@raidiant/notifai 4.0.0 → 6.0.0

package/dist/hooks.js

@@ -1,21 +1,38 @@
 import { randomBytes } from 'node:crypto';
 import { closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync, } from 'node:fs';
 import path from 'node:path';
+import { REPLY_MAX_WINDOW_SECONDS } from '@raidiant/notifai-protocol';
 import { ApiCallError, isRetryableReplyPollError, } from './client.js';
 import { loadConfig, projectSessionPointerPath, sanitizeSessionId, sessionConfigPath, stateDir, } from './config.js';
 import { buildDraft } from './send.js';
 import { atomicWriteFileSync } from './atomic-file.js';
 import { withFileLock } from './file-lock.js';
+import { inferInvocationContext } from './invocation-context.js';
 import { HARNESS_CAPABILITIES, HARNESSES, } from './harnesses.js';
 /**
- * Past this, the question's reply window (3600s) has long expired server-side
- * and the companion shows it as dead on next open anyway; pushing a retirement
- * sync for it is noise. Also the backstop that keeps an unreachable server
- * from growing the queue for ever.
+ * A retirement is only worth syncing while the question it retires could still
+ * be answered, so this has to outlive the longest reply window a user can
+ * choose — it is derived from that bound rather than from a guess about how
+ * long questions stay open, which is exactly the assumption that broke when
+ * the window stopped being one hour. Past it the companion shows the question
+ * as dead on next open anyway. Also the backstop that keeps an unreachable
+ * server from growing the queue for ever.
  */
-const ORPHAN_TTL_MS = 24 * 3600 * 1000;
+const ORPHAN_TTL_MS = (REPLY_MAX_WINDOW_SECONDS + 3600) * 1000;
 /** More orphans than this means something is looping; keep the newest. */
 const ORPHAN_QUEUE_CAP = 50;
+/** Keep immutable session grouping while replacing per-event Git location authoritatively. */
+function sourceContextAtHookEvent(source, cwd) {
+    const invocation = cwd === undefined ? null : inferInvocationContext(cwd);
+    const current = {
+        ...(source?.session_id !== undefined ? { session_id: source.session_id } : {}),
+        ...(source?.session_label !== undefined ? { session_label: source.session_label } : {}),
+        ...(source?.harness !== undefined ? { harness: source.harness } : {}),
+        ...(invocation?.branch !== undefined ? { branch: invocation.branch } : {}),
+        ...(invocation?.worktree !== undefined ? { worktree: invocation.worktree } : {}),
+    };
+    return Object.keys(current).length === 0 ? undefined : current;
+}
 function summarizeRequestIds(entries) {
     const ids = entries.flatMap((entry) => entry.request_id === undefined ? [] : [entry.request_id]);
     return { ids, display: ids.join(', ') };
@@ -30,12 +47,33 @@ function summarizeRequestIds(entries) {
  * question is only how long that host is willing to wait in total.
  */
 export const WAITER_CEILING_SECONDS = 480;
+/**
+ * The same wall clock where the waiter runs in the background instead of
+ * inside a held turn.
+ *
+ * On a host that holds its turn, 480 s is a real cost to the person sitting in
+ * front of it, and the number above is right. On Claude Code the Stop hook
+ * returns at once and the waiter is detached, so the same 480 s buys nothing
+ * and costs a direct wake: an answer arriving at minute nine had to wait for
+ * the session's next turn even though nothing was blocked.
+ *
+ * This sits under `CLAUDE_ASYNC_STOP_TIMEOUT_SECONDS` (3600) with headroom,
+ * because that declaration's kill is silent, and under the reply window the
+ * question was pushed with. Past it the journal still delivers at the next
+ * turn — the ceiling decides how long a *direct* wake stays possible, never
+ * whether the answer survives.
+ */
+export const DETACHED_WAITER_CEILING_SECONDS = 3300;
+/** The waiter's wall clock, which depends on whether a turn is held open for it. */
+export function waiterCeilingSeconds(detached) {
+    return detached ? DETACHED_WAITER_CEILING_SECONDS : WAITER_CEILING_SECONDS;
+}
 /**
  * The wire contract's shortest reply window. A question submitted with less
  * than this is rejected outright, and accepting one would in any case let the
  * server go on taking an answer after the waiter that owns it has returned.
  */
-const MIN_REPLY_WINDOW_SECONDS = 60;
+export const MIN_REPLY_WINDOW_SECONDS = 60;
 /**
  * The terminal-first wait: the question sits in the terminal for
  * `ask_grace_seconds` from when it was sent, and only then reaches companion
@@ -168,6 +206,16 @@ export function pruneAbandonedSessions(env, now = Date.now(), maxAgeMs = SESSION
  * no trustworthy PID fall back to an age limit.
  */
 const CLAIM_TTL_MS = WAITER_CEILING_SECONDS * 1000;
+/**
+ * How long a crashed claim *guard* blocks the next hook.
+ *
+ * The claim itself may legitimately be held for the whole waiter, so it takes
+ * that ceiling. The guard is a short lock around the claim's own bookkeeping —
+ * a few file operations — and borrowing the waiter's ceiling for it meant a
+ * hook killed at exactly the wrong moment wedged this session's Stop path for
+ * eight minutes, for a critical section that never runs longer than a second.
+ */
+const CLAIM_GUARD_TTL_MS = 30_000;
 const heldClaims = new Map();
 export function claimQuestionPush(sessionId, env, now = Date.now(), beforeStaleReplace) {
     const file = claimPath(sessionId, env);
@@ -266,7 +314,7 @@ function acquireClaimGuard(file) {
             if (err.code !== 'EEXIST')
                 return false;
             try {
-                if (Date.now() - statSync(file).mtimeMs < CLAIM_TTL_MS)
+                if (Date.now() - statSync(file).mtimeMs < CLAIM_GUARD_TTL_MS)
                     return false;
             }
             catch {
@@ -287,52 +335,70 @@ function claimPath(sessionId, env) {
  * meantime, and keeps one runaway agent from writing megabytes per session.
  */
 const MAX_STORED_QUESTION_CHARS = 2000;
+function storedProjectSessionPointer(candidate) {
+    if (typeof candidate !== 'object' || candidate === null || Array.isArray(candidate))
+        return null;
+    const entry = candidate;
+    if (typeof entry.session_id !== 'string' || entry.session_id === '')
+        return null;
+    if (typeof entry.updated_at !== 'number')
+        return null;
+    if (!HARNESSES.includes(entry.harness))
+        return null;
+    return {
+        sessionId: entry.session_id,
+        updatedAt: entry.updated_at,
+        harness: entry.harness,
+    };
+}
+function readStoredProjectSessionDocument(file) {
+    if (!existsSync(file))
+        return { root: {}, sessions: [] };
+    try {
+        const parsed = JSON.parse(readFileSync(file, 'utf8'));
+        if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+            return { root: {}, sessions: [] };
+        }
+        const root = parsed;
+        return {
+            root,
+            sessions: Array.isArray(root['sessions']) ? root['sessions'] : [],
+        };
+    }
+    catch {
+        return { root: {}, sessions: [] };
+    }
+}
 /** Records every live session working in a directory, for `notifai ask`. */
 export function writeProjectSession(cwd, env, sessionId, now, harness) {
     const file = projectSessionPointerPath(cwd, env);
     withFileLock(`${file}.lock`, () => {
-        const existing = readStoredProjectSessionPointers(file).filter((entry) => entry.sessionId !== sessionId && now - entry.updatedAt <= 24 * 3600 * 1000);
+        const stored = readStoredProjectSessionDocument(file);
+        const existing = [];
+        let refreshed = {};
+        for (const candidate of stored.sessions) {
+            const entry = storedProjectSessionPointer(candidate);
+            if (entry?.sessionId === sessionId) {
+                refreshed = { ...refreshed, ...candidate };
+            }
+            else if (entry === null || now - entry.updatedAt <= 24 * 3600 * 1000) {
+                existing.push(candidate);
+            }
+        }
         atomicWriteFileSync(file, `${JSON.stringify({
+            ...stored.root,
             sessions: [
-                ...existing.map((entry) => ({
-                    session_id: entry.sessionId,
-                    updated_at: entry.updatedAt,
-                    harness: entry.harness,
-                })),
-                { session_id: sessionId, updated_at: now, harness },
+                ...existing,
+                { ...refreshed, session_id: sessionId, updated_at: now, harness },
             ],
         })}\n`);
     });
 }
 function readStoredProjectSessionPointers(file) {
-    if (!existsSync(file))
-        return [];
-    try {
-        const parsed = JSON.parse(readFileSync(file, 'utf8'));
-        if (!Array.isArray(parsed.sessions))
-            return [];
-        return parsed.sessions.flatMap((candidate) => {
-            if (typeof candidate !== 'object' || candidate === null || Array.isArray(candidate))
-                return [];
-            const entry = candidate;
-            if (typeof entry.session_id !== 'string' || entry.session_id === '')
-                return [];
-            if (typeof entry.updated_at !== 'number')
-                return [];
-            if (!HARNESSES.includes(entry.harness))
-                return [];
-            return [
-                {
-                    sessionId: entry.session_id,
-                    updatedAt: entry.updated_at,
-                    harness: entry.harness,
-                },
-            ];
-        });
-    }
-    catch {
-        return [];
-    }
+    return readStoredProjectSessionDocument(file).sessions.flatMap((candidate) => {
+        const entry = storedProjectSessionPointer(candidate);
+        return entry === null ? [] : [entry];
+    });
 }
 /**
  * Resolves the session working in `cwd`. Stale pointers are ignored rather than
@@ -386,20 +452,46 @@ export function readMatchingProjectSessionPointer(cwd, env, now, sessionId, harn
 function clearMatchingProjectSession(cwd, env, sessionId) {
     const file = projectSessionPointerPath(cwd, env);
     withFileLock(`${file}.lock`, () => {
-        const remaining = readStoredProjectSessionPointers(file).filter((entry) => entry.sessionId !== sessionId);
-        if (remaining.length === 0) {
+        const stored = readStoredProjectSessionDocument(file);
+        const remaining = stored.sessions.filter((candidate) => {
+            const entry = storedProjectSessionPointer(candidate);
+            return entry === null || entry.sessionId !== sessionId;
+        });
+        const hasUnknownRootFields = Object.keys(stored.root).some((key) => key !== 'sessions');
+        if (remaining.length === 0 && !hasUnknownRootFields) {
             rmSync(file, { force: true });
             return;
         }
         atomicWriteFileSync(file, `${JSON.stringify({
-            sessions: remaining.map((entry) => ({
-                session_id: entry.sessionId,
-                updated_at: entry.updatedAt,
-                harness: entry.harness,
-            })),
+            ...stored.root,
+            sessions: remaining,
         })}\n`);
     });
 }
+/**
+ * Record one gate decision.
+ *
+ * `verdict` is what happened to the question and `reason` is the closed-set
+ * name of the rule that decided it, so an agent can ask "why was it held" with
+ * a filter rather than by matching on prose. The prose still exists — it is what
+ * the user sees in the terminal — but it is free to be rewritten, and a log a
+ * filter cannot rely on is a log nobody filters.
+ */
+export const GATE_REASONS = [
+    'no-session',
+    'no-question',
+    'answered',
+    'continuation-repeat',
+    'continuation-limit',
+    'delivery-limit',
+    'acknowledgement-required',
+    'acknowledgement-abandoned',
+    'harness-cannot-continue',
+    'notifications-off',
+    'claimed-elsewhere',
+    'elapsed',
+    'proceeding',
+];
 function gate(ctx, verdict, reason, data = {}) {
     ctx.log?.info('hook.gate', { verdict, reason, stage: 'queued', ...data });
 }
@@ -440,7 +532,7 @@ async function prepareQuestionSubmission(ctx, options) {
         ...(options.media !== undefined ? { media: options.media } : {}),
         device: answerable,
         reply: true,
-        replyWindow: Math.max(60, options.windowSeconds),
+        replyWindow: Math.max(MIN_REPLY_WINDOW_SECONDS, options.windowSeconds),
         questions: options.questions,
         collapseKey,
     }, options.source === undefined ? {} : { source: options.source });
@@ -541,7 +633,8 @@ async function answerableDevices(ctx) {
     return devices
         .filter((device) => (device.platform === 'ios' || device.platform === 'macos') &&
         device.registration_healthy &&
-        device.reply_protocol_version === 2)
+        device.capabilities?.includes('answer') === true &&
+        device.derived_status !== 'must_update')
         .filter((device) => configured === null || configured.includes(device.device_id))
         .map((device) => device.device_id);
 }
@@ -602,7 +695,6 @@ const RETIREMENT_TITLES = {
     answered: 'Answered',
     answered_elsewhere: 'Answered in the terminal',
     expired: 'Question expired',
-    superseded: 'Replaced by a newer question',
 };
 /**
  * Park a delivered question for retirement. Called at the moment we learn it is
@@ -637,7 +729,7 @@ export function parkForRetirement(sessionId, env, pending, state) {
  * question or retire a device that never received it. Fail explicitly and keep
  * the pending record instead of silently broadening or narrowing the fanout.
  */
-function retiringQuestion(pending, state) {
+function retiringQuestion(pending, state, cwd) {
     const hasRequest = pending.request_id !== undefined;
     const hasCollapse = pending.collapse_key !== undefined;
     const hasDevices = pending.device_ids !== undefined && pending.device_ids.length > 0;
@@ -646,13 +738,14 @@ function retiringQuestion(pending, state) {
     if (!hasRequest || !hasCollapse || !hasDevices) {
         throw new Error('live question state is incomplete; refusing to retire it without request, collapse, and device identifiers');
     }
+    const source = sourceContextAtHookEvent(pending.source, cwd);
     return {
         request_id: pending.request_id,
         collapse_key: pending.collapse_key,
         device_ids: [...pending.device_ids],
         question: pending.question,
         ...(pending.project !== undefined ? { project: pending.project } : {}),
-        ...(pending.source !== undefined ? { source: pending.source } : {}),
+        ...(source !== undefined ? { source } : {}),
         state,
     };
 }
@@ -764,6 +857,20 @@ const LATE_PROMPT_POLL_SECONDS = 3;
  * produce.
  */
 export const MAX_CONTINUATION_COUNT = 3;
+/**
+ * How many turns an answer may be *held* before it is settled unread.
+ *
+ * A hold is not a delivery: the route reported that it handed nothing over, so
+ * the agent has not seen the answer and the wake-loop the continuation cap
+ * exists to stop has not happened. Counting holds against that cap meant three
+ * turns where a liveness probe could not reach a busy session were enough to
+ * discard an answer the user had already given.
+ *
+ * It still has to end. A route that can never deliver would otherwise retry
+ * every turn for the life of the session, so holds get their own, far looser
+ * bound — loose because each one costs nothing and the answer is still wanted.
+ */
+export const MAX_HELD_DELIVERIES = 20;
 /** One bounded recovery poll for a question that outlived its original wait. */
 async function pollPendingReply(ctx, pending, timeoutSeconds) {
     if (pending.request_id === undefined) {
@@ -802,6 +909,7 @@ function finalizedAnswer(finalized) {
             reply,
             replies,
             agent_acknowledgement_required: finalized.response?.agent_acknowledgement_required,
+            agent_acknowledgement_text_required: finalized.response?.agent_acknowledgement_text_required,
         };
 }
 /** Persist and surface one answer without letting the two representations drift. */
@@ -848,6 +956,38 @@ function isSamePending(a, b) {
     }
     return a.question === b.question && a.asked_at === b.asked_at;
 }
+/**
+ * The frozen draft itself will never be accepted. Replaying it forever hides a
+ * contract-skew (deleted fields, unexpected properties) as a recoverable wait.
+ * Auth, conflicts, and timeouts are not this class.
+ */
+function isTerminalDraftRejection(err) {
+    return err.status === 422 || (err.status === 400 && err.code === 'invalid_request');
+}
+function dropPendingQuestion(sessionId, env, entry) {
+    updateSessionState(sessionId, env, (current) => {
+        const pending = pendingList(current).filter((candidate) => !isSamePending(candidate, entry));
+        const next = { ...current };
+        if (pending.length > 0)
+            next.pending = pending;
+        else
+            delete next.pending;
+        return next;
+    });
+}
+function clearFrozenSubmission(sessionId, env, entry) {
+    updateSessionState(sessionId, env, (current) => {
+        const list = pendingList(current);
+        const index = list.findIndex((candidate) => isSamePending(candidate, entry));
+        if (index < 0)
+            return current;
+        const next = [...list];
+        const copy = { ...next[index] };
+        delete copy.submission;
+        next[index] = copy;
+        return { ...current, pending: next };
+    });
+}
 /** The question set this pending record pushes, however it was registered. */
 function pendingQuestions(pending) {
     return pending.questions ?? [{ id: 'q1', text: pending.question }];
@@ -890,8 +1030,19 @@ function answerContext(answered) {
  * tied to the question that asked it, with a truthful note about anything
  * still waiting.
  */
-function acknowledgementCommand(requestId) {
-    return `notifai acknowledge ${requestId} --text <text>`;
+function acknowledgementCommand(requestId, textRequired = true) {
+    return textRequired
+        ? `notifai acknowledge ${requestId} --text <text>`
+        : `notifai acknowledge ${requestId}`;
+}
+/**
+ * The acknowledgement is owed either way; only its text is conditional. So the
+ * instruction never says "you may skip this" — it says what to run.
+ */
+function acknowledgementDemand(textRequired) {
+    return textRequired
+        ? ' with non-empty text saying what concrete work you will do because of the reply; a bare acknowledgement is insufficient'
+        : ' exactly as shown; this account turned acknowledgement text off, so the receipt carries no words';
 }
 function acknowledgementContext(answered) {
     const due = answered.filter((entry) => entry.agent_acknowledgement_required === true && entry.pending.request_id !== undefined);
@@ -899,17 +1050,20 @@ function acknowledgementContext(answered) {
         return ' Agent Acknowledgement is not required for the answered request(s).';
     }
     if (due.length === 1) {
-        const requestId = due[0].pending.request_id;
+        const entry = due[0];
+        const requestId = entry.pending.request_id;
+        const textRequired = entry.agent_acknowledgement_text_required !== false;
         return (` Agent Acknowledgement is required for request ${requestId}. Immediately, before doing the resumed work or ending this turn, run ` +
-            `\`${acknowledgementCommand(requestId)}\` with non-empty text saying what concrete work you will do because of the reply; a bare acknowledgement is insufficient.`);
+            `\`${acknowledgementCommand(requestId, textRequired)}\`${acknowledgementDemand(textRequired)}.`);
     }
+    const anyTextRequired = due.some((entry) => entry.agent_acknowledgement_text_required !== false);
     const commands = due
         .map((entry) => {
         const requestId = entry.pending.request_id;
-        return `- ${requestId}: \`${acknowledgementCommand(requestId)}\``;
+        return `- ${requestId}: \`${acknowledgementCommand(requestId, entry.agent_acknowledgement_text_required !== false)}\``;
     })
         .join('\n');
-    return (` Agent Acknowledgement is required for ${due.length} requests. Immediately, before doing the resumed work or ending this turn, run every command below with non-empty text saying what concrete work you will do because of that reply; a bare acknowledgement is insufficient:\n` +
+    return (` Agent Acknowledgement is required for ${due.length} requests. Immediately, before doing the resumed work or ending this turn, run every command below${acknowledgementDemand(anyTextRequired)}:\n` +
         commands);
 }
 function answersContext(answered, remaining) {
@@ -957,7 +1111,11 @@ function stageAcceptedAnswers(ctx, sessionId, answered, remaining) {
             if (answer.agent_acknowledgement_required === true &&
                 requestId !== undefined &&
                 !acknowledgementDue.some((entry) => entry.request_id === requestId)) {
-                acknowledgementDue.push({ request_id: requestId, recorded_at: accepted.recorded_at });
+                acknowledgementDue.push({
+                    request_id: requestId,
+                    recorded_at: accepted.recorded_at,
+                    text_required: answer.agent_acknowledgement_text_required !== false,
+                });
             }
         }
         const next = {
@@ -999,10 +1157,69 @@ export function clearAcknowledgementObligation(sessionId, env, requestId) {
 }
 function acknowledgementBlockContext(due) {
     const commands = due
-        .map((entry) => `- ${entry.request_id}: \`${acknowledgementCommand(entry.request_id)}\``)
+        .map((entry) => `- ${entry.request_id}: \`${acknowledgementCommand(entry.request_id, entry.text_required !== false)}\``)
         .join('\n');
+    const anyTextRequired = due.some((entry) => entry.text_required !== false);
     return (`Notifai — required Agent Acknowledgement${due.length === 1 ? '' : 's'} still missing for request${due.length === 1 ? '' : 's'} ${due.map((entry) => entry.request_id).join(', ')}. ` +
-        `Before doing more resumed work or ending this turn, run ${due.length === 1 ? 'this command' : 'every command'} with non-empty text saying what concrete work you will do because of the reply; a bare acknowledgement is insufficient:\n${commands}`);
+        `Before doing more resumed work or ending this turn, run ${due.length === 1 ? 'this command' : 'every command'}${acknowledgementDemand(anyTextRequired)}:\n${commands}`);
+}
+/**
+ * How many turns in a row a session may be held waiting for an acknowledgement.
+ *
+ * The gate is the one place hooks deliberately break the fail-open rule, and it
+ * had no bound at all: an agent that could not or would not acknowledge — or a
+ * server that stayed unreachable, since an error here counts as unresolved —
+ * held every turn of that session for ever. Blocking a user's agent
+ * indefinitely does not get them an acknowledgement; it costs them the agent as
+ * well as the acknowledgement.
+ */
+const MAX_ACKNOWLEDGEMENT_BLOCKS = 3;
+/**
+ * Hold the turn for an outstanding acknowledgement, or give up and let it
+ * through once holding has stopped being worth its cost.
+ *
+ * Returns the outcome that blocks the turn, or `null` to carry on.
+ */
+function holdForAcknowledgement(ctx, sessionId, due, notes) {
+    if (due.length === 0)
+        return null;
+    const requestIds = due.map((entry) => entry.request_id);
+    const blocks = (readSessionState(sessionId, ctx.env).acknowledgement_blocks ?? 0) + 1;
+    if (blocks > MAX_ACKNOWLEDGEMENT_BLOCKS) {
+        // Drop the obligation with the reason recorded. The answer was already
+        // delivered; what is lost is the agent's receipt for it, and the log is
+        // where that loss stays visible.
+        for (const requestId of requestIds)
+            clearAcknowledgementObligation(sessionId, ctx.env, requestId);
+        resetAcknowledgementBlocks(sessionId, ctx.env);
+        gate(ctx, 'proceeding', 'acknowledgement-abandoned', {
+            request_ids: requestIds,
+            blocks: blocks - 1,
+            limit: MAX_ACKNOWLEDGEMENT_BLOCKS,
+        });
+        notes.push(`no acknowledgement after ${MAX_ACKNOWLEDGEMENT_BLOCKS} turns; continuing without one rather than holding this session for ever`);
+        return null;
+    }
+    updateSessionState(sessionId, ctx.env, (current) => ({
+        ...current,
+        acknowledgement_blocks: blocks,
+    }));
+    gate(ctx, 'held', 'acknowledgement-required', { request_ids: requestIds, blocks });
+    return {
+        stdout: stopAnswerOutput(acknowledgementBlockContext(due)),
+        notes,
+        log: { stage: 'acknowledgement-required', request_ids: requestIds },
+    };
+}
+/** A turn that was not held resets the streak; only consecutive holds count. */
+function resetAcknowledgementBlocks(sessionId, env) {
+    updateSessionState(sessionId, env, (current) => {
+        if (current.acknowledgement_blocks === undefined)
+            return current;
+        const next = { ...current };
+        delete next.acknowledgement_blocks;
+        return next;
+    });
 }
 async function reconcileAcknowledgementObligations(ctx, sessionId, due) {
     const unresolved = [];
@@ -1040,9 +1257,9 @@ async function reconcileAcknowledgementObligations(ctx, sessionId, due) {
  * grows with each settled generation, so the cap that bounds chained
  * answer-to-question loops is a real count rather than a constant 1.
  */
-function settleAcceptedAnswers(ctx, sessionId, accepted) {
+function settleAcceptedAnswers(ctx, sessionId, accepted, cwd) {
     const retirements = accepted.answers
-        .map(({ pending }) => retiringQuestion(pending, 'answered'))
+        .map(({ pending }) => retiringQuestion(pending, 'answered', cwd))
         .filter((entry) => entry !== null);
     updateSessionState(sessionId, ctx.env, (current) => {
         const retiring = [...(current.retiring ?? [])];
@@ -1066,7 +1283,7 @@ async function retirePendings(ctx, envelope, sessionId, entries, state) {
     updateSessionState(sessionId, ctx.env, (current) => {
         const retiring = [...(current.retiring ?? [])];
         for (const entry of entries) {
-            const retirement = retiringQuestion(entry, state);
+            const retirement = retiringQuestion(entry, state, envelope.cwd);
             if (retirement !== null && !retiring.some((item) => item.request_id === retirement.request_id)) {
                 retiring.push(retirement);
             }
@@ -1132,6 +1349,8 @@ export async function handleUserPromptSubmit(ctx, envelope) {
                 reply: replies.at(-1),
                 agent_acknowledgement_required: response?.agent_acknowledgement_required ??
                     entry.agent_acknowledgement_required,
+                agent_acknowledgement_text_required: response?.agent_acknowledgement_text_required ??
+                    entry.agent_acknowledgement_text_required,
             };
         });
         if (answered.length > 0) {
@@ -1153,27 +1372,32 @@ export async function handleUserPromptSubmit(ctx, envelope) {
         const retiring = [...(current.retiring ?? [])];
         const unasked = pendingList(current).filter((entry) => entry.request_id === undefined);
         for (const entry of pendingList(current).filter((entry) => entry.request_id !== undefined)) {
-            const retirement = retiringQuestion(entry, 'answered_elsewhere');
+            const retirement = retiringQuestion(entry, 'answered_elsewhere', envelope.cwd);
             if (retirement !== null &&
                 !retiring.some((parked) => parked.request_id === retirement.request_id)) {
                 retiring.push(retirement);
             }
         }
-        return {
-            last_prompt_at: ctx.now(),
-            ...(current.last_stop_at === undefined ? {} : { last_stop_at: current.last_stop_at }),
-            ...(unasked.length > 0 ? { pending: unasked } : {}),
-            ...(retiring.length > 0 ? { retiring } : {}),
-            ...(current.accepted === undefined ? {} : { accepted: current.accepted }),
-            // The user typed, so whatever chain of answer-driven continuations was
-            // running, a human has taken the turn and the consecutive count starts
-            // over. Only a real prompt reaches here: the journal branch above returns
-            // first, and a wake route's injected message always arrives while its own
-            // answer is still journaled, so it can never pass for the user's presence.
-            ...(current.continuation === undefined
-                ? {}
-                : { continuation: { ...current.continuation, count: 0 } }),
-        };
+        // Start from the whole document so fields introduced by a newer CLI remain
+        // attached while this older writer applies the prompt transition it knows.
+        const next = { ...current, last_prompt_at: ctx.now() };
+        if (unasked.length > 0)
+            next.pending = unasked;
+        else
+            delete next.pending;
+        if (retiring.length > 0)
+            next.retiring = retiring;
+        else
+            delete next.retiring;
+        // The user typed, so whatever chain of answer-driven continuations was
+        // running, a human has taken the turn and the consecutive count starts
+        // over. Only a real prompt reaches here: the journal branch above returns
+        // first, and a wake route's injected message always arrives while its own
+        // answer is still journaled, so it can never pass for the user's presence.
+        if (current.continuation !== undefined) {
+            next.continuation = { ...current.continuation, count: 0 };
+        }
+        return next;
     });
     // The bridge that lets a plain `notifai ask` find the hook's canonical
     // session: an agent shell command gets no hook payload, and not every
@@ -1278,43 +1502,24 @@ export async function runEscalationWaiter(ctx, options) {
             if (!deliveryProven) {
                 for (const answer of accepted.answers)
                     reportAnswer(ctx, notes, answer, true);
-                return await deliverAcceptedAnswers(ctx, sessionId, options.route, accepted, notes);
+                return await deliverAcceptedAnswers(ctx, sessionId, options.route, accepted, notes, envelope.cwd);
             }
-            settleAcceptedAnswers(ctx, sessionId, accepted);
+            settleAcceptedAnswers(ctx, sessionId, accepted, envelope.cwd);
             settledAnswerThisPass = true;
             state = readSessionState(sessionId, ctx.env);
             const currentAcceptedIds = new Set(accepted.answers.flatMap(({ pending }) => pending.request_id === undefined ? [] : [pending.request_id]));
             const due = await reconcileAcknowledgementObligations(ctx, sessionId, (state.acknowledgement_due ?? []).filter((entry) => currentAcceptedIds.has(entry.request_id)));
-            if (due.length > 0) {
-                gate(ctx, 'held', 'acknowledgement-required', {
-                    request_ids: due.map((entry) => entry.request_id),
-                });
-                return {
-                    stdout: stopAnswerOutput(acknowledgementBlockContext(due)),
-                    notes,
-                    log: {
-                        stage: 'acknowledgement-required',
-                        request_ids: due.map((entry) => entry.request_id),
-                    },
-                };
-            }
+            const held = holdForAcknowledgement(ctx, sessionId, due, notes);
+            if (held !== null)
+                return held;
             state = readSessionState(sessionId, ctx.env);
         }
         if (state.accepted === undefined && (state.acknowledgement_due?.length ?? 0) > 0) {
             const due = await reconcileAcknowledgementObligations(ctx, sessionId, state.acknowledgement_due);
-            if (due.length > 0) {
-                gate(ctx, 'held', 'acknowledgement-required', {
-                    request_ids: due.map((entry) => entry.request_id),
-                });
-                return {
-                    stdout: stopAnswerOutput(acknowledgementBlockContext(due)),
-                    notes,
-                    log: {
-                        stage: 'acknowledgement-required',
-                        request_ids: due.map((entry) => entry.request_id),
-                    },
-                };
-            }
+            const held = holdForAcknowledgement(ctx, sessionId, due, notes);
+            if (held !== null)
+                return held;
+            resetAcknowledgementBlocks(sessionId, ctx.env);
             state = readSessionState(sessionId, ctx.env);
         }
         const pending = pendingList(state);
@@ -1364,9 +1569,21 @@ export function hookContinuationRoute() {
  * consults is not a backstop: that is how a single answer once reached a
  * session 250 times.
  */
-async function deliverAcceptedAnswers(ctx, sessionId, route, accepted, notes) {
+async function deliverAcceptedAnswers(ctx, sessionId, route, accepted, notes, cwd) {
     const { answers: answered, remaining } = accepted;
     const requestIds = summarizeRequestIds(answered.map((entry) => entry.pending)).ids;
+    const held = accepted.held_deliveries ?? 0;
+    if (held >= MAX_HELD_DELIVERIES) {
+        gate(ctx, 'held', 'delivery-limit', {
+            route: route.kind,
+            held,
+            limit: MAX_HELD_DELIVERIES,
+            request_ids: requestIds,
+        });
+        settleAcceptedAnswers(ctx, sessionId, accepted, cwd);
+        notes.push(`no route could hand the user's answer over in ${MAX_HELD_DELIVERIES} turns; not holding it any longer`);
+        return { notes };
+    }
     const attempt = (accepted.delivery_attempts ?? 0) + 1;
     if (attempt > MAX_CONTINUATION_COUNT) {
         gate(ctx, 'held', 'delivery-limit', {
@@ -1378,7 +1595,7 @@ async function deliverAcceptedAnswers(ctx, sessionId, route, accepted, notes) {
         // Settle rather than journal for ever. The answer has been offered as often
         // as any working route could need, it is already in the notes of each of
         // those turns, and the questions it answered still deserve retirement.
-        settleAcceptedAnswers(ctx, sessionId, accepted);
+        settleAcceptedAnswers(ctx, sessionId, accepted, cwd);
         notes.push(`the user's answer reached the ${route.kind} route ${MAX_CONTINUATION_COUNT} times without being acknowledged; not delivering it again`);
         return { notes };
     }
@@ -1414,6 +1631,18 @@ async function deliverAcceptedAnswers(ctx, sessionId, route, accepted, notes) {
             delivered_route: deliveredRoute,
         }));
     }
+    else if (delivered.acknowledgement === 'held') {
+        // Give the delivery attempt back and count the hold instead. The attempt
+        // was counted before the call because one that dies mid-delivery still
+        // happened and a counter written afterwards could be evaded by crashing —
+        // but a route that *returns* `held` proves both that this process survived
+        // and that nothing was handed over.
+        amendAcceptedAnswers(ctx, sessionId, (current) => ({
+            ...current,
+            delivery_attempts: accepted.delivery_attempts ?? 0,
+            held_deliveries: (current.held_deliveries ?? 0) + 1,
+        }));
+    }
     ctx.log?.info('hook.answer', {
         answered: true,
         stage: deliveredStage,
@@ -1442,7 +1671,11 @@ async function handleClaimedStop(ctx, envelope, sessionId, state, pending, notes
         for (const entry of live)
             await closeQuietly(ctx, entry.request_id);
         await retirePendings(ctx, envelope, sessionId, pending, 'expired');
-        gate(ctx, 'held', 'no-question');
+        // Not `no-question`: there was a question, and this says so. Reading the
+        // log to find out why an ask never travelled is the whole reason these
+        // reasons exist, and the wrong one sent that reader looking for a question
+        // that was right there.
+        gate(ctx, 'held', 'harness-cannot-continue', { harness: ctx.harness });
         notes.push(`${HARNESS_CAPABILITIES[ctx.harness].deliveryContract}; use a blocking \`notifai send --reply\` question`);
         return { notes };
     }
@@ -1470,6 +1703,8 @@ async function handleClaimedStop(ctx, envelope, sessionId, state, pending, notes
                     reply: replies.at(-1),
                     agent_acknowledgement_required: response?.agent_acknowledgement_required ??
                         entry.agent_acknowledgement_required,
+                    agent_acknowledgement_text_required: response?.agent_acknowledgement_text_required ??
+                        entry.agent_acknowledgement_text_required,
                 };
             });
             const accepted = stageAcceptedAnswers(ctx, sessionId, authoritative, pending.length - authoritative.length - permanentlyRejected.length);
@@ -1477,7 +1712,7 @@ async function handleClaimedStop(ctx, envelope, sessionId, state, pending, notes
                 reportAnswer(ctx, notes, answer, true);
             // Anything still unasked rides the next Stop: the agent is being resumed
             // with answers right now, and may not even need the rest afterwards.
-            return deliverAcceptedAnswers(ctx, sessionId, route, accepted, notes);
+            return deliverAcceptedAnswers(ctx, sessionId, route, accepted, notes, envelope.cwd);
         }
         const recoverableLive = live.filter((entry) => !permanentFailures.has(entry.request_id));
         liveToEscalate = recoverableLive;
@@ -1561,16 +1796,26 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
     // its own notification — one ask never stands in for another.
     const submitted = [];
     for (const entry of unasked) {
-        // The reply window is the question's own: whatever is left of the waiter's
-        // ceiling, granted to the server so it stops accepting answers at the same
-        // moment this owner stops listening for them.
-        const replyWindowSeconds = Math.floor((ceilingAt - ctx.now()) / 1000);
-        if (replyWindowSeconds < MIN_REPLY_WINDOW_SECONDS) {
-            notes.push('too little of the waiter ceiling is left for a reply window the server would accept; leaving this question in the terminal');
+        // How long the answer is accepted, and how long this owner listens for it,
+        // are two different spans. They used to be one: the window was whatever
+        // remained of the waiter's ceiling, so a question asked at a turn's end
+        // stopped being answerable about eight minutes later, whatever the user
+        // had configured.
+        //
+        // That was right when the waiter was the only way an answer came back. It
+        // is not any more: a late answer is found by the next turn's poll or
+        // replayed from the journal, so this owner giving up listening says
+        // nothing about whether the user's answer is still wanted.
+        const replyWindowSeconds = ctx.config.reply_window_seconds.value;
+        if (ceilingAt - ctx.now() < MIN_REPLY_WINDOW_SECONDS * 1000) {
+            notes.push('too little of the waiter ceiling is left to submit and confirm this question; leaving it in the terminal');
             continue;
         }
+        // The owner still stops listening at its own ceiling. Only the span the
+        // server accepts answers into changed.
         const ownerDeadlineAt = ceilingAt;
         const questions = pendingQuestions(entry);
+        const eventSource = sourceContextAtHookEvent(entry.source, envelope.cwd);
         let intent = entry.submission;
         if (intent === undefined) {
             if (entry.body === undefined) {
@@ -1584,7 +1829,7 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
                 questions,
                 ...(entry.media !== undefined ? { media: entry.media } : {}),
                 ...(entry.project !== undefined ? { project: entry.project } : {}),
-                ...(entry.source !== undefined ? { source: entry.source } : {}),
+                ...(eventSource !== undefined ? { source: eventSource } : {}),
                 event: 'agent_question',
                 windowSeconds: replyWindowSeconds,
                 ownerDeadlineAt,
@@ -1639,12 +1884,77 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
             receipt = await submitQuestion(ctx, intent);
             admissionConfirmed = true;
         }
-        catch (err) {
-            if (err instanceof ApiCallError && err.status < 500 && err.status !== 408) {
-                // A concrete client response is an admission rejection, not an
-                // ambiguous commit. Keep the frozen intent for a later retry and leave
-                // the question in the terminal; polling a request the server says it
-                // did not accept only burns the owner window and hides the real fault.
+        catch (caught) {
+            let err = caught;
+            if (err instanceof ApiCallError && isTerminalDraftRejection(err)) {
+                ctx.log?.error('hook.pushed', {
+                    ok: false,
+                    request_id: intent.request_id,
+                    status: err.status,
+                    code: err.code,
+                    message: err.message,
+                });
+                if (entry.submission !== undefined) {
+                    notes.push(`question submission was rejected (${err.code}, HTTP ${err.status}); reminting the draft in the current contract instead of replaying the frozen one`);
+                    clearFrozenSubmission(sessionId, ctx.env, entry);
+                    if (entry.body === undefined) {
+                        dropPendingQuestion(sessionId, ctx.env, entry);
+                        notes.push('registered question has no canonical body; retired the frozen draft instead of retrying it');
+                        continue;
+                    }
+                    const reminted = await prepareQuestionSubmission(ctx, {
+                        title: questions[0].text,
+                        body: entry.body,
+                        questions,
+                        ...(entry.media !== undefined ? { media: entry.media } : {}),
+                        ...(entry.project !== undefined ? { project: entry.project } : {}),
+                        ...(eventSource !== undefined ? { source: eventSource } : {}),
+                        event: 'agent_question',
+                        windowSeconds: replyWindowSeconds,
+                        ownerDeadlineAt,
+                    });
+                    if ('error' in reminted) {
+                        dropPendingQuestion(sessionId, ctx.env, entry);
+                        notes.push(reminted.error);
+                        continue;
+                    }
+                    intent = reminted;
+                    updateSessionState(sessionId, ctx.env, (current) => {
+                        const list = pendingList(current);
+                        const index = list.findIndex((candidate) => isSamePending(candidate, entry));
+                        if (index < 0)
+                            return current;
+                        const next = [...list];
+                        next[index] = { ...next[index], submission: reminted };
+                        return { ...current, pending: next };
+                    });
+                    try {
+                        receipt = await submitQuestion(ctx, intent);
+                        admissionConfirmed = true;
+                    }
+                    catch (retryErr) {
+                        if (retryErr instanceof ApiCallError && isTerminalDraftRejection(retryErr)) {
+                            dropPendingQuestion(sessionId, ctx.env, entry);
+                            notes.push(`reminted draft was also rejected (${retryErr.code}, HTTP ${retryErr.status}); retiring the question so it is not retried forever`);
+                            ctx.log?.error('hook.pushed', {
+                                ok: false,
+                                request_id: intent.request_id,
+                                status: retryErr.status,
+                                code: retryErr.code,
+                                message: retryErr.message,
+                            });
+                            continue;
+                        }
+                        err = retryErr;
+                    }
+                }
+                else {
+                    dropPendingQuestion(sessionId, ctx.env, entry);
+                    notes.push(`question submission was rejected (${err.code}, HTTP ${err.status}); retiring it because the current draft will never be accepted`);
+                    continue;
+                }
+            }
+            if (!admissionConfirmed && err instanceof ApiCallError && err.status < 500 && err.status !== 408) {
                 notes.push(`question submission was rejected (${err.code}, HTTP ${err.status}); preserving it for recovery`);
                 ctx.log?.error('hook.pushed', {
                     ok: false,
@@ -1655,11 +1965,10 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
                 });
                 continue;
             }
-            // This is deliberately not a fail-open return. A transport failure is
-            // ambiguous: the server may already have dispatched the card. The
-            // client-generated request id keeps polling/finalization possible.
-            notes.push(`question submission response was ambiguous; recovering ${intent.request_id}`);
-            ctx.log?.error('hook.pushed', { ok: false, request_id: intent.request_id, message: String(err) });
+            if (!admissionConfirmed) {
+                notes.push(`question submission response was ambiguous; recovering ${intent.request_id}`);
+                ctx.log?.error('hook.pushed', { ok: false, request_id: intent.request_id, message: String(err) });
+            }
         }
         if (admissionConfirmed) {
             ctx.log?.info('hook.pushed', {
@@ -1675,17 +1984,28 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
             : Date.parse(receipt.reply_expires_at);
         const live = {
             ...entry,
+            ...(intent.draft.source !== undefined ? { source: intent.draft.source } : {}),
             request_id: intent.request_id,
             collapse_key: intent.collapse_key,
             device_ids: intent.device_ids,
-            // Submission and every later poll share one wall-clock owner. The
-            // server may start its relative window a little later while the submit
-            // response is in flight; closing at this deadline is therefore the
-            // authoritative backstop against accepting an answer into a void.
-            reply_deadline_at: Math.min(intent.owner_deadline_at, Number.isFinite(committedReplyDeadline)
+            // When the server stops accepting an answer — not when this owner stops
+            // waiting for one. Those were the same number until the window became a
+            // setting, and taking the minimum silently capped every question at the
+            // waiter's ceiling: a question asked with a day-long window was swept as
+            // stale about eight minutes later and retired, so the answer given over
+            // lunch met a closed question.
+            //
+            // Both consumers of this field already clamp to the owner's own ceiling
+            // (`Math.min(hardDeadlineAt, …)` when deriving the ceiling, and
+            // `Math.min(ceilingAt, …)` when deriving the wait), so recording the
+            // real expiry here lengthens what the user gets without lengthening what
+            // this process waits.
+            reply_deadline_at: Number.isFinite(committedReplyDeadline)
                 ? committedReplyDeadline
-                : intent.owner_deadline_at),
+                : intent.owner_deadline_at,
         };
+        if (intent.draft.source === undefined)
+            delete live.source;
         delete live.submission;
         submitted.push(live);
         // Record what is now live on the user's devices BEFORE any wait. If we
@@ -1705,7 +2025,7 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
                 // The entry vanished while the submit was in flight (the user's prompt
                 // wiped the queue). The delivered notification must still be retirable,
                 // so park it rather than lose its only identifiers.
-                const retirement = retiringQuestion(live, 'answered_elsewhere');
+                const retirement = retiringQuestion(live, 'answered_elsewhere', envelope.cwd);
                 const retiring = [...(current.retiring ?? [])];
                 if (!retiring.some((parked) => parked.request_id === retirement.request_id)) {
                     retiring.push(retirement);
@@ -1735,7 +2055,7 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
         const accepted = stageAcceptedAnswers(ctx, sessionId, staleAnswers, remaining);
         for (const answer of staleAnswers)
             reportAnswer(ctx, notes, answer, true);
-        return deliverAcceptedAnswers(ctx, sessionId, route, accepted, notes);
+        return deliverAcceptedAnswers(ctx, sessionId, route, accepted, notes, envelope.cwd);
     }
     const waitingOn = [
         ...alreadyLive.filter((entry) => entry.reply_deadline_at !== undefined && entry.reply_deadline_at > ctx.now()),
@@ -1751,10 +2071,32 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
     if (permanentFailure !== null)
         notes.push(permanentFailure);
     if (waited.byRequest.size === 0) {
-        // Once this owner returns, no shipped command-hook harness can guarantee
-        // a later answer reaches the same agent turn. Close first, then retire the
-        // local records, so the Companion never accepts an answer into a void.
-        const finalized = await finalizePendings(ctx, waitingOn);
+        // This owner is done listening. That used to mean the question was over:
+        // it closed the window server-side and retired the record, on the reasoning
+        // that no later answer could reach the same agent turn.
+        //
+        // The reaching was never the point — the *accepting* is. A question whose
+        // window is still open is polled again by the next prompt and the next
+        // Stop, and an answer found there is journaled and replayed. Closing here
+        // capped every question at this owner's ceiling however long a window the
+        // user had configured, which is what made a day-long window mean eight
+        // minutes.
+        //
+        // So: finalize only what the server has genuinely stopped accepting, and
+        // leave the rest live for the turn that comes next. A session that truly
+        // ends still retires its questions — that is what the session-end hook is
+        // for, and it is the honest place for it.
+        const expired = waitingOn.filter((entry) => entry.reply_deadline_at === undefined ||
+            entry.reply_deadline_at <= ctx.now() ||
+            // A permanent rejection is the server saying this question can never be
+            // answered, whatever its window says. Leaving it open would strand a
+            // dead question on the user's devices.
+            waited.permanentFailures.has(entry.request_id));
+        const stillAnswerable = waitingOn.filter((entry) => !expired.includes(entry));
+        if (stillAnswerable.length > 0) {
+            notes.push(`${stillAnswerable.length} question${stillAnswerable.length === 1 ? ' is' : 's are'} still answerable; leaving ${stillAnswerable.length === 1 ? 'it' : 'them'} open for the next turn rather than closing ${stillAnswerable.length === 1 ? 'it' : 'them'} with this waiter`);
+        }
+        const finalized = await finalizePendings(ctx, expired);
         const finalAnswers = finalized
             .map(finalizedAnswer)
             .filter((entry) => entry !== null);
@@ -1773,7 +2115,7 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
             const accepted = stageAcceptedAnswers(ctx, sessionId, finalAnswers, remaining);
             for (const answer of finalAnswers)
                 reportAnswer(ctx, notes, answer, false);
-            return deliverAcceptedAnswers(ctx, sessionId, route, accepted, notes);
+            return deliverAcceptedAnswers(ctx, sessionId, route, accepted, notes, envelope.cwd);
         }
         const requestIdSummary = summarizeRequestIds(waitingOn);
         ctx.log?.info('hook.answer', {
@@ -1809,6 +2151,7 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
             reply: authoritative.at(-1),
             replies: authoritative,
             agent_acknowledgement_required: finalized.response?.agent_acknowledgement_required,
+            agent_acknowledgement_text_required: finalized.response?.agent_acknowledgement_text_required,
         });
         if (finalized.response === null) {
             notes.push(`could not confirm the close fence for ${entry.request_id}; delivering the durable answer already observed`);
@@ -1817,7 +2160,7 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
     const accepted = stageAcceptedAnswers(ctx, sessionId, answered, waitingOn.length - answered.length);
     for (const answer of answered)
         reportAnswer(ctx, notes, answer, false);
-    return deliverAcceptedAnswers(ctx, sessionId, route, accepted, notes);
+    return deliverAcceptedAnswers(ctx, sessionId, route, accepted, notes, envelope.cwd);
 }
 // ---------------------------------------------------------------------------
 // SessionEnd — local cleanup only
@@ -1841,7 +2184,7 @@ export function handleSessionEnd(env, envelope, now = Date.now()) {
     const orphans = [...(state.retiring ?? [])];
     for (const entry of pendingList(state)) {
         try {
-            const orphan = retiringQuestion(entry, 'expired');
+            const orphan = retiringQuestion(entry, 'expired', envelope.cwd);
             if (orphan !== null)
                 orphans.push(orphan);
         }
@@ -1860,18 +2203,13 @@ export function handleSessionEnd(env, envelope, now = Date.now()) {
         notes.push(`queued ${orphans.length} question${orphans.length > 1 ? 's' : ''} for retirement on the next hook`);
     }
     if (state.accepted !== undefined || (state.acknowledgement_due?.length ?? 0) > 0) {
-        const preserved = {};
-        if (state.accepted !== undefined)
-            preserved.accepted = state.accepted;
-        if (state.acknowledgement_due !== undefined && state.acknowledgement_due.length > 0) {
-            preserved.acknowledgement_due = state.acknowledgement_due;
+        const preserved = { ...state };
+        delete preserved.pending;
+        delete preserved.retiring;
+        delete preserved.acknowledgement_blocks;
+        if ((preserved.acknowledgement_due?.length ?? 0) === 0) {
+            delete preserved.acknowledgement_due;
         }
-        if (state.last_prompt_at !== undefined)
-            preserved.last_prompt_at = state.last_prompt_at;
-        if (state.last_stop_at !== undefined)
-            preserved.last_stop_at = state.last_stop_at;
-        if (state.continuation !== undefined)
-            preserved.continuation = state.continuation;
         writeSessionState(sessionId, env, preserved);
         notes.push(state.accepted !== undefined
             ? 'preserved an accepted device answer for this exact session to resume'
@@ -1893,12 +2231,21 @@ export function handleSessionEnd(env, envelope, now = Date.now()) {
 // ask — register a question for the turn's end
 // ---------------------------------------------------------------------------
 /**
- * More pending questions than this means an agent is looping, not asking.
- * Related questions belong in one `ask --form` (the wire carries up to four
- * questions per notification); four separate pushes is already a lot of lock
- * screen.
+ * Registrations still waiting for their first push. More than this in one turn
+ * means an agent is looping, not asking, and related questions belong in one
+ * `ask --form` instead.
+ *
+ * Deliberately counts only unasked entries. A question already on the user's
+ * devices is waiting on a person, not on the agent, and an answer stays
+ * accepted for a day — so counting live questions here would have turned a
+ * patient user into a reason the agent could no longer ask anything.
  */
 export const MAX_PENDING_QUESTIONS = 4;
+/**
+ * Everything this session has open at once, asked or not. The lock screen is
+ * the shared resource being protected here, not the agent's turn.
+ */
+export const MAX_LIVE_QUESTIONS = 10;
 /**
  * A session may hold several registered questions at once: a new `ask` never
  * ends an earlier one. Each reaches the user as its own notification and is
@@ -1912,11 +2259,16 @@ export const MAX_PENDING_QUESTIONS = 4;
  * running in one project at once, and their questions must never interfere.
  */
 export function registerQuestion(sessionId, env, question, now = Date.now()) {
-    let full = false;
+    let full = null;
     updateSessionState(sessionId, env, (state) => {
         const pending = pendingList(state);
-        if (pending.length >= MAX_PENDING_QUESTIONS) {
-            full = true;
+        const unasked = pending.filter((entry) => entry.request_id === undefined);
+        if (unasked.length >= MAX_PENDING_QUESTIONS) {
+            full = 'unasked';
+            return state;
+        }
+        if (pending.length >= MAX_LIVE_QUESTIONS) {
+            full = 'live';
             return state;
         }
         return {
@@ -1932,10 +2284,14 @@ export function registerQuestion(sessionId, env, question, now = Date.now()) {
             ],
         };
     });
-    if (full) {
+    if (full === 'unasked') {
         throw new Error(`${MAX_PENDING_QUESTIONS} questions are already waiting to be asked. ` +
             'Combine related questions into one `notifai ask --form` instead of registering more.');
     }
+    if (full === 'live') {
+        throw new Error(`${MAX_LIVE_QUESTIONS} questions from this session are already open. ` +
+            'Retire the ones you no longer need with `notifai close <request_id>` before asking another.');
+    }
 }
 /** Parses hook JSON from stdin, tolerating an empty or malformed body. */
 export function parseHookInput(raw) {