace(/-orch$/, "") : "claude"),
     model: modelFromTranscript(stdinRaw),
     hookVersion: (() => { try { return installedVersion(); } catch { return ""; } })() };

package/hooks/hooks.json

@@ -1,5 +1,5 @@
 {
-  "description": "trantor — auto-register each session + inject live roster + overseer landscape warning: linked projects, live peers, files in flight, collisions (SessionStart); turn each substantive user prompt into the session's live 'focus' card so a regular session's own work shows IN PROGRESS (UserPromptSubmit); post an in-flight 'doing' card when a sub-agent is dispatched + claim each file edit on the bus and hand the model a warning when ANOTHER live session is touching the same file (PreToolUse) and enrich it with the native agent_id + parent session when the sub-agent spawns (SubagentStart); heartbeat presence on every tool call + deliver unread bus messages to a busy session mid-turn + mirror the session's TodoWrite list onto the board as cards (PostToolUse); write a handoff before compaction (PreCompact); surface CC's own background/child agents (fork/--agent/subtask) on the board when they need input or complete (Notification); card each sub-agent's notional API cost when it finishes (SubagentStop); refuse to go idle while a peer's DIRECT message sits unread, handing it to the model instead (Stop)",
+  "description": "trantor \u2014 auto-register each session + inject live roster + overseer landscape warning: linked projects, live peers, files in flight, collisions (SessionStart); turn each substantive user prompt into the session's live 'focus' card so a regular session's own work shows IN PROGRESS (UserPromptSubmit); post an in-flight 'doing' card when a sub-agent is dispatched + claim each file edit on the bus and hand the model a warning when ANOTHER live session is touching the same file (PreToolUse) and enrich it with the native agent_id + parent session when the sub-agent spawns (SubagentStart); heartbeat presence on every tool call + deliver unread bus messages to a busy session mid-turn + mirror the session's TodoWrite list onto the board as cards (PostToolUse); write a handoff before compaction (PreCompact); surface CC's own background/child agents (fork/--agent/subtask) on the board when they need input or complete (Notification); card each sub-agent's notional API cost when it finishes (SubagentStop); refuse to go idle while a peer's DIRECT message sits unread, handing it to the model instead (Stop)",
   "hooks": {
     "SessionStart": [
       {
@@ -81,6 +81,15 @@
             "command": "node ${CLAUDE_PLUGIN_ROOT}/hooks/ask-sidecar.mjs"
           }
         ]
+      },
+      {
+        "matcher": "Edit|Write|MultiEdit|NotebookEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node ${CLAUDE_PLUGIN_ROOT}/hooks/file-hold.mjs"
+          }
+        ]
       }
     ],
     "PermissionRequest": [

package/hooks/lib/git-checkout.mjs

@@ -0,0 +1,10 @@
+import { execFileSync } from "node:child_process";
+import { realpathSync } from "node:fs";
+
+export function gitCheckoutRoot(directory) {
+  try {
+    const root = execFileSync("git", ["-C", directory, "rev-parse", "--show-toplevel"],
+      { encoding: "utf8", timeout: 1000, stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return realpathSync(root);
+  } catch { return ""; }
+}

package/hooks/lib/overseer-level-cache.mjs

@@ -0,0 +1,25 @@
+import { createHash } from "node:crypto";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+const cacheDir = busDir => join(busDir || process.env.AGENT_BUS_DIR || join(homedir(), ".agent-bus"), "overseer-levels");
+const cacheFile = ({ project, hub, busDir }) => join(cacheDir(busDir), createHash("sha256").update(JSON.stringify([hub, project])).digest("hex") + ".json");
+
+export function readOverseerLevel(context) {
+  try {
+    const { level: cachedLevel, ts } = JSON.parse(readFileSync(cacheFile(context), "utf8"));
+    const level = cachedLevel ?? 2;
+    const age = Date.now() - ts;
+    return [1, 2, 3, 4].includes(level) && age >= 0 && age < 60_000 ? level : null;
+  } catch { return null; }
+}
+
+export function writeOverseerLevel(context, level = 2) {
+  level ??= 2;
+  if (![1, 2, 3, 4].includes(level)) return;
+  try {
+    mkdirSync(cacheDir(context.busDir), { recursive: true });
+    writeFileSync(cacheFile(context), JSON.stringify({ level, ts: Date.now() }));
+  } catch { /* A cache write failure must not affect the edit decision. */ }
+}

package/hooks/overseer-warn.mjs

@@ -31,7 +31,7 @@ try {
   if (!r.ok || !r.json) silent();
   const c = r.json;
 
-  const level = Number(c.level || 1);
+  const level = Number(c.level ?? 2);
   const warnings = Array.isArray(c.warnings) ? c.warnings : [];
   const inflight = Array.isArray(c.inflight) ? c.inflight : [];
   const links = Array.isArray(c.links) ? c.links : [];

package/hub/auth.mjs

@@ -117,18 +117,7 @@ function projectFromRequest(P, q, b) {
   }
   return canon(String(b?.project || q?.project || "").slice(0, 80));
 }
-// --- Cross-project guard (#6228) -----------------------------------------------------------
-// scopeAllows/canRead answer "can this identity touch project P at all" — and most identities
-// are minted project:"*" role:"owner" by defaultScopesFor (any non-agent kind: an orchestrator,
-// genesis, a human). That is not a project fence; it is exactly the loophole the pr-os
-// orchestrator walked through to register seats and post contracts into crebral-com from its
-// own session, nothing it was ever working. This is the fence: does the CALLER's own project
-// (its identity name's "kind:project" suffix, the same convention defaultScopesFor reads) match
-// the project the request ACTS on. Only a declared `trantor policy link` (state.orgPolicy.links,
-// the same store /policy reads and writes — POST /policy is itself OWNER_ENDPOINTS-gated) or the
-// operator's own identity (kind "human", the key /instance/supersede already treats as owner)
-// opens the door. Applies to the five endpoints that reach across sessions or mint access:
-// /send, /task, /task/update, /register, /invite.
+// Cross-project actions require a declared link or the operator identity, even with wildcard scopes (#6228).
 const CROSS_PROJECT_ENDPOINTS = new Set(["/send", "/task", "/task/update", "/register", "/invite"]);
 function projectsLinked(a, b) {
   if (!a || !b || a === b) return true;
@@ -139,7 +128,7 @@ function projectsLinked(a, b) {
 }
 function overseerPolicy() {
   const policy = state.orgPolicy && typeof state.orgPolicy === "object" ? state.orgPolicy : {};
-  return { autonomy: { "*": 1, ...(policy.autonomy || {}) }, links: Array.isArray(policy.links) ? policy.links : [] };
+  return { autonomy: { "*": 2, ...(policy.autonomy || {}) }, links: Array.isArray(policy.links) ? policy.links : [] };
 }
 // "projPair-a" is an INSTANCE of "projPair", not a different project: the shorter name is a prefix
 // of the longer and the remainder starts with a separator, not another project's first letter.
@@ -147,18 +136,7 @@ function instanceOfProject(a, b) {
   const [lo, hi] = a.length <= b.length ? [a, b] : [b, a];
   return hi.length > lo.length && hi.startsWith(lo) && !/[a-z0-9]/i.test(hi[lo.length]);
 }
-// The caller's home project, by the SAME "name suffix after the colon" rule defaultScopesFor
-// uses to mint a fresh identity's default scope. An identity with no colon in its name (a bare
-// human alias, or a tool identity never given a project) has no home to fence — nothing to check.
-//
-// The suffix is a CONVENTION, not a fact: session ids routinely carry an instance marker after the
-// project — "agent:projPair-a" is session -a OF projPair, the same shape as the fleet's per-seat
-// session ids — and reading that whole suffix as a home project fenced a session against its OWN
-// project's register/send (#6446, red since 3e18faf). So when the identity's own scopes name
-// exactly one concrete project (what /enroll bound at enrollment, and what /invite granted), that
-// enrolled project is the home — unless the suffix names a DIFFERENT project, in which case the
-// stricter suffix wins. Wildcard-scope identities (the fence's original target: a "*" owner like
-// an orchestrator or genesis) keep the pure suffix rule unchanged.
+// Enrollment identifies instance sessions; a conflicting suffix stays stricter. Wildcard identities keep the suffix fence (#6446).
 function callerProject(auth) {
   const name = String(auth?.identity?.name || "");
   const suffix = name.includes(":") ? canon(name.slice(name.lastIndexOf(":") + 1)) : "";
@@ -197,15 +175,7 @@ function crossProjectGuard(auth, P, b) {
   return { ok: false, code: 403,
     error: `cross-project: ${home} may not act on ${target} — cross-project action is a breach unless the operator linked the projects. Run: trantor policy link ${home} ${target} --reason "<why>"` };
 }
-// Is a stored baton claim still worth honouring? The claim names the instance it spared
-// (`exceptInstanceId`), so we defer to THAT instance only while it is still being seen. A claimant
-// that died stops muzzling its twins; one that comes back starts again. Records claimed before
-// `supersededBy` existed carry no claimant, so they fall back to "is any OTHER live instance of this
-// name still carrying it?" — an orphaned flag must not outlive every possible carrier.
-// NOTE lastSeen only advances on a request, and the heartbeat is PostToolUse, so an alive-but-idle
-// claimant reads as gone after the grace window. That is the intended trade: the only session that
-// ever asks this question is one a human is actively driving right now, and deferring to a claimant
-// that has been silent for longer than the window is worse than letting the driven session work.
+// Supersession lasts while its claimant is live, with startup grace; legacy claims defer to another live instance.
 function supersessionActive(rec) {
   if (!rec?.superseded) return false;
   const cut = now() - SUPERSEDE_GRACE_MS;
@@ -231,12 +201,7 @@ async function authenticate(req, path) {
     return { ok: false, code: 401, error: "signature required" };
   }
   const raw = req.method === "GET" || req.method === "HEAD" ? undefined : await rawBody(req);
-  // WARN MODE NEVER BLOCKS — it annotates. That is its entire contract: an observation period
-  // where the hub records what WOULD fail under enforce. The restarted local hub proved the
-  // failure mode: signed requests from a not-yet-enrolled identity got 401 "unknown identity"
-  // while UNSIGNED requests passed — punishing exactly the clients that already do the right
-  // thing. Under warn: bad signature, replay and unknown identity all pass with a warning;
-  // under enforce they are the hard failures they should be.
+  // Auth warn mode annotates signature, replay and enrollment failures; enforce mode rejects them.
   const soft = (warning) => AUTH_MODE === "warn"
     ? { ok: true, mode: AUTH_MODE, trusted: false, warning }
     : { ok: false, code: 401, error: warning };
@@ -287,17 +252,7 @@ function filterReadable(auth, rows, projectOf) {
   if (AUTH_MODE !== "enforce" && !auth?.identity) return rows;
   return rows.filter(row => canRead(auth, projectOf(row)));
 }
-// DISCOVERY follows declared links, and is deliberately wider than read.
-//
-// Sending across projects was never blocked: /send authorizes against the SENDER's project, so any
-// session can DM any session id it happens to know. Only the ROSTER was scoped — which meant two
-// sessions the operator had explicitly declared codependent could not learn each other's ids. The
-// overseer would tell both of them to "coordinate over the bus" and neither could find the other,
-// so the only remaining channel was the human. That is the exact traffic-cop role this project
-// exists to delete.
-//
-// A link is an operator declaration that two projects share resources. Treating it as mutual
-// discovery grants nothing a linked pair wasn't already told to do.
+// Declared links permit mutual roster discovery without granting broader read or write access.
 function canDiscover(auth, project) {
   if (canRead(auth, project)) return true;
   const proj = canon(project || "");

package/hub/overseer.mjs

@@ -1,12 +1,11 @@
+import * as collisionRules from "../lib/overseer.mjs";
+import * as sameProjectRules from "../lib/same-project.mjs";
+const { levelFor, checkoutKey, collisionIdentity } = collisionRules;
 /* oxlint-disable anti-slop/no-runtime-typeof -- SAFETY: orgPolicy is loaded from legacy durable state and this structural split preserves its existing compatibility guard. */
 export function createOverseer({ state, fileClaims, now, appendEvent, markDirty, duty }) {
-let _overseer = null;
-import("../lib/overseer.mjs").then(m => { _overseer = m; }).catch(() => {});
-// #5760: the same-project episode rule (lib/same-project.mjs, pure) — lazy like the detector, so
-// a hub booted before the module lands still runs (the same-project branch fails QUIET until it
-// arrives: a missing rule must never re-instate the hourly metronome).
-let _sameProject = null;
-import("../lib/same-project.mjs").then(m => { _sameProject = m; }).catch(() => {});
+const _overseer = collisionRules;
+const _sameProject = sameProjectRules;
+const saved = state.overseerState || {};
 const OVERSEER_TICK_MS = Number(process.env.RELAY_OVERSEER_TICK_MS || 30 * 1000);
 // How long a condition must be ABSENT before we consider the episode over. This is NOT a re-warn
 // timer: see overseerTick.
@@ -15,7 +14,7 @@ const OVERSEER_CLEAR_MS = Number(process.env.RELAY_OVERSEER_CLEAR_MS || process.
 // not an event: it persists (#5350 doctrine). It fires ONCE when it starts, stays quiet while it
 // holds (a metronome woke duty on 500 events for 4 conditions once), and the entry is forgotten
 // only after OVERSEER_CLEAR_MS of absence, so a genuine recurrence warns again.
-const overseerActive = new Map();
+const overseerActive = new Map((saved.active || []).map(([key, entry]) => [key, { ...entry, sessions: new Set(entry.sessions) }]));
 // Heartbeat for the WATCHER itself: /overseer/status must distinguish "fleet is clear" from "the
 // overseer stopped ticking" — a monitor that cannot prove it is alive reads as clear when dead.
 let overseerLastTick = 0;
@@ -23,14 +22,14 @@ let overseerLastCollisions = [];
 function overseerPolicy() {
   const p = state.orgPolicy && typeof state.orgPolicy === "object" ? state.orgPolicy : {};
   return {
-    autonomy: { "*": 1, ...(p.autonomy || {}) },
+    autonomy: { "*": 2, ...(p.autonomy || {}) },
     links: Array.isArray(p.links) ? p.links : [],
   };
 }
 function overseerInputs() {
   return {
     peers: Object.entries(state.peers).map(([session, v]) => ({
-      session, project: v.project || "", lastSeen: v.lastSeen || 0,
+      session, project: v.project || "", gitRoot: v.gitRoot || state.overseerState?.roots?.[session] || "", lastSeen: v.lastSeen || 0,
       llm: v.llm || "", model: v.model || "", status: v.status || "",
     })),
     claims: [...fileClaims.values()],
@@ -45,11 +44,75 @@ function overseerInputs() {
   };
 }
 
+// Claims and their decisions recover together so a restart cannot reopen a standing hold.
+const holds = new Map(saved.holds || []);
+const claimTtl = Number(process.env.RELAY_CLAIM_TTL_MS || 10 * 60 * 1000);
+for (const claim of saved.claims || []) {
+  if (now() - claim.ts <= claimTtl) fileClaims.set(`${checkoutKey(claim)}\u0000${claim.file}\u0000${claim.session}`, claim);
+}
+function persistEpisodes() {
+  state.overseerState = {
+    roots: state.overseerState?.roots || {},
+    active: [...overseerActive].map(([key, entry]) => [key, { ...entry, sessions: [...entry.sessions] }]),
+    sameProjectFired: [...sameProjectFired],
+    holds: [...holds],
+    claims: [...fileClaims.values()].filter(claim => now() - claim.ts <= claimTtl),
+  };
+  markDirty();
+}
+function syncHolds() {
+  const live = [...fileClaims.values()].filter(c => now() - c.ts <= claimTtl);
+  for (const [key, hold] of holds) {
+    if (levelFor(hold.project, overseerPolicy().autonomy) < 3 || !live.some(c => checkoutKey(c) === checkoutKey(hold) && c.file === hold.file && c.session === hold.other)) {
+      holds.delete(key);
+      appendEvent("hold.expired", hold.project, "overseer", { holdId: hold.id, file: hold.file });
+    }
+  }
+  const first = new Map();
+  for (const claim of live) {
+    const fileKey = JSON.stringify([checkoutKey(claim), claim.file]);
+    const other = first.get(fileKey);
+    if (!other) { first.set(fileKey, claim.session); continue; }
+    if (other === claim.session || levelFor(claim.project, overseerPolicy().autonomy) < 3) continue;
+    const key = JSON.stringify([checkoutKey(claim), claim.file, claim.session]);
+    if (holds.has(key)) continue;
+    const hold = { id: ++state.verifyGateSeq, project: claim.project, file: claim.file,
+      session: claim.session, gitRoot: claim.gitRoot || "", other, status: "pending", ts: now() };
+    holds.set(key, hold);
+    markDirty();
+    appendEvent("hold.opened", hold.project, hold.session,
+      { holdId: hold.id, file: hold.file, sessions: [other, hold.session], reason: holdReason(hold) });
+  }
+  persistEpisodes();
+}
+function holdReason(hold) {
+  return `held: file conflict with ${hold.other}, ${hold.status === "nogo" ? "operator decided no-go" : "waiting on the operator"}`;
+}
+function holdFor(project, file, session, gitRoot = "") {
+  syncHolds();
+  if (levelFor(project, overseerPolicy().autonomy) < 3) return null;
+  const hold = holds.get(JSON.stringify([checkoutKey({ project, gitRoot }), file, session]));
+  return hold && hold.status !== "go" ? { ...hold, reason: holdReason(hold) } : null;
+}
+function listHolds() { syncHolds(); return [...holds.values()]; }
+function decideHold(id, status, by) {
+  syncHolds();
+  const hold = [...holds.values()].find(h => h.id === id);
+  if (!hold || hold.status !== "pending") return null;
+  hold.status = status;
+  hold.decidedBy = by;
+  hold.decidedTs = now();
+  persistEpisodes();
+  appendEvent("hold.decided", hold.project, by, { holdId: hold.id, file: hold.file, status });
+  duty.hubSend(hold.session, `File hold #${hold.id}: ${status === "go" ? "Go — retry your edit" : "No-go — your edit remains held"} (${hold.file}).`, hold.project);
+  return hold;
+}
+
 // --- #5760: the same-project warning is an EPISODE keyed by the MEMBER SET -------------------
 // lib/same-project.mjs (pure) decides from (previous set, current set, declared crew,
 // last-fired-at): a declared crew is the NORMAL state of a project and not a collision at all,
 // an unchanged set never re-warns (#5350 machinery), and the record reports DURATION.
-const sameProjectFired = new Map(); // project -> { hash, sessions, ts } — the set as of the last verdict
+const sameProjectFired = new Map(saved.sameProjectFired || []); // project -> { hash, sessions, ts } — the set as of the last verdict
 
 // #8723 bounce-4: peerKindOf is the ONE answer to "what is this peer" — the row's own kind,
 // nothing else — shared with /peers, so roster and overseer can never disagree. The enrolled
@@ -63,10 +126,10 @@ function peerKindOf(p) {
 // (crew-runner stamps every /register its seats make), "orch" the project's orchestrator pane
 // (sessionstart stamps it when TRANTOR_ORCH names this project). A local crew-windows.txt reader
 // would describe the OPERATOR's machine, never this hub's. Genesis is deliberately NOT crew (#6068).
-function declaredCrewFor(project) {
+function declaredCrewFor(project, gitRoot = "") {
   const crew = new Set();
   for (const [sid, p] of Object.entries(state.peers)) {
-    if ((p.project || "") !== project) continue;
+    if (gitRoot ? (p.gitRoot || state.overseerState?.roots?.[sid]) !== gitRoot : (p.project || "") !== project) continue;
     const k = peerKindOf(p);
     if (k === "agent" || k === "orch") crew.add(sid);
   }
@@ -74,6 +137,7 @@ function declaredCrewFor(project) {
 }
 
 function overseerTick() {
+  syncHolds();
   if (!_overseer?.detectCollisions) return;
   let collisions = [];
   try { collisions = _overseer.detectCollisions(overseerInputs()) || []; } catch { return; }
@@ -86,11 +150,17 @@ function overseerTick() {
   // episode-start branch (all parties) and the standing branch (newcomers only, same-project
   // included): existing members never re-hear it, so a standing condition cannot re-wake every tick.
   const intro = (c, me, others) => {
+    const project = state.peers[me]?.project || c.project;
+    if (levelFor(project, pol.autonomy) < 2) return;
+    if (c.kind === "remote-overlap") {
+      duty.hubSend(me, `⚠️ OVERSEER remote-overlap: ${c.detail || ""}`, project);
+      return;
+    }
     const rest = others.filter(p => p !== me);
     if (rest.length === 0) return;
     duty.hubSend(me,
       `🤝 OVERSEER ${c.kind}: you and ${rest.join(", ")} are working on overlapping ground${c.files?.length ? ` (${c.files.slice(0, 3).join(", ")})` : ""}. ${c.detail || ""} Coordinate directly — relay_send to ${rest[0]} — and split the work between you. No human needs to relay this.`,
-      c.project);
+      project);
   };
   // #5760: same-project sets judged crew-only are dropped entirely — the normal state of a
   // project, not a collision — so not even the context feed narrates them.
@@ -101,16 +171,17 @@ function overseerTick() {
     // silent, the record reports DURATION. Without the rule module the fallback is the pre-#5760
     // generic loop: a missing rule must never re-instate the metronome, only loosen it.
     if (c.kind === "same-project-sessions" && _sameProject?.sameProjectDecision) {
-      const prior = sameProjectFired.get(c.project) || null;
+      const scope = checkoutKey(c);
+      const prior = sameProjectFired.get(scope) || null;
       const d = _sameProject.sameProjectDecision({
         previous: prior?.sessions ?? null,
         current: c.sessions,
-        declaredCrew: declaredCrewFor(c.project),
+        declaredCrew: declaredCrewFor(c.project, c.gitRoot),
         lastFiredAt: prior?.ts ?? null,
         now: t,
       });
       if (d.reason === "crew-only") continue;
-      const key = `${c.project} ${c.kind}`;
+      const key = `${scope} ${c.kind}`;
       c.key = key;
       seen.add(key);
       kept.push(c);
@@ -125,18 +196,18 @@ function overseerTick() {
         for (const me of parties) standing.sessions.add(me);
         // The record tracks the live membership (ts stays at the last warn) so a later open
         // judges the true previous set and can say how long the old one held.
-        if (d.fire && prior) sameProjectFired.set(c.project, { hash: _sameProject.memberSetHash(c.sessions), sessions: c.sessions, ts: prior.ts });
+        if (d.fire && prior) sameProjectFired.set(scope, { hash: _sameProject.memberSetHash(c.sessions), sessions: c.sessions, ts: prior.ts });
         continue;
       }
       // The episode OPENS and the pure rule said fire — first sighting, or a membership change
       // on a remembered set; the record line states how long the previous state held.
-      overseerActive.set(key, { since: t, lastTick: t, sessions: new Set(parties) });
+      overseerActive.set(key, { kind: c.kind, since: t, lastTick: t, sessions: new Set(parties) });
       c.since = t;
       if (d.reason === "membership-changed") c.detail = `${c.detail || ""} (same-project for ${_sameProject.durationLabel(d.durationMs)})`.trim();
-      sameProjectFired.set(c.project, { hash: _sameProject.memberSetHash(c.sessions), sessions: c.sessions, ts: t });
+      sameProjectFired.set(scope, { hash: _sameProject.memberSetHash(c.sessions), sessions: c.sessions, ts: t });
       appendEvent("overseer.warn", c.project, "overseer",
         { kind: c.kind, sessions: c.sessions || [], files: c.files || [], detail: c.detail || "", narrated: false });
-      if (duty.session) duty.hubSend(duty.session, `⚠️ OVERSEER ${c.kind} [${c.project}]: ${c.detail || ""} — if the parties are not already coordinating, message them.`, c.project);
+      if (levelFor(c.project, pol.autonomy) >= 2 && duty.session) duty.hubSend(duty.session, `⚠️ OVERSEER ${c.kind} [${c.project}]: ${c.detail || ""} — if the parties are not already coordinating, message them.`, c.project);
       if (parties.length > 1) for (const me of parties) intro(c, me, parties);
       continue;
     }
@@ -145,7 +216,7 @@ function overseerTick() {
     // membership is volatile — a third seat bouncing in and out of a standing collision minted a
     // fresh key, so a fresh episode, so a fresh warn (+ duty wake + party intros) per permutation.
     // Sessions are participants, not identity; current membership still rides every warn payload.
-    const key = `${c.project} ${c.kind} ${(c.files || []).join(",")}`;
+    const key = collisionIdentity(c);
     c.key = key;
     seen.add(key);
     const parties = [...new Set(c.sessions || [])].filter(s => s && s !== duty.session);
@@ -165,25 +236,18 @@ function overseerTick() {
       for (const me of parties) standing.sessions.add(me);
       continue;
     }
-    overseerActive.set(key, { since: t, lastTick: t, sessions: new Set(parties) });
+    overseerActive.set(key, { kind: c.kind, since: t, lastTick: t, sessions: new Set(parties) });
     c.since = t;
     appendEvent("overseer.warn", c.project, "overseer",
       { kind: c.kind, sessions: c.sessions || [], files: c.files || [], detail: c.detail || "", narrated: false });
-    if (duty.session) duty.hubSend(duty.session, `⚠️ OVERSEER ${c.kind} [${c.project}]: ${c.detail || ""} — if the parties are not already coordinating, message them.`, c.project);
-    if (parties.length > 1) for (const me of parties) intro(c, me, parties);
-    const level = _overseer.levelFor ? _overseer.levelFor(c.project, pol.autonomy) : 1;
-    if (level >= 3 && c.kind === "file-conflict") {
-      const g = { id: ++state.verifyGateSeq, project: c.project, status: "open", ts: now(),
-        by: "overseer", claim: `file conflict: ${(c.files || []).join(", ")} — ${(c.sessions || []).join(" vs ")}`,
-        why: c.detail || "two live sessions on the same file", howToVerify: "decide who proceeds; coordinate over the bus" };
-      state.verifyGates.push(g); markDirty();
-      appendEvent("verify.gate.opened", c.project, "overseer", { gateId: g.id, claim: g.claim, why: g.why });
-    }
+    if (levelFor(c.project, pol.autonomy) >= 2 && duty.session) duty.hubSend(duty.session, `⚠️ OVERSEER ${c.kind} [${c.project}]: ${c.detail || ""} — if the parties are not already coordinating, message them.`, c.project);
+    if (parties.length > 1 || c.kind === "remote-overlap") for (const me of parties) intro(c, me, parties);
+
   }
   // Episode end: a condition gone for the whole clear window is over, so a LATER recurrence is a
   // new episode and warns again. Without this the map would grow forever and nothing could re-fire.
   for (const [k, v] of overseerActive) {
-    if (!seen.has(k) && t - v.lastTick > OVERSEER_CLEAR_MS) {
+    if (!seen.has(k) && (v.kind === "remote-overlap" || t - v.lastTick > OVERSEER_CLEAR_MS)) {
       overseerActive.delete(k);
       // #5760: the same-project verdict record dies WITH its episode — a set that returns after a
       // genuine clear is a new episode (it warns again, first sighting), not the old one continuing.
@@ -191,11 +255,13 @@ function overseerTick() {
     }
   }
   overseerLastCollisions = kept;
+  persistEpisodes();
 }
 setInterval(overseerTick, OVERSEER_TICK_MS).unref?.();
 setTimeout(overseerTick, 2000).unref?.();
 
   return {
+    syncHolds, holdFor, listHolds, decideHold,
     overseerTick, overseerPolicy, overseerInputs, declaredCrewFor, peerKindOf,
     active: overseerActive,
     get engine() { return _overseer; },