@raidiant/notifai 10.1.7 → 11.0.2

package/dist/{hooks.js → hook-lifecycle.js}

@@ -1,43 +1,17 @@
 import { randomBytes } from 'node:crypto';
-import { closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync, } from 'node:fs';
-import path from 'node:path';
-import { REPLY_MAX_WINDOW_SECONDS } from '@raidiant/notifai-protocol';
-import { LEGACY_QUESTION_CLAIM_TTL_SECONDS, QUESTION_STOP_TEARDOWN_HEADROOM_SECONDS, QUESTION_SUBMISSION_COMPLETION_HEADROOM_SECONDS, QUESTION_WAITER_CEILING_SECONDS, } from './question-timing.js';
-import { ApiCallError, isRetryableReplyPollError, } from './client.js';
-import { loadConfig, projectSessionPointerPath, sanitizeSessionId, sessionConfigPath, stateDir, } from './config.js';
-import { buildDraft } from './send.js';
-import { atomicWriteFileSync } from './atomic-file.js';
+import { ApiCallError, isRetryableReplyPollError } from './client.js';
 import { withFileLock } from './file-lock.js';
-import { inferInvocationContext } from './invocation-context.js';
-import { HARNESS_CAPABILITIES, HOOK_INSTALLABLE_HARNESSES, } from './harnesses.js';
-/**
- * A retirement is only worth syncing while the question it retires could still
- * be answered, so this has to outlive the longest reply window a user can
- * choose — it is derived from that bound rather than from a guess about how
- * long questions stay open, which is exactly the assumption that broke when
- * the window stopped being one hour. Past it the companion shows the question
- * as dead on next open anyway. Also the backstop that keeps an unreachable
- * server from growing the queue for ever.
- */
-const ORPHAN_TTL_MS = (REPLY_MAX_WINDOW_SECONDS + 3600) * 1000;
-/** More orphans than this means something is looping; keep the newest. */
-const ORPHAN_QUEUE_CAP = 50;
-/** Keep immutable session grouping while replacing per-event Git location authoritatively. */
-function sourceContextAtHookEvent(source, cwd) {
-    const invocation = cwd === undefined ? null : inferInvocationContext(cwd);
-    const current = {
-        ...(source?.session_id !== undefined ? { session_id: source.session_id } : {}),
-        ...(source?.session_label !== undefined ? { session_label: source.session_label } : {}),
-        ...(source?.harness !== undefined ? { harness: source.harness } : {}),
-        ...(invocation?.branch !== undefined ? { branch: invocation.branch } : {}),
-        ...(invocation?.worktree !== undefined ? { worktree: invocation.worktree } : {}),
-    };
-    return Object.keys(current).length === 0 ? undefined : current;
-}
-function summarizeRequestIds(entries) {
-    const ids = entries.flatMap((entry) => entry.request_id === undefined ? [] : [entry.request_id]);
-    return { ids, display: ids.join(', ') };
-}
+import { HARNESS_CAPABILITIES } from './harnesses.js';
+import { gate } from './hook-gates.js';
+import { acknowledgementBlockContext, amendAcceptedAnswers, answersContext, finishCommittedDelivery, holdForAcknowledgement, reconcileAcknowledgementObligations, resetAcknowledgementBlocks, settleAcceptedAnswers, stageAcceptedAnswers, stopAnswerOutput, } from './hook-acknowledgements.js';
+import { clearMatchingProjectSession, writeProjectSession } from './hook-project-sessions.js';
+import { claimHandoffState, claimQuestionPush, releaseQuestionPush } from './hook-question-lock.js';
+import { closeQuietly, drainOrphanRetirements, drainRetirements, finalizeReplies, orphanRetirements, pendingAnsweredByPrompt, retirePendings, retiringQuestion, } from './hook-question-retirement.js';
+import { clearFrozenSubmission, dropPendingQuestion, isSamePending, pendingQuestions, rememberQuestionState, sourceContextAtHookEvent, summarizeRequestIds, } from './hook-question-state.js';
+import { clearSessionState, markSessionEnded, pendingList, readSessionState, sessionHasEnded, sessionStatePath, updateSessionState, writeSessionState, writeSessionStateUnlocked, } from './hook-session-state.js';
+import { userPromptContextOutput } from './session-activation.js';
+import { QUESTION_STOP_TEARDOWN_HEADROOM_SECONDS, QUESTION_SUBMISSION_COMPLETION_HEADROOM_SECONDS, QUESTION_WAITER_CEILING_SECONDS, } from './question-timing.js';
+import { buildDraft } from './send.js';
 /**
  * The wire contract's shortest reply window. A question submitted with less
  * than this is rejected outright, and accepting one would in any case let the
@@ -70,409 +44,6 @@ async function awaitTerminalFirstWindow(ctx, askedAt, ceilingAt) {
     if (remaining > 0)
         await ctx.sleep(remaining);
 }
-function sessionStatePath(sessionId, env) {
-    return path.join(stateDir(env), 'sessions', `${sanitizeSessionId(sessionId)}.json`);
-}
-/**
- * Durable cancellation for observers that can outlive the harness process.
- *
- * Absence of session state is not enough: SessionEnd deliberately deletes it,
- * and an in-flight submit/fence could otherwise recreate it afterwards. The
- * marker shares the session-state lock, giving every racing writer one total
- * order: either its state lands before SessionEnd and is cleaned up there, or
- * it observes this marker and must not write or deliver into the ended session.
- */
-function sessionEndMarkerPath(sessionId, env) {
-    return path.join(stateDir(env), 'sessions', `${sanitizeSessionId(sessionId)}.ended`);
-}
-function sessionHasEnded(sessionId, env) {
-    return existsSync(sessionEndMarkerPath(sessionId, env));
-}
-function markSessionEnded(sessionId, env, now) {
-    const stateFile = sessionStatePath(sessionId, env);
-    withFileLock(`${stateFile}.lock`, () => {
-        atomicWriteFileSync(sessionEndMarkerPath(sessionId, env), `${now}\n`);
-    });
-}
-function clearSessionEndMarker(sessionId, env) {
-    const stateFile = sessionStatePath(sessionId, env);
-    withFileLock(`${stateFile}.lock`, () => {
-        rmSync(sessionEndMarkerPath(sessionId, env), { force: true });
-    });
-}
-export function readSessionState(sessionId, env) {
-    const file = sessionStatePath(sessionId, env);
-    if (!existsSync(file))
-        return {};
-    try {
-        const parsed = JSON.parse(readFileSync(file, 'utf8'));
-        if (typeof parsed !== 'object' || parsed === null)
-            return {};
-        const state = { ...parsed };
-        delete state.session_id;
-        return state;
-    }
-    catch {
-        // A corrupt marker must not wedge the harness; treat it as "no evidence",
-        // which fails closed onto ordinary terminal behaviour.
-        return {};
-    }
-}
-/**
- * Resolve a stable question or request id to the one exact session that owns it.
- *
- * This deliberately searches lifecycle state, not checkout pointers: question
- * identity is global on this machine, while a linked worktree is only where a
- * command happened to run. Ambiguous or corrupt matches fail closed.
- */
-export function findOwningSession(id, env) {
-    const directory = path.join(stateDir(env), 'sessions');
-    if (!existsSync(directory))
-        return { sessionId: null, ambiguous: false };
-    const matches = [];
-    for (const name of readdirSync(directory)) {
-        if (!name.endsWith('.json'))
-            continue;
-        let persisted = null;
-        try {
-            const parsed = JSON.parse(readFileSync(path.join(directory, name), 'utf8'));
-            if (typeof parsed === 'object' && parsed !== null) {
-                persisted = parsed;
-            }
-        }
-        catch {
-            // Corrupt lifecycle state is not identity evidence.
-        }
-        if (persisted === null || typeof persisted.session_id !== 'string')
-            continue;
-        const sessionId = persisted.session_id;
-        const state = persisted;
-        const pendingMatch = pendingList(state).some((entry) => entry.question_id === id || entry.request_id === id);
-        const retiringMatch = (state.retiring ?? []).some((entry) => entry.question_id === id || entry.request_id === id);
-        const historyMatch = (state.question_history ?? []).some((entry) => entry.question_id === id || entry.request_id === id);
-        const acknowledgementMatch = (state.acknowledgement_due ?? []).some((entry) => entry.request_id === id);
-        const acceptedMatch = state.accepted?.answers.some(({ pending }) => pending.question_id === id || pending.request_id === id) ?? false;
-        if (pendingMatch || retiringMatch || historyMatch || acknowledgementMatch || acceptedMatch) {
-            matches.push(sessionId);
-            if (matches.length > 1)
-                return { sessionId: null, ambiguous: true };
-        }
-    }
-    return { sessionId: matches[0] ?? null, ambiguous: false };
-}
-export function writeSessionState(sessionId, env, state) {
-    const file = sessionStatePath(sessionId, env);
-    withFileLock(`${file}.lock`, () => writeSessionStateUnlocked(file, sessionId, state));
-}
-export function clearSessionState(sessionId, env) {
-    const file = sessionStatePath(sessionId, env);
-    withFileLock(`${file}.lock`, () => {
-        rmSync(file, { force: true });
-        // The session override lives in a sibling file; leaving it behind meant a
-        // later session reusing the id silently inherited `ask_notifications = false`.
-        rmSync(sessionConfigPath(sessionId, env), { force: true });
-    });
-}
-function writeSessionStateUnlocked(file, sessionId, state) {
-    atomicWriteFileSync(file, `${JSON.stringify({ ...state, session_id: sessionId }, null, 2)}\n`);
-}
-function updateSessionState(sessionId, env, update) {
-    const file = sessionStatePath(sessionId, env);
-    return withFileLock(`${file}.lock`, () => {
-        const current = readSessionState(sessionId, env);
-        // SessionEnd and every asynchronous writer share this lock. Once the
-        // durable marker exists, no observer may recreate state for that session.
-        if (sessionHasEnded(sessionId, env))
-            return current;
-        const next = update(current);
-        writeSessionStateUnlocked(file, sessionId, next);
-        return next;
-    });
-}
-/** Record the current installation when an owner session starts. */
-export function recordSessionStart(sessionId, env, harness, cwd, codexStopDefinitionFingerprint) {
-    // Harnesses may reuse a session id only by explicitly starting that session
-    // again. That lifecycle edge is the sole authority for clearing cancellation.
-    clearSessionEndMarker(sessionId, env);
-    updateSessionState(sessionId, env, (current) => {
-        const next = {
-            ...current,
-            ...(harness === undefined ? {} : { harness }),
-            ...(cwd === undefined
-                ? {}
-                : { activation_cwd: harness === 'codex' ? cwd : current.activation_cwd ?? cwd }),
-        };
-        // A Codex SessionStart materializes one new runtime generation. Absence of
-        // singular proof must replace prior proof too; retaining it would let a
-        // resumed session borrow the definition loaded by an earlier runtime.
-        if (harness === 'codex') {
-            delete next.codex_stop_definition_fingerprint;
-            if (codexStopDefinitionFingerprint !== undefined) {
-                next.codex_stop_definition_fingerprint = codexStopDefinitionFingerprint;
-            }
-        }
-        return next;
-    });
-}
-/** Atomically claim Cursor's first-Stop activation fallback once per conversation. */
-export function claimCursorStopActivation(sessionId, env, now) {
-    const claimGuardMs = 30_000;
-    let claimed = false;
-    updateSessionState(sessionId, env, (current) => {
-        if (current.cursor_activation_confirmed_at !== undefined)
-            return current;
-        if (current.cursor_activation_claimed_at !== undefined &&
-            now - current.cursor_activation_claimed_at < claimGuardMs) {
-            return current;
-        }
-        claimed = true;
-        return { ...current, cursor_activation_claimed_at: now };
-    });
-    return claimed;
-}
-/** Cursor's loop_count proves the previous Stop follow-up reached the host. */
-export function confirmCursorStopActivation(sessionId, env, now) {
-    let owned = false;
-    updateSessionState(sessionId, env, (current) => {
-        if (current.cursor_activation_confirmed_at !== undefined) {
-            owned = true;
-            return current;
-        }
-        if (current.cursor_activation_claimed_at === undefined)
-            return current;
-        owned = true;
-        return { ...current, cursor_activation_confirmed_at: now };
-    });
-    return owned;
-}
-/** A fresh/cleared Cursor lifecycle makes its next Stop the fallback owner again. */
-export function resetCursorStopActivation(sessionId, env) {
-    updateSessionState(sessionId, env, (current) => {
-        if (current.cursor_activation_claimed_at === undefined &&
-            current.cursor_activation_confirmed_at === undefined) {
-            return current;
-        }
-        const next = { ...current };
-        delete next.cursor_activation_claimed_at;
-        delete next.cursor_activation_confirmed_at;
-        return next;
-    });
-}
-/**
- * Session state a crashed harness left behind.
- *
- * `SessionEnd` removes session state and leaves a short-lived cancellation
- * marker; a harness that crashes or is killed never reaches it. At roughly a
- * hundred sessions a day that is tens of thousands of files a year, none of
- * which anything reads.
- *
- * Opportunistic rather than scheduled: hooks are the only thing that runs, so
- * a hook is where this has to live. It is rate-limited by its own stamp file
- * so the common case costs one `stat`, not a directory walk — a Stop hook is
- * on the critical path of every turn.
- */
-const SESSION_PRUNE_AFTER_MS = 7 * 24 * 3600 * 1000;
-const SESSION_PRUNE_INTERVAL_MS = 24 * 3600 * 1000;
-export function pruneAbandonedSessions(env, now = Date.now(), maxAgeMs = SESSION_PRUNE_AFTER_MS) {
-    const directory = path.join(stateDir(env), 'sessions');
-    const stamp = path.join(stateDir(env), 'last-prune');
-    try {
-        if (existsSync(stamp) && now - statSync(stamp).mtimeMs < SESSION_PRUNE_INTERVAL_MS)
-            return 0;
-        mkdirSync(path.dirname(stamp), { recursive: true });
-        writeFileSync(stamp, '', { mode: 0o600 });
-        if (!existsSync(directory))
-            return 0;
-        let removed = 0;
-        for (const name of readdirSync(directory)) {
-            const file = path.join(directory, name);
-            try {
-                const age = now - statSync(file).mtimeMs;
-                // A negative age means the clock moved, not that the file is old.
-                // Deleting live session state on an NTP correction would lose a
-                // question already on the user's phone.
-                if (age <= maxAgeMs)
-                    continue;
-                rmSync(file, { force: true });
-                removed += 1;
-            }
-            catch {
-                // A file that vanished under us, or one we may not read. Neither is
-                // worth failing a hook for, and the next pass will see it again.
-            }
-        }
-        return removed;
-    }
-    catch {
-        // Housekeeping must never be the reason a turn fails.
-        return 0;
-    }
-}
-/**
- * One question, one push, even with two Stop hooks racing.
- *
- * Path-independent hook ownership stops the *usual* cause of two handlers
- * firing, but it cannot stop every one — two harnesses in one directory, or an
- * install this build does not recognise. Both processes would read the same
- * pending question, see no `request_id`, and both escalate: one question, two
- * notifications.
- *
- * Exclusive create is atomic on POSIX, so exactly one process gets the claim
- * and the other steps aside. A short guard serializes stale replacement with
- * contenders and releases; random ownership tokens keep an old holder from
- * unlinking its replacement. A live PID owns the claim regardless of age; a
- * known-dead PID is recoverable immediately. Only legacy/corrupt claims with
- * no trustworthy PID fall back to an age limit.
- */
-const CLAIM_TTL_MS = LEGACY_QUESTION_CLAIM_TTL_SECONDS * 1000;
-/**
- * How long a crashed claim *guard* blocks the next hook.
- *
- * The claim itself may legitimately be held for the whole waiter, so it takes
- * that ceiling. The guard is a short lock around the claim's own bookkeeping —
- * a few file operations — and borrowing the waiter's ceiling for it meant a
- * hook killed at exactly the wrong moment wedged this session's Stop path for
- * eight minutes, for a critical section that never runs longer than a second.
- */
-const CLAIM_GUARD_TTL_MS = 30_000;
-const heldClaims = new Map();
-export function claimQuestionPush(sessionId, env, now = Date.now(), beforeStaleReplace, ownerDeadlineAt) {
-    const file = claimPath(sessionId, env);
-    const guard = `${file}.guard`;
-    const token = randomBytes(12).toString('base64url');
-    const pendingQuestionIds = pendingList(readSessionState(sessionId, env)).map(claimQuestionIdentity);
-    mkdirSync(path.dirname(file), { recursive: true });
-    if (!acquireClaimGuard(guard))
-        return false;
-    try {
-        try {
-            writeFileSync(file, `${JSON.stringify({ pid: process.pid, at: now, token, pending_question_ids: pendingQuestionIds, ...(ownerDeadlineAt === undefined ? {} : { owner_deadline_at: ownerDeadlineAt }) })}\n`, {
-                mode: 0o600,
-                flag: 'wx',
-            });
-            heldClaims.set(file, token);
-            return true;
-        }
-        catch {
-            // Held. Break it only if whoever holds it cannot still be running.
-            try {
-                const held = JSON.parse(readFileSync(file, 'utf8'));
-                const age = typeof held.at === 'number' ? now - held.at : Number.POSITIVE_INFINITY;
-                if (typeof held.pid === 'number') {
-                    if (processIsAlive(held.pid))
-                        return false;
-                }
-                else if (age >= 0 && age < CLAIM_TTL_MS) {
-                    return false;
-                }
-            }
-            catch {
-                // Unreadable or corrupt: treat as abandoned.
-            }
-            beforeStaleReplace?.();
-            rmSync(file, { force: true });
-            try {
-                writeFileSync(file, `${JSON.stringify({ pid: process.pid, at: now, token, pending_question_ids: pendingQuestionIds, ...(ownerDeadlineAt === undefined ? {} : { owner_deadline_at: ownerDeadlineAt }) })}\n`, {
-                    mode: 0o600,
-                    flag: 'wx',
-                });
-                heldClaims.set(file, token);
-                return true;
-            }
-            catch {
-                return false;
-            }
-        }
-    }
-    finally {
-        rmSync(guard, { force: true });
-    }
-}
-function claimQuestionIdentity(entry) {
-    return entry.question_id ?? `${entry.asked_at ?? 'legacy'}\u0000${entry.question}`;
-}
-/** True only when the live owner could not have snapshotted this unpushed ask. */
-function claimHandoffState(sessionId, env) {
-    const unasked = pendingList(readSessionState(sessionId, env)).filter((entry) => entry.request_id === undefined);
-    if (unasked.length === 0)
-        return { hasNewQuestion: false };
-    try {
-        const held = JSON.parse(readFileSync(claimPath(sessionId, env), 'utf8'));
-        if (!Array.isArray(held.pending_question_ids))
-            return { hasNewQuestion: false };
-        const snapshotted = new Set(held.pending_question_ids.filter((entry) => typeof entry === 'string'));
-        return {
-            hasNewQuestion: unasked.some((entry) => !snapshotted.has(claimQuestionIdentity(entry))),
-            ...(typeof held.owner_deadline_at === 'number' &&
-                Number.isFinite(held.owner_deadline_at)
-                ? { ownerDeadlineAt: held.owner_deadline_at }
-                : {}),
-        };
-    }
-    catch {
-        return { hasNewQuestion: false };
-    }
-}
-function processIsAlive(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (err) {
-        return err.code === 'EPERM';
-    }
-}
-export function releaseQuestionPush(sessionId, env) {
-    const file = claimPath(sessionId, env);
-    const token = heldClaims.get(file);
-    if (token === undefined)
-        return;
-    const guard = `${file}.guard`;
-    if (!acquireClaimGuard(guard)) {
-        heldClaims.delete(file);
-        return;
-    }
-    try {
-        try {
-            const held = JSON.parse(readFileSync(file, 'utf8'));
-            if (held.token === token)
-                rmSync(file, { force: true });
-        }
-        catch {
-            // Missing or replaced claims are not ours to release.
-        }
-    }
-    finally {
-        heldClaims.delete(file);
-        rmSync(guard, { force: true });
-    }
-}
-/** The guard serializes stale replacement and release; recover a crashed guard. */
-function acquireClaimGuard(file) {
-    for (let attempt = 0; attempt < 2; attempt += 1) {
-        try {
-            const handle = openSync(file, 'wx', 0o600);
-            closeSync(handle);
-            return true;
-        }
-        catch (err) {
-            if (err.code !== 'EEXIST')
-                return false;
-            try {
-                if (Date.now() - statSync(file).mtimeMs < CLAIM_GUARD_TTL_MS)
-                    return false;
-            }
-            catch {
-                // A vanished/corrupt guard is safe to retry once.
-            }
-            rmSync(file, { force: true });
-        }
-    }
-    return false;
-}
-function claimPath(sessionId, env) {
-    return path.join(stateDir(env), 'sessions', `${sanitizeSessionId(sessionId)}.claim`);
-}
 /**
  * A question is stored so a later hook can push it, and it reaches us from a
  * shell command, so its size is whatever the agent typed. The push itself is
@@ -481,166 +52,6 @@ function claimPath(sessionId, env) {
  * megabytes per session.
  */
 const MAX_STORED_QUESTION_CHARS = 2000;
-function storedProjectSessionPointer(candidate) {
-    if (typeof candidate !== 'object' || candidate === null || Array.isArray(candidate))
-        return null;
-    const entry = candidate;
-    if (typeof entry.session_id !== 'string' || entry.session_id === '')
-        return null;
-    if (typeof entry.updated_at !== 'number')
-        return null;
-    if (!HOOK_INSTALLABLE_HARNESSES.includes(entry.harness))
-        return null;
-    return {
-        sessionId: entry.session_id,
-        updatedAt: entry.updated_at,
-        harness: entry.harness,
-    };
-}
-function readStoredProjectSessionDocument(file) {
-    if (!existsSync(file))
-        return { root: {}, sessions: [] };
-    try {
-        const parsed = JSON.parse(readFileSync(file, 'utf8'));
-        if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
-            return { root: {}, sessions: [] };
-        }
-        const root = parsed;
-        return {
-            root,
-            sessions: Array.isArray(root['sessions']) ? root['sessions'] : [],
-        };
-    }
-    catch {
-        return { root: {}, sessions: [] };
-    }
-}
-/** Records every live session working in a directory, for `notifai ask`. */
-export function writeProjectSession(cwd, env, sessionId, now, harness) {
-    const file = projectSessionPointerPath(cwd, env);
-    withFileLock(`${file}.lock`, () => {
-        const stored = readStoredProjectSessionDocument(file);
-        const existing = [];
-        let refreshed = {};
-        for (const candidate of stored.sessions) {
-            const entry = storedProjectSessionPointer(candidate);
-            if (entry?.sessionId === sessionId) {
-                refreshed = { ...refreshed, ...candidate };
-            }
-            else if (entry === null || now - entry.updatedAt <= 24 * 3600 * 1000) {
-                existing.push(candidate);
-            }
-        }
-        atomicWriteFileSync(file, `${JSON.stringify({
-            ...stored.root,
-            sessions: [
-                ...existing,
-                { ...refreshed, session_id: sessionId, updated_at: now, harness },
-            ],
-        })}\n`);
-    });
-}
-function readStoredProjectSessionPointers(file) {
-    return readStoredProjectSessionDocument(file).sessions.flatMap((candidate) => {
-        const entry = storedProjectSessionPointer(candidate);
-        return entry === null ? [] : [entry];
-    });
-}
-/**
- * Resolves the session working in `cwd`. Stale pointers are ignored rather than
- * trusted: an id left by a session that ended days ago would send the question
- * into state nothing is watching.
- */
-export function readProjectSession(cwd, env, now, maxAgeMs = 24 * 3600 * 1000) {
-    return readProjectSessionPointer(cwd, env, now, maxAgeMs)?.sessionId ?? null;
-}
-/**
- * Every session that has fired a hook in this directory recently, newest first.
- *
- * This is the only local record of which harness sessions are actually alive
- * here, which makes it the tiebreaker when the environment alone cannot say
- * which harness owns the current shell.
- */
-export function readLiveProjectSessionPointers(cwd, env, now, maxAgeMs = 24 * 3600 * 1000) {
-    const file = projectSessionPointerPath(cwd, env);
-    return readStoredProjectSessionPointers(file)
-        .filter((entry) => now - entry.updatedAt <= maxAgeMs)
-        .filter((entry) => {
-        try {
-            // A pointer is routing evidence only while its session state still
-            // exists and parses. SessionEnd and explicit cleanup therefore
-            // invalidate it even when a crash prevented removal from this index.
-            const sessionFile = sessionStatePath(entry.sessionId, env);
-            if (!existsSync(sessionFile))
-                return false;
-            const state = JSON.parse(readFileSync(sessionFile, 'utf8'));
-            return typeof state === 'object' && state !== null && !Array.isArray(state);
-        }
-        catch {
-            return false;
-        }
-    })
-        .sort((left, right) => right.updatedAt - left.updatedAt)
-        .map((entry) => ({
-        sessionId: entry.sessionId,
-        harness: entry.harness,
-        updatedAt: entry.updatedAt,
-    }));
-}
-export function readProjectSessionPointer(cwd, env, now, maxAgeMs = 24 * 3600 * 1000) {
-    const latest = readLiveProjectSessionPointers(cwd, env, now, maxAgeMs)[0];
-    return latest === undefined ? null : { sessionId: latest.sessionId, harness: latest.harness };
-}
-export function readMatchingProjectSessionPointer(cwd, env, now, sessionId, harness, maxAgeMs = 24 * 3600 * 1000) {
-    const match = readLiveProjectSessionPointers(cwd, env, now, maxAgeMs).find((entry) => entry.sessionId === sessionId && entry.harness === harness);
-    return match === undefined ? null : { sessionId: match.sessionId, harness: match.harness };
-}
-function clearMatchingProjectSession(cwd, env, sessionId) {
-    const file = projectSessionPointerPath(cwd, env);
-    withFileLock(`${file}.lock`, () => {
-        const stored = readStoredProjectSessionDocument(file);
-        const remaining = stored.sessions.filter((candidate) => {
-            const entry = storedProjectSessionPointer(candidate);
-            return entry === null || entry.sessionId !== sessionId;
-        });
-        const hasUnknownRootFields = Object.keys(stored.root).some((key) => key !== 'sessions');
-        if (remaining.length === 0 && !hasUnknownRootFields) {
-            rmSync(file, { force: true });
-            return;
-        }
-        atomicWriteFileSync(file, `${JSON.stringify({
-            ...stored.root,
-            sessions: remaining,
-        })}\n`);
-    });
-}
-/**
- * Record one gate decision.
- *
- * `verdict` is what happened to the question and `reason` is the closed-set
- * name of the rule that decided it, so an agent can ask "why was it held" with
- * a filter rather than by matching on prose. The prose still exists — it is what
- * the user sees in the terminal — but it is free to be rewritten, and a log a
- * filter cannot rely on is a log nobody filters.
- */
-export const GATE_REASONS = [
-    'no-session',
-    'no-question',
-    'answered',
-    'continuation-repeat',
-    'continuation-limit',
-    'delivery-limit',
-    'acknowledgement-required',
-    'acknowledgement-abandoned',
-    'harness-cannot-continue',
-    'notifications-off',
-    'claimed-elsewhere',
-    'elapsed',
-    'proceeding',
-];
-function gate(ctx, verdict, reason, data = {}) {
-    ctx.log?.info('hook.gate', { verdict, reason, stage: 'queued', ...data });
-}
 /**
  * One round of the waiter's reply poll. Short enough that several questions
  * still share one wall clock, long enough not to hammer the server.
@@ -672,8 +83,9 @@ async function prepareQuestionSubmission(ctx, options) {
         return { error: 'no device can answer a question yet; leaving this to the terminal' };
     }
     const build = buildDraft(ctx.config, {
-        title: options.title,
-        body: options.body,
+        title: options.questions[0].text,
+        summary: options.summary,
+        ...(options.body !== undefined ? { body: options.body } : {}),
         lifecycle: { tier: 'needs_you' },
         ...(options.project !== undefined ? { project: options.project } : {}),
         ...(options.media !== undefined ? { media: options.media } : {}),
@@ -827,221 +239,6 @@ async function answerableDevices(ctx) {
         .filter((device) => configured === null || configured.includes(device.device_id))
         .map((device) => device.device_id);
 }
-/**
- * Close is a server-side serialization fence: a successful response contains
- * every reply that committed before the window closed. `null` is deliberately
- * different from an empty reply set — it means ownership could not be proven
- * final and the local record must stay recoverable.
- */
-async function finalizeReplies(ctx, requestId) {
-    try {
-        return await ctx.client.closeReplies(requestId);
-    }
-    catch {
-        return null;
-    }
-}
-/** Best effort only for already-journaled retirement debt. */
-async function closeQuietly(ctx, requestId) {
-    await finalizeReplies(ctx, requestId);
-}
-/**
- * Close the reply window so the server can mint the retirement push. Client
- * submissions cannot carry `question_retired`; that event is reserved for
- * server-origin state syncs.
- */
-async function proveRetirement(ctx, requestId) {
-    const response = await finalizeReplies(ctx, requestId);
-    const proven = response !== null;
-    ctx.log?.info('hook.retirement', {
-        request_id: requestId,
-        attempted: true,
-        proven,
-    });
-    return proven;
-}
-/**
- * Park a delivered question for retirement. Called at the moment we learn it is
- * dead, which is frequently not a moment we can reach the network.
- *
- * Nothing is parked for a question that never reached a device: with no
- * request_id there is nothing on any device to retire.
- */
-export function parkForRetirement(sessionId, env, pending, state) {
-    const retirement = retiringQuestion(pending, state);
-    if (retirement === null)
-        return;
-    updateSessionState(sessionId, env, (current) => {
-        const already = current.retiring ?? [];
-        const existing = already.findIndex((entry) => entry.request_id === retirement.request_id);
-        if (existing < 0) {
-            return rememberQuestionState({ ...current, retiring: [...already, retirement] }, pending, state === 'answered' ? 'answered' : 'retired');
-        }
-        const retiring = [...already];
-        // An observed answer is final truth and upgrades an earlier supersession
-        // parked while the submission callback was racing a newer question.
-        if (retirement.state === 'answered' && retiring[existing].state !== 'answered') {
-            retiring[existing] = retirement;
-        }
-        return rememberQuestionState({ ...current, retiring }, pending, state === 'answered' ? 'answered' : 'retired');
-    });
-}
-/**
- * Convert live question state into a complete retirement instruction.
- *
- * A request/collapse pair without the original Delivery targets is not safe to
- * send: re-resolving today's routing can miss a device that still shows the
- * question or retire a device that never received it. Fail explicitly and keep
- * the pending record instead of silently broadening or narrowing the fanout.
- */
-function retiringQuestion(pending, state, cwd) {
-    // A submit journal is written before the first network byte. SessionEnd can
-    // therefore race a request that the server accepts after local cleanup. Its
-    // reserved request id and exact fanout are already sufficient retirement
-    // identity, even though the ordinary live fields have not been promoted yet.
-    const requestId = pending.request_id ?? pending.submission?.request_id;
-    const collapseKey = pending.collapse_key ?? pending.submission?.collapse_key;
-    const deviceIds = pending.device_ids ?? pending.submission?.device_ids;
-    const hasRequest = requestId !== undefined;
-    const hasCollapse = collapseKey !== undefined;
-    const hasDevices = deviceIds !== undefined && deviceIds.length > 0;
-    if (!hasRequest && !hasCollapse && !hasDevices)
-        return null;
-    if (!hasRequest || !hasCollapse || !hasDevices) {
-        throw new Error('live question state is incomplete; refusing to retire it without request, collapse, and device identifiers');
-    }
-    const source = sourceContextAtHookEvent(pending.source, cwd);
-    return {
-        ...(pending.question_id !== undefined ? { question_id: pending.question_id } : {}),
-        request_id: requestId,
-        collapse_key: collapseKey,
-        device_ids: [...deviceIds],
-        question: pending.question,
-        ...(pending.project !== undefined ? { project: pending.project } : {}),
-        ...(source !== undefined ? { source } : {}),
-        state,
-    };
-}
-const SHORT_CONFIRMATIONS = new Set(['done', 'yes', 'y', 'no', 'n', 'ok', 'okay']);
-function normalizePrompt(value) {
-    return value.trim().replace(/\s+/g, ' ').toLowerCase();
-}
-function pendingChoiceLabels(pending) {
-    const fromQuestions = (pending.questions ?? []).flatMap((question) => (question.choices ?? []).flatMap((choice) => [choice.label, choice.id]));
-    return fromQuestions.map(normalizePrompt).filter((label) => label.length > 0);
-}
-function pendingHasMatchingChoice(pending, normalizedPrompt) {
-    return pendingChoiceLabels(pending).includes(normalizedPrompt);
-}
-/**
- * Which outstanding questions this prompt plausibly answers.
- *
- * A unique closed-choice match is enough. A short confirmation such as "done"
- * matches only when exactly one question is outstanding. Long unrelated
- * prompts leave every question open for the reply window.
- */
-export function pendingAnsweredByPrompt(prompt, pending) {
-    const normalized = normalizePrompt(prompt ?? '');
-    if (normalized.length === 0 || pending.length === 0)
-        return [];
-    const labelled = pending.filter((entry) => pendingHasMatchingChoice(entry, normalized));
-    if (labelled.length === 1)
-        return labelled;
-    if (labelled.length > 1)
-        return [];
-    if (pending.length === 1 && SHORT_CONFIRMATIONS.has(normalized))
-        return [...pending];
-    return [];
-}
-/**
- * Send every parked retirement, and forget the ones that landed. A failure
- * leaves the entry in place for the next hook rather than losing it, which is
- * the whole reason the queue exists.
- */
-export async function drainRetirements(ctx, sessionId, env) {
-    const queue = readSessionState(sessionId, env).retiring ?? [];
-    if (queue.length === 0)
-        return [];
-    const retired = [];
-    for (const entry of queue) {
-        const proven = await proveRetirement(ctx, entry.request_id);
-        if (proven) {
-            retired.push(entry.request_id);
-            // Persist each success before touching the next entry. A later corrupt
-            // record or interrupted process must not resurrect work already done.
-            updateSessionState(sessionId, env, (current) => ({
-                ...current,
-                retiring: (current.retiring ?? []).filter((candidate) => candidate.request_id !== entry.request_id),
-            }));
-        }
-    }
-    return retired;
-}
-function orphanQueuePath(env) {
-    return path.join(stateDir(env), 'retire-queue.json');
-}
-function readOrphanQueue(env) {
-    const file = orphanQueuePath(env);
-    if (!existsSync(file))
-        return [];
-    try {
-        const parsed = JSON.parse(readFileSync(file, 'utf8'));
-        return Array.isArray(parsed) ? parsed : [];
-    }
-    catch {
-        // Same stance as session state: corruption fails closed to "nothing queued".
-        return [];
-    }
-}
-function writeOrphanQueueUnlocked(file, queue) {
-    atomicWriteFileSync(file, `${JSON.stringify(queue, null, 2)}\n`);
-}
-function updateOrphanQueue(env, update) {
-    const file = orphanQueuePath(env);
-    return withFileLock(`${file}.lock`, () => {
-        const next = update(readOrphanQueue(env));
-        writeOrphanQueueUnlocked(file, next);
-        return next;
-    });
-}
-/** Move retirements into the global queue; deduped so a retry costs nothing. */
-export function orphanRetirements(env, entries, now) {
-    if (entries.length === 0)
-        return;
-    updateOrphanQueue(env, (queue) => {
-        const known = new Set(queue.map((entry) => entry.request_id));
-        const added = entries
-            .filter((entry) => !known.has(entry.request_id))
-            .map((entry) => ({ ...entry, enqueued_at: now }));
-        return [...queue, ...added].slice(-ORPHAN_QUEUE_CAP);
-    });
-}
-/**
- * Retire everything a dead session left behind. Failures stay queued for the
- * next holder of a client; entries past the TTL are dropped as already dead.
- */
-export async function drainOrphanRetirements(ctx, env, now) {
-    const queue = readOrphanQueue(env);
-    if (queue.length === 0)
-        return [];
-    const done = [];
-    for (const entry of queue) {
-        const age = now - entry.enqueued_at;
-        // A negative age is a clock jump, not a fresh entry; retiring is idempotent
-        // and cheap, so treat it as due rather than letting it linger for ever.
-        if (age > ORPHAN_TTL_MS) {
-            done.push(entry.request_id);
-            updateOrphanQueue(env, (current) => current.filter((candidate) => candidate.request_id !== entry.request_id));
-            continue;
-        }
-        const proven = await proveRetirement(ctx, entry.request_id);
-        if (proven) {
-            done.push(entry.request_id);
-            updateOrphanQueue(env, (current) => current.filter((candidate) => candidate.request_id !== entry.request_id));
-        }
-    }
-    return done;
-}
 const LATE_STOP_POLL_SECONDS = 4;
 const LATE_PROMPT_POLL_SECONDS = 3;
 /**
@@ -1146,133 +343,6 @@ async function pollPendingReplies(ctx, live, timeoutSeconds) {
     }
     return { answered, transientTrouble, permanentFailures };
 }
-/** The registered-question queue. Anything but the current shape reads as empty. */
-function pendingList(state) {
-    return Array.isArray(state.pending) ? state.pending : [];
-}
-const QUESTION_HISTORY_CAP = 50;
-/** Keep a bounded, content-free map from local identity to its terminal state. */
-function rememberQuestionState(current, question, state) {
-    if (question.question_id === undefined)
-        return current;
-    const existing = (current.question_history ?? []).find((entry) => entry.question_id === question.question_id);
-    const terminalState = existing?.state === 'withdrawn' || existing?.state === 'answered'
-        ? existing.state
-        : state === 'answered'
-            ? 'answered'
-            : state;
-    const requestId = question.request_id ?? existing?.request_id;
-    const frozenRequestId = requestId === undefined
-        ? question.submission?.request_id ?? existing?.frozen_request_id
-        : undefined;
-    const record = {
-        question_id: question.question_id,
-        state: terminalState,
-        ...(requestId === undefined ? {} : { request_id: requestId }),
-        ...(frozenRequestId === undefined ? {} : { frozen_request_id: frozenRequestId }),
-    };
-    const history = [
-        ...(current.question_history ?? []).filter((entry) => entry.question_id !== question.question_id),
-        record,
-    ].slice(-QUESTION_HISTORY_CAP);
-    return { ...current, question_history: history };
-}
-function pendingQuestionView(entry) {
-    if (entry.question_id === undefined)
-        return null;
-    if (entry.request_id !== undefined) {
-        return {
-            question_id: entry.question_id,
-            state: 'live',
-            submitted: true,
-            request_id: entry.request_id,
-            frozen_request_id: null,
-        };
-    }
-    if (entry.submission !== undefined) {
-        return {
-            question_id: entry.question_id,
-            state: 'frozen',
-            submitted: null,
-            request_id: null,
-            frozen_request_id: entry.submission.request_id,
-        };
-    }
-    return {
-        question_id: entry.question_id,
-        state: 'local',
-        submitted: false,
-        request_id: null,
-        frozen_request_id: null,
-    };
-}
-/** Read one stable local question identity without minting or submitting anything. */
-export function inspectQuestionState(questionId, env) {
-    const owner = findOwningSession(questionId, env);
-    if (owner.ambiguous || owner.sessionId === null) {
-        return { found: false, ambiguous: owner.ambiguous };
-    }
-    const state = readSessionState(owner.sessionId, env);
-    const pending = pendingList(state).find((entry) => entry.question_id === questionId);
-    const pendingView = pending === undefined ? null : pendingQuestionView(pending);
-    if (pendingView !== null) {
-        return { found: true, session_id: owner.sessionId, question: pendingView };
-    }
-    const accepted = state.accepted?.answers.find(({ pending: entry }) => entry.question_id === questionId)?.pending;
-    if (accepted?.question_id !== undefined) {
-        return {
-            found: true,
-            session_id: owner.sessionId,
-            question: {
-                question_id: accepted.question_id,
-                state: 'answered',
-                submitted: true,
-                request_id: accepted.request_id ?? null,
-                frozen_request_id: null,
-            },
-        };
-    }
-    const retiring = (state.retiring ?? []).find((entry) => entry.question_id === questionId);
-    if (retiring?.question_id !== undefined) {
-        return {
-            found: true,
-            session_id: owner.sessionId,
-            question: {
-                question_id: retiring.question_id,
-                state: retiring.state === 'answered' ? 'answered' : 'retired',
-                submitted: true,
-                request_id: retiring.request_id,
-                frozen_request_id: null,
-            },
-        };
-    }
-    const history = (state.question_history ?? []).find((entry) => entry.question_id === questionId);
-    if (history !== undefined) {
-        return {
-            found: true,
-            session_id: owner.sessionId,
-            question: {
-                question_id: history.question_id,
-                state: history.state,
-                submitted: history.request_id !== undefined
-                    ? true
-                    : history.frozen_request_id !== undefined
-                        ? null
-                        : false,
-                request_id: history.request_id ?? null,
-                frozen_request_id: history.frozen_request_id ?? null,
-            },
-        };
-    }
-    return { found: false, ambiguous: false };
-}
-/** Registration identity — the convention every racing writer compares by. */
-function isSamePending(a, b) {
-    if (a.question_id !== undefined || b.question_id !== undefined) {
-        return a.question_id !== undefined && a.question_id === b.question_id;
-    }
-    return a.question === b.question && a.asked_at === b.asked_at;
-}
 /**
  * The frozen draft itself will never be accepted. Replaying it forever hides a
  * contract-skew (deleted fields, unexpected properties) as a recoverable wait.
@@ -1281,394 +351,6 @@ function isSamePending(a, b) {
 function isTerminalDraftRejection(err) {
     return err.status === 422 || (err.status === 400 && err.code === 'invalid_request');
 }
-export function dropPendingQuestion(sessionId, env, entry, terminalState = 'retired') {
-    updateSessionState(sessionId, env, (current) => {
-        const pending = pendingList(current).filter((candidate) => !isSamePending(candidate, entry));
-        const next = { ...current };
-        if (pending.length > 0)
-            next.pending = pending;
-        else
-            delete next.pending;
-        return rememberQuestionState(next, entry, terminalState);
-    });
-}
-/**
- * Drop registrations that never reached a device, so a later Stop cannot push
- * them. A retirement push would be noise: there is nothing on any device to
- * withdraw. Returns the withdrawn entries in registration order.
- */
-export function withdrawUnpushedQuestions(sessionId, env) {
-    let withdrawn = [];
-    updateSessionState(sessionId, env, (current) => {
-        const pending = pendingList(current);
-        withdrawn = pending.filter((entry) => entry.request_id === undefined);
-        if (withdrawn.length === 0)
-            return current;
-        const remaining = pending.filter((entry) => entry.request_id !== undefined);
-        const next = { ...current };
-        if (remaining.length > 0)
-            next.pending = remaining;
-        else
-            delete next.pending;
-        return withdrawn.reduce((remembered, entry) => rememberQuestionState(remembered, entry, 'withdrawn'), next);
-    });
-    return withdrawn;
-}
-function clearFrozenSubmission(sessionId, env, entry) {
-    updateSessionState(sessionId, env, (current) => {
-        const list = pendingList(current);
-        const index = list.findIndex((candidate) => isSamePending(candidate, entry));
-        if (index < 0)
-            return current;
-        const next = [...list];
-        const copy = { ...next[index] };
-        delete copy.submission;
-        next[index] = copy;
-        return { ...current, pending: next };
-    });
-}
-/** The question set this pending record pushes, however it was registered. */
-function pendingQuestions(pending) {
-    return pending.questions ?? [{ id: 'q1', text: pending.question }];
-}
-/** Did any question in the set offer choices? Decides how replies combine. */
-function pendingHasChoices(pending) {
-    return pendingQuestions(pending).some((question) => question.choices !== undefined);
-}
-/**
- * The answer as the agent should read it. For a question with choices the
- * latest reply IS the answer — an earlier conflicting one was corrected by
- * it. Free-text answers can arrive in parts, and every part reaches the
- * agent in the order it was written, so it can tell expansion from
- * correction itself.
- *
- * The continuation repeats only identity the agent actually registered and
- * the answer the server accepted. It never invents trust, urgency, permission,
- * or approval claims for the transport to assert.
- */
-function answerContext(answered) {
-    const { pending, replies } = answered;
-    const latest = replies.at(-1);
-    if (latest === undefined)
-        return 'Notifai — no answer was recorded.';
-    const answeredQuestionIds = [...new Set(latest.answers.map((answer) => answer.question_id))];
-    const identity = answeredQuestionIds.length === 0
-        ? ''
-        : `question_id${answeredQuestionIds.length === 1 ? '' : 's'} ${answeredQuestionIds.join(', ')}, `;
-    const question = `question ${JSON.stringify(pending.question)}`;
-    if (replies.length === 1 || pendingHasChoices(pending)) {
-        return `Notifai — ${identity}${question}; the user answered ${JSON.stringify(latest.text)}.`;
-    }
-    const parts = replies.map((reply) => JSON.stringify(reply.text)).join(', then ');
-    return (`Notifai — ${identity}${question}; the user answered in ${replies.length} parts, ` +
-        `in the order written: ${parts}. Later parts extend or correct earlier ones.`);
-}
-/**
- * Every answer that has arrived, as one message. Several registered questions
- * may resolve in one hook pass; the agent reads them together, each answer
- * tied to the question that asked it, with a truthful note about anything
- * still waiting.
- */
-function acknowledgementCommand(requestId, textRequired = true) {
-    return textRequired
-        ? `notifai acknowledge ${requestId} --text <text>`
-        : `notifai acknowledge ${requestId}`;
-}
-/**
- * The acknowledgement is owed either way; only its text is conditional. So the
- * instruction never says "you may skip this" — it says what to run.
- */
-function acknowledgementDemand(textRequired) {
-    return textRequired
-        ? ' with non-empty text saying what concrete work you will do because of the reply; a bare acknowledgement is insufficient'
-        : ' exactly as shown; this account turned acknowledgement text off, so the receipt carries no words';
-}
-function acknowledgementContext(answered) {
-    const due = answered.filter((entry) => entry.agent_acknowledgement_required === true && entry.pending.request_id !== undefined);
-    if (due.length === 0) {
-        return ' Agent Acknowledgement is not required for the answered request(s).';
-    }
-    if (due.length === 1) {
-        const entry = due[0];
-        const requestId = entry.pending.request_id;
-        const textRequired = entry.agent_acknowledgement_text_required !== false;
-        return (` Agent Acknowledgement is required for request ${requestId}. Immediately, before doing the resumed work or ending this turn, run ` +
-            `\`${acknowledgementCommand(requestId, textRequired)}\`${acknowledgementDemand(textRequired)}.`);
-    }
-    const anyTextRequired = due.some((entry) => entry.agent_acknowledgement_text_required !== false);
-    const commands = due
-        .map((entry) => {
-        const requestId = entry.pending.request_id;
-        return `- ${requestId}: \`${acknowledgementCommand(requestId, entry.agent_acknowledgement_text_required !== false)}\``;
-    })
-        .join('\n');
-    return (` Agent Acknowledgement is required for ${due.length} requests. Immediately, before doing the resumed work or ending this turn, run every command below${acknowledgementDemand(anyTextRequired)}:\n` +
-        commands);
-}
-function answersContext(answered, remaining) {
-    const tail = remaining > 0
-        ? ` (${remaining} more registered question${remaining === 1 ? ' is' : 's are'} still waiting for an answer.)`
-        : '';
-    const guidance = acknowledgementContext(answered);
-    if (answered.length === 1) {
-        return answerContext(answered[0]) + tail + guidance;
-    }
-    const lines = answered.map(({ pending, replies }) => {
-        const latest = replies.at(-1);
-        const answer = replies.length === 1 || pendingHasChoices(pending)
-            ? JSON.stringify(latest.text)
-            : `${replies.map((reply) => JSON.stringify(reply.text)).join(', then ')} (parts in the order written; later parts extend or correct earlier ones)`;
-        const ids = [...new Set(latest.answers.map((entry) => entry.question_id))];
-        const identity = ids.length === 0 ? '' : `question_id${ids.length === 1 ? '' : 's'} ${ids.join(', ')}: `;
-        return `- ${identity}${JSON.stringify(pending.question)} → ${answer}`;
-    });
-    return `Notifai — the user answered ${answered.length} questions:\n${lines.join('\n')}${tail}${guidance}`;
-}
-function stopAnswerOutput(context) {
-    return JSON.stringify({
-        decision: 'block',
-        reason: context,
-    });
-}
-/**
- * Close, truthfully retire, and forget every answered pending question in one
- * state write, without dropping any other retirement debt or any question
- * still waiting. Stop answers also open one bounded continuation generation;
- * UserPromptSubmit answers ride the user's new turn.
- */
-function stageAcceptedAnswers(ctx, sessionId, answered, remaining) {
-    const accepted = {
-        answers: answered,
-        remaining,
-        recorded_at: ctx.now(),
-    };
-    updateSessionState(sessionId, ctx.env, (current) => {
-        const pendingRemaining = pendingList(current).filter((entry) => !answered.some(({ pending }) => isSamePending(entry, pending)));
-        const acknowledgementDue = [...(current.acknowledgement_due ?? [])];
-        for (const answer of answered) {
-            const requestId = answer.pending.request_id;
-            if (answer.agent_acknowledgement_required === true &&
-                requestId !== undefined &&
-                !acknowledgementDue.some((entry) => entry.request_id === requestId)) {
-                acknowledgementDue.push({
-                    request_id: requestId,
-                    recorded_at: accepted.recorded_at,
-                    text_required: answer.agent_acknowledgement_text_required !== false,
-                });
-            }
-        }
-        const next = {
-            ...current,
-            accepted,
-        };
-        if (pendingRemaining.length > 0)
-            next.pending = pendingRemaining;
-        else
-            delete next.pending;
-        if (acknowledgementDue.length > 0)
-            next.acknowledgement_due = acknowledgementDue;
-        else
-            delete next.acknowledgement_due;
-        return answered.reduce((remembered, answer) => rememberQuestionState(remembered, answer.pending, 'answered'), next);
-    });
-    return accepted;
-}
-/** Amend the live accepted record in place, without resurrecting a settled one. */
-function amendAcceptedAnswers(ctx, sessionId, amend) {
-    updateSessionState(sessionId, ctx.env, (current) => current.accepted === undefined ? current : { ...current, accepted: amend(current.accepted) });
-}
-/**
- * Finish a route write that linearized before SessionEnd.
- *
- * Ordinary state writers stop at the ended marker. This one narrow completion
- * is allowed through because the journal's own `delivery_committed_at` proves
- * the irreversible write won the ordering first; without the matching finish,
- * a later SessionStart would replay a write that already reached the harness.
- */
-function finishCommittedDelivery(ctx, sessionId, accepted, deliveredRoute) {
-    const file = sessionStatePath(sessionId, ctx.env);
-    withFileLock(`${file}.lock`, () => {
-        const current = readSessionState(sessionId, ctx.env);
-        if (current.accepted?.recorded_at !== accepted.recorded_at ||
-            current.accepted.delivery_committed_at === undefined) {
-            return;
-        }
-        writeSessionStateUnlocked(file, sessionId, {
-            ...current,
-            accepted: {
-                ...current.accepted,
-                delivered_at: ctx.now(),
-                delivered_route: deliveredRoute,
-            },
-        });
-    });
-}
-export function clearAcknowledgementObligation(sessionId, env, requestId) {
-    let cleared = false;
-    updateSessionState(sessionId, env, (current) => {
-        const due = current.acknowledgement_due ?? [];
-        const remaining = due.filter((entry) => entry.request_id !== requestId);
-        cleared = remaining.length !== due.length;
-        if (!cleared)
-            return current;
-        const next = { ...current };
-        if (remaining.length > 0)
-            next.acknowledgement_due = remaining;
-        else
-            delete next.acknowledgement_due;
-        return next;
-    });
-    return cleared;
-}
-function acknowledgementBlockContext(due) {
-    const commands = due
-        .map((entry) => `- ${entry.request_id}: \`${acknowledgementCommand(entry.request_id, entry.text_required !== false)}\``)
-        .join('\n');
-    const anyTextRequired = due.some((entry) => entry.text_required !== false);
-    return (`Notifai — required Agent Acknowledgement${due.length === 1 ? '' : 's'} still missing for request${due.length === 1 ? '' : 's'} ${due.map((entry) => entry.request_id).join(', ')}. ` +
-        `Before doing more resumed work or ending this turn, run ${due.length === 1 ? 'this command' : 'every command'}${acknowledgementDemand(anyTextRequired)}:\n${commands}`);
-}
-/**
- * How many turns in a row a session may be held waiting for an acknowledgement.
- *
- * The gate is the one place hooks deliberately break the fail-open rule, and it
- * had no bound at all: an agent that could not or would not acknowledge — or a
- * server that stayed unreachable, since an error here counts as unresolved —
- * held every turn of that session for ever. Blocking a user's agent
- * indefinitely does not get them an acknowledgement; it costs them the agent as
- * well as the acknowledgement.
- */
-const MAX_ACKNOWLEDGEMENT_BLOCKS = 3;
-/**
- * Hold the turn for an outstanding acknowledgement, or give up and let it
- * through once holding has stopped being worth its cost.
- *
- * Returns the outcome that blocks the turn, or `null` to carry on.
- */
-function holdForAcknowledgement(ctx, sessionId, due, notes) {
-    if (due.length === 0)
-        return null;
-    const requestIds = due.map((entry) => entry.request_id);
-    const blocks = (readSessionState(sessionId, ctx.env).acknowledgement_blocks ?? 0) + 1;
-    if (blocks > MAX_ACKNOWLEDGEMENT_BLOCKS) {
-        // Drop the obligation with the reason recorded. The answer was already
-        // delivered; what is lost is the agent's receipt for it, and the log is
-        // where that loss stays visible.
-        for (const requestId of requestIds)
-            clearAcknowledgementObligation(sessionId, ctx.env, requestId);
-        resetAcknowledgementBlocks(sessionId, ctx.env);
-        gate(ctx, 'proceeding', 'acknowledgement-abandoned', {
-            request_ids: requestIds,
-            blocks: blocks - 1,
-            limit: MAX_ACKNOWLEDGEMENT_BLOCKS,
-        });
-        notes.push(`no acknowledgement after ${MAX_ACKNOWLEDGEMENT_BLOCKS} turns; continuing without one rather than holding this session for ever`);
-        return null;
-    }
-    updateSessionState(sessionId, ctx.env, (current) => ({
-        ...current,
-        acknowledgement_blocks: blocks,
-    }));
-    gate(ctx, 'held', 'acknowledgement-required', { request_ids: requestIds, blocks });
-    return {
-        stdout: stopAnswerOutput(acknowledgementBlockContext(due)),
-        notes,
-        log: { stage: 'acknowledgement-required', request_ids: requestIds },
-    };
-}
-/** A turn that was not held resets the streak; only consecutive holds count. */
-function resetAcknowledgementBlocks(sessionId, env) {
-    updateSessionState(sessionId, env, (current) => {
-        if (current.acknowledgement_blocks === undefined)
-            return current;
-        const next = { ...current };
-        delete next.acknowledgement_blocks;
-        return next;
-    });
-}
-async function reconcileAcknowledgementObligations(ctx, sessionId, due) {
-    const unresolved = [];
-    for (const obligation of due) {
-        try {
-            const snapshot = await ctx.client.agentAcknowledgement(obligation.request_id, {
-                waitSeconds: 0,
-            });
-            if (snapshot.agent_acknowledgement_required === false ||
-                snapshot.agent_acknowledgement !== null) {
-                clearAcknowledgementObligation(sessionId, ctx.env, obligation.request_id);
-            }
-            else {
-                unresolved.push(obligation);
-            }
-        }
-        catch (err) {
-            unresolved.push(obligation);
-            ctx.log?.error('hook.gate', {
-                verdict: 'held',
-                reason: 'acknowledgement-required',
-                stage: 'reconcile-failed',
-                request_id: obligation.request_id,
-                message: err instanceof Error ? err.message : String(err),
-            });
-        }
-    }
-    return unresolved;
-}
-/**
- * Retire the answered questions and close the journal.
- *
- * Called once an answer's delivery is acknowledged — by the route's own write,
- * or by the successor Stop of a blocking continuation. The continuation counter
- * grows with each settled generation, so the cap that bounds chained
- * answer-to-question loops is a real count rather than a constant 1.
- */
-function settleAcceptedAnswers(ctx, sessionId, accepted, cwd) {
-    const retirements = accepted.answers
-        .map(({ pending }) => retiringQuestion(pending, 'answered', cwd))
-        .filter((entry) => entry !== null);
-    updateSessionState(sessionId, ctx.env, (current) => {
-        const retiring = [...(current.retiring ?? [])];
-        for (const retirement of retirements) {
-            const existing = retiring.findIndex((entry) => entry.request_id === retirement.request_id);
-            if (existing < 0)
-                retiring.push(retirement);
-            else
-                retiring[existing] = retirement;
-        }
-        const next = { ...current, retiring };
-        delete next.accepted;
-        next.continuation = {
-            answered_at: accepted.recorded_at,
-            count: (current.continuation?.count ?? 0) + 1,
-        };
-        return next;
-    });
-}
-async function retirePendings(ctx, envelope, sessionId, entries, state) {
-    updateSessionState(sessionId, ctx.env, (current) => {
-        const retiring = [...(current.retiring ?? [])];
-        for (const entry of entries) {
-            const retirement = retiringQuestion(entry, state, envelope.cwd);
-            if (retirement !== null && !retiring.some((item) => item.request_id === retirement.request_id)) {
-                retiring.push(retirement);
-            }
-        }
-        const pending = pendingList(current).filter((candidate) => !entries.some((entry) => isSamePending(candidate, entry)));
-        const next = { ...current };
-        if (pending.length > 0)
-            next.pending = pending;
-        else
-            delete next.pending;
-        if (retiring.length > 0)
-            next.retiring = retiring;
-        else
-            delete next.retiring;
-        return entries.reduce((remembered, entry) => rememberQuestionState(remembered, entry, state === 'answered' ? 'answered' : 'retired'), next);
-    });
-    // Network retirement is deliberately deferred to a later no-question hook.
-    // The state write above is the durable operation; blocking here creates a
-    // crash window before an answer can reach harness stdout.
-}
 // ---------------------------------------------------------------------------
 // UserPromptSubmit — the user is at the keyboard
 // ---------------------------------------------------------------------------
@@ -1692,9 +374,21 @@ export async function handleUserPromptSubmit(ctx, envelope) {
         if (envelope.cwd !== undefined && ctx.harness !== undefined) {
             writeProjectSession(envelope.cwd, ctx.env, sessionId, ctx.now(), ctx.harness);
         }
-        notes.push(state.accepted.delivered_at === undefined
-            ? 'a device answer is safely journaled; the next Stop will deliver it'
-            : 'a device answer has already been delivered; the next Stop will close it out');
+        const stdout = userPromptContextOutput(ctx.harness, answersContext(state.accepted.answers, state.accepted.remaining));
+        if (stdout !== undefined) {
+            notes.push('the journaled device answer was added to the user\'s new turn');
+            return {
+                stdout,
+                decided: false,
+                notes,
+                log: {
+                    stage: 'context-added',
+                    route: 'user-prompt-submit',
+                    request_ids: state.accepted.answers.flatMap(({ pending }) => pending.request_id === undefined ? [] : [pending.request_id]),
+                },
+            };
+        }
+        notes.push('a device answer is safely journaled; the next Stop will deliver it');
         return { notes };
     }
     const live = pendingList(state).filter((entry) => entry.request_id !== undefined);
@@ -1789,12 +483,27 @@ export async function handleUserPromptSubmit(ctx, envelope) {
         writeProjectSession(envelope.cwd, ctx.env, sessionId, ctx.now(), ctx.harness);
     }
     if (lateAnswers.length > 0) {
-        // UserPromptSubmit has no later hook field proving its stdout reached the
-        // model. Keep the journal and let the next Stop use its acknowledged
-        // continuation channel instead of recreating the crash-before-stdout gap.
-        notes.push('the late device answer will continue the agent at this turn’s Stop');
+        // UserPromptSubmit can add context to the turn already beginning. Keep the
+        // accepted-answer journal until the agent acknowledges: if this process or
+        // host dies around stdout, a later prompt or Stop safely replays it.
+        const stdout = userPromptContextOutput(ctx.harness, answersContext(lateAnswers, 0));
+        if (stdout !== undefined)
+            notes.push('the late device answer was added to the user\'s new turn');
+        else
+            notes.push('the late device answer will continue the agent at this turn’s Stop');
         return {
             notes,
+            ...(stdout === undefined
+                ? {}
+                : {
+                    stdout,
+                    decided: false,
+                    log: {
+                        stage: 'context-added',
+                        route: 'user-prompt-submit',
+                        request_ids: lateAnswers.flatMap(({ pending }) => pending.request_id === undefined ? [] : [pending.request_id]),
+                    },
+                }),
             settlementRequired: pendingList(updated).some((entry) => entry.request_id === undefined),
         };
     }
@@ -1923,7 +632,13 @@ export async function runEscalationWaiter(ctx, options) {
             // on the answer — delivery is not consumption — but nothing later can
             // prove more, and an answer redelivered without end is strictly worse
             // than one settled on delivery. So a recorded delivery settles.
-            const deliveryProven = accepted.delivered_at !== undefined || envelope.stop_hook_active === true;
+            const acknowledgementProvesDelivery = accepted.answers.length > 0 &&
+                accepted.answers.every(({ pending, agent_acknowledgement_required }) => agent_acknowledgement_required === true &&
+                    pending.request_id !== undefined &&
+                    !(state.acknowledgement_due ?? []).some((entry) => entry.request_id === pending.request_id));
+            const deliveryProven = accepted.delivered_at !== undefined ||
+                envelope.stop_hook_active === true ||
+                acknowledgementProvesDelivery;
             if (!deliveryProven) {
                 for (const answer of accepted.answers)
                     reportAnswer(ctx, notes, answer, true);
@@ -2288,14 +1003,9 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
         const eventSource = sourceContextAtHookEvent(entry.source, envelope.cwd);
         let intent = entry.submission;
         if (intent === undefined) {
-            if (entry.body === undefined) {
-                notes.push('registered question has no canonical body; register it again with this CLI');
-                continue;
-            }
             const prepared = await prepareQuestionSubmission(ctx, {
-                // Type and Project have their own fields; the title is only substance.
-                title: questions[0].text,
-                body: entry.body,
+                summary: entry.summary,
+                ...(entry.body !== undefined ? { body: entry.body } : {}),
                 questions,
                 ...(entry.media !== undefined ? { media: entry.media } : {}),
                 ...(entry.project !== undefined ? { project: entry.project } : {}),
@@ -2369,14 +1079,9 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
                 if (entry.submission !== undefined) {
                     notes.push(`question submission was rejected (${err.code}, HTTP ${err.status}); reminting the draft in the current contract instead of replaying the frozen one`);
                     clearFrozenSubmission(sessionId, ctx.env, entry);
-                    if (entry.body === undefined) {
-                        dropPendingQuestion(sessionId, ctx.env, entry);
-                        notes.push('registered question has no canonical body; retired the frozen draft instead of retrying it');
-                        continue;
-                    }
                     const reminted = await prepareQuestionSubmission(ctx, {
-                        title: questions[0].text,
-                        body: entry.body,
+                        summary: entry.summary,
+                        ...(entry.body !== undefined ? { body: entry.body } : {}),
                         questions,
                         ...(entry.media !== undefined ? { media: entry.media } : {}),
                         ...(entry.project !== undefined ? { project: entry.project } : {}),
@@ -2873,7 +1578,4 @@ export function parseHookInput(raw) {
         return {};
     }
 }
-export function resolveHookConfig(cwd, env, sessionId) {
-    return loadConfig({ cwd, env, sessionId });
-}
-//# sourceMappingURL=hooks.js.map
+//# sourceMappingURL=hook-lifecycle.js.map