@mmmbuto/nexuscrew 0.9.57 → 0.9.59

package/lib/proxy/federation.js

@@ -1,11 +1,13 @@
 'use strict';
 
+const { createAskSlotVerifier, askSlotVerifier, binding: askSlotBinding } = require('../nodes/ask-slot-verifier.js');
 const http = require('node:http');
 const net = require('node:net');
 const crypto = require('node:crypto');
 const express = require('express');
 const { WebSocketServer } = require('ws');
 const store = require('../nodes/store.js');
+const accessPresets = require('../nodes/access-presets.js');
 const topologyCache = require('../nodes/topology-cache.js');
 const { allowedByClass, classifyResource } = require('./resource-acl.js');
 const reverseRotation = require('../nodes/reverse-rotation.js');
@@ -223,7 +225,7 @@ function knownResource(resource) {
     || resource === '/event-feed'
     || resource === '/event-feed/snapshot'
     // Federated ask write-back: answer, dismiss, attempt status.
-    || /^\/event-feed\/asks\/[a-f0-9]{8}(?:\/answer|\/requests\/[0-9a-f-]{16,64})?$/.test(resource)
+    || /^\/event-feed\/asks\/[a-f0-9]{8}(?:\/answer|\/capability|\/requests\/[0-9a-f-]{16,64})?$/.test(resource)
     || /^\/event-feed\/[A-Za-z0-9._-]{1,32}$/.test(resource)
     || /^\/event-feed\/node\/[a-f0-9]{32}$/.test(resource)
     || isPanelResource(resource)
@@ -330,6 +332,7 @@ function allowedResource(resource, method = 'GET') {
   if (/^\/event-feed\/[A-Za-z0-9._-]{1,32}$/.test(resource)) return method === 'GET';
   if (/^\/event-feed\/node\/[a-f0-9]{32}$/.test(resource)) return method === 'GET';
   if (/^\/event-feed\/asks\/[a-f0-9]{8}\/answer$/.test(resource)) return method === 'POST';
+  if (/^\/event-feed\/asks\/[a-f0-9]{8}\/capability$/.test(resource)) return method === 'GET';
   if (/^\/event-feed\/asks\/[a-f0-9]{8}$/.test(resource)) return method === 'DELETE';
   if (/^\/event-feed\/asks\/[a-f0-9]{8}\/requests\/[0-9a-f-]{16,64}$/.test(resource)) return method === 'GET';
   if (resource === '/asks') return method === 'POST';
@@ -477,19 +480,23 @@ function liveHostLedgerCapture({ ledger, ownerId, resource }) {
 const SSE_IDLE_TIMEOUT_MS = 90000;
 const SSE_CONTENT_TYPE_RE = /^text\/event-stream/i;
 
-function proxyHttp(req, res, { port, path, credential, visited = null, hopProof = null, setCookiePrefix = null, panelCookie = null, capture = null, getTimeoutMs = 10000, sseIdleMs = SSE_IDLE_TIMEOUT_MS }) {
+function proxyHttp(req, res, { port, path, credential, visited = null, hopProof = null, setCookiePrefix = null, panelCookie = null, capture = null, getTimeoutMs = 10000, sseIdleMs = SSE_IDLE_TIMEOUT_MS, onForwardFailure = null, abortWithClient = false }) {
   // A body a local middleware has already read is no longer in the stream: the
   // headers would announce bytes that nothing sends, and the peer would wait for
   // a body that never arrives. Say it at once, with a name, instead of letting
   // the forward sit until the upstream timeout expires.
   if (Number(req.headers['content-length'] || 0) > 0 && req.readableEnded) {
+    if (onForwardFailure) onForwardFailure();
     return res.status(502).json({ error: 'request body already read by a local middleware', reason: 'federation-body-consumed' });
   }
+  const failed = () => { if (onForwardFailure) onForwardFailure(); };
   let streamWatchdog = null;
   const clearStreamWatchdog = () => {
     if (streamWatchdog) { clearTimeout(streamWatchdog); streamWatchdog = null; }
   };
   const up = http.request({ host: '127.0.0.1', port, method: req.method, path, headers: cleanHeaders(req.headers, credential, visited, hopProof, panelCookie) }, (r) => {
+    if (r.statusCode < 200 || r.statusCode >= 300) failed();
+    r.once('aborted', failed); r.once('error', failed);
     const headers = setCookiePrefix ? rewriteSetCookiePath(r.headers, setCookiePrefix) : r.headers;
     if (!capture) {
       res.writeHead(r.statusCode, sanitizeResponseHeaders(headers));
@@ -534,8 +541,13 @@ function proxyHttp(req, res, { port, path, credential, visited = null, hopProof
   // quando il tunnel del peer è «su a metà» (socket aperto, nessuna risposta):
   // 10 s e 504 — prima era un unico 30 s che chiudeva con 502. Gli altri
   // metodi mantengono il tetto largo di prima.
+  if (abortWithClient) {
+    req.once('aborted', () => { failed(); up.destroy(); });
+    res.once('close', () => { if (!res.writableFinished) { failed(); up.destroy(); } });
+  }
   const FORWARD_TIMEOUT_MS = req.method === 'GET' ? getTimeoutMs : 30000;
   up.setTimeout(FORWARD_TIMEOUT_MS, () => {
+    failed();
     if (!res.headersSent) {
       res.status(504).json({ error: 'peer non risponde entro il timeout', reason: 'federation-peer-timeout' });
       up.destroy();
@@ -545,6 +557,7 @@ function proxyHttp(req, res, { port, path, credential, visited = null, hopProof
   });
   up.on('close', clearStreamWatchdog);
   up.on('error', () => {
+    failed();
     clearStreamWatchdog();
     if (!res.headersSent) res.status(502).json({ error: 'peer non raggiungibile', reason: 'federation-peer-unreachable' });
     else res.destroy();
@@ -552,9 +565,20 @@ function proxyHttp(req, res, { port, path, credential, visited = null, hopProof
   req.pipe(up);
 }
 
-function routeHandler({ nodesPath, localPort, localCredential, ingress = null, readonly = () => false, hopSecret = null, liveHostLedger = null, forwardGetTimeoutMs = 10000, forwardSseIdleMs = SSE_IDLE_TIMEOUT_MS }) {
-  return (req, res) => {
+function routeHandler({ nodesPath, localPort, localCredential, ingress = null, readonly = () => false, hopSecret = null, liveHostLedger = null, forwardGetTimeoutMs = 10000, forwardSseIdleMs = SSE_IDLE_TIMEOUT_MS, askProofNow = null, slotVerifier = null }) {
+  const verifier = slotVerifier || (askProofNow ? createAskSlotVerifier({ now: askProofNow }) : askSlotVerifier);
+  return async (req, res) => {
     const parsed = parseRoute(req.url);
+    const rejectAskRequest = (status, body) => {
+      if (parsed && classifyResource(parsed.resource, req.method) === 'ask-action') {
+        const current = store.loadStore(nodesPath);
+        verifier.sync(current, nodesPath);
+        const peer = current && store.getNode(current, parsed.route[0]);
+        const selected = askSlotBinding(current, peer);
+        verifier.invalidate(selected && selected.key);
+      }
+      return res.status(status).json(body);
+    };
     // Prima dell'allowlist: un peer senza permesso non deve nemmeno sapere se la
     // risorsa esiste per una cella o per un'altra.
     if (parsed && isPanelResource(parsed.resource) && !panelAllowedFor(ingress)) {
@@ -571,7 +595,7 @@ function routeHandler({ nodesPath, localPort, localCredential, ingress = null, r
     if (parsed && allowedResource(parsed.resource, req.method)) {
       const gate = classGateCheck(parsed.resource, req.method, ingress);
       if (!gate.ok) {
-        return res.status(gate.status).json({
+        return rejectAskRequest(gate.status, {
           error: gate.status === 404 ? 'not found' : 'risorsa non concessa a questo nodo',
           reason: gate.reason,
         });
@@ -579,9 +603,11 @@ function routeHandler({ nodesPath, localPort, localCredential, ingress = null, r
     }
     if (!parsed || !allowedResource(parsed.resource, req.method)
       || !allowedQuery(parsed.resource, req.method, req.url)) return res.status(404).json({ error: 'not found' });
-    if (readonly() && readonlyBlocksFederated(parsed.resource, req.method)) return res.status(403).json({ error: 'READONLY: federated mutation blocked' });
+    if (readonly() && readonlyBlocksFederated(parsed.resource, req.method)) return rejectAskRequest(403, { error: 'READONLY: federated mutation blocked' });
     const st = store.loadStore(nodesPath);
     if (!st) return res.status(503).json({ error: 'node store unavailable' });
+    const isAskAction = classifyResource(parsed.resource, req.method) === 'ask-action';
+    if (isAskAction) verifier.sync(st, nodesPath);
     const visited = controlledVisited(req, ingress, st.nodeId);
     if (!visited) return res.status(409).json({ error: 'federation cycle rejected' });
     // Vale per l'ultimo hop come per il transito: se si fermasse al primo, una
@@ -602,11 +628,18 @@ function routeHandler({ nodesPath, localPort, localCredential, ingress = null, r
         panelCookie,
         getTimeoutMs: forwardGetTimeoutMs,
         sseIdleMs: forwardSseIdleMs,
+        abortWithClient: isAskAction,
       });
     }
     const next = st && store.getNode(st, parsed.route[0]);
     const privateInbound = next && next.direction === 'inbound' && next.shared !== true;
-    if (!next || !next.token || privateInbound || (ingress && !canTransit(ingress, next))) return res.status(403).json({ error: 'route non consentita' });
+    if (!next || !next.token || privateInbound || (ingress && !canTransit(ingress, next))) return rejectAskRequest(403, { error: 'route non consentita' });
+    if (parsed.resource === '/asks' && req.method === 'POST') {
+      const view = accessPresets.grantsOf(next);
+      if (!view.configured || view.label !== 'admin') {
+        return res.status(403).json({ error: 'ASK target is not an admin peer', reason: 'ask-target-not-admin' });
+      }
+    }
     const rest = parsed.route.slice(1);
     const path = `/federation/route/${rest.length ? `${rest.join('/')}/` : ''}${ROUTE_DELIMITER}${parsed.resource}${queryOf(req.url)}`;
     // Verso il browser di questo nodo (ingress nullo) il cookie di visione del
@@ -622,7 +655,68 @@ function routeHandler({ nodesPath, localPort, localCredential, ingress = null, r
     const capture = liveHostLedger && (parsed.resource === '/live-host/designate' || parsed.resource === '/live-host/clear')
       ? liveHostLedgerCapture({ ledger: liveHostLedger, ownerId: next.nodeId, resource: parsed.resource })
       : null;
-    proxyHttp(req, res, { port: next.localPort, path, credential: next.token, visited, setCookiePrefix, panelCookie, capture, getTimeoutMs: forwardGetTimeoutMs, sseIdleMs: forwardSseIdleMs });
+    let forwardPort = next.localPort;
+    let proofKey = null;
+    if (next.direction === 'inbound' && classifyResource(parsed.resource, req.method) === 'ask-action') {
+      const rejectForward = (status, body) => { verifier.invalidate(proofKey); return res.status(status).json(body); };
+      const unverified = () => rejectForward(404, { error: 'not found', reason: 'reverse-slot-unverified' });
+      const channel = (peer) => {
+        const pool = peer && peer.reversePool;
+        const slot = pool && Array.isArray(pool.slots) && pool.slots[pool.activeSlot];
+        if (!slot || slot.state !== 'active' || !Number.isInteger(slot.port) || slot.port < 1 || slot.port > 65535
+          || !Number.isSafeInteger(pool.activeGeneration) || pool.activeGeneration < 1
+          || slot.generation !== pool.activeGeneration || !peer.token || !peer.nodeId) return null;
+        return { token: peer.token, nodeId: peer.nodeId, localPort: peer.localPort,
+          activeSlot: pool.activeSlot, port: slot.port, generation: pool.activeGeneration };
+      };
+      const selected = channel(next);
+      if (!selected) return unverified();
+      let disconnected = req.aborted || res.destroyed;
+      const controller = new AbortController();
+      const onDisconnect = () => { disconnected = true; controller.abort(); };
+      req.once('aborted', onDisconnect);
+      res.once('close', onDisconnect);
+      let proof;
+      try {
+        proof = await verifier.verify({ store: st, peer: next, loadStore: () => store.loadStore(nodesPath),
+          scope: nodesPath, signal: controller.signal });
+      } catch (_) { proof = null; }
+      finally {
+        req.removeListener('aborted', onDisconnect);
+        res.removeListener('close', onDisconnect);
+      }
+      proofKey = proof && proof.key;
+      if (disconnected || req.aborted || res.destroyed) { verifier.invalidate(proofKey); return; }
+      if (!proof || !proof.owned) return unverified();
+
+      const current = store.loadStore(nodesPath);
+      const currentNext = current && store.getNode(current, parsed.route[0]);
+      if (!current || current.nodeId !== st.nodeId || !currentNext || currentNext.direction !== 'inbound'
+        || JSON.stringify(channel(currentNext)) !== JSON.stringify(selected)) return unverified();
+      // The proof awaited remote I/O: none of the authorization held above is
+      // retained across that wait. Recheck the ingress credential and grants.
+      const currentIngress = ingress ? peerFromToken(nodesPath, bearerFrom(req)) : null;
+      if (ingress && (!currentIngress || currentIngress.name !== ingress.name || currentIngress.nodeId !== ingress.nodeId)) {
+        return rejectForward(401, { error: 'unauthorized peer' });
+      }
+      const gate = classGateCheck(parsed.resource, req.method, currentIngress);
+      if (!gate.ok) return rejectForward(gate.status, { error: 'risorsa non concessa a questo nodo', reason: gate.reason });
+      if (readonly() && readonlyBlocksFederated(parsed.resource, req.method)) {
+        return rejectForward(403, { error: 'READONLY: federated mutation blocked' });
+      }
+      if (!currentNext.token || currentNext.shared !== true || (currentIngress && !canTransit(currentIngress, currentNext))) {
+        return rejectForward(403, { error: 'route non consentita' });
+      }
+      if (!controlledVisited(req, currentIngress, current.nodeId)) return rejectForward(409, { error: 'federation cycle rejected' });
+      forwardPort = selected.port;
+    }
+    const invalidateProof = () => verifier.invalidate(proofKey);
+    const actionCapture = isAskAction ? (status, text) => {
+      if (status < 200 || status >= 300) invalidateProof();
+      try { JSON.parse(text); } catch (_) { invalidateProof(); }
+    } : capture;
+    proxyHttp(req, res, { port: forwardPort, path, credential: next.token, visited, setCookiePrefix, panelCookie, capture: actionCapture,
+      onForwardFailure: isAskAction ? invalidateProof : null, abortWithClient: isAskAction, getTimeoutMs: forwardGetTimeoutMs, sseIdleMs: forwardSseIdleMs });
   };
 }
 
@@ -1251,7 +1345,8 @@ async function probeReverseOwner(peer, fetchImpl = fetch) {
   });
 }
 
-function peerRouter({ nodesPath, localPort, localCredential, fetchImpl, readonly = () => false, version = null, roles = null, hopSecret = null, diagnostics = null }) {
+function peerRouter({ nodesPath, localPort, localCredential, fetchImpl, readonly = () => false, version = null, roles = null, hopSecret = null, diagnostics = null, askProofNow = null, slotVerifier = null }) {
+  slotVerifier = slotVerifier || (askProofNow ? createAskSlotVerifier({ now: askProofNow }) : askSlotVerifier);
   const r = express.Router();
   r.use((req, res, next) => {
     const peer = peerFromToken(nodesPath, bearerFrom(req));
@@ -1532,13 +1627,18 @@ function peerRouter({ nodesPath, localPort, localCredential, fetchImpl, readonly
       return res.status(e.status || 500).json({ error: String(e && e.message || e), ...(e.code ? { code: e.code } : {}) });
     }
   });
-  r.use('/route', (req, res) => routeHandler({ nodesPath, localPort, localCredential, ingress: req.peer, readonly, hopSecret })(req, res));
+  r.use('/route', (req, res, next) => {
+    routeHandler({ nodesPath, localPort, localCredential, ingress: req.peer, readonly, hopSecret, slotVerifier })(req, res).catch(next);
+  });
   return r;
 }
 
-function localRouter({ nodesPath, localPort, localCredential, readonly, hopSecret = null, liveHostLedger = null }) {
+function localRouter({ nodesPath, localPort, localCredential, readonly, hopSecret = null, liveHostLedger = null, askProofNow = null, slotVerifier = null }) {
+  slotVerifier = slotVerifier || (askProofNow ? createAskSlotVerifier({ now: askProofNow }) : askSlotVerifier);
   const r = express.Router();
-  r.use((req, res) => routeHandler({ nodesPath, localPort, localCredential, readonly, hopSecret, liveHostLedger })(req, res));
+  r.use((req, res, next) => {
+    routeHandler({ nodesPath, localPort, localCredential, readonly, hopSecret, liveHostLedger, slotVerifier })(req, res).catch(next);
+  });
   return r;
 }
 

package/lib/proxy/resource-acl.js

@@ -55,6 +55,7 @@ function classifyResource(resource, method = 'GET') {
   // attempt id a UUID. The routes live UNDER /event-feed because they are the
   // feed's own write-back path; the class is the same ask-action.
   if (/^\/event-feed\/asks\/[a-f0-9]{8}\/answer$/.test(resource)) return m === 'POST' ? 'ask-action' : null;
+  if (/^\/event-feed\/asks\/[a-f0-9]{8}\/capability$/.test(resource)) return m === 'GET' ? 'ask-action' : null;
   if (/^\/event-feed\/asks\/[a-f0-9]{8}$/.test(resource)) return m === 'DELETE' ? 'ask-action' : null;
   if (/^\/event-feed\/asks\/[a-f0-9]{8}\/requests\/[0-9a-f-]{16,64}$/.test(resource)) return m === 'GET' ? 'ask-action' : null;
 

package/lib/server.js

@@ -26,7 +26,7 @@ const { transcribe } = require('./voice/transcribe.js');
 const { selectProvider } = require('./fleet/provider.js');
 const { fleetRoutes } = require('./fleet/routes.js');
 const { leaseRoutes } = require('./fleet/lease-routes.js');
-const { cellsRoutes } = require('./cells/routes.js');
+const { cellsRoutes, publicCells } = require('./cells/routes.js');
 const { liveHostRoutes } = require('./live-host/routes.js');
 const { createLiveHostStore, liveHostPath } = require('./live-host/store.js');
 const { createLiveBridge } = require('./live-host/bridge.js');
@@ -85,6 +85,8 @@ const { createAskReceipts } = require('./notify/ask-receipts.js');
 const { createAskAnswerService } = require('./notify/ask-answer-service.js');
 const { createEventFeedAsksRoutes } = require('./notify/event-feed-asks-routes.js');
 const { createAskRelay } = require('./notify/ask-relay.js');
+const { createImportedDismissalDrainer } = require('./notify/imported-dismissals.js');
+const { createAskSlotVerifier } = require('./nodes/ask-slot-verifier.js');
 const { readFederationEventsEnabled } = require('./config.js');
 
 function sanitizeReplyLabel(raw) {
@@ -127,6 +129,7 @@ function wsBridgeDefaults(cfg = {}) {
 }
 
 function createServer(opts = {}) {
+  const askReverseVerifier = createAskSlotVerifier();
   const cfg = loadConfig(opts);
   // UNA istanza per server: trattiene le attach federate quando il client cade,
   // cosi' chi torna con la stessa identita' riprende dal buffer. I parametri
@@ -234,7 +237,27 @@ function createServer(opts = {}) {
   let closureRetry = null;
   const askAnswerService = createAskAnswerService({
     asks: asksStore,
-    paste: cfg.pasteSeam || ((session, text) => pasteToSession(cfg.tmuxBin, session, text)),
+    submit: opts.askSubmit || (async (session, text) => {
+      let cell;
+      try {
+        const fleet = await fleetP;
+        const statusFn = fleet && (typeof fleet.cellStatus === 'function' ? fleet.cellStatus : fleet.status);
+        const status = fleet && fleet.available === true && typeof statusFn === 'function' ? await statusFn.call(fleet) : null;
+        if (!status || status.available !== true || !Array.isArray(status.cells)) {
+          return { outcome: 'failed-pre-paste', submitted: false, reason: 'fleet-unavailable' };
+        }
+        cell = publicCells(status, apiNodeId()).find(entry => entry.tmuxSession === session);
+      } catch (_) { return { outcome: 'failed-pre-paste', submitted: false, reason: 'fleet-unavailable' }; }
+      if (!cell) {
+        if (!sessionExistsImpl(session)) return { outcome: 'failed-pre-paste', submitted: false, reason: 'session-unavailable' };
+        // Manual tmux sessions keep the existing paste-only answer contract.
+        const pasted = await pasteToSession(cfg.tmuxBin, session, text);
+        return { outcome: pasted ? 'pasted-not-submitted' : 'delivery-unknown', submitted: false };
+      }
+      if (!cell.active || !cell.engine) return { outcome: 'failed-pre-paste', submitted: false, reason: 'cell-unavailable' };
+      // Same submission as cell messages; operator draft in the composer may be submitted.
+      return submitToSession(cfg.tmuxBin, session, text, { engine: cell.engine });
+    }),
     receipts: askReceipts,
     // La chiusura esce da QUI: e' il punto in cui OGNI transizione autorevole
     // passa — risposta e scarto, rotta locale e rotta federata. Emetterla dalle
@@ -350,7 +373,7 @@ function createServer(opts = {}) {
           if (cellId) {
             recordAndPublish({
               producer: 'ask', cellId,
-              payload: { askId: ask.id, revision: ask.revision || 0, question: ask.question, options: ask.options, session: ask.session, ts: Date.now() },
+              payload: { askId: ask.id, revision: ask.revision || 0, question: ask.question, options: ask.options, session: ask.session, askTs: ask.ts, ts: Date.now() },
             });
           }
         } else if (frame && (frame.type === 'ask-answered' || frame.type === 'ask-dismissed')) {
@@ -920,7 +943,7 @@ function createServer(opts = {}) {
   // abbia mai preso un ticket). Resta della PWA autenticata l'EMISSIONE: il POST
   // .../panel/<cella>/ticket transita di sotto, col Bearer, come ogni altra /api.
   const panelFederatoRouter = federation.localRouter({
-    nodesPath, localPort: () => (server && server.address() ? server.address().port : cfg.port), localCredential: () => tokenHolder.value, readonly: proxyReadonly,
+    nodesPath, slotVerifier: askReverseVerifier, localPort: () => (server && server.address() ? server.address().port : cfg.port), localCredential: () => tokenHolder.value, readonly: proxyReadonly,
     hopSecret: () => hopSecret,
   });
   api.use('/route', (req, res, next) => {
@@ -1139,7 +1162,10 @@ function createServer(opts = {}) {
   });
   const askPeerTargets = async () => {
     const list = await federatedPeers();
-    return (Array.isArray(list) ? list : []).map((p) => p && (p.nodeId || p.instanceId)).filter(Boolean);
+    const current = nodesStore.loadStoreStrict(nodesPath);
+    return (Array.isArray(list) ? list : []).map(peer => ({ ...peer,
+      firstHop: current && current.nodes.find(node => node.name === peer.route?.[0]),
+    }));
   };
   // Riconciliazione del RICEVENTE: per ogni alias ancora aperto si chiede
   // all'owner quali domande sono ancora aperte. Se l'alias non c'e' piu' la'
@@ -1199,7 +1225,7 @@ function createServer(opts = {}) {
         try {
           const closed = asksStore.closeImported({ ownerId, ownerAskId: alias.ownerAskId, outcome: 'dismissed' });
           if (closed.changed && closed.ask) {
-            try { notifier.deliverOnlyRaw({ type: 'ask-dismissed', id: closed.ask.id, ownerId }); } catch (_) {}
+            try { notifier.deliverOnlyRaw({ type: 'ask-dismissed', id: closed.ask.id, ownerId, ownerAskId: closed.ask.ownerAskId }); } catch (_) {}
           }
         } catch (_) { /* un alias non chiudibile non ferma gli altri */ }
       }
@@ -1252,15 +1278,6 @@ function createServer(opts = {}) {
     federatedRate: createSpeakRateLimiter(),
     answerService: askAnswerService,
     receipts: askReceipts,
-    // Elenco dei peer autorizzati per il fan-out di default della domanda
-    // (nessun `target` → tutti i nodi dell'owner). Il
-    // dispatcher resta a target esatto: l'enumerazione la fa la route.
-    peerTargets: async () => {
-      const list = await federatedPeers();
-      return (Array.isArray(list) ? list : [])
-        .map((p) => p && (p.nodeId || p.instanceId))
-        .filter(Boolean);
-    },
     log: opts.log || console.log,
   }));
   // Event feed: the closed SSE/JSON surface, mounted inside the
@@ -1305,7 +1322,12 @@ function createServer(opts = {}) {
   // resolves the owner from the authorized store and forwards with the peer's
   // own pair token. Uncertain outcomes are parked, never retried silently.
   const askRelay = createAskRelay({
+    availabilityBinding: dismissalBinding,
+    nodesPath, slotVerifier: askReverseVerifier,
     loadStore: () => nodesStore.loadStore(nodesPath),
+    peers: federatedPeers,
+    localPort: () => (server && server.address() ? server.address().port : cfg.port),
+    localToken: () => tokenHolder.value,
     log: opts.log || console.log,
   });
   // Il body va parsato QUI: il router `api` non monta un parser globale, ogni
@@ -1314,9 +1336,94 @@ function createServer(opts = {}) {
   // 400 «ownerId, askId e text richiesti» a OGNI richiesta: la risposta
   // federata non ha mai potuto attraversare, e nessun test copriva questa
   // rotta. Difetto preesistente, trovato scrivendo il test del ritorno federato.
+  function dismissalBinding(ownerId) {
+      const st = nodesStore.loadStore(nodesPath);
+      if (!st) return null;
+      const direct = st.nodes.filter(node => node.nodeId === ownerId);
+      const cached = topologyCache.loadCache(topologyCachePath);
+      const route = cached && cached.nodes.find(node => node.instanceId === ownerId)?.route;
+      const relevant = direct.length ? direct : st.nodes.filter(node => route && route.includes(node.name));
+      return require('node:crypto').createHash('sha256').update(JSON.stringify(relevant.map(node => ({ nodeId: node.nodeId, direction: node.direction,
+        shared: node.shared, pairingRevision: node.pairingRevision || 0, localPort: node.localPort, reversePool: node.reversePool,
+        configured: accessPresets.grantsOf(node).configured, grants: accessPresets.grantsOf(node).grants }))) + JSON.stringify(route || [])).digest('hex');
+  }
+  function dismissalPeer(ownerId) {
+    const st = nodesStore.loadStore(nodesPath);
+    if (!st) return null;
+    const direct = st.nodes.filter(node => node.nodeId === ownerId);
+    if (direct.length) return direct.length === 1 ? direct[0] : null;
+    // A cached route identifies the first hop, never authorizes it or proves
+    // an outage. The current local grants and channel are checked separately.
+    const cached = topologyCache.loadCache(topologyCachePath);
+    const routes = cached && cached.nodes.filter(node => node.instanceId === ownerId);
+    if (!routes || routes.length !== 1) return null;
+    const first = st.nodes.filter(node => node.name === routes[0].route[0]);
+    return first.length === 1 ? first[0] : null;
+  }
+  function localDismissalEligibility(ownerId, askId) {
+    const peer = dismissalPeer(ownerId);
+    const storedAlias = asksStore.findImported(ownerId, askId);
+    const previous = asksStore.getImportedDismissal(ownerId, askId);
+    const view = eventFeedClient.state().views.find(item => item.ownerId === ownerId);
+    const feedAsk = view && view.asks.find(item => (item.ownerAskId || item.id) === askId);
+    const tsOf = item => { const ts = item && (Object.hasOwn(item, 'ownerAskTs') ? item.ownerAskTs : item.originNode ? null : item.ts); return Number.isSafeInteger(ts) && ts > 0 ? ts : null; };
+    let ask = storedAlias || feedAsk, ambiguous = false;
+    if (storedAlias && feedAsk) {
+      const aliasTs = tsOf(storedAlias), feedTs = tsOf(feedAsk);
+      const sameContent = asksStore.askFingerprint(storedAlias) === asksStore.askFingerprint(feedAsk);
+      if (aliasTs !== null && feedTs !== null && aliasTs !== feedTs) {
+        ask = feedTs > aliasTs ? feedAsk : storedAlias;
+        // An older visible feed cannot be acknowledged through a newer closed
+        // alias. Its current generation needs an authoritative refresh.
+        if (ask === storedAlias && (storedAlias.dismissed || storedAlias.answered)) ambiguous = true;
+      }
+      else if (!sameContent) ambiguous = true;
+      else ask = feedTs !== null && aliasTs === null ? feedAsk : storedAlias;
+    }
+    // Guards and alias mutation belong only to the selected generation.
+    const alias = storedAlias && ask && asksStore.sameImportedGeneration(storedAlias, ask) ? storedAlias : null;
+    const grants = peer && accessPresets.grantsOf(peer);
+    const cellId = ask ? cellIdFromTmuxSession(ask.session) : previous && previous.cellId;
+    const visible = !!((ask || previous) && cellId && grants && grants.configured && grants.grants.eventsAccess === true
+      && eventFeedAcl.visibilityAllows(grants.grants, cellId));
+    const blocked = !!((ask && ask.answered) || (alias && (asksStore.isAnswering(alias.id) || askReceipts.isBlocked(alias.id)))
+      || askRelay.state().some(attempt => attempt.ownerId === ownerId && attempt.askId === askId && ['sent', 'uncertain'].includes(attempt.state)));
+    const slot = peer && peer.reversePool && peer.reversePool.slots && peer.reversePool.slots[peer.reversePool.activeSlot];
+    const unavailable = !!(peer && peer.direction === 'inbound' && (!peer.shared || !slot || !Number.isInteger(slot.port)))
+      || askRelay.channelState(ownerId).unavailable;
+    return { peer, alias, previous, ask, grants, cellId, visible, blocked: blocked || ambiguous, unavailable, ambiguous };
+  }
   api.post('/asks-relay', express.json({ limit: '8kb' }), async (req, res) => {
     try {
       const b = req.body || {};
+      if (b.action === 'dismiss-local') {
+        if (proxyReadonly()) return res.status(403).json({ error: 'READONLY: mutation blocked' });
+        if (req.headers[HOP_HEADER]) return res.status(403).json({ error: 'local operator required' });
+        if (!b || Array.isArray(b) || Object.keys(b).some(key => !['action', 'ownerId', 'askId'].includes(key))
+          || !/^[a-f0-9]{32}$/.test(b.ownerId) || !/^[a-f0-9]{8}$/.test(b.askId) || b.ownerId === federatedNodeId()) {
+          return res.status(400).json({ error: 'invalid local dismissal body' });
+        }
+        try { if (!asksStore.health().readable) return res.status(503).json({ error: 'dismissal store unavailable' }); }
+        catch (_) { return res.status(503).json({ error: 'dismissal store unavailable' }); }
+        const { peer, alias, previous, ask, grants, cellId, visible, unavailable, ambiguous } = localDismissalEligibility(b.ownerId, b.askId);
+        if (!visible) return res.status(404).json({ error: 'unknown or invisible ask' });
+        if (ambiguous) return res.status(409).json({ error: 'ask generation is ambiguous; refresh the owner view', reason: 'generation-ambiguous' });
+        if (ask && ask.answered) return res.status(409).json({ error: 'ask already answered', reason: 'answered' });
+        if ((alias && (asksStore.isAnswering(alias.id) || askReceipts.isBlocked(alias.id)))
+          || askRelay.state().some(attempt => attempt.ownerId === b.ownerId && attempt.askId === b.askId && ['sent', 'uncertain'].includes(attempt.state))) {
+          return res.status(409).json({ error: 'answer requires reconciliation', reason: 'delivery-unknown-block' });
+        }
+        if (!ask && previous) return res.json({ dismissed: true, scope: 'local', ownerSync: previous.syncState === 'blocked' ? 'blocked' : 'pending' });
+        if (!unavailable) return res.status(409).json({ error: 'owner channel is not known unavailable', reason: 'owner-availability-unknown' });
+        const out = asksStore.dismissImported({ ownerId: b.ownerId, ownerAskId: b.askId, ask, cellId, retryBinding: dismissalBinding(b.ownerId),
+          syncState: grants.grants.askReplyAccess === true ? 'pending' : 'blocked' });
+        if (!out.ok) return res.status(out.reason === 'dismissal-cap' ? 429 : 503).json({ error: 'local dismissal refused', reason: out.reason });
+        notifier.deliverOnlyRaw({ type: 'ask-dismissed', id: alias ? alias.id : b.askId, ownerId: b.ownerId, ownerAskId: b.askId, scope: 'local',
+          // UI-only context also distinguishes changed content before the first snapshot.
+          askGeneration: { question: ask.question, options: ask.options || [], session: ask.session },
+          ownerAskTs: out.record.ownerAskTs, ownerSync: out.record.syncState === 'blocked' ? 'blocked' : 'pending' });
+        return res.json({ dismissed: true, scope: 'local', ownerSync: out.record.syncState === 'blocked' ? 'blocked' : 'pending' });
+      }
       if (b.action === 'dismiss') {
         const out = await askRelay.relayDismiss({ ownerId: b.ownerId, askId: b.askId });
         // Dismiss CONFERMATO dall'owner (2xx): la view del feed lo dimentica
@@ -1326,23 +1433,39 @@ function createServer(opts = {}) {
         if (out.ok && typeof eventFeedClient.dismissConfirmed === 'function') {
           eventFeedClient.dismissConfirmed(b.ownerId, b.askId);
         }
-        return res.status(out.ok ? 200 : out.code || 500).json(out.ok ? { dismissed: true } : { error: out.error || 'unknown' });
+        return res.status(out.ok ? 200 : out.code || 500).json(out.ok ? { dismissed: true } : { error: out.error || 'unknown', reason: out.reason });
       }
       if (b.action === 'verify') {
         const out = await askRelay.verifyStatus({ ownerId: b.ownerId, askId: b.askId, requestId: b.requestId });
-        return res.status(out.ok ? 200 : out.code || 500).json(out.ok ? { state: out.state } : { error: out.error || 'unknown', reason: out.reason });
+        return res.status(out.ok ? 200 : out.code || 500).json(out.ok ? { state: out.state, ownerId: out.ownerId, askId: out.askId, actor: out.actor, receipt: out.receipt } : { error: out.error || 'unknown', reason: out.reason });
       }
-      const out = await askRelay.relayAnswer({ ownerId: b.ownerId, askId: b.askId, text: b.text });
+      const out = await askRelay.relayAnswer({ ownerId: b.ownerId, askId: b.askId, text: b.text, rid: b.requestId });
       return res.status(out.ok ? 200 : out.code || 500).json({
-        ...(out.ok ? { status: out.status } : {}),
+        ...(out.ok ? { status: out.status, ownerId: out.ownerId, askId: out.askId, actor: out.actor, receipt: out.receipt } : {}),
         requestId: out.requestId || b.requestId,
-        ...(out.uncertain ? { uncertain: true, reason: out.reason } : {}),
+        ...(out.uncertain ? { uncertain: true, reason: out.reason, originalRequestId: out.originalRequestId } : {}),
         ...(!out.ok && !out.uncertain ? { error: out.error, reason: out.reason } : {}),
       });
     } catch (e) { res.status(500).json({ error: String(e.message || e) }); }
   });
   // Riconciliazione dopo refresh: gli esiti incerti noti al relay (solo
   // contatori/ID, mai testo) per ricostruire lo stato «verifica» senza reinvii.
+  api.get('/asks-relay/capability', async (req, res) => {
+    const ownerId = typeof req.query.ownerId === 'string' ? req.query.ownerId : '';
+    const askId = typeof req.query.askId === 'string' ? req.query.askId : '';
+    if (!/^[a-f0-9]{32}$/.test(ownerId) || !/^[a-f0-9]{8}$/.test(askId)) return res.status(400).json({ error: 'ownerId e askId richiesti' });
+    try {
+      const remote = await askRelay.replyCapability({ ownerId, askId });
+      if (req.query.dismissals !== '1') return res.json(remote);
+      const local = localDismissalEligibility(ownerId, askId);
+      const mutable = !proxyReadonly() && !req.headers[HOP_HEADER];
+      let readable = false;
+      try { readable = asksStore.health().readable; } catch (_) {}
+      res.json({ ...remote, canDismissRemote: mutable && remote.canReply === true,
+        canDismissLocal: mutable && readable && local.visible && !local.blocked && (local.unavailable || !!local.previous) });
+    }
+    catch (_) { res.json({ ownerId, askId, canReply: false, status: 'unreachable' }); }
+  });
   api.get('/asks-relay/state', (_req, res) => {
     try { res.json({ attempts: askRelay.state() }); }
     catch (e) { res.status(500).json({ error: String(e.message || e) }); }
@@ -1358,7 +1481,15 @@ function createServer(opts = {}) {
       if (!bridgeReadonly()) pushRelay.considerImported(event);
     },
   };
+  try { nodesStore.migrateAdminReception({ filePath: nodesPath, readonly: bridgeReadonly() }); }
+  catch (error) {
+    if (error?.code !== 'NODES_STORE_MISSING') {
+      (opts.log || console.log)(`Admin reception migration skipped: ${error?.code || 'NODES_STORE_UNAVAILABLE'}`);
+    }
+  }
   const eventFeedClient = createEventFeedClient({
+    isAskDismissed: (ownerId, ask) => asksStore.isImportedDismissed(ownerId, ask),
+    onAskClosed: (ownerId, ownerAskId, outcome) => asksStore.closeImported({ ownerId, ownerAskId, outcome }),
     loadStore: () => nodesStore.loadStore(nodesPath),
     token: () => tokenHolder.value,
     eventsHub: importHub,
@@ -1371,6 +1502,11 @@ function createServer(opts = {}) {
     pollMs: cfg.eventFeedClientPollMs,
   });
   eventFeedClient.start();
+  const importedDismissalDrainer = createImportedDismissalDrainer({
+    store: asksStore, relay: askRelay, readonly: proxyReadonly, log: opts.log || console.log,
+    bindingForOwner: dismissalBinding,
+  });
+
   // Local aggregated read for the UI: connected views only, with the cursor
   // watermark so the first fetch cannot race the live stream. Local
   // authenticated route, NOT in the federation allowlist.
@@ -1584,6 +1720,7 @@ function createServer(opts = {}) {
       });
       // Store-root revision of the peer access policy: the CAS value the UI
       // must send back with every preset write (stale revision -> 409).
+      importedDismissalDrainer.nudge();
       res.json({ nodeId: view.nodeId, nodes, accessRevision: nodesStore.accessRevisionOf(st) });
     } catch (e) { res.status(500).json({ error: String(e.message || e) }); }
   });
@@ -1640,7 +1777,7 @@ function createServer(opts = {}) {
     catch (e) { res.status(500).json({ error: String(e.message || e) }); }
   });
   api.use('/route', federation.localRouter({
-    nodesPath, localPort: () => (server && server.address() ? server.address().port : cfg.port), localCredential: () => tokenHolder.value, readonly: proxyReadonly,
+    nodesPath, slotVerifier: askReverseVerifier, localPort: () => (server && server.address() ? server.address().port : cfg.port), localCredential: () => tokenHolder.value, readonly: proxyReadonly,
     hopSecret: () => hopSecret,
     // A designation forwarded from here to a peer is recorded by the answer
     // the peer gives, not by a local guess: see liveHostLedgerCapture.
@@ -1672,7 +1809,7 @@ function createServer(opts = {}) {
 
   app.use('/api', api);
   app.use('/federation', federation.peerRouter({
-    nodesPath, localPort: () => (server && server.address() ? server.address().port : cfg.port), localCredential: () => tokenHolder.value, readonly: proxyReadonly, version: VERSION,
+    nodesPath, slotVerifier: askReverseVerifier, localPort: () => (server && server.address() ? server.address().port : cfg.port), localCredential: () => tokenHolder.value, readonly: proxyReadonly, version: VERSION,
     fetchImpl: healthFetch, hopSecret: () => hopSecret,
     roles: () => require('./cli/commands.js').readRoles(cfg.configPath || configJsonPath()),
     diagnostics,
@@ -1715,13 +1852,14 @@ function createServer(opts = {}) {
     diagnostics.record('info', 'server', 'SERVER_STARTED', 'NexusCrew server started', {
       port: runtimePort(), platform: cfg.platform || process.platform,
     });
-    updater.start(); startManagedTunnels();
+    updater.start(); startManagedTunnels(); importedDismissalDrainer.start();
   });
   server.on('close', () => {
     diagnostics.record('info', 'server', 'SERVER_STOPPED', 'NexusCrew server stopped', { reason: 'close' });
     watcher.close(); previews.close(); eventsHub.closeAll(); updater.close(); ptyGrace.close();
     // Nessun timer di ritentativo sopravvive alla chiusura del server.
     if (closureRetry) { try { closureRetry.stop(); } catch (_) {} }
+    importedDismissalDrainer.stop(); eventFeedClient.stop();
     for (const timer of reverseWatchers.values()) clearInterval(timer);
     reverseWatchers.clear(); rotatableReverse.clear(); void reverseSlotListeners?.closeAll();
     // Il pannello non sopravvive al control plane: senza requireToken sopra,