@mmmbuto/nexuscrew 0.9.58 → 0.9.60

package/lib/notify/ask-relay.js

@@ -27,12 +27,13 @@ const OWNER_REASONS = new Set([
   'unknown', 'dismissed', 'answering', 'answered', 'store-unreadable',
   'delivery-unknown-block', 'already-delivered', 'paste-failed', 'bad-request-id',
   'no-receipts', 'request-conflict', 'receipt-cap', 'federation-peer-unreachable',
-  'federation-peer-timeout', 'federation-body-consumed',
+  'federation-peer-timeout', 'federation-body-consumed', 'generation-mismatch', 'invalid-generation', 'unsupported',
 ]);
 function safeReason(reason) { return OWNER_REASONS.has(reason) ? reason : undefined; }
 
-function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = () => {}, probeReverseSlotImpl = probeReverseSlot, peers = null, localPort = () => 0, localToken = () => '', nodesPath = null, slotVerifier = askSlotVerifier } = {}) {
+function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = () => {}, probeReverseSlotImpl = probeReverseSlot, peers = null, localPort = () => 0, localToken = () => '', nodesPath = null, availabilityBinding = () => null, slotVerifier = askSlotVerifier } = {}) {
   // (ownerId|askId|requestId) -> {state: 'sent'|'committed'|'failed'|'uncertain', requestId}
+  const channelObservations = new Map();
   const attempts = new Map();
   const answerFlights = new Map();
 
@@ -123,7 +124,7 @@ function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = ()
     return `http://127.0.0.1:${port}/federation/route/_/${path.replace(/^\//, '')}`;
   }
 
-  async function forward(candidate, path, { method = 'GET', body, op } = {}) {
+  async function forward(candidate, path, { method = 'GET', body, expectedTs, op } = {}) {
     op.check();
     const st = loadStore();
     slotVerifier.sync(st, proofScope);
@@ -143,7 +144,8 @@ function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = ()
       : { authorization: `Bearer ${candidate.forwardToken}`, 'x-nexuscrew-visited': st && st.nodeId || '' };
     try {
       op.check(); op.delivered = true;
-      const r = await op.wait(fetchImpl(url, { method, headers: { ...headers, 'content-type': 'application/json' },
+      const r = await op.wait(fetchImpl(url, { method, headers: { ...headers, 'content-type': 'application/json',
+        ...(expectedTs === undefined ? {} : { 'x-nexuscrew-ask-ts': String(expectedTs) }) },
         ...(body === undefined ? {} : { body: JSON.stringify(body) }), signal: op.controller.signal }));
       op.check();
       const payload = await op.wait(r.json().catch(error => {
@@ -290,7 +292,15 @@ function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = ()
   }
 
   // Remote dismiss: same resolution rules as the answer (DELETE on the owner).
-  async function relayDismissOnce({ ownerId, askId } = {}, op) {
+  function retryAfterMs(response) {
+    const value = response.headers?.get?.('retry-after');
+    if (typeof value !== 'string') return 0;
+    const seconds = /^\d+(?:\.\d+)?$/.test(value.trim()) ? Number(value) : null;
+    const delay = seconds === null ? Date.parse(value) - now() : seconds * 1000;
+    return Number.isFinite(delay) && delay > 0 ? delay : 0;
+  }
+
+  async function relayDismissOnce({ ownerId, askId, expectedTs } = {}, op) {
     const candidate = await candidateOwner(ownerId, op);
     if (!candidate) return { ok: false, code: 404, error: 'owner non tra i peer autorizzati', reason: 'owner-unknown' };
     if (candidate.kind === 'inbound-unverified') {
@@ -303,9 +313,9 @@ function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = ()
     const peer = candidate.node;
     const store = loadStore();
     try {
-      const { r, body } = await forward(candidate, `/event-feed/asks/${encodeURIComponent(askId)}`, { method: 'DELETE', op });
-      if (!r.ok) return { ok: false, code: r.status, error: 'owner refused', reason: body.reason };
-      return { ok: true };
+      const { r, body } = await forward(candidate, `/event-feed/asks/${encodeURIComponent(askId)}`, { method: 'DELETE', expectedTs, op });
+      if (!r.ok) return { ok: false, code: r.status, error: 'owner refused', reason: body.reason, retryAfterMs: retryAfterMs(r) };
+      return { ok: true, ...(body.outcome ? { outcome: body.outcome } : {}) };
     } catch (e) { if (!op.active()) return deadlineResult(op, { ownerId, askId }, false); return { ok: false, code: 502, reason: safeReason(e.reason), error: 'owner unreachable' }; }
   }
 
@@ -343,32 +353,72 @@ function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = ()
     const denied = (status, reason) => ({ ownerId, askId, canReply: false, status, ...(reason ? { reason } : {}) });
     const candidate = await candidateOwner(ownerId, op);
     if (!candidate) return denied('unreachable', 'owner-unknown');
-    if (candidate.kind === 'inbound-unverified') return denied('unreachable', 'reverse-slot-unverified');
+    if (candidate.kind === 'inbound-unverified') { op.channelUnavailable = true; return denied('unreachable', 'reverse-slot-unverified'); }
     if (candidate.kind === 'inbound') {
       const gate = await verifyInboundChannel(candidate, op);
-      if (!gate.ok) return denied('unreachable', gate.reason);
+      if (!gate.ok) { op.channelUnavailable = true; return denied('unreachable', gate.reason); }
     }
     try {
       const { r, body } = await forward(candidate, `/event-feed/asks/${encodeURIComponent(askId)}/capability`, { op });
-      if (body.reason === 'reverse-slot-unverified') return denied('unreachable', body.reason);
+      if (['reverse-slot-unverified', 'federation-peer-unreachable', 'federation-peer-timeout'].includes(body.reason)) { op.channelUnavailable = true; return denied('unreachable', body.reason); }
       if (r.status === 404 || r.status === 501) return denied('unsupported', body.reason);
       if (r.status === 403) return denied('denied', body.reason);
       if (!r.ok || body.ownerId !== ownerId || body.askId !== askId || typeof body.canReply !== 'boolean'
         || !['open', 'denied', 'answered', 'dismissed'].includes(body.status)
         || (body.canReply && body.status !== 'open')) return denied('unreachable');
       return { ownerId, askId, canReply: body.canReply, status: body.status };
-    } catch (_) { return denied('unreachable', op.active() ? undefined : 'relay-deadline'); }
+    } catch (_) { op.channelUnavailable = true; return denied('unreachable', op.active() ? undefined : 'relay-deadline'); }
+  }
+
+  async function inspectDismissalOnce({ ownerId, askId } = {}, op) {
+    const candidate = await candidateOwner(ownerId, op);
+    if (!candidate) return { ok: false, code: 404, reason: 'owner-unknown' };
+    if (candidate.kind === 'inbound-unverified') return { ok: false, code: 404, reason: 'reverse-slot-unverified' };
+    if (candidate.kind === 'inbound') {
+      const proof = await verifyInboundChannel(candidate, op);
+      if (!proof.ok) return proof;
+    }
+    const { r, body } = await forward(candidate, `/event-feed/asks/${encodeURIComponent(askId)}/capability`, { op });
+    if (!r.ok) return { ok: false, code: r.status, reason: body.reason || 'unknown', retryAfterMs: retryAfterMs(r) };
+    if (body.ownerId !== ownerId || body.askId !== askId || !['open', 'answered', 'dismissed'].includes(body.status)) {
+      return { ok: false, code: 403, reason: 'unknown' };
+    }
+    if (body.generationPrecondition !== true) return { ok: false, code: 501, reason: 'unsupported' };
+    const ask = body.ask;
+    if (!ask || ask.id !== askId || !Number.isSafeInteger(ask.ts) || ask.ts <= 0
+      || typeof ask.question !== 'string' || typeof ask.session !== 'string'
+      || (ask.options !== undefined && (!Array.isArray(ask.options) || ask.options.some(option => typeof option !== 'string')))) {
+      return { ok: false, code: 409, reason: 'generation-mismatch' };
+    }
+    return { ok: true, status: body.status, ask, generationPrecondition: true };
   }
+  function inspectDismissal(args = {}) { return operation(args, op => inspectDismissalOnce(args, op)); }
 
   function relayDismiss(args = {}) { return operation(args, op => relayDismissOnce(args, op)); }
   function verifyStatus(args = {}) { return operation(args, op => verifyStatusOnce(args, op)); }
-  function replyCapability(args = {}) { return operation(args, op => replyCapabilityOnce(args, op), true); }
+  function channelBinding(ownerId) {
+    const store = loadStore();
+    // Kept only in process memory; credentials never enter the dismissal store.
+    return crypto.createHash('sha256').update(JSON.stringify([store, availabilityBinding(ownerId)])).digest('hex');
+  }
+  function channelState(ownerId) {
+    const observation = channelObservations.get(ownerId);
+    return { unavailable: !!(observation && now() - observation.at < 30000 && observation.binding === channelBinding(ownerId) && observation.unavailable) };
+  }
+  function replyCapability(args = {}) {
+    const initial = channelBinding(args.ownerId);
+    return operation(args, async op => {
+      const result = await replyCapabilityOnce(args, op);
+      channelObservations.set(args.ownerId, { at: now(), binding: initial, unavailable: op.channelUnavailable === true });
+      return result;
+    }, true);
+  }
 
   function state() {
     return [...attempts.entries()].map(([key, a]) => ({ key, ...a }));
   }
 
-  return { relayAnswer, relayDismiss, verifyStatus, replyCapability, state, isUncertain, requestId };
+  return { channelState, inspectDismissal, relayAnswer, relayDismiss, verifyStatus, replyCapability, state, isUncertain, requestId };
 }
 
 module.exports = { createAskRelay };

package/lib/notify/asks.js

@@ -17,6 +17,22 @@ const MAX_OPEN = 100;
 // che arrivano da un peer e quelle poste da questo nodo sono due classi
 // distinte, e le prime non devono poter esaurire il budget delle seconde.
 const MAX_OPEN_IMPORTED = 100;
+const MAX_IMPORTED_DISMISSALS = 1000;
+const SYNC_STATES = new Set(['pending', 'confirmed-dismissed', 'confirmed-answered', 'blocked']);
+function askFingerprint(ask) {
+  return crypto.createHash('sha256').update(JSON.stringify([String(ask.question || ''), Array.isArray(ask.options) ? ask.options : [], String(ask.session || '')])).digest('hex');
+}
+function validDismissals(value) {
+  return value && typeof value === 'object' && !Array.isArray(value) && Object.entries(value).every(([key, r]) =>
+    r && key === `${r.ownerId}|${r.ownerAskId}` && /^[a-f0-9]{32}$/.test(r.ownerId) && /^[a-f0-9]{8}$/.test(r.ownerAskId)
+    && /^[a-f0-9]{64}$/.test(r.ownerAskFingerprint) && SYNC_STATES.has(r.syncState)
+    && ['known', 'unknown'].includes(r.generation)
+    && (r.generation === 'unknown' ? r.ownerAskTs === null : Number.isSafeInteger(r.ownerAskTs) && r.ownerAskTs > 0)
+    && (r.cellId === undefined || (typeof r.cellId === 'string' && /^[A-Za-z0-9._-]{1,32}$/.test(r.cellId)))
+    && r.dismissed === true && Number.isSafeInteger(r.attempts) && r.attempts >= 0
+    && Number.isFinite(r.nextRetryAt) && r.nextRetryAt >= 0
+    && r.dismissedReason === 'owner-unreachable' && Number.isFinite(r.dismissedTs));
+}
 const MAX_KEEP = 100;          // ask totali persistiti (i piu' vecchi answered si potano)
 const MAX_QUESTION = 2000;
 const MAX_OPTIONS = 8;
@@ -39,11 +55,14 @@ function createAsksStore(opts = {}) {
   //    per non sovrascrivere il file malformato con un defaults vuoto, che
   //    cancellerebbe le domande aperte.
   let asks = null;
+  let importedDismissals = null;
+  const dismissalCap = opts.maxImportedDismissals || MAX_IMPORTED_DISMISSALS;
   function load() {
     if (asks) return asks;
     const r = readJsonStrict(filePath);
-    if (r.state === 'absent') { asks = []; return asks; }
-    if (r.state === 'ok' && Array.isArray(r.value.asks)) {
+    if (r.state === 'absent') { asks = []; importedDismissals = {}; return asks; }
+    if (r.state === 'ok' && Array.isArray(r.value.asks) && (r.value.importedDismissals === undefined || validDismissals(r.value.importedDismissals))) {
+      importedDismissals = r.value.importedDismissals || {};
       asks = r.value.asks.filter((a) => a && typeof a === 'object' && typeof a.id === 'string');
       return asks;
     }
@@ -58,7 +77,8 @@ function createAsksStore(opts = {}) {
     if (asks) return { readable: true };
     const r = readJsonStrict(filePath);
     if (r.state === 'absent') return { readable: true };
-    if (r.state === 'ok' && Array.isArray(r.value.asks)) return { readable: true };
+    if (r.state === 'ok' && Array.isArray(r.value.asks) && (r.value.importedDismissals === undefined || validDismissals(r.value.importedDismissals))) return { readable: true };
+    if (r.state === 'ok' && r.value.importedDismissals !== undefined && !validDismissals(r.value.importedDismissals)) return { readable: false, reason: 'malformed imported dismissals' };
     const reason = r.state === 'malformed'
       ? r.reason
       : `forma invalida: 'asks' non e' un array (${r.value && r.value.asks !== undefined ? typeof r.value.asks : 'assente'})`;
@@ -86,7 +106,7 @@ function createAsksStore(opts = {}) {
       const drop = new Set(answered.slice(0, excess).map((a) => a.id));
       asks = list.filter((a) => !drop.has(a.id));
     }
-    atomicWriteJson(filePath, { asks: load() });
+    atomicWriteJson(filePath, { asks: load(), importedDismissals: importedDismissals || {} });
   }
 
   // Validazione input fail-closed. Ritorna {ok:false,error} o {ok:true,value}.
@@ -121,17 +141,28 @@ function createAsksStore(opts = {}) {
   // L'`id` locale e' nostro e all'owner non dice nulla; e' la coppia che nomina
   // lo STESSO oggetto sui due nodi, quindi e' la chiave con cui si riconcilia.
   function findImported(ownerId, ownerAskId) {
-    return load().find((a) => isImported(a) && a.ownerId === String(ownerId)
+    return load().slice().reverse().find((a) => isImported(a) && a.ownerId === String(ownerId)
       && a.ownerAskId === String(ownerAskId)) || null;
   }
 
   // Chiusura dell'alias locale quando l'OWNER chiude la domanda. Durevole: la
   // riga resta nello storico marcata, quindi non ricompare a un reload e non
   // torna risponibile.
-  function closeImported({ ownerId, ownerAskId, outcome }) {
+  function closeImported({ ownerId, ownerAskId, ownerAskTs, outcome }) {
     const ur = unreadableGuard();
     if (ur) return { ok: false, reason: 'store-unreadable', changed: false, ask: null };
     const ask = findImported(ownerId, ownerAskId);
+    const record = getImportedDismissal(ownerId, ownerAskId);
+    // Known closure generations cannot mutate a newer alias or dismissal receipt.
+    const closureTs = Number.isSafeInteger(ownerAskTs) && ownerAskTs > 0 ? ownerAskTs : null;
+    const recordMismatch = closureTs && record && record.ownerAskTs && record.ownerAskTs !== closureTs;
+    if ((closureTs && ask && generationTs(ask) && generationTs(ask) !== closureTs) || (!ask && recordMismatch)) {
+      return { ok: true, changed: false, ask: null, generationMismatch: true };
+    }
+    if (record && !recordMismatch) {
+      const synced = updateImportedDismissal(ownerId, ownerAskId, { syncState: outcome === 'answered' ? 'confirmed-answered' : 'confirmed-dismissed', ownerOutcome: outcome });
+      if (!synced.ok) return { ...synced, changed: false, ask: null };
+    }
     if (!ask) return { ok: true, changed: false, ask: null };
     if (ask.answered || ask.dismissed) return { ok: true, changed: false, ask };
     if (outcome === 'answered') { ask.answered = true; ask.answeredReconciled = true; }
@@ -141,7 +172,7 @@ function createAsksStore(opts = {}) {
     return { ok: true, changed: true, ask };
   }
 
-  function create({ question, options, session, ownerId, ownerAskId, originNode, originCell }) {
+  function create({ question, options, session, ownerId, ownerAskId, originNode, originCell, ownerAskTs }) {
     const ur = unreadableGuard();
     if (ur) return { ok: false, reason: 'store-unreadable', error: `store illeggibile (${ur}): creazione rifiutata` };
     const v = validate({ question, options });
@@ -152,7 +183,12 @@ function createAsksStore(opts = {}) {
     // se ne crea un secondo.
     if (originNode && ownerId && ownerAskId) {
       const existing = findImported(ownerId, ownerAskId);
-      if (existing) return { ok: true, ask: existing, deduped: true };
+      const incoming = { id: ownerAskId, question: v.value.question, options: v.value.options, session: String(session || ''), originNode, ownerAskTs };
+      if (isImportedDismissed(ownerId, incoming)) return { ok: true, ask: existing, suppressed: true, deduped: !!existing };
+      if (existing && askFingerprint(existing) === askFingerprint(incoming)
+        && (generationTs(existing) === null || generationTs(incoming) === null || generationTs(existing) === generationTs(incoming))) {
+        return { ok: true, ask: existing, deduped: true };
+      }
     }
     // Cap duro sugli aperti, SEPARATO PER CLASSE: gli importati non consumano il
     // budget dei locali. Con un cap unico, cento domande ricevute da un peer
@@ -188,6 +224,7 @@ function createAsksStore(opts = {}) {
       // ri-esportato (nessun loop A->B->A). Un ask locale non ha questo campo.
       ...(originNode ? { originNode: String(originNode) } : {}),
       ...(originCell ? { originCell: String(originCell) } : {}),
+      ...(Number.isSafeInteger(ownerAskTs) && ownerAskTs > 0 ? { ownerAskTs } : {}),
       ts: now(),
       revision: 0,
       answered: false,
@@ -208,6 +245,83 @@ function createAsksStore(opts = {}) {
       .map((a) => ({ ...a, ...(a.options ? { options: a.options.slice() } : {}) }));
   }
 
+  function getImportedDismissal(ownerId, askId) {
+    load();
+    const record = importedDismissals && importedDismissals[`${ownerId}|${askId}`];
+    return record ? { ...record } : null;
+  }
+  function listImportedDismissals() {
+    load();
+    return Object.values(importedDismissals || {}).map(r => ({ ...r }));
+  }
+  function generationTs(ask) {
+    const ts = Object.hasOwn(ask, 'ownerAskTs') ? ask.ownerAskTs : ask.originNode ? null : ask.ts;
+    return Number.isSafeInteger(ts) && ts > 0 ? ts : null;
+  }
+  function sameImportedGeneration(a, b) {
+    const at = generationTs(a), bt = generationTs(b);
+    return askFingerprint(a) === askFingerprint(b) && (at === null || bt === null || at === bt);
+  }
+  function isImportedDismissed(ownerId, ask) {
+    const record = getImportedDismissal(ownerId, ask.ownerAskId || ask.id);
+    if (!record || record.ownerAskFingerprint !== askFingerprint(ask)) return false;
+    // Historical imports have no original owner timestamp. Reusing an id with
+    // identical content remains suppressed; this is not proof of historical identity.
+    const ts = generationTs(ask);
+    return record.generation === 'unknown' || ts === null || record.ownerAskTs === ts;
+  }
+  function dismissalTransaction(change) {
+    const ur = unreadableGuard();
+    if (ur) return { ok: false, reason: 'store-unreadable' };
+    load();
+    const beforeAsks = asks.map(a => ({ ...a }));
+    const beforeRecords = Object.fromEntries(Object.entries(importedDismissals).map(([k, r]) => [k, { ...r }]));
+    try { const result = change(); if (!result.ok) return result; save(); return result; }
+    catch (_) { asks = beforeAsks; importedDismissals = beforeRecords; return { ok: false, reason: 'persist-failed' }; }
+  }
+  function dismissImported({ ownerId, ownerAskId, ask, cellId, retryBinding, syncState = 'pending' } = {}) {
+    return dismissalTransaction(() => {
+      if (!/^[a-f0-9]{32}$/.test(ownerId) || !/^[a-f0-9]{8}$/.test(ownerAskId) || !ask || (ask.ownerAskId || ask.id) !== ownerAskId) return { ok: false, reason: 'unknown' };
+      const candidate = findImported(ownerId, ownerAskId);
+      const alias = candidate && sameImportedGeneration(candidate, ask) ? candidate : null;
+      if (alias && answering.has(alias.id)) return { ok: false, reason: 'answering' };
+      if (ask.answered || (alias && alias.answered)) return { ok: false, reason: 'answered' };
+      const key = `${ownerId}|${ownerAskId}`;
+      const existing = importedDismissals[key];
+      if (existing && isImportedDismissed(ownerId, ask)) return { ok: true, record: { ...existing }, idempotent: true };
+      if (!existing && Object.keys(importedDismissals).length >= dismissalCap) return { ok: false, reason: 'dismissal-cap' };
+      const ts = generationTs(ask);
+      const record = { ownerId, ownerAskId, ...(cellId ? { cellId } : {}), ...(alias ? { localAliasId: alias.id } : {}),
+        dismissed: true, dismissedReason: 'owner-unreachable', dismissedTs: now(),
+        generation: ts === null ? 'unknown' : 'known', ownerAskTs: ts,
+        ownerAskFingerprint: askFingerprint(ask), syncState, attempts: 0, nextRetryAt: 0,
+        ...(syncState === 'blocked' ? { lastReason: 'permission-denied', ...(retryBinding ? { retryBinding } : {}) } : {}) };
+      importedDismissals[key] = record;
+      if (alias) {
+        if (!alias.dismissed) { alias.dismissed = true; alias.dismissedTs = now(); alias.revision = (alias.revision || 0) + 1; }
+        alias.dismissedReason = 'owner-unreachable';
+      }
+      return { ok: true, record: { ...record } };
+    });
+  }
+  function updateImportedDismissal(ownerId, askId, patch) {
+    return dismissalTransaction(() => {
+      const record = importedDismissals[`${ownerId}|${askId}`];
+      if (!record) return { ok: false, reason: 'unknown' };
+      const next = { ...record, ...patch };
+      if (!validDismissals({ [`${ownerId}|${askId}`]: next })) return { ok: false, reason: 'invalid' };
+      importedDismissals[`${ownerId}|${askId}`] = next;
+      return { ok: true, record: { ...next } };
+    });
+  }
+  function adoptImportedDismissal(ownerId, askId, ask) {
+    const record = getImportedDismissal(ownerId, askId);
+    const ts = generationTs(ask);
+    if (!record || (ask.ownerAskId || ask.id) !== askId || ts === null || record.ownerAskFingerprint !== askFingerprint(ask)
+      || (record.generation === 'known' && record.ownerAskTs !== ts)) return { ok: false, reason: 'generation-mismatch' };
+    return updateImportedDismissal(ownerId, askId, { generation: 'known', ownerAskTs: ts });
+  }
+
   // --- ciclo answer (da revisione): claim atomico open -> answering ---------------
   // Node e' single-threaded ma il paste e' un await: due answer concorrenti
   // superavano entrambe il check `answered` prima che una marcasse. Il claim
@@ -301,7 +415,7 @@ function createAsksStore(opts = {}) {
     return commit(id, text);
   }
 
-  return { create, get, list, openCount, isImported, findImported, closeImported, claim, release, commit, markAnswered, markReconciled, isAnswering, dismiss, validate, health, filePath, MAX_OPEN, MAX_OPEN_IMPORTED };
+  return { sameImportedGeneration, dismissImported, getImportedDismissal, listImportedDismissals, isImportedDismissed, updateImportedDismissal, adoptImportedDismissal, askFingerprint, create, get, list, openCount, isImported, findImported, closeImported, claim, release, commit, markAnswered, markReconciled, isAnswering, dismiss, validate, health, filePath, MAX_OPEN, MAX_OPEN_IMPORTED };
 }
 
-module.exports = { createAsksStore };
+module.exports = { createAsksStore, askFingerprint };

package/lib/notify/closure-retry.js

@@ -93,7 +93,7 @@ function createClosureRetryQueue({
     // riceve una seconda consegna inutile.
     const targets = [...entry.targets];
     try {
-      results = await run({ askId: entry.askId, outcome: entry.outcome, session: entry.session, targets });
+      results = await run({ askId: entry.askId, ...(entry.ownerAskTs ? { ownerAskTs: entry.ownerAskTs } : {}), outcome: entry.outcome, session: entry.session, targets });
     } catch (e) {
       results = targets.map((target) => ({ target, status: 'unknown', reason: 'dispatch-threw' }));
       try { log(`chiusura ask ${entry.askId}: tentativo fallito (${String(e && e.message || e)})`); } catch (_) {}
@@ -129,11 +129,12 @@ function createClosureRetryQueue({
   // stessa chiusura UNISCE i target invece di essere buttata via: e' cio' che
   // impedisce a un peer spento di sparire dalla coda quando un ALTRO peer
   // risponde, o quando la stessa chiusura viene riprovata piu' tardi.
-  function enqueue({ askId, outcome, session, targets } = {}) {
+  function enqueue({ askId, ownerAskTs, outcome, session, targets } = {}) {
     if (stopped || !askId || !outcome) return { ok: false, reason: 'invalid' };
     const nuovi = [...new Set((Array.isArray(targets) ? targets : []).map((t) => String(t)).filter(Boolean))];
     if (!nuovi.length) return { ok: false, reason: 'no-targets' };
-    const existing = entries.find((e) => e.askId === askId && e.outcome === outcome);
+    const generation = Number.isSafeInteger(ownerAskTs) && ownerAskTs > 0 ? ownerAskTs : null;
+    const existing = entries.find((e) => e.askId === askId && e.outcome === outcome && (e.ownerAskTs || null) === generation);
     if (existing) {
       const prima = existing.targets.size;
       for (const t of nuovi) existing.targets.add(t);
@@ -148,7 +149,7 @@ function createClosureRetryQueue({
       try { log(`coda chiusure piena (${maxEntries}): scartata la piu' vecchia (${oldest.askId})`); } catch (_) {}
     }
     const entry = {
-      askId, outcome, session, targets: new Set(nuovi),
+      askId, ...(generation ? { ownerAskTs: generation } : {}), outcome, session, targets: new Set(nuovi),
       attempts: 0, createdAt: now(), nextAt: 0, timer: null, inFlight: false,
     };
     entries.push(entry);

package/lib/notify/event-feed-asks-routes.js

@@ -102,7 +102,9 @@ function createEventFeedAsksRoutes(deps) {
     const readonly = deps.readonly && deps.readonly();
     const status = !resolved || readonly ? 'denied'
       : resolved.ask.dismissed ? 'dismissed' : resolved.ask.answered ? 'answered' : 'open';
-    return res.json({ ownerId: g.self, askId, canReply: status === 'open', status });
+    return res.json({ ownerId: g.self, askId, canReply: status === 'open', status,
+      ...(resolved && !readonly ? { generationPrecondition: true, ask: { id: resolved.ask.id, ts: resolved.ask.ts, question: resolved.ask.question,
+        ...(resolved.ask.options ? { options: resolved.ask.options } : {}), session: resolved.ask.session } } : {}) });
   });
 
   r.post('/:id/answer', json, async (req, res) => {
@@ -157,15 +159,26 @@ function createEventFeedAsksRoutes(deps) {
     const askId = String(req.params.id || '');
     const resolved = resolveAskForPeer(g.peer, askId);
     if (!resolved) return res.status(404).json({ error: 'ask inesistente' });
-    // Local answer in flight wins: 409, and a dismissed ask is not answerable.
+    const expected = req.headers['x-nexuscrew-ask-ts'];
+    if (expected !== undefined && (typeof expected !== 'string' || !/^[1-9][0-9]{0,15}$/.test(expected)
+      || !Number.isSafeInteger(Number(expected)))) {
+      return res.status(400).json({ error: 'invalid generation precondition', reason: 'invalid-generation' });
+    }
+    // Keep the generation and terminal guards next to the synchronous service:
+    // authorization may await, but no yield is allowed between this check and dismiss.
+    if (expected !== undefined && resolved.ask.ts !== Number(expected)) {
+      return res.status(409).json({ error: 'ask generation changed', reason: 'generation-mismatch' });
+    }
+    if (resolved.ask.answered) return res.json({ dismissed: false, id: askId, outcome: 'answered', idempotent: true });
+    if (resolved.ask.dismissed) return res.json({ dismissed: true, id: askId, outcome: 'dismissed', idempotent: true });
     const out = deps.answerService.dismiss(askId);
     if (!out.ok) {
       if (out.reason === 'unknown') return res.status(404).json({ error: 'ask inesistente' });
-      if (out.reason === 'answering') return res.status(409).json({ error: 'risposta in corso: non si scarta un ask in answering' });
-      return res.status(500).json({ error: 'dismiss non riuscito' });
+      if (['answering', 'delivery-unknown-block'].includes(out.reason)) return res.status(409).json({ error: out.error || 'ask cannot be dismissed', reason: out.reason });
+      return res.status(out.code || 500).json({ error: out.error || 'dismiss failed', reason: out.reason });
     }
     if (out.closure) { try { await out.closure; } catch (_) {} }
-    return res.json({ dismissed: true, id: askId, idempotent: out.idempotent === true });
+    return res.json({ dismissed: true, id: askId, outcome: 'dismissed', idempotent: out.idempotent === true });
   });
 
   r.get('/:id/requests/:requestId', async (req, res) => {