@mmmbuto/nexuscrew 0.9.59 → 0.9.60

package/lib/notify/event-feed-client.js

@@ -150,23 +150,29 @@ function createEventFeedClient(opts = {}) {
 
   function askTombstoneKey(ownerId, askId) { return `${ownerId}|${askId}`; }
 
-  function noteAskClosed(ownerId, askId, epoch) {
+  function noteAskClosed(ownerId, askId, epoch, ownerAskTs, ask) {
     if (!ownerId || !askId) return;
-    askTombstones.set(askTombstoneKey(ownerId, askId), { at: now(), epoch });
+    askTombstones.set(askTombstoneKey(ownerId, askId), { at: now(), epoch, ownerAskTs,
+      fingerprint: ask && ask.question !== undefined ? JSON.stringify([ask.question, ask.options || [], ask.session]) : null });
+    if (askTombstones.size > 4096) askTombstones.delete(askTombstones.keys().next().value);
   }
 
-  function askIsClosed(ownerId, askId, epoch) {
+  function askIsClosed(ownerId, askId, epoch, ask) {
     const key = askTombstoneKey(ownerId, askId);
     const hit = askTombstones.get(key);
     if (!hit) return false;
     if (now() - hit.at > ASK_TOMBSTONE_TTL_MS) { askTombstones.delete(key); return false; }
     if (typeof hit.epoch === 'number' && typeof epoch === 'number' && hit.epoch !== epoch) return false;
+    const ts = ask && (Object.hasOwn(ask, 'ownerAskTs') ? ask.ownerAskTs : ask.ts);
+    if (Number.isSafeInteger(hit.ownerAskTs) && hit.ownerAskTs > 0 && Number.isSafeInteger(ts) && ts > 0 && hit.ownerAskTs !== ts) return false;
+    if (!hit.ownerAskTs && hit.fingerprint !== null && ask && hit.fingerprint !== JSON.stringify([ask.question, ask.options || [], ask.session])) return false;
     return true;
   }
 
   function dropAskFromView(ownerId, askId) {
     const view = viewFor(ownerId);
     view.asks = view.asks.filter((a) => (a.ownerAskId || a.id) !== askId);
+    if (view.alertAsks) view.alertAsks.delete(askId);
     return view;
   }
 
@@ -227,14 +233,16 @@ function createEventFeedClient(opts = {}) {
     // ask: the tombstone is what keeps it from coming back.
     view.asks = Array.isArray(snap.asks)
       ? snap.asks
-        .filter((a) => a && !askIsClosed(ownerId, a.ownerAskId || a.id, snap.viewEpoch) && !isAskDismissed(ownerId, a))
+        .filter((a) => a && !askIsClosed(ownerId, a.ownerAskId || a.id, snap.viewEpoch, a) && !isAskDismissed(ownerId, a))
         .map((a) => ({ ...a, ownerId }))
       : [];
+    view.alertAsks = new Map(); // fresh snapshot replaces all live-only alert sources
     view.notifications = Array.isArray(snap.notifications) ? snap.notifications.map((e) => ({ ...e, ownerId })) : [];
     view.fleetState = snap.fleetState || null;
     view.askReplyAccess = snap.askReplyAccess === true;
     view.viewEpoch = snap.viewEpoch;
     view.stale = false;
+    if (typeof opts.onAuthoritativeAsks === 'function') opts.onAuthoritativeAsks(ownerId, view.asks);
     // Lo snapshot fresco è la guarigione visibile: stale torna falso e
     // l'ultimo errore cessa di essere mostrato. Lo streak NON si tocca qui:
     // il conto dei reset misura i round SENZA frame sano, e ogni round di
@@ -242,9 +250,70 @@ function createEventFeedClient(opts = {}) {
     // tappo anti-reset. Lo sblocco dello streak sta alla scadenza del cooldown.
     view.lastError = null;
     view.generation = gen;
+    if (typeof opts.onViewChanged === 'function') {
+      try { opts.onViewChanged(ownerId); } catch (_) { /* UI refresh cannot invalidate the applied view. */ }
+    }
     return true;
   }
 
+  // Both authenticated ingress paths must update the same exported owner
+  // collection. Recording a fan-out ASK neither publishes nor fabricates a
+  // feed cursor; the next genuinely new owner snapshot can replace it.
+  function rememberLiveAsk(ownerId, source) {
+    const askId = source.ownerAskId || source.id;
+    const ask = { ...source, id: askId, ownerId,
+      ownerAskTs: Object.hasOwn(source, 'ownerAskTs') ? source.ownerAskTs : source.ts };
+    const view = viewFor(ownerId);
+    if (isAskDismissed(ownerId, ask)
+      || askIsClosed(ownerId, askId, view.viewEpoch, ask)) return null;
+    // The exported collection must follow both ingress paths, even when the
+    // feed cursor has not yet advanced, or a cache falsely certifies absence.
+    const currentIndex = view.asks.findIndex(a => (a.ownerAskId || a.id) === askId);
+    const current = currentIndex >= 0 ? view.asks[currentIndex] : null;
+    const currentTs = current && (Object.hasOwn(current, 'ownerAskTs') ? current.ownerAskTs : current.ts);
+    if (current && Number.isSafeInteger(currentTs) && currentTs > 0
+      && (!ask.ownerAskTs || ask.ownerAskTs < currentTs)) return null;
+    if (currentIndex >= 0) view.asks[currentIndex] = ask;
+    else if (view.asks.length < SNAPSHOT_MAX_ASKS) view.asks.push(ask);
+    else {
+      // Never certify an incomplete collection or silently evict a card.
+      view.stale = true; view.lastError = 'snapshot-asks-cap';
+    }
+    if (!view.stale) {
+      if (!view.alertAsks) view.alertAsks = new Map();
+      view.alertAsks.delete(askId); view.alertAsks.set(askId, ask);
+      while (view.alertAsks.size > SNAPSHOT_MAX_ASKS) view.alertAsks.delete(view.alertAsks.keys().next().value);
+    }
+    view.liveAskRevision = (view.liveAskRevision || 0) + 1;
+    return ask;
+  }
+
+  // An authenticated owner closure (fan-out frame or feed envelope) lands on
+  // the SAME exported view the live ask entered — whether or not the store
+  // alias changed. The key is canonical (ownerId, ownerAskId); a closure of a
+  // different generation closes nothing. The tombstone blocks the CLOSED
+  // generation for both outcomes, and the revision bump rejects a snapshot
+  // acquisition that started before the closure: an anterior read must never
+  // certify the card back.
+  function applyOwnerClosure(ownerId, ownerAskId, { ownerAskTs, outcome, ask } = {}) {
+    if (!ownerId || !ownerAskId) return { applied: false };
+    const view = viewFor(ownerId);
+    const current = view.asks.find((a) => (a.ownerAskId || a.id) === ownerAskId)
+      || (view.alertAsks && view.alertAsks.get(ownerAskId)) || null;
+    const currentTs = current && (Object.hasOwn(current, 'ownerAskTs') ? current.ownerAskTs : current.ts);
+    const closureTs = Number.isSafeInteger(ownerAskTs) && ownerAskTs > 0 ? ownerAskTs : null;
+    if (closureTs && Number.isSafeInteger(currentTs) && currentTs > 0 && currentTs !== closureTs) {
+      return { applied: false, mismatch: true };
+    }
+    dropAskFromView(ownerId, ownerAskId);
+    noteAskClosed(ownerId, ownerAskId, view.viewEpoch, closureTs || undefined, current || ask);
+    view.liveAskRevision = (view.liveAskRevision || 0) + 1;
+    if (typeof opts.onViewChanged === 'function') {
+      try { opts.onViewChanged(ownerId); } catch (_) { /* UI refresh cannot invalidate the closure. */ }
+    }
+    return { applied: true };
+  }
+
   // Local re-emission of ONE imported envelope: attributed to the owner, into
   // the local SSE hub only. The hub is the browser-facing surface — this call
   // deliberately bypasses the notifier so the imported event can never be
@@ -256,29 +325,59 @@ function createEventFeedClient(opts = {}) {
     if (!envelope.frame || envelope.hop !== 1) return false;
     const f = envelope.frame;
     if (f.type === 'notify') {
+      const { canonicalAskAlert, alertFields } = require('./ask-alert-identity.js');
+      let alertFrame = { ...f, ownerId: envelope.ownerId };
+      let historicalAsk = null;
+      if (f.askId && !canonicalAskAlert(alertFrame)) {
+        const view = views.get(envelope.ownerId);
+        // A legacy notification has no generation. Only a fresh full owner
+        // ASK can supply its fingerprint; emission time never supplies a ts.
+        const source = view && !view.stale && ((view.alertAsks && view.alertAsks.get(f.askId)) || view.asks.find(a => a.id === f.askId));
+        historicalAsk = source && source.question === f.body ? source : null;
+        if (historicalAsk) {
+          const ownerAskTs = historicalAsk.ownerAskTs === undefined ? historicalAsk.ts : historicalAsk.ownerAskTs;
+          alertFrame = { ...alertFrame, ownerAskFingerprint: require('./asks.js').askFingerprint(historicalAsk),
+            ...(Number.isSafeInteger(ownerAskTs) && ownerAskTs > 0 ? { ownerAskTs } : {}) };
+          if (typeof opts.onAuthoritativeAsks === 'function') opts.onAuthoritativeAsks(envelope.ownerId, [historicalAsk]);
+        }
+      }
       opts.eventsHub.broadcast({
         type: 'notify', title: f.title, ...(f.body ? { body: f.body } : {}),
         urgency: f.urgency === 'high' ? 'high' : 'normal',
         ...(f.lang ? { lang: f.lang } : {}),
         ...(f.askId ? { askId: String(f.askId) } : {}),
+        ...alertFields(alertFrame),
         originNode: envelope.ownerId, ownerId: envelope.ownerId,
         ...(envelope.scope === 'cell' && envelope.cellId ? { originCell: envelope.cellId } : {}),
         eventId: envelope.eventId, ts: Date.now(),
       });
+      // The first legacy alert may have created an unknown admission during
+      // broadcast. Bind that admission before any following known replay.
+      if (historicalAsk && typeof opts.onAuthoritativeAsks === 'function') opts.onAuthoritativeAsks(envelope.ownerId, [historicalAsk]);
     } else if (f.type === 'ask') {
       const ask = { id: f.askId, question: f.question, options: f.options, session: f.session, ts: f.ts,
         ownerAskTs: Number.isSafeInteger(f.askTs) && f.askTs > 0 ? f.askTs : null, ownerId: envelope.ownerId };
-      if (isAskDismissed(envelope.ownerId, ask)) return false;
+      if (!rememberLiveAsk(envelope.ownerId, ask)) return false;
+      if (typeof opts.onAuthoritativeAsks === 'function') opts.onAuthoritativeAsks(envelope.ownerId, [ask]);
       opts.eventsHub.broadcast({ type: 'ask', ownerId: envelope.ownerId, eventId: envelope.eventId,
         ask });
     } else if (f.type === 'ask-closed') {
-      if (typeof opts.onAskClosed === 'function') opts.onAskClosed(envelope.ownerId, f.askId, f.outcome);
+      const ownerAskTs = Number.isSafeInteger(f.askTs) && f.askTs > 0 ? f.askTs : null;
+      const view = viewFor(envelope.ownerId);
+      const current = view.asks.find(a => (a.ownerAskId || a.id) === f.askId) || (view.alertAsks && view.alertAsks.get(f.askId));
+      const currentTs = current && (Object.hasOwn(current, 'ownerAskTs') ? current.ownerAskTs : current.ts);
+      if (ownerAskTs && Number.isSafeInteger(currentTs) && currentTs > 0 && currentTs !== ownerAskTs) return false;
+      if (typeof opts.onAskClosed === 'function') {
+        const closed = opts.onAskClosed(envelope.ownerId, f.askId, f.outcome, ownerAskTs);
+        if (closed && closed.generationMismatch === true) return false;
+      }
       // The owner says the ask is closed: the VIEW drops it too, not only the
-      // UI, or the next state read hands the card back.
-      const closedView = dropAskFromView(envelope.ownerId, f.askId);
-      if (f.outcome === 'dismissed') noteAskClosed(envelope.ownerId, f.askId, closedView.viewEpoch);
+      // UI, or the next state read hands the card back. Same function as the
+      // fan-out path: one closure semantics, one exported collection.
+      applyOwnerClosure(envelope.ownerId, f.askId, { ownerAskTs, outcome: f.outcome });
       opts.eventsHub.broadcast({ type: f.outcome === 'dismissed' ? 'ask-dismissed' : 'ask-answered',
-        id: f.askId, ownerAskId: f.askId, ownerId: envelope.ownerId, eventId: envelope.eventId });
+        id: f.askId, ownerAskId: f.askId, ownerId: envelope.ownerId, eventId: envelope.eventId,
+        ...(ownerAskTs ? { ownerAskTs } : {}) });
     } else if (f.type === 'file-notice') {
       // Stessa forma della consegna locale (lib/files/routes.js): il nome del
       // file e' SEMPRE nel corpo, con la caption quando c'e'. Prima l'importato
@@ -588,11 +687,17 @@ function createEventFeedClient(opts = {}) {
     view.lastSnapshotAt = now();
     view.nextSnapshotAllowedAt = null;
     const gen = generation;
+    const acquisitionCursor = view.cursor;
+    const acquisitionAskRevision = view.liveAskRevision || 0;
     const { r, text } = await withDeadline(slot, 8000, async (signal) => {
       const r = await fetchImpl(routeUrl(peer, '/event-feed/snapshot'), {
         headers: identityHeaders(peer, store), signal,
       });
-      if (!r.ok) throw new Error(`snapshot HTTP ${r.status}`);
+      if (!r.ok) {
+        const error = new Error(`snapshot HTTP ${r.status}`);
+        error.snapshotReason = r.status === 503 ? 'asks-unreadable' : `http-${r.status}`;
+        throw error;
+      }
       return { r, text: await r.text() };
     });
     if ((slot && !active(ownerId, slot)) || gen !== generation) throw new Error('obsolete acquisition');
@@ -615,6 +720,13 @@ function createEventFeedClient(opts = {}) {
       view.stale = true; view.lastError = decision.reason;
       return { state: 'failed' };
     }
+    // An event consumed during this acquisition is later than the start of
+    // the read. Neither the view nor imported alias decisions may use that
+    // older response to certify an ASK's absence.
+    if (view.cursor !== acquisitionCursor || (view.liveAskRevision || 0) !== acquisitionAskRevision) {
+      view.stale = true; view.lastError = 'snapshot-superseded';
+      return { state: 'failed' };
+    }
     if (!forView.ok) {
       if (profile !== 'view') {
         // Autorevole per la chiusura, non applicabile alla vista: la vista
@@ -833,14 +945,27 @@ function createEventFeedClient(opts = {}) {
         // l'elenco che la decisione usa — e solo quello. La vista, nello
         // stesso snapshotOnce, applica il suo schema completo o resta ferma.
         state = await Promise.race([snapshotOnce(peer, id, store, { profile: 'decision' }), doorTimeoutPromise()]);
-      } catch (_) {
-        return { status: 'error', reason: 'transport' };
+      } catch (error) {
+        const reason = error && error.snapshotReason || 'transport';
+        const view = viewFor(id);
+        view.stale = true; view.lastError = reason;
+        if (typeof opts.onViewChanged === 'function') {
+          try { opts.onViewChanged(id); } catch (_) { /* Diagnostics cannot replace the acquisition failure. */ }
+        }
+        return { status: 'error', reason };
       } finally {
         doorInFlight.delete(id);
       }
       const view = views.get(id);
       const retryAt = (view && typeof view.lastSnapshotAt === 'number' ? view.lastSnapshotAt : now()) + minSnapshotIntervalMs;
-      if (state === null) return { status: 'pending', reason: 'door-timeout', retryAt };
+      if (state === null) {
+        const pendingView = viewFor(id);
+        pendingView.stale = true; pendingView.lastError = 'snapshot-timeout';
+        if (typeof opts.onViewChanged === 'function') {
+          try { opts.onViewChanged(id); } catch (_) { /* A pending owner acquisition remains non-authoritative. */ }
+        }
+        return { status: 'pending', reason: 'door-timeout', retryAt };
+      }
       if (state.state === 'skipped') return { status: 'skipped', reason: 'window', retryAt };
       if (state.state === 'applied') {
         // L'elenco autorevole è quello dello snapshot: anche quando la vista
@@ -884,7 +1009,7 @@ function createEventFeedClient(opts = {}) {
     }
   }
 
-  return { start, stop, poll, state, reemit, viewFor, dismissConfirmed, ownerSnapshotAsks };
+  return { start, stop, poll, state, reemit, viewFor, dismissConfirmed, ownerSnapshotAsks, rememberLiveAsk, applyOwnerClosure };
 }
 
 module.exports = { createEventFeedClient };

package/lib/notify/event-feed-producers.js

@@ -9,6 +9,7 @@
 // coverage is proved by tests, never by silent omission.
 
 const crypto = require('node:crypto');
+const { alertFields } = require('./ask-alert-identity.js');
 
 const CELL_ID_RE = /^[A-Za-z0-9._-]{1,32}$/;
 const FRAME_MAX_BYTES = 16 * 1024;
@@ -38,6 +39,7 @@ const PRODUCERS = {
     requires: ['cellId'],
     build: (p) => ({
       type: 'notify',
+      ...alertFields(p),
       title: cleanStr(p.title, 200) || '',
       ...(p.body !== undefined ? { body: cleanStr(p.body, 2000) || '' } : {}),
       urgency: p.urgency === 'high' ? 'high' : 'normal',
@@ -55,6 +57,7 @@ const PRODUCERS = {
     requires: [],
     build: (p) => ({
       type: 'notify',
+      ...alertFields(p),
       title: cleanStr(p.title, 200) || '',
       ...(p.body !== undefined ? { body: cleanStr(p.body, 2000) || '' } : {}),
       urgency: p.urgency === 'high' ? 'high' : 'normal',
@@ -87,6 +90,7 @@ const PRODUCERS = {
       askId: cleanStr(p.askId, 32) || '',
       revision: typeof p.revision === 'number' ? p.revision : 0,
       outcome: p.outcome === 'answered' || p.outcome === 'dismissed' ? p.outcome : 'answered',
+      ...(Number.isSafeInteger(p.askTs) && p.askTs > 0 ? { askTs: p.askTs } : {}),
       ts: typeof p.ts === 'number' ? p.ts : undefined,
     }),
   },

package/lib/notify/event-feed-routes.js

@@ -223,6 +223,7 @@ function createEventFeedRoutes(deps) {
         err.reason = 'asks-unreadable';
         throw err;
       }
+      const cellForSession = deps.askScopeResolver ? deps.askScopeResolver() : deps.cellForSession;
       const self = typeof deps.localNodeId === 'function' ? deps.localNodeId() : null;
       const open = deps.asksStore.list({ open: true }) || [];
       const visible = open
@@ -234,7 +235,7 @@ function createEventFeedRoutes(deps) {
         // visibilita' della cella.
         .filter((a) => !a.originNode && !(a.ownerId && self && a.ownerId !== self))
         .map((a) => ({ id: a.id, question: a.question, options: a.options, session: a.session, ts: a.ts }))
-        .filter((a) => peer.allows({ scope: 'cell', cellId: deps.cellForSession(a.session) }))
+        .filter((a) => peer.allows({ scope: 'cell', cellId: cellForSession(a.session) }))
         .slice(0, SNAPSHOT_MAX_ASKS);
       asks = visible;
     } catch (e) {

package/lib/notify/notifier.js

@@ -3,11 +3,15 @@
 // web-push. Reused by the /api/notify route, by the asks (high urgency) and
 // by the outbox file delivery — one point that knows both channels.
 
-function createNotifier({ hub, push }) {
+const { alertFields } = require('./ask-alert-identity.js');
+
+function createNotifier({ hub, push, alertRegistry }) {
   // frame: {title, body?, urgency?, session?, lang?, url?}. Ritorna {ui, push} (conteggi).
   async function emit(frame) {
-    const ui = hub.broadcast({
+    const uiClaim = alertRegistry ? alertRegistry.claim(frame, 'ui') : { allowed: true };
+    const ui = uiClaim.allowed ? hub.broadcast({
       type: 'notify',
+      ...alertFields(frame),
       title: String(frame.title || ''),
       ...(frame.body ? { body: String(frame.body) } : {}),
       urgency: frame.urgency === 'high' ? 'high' : 'normal',
@@ -21,18 +25,26 @@ function createNotifier({ hub, push }) {
       ...(frame.originNode ? { originNode: String(frame.originNode) } : {}),
       ...(frame.originCell ? { originCell: String(frame.originCell) } : {}),
       ts: Date.now(),
-    });
-    let pushed = 0;
+    }) : 0;
+    if (uiClaim.allowed && alertRegistry) alertRegistry.complete(frame, 'ui', ui);
+    let pushed = 0; let pushReason = null;
+    const pushClaim = alertRegistry ? alertRegistry.claim(frame, 'push') : { allowed: true };
     try {
+      if (pushClaim.allowed) {
       const r = await push.sendToAll({
+        ...alertFields(frame),
         title: String(frame.title || ''),
         ...(frame.body ? { body: String(frame.body) } : {}),
         ...(frame.lang ? { lang: String(frame.lang) } : {}),
         url: typeof frame.url === 'string' ? frame.url : '/',
       });
-      pushed = r.sent;
-    } catch (_) { /* push best-effort: la notify UI resta valida */ }
-    return { ui, push: pushed };
+      pushed = r && Number.isFinite(r.sent) ? r.sent : 0;
+      if (!pushed) pushReason = 'no-delivery';
+      } else pushReason = pushClaim.reason;
+    } catch (_) { pushReason = 'send-failed'; }
+    if (pushClaim.allowed && alertRegistry) alertRegistry.complete(frame, 'push', pushed);
+    if (!frame.askId) return { ui, push: pushed };
+    return { ui, push: pushed, uiAttempted: uiClaim.allowed === true, pushAttempted: pushClaim.allowed === true, alertStatus: ui > 0 || pushed > 0 ? 'delivered' : 'no-delivery', ...(pushReason ? { pushReason } : {}) };
   }
 
   // Frame di servizio solo-UI (es. {type:'ask-answered', id}): nessun push.

package/lib/notify/owner-ask-scope.js

@@ -0,0 +1,35 @@
+'use strict';
+const path = require('node:path');
+const { loadDefinitions, cellIdFromTmuxSession } = require('../fleet/definitions.js');
+
+// The owner resolves local definitions, never a cell id supplied by a peer.
+// Activity and tmux polling do not participate in ASK authorization.
+function resolveOwnerSession(session, cells) {
+  if (typeof session !== 'string' || !session) return null;
+  const matches = cells.filter(cell => cell.tmuxSession === session);
+  if (matches.length > 1) return null;
+  if (matches.length === 1) return matches[0].id;
+  return cellIdFromTmuxSession(session);
+}
+
+function createOwnerAskScope(cfg) {
+  const enabled = cfg.fleetEnabled !== false && cfg.builtinEnabled !== false;
+  const definitionsPath = enabled ? (cfg.fleetDefsPath || path.join(cfg.home, '.nexuscrew', 'fleet.json')) : null;
+  function read() {
+    if (!enabled) return { available: true, cells: [] };
+    const definitions = loadDefinitions(definitionsPath);
+    return definitions ? { available: true, cells: definitions.cells } : { available: false, cells: [] };
+  }
+  return {
+    snapshotResolver: () => {
+      const definitions = read();
+      if (!definitions.available) throw new Error('owner ASK scope unavailable');
+      return session => resolveOwnerSession(session, definitions.cells);
+    },
+    cellForSession: session => {
+      const definitions = read();
+      return definitions.available ? resolveOwnerSession(session, definitions.cells) : null;
+    },
+  };
+}
+module.exports = { createOwnerAskScope, resolveOwnerSession };

package/lib/notify/push-relay.js

@@ -17,6 +17,7 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
+const { alertFields } = require('./ask-alert-identity.js');
 
 const QUEUE_MAX_ALERTS = 32;
 const QUEUE_MAX_BYTES = 128 * 1024;
@@ -60,6 +61,7 @@ function buildPayload(envelope) {
     ...(preview ? { body: truncated ? `${preview}…` : preview } : {}),
     ...(f.lang ? { lang: f.lang } : {}),
     tag: `nc:${envelope.ownerId}:${envelope.eventId}`,
+    ...alertFields({ ...f, ownerId: envelope.ownerId }),
     url,
     ownerId: envelope.ownerId,
     eventId: envelope.eventId,
@@ -104,7 +106,7 @@ function createPushDedup({ filePath, now = Date.now } = {}) {
 
 // `send` is the push sender call (pushService.sendToAll wrapped with the
 // timeout). Everything else is queue + budget + counters.
-function createPushRelay({ pushDedup, send, now = Date.now, sendTimeoutMs = SEND_TIMEOUT_MS, log = () => {} } = {}) {
+function createPushRelay({ pushDedup, send, alertRegistry, now = Date.now, sendTimeoutMs = SEND_TIMEOUT_MS, log = () => {} } = {}) {
   const queue = [];
   let queueBytes = 0;
   let active = 0;
@@ -147,6 +149,7 @@ function createPushRelay({ pushDedup, send, now = Date.now, sendTimeoutMs = SEND
           send(item.payload),
           new Promise((resolve) => setTimeout(() => resolve({ timeout: true }), sendTimeoutMs)),
         ]);
+        if (alertRegistry) alertRegistry.complete(item.payload, 'push', out && out.timeout ? 'uncertain' : out && out.sent || 0);
         const own = forOwner(item.payload && item.payload.ownerId);
         if (out && out.timeout) {
           counters.sendFailed += 1; own.sendFailed += 1; own.lastReason = 'send-timeout';
@@ -154,6 +157,7 @@ function createPushRelay({ pushDedup, send, now = Date.now, sendTimeoutMs = SEND
         } else if (out && out.sent > 0) { counters.pushed += out.sent; own.pushed += out.sent; }
         else { counters.sendFailed += 1; own.sendFailed += 1; own.lastReason = 'send-failed'; }
       } catch (_) {
+        if (alertRegistry) alertRegistry.complete(item.payload, 'push', 0);
         counters.sendFailed += 1;
         const own = forOwner(item.payload && item.payload.ownerId);
         own.sendFailed += 1; own.lastReason = 'send-failed';
@@ -194,6 +198,10 @@ function createPushRelay({ pushDedup, send, now = Date.now, sendTimeoutMs = SEND
       own.dropped += 1; own.lastReason = 'dedup-persist-failed';
       return false;
     }
+    if (alertRegistry) {
+      const claim = alertRegistry.claim(payload, 'push');
+      if (!claim.allowed) { counters.dropped += 1; const own = forOwner(envelope.ownerId); own.dropped += 1; own.lastReason = claim.reason; return false; }
+    }
     queue.push({ payload, bytes });
     queueBytes += bytes;
     void flush();
@@ -216,6 +224,7 @@ function createPushRelay({ pushDedup, send, now = Date.now, sendTimeoutMs = SEND
       frame: {
         type: 'notify', title: event.title, body: event.body, lang: event.lang,
         ...(event.askId ? { askId: String(event.askId) } : {}),
+        ...alertFields(event),
       },
     });
   }

package/lib/notify/routes.js

@@ -160,7 +160,7 @@ function createClosureFanout({
   // l'unico lato che puo' riprovare: il ricevente non ha rotta verso l'owner).
   retry = null,
 } = {}) {
-  async function dispatch({ askId, outcome, session, retryOnFailure = true, targets = null }) {
+  async function dispatch({ askId, ownerAskTs, outcome, session, retryOnFailure = true, targets = null }) {
     if (!dispatcher) return [];
     const self = localNodeId();
     // `targets` esplicito = ritentativo: si va SOLO verso i pendenti, non di
@@ -178,7 +178,8 @@ function createClosureFanout({
           resource: '/asks',
           target,
           origin: { node: self, cell: session || 'unknown' },
-          payload: { askId, closeOutcome: outcome, ownerNode: self },
+          payload: { askId, closeOutcome: outcome, ownerNode: self,
+            ...(Number.isSafeInteger(ownerAskTs) && ownerAskTs > 0 ? { ownerAskTs } : {}) },
         });
         out.push({ target, status: r && r.status, ...(r && r.reason ? { reason: r.reason } : {}) });
       } catch (e) {
@@ -197,7 +198,7 @@ function createClosureFanout({
       const pendenti = out
         .filter((r) => !CLOSURE_DONE_STATUSES.has(r.status) && !CLOSURE_FINAL_STATUSES.has(r.status))
         .map((r) => r.target);
-      try { retry.enqueue({ askId, outcome, session, targets: pendenti }); } catch (_) {}
+      try { retry.enqueue({ askId, ownerAskTs, outcome, session, targets: pendenti }); } catch (_) {}
     }
     return out;
   }
@@ -464,7 +465,7 @@ function notifyRoutes({
         if (isClosure) {
           const owner = resolved.origin.node;
           const closed = asks.closeImported({
-            ownerId: owner, ownerAskId: b.askId, outcome: b.closeOutcome,
+            ownerId: owner, ownerAskId: b.askId, ownerAskTs: b.ownerAskTs, outcome: b.closeOutcome,
           });
           // closeImported rifiuta ({ok:false, reason:'store-unreadable'}) se lo
           // store locale e' illeggibile: l'alias NON e' stato chiuso. Rispondere
@@ -480,14 +481,17 @@ function notifyRoutes({
             const reason = closed.reason || 'store-unreadable';
             return res.status(503).json({ status: 'unavailable', reason });
           }
-          if (closed.changed && closed.ask) {
-            // Preserve the local alias id for older clients and the canonical
-            // owner ask id for clients that merge aliases with feed cards.
+          if (!closed.generationMismatch) {
+            // The frame must reach the exported view even when the store had
+            // nothing to change (alias absent, or already closed by a
+            // duplicate): a fresh page rebuilds its cards from that view, and
+            // only a generation mismatch may refuse the closure.
             notifier.deliverOnlyRaw({
               type: b.closeOutcome === 'dismissed' ? 'ask-dismissed' : 'ask-answered',
-              id: closed.ask.id,
+              id: (closed.ask && closed.ask.id) || b.askId,
               ownerId: owner,
-              ownerAskId: closed.ask.ownerAskId,
+              ownerAskId: (closed.ask && closed.ask.ownerAskId) || b.askId,
+              ...(Number.isSafeInteger(b.ownerAskTs) && b.ownerAskTs > 0 ? { ownerAskTs: b.ownerAskTs } : {}),
             });
           }
           return res.json({ status: 'delivered', closed: closed.changed });
@@ -514,23 +518,29 @@ function notifyRoutes({
         if (!out.ok) {
           return res.status(out.reason === 'cap' ? 429 : 400).json({ status: 'refused', reason: out.reason, error: out.error });
         }
-        if (out.suppressed) return res.json({ status: 'delivered', suppressed: true, ownerId: owner });
+        if (out.suppressed || out.elided) {
+          const reason = out.suppressed ? 'suppressed' : 'elided';
+          try { log(`ask ingress ${owner}/${b.askId}: ${reason}, ui=0 push=0`); } catch (_) {}
+          return res.json({ status: 'delivered', ...(out.suppressed ? { suppressed: true } : { elided: true }), ownerId: owner, alertStatus: reason, alert: { ui: 0, push: 0, uiAttempted: false, pushAttempted: false } });
+        }
         const ask = out.ask;
         // deliverOnly: consegna locale alla UI, NIENTE pubblicazione sul feed e
         // niente ri-esportazione. E' l'invariante che uccide il loop A->B->A per
         // costruzione — un ask importato non torna mai indietro, esattamente
         // come una notify federata.
-        notifier.deliverOnlyRaw({ type: 'ask', ask });
-        await notifier.deliverOnly({
+        const cardUi = notifier.deliverOnlyRaw({ type: 'ask', ask });
+        const alert = await notifier.deliverOnly({
           title: `domanda da ${ask.session}`,
           body: ask.question,
           urgency: 'high',
           session: ask.session,
           lang: 'it',
-          askId: ask.id,
+          ownerId: owner, askId: ask.ownerAskId || ask.id,
+          ...(Number.isSafeInteger(ask.ownerAskTs) && ask.ownerAskTs > 0 ? { ownerAskTs: ask.ownerAskTs } : { ownerAskFingerprint: asks.askFingerprint(ask) }),
           url: `/#ask=${ask.id}`,
         });
-        return res.json({ status: 'delivered', id: ask.id, ownerId: ask.ownerId });
+        try { log(`ask ingress ${owner}/${b.askId}: accepted, cardUi=${cardUi || 0} ui=${alert.ui} push=${alert.push} alert=${alert.alertStatus}`); } catch (_) {}
+        return res.json({ status: 'delivered', id: ask.id, ownerId: ask.ownerId, deduped: out.deduped === true, cardUi: cardUi || 0, alertStatus: alert.alertStatus, alert });
       }
 
       // --- domanda locale ----------------------------------------------------
@@ -572,7 +582,7 @@ function notifyRoutes({
               ownerNode: self,
             },
           });
-          fanout.push({ target, status: r && r.status, ...(r && r.reason ? { reason: r.reason } : {}) });
+          fanout.push({ target, status: r && r.status, ...(r && r.reason ? { reason: r.reason } : {}), ...(r && r.alertStatus ? { alertStatus: r.alertStatus, alert: r.alert } : {}), ...(r && r.suppressed === true ? { suppressed: true } : {}), ...(r && r.elided === true ? { elided: true } : {}), ...(r && typeof r.deduped === 'boolean' ? { deduped: r.deduped } : {}) });
         } catch (e) {
           fanout.push({ target, status: 'unknown', reason: 'dispatch-threw' });
           try { log(`ask fan-out verso ${target} fallito: ${String(e && e.message || e)}`); } catch (_) {}
@@ -592,7 +602,7 @@ function notifyRoutes({
         urgency: 'high',
         session: ask.session,
         lang: 'it',
-        askId: ask.id,
+        ownerId: self, askId: ask.id, ownerAskTs: ask.ts,
         url: `/#ask=${ask.id}`,
       });
       res.status(201).json({ id: ask.id, ...(fanout.length ? { fanout } : {}) });