@raidiant/notifai 7.0.2 → 9.0.0

package/src/hooks.ts

@@ -69,6 +69,8 @@ export interface HookEnvelope {
   session_id?: string
   cwd?: string
   hook_event_name?: string
+  /** How a harness lifecycle began: startup, resume, clear, compact, or fork. */
+  source?: string
   /** Set by the harness when this Stop follows a previous Stop continuation. */
   stop_hook_active?: boolean
   /** Cursor's stable per-conversation identifier. */
@@ -77,9 +79,20 @@ export interface HookEnvelope {
   workspace_roots?: string[]
   /** Cursor increments this after each stop-hook automatic follow-up. */
   loop_count?: number
+  /** Cursor Stop completion state; cancellation must not auto-follow. */
+  status?: string
+  /** The prompt the user just submitted, when the harness includes it. */
+  prompt?: string
 }
 
 export interface SessionState {
+  /** Model-visible proactive context already emitted for this harness session. */
+  activation_context_emitted_at?: number
+  /** Harness process that received it; a resumed session has a new owner. */
+  activation_context_owner_pid?: number
+  /** Cursor's documented session context path is lossy; bounded first-Stop fallback journal. */
+  cursor_activation_claimed_at?: number
+  cursor_activation_confirmed_at?: number
   /** Epoch ms of the user's last prompt in this session — our presence signal. */
   last_prompt_at?: number
   /** Epoch ms of the last observed Stop hook, distinct from prompt routing. */
@@ -239,6 +252,15 @@ export interface PendingQuestion {
   device_ids?: string[]
   /** Absolute end of the server reply window and its local continuation owner. */
   reply_deadline_at?: number
+  /**
+   * When this Stop owner stops listening for a direct wake. Distinct from
+   * `reply_deadline_at`: the server may still accept an answer for a day after
+   * this owner has returned. A later Stop that treats the reply window as a
+   * fresh waiter ceiling monopolizes the claim and skips newly registered
+   * questions. Absent on state written before this field existed — treated as
+   * already spent, because that is the shape a degraded waiter left behind.
+   */
+  owner_deadline_at?: number
   /** Frozen before the first network byte, so an ambiguous submit is replayable. */
   submission?: PendingSubmissionIntent
 }
@@ -319,6 +341,14 @@ export function waiterCeilingSeconds(detached: boolean): number {
  */
 export const MIN_REPLY_WINDOW_SECONDS = 60
 
+/**
+ * HTTP budget reserved for the waiter's final reply fetch and close fence.
+ * Taken from the owner deadline rather than added after it, so the hook does
+ * not block past its ceiling. A near-zero remainder used to produce a
+ * misleading 0s timeout and an unproven retirement.
+ */
+export const FINALIZATION_NETWORK_BUDGET_SECONDS = 3
+
 /**
  * The terminal-first wait: the question sits in the terminal for
  * `ask_grace_seconds` from when it was sent, and only then reaches companion
@@ -348,8 +378,10 @@ async function awaitTerminalFirstWindow(
 }
 
 export interface HookOutcome {
-  /** Written to stdout verbatim — the harness parses this as the decision. */
+  /** Written to stdout verbatim — the harness parses this as output. */
   stdout?: string
+  /** Whether stdout takes over the turn, rather than adding prompt context. */
+  decided?: boolean
   /** Diagnostics; harnesses surface hook stderr in the transcript. */
   notes: string[]
   /** Structured lifecycle detail that belongs on hook.end without user text. */
@@ -462,6 +494,108 @@ function updateSessionState(
   })
 }
 
+/** Record a lifecycle activation so the first-prompt compatibility path stays silent. */
+export function markSessionActivation(
+  sessionId: string,
+  env: NodeJS.ProcessEnv,
+  now: number,
+  ownerPid: number,
+): void {
+  updateSessionState(sessionId, env, (current) => ({
+    ...current,
+    activation_context_emitted_at: now,
+    activation_context_owner_pid: ownerPid,
+  }))
+}
+
+/**
+ * Atomically own first-prompt activation only when no lifecycle hook did.
+ *
+ * Some managed hosts preserve UserPromptSubmit while regenerating away newer
+ * SessionStart definitions. This is a compatibility seam, not the primary
+ * lifecycle: one session gets at most one model-visible activation from it.
+ */
+export function claimPromptActivation(
+  sessionId: string,
+  env: NodeJS.ProcessEnv,
+  now: number,
+  ownerPid: number,
+): boolean {
+  let claimed = false
+  updateSessionState(sessionId, env, (current) => {
+    if (
+      current.activation_context_emitted_at !== undefined &&
+      current.activation_context_owner_pid === ownerPid
+    ) {
+      return current
+    }
+    claimed = true
+    return {
+      ...current,
+      activation_context_emitted_at: now,
+      activation_context_owner_pid: ownerPid,
+    }
+  })
+  return claimed
+}
+
+/** Atomically claim Cursor's first-Stop activation fallback once per conversation. */
+export function claimCursorStopActivation(
+  sessionId: string,
+  env: NodeJS.ProcessEnv,
+  now: number,
+): boolean {
+  const claimGuardMs = 30_000
+  let claimed = false
+  updateSessionState(sessionId, env, (current) => {
+    if (current.cursor_activation_confirmed_at !== undefined) return current
+    if (
+      current.cursor_activation_claimed_at !== undefined &&
+      now - current.cursor_activation_claimed_at < claimGuardMs
+    ) {
+      return current
+    }
+    claimed = true
+    return { ...current, cursor_activation_claimed_at: now }
+  })
+  return claimed
+}
+
+/** Cursor's loop_count proves the previous Stop follow-up reached the host. */
+export function confirmCursorStopActivation(
+  sessionId: string,
+  env: NodeJS.ProcessEnv,
+  now: number,
+): boolean {
+  let owned = false
+  updateSessionState(sessionId, env, (current) => {
+    if (current.cursor_activation_confirmed_at !== undefined) {
+      owned = true
+      return current
+    }
+    if (current.cursor_activation_claimed_at === undefined) return current
+    owned = true
+    return { ...current, cursor_activation_confirmed_at: now }
+  })
+  return owned
+}
+
+/** A fresh/cleared Cursor lifecycle makes its next Stop the fallback owner again. */
+export function resetCursorStopActivation(sessionId: string, env: NodeJS.ProcessEnv): void {
+  updateSessionState(sessionId, env, (current) => {
+    if (
+      current.cursor_activation_claimed_at === undefined &&
+      current.cursor_activation_confirmed_at === undefined
+    ) {
+      return current
+    }
+    const next = { ...current }
+    delete next.cursor_activation_claimed_at
+    delete next.cursor_activation_confirmed_at
+    return next
+  })
+}
+
 /**
  * Session state a crashed harness left behind.
  *
@@ -651,8 +785,9 @@ function claimPath(sessionId: string, env: NodeJS.ProcessEnv): string {
 /**
  * A question is stored so a later hook can push it, and it reaches us from a
  * shell command, so its size is whatever the agent typed. The push itself is
- * bounded by the 4096-byte APNs envelope; this bounds what sits on disk in the
- * meantime, and keeps one runaway agent from writing megabytes per session.
+ * bounded by the current 4096-byte push-provider envelopes; this bounds what
+ * sits on disk in the meantime, and keeps one runaway agent from writing
+ * megabytes per session.
  */
 const MAX_STORED_QUESTION_CHARS = 2000
 
@@ -950,7 +1085,6 @@ async function prepareQuestionSubmission(
     media?: MediaItemT[] | undefined
     project?: string | undefined
     source?: SourceContextT | undefined
-    event: string
     /** How long the server keeps accepting an answer. */
     windowSeconds: number
     /** Absolute owner deadline persisted before submit. */
@@ -969,7 +1103,6 @@ async function prepareQuestionSubmission(
     {
       title: options.title,
       body: options.body,
-      event: options.event,
       lifecycle: { tier: 'needs_you' },
       ...(options.project !== undefined ? { project: options.project } : {}),
       ...(options.media !== undefined ? { media: options.media } : {}),
@@ -1036,6 +1169,10 @@ async function waitForAnyReply(
   let firstPoll = true
   const permanentFailures = new Map<string, string>()
 
+  if (timeoutSeconds <= 0 || deadline <= ctx.now()) {
+    return { byRequest: new Map(), degraded: false, permanentFailures }
+  }
+
   for (;;) {
     const remainingMs = Math.max(0, deadline - ctx.now())
     if (!firstPoll && remainingMs === 0) {
@@ -1089,17 +1226,16 @@ function permanentReplyFailureNote(failures: Map<string, string>): string | null
   return `reply polling stopped after a permanent server rejection (${details}); the affected question will be retired before its continuation owner exits`
 }
 
-/**
- * Healthy companion devices that implement replies. Both the iOS app and the
- * macOS app register reply categories and submit answers directly.
- */
+/** Healthy Companion devices that advertise the current answer job. */
 async function answerableDevices(ctx: HookContext): Promise<string[]> {
   const configured = ctx.config.devices.value
   const { devices } = await ctx.client.listDevices()
   return devices
     .filter(
       (device) =>
-        (device.platform === 'ios' || device.platform === 'macos') &&
+        (device.platform === 'ios' ||
+          device.platform === 'macos' ||
+          device.platform === 'android') &&
         device.registration_healthy &&
         device.capabilities?.includes('answer') === true &&
         device.derived_status !== 'must_update',
@@ -1113,7 +1249,7 @@ async function answerableDevices(ctx: HookContext): Promise<string[]> {
  * `notifai ask` supersedes the previous question and it is a plain command with
  * no hook payload, no idle probe and nothing to sleep for.
  */
-export type RetireDeps = Pick<HookContext, 'client' | 'config'>
+export type RetireDeps = Pick<HookContext, 'client' | 'config'> & Pick<Partial<HookContext>, 'log'>
 
 /**
  * Close is a server-side serialization fence: a successful response contains
@@ -1138,60 +1274,22 @@ async function closeQuietly(ctx: RetireDeps, requestId: string): Promise<void> {
 }
 
 /**
- * Retire the question on every device it reached. A state change is not news
- * (D-B): the retirement rides as a background state sync — no alert, no
- * sound — carrying the shared collapse key so the companion removes the
- * delivered question and marks it done. If the app cannot run, the stale
- * question simply waits until next open, which beats a tombstone banner
- * announcing what the user just did.
+ * Close the reply window so the server can mint the retirement push. Client
+ * submissions cannot carry `question_retired`; that event is reserved for
+ * server-origin state syncs.
  */
-async function retire(
+async function proveRetirement(
   ctx: RetireDeps,
-  collapseKey: string,
-  title: string,
-  body: string,
-  endState: LifecycleEndState,
-  retiresRequestId: string,
-  devices?: string[],
-  project?: string | undefined,
-  source?: SourceContextT | undefined,
+  requestId: string,
 ): Promise<boolean> {
-  const build = buildDraft(
-    ctx.config,
-    {
-      title,
-      body,
-      event: 'question_retired',
-      lifecycle: { tier: 'done', state: endState, retires_request_id: retiresRequestId },
-      ...(project !== undefined ? { project } : {}),
-      ...(devices !== undefined && devices.length > 0 ? { device: devices } : {}),
-      collapseKey,
-      level: 'passive',
-    },
-    source === undefined ? {} : { source },
-  )
-  if (!build.ok) return false
-  try {
-    await ctx.client.submit(
-      { idempotency_key: `retire-${randomBytes(12).toString('base64url')}`, draft: build.draft },
-      0,
-    )
-    return true
-  } catch {
-    // Same reasoning as closeQuietly: the window is already closed server-side.
-    return false
-  }
-}
-
-/**
- * The title a retirement carries. It is never rendered as a banner — the push
- * is `content-available` only — but it is what a companion with no matching
- * history entry has to fall back on, and it is what shows in server-side logs.
- */
-const RETIREMENT_TITLES: Record<LifecycleEndState, string> = {
-  answered: 'Answered',
-  answered_elsewhere: 'Answered in the terminal',
-  expired: 'Question expired',
+  const response = await finalizeReplies(ctx, requestId)
+  const proven = response !== null
+  ctx.log?.info('hook.retirement', {
+    request_id: requestId,
+    attempted: true,
+    proven,
+  })
+  return proven
 }
 
 /**
@@ -1257,13 +1355,42 @@ function retiringQuestion(
   }
 }
 
-function retirementDeviceIds(entry: RetiringQuestion): string[] {
-  if (!Array.isArray(entry.device_ids) || entry.device_ids.length === 0) {
-    throw new Error(
-      `retirement for ${entry.request_id} is missing its device identifiers; refusing to re-resolve routing`,
-    )
-  }
-  return entry.device_ids
+const SHORT_CONFIRMATIONS = new Set(['done', 'yes', 'y', 'no', 'n', 'ok', 'okay'])
+
+function normalizePrompt(value: string): string {
+  return value.trim().replace(/\s+/g, ' ').toLowerCase()
+}
+
+function pendingChoiceLabels(pending: PendingQuestion): string[] {
+  const fromQuestions = (pending.questions ?? []).flatMap((question) =>
+    (question.choices ?? []).flatMap((choice) => [choice.label, choice.id]),
+  )
+  return fromQuestions.map(normalizePrompt).filter((label) => label.length > 0)
+}
+
+function pendingHasMatchingChoice(pending: PendingQuestion, normalizedPrompt: string): boolean {
+  return pendingChoiceLabels(pending).includes(normalizedPrompt)
+}
+
+/**
+ * Which outstanding questions this prompt plausibly answers.
+ *
+ * A unique closed-choice match is enough. A short confirmation such as "done"
+ * matches only when exactly one question is outstanding. Long unrelated
+ * prompts leave every question open for the reply window.
+ */
+export function pendingAnsweredByPrompt(
+  prompt: string | undefined,
+  pending: readonly PendingQuestion[],
+): PendingQuestion[] {
+  const normalized = normalizePrompt(prompt ?? '')
+  if (normalized.length === 0 || pending.length === 0) return []
+
+  const labelled = pending.filter((entry) => pendingHasMatchingChoice(entry, normalized))
+  if (labelled.length === 1) return labelled
+  if (labelled.length > 1) return []
+  if (pending.length === 1 && SHORT_CONFIRMATIONS.has(normalized)) return [...pending]
+  return []
 }
 
 /**
@@ -1281,19 +1408,8 @@ export async function drainRetirements(
 
   const retired: string[] = []
   for (const entry of queue) {
-    await closeQuietly(ctx, entry.request_id)
-    const sent = await retire(
-      ctx,
-      entry.collapse_key,
-      RETIREMENT_TITLES[entry.state],
-      entry.question,
-      entry.state,
-      entry.request_id,
-      retirementDeviceIds(entry),
-      entry.project,
-      entry.source,
-    )
-    if (sent) {
+    const proven = await proveRetirement(ctx, entry.request_id)
+    if (proven) {
       retired.push(entry.request_id)
       // Persist each success before touching the next entry. A later corrupt
       // record or interrupted process must not resurrect work already done.
@@ -1380,19 +1496,8 @@ export async function drainOrphanRetirements(
       )
       continue
     }
-    await closeQuietly(ctx, entry.request_id)
-    const sent = await retire(
-      ctx,
-      entry.collapse_key,
-      RETIREMENT_TITLES[entry.state],
-      entry.question,
-      entry.state,
-      entry.request_id,
-      retirementDeviceIds(entry),
-      entry.project,
-      entry.source,
-    )
-    if (sent) {
+    const proven = await proveRetirement(ctx, entry.request_id)
+    if (proven) {
       done.push(entry.request_id)
       updateOrphanQueue(env, (current) =>
         current.filter((candidate) => candidate.request_id !== entry.request_id),
@@ -1484,10 +1589,15 @@ async function finalizePendings(
   pending: PendingQuestion[],
 ): Promise<FinalizedPending[]> {
   return Promise.all(
-    pending.map(async (entry) => ({
-      pending: entry,
-      response: await finalizeReplies(ctx, entry.request_id!),
-    })),
+    pending.map(async (entry) => {
+      const response = await finalizeReplies(ctx, entry.request_id!)
+      ctx.log?.info('hook.retirement', {
+        request_id: entry.request_id,
+        attempted: true,
+        proven: response !== null,
+      })
+      return { pending: entry, response }
+    }),
   )
 }
 
@@ -1521,7 +1631,7 @@ function reportAnswer(
     ...(late ? { late: true } : {}),
     request_id: answered.pending.request_id,
     device: answered.reply.device_name,
-    text: answered.reply.text,
+    text_chars: answered.reply.text.length,
   })
   notes.push(`${late ? 'late ' : ''}answer from ${answered.reply.device_name}: ${answered.reply.text}`)
 }
@@ -1579,7 +1689,7 @@ function isTerminalDraftRejection(err: ApiCallError): boolean {
   return err.status === 422 || (err.status === 400 && err.code === 'invalid_request')
 }
 
-function dropPendingQuestion(
+export function dropPendingQuestion(
   sessionId: string,
   env: NodeJS.ProcessEnv,
   entry: PendingQuestion,
@@ -1593,6 +1703,29 @@ function dropPendingQuestion(
   })
 }
 
+/**
+ * Drop registrations that never reached a device, so a later Stop cannot push
+ * them. A retirement push would be noise: there is nothing on any device to
+ * withdraw. Returns the withdrawn entries in registration order.
+ */
+export function withdrawUnpushedQuestions(
+  sessionId: string,
+  env: NodeJS.ProcessEnv,
+): PendingQuestion[] {
+  let withdrawn: PendingQuestion[] = []
+  updateSessionState(sessionId, env, (current) => {
+    const pending = pendingList(current)
+    withdrawn = pending.filter((entry) => entry.request_id === undefined)
+    if (withdrawn.length === 0) return current
+    const remaining = pending.filter((entry) => entry.request_id !== undefined)
+    const next: SessionState = { ...current }
+    if (remaining.length > 0) next.pending = remaining
+    else delete next.pending
+    return next
+  })
+  return withdrawn
+}
+
 function clearFrozenSubmission(
   sessionId: string,
   env: NodeJS.ProcessEnv,
@@ -1992,10 +2125,9 @@ async function retirePendings(
 // ---------------------------------------------------------------------------
 
 /**
- * Records presence and retires anything still asking on companion devices. This is the
- * "answered in the terminal" case from the original design: we cannot tell
- * whether the new prompt answers the question, but we do not need to — the
- * user being here is what makes the notification noise.
+ * Records presence. Retires a live question only when this prompt plausibly
+ * answers it. Typing in the terminal is not by itself a resolution: the User
+ * may be answering a different question on a device.
  */
 export async function handleUserPromptSubmit(
   ctx: HookContext,
@@ -2070,13 +2202,26 @@ export async function handleUserPromptSubmit(
     const permanentFailure = permanentReplyFailureNote(permanentFailures)
     if (permanentFailure !== null) notes.push(permanentFailure)
   }
+  const matched = pendingAnsweredByPrompt(envelope.prompt, pendingList(state))
+  for (const entry of matched) {
+    ctx.log?.info('hook.retirement', {
+      request_id: entry.request_id,
+      question_id: entry.question_id,
+      reason: 'prompt-matched',
+      attempted: entry.request_id !== undefined,
+      proven: false,
+    })
+  }
   // Park before dropping `pending`. If the process dies between these writes,
   // the next hook sees both copies and dedupes them; the old order could die in
   // the gap after erasing the only request/collapse/device identifiers.
   updateSessionState(sessionId, ctx.env, (current) => {
     const retiring = [...(current.retiring ?? [])]
-    const unasked = pendingList(current).filter((entry) => entry.request_id === undefined)
-    for (const entry of pendingList(current).filter((entry) => entry.request_id !== undefined)) {
+    const matchedNow = pendingAnsweredByPrompt(envelope.prompt, pendingList(current))
+    const unmatched = pendingList(current).filter(
+      (entry) => !matchedNow.some((item) => isSamePending(item, entry)),
+    )
+    for (const entry of matchedNow.filter((item) => item.request_id !== undefined)) {
       const retirement = retiringQuestion(entry, 'answered_elsewhere', envelope.cwd)
       if (
         retirement !== null &&
@@ -2085,11 +2230,17 @@ export async function handleUserPromptSubmit(
         retiring.push(retirement)
       }
     }
+    const unasked = unmatched.filter((entry) => entry.request_id === undefined)
+    const stillLive = unmatched.filter((entry) => entry.request_id !== undefined)
+    const remaining = [...stillLive, ...unasked]
 
     // Start from the whole document so fields introduced by a newer CLI remain
     // attached while this older writer applies the prompt transition it knows.
-    const next: SessionState = { ...current, last_prompt_at: ctx.now() }
-    if (unasked.length > 0) next.pending = unasked
+    const next: SessionState = {
+      ...current,
+      last_prompt_at: ctx.now(),
+    }
+    if (remaining.length > 0) next.pending = remaining
     else delete next.pending
     if (retiring.length > 0) next.retiring = retiring
     else delete next.retiring
@@ -2428,6 +2579,11 @@ async function deliverAcceptedAnswers(
   return outcome
 }
 
+/** True while this Stop owner is still allowed a direct-wake wait. */
+function ownerLeaseActive(entry: PendingQuestion, now: number): boolean {
+  return entry.owner_deadline_at !== undefined && entry.owner_deadline_at > now
+}
+
 /** The complete per-session Stop decision, after this process owns the claim. */
 async function handleClaimedStop(
   ctx: HookContext,
@@ -2515,26 +2671,44 @@ async function handleClaimedStop(
     const recoverableLive = live.filter(
       (entry) => !permanentFailures.has(entry.request_id!),
     )
-    liveToEscalate = recoverableLive
+    // A spent owner has already used its waiter ceiling. Passing those
+    // questions back into `escalate` starts a fresh ceiling, holds the
+    // per-session claim for another 3300s, and is why a later `ask` never
+    // reached a device after a degraded waiter (the next Stop never ran, or
+    // ran as claimed-elsewhere). Late answers still ride the short poll above
+    // and every later turn. Independent questions whose lease is still running
+    // keep their successor wait.
+    const stillOwned = recoverableLive.filter((entry) => ownerLeaseActive(entry, ctx.now()))
+    liveToEscalate = stillOwned
     if (unasked.length === 0) {
       if (recoverableLive.length === 0) return { notes }
-      // A previous answer may have resumed the model while independent
-      // questions remain. The next Stop is their successor owner: keep waiting
-      // to the original absolute deadline instead of polling for four seconds
-      // and abandoning them.
+      if (stillOwned.length === 0) {
+        const requestIdSummary = summarizeRequestIds(recoverableLive)
+        ctx.log?.info('hook.answer', {
+          answered: false,
+          stage: 'queued',
+          request_ids: requestIdSummary.ids,
+          owner_spent: true,
+        })
+        notes.push(
+          `${recoverableLive.length} question${recoverableLive.length === 1 ? ' is' : 's are'} still answerable; the previous waiter already used its ceiling, so a later turn will collect a late answer rather than waiting again`,
+        )
+        return { notes }
+      }
       return await escalate(
         ctx,
         envelope,
         sessionId,
         [],
-        recoverableLive,
+        stillOwned,
         notes,
         hardDeadlineAt,
         route,
       )
     }
     // Questions registered after the earlier push still owe the user their
-    // notification; fall through and escalate just those.
+    // notification; fall through and escalate just those, plus any live
+    // question whose owner lease is still running.
   }
 
   // A Stop answer may immediately produce a legitimate follow-up question.
@@ -2672,7 +2846,6 @@ async function escalate(
         ...(entry.media !== undefined ? { media: entry.media } : {}),
         ...(entry.project !== undefined ? { project: entry.project } : {}),
         ...(eventSource !== undefined ? { source: eventSource } : {}),
-        event: 'agent_question',
         windowSeconds: replyWindowSeconds,
         ownerDeadlineAt,
       })
@@ -2751,7 +2924,6 @@ async function escalate(
             ...(entry.media !== undefined ? { media: entry.media } : {}),
             ...(entry.project !== undefined ? { project: entry.project } : {}),
             ...(eventSource !== undefined ? { source: eventSource } : {}),
-            event: 'agent_question',
             windowSeconds: replyWindowSeconds,
             ownerDeadlineAt,
           })
@@ -2821,7 +2993,7 @@ async function escalate(
         request_id: intent.request_id,
         devices: intent.device_ids.length,
         questions: questions.length,
-        text: questions[0]!.text,
+        text_chars: questions[0]!.text.length,
       })
     }
     const committedReplyDeadline =
@@ -2841,14 +3013,14 @@ async function escalate(
       // stale about eight minutes later and retired, so the answer given over
       // lunch met a closed question.
       //
-      // Both consumers of this field already clamp to the owner's own ceiling
-      // (`Math.min(hardDeadlineAt, …)` when deriving the ceiling, and
-      // `Math.min(ceilingAt, …)` when deriving the wait), so recording the
-      // real expiry here lengthens what the user gets without lengthening what
-      // this process waits.
+      // The reply window is how long the server accepts an answer. This
+      // process still clamps its own wait to `hardDeadlineAt`. Recording the
+      // owner lease separately is what stops the *next* Stop from treating
+      // the remaining window as a fresh waiter ceiling.
       reply_deadline_at: Number.isFinite(committedReplyDeadline)
         ? committedReplyDeadline
         : intent.owner_deadline_at,
+      owner_deadline_at: intent.owner_deadline_at,
     }
     if (intent.draft.source === undefined) delete live.source
     delete live.submission
@@ -2927,7 +3099,8 @@ async function escalate(
     ceilingAt,
     Math.max(...waitingOn.map((entry) => entry.reply_deadline_at!)),
   )
-  const timeoutSeconds = Math.max(0, Math.ceil((ownerDeadline - ctx.now()) / 1000))
+  const waitUntil = ownerDeadline - FINALIZATION_NETWORK_BUDGET_SECONDS * 1000
+  const timeoutSeconds = Math.max(0, Math.ceil((waitUntil - ctx.now()) / 1000))
   const waited = await waitForAnyReply(
     ctx,
     waitingOn.map((entry) => entry.request_id!),
@@ -2955,7 +3128,7 @@ async function escalate(
     const expired = waitingOn.filter(
       (entry) =>
         entry.reply_deadline_at === undefined ||
-        entry.reply_deadline_at <= ctx.now() ||
+        entry.reply_deadline_at <= ownerDeadline ||
         // A permanent rejection is the server saying this question can never be
         // answered, whatever its window says. Leaving it open would strand a
         // dead question on the user's devices.
@@ -3001,10 +3174,10 @@ async function escalate(
       permanent_failures: waited.permanentFailures.size,
       waited_seconds: timeoutSeconds,
     })
-    if (waited.permanentFailures.size === 0) {
+    if (waited.permanentFailures.size === 0 && confirmedSilent.length > 0) {
       notes.push(
         waited.degraded
-          ? 'could not reach the server before the owner deadline; the question was retired so no answer can be lost later'
+          ? 'could not reach the server before the owner deadline; expired questions were retired so no answer can be lost later'
           : 'no answer in time; the question expired with its continuation owner',
       )
     }
@@ -3159,8 +3332,9 @@ export function registerQuestion(
   env: NodeJS.ProcessEnv,
   question: PendingQuestion,
   now: number = Date.now(),
-): void {
+): string {
   let full: 'unasked' | 'live' | null = null
+  const questionId = question.question_id ?? `q_${randomBytes(12).toString('base64url')}`
   updateSessionState(sessionId, env, (state) => {
     const pending = pendingList(state)
     const unasked = pending.filter((entry) => entry.request_id === undefined)
@@ -3177,9 +3351,9 @@ export function registerQuestion(
       pending: [
         ...pending,
         {
-          question_id: `q_${randomBytes(12).toString('base64url')}`,
           asked_at: now,
           ...question,
+          question_id: questionId,
           question: question.question.slice(0, MAX_STORED_QUESTION_CHARS),
         },
       ],
@@ -3194,9 +3368,10 @@ export function registerQuestion(
   if (full === 'live') {
     throw new Error(
       `${MAX_LIVE_QUESTIONS} questions from this session are already open. ` +
-        'Retire the ones you no longer need with `notifai close <request_id>` before asking another.',
+        'Retire the ones you no longer need with `notifai close <question_id>` or `notifai close --pending` before asking another.',
     )
   }
+  return questionId
 }
 
 /** Parses hook JSON from stdin, tolerating an empty or malformed body. */