trantor 0.18.82 → 0.18.86

package/hub/overseer.mjs

@@ -1,12 +1,11 @@
+import * as collisionRules from "../lib/overseer.mjs";
+import * as sameProjectRules from "../lib/same-project.mjs";
+const { levelFor, checkoutKey, collisionIdentity } = collisionRules;
 /* oxlint-disable anti-slop/no-runtime-typeof -- SAFETY: orgPolicy is loaded from legacy durable state and this structural split preserves its existing compatibility guard. */
 export function createOverseer({ state, fileClaims, now, appendEvent, markDirty, duty }) {
-let _overseer = null;
-import("../lib/overseer.mjs").then(m => { _overseer = m; }).catch(() => {});
-// #5760: the same-project episode rule (lib/same-project.mjs, pure) — lazy like the detector, so
-// a hub booted before the module lands still runs (the same-project branch fails QUIET until it
-// arrives: a missing rule must never re-instate the hourly metronome).
-let _sameProject = null;
-import("../lib/same-project.mjs").then(m => { _sameProject = m; }).catch(() => {});
+const _overseer = collisionRules;
+const _sameProject = sameProjectRules;
+const saved = state.overseerState || {};
 const OVERSEER_TICK_MS = Number(process.env.RELAY_OVERSEER_TICK_MS || 30 * 1000);
 // How long a condition must be ABSENT before we consider the episode over. This is NOT a re-warn
 // timer: see overseerTick.
@@ -15,7 +14,7 @@ const OVERSEER_CLEAR_MS = Number(process.env.RELAY_OVERSEER_CLEAR_MS || process.
 // not an event: it persists (#5350 doctrine). It fires ONCE when it starts, stays quiet while it
 // holds (a metronome woke duty on 500 events for 4 conditions once), and the entry is forgotten
 // only after OVERSEER_CLEAR_MS of absence, so a genuine recurrence warns again.
-const overseerActive = new Map();
+const overseerActive = new Map((saved.active || []).map(([key, entry]) => [key, { ...entry, sessions: new Set(entry.sessions) }]));
 // Heartbeat for the WATCHER itself: /overseer/status must distinguish "fleet is clear" from "the
 // overseer stopped ticking" — a monitor that cannot prove it is alive reads as clear when dead.
 let overseerLastTick = 0;
@@ -23,14 +22,14 @@ let overseerLastCollisions = [];
 function overseerPolicy() {
   const p = state.orgPolicy && typeof state.orgPolicy === "object" ? state.orgPolicy : {};
   return {
-    autonomy: { "*": 1, ...(p.autonomy || {}) },
+    autonomy: { "*": 2, ...(p.autonomy || {}) },
     links: Array.isArray(p.links) ? p.links : [],
   };
 }
 function overseerInputs() {
   return {
     peers: Object.entries(state.peers).map(([session, v]) => ({
-      session, project: v.project || "", lastSeen: v.lastSeen || 0,
+      session, project: v.project || "", gitRoot: v.gitRoot || state.overseerState?.roots?.[session] || "", lastSeen: v.lastSeen || 0,
       llm: v.llm || "", model: v.model || "", status: v.status || "",
     })),
     claims: [...fileClaims.values()],
@@ -45,11 +44,75 @@ function overseerInputs() {
   };
 }
 
+// Claims and their decisions recover together so a restart cannot reopen a standing hold.
+const holds = new Map(saved.holds || []);
+const claimTtl = Number(process.env.RELAY_CLAIM_TTL_MS || 10 * 60 * 1000);
+for (const claim of saved.claims || []) {
+  if (now() - claim.ts <= claimTtl) fileClaims.set(`${checkoutKey(claim)}\u0000${claim.file}\u0000${claim.session}`, claim);
+}
+function persistEpisodes() {
+  state.overseerState = {
+    roots: state.overseerState?.roots || {},
+    active: [...overseerActive].map(([key, entry]) => [key, { ...entry, sessions: [...entry.sessions] }]),
+    sameProjectFired: [...sameProjectFired],
+    holds: [...holds],
+    claims: [...fileClaims.values()].filter(claim => now() - claim.ts <= claimTtl),
+  };
+  markDirty();
+}
+function syncHolds() {
+  const live = [...fileClaims.values()].filter(c => now() - c.ts <= claimTtl);
+  for (const [key, hold] of holds) {
+    if (levelFor(hold.project, overseerPolicy().autonomy) < 3 || !live.some(c => checkoutKey(c) === checkoutKey(hold) && c.file === hold.file && c.session === hold.other)) {
+      holds.delete(key);
+      appendEvent("hold.expired", hold.project, "overseer", { holdId: hold.id, file: hold.file });
+    }
+  }
+  const first = new Map();
+  for (const claim of live) {
+    const fileKey = JSON.stringify([checkoutKey(claim), claim.file]);
+    const other = first.get(fileKey);
+    if (!other) { first.set(fileKey, claim.session); continue; }
+    if (other === claim.session || levelFor(claim.project, overseerPolicy().autonomy) < 3) continue;
+    const key = JSON.stringify([checkoutKey(claim), claim.file, claim.session]);
+    if (holds.has(key)) continue;
+    const hold = { id: ++state.verifyGateSeq, project: claim.project, file: claim.file,
+      session: claim.session, gitRoot: claim.gitRoot || "", other, status: "pending", ts: now() };
+    holds.set(key, hold);
+    markDirty();
+    appendEvent("hold.opened", hold.project, hold.session,
+      { holdId: hold.id, file: hold.file, sessions: [other, hold.session], reason: holdReason(hold) });
+  }
+  persistEpisodes();
+}
+function holdReason(hold) {
+  return `held: file conflict with ${hold.other}, ${hold.status === "nogo" ? "operator decided no-go" : "waiting on the operator"}`;
+}
+function holdFor(project, file, session, gitRoot = "") {
+  syncHolds();
+  if (levelFor(project, overseerPolicy().autonomy) < 3) return null;
+  const hold = holds.get(JSON.stringify([checkoutKey({ project, gitRoot }), file, session]));
+  return hold && hold.status !== "go" ? { ...hold, reason: holdReason(hold) } : null;
+}
+function listHolds() { syncHolds(); return [...holds.values()]; }
+function decideHold(id, status, by) {
+  syncHolds();
+  const hold = [...holds.values()].find(h => h.id === id);
+  if (!hold || hold.status !== "pending") return null;
+  hold.status = status;
+  hold.decidedBy = by;
+  hold.decidedTs = now();
+  persistEpisodes();
+  appendEvent("hold.decided", hold.project, by, { holdId: hold.id, file: hold.file, status });
+  duty.hubSend(hold.session, `File hold #${hold.id}: ${status === "go" ? "Go — retry your edit" : "No-go — your edit remains held"} (${hold.file}).`, hold.project);
+  return hold;
+}
+
 // --- #5760: the same-project warning is an EPISODE keyed by the MEMBER SET -------------------
 // lib/same-project.mjs (pure) decides from (previous set, current set, declared crew,
 // last-fired-at): a declared crew is the NORMAL state of a project and not a collision at all,
 // an unchanged set never re-warns (#5350 machinery), and the record reports DURATION.
-const sameProjectFired = new Map(); // project -> { hash, sessions, ts } — the set as of the last verdict
+const sameProjectFired = new Map(saved.sameProjectFired || []); // project -> { hash, sessions, ts } — the set as of the last verdict
 
 // #8723 bounce-4: peerKindOf is the ONE answer to "what is this peer" — the row's own kind,
 // nothing else — shared with /peers, so roster and overseer can never disagree. The enrolled
@@ -63,10 +126,10 @@ function peerKindOf(p) {
 // (crew-runner stamps every /register its seats make), "orch" the project's orchestrator pane
 // (sessionstart stamps it when TRANTOR_ORCH names this project). A local crew-windows.txt reader
 // would describe the OPERATOR's machine, never this hub's. Genesis is deliberately NOT crew (#6068).
-function declaredCrewFor(project) {
+function declaredCrewFor(project, gitRoot = "") {
   const crew = new Set();
   for (const [sid, p] of Object.entries(state.peers)) {
-    if ((p.project || "") !== project) continue;
+    if (gitRoot ? (p.gitRoot || state.overseerState?.roots?.[sid]) !== gitRoot : (p.project || "") !== project) continue;
     const k = peerKindOf(p);
     if (k === "agent" || k === "orch") crew.add(sid);
   }
@@ -74,6 +137,7 @@ function declaredCrewFor(project) {
 }
 
 function overseerTick() {
+  syncHolds();
   if (!_overseer?.detectCollisions) return;
   let collisions = [];
   try { collisions = _overseer.detectCollisions(overseerInputs()) || []; } catch { return; }
@@ -86,11 +150,17 @@ function overseerTick() {
   // episode-start branch (all parties) and the standing branch (newcomers only, same-project
   // included): existing members never re-hear it, so a standing condition cannot re-wake every tick.
   const intro = (c, me, others) => {
+    const project = state.peers[me]?.project || c.project;
+    if (levelFor(project, pol.autonomy) < 2) return;
+    if (c.kind === "remote-overlap") {
+      duty.hubSend(me, `⚠️ OVERSEER remote-overlap: ${c.detail || ""}`, project);
+      return;
+    }
     const rest = others.filter(p => p !== me);
     if (rest.length === 0) return;
     duty.hubSend(me,
       `🤝 OVERSEER ${c.kind}: you and ${rest.join(", ")} are working on overlapping ground${c.files?.length ? ` (${c.files.slice(0, 3).join(", ")})` : ""}. ${c.detail || ""} Coordinate directly — relay_send to ${rest[0]} — and split the work between you. No human needs to relay this.`,
-      c.project);
+      project);
   };
   // #5760: same-project sets judged crew-only are dropped entirely — the normal state of a
   // project, not a collision — so not even the context feed narrates them.
@@ -101,16 +171,17 @@ function overseerTick() {
     // silent, the record reports DURATION. Without the rule module the fallback is the pre-#5760
     // generic loop: a missing rule must never re-instate the metronome, only loosen it.
     if (c.kind === "same-project-sessions" && _sameProject?.sameProjectDecision) {
-      const prior = sameProjectFired.get(c.project) || null;
+      const scope = checkoutKey(c);
+      const prior = sameProjectFired.get(scope) || null;
       const d = _sameProject.sameProjectDecision({
         previous: prior?.sessions ?? null,
         current: c.sessions,
-        declaredCrew: declaredCrewFor(c.project),
+        declaredCrew: declaredCrewFor(c.project, c.gitRoot),
         lastFiredAt: prior?.ts ?? null,
         now: t,
       });
       if (d.reason === "crew-only") continue;
-      const key = `${c.project} ${c.kind}`;
+      const key = `${scope} ${c.kind}`;
       c.key = key;
       seen.add(key);
       kept.push(c);
@@ -125,18 +196,18 @@ function overseerTick() {
         for (const me of parties) standing.sessions.add(me);
         // The record tracks the live membership (ts stays at the last warn) so a later open
         // judges the true previous set and can say how long the old one held.
-        if (d.fire && prior) sameProjectFired.set(c.project, { hash: _sameProject.memberSetHash(c.sessions), sessions: c.sessions, ts: prior.ts });
+        if (d.fire && prior) sameProjectFired.set(scope, { hash: _sameProject.memberSetHash(c.sessions), sessions: c.sessions, ts: prior.ts });
         continue;
       }
       // The episode OPENS and the pure rule said fire — first sighting, or a membership change
       // on a remembered set; the record line states how long the previous state held.
-      overseerActive.set(key, { since: t, lastTick: t, sessions: new Set(parties) });
+      overseerActive.set(key, { kind: c.kind, since: t, lastTick: t, sessions: new Set(parties) });
       c.since = t;
       if (d.reason === "membership-changed") c.detail = `${c.detail || ""} (same-project for ${_sameProject.durationLabel(d.durationMs)})`.trim();
-      sameProjectFired.set(c.project, { hash: _sameProject.memberSetHash(c.sessions), sessions: c.sessions, ts: t });
+      sameProjectFired.set(scope, { hash: _sameProject.memberSetHash(c.sessions), sessions: c.sessions, ts: t });
       appendEvent("overseer.warn", c.project, "overseer",
         { kind: c.kind, sessions: c.sessions || [], files: c.files || [], detail: c.detail || "", narrated: false });
-      if (duty.session) duty.hubSend(duty.session, `⚠️ OVERSEER ${c.kind} [${c.project}]: ${c.detail || ""} — if the parties are not already coordinating, message them.`, c.project);
+      if (levelFor(c.project, pol.autonomy) >= 2 && duty.session) duty.hubSend(duty.session, `⚠️ OVERSEER ${c.kind} [${c.project}]: ${c.detail || ""} — if the parties are not already coordinating, message them.`, c.project);
       if (parties.length > 1) for (const me of parties) intro(c, me, parties);
       continue;
     }
@@ -145,7 +216,7 @@ function overseerTick() {
     // membership is volatile — a third seat bouncing in and out of a standing collision minted a
     // fresh key, so a fresh episode, so a fresh warn (+ duty wake + party intros) per permutation.
     // Sessions are participants, not identity; current membership still rides every warn payload.
-    const key = `${c.project} ${c.kind} ${(c.files || []).join(",")}`;
+    const key = collisionIdentity(c);
     c.key = key;
     seen.add(key);
     const parties = [...new Set(c.sessions || [])].filter(s => s && s !== duty.session);
@@ -165,25 +236,18 @@ function overseerTick() {
       for (const me of parties) standing.sessions.add(me);
       continue;
     }
-    overseerActive.set(key, { since: t, lastTick: t, sessions: new Set(parties) });
+    overseerActive.set(key, { kind: c.kind, since: t, lastTick: t, sessions: new Set(parties) });
     c.since = t;
     appendEvent("overseer.warn", c.project, "overseer",
       { kind: c.kind, sessions: c.sessions || [], files: c.files || [], detail: c.detail || "", narrated: false });
-    if (duty.session) duty.hubSend(duty.session, `⚠️ OVERSEER ${c.kind} [${c.project}]: ${c.detail || ""} — if the parties are not already coordinating, message them.`, c.project);
-    if (parties.length > 1) for (const me of parties) intro(c, me, parties);
-    const level = _overseer.levelFor ? _overseer.levelFor(c.project, pol.autonomy) : 1;
-    if (level >= 3 && c.kind === "file-conflict") {
-      const g = { id: ++state.verifyGateSeq, project: c.project, status: "open", ts: now(),
-        by: "overseer", claim: `file conflict: ${(c.files || []).join(", ")} — ${(c.sessions || []).join(" vs ")}`,
-        why: c.detail || "two live sessions on the same file", howToVerify: "decide who proceeds; coordinate over the bus" };
-      state.verifyGates.push(g); markDirty();
-      appendEvent("verify.gate.opened", c.project, "overseer", { gateId: g.id, claim: g.claim, why: g.why });
-    }
+    if (levelFor(c.project, pol.autonomy) >= 2 && duty.session) duty.hubSend(duty.session, `⚠️ OVERSEER ${c.kind} [${c.project}]: ${c.detail || ""} — if the parties are not already coordinating, message them.`, c.project);
+    if (parties.length > 1 || c.kind === "remote-overlap") for (const me of parties) intro(c, me, parties);
+
   }
   // Episode end: a condition gone for the whole clear window is over, so a LATER recurrence is a
   // new episode and warns again. Without this the map would grow forever and nothing could re-fire.
   for (const [k, v] of overseerActive) {
-    if (!seen.has(k) && t - v.lastTick > OVERSEER_CLEAR_MS) {
+    if (!seen.has(k) && (v.kind === "remote-overlap" || t - v.lastTick > OVERSEER_CLEAR_MS)) {
       overseerActive.delete(k);
       // #5760: the same-project verdict record dies WITH its episode — a set that returns after a
       // genuine clear is a new episode (it warns again, first sighting), not the old one continuing.
@@ -191,11 +255,13 @@ function overseerTick() {
     }
   }
   overseerLastCollisions = kept;
+  persistEpisodes();
 }
 setInterval(overseerTick, OVERSEER_TICK_MS).unref?.();
 setTimeout(overseerTick, 2000).unref?.();
 
   return {
+    syncHolds, holdFor, listHolds, decideHold,
     overseerTick, overseerPolicy, overseerInputs, declaredCrewFor, peerKindOf,
     active: overseerActive,
     get engine() { return _overseer; },

package/hub/routes/admin.mjs

@@ -1,3 +1,4 @@
+import { checkoutKey, collisionIdentity, levelFor } from "../../lib/overseer.mjs";
 /* oxlint-disable anti-slop/no-runtime-typeof -- SAFETY: These checks preserve the established request and provider-response compatibility boundary during a route-only extraction. */
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
@@ -7,6 +8,19 @@ import { join } from "node:path";
 // consume a claim's first-touch (or vice versa), and /claims must never list reads. #7972.
 const fileReads = new Map();
 
+function remoteEvidence(value, file) {
+  if (!Array.isArray(value)) return [];
+  return value.slice(0, 25).filter(row =>
+    row && typeof row.repo === "string" && /^[\w.-]+\/[\w.-]+$/.test(row.repo) && row.repo.length <= 200 &&
+    Number.isSafeInteger(row.number) && row.number > 0 &&
+    typeof row.author === "string" && row.author.length > 0 && row.author.length <= 120 &&
+    typeof row.url === "string" && row.url.length <= 2000 &&
+    (row.url === "" || /^https:\/\/[^\s]+$/.test(row.url)) &&
+    Array.isArray(row.files) && row.files.includes(file)
+  ).map(row => ({ repo: row.repo.toLowerCase(), number: row.number, author: row.author,
+    url: row.url, files: [file] }));
+}
+
 export async function routeAdmin({ req, res, q, P, auth, ctx }) {
   const {
     state, body, json, crossProjectGuard, touch, canon, filterReadable,
@@ -23,6 +37,13 @@ export async function routeAdmin({ req, res, q, P, auth, ctx }) {
       // WHO is this, really: the LLM brand + the exact model currently loaded. In-memory like the
       // rest of presence — the next heartbeat re-supplies it after a restart.
       const pr = state.peers[b.session];
+      if (pr && b.gitRoot) {
+        pr.gitRoot = String(b.gitRoot).slice(0, 2000);
+        state.overseerState ??= {};
+        state.overseerState.roots ??= {};
+        state.overseerState.roots[b.session] = pr.gitRoot;
+        markDirty();
+      }
       // #6148: WHAT a session is rides its peer row (kind "genesis" = the CLI's brief-poster,
       // "agent" = a crew seat) — /peers hands it to the app so the seat strip can tell them apart.
       if (pr) { if (b.model) pr.model = String(b.model).slice(0, 80); if (b.llm) pr.llm = String(b.llm).slice(0, 40); if (b.kind) pr.kind = String(b.kind).slice(0, 40); }
@@ -194,7 +215,7 @@ export async function routeAdmin({ req, res, q, P, auth, ctx }) {
       const proj = canon(String(q.project || "").slice(0, 80));
       if (!proj) return json(res, 400, { error: "project required" });
       const pol = overseerPolicy();
-      const level = overseer.engine?.levelFor ? overseer.engine.levelFor(proj, pol.autonomy) : (pol.autonomy[proj] ?? pol.autonomy["*"] ?? 1);
+      const level = overseer.engine?.levelFor ? overseer.engine.levelFor(proj, pol.autonomy) : (pol.autonomy[proj] ?? pol.autonomy["*"] ?? 2);
       const links = pol.links.filter(l => (l.projects || []).includes(proj));
       const linked = new Set(links.flatMap(l => l.projects).filter(x => x !== proj));
       const cutoff = now() - ONLINE_MS;
@@ -207,7 +228,7 @@ export async function routeAdmin({ req, res, q, P, auth, ctx }) {
       let warnings = [];
       try {
         warnings = (overseer.engine?.detectCollisions ? overseer.engine.detectCollisions(overseerInputs()) : [])
-          .filter(c => c.project === proj || linked.has(c.project));
+          .filter(c => c.project === proj || c.projects?.includes(proj) || linked.has(c.project));
         // #5760: a declared crew is the NORMAL state of a project, not a collision — the tick
         // loop drops crew-only sets before they ever become episodes, and this live view must
         // agree with it: the SessionStart hook narrates exactly these lines, so a crew-only leak
@@ -215,14 +236,14 @@ export async function routeAdmin({ req, res, q, P, auth, ctx }) {
         warnings = warnings.filter(c => !(c.kind === "same-project-sessions" && overseer.sameProject?.sameProjectDecision &&
           overseer.sameProject.sameProjectDecision({
             current: c.sessions,
-            declaredCrew: declaredCrewFor(c.project),
+            declaredCrew: declaredCrewFor(c.project, c.gitRoot),
             now: now(),
           }).reason === "crew-only"));
         // The record line reports DURATION ("standing for 6h"), never a count of warnings. Episode
         // identity is project+kind+files, exactly as the tick loop keys it, so this view says the
         // same thing the warning did  for every kind, not just same-project (#7029).
         for (const c of warnings) {
-          const ep = overseer.active.get(`${c.project} ${c.kind}${c.kind === "same-project-sessions" ? "" : ` ${(c.files || []).join(",")}`}`);
+          const ep = overseer.active.get(c.kind === "same-project-sessions" ? `${checkoutKey(c)} ${c.kind}` : collisionIdentity(c));
           if (!ep) continue;
           c.since = ep.since;
           const label = c.kind === "same-project-sessions" ? "same-project" : "standing";
@@ -269,25 +290,50 @@ export async function routeAdmin({ req, res, q, P, auth, ctx }) {
       markDirty();
       return json(res, 200, { ok: true });
     }
-    if (req.method === "POST" && P === "/claim") {
+    if (req.method === "GET" && P === "/holds") {
+      const rows = overseer.listHolds().filter(h => (!q.project || h.project === canon(q.project)) && (!q.status || h.status === q.status));
+      return json(res, 200, { holds: filterReadable(auth, rows, h => h.project) });
+    }
+    if (req.method === "POST" && P === "/hold/decide") {
+      const b = await body(req);
+      const hold = overseer.listHolds().find(h => h.id === Number(b.id));
+      if (!hold) return json(res, 404, { error: "hold expired or not found" });
+      if (AUTH_MODE !== "off" && !scopeAllows(auth?.identity, hold.project, "owner")) return json(res, 403, { error: "operator permission required" });
+      if (b.status !== "go" && b.status !== "nogo") return json(res, 400, { error: "status must be go or nogo" });
+      const decided = overseer.decideHold(hold.id, b.status, auth?.identity?.name || "operator");
+      return decided ? json(res, 200, { ok: true, hold: decided }) : json(res, 409, { error: "hold already decided" });
+    }
+    if (req.method === "POST" && (P === "/claim" || P === "/hold/check")) {
       const b = await body(req);
       const proj = canon(String(b.project || "").slice(0, 80));
       const file = String(b.file || "").slice(0, 400);
       const session = String(b.session || "").slice(0, 120);
       if (!proj || !file || !session) return json(res, 400, { error: "project, file and session required" });
+      if (auth?.identity && session !== auth.identity.name) return json(res, 403, { error: "session must match signer" });
+      const gitRoot = String(b.gitRoot || state.peers[session]?.gitRoot || state.overseerState?.roots?.[session] || "").slice(0, 2000);
       pruneClaims();
-      const key = `${proj}${file}${session}`;
+      const key = `${checkoutKey({ project: proj, gitRoot })}\u0000${file}\u0000${session}`;
       const mine = fileClaims.get(key);
       const conflicts = [...fileClaims.values()]
-        .filter(c => c.project === proj && c.file === file && c.session !== session)
+        .filter(c => checkoutKey(c) === checkoutKey({ project: proj, gitRoot }) && c.file === file && c.session !== session)
         .map(c => ({ session: c.session, ts: c.ts, agoSec: Math.round((now() - c.ts) / 1000) }));
-      fileClaims.set(key, { project: proj, file, session, ts: now() });
+      const remote = P === "/hold/check" && b.remote === undefined
+        ? (mine?.remote || []) : remoteEvidence(b.remote, file);
+      fileClaims.set(key, { project: proj, file, session, gitRoot, ts: now(), remote });
       touch(session, undefined, undefined, undefined, auth);
-      // Feed events, throttled by design: the FIRST touch inside a TTL window says "claimed";
-      // a collision says so every time — that is the one worth seeing on the FEED.
+      if (gitRoot) {
+        state.peers[session].gitRoot = gitRoot;
+        state.overseerState ??= {};
+        state.overseerState.roots ??= {};
+        state.overseerState.roots[session] = gitRoot;
+      }
+      // Repeated checks refresh the claim without repeating its conflict event.
       if (!mine) appendEvent("file.claim", proj, session, { file });
-      if (conflicts.length) appendEvent("file.conflict", proj, session, { file, with: conflicts.map(c => c.session) });
-      return json(res, 200, { ok: true, conflicts, ttlMs: CLAIM_TTL_MS });
+      if (!mine && conflicts.length) appendEvent("file.conflict", proj, session, { file, with: conflicts.map(c => c.session) });
+      overseer.overseerTick();
+      const hold = overseer.holdFor(proj, file, session, gitRoot);
+      const level = levelFor(proj, overseer.overseerPolicy().autonomy);
+      return json(res, 200, { ok: true, conflicts: level >= 2 ? conflicts : [], level, hold, ttlMs: CLAIM_TTL_MS });
     }
     if (req.method === "GET" && P === "/claims") {
       pruneClaims();

package/hub/store.mjs

@@ -6,7 +6,7 @@ import { DEFAULT_ORG } from "../lib/store-contract.mjs";
 
 export async function createStoreRuntime({ STORE_KIND, PG_URL, ORG_ID, DATA }) {
 function emptyState() {
-  return { messages: [], peers: {}, seq: 0, tasks: [], taskSeq: 0, projectMeta: {}, lessons: [], events: [], cardEventsBackfilled: false, aliases: {}, phaseMeta: {}, verifyGates: [], verifyGateSeq: 0, proposals: [], proposalSeq: 0, balances: { ts: 0, by: "", entries: [] }, subagentCostReset: false, handoffLog: [], identities: {}, inviteTokens: {}, focus: {}, orgPolicy: {}, instances: {}, dutySession: "", contractReap: {}, eventSeq: 0 };
+  return { messages: [], peers: {}, seq: 0, tasks: [], taskSeq: 0, projectMeta: {}, lessons: [], events: [], cardEventsBackfilled: false, aliases: {}, phaseMeta: {}, verifyGates: [], verifyGateSeq: 0, proposals: [], proposalSeq: 0, balances: { ts: 0, by: "", entries: [] }, subagentCostReset: false, handoffLog: [], identities: {}, inviteTokens: {}, focus: {}, orgPolicy: {}, overseerState: {}, instances: {}, dutySession: "", contractReap: {}, eventSeq: 0 };
 }
 
 const CARD_LOG_MAX = 40;
@@ -110,6 +110,7 @@ function normalizeState(loaded = {}) {
   s.instances = loaded.instances && typeof loaded.instances === "object" ? loaded.instances : {};
   s.focus = loaded.focus && typeof loaded.focus === "object" ? loaded.focus : {};
   s.orgPolicy = loaded.orgPolicy && typeof loaded.orgPolicy === "object" ? loaded.orgPolicy : {};
+  s.overseerState = loaded.overseerState || {};
   s.dutySession = String(loaded.dutySession || "");
   s.contractReap = loaded.contractReap && typeof loaded.contractReap === "object" ? loaded.contractReap : {};
   // The event id high-water mark. Seeded from the store's own MAX(id) where it supplied one, and
@@ -127,7 +128,7 @@ function normalizeState(loaded = {}) {
       // #6170: `kind` rides the load. This normalizer rebuilds every peer from an explicit field
       // list, so a field missing here is dropped however faithfully the store returned it (the kinds
       // came back empty on the first live restart). llm/model stay out: they are in-memory presence.
-      : { lastSeen: v.lastSeen || 0, status: v.status || "", project: v.project || "", pubkey: v.pubkey || "", identity: v.identity || null, authWarning: v.authWarning || "", hookVersion: v.hookVersion || "", kind: v.kind || "", deliveredUpTo: v.deliveredUpTo || v.delivered_up_to || 0, _on: v._on === true || v.online === true };
+      : { lastSeen: v.lastSeen || 0, status: v.status || "", project: v.project || "", pubkey: v.pubkey || "", identity: v.identity || null, authWarning: v.authWarning || "", hookVersion: v.hookVersion || "", kind: v.kind || "", gitRoot: v.gitRoot || loaded.overseerState?.roots?.[session] || "", deliveredUpTo: v.deliveredUpTo || v.delivered_up_to || 0, _on: v._on === true || v.online === true };
   }
   return s;
 }

package/hub.mjs

@@ -27,7 +27,7 @@ const PG_URL = process.env.RELAY_DATABASE_URL || process.env.POSTGRES_URL ||
   ((RAW_STORE_KIND === "pg" || RAW_STORE_KIND === "postgres") ? process.env.DATABASE_URL : "");
 const STORE_KIND = RAW_STORE_KIND || (PG_URL ? "pg" : "json");
 const ORG_ID = process.env.RELAY_ORG_ID || DEFAULT_ORG;
-const AUTH_MODE = ["off", "warn", "enforce"].includes(process.env.RELAY_AUTH) ? process.env.RELAY_AUTH : "warn";
+const AUTH_MODE = ["off", "warn", "enforce"].includes(process.env.RELAY_AUTH) ? process.env.RELAY_AUTH : "enforce";
 const ENROLL_MODE = process.env.RELAY_ENROLL || "tofu";
 const ONLINE_MS = Number(process.env.RELAY_ONLINE_MS || 5 * 60 * 1000);
 const PEER_TTL_DEFAULT_MS = 21600000;

package/lib/duty-nudges.mjs

@@ -283,6 +283,18 @@ export async function recordDutyNudges({ plan, observedIds, statePath, now = Dat
   return nudged;
 }
 
+// #11355: an id the shared pre-send ledger awarded to the OTHER nudger must not keep this path's
+// planned claim — it would block the winner's own re-claim machinery for up to 30 minutes.
+export async function releaseDutyNudgeClaims({ ids, statePath, owner }) {
+  const wanted = [...new Set((ids || []).map(String).filter(Boolean))];
+  if (!wanted.length) return;
+  await withStateLock(statePath, state => {
+    for (const id of wanted) {
+      if (state.planned[id]?.owner === owner) delete state.planned[id];
+    }
+  });
+}
+
 export async function auditDutyNudges({ plan, observedIds, statePath, reportFailure, now = Date.now() }) {
   const nudged = await recordDutyNudges({ plan, observedIds, statePath, now });
   // #7429: the audit reads the ledger — an id the mechanical wake already verified (or a terminal