@mmmbuto/nexuscrew 0.9.58 → 0.9.59

package/frontend/dist/index.html

@@ -11,7 +11,7 @@
   <meta name="apple-mobile-web-app-title" content="NexusCrew" />
   <link rel="manifest" href="/manifest.json" />
   <title>NexusCrew</title>
-  <script type="module" crossorigin src="/assets/index-D8cf4AEo.js"></script>
+  <script type="module" crossorigin src="/assets/index-CZFJnks_.js"></script>
   <link rel="stylesheet" crossorigin href="/assets/index-fCIoVxeq.css">
 </head>
 <body>

package/frontend/dist/version.json

@@ -1 +1 @@
-{"version":"0.9.58"}
+{"version":"0.9.59"}

package/lib/nodes/store.js

@@ -109,7 +109,7 @@ const LABEL_MAX = 64;
 const NODE_KEYS = new Set([
   'name', 'ssh', 'sshPort', 'remotePort', 'localPort', 'keyPath', 'identityFile',
   'roles', 'rolesKnown', 'token', 'acceptToken', 'nodeId', 'transport', 'autostart', 'visibility', 'selected',
-  'direction', 'reversePort', 'shared', 'label', 'reversePool',
+  'direction', 'reversePort', 'shared', 'label', 'reversePool', 'pairingRevision',
   // Quali CELLE di questo nodo il peer puo' vedere. Distinto da `visibility`,
   // che governa il TRANSITO (attraverso chi passa il traffico) e non l'accesso.
   'cellVisibility', 'cells',
@@ -392,6 +392,11 @@ function parseNode(n, schemaVersion = SCHEMA_VERSION) {
     if (!validToken(n.acceptToken)) return null;
     out.acceptToken = n.acceptToken;
   }
+  // Public rotation counter, independent of the credential bytes.
+  if (n.pairingRevision !== undefined) {
+    if (!Number.isSafeInteger(n.pairingRevision) || n.pairingRevision < 0) return null;
+    out.pairingRevision = n.pairingRevision;
+  }
   if (n.nodeId !== undefined) {
     if (typeof n.nodeId !== 'string' || !NODE_ID_RE.test(n.nodeId)) return null;
     out.nodeId = n.nodeId;
@@ -570,6 +575,19 @@ function atomicWriteStore(p, data) {
   const parsed = parseStore(data);
   if (!parsed) throw new Error('nodes.json non valido: validazione fallita (schema strict)');
 
+  // Count rotations at the durable write boundary, including pairing paths
+  // that replace tokens directly. Never export a hash of the credentials.
+  const previous = loadStore(p);
+  for (const peer of parsed.nodes) {
+    const old = previous && previous.nodes.find(node => node.name === peer.name && node.nodeId === peer.nodeId);
+    if (!old) continue;
+    const revision = old.pairingRevision || 0;
+    const rotated = old.token !== peer.token || old.acceptToken !== peer.acceptToken;
+    if (rotated && revision === Number.MAX_SAFE_INTEGER) throw new Error('pairing rotation revision exhausted');
+    if (rotated || old.pairingRevision !== undefined) peer.pairingRevision = revision + (rotated ? 1 : 0);
+    else delete peer.pairingRevision;
+  }
+
   const dir = path.dirname(p);
   fs.mkdirSync(dir, { recursive: true });
   const tmp = path.join(dir, `.${path.basename(p)}.${crypto.randomBytes(6).toString('hex')}.tmp`);

package/lib/notify/ask-relay.js

@@ -27,12 +27,13 @@ const OWNER_REASONS = new Set([
   'unknown', 'dismissed', 'answering', 'answered', 'store-unreadable',
   'delivery-unknown-block', 'already-delivered', 'paste-failed', 'bad-request-id',
   'no-receipts', 'request-conflict', 'receipt-cap', 'federation-peer-unreachable',
-  'federation-peer-timeout', 'federation-body-consumed',
+  'federation-peer-timeout', 'federation-body-consumed', 'generation-mismatch', 'invalid-generation', 'unsupported',
 ]);
 function safeReason(reason) { return OWNER_REASONS.has(reason) ? reason : undefined; }
 
-function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = () => {}, probeReverseSlotImpl = probeReverseSlot, peers = null, localPort = () => 0, localToken = () => '', nodesPath = null, slotVerifier = askSlotVerifier } = {}) {
+function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = () => {}, probeReverseSlotImpl = probeReverseSlot, peers = null, localPort = () => 0, localToken = () => '', nodesPath = null, availabilityBinding = () => null, slotVerifier = askSlotVerifier } = {}) {
   // (ownerId|askId|requestId) -> {state: 'sent'|'committed'|'failed'|'uncertain', requestId}
+  const channelObservations = new Map();
   const attempts = new Map();
   const answerFlights = new Map();
 
@@ -123,7 +124,7 @@ function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = ()
     return `http://127.0.0.1:${port}/federation/route/_/${path.replace(/^\//, '')}`;
   }
 
-  async function forward(candidate, path, { method = 'GET', body, op } = {}) {
+  async function forward(candidate, path, { method = 'GET', body, expectedTs, op } = {}) {
     op.check();
     const st = loadStore();
     slotVerifier.sync(st, proofScope);
@@ -143,7 +144,8 @@ function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = ()
       : { authorization: `Bearer ${candidate.forwardToken}`, 'x-nexuscrew-visited': st && st.nodeId || '' };
     try {
       op.check(); op.delivered = true;
-      const r = await op.wait(fetchImpl(url, { method, headers: { ...headers, 'content-type': 'application/json' },
+      const r = await op.wait(fetchImpl(url, { method, headers: { ...headers, 'content-type': 'application/json',
+        ...(expectedTs === undefined ? {} : { 'x-nexuscrew-ask-ts': String(expectedTs) }) },
         ...(body === undefined ? {} : { body: JSON.stringify(body) }), signal: op.controller.signal }));
       op.check();
       const payload = await op.wait(r.json().catch(error => {
@@ -290,7 +292,15 @@ function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = ()
   }
 
   // Remote dismiss: same resolution rules as the answer (DELETE on the owner).
-  async function relayDismissOnce({ ownerId, askId } = {}, op) {
+  function retryAfterMs(response) {
+    const value = response.headers?.get?.('retry-after');
+    if (typeof value !== 'string') return 0;
+    const seconds = /^\d+(?:\.\d+)?$/.test(value.trim()) ? Number(value) : null;
+    const delay = seconds === null ? Date.parse(value) - now() : seconds * 1000;
+    return Number.isFinite(delay) && delay > 0 ? delay : 0;
+  }
+
+  async function relayDismissOnce({ ownerId, askId, expectedTs } = {}, op) {
     const candidate = await candidateOwner(ownerId, op);
     if (!candidate) return { ok: false, code: 404, error: 'owner non tra i peer autorizzati', reason: 'owner-unknown' };
     if (candidate.kind === 'inbound-unverified') {
@@ -303,9 +313,9 @@ function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = ()
     const peer = candidate.node;
     const store = loadStore();
     try {
-      const { r, body } = await forward(candidate, `/event-feed/asks/${encodeURIComponent(askId)}`, { method: 'DELETE', op });
-      if (!r.ok) return { ok: false, code: r.status, error: 'owner refused', reason: body.reason };
-      return { ok: true };
+      const { r, body } = await forward(candidate, `/event-feed/asks/${encodeURIComponent(askId)}`, { method: 'DELETE', expectedTs, op });
+      if (!r.ok) return { ok: false, code: r.status, error: 'owner refused', reason: body.reason, retryAfterMs: retryAfterMs(r) };
+      return { ok: true, ...(body.outcome ? { outcome: body.outcome } : {}) };
     } catch (e) { if (!op.active()) return deadlineResult(op, { ownerId, askId }, false); return { ok: false, code: 502, reason: safeReason(e.reason), error: 'owner unreachable' }; }
   }
 
@@ -343,32 +353,72 @@ function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = ()
     const denied = (status, reason) => ({ ownerId, askId, canReply: false, status, ...(reason ? { reason } : {}) });
     const candidate = await candidateOwner(ownerId, op);
     if (!candidate) return denied('unreachable', 'owner-unknown');
-    if (candidate.kind === 'inbound-unverified') return denied('unreachable', 'reverse-slot-unverified');
+    if (candidate.kind === 'inbound-unverified') { op.channelUnavailable = true; return denied('unreachable', 'reverse-slot-unverified'); }
     if (candidate.kind === 'inbound') {
       const gate = await verifyInboundChannel(candidate, op);
-      if (!gate.ok) return denied('unreachable', gate.reason);
+      if (!gate.ok) { op.channelUnavailable = true; return denied('unreachable', gate.reason); }
     }
     try {
       const { r, body } = await forward(candidate, `/event-feed/asks/${encodeURIComponent(askId)}/capability`, { op });
-      if (body.reason === 'reverse-slot-unverified') return denied('unreachable', body.reason);
+      if (['reverse-slot-unverified', 'federation-peer-unreachable', 'federation-peer-timeout'].includes(body.reason)) { op.channelUnavailable = true; return denied('unreachable', body.reason); }
       if (r.status === 404 || r.status === 501) return denied('unsupported', body.reason);
       if (r.status === 403) return denied('denied', body.reason);
       if (!r.ok || body.ownerId !== ownerId || body.askId !== askId || typeof body.canReply !== 'boolean'
         || !['open', 'denied', 'answered', 'dismissed'].includes(body.status)
         || (body.canReply && body.status !== 'open')) return denied('unreachable');
       return { ownerId, askId, canReply: body.canReply, status: body.status };
-    } catch (_) { return denied('unreachable', op.active() ? undefined : 'relay-deadline'); }
+    } catch (_) { op.channelUnavailable = true; return denied('unreachable', op.active() ? undefined : 'relay-deadline'); }
+  }
+
+  async function inspectDismissalOnce({ ownerId, askId } = {}, op) {
+    const candidate = await candidateOwner(ownerId, op);
+    if (!candidate) return { ok: false, code: 404, reason: 'owner-unknown' };
+    if (candidate.kind === 'inbound-unverified') return { ok: false, code: 404, reason: 'reverse-slot-unverified' };
+    if (candidate.kind === 'inbound') {
+      const proof = await verifyInboundChannel(candidate, op);
+      if (!proof.ok) return proof;
+    }
+    const { r, body } = await forward(candidate, `/event-feed/asks/${encodeURIComponent(askId)}/capability`, { op });
+    if (!r.ok) return { ok: false, code: r.status, reason: body.reason || 'unknown', retryAfterMs: retryAfterMs(r) };
+    if (body.ownerId !== ownerId || body.askId !== askId || !['open', 'answered', 'dismissed'].includes(body.status)) {
+      return { ok: false, code: 403, reason: 'unknown' };
+    }
+    if (body.generationPrecondition !== true) return { ok: false, code: 501, reason: 'unsupported' };
+    const ask = body.ask;
+    if (!ask || ask.id !== askId || !Number.isSafeInteger(ask.ts) || ask.ts <= 0
+      || typeof ask.question !== 'string' || typeof ask.session !== 'string'
+      || (ask.options !== undefined && (!Array.isArray(ask.options) || ask.options.some(option => typeof option !== 'string')))) {
+      return { ok: false, code: 409, reason: 'generation-mismatch' };
+    }
+    return { ok: true, status: body.status, ask, generationPrecondition: true };
   }
+  function inspectDismissal(args = {}) { return operation(args, op => inspectDismissalOnce(args, op)); }
 
   function relayDismiss(args = {}) { return operation(args, op => relayDismissOnce(args, op)); }
   function verifyStatus(args = {}) { return operation(args, op => verifyStatusOnce(args, op)); }
-  function replyCapability(args = {}) { return operation(args, op => replyCapabilityOnce(args, op), true); }
+  function channelBinding(ownerId) {
+    const store = loadStore();
+    // Kept only in process memory; credentials never enter the dismissal store.
+    return crypto.createHash('sha256').update(JSON.stringify([store, availabilityBinding(ownerId)])).digest('hex');
+  }
+  function channelState(ownerId) {
+    const observation = channelObservations.get(ownerId);
+    return { unavailable: !!(observation && now() - observation.at < 30000 && observation.binding === channelBinding(ownerId) && observation.unavailable) };
+  }
+  function replyCapability(args = {}) {
+    const initial = channelBinding(args.ownerId);
+    return operation(args, async op => {
+      const result = await replyCapabilityOnce(args, op);
+      channelObservations.set(args.ownerId, { at: now(), binding: initial, unavailable: op.channelUnavailable === true });
+      return result;
+    }, true);
+  }
 
   function state() {
     return [...attempts.entries()].map(([key, a]) => ({ key, ...a }));
   }
 
-  return { relayAnswer, relayDismiss, verifyStatus, replyCapability, state, isUncertain, requestId };
+  return { channelState, inspectDismissal, relayAnswer, relayDismiss, verifyStatus, replyCapability, state, isUncertain, requestId };
 }
 
 module.exports = { createAskRelay };

package/lib/notify/asks.js

@@ -17,6 +17,22 @@ const MAX_OPEN = 100;
 // che arrivano da un peer e quelle poste da questo nodo sono due classi
 // distinte, e le prime non devono poter esaurire il budget delle seconde.
 const MAX_OPEN_IMPORTED = 100;
+const MAX_IMPORTED_DISMISSALS = 1000;
+const SYNC_STATES = new Set(['pending', 'confirmed-dismissed', 'confirmed-answered', 'blocked']);
+function askFingerprint(ask) {
+  return crypto.createHash('sha256').update(JSON.stringify([String(ask.question || ''), Array.isArray(ask.options) ? ask.options : [], String(ask.session || '')])).digest('hex');
+}
+function validDismissals(value) {
+  return value && typeof value === 'object' && !Array.isArray(value) && Object.entries(value).every(([key, r]) =>
+    r && key === `${r.ownerId}|${r.ownerAskId}` && /^[a-f0-9]{32}$/.test(r.ownerId) && /^[a-f0-9]{8}$/.test(r.ownerAskId)
+    && /^[a-f0-9]{64}$/.test(r.ownerAskFingerprint) && SYNC_STATES.has(r.syncState)
+    && ['known', 'unknown'].includes(r.generation)
+    && (r.generation === 'unknown' ? r.ownerAskTs === null : Number.isSafeInteger(r.ownerAskTs) && r.ownerAskTs > 0)
+    && (r.cellId === undefined || (typeof r.cellId === 'string' && /^[A-Za-z0-9._-]{1,32}$/.test(r.cellId)))
+    && r.dismissed === true && Number.isSafeInteger(r.attempts) && r.attempts >= 0
+    && Number.isFinite(r.nextRetryAt) && r.nextRetryAt >= 0
+    && r.dismissedReason === 'owner-unreachable' && Number.isFinite(r.dismissedTs));
+}
 const MAX_KEEP = 100;          // ask totali persistiti (i piu' vecchi answered si potano)
 const MAX_QUESTION = 2000;
 const MAX_OPTIONS = 8;
@@ -39,11 +55,14 @@ function createAsksStore(opts = {}) {
   //    per non sovrascrivere il file malformato con un defaults vuoto, che
   //    cancellerebbe le domande aperte.
   let asks = null;
+  let importedDismissals = null;
+  const dismissalCap = opts.maxImportedDismissals || MAX_IMPORTED_DISMISSALS;
   function load() {
     if (asks) return asks;
     const r = readJsonStrict(filePath);
-    if (r.state === 'absent') { asks = []; return asks; }
-    if (r.state === 'ok' && Array.isArray(r.value.asks)) {
+    if (r.state === 'absent') { asks = []; importedDismissals = {}; return asks; }
+    if (r.state === 'ok' && Array.isArray(r.value.asks) && (r.value.importedDismissals === undefined || validDismissals(r.value.importedDismissals))) {
+      importedDismissals = r.value.importedDismissals || {};
       asks = r.value.asks.filter((a) => a && typeof a === 'object' && typeof a.id === 'string');
       return asks;
     }
@@ -58,7 +77,8 @@ function createAsksStore(opts = {}) {
     if (asks) return { readable: true };
     const r = readJsonStrict(filePath);
     if (r.state === 'absent') return { readable: true };
-    if (r.state === 'ok' && Array.isArray(r.value.asks)) return { readable: true };
+    if (r.state === 'ok' && Array.isArray(r.value.asks) && (r.value.importedDismissals === undefined || validDismissals(r.value.importedDismissals))) return { readable: true };
+    if (r.state === 'ok' && r.value.importedDismissals !== undefined && !validDismissals(r.value.importedDismissals)) return { readable: false, reason: 'malformed imported dismissals' };
     const reason = r.state === 'malformed'
       ? r.reason
       : `forma invalida: 'asks' non e' un array (${r.value && r.value.asks !== undefined ? typeof r.value.asks : 'assente'})`;
@@ -86,7 +106,7 @@ function createAsksStore(opts = {}) {
       const drop = new Set(answered.slice(0, excess).map((a) => a.id));
       asks = list.filter((a) => !drop.has(a.id));
     }
-    atomicWriteJson(filePath, { asks: load() });
+    atomicWriteJson(filePath, { asks: load(), importedDismissals: importedDismissals || {} });
   }
 
   // Validazione input fail-closed. Ritorna {ok:false,error} o {ok:true,value}.
@@ -121,7 +141,7 @@ function createAsksStore(opts = {}) {
   // L'`id` locale e' nostro e all'owner non dice nulla; e' la coppia che nomina
   // lo STESSO oggetto sui due nodi, quindi e' la chiave con cui si riconcilia.
   function findImported(ownerId, ownerAskId) {
-    return load().find((a) => isImported(a) && a.ownerId === String(ownerId)
+    return load().slice().reverse().find((a) => isImported(a) && a.ownerId === String(ownerId)
       && a.ownerAskId === String(ownerAskId)) || null;
   }
 
@@ -132,6 +152,11 @@ function createAsksStore(opts = {}) {
     const ur = unreadableGuard();
     if (ur) return { ok: false, reason: 'store-unreadable', changed: false, ask: null };
     const ask = findImported(ownerId, ownerAskId);
+    const record = getImportedDismissal(ownerId, ownerAskId);
+    if (record) {
+      const synced = updateImportedDismissal(ownerId, ownerAskId, { syncState: outcome === 'answered' ? 'confirmed-answered' : 'confirmed-dismissed', ownerOutcome: outcome });
+      if (!synced.ok) return { ...synced, changed: false, ask: null };
+    }
     if (!ask) return { ok: true, changed: false, ask: null };
     if (ask.answered || ask.dismissed) return { ok: true, changed: false, ask };
     if (outcome === 'answered') { ask.answered = true; ask.answeredReconciled = true; }
@@ -141,7 +166,7 @@ function createAsksStore(opts = {}) {
     return { ok: true, changed: true, ask };
   }
 
-  function create({ question, options, session, ownerId, ownerAskId, originNode, originCell }) {
+  function create({ question, options, session, ownerId, ownerAskId, originNode, originCell, ownerAskTs }) {
     const ur = unreadableGuard();
     if (ur) return { ok: false, reason: 'store-unreadable', error: `store illeggibile (${ur}): creazione rifiutata` };
     const v = validate({ question, options });
@@ -152,7 +177,12 @@ function createAsksStore(opts = {}) {
     // se ne crea un secondo.
     if (originNode && ownerId && ownerAskId) {
       const existing = findImported(ownerId, ownerAskId);
-      if (existing) return { ok: true, ask: existing, deduped: true };
+      const incoming = { id: ownerAskId, question: v.value.question, options: v.value.options, session: String(session || ''), originNode, ownerAskTs };
+      if (isImportedDismissed(ownerId, incoming)) return { ok: true, ask: existing, suppressed: true, deduped: !!existing };
+      if (existing && askFingerprint(existing) === askFingerprint(incoming)
+        && (generationTs(existing) === null || generationTs(incoming) === null || generationTs(existing) === generationTs(incoming))) {
+        return { ok: true, ask: existing, deduped: true };
+      }
     }
     // Cap duro sugli aperti, SEPARATO PER CLASSE: gli importati non consumano il
     // budget dei locali. Con un cap unico, cento domande ricevute da un peer
@@ -188,6 +218,7 @@ function createAsksStore(opts = {}) {
       // ri-esportato (nessun loop A->B->A). Un ask locale non ha questo campo.
       ...(originNode ? { originNode: String(originNode) } : {}),
       ...(originCell ? { originCell: String(originCell) } : {}),
+      ...(Number.isSafeInteger(ownerAskTs) && ownerAskTs > 0 ? { ownerAskTs } : {}),
       ts: now(),
       revision: 0,
       answered: false,
@@ -208,6 +239,83 @@ function createAsksStore(opts = {}) {
       .map((a) => ({ ...a, ...(a.options ? { options: a.options.slice() } : {}) }));
   }
 
+  function getImportedDismissal(ownerId, askId) {
+    load();
+    const record = importedDismissals && importedDismissals[`${ownerId}|${askId}`];
+    return record ? { ...record } : null;
+  }
+  function listImportedDismissals() {
+    load();
+    return Object.values(importedDismissals || {}).map(r => ({ ...r }));
+  }
+  function generationTs(ask) {
+    const ts = Object.hasOwn(ask, 'ownerAskTs') ? ask.ownerAskTs : ask.originNode ? null : ask.ts;
+    return Number.isSafeInteger(ts) && ts > 0 ? ts : null;
+  }
+  function sameImportedGeneration(a, b) {
+    const at = generationTs(a), bt = generationTs(b);
+    return askFingerprint(a) === askFingerprint(b) && (at === null || bt === null || at === bt);
+  }
+  function isImportedDismissed(ownerId, ask) {
+    const record = getImportedDismissal(ownerId, ask.ownerAskId || ask.id);
+    if (!record || record.ownerAskFingerprint !== askFingerprint(ask)) return false;
+    // Historical imports have no original owner timestamp. Reusing an id with
+    // identical content remains suppressed; this is not proof of historical identity.
+    const ts = generationTs(ask);
+    return record.generation === 'unknown' || ts === null || record.ownerAskTs === ts;
+  }
+  function dismissalTransaction(change) {
+    const ur = unreadableGuard();
+    if (ur) return { ok: false, reason: 'store-unreadable' };
+    load();
+    const beforeAsks = asks.map(a => ({ ...a }));
+    const beforeRecords = Object.fromEntries(Object.entries(importedDismissals).map(([k, r]) => [k, { ...r }]));
+    try { const result = change(); if (!result.ok) return result; save(); return result; }
+    catch (_) { asks = beforeAsks; importedDismissals = beforeRecords; return { ok: false, reason: 'persist-failed' }; }
+  }
+  function dismissImported({ ownerId, ownerAskId, ask, cellId, retryBinding, syncState = 'pending' } = {}) {
+    return dismissalTransaction(() => {
+      if (!/^[a-f0-9]{32}$/.test(ownerId) || !/^[a-f0-9]{8}$/.test(ownerAskId) || !ask || (ask.ownerAskId || ask.id) !== ownerAskId) return { ok: false, reason: 'unknown' };
+      const candidate = findImported(ownerId, ownerAskId);
+      const alias = candidate && sameImportedGeneration(candidate, ask) ? candidate : null;
+      if (alias && answering.has(alias.id)) return { ok: false, reason: 'answering' };
+      if (ask.answered || (alias && alias.answered)) return { ok: false, reason: 'answered' };
+      const key = `${ownerId}|${ownerAskId}`;
+      const existing = importedDismissals[key];
+      if (existing && isImportedDismissed(ownerId, ask)) return { ok: true, record: { ...existing }, idempotent: true };
+      if (!existing && Object.keys(importedDismissals).length >= dismissalCap) return { ok: false, reason: 'dismissal-cap' };
+      const ts = generationTs(ask);
+      const record = { ownerId, ownerAskId, ...(cellId ? { cellId } : {}), ...(alias ? { localAliasId: alias.id } : {}),
+        dismissed: true, dismissedReason: 'owner-unreachable', dismissedTs: now(),
+        generation: ts === null ? 'unknown' : 'known', ownerAskTs: ts,
+        ownerAskFingerprint: askFingerprint(ask), syncState, attempts: 0, nextRetryAt: 0,
+        ...(syncState === 'blocked' ? { lastReason: 'permission-denied', ...(retryBinding ? { retryBinding } : {}) } : {}) };
+      importedDismissals[key] = record;
+      if (alias) {
+        if (!alias.dismissed) { alias.dismissed = true; alias.dismissedTs = now(); alias.revision = (alias.revision || 0) + 1; }
+        alias.dismissedReason = 'owner-unreachable';
+      }
+      return { ok: true, record: { ...record } };
+    });
+  }
+  function updateImportedDismissal(ownerId, askId, patch) {
+    return dismissalTransaction(() => {
+      const record = importedDismissals[`${ownerId}|${askId}`];
+      if (!record) return { ok: false, reason: 'unknown' };
+      const next = { ...record, ...patch };
+      if (!validDismissals({ [`${ownerId}|${askId}`]: next })) return { ok: false, reason: 'invalid' };
+      importedDismissals[`${ownerId}|${askId}`] = next;
+      return { ok: true, record: { ...next } };
+    });
+  }
+  function adoptImportedDismissal(ownerId, askId, ask) {
+    const record = getImportedDismissal(ownerId, askId);
+    const ts = generationTs(ask);
+    if (!record || (ask.ownerAskId || ask.id) !== askId || ts === null || record.ownerAskFingerprint !== askFingerprint(ask)
+      || (record.generation === 'known' && record.ownerAskTs !== ts)) return { ok: false, reason: 'generation-mismatch' };
+    return updateImportedDismissal(ownerId, askId, { generation: 'known', ownerAskTs: ts });
+  }
+
   // --- ciclo answer (da revisione): claim atomico open -> answering ---------------
   // Node e' single-threaded ma il paste e' un await: due answer concorrenti
   // superavano entrambe il check `answered` prima che una marcasse. Il claim
@@ -301,7 +409,7 @@ function createAsksStore(opts = {}) {
     return commit(id, text);
   }
 
-  return { create, get, list, openCount, isImported, findImported, closeImported, claim, release, commit, markAnswered, markReconciled, isAnswering, dismiss, validate, health, filePath, MAX_OPEN, MAX_OPEN_IMPORTED };
+  return { sameImportedGeneration, dismissImported, getImportedDismissal, listImportedDismissals, isImportedDismissed, updateImportedDismissal, adoptImportedDismissal, askFingerprint, create, get, list, openCount, isImported, findImported, closeImported, claim, release, commit, markAnswered, markReconciled, isAnswering, dismiss, validate, health, filePath, MAX_OPEN, MAX_OPEN_IMPORTED };
 }
 
-module.exports = { createAsksStore };
+module.exports = { createAsksStore, askFingerprint };

package/lib/notify/event-feed-asks-routes.js

@@ -102,7 +102,9 @@ function createEventFeedAsksRoutes(deps) {
     const readonly = deps.readonly && deps.readonly();
     const status = !resolved || readonly ? 'denied'
       : resolved.ask.dismissed ? 'dismissed' : resolved.ask.answered ? 'answered' : 'open';
-    return res.json({ ownerId: g.self, askId, canReply: status === 'open', status });
+    return res.json({ ownerId: g.self, askId, canReply: status === 'open', status,
+      ...(resolved && !readonly ? { generationPrecondition: true, ask: { id: resolved.ask.id, ts: resolved.ask.ts, question: resolved.ask.question,
+        ...(resolved.ask.options ? { options: resolved.ask.options } : {}), session: resolved.ask.session } } : {}) });
   });
 
   r.post('/:id/answer', json, async (req, res) => {
@@ -157,15 +159,26 @@ function createEventFeedAsksRoutes(deps) {
     const askId = String(req.params.id || '');
     const resolved = resolveAskForPeer(g.peer, askId);
     if (!resolved) return res.status(404).json({ error: 'ask inesistente' });
-    // Local answer in flight wins: 409, and a dismissed ask is not answerable.
+    const expected = req.headers['x-nexuscrew-ask-ts'];
+    if (expected !== undefined && (typeof expected !== 'string' || !/^[1-9][0-9]{0,15}$/.test(expected)
+      || !Number.isSafeInteger(Number(expected)))) {
+      return res.status(400).json({ error: 'invalid generation precondition', reason: 'invalid-generation' });
+    }
+    // Keep the generation and terminal guards next to the synchronous service:
+    // authorization may await, but no yield is allowed between this check and dismiss.
+    if (expected !== undefined && resolved.ask.ts !== Number(expected)) {
+      return res.status(409).json({ error: 'ask generation changed', reason: 'generation-mismatch' });
+    }
+    if (resolved.ask.answered) return res.json({ dismissed: false, id: askId, outcome: 'answered', idempotent: true });
+    if (resolved.ask.dismissed) return res.json({ dismissed: true, id: askId, outcome: 'dismissed', idempotent: true });
     const out = deps.answerService.dismiss(askId);
     if (!out.ok) {
       if (out.reason === 'unknown') return res.status(404).json({ error: 'ask inesistente' });
-      if (out.reason === 'answering') return res.status(409).json({ error: 'risposta in corso: non si scarta un ask in answering' });
-      return res.status(500).json({ error: 'dismiss non riuscito' });
+      if (['answering', 'delivery-unknown-block'].includes(out.reason)) return res.status(409).json({ error: out.error || 'ask cannot be dismissed', reason: out.reason });
+      return res.status(out.code || 500).json({ error: out.error || 'dismiss failed', reason: out.reason });
     }
     if (out.closure) { try { await out.closure; } catch (_) {} }
-    return res.json({ dismissed: true, id: askId, idempotent: out.idempotent === true });
+    return res.json({ dismissed: true, id: askId, outcome: 'dismissed', idempotent: out.idempotent === true });
   });
 
   r.get('/:id/requests/:requestId', async (req, res) => {

package/lib/notify/event-feed-client.js

@@ -88,6 +88,8 @@ function createEventFeedClient(opts = {}) {
     : MIN_SNAPSHOT_INTERVAL_MS;
   // ownerId -> view state {cursor, generation, asks, notifications, fleetState,
   //   stale, lastError}; generation guards against obsolete fetches.
+  const isAskDismissed = typeof opts.isAskDismissed === 'function' ? opts.isAskDismissed : () => false;
+  const visibleAsks = (ownerId, asks) => asks.filter(ask => !isAskDismissed(ownerId, ask));
   const views = new Map();
   const running = new Map(); // nodeId -> {abort}
   let stopped = false;
@@ -225,7 +227,7 @@ function createEventFeedClient(opts = {}) {
     // ask: the tombstone is what keeps it from coming back.
     view.asks = Array.isArray(snap.asks)
       ? snap.asks
-        .filter((a) => a && !askIsClosed(ownerId, a.ownerAskId || a.id, snap.viewEpoch))
+        .filter((a) => a && !askIsClosed(ownerId, a.ownerAskId || a.id, snap.viewEpoch) && !isAskDismissed(ownerId, a))
         .map((a) => ({ ...a, ownerId }))
       : [];
     view.notifications = Array.isArray(snap.notifications) ? snap.notifications.map((e) => ({ ...e, ownerId })) : [];
@@ -264,15 +266,19 @@ function createEventFeedClient(opts = {}) {
         eventId: envelope.eventId, ts: Date.now(),
       });
     } else if (f.type === 'ask') {
+      const ask = { id: f.askId, question: f.question, options: f.options, session: f.session, ts: f.ts,
+        ownerAskTs: Number.isSafeInteger(f.askTs) && f.askTs > 0 ? f.askTs : null, ownerId: envelope.ownerId };
+      if (isAskDismissed(envelope.ownerId, ask)) return false;
       opts.eventsHub.broadcast({ type: 'ask', ownerId: envelope.ownerId, eventId: envelope.eventId,
-        ask: { id: f.askId, question: f.question, options: f.options, session: f.session, ownerId: envelope.ownerId } });
+        ask });
     } else if (f.type === 'ask-closed') {
+      if (typeof opts.onAskClosed === 'function') opts.onAskClosed(envelope.ownerId, f.askId, f.outcome);
       // The owner says the ask is closed: the VIEW drops it too, not only the
       // UI, or the next state read hands the card back.
       const closedView = dropAskFromView(envelope.ownerId, f.askId);
       if (f.outcome === 'dismissed') noteAskClosed(envelope.ownerId, f.askId, closedView.viewEpoch);
       opts.eventsHub.broadcast({ type: f.outcome === 'dismissed' ? 'ask-dismissed' : 'ask-answered',
-        id: f.askId, ownerId: envelope.ownerId, eventId: envelope.eventId });
+        id: f.askId, ownerAskId: f.askId, ownerId: envelope.ownerId, eventId: envelope.eventId });
     } else if (f.type === 'file-notice') {
       // Stessa forma della consegna locale (lib/files/routes.js): il nome del
       // file e' SEMPRE nel corpo, con la caption quando c'e'. Prima l'importato
@@ -780,7 +786,7 @@ function createEventFeedClient(opts = {}) {
         lastError: v.lastError || null,
         ingressBlockedUntil: v.ingressBlockedUntil || null,
         ingressBlockReason: v.ingressBlockReason || null,
-        asks: v.asks, notifications: v.notifications, fleetState: v.fleetState,
+        asks: visibleAsks(ownerId, v.asks), notifications: v.notifications, fleetState: v.fleetState,
       })),
     };
   }

package/lib/notify/event-feed-producers.js

@@ -74,6 +74,7 @@ const PRODUCERS = {
       question: cleanStr(p.question, 3900) || '',
       ...(Array.isArray(p.options) ? { options: p.options.slice(0, 8).map((o) => cleanStr(o, 200) || '') } : {}),
       session: cleanStr(p.session, 128) || undefined,
+      ...(Number.isSafeInteger(p.askTs) && p.askTs > 0 ? { askTs: p.askTs } : {}),
       ts: typeof p.ts === 'number' ? p.ts : undefined,
     }),
   },

package/lib/notify/imported-dismissals.js

@@ -0,0 +1,106 @@
+'use strict';
+// Durable receiver-to-owner synchronization. No attempt may submit an answer.
+function createImportedDismissalDrainer({ store, relay, now = Date.now, random = Math.random,
+  setTimer = setTimeout, clearTimer = clearTimeout, intervalMs = 15000,
+  globalBudget = 4, ownerBudget = 1, budgetWindowMs = 60000, bindingForOwner = () => null, readonly = () => false, log = () => {} } = {}) {
+  const flights = new Set();
+  const globalHits = [];
+  const ownerHits = new Map();
+  let stopped = false;
+  let timer = null;
+  let running = null;
+  function defer(record, reason, blocked = false, retryAfterMs = 0) {
+    const attempts = (record.attempts || 0) + 1;
+    const delay = Math.max(retryAfterMs, Math.min(300000, 1000 * 2 ** Math.min(attempts, 9)) * (0.5 + random() * 0.5));
+    return store.updateImportedDismissal(record.ownerId, record.ownerAskId, {
+      syncState: blocked ? 'blocked' : 'pending', retryBinding: bindingForOwner(record.ownerId), attempts, lastReason: reason || 'owner-unreachable', nextRetryAt: now() + delay,
+    });
+  }
+  function rejected(record, result = {}) {
+    const reason = result.reason || 'owner-unreachable';
+    const transient = ['answering', 'delivery-unknown-block', 'reverse-slot-unverified', 'relay-deadline', 'owner-unreachable', 'federation-peer-unreachable'];
+    const pending = transient.includes(reason) || result.code === 429 || result.code >= 500;
+    return defer(record, reason, !pending, result.retryAfterMs || 0);
+  }
+  function confirmed(record, outcome) {
+    return store.updateImportedDismissal(record.ownerId, record.ownerAskId, {
+      syncState: outcome === 'answered' ? 'confirmed-answered' : 'confirmed-dismissed', ownerOutcome: outcome, lastReason: null,
+    });
+  }
+  async function attempt(record) {
+    const key = `${record.ownerId}|${record.ownerAskId}`;
+    if (flights.has(key) || stopped || readonly()) return;
+    flights.add(key);
+    try {
+      let current = store.getImportedDismissal(record.ownerId, record.ownerAskId);
+      if (!current || current.syncState !== 'pending') return;
+      const result = await relay.inspectDismissal({ ownerId: record.ownerId, askId: record.ownerAskId });
+      if (stopped || readonly()) return;
+      current = store.getImportedDismissal(record.ownerId, record.ownerAskId);
+      if (!current || current.syncState !== 'pending' || current.dismissedTs !== record.dismissedTs) return;
+      if (!result.ok) { rejected(current, result); return; }
+      if (result.generationPrecondition !== true) { defer(current, 'unsupported', true); return; }
+      if (!result.ask || (result.ask.ownerAskId || result.ask.id) !== current.ownerAskId
+        || store.askFingerprint(result.ask) !== current.ownerAskFingerprint
+        || !Number.isSafeInteger(result.ask.ts) || result.ask.ts <= 0
+        || (current.generation === 'known' && current.ownerAskTs !== result.ask.ts)) {
+        defer(current, 'generation-mismatch', true); return;
+      }
+      const adopted = store.adoptImportedDismissal(current.ownerId, current.ownerAskId, result.ask);
+      if (!adopted.ok) { log(`dismissal adoption refused: ${adopted.reason}`); return; }
+      current = adopted.record;
+      if (['answered', 'dismissed'].includes(result.status)) { confirmed(current, result.status); return; }
+      if (result.status !== 'open') { rejected(current, { code: 409, reason: result.status || 'unknown' }); return; }
+      // The timestamp is durable before the request and checked atomically by
+      // the owner. A lost response leaves the record pending for reconciliation.
+      const out = await relay.relayDismiss({ ownerId: current.ownerId, askId: current.ownerAskId, expectedTs: current.ownerAskTs });
+      if (stopped || readonly()) return;
+      const latest = store.getImportedDismissal(current.ownerId, current.ownerAskId);
+      if (!latest || latest.syncState !== 'pending' || latest.dismissedTs !== current.dismissedTs) return;
+      if (out.ok && ['answered', 'dismissed'].includes(out.outcome)) confirmed(latest, out.outcome);
+      else rejected(latest, out.ok ? { code: 409, reason: 'unsupported' } : out);
+    } catch (error) {
+      const current = store.getImportedDismissal(record.ownerId, record.ownerAskId);
+      if (!stopped && current && current.syncState === 'pending') defer(current, 'owner-unreachable');
+      log(`dismissal synchronization failed: ${String(error.message || error)}`);
+    } finally { flights.delete(key); }
+  }
+  async function run() {
+    if (stopped || readonly()) return;
+    const t = now();
+    const prune = hits => { while (hits.length && hits[0] <= t - budgetWindowMs) hits.shift(); };
+    prune(globalHits);
+    for (const [ownerId, hits] of ownerHits) { prune(hits); if (!hits.length) ownerHits.delete(ownerId); }
+    for (let record of store.listImportedDismissals()) {
+      if (globalHits.length >= globalBudget) break;
+      if (record.syncState === 'blocked' && record.lastReason !== 'generation-mismatch') {
+        const binding = bindingForOwner(record.ownerId);
+        if (binding !== null && binding !== record.retryBinding) {
+          const resumed = store.updateImportedDismissal(record.ownerId, record.ownerAskId, { syncState: 'pending', nextRetryAt: 0, retryBinding: binding });
+          if (resumed.ok) record = resumed.record;
+        }
+      }
+      if (record.syncState !== 'pending' || (record.nextRetryAt || 0) > now()) continue;
+      const hits = ownerHits.get(record.ownerId) || [];
+      if (hits.length >= ownerBudget) continue;
+      hits.push(t); ownerHits.set(record.ownerId, hits); globalHits.push(t);
+      await attempt(record);
+    }
+  }
+  function drain() {
+    if (running) return running;
+    const flight = run().finally(() => { if (running === flight) running = null; });
+    running = flight;
+    return flight;
+  }
+  function schedule() {
+    if (stopped || timer) return;
+    timer = setTimer(() => { timer = null; void drain().catch(error => log(String(error.message || error))).finally(schedule); }, intervalMs);
+    if (timer && typeof timer.unref === 'function') timer.unref();
+  }
+  function start() { schedule(); void drain().catch(error => log(String(error.message || error))); }
+  function stop() { stopped = true; if (timer) clearTimer(timer); timer = null; }
+  function nudge() { if (!stopped) void drain().catch(error => log(String(error.message || error))); }
+  return { start, stop, drain, nudge };
+}
+module.exports = { createImportedDismissalDrainer };