@mmmbuto/nexuscrew 0.9.29 → 0.9.31

package/lib/notify/ask-answer-service.js

@@ -0,0 +1,184 @@
+'use strict';
+// lib/notify/ask-answer-service.js — ONE answer cycle for BOTH the local route
+// and the federated one. There is no second path: claim (synchronous) ->
+// paste to the session FROM THE STORE (never from a body) -> commit or a
+// declared failure -> a qualified closure event (askId, revision, cell).
+//
+// Federated attempts additionally carry a durable receipt (written BEFORE the
+// paste) and an idempotency contract: the same requestId with the same text
+// after a timeout returns the stored state WITHOUT pasting again; the same id
+// with a different text is a 409. A locked ask (delivery-unknown from a
+// previous crash) refuses new pastes on EVERY path until the operator
+// reconciles explicitly: no silent retries, no TTL.
+
+const crypto = require('node:crypto');
+
+const REQUEST_ID_RE = /^[0-9a-f-]{16,64}$/i;
+
+function createAskAnswerService({ asks, paste, receipts, onClosure, labelPrefix = 'reply' } = {}) {
+  if (!asks || !paste) throw new Error('createAskAnswerService: asks e paste richiesti');
+  const emitClosure = typeof onClosure === 'function' ? onClosure : () => {};
+
+  function pasteText(askId, text, label) {
+    return `[${label} reply · ask#${askId}] ${text}`;
+  }
+
+  // The shared core. Returns {ok:true} or {ok:false, code, error, reason}.
+  async function runAnswer({ askId, text, request = null }) {
+    // A locked ask refuses new pastes on every path until reconciliation.
+    if (receipts && receipts.isBlocked(askId)) {
+      return { ok: false, code: 409, error: 'ask con esito incerto: richiede riconciliazione dell\'operatore', reason: 'delivery-unknown-block' };
+    }
+    // The receipt is authoritative AT THE POINT OF PASTE: an ask whose durable
+    // answer state is already terminal cannot produce a second paste, whichever
+    // path got here — the ask store alone is not enough, because a reconciliation
+    // can land on the receipt without closing the ask.
+    const answerState = receipts && typeof receipts.answerStateFor === 'function'
+      ? receipts.answerStateFor(askId) : null;
+    if (answerState === 'committed' || answerState === 'delivered') {
+      return { ok: false, code: 409, error: 'ask gia\' consegnato: nessun nuovo paste', reason: 'already-delivered' };
+    }
+    const claim = asks.claim(askId);
+    if (!claim.ok) {
+      // Refused BEFORE any paste: the attempt is closed here. Left `pending`, it
+      // would come back as delivery-unknown after a restart and block the ask
+      // for a paste that never happened.
+      if (request && receipts) receipts.finalize(request.peerId, askId, request.requestId, 'failed', `refused:${claim.reason}`);
+      if (claim.reason === 'unknown') return { ok: false, code: 404, error: 'ask inesistente', reason: 'unknown' };
+      if (claim.reason === 'dismissed') return { ok: false, code: 409, error: 'ask gia\' scartato (dismissed)', reason: 'dismissed' };
+      if (claim.reason === 'answering') return { ok: false, code: 409, error: 'risposta gia\' in corso da un\'altra richiesta', reason: 'answering' };
+      return { ok: false, code: 409, error: 'ask gia\' risposto', reason: 'answered' };
+    }
+    let pasted = false;
+    try {
+      pasted = await paste(claim.ask.session, pasteText(askId, text, labelPrefix));
+    } catch (_) { pasted = false; }
+    if (!pasted) {
+      asks.release(askId); // rollback: the ask stays open and contestable
+      if (request && receipts) receipts.finalize(request.peerId, askId, request.requestId, 'failed', 'paste-failed');
+      return { ok: false, code: 502, error: `paste fallito: sessione "${claim.ask.session}" non raggiungibile`, reason: 'paste-failed' };
+    }
+    const committed = asks.commit(askId, text);
+    if (request && receipts) receipts.finalize(request.peerId, askId, request.requestId, 'committed', null);
+    const finalAsk = asks.get(askId);
+    emitClosure('ask-answered', { askId, revision: (finalAsk && finalAsk.revision) || 1, cellSession: finalAsk && finalAsk.session });
+    return { ok: true, committed };
+  }
+
+  // LOCAL answer: validation and binding already happened in the route.
+  async function answerLocal({ askId, text }) {
+    return runAnswer({ askId, text });
+  }
+
+  // FEDERATED answer: the receipt lifecycle wraps the same core.
+  async function answerFederated({ askId, text, peerId, requestId }) {
+    if (!requestId || !REQUEST_ID_RE.test(String(requestId))) {
+      return { ok: false, code: 400, error: 'requestId non valido', reason: 'bad-request-id' };
+    }
+    if (!receipts) return { ok: false, code: 503, error: 'receipt store non disponibile', reason: 'no-receipts' };
+    const existing = receipts.get(peerId, askId, requestId);
+    const digest = receipts.digestOf(text);
+    if (existing) {
+      // Same id, same text: the stored state, never a second paste.
+      if (existing.digest === digest) {
+        return { ok: true, replay: true, state: existing.state };
+      }
+      // Same id, different text: never answer twice with diverging payloads.
+      return { ok: false, code: 409, error: 'stesso requestId con testo diverso', reason: 'request-conflict' };
+    }
+    // Receipt BEFORE the paste: a failed receipt write means no paste at all.
+    const receipt = receipts.attempt({ peerId, askId, requestId, text });
+    if (!receipt.ok) {
+      if (receipt.reason === 'blocked') {
+        return { ok: false, code: 409, error: 'ask con esito incerto: richiede riconciliazione dell\'operatore', reason: 'delivery-unknown-block' };
+      }
+      if (receipt.reason === 'digest-conflict') {
+        return { ok: false, code: 409, error: 'stesso requestId con testo diverso', reason: 'request-conflict' };
+      }
+      return { ok: false, code: 429, error: 'receipt store al cap', reason: 'receipt-cap' };
+    }
+    const out = await runAnswer({ askId, text, request: { peerId, requestId } });
+    if (out.ok) return { ok: true, state: 'committed' };
+    // Every refusal is answered as it is: a rejection BEFORE the paste (claim
+    // lost, ask closed, locked) finalizes the attempt as failed, and a transport
+    // failure does the same — the peer re-checks the status instead of blindly
+    // retrying.
+    return out;
+  }
+
+  // Dismiss: idempotent, refused while an answer is in flight, and refused on an
+  // ask whose delivery is still unknown — dismissing the card would hide an
+  // outcome the operator still has to reconcile.
+  function dismiss(askId) {
+    if (receipts && receipts.isBlocked(askId)) {
+      return { ok: false, code: 409, error: 'ask con esito incerto: richiede riconciliazione dell\'operatore', reason: 'delivery-unknown-block' };
+    }
+    const out = asks.dismiss(askId);
+    if (!out.ok) return out;
+    emitClosure('ask-dismissed', { askId, revision: (out.ask && out.ask.revision) || 1, cellSession: out.ask && out.ask.session });
+    return out;
+  }
+
+  // Operator reconciliation of a delivery-unknown attempt. The revision is a
+  // MANDATORY compare-and-set: a reconciliation decided on a generation that is
+  // already gone must not unlock anything, and the transition itself advances
+  // the revision so the same token cannot be replayed.
+  function reconcile({ askId, decision, expectedRevision }) {
+    if (decision !== 'mark-delivered' && decision !== 'allow-new-attempt') {
+      return { ok: false, code: 400, error: 'decision deve essere mark-delivered|allow-new-attempt', reason: 'bad-decision' };
+    }
+    if (!receipts) return { ok: false, code: 503, error: 'receipt store non disponibile', reason: 'no-receipts' };
+    const ask = asks.get(askId);
+    if (!ask) return { ok: false, code: 404, error: 'ask inesistente', reason: 'unknown' };
+    if (expectedRevision === undefined || expectedRevision === null || expectedRevision === '') {
+      return { ok: false, code: 400, error: 'expectedRevision obbligatoria', reason: 'revision-required' };
+    }
+    if (Number(expectedRevision) !== (ask.revision || 0)) {
+      return { ok: false, code: 409, error: 'revision stantia', reason: 'revision-conflict' };
+    }
+    // A paste that is still in flight is not an outcome to reconcile: its claim
+    // is HERS, and deciding here would release a claim mid-paste and let a
+    // second paste through. Refused without touching the claim.
+    // The window between this check and markReconciled is SYNCHRONOUS (there is
+    // no await in between), so no new claim can appear once the refusal is not
+    // taken: that is what makes the guard sufficient, not the receipt alone.
+    const live = receipts.reconcilableFor(askId);
+    if ((typeof asks.isAnswering === 'function' && asks.isAnswering(askId)) || live.live > 0) {
+      return {
+        ok: false, code: 409, reason: 'answering',
+        error: 'paste in corso su questa ask: riconciliazione rifiutata, il claim non si tocca',
+      };
+    }
+    // Nothing unresolved: `ok:true, changed:0` would be a false success.
+    if (live.count === 0) {
+      return { ok: false, code: 409, reason: 'nothing-to-reconcile', error: 'nessun esito incerto da riconciliare' };
+    }
+    const expect = { count: live.count, generation: live.generation };
+
+    // Restrictive write FIRST, permissive one last: the ask-store transition
+    // closes the ask (mark-delivered) or just advances the revision
+    // (allow-new-attempt), while the receipt keeps blocking the paste until its
+    // own durable write lands. A partial failure therefore never leaves a state
+    // where a paste is possible: the residue is "ask closed" or "receipt still
+    // blocked", never more permissive than the decision.
+    const moved = asks.markReconciled(askId, decision);
+    if (!moved.ok) {
+      return { ok: false, code: 500, error: 'transizione non scritta: stato invariato', reason: 'ask-transition-failed' };
+    }
+    const out = receipts.reconcile(askId, decision, expect);
+    if (!out.ok) {
+      return {
+        ok: false, code: out.reason === 'nothing-to-reconcile' || out.reason === 'generation-changed' ? 409 : 500,
+        reason: out.reason,
+        error: decision === 'mark-delivered'
+          ? 'ricevuta non riconciliata: ask comunque chiuso (nessun paste possibile)'
+          : 'ricevuta non riconciliata: blocco ancora attivo (nessun paste possibile)',
+      };
+    }
+    return { ok: true, changed: out.changed, revision: (moved.ask && moved.ask.revision) || 0 };
+  }
+
+  return { answerLocal, answerFederated, dismiss, reconcile, pasteText };
+}
+
+module.exports = { createAskAnswerService, REQUEST_ID_RE };

package/lib/notify/ask-receipts.js

@@ -0,0 +1,197 @@
+'use strict';
+// lib/notify/ask-receipts.js — durable receipts for FEDERATED answer attempts.
+//
+// The receipt is the answer's paper trail: a federated attempt gets a UUID
+// (requestId), a digest of the text and a state that is WRITTEN BEFORE the
+// paste happens (a failed receipt write means no paste — the owner never fires
+// blind). Terminal states are final: replaying the same requestId with the
+// same digest returns the stored state without pasting again; the same id with
+// a different digest is a conflict. A process crash leaves `pending` behind:
+// at recovery it becomes `delivery-unknown` and BLOCKS every new paste for
+// that ask — local ones too — until the operator reconciles explicitly (
+// no silent retries, no TTL).
+//
+// Cap 1000 attempts; terminal receipts age out after 24 h; at cap, NEW
+// attempts are refused rather than evicting pending/unknown ones.
+
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { atomicWriteJson } = require('./persist.js');
+
+const SCHEMA = 'nexuscrew-ask-receipts-v1';
+const CAP_ATTEMPTS = 1000;
+const TERMINAL_RETENTION_MS = 24 * 60 * 60 * 1000;
+
+function keyOf(peerId, askId, requestId) { return `${peerId}|${askId}|${requestId}`; }
+function digestOf(text) { return crypto.createHash('sha256').update(String(text), 'utf8').digest('hex'); }
+
+function createAskReceipts({ filePath, now = Date.now } = {}) {
+  if (!filePath) throw new Error('createAskReceipts: filePath richiesta');
+
+  function loadRaw() {
+    try {
+      const parsed = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+      if (parsed && parsed.schema === SCHEMA && parsed.attempts && typeof parsed.attempts === 'object') return parsed;
+    } catch (_) { /* fresh */ }
+    return { schema: SCHEMA, attempts: {}, blockedAsks: {} };
+  }
+
+  function persist(state) {
+    const dir = path.dirname(filePath);
+    fs.mkdirSync(dir, { recursive: true });
+    const tmp = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(state), { mode: 0o600 });
+    fs.renameSync(tmp, filePath);
+  }
+
+  // Recovery at construction: a `pending` attempt did not observe its own
+  // paste, so its outcome is unknown and the ask is locked.
+  const state = loadRaw();
+  for (const entry of Object.values(state.attempts)) {
+    if (entry.state === 'pending') {
+      entry.state = 'delivery-unknown';
+      entry.updatedAt = now();
+      state.blockedAsks[entry.askId] = true;
+    }
+  }
+  // Terminal retention: old terminal receipts age out (pending/unknown NEVER).
+  const cutoff = now() - TERMINAL_RETENTION_MS;
+  for (const [key, entry] of Object.entries(state.attempts)) {
+    const terminal = entry.state === 'committed' || entry.state === 'failed';
+    if (terminal && (entry.updatedAt || 0) < cutoff) delete state.attempts[key];
+  }
+  if (Object.keys(state.attempts).length > 0) persist(state);
+
+  function isBlocked(askId) { return state.blockedAsks[askId] === true; }
+
+  function get(peerId, askId, requestId) {
+    return state.attempts[keyOf(peerId, askId, requestId)] || null;
+  }
+
+  // Create the pending receipt. Refuses when the ask is blocked, or at cap —
+  // NEVER evicts a pending/unknown attempt to make room.
+  function attempt({ peerId, askId, requestId, text }) {
+    if (isBlocked(askId)) return { ok: false, reason: 'blocked' };
+    const key = keyOf(peerId, askId, requestId);
+    const existing = state.attempts[key];
+    if (existing) {
+      if (existing.digest !== digestOf(text)) return { ok: false, reason: 'digest-conflict', entry: existing };
+      return { ok: true, replay: true, entry: existing };
+    }
+    const terminalCount = Object.values(state.attempts)
+      .filter((e) => e.state !== 'pending' && e.state !== 'delivery-unknown').length;
+    if (Object.keys(state.attempts).length >= CAP_ATTEMPTS && terminalCount === 0) {
+      return { ok: false, reason: 'cap' };
+    }
+    const entry = {
+      peerId, askId, requestId,
+      digest: digestOf(text),
+      state: 'pending',
+      createdAt: now(), updatedAt: now(),
+    };
+    state.attempts[key] = entry;
+    persist(state);
+    return { ok: true, replay: false, entry };
+  }
+
+  function finalize(peerId, askId, requestId, finalState, receipt) {
+    const entry = state.attempts[keyOf(peerId, askId, requestId)];
+    if (!entry) return false;
+    if (entry.state !== 'pending') { entry.replayedAt = now(); return true; }
+    entry.state = finalState;
+    entry.receipt = receipt === undefined ? null : receipt;
+    entry.updatedAt = now();
+    persist(state);
+    return true;
+  }
+
+  // Explicit operator reconciliation (local, authenticated, never federated):
+  // every delivery-unknown attempt of the ask gets the decided outcome and the
+  // ask is unlocked for new pastes.
+  function reconcile(askId, decision, expect = null) {
+    const finalState = decision === 'mark-delivered' ? 'committed'
+      : decision === 'allow-new-attempt' ? 'failed' : null;
+    if (!finalState) return { ok: false, reason: 'bad-decision' };
+    // The decision is bound to the GENERATION it was taken on: the exact set of
+    // unresolved outcomes that was visible when the operator decided. If that
+    // set moved (or is empty), this reconciliation is refused instead of
+    // unlocking a generation nobody decided about.
+    const current = reconcilableFor(askId);
+    if (current.count === 0) return { ok: false, reason: 'nothing-to-reconcile' };
+    if (expect && (expect.count !== current.count || expect.generation !== current.generation)) {
+      return { ok: false, reason: 'generation-changed' };
+    }
+    // The unlock is exposed ONLY after the durable write succeeded: the fields
+    // this decision touches are snapshotted first, so a failed write leaves the
+    // ask exactly as blocked as it was (no half-reconciled state in memory).
+    const touched = [];
+    let changed = 0;
+    for (const [key, entry] of Object.entries(state.attempts)) {
+      if (entry.askId === askId && entry.state === 'delivery-unknown') {
+        touched.push([key, { ...entry }]);
+        entry.state = finalState;
+        entry.receipt = 'reconciled';
+        entry.updatedAt = now();
+        changed += 1;
+      }
+    }
+    const wasBlocked = state.blockedAsks[askId] === true;
+    delete state.blockedAsks[askId];
+    try {
+      persist(state);
+    } catch (_) {
+      for (const [key, prev] of touched) state.attempts[key] = prev;
+      if (wasBlocked) state.blockedAsks[askId] = true;
+      return { ok: false, reason: 'persist-failed' };
+    }
+    return { ok: true, changed };
+  }
+
+  // The authoritative answer state of an ask, as the durable receipts know it:
+  // a terminal write (`committed` after a paste, `delivered` after an operator
+  // reconciliation) means the ask already produced its answer — whatever store
+  // the caller went through. `unknown` marks an outcome that is still unresolved.
+  function answerStateFor(askId) {
+    let unfinished = false;
+    for (const entry of Object.values(state.attempts)) {
+      if (entry.askId !== askId) continue;
+      if (entry.state === 'committed' || entry.state === 'delivered') return entry.state;
+      if (entry.state === 'pending' || entry.state === 'delivery-unknown') unfinished = true;
+    }
+    return unfinished ? 'unknown' : null;
+  }
+
+  // The outcomes an operator can reconcile right now: the delivery-unknown
+  // attempts of this ask, with a short digest of their identity set. `pending`
+  // attempts are a paste still in flight — they are NOT reconcilable and are
+  // reported separately, so nobody can decide on an outcome that is still open.
+  function reconcilableFor(askId) {
+    const ids = [];
+    let live = 0;
+    for (const entry of Object.values(state.attempts)) {
+      if (entry.askId !== askId) continue;
+      if (entry.state === 'delivery-unknown') ids.push(String(entry.requestId));
+      else if (entry.state === 'pending') live += 1;
+    }
+    ids.sort();
+    return {
+      count: ids.length,
+      live,
+      generation: crypto.createHash('sha256').update(ids.join('|'), 'utf8').digest('hex').slice(0, 16),
+    };
+  }
+
+  function statusFor(askId) {
+    const attempts = Object.values(state.attempts).filter((e) => e.askId === askId);
+    return {
+      blocked: isBlocked(askId),
+      attempts: attempts.length,
+      unknown: attempts.filter((e) => e.state === 'delivery-unknown').length,
+    };
+  }
+
+  return { attempt, get, finalize, isBlocked, reconcile, reconcilableFor, statusFor, answerStateFor, digestOf };
+}
+
+module.exports = { createAskReceipts, digestOf, keyOf, CAP_ATTEMPTS };

package/lib/notify/ask-relay.js

@@ -0,0 +1,152 @@
+'use strict';
+// lib/notify/ask-relay.js — the client-side relay for federated ask answers.
+//
+// The local endpoint receives {ownerId, askId, text, requestId} from the PWA.
+// The route to the owner is resolved from the AUTHORIZED node store (the
+// outbound peer whose nodeId is the owner) — never from anything an event
+// said. The forward uses the peer's own pair token and the visited header;
+// the hop proof is minted by the owner on the last hop.
+//
+// Outcome contract: a committed/failed answer is final. An uncertain
+// outcome (timeout, network error after the request left) is NOT retried: the
+// attempt is parked as "uncertain" and the only allowed action is "verify
+// status" (GET .../requests/:requestId). A new paste for the same ask is
+// refused locally until verification resolves the attempt.
+
+const crypto = require('node:crypto');
+const IDLE_MS = 15000;
+
+function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = () => {} } = {}) {
+  // (ownerId|askId|requestId) -> {state: 'sent'|'committed'|'failed'|'uncertain', requestId}
+  const attempts = new Map();
+
+  function requestId() { return crypto.randomUUID(); }
+
+  function resolveOwner(ownerId) {
+    const store = loadStore();
+    if (!store) return null;
+    return (store.nodes || []).find((n) => n && n.direction === 'outbound'
+      && n.nodeId === ownerId && n.token && n.localPort) || null;
+  }
+
+  function ownerUrl(peer, path) {
+    return `http://127.0.0.1:${peer.localPort}/federation/route/_/${path.replace(/^\//, '')}`;
+  }
+
+  function attemptKey(ownerId, askId, rid) { return `${ownerId}|${askId}|${rid}`; }
+
+  function statusFor(ownerId, askId) {
+    const out = [];
+    for (const [key, a] of attempts) {
+      if (key.startsWith(`${ownerId}|${askId}|`)) out.push(a);
+    }
+    return out;
+  }
+
+  function isUncertain(ownerId, askId) {
+    return statusFor(ownerId, askId).some((a) => a.state === 'uncertain');
+  }
+
+  async function relayAnswer({ ownerId, askId, text, rid: providedRid } = {}) {
+    if (!ownerId || !askId || typeof text !== 'string' || !text.trim()) {
+      return { ok: false, code: 400, error: 'ownerId, askId e text richiesti' };
+    }
+    const peer = resolveOwner(ownerId);
+    if (!peer) return { ok: false, code: 404, error: 'owner non tra i peer autorizzati', reason: 'owner-unknown' };
+    // Local reconciliation FIRST: an uncertain attempt on this ask must be
+    // verified before any new paste leaves this node.
+    if (isUncertain(ownerId, askId)) {
+      return { ok: false, code: 409, error: 'esito incerto: verifica lo stato prima di rispondere', reason: 'uncertain', uncertain: true };
+    }
+    const rid = providedRid || requestId();
+    const key = attemptKey(ownerId, askId, rid);
+    const store = loadStore();
+    attempts.set(key, { requestId: rid, state: 'sent', askId, ownerId });
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), IDLE_MS);
+    try {
+      const r = await fetchImpl(ownerUrl(peer, `/event-feed/asks/${askId}/answer`), {
+        method: 'POST',
+        headers: {
+          authorization: `Bearer ${peer.token}`,
+          'content-type': 'application/json',
+          'x-nexuscrew-visited': store.nodeId,
+        },
+        body: JSON.stringify({ text, requestId: rid }),
+        signal: ctrl.signal,
+      });
+      const body = await r.json().catch(() => ({}));
+      if (r.status === 200) {
+        const state = body.status === 'answered' ? 'committed' : body.status || 'committed';
+        attempts.get(key).state = body.replay ? (body.state || state) : state;
+        return { ok: true, status: attempts.get(key).state, requestId: rid };
+      }
+      const entry = attempts.get(key);
+      // 409 request-conflict / answering are definitive; anything else that
+      // could have pasted (timeout-ish) parks as uncertain, never retried.
+      if (r.status === 409) {
+        if (entry) entry.state = body.reason === 'delivery-unknown-block' ? 'uncertain' : 'failed';
+        return { ok: false, code: 409, error: body.error || 'conflict', reason: body.reason };
+      }
+      if (r.status === 502) {
+        if (entry) entry.state = 'uncertain';
+        return { ok: false, code: 200, uncertain: true, reason: 'delivery-unknown', requestId: rid,
+          error: 'esito incerto: verifica lo stato prima di rispondere' };
+      }
+      if (entry) entry.state = 'failed';
+      return { ok: false, code: r.status, error: body.error || `HTTP ${r.status}`, reason: body.reason };
+    } catch (_) {
+      // The request may or may not have pasted: uncertain, never retried.
+      const entry = attempts.get(key);
+      if (entry) entry.state = 'uncertain';
+      return { ok: false, code: 200, uncertain: true, reason: 'delivery-unknown', requestId: rid,
+        error: 'esito incerto: verifica lo stato prima di rispondere' };
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+
+  // Remote dismiss: same resolution rules as the answer (DELETE on the owner).
+  async function relayDismiss({ ownerId, askId } = {}) {
+    const peer = resolveOwner(ownerId);
+    if (!peer) return { ok: false, code: 404, error: 'owner non tra i peer autorizzati' };
+    const store = loadStore();
+    try {
+      const r = await fetchImpl(ownerUrl(peer, `/event-feed/asks/${askId}`), {
+        method: 'DELETE',
+        headers: { authorization: `Bearer ${peer.token}`, 'x-nexuscrew-visited': store ? store.nodeId : '' },
+      });
+      const body = await r.json().catch(() => ({}));
+      if (!r.ok) return { ok: false, code: r.status, error: body.error || `HTTP ${r.status}` };
+      return { ok: true };
+    } catch (e) { return { ok: false, error: String((e && e.message) || e) }; }
+  }
+
+  async function verifyStatus({ ownerId, askId, requestId: rid }) {
+    const peer = resolveOwner(ownerId);
+    if (!peer) return { ok: false, code: 404, error: 'owner non tra i peer autorizzati' };
+    const store = loadStore();
+    try {
+      const r = await fetchImpl(ownerUrl(peer, `/event-feed/asks/${askId}/requests/${rid}`), {
+        headers: { authorization: `Bearer ${peer.token}`, 'x-nexuscrew-visited': store ? store.nodeId : '' },
+      });
+      if (!r.ok) return { ok: false, code: r.status };
+      const body = await r.json();
+      const key = attemptKey(ownerId, askId, rid);
+      if (attempts.has(key) && (body.state === 'committed' || body.state === 'failed')) {
+        attempts.get(key).state = body.state;
+      }
+      return { ok: true, state: body.state || 'unknown' };
+    } catch (e) {
+      return { ok: false, error: String((e && e.message) || e) };
+    }
+  }
+
+  function state() {
+    return [...attempts.entries()].map(([key, a]) => ({ key, ...a }));
+  }
+
+  return { relayAnswer, relayDismiss, verifyStatus, state, isUncertain, requestId };
+}
+
+module.exports = { createAskRelay };

package/lib/notify/asks.js

@@ -1,5 +1,5 @@
 'use strict';
-// Store degli "ask" (domande cella→operatore) — MCP bridge, design §2c.
+// Store of "asks" (cell->operator questions) — MCP bridge.
 // Stato in-memory + persistenza <dir>/asks.json 0600 (sopravvive al restart:
 // un ask aperto resta risponibile). Lo store e' PURO stato: il paste tmux e la
 // notify li orchestra la route (lib/notify/routes.js), che qui fa il ciclo
@@ -86,6 +86,7 @@ function createAsksStore(opts = {}) {
       ...(v.value.options ? { options: v.value.options } : {}),
       session: String(session),
       ts: now(),
+      revision: 0,
       answered: false,
       dismissed: false,
     };
@@ -117,7 +118,7 @@ function createAsksStore(opts = {}) {
     if (!ask) return { ok: false, reason: 'unknown' };
     // Un ask dismissato non e' piu' risponibile: senza questa guardia la
     // sequenza dismiss -> claim -> commit lascia lo stato ibrido
-    // `dismissed && answered` (F-02).
+    // `dismissed && answered` state.
     if (ask.dismissed) return { ok: false, reason: 'dismissed' };
     if (ask.answered) return { ok: false, reason: 'answered' };
     if (answering.has(id)) return { ok: false, reason: 'answering' };
@@ -125,6 +126,10 @@ function createAsksStore(opts = {}) {
     return { ok: true, ask: { ...ask } };
   }
 
+  // Read-only: a claim is being held right now. Reconciliation uses this to
+  // refuse WITHOUT touching the claim of a paste that is still in flight.
+  function isAnswering(id) { return answering.has(id); }
+
   // Rollback: il paste e' fallito, l'ask torna contendibile.
   function release(id) {
     answering.delete(id);
@@ -138,6 +143,7 @@ function createAsksStore(opts = {}) {
     ask.answered = true;
     ask.answer = String(text);
     ask.answeredTs = now();
+    ask.revision = (ask.revision || 0) + 1;
     save();
     return true;
   }
@@ -154,6 +160,25 @@ function createAsksStore(opts = {}) {
     if (ask.dismissed) return { ok: true, ask: { ...ask }, idempotent: true };
     ask.dismissed = true;
     ask.dismissedTs = now();
+    ask.revision = (ask.revision || 0) + 1;
+    save();
+    return { ok: true, ask: { ...ask } };
+  }
+
+  // Operator reconciliation of a federated attempt: `mark-delivered` closes the
+  // ask (the paste happened on the peer's side, there is no local answer text),
+  // `allow-new-attempt` leaves it open. Both advance the revision, so the token
+  // the operator reconciled with can never be reused on the same generation.
+  function markReconciled(id, decision) {
+    const ask = get(id);
+    if (!ask) return { ok: false, reason: 'unknown' };
+    answering.delete(id);
+    if (decision === 'mark-delivered' && !ask.answered) {
+      ask.answered = true;
+      ask.answeredTs = now();
+      ask.answeredReconciled = true;
+    }
+    ask.revision = (ask.revision || 0) + 1;
     save();
     return { ok: true, ask: { ...ask } };
   }
@@ -165,7 +190,7 @@ function createAsksStore(opts = {}) {
     return commit(id, text);
   }
 
-  return { create, get, list, openCount, claim, release, commit, markAnswered, dismiss, validate, filePath, MAX_OPEN };
+  return { create, get, list, openCount, claim, release, commit, markAnswered, markReconciled, isAnswering, dismiss, validate, filePath, MAX_OPEN };
 }
 
 module.exports = { createAsksStore };