@raidiant/notifai 11.3.2 → 11.4.0

package/dist/hook-lifecycle.js

@@ -3,13 +3,16 @@ import { ApiCallError, isRetryableReplyPollError } from './client.js';
 import { withFileLock } from './file-lock.js';
 import { HARNESS_CAPABILITIES } from './harnesses.js';
 import { gate } from './hook-gates.js';
-import { acknowledgementBlockContext, amendAcceptedAnswers, answersContext, classifyJournaledAcknowledgements, finishCommittedDelivery, holdForAcknowledgement, reconcileAcknowledgementObligations, recoverQueuedAnswers, resetAcknowledgementBlocks, settleAcceptedAnswers, stageAcceptedAnswers, stopAnswerOutput, } from './hook-acknowledgements.js';
+import { acknowledgementBlockContext, amendAcceptedAnswers, answersContext, classifyJournaledAcknowledgements, finishCommittedDelivery, holdForAcknowledgement, owedAcknowledgements, reconcileAcknowledgementObligations, recoverQueuedAnswers, resetAcknowledgementBlocks, settleAcceptedAnswers, stageAcceptedAnswers, stopAnswerOutput, } from './hook-acknowledgements.js';
 import { clearMatchingProjectSession, writeProjectSession } from './hook-project-sessions.js';
 import { claimHandoffState, claimQuestionPush, releaseQuestionPush } from './hook-question-lock.js';
-import { closeQuietly, drainOrphanRetirements, drainRetirements, finalizeReplies, orphanRetirements, pendingAnsweredByPrompt, retirePendings, retiringQuestion, } from './hook-question-retirement.js';
+import { closeQuietly, drainOrphanRetirements, drainRetirements, finalizeReplies, selectedForClaimedDelivery, orphanRetirements, pendingAnsweredByPrompt, retirePendings, retiringQuestion, } from './hook-question-retirement.js';
 import { admitQueuedQuestion, clearFrozenSubmission, dropPendingQuestion, isSamePending, pendingQuestions, questionSubmissionAttempted, queuedQuestionStillEligible, rememberQuestionState, sourceContextAtHookEvent, summarizeRequestIds, } from './hook-question-state.js';
-import { clearSessionState, markSessionEnded, pendingList, readSessionState, sessionHasEnded, sessionStatePath, updateSessionState, writeSessionState, writeSessionStateUnlocked, } from './hook-session-state.js';
+import { clearSessionState, markSessionEnded, pendingList, readSessionState, sessionHasEnded, sessionStatePath, updateSessionState, writeSessionState, writeSessionStateUnlocked, recordSessionNotified, } from './hook-session-state.js';
+import { currentProcessIdentity } from './process-identity.js';
 import { userPromptContextOutput } from './session-activation.js';
+import { answersAlreadyWritten, beginHandOff, recordUnclaimedHandOffs, recoverDeliveryJournal, sweepDeliveryJournals, } from './session-delivery.js';
+import { WRITE_ABORTED_REASON } from './wake-support.js';
 import { QUESTION_STOP_TEARDOWN_HEADROOM_SECONDS, QUESTION_SUBMISSION_COMPLETION_HEADROOM_SECONDS, QUESTION_WAITER_CEILING_SECONDS, } from './question-timing.js';
 import { buildDraft } from './send.js';
 /**
@@ -117,6 +120,8 @@ function submitQuestion(ctx, sessionId, entry, intent, notes) {
             if (receipt.request_id !== intent.request_id) {
                 throw new Error(`server replay returned ${receipt.request_id}, expected reserved ${intent.request_id}`);
             }
+            // Wakes this session's dormant Session Attendant.
+            recordSessionNotified(sessionId, ctx.env, ctx.now());
             return receipt;
         });
         if (attempt === null)
@@ -297,10 +302,27 @@ async function pollPendingReply(ctx, pending, timeoutSeconds) {
             : { reply: null, replies: [], degraded: false, permanentFailure: replyPollFailure(err) };
     }
 }
+/**
+ * How an answer-collecting close names itself: `deliver` only when this
+ * waiter will claim the fenced answer before writing it in place — a Claude
+ * inbox write or a Codex thread-queue write while this session's attendant
+ * holds a lease. Otherwise no disposition, exactly as released CLIs close.
+ */
+function answerCloseDisposition(ctx, route) {
+    return claimableRoute(route) && ctx.answerClaims?.lease() != null ? 'deliver' : undefined;
+}
+/** Routes that write into the running session itself, so a claim can cover the write. */
+function claimableRoute(route) {
+    return route.kind === 'inbox-socket' || route.kind === 'session-queue';
+}
+/** The claim marker for an answer its own `deliver` close selected. */
+function claimMarker(response) {
+    return selectedForClaimedDelivery(response) ? { delivery_claim: true } : {};
+}
 /** Close several windows concurrently without confusing failure with silence. */
-async function finalizePendings(ctx, pending) {
+async function finalizePendings(ctx, pending, disposition) {
     return Promise.all(pending.map(async (entry) => {
-        const response = await finalizeReplies(ctx, entry.request_id);
+        const response = await finalizeReplies(ctx, entry.request_id, disposition);
         ctx.log?.info('hook.retirement', {
             request_id: entry.request_id,
             attempted: true,
@@ -321,6 +343,7 @@ function finalizedAnswer(finalized) {
             replies,
             agent_acknowledgement_required: finalized.response?.agent_acknowledgement_required,
             agent_acknowledgement_text_required: finalized.response?.agent_acknowledgement_text_required,
+            ...claimMarker(finalized.response),
         };
 }
 /** Persist and surface one answer without letting the two representations drift. */
@@ -373,10 +396,47 @@ function isTerminalDraftRejection(err) {
  * may be answering a different question on a device.
  */
 export async function handleUserPromptSubmit(ctx, envelope) {
-    const notes = [];
     const sessionId = envelope.session_id;
     if (!sessionId)
-        return { notes };
+        return { notes: [] };
+    // Owed Session Message acknowledgements come before any resumed work: a
+    // session resumed after SessionEnd has no Stop to remind it first.
+    const reminder = { text: await messageAcknowledgementReminder(ctx, sessionId), used: false };
+    const outcome = await answerPrompt(ctx, envelope, sessionId, reminder);
+    if (reminder.text === null || reminder.used || outcome.stdout !== undefined || sessionHasEnded(sessionId, ctx.env)) {
+        return outcome;
+    }
+    const stdout = userPromptContextOutput(ctx.harness, reminder.text);
+    if (stdout === undefined)
+        return outcome;
+    outcome.notes.push('an owed Session Message acknowledgement was added to the user\'s new turn');
+    return {
+        ...outcome,
+        stdout,
+        decided: false,
+        log: { ...outcome.log, stage: outcome.log?.['stage'] ?? 'acknowledgement-reminded' },
+    };
+}
+/** Context for the new turn, carrying the owed-acknowledgement reminder once. */
+function withReminder(reminder, context) {
+    if (reminder.text === null)
+        return context;
+    reminder.used = true;
+    return `${context}\n\n${reminder.text}`;
+}
+/**
+ * The instruction for Session Message acknowledgements still owed after asking
+ * the service, or null when none is.
+ */
+async function messageAcknowledgementReminder(ctx, sessionId) {
+    const owed = readSessionState(sessionId, ctx.env).message_acknowledgement_due ?? [];
+    if (owed.length === 0)
+        return null;
+    const still = await reconcileAcknowledgementObligations(ctx, sessionId, owed);
+    return still.length === 0 ? null : acknowledgementBlockContext(still);
+}
+async function answerPrompt(ctx, envelope, sessionId, reminder) {
+    const notes = [];
     recoverQueuedAnswers(sessionId, ctx.env);
     let state = readSessionState(sessionId, ctx.env);
     if (state.accepted !== undefined || (state.delivered_answers?.length ?? 0) > 0) {
@@ -393,6 +453,23 @@ export async function handleUserPromptSubmit(ctx, envelope) {
             state = readSessionState(sessionId, ctx.env);
         }
     }
+    if (state.accepted !== undefined) {
+        // A journaled write of this batch already began (claimed, or recorded
+        // after an unclaimed hand-off): adding it to this turn would hand it over
+        // twice. It settles instead; its acknowledgement stays owed.
+        const written = answersAlreadyWritten(sessionId, ctx.env, state.accepted.answers.flatMap(({ pending }) => (pending.request_id === undefined ? [] : [pending.request_id])));
+        if (written.length > 0) {
+            settleAcceptedAnswers(ctx, sessionId, state.accepted, envelope.cwd);
+            ctx.log?.info('hook.answer', {
+                answered: true,
+                stage: 'replay-suppressed',
+                route: 'user-prompt-submit',
+                journal: written.map((entry) => `${entry.requestId}:${entry.stage}`),
+            });
+            notes.push('an earlier hand-off of the journaled answer already began its write; not adding it to this turn');
+            state = readSessionState(sessionId, ctx.env);
+        }
+    }
     if (state.accepted !== undefined) {
         const answers = [
             ...(state.delivered_answers ?? []),
@@ -406,13 +483,17 @@ export async function handleUserPromptSubmit(ctx, envelope) {
         if (envelope.cwd !== undefined && ctx.harness !== undefined) {
             writeProjectSession(envelope.cwd, ctx.env, sessionId, ctx.now(), ctx.harness);
         }
-        const stdout = userPromptContextOutput(ctx.harness, answersContext(answers, state.accepted.remaining));
+        const stdout = userPromptContextOutput(ctx.harness, withReminder(reminder, answersContext(answers, state.accepted.remaining)));
         if (stdout !== undefined) {
             notes.push('the journaled device answer was added to the user\'s new turn');
+            const selected = unclaimedSelectedAnswers(sessionId, ctx.env, answers);
             return {
                 stdout,
                 decided: false,
                 notes,
+                ...(selected.length === 0
+                    ? {}
+                    : { afterOutput: () => reportHandedOffAfterTheFact(ctx, sessionId, selected) }),
                 log: {
                     stage: 'context-added',
                     route: 'user-prompt-submit',
@@ -518,7 +599,7 @@ export async function handleUserPromptSubmit(ctx, envelope) {
         // UserPromptSubmit can add context to the turn already beginning. Keep the
         // accepted-answer journal until the agent acknowledges: if this process or
         // host dies around stdout, a later prompt or Stop safely replays it.
-        const stdout = userPromptContextOutput(ctx.harness, answersContext([...(readSessionState(sessionId, ctx.env).delivered_answers ?? []), ...lateAnswers], pendingList(updated).length));
+        const stdout = userPromptContextOutput(ctx.harness, withReminder(reminder, answersContext([...(readSessionState(sessionId, ctx.env).delivered_answers ?? []), ...lateAnswers], pendingList(updated).length)));
         if (stdout !== undefined)
             notes.push('the late device answer was added to the user\'s new turn');
         else
@@ -541,13 +622,14 @@ export async function handleUserPromptSubmit(ctx, envelope) {
     }
     const retired = await drainRetirements(ctx, sessionId, ctx.env);
     const orphaned = await drainOrphanRetirements(ctx, ctx.env, ctx.now());
+    await sweepDeliveryJournalsFor(ctx);
     const swept = [...retired, ...orphaned];
     if (swept.length > 0) {
         notes.push(`retired question${swept.length > 1 ? 's' : ''} ${swept.join(', ')}`);
     }
     const delivered = readSessionState(sessionId, ctx.env).delivered_answers ?? [];
     const stdout = delivered.length > 0
-        ? userPromptContextOutput(ctx.harness, answersContext(delivered, pendingList(updated).length))
+        ? userPromptContextOutput(ctx.harness, withReminder(reminder, answersContext(delivered, pendingList(updated).length)))
         : undefined;
     return {
         notes,
@@ -702,9 +784,9 @@ export async function runEscalationWaiter(ctx, options) {
                 return held;
             state = readSessionState(sessionId, ctx.env);
         }
-        if (state.accepted === undefined && (state.acknowledgement_due?.length ?? 0) > 0 &&
+        if (state.accepted === undefined && owedAcknowledgements(state).length > 0 &&
             !(options.recordStop === false && options.route.kind === 'session-queue')) {
-            const due = await reconcileAcknowledgementObligations(ctx, sessionId, state.acknowledgement_due);
+            const due = await reconcileAcknowledgementObligations(ctx, sessionId, owedAcknowledgements(state));
             const held = holdForAcknowledgement(ctx, sessionId, due, notes);
             if (held !== null)
                 return held;
@@ -717,6 +799,7 @@ export async function runEscalationWaiter(ctx, options) {
                 ...(await drainRetirements(ctx, sessionId, ctx.env)),
                 ...(await drainOrphanRetirements(ctx, ctx.env, ctx.now())),
             ];
+            await sweepDeliveryJournalsFor(ctx);
             if (swept.length > 0) {
                 notes.push(`retired question${swept.length > 1 ? 's' : ''} ${swept.join(', ')}`);
             }
@@ -727,7 +810,7 @@ export async function runEscalationWaiter(ctx, options) {
         // Every route's successor turn-end, named the same way: the harness flag
         // for a blocking continuation, and the settle above for a route that woke
         // a brand-new turn out of band.
-        envelope.stop_hook_active === true || settledAnswerThisPass);
+        envelope.stop_hook_active === true || settledAnswerThisPass, options.recordStop !== false && ctx.harness === 'codex' && options.route.kind === 'session-queue');
     }
     finally {
         releaseQuestionPush(sessionId, ctx.env);
@@ -785,6 +868,9 @@ async function deliverAcceptedAnswers(ctx, sessionId, route, accepted, notes, cw
         notes.push('the Agent Session ended before answer delivery; stopping this observer');
         return { notes };
     }
+    const replayed = await suppressWrittenReplay(ctx, sessionId, accepted, notes, cwd);
+    if (replayed !== null)
+        return replayed;
     const held = accepted.held_deliveries ?? 0;
     if (held >= MAX_HELD_DELIVERIES) {
         gate(ctx, 'held', 'delivery-limit', {
@@ -853,14 +939,42 @@ async function deliverAcceptedAnswers(ctx, sessionId, route, accepted, notes, cw
             return true;
         });
     };
-    let delivered = await route.deliver({
-        context: answersContext(answered, remaining),
-        answers: answered.length,
-        remaining,
-        request_ids: requestIds,
-        journal_recorded_at: accepted.recorded_at,
-        commitDelivery,
-    });
+    // Answers a `deliver` close selected are claimed first, under this session's
+    // delivery lock, so an Answer Edit can only follow the write. A claim that
+    // cannot be had never withholds the answer: it is written unclaimed, as
+    // released CLIs write it, and its edits simply wait.
+    const handOff = await claimAnswerHandOff(ctx, sessionId, route, answered);
+    let delivered;
+    try {
+        delivered = await route.deliver({
+            context: answersContext(answered, remaining),
+            answers: answered.length,
+            remaining,
+            request_ids: requestIds,
+            journal_recorded_at: accepted.recorded_at,
+            commitDelivery: handOff === null
+                ? commitDelivery
+                : (writer) => handOff.begin(commitDelivery, { subprocess: writer === 'subprocess' }),
+            ...(handOff === null || handOff.claimed.length === 0
+                ? {}
+                : {
+                    writeGuard: { writable: () => handOff.writable(), remainingMs: () => handOff.remainingMs() },
+                    writerGroup: (pgid) => handOff.recordGroup(pgid),
+                }),
+        });
+    }
+    catch (err) {
+        await handOff?.finish('failed');
+        throw err;
+    }
+    await handOff?.finish(delivered.acknowledgement === 'delivered'
+        ? 'written'
+        : delivered.log?.['reason'] === WRITE_ABORTED_REASON
+            ? 'aborted'
+            : 'not-written');
+    if (delivered.acknowledgement === 'delivered' && deliveryCommitted) {
+        await reportUnclaimedHandOff(ctx, sessionId, answered, handOff);
+    }
     if (delivered.acknowledgement === 'delivered' && !deliveryCommitted) {
         delivered = {
             notes: [
@@ -911,12 +1025,158 @@ async function deliverAcceptedAnswers(ctx, sessionId, route, accepted, notes, cw
     }
     return outcome;
 }
+/**
+ * A restart must never write an answer twice. When this session's delivery
+ * journal shows that an earlier hand-off of any answer in the batch already
+ * began its write — completed (`written`) or possibly (`writing`, `failed`) —
+ * the batch settles without another write. Journal recovery reports the
+ * earlier attempt's outcome; an unconfirmed one is never retried.
+ */
+async function suppressWrittenReplay(ctx, sessionId, accepted, notes, cwd) {
+    const requestIds = accepted.answers.flatMap(({ pending }) => pending.request_id === undefined ? [] : [pending.request_id]);
+    const written = answersAlreadyWritten(sessionId, ctx.env, requestIds);
+    if (written.length === 0)
+        return null;
+    if (ctx.answerClaims !== undefined) {
+        try {
+            await recoverDeliveryJournal(answerSequencer(ctx, sessionId, ctx.answerClaims));
+        }
+        catch {
+            // Reporting is recovery's to retry; suppression does not depend on it.
+        }
+    }
+    settleAcceptedAnswers(ctx, sessionId, accepted, cwd);
+    ctx.log?.info('hook.answer', {
+        answered: true,
+        stage: 'replay-suppressed',
+        request_ids: requestIds,
+        journal: written.map((entry) => `${entry.requestId}:${entry.stage}`),
+    });
+    notes.push('an earlier hand-off of this answer already began its write; not writing it again');
+    return { notes, log: { stage: 'replay-suppressed', request_ids: requestIds } };
+}
+/**
+ * The Answer Edit release rule needs the fenced answer's outcome. A selected
+ * answer written without a claim (the lease moved, the lock stayed busy, the
+ * claim was refused) is recorded after the fact as handed off, so its edits
+ * follow it instead of waiting on an attempt that never existed.
+ */
+async function reportUnclaimedHandOff(ctx, sessionId, answered, handOff) {
+    const claimed = new Set((handOff?.claimed ?? []).flatMap((attempt) => attempt.subject.type === 'answer' ? [attempt.subject.request_id] : []));
+    const unclaimed = answered.flatMap(({ pending, delivery_claim }) => delivery_claim === true && pending.request_id !== undefined && !claimed.has(pending.request_id)
+        ? [pending.request_id]
+        : []);
+    await reportHandedOffAfterTheFact(ctx, sessionId, unclaimed);
+}
+/**
+ * Journal, then record, selected answers already written without a claim. A
+ * record that fails stays in this session's delivery journal, so the next
+ * hand-off here or the machine-wide sweep records it later.
+ */
+export async function reportHandedOffAfterTheFact(ctx, sessionId, requestIds) {
+    if (requestIds.length === 0)
+        return;
+    const writer = ctx.answerClaims?.writer ?? currentProcessIdentity();
+    if (writer === null)
+        return;
+    await recordUnclaimedHandOffs({
+        sessionId,
+        env: ctx.env,
+        client: ctx.client,
+        monotonic: ctx.answerClaims?.monotonic ?? (() => performance.now()),
+        wall: ctx.now,
+        sleep: ctx.sleep,
+        writer,
+        ...(ctx.log === undefined ? {} : { log: ctx.log }),
+    }, requestIds);
+}
+function answerSequencer(ctx, sessionId, claims) {
+    return {
+        sessionId,
+        env: ctx.env,
+        client: ctx.client,
+        monotonic: claims.monotonic,
+        wall: ctx.now,
+        sleep: ctx.sleep,
+        writer: claims.writer,
+        ...(ctx.log === undefined ? {} : { log: ctx.log }),
+    };
+}
+/**
+ * Selected answers this prompt hands off in its context without a claim; the
+ * ones a claimed write already covered are left to that attempt.
+ */
+function unclaimedSelectedAnswers(sessionId, env, answers) {
+    const selected = answers.flatMap(({ pending, delivery_claim }) => delivery_claim === true && pending.request_id !== undefined ? [pending.request_id] : []);
+    const covered = new Set(answersAlreadyWritten(sessionId, env, selected).map((entry) => entry.requestId));
+    return selected.filter((requestId) => !covered.has(requestId));
+}
+/** The machine-wide journal sweep, from a hook that already holds a client. */
+async function sweepDeliveryJournalsFor(ctx) {
+    const writer = ctx.answerClaims?.writer ?? currentProcessIdentity();
+    if (writer === null)
+        return;
+    try {
+        await sweepDeliveryJournals({
+            env: ctx.env,
+            client: ctx.client,
+            writer,
+            now: ctx.now(),
+            ...(ctx.log === undefined ? {} : { log: ctx.log }),
+        });
+    }
+    catch {
+        // Housekeeping never fails a hook; the next sweep retries.
+    }
+}
+/** How long a waiter waits for the attendant to re-acquire a moved lease. */
+const ANSWER_CLAIM_RETRY_MS = 2_000;
+const ANSWER_CLAIM_ROUNDS = 3;
+/**
+ * Claim every selected answer of this batch for one in-place write, or null
+ * when nothing may be claimed: no attendant lease, a route that does not write
+ * in place, or a delivery lock another writer kept.
+ */
+async function claimAnswerHandOff(ctx, sessionId, route, answered) {
+    const claims = ctx.answerClaims;
+    const subjects = answered.flatMap(({ pending, delivery_claim }) => delivery_claim === true && pending.request_id !== undefined
+        ? [{ type: 'answer', request_id: pending.request_id }]
+        : []);
+    if (claims === undefined || subjects.length === 0 || !claimableRoute(route))
+        return null;
+    const deps = answerSequencer(ctx, sessionId, claims);
+    for (let round = 1;; round += 1) {
+        const lease = claims.lease();
+        const handOff = lease === null ? null : await beginHandOff(deps, { lease, subjects });
+        if (handOff === null) {
+            ctx.log?.info('delivery.claimed', {
+                subject: 'answer',
+                request_ids: subjects.map((subject) => subject.request_id),
+                claimed: false,
+                reason: lease === null ? 'no-attendant-lease' : 'delivery-lock-busy',
+            });
+            if (lease === null && round < ANSWER_CLAIM_ROUNDS) {
+                await ctx.sleep(ANSWER_CLAIM_RETRY_MS);
+                continue;
+            }
+            return null;
+        }
+        // A lease that moved between the close and this claim is re-read once the
+        // attendant has had a moment to re-acquire; any other refusal is final.
+        const fenced = handOff.claimed.length === 0 &&
+            handOff.refused.every((refusal) => refusal.reason === 'generation_fenced');
+        if (!fenced || round >= ANSWER_CLAIM_ROUNDS)
+            return handOff;
+        await handOff.finish('not-written');
+        await ctx.sleep(ANSWER_CLAIM_RETRY_MS);
+    }
+}
 /** True while this Stop owner is still allowed a direct-wake wait. */
 function ownerLeaseActive(entry, now) {
     return entry.owner_deadline_at !== undefined && entry.owner_deadline_at > now;
 }
 /** The complete per-session Stop decision, after this process owns the claim. */
-async function handleClaimedStop(ctx, envelope, sessionId, state, pending, notes, hardDeadlineAt, route, continuingFromAnswer) {
+async function handleClaimedStop(ctx, envelope, sessionId, state, pending, notes, hardDeadlineAt, route, continuingFromAnswer, handoffToDetachedOwner) {
     const live = pending.filter((entry) => entry.request_id !== undefined);
     const unasked = pending.filter((entry) => entry.request_id === undefined);
     let liveToEscalate = live;
@@ -944,7 +1204,7 @@ async function handleClaimedStop(ctx, envelope, sessionId, state, pending, notes
             await retirePendings(ctx, envelope, sessionId, permanentlyRejected, 'expired');
         }
         if (answered.length > 0) {
-            const finalized = await finalizePendings(ctx, answered.map((entry) => entry.pending));
+            const finalized = await finalizePendings(ctx, answered.map((entry) => entry.pending), answerCloseDisposition(ctx, route));
             const authoritative = answered.map((entry) => {
                 const response = finalized.find((candidate) => isSamePending(candidate.pending, entry.pending))?.response;
                 const replies = response?.replies.length ? response.replies : entry.replies;
@@ -959,6 +1219,7 @@ async function handleClaimedStop(ctx, envelope, sessionId, state, pending, notes
                         entry.agent_acknowledgement_required,
                     agent_acknowledgement_text_required: response?.agent_acknowledgement_text_required ??
                         entry.agent_acknowledgement_text_required,
+                    ...claimMarker(response),
                 };
             });
             const accepted = stageAcceptedAnswers(ctx, sessionId, authoritative, pending.length - authoritative.length - permanentlyRejected.length);
@@ -989,7 +1250,7 @@ async function handleClaimedStop(ctx, envelope, sessionId, state, pending, notes
                 notes.push(`${recoverableLive.length} question${recoverableLive.length === 1 ? ' is' : 's are'} still recorded after the previous answer owner ended; a later turn will reconcile ${recoverableLive.length === 1 ? 'it' : 'them'} without starting another full-window wait`);
                 return { notes };
             }
-            return await escalate(ctx, envelope, sessionId, [], stillOwned, notes, hardDeadlineAt, route);
+            return await escalate(ctx, envelope, sessionId, [], stillOwned, notes, hardDeadlineAt, route, handoffToDetachedOwner);
         }
         // Questions registered after the earlier push still owe the user their
         // notification; fall through and escalate just those, plus any live
@@ -1037,10 +1298,10 @@ async function handleClaimedStop(ctx, envelope, sessionId, state, pending, notes
         already_live: liveToEscalate.length,
         grace_seconds: ctx.config.ask_grace_seconds.value,
     });
-    return await escalate(ctx, envelope, sessionId, unasked, liveToEscalate, notes, hardDeadlineAt, route);
+    return await escalate(ctx, envelope, sessionId, unasked, liveToEscalate, notes, hardDeadlineAt, route, handoffToDetachedOwner);
 }
 /** The escalation itself, split out so the claim is released on every path. */
-async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, hardDeadlineAt, route) {
+async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, hardDeadlineAt, route, handoffToDetachedOwner) {
     // The questions still owe the user their terminal-first window before
     // anything reaches their devices — measured from the oldest registration,
     // because that is the question that has waited longest.
@@ -1265,7 +1526,7 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
             delete live.source;
         delete live.submission;
         if (live.reply_deadline_at > live.owner_deadline_at) {
-            const response = await finalizeReplies(ctx, live.request_id);
+            const response = await finalizeReplies(ctx, live.request_id, answerCloseDisposition(ctx, route));
             if (response === null) {
                 // Closing was unreachable, so the question is still potentially live.
                 // Preserve it in the exact session instead of demoting it to the orphan
@@ -1300,6 +1561,7 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
                     replies: response.replies,
                     agent_acknowledgement_required: response.agent_acknowledgement_required,
                     agent_acknowledgement_text_required: response.agent_acknowledgement_text_required,
+                    ...claimMarker(response),
                 });
             }
             dropPendingQuestion(sessionId, ctx.env, entry);
@@ -1354,7 +1616,7 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
         return deliverAcceptedAnswers(ctx, sessionId, route, accepted, notes, envelope.cwd);
     }
     const staleLive = alreadyLive.filter((entry) => entry.reply_deadline_at === undefined || entry.reply_deadline_at <= ctx.now());
-    const finalizedStale = await finalizePendings(ctx, staleLive);
+    const finalizedStale = await finalizePendings(ctx, staleLive, answerCloseDisposition(ctx, route));
     const staleAnswers = finalizedStale
         .map(finalizedAnswer)
         .filter((entry) => entry !== null);
@@ -1382,6 +1644,13 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
     ];
     if (waitingOn.length === 0)
         return { notes };
+    // Codex has a durable exact-thread queue route. Release the short Stop hook
+    // after admission so a detached owner, independent of the TUI process, can
+    // observe the entire committed answer window. The owner lease and pending
+    // request identities remain in session state for that successor.
+    if (handoffToDetachedOwner) {
+        return { notes, settlementRequired: true };
+    }
     // Phase two: keep the same owner alive across every committed answer window.
     // Different questions may expire at different times, so finalize each one at
     // its own server deadline and continue waiting on the rest. Reserving time by
@@ -1424,7 +1693,7 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
             entry.reply_deadline_at <= waitDeadline ||
             waited.permanentFailures.has(entry.request_id));
         const stillAnswerable = activeWaiting.filter((entry) => !expired.includes(entry));
-        const finalized = await finalizePendings(ctx, expired);
+        const finalized = await finalizePendings(ctx, expired, answerCloseDisposition(ctx, route));
         const finalAnswers = finalized
             .map(finalizedAnswer)
             .filter((entry) => entry !== null);
@@ -1469,7 +1738,7 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
         return { notes };
     }
     const polledAnswered = activeWaiting.filter((entry) => waited.byRequest.has(entry.request_id));
-    const finalizedAnswered = await finalizePendings(ctx, polledAnswered);
+    const finalizedAnswered = await finalizePendings(ctx, polledAnswered, answerCloseDisposition(ctx, route));
     const answered = [];
     for (const finalized of finalizedAnswered) {
         const entry = finalized.pending;
@@ -1487,6 +1756,7 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
             replies: authoritative,
             agent_acknowledgement_required: finalized.response?.agent_acknowledgement_required,
             agent_acknowledgement_text_required: finalized.response?.agent_acknowledgement_text_required,
+            ...claimMarker(finalized.response),
         });
         if (finalized.response === null) {
             notes.push(`could not confirm the close fence for ${entry.request_id}; delivering the durable answer already observed`);
@@ -1557,7 +1827,9 @@ export function handleSessionEnd(env, envelope, now = Date.now()) {
         orphanRetirements(env, orphans, now);
         notes.push(`queued ${orphans.length} question${orphans.length > 1 ? 's' : ''} for retirement on the next hook`);
     }
-    if (state.accepted !== undefined || (state.acknowledgement_due?.length ?? 0) > 0) {
+    if (state.accepted !== undefined ||
+        (state.acknowledgement_due?.length ?? 0) > 0 ||
+        (state.message_acknowledgement_due?.length ?? 0) > 0) {
         const preserved = { ...stateWithHistory };
         delete preserved.pending;
         delete preserved.retiring;
@@ -1565,6 +1837,9 @@ export function handleSessionEnd(env, envelope, now = Date.now()) {
         if ((preserved.acknowledgement_due?.length ?? 0) === 0) {
             delete preserved.acknowledgement_due;
         }
+        if ((preserved.message_acknowledgement_due?.length ?? 0) === 0) {
+            delete preserved.message_acknowledgement_due;
+        }
         writeSessionState(sessionId, env, preserved);
         notes.push(state.accepted !== undefined
             ? 'preserved an accepted device answer for this exact session to resume'
@@ -1576,6 +1851,9 @@ export function handleSessionEnd(env, envelope, now = Date.now()) {
                 queued_retirements: orphans.length,
                 accepted_answers: state.accepted?.answers.length ?? 0,
                 acknowledgement_due: state.acknowledgement_due?.length ?? 0,
+                ...(state.message_acknowledgement_due === undefined
+                    ? {}
+                    : { message_acknowledgement_due: state.message_acknowledgement_due.length }),
             },
         };
     }