@raidiant/notifai 9.2.1 → 9.3.0

package/dist/hooks.js

@@ -2,6 +2,7 @@ import { randomBytes } from 'node:crypto';
 import { closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync, } from 'node:fs';
 import path from 'node:path';
 import { REPLY_MAX_WINDOW_SECONDS } from '@raidiant/notifai-protocol';
+import { LEGACY_QUESTION_CLAIM_TTL_SECONDS, QUESTION_STOP_TEARDOWN_HEADROOM_SECONDS, QUESTION_SUBMISSION_COMPLETION_HEADROOM_SECONDS, QUESTION_WAITER_CEILING_SECONDS, } from './question-timing.js';
 import { ApiCallError, isRetryableReplyPollError, } from './client.js';
 import { loadConfig, projectSessionPointerPath, sanitizeSessionId, sessionConfigPath, stateDir, } from './config.js';
 import { buildDraft } from './send.js';
@@ -37,50 +38,12 @@ function summarizeRequestIds(entries) {
     const ids = entries.flatMap((entry) => entry.request_id === undefined ? [] : [entry.request_id]);
     return { ids, display: ids.join(', ') };
 }
-/**
- * The waiter's whole wall clock: the terminal-first timer, submission, and the
- * wait for an answer, from the moment the turn-end hook starts.
- *
- * One plain ceiling, deliberately not a budget carved into reserves. The
- * reserves existed to fit every phase inside a *held* turn; on Claude Code the
- * turn is not held any more, and on a host that still holds one the useful
- * question is only how long that host is willing to wait in total.
- */
-export const WAITER_CEILING_SECONDS = 480;
-/**
- * The same wall clock where the waiter runs in the background instead of
- * inside a held turn.
- *
- * On a host that holds its turn, 480 s is a real cost to the person sitting in
- * front of it, and the number above is right. On Claude Code the Stop hook
- * returns at once and the waiter is detached, so the same 480 s buys nothing
- * and costs a direct wake: an answer arriving at minute nine had to wait for
- * the session's next turn even though nothing was blocked.
- *
- * This sits under `CLAUDE_ASYNC_STOP_TIMEOUT_SECONDS` (3600) with headroom,
- * because that declaration's kill is silent, and under the reply window the
- * question was pushed with. Past it the journal still delivers at the next
- * turn — the ceiling decides how long a *direct* wake stays possible, never
- * whether the answer survives.
- */
-export const DETACHED_WAITER_CEILING_SECONDS = 3300;
-/** The waiter's wall clock, which depends on whether a turn is held open for it. */
-export function waiterCeilingSeconds(detached) {
-    return detached ? DETACHED_WAITER_CEILING_SECONDS : WAITER_CEILING_SECONDS;
-}
 /**
  * The wire contract's shortest reply window. A question submitted with less
  * than this is rejected outright, and accepting one would in any case let the
  * server go on taking an answer after the waiter that owns it has returned.
  */
 export const MIN_REPLY_WINDOW_SECONDS = 60;
-/**
- * HTTP budget reserved for the waiter's final reply fetch and close fence.
- * Taken from the owner deadline rather than added after it, so the hook does
- * not block past its ceiling. A near-zero remainder used to produce a
- * misleading 0s timeout and an unproven retirement.
- */
-export const FINALIZATION_NETWORK_BUDGET_SECONDS = 3;
 /**
  * The terminal-first wait: the question sits in the terminal for
  * `ask_grace_seconds` from when it was sent, and only then reaches companion
@@ -89,8 +52,9 @@ export const FINALIZATION_NETWORK_BUDGET_SECONDS = 3;
  * A plain timer, and nothing else. It once polled an idle signal so it could
  * abandon the wait the moment the user touched the keyboard — necessary while
  * the wait blocked the terminal, because a user wanting to answer locally was
- * otherwise locked out of their own prompt. Nothing is monopolised now, so
- * there is nothing to watch for and no machine this cannot run on.
+ * otherwise locked out of their own prompt. Presence no longer changes this
+ * deterministic timer; whether the harness holds or wakes is a separate route
+ * decision.
  *
  * The window is measured from registration, not from the turn's end: a
  * question the agent asked five minutes ago while it kept working has already
@@ -109,6 +73,33 @@ async function awaitTerminalFirstWindow(ctx, askedAt, ceilingAt) {
 function sessionStatePath(sessionId, env) {
     return path.join(stateDir(env), 'sessions', `${sanitizeSessionId(sessionId)}.json`);
 }
+/**
+ * Durable cancellation for observers that can outlive the harness process.
+ *
+ * Absence of session state is not enough: SessionEnd deliberately deletes it,
+ * and an in-flight submit/fence could otherwise recreate it afterwards. The
+ * marker shares the session-state lock, giving every racing writer one total
+ * order: either its state lands before SessionEnd and is cleaned up there, or
+ * it observes this marker and must not write or deliver into the ended session.
+ */
+function sessionEndMarkerPath(sessionId, env) {
+    return path.join(stateDir(env), 'sessions', `${sanitizeSessionId(sessionId)}.ended`);
+}
+function sessionHasEnded(sessionId, env) {
+    return existsSync(sessionEndMarkerPath(sessionId, env));
+}
+function markSessionEnded(sessionId, env, now) {
+    const stateFile = sessionStatePath(sessionId, env);
+    withFileLock(`${stateFile}.lock`, () => {
+        atomicWriteFileSync(sessionEndMarkerPath(sessionId, env), `${now}\n`);
+    });
+}
+function clearSessionEndMarker(sessionId, env) {
+    const stateFile = sessionStatePath(sessionId, env);
+    withFileLock(`${stateFile}.lock`, () => {
+        rmSync(sessionEndMarkerPath(sessionId, env), { force: true });
+    });
+}
 export function readSessionState(sessionId, env) {
     const file = sessionStatePath(sessionId, env);
     if (!existsSync(file))
@@ -187,13 +178,21 @@ function writeSessionStateUnlocked(file, sessionId, state) {
 function updateSessionState(sessionId, env, update) {
     const file = sessionStatePath(sessionId, env);
     return withFileLock(`${file}.lock`, () => {
-        const next = update(readSessionState(sessionId, env));
+        const current = readSessionState(sessionId, env);
+        // SessionEnd and every asynchronous writer share this lock. Once the
+        // durable marker exists, no observer may recreate state for that session.
+        if (sessionHasEnded(sessionId, env))
+            return current;
+        const next = update(current);
         writeSessionStateUnlocked(file, sessionId, next);
         return next;
     });
 }
 /** Record the current installation when an owner session starts. */
 export function recordSessionStart(sessionId, env, harness, cwd) {
+    // Harnesses may reuse a session id only by explicitly starting that session
+    // again. That lifecycle edge is the sole authority for clearing cancellation.
+    clearSessionEndMarker(sessionId, env);
     updateSessionState(sessionId, env, (current) => ({
         ...current,
         ...(harness === undefined ? {} : { harness }),
@@ -247,9 +246,10 @@ export function resetCursorStopActivation(sessionId, env) {
 /**
  * Session state a crashed harness left behind.
  *
- * `SessionEnd` removes both the marker and the session override, but a harness
- * that crashes or is killed never reaches it. At roughly a hundred sessions a
- * day that is tens of thousands of files a year, none of which anything reads.
+ * `SessionEnd` removes session state and leaves a short-lived cancellation
+ * marker; a harness that crashes or is killed never reaches it. At roughly a
+ * hundred sessions a day that is tens of thousands of files a year, none of
+ * which anything reads.
  *
  * Opportunistic rather than scheduled: hooks are the only thing that runs, so
  * a hook is where this has to live. It is rate-limited by its own stamp file
@@ -309,7 +309,7 @@ export function pruneAbandonedSessions(env, now = Date.now(), maxAgeMs = SESSION
  * known-dead PID is recoverable immediately. Only legacy/corrupt claims with
  * no trustworthy PID fall back to an age limit.
  */
-const CLAIM_TTL_MS = WAITER_CEILING_SECONDS * 1000;
+const CLAIM_TTL_MS = LEGACY_QUESTION_CLAIM_TTL_SECONDS * 1000;
 /**
  * How long a crashed claim *guard* blocks the next hook.
  *
@@ -321,16 +321,17 @@ const CLAIM_TTL_MS = WAITER_CEILING_SECONDS * 1000;
  */
 const CLAIM_GUARD_TTL_MS = 30_000;
 const heldClaims = new Map();
-export function claimQuestionPush(sessionId, env, now = Date.now(), beforeStaleReplace) {
+export function claimQuestionPush(sessionId, env, now = Date.now(), beforeStaleReplace, ownerDeadlineAt) {
     const file = claimPath(sessionId, env);
     const guard = `${file}.guard`;
     const token = randomBytes(12).toString('base64url');
+    const pendingQuestionIds = pendingList(readSessionState(sessionId, env)).map(claimQuestionIdentity);
     mkdirSync(path.dirname(file), { recursive: true });
     if (!acquireClaimGuard(guard))
         return false;
     try {
         try {
-            writeFileSync(file, `${JSON.stringify({ pid: process.pid, at: now, token })}\n`, {
+            writeFileSync(file, `${JSON.stringify({ pid: process.pid, at: now, token, pending_question_ids: pendingQuestionIds, ...(ownerDeadlineAt === undefined ? {} : { owner_deadline_at: ownerDeadlineAt }) })}\n`, {
                 mode: 0o600,
                 flag: 'wx',
             });
@@ -356,7 +357,7 @@ export function claimQuestionPush(sessionId, env, now = Date.now(), beforeStaleR
             beforeStaleReplace?.();
             rmSync(file, { force: true });
             try {
-                writeFileSync(file, `${JSON.stringify({ pid: process.pid, at: now, token })}\n`, {
+                writeFileSync(file, `${JSON.stringify({ pid: process.pid, at: now, token, pending_question_ids: pendingQuestionIds, ...(ownerDeadlineAt === undefined ? {} : { owner_deadline_at: ownerDeadlineAt }) })}\n`, {
                     mode: 0o600,
                     flag: 'wx',
                 });
@@ -372,6 +373,31 @@ export function claimQuestionPush(sessionId, env, now = Date.now(), beforeStaleR
         rmSync(guard, { force: true });
     }
 }
+function claimQuestionIdentity(entry) {
+    return entry.question_id ?? `${entry.asked_at ?? 'legacy'}\u0000${entry.question}`;
+}
+/** True only when the live owner could not have snapshotted this unpushed ask. */
+function claimHandoffState(sessionId, env) {
+    const unasked = pendingList(readSessionState(sessionId, env)).filter((entry) => entry.request_id === undefined);
+    if (unasked.length === 0)
+        return { hasNewQuestion: false };
+    try {
+        const held = JSON.parse(readFileSync(claimPath(sessionId, env), 'utf8'));
+        if (!Array.isArray(held.pending_question_ids))
+            return { hasNewQuestion: false };
+        const snapshotted = new Set(held.pending_question_ids.filter((entry) => typeof entry === 'string'));
+        return {
+            hasNewQuestion: unasked.some((entry) => !snapshotted.has(claimQuestionIdentity(entry))),
+            ...(typeof held.owner_deadline_at === 'number' &&
+                Number.isFinite(held.owner_deadline_at)
+                ? { ownerDeadlineAt: held.owner_deadline_at }
+                : {}),
+        };
+    }
+    catch {
+        return { hasNewQuestion: false };
+    }
+}
 function processIsAlive(pid) {
     try {
         process.kill(pid, 0);
@@ -605,6 +631,8 @@ function gate(ctx, verdict, reason, data = {}) {
  * still share one wall clock, long enough not to hammer the server.
  */
 const REPLY_POLL_SECONDS = 5;
+/** Avoid hot-looping while a live observer cooperatively yields its claim. */
+const CLAIM_HANDOFF_POLL_MS = 1_000;
 /**
  * Push a question and block for the answer.
  *
@@ -662,6 +690,11 @@ async function submitQuestion(ctx, intent) {
     }
     return receipt;
 }
+function canSubmitCompleteWindow(ctx, intent, fallbackWindowSeconds) {
+    const frozenWindowSeconds = intent.draft.reply?.expires_in_seconds ?? fallbackWindowSeconds;
+    return (intent.owner_deadline_at - ctx.now() >=
+        (frozenWindowSeconds + QUESTION_SUBMISSION_COMPLETION_HEADROOM_SECONDS) * 1000);
+}
 /**
  * The waiter's wait: one bounded poll across every live question at once.
  *
@@ -671,18 +704,22 @@ async function submitQuestion(ctx, intent) {
  * registered. A question whose polling is permanently rejected drops out of
  * the round rather than failing the whole wait.
  */
-async function waitForAnyReply(ctx, requestIds, timeoutSeconds) {
+async function waitForAnyReply(ctx, requestIds, timeoutSeconds, interruption) {
     const deadline = ctx.now() + timeoutSeconds * 1000;
     let degraded = false;
     let firstPoll = true;
     const permanentFailures = new Map();
     if (timeoutSeconds <= 0 || deadline <= ctx.now()) {
-        return { byRequest: new Map(), degraded: false, permanentFailures };
+        return { byRequest: new Map(), degraded: false, permanentFailures, interrupted: null };
     }
     for (;;) {
+        const beforePoll = interruption?.() ?? null;
+        if (beforePoll !== null) {
+            return { byRequest: new Map(), degraded, permanentFailures, interrupted: beforePoll };
+        }
         const remainingMs = Math.max(0, deadline - ctx.now());
         if (!firstPoll && remainingMs === 0) {
-            return { byRequest: new Map(), degraded, permanentFailures };
+            return { byRequest: new Map(), degraded, permanentFailures, interrupted: null };
         }
         firstPoll = false;
         const pollSeconds = Math.min(REPLY_POLL_SECONDS, Math.max(0, Math.ceil(remainingMs / 1000)));
@@ -713,11 +750,42 @@ async function waitForAnyReply(ctx, requestIds, timeoutSeconds) {
             if (result.replies.length > 0)
                 byRequest.set(result.requestId, result.replies);
         }
+        const afterPoll = interruption?.() ?? null;
+        // SessionEnd or terminal-side retirement wins even if an in-flight poll
+        // happened to return an answer. A newly registered question merely asks
+        // this owner to yield; an answer already observed remains authoritative.
+        if (afterPoll === 'ownership-ended') {
+            return { byRequest: new Map(), degraded, permanentFailures, interrupted: afterPoll };
+        }
         if (byRequest.size > 0 || permanentFailures.size === requestIds.length) {
-            return { byRequest, degraded, permanentFailures };
+            return { byRequest, degraded, permanentFailures, interrupted: null };
+        }
+        if (afterPoll === 'new-question') {
+            return { byRequest: new Map(), degraded, permanentFailures, interrupted: afterPoll };
         }
     }
 }
+/**
+ * Local lifecycle signal for a long-lived observer.
+ *
+ * SessionEnd and terminal-side retirement remove an owned request from pending
+ * state; the detached process must stop instead of recreating that session.
+ * A new unpushed question asks this owner to yield the session claim so the
+ * successor Stop can submit it promptly.
+ */
+function waiterInterruption(sessionId, env, requestIds) {
+    if (sessionHasEnded(sessionId, env))
+        return 'ownership-ended';
+    const pending = pendingList(readSessionState(sessionId, env));
+    const owned = new Set(requestIds);
+    // One question can be retired from the terminal while this observer owns
+    // several. That is a per-question change, not whole-session cancellation;
+    // the caller filters the changed set after each poll and keeps the rest.
+    return pending.some((entry) => entry.request_id === undefined &&
+        (entry.submission === undefined || !owned.has(entry.submission.request_id)))
+        ? 'new-question'
+        : null;
+}
 /** A non-retryable replies fault, with enough server identity to act on it. */
 function replyPollFailure(err) {
     return err instanceof ApiCallError
@@ -811,9 +879,16 @@ export function parkForRetirement(sessionId, env, pending, state) {
  * the pending record instead of silently broadening or narrowing the fanout.
  */
 function retiringQuestion(pending, state, cwd) {
-    const hasRequest = pending.request_id !== undefined;
-    const hasCollapse = pending.collapse_key !== undefined;
-    const hasDevices = pending.device_ids !== undefined && pending.device_ids.length > 0;
+    // A submit journal is written before the first network byte. SessionEnd can
+    // therefore race a request that the server accepts after local cleanup. Its
+    // reserved request id and exact fanout are already sufficient retirement
+    // identity, even though the ordinary live fields have not been promoted yet.
+    const requestId = pending.request_id ?? pending.submission?.request_id;
+    const collapseKey = pending.collapse_key ?? pending.submission?.collapse_key;
+    const deviceIds = pending.device_ids ?? pending.submission?.device_ids;
+    const hasRequest = requestId !== undefined;
+    const hasCollapse = collapseKey !== undefined;
+    const hasDevices = deviceIds !== undefined && deviceIds.length > 0;
     if (!hasRequest && !hasCollapse && !hasDevices)
         return null;
     if (!hasRequest || !hasCollapse || !hasDevices) {
@@ -821,9 +896,9 @@ function retiringQuestion(pending, state, cwd) {
     }
     const source = sourceContextAtHookEvent(pending.source, cwd);
     return {
-        request_id: pending.request_id,
-        collapse_key: pending.collapse_key,
-        device_ids: [...pending.device_ids],
+        request_id: requestId,
+        collapse_key: collapseKey,
+        device_ids: [...deviceIds],
         question: pending.question,
         ...(pending.project !== undefined ? { project: pending.project } : {}),
         ...(source !== undefined ? { source } : {}),
@@ -1269,6 +1344,32 @@ function stageAcceptedAnswers(ctx, sessionId, answered, remaining) {
 function amendAcceptedAnswers(ctx, sessionId, amend) {
     updateSessionState(sessionId, ctx.env, (current) => current.accepted === undefined ? current : { ...current, accepted: amend(current.accepted) });
 }
+/**
+ * Finish a route write that linearized before SessionEnd.
+ *
+ * Ordinary state writers stop at the ended marker. This one narrow completion
+ * is allowed through because the journal's own `delivery_committed_at` proves
+ * the irreversible write won the ordering first; without the matching finish,
+ * a later SessionStart would replay a write that already reached the harness.
+ */
+function finishCommittedDelivery(ctx, sessionId, accepted, deliveredRoute) {
+    const file = sessionStatePath(sessionId, ctx.env);
+    withFileLock(`${file}.lock`, () => {
+        const current = readSessionState(sessionId, ctx.env);
+        if (current.accepted?.recorded_at !== accepted.recorded_at ||
+            current.accepted.delivery_committed_at === undefined) {
+            return;
+        }
+        writeSessionStateUnlocked(file, sessionId, {
+            ...current,
+            accepted: {
+                ...current.accepted,
+                delivered_at: ctx.now(),
+                delivered_route: deliveredRoute,
+            },
+        });
+    });
+}
 export function clearAcknowledgementObligation(sessionId, env, requestId) {
     let cleared = false;
     updateSessionState(sessionId, env, (current) => {
@@ -1577,7 +1678,7 @@ export async function handleUserPromptSubmit(ctx, envelope) {
  * `notifai ask`. Guessing from the last assistant message was the alternative
  * and it is not worth it: a false positive here hijacks the terminal.
  */
-export async function handleStop(ctx, envelope, processDeadlineAt = ctx.now() + WAITER_CEILING_SECONDS * 1000, route = hookContinuationRoute()) {
+export async function handleStop(ctx, envelope, processDeadlineAt = ctx.now() + QUESTION_WAITER_CEILING_SECONDS * 1000, route = hookContinuationRoute()) {
     const sessionId = envelope.session_id;
     if (!sessionId) {
         gate(ctx, 'held', 'no-session', { stage: 'queued' });
@@ -1590,6 +1691,34 @@ export async function handleStop(ctx, envelope, processDeadlineAt = ctx.now() +
         processDeadlineAt,
     });
 }
+/**
+ * Acquire the per-session owner, waiting only when this Stop carries a
+ * newly registered question. The live owner sees that state on its next reply
+ * poll and yields; without this handoff the new question could sit unpushed for
+ * the older question's complete answer window.
+ */
+async function acquireQuestionOwner(ctx, sessionId, hardDeadlineAt) {
+    if (sessionHasEnded(sessionId, ctx.env))
+        return false;
+    if (claimQuestionPush(sessionId, ctx.env, Date.now(), undefined, hardDeadlineAt))
+        return true;
+    while (ctx.now() < hardDeadlineAt) {
+        const handoff = claimHandoffState(sessionId, ctx.env);
+        if (!handoff.hasNewQuestion)
+            return false;
+        const holderReleaseDeadlineAt = Math.min(hardDeadlineAt, handoff.ownerDeadlineAt === undefined
+            ? hardDeadlineAt
+            : handoff.ownerDeadlineAt + QUESTION_STOP_TEARDOWN_HEADROOM_SECONDS * 1000);
+        if (ctx.now() >= holderReleaseDeadlineAt)
+            return false;
+        await ctx.sleep(Math.min(CLAIM_HANDOFF_POLL_MS, holderReleaseDeadlineAt - ctx.now()));
+        if (sessionHasEnded(sessionId, ctx.env))
+            return false;
+        if (claimQuestionPush(sessionId, ctx.env, Date.now(), undefined, hardDeadlineAt))
+            return true;
+    }
+    return false;
+}
 /**
  * Own one registered question pipeline from its terminal-first timer through
  * its final delivery or retirement. Hosts differ only in the injected route.
@@ -1597,7 +1726,11 @@ export async function handleStop(ctx, envelope, processDeadlineAt = ctx.now() +
 export async function runEscalationWaiter(ctx, options) {
     const notes = [];
     const { sessionId, envelope } = options;
-    const hardDeadlineAt = options.processDeadlineAt ?? ctx.now() + WAITER_CEILING_SECONDS * 1000;
+    const hardDeadlineAt = options.processDeadlineAt ?? ctx.now() + QUESTION_WAITER_CEILING_SECONDS * 1000;
+    if (sessionHasEnded(sessionId, ctx.env)) {
+        notes.push('the Agent Session already ended; no answer observer was started');
+        return { notes };
+    }
     // This event marker is diagnostic evidence in its own right. Record it
     // before every early return so doctor can distinguish a working Stop route
     // from the prompt-only state that previously looked healthy.
@@ -1610,9 +1743,9 @@ export async function runEscalationWaiter(ctx, options) {
     // polling, close fencing, route delivery, and every retirement path.
     // Real clock, deliberately, not `ctx.now` — the claim answers whether
     // another process is alive right now, which an injected clock cannot know.
-    if (!claimQuestionPush(sessionId, ctx.env)) {
+    if (!(await acquireQuestionOwner(ctx, sessionId, hardDeadlineAt))) {
         gate(ctx, 'held', 'claimed-elsewhere', { stage: 'queued' });
-        notes.push('another hook is already handling this question');
+        notes.push('another hook is already handling this session; a newly registered question remains queued for the next owner');
         return { notes };
     }
     let settledAnswerThisPass = false;
@@ -1704,6 +1837,7 @@ export function hookContinuationRoute() {
         kind: 'hook-continuation',
         deliver: async (event) => ({
             stdout: stopAnswerOutput(event.context),
+            commitStdout: event.commitDelivery,
             notes: [],
             // The harness reads this stdout after the process exits, so only the
             // successor Stop can acknowledge it.
@@ -1722,6 +1856,10 @@ export function hookContinuationRoute() {
 async function deliverAcceptedAnswers(ctx, sessionId, route, accepted, notes, cwd) {
     const { answers: answered, remaining } = accepted;
     const requestIds = summarizeRequestIds(answered.map((entry) => entry.pending)).ids;
+    if (sessionHasEnded(sessionId, ctx.env)) {
+        notes.push('the Agent Session ended before answer delivery; stopping this observer');
+        return { notes };
+    }
     const held = accepted.held_deliveries ?? 0;
     if (held >= MAX_HELD_DELIVERIES) {
         gate(ctx, 'held', 'delivery-limit', {
@@ -1755,6 +1893,12 @@ async function deliverAcceptedAnswers(ctx, sessionId, route, accepted, notes, cw
         ...current,
         delivery_attempts: attempt,
     }));
+    // Linearize delivery after the journal write. If SessionEnd acquired the
+    // shared state lock in between, its durable marker wins and no wake starts.
+    if (sessionHasEnded(sessionId, ctx.env)) {
+        notes.push('the Agent Session ended before answer delivery; stopping this observer');
+        return { notes };
+    }
     ctx.log?.info('hook.gate', {
         verdict: 'proceeding',
         reason: 'answered',
@@ -1765,21 +1909,47 @@ async function deliverAcceptedAnswers(ctx, sessionId, route, accepted, notes, cw
         journal_recorded_at: accepted.recorded_at,
         delivery_attempt: attempt,
     });
-    const delivered = await route.deliver({
+    let deliveryCommitted = false;
+    const commitDelivery = () => {
+        if (deliveryCommitted)
+            return true;
+        const file = sessionStatePath(sessionId, ctx.env);
+        return withFileLock(`${file}.lock`, () => {
+            if (sessionHasEnded(sessionId, ctx.env))
+                return false;
+            const current = readSessionState(sessionId, ctx.env);
+            if (current.accepted === undefined)
+                return false;
+            deliveryCommitted = true;
+            writeSessionStateUnlocked(file, sessionId, {
+                ...current,
+                accepted: { ...current.accepted, delivery_committed_at: ctx.now() },
+            });
+            return true;
+        });
+    };
+    let delivered = await route.deliver({
         context: answersContext(answered, remaining),
         answers: answered.length,
         remaining,
         request_ids: requestIds,
         journal_recorded_at: accepted.recorded_at,
+        commitDelivery,
     });
+    if (delivered.acknowledgement === 'delivered' && !deliveryCommitted) {
+        delivered = {
+            notes: [
+                ...(delivered.notes ?? []),
+                `the ${route.kind} route reported delivery without committing against SessionEnd; preserving the answer instead of accepting an unordered write`,
+            ],
+            log: { route: route.kind, stage: 'queued', reason: 'delivery-not-committed' },
+            acknowledgement: 'held',
+        };
+    }
     const deliveredRoute = typeof delivered.log?.['route'] === 'string' ? delivered.log['route'] : route.kind;
     const deliveredStage = typeof delivered.log?.['stage'] === 'string' ? delivered.log['stage'] : 'delivered';
     if (delivered.acknowledgement === 'delivered') {
-        amendAcceptedAnswers(ctx, sessionId, (current) => ({
-            ...current,
-            delivered_at: ctx.now(),
-            delivered_route: deliveredRoute,
-        }));
+        finishCommittedDelivery(ctx, sessionId, accepted, deliveredRoute);
     }
     else if (delivered.acknowledgement === 'held') {
         // Give the delivery attempt back and count the hold instead. The attempt
@@ -1807,6 +1977,8 @@ async function deliverAcceptedAnswers(ctx, sessionId, route, accepted, notes, cw
     const outcome = { notes: [...notes, ...(delivered.notes ?? [])] };
     if (delivered.stdout !== undefined)
         outcome.stdout = delivered.stdout;
+    if (delivered.commitStdout !== undefined)
+        outcome.commitStdout = delivered.commitStdout;
     if (delivered.log !== undefined)
         outcome.log = delivered.log;
     return outcome;
@@ -1869,13 +2041,10 @@ async function handleClaimedStop(ctx, envelope, sessionId, state, pending, notes
             return deliverAcceptedAnswers(ctx, sessionId, route, accepted, notes, envelope.cwd);
         }
         const recoverableLive = live.filter((entry) => !permanentFailures.has(entry.request_id));
-        // A spent owner has already used its waiter ceiling. Passing those
-        // questions back into `escalate` starts a fresh ceiling, holds the
-        // per-session claim for another 3300s, and is why a later `ask` never
-        // reached a device after a degraded waiter (the next Stop never ran, or
-        // ran as claimed-elsewhere). Late answers still ride the short poll above
-        // and every later turn. Independent questions whose lease is still running
-        // keep their successor wait.
+        // A spent owner has already reached the end of the answer window it owned.
+        // Passing those questions back into `escalate` starts a fresh ceiling and
+        // can monopolize the per-session claim after expiry. Independent questions
+        // whose lease is still running keep their successor wait.
         const stillOwned = recoverableLive.filter((entry) => ownerLeaseActive(entry, ctx.now()));
         liveToEscalate = stillOwned;
         if (unasked.length === 0) {
@@ -1889,7 +2058,7 @@ async function handleClaimedStop(ctx, envelope, sessionId, state, pending, notes
                     request_ids: requestIdSummary.ids,
                     owner_spent: true,
                 });
-                notes.push(`${recoverableLive.length} question${recoverableLive.length === 1 ? ' is' : 's are'} still answerable; the previous waiter already used its ceiling, so a later turn will collect a late answer rather than waiting again`);
+                notes.push(`${recoverableLive.length} question${recoverableLive.length === 1 ? ' is' : 's are'} still recorded after the previous answer owner ended; a later turn will reconcile ${recoverableLive.length === 1 ? 'it' : 'them'} without starting another full-window wait`);
                 return { notes };
             }
             return await escalate(ctx, envelope, sessionId, [], stillOwned, notes, hardDeadlineAt, route);
@@ -1947,11 +2116,7 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
     // The questions still owe the user their terminal-first window before
     // anything reaches their devices — measured from the oldest registration,
     // because that is the question that has waited longest.
-    const startedAt = ctx.now();
-    const existingDeadlines = alreadyLive.flatMap((entry) => entry.reply_deadline_at === undefined || entry.reply_deadline_at <= startedAt
-        ? []
-        : [entry.reply_deadline_at]);
-    const ceilingAt = Math.min(hardDeadlineAt, ...(existingDeadlines.length === 0 ? [] : existingDeadlines));
+    const ceilingAt = hardDeadlineAt;
     if (unasked.length > 0 && alreadyLive.length === 0) {
         const oldest = Math.min(...unasked.map((entry) => entry.asked_at ?? ctx.now()));
         await awaitTerminalFirstWindow(ctx, oldest, ceilingAt);
@@ -1965,24 +2130,17 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
     // Phase one: every registered question reaches the user's devices, each as
     // its own notification — one ask never stands in for another.
     const submitted = [];
+    const admissionAnswers = [];
     for (const entry of unasked) {
-        // How long the answer is accepted, and how long this owner listens for it,
-        // are two different spans. They used to be one: the window was whatever
-        // remained of the waiter's ceiling, so a question asked at a turn's end
-        // stopped being answerable about eight minutes later, whatever the user
-        // had configured.
-        //
-        // That was right when the waiter was the only way an answer came back. It
-        // is not any more: a late answer is found by the next turn's poll or
-        // replayed from the journal, so this owner giving up listening says
-        // nothing about whether the user's answer is still wanted.
+        // The service owns how long the answer is accepted. This process begins
+        // before submission, so its larger maximum-window budget includes startup
+        // headroom and remains alive through the complete committed window.
         const replyWindowSeconds = ctx.config.reply_window_seconds.value;
-        if (ceilingAt - ctx.now() < MIN_REPLY_WINDOW_SECONDS * 1000) {
-            notes.push('too little of the waiter ceiling is left to submit and confirm this question; leaving it in the terminal');
+        if (ceilingAt - ctx.now() <
+            (replyWindowSeconds + QUESTION_SUBMISSION_COMPLETION_HEADROOM_SECONDS) * 1000) {
+            notes.push('too little owner lifetime remains for the complete configured answer window; leaving this question frozen for a successor owner');
             continue;
         }
-        // The owner still stops listening at its own ceiling. Only the span the
-        // server accepts answers into changed.
         const ownerDeadlineAt = ceilingAt;
         const questions = pendingQuestions(entry);
         const eventSource = sourceContextAtHookEvent(entry.source, envelope.cwd);
@@ -2039,12 +2197,15 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
             });
         }
         if (ctx.now() >= intent.owner_deadline_at) {
-            notes.push('the waiter ceiling ended before submission; preserving the frozen intent');
+            notes.push('the owner lifetime ended before submission; preserving the frozen intent');
+            continue;
+        }
+        if (!canSubmitCompleteWindow(ctx, intent, replyWindowSeconds)) {
+            notes.push('setup consumed the admission allowance; preserving the frozen intent instead of publishing an answer window this owner cannot observe completely');
             continue;
         }
-        const beforeSubmitSeconds = Math.floor((intent.owner_deadline_at - ctx.now()) / 1000);
-        if (beforeSubmitSeconds < MIN_REPLY_WINDOW_SECONDS) {
-            notes.push('device resolution consumed the reply window; preserving the frozen intent instead of shrinking it below what the server accepts');
+        if (sessionHasEnded(sessionId, ctx.env)) {
+            notes.push('the Agent Session ended before submission; preserving no live observer');
             continue;
         }
         let receipt;
@@ -2097,6 +2258,14 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
                         return { ...current, pending: next };
                     });
                     try {
+                        if (!canSubmitCompleteWindow(ctx, intent, replyWindowSeconds)) {
+                            notes.push('draft recovery consumed the admission allowance; preserving the frozen intent for a successor owner');
+                            continue;
+                        }
+                        if (sessionHasEnded(sessionId, ctx.env)) {
+                            notes.push('the Agent Session ended before recovered submission');
+                            continue;
+                        }
                         receipt = await submitQuestion(ctx, intent);
                         admissionConfirmed = true;
                     }
@@ -2156,17 +2325,9 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
             request_id: intent.request_id,
             collapse_key: intent.collapse_key,
             device_ids: intent.device_ids,
-            // When the server stops accepting an answer — not when this owner stops
-            // waiting for one. Those were the same number until the window became a
-            // setting, and taking the minimum silently capped every question at the
-            // waiter's ceiling: a question asked with a day-long window was swept as
-            // stale about eight minutes later and retired, so the answer given over
-            // lunch met a closed question.
-            //
-            // The reply window is how long the server accepts an answer. This
-            // process still clamps its own wait to `hardDeadlineAt`. Recording the
-            // owner lease separately is what stops the *next* Stop from treating
-            // the remaining window as a fresh waiter ceiling.
+            // The server's committed answer deadline is authoritative. The local
+            // owner deadline starts earlier and includes startup headroom, so it may
+            // be later but must never be earlier.
             reply_deadline_at: Number.isFinite(committedReplyDeadline)
                 ? committedReplyDeadline
                 : intent.owner_deadline_at,
@@ -2175,7 +2336,48 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
         if (intent.draft.source === undefined)
             delete live.source;
         delete live.submission;
-        submitted.push(live);
+        if (live.reply_deadline_at > live.owner_deadline_at) {
+            const response = await finalizeReplies(ctx, live.request_id);
+            if (response === null) {
+                // Closing was unreachable, so the question is still potentially live.
+                // Preserve it in the exact session instead of demoting it to the orphan
+                // retirement queue, whose later close has no route for an answer.
+                updateSessionState(sessionId, ctx.env, (current) => {
+                    const list = pendingList(current);
+                    const index = list.findIndex((candidate) => isSamePending(candidate, entry));
+                    if (index < 0) {
+                        // Terminal input removed this registration while the anomalous
+                        // close was in flight. Preserve retirement identity exactly as
+                        // normal submit promotion does; the observer must not become the
+                        // only remaining record of a live card.
+                        const retirement = retiringQuestion(live, 'answered_elsewhere', envelope.cwd);
+                        const retiring = [...(current.retiring ?? [])];
+                        if (!retiring.some((parked) => parked.request_id === retirement.request_id)) {
+                            retiring.push(retirement);
+                        }
+                        return { ...current, retiring };
+                    }
+                    const next = [...list];
+                    next[index] = live;
+                    return { ...current, pending: next };
+                });
+                submitted.push(live);
+                notes.push('the server committed an answer deadline beyond this process owner and immediate closure was unreachable; preserving the live question for exact-session recovery');
+                continue;
+            }
+            else if (response.replies.length > 0) {
+                admissionAnswers.push({
+                    pending: live,
+                    reply: response.replies.at(-1),
+                    replies: response.replies,
+                    agent_acknowledgement_required: response.agent_acknowledgement_required,
+                    agent_acknowledgement_text_required: response.agent_acknowledgement_text_required,
+                });
+            }
+            dropPendingQuestion(sessionId, ctx.env, entry);
+            notes.push('the server committed an answer deadline beyond this process owner; closed the anomalous window instead of abandoning it early');
+            continue;
+        }
         // Record what is now live on the user's devices BEFORE any wait. If we
         // only learned these ids afterwards, a question that timed out would
         // leave no trace, and the user returning to the terminal could never
@@ -2201,6 +2403,21 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
                 return { ...current, retiring };
             });
         }
+        if (sessionHasEnded(sessionId, ctx.env)) {
+            // SessionEnd may have raced either the submit or promotion. Its snapshot
+            // usually already queued the frozen intent; this idempotent add closes
+            // the other ordering where the request committed just after cleanup.
+            orphanRetirements(ctx.env, [retiringQuestion(live, 'expired', envelope.cwd)], ctx.now());
+            notes.push('the Agent Session ended during submission; queued the question for retirement');
+            continue;
+        }
+        submitted.push(live);
+    }
+    if (admissionAnswers.length > 0) {
+        const accepted = stageAcceptedAnswers(ctx, sessionId, admissionAnswers, pendingList(readSessionState(sessionId, ctx.env)).length);
+        for (const answer of admissionAnswers)
+            reportAnswer(ctx, notes, answer, false);
+        return deliverAcceptedAnswers(ctx, sessionId, route, accepted, notes, envelope.cwd);
     }
     const staleLive = alreadyLive.filter((entry) => entry.reply_deadline_at === undefined || entry.reply_deadline_at <= ctx.now());
     const finalizedStale = await finalizePendings(ctx, staleLive);
@@ -2231,40 +2448,48 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
     ];
     if (waitingOn.length === 0)
         return { notes };
-    // Phase two: one wait across everything live, old and new alike.
-    const ownerDeadline = Math.min(ceilingAt, Math.max(...waitingOn.map((entry) => entry.reply_deadline_at)));
-    const waitUntil = ownerDeadline - FINALIZATION_NETWORK_BUDGET_SECONDS * 1000;
-    const timeoutSeconds = Math.max(0, Math.ceil((waitUntil - ctx.now()) / 1000));
-    const waited = await waitForAnyReply(ctx, waitingOn.map((entry) => entry.request_id), timeoutSeconds);
-    const permanentFailure = permanentReplyFailureNote(waited.permanentFailures);
-    if (permanentFailure !== null)
-        notes.push(permanentFailure);
-    if (waited.byRequest.size === 0) {
-        // This owner is done listening. That used to mean the question was over:
-        // it closed the window server-side and retired the record, on the reasoning
-        // that no later answer could reach the same agent turn.
-        //
-        // The reaching was never the point — the *accepting* is. A question whose
-        // window is still open is polled again by the next prompt and the next
-        // Stop, and an answer found there is journaled and replayed. Closing here
-        // capped every question at this owner's ceiling however long a window the
-        // user had configured, which is what made a day-long window mean eight
-        // minutes.
-        //
-        // So: finalize only what the server has genuinely stopped accepting, and
-        // leave the rest live for the turn that comes next. A session that truly
-        // ends still retires its questions — that is what the session-end hook is
-        // for, and it is the honest place for it.
-        const expired = waitingOn.filter((entry) => entry.reply_deadline_at === undefined ||
-            entry.reply_deadline_at <= ownerDeadline ||
-            // A permanent rejection is the server saying this question can never be
-            // answered, whatever its window says. Leaving it open would strand a
-            // dead question on the user's devices.
-            waited.permanentFailures.has(entry.request_id));
-        const stillAnswerable = waitingOn.filter((entry) => !expired.includes(entry));
-        if (stillAnswerable.length > 0) {
-            notes.push(`${stillAnswerable.length} question${stillAnswerable.length === 1 ? ' is' : 's are'} still answerable; leaving ${stillAnswerable.length === 1 ? 'it' : 'them'} open for the next turn rather than closing ${stillAnswerable.length === 1 ? 'it' : 'them'} with this waiter`);
+    // Phase two: keep the same owner alive across every committed answer window.
+    // Different questions may expire at different times, so finalize each one at
+    // its own server deadline and continue waiting on the rest. Reserving time by
+    // closing early would make the advertised reply window untrue.
+    let activeWaiting = waitingOn;
+    let timeoutSeconds = 0;
+    let waited;
+    for (;;) {
+        const nextReplyDeadline = Math.min(...activeWaiting.map((entry) => entry.reply_deadline_at));
+        const waitDeadline = Math.min(ceilingAt, nextReplyDeadline);
+        timeoutSeconds = Math.max(0, Math.ceil((waitDeadline - ctx.now()) / 1000));
+        waited = await waitForAnyReply(ctx, activeWaiting.map((entry) => entry.request_id), timeoutSeconds, () => waiterInterruption(sessionId, ctx.env, activeWaiting.map((entry) => entry.request_id)));
+        if (waited.interrupted !== null) {
+            notes.push(waited.interrupted === 'new-question'
+                ? 'yielding the answer owner so a newly registered question can be sent now'
+                : 'answer ownership ended locally; stopping this observer without delivering into a closed session');
+            return { notes };
+        }
+        const currentRequestIds = new Set(pendingList(readSessionState(sessionId, ctx.env)).flatMap((entry) => [entry.request_id, entry.submission?.request_id].filter((requestId) => requestId !== undefined)));
+        const removedDuringPoll = activeWaiting.filter((entry) => !currentRequestIds.has(entry.request_id));
+        for (const entry of removedDuringPoll) {
+            waited.byRequest.delete(entry.request_id);
+            waited.permanentFailures.delete(entry.request_id);
         }
+        if (removedDuringPoll.length > 0) {
+            notes.push(`${removedDuringPoll.length} question${removedDuringPoll.length === 1 ? ' changed' : 's changed'} outside this observer; continuing with the independently live questions`);
+            activeWaiting = activeWaiting.filter((entry) => currentRequestIds.has(entry.request_id));
+            if (activeWaiting.length === 0)
+                return { notes };
+        }
+        const permanentFailure = permanentReplyFailureNote(waited.permanentFailures);
+        if (permanentFailure !== null)
+            notes.push(permanentFailure);
+        if (waited.byRequest.size > 0)
+            break;
+        // A permanent rejection is authoritative immediately. Time-based expiry is
+        // authoritative only when this owner reached that question's committed
+        // server deadline; reaching the process ceiling first preserves the record.
+        const expired = activeWaiting.filter((entry) => entry.reply_deadline_at === undefined ||
+            entry.reply_deadline_at <= waitDeadline ||
+            waited.permanentFailures.has(entry.request_id));
+        const stillAnswerable = activeWaiting.filter((entry) => !expired.includes(entry));
         const finalized = await finalizePendings(ctx, expired);
         const finalAnswers = finalized
             .map(finalizedAnswer)
@@ -2286,6 +2511,10 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
                 reportAnswer(ctx, notes, answer, false);
             return deliverAcceptedAnswers(ctx, sessionId, route, accepted, notes, envelope.cwd);
         }
+        if (stillAnswerable.length > 0 && waitDeadline < ceilingAt) {
+            activeWaiting = stillAnswerable;
+            continue;
+        }
         const requestIdSummary = summarizeRequestIds(waitingOn);
         ctx.log?.info('hook.answer', {
             answered: false,
@@ -2295,14 +2524,17 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
             permanent_failures: waited.permanentFailures.size,
             waited_seconds: timeoutSeconds,
         });
-        if (waited.permanentFailures.size === 0 && confirmedSilent.length > 0) {
+        if (stillAnswerable.length > 0) {
+            notes.push(`${stillAnswerable.length} question${stillAnswerable.length === 1 ? ' remains' : 's remain'} answerable after the process owner ended; preserving ${stillAnswerable.length === 1 ? 'it' : 'them'} for recovery`);
+        }
+        else if (waited.permanentFailures.size === 0 && confirmedSilent.length > 0) {
             notes.push(waited.degraded
-                ? 'could not reach the server before the owner deadline; expired questions were retired so no answer can be lost later'
+                ? 'could not reach the server before the answer deadline; expired questions were retired so no answer can be lost later'
                 : 'no answer in time; the question expired with its continuation owner');
         }
         return { notes };
     }
-    const polledAnswered = waitingOn.filter((entry) => waited.byRequest.has(entry.request_id));
+    const polledAnswered = activeWaiting.filter((entry) => waited.byRequest.has(entry.request_id));
     const finalizedAnswered = await finalizePendings(ctx, polledAnswered);
     const answered = [];
     for (const finalized of finalizedAnswered) {
@@ -2326,7 +2558,7 @@ async function escalate(ctx, envelope, sessionId, unasked, alreadyLive, notes, h
             notes.push(`could not confirm the close fence for ${entry.request_id}; delivering the durable answer already observed`);
         }
     }
-    const accepted = stageAcceptedAnswers(ctx, sessionId, answered, waitingOn.length - answered.length);
+    const accepted = stageAcceptedAnswers(ctx, sessionId, answered, Math.max(0, pendingList(readSessionState(sessionId, ctx.env)).length - answered.length));
     for (const answer of answered)
         reportAnswer(ctx, notes, answer, false);
     return deliverAcceptedAnswers(ctx, sessionId, route, accepted, notes, envelope.cwd);
@@ -2347,15 +2579,24 @@ export function handleSessionEnd(env, envelope, now = Date.now()) {
     const sessionId = envelope.session_id;
     if (!sessionId)
         return { notes, log: { outcome: 'ignored', reason: 'missing-session-id' } };
+    // Publish cancellation before reading or clearing anything. In-flight Stop
+    // writers use the same session lock, so none can recreate state after this.
+    markSessionEnded(sessionId, env, now);
     if (envelope.cwd !== undefined)
         clearMatchingProjectSession(envelope.cwd, env, sessionId);
     const state = readSessionState(sessionId, env);
     const orphans = [...(state.retiring ?? [])];
-    for (const entry of pendingList(state)) {
+    const retirementCandidates = [
+        ...pendingList(state),
+        ...(state.accepted?.answers.map((entry) => entry.pending) ?? []),
+    ];
+    for (const entry of retirementCandidates) {
         try {
             const orphan = retiringQuestion(entry, 'expired', envelope.cwd);
-            if (orphan !== null)
+            if (orphan !== null &&
+                !orphans.some((candidate) => candidate.request_id === orphan.request_id)) {
                 orphans.push(orphan);
+            }
         }
         catch (err) {
             notes.push(err instanceof Error ? err.message : String(err));