@mmmbuto/nexuscrew 0.9.64 → 0.9.66

package/lib/notify/ask-relay.js

@@ -14,10 +14,9 @@
 // refused locally until verification resolves the attempt.
 
 const crypto = require('node:crypto');
-const { NODE_NAME_RE } = require('../nodes/store.js');
 const { probeReverseSlot } = require('../nodes/reverse-slot-proof.js');
-const { askSlotVerifier, binding } = require('../nodes/ask-slot-verifier.js');
-const RELAY_DEADLINE_MS = 8000;
+const { askSlotVerifier } = require('../nodes/ask-slot-verifier.js');
+const { createOwnerChannel } = require('./owner-channel.js');
 const OWNER_REASONS = new Set([
   'reverse-slot-unverified', 'peer-unknown', 'events-disabled', 'grant-required:ask-action',
   'peer-visibility', 'origin-visibility', 'federated-origin-required', 'hop-chain',
@@ -37,148 +36,19 @@ function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = ()
   const attempts = new Map();
   const answerFlights = new Map();
 
-  const proofScope = nodesPath || loadStore;
-  function deadlineResult(op, args, capability) {
-    if (capability) return { ownerId: args.ownerId, askId: args.askId, canReply: false, status: 'unreachable', reason: 'relay-deadline' };
-    if (op.answer && op.delivered && args.rid) {
-      return { ok: false, code: 200, uncertain: true, requestId: args.rid, reason: 'delivery-unknown', error: 'esito incerto: verifica lo stato prima di rispondere' };
-    }
-    return { ok: false, code: 504, reason: 'relay-deadline', error: 'relay deadline' };
-  }
-  async function operation(args, work, capability = false, answer = false) {
-    const controller = new AbortController();
-    const op = { controller, answer, delivered: false, expired: false, proofKey: null, proofBinding: null };
-    let rejectAbort;
-    const aborted = new Promise((_resolve, reject) => { rejectAbort = () => reject(new Error('relay deadline')); });
-    controller.signal.addEventListener('abort', rejectAbort, { once: true });
-    op.active = () => !controller.signal.aborted;
-    op.check = () => { if (!op.active()) throw new Error('relay deadline'); };
-    op.wait = promise => Promise.race([promise, aborted]);
-    const timer = setTimeout(() => { op.expired = true; controller.abort(); }, RELAY_DEADLINE_MS);
-    try { return await Promise.race([Promise.resolve().then(() => work(op)), aborted]); }
-    catch (_) {
-      slotVerifier.invalidate(op.proofKey);
-      if (op.answer && op.delivered && args.rid) {
-        const entry = attempts.get(attemptKey(args.ownerId, args.askId, args.rid));
-        if (entry) entry.state = 'uncertain';
-      }
-      if (op.expired) return deadlineResult(op, args, capability);
-      return capability
-        ? { ownerId: args.ownerId, askId: args.askId, canReply: false, status: 'unreachable' }
-        : { ok: false, code: 502, error: 'owner unreachable' };
-    } finally {
-      clearTimeout(timer); controller.signal.removeEventListener('abort', rejectAbort); controller.abort();
-    }
-  }
-
+  const attemptKey = (ownerId, askId, rid) => `${ownerId}|${askId}|${rid}`;
+  // The channel to the owner (resolution, deadline, forwarding, hop proof) is
+  // SHARED with the notice dismissals: one implementation, one chain rule.
+  const channel = createOwnerChannel({
+    loadStore, now, fetchImpl, probeReverseSlotImpl, peers, localPort, localToken, nodesPath, slotVerifier,
+    sanitizeReason: safeReason,
+    onUncertain: (args) => {
+      const entry = attempts.get(attemptKey(args.ownerId, args.askId, args.rid));
+      if (entry) entry.state = 'uncertain';
+    },
+  });
   function requestId() { return crypto.randomUUID(); }
 
-  // Risoluzione del produttore: peer OUTBOUND (canale proprio, come sempre)
-  // oppure peer INBOUND condiviso con consenso eventi+risposta e slot reverse
-  // attivo. Per gli inbound la porta dello slot DEVE essere verificata con la
-  // stessa sonda dei terminali (secret del peer + instanceId atteso): nessun
-  // fallback sulla localPort senza proof.
-  async function candidateOwner(ownerId, op) {
-    let store = loadStore();
-    if (!store) return null;
-    let routed = null;
-    if (typeof peers === 'function') {
-      let inventory;
-      try { inventory = await op.wait(peers()); } catch (_) { op.check(); return null; }
-      op.check();
-      const matches = (Array.isArray(inventory) ? inventory : [])
-        .filter((p) => p && (p.nodeId === ownerId || p.instanceId === ownerId));
-      if (matches.length !== 1 || matches[0].stale === true) return null;
-      const route = matches[0].route;
-      if (!Array.isArray(route) || !route.length || route.length > 4
-        || route.some((name) => typeof name !== 'string' || !NODE_NAME_RE.test(name))
-        || new Set(route).size !== route.length) return null;
-      routed = [...route];
-    }
-    op.check();
-    store = loadStore();
-    if (!store) return null;
-    slotVerifier.sync(store, proofScope);
-    const nodes = store.nodes || [];
-    const direct = nodes.filter((n) => n && n.nodeId === ownerId);
-    if (direct.length > 1) return null;
-    const out = direct.find((n) => n.direction === 'outbound' && n.token && n.localPort);
-    if (out) return { node: out, forwardPort: out.localPort, forwardToken: out.token, kind: 'outbound', route: routed };
-    if (!direct.length && routed) return { node: null, kind: 'routed', route: routed };
-    const inbound = nodes.find((n) => n && n.direction === 'inbound'
-      && n.shared === true && n.nodeId === ownerId
-      && n.token
-      && n.askReplyAccess === true && n.eventsAccess === true
-      && n.cellVisibility !== 'none');
-    if (!inbound) return null;
-    const forwardToken = inbound.token;
-    const pool = inbound.reversePool;
-    const slot = pool && Array.isArray(pool.slots) ? pool.slots[pool.activeSlot] : null;
-    if (!slot || !Number.isInteger(slot.port)) {
-      return { node: inbound, forwardPort: null, forwardToken, kind: 'inbound-unverified', route: routed };
-    }
-    return { node: inbound, forwardPort: slot.port, forwardToken, kind: 'inbound', route: routed };
-  }
-
-  function ownerUrl(port, path) {
-    return `http://127.0.0.1:${port}/federation/route/_/${path.replace(/^\//, '')}`;
-  }
-
-  async function forward(candidate, path, { method = 'GET', body, expectedTs, op } = {}) {
-    op.check();
-    const st = loadStore();
-    slotVerifier.sync(st, proofScope);
-    if (candidate.kind === 'inbound' && !candidate.route) {
-      const current = st && (st.nodes || []).find(node => node.name === candidate.node.name);
-      const selected = binding(st, current);
-      if (!selected || selected.fingerprint !== op.proofBinding) {
-        slotVerifier.invalidate(op.proofKey);
-        const error = new Error('reverse slot changed'); error.reason = 'reverse-slot-unverified'; throw error;
-      }
-    }
-    const routed = candidate.route;
-    const url = routed
-      ? `http://127.0.0.1:${localPort()}/api/route/${routed.map(encodeURIComponent).join('/')}/_${path}`
-      : ownerUrl(candidate.forwardPort, path);
-    const headers = routed ? { authorization: `Bearer ${localToken()}` }
-      : { authorization: `Bearer ${candidate.forwardToken}`, 'x-nexuscrew-visited': st && st.nodeId || '' };
-    try {
-      op.check(); op.delivered = true;
-      const r = await op.wait(fetchImpl(url, { method, headers: { ...headers, 'content-type': 'application/json',
-        ...(expectedTs === undefined ? {} : { 'x-nexuscrew-ask-ts': String(expectedTs) }) },
-        ...(body === undefined ? {} : { body: JSON.stringify(body) }), signal: op.controller.signal }));
-      op.check();
-      const payload = await op.wait(r.json().catch(error => {
-        if ([403, 404, 501].includes(r.status)) return {};
-        throw error;
-      }));
-      op.check();
-      if (!r.ok) slotVerifier.invalidate(op.proofKey);
-      return { r, body: { ...payload, reason: safeReason(payload && payload.reason) } };
-    } catch (error) { slotVerifier.invalidate(op.proofKey); throw error; }
-  }
-
-  // Preflight del canale reverse per un peer inbound: rifiuto NETTO se lo slot
-  // non e' verificato (non e' un esito incerto: il forward non e' mai partito).
-  async function verifyInboundChannel(candidate, op) {
-    // REST routes prove the slot at their inbound proxy hop, never twice.
-    if (candidate.route) return { ok: true };
-    op.check();
-    const st = loadStore();
-    const proof = await op.wait(slotVerifier.verify({ store: st, peer: candidate.node, loadStore,
-      scope: proofScope, signal: op.controller.signal, probeImpl: probeReverseSlotImpl }));
-    op.check();
-    if (proof && proof.owned === true) {
-      op.proofKey = proof.key;
-      const selected = binding(st, candidate.node);
-      op.proofBinding = selected && selected.fingerprint;
-      return { ok: true };
-    }
-    return { ok: false, code: 404, error: 'canale reverse non verificato: risposta non inoltrata', reason: 'reverse-slot-unverified' };
-  }
-
-  function attemptKey(ownerId, askId, rid) { return `${ownerId}|${askId}|${rid}`; }
-
   function statusFor(ownerId, askId) {
     const out = [];
     for (const [key, a] of attempts) {
@@ -204,13 +74,13 @@ function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = ()
     if (!ownerId || !askId || typeof text !== 'string' || !text.trim()) {
       return { ok: false, code: 400, error: 'ownerId, askId e text richiesti' };
     }
-    const candidate = await candidateOwner(ownerId, op);
+    const candidate = await channel.candidateOwner(ownerId, op);
     if (!candidate) return { ok: false, code: 404, error: 'owner non tra i peer autorizzati', reason: 'owner-unknown' };
     if (candidate.kind === 'inbound-unverified') {
       return { ok: false, code: 404, error: 'canale reverse non verificato: risposta non inoltrata', reason: 'reverse-slot-unverified' };
     }
     if (candidate.kind === 'inbound') {
-      const gate = await verifyInboundChannel(candidate, op);
+      const gate = await channel.verifyInboundChannel(candidate, op);
       if (!gate.ok) return { ok: false, code: gate.code, error: gate.error, reason: gate.reason };
     }
     const peer = candidate.node;
@@ -226,7 +96,7 @@ function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = ()
     const store = loadStore();
     attempts.set(key, { requestId: rid, state: 'sent', askId, ownerId, digest: crypto.createHash('sha256').update(text).digest('hex') });
     try {
-      const { r, body } = await forward(candidate, `/event-feed/asks/${encodeURIComponent(askId)}/answer`, {
+      const { r, body } = await channel.forward(candidate, `/event-feed/asks/${encodeURIComponent(askId)}/answer`, {
         method: 'POST', body: { text, requestId: rid }, op,
       });
       op.check();
@@ -263,7 +133,7 @@ function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = ()
       if (entry) entry.state = 'failed';
       return { ok: false, code: r.status, error: `HTTP ${r.status}`, reason: body.reason };
     } catch (error) {
-      if (!op.active()) return deadlineResult(op, { ownerId, askId, rid }, false);
+      if (!op.active()) return channel.deadlineResult(op, { ownerId, askId, rid }, false);
       if (!op.delivered) {
         const entry = attempts.get(key); if (entry) entry.state = 'failed';
         return { ok: false, code: 404, reason: error.reason || 'reverse-slot-unverified', error: 'risposta non inoltrata' };
@@ -285,7 +155,7 @@ function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = ()
     const pending = answerFlights.get(key);
     if (pending && pending.digest !== digest) return { ok: false, code: 409, reason: 'request-conflict', error: 'stesso requestId con testo diverso' };
     if (pending) return pending.promise;
-    const flight = operation({ ...args, rid }, op => relayAnswerOnce({ ...args, rid }, op), false, true);
+    const flight = channel.operation({ ...args, rid }, op => relayAnswerOnce({ ...args, rid }, op), false, true);
     const slot = { promise: flight, digest };
     answerFlights.set(key, slot);
     try { return await flight; } finally { if (answerFlights.get(key) === slot) answerFlights.delete(key); }
@@ -301,38 +171,38 @@ function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = ()
   }
 
   async function relayDismissOnce({ ownerId, askId, expectedTs } = {}, op) {
-    const candidate = await candidateOwner(ownerId, op);
+    const candidate = await channel.candidateOwner(ownerId, op);
     if (!candidate) return { ok: false, code: 404, error: 'owner non tra i peer autorizzati', reason: 'owner-unknown' };
     if (candidate.kind === 'inbound-unverified') {
       return { ok: false, code: 404, error: 'canale reverse non verificato: risposta non inoltrata', reason: 'reverse-slot-unverified' };
     }
     if (candidate.kind === 'inbound') {
-      const gate = await verifyInboundChannel(candidate, op);
+      const gate = await channel.verifyInboundChannel(candidate, op);
       if (!gate.ok) return { ok: false, code: gate.code, error: gate.error, reason: gate.reason };
     }
     const peer = candidate.node;
     const store = loadStore();
     try {
-      const { r, body } = await forward(candidate, `/event-feed/asks/${encodeURIComponent(askId)}`, { method: 'DELETE', expectedTs, op });
+      const { r, body } = await channel.forward(candidate, `/event-feed/asks/${encodeURIComponent(askId)}`, { method: 'DELETE', expectedTs, op });
       if (!r.ok) return { ok: false, code: r.status, error: 'owner refused', reason: body.reason, retryAfterMs: retryAfterMs(r) };
       return { ok: true, ...(body.outcome ? { outcome: body.outcome } : {}) };
-    } catch (e) { if (!op.active()) return deadlineResult(op, { ownerId, askId }, false); return { ok: false, code: 502, reason: safeReason(e.reason), error: 'owner unreachable' }; }
+    } catch (e) { if (!op.active()) return channel.deadlineResult(op, { ownerId, askId }, false); return { ok: false, code: 502, reason: safeReason(e.reason), error: 'owner unreachable' }; }
   }
 
   async function verifyStatusOnce({ ownerId, askId, requestId: rid }, op) {
-    const candidate = await candidateOwner(ownerId, op);
+    const candidate = await channel.candidateOwner(ownerId, op);
     if (!candidate) return { ok: false, code: 404, error: 'owner non tra i peer autorizzati', reason: 'owner-unknown' };
     if (candidate.kind === 'inbound-unverified') {
       return { ok: false, code: 404, error: 'canale reverse non verificato: risposta non inoltrata', reason: 'reverse-slot-unverified' };
     }
     if (candidate.kind === 'inbound') {
-      const gate = await verifyInboundChannel(candidate, op);
+      const gate = await channel.verifyInboundChannel(candidate, op);
       if (!gate.ok) return { ok: false, code: gate.code, error: gate.error, reason: gate.reason };
     }
     const peer = candidate.node;
     const store = loadStore();
     try {
-      const { r, body } = await forward(candidate,
+      const { r, body } = await channel.forward(candidate,
         `/event-feed/asks/${encodeURIComponent(askId)}/requests/${encodeURIComponent(rid)}`, { op });
       if (!r.ok) return { ok: false, code: r.status, reason: body.reason, error: 'owner refused' };
       op.check();
@@ -344,22 +214,22 @@ function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = ()
         ...(body.ownerId ? { ownerId: body.ownerId } : {}), ...(body.askId ? { askId: body.askId } : {}),
         ...(body.actor ? { actor: body.actor } : {}), ...(body.receipt ? { receipt: body.receipt } : {}) };
     } catch (e) {
-      if (!op.active()) return deadlineResult(op, { ownerId, askId }, false);
+      if (!op.active()) return channel.deadlineResult(op, { ownerId, askId }, false);
       return { ok: false, code: 502, reason: safeReason(e.reason), error: 'owner unreachable' };
     }
   }
 
   async function replyCapabilityOnce({ ownerId, askId } = {}, op) {
     const denied = (status, reason) => ({ ownerId, askId, canReply: false, status, ...(reason ? { reason } : {}) });
-    const candidate = await candidateOwner(ownerId, op);
+    const candidate = await channel.candidateOwner(ownerId, op);
     if (!candidate) return denied('unreachable', 'owner-unknown');
     if (candidate.kind === 'inbound-unverified') { op.channelUnavailable = true; return denied('unreachable', 'reverse-slot-unverified'); }
     if (candidate.kind === 'inbound') {
-      const gate = await verifyInboundChannel(candidate, op);
+      const gate = await channel.verifyInboundChannel(candidate, op);
       if (!gate.ok) { op.channelUnavailable = true; return denied('unreachable', gate.reason); }
     }
     try {
-      const { r, body } = await forward(candidate, `/event-feed/asks/${encodeURIComponent(askId)}/capability`, { op });
+      const { r, body } = await channel.forward(candidate, `/event-feed/asks/${encodeURIComponent(askId)}/capability`, { op });
       if (['reverse-slot-unverified', 'federation-peer-unreachable', 'federation-peer-timeout'].includes(body.reason)) { op.channelUnavailable = true; return denied('unreachable', body.reason); }
       if (r.status === 404 || r.status === 501) return denied('unsupported', body.reason);
       if (r.status === 403) return denied('denied', body.reason);
@@ -371,14 +241,14 @@ function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = ()
   }
 
   async function inspectDismissalOnce({ ownerId, askId } = {}, op) {
-    const candidate = await candidateOwner(ownerId, op);
+    const candidate = await channel.candidateOwner(ownerId, op);
     if (!candidate) return { ok: false, code: 404, reason: 'owner-unknown' };
     if (candidate.kind === 'inbound-unverified') return { ok: false, code: 404, reason: 'reverse-slot-unverified' };
     if (candidate.kind === 'inbound') {
-      const proof = await verifyInboundChannel(candidate, op);
+      const proof = await channel.verifyInboundChannel(candidate, op);
       if (!proof.ok) return proof;
     }
-    const { r, body } = await forward(candidate, `/event-feed/asks/${encodeURIComponent(askId)}/capability`, { op });
+    const { r, body } = await channel.forward(candidate, `/event-feed/asks/${encodeURIComponent(askId)}/capability`, { op });
     if (!r.ok) return { ok: false, code: r.status, reason: body.reason || 'unknown', retryAfterMs: retryAfterMs(r) };
     if (body.ownerId !== ownerId || body.askId !== askId || !['open', 'answered', 'dismissed'].includes(body.status)) {
       return { ok: false, code: 403, reason: 'unknown' };
@@ -392,10 +262,10 @@ function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = ()
     }
     return { ok: true, status: body.status, ask, generationPrecondition: true };
   }
-  function inspectDismissal(args = {}) { return operation(args, op => inspectDismissalOnce(args, op)); }
+  function inspectDismissal(args = {}) { return channel.operation(args, op => inspectDismissalOnce(args, op)); }
 
-  function relayDismiss(args = {}) { return operation(args, op => relayDismissOnce(args, op)); }
-  function verifyStatus(args = {}) { return operation(args, op => verifyStatusOnce(args, op)); }
+  function relayDismiss(args = {}) { return channel.operation(args, op => relayDismissOnce(args, op)); }
+  function verifyStatus(args = {}) { return channel.operation(args, op => verifyStatusOnce(args, op)); }
   function channelBinding(ownerId) {
     const store = loadStore();
     // Kept only in process memory; credentials never enter the dismissal store.
@@ -407,7 +277,7 @@ function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = ()
   }
   function replyCapability(args = {}) {
     const initial = channelBinding(args.ownerId);
-    return operation(args, async op => {
+    return channel.operation(args, async op => {
       const result = await replyCapabilityOnce(args, op);
       channelObservations.set(args.ownerId, { at: now(), binding: initial, unavailable: op.channelUnavailable === true });
       return result;

package/lib/notify/event-feed-asks-routes.js

@@ -17,7 +17,7 @@ const express = require('express');
 const nodesStore = require('../nodes/store.js');
 const accessPresets = require('../nodes/access-presets.js');
 const { createAudioAcl } = require('../audio/acl.js');
-const { visibilityAllows } = require('./event-feed-acl.js');
+const { visibilityAllows, allowsEnvelope, peerGrants } = require('./event-feed-acl.js');
 
 const ANSWER_RATE_PER_MIN = 6;
 const ANSWER_GLOBAL_PER_MIN = 30;
@@ -69,8 +69,23 @@ function createAskActionGate(deps) {
     if (grants.some((view) => !view.configured || view.grants.eventsAccess !== true || view.grants.askReplyAccess !== true)) {
       return refuse(403, 'grant-required:ask-action');
     }
+    // Two different questions, two different rules — on purpose.
+    //
+    // `allows` keeps the ask-action semantics it always had: the target CELL is
+    // visible only if EVERY ring of the chain can see it.
+    //
+    // `allowsEnvelope` answers for a whole envelope (scope 'node' needs
+    // nodeEventsAccess) and follows the SNAPSHOT's rule instead, because the
+    // dismissals use it to decide whether the peer may clear the entry it is
+    // pointing at: the snapshot resolves the ORIGIN peer and nothing else
+    // (`event-feed-routes.js:64` `resolvePeer(store, visited[0])`) and refuses
+    // relays outright (`:58`), so the node that asks is judged by its own view.
+    // Intersecting the rings here would be stricter than the snapshot on a
+    // two-hop request: a node could not clear a notice it does see.
+    const originGrants = peerGrants(st, actor);
     return { self, actor, peer: { nodeId: deliveringId, grants: grants[0].grants,
-      allows: ({ cellId }) => grants.every((view) => visibilityAllows(view.grants, cellId)) } };
+      allows: ({ cellId }) => grants.every((view) => visibilityAllows(view.grants, cellId)),
+      allowsEnvelope: (envelope) => !!originGrants && allowsEnvelope(originGrants, envelope) } };
   };
 }
 
@@ -205,4 +220,4 @@ function createEventFeedAsksRoutes(deps) {
   return r;
 }
 
-module.exports = { createEventFeedAsksRoutes, createAskRateLimiter };
+module.exports = { createEventFeedAsksRoutes, createAskActionGate, createAskRateLimiter };

package/lib/notify/event-feed-client.js

@@ -11,6 +11,8 @@
 // dies by construction. Transport failures back off with jitter 5→60 s; a
 // stream silent for 60 s is aborted and resynced.
 
+const askCell = require('./ask-cell.js');
+
 const BACKOFF_MIN_MS = 5000;
 const BACKOFF_MAX_MS = 60000;
 const IDLE_TIMEOUT_MS = 60000;
@@ -90,6 +92,13 @@ function createEventFeedClient(opts = {}) {
   //   stale, lastError}; generation guards against obsolete fetches.
   const isAskDismissed = typeof opts.isAskDismissed === 'function' ? opts.isAskDismissed : () => false;
   const visibleAsks = (ownerId, asks) => asks.filter(ask => !isAskDismissed(ownerId, ask));
+  // Notices THIS node has already cleared locally while the owner has not taken
+  // the dismissal yet (queued, or refused for good): the local intent is what the
+  // operator acted on, so the notice must not come back to a node that reloads or
+  // restarts and rebuilds this view from the owner's snapshot. Applied at IMPORT,
+  // where every notice enters the view — a dismissal drops the one already held —
+  // so nothing else has to filter on read.
+  const isNoticeDismissed = typeof opts.isNoticeDismissed === 'function' ? opts.isNoticeDismissed : () => false;
   const views = new Map();
   const running = new Map(); // nodeId -> {abort}
   let stopped = false;
@@ -169,6 +178,36 @@ function createEventFeedClient(opts = {}) {
     return true;
   }
 
+  // Notices the owner said are CLEARED. Same shape and same reasoning as the
+  // ask tombstones above, with the TTL of the store that produced them (15
+  // minutes, the life of the notice itself) and the view epoch, so an event id
+  // reused after an owner reset is not suppressed forever.
+  const NOTICE_TOMBSTONE_TTL_MS = 15 * 60 * 1000;
+  const noticeTombstones = new Map(); // `${ownerId}|${eventId}` -> {at, epoch}
+
+  function noticeTombstoneKey(ownerId, eventId) { return `${ownerId}|${eventId}`; }
+
+  function noteNoticeClosed(ownerId, eventId, epoch) {
+    if (!ownerId || !eventId) return;
+    noticeTombstones.set(noticeTombstoneKey(ownerId, eventId), { at: now(), epoch });
+    if (noticeTombstones.size > 4096) noticeTombstones.delete(noticeTombstones.keys().next().value);
+  }
+
+  function noticeIsClosed(ownerId, eventId, epoch) {
+    const key = noticeTombstoneKey(ownerId, eventId);
+    const hit = noticeTombstones.get(key);
+    if (!hit) return false;
+    if (now() - hit.at > NOTICE_TOMBSTONE_TTL_MS) { noticeTombstones.delete(key); return false; }
+    if (typeof hit.epoch === 'number' && typeof epoch === 'number' && hit.epoch !== epoch) return false;
+    return true;
+  }
+
+  function dropNoticeFromView(ownerId, eventId) {
+    const view = viewFor(ownerId);
+    view.notifications = view.notifications.filter((n) => (n && n.eventId) !== eventId);
+    return view;
+  }
+
   function dropAskFromView(ownerId, askId) {
     const view = viewFor(ownerId);
     view.asks = view.asks.filter((a) => (a.ownerAskId || a.id) !== askId);
@@ -222,6 +261,28 @@ function createEventFeedClient(opts = {}) {
     }
   }
 
+  // An ask of a snapshot, attributed to its owner, with the cell the OWNER
+  // resolved for it. `cellId` on the wire becomes `ownerCellId` here (validated by
+  // the schema check) and any `ownerCellId`/`originCell` the wire carried is
+  // dropped: those two names are ours, set only by authenticated ingress. When the
+  // snapshot has no cell for the ask, the cell the view already held for the SAME
+  // generation (same owner timestamp and content) is kept; a new generation never
+  // inherits it.
+  function withOwnerCell(wire, ownerId, knownCells) {
+    const { cellId, ownerCellId: _forged, originCell: _forgedOrigin, ...ask } = wire;
+    const out = { ...ask, ownerId };
+    if (askCell.isCellId(cellId)) return { ...out, ownerCellId: cellId };
+    const hit = knownCells.get(out.ownerAskId || out.id);
+    if (hit) {
+      const { askFingerprint } = require('./asks.js');
+      const priorTs = Object.hasOwn(hit.prior, 'ownerAskTs') ? hit.prior.ownerAskTs : hit.prior.ts;
+      const nextTs = Object.hasOwn(out, 'ownerAskTs') ? out.ownerAskTs : out.ts;
+      if (Number.isSafeInteger(priorTs) && priorTs > 0 && priorTs === nextTs
+        && askFingerprint(hit.prior) === askFingerprint(out)) return { ...out, ownerCellId: hit.cellId };
+    }
+    return out;
+  }
+
   // Apply a fetched snapshot ONLY if it belongs to the current generation:
   // an obsolete fetch must never overwrite a newer view (the snapshot
   // WINS over the previous view of the same owner).
@@ -231,13 +292,29 @@ function createEventFeedClient(opts = {}) {
     view.cursor = snap.cursor || null;
     // A snapshot taken before the owner processed a dismiss still carries the
     // ask: the tombstone is what keeps it from coming back.
+    // What this view already knows about the cell of each ask, taken BEFORE the
+    // view is replaced: an owner that does not publish the cell in its snapshot
+    // (older release) must not make a card forget what its live frame said.
+    const knownCells = new Map();
+    for (const prior of [...view.asks, ...(view.alertAsks ? view.alertAsks.values() : [])]) {
+      const resolved = askCell.resolveAskCell({ ownerCellId: prior.ownerCellId, originCell: prior.originCell });
+      if (resolved.cellId) knownCells.set(prior.ownerAskId || prior.id, { prior, cellId: resolved.cellId });
+    }
     view.asks = Array.isArray(snap.asks)
       ? snap.asks
         .filter((a) => a && !askIsClosed(ownerId, a.ownerAskId || a.id, snap.viewEpoch, a) && !isAskDismissed(ownerId, a))
-        .map((a) => ({ ...a, ownerId }))
+        .map((a) => withOwnerCell(a, ownerId, knownCells))
       : [];
     view.alertAsks = new Map(); // fresh snapshot replaces all live-only alert sources
-    view.notifications = Array.isArray(snap.notifications) ? snap.notifications.map((e) => ({ ...e, ownerId })) : [];
+    // A snapshot taken before the owner processed the dismissal still carries
+    // the notice: the tombstone is what keeps it from coming back, exactly like
+    // the ask above.
+    view.notifications = Array.isArray(snap.notifications)
+      ? snap.notifications
+        .filter((e) => e && !noticeIsClosed(ownerId, e.eventId, snap.viewEpoch)
+          && !isNoticeDismissed(ownerId, e.eventId))
+        .map((e) => ({ ...e, ownerId }))
+      : [];
     view.fleetState = snap.fleetState || null;
     view.askReplyAccess = snap.askReplyAccess === true;
     view.viewEpoch = snap.viewEpoch;
@@ -349,14 +426,21 @@ function createEventFeedClient(opts = {}) {
         ...alertFields(alertFrame),
         originNode: envelope.ownerId, ownerId: envelope.ownerId,
         ...(envelope.scope === 'cell' && envelope.cellId ? { originCell: envelope.cellId } : {}),
-        eventId: envelope.eventId, ts: Date.now(),
+        eventId: envelope.eventId,
+        // Origin time, not rebroadcast time: toast and card must tell the
+        // same truth as the owner's emission (emittedAt), falling back only
+        // when an envelope somehow carries none.
+        ts: Number.isFinite(envelope.emittedAt) ? envelope.emittedAt : Date.now(),
       });
       // The first legacy alert may have created an unknown admission during
       // broadcast. Bind that admission before any following known replay.
       if (historicalAsk && typeof opts.onAuthoritativeAsks === 'function') opts.onAuthoritativeAsks(envelope.ownerId, [historicalAsk]);
     } else if (f.type === 'ask') {
       const ask = { id: f.askId, question: f.question, options: f.options, session: f.session, ts: f.ts,
-        ownerAskTs: Number.isSafeInteger(f.askTs) && f.askTs > 0 ? f.askTs : null, ownerId: envelope.ownerId };
+        ownerAskTs: Number.isSafeInteger(f.askTs) && f.askTs > 0 ? f.askTs : null, ownerId: envelope.ownerId,
+        // The envelope of an ask frame is scoped to the cell the owner resolved;
+        // it is the owner's statement, carried on the authenticated stream.
+        ...(envelope.scope === 'cell' && askCell.isCellId(envelope.cellId) ? { ownerCellId: envelope.cellId } : {}) };
       if (!rememberLiveAsk(envelope.ownerId, ask)) return false;
       if (typeof opts.onAuthoritativeAsks === 'function') opts.onAuthoritativeAsks(envelope.ownerId, [ask]);
       opts.eventsHub.broadcast({ type: 'ask', ownerId: envelope.ownerId, eventId: envelope.eventId,
@@ -378,6 +462,16 @@ function createEventFeedClient(opts = {}) {
       opts.eventsHub.broadcast({ type: f.outcome === 'dismissed' ? 'ask-dismissed' : 'ask-answered',
         id: f.askId, ownerAskId: f.askId, ownerId: envelope.ownerId, eventId: envelope.eventId,
         ...(ownerAskTs ? { ownerAskTs } : {}) });
+    } else if (f.type === 'notify-closed' || f.type === 'notify-closed-node') {
+      // The owner cleared a notice. The card leaves the exported view of every
+      // device that reads this feed, live, and the tombstone keeps an anterior
+      // snapshot from handing it back. The frame carries the id of the notice it
+      // closes, not its own: the envelope id only moves the cursor.
+      const eventId = typeof f.eventId === 'string' ? f.eventId : '';
+      if (!eventId) return false;
+      dismissNoticeConfirmed(envelope.ownerId, eventId);
+      opts.eventsHub.broadcast({ type: 'notify-dismissed', ownerId: envelope.ownerId, eventId,
+        ...(envelope.scope === 'cell' && envelope.cellId ? { originCell: envelope.cellId } : {}) });
     } else if (f.type === 'file-notice') {
       // Stessa forma della consegna locale (lib/files/routes.js): il nome del
       // file e' SEMPRE nel corpo, con la caption quando c'e'. Prima l'importato
@@ -389,7 +483,8 @@ function createEventFeedClient(opts = {}) {
         // DELLA CELLA, e senza questo campo il relay lo contava come scope nodo
         // (budget diverso: 7 avvisi invece di 6).
         ...(envelope.scope === 'cell' && envelope.cellId ? { originCell: envelope.cellId } : {}),
-        eventId: envelope.eventId, ts: Date.now() });
+        eventId: envelope.eventId,
+        ts: Number.isFinite(envelope.emittedAt) ? envelope.emittedAt : Date.now() });
     } else if (f.type === 'fleet-state' || f.type === 'node-state') {
       opts.eventsHub.broadcast({ type: 'feed-state', ownerId: envelope.ownerId, eventId: envelope.eventId, state: f });
     }
@@ -580,7 +675,8 @@ function createEventFeedClient(opts = {}) {
   //     punto non è mai 'ok' (reason 'snapshot-schema:<campo>') — lo snapshot
   //     non si applica, niente applicazione parziale.
   // Produttore di riferimento: lib/notify/event-feed-routes.js buildSnapshot
-  // (emette sempre i campi della view e marca resyncRequired a ogni cap).
+  // (emette sempre i campi della view e marca resyncRequired solo quando la
+  // fonte aveva più voci del cap, non a pagina piena).
   function validateSnapshot(ownerId, snap, bytes, contentType, profile = 'view') {
     if (!snap || typeof snap !== 'object') return { ok: false, reason: 'shape' };
     if (bytes > 3 * 1024 * 1024) return { ok: false, reason: 'snapshot-oversize' };
@@ -605,11 +701,12 @@ function createEventFeedClient(opts = {}) {
       && Buffer.byteLength(JSON.stringify(e), 'utf8') <= SNAPSHOT_ELEMENT_MAX_BYTES;
     // Cap di pagina e per-elemento: identità e misura. Id non stringa o vuoto,
     // elemento non oggetto o fuori budget → 'snapshot-element-oversize'
-    // (mapping storico invariato, il cap resta un cap). Il cap di pagina vale
-    // a quota PIENA (>= SNAPSHOT_MAX_ASKS): il produttore marca resyncRequired
-    // proprio a quella quota, quindi un elenco al cap SENZA marcatore non è
-    // una forma dell'owner e non prova l'assenza di nessuna domanda.
-    if (snap.asks.length >= SNAPSHOT_MAX_ASKS
+    // (mapping storico invariato, il cap resta un cap). SOPRA il cap (>): il
+    // produttore marca resyncRequired solo quando la FONTe superava la pagina,
+    // quindi una pagina ESATTAMENTE al cap senza marcatore è una forma
+    // legittima dell'owner — la pagina al cap È il suo elenco aperto — mentre
+    // OLTRE il cap la lista non prova l'assenza di nessuna domanda.
+    if (snap.asks.length > SNAPSHOT_MAX_ASKS
       || !snap.asks.every((a) => boundedElement(a) && boundedId(a && a.id))) {
       return { ok: false, reason: 'snapshot-element-oversize' };
     }
@@ -650,6 +747,9 @@ function createEventFeedClient(opts = {}) {
       && (a.question === undefined || typeof a.question === 'string')
       && (a.options === undefined || Array.isArray(a.options))
       && (a.session === undefined || typeof a.session === 'string')
+      // The cell the OWNER resolved for the ask: absent (an older owner, or a
+      // session the owner could not resolve) or a well-formed cell id, never anything else.
+      && (a.cellId === undefined || askCell.isCellId(a.cellId))
       && (a.ts === undefined || typeof a.ts === 'number');
     if (!snap.asks.every(askFieldsOk)) return schema('asks');
     return { ok: true };
@@ -912,6 +1012,19 @@ function createEventFeedClient(opts = {}) {
     return true;
   }
 
+  // A notice dismissal this node has CONFIRMED (the owner's closure frame, or a
+  // relay that returned 2xx/404): only then does the view forget the notice, and
+  // only then is it tombstoned. Until then the card stays where it is.
+  function dismissNoticeConfirmed(ownerId, eventId) {
+    if (!ownerId || !eventId) return false;
+    const view = dropNoticeFromView(ownerId, eventId);
+    noteNoticeClosed(ownerId, eventId, view.viewEpoch);
+    if (typeof opts.onViewChanged === 'function') {
+      try { opts.onViewChanged(ownerId); } catch (_) { /* UI refresh cannot invalidate the closure. */ }
+    }
+    return true;
+  }
+
   // Esito TIPIZZATO: {status:'ok', asks} | {status:'skipped'|'pending'|'error',
   // reason, retryAt}. SOLO 'ok' è autorevole (snapshot fresco, col contratto
   // della decisione soddisfatto, acquisito in questa chiamata): uno skip, un
@@ -1009,7 +1122,7 @@ function createEventFeedClient(opts = {}) {
     }
   }
 
-  return { start, stop, poll, state, reemit, viewFor, dismissConfirmed, ownerSnapshotAsks, rememberLiveAsk, applyOwnerClosure };
+  return { start, stop, poll, state, reemit, viewFor, dismissConfirmed, dismissNoticeConfirmed, ownerSnapshotAsks, rememberLiveAsk, applyOwnerClosure };
 }
 
 module.exports = { createEventFeedClient };