commandmate 0.46.1 → 0.47.2

package/dist/server/src/lib/push/prompt-push-gate.js

@@ -56,6 +56,43 @@
  * it resolves in seconds, and the reminder below is what catches it when it
  * does not.
  *
+ * ## "About to answer" has a deadline (Issue #3757)
+ *
+ * Nothing recorded is not proof that Auto-Yes is answering. A screen the poller
+ * cannot read at all (agy's folder-trust screen was the measured case: the
+ * poller read no prompt, so it recorded nothing) looked exactly like the
+ * common case above, and the wait was held silent until the ten-minute
+ * reminder. So the hold lasts {@link AUTO_YES_ANSWER_GRACE_MS} — time for the
+ * poller to answer or to record why it did not — and a wait still open after
+ * that notifies as `auto-yes-not-answered`. `waiting-push-notifier` asks again
+ * when the hold ends.
+ *
+ * The hold is NOT counted from `waitingSince`. That is the wait's identity,
+ * not when anyone saw it: it can be a hook's timestamp older than the probe
+ * that opened the edge, and it stays frozen across several prompts of one
+ * episode. It is counted from {@link autoYesHoldStartedAt}: the later of the
+ * moment the gate first held this episode and the poller's last answer, so a
+ * second prompt right after an answer gets a full hold of its own. Both
+ * producers ask through {@link decideAndLogPromptPush} and share that origin.
+ *
+ * ## The hold reaches the session wait's tick (Issue #3791)
+ *
+ * The 9 s assume the poller's next tick is at most a cooldown away. Its ticks
+ * are a poll interval, a cooldown or the thinking interval (5 s) apart — inside
+ * the 9 s — with two exceptions. An error backoff (up to `MAX_BACKOFF_MS`) is
+ * not waited for: a poller failing in a row is the least likely to answer, and
+ * a broken Auto-Yes is when a human most needs the notification. The session
+ * wait is: a capture that found no session puts the next tick `MAX_BACKOFF_MS`
+ * away, and a session started meanwhile (`send --auto-yes` enables Auto-Yes
+ * before the session exists) gets its first prompt answered on that tick. So
+ * when the hold begins while that tick is pending, it lasts until the tick plus
+ * two ticks (answer, or the Enter fallback's second look):
+ * {@link autoYesHoldEndsAt}. The tick is read once, and only counts while the
+ * poller that scheduled it is still the one running — a poller stopped or
+ * replaced meanwhile will not tick. Issue #3796: the session's creation brings
+ * that tick forward to a poll interval, and the hold follows it — the tick is
+ * only ever read earlier than it was when the hold began.
+ *
  * ## The reminder is never muted
  *
  * `runEscalationTick` has already established that the wait is still open — it
@@ -71,12 +108,141 @@
  * @module lib/push/prompt-push-gate
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTO_YES_HOLD_MAX_AGE_MS = exports.AUTO_YES_ANSWER_AFTER_TICK_MS = exports.AUTO_YES_ANSWER_GRACE_MS = void 0;
+exports.autoYesHoldStartedAt = autoYesHoldStartedAt;
+exports.autoYesHoldEndsAt = autoYesHoldEndsAt;
+exports.forgetAutoYesHold = forgetAutoYesHold;
+exports.clearAutoYesHolds = clearAutoYesHolds;
 exports.decidePromptPush = decidePromptPush;
 exports.isPromptPushSuppressed = isPromptPushSuppressed;
+exports.decideAndLogPromptPush = decideAndLogPromptPush;
 const auto_yes_state_1 = require("../../lib/auto-yes-state");
 const logger_1 = require("../../lib/logger");
 const auto_yes_suppression_state_1 = require("../../lib/polling/auto-yes-suppression-state");
+const global_state_1 = require("../../lib/global-state");
 const logger = (0, logger_1.createLogger)('push/prompt-gate');
+/**
+ * How long a wait with nothing recorded about it is held as "Auto-Yes is
+ * answering" (Issue #3757), from {@link autoYesHoldStartedAt}. The poller
+ * answers a prompt it can read on the tick that sees it and records a reason
+ * on the same tick when it will not, but that tick can be a cooldown away
+ * (`COOLDOWN_INTERVAL_MS` after an answer, as long while thinking), and the
+ * Enter fallback needs one more tick: a cooldown plus two ticks, 9 s.
+ */
+exports.AUTO_YES_ANSWER_GRACE_MS = Math.max(3 * auto_yes_state_1.POLLING_INTERVAL_MS, auto_yes_state_1.COOLDOWN_INTERVAL_MS + 2 * auto_yes_state_1.POLLING_INTERVAL_MS);
+/** compositeKey -> the hold of that session's current episode. globalThis per #1736. */
+const autoYesHolds = (0, global_state_1.getOrInitGlobal)('__promptPushAutoYesHolds', () => new Map());
+/**
+ * Where this wait's `auto-yes-answering` hold is counted from (Issue #3757):
+ * the later of the moment the gate first held this episode (recorded here on
+ * the first call) and the Auto-Yes poller's last answer to this session.
+ *
+ * The poller's answer is read off its state on `globalThis`
+ * (`__autoYesPollerStates`, `lastServerResponseTimestamp`) rather than through
+ * `auto-yes-poller`, which imports `response-checker`, which imports this gate.
+ *
+ * @param now - Epoch ms of the decision; recorded as the start of a new hold
+ */
+function autoYesHoldStartedAt(input, now) {
+    const key = (0, auto_yes_state_1.buildCompositeKey)(input.worktreeId, input.cliToolId, input.instanceId);
+    sweepStaleAutoYesHolds(now);
+    let hold = autoYesHolds.get(key);
+    if (hold === undefined || hold.since !== input.waitingSince) {
+        hold = { since: input.waitingSince, firstHeldAt: now, sessionWaitTick: pendingSessionWaitTick(key, now) };
+        autoYesHolds.set(key, hold);
+    }
+    // Issue #3770: Auto-Yes switched off and on again inside one episode starts a
+    // fresh hold; the old origin would read the poller's silence while it was off
+    // as "did not answer".
+    const enabledAt = (0, auto_yes_state_1.getAutoYesState)(input.worktreeId, input.cliToolId, input.instanceId)?.enabledAt;
+    if (enabledAt !== undefined && enabledAt > hold.firstHeldAt && enabledAt <= now)
+        hold.firstHeldAt = enabledAt;
+    const lastAnswer = globalThis.__autoYesPollerStates?.get(key)?.lastServerResponseTimestamp ?? null;
+    return lastAnswer !== null ? Math.max(hold.firstHeldAt, lastAnswer) : hold.firstHeldAt;
+}
+/**
+ * How long after the poller's tick the hold still lasts (Issue #3791): that
+ * tick answers, or records why not, and the Enter fallback answers on the tick
+ * after it — the "two ticks" of {@link AUTO_YES_ANSWER_GRACE_MS}.
+ */
+exports.AUTO_YES_ANSWER_AFTER_TICK_MS = 2 * auto_yes_state_1.POLLING_INTERVAL_MS;
+/**
+ * The Auto-Yes poller's pending session-wait tick (Issue #3791), read off its
+ * state on `globalThis` for the same reason as `lastServerResponseTimestamp`.
+ * Only a tick due after `now`, and no further than the session wait puts it.
+ */
+function pendingSessionWaitTick(key, now) {
+    const poller = globalThis.__autoYesPollerStates?.get(key);
+    const at = poller?.sessionWaitTickAt;
+    if (poller === undefined || at === undefined || at <= now)
+        return undefined;
+    return { at: Math.min(at, now + auto_yes_state_1.MAX_BACKOFF_MS), poller, heldAt: now };
+}
+/**
+ * Issue #3796: when the session wait's tick the hold counts on actually comes.
+ * The tick read when the hold began, brought forward when the poller ticked
+ * early — its session was created, and it rescheduled the tick a poll interval
+ * away (`sessionWaitTickAt`), or already ran it (`sessionWaitTickRanAt`,
+ * `sessionAppearedAt`) — only times since the hold began count. Only
+ * ever earlier: a session wait scheduled after the hold began does not extend
+ * it (#3791).
+ */
+function effectiveSessionWaitTickAt(tick) {
+    let at = tick.at;
+    for (const t of [tick.poller.sessionWaitTickAt, tick.poller.sessionWaitTickRanAt, tick.poller.sessionAppearedAt]) {
+        if (t !== undefined && t >= tick.heldAt && t < at)
+            at = t;
+    }
+    return at;
+}
+/**
+ * When this wait's `auto-yes-answering` hold ends (Issue #3791): a full
+ * {@link AUTO_YES_ANSWER_GRACE_MS} after {@link autoYesHoldStartedAt}, and not
+ * before {@link AUTO_YES_ANSWER_AFTER_TICK_MS} past the session wait's tick
+ * pending when the hold began — while the poller that scheduled it still runs.
+ *
+ * @param now - Epoch ms of the decision; recorded as the start of a new hold
+ */
+function autoYesHoldEndsAt(input, now) {
+    const startedAt = autoYesHoldStartedAt(input, now);
+    const key = (0, auto_yes_state_1.buildCompositeKey)(input.worktreeId, input.cliToolId, input.instanceId);
+    const tick = autoYesHolds.get(key)?.sessionWaitTick;
+    const graceEndsAt = startedAt + exports.AUTO_YES_ANSWER_GRACE_MS;
+    // A poller stopped or replaced since (disable, off → on) will not tick.
+    if (tick === undefined || globalThis.__autoYesPollerStates?.get(key) !== tick.poller)
+        return graceEndsAt;
+    // Kept on the hold: an earlier tick once adopted is not lost when the poller
+    // later reschedules (an ordinary tick after a failed capture, a new session
+    // wait) — the hold never moves back out.
+    tick.at = effectiveSessionWaitTickAt(tick);
+    return Math.max(graceEndsAt, tick.at + exports.AUTO_YES_ANSWER_AFTER_TICK_MS);
+}
+/** A hold older than this is dropped (Issue #3770): its episode is long over. */
+exports.AUTO_YES_HOLD_MAX_AGE_MS = 60 * 60 * 1000;
+function sweepStaleAutoYesHolds(now) {
+    for (const [key, hold] of autoYesHolds) {
+        if (now - hold.firstHeldAt >= exports.AUTO_YES_HOLD_MAX_AGE_MS)
+            autoYesHolds.delete(key);
+    }
+}
+/**
+ * Drop the hold of one session (Issue #3770): Auto-Yes went off, or the
+ * episode closed.
+ *
+ * @param since - Issue #3776: drop it only when it is this episode's hold. A
+ *   caller retiring one episode must not take the next episode's origin with it
+ *   (that hold would start over, and its notification come up to a hold late).
+ *   Omitted, the session's hold goes whatever its episode.
+ */
+function forgetAutoYesHold(key, since) {
+    if (since !== undefined && autoYesHolds.get(key)?.since !== since)
+        return;
+    autoYesHolds.delete(key);
+}
+/** Forget every hold. Test seam. */
+function clearAutoYesHolds() {
+    autoYesHolds.clear();
+}
 /**
  * Decide whether this prompt notification is worth a human's attention.
  *
@@ -97,6 +263,10 @@ function decidePromptPush(input) {
     if (input.escalated === true) {
         return { suppress: false, reason: 'escalation-reminder' };
     }
+    const holdEndsAt = input.holdEndsAt ?? (input.holdStartedAt !== undefined ? input.holdStartedAt + exports.AUTO_YES_ANSWER_GRACE_MS : undefined);
+    if (holdEndsAt !== undefined && (input.now ?? Date.now()) >= holdEndsAt) {
+        return { suppress: false, reason: 'auto-yes-not-answered' };
+    }
     return { suppress: true, reason: 'auto-yes-answering' };
 }
 /**
@@ -111,7 +281,23 @@ function decidePromptPush(input) {
  * so the line is only there for the "why did this one ring?" question.
  */
 function isPromptPushSuppressed(input) {
-    const decision = decidePromptPush(input);
+    return decideAndLogPromptPush(input).suppress;
+}
+/**
+ * {@link isPromptPushSuppressed}, with the whole decision handed back — for the
+ * caller that has to ask again when an `auto-yes-answering` hold ends
+ * (`waiting-push-notifier`, Issue #3757).
+ */
+function decideAndLogPromptPush(input, options = {}) {
+    let decision = decidePromptPush(input);
+    if (decision.reason === 'auto-yes-inactive') {
+        forgetAutoYesHold((0, auto_yes_state_1.buildCompositeKey)(input.worktreeId, input.cliToolId, input.instanceId));
+    }
+    // Issue #3757: only a wait that reached the hold gets an origin recorded.
+    if (decision.reason === 'auto-yes-answering' && input.holdStartedAt === undefined && input.holdEndsAt === undefined) {
+        const now = input.now ?? Date.now();
+        decision = decidePromptPush({ ...input, now, holdEndsAt: autoYesHoldEndsAt(input, now) });
+    }
     const context = {
         worktreeId: input.worktreeId,
         cliToolId: input.cliToolId,
@@ -122,9 +308,15 @@ function isPromptPushSuppressed(input) {
         ...(decision.stopReason !== undefined ? { stopReason: decision.stopReason } : {}),
         ...(decision.suppressedBy !== undefined ? { suppressedBy: decision.suppressedBy } : {}),
     };
-    if (decision.suppress)
+    // A re-ask at the end of a hold (Issue #3757) that holds again was already
+    // logged when the hold began.
+    if (decision.suppress && options.recheck === true)
+        logger.debug('prompt-push-suppressed', context);
+    else if (decision.suppress)
         logger.info('prompt-push-suppressed', context);
+    else if (decision.reason === 'auto-yes-not-answered')
+        logger.info('prompt-push-allowed', context);
     else
         logger.debug('prompt-push-allowed', context);
-    return decision.suppress;
+    return decision;
 }

package/dist/server/src/lib/push/waiting-push-notifier.js

@@ -103,6 +103,12 @@ exports.CLASSIFICATION_GRACE_MS = 8_000;
 const pending = (0, global_state_1.getOrInitGlobal)('__waitingPushPending', () => new Map());
 /** Composite key -> the timer holding that wait's first notification (#2156). */
 const graceTimers = (0, global_state_1.getOrInitGlobal)('__waitingPushGraceTimers', () => new Map());
+/**
+ * Composite key -> the timer that asks the gate again when its
+ * `auto-yes-answering` hold ends (Issue #3757). Apart from {@link graceTimers}:
+ * that one is the classification hold of #2156, this one the Auto-Yes hold.
+ */
+const answerGraceTimers = (0, global_state_1.getOrInitGlobal)('__waitingPushAnswerGraceTimers', () => new Map());
 /**
  * The worktree's display name, for the notification title.
  *
@@ -160,10 +166,15 @@ function isUnnamedWait(kind) {
 /** Drop the hold on this wait without sending anything. */
 function cancelGrace(key) {
     const timer = graceTimers.get(key);
-    if (timer === undefined)
-        return;
-    clearTimeout(timer);
-    graceTimers.delete(key);
+    if (timer !== undefined) {
+        clearTimeout(timer);
+        graceTimers.delete(key);
+    }
+    const answerTimer = answerGraceTimers.get(key);
+    if (answerTimer !== undefined) {
+        clearTimeout(answerTimer);
+        answerGraceTimers.delete(key);
+    }
 }
 /**
  * The Auto-Yes gate, then the fan-out.
@@ -172,17 +183,70 @@ function cancelGrace(key) {
  * moment it decides to send, so a notification dropped after the fan-out began
  * would still consume the episode's one slot — see `prompt-push-gate`.
  */
-function gateAndSend(wait, now) {
-    if ((0, prompt_push_gate_1.isPromptPushSuppressed)({
+function gateAndSend(wait, now, recheck = false) {
+    const decision = (0, prompt_push_gate_1.decideAndLogPromptPush)({
         worktreeId: wait.worktreeId,
         cliToolId: wait.cliToolId,
         instanceId: wait.instanceId,
         waitingSince: wait.since,
-    })) {
+        now,
+    }, { recheck });
+    if (decision.suppress) {
+        // Issue #3757: "Auto-Yes is answering" is a hold, not a verdict. Ask again
+        // when it ends; a wait Auto-Yes did answer is gone from the episode store
+        // by then and nothing is sent.
+        if (decision.reason === 'auto-yes-answering')
+            holdForAutoYesAnswer(wait, now);
         return;
     }
     void sendWaitingPush(wait, false, now);
 }
+/**
+ * Re-ask the gate for this wait when its `auto-yes-answering` hold ends
+ * (Issue #3757). The edge fires once, so without this a wait Auto-Yes never
+ * answered — a screen the poller cannot read and records nothing about — stayed
+ * silent until the escalation reminder, ten minutes later.
+ */
+function holdForAutoYesAnswer(wait, now) {
+    const key = (0, auto_yes_state_1.buildCompositeKey)(wait.worktreeId, wait.cliToolId, wait.instanceId);
+    const existing = answerGraceTimers.get(key);
+    if (existing !== undefined)
+        clearTimeout(existing);
+    // From the gate's own origin, not `since` (Issue #3757 review), and past the
+    // poller's session-wait tick (Issue #3791). Capped at the grace, so a clock
+    // that went backwards cannot arm an overflowing timer, and a longer hold is
+    // asked about again every grace: a poller stopped meanwhile ends it then
+    // rather than at a tick that will not come.
+    const holdEndsAt = (0, prompt_push_gate_1.autoYesHoldEndsAt)({ worktreeId: wait.worktreeId, cliToolId: wait.cliToolId, instanceId: wait.instanceId, waitingSince: wait.since }, now);
+    const delay = Math.min(prompt_push_gate_1.AUTO_YES_ANSWER_GRACE_MS, Math.max(0, holdEndsAt - now));
+    const timer = setTimeout(() => {
+        answerGraceTimers.delete(key);
+        releaseAutoYesHold(key, wait.since);
+    }, delay);
+    // Never hold the process open for it, as with the other timers here.
+    timer.unref?.();
+    answerGraceTimers.set(key, timer);
+}
+/**
+ * The Auto-Yes hold ended: notify unless the wait is over or is another one
+ * (Issue #3757). Read from the episode store, as {@link releaseHeldWait} does.
+ */
+function releaseAutoYesHold(key, since) {
+    const held = pending.get(key);
+    if (held === undefined || held.since !== since)
+        return;
+    const episode = (0, waiting_episode_state_1.getWaitingEpisode)(held.worktreeId, held.cliToolId, held.instanceId);
+    if (episode === null || episode.since !== held.since) {
+        pending.delete(key);
+        // Issue #3776: this episode's hold only — the next one may hold already.
+        (0, prompt_push_gate_1.forgetAutoYesHold)(key, held.since);
+        stopEscalationTimerIfIdle();
+        return;
+    }
+    const settled = { ...held, kind: episode.kind };
+    pending.set(key, settled);
+    gateAndSend(settled, Date.now(), true);
+}
 /**
  * The grace elapsed: send the held wait with whatever it is called *now*
  * (Issue #2156).
@@ -380,6 +444,9 @@ function stopWaitingPushNotifier() {
     for (const timer of graceTimers.values())
         clearTimeout(timer);
     graceTimers.clear();
+    for (const timer of answerGraceTimers.values())
+        clearTimeout(timer);
+    answerGraceTimers.clear();
     pending.clear();
     stopEscalationTimerIfIdle();
 }

package/dist/server/src/lib/relay/relay-delivery-claims.js

@@ -0,0 +1,46 @@
+"use strict";
+/**
+ * Relays whose payload is being typed into the requester's composer right now
+ * (Issue #3732).
+ *
+ * A claim is taken by `relay-delivery` immediately before `sendUserMessage`, in
+ * the same synchronous stretch that re-read the row and found it still open, and
+ * released once the attempt is over (delivered, held or failed). While it is
+ * held, `withdrawRelay` answers `delivering` instead of cancelling: a cancel
+ * that reported success would be a lie once the send is already under way, and
+ * the send cannot be taken back.
+ *
+ * A module of its own, rather than an export of `relay-delivery`, so that
+ * `relay-service` (and the cancel route behind it) can consult it without
+ * importing the send path.
+ *
+ * On `globalThis` for the reason the in-flight set is (#1736): the poller's and
+ * the API's bundles must see the same set under `next dev`. Being in memory is
+ * enough — a claim only lives for the duration of one send in this process, so
+ * there is nothing to migrate and nothing to recover after a restart.
+ *
+ * @module lib/relay/relay-delivery-claims
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.claimRelayDelivery = claimRelayDelivery;
+exports.releaseRelayDelivery = releaseRelayDelivery;
+exports.isRelayDeliveryClaimed = isRelayDeliveryClaimed;
+exports.resetRelayDeliveryClaims = resetRelayDeliveryClaims;
+const global_state_1 = require("../global-state");
+const claims = (0, global_state_1.getOrInitGlobal)('__relayDeliveryClaims', () => new Set());
+/** Mark a relay as being delivered. */
+function claimRelayDelivery(relayId) {
+    claims.add(relayId);
+}
+/** The attempt is over, whatever its outcome. */
+function releaseRelayDelivery(relayId) {
+    claims.delete(relayId);
+}
+/** Whether a send for this relay is under way right now. */
+function isRelayDeliveryClaimed(relayId) {
+    return claims.has(relayId);
+}
+/** Forget every claim. Test seam. */
+function resetRelayDeliveryClaims() {
+    claims.clear();
+}

package/dist/server/src/lib/relay/relay-delivery.js

@@ -57,6 +57,8 @@ const relay_policy_1 = require("../../lib/relay/relay-policy");
 const relay_readiness_1 = require("../../lib/relay/relay-readiness");
 const relay_session_ref_1 = require("../../lib/relay/relay-session-ref");
 const relay_system_line_1 = require("../../lib/relay/relay-system-line");
+const relay_delivery_claims_1 = require("../../lib/relay/relay-delivery-claims");
+const types_1 = require("../../lib/relay/types");
 const logger_1 = require("../../lib/logger");
 const global_state_1 = require("../global-state");
 const logger = (0, logger_1.createLogger)('relay-delivery');
@@ -158,6 +160,7 @@ const inFlight = (0, global_state_1.getOrInitGlobal)('__relayDeliveryInFlight',
 /** Forget every in-flight delivery. Test seam. */
 function resetRelayDeliveryState() {
     inFlight.clear();
+    (0, relay_delivery_claims_1.resetRelayDeliveryClaims)();
     globalThis.__relayPumpRunning = false;
 }
 function senderLabel(db, relay) {
@@ -431,6 +434,13 @@ function notifyRelayPromptWaiting(worker) {
 function sweepExpiredRelays(db, now = Date.now()) {
     let expired = 0;
     for (const relay of (0, relay_db_1.listExpiredOpenRelays)(db, now)) {
+        // A send already under way for this relay cannot be taken back (#3732).
+        // Expiring it now would leave A with both the reply and the expiry notice,
+        // and the delivery's own cleanup would then wipe that notice. The next
+        // sweep finds it closed (delivered) or, if the send was refused, still
+        // open and expires it then.
+        if ((0, relay_delivery_claims_1.isRelayDeliveryClaimed)(relay.id))
+            continue;
         try {
             const locale = (0, model_change_push_notifier_1.resolveReadersLocale)(db);
             // A payload that never went out is superseded by the expiry notice: A
@@ -465,47 +475,83 @@ function sweepExpiredRelays(db, now = Date.now()) {
  * repeat delivery is prevented by the in-flight set within a process and by
  * `markRelayDelivered`'s guarded update across one, which is the idempotency the
  * Issue asks for by name.
+ *
+ * `kind` and `body` are what the pump's listing saw, and that listing is stale
+ * by the time the readiness check returns (#3732): an earlier relay's send, or
+ * this one's own capture, may have let a cancel or an expiry sweep run. So the
+ * row is read again AFTER the last await before the send, and the send goes
+ * ahead only when it still carries the same payload — and, for anything but an
+ * expiry notice, is still open. The claim is taken in that same synchronous
+ * stretch, so no cancel can slip in between the check and the send; from then
+ * on `withdrawRelay` answers `delivering`.
  */
 async function deliverOne(db, relayId, kind, body) {
-    const relay = (0, relay_db_1.getRelayById)(db, relayId);
-    if (!relay)
+    const listed = (0, relay_db_1.getRelayById)(db, relayId);
+    if (!listed)
         return 'skipped';
-    const requester = (0, relay_session_ref_1.resolveRelaySession)(db, relay.from);
-    const hold = await (0, relay_readiness_1.findRelayHoldReason)(requester.worktreeId, requester.cliToolId, requester.instanceId, db);
+    const listedRequester = (0, relay_session_ref_1.resolveRelaySession)(db, listed.from);
+    const hold = await (0, relay_readiness_1.findRelayHoldReason)(listedRequester.worktreeId, listedRequester.cliToolId, listedRequester.instanceId, db);
     if (hold) {
         logger.debug('relay-delivery-held', { relayId, kind, reason: hold });
         return 'held';
     }
-    const result = await (0, send_user_message_1.sendUserMessage)(db, {
-        worktreeId: requester.worktreeId,
-        content: body,
-        cliToolId: requester.cliToolId,
-        instanceId: requester.instanceId,
-        messageType: 'relay',
-        // The pointer back at the ledger. Also `session_relays.sent_request_id` for
-        // a reply, which carries a UNIQUE index — so a second delivery of the same
-        // relay cannot be recorded even if one were somehow attempted.
-        requestId: kind === 'reply' ? (0, chat_db_1.relayRequestId)(relay.id) : undefined,
-    });
-    if (!result.ok) {
-        logger.info('relay-delivery-refused', { relayId, kind, stage: result.stage });
-        return result.stage === 'prompt_waiting' ? 'held' : 'failed';
+    // Synchronous from here to the send: re-read, then claim.
+    const current = findCurrentPayload(db, relayId);
+    if (!current || current.kind !== kind || current.body !== body) {
+        logger.info('relay-delivery-superseded', { relayId, kind });
+        return 'skipped';
+    }
+    // An expiry notice is delivered from a CLOSED relay by design; everything
+    // else is only owed while the relay is open.
+    if (kind !== 'expired' && !(0, types_1.isOpenRelayState)(current.relay.state)) {
+        logger.info('relay-delivery-closed', { relayId, kind, state: current.relay.state });
+        return 'skipped';
     }
-    const now = Date.now();
-    if (kind === 'reply') {
-        if (!(0, relay_db_1.markRelayDelivered)(db, relay.id, (0, chat_db_1.relayRequestId)(relay.id), now)) {
-            // Somebody closed it underneath us. The message is already in A's
-            // composer, which is the outcome that mattered.
-            logger.info('relay-already-closed-on-deliver', { relayId });
+    const relay = current.relay;
+    const requester = (0, relay_session_ref_1.resolveRelaySession)(db, relay.from);
+    (0, relay_delivery_claims_1.claimRelayDelivery)(relayId);
+    try {
+        const result = await (0, send_user_message_1.sendUserMessage)(db, {
+            worktreeId: requester.worktreeId,
+            content: body,
+            cliToolId: requester.cliToolId,
+            instanceId: requester.instanceId,
+            messageType: 'relay',
+            // The pointer back at the ledger. Also `session_relays.sent_request_id` for
+            // a reply, which carries a UNIQUE index — so a second delivery of the same
+            // relay cannot be recorded even if one were somehow attempted.
+            requestId: kind === 'reply' ? (0, chat_db_1.relayRequestId)(relay.id) : undefined,
+        });
+        if (!result.ok) {
+            logger.info('relay-delivery-refused', { relayId, kind, stage: result.stage });
+            return result.stage === 'prompt_waiting' ? 'held' : 'failed';
+        }
+        const now = Date.now();
+        if (kind === 'reply') {
+            if (!(0, relay_db_1.markRelayDelivered)(db, relay.id, (0, chat_db_1.relayRequestId)(relay.id), now)) {
+                // Somebody closed it underneath us. The message is already in A's
+                // composer, which is the outcome that mattered.
+                logger.info('relay-already-closed-on-deliver', { relayId });
+            }
+            (0, relay_system_line_1.writeRelaySystemLine)(db, relay.id, 'replied', requester, (0, relay_session_ref_1.resolveRelaySession)(db, relay.to), now);
         }
-        (0, relay_system_line_1.writeRelaySystemLine)(db, relay.id, 'replied', requester, (0, relay_session_ref_1.resolveRelaySession)(db, relay.to), now);
+        else if (kind === 'prompt') {
+            (0, relay_system_line_1.writeRelaySystemLine)(db, relay.id, 'waiting', requester, (0, relay_session_ref_1.resolveRelaySession)(db, relay.to), now);
+        }
+        (0, relay_db_1.clearRelayPending)(db, relay.id, now);
+        logger.info('relay-delivered', { relayId, kind, to: `${requester.worktreeId}/${requester.instanceId}` });
+        return 'delivered';
     }
-    else if (kind === 'prompt') {
-        (0, relay_system_line_1.writeRelaySystemLine)(db, relay.id, 'waiting', requester, (0, relay_session_ref_1.resolveRelaySession)(db, relay.to), now);
+    finally {
+        // Delivered: a reply is closed now and a prompt notice leaves the relay
+        // open on purpose, so either way a later cancel must be judged by the row.
+        // Held or failed: nothing reached A, so the relay can be withdrawn again.
+        (0, relay_delivery_claims_1.releaseRelayDelivery)(relayId);
     }
-    (0, relay_db_1.clearRelayPending)(db, relay.id, now);
-    logger.info('relay-delivered', { relayId, kind, to: `${requester.worktreeId}/${requester.instanceId}` });
-    return 'delivered';
+}
+/** The payload this relay carries right now, read straight from the ledger. */
+function findCurrentPayload(db, relayId) {
+    return (0, relay_db_1.listRelaysWithPendingPayload)(db).find((item) => item.relay.id === relayId) ?? null;
 }
 /**
  * Deliver every stashed payload that can be delivered now.

package/dist/server/src/lib/schedule-manager.js

@@ -209,6 +209,8 @@ function getManagerState() {
         initialized: false,
         isSyncing: false,
         cmateFileCache: new Map(),
+        generation: 0,
+        worktreeStopCounts: new Map(),
     }));
 }
 // =============================================================================
@@ -251,6 +253,10 @@ async function syncSchedules() {
         return;
     manager.isSyncing = true;
     try {
+        // Issue #3735: remember what had been stopped when this pass began, so that
+        // a stop landing during the readCmateFile() await is noticed afterwards.
+        const startGeneration = manager.generation ?? 0;
+        const startStopCounts = new Map(manager.worktreeStopCounts);
         const worktrees = (0, cron_parser_1.getAllWorktrees)();
         // Track which scheduleIds are still valid
         const activeScheduleIds = new Set();
@@ -300,7 +306,26 @@ async function syncSchedules() {
                     continue;
                 const entries = (0, cmate_parser_1.parseSchedulesSection)(scheduleRows);
                 // Issue #409: Batch upsert all entries for this worktree
+                // (Issue #3735: deliberately not gated — a row for a stopped worktree is
+                // fixed by the FK CASCADE or the next sync's disableStaleSchedules())
                 const scheduleIds = (0, cron_parser_1.batchUpsertSchedules)(worktree.id, entries);
+                // Issue #3735: no await below, so this synchronous check covers every
+                // cron created, replaced or recovered for this worktree.
+                if ((manager.generation ?? 0) !== startGeneration) {
+                    // stopAllSchedules() ran. Abandon the pass entirely: the stale-removal
+                    // step below would otherwise judge schedules of a restarted manager
+                    // against this pass's partial activeScheduleIds.
+                    manager.cmateFileCache.delete(worktree.path);
+                    logger.info('sync:aborted-by-stop-all', { worktreeId: worktree.id });
+                    return;
+                }
+                if ((manager.worktreeStopCounts?.get(worktree.id) ?? 0) !== (startStopCounts.get(worktree.id) ?? 0)) {
+                    // The mtime cache was set before the await; drop it so a worktree
+                    // that still exists is picked up by the next pass.
+                    manager.cmateFileCache.delete(worktree.path);
+                    logger.info('sync:skipped-stopped-worktree', { worktreeId: worktree.id });
+                    continue;
+                }
                 for (let i = 0; i < entries.length; i++) {
                     const entry = entries[i];
                     const scheduleId = scheduleIds[i];
@@ -472,6 +497,7 @@ function stopAllSchedules() {
         }
     }
     manager.schedules.clear();
+    manager.generation = (manager.generation ?? 0) + 1;
     // DR1-008: Clear mtime cache to prevent stale values from causing
     // incorrect skip decisions on next initScheduleManager() call
     manager.cmateFileCache.clear();
@@ -504,6 +530,8 @@ function stopAllSchedules() {
  */
 function stopScheduleForWorktree(worktreeId) {
     const manager = getManagerState();
+    const stopCounts = (manager.worktreeStopCounts ??= new Map());
+    stopCounts.set(worktreeId, (stopCounts.get(worktreeId) ?? 0) + 1);
     // Stop and remove cron jobs for the target worktree
     for (const [scheduleId, state] of manager.schedules) {
         if (state.worktreeId === worktreeId) {