@huynle/hub 0.8.2 → 0.8.4

package/src/central/recording/taps.ts

@@ -0,0 +1,105 @@
+// REC-01 registry taps (contract: Event schema → Hub): turn.started / first.token / turn.ended of the recorded root
+// session, tool rows (summary only, never the output), say.sent per spoken sentence, reply.full, utterance.delivered.
+// The registry calls these only from the session owner's connection; everything here is synchronous and cheap, the
+// writes happen in the recording service (asynchronous, best effort).
+import type { HubEventKind } from "../../protocol"
+import type { RecordingTap } from "../registry"
+
+export interface TapSink {
+  /** Records a hub event into every active recording of (userID, sessionID); a no-op without one. */
+  hub(userID: string, sessionID: string, kind: HubEventKind, fields: Record<string, unknown>): void
+  /** False when the user surely has no active recording (a fresh, empty cache); true when unsure. */
+  mayRecord(userID: string): boolean
+}
+
+const OUTCOMES: Record<string, "succeeded" | "failed" | "interrupted"> = {
+  "session.execution.succeeded": "succeeded",
+  "session.execution.failed": "failed",
+  "session.execution.interrupted": "interrupted",
+}
+const TOOL_STATES: Record<string, "called" | "success" | "failed"> = {
+  "session.tool.called": "called",
+  "session.tool.success": "success",
+  "session.tool.failed": "failed",
+}
+
+const remember = <K, V>(map: Map<K, V>, key: K, value: V, max = 1000) => {
+  map.delete(key)
+  map.set(key, value)
+  if (map.size > max) map.delete(map.keys().next().value as K)
+}
+
+export class RegistryTaps implements RecordingTap {
+  /** Root sessions whose turn started and whose first text delta is not seen yet. */
+  private readonly firstToken = new Set<string>()
+  /** Tool names by call ID (session.tool.input.started carries the name, the later events do not). */
+  private readonly tools = new Map<string, string>()
+
+  constructor(private readonly sink: TapSink) {}
+
+  wants(tenant: string, sessionID: string, type: string): boolean {
+    if (type === "session.text.delta") return this.firstToken.has(sessionID) && this.sink.mayRecord(tenant)
+    if (type === "session.execution.started") return true
+    return this.sink.mayRecord(tenant)
+  }
+
+  event(tenant: string, sessionID: string, type: string, data: Record<string, unknown>): void {
+    if (type === "session.execution.started") {
+      this.firstToken.add(sessionID)
+      if (this.firstToken.size > 1000) this.firstToken.delete(this.firstToken.values().next().value as string)
+      this.sink.hub(tenant, sessionID, "turn.started", {})
+      return
+    }
+    const outcome = OUTCOMES[type]
+    if (outcome) {
+      this.firstToken.delete(sessionID)
+      this.sink.hub(tenant, sessionID, "turn.ended", { outcome })
+      return
+    }
+    if (type === "session.text.delta") {
+      if (!this.firstToken.delete(sessionID)) return
+      const { assistantMessageID: messageID, ordinal } = data
+      this.sink.hub(tenant, sessionID, "first.token", { ...(typeof messageID === "string" ? { messageID } : {}), ...(typeof ordinal === "number" ? { ordinal } : {}) })
+      return
+    }
+    const callID = typeof data.id === "string" ? data.id : undefined
+    if (type === "session.tool.input.started") {
+      if (callID && typeof data.name === "string") remember(this.tools, callID, data.name.slice(0, 120))
+      return
+    }
+    const state = TOOL_STATES[type]
+    if (!state || !callID) return
+    const tool = this.tools.get(callID)
+    if (state !== "called") this.tools.delete(callID)
+    // The summary only (summarizeToolInput on the spoke): never the input itself, never the output or error.
+    const summary = state === "called" && typeof data.summary === "string" ? data.summary : undefined
+    this.sink.hub(tenant, sessionID, "tool", { callID, ...(tool ? { tool } : {}), ...(summary !== undefined ? { summary } : {}), state })
+  }
+
+  sentence(tenant: string, sessionID: string, messageID: string, ordinal: number, seq: number, text: string): void {
+    this.sink.hub(tenant, sessionID, "say.sent", { messageID, ordinal, seq, text })
+  }
+
+  reply(tenant: string, sessionID: string, messageID: string, ordinal: number, text: string): void {
+    if (!text.trim()) return
+    this.sink.hub(tenant, sessionID, "reply.full", { messageID, ordinal, text })
+  }
+
+  heard(tenant: string, sessionID: string, inboxID: string): void {
+    this.sink.hub(tenant, sessionID, "utterance.delivered", { inboxID })
+  }
+}
+
+/** A TTS ref header "<messageID>:<ordinal>:<seq>:<i>" (seq may be empty); undefined when malformed. */
+export function parseTtsRef(header: string | null): { messageID: string; ordinal: number; seq?: number; i: number } | undefined {
+  if (!header || header.length > 400) return undefined
+  const parts = header.split(":")
+  if (parts.length < 4) return undefined
+  const i = Number(parts.pop())
+  const seqText = parts.pop()!
+  const ordinal = Number(parts.pop())
+  const messageID = parts.join(":")
+  const seq = seqText === "" ? undefined : Number(seqText)
+  if (!messageID || !Number.isSafeInteger(i) || !Number.isSafeInteger(ordinal) || (seq !== undefined && !Number.isSafeInteger(seq))) return undefined
+  return { messageID, ordinal, ...(seq !== undefined ? { seq } : {}), i }
+}

package/src/central/recording/zip.ts

@@ -0,0 +1,138 @@
+// REC-01 streaming zip writer for recording exports (contract: Export response): the STORE method (no
+// compression; WAV hardly compresses), CRC-32 (Bun.hash.crc32), data descriptors (flag bit 3) so nothing is
+// buffered per entry, UTF-8 names (flag bit 11), no ZIP64 (RECORDING_LIMITS.userBytes keeps an export far below 4 GiB).
+
+export interface ZipEntry {
+  /** Path inside the archive ("manifest.json", "<id>/audio/000001.wav"). */
+  readonly name: string
+  /** The entry's bytes, read once when the writer reaches it; undefined writes an empty entry. */
+  body(): Promise<Uint8Array | ReadableStream<Uint8Array> | undefined>
+}
+
+const FLAGS = 0x0008 | 0x0800
+/** 1980-01-01 00:00 in DOS time (the exports carry their own timestamps in the manifest). */
+const DOS_TIME = 0
+const DOS_DATE = (0 << 9) | (1 << 5) | 1
+
+interface Written {
+  readonly name: Uint8Array
+  readonly offset: number
+  readonly crc: number
+  readonly size: number
+}
+
+const le = (size: number) => {
+  const bytes = new Uint8Array(size)
+  return { bytes, view: new DataView(bytes.buffer) }
+}
+
+function localHeader(name: Uint8Array): Uint8Array {
+  const { bytes, view } = le(30 + name.length)
+  view.setUint32(0, 0x04034b50, true)
+  view.setUint16(4, 20, true)
+  view.setUint16(6, FLAGS, true)
+  view.setUint16(8, 0, true)
+  view.setUint16(10, DOS_TIME, true)
+  view.setUint16(12, DOS_DATE, true)
+  // CRC and sizes follow in the data descriptor.
+  view.setUint16(26, name.length, true)
+  bytes.set(name, 30)
+  return bytes
+}
+
+function descriptor(crc: number, size: number): Uint8Array {
+  const { bytes, view } = le(16)
+  view.setUint32(0, 0x08074b50, true)
+  view.setUint32(4, crc, true)
+  view.setUint32(8, size, true)
+  view.setUint32(12, size, true)
+  return bytes
+}
+
+function centralEntry(entry: Written): Uint8Array {
+  const { bytes, view } = le(46 + entry.name.length)
+  view.setUint32(0, 0x02014b50, true)
+  view.setUint16(4, 20, true)
+  view.setUint16(6, 20, true)
+  view.setUint16(8, FLAGS, true)
+  view.setUint16(10, 0, true)
+  view.setUint16(12, DOS_TIME, true)
+  view.setUint16(14, DOS_DATE, true)
+  view.setUint32(16, entry.crc, true)
+  view.setUint32(20, entry.size, true)
+  view.setUint32(24, entry.size, true)
+  view.setUint16(28, entry.name.length, true)
+  view.setUint32(42, entry.offset, true)
+  bytes.set(entry.name, 46)
+  return bytes
+}
+
+function endOfDirectory(count: number, size: number, offset: number): Uint8Array {
+  const { bytes, view } = le(22)
+  view.setUint32(0, 0x06054b50, true)
+  view.setUint16(8, count, true)
+  view.setUint16(10, count, true)
+  view.setUint32(12, size, true)
+  view.setUint32(16, offset, true)
+  return bytes
+}
+
+/** The archive of `entries`, streamed: each entry's body is read only when the reader gets to it. */
+export function zipStream(entries: Iterable<ZipEntry> | AsyncIterable<ZipEntry>): ReadableStream<Uint8Array> {
+  async function* produce(): AsyncGenerator<Uint8Array> {
+    const written: Written[] = []
+    let offset = 0
+    for await (const entry of entries as AsyncIterable<ZipEntry>) {
+      const name = new TextEncoder().encode(entry.name)
+      const header = localHeader(name)
+      const start = offset
+      yield header
+      offset += header.length
+      let crc = 0
+      let size = 0
+      const body = await entry.body()
+      const take = (chunk: Uint8Array) => {
+        crc = Bun.hash.crc32(chunk, crc)
+        size += chunk.length
+        offset += chunk.length
+      }
+      if (body instanceof Uint8Array) {
+        take(body)
+        if (body.length) yield body
+      } else if (body) {
+        for await (const chunk of body as unknown as AsyncIterable<Uint8Array>) {
+          take(chunk)
+          if (chunk.length) yield chunk
+        }
+      }
+      crc >>>= 0
+      const tail = descriptor(crc, size)
+      yield tail
+      offset += tail.length
+      written.push({ name, offset: start, crc, size })
+    }
+    const directoryStart = offset
+    let directorySize = 0
+    for (const entry of written) {
+      const bytes = centralEntry(entry)
+      directorySize += bytes.length
+      yield bytes
+    }
+    yield endOfDirectory(written.length, directorySize, directoryStart)
+  }
+  const iterator = produce()
+  return new ReadableStream<Uint8Array>({
+    async pull(controller) {
+      try {
+        const { done, value } = await iterator.next()
+        if (done) controller.close()
+        else controller.enqueue(value)
+      } catch (cause) {
+        controller.error(cause)
+      }
+    },
+    async cancel() {
+      await iterator.return(undefined)
+    },
+  })
+}

package/src/central/registry.ts

@@ -12,7 +12,7 @@
 // holds the connection; remote state is never re-exported.
 import path from "node:path"
 import { HARNESS_OPENCODE, helloHarness, spokeFeatures, type EvidenceLevel, type ForwardedEvent, type Hello, type HerdrWorkspace, type ProcessKind, type SessionInfo, type RevertCommitted, type SessionRevertInfo, type SpokeFeature, type SpokeMode, type TerminalInfo, type Terminals } from "../protocol"
-import { StatusBoard, errorTypeLabel, permissionRequest, providerFailureNeedsUser, providerRetryNeedsUser, type Blocker, type BlockerRecommendation, type PermissionRequest, type SessionStatus } from "../status"
+import { BLOCKER_ID_MAX, StatusBoard, askBlocker, errorTypeLabel, permissionRequest, providerFailureNeedsUser, providerRetryNeedsUser, type Blocker, type BlockerRecommendation, type PermissionRequest, type SessionStatus } from "../status"
 import { sanitizeLabel } from "./agent/envelope"
 import { DoneWatch } from "./done"
 import { SentenceStream } from "./say-stream"
@@ -20,6 +20,23 @@ import type { ActivityStep, NotificationKind } from "./push"
 
 export { ACTIVITY_INTERVAL_MINUTES } from "./store"
 /** A tool call that took at least this long is named in activity updates (shorter ones are only counted). */
+/**
+ * (REC-01) Voice recording taps: what the hub sees of a recorded root session (docs/voice-recording.md). Called
+ * only from the session owner's connection (deduped like speakDelta), never changing behaviour; the tap writes
+ * only into recordings of `tenant` (the session's owner) and answers at once (its writes are asynchronous).
+ */
+export interface RecordingTap {
+  /** Cheap pre-check before an event is tapped (e.g. a text delta only while a first token is awaited). */
+  wants(tenant: string, sessionID: string, type: string): boolean
+  event(tenant: string, sessionID: string, type: string, data: Record<string, unknown>): void
+  sentence(tenant: string, sessionID: string, messageID: string, ordinal: number, seq: number, text: string): void
+  reply(tenant: string, sessionID: string, messageID: string, ordinal: number, text: string): void
+  heard(tenant: string, sessionID: string, inboxID: string): void
+}
+
+/** Spoke events a RecordingTap sees (root sessions only). */
+const TAPPED = new Set(["session.execution.started", "session.execution.succeeded", "session.execution.failed", "session.execution.interrupted", "session.tool.input.started", "session.tool.called", "session.tool.success", "session.tool.failed", "session.text.delta"])
+
 export const LONG_TOOL_MS = 30_000
 
 export class BusyError extends Error {
@@ -170,6 +187,17 @@ interface PendingPermission {
   readonly tenant?: string
   readonly request?: PermissionRequest
   recommendation?: BlockerRecommendation
+  /** Its blocker (bounded, askBlocker), to put back on a status board that lost it (see restoreBlockers). */
+  readonly blocker?: Blocker
+}
+
+/** A pending form and the processes that forwarded it. */
+interface PendingForm {
+  connIDs: string[]
+  readonly sessionID: string
+  readonly tenant?: string
+  /** Its blocker (bounded, askBlocker), to put back on a status board that lost it (see restoreBlockers). */
+  readonly blocker?: Blocker
 }
 
 /** Characters of a recommendation's author and reason on a blocker. */
@@ -382,6 +410,8 @@ interface WorkerSpeech {
 
 /** How many spoken texts, utterances and early deliveries are remembered for dedupe and matching. */
 const MEMORY = 1000
+/** Pending permissions, and pending forms, kept per tenant (oldest dropped). */
+export const PENDING_PER_TENANT = 200
 
 /** Adds to a bounded insertion-ordered map, dropping the oldest entry when full. */
 function remember<K, V>(map: Map<K, V>, key: K, value: V, limit = MEMORY): void {
@@ -389,6 +419,12 @@ function remember<K, V>(map: Map<K, V>, key: K, value: V, limit = MEMORY): void
   if (map.size > limit) map.delete(map.keys().next().value!)
 }
 
+/** Adds an ID to a bounded set of IDs (oldest dropped). */
+function rememberID(set: Set<string>, id: string, limit = 1000): void {
+  set.add(id)
+  if (set.size > limit) set.delete(set.values().next().value!)
+}
+
 const eventSessionID = (event: ForwardedEvent): string | undefined => {
   const data = event.data as Record<string, any>
   const id = event.type === "form.created" ? data.form?.sessionID : data.sessionID
@@ -399,6 +435,9 @@ const eventSessionID = (event: ForwardedEvent): string | undefined => {
 const isOn = (s: SessionInfo) => s.exposed !== false
 
 export class Registry {
+  /** (REC-01) Voice recording taps; optional, best effort. */
+  recordingTap?: RecordingTap
+
   private readonly conns = new Map<string, Conn>()
   private readonly boards = new Map<string, StatusBoard>()
   /**
@@ -420,9 +459,11 @@ export class Registry {
   private readonly humanTurnListeners = new Set<(sessionID: string, tenant?: string) => void>()
   private readonly sessionDeletedListeners = new Set<(sessionID: string, tenant: string) => void>()
   /** Pending form ID → its session and every connection that forwarded it, first first (like permissions). */
-  private readonly forms = new Map<string, { connIDs: string[]; sessionID: string }>()
-  /** Form IDs already alerted (forms may be forwarded by several processes). */
+  private readonly forms = new Map<string, PendingForm>()
+  /** Form IDs already alerted (forms may be forwarded by several processes, and re-announced after a reconnect). */
   private readonly alertedForms = new Set<string>()
+  /** Permission IDs already alerted (a reconnecting spoke re-announces what is still pending). */
+  private readonly alertedPermissions = new Set<string>()
   /** Sessions whose current run raised a providerError notification (once per run; cleared when a run starts). */
   private readonly providerAlerted = new Set<string>()
   /** Sessions in conversation mode → the connection last told so (re-sent when another one takes over). */
@@ -699,6 +740,8 @@ export class Registry {
       const owner = this.sessionTenant(id)
       if (owner !== undefined && owner !== tenant) return
     }
+    // A question or permission whose ID no card can carry is never kept (no card, no answer; unbounded memory).
+    if (oversizedBlockerID(event.type, data)) return
     if (sessionID) conn.activity.set(sessionID, this.tick())
     if (sessionID && event.type.startsWith("session.execution.")) {
       if (event.type === "session.execution.interrupted" && data.inferred === true) remember(this.inferredEnds, sessionID, this.now())
@@ -713,37 +756,50 @@ export class Registry {
     if (event.type === "permission.asked" && typeof data.id === "string" && sessionID) {
       const known = this.permissions.get(data.id)
       if (known) {
-        // The same request forwarded by another process: one more place to answer it.
+        // The same request forwarded by another process (or re-announced): one more place to answer it, and its
+        // blocker back on a status board that lost it.
         if (!known.connIDs.includes(connID)) known.connIDs.push(connID)
+        this.observeBoards(event, tenant)
         return
       }
       const request = permissionRequest(data)
-      this.permissions.set(data.id, { connIDs: [connID], sessionID, tenant, ...(request ? { request } : {}) })
-      this.alert("permission", sessionID, { requestID: data.id })
+      const blocker = askBlocker(event)
+      this.permissions.set(data.id, { connIDs: [connID], sessionID, tenant, ...(request ? { request } : {}), ...(blocker ? { blocker } : {}) })
+      this.capPending(this.permissions, tenant, (id) => this.dropPermission(id))
+      if (!this.alertedPermissions.has(data.id) && this.alert("permission", sessionID, { requestID: data.id })) rememberID(this.alertedPermissions, data.id)
     }
     if (event.type === "form.created" && sessionID) {
       const formID = (data.form as Record<string, unknown> | undefined)?.id
       if (typeof formID === "string") {
         const known = this.forms.get(formID)
         if (known && !known.connIDs.includes(connID)) known.connIDs.push(connID)
-        else if (!known) remember(this.forms, formID, { connIDs: [connID], sessionID })
-      }
-      if (typeof formID === "string" && !this.alertedForms.has(formID)) {
-        this.alertedForms.add(formID)
-        if (this.alertedForms.size > 1000) this.alertedForms.delete(this.alertedForms.values().next().value!)
-        this.alert("question", sessionID)
+        else if (!known) {
+          const blocker = askBlocker(event)
+          this.forms.set(formID, { connIDs: [connID], sessionID, tenant, ...(blocker ? { blocker } : {}) })
+          this.capPending(this.forms, tenant, (id) => this.dropForm(id))
+        }
       }
+      if (typeof formID === "string" && !this.alertedForms.has(formID) && this.alert("question", sessionID)) rememberID(this.alertedForms, formID)
     }
     let closedPermission: [string, PendingPermission] | undefined
-    if (event.type === "permission.replied" && typeof data.requestID === "string") {
-      const origin = this.permissions.get(data.requestID)
-      if (origin && this.permissions.delete(data.requestID)) closedPermission = [data.requestID, origin]
-    }
-    if ((event.type === "form.replied" || event.type === "form.cancelled") && typeof data.id === "string") {
-      this.forms.delete(data.id)
+    const permissionClose = event.type === "permission.replied" && typeof data.requestID === "string"
+    const formClose = (event.type === "form.replied" || event.type === "form.cancelled") && typeof data.id === "string"
+    if (permissionClose || formClose) {
+      const id = (permissionClose ? data.requestID : data.id) as string
+      const map: Map<string, PendingPermission | PendingForm> = permissionClose ? this.permissions : this.forms
+      const origin = map.get(id)
+      // Only the tenant that asked closes it (IDs are not secret enough to let another tenant end it).
+      const own = origin !== undefined && (origin.tenant === undefined || origin.tenant === tenant)
+      if (own && data.unlisted === true) {
+        // A spoke found it no longer listed by its own harness: only that process stops holding it.
+        origin.connIDs = origin.connIDs.filter((c) => c !== connID)
+        if (origin.connIDs.length) return
+      }
+      if (own && map.delete(id) && permissionClose) closedPermission = [id, origin as PendingPermission]
     }
 
     if (sessionID) this.trackRun(event.type, sessionID)
+    if (sessionID && this.recordingTap && TAPPED.has(event.type)) this.tap(connID, tenant, sessionID, event.type, data)
     const before = sessionID ? this.status(sessionID)?.find((s) => s.id === sessionID) : undefined
     this.observeBoards(event, tenant)
     if (sessionID) this.activitySteps(event.type, sessionID, data, before)
@@ -769,6 +825,31 @@ export class Registry {
     if (closedPermission) this.permissionClosed(...closedPermission)
   }
 
+  /** (REC-01) Hands a root session's event to the recording tap once: from the session's owner connection only. */
+  private tap(connID: string, tenant: string | undefined, sessionID: string, type: string, data: Record<string, unknown>): void {
+    const tap = this.recordingTap
+    if (!tap || tenant === undefined) return
+    try {
+      if (!tap.wants(tenant, sessionID, type) || this.rootOf(sessionID) !== sessionID || this.owner(sessionID) !== connID) return
+      tap.event(tenant, sessionID, type, data)
+    } catch (cause) {
+      console.error(`[hub] recording tap failed: ${(cause as Error).message}`)
+    }
+  }
+
+  /** (REC-01) A tap call that never throws into the registry. */
+  private tapSafely(call: (tap: RecordingTap, tenant: string) => void, sessionID: string): void {
+    const tap = this.recordingTap
+    if (!tap) return
+    const tenant = this.sessionTenant(sessionID)
+    if (tenant === undefined) return
+    try {
+      call(tap, tenant)
+    } catch (cause) {
+      console.error(`[hub] recording tap failed: ${(cause as Error).message}`)
+    }
+  }
+
   /** Records when a session's run started (kept by the first process to report it while it runs). */
   private trackRun(type: string, sessionID: string): void {
     if (type === "session.execution.started") {
@@ -816,8 +897,10 @@ export class Registry {
 
   /** Remembers an utterance's inbox item so its delivery is reported as a heard event. */
   trackUtterance(sessionID: string, inboxID: string): void {
-    if (this.deliveries.delete(inboxID)) this.emit({ type: "heard", sessionID, inboxID })
-    else remember(this.utterances, inboxID, sessionID)
+    if (this.deliveries.delete(inboxID)) {
+      this.emit({ type: "heard", sessionID, inboxID })
+      this.tapSafely((tap, tenant) => tap.heard(tenant, sessionID, inboxID), sessionID)
+    } else remember(this.utterances, inboxID, sessionID)
   }
 
   /**
@@ -841,6 +924,7 @@ export class Registry {
     if (sessionID === undefined) return remember(this.deliveries, inboxID, true)
     this.utterances.delete(inboxID)
     this.emit({ type: "heard", sessionID, inboxID })
+    this.tapSafely((tap, tenant) => tap.heard(tenant, sessionID, inboxID), sessionID)
   }
 
   /** Root text streaming in conversation mode: each sentence is spoken as soon as it is complete. */
@@ -872,13 +956,16 @@ export class Registry {
     const state = this.rootSpeech.get(key) ?? { sessionID, connID: "", stream: new SentenceStream(), seq: 0 }
     this.rootSpeech.delete(key)
     for (const sentence of state.stream.end(text)) this.emitSentence(state, messageID, ordinal, sentence)
+    this.tapSafely((tap, tenant) => tap.reply(tenant, sessionID, messageID, ordinal, text), sessionID)
     // Nobody is listening on a phone: push the whole reply so it reaches a locked screen.
     if (text.trim() && !this.watched(sessionID)) this.alert("say", sessionID, { text })
   }
 
   private emitSentence(state: RootSpeech, messageID: string, ordinal: number, text: string): void {
     this.heardFrom(state.sessionID, text)
-    this.emit({ type: "say", sessionID: state.sessionID, messageID, ordinal, seq: state.seq++, text })
+    const seq = state.seq++
+    this.emit({ type: "say", sessionID: state.sessionID, messageID, ordinal, seq, text })
+    this.tapSafely((tap, tenant) => tap.sentence(tenant, state.sessionID, messageID, ordinal, seq, text), state.sessionID)
   }
 
   /** The run stopped or conversation mode ended: the rest of its text parts is not spoken. */
@@ -1808,6 +1895,19 @@ export class Registry {
     }
   }
 
+  /**
+   * The user dismissed the session's last run failure: its status board stops showing it (consoles and the Concierge
+   * see the state leave "error") until it fails again. True when there was one to clear.
+   */
+  dismissError(sessionID: string): boolean {
+    const rootID = this.rootOf(sessionID)
+    const board = rootID === undefined ? undefined : this.boards.get(rootID)
+    if (rootID === undefined || !board?.observe({ type: "session.error.dismissed", data: { sessionID } })) return false
+    this.changed(this.sessionTenant(rootID))
+    this.emit({ type: "status", sessionID: rootID, sessions: this.live(board.snapshot().sessions) })
+    return true
+  }
+
   /** After a stop or interrupt: releases the turn locks in the session's tree and ends their waiting requests. */
   cancelTurns(sessionID: string): void {
     const rootID = this.rootOf(sessionID) ?? sessionID
@@ -1886,6 +1986,33 @@ export class Registry {
       if (next.length === pending.length) break
       pending = next
     }
+    this.restoreBlockers()
+  }
+
+  /** Keeps at most PENDING_PER_TENANT entries of the tenant in a pending map: the oldest are dropped (with their blocker). */
+  private capPending(map: Map<string, PendingPermission | PendingForm>, tenant: string, drop: (id: string) => void): void {
+    const own = [...map].filter(([, origin]) => (origin.tenant ?? this.sessionTenant(origin.sessionID)) === tenant)
+    for (const [id] of own.slice(0, Math.max(0, own.length - PENDING_PER_TENANT))) drop(id)
+  }
+
+  /**
+   * Puts pending permissions and forms back on the status boards that lost them: a board recreated after its
+   * session left the reported sessions for a moment, or one created after the question was asked (events reach
+   * only existing boards). OpenCode still waits for them; only a reply, a cancel or their processes going away
+   * end them (production 2026-11-05: a question card vanished while the session still waited).
+   */
+  private restoreBlockers(): void {
+    const restored = new Set<string>()
+    const restore = ({ sessionID, tenant, blocker }: PendingPermission | PendingForm) => {
+      if (!blocker) return
+      const rootID = this.rootOf(sessionID)
+      const board = rootID === undefined ? undefined : this.boards.get(rootID)
+      if (!rootID || !board || (tenant !== undefined && this.sessionTenant(rootID) !== tenant)) return
+      if (board.restoreBlocker(sessionID, blocker)) restored.add(rootID)
+    }
+    for (const origin of this.permissions.values()) restore(origin)
+    for (const origin of this.forms.values()) restore(origin)
+    for (const rootID of restored) this.emit({ type: "status", sessionID: rootID, sessions: this.live(this.boards.get(rootID)!.snapshot().sessions) })
   }
 
   // ---------- cluster (design §9) ----------
@@ -1913,7 +2040,7 @@ export class Registry {
     const add = (tenant: string | undefined) => tenant !== undefined && tenants.add(tenant)
     for (const rootID of this.boards.keys()) add(this.sessionTenant(rootID))
     for (const origin of this.permissions.values()) add(origin.tenant ?? this.sessionTenant(origin.sessionID))
-    for (const origin of this.forms.values()) add(this.sessionTenant(origin.sessionID))
+    for (const origin of this.forms.values()) add(origin.tenant ?? this.sessionTenant(origin.sessionID))
     for (const entry of this.presence.values()) add(this.sessionTenant(entry.sessionID))
     for (const sessionID of this.active.keys()) add(this.sessionTenant(sessionID))
     return [...tenants]
@@ -2048,11 +2175,12 @@ export class Registry {
    * Raises a notification for the root of `sessionID`'s tree. Only hand-offs, questions and permissions reach a
    * session some device shows (spoken replies check that themselves: the watching device speaks them).
    */
-  private alert(kind: NotificationKind, sessionID: string, fields: { text?: string; requestID?: string; subject?: string; key?: string; unlessPref?: NotificationKind } = {}): void {
+  /** True when it was raised (or skipped because a device shows the session); false for a session on no board. */
+  private alert(kind: NotificationKind, sessionID: string, fields: { text?: string; requestID?: string; subject?: string; key?: string; unlessPref?: NotificationKind } = {}): boolean {
     const entry = [...this.boards].find(([, board]) => board.get(sessionID))
-    if (!entry) return
+    if (!entry) return false
     const [rootID, board] = entry
-    if (!ALWAYS_ALERT.has(kind) && this.watched(rootID)) return
+    if (!ALWAYS_ALERT.has(kind) && this.watched(rootID)) return true
     const alert: Alert = {
       kind,
       sessionID: rootID,
@@ -2065,6 +2193,7 @@ export class Registry {
     }
     const owner = this.sessionTenant(rootID)
     for (const listener of this.alertListeners) listener(owner ? { ...alert, owner } : alert)
+    return true
   }
 
   private emit(message: RegistryMessage): void {
@@ -2072,3 +2201,10 @@ export class Registry {
     for (const listener of this.listeners) listener(message, tenant)
   }
 }
+
+/** A permission.asked / form.created (or their closes) with an ID longer than any card keeps. */
+function oversizedBlockerID(type: string, data: Record<string, unknown>): boolean {
+  const ids =
+    type === "permission.asked" ? [data.id] : type === "form.created" ? [(data.form as Record<string, unknown> | undefined)?.id] : []
+  return ids.some((id) => typeof id === "string" && id.length > BLOCKER_ID_MAX)
+}

package/src/central/spoke-ws.ts

@@ -521,6 +521,8 @@ export class SpokeHub {
       const owner = this.options.registry.sessionTenant(sessionID)
       if (owner !== undefined && owner !== call.tenant) throw new SpokeError("Unknown session")
     }
+    // A dismissed error: the session's status board is this pod's (its connection is here), not the calling pod's.
+    if (call.kind === "spoke" && call.req.op === "dismissError") this.options.registry.dismissError(call.req.sessionID)
     return call.kind === "node" ? this.requestNode(call.connID, call.req) : this.request(call.connID, call.req)
   }
 

package/src/index.ts

@@ -162,6 +162,33 @@ async function activity(kind: "service" | "standalone", directories: readonly st
   return { active: Object.keys(active ?? {}), jobs }
 }
 
+/**
+ * What OpenCode waits for in each session on this process's own server: its pending forms (session.form.list) and
+ * permission requests (session.permission.list). A session that cannot be read is left out; nothing when the
+ * server cannot be reached.
+ */
+async function pending(kind: "service" | "standalone", sessionIDs: readonly string[]) {
+  const client = await ownClient(kind).catch(() => undefined)
+  if (!client) return []
+  const out: Array<{ sessionID: string; forms: unknown[]; permissions: unknown[] }> = []
+  // One budget for the whole listing (the spoke gives up after 5 s too): a hung server stops being asked.
+  const signal = AbortSignal.timeout(PENDING_LIST_TIMEOUT_MS)
+  for (const sessionID of sessionIDs) {
+    if (signal.aborted) break
+    try {
+      const [forms, permissions] = await Promise.all([client.session.form.list({ sessionID }, { signal }), client.permission.list({ sessionID }, { signal })])
+      const list = (v: unknown) => unwrap<unknown[]>(v, Array.isArray)
+      out.push({ sessionID, forms: Array.isArray(list(forms)) ? list(forms) : [], permissions: Array.isArray(list(permissions)) ? list(permissions) : [] })
+    } catch {
+      // a session this server does not have (any more)
+    }
+  }
+  return out
+}
+
+/** How long one listing of pending forms and permissions may take on the own server. */
+const PENDING_LIST_TIMEOUT_MS = 5000
+
 /** Plugin API results may arrive bare or wrapped as { location, data }. */
 function unwrap<T>(value: unknown, isBare: (v: any) => boolean): T {
   const v = value as any
@@ -253,6 +280,7 @@ function hostFrom(ctx: Context, locations: () => PermissionLocation[], kind: "se
     },
     ...(canList(kind) ? { listRecent: (options?: { days: number; max: number; include: readonly string[]; signal?: AbortSignal }) => listRecent(kind, () => locations().map((l) => l.directory), options) } : {}),
     activity: (directories) => activity(kind, directories),
+    pending: (sessionIDs) => pending(kind, sessionIDs),
     // Fork and revert: over the own server's API (the plugin API has neither); only where it can be reached.
     ...(canList(kind)
       ? {