@mmmbuto/nexuscrew 0.9.57 → 0.9.59

package/lib/notify/event-feed-client.js

@@ -14,6 +14,7 @@
 const BACKOFF_MIN_MS = 5000;
 const BACKOFF_MAX_MS = 60000;
 const IDLE_TIMEOUT_MS = 60000;
+const ERROR_BODY_TIMEOUT_MS = 5000;
 const MAX_CONSECUTIVE_RESETS = 3;
 // `resync-exhausted` ferma il loop ma non deve parcheggiare la view
 // per sempre. Al tappo la view prende un cooldown a gradini — 30 s → 2 min →
@@ -68,6 +69,12 @@ function contentTypeOf(r) {
   }
 }
 
+function isNamedFeedReason(reason) {
+  return ['shape', 'owner-mismatch', 'snapshot-oversize', 'snapshot-element-oversize',
+    'snapshot-resync-required', 'snapshot-content-type'].includes(reason)
+    || (typeof reason === 'string' && reason.startsWith('snapshot-schema:'));
+}
+
 function createEventFeedClient(opts = {}) {
   // deps: { nodesPath, token(), eventsHub, now, fetchImpl, log }
   const fetchImpl = opts.fetchImpl || fetch;
@@ -81,14 +88,47 @@ function createEventFeedClient(opts = {}) {
     : MIN_SNAPSHOT_INTERVAL_MS;
   // ownerId -> view state {cursor, generation, asks, notifications, fleetState,
   //   stale, lastError}; generation guards against obsolete fetches.
+  const isAskDismissed = typeof opts.isAskDismissed === 'function' ? opts.isAskDismissed : () => false;
+  const visibleAsks = (ownerId, asks) => asks.filter(ask => !isAskDismissed(ownerId, ask));
   const views = new Map();
   const running = new Map(); // nodeId -> {abort}
   let stopped = false;
   let generation = 0;
 
-  function backoffMs(peer) {
-    const fails = (peer._fails || 0) + 1;
-    peer._fails = fails;
+  const retries = new Map(); // ownerId -> persistent retry state
+  const configurations = new Map();
+  function retryFor(ownerId) {
+    if (!retries.has(ownerId)) retries.set(ownerId, { fails: 0, nextRetryAt: 0, timer: null });
+    return retries.get(ownerId);
+  }
+  function clearRetry(ownerId, reset = false) {
+    const retry = retries.get(ownerId);
+    if (!retry) return;
+    if (retry.timer) clearTimeout(retry.timer);
+    retry.timer = null;
+    if (reset) { retry.fails = 0; retry.nextRetryAt = 0; }
+  }
+  function active(ownerId, slot) {
+    return !stopped && running.get(ownerId) === slot && !slot.controller.signal.aborted;
+  }
+  async function withDeadline(slot, milliseconds, operation) {
+    const controller = slot ? slot.controller : new AbortController();
+    const signal = controller.signal;
+    let rejectAbort;
+    const aborted = new Promise((_resolve, reject) => { rejectAbort = () => reject(new Error('acquisition aborted')); });
+    signal.addEventListener('abort', rejectAbort, { once: true });
+    const timer = setTimeout(() => controller.abort(), milliseconds);
+    try {
+      if (signal.aborted) throw new Error('acquisition aborted');
+      return await Promise.race([operation(signal), aborted]);
+    } finally {
+      clearTimeout(timer);
+      signal.removeEventListener('abort', rejectAbort);
+    }
+  }
+  function backoffMs(ownerId) {
+    const retry = retryFor(ownerId);
+    const fails = ++retry.fails;
     const base = Math.min(BACKOFF_MAX_MS, BACKOFF_MIN_MS * Math.pow(2, fails - 1));
     return Math.floor(base / 2 + Math.random() * (base / 2));
   }
@@ -187,7 +227,7 @@ function createEventFeedClient(opts = {}) {
     // ask: the tombstone is what keeps it from coming back.
     view.asks = Array.isArray(snap.asks)
       ? snap.asks
-        .filter((a) => a && !askIsClosed(ownerId, a.ownerAskId || a.id, snap.viewEpoch))
+        .filter((a) => a && !askIsClosed(ownerId, a.ownerAskId || a.id, snap.viewEpoch) && !isAskDismissed(ownerId, a))
         .map((a) => ({ ...a, ownerId }))
       : [];
     view.notifications = Array.isArray(snap.notifications) ? snap.notifications.map((e) => ({ ...e, ownerId })) : [];
@@ -226,15 +266,19 @@ function createEventFeedClient(opts = {}) {
         eventId: envelope.eventId, ts: Date.now(),
       });
     } else if (f.type === 'ask') {
+      const ask = { id: f.askId, question: f.question, options: f.options, session: f.session, ts: f.ts,
+        ownerAskTs: Number.isSafeInteger(f.askTs) && f.askTs > 0 ? f.askTs : null, ownerId: envelope.ownerId };
+      if (isAskDismissed(envelope.ownerId, ask)) return false;
       opts.eventsHub.broadcast({ type: 'ask', ownerId: envelope.ownerId, eventId: envelope.eventId,
-        ask: { id: f.askId, question: f.question, options: f.options, session: f.session, ownerId: envelope.ownerId } });
+        ask });
     } else if (f.type === 'ask-closed') {
+      if (typeof opts.onAskClosed === 'function') opts.onAskClosed(envelope.ownerId, f.askId, f.outcome);
       // The owner says the ask is closed: the VIEW drops it too, not only the
       // UI, or the next state read hands the card back.
       const closedView = dropAskFromView(envelope.ownerId, f.askId);
       if (f.outcome === 'dismissed') noteAskClosed(envelope.ownerId, f.askId, closedView.viewEpoch);
       opts.eventsHub.broadcast({ type: f.outcome === 'dismissed' ? 'ask-dismissed' : 'ask-answered',
-        id: f.askId, ownerId: envelope.ownerId, eventId: envelope.eventId });
+        id: f.askId, ownerAskId: f.askId, ownerId: envelope.ownerId, eventId: envelope.eventId });
     } else if (f.type === 'file-notice') {
       // Stessa forma della consegna locale (lib/files/routes.js): il nome del
       // file e' SEMPRE nel corpo, con la caption quando c'e'. Prima l'importato
@@ -296,7 +340,7 @@ function createEventFeedClient(opts = {}) {
     return Math.max(oldest + INGRESS_WINDOW_MS, t) + INGRESS_BLOCK_BACKOFF_MS;
   }
 
-  async function streamOnce(peer, ownerId, store) {
+  async function streamOnce(peer, ownerId, store, slot) {
     const view = viewFor(ownerId);
     // The deadline expired: the peer is admitted again and the block is closed
     // by the transition that reopens the stream, not by a silent timeout.
@@ -305,15 +349,16 @@ function createEventFeedClient(opts = {}) {
       view.ingressBlockReason = null;
     }
     const after = view.cursor ? `?after=${encodeURIComponent(view.cursor)}` : '';
-    const ctrl = new AbortController();
-    running.set(ownerId, { abort: () => ctrl.abort() });
-    let timer = setTimeout(() => ctrl.abort(), IDLE_TIMEOUT_MS); // 60 s without bytes
+    const ctrl = slot.controller;
     try {
-      const r = await fetchImpl(routeUrl(peer, '/event-feed', after), {
-        headers: identityHeaders(peer, store), signal: ctrl.signal,
-      });
-      if (r.status === 403 && (await r.json().catch(() => ({}))).reason === 'events-disabled') {
-        view.stale = true; return;
+      const r = await withDeadline(slot, IDLE_TIMEOUT_MS, (signal) => fetchImpl(routeUrl(peer, '/event-feed', after), {
+        headers: identityHeaders(peer, store), signal,
+      }));
+      if (!active(ownerId, slot)) return;
+      if (r.status === 403) {
+        const body = await withDeadline(slot, ERROR_BODY_TIMEOUT_MS, () => r.json().catch(() => ({})));
+        if (!active(ownerId, slot)) return;
+        if (body.reason === 'events-disabled') { view.stale = true; return; }
       }
       if (r.status === 409) { // reset-required / cursor-future: resync from a fresh snapshot
         view.cursor = null;
@@ -321,17 +366,15 @@ function createEventFeedClient(opts = {}) {
         return;
       }
       if (!r.ok) { view.stale = true; throw new Error(`event-feed HTTP ${r.status}`); }
-      peer._fails = 0;
+      if (!active(ownerId, slot)) return;
       const reader = r.body.getReader();
       const dec = new TextDecoder();
       let buffer = '';
       for (;;) {
-        const { done, value } = await reader.read();
-        if (done) break;
-        // ONE idle timer, rearmed on every chunk: a stale armed timeout must
-        // never survive next to a new one.
-        clearTimeout(timer);
-        timer = setTimeout(() => ctrl.abort(), IDLE_TIMEOUT_MS);
+        const { done, value } = await withDeadline(slot, IDLE_TIMEOUT_MS, () => reader.read());
+        if (!active(ownerId, slot)) return;
+        if (done) throw new Error('event-feed EOF');
+        // Each read owns one deadline; no previous timeout survives the chunk.
         const chunk = dec.decode(value, { stream: true });
         buffer += chunk;
         let idx;
@@ -376,35 +419,42 @@ function createEventFeedClient(opts = {}) {
           view.consecutiveResets = 0; // a usable frame: the streak is over
           view.resyncExhaustions = 0; // and a working stream: the cooldown ladder back to the first step
           view.cursor = `${epochStr}:${sStr}`;
+          clearRetry(ownerId, true);
           reemit(envelope);
         }
       }
     } finally {
-      clearTimeout(timer);
-      running.delete(ownerId);
+      // The acquisition slot owns the connection throughout its lifecycle.
+      ctrl.abort();
     }
   }
 
   // Capability BEFORE subscribing: an owner without the feed capability makes
   // the view unsupported — no fallback, no infinite backoff.
-  async function checkCapability(peer, ownerId) {
+  async function checkCapability(peer, ownerId, slot) {
     const view = viewFor(ownerId);
     if (view.capabilityChecked) return true;
     // The health endpoint of the OWNER is probed directly (same pattern as
     // the tunnel health probe): /federation/health with the peer's token.
-    const r = await fetchImpl(`http://127.0.0.1:${peer.localPort}/federation/health`, {
-      headers: { authorization: `Bearer ${peer.token}` },
+    const body = await withDeadline(slot, 5000, async (signal) => {
+      const r = await fetchImpl(`http://127.0.0.1:${peer.localPort}/federation/health`, {
+        headers: { authorization: `Bearer ${peer.token}` }, signal,
+      });
+      if (!r.ok) throw new Error(`health HTTP ${r.status}`);
+      return r.json();
     });
-    if (!r.ok) { view.stale = true; throw new Error(`health HTTP ${r.status}`); }
-    const body = await r.json();
+    if (!active(ownerId, slot)) throw new Error('obsolete acquisition');
     if (body.eventFeedV1 !== true || body.instanceId !== ownerId) {
       view.unsupported = true;
       view.lastError = 'event-feed-unsupported';
+      view.capabilityRecheckAt = now() + BACKOFF_MAX_MS;
       // One transition log, not one per tick: the poll gate keeps this
       // owner out from here on.
       log(`event-feed-client: ${ownerId.slice(0, 8)}… no feed capability, subscription refused`);
       return false;
     }
+    view.unsupported = false;
+    view.capabilityRecheckAt = null;
     view.capabilityChecked = true;
     return true;
   }
@@ -518,7 +568,7 @@ function createEventFeedClient(opts = {}) {
   //     vista resta ferma e STALE con la sua causa — ma l'elenco asks torna
   //     comunque alla porta, che è autorizzata a decidere: un campo che la
   //     chiusura non legge non può tenere aperta una card chiusa dall'owner.
-  async function snapshotOnce(peer, ownerId, store, { profile = 'view' } = {}) {
+  async function snapshotOnce(peer, ownerId, store, { profile = 'view', slot = null } = {}) {
     const view = viewFor(ownerId);
     // INVARIANTE (punto d'ingresso, per owner): al massimo uno snapshot per
     // finestra, da qualunque causa di resync. Se la finestra non è trascorsa
@@ -538,14 +588,14 @@ function createEventFeedClient(opts = {}) {
     view.lastSnapshotAt = now();
     view.nextSnapshotAllowedAt = null;
     const gen = generation;
-    const r = await fetchImpl(routeUrl(peer, '/event-feed/snapshot'), {
-      headers: identityHeaders(peer, store),
+    const { r, text } = await withDeadline(slot, 8000, async (signal) => {
+      const r = await fetchImpl(routeUrl(peer, '/event-feed/snapshot'), {
+        headers: identityHeaders(peer, store), signal,
+      });
+      if (!r.ok) throw new Error(`snapshot HTTP ${r.status}`);
+      return { r, text: await r.text() };
     });
-    if (!r.ok) { view.stale = true; throw new Error(`snapshot HTTP ${r.status}`); }
-    // Size cap BEFORE JSON.parse: a body over the server budget is refused on
-    // sight, never parsed. La regola vive nel validatore unico; qui è la
-    // scorciatoia che evita di pagare il parse di un corpo già rifiutato.
-    const text = await r.text();
+    if ((slot && !active(ownerId, slot)) || gen !== generation) throw new Error('obsolete acquisition');
     const bytes = Buffer.byteLength(text, 'utf8');
     if (bytes > 3 * 1024 * 1024) {
       view.stale = true; view.lastError = 'snapshot-oversize';
@@ -576,6 +626,7 @@ function createEventFeedClient(opts = {}) {
       return { state: 'failed' };
     }
     applySnapshot(ownerId, snap, gen);
+    clearRetry(ownerId, true);
     return { state: 'applied', asks: snap.asks, appliedToView: true };
   }
 
@@ -586,15 +637,31 @@ function createEventFeedClient(opts = {}) {
     if (!store) return;
     const peers = (store.nodes || []).filter((n) => n && n.direction === 'outbound'
       && n.eventsReceive === true && n.token && n.localPort && n.nodeId);
+    const eligible = new Map(peers.map((peer) => [peer.nodeId, peer]));
+    const fingerprint = (peer) => JSON.stringify([peer.token, peer.localPort, peer.nodeId, peer.accessGrants, peer.accessPreset]);
+    for (const [ownerId, config] of configurations) {
+      const peer = eligible.get(ownerId);
+      if (!peer || fingerprint(peer) !== config) {
+        const slot = running.get(ownerId);
+        if (slot) { running.delete(ownerId); slot.abort(); }
+        clearRetry(ownerId, true);
+        configurations.delete(ownerId);
+        const view = views.get(ownerId);
+        if (view) { view.cursor = null; view.stale = true; view.capabilityChecked = false; view.unsupported = false; }
+      }
+    }
     await Promise.all(peers.map(async (peer) => {
       const ownerId = peer.nodeId;
+      configurations.set(ownerId, fingerprint(peer));
+      if (now() < retryFor(ownerId).nextRetryAt) return;
       if (running.has(ownerId)) return; // one loop per pair
       // Il guard vale per TUTTO il round, non solo per lo stream: due poll
       // sovrapposti (tick + backoff, o macchina carica) facevano due snapshot
       // nella stessa finestra e il secondo, senza il flag di recupero,
-      // saltava il riarma del cooldown. streamOnce
-      // sovrascrive lo slot col vero handle di abort.
-      const slot = { abort: () => {} };
+      // saltava il riarma del cooldown. Lo stesso controller resta attivo
+      // dalla prima acquisizione fino alla chiusura dello stream.
+      const controller = new AbortController();
+      const slot = { controller, abort: () => controller.abort() };
       running.set(ownerId, slot);
       const view = viewFor(ownerId);
       try {
@@ -619,7 +686,11 @@ function createEventFeedClient(opts = {}) {
           recovery = true;
           log(`event-feed-client: ${ownerId.slice(0, 8)}… resync cooldown expired: one fresh snapshot attempt`);
         }
-        if (view.unsupported || (view.ingressBlockedUntil || 0) > Date.now()) return;
+        if (view.unsupported) {
+          if (now() < view.capabilityRecheckAt) return;
+          view.capabilityChecked = false;
+        }
+        if ((view.ingressBlockedUntil || 0) > Date.now()) return;
         // La fase di ACQUISIZIONE del tentativo (capability + snapshot) ha UN
         // SOLO punto di uscita per gli esiti non riusciti: throw, timeout,
         // abort e 'failed' convergono tutti lì — non un ramo per tipo di
@@ -635,15 +706,16 @@ function createEventFeedClient(opts = {}) {
         let snapState = null; // null = tentativo non fatto (cursor già valido)
         try {
           if (!view.capabilityChecked) {
-            const capOk = await checkCapability(peer, ownerId);
+            const capOk = await checkCapability(peer, ownerId, slot);
             if (!capOk) return; // senza la capability il gate blocca: nessun tentativo fatto
           }
           if (!view.cursor) {
-            snapState = await snapshotOnce(peer, ownerId, store); // profilo view
+            snapState = await snapshotOnce(peer, ownerId, store, { slot }); // profilo view
           }
         } catch (e) {
           attemptError = e;
         }
+        if (stopped || running.get(ownerId) !== slot) return;
         if (attemptError || (snapState && snapState.state === 'failed')) {
           if (recovery) armResyncCooldown(view, attemptError ? 'recovery attempt failed' : 'recovery snapshot failed');
         }
@@ -651,21 +723,27 @@ function createEventFeedClient(opts = {}) {
         // Un tentativo fallito o posticipato ferma il round; NESSUN tentativo
         // (cursor già valido) va dritto allo stream.
         if (snapState && snapState.state !== 'applied') return;
-        await streamOnce(peer, ownerId, store);
+        await streamOnce(peer, ownerId, store, slot);
       } catch (e) {
+        if (stopped || running.get(ownerId) !== slot) return;
+        view.cursor = null;
         view.stale = true;
         // A named feed reason (e.g. owner-mismatch) survives a later transport
         // error: it is the reason the operator needs to see.
-        if (view.lastError !== 'owner-mismatch') {
+        if (!isNamedFeedReason(view.lastError)) {
           view.lastError = String((e && e.message) || e);
         }
-        const delay = backoffMs(peer);
+        const delay = backoffMs(ownerId);
+        const retry = retryFor(ownerId);
+        clearRetry(ownerId);
+        retry.nextRetryAt = now() + delay;
         log(`event-feed-client: ${ownerId.slice(0, 8)}… retry in ${delay} ms (${view.lastError})`);
-        setTimeout(() => { void poll(); }, delay);
+        retry.timer = setTimeout(() => { retry.timer = null; void poll(); }, delay);
+        if (typeof retry.timer.unref === 'function') retry.timer.unref();
       } finally {
-        // Libera lo slot solo se è ancora il NOSTRO: se il round è arrivato a
-        // streamOnce, quello ha già messo (e alla fine tolto) il suo slot vero.
+        // Un round obsoleto non libera mai lo slot della nuova generazione.
         if (running.get(ownerId) === slot) running.delete(ownerId);
+        slot.abort();
       }
     }));
   }
@@ -685,7 +763,9 @@ function createEventFeedClient(opts = {}) {
   function stop() {
     stopped = true; generation += 1;
     if (pollTimer) { clearInterval(pollTimer); pollTimer = null; }
+    for (const ownerId of retries.keys()) clearRetry(ownerId, true);
     for (const [, h] of running) { try { h.abort(); } catch (_) {} }
+    running.clear();
   }
 
   // Local aggregated read: connected views only, with the watermark the UI
@@ -706,7 +786,7 @@ function createEventFeedClient(opts = {}) {
         lastError: v.lastError || null,
         ingressBlockedUntil: v.ingressBlockedUntil || null,
         ingressBlockReason: v.ingressBlockReason || null,
-        asks: v.asks, notifications: v.notifications, fleetState: v.fleetState,
+        asks: visibleAsks(ownerId, v.asks), notifications: v.notifications, fleetState: v.fleetState,
       })),
     };
   }

package/lib/notify/event-feed-producers.js

@@ -74,6 +74,7 @@ const PRODUCERS = {
       question: cleanStr(p.question, 3900) || '',
       ...(Array.isArray(p.options) ? { options: p.options.slice(0, 8).map((o) => cleanStr(o, 200) || '') } : {}),
       session: cleanStr(p.session, 128) || undefined,
+      ...(Number.isSafeInteger(p.askTs) && p.askTs > 0 ? { askTs: p.askTs } : {}),
       ts: typeof p.ts === 'number' ? p.ts : undefined,
     }),
   },

package/lib/notify/imported-dismissals.js

@@ -0,0 +1,106 @@
+'use strict';
+// Durable receiver-to-owner synchronization. No attempt may submit an answer.
+function createImportedDismissalDrainer({ store, relay, now = Date.now, random = Math.random,
+  setTimer = setTimeout, clearTimer = clearTimeout, intervalMs = 15000,
+  globalBudget = 4, ownerBudget = 1, budgetWindowMs = 60000, bindingForOwner = () => null, readonly = () => false, log = () => {} } = {}) {
+  const flights = new Set();
+  const globalHits = [];
+  const ownerHits = new Map();
+  let stopped = false;
+  let timer = null;
+  let running = null;
+  function defer(record, reason, blocked = false, retryAfterMs = 0) {
+    const attempts = (record.attempts || 0) + 1;
+    const delay = Math.max(retryAfterMs, Math.min(300000, 1000 * 2 ** Math.min(attempts, 9)) * (0.5 + random() * 0.5));
+    return store.updateImportedDismissal(record.ownerId, record.ownerAskId, {
+      syncState: blocked ? 'blocked' : 'pending', retryBinding: bindingForOwner(record.ownerId), attempts, lastReason: reason || 'owner-unreachable', nextRetryAt: now() + delay,
+    });
+  }
+  function rejected(record, result = {}) {
+    const reason = result.reason || 'owner-unreachable';
+    const transient = ['answering', 'delivery-unknown-block', 'reverse-slot-unverified', 'relay-deadline', 'owner-unreachable', 'federation-peer-unreachable'];
+    const pending = transient.includes(reason) || result.code === 429 || result.code >= 500;
+    return defer(record, reason, !pending, result.retryAfterMs || 0);
+  }
+  function confirmed(record, outcome) {
+    return store.updateImportedDismissal(record.ownerId, record.ownerAskId, {
+      syncState: outcome === 'answered' ? 'confirmed-answered' : 'confirmed-dismissed', ownerOutcome: outcome, lastReason: null,
+    });
+  }
+  async function attempt(record) {
+    const key = `${record.ownerId}|${record.ownerAskId}`;
+    if (flights.has(key) || stopped || readonly()) return;
+    flights.add(key);
+    try {
+      let current = store.getImportedDismissal(record.ownerId, record.ownerAskId);
+      if (!current || current.syncState !== 'pending') return;
+      const result = await relay.inspectDismissal({ ownerId: record.ownerId, askId: record.ownerAskId });
+      if (stopped || readonly()) return;
+      current = store.getImportedDismissal(record.ownerId, record.ownerAskId);
+      if (!current || current.syncState !== 'pending' || current.dismissedTs !== record.dismissedTs) return;
+      if (!result.ok) { rejected(current, result); return; }
+      if (result.generationPrecondition !== true) { defer(current, 'unsupported', true); return; }
+      if (!result.ask || (result.ask.ownerAskId || result.ask.id) !== current.ownerAskId
+        || store.askFingerprint(result.ask) !== current.ownerAskFingerprint
+        || !Number.isSafeInteger(result.ask.ts) || result.ask.ts <= 0
+        || (current.generation === 'known' && current.ownerAskTs !== result.ask.ts)) {
+        defer(current, 'generation-mismatch', true); return;
+      }
+      const adopted = store.adoptImportedDismissal(current.ownerId, current.ownerAskId, result.ask);
+      if (!adopted.ok) { log(`dismissal adoption refused: ${adopted.reason}`); return; }
+      current = adopted.record;
+      if (['answered', 'dismissed'].includes(result.status)) { confirmed(current, result.status); return; }
+      if (result.status !== 'open') { rejected(current, { code: 409, reason: result.status || 'unknown' }); return; }
+      // The timestamp is durable before the request and checked atomically by
+      // the owner. A lost response leaves the record pending for reconciliation.
+      const out = await relay.relayDismiss({ ownerId: current.ownerId, askId: current.ownerAskId, expectedTs: current.ownerAskTs });
+      if (stopped || readonly()) return;
+      const latest = store.getImportedDismissal(current.ownerId, current.ownerAskId);
+      if (!latest || latest.syncState !== 'pending' || latest.dismissedTs !== current.dismissedTs) return;
+      if (out.ok && ['answered', 'dismissed'].includes(out.outcome)) confirmed(latest, out.outcome);
+      else rejected(latest, out.ok ? { code: 409, reason: 'unsupported' } : out);
+    } catch (error) {
+      const current = store.getImportedDismissal(record.ownerId, record.ownerAskId);
+      if (!stopped && current && current.syncState === 'pending') defer(current, 'owner-unreachable');
+      log(`dismissal synchronization failed: ${String(error.message || error)}`);
+    } finally { flights.delete(key); }
+  }
+  async function run() {
+    if (stopped || readonly()) return;
+    const t = now();
+    const prune = hits => { while (hits.length && hits[0] <= t - budgetWindowMs) hits.shift(); };
+    prune(globalHits);
+    for (const [ownerId, hits] of ownerHits) { prune(hits); if (!hits.length) ownerHits.delete(ownerId); }
+    for (let record of store.listImportedDismissals()) {
+      if (globalHits.length >= globalBudget) break;
+      if (record.syncState === 'blocked' && record.lastReason !== 'generation-mismatch') {
+        const binding = bindingForOwner(record.ownerId);
+        if (binding !== null && binding !== record.retryBinding) {
+          const resumed = store.updateImportedDismissal(record.ownerId, record.ownerAskId, { syncState: 'pending', nextRetryAt: 0, retryBinding: binding });
+          if (resumed.ok) record = resumed.record;
+        }
+      }
+      if (record.syncState !== 'pending' || (record.nextRetryAt || 0) > now()) continue;
+      const hits = ownerHits.get(record.ownerId) || [];
+      if (hits.length >= ownerBudget) continue;
+      hits.push(t); ownerHits.set(record.ownerId, hits); globalHits.push(t);
+      await attempt(record);
+    }
+  }
+  function drain() {
+    if (running) return running;
+    const flight = run().finally(() => { if (running === flight) running = null; });
+    running = flight;
+    return flight;
+  }
+  function schedule() {
+    if (stopped || timer) return;
+    timer = setTimer(() => { timer = null; void drain().catch(error => log(String(error.message || error))).finally(schedule); }, intervalMs);
+    if (timer && typeof timer.unref === 'function') timer.unref();
+  }
+  function start() { schedule(); void drain().catch(error => log(String(error.message || error))); }
+  function stop() { stopped = true; if (timer) clearTimer(timer); timer = null; }
+  function nudge() { if (!stopped) void drain().catch(error => log(String(error.message || error))); }
+  return { start, stop, drain, nudge };
+}
+module.exports = { createImportedDismissalDrainer };

package/lib/notify/routes.js

@@ -18,6 +18,7 @@
 // Il paste della risposta riusa ESATTAMENTE pasteToSession (bracketed literal,
 // niente Invio, control char rifiutati): qui si sanifica il testo PRIMA.
 const express = require('express');
+const accessPresets = require('../nodes/access-presets.js');
 const { createAskAnswerService } = require('./ask-answer-service.js');
 // Gli insiemi degli esiti vivono nella coda: il fan-out decide COSA accodare con
 // la stessa definizione con cui la coda decide cosa ritentare. Due copie della
@@ -43,7 +44,7 @@ const ASK_KEYS = new Set(['question', 'options', 'session', 'target']);
 // del nodo di origine, non un chiamante locale (stessa regola di FEDERATED_KEYS).
 // `ownerNode`/`originNode` qualificano l'identita', `askId` e' l'id con cui
 // l'owner conosce la domanda (serve alla risposta per tornare sul bersaglio).
-const FEDERATED_ASK_KEYS = new Set(['askId', 'ownerNode', 'originNode', 'originCell', 'closeOutcome']);
+const FEDERATED_ASK_KEYS = new Set(['askId', 'ownerNode', 'originNode', 'originCell', 'closeOutcome', 'ownerAskTs']);
 const RATE_MAX = 6;
 const RATE_WINDOW_MS = 60 * 1000;
 const RATE_MAX_BUCKETS = 64;
@@ -116,23 +117,33 @@ function replyLabel(cfg) {
 // peer autorizzati di questo nodo. L'enumerazione sta qui e non nel dispatcher
 // perche' il dispatcher conosce solo il target esatto: una wildcard implicita
 // sarebbe un modo per parlare a chi non si e' scelto.
-async function resolveFanTargets(peerTargets, target, self) {
-  if (target !== undefined) return target === self ? [] : [String(target)];
-  if (!peerTargets) return [];
+async function resolveQualifiedFanTargets(peerTargets, target, self, log = () => {}) {
+  if (target === self) return { targets: [], known: true };
+  if (!peerTargets) return { targets: [], known: false };
   let list;
-  try { list = await peerTargets(); } catch (_) { return []; }
-  if (!Array.isArray(list)) return [];
+  try { list = await peerTargets(); } catch (_) { return { targets: [], known: false }; }
+  if (!Array.isArray(list)) return { targets: [], known: false };
   const seen = new Set();
   const out = [];
+  let skipped = 0;
   for (const raw of list) {
     const id = raw && typeof raw === 'object' ? (raw.nodeId || raw.instanceId) : raw;
     const clean = String(id || '');
-    if (!TARGET_RE.test(clean)) continue;
-    if (self && clean === self) continue;
-    if (seen.has(clean)) continue;
-    seen.add(clean); out.push(clean);
+    if (!TARGET_RE.test(clean) || (self && clean === self) || seen.has(clean)) continue;
+    if (target !== undefined && clean !== String(target)) continue;
+    seen.add(clean);
+    // A routed destination is qualified by this node's own direct first hop.
+    const view = accessPresets.grantsOf(raw && typeof raw === 'object' ? (raw.firstHop || raw) : null);
+    if (!view.configured || view.label !== 'admin') { skipped++; continue; }
+    out.push(clean);
   }
-  return out;
+  if (target !== undefined && !seen.has(String(target))) skipped++;
+  if (skipped) { try { log(`ask fan-out skipped: not admin (${skipped})`); } catch (_) {} }
+  return { targets: out, known: true };
+}
+
+async function resolveFanTargets(peerTargets, target, self, log = () => {}) {
+  return (await resolveQualifiedFanTargets(peerTargets, target, self, log)).targets;
 }
 
 // La CHIUSURA di un ask segue la stessa strada dell'andata: chi ha ricevuto la
@@ -154,10 +165,13 @@ function createClosureFanout({
     const self = localNodeId();
     // `targets` esplicito = ritentativo: si va SOLO verso i pendenti, non di
     // nuovo verso tutti. Senza, si enumerano i peer autorizzati come sempre.
-    const targets2 = Array.isArray(targets) && targets.length
-      ? targets
-      : await resolveFanTargets(peerTargets, undefined, self);
-    const out = [];
+    const inventory = await resolveQualifiedFanTargets(peerTargets, undefined, self, log);
+    const eligible = inventory.targets;
+    const allowed = new Set(eligible);
+    const targets2 = Array.isArray(targets) && targets.length ? targets.filter(target => allowed.has(target)) : eligible;
+    const out = Array.isArray(targets) ? targets.filter(target => !allowed.has(target))
+      .map(target => ({ target, status: inventory.known ? 'refused' : 'unknown',
+        reason: inventory.known ? 'ask-target-not-admin' : 'ask-targets-unavailable' })) : [];
     for (const target of targets2) {
       try {
         const r = await dispatcher.dispatch({
@@ -191,7 +205,7 @@ function createClosureFanout({
 }
 
 function notifyRoutes({
-  cfg, notifier, push, asks, paste, sessionExists,
+  cfg, notifier, push, asks, submit, sessionExists,
   fleetP = null, instanceId = null, identityMode = 'legacy',
   // Federazione delle notifiche. Assenti (test unitari, montaggi parziali) la
   // route resta esattamente quella locale di prima: nessun percorso nuovo si
@@ -215,7 +229,8 @@ function notifyRoutes({
   // not inject one: the local route and the federated surface must never drift
   // into two different implementations.
   const askService = answerService || createAskAnswerService({
-    asks, paste,
+    asks,
+    submit, receipts,
     labelPrefix: replyLabel(cfg),
     onClosure: (kind, info) => { try { notifier.emitRaw({ type: kind, id: info.askId }); } catch (_) {} },
   });
@@ -384,7 +399,7 @@ function notifyRoutes({
   // perche' il dispatcher non conosce i broadcast: target esatto soltanto, e
   // deve restare cosi' (una wildcard implicita e' un modo per parlare a chi non
   // si e' scelto).
-  const askFanTargets = (target, self) => resolveFanTargets(peerTargets, target, self);
+  const askFanTargets = (target, self) => resolveFanTargets(peerTargets, target, self, log);
   const closureFanout = closureFanoutDep || createClosureFanout({ dispatcher, peerTargets, localNodeId, log, retry: closureRetry });
 
   // da revisione: gated READONLY (mutGate) — crea stato durevole (asks.json) e domande
@@ -466,12 +481,13 @@ function notifyRoutes({
             return res.status(503).json({ status: 'unavailable', reason });
           }
           if (closed.changed && closed.ask) {
-            // Il frame porta l'id LOCALE: e' quello con cui questa UI identifica
-            // la card, e senza di esso la card resterebbe a schermo.
+            // Preserve the local alias id for older clients and the canonical
+            // owner ask id for clients that merge aliases with feed cards.
             notifier.deliverOnlyRaw({
               type: b.closeOutcome === 'dismissed' ? 'ask-dismissed' : 'ask-answered',
               id: closed.ask.id,
               ownerId: owner,
+              ownerAskId: closed.ask.ownerAskId,
             });
           }
           return res.json({ status: 'delivered', closed: closed.changed });
@@ -491,12 +507,14 @@ function notifyRoutes({
           // L'id con cui l'OWNER conosce la domanda: e' quello che la risposta
           // deve citare. Il nostro `id` locale resta nostro.
           ownerAskId: b.askId,
+          ownerAskTs: b.ownerAskTs,
           originNode: owner,
           originCell: resolved.origin.cell,
         });
         if (!out.ok) {
           return res.status(out.reason === 'cap' ? 429 : 400).json({ status: 'refused', reason: out.reason, error: out.error });
         }
+        if (out.suppressed) return res.json({ status: 'delivered', suppressed: true, ownerId: owner });
         const ask = out.ask;
         // deliverOnly: consegna locale alla UI, NIENTE pubblicazione sul feed e
         // niente ri-esportazione. E' l'invariante che uccide il loop A->B->A per
@@ -550,6 +568,7 @@ function notifyRoutes({
               ...(ask.options ? { options: ask.options } : {}),
               session: ask.session,
               askId: ask.id,
+              ownerAskTs: ask.ts,
               ownerNode: self,
             },
           });