commandmate 0.47.2 → 0.48.0

package/dist/server/src/lib/push/prompt-card-state.js

@@ -88,12 +88,27 @@
  * this module's; it is written up as a remaining limitation in §6.2 of the
  * design note and pinned by `tests/unit/push/restart-card-state-2057.test.ts`.
  *
+ * ## Which episode the card is about (Issue #3798)
+ *
+ * The mark also keeps the id of the waiting episode the card was last sent
+ * for, so the resolution can name it (`resolvedEpisodeId`) and the Service
+ * Worker can leave a newer episode's card alone. The id lives in a second row,
+ * {@link PROMPT_CARD_EPISODE_KEY_PREFIX}`<worktreeId>`, written in the same
+ * statement as the time row — one write, so a reader never sees a new time
+ * with an old id — and its value repeats the time (`<at>:<episodeId>`): an id
+ * whose time is not the time row's is not this card's and reads as none. The
+ * time row's value stays the bare timestamp it was before #3798, so a mark
+ * written by an older server (time row only) reads as a card with no id, and
+ * an older server reading a newer mark sees exactly what it wrote.
+ *
  * @module lib/push/prompt-card-state
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PROMPT_CARD_MAX_AGE_MS = exports.PROMPT_CARD_KEY_PREFIX = void 0;
+exports.PROMPT_CARD_MAX_AGE_MS = exports.PROMPT_ORDER_KEY_PREFIX = exports.PROMPT_CARD_EPISODE_KEY_PREFIX = exports.PROMPT_CARD_KEY_PREFIX = void 0;
 exports.markPromptCardShown = markPromptCardShown;
+exports.nextPromptOrder = nextPromptOrder;
 exports.hasPromptCard = hasPromptCard;
+exports.getPromptCardEpisodeId = getPromptCardEpisodeId;
 exports.clearPromptCard = clearPromptCard;
 exports.clearAllPromptCards = clearAllPromptCards;
 exports.forgetPromptCardMemory = forgetPromptCardMemory;
@@ -111,6 +126,20 @@ const logger = (0, logger_1.createLogger)('push/prompt-card-state');
  * spell another id's key.
  */
 exports.PROMPT_CARD_KEY_PREFIX = 'push_prompt_card:';
+/**
+ * `app_settings.key` prefix for the episode id beside one worktree's card mark
+ * (Issue #3798). Not matched by `${PROMPT_CARD_KEY_PREFIX}*`: the character
+ * after `push_prompt_card` is `_` here and `:` there.
+ */
+exports.PROMPT_CARD_EPISODE_KEY_PREFIX = 'push_prompt_card_episode:';
+/**
+ * `app_settings.key` prefix for one worktree's prompt push order (Issue #3798):
+ * a counter that moves once per episode-named waiting card and once per
+ * resolution that names its episode, so the Service Worker can tell a card
+ * sent after a resolution was decided from one sent before it. Not a card row:
+ * no card GLOB matches it and nothing clears it, so the order never goes back.
+ */
+exports.PROMPT_ORDER_KEY_PREFIX = 'push_prompt_order:';
 /**
  * How long a persisted mark is believed.
  *
@@ -144,25 +173,51 @@ exports.PROMPT_CARD_KEY_PREFIX = 'push_prompt_card:';
 exports.PROMPT_CARD_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 /** worktreeId -> epoch ms the most recent prompt card was fanned out. */
 const cards = (0, global_state_1.getOrInitGlobal)('__promptPushCards', () => new Map());
+/**
+ * worktreeId -> the episode id that card was sent for, or null (Issue #3798).
+ * Set and dropped together with {@link cards}; a worktree in `cards` with no
+ * entry here reads as id-less.
+ */
+const cardEpisodes = (0, global_state_1.getOrInitGlobal)('__promptPushCardEpisodes', () => new Map());
 function keyFor(worktreeId) {
     return `${exports.PROMPT_CARD_KEY_PREFIX}${worktreeId}`;
 }
+function episodeKeyFor(worktreeId) {
+    return `${exports.PROMPT_CARD_EPISODE_KEY_PREFIX}${worktreeId}`;
+}
+/**
+ * The episode id from its row, if that row belongs to the mark written at `at`.
+ * `<at>:<id>`; an empty id, a different time or a malformed value is no id.
+ */
+function parseEpisodeValue(value, at) {
+    if (value === undefined)
+        return null;
+    const sep = value.indexOf(':');
+    if (sep < 0 || value.slice(0, sep) !== String(at))
+        return null;
+    const id = value.slice(sep + 1);
+    return id === '' ? null : id;
+}
 function isExpired(at, now) {
     return now - at >= exports.PROMPT_CARD_MAX_AGE_MS;
 }
 /** The persisted mark for one worktree, or null. Never throws. */
 function readRow(worktreeId) {
     try {
-        const row = (0, db_instance_1.getDbInstance)()
-            .prepare('SELECT value FROM app_settings WHERE key = ?')
-            .get(keyFor(worktreeId));
+        const rows = (0, db_instance_1.getDbInstance)()
+            .prepare('SELECT key, value FROM app_settings WHERE key IN (?, ?)')
+            .all(keyFor(worktreeId), episodeKeyFor(worktreeId));
+        const row = rows.find((r) => r.key === keyFor(worktreeId));
         if (!row)
             return null;
         const at = Number.parseInt(row.value, 10);
         // A value nobody can read is treated as no card: it fails towards *not*
         // spending a push, the same direction `decidePromptResolution` chose for a
         // database that cannot answer.
-        return Number.isFinite(at) ? at : null;
+        if (!Number.isFinite(at))
+            return null;
+        const episodeRow = rows.find((r) => r.key === episodeKeyFor(worktreeId));
+        return { at, episodeId: parseEpisodeValue(episodeRow?.value, at) };
     }
     catch (error) {
         logger.debug('prompt-card-read-failed', {
@@ -195,18 +250,24 @@ function readAllRows() {
         return [];
     }
 }
-/** Write one worktree's mark through to storage. Never throws. */
-function writeRow(worktreeId, at) {
+/**
+ * Write one worktree's mark through to storage. Never throws.
+ *
+ * Issue #3798: the time row and the episode row in one statement — an id-less
+ * mark writes an empty id, so a newer id-less card never leaves an older
+ * card's id behind.
+ */
+function writeRow(worktreeId, at, episodeId) {
     try {
         (0, db_instance_1.getDbInstance)()
             .prepare(`
         INSERT INTO app_settings (key, value, created_at, updated_at)
-        VALUES (?, ?, ?, ?)
+        VALUES (?, ?, ?, ?), (?, ?, ?, ?)
         ON CONFLICT(key) DO UPDATE SET
           value = excluded.value,
           updated_at = excluded.updated_at
       `)
-            .run(keyFor(worktreeId), String(at), at, at);
+            .run(keyFor(worktreeId), String(at), at, at, episodeKeyFor(worktreeId), `${at}:${episodeId ?? ''}`, at, at);
     }
     catch (error) {
         logger.debug('prompt-card-write-failed', {
@@ -218,8 +279,9 @@ function writeRow(worktreeId, at) {
 /** @returns True when a row was actually removed. Never throws. */
 function deleteRow(worktreeId) {
     try {
-        return ((0, db_instance_1.getDbInstance)().prepare('DELETE FROM app_settings WHERE key = ?').run(keyFor(worktreeId))
-            .changes > 0);
+        return ((0, db_instance_1.getDbInstance)()
+            .prepare('DELETE FROM app_settings WHERE key IN (?, ?)')
+            .run(keyFor(worktreeId), episodeKeyFor(worktreeId)).changes > 0);
     }
     catch (error) {
         logger.debug('prompt-card-delete-failed', {
@@ -235,10 +297,49 @@ function deleteRow(worktreeId) {
  * Idempotent by overwrite: a second prompt in the same worktree (another
  * instance, or the #1790 reminder) replaces the same card on the device, so it
  * refreshes the timestamp rather than adding an entry.
+ *
+ * @param episodeId Issue #3798: the waiting episode this card is about, or
+ *   null when the producer did not name one. The last card's id replaces the
+ *   previous one — the device shows one card per worktree.
  */
-function markPromptCardShown(worktreeId, at = Date.now()) {
+function markPromptCardShown(worktreeId, at = Date.now(), episodeId = null) {
     cards.set(worktreeId, at);
-    writeRow(worktreeId, at);
+    cardEpisodes.set(worktreeId, episodeId);
+    writeRow(worktreeId, at, episodeId);
+}
+/**
+ * Take this worktree's next prompt push order (Issue #3798). Never throws.
+ *
+ * One statement reads and advances the counter, so two decisions never share a
+ * value — not even within the same millisecond — and it survives a restart
+ * with the database. The episode's `since` cannot do this job: a structured
+ * since is reused by the next episode and can be older than the observation.
+ *
+ * @returns The new value, or null when storage cannot answer; the push then
+ *   carries no order and the Service Worker treats it as it did before #3798.
+ */
+function nextPromptOrder(worktreeId, at = Date.now()) {
+    try {
+        const row = (0, db_instance_1.getDbInstance)()
+            .prepare(`
+        INSERT INTO app_settings (key, value, created_at, updated_at)
+        VALUES (?, '1', ?, ?)
+        ON CONFLICT(key) DO UPDATE SET
+          value = CAST(app_settings.value AS INTEGER) + 1,
+          updated_at = excluded.updated_at
+        RETURNING value
+      `)
+            .get(`${exports.PROMPT_ORDER_KEY_PREFIX}${worktreeId}`, at, at);
+        const order = Number(row?.value);
+        return Number.isSafeInteger(order) && order > 0 ? order : null;
+    }
+    catch (error) {
+        logger.debug('prompt-order-advance-failed', {
+            worktreeId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return null;
+    }
 }
 /**
  * Whether a prompt card for this worktree was fanned out and not yet cleared.
@@ -253,21 +354,38 @@ function markPromptCardShown(worktreeId, at = Date.now()) {
  *   {@link PROMPT_CARD_MAX_AGE_MS} without a fake clock.
  */
 function hasPromptCard(worktreeId, now = Date.now()) {
-    const at = cards.get(worktreeId) ?? readRow(worktreeId);
-    if (at === null || at === undefined)
+    const remembered = cards.get(worktreeId);
+    const mark = remembered !== undefined
+        ? { at: remembered, episodeId: cardEpisodes.get(worktreeId) ?? null }
+        : readRow(worktreeId);
+    if (mark === null)
         return false;
-    if (isExpired(at, now)) {
+    if (isExpired(mark.at, now)) {
         // Dropped as it is read rather than by a sweep: this is the only question
         // asked about a given worktree's card, so the read is the moment the
         // expiry becomes observable, and there is nothing a background pass would
         // catch earlier.
         cards.delete(worktreeId);
+        cardEpisodes.delete(worktreeId);
         deleteRow(worktreeId);
         return false;
     }
-    cards.set(worktreeId, at);
+    cards.set(worktreeId, mark.at);
+    cardEpisodes.set(worktreeId, mark.episodeId);
     return true;
 }
+/**
+ * The episode id the worktree's outstanding card was sent for (Issue #3798),
+ * or null — no card, or a card marked without an id (including every mark an
+ * older server wrote). Read the same way {@link hasPromptCard} reads the mark:
+ * memory first, storage after a restart. Does not expire anything; ask
+ * {@link hasPromptCard} first.
+ */
+function getPromptCardEpisodeId(worktreeId) {
+    if (cards.has(worktreeId))
+        return cardEpisodes.get(worktreeId) ?? null;
+    return readRow(worktreeId)?.episodeId ?? null;
+}
 /**
  * Forget this worktree's card, in memory and in storage.
  *
@@ -277,6 +395,7 @@ function hasPromptCard(worktreeId, now = Date.now()) {
  *   from `app_settings` still reports as cleared.
  */
 function clearPromptCard(worktreeId) {
+    cardEpisodes.delete(worktreeId);
     const wasInMemory = cards.delete(worktreeId);
     const wasPersisted = deleteRow(worktreeId);
     return wasInMemory || wasPersisted;
@@ -290,10 +409,11 @@ function clearPromptCard(worktreeId) {
  */
 function clearAllPromptCards() {
     cards.clear();
+    cardEpisodes.clear();
     try {
         (0, db_instance_1.getDbInstance)()
-            .prepare('DELETE FROM app_settings WHERE key GLOB ?')
-            .run(`${exports.PROMPT_CARD_KEY_PREFIX}*`);
+            .prepare('DELETE FROM app_settings WHERE key GLOB ? OR key GLOB ?')
+            .run(`${exports.PROMPT_CARD_KEY_PREFIX}*`, `${exports.PROMPT_CARD_EPISODE_KEY_PREFIX}*`);
     }
     catch (error) {
         logger.debug('prompt-card-clear-all-failed', {
@@ -312,6 +432,7 @@ function clearAllPromptCards() {
  */
 function forgetPromptCardMemory() {
     cards.clear();
+    cardEpisodes.clear();
 }
 /**
  * How many worktrees have an outstanding, unexpired card. Test seam.

package/dist/server/src/lib/push/prompt-push-gate.js

@@ -47,6 +47,12 @@
  * `at` lines up with the current wait. Here that is `at >= waitingSince` — the
  * suppression was recorded at or after this episode opened. A record from an
  * earlier episode is older than `since` and is ignored.
+ * Issue #3798: a record that names its episode (`episodeId`) is matched to a
+ * wait that names one by that id instead, since two episodes can share a
+ * `since`; either side without an id falls back to the time comparison. A
+ * record of the episode the poller then answered (`lastAnswer`), written
+ * before that answer, is not the wait's reason any more: the success path of
+ * a send does not clear the record, and the answer is the newer fact.
  *
  * The poller re-evaluates a suppressed prompt on every poll (the duplicate
  * guard only remembers *answered* prompts), so `at` stays current for as long
@@ -75,6 +81,20 @@
  * second prompt right after an answer gets a full hold of its own. Both
  * producers ask through {@link decideAndLogPromptPush} and share that origin.
  *
+ * ## Which hold belongs to which wait (Issue #3798)
+ *
+ * A wait is named by its episode id when the caller has one
+ * (`waitingEpisodeId`), and by `waitingSince` when it does not. The two are
+ * matched by the rule {@link isSameWait} states, the same rule the episode
+ * dedup in `notification-dedup` uses: both ids present and equal, or one of
+ * them absent and the `since`s equal. So an id-less producer (opencode's
+ * question push, or the response poller when its commit changed nothing —
+ * otherwise it names the episode it committed) and the id-bearing notifier asking about
+ * one wait share one hold, and the session wait's tick (#3796) is read once,
+ * when that hold begins. A rebind keeps the id, so it keeps the hold and its
+ * end; a replacement brings a new id, so it begins a new hold that reads the
+ * tick at its own start — even when the new wait reuses the old `since`.
+ *
  * ## The hold reaches the session wait's tick (Issue #3791)
  *
  * The 9 s assume the poller's next tick is at most a cooldown away. Its ticks
@@ -93,6 +113,38 @@
  * that tick forward to a poll interval, and the hold follows it — the tick is
  * only ever read earlier than it was when the hold began.
  *
+ * The other tick past the 9 s is the duplicate guard's (#306). A prompt with
+ * the type and question of the one the poller just answered — Claude's
+ * consecutive Bash approvals all ask `Do you want to proceed?` — is not
+ * answered for `DUPLICATE_RETRY_EXPIRY_MS` (10 s) after that answer, and is
+ * answered on the first tick after. While the poller reports that the guard
+ * actually held back the prompt of this wait (`duplicateRetryReservation`,
+ * review N1: its tick matched the guard's key, since this wait opened, and no
+ * tick since read another screen, no prompt, no session or failed; the tick
+ * sending the retry keeps it until that send is settled, review N3) the hold
+ * also lasts until that retry plus two ticks: {@link duplicateRetryHoldEndsAt}.
+ * An answer alone does not: a different screen the poller will not answer, or
+ * an error backoff, after an answer still notifies at the usual 9 s. Read on
+ * every decision, not once: the reservation appears on the poller's next tick,
+ * after the wait may already be held, and the notifier asks again when the 9 s
+ * end.
+ *
+ * ## A wait the poller answered is not "not answered" (Issue #3798)
+ *
+ * The poller records which episode its answer went to (`lastAnswer`, read off
+ * its state on `globalThis` like the answer's time), and closes that episode
+ * when the confirmation is gone. Until a frame says so — the agent works on
+ * over frames no rule reads — the episode stays open, and its hold can run
+ * out. That end is not "Auto-Yes did not answer": when the wait asked about
+ * names its id and it is the answered episode, still open and not a screen
+ * only a person drives, the gate says `auto-yes-answered` and stays quiet.
+ * Another confirmation in the same turn is another episode (R1-7), and a
+ * survey or a picker after the answer turns the episode into a `screen`: both
+ * notify as before. Without an id on either side nothing is matched, and the
+ * hold's end notifies as before. The hold itself is unchanged — its start, its
+ * end, the session wait's tick (#3796) and the duplicate guard's retry (#3791)
+ * are counted as above.
+ *
  * ## The reminder is never muted
  *
  * `runEscalationTick` has already established that the wait is still open — it
@@ -109,17 +161,20 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AUTO_YES_HOLD_MAX_AGE_MS = exports.AUTO_YES_ANSWER_AFTER_TICK_MS = exports.AUTO_YES_ANSWER_GRACE_MS = void 0;
+exports.isSameWait = isSameWait;
 exports.autoYesHoldStartedAt = autoYesHoldStartedAt;
 exports.autoYesHoldEndsAt = autoYesHoldEndsAt;
 exports.forgetAutoYesHold = forgetAutoYesHold;
 exports.clearAutoYesHolds = clearAutoYesHolds;
 exports.decidePromptPush = decidePromptPush;
+exports.autoYesAnsweredWait = autoYesAnsweredWait;
 exports.isPromptPushSuppressed = isPromptPushSuppressed;
 exports.decideAndLogPromptPush = decideAndLogPromptPush;
 const auto_yes_state_1 = require("../../lib/auto-yes-state");
 const logger_1 = require("../../lib/logger");
 const auto_yes_suppression_state_1 = require("../../lib/polling/auto-yes-suppression-state");
 const global_state_1 = require("../../lib/global-state");
+const waiting_episode_state_1 = require("../../lib/session/waiting-episode-state");
 const logger = (0, logger_1.createLogger)('push/prompt-gate');
 /**
  * How long a wait with nothing recorded about it is held as "Auto-Yes is
@@ -132,6 +187,20 @@ const logger = (0, logger_1.createLogger)('push/prompt-gate');
 exports.AUTO_YES_ANSWER_GRACE_MS = Math.max(3 * auto_yes_state_1.POLLING_INTERVAL_MS, auto_yes_state_1.COOLDOWN_INTERVAL_MS + 2 * auto_yes_state_1.POLLING_INTERVAL_MS);
 /** compositeKey -> the hold of that session's current episode. globalThis per #1736. */
 const autoYesHolds = (0, global_state_1.getOrInitGlobal)('__promptPushAutoYesHolds', () => new Map());
+/**
+ * Whether two names are the same wait (Issue #3798): both ids present and
+ * equal, or one of them absent and the `since`s equal. The id decides whenever
+ * both sides have one — two waits can share a `since` (the same millisecond, a
+ * structured `at` reused by the next prompt), and one wait keeps its id across
+ * a rebind.
+ */
+function isSameWait(a, b) {
+    const aId = a.episodeId ?? null;
+    const bId = b.episodeId ?? null;
+    if (aId !== null && bId !== null)
+        return aId === bId;
+    return a.since === b.since;
+}
 /**
  * Where this wait's `auto-yes-answering` hold is counted from (Issue #3757):
  * the later of the moment the gate first held this episode (recorded here on
@@ -146,11 +215,21 @@ const autoYesHolds = (0, global_state_1.getOrInitGlobal)('__promptPushAutoYesHol
 function autoYesHoldStartedAt(input, now) {
     const key = (0, auto_yes_state_1.buildCompositeKey)(input.worktreeId, input.cliToolId, input.instanceId);
     sweepStaleAutoYesHolds(now);
+    const episodeId = input.waitingEpisodeId ?? undefined;
     let hold = autoYesHolds.get(key);
-    if (hold === undefined || hold.since !== input.waitingSince) {
-        hold = { since: input.waitingSince, firstHeldAt: now, sessionWaitTick: pendingSessionWaitTick(key, now) };
+    if (hold === undefined || !isSameWait(hold, { since: input.waitingSince, episodeId })) {
+        hold = {
+            since: input.waitingSince,
+            ...(episodeId !== undefined ? { episodeId } : {}),
+            firstHeldAt: now,
+            sessionWaitTick: pendingSessionWaitTick(key, now),
+        };
         autoYesHolds.set(key, hold);
     }
+    else if (hold.episodeId === undefined && episodeId !== undefined) {
+        // Issue #3798: an id-less caller began this hold; the wait is now named.
+        hold.episodeId = episodeId;
+    }
     // Issue #3770: Auto-Yes switched off and on again inside one episode starts a
     // fresh hold; the old origin would read the poller's silence while it was off
     // as "did not answer".
@@ -199,7 +278,8 @@ function effectiveSessionWaitTickAt(tick) {
  * When this wait's `auto-yes-answering` hold ends (Issue #3791): a full
  * {@link AUTO_YES_ANSWER_GRACE_MS} after {@link autoYesHoldStartedAt}, and not
  * before {@link AUTO_YES_ANSWER_AFTER_TICK_MS} past the session wait's tick
- * pending when the hold began — while the poller that scheduled it still runs.
+ * pending when the hold began — while the poller that scheduled it still runs —
+ * nor past the duplicate guard's retry the poller reserved for this wait.
  *
  * @param now - Epoch ms of the decision; recorded as the start of a new hold
  */
@@ -208,14 +288,35 @@ function autoYesHoldEndsAt(input, now) {
     const key = (0, auto_yes_state_1.buildCompositeKey)(input.worktreeId, input.cliToolId, input.instanceId);
     const tick = autoYesHolds.get(key)?.sessionWaitTick;
     const graceEndsAt = startedAt + exports.AUTO_YES_ANSWER_GRACE_MS;
+    const holdEndsAt = Math.max(graceEndsAt, duplicateRetryHoldEndsAt(key, input.waitingSince));
     // A poller stopped or replaced since (disable, off → on) will not tick.
     if (tick === undefined || globalThis.__autoYesPollerStates?.get(key) !== tick.poller)
-        return graceEndsAt;
+        return holdEndsAt;
     // Kept on the hold: an earlier tick once adopted is not lost when the poller
     // later reschedules (an ordinary tick after a failed capture, a new session
     // wait) — the hold never moves back out.
     tick.at = effectiveSessionWaitTickAt(tick);
-    return Math.max(graceEndsAt, tick.at + exports.AUTO_YES_ANSWER_AFTER_TICK_MS);
+    return Math.max(holdEndsAt, tick.at + exports.AUTO_YES_ANSWER_AFTER_TICK_MS);
+}
+/**
+ * Issue #3791: when the duplicate guard (#306) lets the running poller answer
+ * again, plus {@link AUTO_YES_ANSWER_AFTER_TICK_MS} — or -Infinity unless the
+ * poller reserved that retry for this wait (review N1): a reservation on the
+ * live poller (`__autoYesPollerStates`, so a stopped or replaced one has none),
+ * made by a tick since the wait opened, for the answer the guard still counts
+ * from. Read off `globalThis` for the reason {@link autoYesHoldStartedAt} gives.
+ */
+function duplicateRetryHoldEndsAt(key, waitingSince) {
+    const poller = globalThis.__autoYesPollerStates?.get(key);
+    const reservation = poller?.duplicateRetryReservation;
+    if (poller === undefined || reservation === undefined || reservation === null)
+        return -Infinity;
+    if (reservation.observedAt < waitingSince)
+        return -Infinity;
+    if (reservation.answeredAt !== poller.lastAnsweredAt || reservation.promptKey !== poller.lastAnsweredPromptKey) {
+        return -Infinity;
+    }
+    return reservation.answeredAt + auto_yes_state_1.DUPLICATE_RETRY_EXPIRY_MS + exports.AUTO_YES_ANSWER_AFTER_TICK_MS;
 }
 /** A hold older than this is dropped (Issue #3770): its episode is long over. */
 exports.AUTO_YES_HOLD_MAX_AGE_MS = 60 * 60 * 1000;
@@ -229,14 +330,21 @@ function sweepStaleAutoYesHolds(now) {
  * Drop the hold of one session (Issue #3770): Auto-Yes went off, or the
  * episode closed.
  *
- * @param since - Issue #3776: drop it only when it is this episode's hold. A
+ * @param wait - Issue #3776: drop it only when it is this episode's hold. A
  *   caller retiring one episode must not take the next episode's origin with it
  *   (that hold would start over, and its notification come up to a hold late).
- *   Omitted, the session's hold goes whatever its episode.
+ *   A number is the episode's `since`; Issue #3798 adds the episode's id, matched
+ *   by {@link isSameWait}. Omitted, the session's hold goes whatever its episode.
  */
-function forgetAutoYesHold(key, since) {
-    if (since !== undefined && autoYesHolds.get(key)?.since !== since)
-        return;
+function forgetAutoYesHold(key, wait) {
+    if (wait !== undefined) {
+        const hold = autoYesHolds.get(key);
+        if (hold === undefined)
+            return;
+        const identity = typeof wait === 'number' ? { since: wait } : wait;
+        if (!isSameWait(hold, identity))
+            return;
+    }
     autoYesHolds.delete(key);
 }
 /** Forget every hold. Test seam. */
@@ -251,13 +359,16 @@ function clearAutoYesHolds() {
  * rather than only the outcome.
  */
 function decidePromptPush(input) {
-    const { worktreeId, cliToolId, instanceId, waitingSince } = input;
+    const { worktreeId, cliToolId, instanceId } = input;
     const state = (0, auto_yes_state_1.getAutoYesState)(worktreeId, cliToolId, instanceId);
     if (state === null || !state.enabled) {
         return { suppress: false, reason: 'auto-yes-inactive', stopReason: state?.stopReason };
     }
     const suppression = (0, auto_yes_suppression_state_1.getLastPolicySuppression)(worktreeId, cliToolId, instanceId);
-    if (suppression !== null && suppression.at >= waitingSince) {
+    if (suppression !== null &&
+        suppressionBelongsToWait(suppression, input) &&
+        // The answer that came after the record is the newer fact (Issue #3798).
+        !(0, auto_yes_suppression_state_1.suppressionPredatesAnswer)(suppression, input.waitingEpisodeId, answerTo(input))) {
         return { suppress: false, reason: 'policy-withheld', suppressedBy: suppression.reason };
     }
     if (input.escalated === true) {
@@ -265,10 +376,44 @@ function decidePromptPush(input) {
     }
     const holdEndsAt = input.holdEndsAt ?? (input.holdStartedAt !== undefined ? input.holdStartedAt + exports.AUTO_YES_ANSWER_GRACE_MS : undefined);
     if (holdEndsAt !== undefined && (input.now ?? Date.now()) >= holdEndsAt) {
+        if (autoYesAnsweredWait(input))
+            return { suppress: true, reason: 'auto-yes-answered' };
         return { suppress: false, reason: 'auto-yes-not-answered' };
     }
     return { suppress: true, reason: 'auto-yes-answering' };
 }
+/**
+ * Whether the Auto-Yes poller answered this wait (Issue #3798): the caller
+ * names the episode, the poller's `lastAnswer` names the same one, and that
+ * episode is still the one open and not a screen only a person drives (a
+ * survey or a picker after the answer is rebound to `screen` under the same
+ * id, and a person has to act on it). Read off the poller state on
+ * `globalThis`, as {@link autoYesHoldStartedAt} reads the answer's time.
+ */
+function autoYesAnsweredWait(input) {
+    const waitId = input.waitingEpisodeId ?? null;
+    if (waitId === null || answerTo(input)?.episodeId !== waitId)
+        return false;
+    const episode = (0, waiting_episode_state_1.getWaitingEpisodeRecord)(input.worktreeId, input.cliToolId, input.instanceId);
+    return episode !== null && episode.episodeId === waitId && episode.binding.kind !== 'screen';
+}
+/** The poller's `lastAnswer` for this instance, read off `globalThis` (Issue #3798). */
+function answerTo(input) {
+    const key = (0, auto_yes_state_1.buildCompositeKey)(input.worktreeId, input.cliToolId, input.instanceId);
+    return globalThis.__autoYesPollerStates?.get(key)?.lastAnswer ?? null;
+}
+/**
+ * Whether a policy-suppression record is about this wait (Issue #3798). By the
+ * episode id when both the record and the caller carry one — a record written
+ * for an earlier episode is not this wait's reason however recent its `at` —
+ * and by #1684's `at >= waitingSince` otherwise.
+ */
+function suppressionBelongsToWait(suppression, input) {
+    const waitId = input.waitingEpisodeId ?? null;
+    if (suppression.episodeId !== undefined && waitId !== null)
+        return suppression.episodeId === waitId;
+    return suppression.at >= input.waitingSince;
+}
 /**
  * {@link decidePromptPush}, logged.
  *
@@ -303,6 +448,7 @@ function decideAndLogPromptPush(input, options = {}) {
         cliToolId: input.cliToolId,
         instanceId: input.instanceId ?? input.cliToolId,
         waitingSince: input.waitingSince,
+        ...(input.waitingEpisodeId ? { waitingEpisodeId: input.waitingEpisodeId } : {}),
         escalated: input.escalated === true,
         reason: decision.reason,
         ...(decision.stopReason !== undefined ? { stopReason: decision.stopReason } : {}),

package/dist/server/src/lib/push/push-sender.js

@@ -160,7 +160,9 @@ function buildFailureBody(event, messages, excerpt, locale) {
         : messages[keys.plain];
 }
 /** Build the minimal notification payload for an event, in the reader's language. */
-function buildPushPayload(event, locale = i18n_config_1.DEFAULT_LOCALE, now = Date.now()) {
+function buildPushPayload(event, locale = i18n_config_1.DEFAULT_LOCALE, now = Date.now(), 
+/** Issue #3798: the prompt push order taken for this fan-out, if any. */
+order = null) {
     const excerpt = buildExcerpt(event.excerpt);
     const agentSuffix = event.agentName ? ` (${event.agentName})` : '';
     const title = `${event.worktreeName}${agentSuffix}`;
@@ -208,6 +210,12 @@ function buildPushPayload(event, locale = i18n_config_1.DEFAULT_LOCALE, now = Da
         timestamp: now,
         ...(event.waitingKind ? { waitingKind: event.waitingKind } : {}),
         ...(event.resolved === true ? { resolved: true } : {}),
+        ...(event.kind === 'prompt' && event.resolved !== true && event.waitingEpisodeId
+            ? { episodeId: event.waitingEpisodeId, ...(typeof order === 'number' ? { order } : {}) }
+            : {}),
+        ...(event.resolved === true && event.resolvedEpisodeId
+            ? { resolvedEpisodeId: event.resolvedEpisodeId, ...(typeof order === 'number' ? { order } : {}) }
+            : {}),
     };
 }
 /**
@@ -296,6 +304,7 @@ function passesDedup(event) {
             worktreeId: event.worktreeId,
             instanceId: event.instanceId ?? event.agentName ?? '',
             since: event.waitingSince,
+            episodeId: event.waitingEpisodeId,
             escalated: event.escalated,
         });
     }
@@ -334,8 +343,19 @@ async function notifyPushSubscribers(event, now = Date.now()) {
         // itself does not mark; it clears, and it does so in its own module so each
         // direction has one writer.
         if (event.kind === 'prompt' && event.resolved !== true) {
-            (0, prompt_card_state_1.markPromptCardShown)(event.worktreeId, now);
+            // Issue #3798: with the episode's id, so the resolution can tell its own
+            // card from a newer one (`resolvedEpisodeId`).
+            (0, prompt_card_state_1.markPromptCardShown)(event.worktreeId, now, event.waitingEpisodeId ?? null);
         }
+        // Issue #3798: the order is taken here, synchronously with the decision to
+        // send — for a resolution, in the same tick `notifyPromptResolved` found
+        // nothing waiting — so a card taken after it compares greater on every
+        // device, whichever arrives first. Only pushes the Service Worker compares
+        // take one: an episode-named card, and a resolution naming its episode.
+        const order = event.kind === 'prompt' &&
+            (event.resolved === true ? Boolean(event.resolvedEpisodeId) : Boolean(event.waitingEpisodeId))
+            ? (0, prompt_card_state_1.nextPromptOrder)(event.worktreeId, now)
+            : null;
         web_push_1.default.setVapidDetails(config.subject, config.publicKey, config.privateKey);
         // Devices can be registered in different languages, so the body is built per
         // distinct locale rather than once for the whole fan-out.
@@ -349,7 +369,7 @@ async function notifyPushSubscribers(event, now = Date.now()) {
                 byLocale.set(locale, [sub]);
         }
         const outcomes = (await Promise.all(Array.from(byLocale, ([locale, subs]) => {
-            const payload = JSON.stringify(buildPushPayload(event, locale, now));
+            const payload = JSON.stringify(buildPushPayload(event, locale, now, order));
             return Promise.all(subs.map((sub) => sendToOne(sub, payload, now)));
         }))).flat();
         // Issue #2124: a fan-out that reached nobody used to be indistinguishable

package/dist/server/src/lib/push/resolution-push-notifier.js

@@ -56,6 +56,16 @@
  *    exist, so a single-device install sends exactly as many pushes as it did
  *    before this module was written — zero extra.
  *
+ * ## Which card it clears (Issue #3798)
+ *
+ * The resolution names the episode the card mark was last sent for
+ * (`resolvedEpisodeId`). A resolution can reach a device after the card of a
+ * newer wait in the same worktree — the next prompt's push overtook it — and
+ * without the name the Service Worker would close that newer, still-true card.
+ * With it, the worker closes only this episode's cards (and cards that name no
+ * episode) and re-shows the newer one silently. A mark without an id sends a
+ * resolution without one, which the worker handles exactly as before.
+ *
  * `completion` and `failure` cards are deliberately left alone; the reasoning
  * for each is in the design note under "which kinds are cleared".
  *
@@ -170,6 +180,9 @@ async function notifyPromptResolved(input) {
         reason: decision.reason,
         ...(decision.deviceCount !== undefined ? { deviceCount: decision.deviceCount } : {}),
     };
+    // Issue #3798: read before the mark is cleared below; `decidePromptResolution`
+    // has just adopted it into memory, so this is not a second query.
+    const resolvedEpisodeId = decision.send ? (0, prompt_card_state_1.getPromptCardEpisodeId)(worktreeId) : null;
     if (decision.reason !== 'still-waiting') {
         (0, prompt_card_state_1.clearPromptCard)(worktreeId);
     }
@@ -193,6 +206,7 @@ async function notifyPromptResolved(input) {
             kind: 'prompt',
             agentName,
             resolved: true,
+            ...(resolvedEpisodeId !== null ? { resolvedEpisodeId } : {}),
         }, at);
         logger.info('resolution-push-sent', context);
     }