@mmmbuto/nexuscrew 0.9.58 → 0.9.60

package/lib/notify/event-feed-client.js

@@ -88,6 +88,8 @@ function createEventFeedClient(opts = {}) {
     : MIN_SNAPSHOT_INTERVAL_MS;
   // ownerId -> view state {cursor, generation, asks, notifications, fleetState,
   //   stale, lastError}; generation guards against obsolete fetches.
+  const isAskDismissed = typeof opts.isAskDismissed === 'function' ? opts.isAskDismissed : () => false;
+  const visibleAsks = (ownerId, asks) => asks.filter(ask => !isAskDismissed(ownerId, ask));
   const views = new Map();
   const running = new Map(); // nodeId -> {abort}
   let stopped = false;
@@ -148,23 +150,29 @@ function createEventFeedClient(opts = {}) {
 
   function askTombstoneKey(ownerId, askId) { return `${ownerId}|${askId}`; }
 
-  function noteAskClosed(ownerId, askId, epoch) {
+  function noteAskClosed(ownerId, askId, epoch, ownerAskTs, ask) {
     if (!ownerId || !askId) return;
-    askTombstones.set(askTombstoneKey(ownerId, askId), { at: now(), epoch });
+    askTombstones.set(askTombstoneKey(ownerId, askId), { at: now(), epoch, ownerAskTs,
+      fingerprint: ask && ask.question !== undefined ? JSON.stringify([ask.question, ask.options || [], ask.session]) : null });
+    if (askTombstones.size > 4096) askTombstones.delete(askTombstones.keys().next().value);
   }
 
-  function askIsClosed(ownerId, askId, epoch) {
+  function askIsClosed(ownerId, askId, epoch, ask) {
     const key = askTombstoneKey(ownerId, askId);
     const hit = askTombstones.get(key);
     if (!hit) return false;
     if (now() - hit.at > ASK_TOMBSTONE_TTL_MS) { askTombstones.delete(key); return false; }
     if (typeof hit.epoch === 'number' && typeof epoch === 'number' && hit.epoch !== epoch) return false;
+    const ts = ask && (Object.hasOwn(ask, 'ownerAskTs') ? ask.ownerAskTs : ask.ts);
+    if (Number.isSafeInteger(hit.ownerAskTs) && hit.ownerAskTs > 0 && Number.isSafeInteger(ts) && ts > 0 && hit.ownerAskTs !== ts) return false;
+    if (!hit.ownerAskTs && hit.fingerprint !== null && ask && hit.fingerprint !== JSON.stringify([ask.question, ask.options || [], ask.session])) return false;
     return true;
   }
 
   function dropAskFromView(ownerId, askId) {
     const view = viewFor(ownerId);
     view.asks = view.asks.filter((a) => (a.ownerAskId || a.id) !== askId);
+    if (view.alertAsks) view.alertAsks.delete(askId);
     return view;
   }
 
@@ -225,14 +233,16 @@ function createEventFeedClient(opts = {}) {
     // ask: the tombstone is what keeps it from coming back.
     view.asks = Array.isArray(snap.asks)
       ? snap.asks
-        .filter((a) => a && !askIsClosed(ownerId, a.ownerAskId || a.id, snap.viewEpoch))
+        .filter((a) => a && !askIsClosed(ownerId, a.ownerAskId || a.id, snap.viewEpoch, a) && !isAskDismissed(ownerId, a))
         .map((a) => ({ ...a, ownerId }))
       : [];
+    view.alertAsks = new Map(); // fresh snapshot replaces all live-only alert sources
     view.notifications = Array.isArray(snap.notifications) ? snap.notifications.map((e) => ({ ...e, ownerId })) : [];
     view.fleetState = snap.fleetState || null;
     view.askReplyAccess = snap.askReplyAccess === true;
     view.viewEpoch = snap.viewEpoch;
     view.stale = false;
+    if (typeof opts.onAuthoritativeAsks === 'function') opts.onAuthoritativeAsks(ownerId, view.asks);
     // Lo snapshot fresco è la guarigione visibile: stale torna falso e
     // l'ultimo errore cessa di essere mostrato. Lo streak NON si tocca qui:
     // il conto dei reset misura i round SENZA frame sano, e ogni round di
@@ -240,9 +250,70 @@ function createEventFeedClient(opts = {}) {
     // tappo anti-reset. Lo sblocco dello streak sta alla scadenza del cooldown.
     view.lastError = null;
     view.generation = gen;
+    if (typeof opts.onViewChanged === 'function') {
+      try { opts.onViewChanged(ownerId); } catch (_) { /* UI refresh cannot invalidate the applied view. */ }
+    }
     return true;
   }
 
+  // Both authenticated ingress paths must update the same exported owner
+  // collection. Recording a fan-out ASK neither publishes nor fabricates a
+  // feed cursor; the next genuinely new owner snapshot can replace it.
+  function rememberLiveAsk(ownerId, source) {
+    const askId = source.ownerAskId || source.id;
+    const ask = { ...source, id: askId, ownerId,
+      ownerAskTs: Object.hasOwn(source, 'ownerAskTs') ? source.ownerAskTs : source.ts };
+    const view = viewFor(ownerId);
+    if (isAskDismissed(ownerId, ask)
+      || askIsClosed(ownerId, askId, view.viewEpoch, ask)) return null;
+    // The exported collection must follow both ingress paths, even when the
+    // feed cursor has not yet advanced, or a cache falsely certifies absence.
+    const currentIndex = view.asks.findIndex(a => (a.ownerAskId || a.id) === askId);
+    const current = currentIndex >= 0 ? view.asks[currentIndex] : null;
+    const currentTs = current && (Object.hasOwn(current, 'ownerAskTs') ? current.ownerAskTs : current.ts);
+    if (current && Number.isSafeInteger(currentTs) && currentTs > 0
+      && (!ask.ownerAskTs || ask.ownerAskTs < currentTs)) return null;
+    if (currentIndex >= 0) view.asks[currentIndex] = ask;
+    else if (view.asks.length < SNAPSHOT_MAX_ASKS) view.asks.push(ask);
+    else {
+      // Never certify an incomplete collection or silently evict a card.
+      view.stale = true; view.lastError = 'snapshot-asks-cap';
+    }
+    if (!view.stale) {
+      if (!view.alertAsks) view.alertAsks = new Map();
+      view.alertAsks.delete(askId); view.alertAsks.set(askId, ask);
+      while (view.alertAsks.size > SNAPSHOT_MAX_ASKS) view.alertAsks.delete(view.alertAsks.keys().next().value);
+    }
+    view.liveAskRevision = (view.liveAskRevision || 0) + 1;
+    return ask;
+  }
+
+  // An authenticated owner closure (fan-out frame or feed envelope) lands on
+  // the SAME exported view the live ask entered — whether or not the store
+  // alias changed. The key is canonical (ownerId, ownerAskId); a closure of a
+  // different generation closes nothing. The tombstone blocks the CLOSED
+  // generation for both outcomes, and the revision bump rejects a snapshot
+  // acquisition that started before the closure: an anterior read must never
+  // certify the card back.
+  function applyOwnerClosure(ownerId, ownerAskId, { ownerAskTs, outcome, ask } = {}) {
+    if (!ownerId || !ownerAskId) return { applied: false };
+    const view = viewFor(ownerId);
+    const current = view.asks.find((a) => (a.ownerAskId || a.id) === ownerAskId)
+      || (view.alertAsks && view.alertAsks.get(ownerAskId)) || null;
+    const currentTs = current && (Object.hasOwn(current, 'ownerAskTs') ? current.ownerAskTs : current.ts);
+    const closureTs = Number.isSafeInteger(ownerAskTs) && ownerAskTs > 0 ? ownerAskTs : null;
+    if (closureTs && Number.isSafeInteger(currentTs) && currentTs > 0 && currentTs !== closureTs) {
+      return { applied: false, mismatch: true };
+    }
+    dropAskFromView(ownerId, ownerAskId);
+    noteAskClosed(ownerId, ownerAskId, view.viewEpoch, closureTs || undefined, current || ask);
+    view.liveAskRevision = (view.liveAskRevision || 0) + 1;
+    if (typeof opts.onViewChanged === 'function') {
+      try { opts.onViewChanged(ownerId); } catch (_) { /* UI refresh cannot invalidate the closure. */ }
+    }
+    return { applied: true };
+  }
+
   // Local re-emission of ONE imported envelope: attributed to the owner, into
   // the local SSE hub only. The hub is the browser-facing surface — this call
   // deliberately bypasses the notifier so the imported event can never be
@@ -254,25 +325,59 @@ function createEventFeedClient(opts = {}) {
     if (!envelope.frame || envelope.hop !== 1) return false;
     const f = envelope.frame;
     if (f.type === 'notify') {
+      const { canonicalAskAlert, alertFields } = require('./ask-alert-identity.js');
+      let alertFrame = { ...f, ownerId: envelope.ownerId };
+      let historicalAsk = null;
+      if (f.askId && !canonicalAskAlert(alertFrame)) {
+        const view = views.get(envelope.ownerId);
+        // A legacy notification has no generation. Only a fresh full owner
+        // ASK can supply its fingerprint; emission time never supplies a ts.
+        const source = view && !view.stale && ((view.alertAsks && view.alertAsks.get(f.askId)) || view.asks.find(a => a.id === f.askId));
+        historicalAsk = source && source.question === f.body ? source : null;
+        if (historicalAsk) {
+          const ownerAskTs = historicalAsk.ownerAskTs === undefined ? historicalAsk.ts : historicalAsk.ownerAskTs;
+          alertFrame = { ...alertFrame, ownerAskFingerprint: require('./asks.js').askFingerprint(historicalAsk),
+            ...(Number.isSafeInteger(ownerAskTs) && ownerAskTs > 0 ? { ownerAskTs } : {}) };
+          if (typeof opts.onAuthoritativeAsks === 'function') opts.onAuthoritativeAsks(envelope.ownerId, [historicalAsk]);
+        }
+      }
       opts.eventsHub.broadcast({
         type: 'notify', title: f.title, ...(f.body ? { body: f.body } : {}),
         urgency: f.urgency === 'high' ? 'high' : 'normal',
         ...(f.lang ? { lang: f.lang } : {}),
         ...(f.askId ? { askId: String(f.askId) } : {}),
+        ...alertFields(alertFrame),
         originNode: envelope.ownerId, ownerId: envelope.ownerId,
         ...(envelope.scope === 'cell' && envelope.cellId ? { originCell: envelope.cellId } : {}),
         eventId: envelope.eventId, ts: Date.now(),
       });
+      // The first legacy alert may have created an unknown admission during
+      // broadcast. Bind that admission before any following known replay.
+      if (historicalAsk && typeof opts.onAuthoritativeAsks === 'function') opts.onAuthoritativeAsks(envelope.ownerId, [historicalAsk]);
     } else if (f.type === 'ask') {
+      const ask = { id: f.askId, question: f.question, options: f.options, session: f.session, ts: f.ts,
+        ownerAskTs: Number.isSafeInteger(f.askTs) && f.askTs > 0 ? f.askTs : null, ownerId: envelope.ownerId };
+      if (!rememberLiveAsk(envelope.ownerId, ask)) return false;
+      if (typeof opts.onAuthoritativeAsks === 'function') opts.onAuthoritativeAsks(envelope.ownerId, [ask]);
       opts.eventsHub.broadcast({ type: 'ask', ownerId: envelope.ownerId, eventId: envelope.eventId,
-        ask: { id: f.askId, question: f.question, options: f.options, session: f.session, ownerId: envelope.ownerId } });
+        ask });
     } else if (f.type === 'ask-closed') {
+      const ownerAskTs = Number.isSafeInteger(f.askTs) && f.askTs > 0 ? f.askTs : null;
+      const view = viewFor(envelope.ownerId);
+      const current = view.asks.find(a => (a.ownerAskId || a.id) === f.askId) || (view.alertAsks && view.alertAsks.get(f.askId));
+      const currentTs = current && (Object.hasOwn(current, 'ownerAskTs') ? current.ownerAskTs : current.ts);
+      if (ownerAskTs && Number.isSafeInteger(currentTs) && currentTs > 0 && currentTs !== ownerAskTs) return false;
+      if (typeof opts.onAskClosed === 'function') {
+        const closed = opts.onAskClosed(envelope.ownerId, f.askId, f.outcome, ownerAskTs);
+        if (closed && closed.generationMismatch === true) return false;
+      }
       // The owner says the ask is closed: the VIEW drops it too, not only the
-      // UI, or the next state read hands the card back.
-      const closedView = dropAskFromView(envelope.ownerId, f.askId);
-      if (f.outcome === 'dismissed') noteAskClosed(envelope.ownerId, f.askId, closedView.viewEpoch);
+      // UI, or the next state read hands the card back. Same function as the
+      // fan-out path: one closure semantics, one exported collection.
+      applyOwnerClosure(envelope.ownerId, f.askId, { ownerAskTs, outcome: f.outcome });
       opts.eventsHub.broadcast({ type: f.outcome === 'dismissed' ? 'ask-dismissed' : 'ask-answered',
-        id: f.askId, ownerId: envelope.ownerId, eventId: envelope.eventId });
+        id: f.askId, ownerAskId: f.askId, ownerId: envelope.ownerId, eventId: envelope.eventId,
+        ...(ownerAskTs ? { ownerAskTs } : {}) });
     } else if (f.type === 'file-notice') {
       // Stessa forma della consegna locale (lib/files/routes.js): il nome del
       // file e' SEMPRE nel corpo, con la caption quando c'e'. Prima l'importato
@@ -582,11 +687,17 @@ function createEventFeedClient(opts = {}) {
     view.lastSnapshotAt = now();
     view.nextSnapshotAllowedAt = null;
     const gen = generation;
+    const acquisitionCursor = view.cursor;
+    const acquisitionAskRevision = view.liveAskRevision || 0;
     const { r, text } = await withDeadline(slot, 8000, async (signal) => {
       const r = await fetchImpl(routeUrl(peer, '/event-feed/snapshot'), {
         headers: identityHeaders(peer, store), signal,
       });
-      if (!r.ok) throw new Error(`snapshot HTTP ${r.status}`);
+      if (!r.ok) {
+        const error = new Error(`snapshot HTTP ${r.status}`);
+        error.snapshotReason = r.status === 503 ? 'asks-unreadable' : `http-${r.status}`;
+        throw error;
+      }
       return { r, text: await r.text() };
     });
     if ((slot && !active(ownerId, slot)) || gen !== generation) throw new Error('obsolete acquisition');
@@ -609,6 +720,13 @@ function createEventFeedClient(opts = {}) {
       view.stale = true; view.lastError = decision.reason;
       return { state: 'failed' };
     }
+    // An event consumed during this acquisition is later than the start of
+    // the read. Neither the view nor imported alias decisions may use that
+    // older response to certify an ASK's absence.
+    if (view.cursor !== acquisitionCursor || (view.liveAskRevision || 0) !== acquisitionAskRevision) {
+      view.stale = true; view.lastError = 'snapshot-superseded';
+      return { state: 'failed' };
+    }
     if (!forView.ok) {
       if (profile !== 'view') {
         // Autorevole per la chiusura, non applicabile alla vista: la vista
@@ -780,7 +898,7 @@ function createEventFeedClient(opts = {}) {
         lastError: v.lastError || null,
         ingressBlockedUntil: v.ingressBlockedUntil || null,
         ingressBlockReason: v.ingressBlockReason || null,
-        asks: v.asks, notifications: v.notifications, fleetState: v.fleetState,
+        asks: visibleAsks(ownerId, v.asks), notifications: v.notifications, fleetState: v.fleetState,
       })),
     };
   }
@@ -827,14 +945,27 @@ function createEventFeedClient(opts = {}) {
         // l'elenco che la decisione usa — e solo quello. La vista, nello
         // stesso snapshotOnce, applica il suo schema completo o resta ferma.
         state = await Promise.race([snapshotOnce(peer, id, store, { profile: 'decision' }), doorTimeoutPromise()]);
-      } catch (_) {
-        return { status: 'error', reason: 'transport' };
+      } catch (error) {
+        const reason = error && error.snapshotReason || 'transport';
+        const view = viewFor(id);
+        view.stale = true; view.lastError = reason;
+        if (typeof opts.onViewChanged === 'function') {
+          try { opts.onViewChanged(id); } catch (_) { /* Diagnostics cannot replace the acquisition failure. */ }
+        }
+        return { status: 'error', reason };
       } finally {
         doorInFlight.delete(id);
       }
       const view = views.get(id);
       const retryAt = (view && typeof view.lastSnapshotAt === 'number' ? view.lastSnapshotAt : now()) + minSnapshotIntervalMs;
-      if (state === null) return { status: 'pending', reason: 'door-timeout', retryAt };
+      if (state === null) {
+        const pendingView = viewFor(id);
+        pendingView.stale = true; pendingView.lastError = 'snapshot-timeout';
+        if (typeof opts.onViewChanged === 'function') {
+          try { opts.onViewChanged(id); } catch (_) { /* A pending owner acquisition remains non-authoritative. */ }
+        }
+        return { status: 'pending', reason: 'door-timeout', retryAt };
+      }
       if (state.state === 'skipped') return { status: 'skipped', reason: 'window', retryAt };
       if (state.state === 'applied') {
         // L'elenco autorevole è quello dello snapshot: anche quando la vista
@@ -878,7 +1009,7 @@ function createEventFeedClient(opts = {}) {
     }
   }
 
-  return { start, stop, poll, state, reemit, viewFor, dismissConfirmed, ownerSnapshotAsks };
+  return { start, stop, poll, state, reemit, viewFor, dismissConfirmed, ownerSnapshotAsks, rememberLiveAsk, applyOwnerClosure };
 }
 
 module.exports = { createEventFeedClient };

package/lib/notify/event-feed-producers.js

@@ -9,6 +9,7 @@
 // coverage is proved by tests, never by silent omission.
 
 const crypto = require('node:crypto');
+const { alertFields } = require('./ask-alert-identity.js');
 
 const CELL_ID_RE = /^[A-Za-z0-9._-]{1,32}$/;
 const FRAME_MAX_BYTES = 16 * 1024;
@@ -38,6 +39,7 @@ const PRODUCERS = {
     requires: ['cellId'],
     build: (p) => ({
       type: 'notify',
+      ...alertFields(p),
       title: cleanStr(p.title, 200) || '',
       ...(p.body !== undefined ? { body: cleanStr(p.body, 2000) || '' } : {}),
       urgency: p.urgency === 'high' ? 'high' : 'normal',
@@ -55,6 +57,7 @@ const PRODUCERS = {
     requires: [],
     build: (p) => ({
       type: 'notify',
+      ...alertFields(p),
       title: cleanStr(p.title, 200) || '',
       ...(p.body !== undefined ? { body: cleanStr(p.body, 2000) || '' } : {}),
       urgency: p.urgency === 'high' ? 'high' : 'normal',
@@ -74,6 +77,7 @@ const PRODUCERS = {
       question: cleanStr(p.question, 3900) || '',
       ...(Array.isArray(p.options) ? { options: p.options.slice(0, 8).map((o) => cleanStr(o, 200) || '') } : {}),
       session: cleanStr(p.session, 128) || undefined,
+      ...(Number.isSafeInteger(p.askTs) && p.askTs > 0 ? { askTs: p.askTs } : {}),
       ts: typeof p.ts === 'number' ? p.ts : undefined,
     }),
   },
@@ -86,6 +90,7 @@ const PRODUCERS = {
       askId: cleanStr(p.askId, 32) || '',
       revision: typeof p.revision === 'number' ? p.revision : 0,
       outcome: p.outcome === 'answered' || p.outcome === 'dismissed' ? p.outcome : 'answered',
+      ...(Number.isSafeInteger(p.askTs) && p.askTs > 0 ? { askTs: p.askTs } : {}),
       ts: typeof p.ts === 'number' ? p.ts : undefined,
     }),
   },

package/lib/notify/event-feed-routes.js

@@ -223,6 +223,7 @@ function createEventFeedRoutes(deps) {
         err.reason = 'asks-unreadable';
         throw err;
       }
+      const cellForSession = deps.askScopeResolver ? deps.askScopeResolver() : deps.cellForSession;
       const self = typeof deps.localNodeId === 'function' ? deps.localNodeId() : null;
       const open = deps.asksStore.list({ open: true }) || [];
       const visible = open
@@ -234,7 +235,7 @@ function createEventFeedRoutes(deps) {
         // visibilita' della cella.
         .filter((a) => !a.originNode && !(a.ownerId && self && a.ownerId !== self))
         .map((a) => ({ id: a.id, question: a.question, options: a.options, session: a.session, ts: a.ts }))
-        .filter((a) => peer.allows({ scope: 'cell', cellId: deps.cellForSession(a.session) }))
+        .filter((a) => peer.allows({ scope: 'cell', cellId: cellForSession(a.session) }))
         .slice(0, SNAPSHOT_MAX_ASKS);
       asks = visible;
     } catch (e) {

package/lib/notify/imported-dismissals.js

@@ -0,0 +1,106 @@
+'use strict';
+// Durable receiver-to-owner synchronization. No attempt may submit an answer.
+function createImportedDismissalDrainer({ store, relay, now = Date.now, random = Math.random,
+  setTimer = setTimeout, clearTimer = clearTimeout, intervalMs = 15000,
+  globalBudget = 4, ownerBudget = 1, budgetWindowMs = 60000, bindingForOwner = () => null, readonly = () => false, log = () => {} } = {}) {
+  const flights = new Set();
+  const globalHits = [];
+  const ownerHits = new Map();
+  let stopped = false;
+  let timer = null;
+  let running = null;
+  function defer(record, reason, blocked = false, retryAfterMs = 0) {
+    const attempts = (record.attempts || 0) + 1;
+    const delay = Math.max(retryAfterMs, Math.min(300000, 1000 * 2 ** Math.min(attempts, 9)) * (0.5 + random() * 0.5));
+    return store.updateImportedDismissal(record.ownerId, record.ownerAskId, {
+      syncState: blocked ? 'blocked' : 'pending', retryBinding: bindingForOwner(record.ownerId), attempts, lastReason: reason || 'owner-unreachable', nextRetryAt: now() + delay,
+    });
+  }
+  function rejected(record, result = {}) {
+    const reason = result.reason || 'owner-unreachable';
+    const transient = ['answering', 'delivery-unknown-block', 'reverse-slot-unverified', 'relay-deadline', 'owner-unreachable', 'federation-peer-unreachable'];
+    const pending = transient.includes(reason) || result.code === 429 || result.code >= 500;
+    return defer(record, reason, !pending, result.retryAfterMs || 0);
+  }
+  function confirmed(record, outcome) {
+    return store.updateImportedDismissal(record.ownerId, record.ownerAskId, {
+      syncState: outcome === 'answered' ? 'confirmed-answered' : 'confirmed-dismissed', ownerOutcome: outcome, lastReason: null,
+    });
+  }
+  async function attempt(record) {
+    const key = `${record.ownerId}|${record.ownerAskId}`;
+    if (flights.has(key) || stopped || readonly()) return;
+    flights.add(key);
+    try {
+      let current = store.getImportedDismissal(record.ownerId, record.ownerAskId);
+      if (!current || current.syncState !== 'pending') return;
+      const result = await relay.inspectDismissal({ ownerId: record.ownerId, askId: record.ownerAskId });
+      if (stopped || readonly()) return;
+      current = store.getImportedDismissal(record.ownerId, record.ownerAskId);
+      if (!current || current.syncState !== 'pending' || current.dismissedTs !== record.dismissedTs) return;
+      if (!result.ok) { rejected(current, result); return; }
+      if (result.generationPrecondition !== true) { defer(current, 'unsupported', true); return; }
+      if (!result.ask || (result.ask.ownerAskId || result.ask.id) !== current.ownerAskId
+        || store.askFingerprint(result.ask) !== current.ownerAskFingerprint
+        || !Number.isSafeInteger(result.ask.ts) || result.ask.ts <= 0
+        || (current.generation === 'known' && current.ownerAskTs !== result.ask.ts)) {
+        defer(current, 'generation-mismatch', true); return;
+      }
+      const adopted = store.adoptImportedDismissal(current.ownerId, current.ownerAskId, result.ask);
+      if (!adopted.ok) { log(`dismissal adoption refused: ${adopted.reason}`); return; }
+      current = adopted.record;
+      if (['answered', 'dismissed'].includes(result.status)) { confirmed(current, result.status); return; }
+      if (result.status !== 'open') { rejected(current, { code: 409, reason: result.status || 'unknown' }); return; }
+      // The timestamp is durable before the request and checked atomically by
+      // the owner. A lost response leaves the record pending for reconciliation.
+      const out = await relay.relayDismiss({ ownerId: current.ownerId, askId: current.ownerAskId, expectedTs: current.ownerAskTs });
+      if (stopped || readonly()) return;
+      const latest = store.getImportedDismissal(current.ownerId, current.ownerAskId);
+      if (!latest || latest.syncState !== 'pending' || latest.dismissedTs !== current.dismissedTs) return;
+      if (out.ok && ['answered', 'dismissed'].includes(out.outcome)) confirmed(latest, out.outcome);
+      else rejected(latest, out.ok ? { code: 409, reason: 'unsupported' } : out);
+    } catch (error) {
+      const current = store.getImportedDismissal(record.ownerId, record.ownerAskId);
+      if (!stopped && current && current.syncState === 'pending') defer(current, 'owner-unreachable');
+      log(`dismissal synchronization failed: ${String(error.message || error)}`);
+    } finally { flights.delete(key); }
+  }
+  async function run() {
+    if (stopped || readonly()) return;
+    const t = now();
+    const prune = hits => { while (hits.length && hits[0] <= t - budgetWindowMs) hits.shift(); };
+    prune(globalHits);
+    for (const [ownerId, hits] of ownerHits) { prune(hits); if (!hits.length) ownerHits.delete(ownerId); }
+    for (let record of store.listImportedDismissals()) {
+      if (globalHits.length >= globalBudget) break;
+      if (record.syncState === 'blocked' && record.lastReason !== 'generation-mismatch') {
+        const binding = bindingForOwner(record.ownerId);
+        if (binding !== null && binding !== record.retryBinding) {
+          const resumed = store.updateImportedDismissal(record.ownerId, record.ownerAskId, { syncState: 'pending', nextRetryAt: 0, retryBinding: binding });
+          if (resumed.ok) record = resumed.record;
+        }
+      }
+      if (record.syncState !== 'pending' || (record.nextRetryAt || 0) > now()) continue;
+      const hits = ownerHits.get(record.ownerId) || [];
+      if (hits.length >= ownerBudget) continue;
+      hits.push(t); ownerHits.set(record.ownerId, hits); globalHits.push(t);
+      await attempt(record);
+    }
+  }
+  function drain() {
+    if (running) return running;
+    const flight = run().finally(() => { if (running === flight) running = null; });
+    running = flight;
+    return flight;
+  }
+  function schedule() {
+    if (stopped || timer) return;
+    timer = setTimer(() => { timer = null; void drain().catch(error => log(String(error.message || error))).finally(schedule); }, intervalMs);
+    if (timer && typeof timer.unref === 'function') timer.unref();
+  }
+  function start() { schedule(); void drain().catch(error => log(String(error.message || error))); }
+  function stop() { stopped = true; if (timer) clearTimer(timer); timer = null; }
+  function nudge() { if (!stopped) void drain().catch(error => log(String(error.message || error))); }
+  return { start, stop, drain, nudge };
+}
+module.exports = { createImportedDismissalDrainer };

package/lib/notify/notifier.js

@@ -3,11 +3,15 @@
 // web-push. Reused by the /api/notify route, by the asks (high urgency) and
 // by the outbox file delivery — one point that knows both channels.
 
-function createNotifier({ hub, push }) {
+const { alertFields } = require('./ask-alert-identity.js');
+
+function createNotifier({ hub, push, alertRegistry }) {
   // frame: {title, body?, urgency?, session?, lang?, url?}. Ritorna {ui, push} (conteggi).
   async function emit(frame) {
-    const ui = hub.broadcast({
+    const uiClaim = alertRegistry ? alertRegistry.claim(frame, 'ui') : { allowed: true };
+    const ui = uiClaim.allowed ? hub.broadcast({
       type: 'notify',
+      ...alertFields(frame),
       title: String(frame.title || ''),
       ...(frame.body ? { body: String(frame.body) } : {}),
       urgency: frame.urgency === 'high' ? 'high' : 'normal',
@@ -21,18 +25,26 @@ function createNotifier({ hub, push }) {
       ...(frame.originNode ? { originNode: String(frame.originNode) } : {}),
       ...(frame.originCell ? { originCell: String(frame.originCell) } : {}),
       ts: Date.now(),
-    });
-    let pushed = 0;
+    }) : 0;
+    if (uiClaim.allowed && alertRegistry) alertRegistry.complete(frame, 'ui', ui);
+    let pushed = 0; let pushReason = null;
+    const pushClaim = alertRegistry ? alertRegistry.claim(frame, 'push') : { allowed: true };
     try {
+      if (pushClaim.allowed) {
       const r = await push.sendToAll({
+        ...alertFields(frame),
         title: String(frame.title || ''),
         ...(frame.body ? { body: String(frame.body) } : {}),
         ...(frame.lang ? { lang: String(frame.lang) } : {}),
         url: typeof frame.url === 'string' ? frame.url : '/',
       });
-      pushed = r.sent;
-    } catch (_) { /* push best-effort: la notify UI resta valida */ }
-    return { ui, push: pushed };
+      pushed = r && Number.isFinite(r.sent) ? r.sent : 0;
+      if (!pushed) pushReason = 'no-delivery';
+      } else pushReason = pushClaim.reason;
+    } catch (_) { pushReason = 'send-failed'; }
+    if (pushClaim.allowed && alertRegistry) alertRegistry.complete(frame, 'push', pushed);
+    if (!frame.askId) return { ui, push: pushed };
+    return { ui, push: pushed, uiAttempted: uiClaim.allowed === true, pushAttempted: pushClaim.allowed === true, alertStatus: ui > 0 || pushed > 0 ? 'delivered' : 'no-delivery', ...(pushReason ? { pushReason } : {}) };
   }
 
   // Frame di servizio solo-UI (es. {type:'ask-answered', id}): nessun push.

package/lib/notify/owner-ask-scope.js

@@ -0,0 +1,35 @@
+'use strict';
+const path = require('node:path');
+const { loadDefinitions, cellIdFromTmuxSession } = require('../fleet/definitions.js');
+
+// The owner resolves local definitions, never a cell id supplied by a peer.
+// Activity and tmux polling do not participate in ASK authorization.
+function resolveOwnerSession(session, cells) {
+  if (typeof session !== 'string' || !session) return null;
+  const matches = cells.filter(cell => cell.tmuxSession === session);
+  if (matches.length > 1) return null;
+  if (matches.length === 1) return matches[0].id;
+  return cellIdFromTmuxSession(session);
+}
+
+function createOwnerAskScope(cfg) {
+  const enabled = cfg.fleetEnabled !== false && cfg.builtinEnabled !== false;
+  const definitionsPath = enabled ? (cfg.fleetDefsPath || path.join(cfg.home, '.nexuscrew', 'fleet.json')) : null;
+  function read() {
+    if (!enabled) return { available: true, cells: [] };
+    const definitions = loadDefinitions(definitionsPath);
+    return definitions ? { available: true, cells: definitions.cells } : { available: false, cells: [] };
+  }
+  return {
+    snapshotResolver: () => {
+      const definitions = read();
+      if (!definitions.available) throw new Error('owner ASK scope unavailable');
+      return session => resolveOwnerSession(session, definitions.cells);
+    },
+    cellForSession: session => {
+      const definitions = read();
+      return definitions.available ? resolveOwnerSession(session, definitions.cells) : null;
+    },
+  };
+}
+module.exports = { createOwnerAskScope, resolveOwnerSession };

package/lib/notify/push-relay.js

@@ -17,6 +17,7 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
+const { alertFields } = require('./ask-alert-identity.js');
 
 const QUEUE_MAX_ALERTS = 32;
 const QUEUE_MAX_BYTES = 128 * 1024;
@@ -60,6 +61,7 @@ function buildPayload(envelope) {
     ...(preview ? { body: truncated ? `${preview}…` : preview } : {}),
     ...(f.lang ? { lang: f.lang } : {}),
     tag: `nc:${envelope.ownerId}:${envelope.eventId}`,
+    ...alertFields({ ...f, ownerId: envelope.ownerId }),
     url,
     ownerId: envelope.ownerId,
     eventId: envelope.eventId,
@@ -104,7 +106,7 @@ function createPushDedup({ filePath, now = Date.now } = {}) {
 
 // `send` is the push sender call (pushService.sendToAll wrapped with the
 // timeout). Everything else is queue + budget + counters.
-function createPushRelay({ pushDedup, send, now = Date.now, sendTimeoutMs = SEND_TIMEOUT_MS, log = () => {} } = {}) {
+function createPushRelay({ pushDedup, send, alertRegistry, now = Date.now, sendTimeoutMs = SEND_TIMEOUT_MS, log = () => {} } = {}) {
   const queue = [];
   let queueBytes = 0;
   let active = 0;
@@ -147,6 +149,7 @@ function createPushRelay({ pushDedup, send, now = Date.now, sendTimeoutMs = SEND
           send(item.payload),
           new Promise((resolve) => setTimeout(() => resolve({ timeout: true }), sendTimeoutMs)),
         ]);
+        if (alertRegistry) alertRegistry.complete(item.payload, 'push', out && out.timeout ? 'uncertain' : out && out.sent || 0);
         const own = forOwner(item.payload && item.payload.ownerId);
         if (out && out.timeout) {
           counters.sendFailed += 1; own.sendFailed += 1; own.lastReason = 'send-timeout';
@@ -154,6 +157,7 @@ function createPushRelay({ pushDedup, send, now = Date.now, sendTimeoutMs = SEND
         } else if (out && out.sent > 0) { counters.pushed += out.sent; own.pushed += out.sent; }
         else { counters.sendFailed += 1; own.sendFailed += 1; own.lastReason = 'send-failed'; }
       } catch (_) {
+        if (alertRegistry) alertRegistry.complete(item.payload, 'push', 0);
         counters.sendFailed += 1;
         const own = forOwner(item.payload && item.payload.ownerId);
         own.sendFailed += 1; own.lastReason = 'send-failed';
@@ -194,6 +198,10 @@ function createPushRelay({ pushDedup, send, now = Date.now, sendTimeoutMs = SEND
       own.dropped += 1; own.lastReason = 'dedup-persist-failed';
       return false;
     }
+    if (alertRegistry) {
+      const claim = alertRegistry.claim(payload, 'push');
+      if (!claim.allowed) { counters.dropped += 1; const own = forOwner(envelope.ownerId); own.dropped += 1; own.lastReason = claim.reason; return false; }
+    }
     queue.push({ payload, bytes });
     queueBytes += bytes;
     void flush();
@@ -216,6 +224,7 @@ function createPushRelay({ pushDedup, send, now = Date.now, sendTimeoutMs = SEND
       frame: {
         type: 'notify', title: event.title, body: event.body, lang: event.lang,
         ...(event.askId ? { askId: String(event.askId) } : {}),
+        ...alertFields(event),
       },
     });
   }