From cc0c574a2e52e2b1f6166e3c1fb76f6d662540b2 Mon Sep 17 00:00:00 2001
From: Abir Abbas <abirabbas1998@gmail.com>
Date: Wed, 28 Oct 2026 14:08:44 -0400
Subject: [PATCH 1/6] app: settle a crew proposal's Inbox item when the crew is
 made

Making the crew closed the proposal's ask, but its Inbox item was resolved
only through a receipt id, and the formation receipt names the crew, so the
item stayed waiting (and a later Inbox read brought it back). Resolve the
proposal's item explicitly on create, once; the chat keeps its single
formation fact.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 cmd/codeaf/appcrewmembers.go                  |  3 +++
 cmd/codeaf/appcrewpropose_test.go             | 24 ++++++++++++++++++-
 .../unreleased/0-app-crew-proposal-inbox.md   |  8 +++++++
 .../manual/chat/team-questions-and-caps.md    |  7 ++++++
 4 files changed, 41 insertions(+), 1 deletion(-)
 create mode 100644 docs/changes/unreleased/0-app-crew-proposal-inbox.md

diff --git a/cmd/codeaf/appcrewmembers.go b/cmd/codeaf/appcrewmembers.go
index a4f4478fff..92211d7ef0 100644
--- a/cmd/codeaf/appcrewmembers.go
+++ b/cmd/codeaf/appcrewmembers.go
@@ -740,6 +740,9 @@ func (b *appBackend) dropProposal(id, option string) {
 	// "Made the crew" here drew the card's end twice. A kept agent's receipt
 	// says so in its own words.
 	if option == appwire.ProposalCreate {
+		// The formation fact names the crew, so its receipt id cannot resolve
+		// the proposal's Inbox item through the usual receipt-id mapping.
+		b.inboxResolved(appInboxID(ask.Agent, ask.ID), appwire.Entry{})
 		return
 	}
 	b.emit.Emit(appwire.EventEntryAdded, appwire.EntryAdded{Entry: appwire.Entry{
diff --git a/cmd/codeaf/appcrewpropose_test.go b/cmd/codeaf/appcrewpropose_test.go
index bf52844150..f9240beb68 100644
--- a/cmd/codeaf/appcrewpropose_test.go
+++ b/cmd/codeaf/appcrewpropose_test.go
@@ -462,6 +462,7 @@ func TestAppCrewProposalAtTheDayCapAsksAboutTheCap(t *testing.T) {
 // agent alone leaves "Kept as one agent · you · <time>", and making the crew
 // leaves the crew's formation fact alone — not a second "Made the crew" beside
 // it.
+// Contract 1: proposal answers settle the Inbox and chat exactly once.
 func TestAppCrewProposalEndsInOneReceipt(t *testing.T) {
 	conv := &proposingConversation{fakeConversation: &fakeConversation{}, answer: helpersProposal}
 	backend, rec, agent := proposingBackend(t, conv)
@@ -495,6 +496,12 @@ func TestAppCrewProposalEndsInOneReceipt(t *testing.T) {
 	}
 
 	kept := opened()
+	if err := backend.AnswerAsk(agent.ID, kept.ID, appwire.ProposalEdit, ""); err != nil {
+		t.Fatal(err)
+	}
+	if waiting, counts, err := backend.ListInbox(appwire.InboxWaiting, ""); err != nil || len(waiting) != 1 || counts.Waiting != 1 {
+		t.Fatalf("Edit changed Waiting: %+v %+v %v", waiting, counts, err)
+	}
 	rec.mu.Lock()
 	mark := len(rec.events)
 	rec.mu.Unlock()
@@ -512,9 +519,24 @@ func TestAppCrewProposalEndsInOneReceipt(t *testing.T) {
 	// Made with its helpers edited away, so no start runs on behind the test:
 	// the receipt is what is asserted, and a start is the crew watch's own.
 	edits := &appwire.Proposal{Helpers: []appwire.ProposalHelper{}}
-	if _, err := backend.CrewCreate(appwire.CrewCreate{From: "proposal", Proposal: strings.TrimPrefix(made.ID, appProposalAskPrefix), Edits: edits}); err != nil {
+	create := appwire.CrewCreate{From: "proposal", Proposal: strings.TrimPrefix(made.ID, appProposalAskPrefix), Edits: edits}
+	crew, err := backend.CrewCreate(create)
+	if err != nil {
 		t.Fatal(err)
 	}
+	if asks, err := backend.ListAsks(agent.ID); err != nil || len(asks) != 0 {
+		t.Fatalf("asks after create: %+v %v", asks, err)
+	}
+	if waiting, counts, err := backend.ListInbox(appwire.InboxWaiting, ""); err != nil || len(waiting) != 0 || counts.Waiting != 0 {
+		t.Fatalf("Waiting after create: %+v %+v %v", waiting, counts, err)
+	}
+	if again, err := backend.CrewCreate(create); err != nil || again.ID != crew.ID {
+		t.Fatalf("retried create: %+v %v", again, err)
+	}
+	done, counts, err := backend.ListInbox(appwire.InboxDone, "")
+	if err != nil || len(done) != 2 || counts.DoneToday != 2 || done[0].ID != appInboxID(agent.ID, made.ID) || done[0].Answered == nil || done[0].Answered.Option != appwire.ProposalCreate {
+		t.Fatalf("Done after Keep and retried create: %+v %+v %v", done, counts, err)
+	}
 	got := receipts(mark)
 	if len(got) != 1 || got[0].Op == nil || got[0].Op.Kind != appwire.OpCrewFormed || got[0].Op.Name != "flaky" {
 		t.Fatalf("making the crew left %+v", got)
diff --git a/docs/changes/unreleased/0-app-crew-proposal-inbox.md b/docs/changes/unreleased/0-app-crew-proposal-inbox.md
new file mode 100644
index 0000000000..5c8b6e74c1
--- /dev/null
+++ b/docs/changes/unreleased/0-app-crew-proposal-inbox.md
@@ -0,0 +1,8 @@
+---
+kind: fixed
+title: Clear crew proposals from the app Inbox when the crew is made
+pr: 0
+surface: [engine]
+invalidates:
+  - "Making a crew closed its proposal ask but left the proposal in Inbox Waiting because the formation receipt names the crew. Creation now resolves the proposal item explicitly, once, while the chat keeps its single formation fact. Edit and Keep it one agent retain their existing meanings."
+---
diff --git a/internal/manual/chat/team-questions-and-caps.md b/internal/manual/chat/team-questions-and-caps.md
index 8c6cd787a1..d525b7158e 100644
--- a/internal/manual/chat/team-questions-and-caps.md
+++ b/internal/manual/chat/team-questions-and-caps.md
@@ -141,3 +141,10 @@ does not hand out another 15 minutes. The next time the manager's conversation i
 countdown continues with the time that is left. If that time already ran out while codeaf
 was closed, codeaf brings the incomplete report once, the same way it does when the clock
 runs out with codeaf open. Opening codeaf again does not bring that report a second time.
+
+## Desktop crew proposal — Make the crew, Edit, Keep it one agent
+
+"Make the crew" closes the proposal in the chat and removes it from Inbox
+Waiting. Inbox Done records that answer once. The chat keeps one crew formation
+fact, including when a create request is retried. "Edit" leaves the proposal
+open; "Keep it one agent" closes it with its own receipt.

From 7c4edefc63899cc0ece7a53f1aa9b4d338ee7e4d Mon Sep 17 00:00:00 2001
From: Abir Abbas <abirabbas1998@gmail.com>
Date: Wed, 28 Oct 2026 14:08:44 -0400
Subject: [PATCH 2/6] app: check an Inbox answer before its undo hold starts

inbox.answer returned an undo deadline before checking the answer, and a
failure after the hold was dropped, so the desktop kept "Answering...".
Validate what the owning handler will check (open question, offered option,
required text, proposals, budget and fuel amounts, landing verdicts, service
health) before the hold, and refuse at once. Day-cap raises the limit itself
refuses are still checked only when sent.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 cmd/codeaf/app.go                             |  67 +++-
 cmd/codeaf/appcrewmembers.go                  |  11 +
 cmd/codeaf/appcrews.go                        |  20 +-
 cmd/codeaf/appinbox.go                        |  65 +++-
 cmd/codeaf/appinbox_test.go                   | 326 ++++++++++++++++++
 cmd/codeaf/appmoney.go                        |  50 ++-
 cmd/codeaf/apporders.go                       |  14 +-
 cmd/codeaf/appservices.go                     |  11 +
 .../0-app-inbox-answer-validation.md          |   8 +
 internal/manual/chat/permissions.md           |  18 +
 10 files changed, 557 insertions(+), 33 deletions(-)
 create mode 100644 docs/changes/unreleased/0-app-inbox-answer-validation.md

diff --git a/cmd/codeaf/app.go b/cmd/codeaf/app.go
index 69eaacf17f..a144921e6e 100644
--- a/cmd/codeaf/app.go
+++ b/cmd/codeaf/app.go
@@ -58,6 +58,7 @@ import (
 	"github.com/Agent-Field/codeaf/internal/home"
 	"github.com/Agent-Field/codeaf/internal/leave"
 	"github.com/Agent-Field/codeaf/internal/modelsource"
+	"github.com/Agent-Field/codeaf/internal/orchestrate"
 	"github.com/Agent-Field/codeaf/internal/provider"
 	"github.com/Agent-Field/codeaf/internal/redact"
 	"github.com/Agent-Field/codeaf/internal/remote"
@@ -3209,18 +3210,9 @@ func (b *appBackend) answerAskScope(id, askID, option, text, scope string) error
 			refused = appwire.Errorf(appwire.CodeNotFound, "the ask %s is not open; it may have been answered elsewhere", askID)
 			return
 		}
-		if option != "" {
-			picked, offered := appOptionNamed(q, option)
-			if !offered {
-				refused = appwire.Errorf(appwire.CodeBadParams, "the ask %s offers no option %q", askID, option)
-				return
-			}
-			key = picked.key
-		}
-		if q.Kind == session.QuestionConsent && option == appwire.OptionAlways {
-			if refused = appValidateScope(option, scope, q.ConsentScopes); refused != nil {
-				return
-			}
+		key, refused = appValidateQuestionAnswer(askID, q, option, text, scope)
+		if refused != nil {
+			return
 		}
 		live.answered[askID] = appAnsweredMark + option
 		live.lastUse = b.now()
@@ -3253,6 +3245,57 @@ func (b *appBackend) answerAskScope(id, askID, option, text, scope string) error
 	return nil
 }
 
+// appValidateQuestionAnswer is shared by immediate answers and Inbox preflight.
+// Words alone remain valid for model questions and task redirects.
+func appValidateQuestionAnswer(id string, q session.Question, option, text, scope string) (string, error) {
+	key := ""
+	if option != "" {
+		picked, offered := appOptionNamed(q, option)
+		if !offered {
+			return "", appwire.Errorf(appwire.CodeBadParams, "the ask %s offers no option %q", id, option)
+		}
+		key = picked.key
+	} else {
+		required := false
+		switch q.Kind {
+		case session.QuestionConsent, session.QuestionKeep, session.QuestionLanding:
+			required = true
+		case session.QuestionTask, session.QuestionFactory, session.QuestionRecipe, session.QuestionItem, session.QuestionAutomation:
+			required = strings.TrimSpace(text) == ""
+		}
+		if required {
+			return "", appwire.Errorf(appwire.CodeBadParams, "the ask %s needs an option", id)
+		}
+	}
+	switch q.Kind {
+	case session.QuestionConsent:
+		if err := appValidateScope(option, scope, q.ConsentScopes); err != nil {
+			return "", err
+		}
+	case session.QuestionLanding, session.QuestionConflict:
+		if key == session.LandingTellKey && strings.TrimSpace(text) == "" {
+			return "", appwire.Errorf(appwire.CodeBadParams, "the ask %s needs words for Tell", id)
+		}
+	case session.QuestionFuel:
+		answer := strings.ToLower(strings.TrimSpace(text))
+		switch key {
+		case "1":
+			answer = orchestrate.GateTopup + ":" + answer
+		case "2":
+			answer = orchestrate.GateFinish
+		case "3":
+			answer = orchestrate.GateStop
+		}
+		if answer != orchestrate.GateFinish && answer != orchestrate.GateStop {
+			amount, topup := strings.CutPrefix(answer, orchestrate.GateTopup+":")
+			if _, valid := appParseUSD(amount); !topup || !valid {
+				return "", appwire.Errorf(appwire.CodeBadParams, "the ask %s needs a positive top-up amount, finish or stop", id)
+			}
+		}
+	}
+	return key, nil
+}
+
 // appValidateScope keeps both answer doors on the permission's offered rules.
 func appValidateScope(option, scope string, scopes []string) error {
 	if option == appwire.OptionAlways && (scope == "" || !slices.Contains(scopes, scope)) {
diff --git a/cmd/codeaf/appcrewmembers.go b/cmd/codeaf/appcrewmembers.go
index 92211d7ef0..e7f943ddfc 100644
--- a/cmd/codeaf/appcrewmembers.go
+++ b/cmd/codeaf/appcrewmembers.go
@@ -702,6 +702,9 @@ func appParseProposal(answer string) (appwire.Proposal, bool) {
 // answerProposal is the person's answer to a proposal: make the crew, or keep
 // the agent alone. Edit is the app's editor, and leaves the ask open.
 func (b *appBackend) answerProposal(agent, id, option string) error {
+	if err := appValidateProposalAnswer(option); err != nil {
+		return err
+	}
 	switch option {
 	case appwire.ProposalCreate:
 		_, err := b.CrewCreate(appwire.CrewCreate{From: "proposal", Proposal: id})
@@ -715,6 +718,14 @@ func (b *appBackend) answerProposal(agent, id, option string) error {
 	return appwire.Errorf(appwire.CodeBadParams, "a proposal is answered create, edit or keep")
 }
 
+func appValidateProposalAnswer(option string) error {
+	switch option {
+	case appwire.ProposalCreate, appwire.ProposalEdit, appwire.ProposalKeep:
+		return nil
+	}
+	return appwire.Errorf(appwire.CodeBadParams, "a proposal is answered create, edit or keep")
+}
+
 // dropProposal forgets a proposal and closes its ask.
 func (b *appBackend) dropProposal(id, option string) {
 	_ = b.crewLayer().write(func(f *appCrewLayerFile) error {
diff --git a/cmd/codeaf/appcrews.go b/cmd/codeaf/appcrews.go
index 70633c516e..cea16c38b8 100644
--- a/cmd/codeaf/appcrews.go
+++ b/cmd/codeaf/appcrews.go
@@ -2011,10 +2011,11 @@ func (b *appBackend) CrewDecisions(id string, all bool) ([]appwire.Decision, err
 // closes the crew it reports on.
 func (b *appBackend) CrewDecide(packet, option, text, reason string) (appwire.Decision, error) {
 	profile := b.crewProfile()
-	decision := strings.TrimSpace(option)
-	if decision == "" {
-		decision = strings.TrimSpace(text)
-	} else if strings.TrimSpace(text) != "" && strings.TrimSpace(reason) == "" {
+	decision, err := appValidateCrewDecisionAnswer(option, text)
+	if err != nil {
+		return appwire.Decision{}, err
+	}
+	if strings.TrimSpace(option) != "" && strings.TrimSpace(text) != "" && strings.TrimSpace(reason) == "" {
 		reason = text
 	}
 	p, err := teamstore.Decide(profile, packet, teamstore.Person, decision, strings.TrimSpace(reason))
@@ -2044,6 +2045,17 @@ func (b *appBackend) CrewDecide(packet, option, text, reason string) (appwire.De
 	return appDecisionOf(f, p), nil
 }
 
+func appValidateCrewDecisionAnswer(option, text string) (string, error) {
+	decision := strings.TrimSpace(option)
+	if decision == "" {
+		decision = strings.TrimSpace(text)
+	}
+	if decision == "" {
+		return "", appwire.Errorf(appwire.CodeBadParams, "a decision needs an answer")
+	}
+	return decision, nil
+}
+
 // CrewManager makes a member the crew's manager, or clears it.
 func (b *appBackend) CrewManager(id, agent string) (appwire.Crew, error) {
 	t, _, err := b.crewTeam(id)
diff --git a/cmd/codeaf/appinbox.go b/cmd/codeaf/appinbox.go
index 0a1e170d75..9294522186 100644
--- a/cmd/codeaf/appinbox.go
+++ b/cmd/codeaf/appinbox.go
@@ -18,6 +18,7 @@ package main
 // [appBackend.sweepAgent]), which is what keeps its asks answerable here.
 
 import (
+	"slices"
 	"strings"
 	"sync"
 	"time"
@@ -352,12 +353,74 @@ func (b *appBackend) AnswerInbox(id, option, text, why, scope string) (time.Time
 	if !ok {
 		return time.Time{}, appwire.Errorf(appwire.CodeBadParams, "%s is not an Inbox item", id)
 	}
+	// Validate outside the Inbox lock because finding a crew owner can emit.
+	words := strings.TrimSpace(strings.TrimSpace(text) + "\n" + strings.TrimSpace(why))
+	if episode, service := strings.CutPrefix(ask, "service:"); service {
+		if err := appValidateServiceAnswer(option); err != nil {
+			return time.Time{}, err
+		}
+		local, _, _ := strings.Cut(episode, ".")
+		svc, owner, serviceID, err := b.serviceRow(agent + ":" + local)
+		if err != nil {
+			return time.Time{}, err
+		}
+		if _, err := svc.sup.Get(owner, serviceID); err != nil {
+			return time.Time{}, appServiceError(err)
+		}
+	} else {
+		asks, err := b.ListAsks(agent)
+		if err != nil {
+			return time.Time{}, err
+		}
+		at := slices.IndexFunc(asks, func(q appwire.Ask) bool { return q.ID == ask })
+		if at < 0 {
+			return time.Time{}, appwire.Errorf(appwire.CodeNotFound, "the ask %s is not open; it may have been answered elsewhere", ask)
+		}
+		q := asks[at]
+		switch q.Subkind {
+		case appwire.SubkindCrewProposal:
+			err = appValidateProposalAnswer(option)
+		case appwire.SubkindOrderRun:
+			err = appValidateOrderAnswer(ask, option)
+		case appwire.SubkindCrewDecision:
+			_, err = appValidateCrewDecisionAnswer(option, text)
+		}
+		if err != nil {
+			return time.Time{}, err
+		}
+		a, err := b.findCrewOwner(agent)
+		if err != nil {
+			return time.Time{}, err
+		}
+		var refused error
+		b.locked(func() {
+			if a.live == nil {
+				return
+			}
+			if money, found := a.live.money[ask]; found {
+				_, refused = appValidateMoneyAnswer(money.scope, ask, option, words, a.live.running)
+			} else if question, found := a.live.questions[ask]; found {
+				_, refused = appValidateQuestionAnswer(ask, question, option, words, scope)
+			}
+		})
+		if refused != nil {
+			return time.Time{}, refused
+		}
+		if option != "" && !slices.ContainsFunc(q.Options, func(o appwire.AskOption) bool { return o.ID == option }) {
+			return time.Time{}, appwire.Errorf(appwire.CodeBadParams, "the ask %s offers no option %q", ask, option)
+		}
+		if q.Subkind == appwire.SubkindPermission {
+			if err := appValidateScope(option, scope, q.Scopes); err != nil {
+				return time.Time{}, err
+			}
+		}
+	}
 	in := b.inbox
 	var refused error
 	var until time.Time
 	in.locked(func() {
 		switch {
-		case in.items[id] == nil:
+		case in.items[id] == nil || in.closing[id].ID != "":
 			refused = appwire.Errorf(appwire.CodeNotFound, "the Inbox item %s is no longer waiting", id)
 		case in.held[id] != nil:
 			refused = appwire.Errorf(appwire.CodeBusy, "the Inbox item %s is already being answered", id)
diff --git a/cmd/codeaf/appinbox_test.go b/cmd/codeaf/appinbox_test.go
index e7eb68ef81..7c09871133 100644
--- a/cmd/codeaf/appinbox_test.go
+++ b/cmd/codeaf/appinbox_test.go
@@ -6,7 +6,10 @@ import (
 	"time"
 
 	"github.com/Agent-Field/codeaf/internal/appwire"
+	"github.com/Agent-Field/codeaf/internal/automation"
+	"github.com/Agent-Field/codeaf/internal/service"
 	"github.com/Agent-Field/codeaf/internal/session"
+	teamstore "github.com/Agent-Field/codeaf/internal/teams"
 )
 
 // EVERY OPEN ASK IS AN INBOX ITEM with the turns before it; an answer from the
@@ -84,3 +87,326 @@ func TestAppInboxHoldsUndoesAndClearsEverywhere(t *testing.T) {
 		t.Fatalf("open = %s %s %v", a, task, err)
 	}
 }
+
+// Contract 2: each owning lane refuses invalid payloads before Undo starts.
+func TestAppInboxValidatesOwnedAnswerPayloads(t *testing.T) {
+	refused := func(t *testing.T, b *appBackend, id, option, text, want string) {
+		t.Helper()
+		until, err := b.AnswerInbox(id, option, text, "", "")
+		undo := b.UndoInbox(id)
+		if wireCode(err) != want || !until.IsZero() || wireCode(undo) != appwire.CodeNotFound {
+			t.Errorf("answer = %v %v; Undo = %v; want immediate %s and no hold", until, err, undo, want)
+		}
+		if items, counts, err := b.ListInbox(appwire.InboxWaiting, ""); err != nil || len(items) != 1 || counts.Waiting != 1 || counts.DoneToday != 0 {
+			t.Fatalf("validation changed Waiting: %+v %+v %v", items, counts, err)
+		}
+	}
+	for _, tc := range []struct{ name, option, text, code string }{
+		{"raise needs money", appwire.OptionRaise, "not money", appwire.CodeBadParams},
+		{"tell needs words", appwire.OptionTell, " ", appwire.CodeBadParams},
+		{"budget needs option", "", "", appwire.CodeBadParams},
+		{"tell needs idle agent", appwire.OptionTell, "keep going", appwire.CodeBusy},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Setenv("CODEAF_HOME", t.TempDir())
+			conv := &fakeConversation{cost: 4.2}
+			b, rec, agent := workBackend(t, conv)
+			b.profileDir = t.TempDir()
+			budget := 5.0
+			if _, err := b.SetAgentBudget(appwire.AgentBudgetSet{ID: agent.ID, USD: &budget}); err != nil {
+				t.Fatal(err)
+			}
+			if _, err := b.Send(agent.ID, "keep going", ""); err != nil {
+				t.Fatal(err)
+			}
+			i := rec.waitFor(t, 5*time.Second, func(_ string, data any) bool {
+				v, ok := data.(appwire.InboxAddedEvent)
+				return ok && v.Item.Ask.Subkind == appwire.SubkindBudget
+			})
+			rec.mu.Lock()
+			id := rec.data[i].(appwire.InboxAddedEvent).Item.ID
+			rec.mu.Unlock()
+			if tc.code == appwire.CodeBusy {
+				a := mustFind(t, b, agent.ID)
+				b.locked(func() { a.live.running = true })
+				defer b.locked(func() { a.live.running = false })
+			}
+			refused(t, b, id, tc.option, tc.text, tc.code)
+		})
+	}
+	t.Run("proposal needs option", func(t *testing.T) {
+		conv := &proposingConversation{fakeConversation: &fakeConversation{}, answer: helpersProposal}
+		b, rec, agent := proposingBackend(t, conv)
+		if err := b.CrewPropose(agent.ID); err != nil {
+			t.Fatal(err)
+		}
+		i := rec.waitFor(t, 5*time.Second, func(_ string, data any) bool {
+			v, ok := data.(appwire.InboxAddedEvent)
+			return ok && v.Item.Ask.Subkind == appwire.SubkindCrewProposal
+		})
+		rec.mu.Lock()
+		id := rec.data[i].(appwire.InboxAddedEvent).Item.ID
+		rec.mu.Unlock()
+		refused(t, b, id, "", "", appwire.CodeBadParams)
+	})
+	t.Run("service needs offered option", func(t *testing.T) {
+		w := newSvcWorld(t)
+		row := w.keep(t, w.agent.ID, service.PolicyNever)
+		w.rt.Failing(true)
+		for fails := 1; fails <= 3; fails++ {
+			w.check(t, w.agent.ID+":"+row.ID, fails)
+		}
+		i := w.rec.waitFor(t, 5*time.Second, func(_ string, data any) bool {
+			v, ok := data.(appwire.InboxAddedEvent)
+			return ok && v.Item.Ask.Subkind == appwire.SubkindServiceHealth
+		})
+		w.rec.mu.Lock()
+		id := w.rec.data[i].(appwire.InboxAddedEvent).Item.ID
+		w.rec.mu.Unlock()
+		for _, option := range []string{"invented", ""} {
+			refused(t, w.backend, id, option, "", appwire.CodeBadParams)
+		}
+	})
+	t.Run("order needs option", func(t *testing.T) {
+		b, rec, agent := workBackend(t, &fakeConversation{})
+		b.profileDir = t.TempDir()
+		store, err := automation.Open(t.TempDir())
+		if err != nil {
+			t.Fatal(err)
+		}
+		t.Cleanup(func() { store.Close() })
+		b.orderStore = func() *automation.Store { return store }
+		order, err := store.Create(automation.Automation{
+			Title: "weekly update", Schedule: automation.Schedule{Every: "1h", Zone: "UTC"},
+			Action: automation.Action{Do: "draft the update"}, Workspace: t.TempDir(),
+			Status: automation.StatusProposed, Trust: automation.TrustAsksFirst,
+			Origin: automation.Origin{Transcript: appFakeTranscript},
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := store.Ratify(order.ID); err != nil {
+			t.Fatal(err)
+		}
+		run, err := store.QueueAsking(order.ID)
+		if err != nil {
+			t.Fatal(err)
+		}
+		b.sayOrderAsks(store, map[int64]appwire.Ask{})
+		rec.waitFor(t, 5*time.Second, func(_ string, data any) bool { _, ok := data.(appwire.InboxAddedEvent); return ok })
+		refused(t, b, appInboxID(agent.ID, appOrderAskID(run.ID)), "", "", appwire.CodeBadParams)
+	})
+	t.Run("crew decision needs answer", func(t *testing.T) {
+		b, rec, agent, crew := crewBackend(t)
+		run := b.crews()
+		packet, err := teamstore.Raise(b.profileDir, teamstore.Packet{
+			Kind: teamstore.PacketQuestion, Team: teamstore.Person, Origin: crew,
+			RaisedBy: teamstore.FromManager, Question: "Which day?",
+			Options: []teamstore.Option{{ID: "fri", Label: "Friday", Consequence: "ship before the weekend"}},
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+		b.crewTick(run, false)
+		rec.waitFor(t, 5*time.Second, func(_ string, data any) bool { _, ok := data.(appwire.InboxAddedEvent); return ok })
+		id := appInboxID(agent.ID, appCrewAskPrefix+packet.ID)
+		refused(t, b, id, "", "", appwire.CodeBadParams)
+		until, err := b.AnswerInbox(id, "", "Friday", "", "")
+		if err != nil || until.IsZero() {
+			t.Fatalf("crew text-only answer = %v %v", until, err)
+		}
+		if err := b.UndoInbox(id); err != nil {
+			t.Fatal(err)
+		}
+	})
+}
+
+// Contract 2: invalid answers never enter the undo hold or reach the engine.
+func TestAppInboxRefusesInvalidAnswersBeforeHolding(t *testing.T) {
+	for _, scenario := range []string{"closed", "unoffered option", "unknown conversation", "empty consent", "empty task"} {
+		t.Run(scenario, func(t *testing.T) {
+			t.Setenv("CODEAF_HOME", t.TempDir())
+			conv := &fakeConversation{}
+			backend, rec, agent := workBackend(t, conv)
+			backend.profileDir = t.TempDir()
+			q := session.Question{ID: 9, Kind: session.QuestionAsk, Head: "Which store?", Options: []session.AnswerOption{{Key: "sqlite", Label: "SQLite"}}}
+			if scenario == "empty consent" {
+				q.Kind, q.Options = session.QuestionConsent, session.AnswerOptions(session.QuestionConsent)
+			} else if scenario == "empty task" {
+				q.Kind, q.Options = session.QuestionTask, session.AnswerOptions(session.QuestionTask)
+			}
+			conv.raise(session.Event{Kind: session.EventQuestion, Question: &q})
+			rec.waitFor(t, 5*time.Second, func(_ string, data any) bool { _, ok := data.(appwire.InboxAddedEvent); return ok })
+			id, option, want := appInboxID(agent.ID, "ask:9"), "sqlite", appwire.CodeNotFound
+			if strings.HasPrefix(scenario, "empty ") {
+				id, option, want = appInboxID(agent.ID, appAskID(q)), "", appwire.CodeBadParams
+			}
+			switch scenario {
+			case "closed":
+				conv.raise(session.Event{Kind: session.EventQuestionWithdrawn, Question: &q})
+				rec.waitFor(t, 5*time.Second, func(_ string, data any) bool { _, ok := data.(appwire.InboxResolvedEvent); return ok })
+			case "unoffered option":
+				option, want = "invented", appwire.CodeBadParams
+			case "unknown conversation":
+				id = "missing/ask:9"
+				backend.emit.Emit(appwire.EventAskOpened, appwire.AskOpened{Ask: appwire.Ask{ID: "ask:9", Agent: "missing", Options: []appwire.AskOption{{ID: "sqlite", Label: "SQLite"}}}})
+			}
+			until, err := backend.AnswerInbox(id, option, "", "", "")
+			undo := backend.UndoInbox(id)
+			if wireCode(err) != want || !until.IsZero() || wireCode(undo) != appwire.CodeNotFound {
+				t.Fatalf("answer = %v %v; Undo = %v; want immediate %s and no hold", until, err, undo, want)
+			}
+			conv.mu.Lock()
+			defer conv.mu.Unlock()
+			if len(conv.answers) != 0 {
+				t.Fatalf("validation sent answers: %+v", conv.answers)
+			}
+		})
+	}
+}
+
+// Contract 2: landing verdicts and fuel amounts are checked before any hold,
+// while valid answers keep the same Undo path and validation settles nothing.
+func TestAppInboxValidatesLandingAndFuelAnswers(t *testing.T) {
+	for _, tc := range []struct {
+		name              string
+		kind              session.QuestionKind
+		option, text, why string
+		valid             bool
+	}{
+		{"landing needs verdict", session.QuestionLanding, "", "", "", false},
+		{"landing text is not verdict", session.QuestionLanding, "", "looks good", "", false},
+		{"landing why is not verdict", session.QuestionLanding, "", "", "looks good", false},
+		{"landing tell needs words", session.QuestionLanding, session.LandingTellKey, "", "", false},
+		{"landing tell needs nonblank words", session.QuestionLanding, session.LandingTellKey, " \t", "\n", false},
+		{"conflict tell needs words", session.QuestionConflict, session.LandingTellKey, "", "", false},
+		{"fuel needs answer", session.QuestionFuel, "", "", "", false},
+		{"fuel needs gate words", session.QuestionFuel, "", "not money", "", false},
+		{"fuel amount alone is not answer", session.QuestionFuel, "", "2.50", "", false},
+		{"fuel topup needs money", session.QuestionFuel, "1", "not money", "", false},
+		{"fuel topup needs amount", session.QuestionFuel, "1", "", "", false},
+		{"fuel topup needs positive amount", session.QuestionFuel, "1", "0", "", false},
+		{"fuel topup rejects negative amount", session.QuestionFuel, "1", "-2.50", "", false},
+		{"fuel topup validates why", session.QuestionFuel, "1", "", "not money", false},
+		{"fuel typed topup needs money", session.QuestionFuel, "", "topup:not money", "", false},
+		{"fuel typed topup needs amount", session.QuestionFuel, "", "topup:", "", false},
+		{"fuel typed topup needs positive amount", session.QuestionFuel, "", "topup:0", "", false},
+		{"landing accept", session.QuestionLanding, session.LandingYesKey, "", "", true},
+		{"landing refuse with note", session.QuestionLanding, session.LandingNoKey, "try again", "", true},
+		{"landing tell words", session.QuestionLanding, session.LandingTellKey, "use the existing reader", "", true},
+		{"landing tell why", session.QuestionLanding, session.LandingTellKey, "", "use the existing reader", true},
+		{"conflict resolve", session.QuestionConflict, session.LandingYesKey, "", "", true},
+		{"fuel topup", session.QuestionFuel, "1", "2.50", "", true},
+		{"fuel topup dollars", session.QuestionFuel, "1", " $2.50 ", "", true},
+		{"fuel topup why", session.QuestionFuel, "1", "", "$2.50", true},
+		{"fuel finish with note", session.QuestionFuel, "2", "wrap up", "", true},
+		{"fuel stop", session.QuestionFuel, "3", "", "", true},
+		{"fuel typed finish", session.QuestionFuel, "", " FINISH ", "", true},
+		{"fuel typed stop", session.QuestionFuel, "", "stop", "", true},
+		{"fuel typed topup", session.QuestionFuel, "", " TOPUP: $2.50 ", "", true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Setenv("CODEAF_HOME", t.TempDir())
+			conv := &fakeConversation{}
+			b, rec, agent := workBackend(t, conv)
+			b.profileDir = t.TempDir()
+			q := session.Question{ID: 9, Kind: tc.kind, Head: "What next?", Options: session.AnswerOptions(tc.kind)}
+			conv.raise(session.Event{Kind: session.EventQuestion, Question: &q})
+			rec.waitFor(t, 5*time.Second, func(_ string, data any) bool { _, ok := data.(appwire.InboxAddedEvent); return ok })
+			id := appInboxID(agent.ID, appAskID(q))
+			until, err := b.AnswerInbox(id, tc.option, tc.text, tc.why, "")
+			undo := b.UndoInbox(id)
+			if tc.valid {
+				if err != nil || until.Before(time.Now().Add(4*time.Second)) || undo != nil {
+					t.Errorf("valid answer = %v %v; Undo = %v; want the normal hold", until, err, undo)
+				}
+			} else if wireCode(err) != appwire.CodeBadParams || !until.IsZero() || wireCode(undo) != appwire.CodeNotFound {
+				t.Errorf("invalid answer = %v %v; Undo = %v; want immediate bad_params and no hold", until, err, undo)
+			}
+			if items, counts, err := b.ListInbox(appwire.InboxWaiting, ""); err != nil || len(items) != 1 || counts.Waiting != 1 || counts.DoneToday != 0 {
+				t.Errorf("validation changed Waiting: %+v %+v %v", items, counts, err)
+			}
+			if done, _, err := b.ListInbox(appwire.InboxDone, ""); err != nil || len(done) != 0 {
+				t.Errorf("validation wrote Done: %+v %v", done, err)
+			}
+			if asks, err := b.ListAsks(agent.ID); err != nil || len(asks) != 1 || asks[0].ID != appAskID(q) {
+				t.Errorf("validation changed asks: %+v %v", asks, err)
+			}
+			a := mustFind(t, b, agent.ID)
+			b.locked(func() {
+				if len(a.live.answered) != 0 {
+					t.Errorf("validation marked answers: %+v", a.live.answered)
+				}
+			})
+			conv.mu.Lock()
+			defer conv.mu.Unlock()
+			if len(conv.answers) != 0 {
+				t.Errorf("validation sent answers: %+v", conv.answers)
+			}
+		})
+	}
+}
+
+// Contract 2: model answers and task redirects still accept words without a pick.
+func TestAppInboxRetainsFreeTextAnswers(t *testing.T) {
+	for _, kind := range []session.QuestionKind{session.QuestionAsk, session.QuestionTask} {
+		t.Run(string(kind), func(t *testing.T) {
+			t.Setenv("CODEAF_HOME", t.TempDir())
+			conv := &fakeConversation{}
+			b, rec, agent := workBackend(t, conv)
+			b.profileDir = t.TempDir()
+			q := session.Question{ID: 9, Kind: kind, Head: "What next?", Options: session.AnswerOptions(kind)}
+			conv.raise(session.Event{Kind: session.EventQuestion, Question: &q})
+			rec.waitFor(t, 5*time.Second, func(_ string, data any) bool { _, ok := data.(appwire.InboxAddedEvent); return ok })
+			id := appInboxID(agent.ID, appAskID(q))
+			until, err := b.AnswerInbox(id, "", "use the existing reader", "", "")
+			if err != nil || until.IsZero() {
+				t.Fatalf("text-only answer = %v %v", until, err)
+			}
+			if err := b.UndoInbox(id); err != nil {
+				t.Fatal(err)
+			}
+		})
+	}
+}
+
+// Contract 2: a valid answer is held, then sent once with its words intact.
+func TestAppInboxSendsAValidAnswerAfterTheHold(t *testing.T) {
+	t.Setenv("CODEAF_HOME", t.TempDir())
+	conv := &fakeConversation{}
+	backend, rec, agent := workBackend(t, conv)
+	backend.profileDir = t.TempDir()
+	answered := make(chan session.Answer, 1)
+	conv.mu.Lock()
+	conv.onAnswer = func(answer session.Answer) {
+		answered <- answer
+		q := session.Question{ID: answer.ID, Kind: answer.Kind}
+		conv.raise(session.Event{Kind: session.EventQuestionAnswered, Question: &q, Answer: &answer})
+	}
+	conv.mu.Unlock()
+	q := session.Question{ID: 9, Kind: session.QuestionAsk, Head: "Which store?", Options: []session.AnswerOption{{Key: "sqlite", Label: "SQLite"}}}
+	conv.raise(session.Event{Kind: session.EventQuestion, Question: &q})
+	rec.waitFor(t, 5*time.Second, func(_ string, data any) bool { _, ok := data.(appwire.InboxAddedEvent); return ok })
+	id := appInboxID(agent.ID, "ask:9")
+	until, err := backend.AnswerInbox(id, "sqlite", "keep the reader", "already supported", "")
+	if err != nil || until.Before(time.Now().Add(4*time.Second)) {
+		t.Fatalf("valid hold = %v %v", until, err)
+	}
+	select {
+	case answer := <-answered:
+		t.Fatalf("sent before the hold: %+v", answer)
+	default:
+	}
+	select {
+	case answer := <-answered:
+		if answer.Key != "sqlite" || answer.Change != "keep the reader\nalready supported" {
+			t.Fatalf("sent answer = %+v", answer)
+		}
+	case <-time.After(appInboxHold + 2*time.Second):
+		t.Fatal("the valid held answer was not sent")
+	}
+	rec.waitFor(t, 5*time.Second, func(_ string, data any) bool { _, ok := data.(appwire.InboxResolvedEvent); return ok })
+	if done, counts, err := backend.ListInbox(appwire.InboxDone, ""); err != nil || len(done) != 1 || counts.Waiting != 0 || counts.DoneToday != 1 {
+		t.Fatalf("Done = %+v %+v %v", done, counts, err)
+	}
+}
diff --git a/cmd/codeaf/appmoney.go b/cmd/codeaf/appmoney.go
index 72b02b3a57..39966d6726 100644
--- a/cmd/codeaf/appmoney.go
+++ b/cmd/codeaf/appmoney.go
@@ -277,6 +277,39 @@ func (b *appBackend) moneyAfter(a *appAgent, live *appLive, today float64) {
 	}
 }
 
+// appValidateMoneyAnswer checks the payload without changing a cap or an ask.
+func appValidateMoneyAnswer(scope, askID, option, text string, running bool) (float64, error) {
+	switch scope {
+	case appwire.CapAgent:
+		switch option {
+		case appwire.OptionRaise:
+			usd, ok := appParseUSD(text)
+			if !ok {
+				return 0, appwire.Errorf(appwire.CodeBadParams, "raise needs the new budget as text, such as \"8.00\"")
+			}
+			return usd, nil
+		case appwire.OptionStop:
+			return 0, nil
+		case appwire.OptionTell:
+			if strings.TrimSpace(text) == "" {
+				return 0, appwire.Errorf(appwire.CodeBadParams, "tell needs the words to tell it")
+			}
+			if running {
+				return 0, appwire.Errorf(appwire.CodeBusy, "this agent is still working on a turn; tell it when the turn ends")
+			}
+			return 0, nil
+		}
+		return 0, appwire.Errorf(appwire.CodeBadParams, "the ask %s offers raise, stop and tell", askID)
+	case appwire.CapDay:
+		if option == appwire.OptionRaiseToday || option == appwire.OptionWait {
+			usd, _ := appParseUSD(text)
+			return usd, nil
+		}
+		return 0, appwire.Errorf(appwire.CodeBadParams, "the ask %s offers raise_today and wait", askID)
+	}
+	return 0, appwire.Errorf(appwire.CodeNotFound, "the ask %s is not open", askID)
+}
+
 // answerMoney answers one of this process's budget asks, and says whether the
 // ask was one.
 func (b *appBackend) answerMoney(a *appAgent, askID, option, text string) (bool, error) {
@@ -294,15 +327,15 @@ func (b *appBackend) answerMoney(a *appAgent, askID, option, text string) (bool,
 	if !found {
 		return false, nil
 	}
+	usd, err := appValidateMoneyAnswer(open.scope, askID, option, text, running)
+	if err != nil {
+		return true, err
+	}
 	now := b.now()
 	switch open.scope {
 	case appwire.CapAgent:
 		switch option {
 		case appwire.OptionRaise:
-			usd, ok := appParseUSD(text)
-			if !ok {
-				return true, appwire.Errorf(appwire.CodeBadParams, "raise needs the new budget as text, such as \"8.00\"")
-			}
 			return true, b.RaiseCap(appwire.CapRaise{Scope: appwire.CapAgent, ID: id, ToUSD: usd, For: appwire.RaiseGood})
 		case appwire.OptionStop:
 			if running {
@@ -313,12 +346,6 @@ func (b *appBackend) answerMoney(a *appAgent, askID, option, text string) (bool,
 			return true, nil
 		case appwire.OptionTell:
 			words := strings.TrimSpace(text)
-			if words == "" {
-				return true, appwire.Errorf(appwire.CodeBadParams, "tell needs the words to tell it")
-			}
-			if running {
-				return true, appwire.Errorf(appwire.CodeBusy, "this agent is still working on a turn; tell it when the turn ends")
-			}
 			b.closeMoneyAsks(a, appwire.CapAgent, appwire.OptionTell, "Told it")
 			guard.Go("app/tell", func() { _, _ = b.Send(id, words, "") })
 			return true, nil
@@ -327,8 +354,7 @@ func (b *appBackend) answerMoney(a *appAgent, askID, option, text string) (bool,
 	case appwire.CapDay:
 		switch option {
 		case appwire.OptionRaiseToday:
-			usd, ok := appParseUSD(text)
-			if !ok {
+			if usd == 0 {
 				// Nothing typed raises the cap by itself again: twice the
 				// cap, for the rest of today.
 				limit, err := b.dayCap(now)
diff --git a/cmd/codeaf/apporders.go b/cmd/codeaf/apporders.go
index 064115e01e..49d0bd5ddb 100644
--- a/cmd/codeaf/apporders.go
+++ b/cmd/codeaf/apporders.go
@@ -522,10 +522,8 @@ func (b *appBackend) answerOrderAsk(askID, option string) (bool, error) {
 	if err != nil {
 		return true, appwire.Errorf(appwire.CodeNotFound, "the ask %s is not open", askID)
 	}
-	switch option {
-	case appwire.VerdictGo, appwire.VerdictSkip, appwire.VerdictNotRight:
-	default:
-		return true, appwire.Errorf(appwire.CodeBadParams, "the ask %s offers go, skip or not_right", askID)
+	if err := appValidateOrderAnswer(askID, option); err != nil {
+		return true, err
 	}
 	_, err = b.OrderVerdict(r.AutomationID, run, option)
 	if err == nil {
@@ -534,6 +532,14 @@ func (b *appBackend) answerOrderAsk(askID, option string) (bool, error) {
 	return true, err
 }
 
+func appValidateOrderAnswer(id, option string) error {
+	switch option {
+	case appwire.VerdictGo, appwire.VerdictSkip, appwire.VerdictNotRight:
+		return nil
+	}
+	return appwire.Errorf(appwire.CodeBadParams, "the ask %s offers go, skip or not_right", id)
+}
+
 // appOrderAnswered is the runs this app answered, with the option, so the
 // ask's closing says it was answered here.
 var appOrderAnswered sync.Map
diff --git a/cmd/codeaf/appservices.go b/cmd/codeaf/appservices.go
index 034d00db84..3cfd4136f5 100644
--- a/cmd/codeaf/appservices.go
+++ b/cmd/codeaf/appservices.go
@@ -518,6 +518,9 @@ func (b *appBackend) answerInboxItem(id, agent, ask string, answer appwire.AskAn
 	if !ok {
 		return b.AnswerAskWith(agent, ask, answer)
 	}
+	if err := appValidateServiceAnswer(answer.Option); err != nil {
+		return err
+	}
 	local, _, _ := strings.Cut(episode, ".")
 	process := agent + ":" + local
 	var err error
@@ -540,6 +543,14 @@ func (b *appBackend) answerInboxItem(id, agent, ask string, answer appwire.AskAn
 	return err
 }
 
+func appValidateServiceAnswer(option string) error {
+	switch option {
+	case appwire.OptionRestart, appwire.OptionStop:
+		return nil
+	}
+	return appwire.Errorf(appwire.CodeBadParams, "a kept-running process is answered restart or stop")
+}
+
 // laterServiceItem puts a service's line aside, or back. It answers false
 // for an item that is not a service's.
 func (b *appBackend) laterServiceItem(id, ask string, later bool) (bool, error) {
diff --git a/docs/changes/unreleased/0-app-inbox-answer-validation.md b/docs/changes/unreleased/0-app-inbox-answer-validation.md
new file mode 100644
index 0000000000..eb1cdbd798
--- /dev/null
+++ b/docs/changes/unreleased/0-app-inbox-answer-validation.md
@@ -0,0 +1,8 @@
+---
+kind: fixed
+title: Refuse invalid app Inbox answers before starting Undo
+pr: 0
+surface: [engine]
+invalidates:
+  - "An Inbox answer returned an undo deadline before checking whether its conversation and question were reachable or its payload was valid. Preflight now shares the answer handlers' budget, required-option, landed-task verdict, Tell words, fuel amount and permission-scope checks and validates supervisor answers before the hold. Valid answers retain the five-second Undo hold; failures arising during that hold still have no separate failure event."
+---
diff --git a/internal/manual/chat/permissions.md b/internal/manual/chat/permissions.md
index 414db13e74..d0d6cb111c 100644
--- a/internal/manual/chat/permissions.md
+++ b/internal/manual/chat/permissions.md
@@ -1245,3 +1245,21 @@ still asks, with the closest saved rule it falls outside (the longest rule for
 the same program). Non-shell calls and commands with no same-program rule have
 no outside-rule explanation. If saving fails, the question stays open and the desktop gets an
 error. Nothing is silently widened to all bash commands.
+
+## Desktop Inbox — invalid answers and the five-second Undo hold
+
+An Inbox answer is checked before its five-second Undo hold starts. If the
+question has closed, the chosen option is not offered, or its conversation
+cannot be reached, the request returns the error immediately. Permission scopes,
+required options and budget payloads are checked before the hold too: raising an
+agent budget needs a positive amount, and Tell needs words and an idle agent.
+Service health answers must choose Restart or Stop, and standing order runs need
+an offered verdict. A crew decision needs an option or answer text. Landed tasks
+need an offered verdict, and Tell needs words. Fuel top-ups need a positive dollar
+amount; finishing or stopping needs no amount. Text-only model answers and task
+redirects remain supported. A valid answer waits five seconds; Undo during that
+hold leaves the question waiting and sends nothing.
+
+A question can close or its conversation can fail during those five seconds.
+The eventual send still checks it again; the app protocol does not publish a
+separate deferred-send failure event.

From 0ff126e535ec5f95cc4c8da5e396f4e30e7b0132 Mon Sep 17 00:00:00 2001
From: Abir Abbas <abirabbas1998@gmail.com>
Date: Wed, 28 Oct 2026 14:08:44 -0400
Subject: [PATCH 3/6] app: Hold holds a model question's clock

asks.hold answered success for a clocked model question but only held task
proposals, so the clock still picked the suggestion. Use the question
holder the terminal uses, and restate a changed question under its own id
while identical replays stay silent.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 cmd/codeaf/app.go                             |  14 +-
 cmd/codeaf/appconvo.go                        |  14 +-
 cmd/codeaf/appquestionhold_test.go            | 178 ++++++++++++++++++
 .../unreleased/0-app-model-question-hold.md   |   8 +
 internal/manual/chat/questions.md             |   8 +
 5 files changed, 215 insertions(+), 7 deletions(-)
 create mode 100644 cmd/codeaf/appquestionhold_test.go
 create mode 100644 docs/changes/unreleased/0-app-model-question-hold.md

diff --git a/cmd/codeaf/app.go b/cmd/codeaf/app.go
index a144921e6e..20a13a3ef1 100644
--- a/cmd/codeaf/app.go
+++ b/cmd/codeaf/app.go
@@ -37,6 +37,7 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
+	"reflect"
 	"slices"
 	"sort"
 	"strconv"
@@ -2004,18 +2005,20 @@ func (b *appBackend) questionEvent(a *appAgent, id string, live *appLive, event
 		}
 		ask := appAskOf(id, q)
 		appAskFacts(id, &ask, q)
-		defer b.restateBatch(live, q)
-		restated, moved := false, false
+		restated, changed, moved := false, false, false
 		var view appwire.Agent
 		b.locked(func() {
 			ask.HoldingUp = askHoldingUpLocked(live, ask)
 			if _, open := live.questions[askID]; open {
-				// The lane replays what is open when it is subscribed again,
-				// and a question restated in place is the same ask.
+				// Identical subscription replays say nothing new. A changed
+				// question, such as a held clock, restates the same ask id.
 				restated = true
 				live.questions[askID] = q
+				ask.Batch, _ = b.batchLocked(live, q)
 				for i := range live.asks {
 					if live.asks[i].ID == askID {
+						ask.Later = live.asks[i].Later
+						changed = !reflect.DeepEqual(live.asks[i], ask)
 						live.asks[i] = ask
 					}
 				}
@@ -2025,13 +2028,14 @@ func (b *appBackend) questionEvent(a *appAgent, id string, live *appLive, event
 			live.asks = append(live.asks, ask)
 			view, moved = b.restateLocked(a, live)
 		})
-		if restated {
+		if restated && !changed {
 			return
 		}
 		live.box.Event(appwire.EventAskOpened, appwire.AskOpened{Ask: ask})
 		if moved {
 			live.box.Event(appwire.EventAgentChanged, appwire.AgentChanged{Agent: view})
 		}
+		b.restateBatch(live, q)
 	case session.EventQuestionAnswered, session.EventQuestionWithdrawn:
 		open, moved := false, false
 		by, option := appwire.ClosedByElsewhere, ""
diff --git a/cmd/codeaf/appconvo.go b/cmd/codeaf/appconvo.go
index d1f6cbaa16..0e88840fce 100644
--- a/cmd/codeaf/appconvo.go
+++ b/cmd/codeaf/appconvo.go
@@ -788,8 +788,8 @@ func (b *appBackend) AnswerAskWith(agent, id string, answer appwire.AskAnswer) e
 // appDecideMark marks an ask the person handed back to the agent's own pick.
 const appDecideMark = "decide:"
 
-// HoldAsk stops an ask's clock. Only a proposed task has one: its hold is the
-// task's own.
+// HoldAsk stops an ask's clock through its owning lane. Proposed tasks keep
+// their task action; the model's questions use the engine's question hold.
 func (b *appBackend) HoldAsk(agent, id string) error {
 	a, err := b.findCrewOwner(agent)
 	if err != nil {
@@ -805,6 +805,16 @@ func (b *appBackend) HoldAsk(agent, id string) error {
 	if !open {
 		return appwire.Errorf(appwire.CodeNotFound, "the ask %s is not open", id)
 	}
+	if q.Kind == session.QuestionAsk {
+		holder, ok := live.conn.Conv.(interface {
+			HoldQuestion(session.QuestionKind, string)
+		})
+		if !ok {
+			return appwire.Errorf(appwire.CodeEngine, "this conversation cannot hold a question's clock")
+		}
+		holder.HoldQuestion(q.Kind, q.Token())
+		return nil
+	}
 	if q.Kind != session.QuestionTask || q.Deadline.IsZero() {
 		return nil
 	}
diff --git a/cmd/codeaf/appquestionhold_test.go b/cmd/codeaf/appquestionhold_test.go
new file mode 100644
index 0000000000..48af097654
--- /dev/null
+++ b/cmd/codeaf/appquestionhold_test.go
@@ -0,0 +1,178 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/Agent-Field/codeaf/internal/appwire"
+	"github.com/Agent-Field/codeaf/internal/config"
+	"github.com/Agent-Field/codeaf/internal/remote"
+	"github.com/Agent-Field/codeaf/internal/session"
+)
+
+// Contract 3 and 5: app Hold reaches the terminal engine's question clock;
+// unheld clocks still take their suggestion through that same engine.
+func TestAppModelQuestionHoldStopsTheEngineClock(t *testing.T) {
+	for _, hold := range []bool{true, false} {
+		t.Run(fmt.Sprintf("hold=%v", hold), func(t *testing.T) {
+			root := t.TempDir()
+			t.Setenv("CODEAF_HOME", root)
+			t.Setenv(config.ProfileDirEnv, root)
+			var calls atomic.Int32
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.Method != http.MethodPost {
+					w.Header().Set("Content-Type", "application/json")
+					fmt.Fprint(w, `{"data":[]}`)
+					return
+				}
+				w.Header().Set("Content-Type", "text/event-stream")
+				var delta any
+				finish := "tool_calls"
+				switch calls.Add(1) {
+				case 1:
+					delta = map[string]any{"tool_calls": []any{map[string]any{"index": 0, "id": "load", "type": "function", "function": map[string]string{"name": "load_capability", "arguments": `{"group":"questions"}`}}}}
+				case 2:
+					delta = map[string]any{"tool_calls": []any{map[string]any{"index": 0, "id": "choose", "type": "function", "function": map[string]string{"name": "ask", "arguments": `{"head":"Which store?","kind":"choice","reason":"Both fit","stakes":"reversible","options":[{"key":"sqlite","label":"SQLite"},{"key":"jsonl","label":"JSONL"}],"pick":{"key":"sqlite","reason":"Existing readers"}}`}}}}
+				default:
+					delta, finish = map[string]string{"content": "done"}, "stop"
+				}
+				chunk, _ := json.Marshal(map[string]any{"id": "clock", "choices": []any{map[string]any{"index": 0, "delta": delta}}})
+				fmt.Fprintf(w, "data: %s\n\ndata: {\"id\":\"clock\",\"choices\":[{\"index\":0,\"delta\":{},\"finish_reason\":%q}]}\n\ndata: [DONE]\n\n", chunk, finish)
+			}))
+			defer server.Close()
+			engine, err := session.New(session.Config{Workspace: root, Place: session.Place{Dir: filepath.Join(root, "chat"), Workspace: root}, ProfileDir: root, Model: "test/model", APIKey: "dummy", BaseURL: server.URL, Interactive: true, OneModel: true, DeterministicNames: true, ChoiceClockSeconds: 1})
+			if err != nil {
+				t.Fatal(err)
+			}
+			loop, err := remote.Loopback(remote.Hello{Version: remote.Version}, remote.Options{Boot: func(remote.Hello) (*remote.Engine, error) { return &remote.Engine{Agent: engine}, nil }})
+			if err != nil {
+				engine.Close()
+				t.Fatal(err)
+			}
+			defer loop.Close()
+			rec := newAppRecorder()
+			backend := newFakeBackend(rec, func(ask appOpenAsk) (*appConn, error) {
+				return &appConn{Conv: loop.Client.Agent(), Workspace: root, Transcript: appFakeTranscript, Release: func() {}}, nil
+			})
+			backend.profileDir = root
+			defer backend.Close()
+			agent, err := mustCreate(t, backend, appwire.CreateAsk{Workspace: root})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if _, err := backend.Send(agent.ID, "Choose a store with the ask tool.", ""); err != nil {
+				t.Fatal(err)
+			}
+			i := rec.waitFor(t, 5*time.Second, appAskEvent(appwire.EventAskOpened))
+			rec.mu.Lock()
+			ask := rec.data[i].(appwire.AskOpened).Ask
+			rec.mu.Unlock()
+			if ask.ClockUntil == nil {
+				t.Fatal("the question has no clock")
+			}
+			if !hold {
+				rec.waitFor(t, 5*time.Second, appAskEvent(appwire.EventAskClosed))
+				decisions := engine.Decisions()
+				if len(decisions) != 1 || len(decisions[0].Picked) != 1 || decisions[0].Picked[0] != "1" || len(decisions[0].Labels) != 1 || decisions[0].Labels[0] != "SQLite" {
+					t.Fatalf("unheld clock decisions = %+v", decisions)
+				}
+				return
+			}
+			if err := backend.HoldAsk(agent.ID, ask.ID); err != nil {
+				t.Fatal(err)
+			}
+			rec.waitFor(t, 2*time.Second, func(event string, data any) bool {
+				v, ok := data.(appwire.AskOpened)
+				return ok && v.Ask.ID == ask.ID && v.Ask.ClockUntil == nil
+			})
+			time.Sleep(time.Until(*ask.ClockUntil) + 100*time.Millisecond)
+			if open := engine.OpenQuestions(); len(open) != 1 || !open[0].Deadline.IsZero() || len(engine.Decisions()) != 0 {
+				t.Fatalf("held engine question = %+v; decisions = %+v", open, engine.Decisions())
+			}
+			if open, err := backend.ListAsks(agent.ID); err != nil || len(open) != 1 || open[0].ID != ask.ID || open[0].ClockUntil != nil {
+				t.Fatalf("held asks.list = %+v %v", open, err)
+			}
+			if waiting, _, err := backend.ListInbox(appwire.InboxWaiting, ""); err != nil || len(waiting) != 1 || waiting[0].Ask.ClockUntil != nil {
+				t.Fatalf("held Inbox = %+v %v", waiting, err)
+			}
+			// An identical lane replay must not publish another opening.
+			a := mustFind(t, backend, agent.ID)
+			q := engine.OpenQuestions()[0]
+			backend.questionEvent(a, agent.ID, backend.liveOf(a), session.Event{Kind: session.EventQuestion, Question: &q})
+			rec.mu.Lock()
+			defer rec.mu.Unlock()
+			opened := 0
+			for _, event := range rec.events {
+				if event == appwire.EventAskOpened {
+					opened++
+				}
+			}
+			if opened != 2 {
+				t.Fatalf("initial + Hold + identical replay emitted %d openings, want 2", opened)
+			}
+		})
+	}
+}
+
+// Contract 3: task proposal Hold retains its existing task action.
+func TestAppTaskQuestionHoldKeepsTheTaskDoor(t *testing.T) {
+	t.Setenv("CODEAF_HOME", t.TempDir())
+	conv := &fakeConversation{}
+	backend, rec, agent := workBackend(t, conv)
+	backend.profileDir = t.TempDir()
+	q := session.Question{ID: 4, Kind: session.QuestionTask, Head: "Start the task?", Deadline: time.Now().Add(time.Hour)}
+	conv.raise(session.Event{Kind: session.EventQuestion, Question: &q})
+	rec.waitFor(t, 5*time.Second, appAskEvent(appwire.EventAskOpened))
+	if err := backend.HoldAsk(agent.ID, "task:4"); err != nil {
+		t.Fatal(err)
+	}
+	conv.mu.Lock()
+	defer conv.mu.Unlock()
+	if len(conv.intents) != 1 || conv.intents[0].ID != "4" || conv.intents[0].Action != "hold" || len(conv.answers) != 0 {
+		t.Fatalf("task Hold = %+v; answers = %+v", conv.intents, conv.answers)
+	}
+}
+
+// Contract 3: replaying either consent sibling preserves grouping silently.
+func TestAppQuestionReplayDoesNotRepeatTheBatch(t *testing.T) {
+	t.Setenv("CODEAF_HOME", t.TempDir())
+	backend, rec, agent := workBackend(t, &fakeConversation{})
+	backend.profileDir = t.TempDir()
+	a := mustFind(t, backend, agent.ID)
+	live := backend.liveOf(a)
+	questions := []session.Question{
+		{ID: 1, Kind: session.QuestionConsent, Batch: "tools", Head: "First call", Options: session.AnswerOptions(session.QuestionConsent)},
+		{ID: 2, Kind: session.QuestionConsent, Batch: "tools", Head: "Second call", Options: session.AnswerOptions(session.QuestionConsent)},
+	}
+	for range 2 {
+		for _, q := range questions {
+			backend.questionEvent(a, agent.ID, live, session.Event{Kind: session.EventQuestion, Question: &q})
+		}
+	}
+	// Drain the ordered event queue before counting the observable openings.
+	live.box.Close()
+	openings, batchless := 0, 0
+	rec.mu.Lock()
+	for _, data := range rec.data {
+		if v, ok := data.(appwire.AskOpened); ok {
+			openings++
+			if len(v.Ask.Batch) == 0 {
+				batchless++
+			}
+		}
+	}
+	rec.mu.Unlock()
+	if openings != 4 || batchless != 2 {
+		t.Fatalf("two initial asks + grouping + identical replays = %d openings (%d batchless); want 4 (2 batchless)", openings, batchless)
+	}
+	asks, err := backend.ListAsks(agent.ID)
+	if err != nil || len(asks) != 2 || len(asks[0].Batch) != 2 || len(asks[1].Batch) != 2 {
+		t.Fatalf("replayed asks = %+v %v", asks, err)
+	}
+}
diff --git a/docs/changes/unreleased/0-app-model-question-hold.md b/docs/changes/unreleased/0-app-model-question-hold.md
new file mode 100644
index 0000000000..458eb02778
--- /dev/null
+++ b/docs/changes/unreleased/0-app-model-question-hold.md
@@ -0,0 +1,8 @@
+---
+kind: fixed
+title: Hold model question clocks in the app engine
+pr: 0
+surface: [engine]
+invalidates:
+  - "App Hold reported success on a model question while its clock kept running. It now uses the engine's existing HoldQuestion door and publishes the changed question under its existing ask id, so the chat and Inbox remove the deadline. Identical question replays remain deduplicated and task proposal Hold keeps its existing task action."
+---
diff --git a/internal/manual/chat/questions.md b/internal/manual/chat/questions.md
index 49e1f4e633..33adb6a85c 100644
--- a/internal/manual/chat/questions.md
+++ b/internal/manual/chat/questions.md
@@ -1448,3 +1448,11 @@ Saving is not forever: pausing or deleting one later is `/automations`, or askin
 (*Automations*). A rule such as "always use tabs" is not an automation — it has no
 time and nothing to run — so it is kept as a memory, with `/remember` (*Rules are not
 automations*).
+
+## Desktop Hold — stop a model question's countdown
+
+Hold on a model question stops its clock in the engine without answering it.
+The same question stays open past its original deadline. Its countdown goes
+away in the chat and Inbox, and later listings keep showing it without a clock.
+Hold on a task proposal still uses the task's existing hold action. A clock
+that has not been held still takes its declared suggestion when it expires.

From 5145c431354feed60890d49459e648bfbded5947 Mon Sep 17 00:00:00 2001
From: Abir Abbas <abirabbas1998@gmail.com>
Date: Wed, 28 Oct 2026 14:08:44 -0400
Subject: [PATCH 4/6] app: announce a model listing that finishes late

models.list answers within about three seconds with what it has; when a
slow provider listing finished later, nothing told the desktop. Emit one
models.changed per completion from a lifecycle-owned subscription, sent
outside the backend lock and stopped on close. No polling and no extra wait
in models.list.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 cmd/codeaf/app.go                             |  11 +
 cmd/codeaf/appmodelsnotice.go                 |  73 ++++
 cmd/codeaf/appmodelsnotice_test.go            | 320 ++++++++++++++++++
 .../unreleased/0-app-late-model-list.md       |   8 +
 docs/design/app-v3/PROTOCOL.md                |   9 +
 internal/appwire/events.go                    |   1 +
 internal/appwire/server.go                    |  27 +-
 internal/appwire/wire.go                      |   1 +
 internal/manual/chat/quick-switch-models.md   |   8 +
 9 files changed, 454 insertions(+), 4 deletions(-)
 create mode 100644 cmd/codeaf/appmodelsnotice.go
 create mode 100644 cmd/codeaf/appmodelsnotice_test.go
 create mode 100644 docs/changes/unreleased/0-app-late-model-list.md

diff --git a/cmd/codeaf/app.go b/cmd/codeaf/app.go
index 20a13a3ef1..54e4d9cfa0 100644
--- a/cmd/codeaf/app.go
+++ b/cmd/codeaf/app.go
@@ -665,6 +665,9 @@ type appBackend struct {
 	// providerWarm closes when the latest fetch of the providers' model lists
 	// is over ([appBackend.warmProviderModels]); models.list waits a moment for it.
 	providerWarm chan struct{}
+	// stopModelNotices removes the model completion subscription and joins
+	// the initial catalog waiter and cancellable sender when this app closes.
+	stopModelNotices func()
 	// state is the app's own file: setup, its settings, budgets and raises.
 	state *appState
 	// dayAuth is the daily limit's one-time hand-over from this file's old cap.
@@ -3905,6 +3908,9 @@ func (b *appBackend) process() (*v3Process, error) {
 // opened — the keys a launch hands over, a setup finished on its first screen
 // — would otherwise offer nothing in models.list until the next fetch.
 func (b *appBackend) markAssembled() {
+	if proc := openedEngineProcess(); proc != nil {
+		b.watchModelCompletions(proc)
+	}
 	if !b.assembled.Swap(true) {
 		b.warmProviderModels()
 	}
@@ -4246,6 +4252,7 @@ func (b *appBackend) Close() error {
 	var agents []*appAgent
 	var warmed chan struct{}
 	var balances *appBalances
+	var stopModelNotices func()
 	b.locked(func() {
 		if already = b.closing; already {
 			return
@@ -4262,6 +4269,7 @@ func (b *appBackend) Close() error {
 			b.accountAuth.flow.Cancel()
 		}
 		crews, warmed, balances = b.crewRun, b.warmed, b.balances
+		stopModelNotices = b.stopModelNotices
 		if b.signIn != nil {
 			b.signIn.Cancel()
 			b.signIn = nil
@@ -4282,6 +4290,9 @@ func (b *appBackend) Close() error {
 		b.stopSyncedSettings()
 	}
 	b.closeChats()
+	if stopModelNotices != nil {
+		stopModelNotices()
+	}
 	if b.devices != nil {
 		b.devices.close()
 	}
diff --git a/cmd/codeaf/appmodelsnotice.go b/cmd/codeaf/appmodelsnotice.go
new file mode 100644
index 0000000000..e45f66f77d
--- /dev/null
+++ b/cmd/codeaf/appmodelsnotice.go
@@ -0,0 +1,73 @@
+package main
+
+import (
+	"context"
+
+	"github.com/Agent-Field/codeaf/internal/appwire"
+	"github.com/Agent-Field/codeaf/internal/guard"
+)
+
+// appModelNoticeDelivery lets Close cancel a sender waiting on the wire queue.
+// Recorders may implement only Emit; the production wire supports cancellation.
+type appModelNoticeDelivery struct {
+	ctx  context.Context
+	emit appwire.Emitter
+}
+
+func (d appModelNoticeDelivery) Emit(event string, data any) {
+	if d.ctx.Err() != nil {
+		return
+	}
+	if emit, ok := d.emit.(interface {
+		EmitContext(context.Context, string, any)
+	}); ok {
+		emit.EmitContext(d.ctx, event, data)
+		return
+	}
+	d.emit.Emit(event, data)
+}
+
+// watchModelCompletions joins the terminal's service-model notifications once
+// per app lifetime. The initial lazy catalog has its own completion door, so
+// one cancellable waiter covers it before any provider warm can finish.
+func (b *appBackend) watchModelCompletions(proc *v3Process) {
+	b.locked(func() {
+		if b.closing || b.stopModelNotices != nil {
+			return
+		}
+		ctx, cancel := context.WithCancel(context.Background())
+		// Model notices do not change Inbox state. Queue them to its final
+		// emitter, retaining the wire's cancellable delivery door.
+		box := appwire.NewOutbox(appModelNoticeDelivery{ctx: ctx, emit: b.inbox.next})
+		tell := func(string, string) {
+			// Only admission is serialized with Close; stdout never owns b.mu.
+			b.locked(func() {
+				if !b.closing {
+					box.Event(appwire.EventModelsChanged, appwire.Empty{})
+				}
+			})
+		}
+		remove := proc.registerServiceNotice(tell)
+		done := make(chan struct{})
+		b.stopModelNotices = func() {
+			cancel()
+			remove()
+			<-done
+			box.Close()
+		}
+		// A catalog already in hand needs no notification: the first list can
+		// read it. A cancelled context makes this readiness probe nonblocking.
+		ready, stopReady := context.WithCancel(context.Background())
+		stopReady()
+		if proc.Models == nil || proc.Models.Warmed(ready) {
+			close(done)
+			return
+		}
+		guard.Go("app/models-completion", func() {
+			defer close(done)
+			if proc.Models.Warmed(ctx) && ctx.Err() == nil {
+				tell("", "")
+			}
+		})
+	})
+}
diff --git a/cmd/codeaf/appmodelsnotice_test.go b/cmd/codeaf/appmodelsnotice_test.go
new file mode 100644
index 0000000000..05802d468b
--- /dev/null
+++ b/cmd/codeaf/appmodelsnotice_test.go
@@ -0,0 +1,320 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/Agent-Field/codeaf/internal/appwire"
+	"github.com/Agent-Field/codeaf/internal/catalog"
+	"github.com/Agent-Field/codeaf/internal/config"
+)
+
+type appModelNoticeEmitter struct {
+	*appRecorder
+	wire *appwire.Server
+}
+
+func (e appModelNoticeEmitter) Emit(event string, data any) {
+	e.appRecorder.Emit(event, data)
+	e.wire.Emit(event, data)
+}
+
+// delayedAppModels seats a lazy process catalog behind the app backend, with
+// its listing held until release. Unrelated process startup must not consume
+// the listing timeout before this test reaches its three-second list call.
+func delayedAppModels(t *testing.T) (*appBackend, *appRecorder, func()) {
+	t.Helper()
+	wakeEnvironment(t, resolvedTempDir(t))
+	release := make(chan struct{})
+	var once sync.Once
+	unblock := func() { once.Do(func() { close(release) }) }
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		select {
+		case <-release:
+		case <-r.Context().Done():
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		io.WriteString(w, `{"data":[{"id":"vendor/alpha","name":"Alpha"},{"id":"vendor/beta","name":"Beta"}]}`)
+	}))
+	t.Cleanup(server.Close)
+	t.Cleanup(unblock)
+	t.Setenv("CODEAF_BASE_URL", server.URL)
+	t.Setenv("CODEAF_MODEL", "vendor/alpha")
+	settings, err := config.LoadKeyless()
+	if err != nil {
+		t.Fatal(err)
+	}
+	options := catalog.Options{BaseURL: server.URL, APIKey: settings.APIKey, Dir: settings.ProfileDir, HTTPClient: &http.Client{Timeout: time.Minute}}
+	models := catalog.LoadLazy(t.Context(), options)
+	proc := &v3Process{Settings: settings, ProfileDir: settings.ProfileDir, Models: models, Shelf: newV3ModelShelf(models, options)}
+	proc.Shelf.setSources(settings.Sources)
+	engineProcess.mu.Lock()
+	engineProcess.proc, engineProcess.tried = proc, true
+	engineProcess.mu.Unlock()
+	rec := newAppRecorder()
+	backend := newAppBackend(rec, appOpenInProcess)
+	t.Cleanup(func() { backend.Close() })
+	return backend, rec, unblock
+}
+
+func appModelsChangedCount(rec *appRecorder) int {
+	rec.mu.Lock()
+	defer rec.mu.Unlock()
+	count := 0
+	for _, event := range rec.events {
+		if event == "models.changed" {
+			count++
+		}
+	}
+	return count
+}
+
+// Contract 4: a list bounded at three seconds gets one completion notice on
+// the actual wire; the next list includes the late rows without another fetch.
+func TestAppLateModelsEmitOneCompletionOnTheWire(t *testing.T) {
+	backend, rec, release := delayedAppModels(t)
+	var output bytes.Buffer
+	wire := appwire.NewServer(&output)
+	backend.emit = backend.newAppInbox(appModelNoticeEmitter{rec, wire})
+	in, input := io.Pipe()
+	done := make(chan struct{})
+	var serveErr error
+	go func() {
+		serveErr = wire.Serve(context.Background(), in, appwire.Hello{Version: "test"}, backend)
+		close(done)
+	}()
+	defer func() { input.Close(); <-done }()
+
+	backend.Warm()
+	first, err := backend.ListModels()
+	if err != nil || len(first) != 1 || first[0].ID != "vendor/alpha" || appModelsChangedCount(rec) != 0 {
+		t.Fatalf("initial bounded list = %+v %v; notices = %d", first, err, appModelsChangedCount(rec))
+	}
+	release()
+	rec.waitFor(t, 5*time.Second, func(event string, _ any) bool { return event == "models.changed" })
+	for range 2 {
+		models, err := backend.ListModels()
+		if err != nil || len(models) != 2 {
+			t.Fatalf("late list = %+v %v", models, err)
+		}
+	}
+	if count := appModelsChangedCount(rec); count != 1 {
+		t.Fatalf("one completion emitted %d notices", count)
+	}
+	proc := openedEngineProcess()
+	callbacks := proc.serviceNoticesSnapshot()
+	if len(callbacks) != 1 {
+		t.Fatalf("app registered %d service-model subscriptions, want 1", len(callbacks))
+	}
+	if err := backend.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if left := len(proc.serviceNoticesSnapshot()); left != 0 {
+		t.Fatalf("close left %d model subscriptions", left)
+	}
+	for _, callback := range callbacks {
+		callback("provider", "fixture")
+	}
+	if count := appModelsChangedCount(rec); count != 1 {
+		t.Fatalf("an in-flight callback emitted after close: %d notices", count)
+	}
+	input.Close()
+	<-done
+	if serveErr != nil {
+		t.Fatal(serveErr)
+	}
+	changed := 0
+	for _, line := range bytes.Split(bytes.TrimSpace(output.Bytes()), []byte{'\n'}) {
+		var frame struct {
+			Event string          `json:"event"`
+			Seq   uint64          `json:"seq"`
+			Data  json.RawMessage `json:"data"`
+		}
+		if err := json.Unmarshal(line, &frame); err != nil {
+			t.Fatal(err)
+		}
+		if frame.Event == "models.changed" {
+			changed++
+			if frame.Seq == 0 || string(frame.Data) != "{}" {
+				t.Fatalf("completion frame = %s", line)
+			}
+		}
+	}
+	if changed != 1 {
+		t.Fatalf("wire carried %d completion events", changed)
+	}
+}
+
+// Contract 4: a pending discovery owns no app worker or callback after Close.
+func TestAppCloseCancelsPendingModelNotification(t *testing.T) {
+	backend, rec, release := delayedAppModels(t)
+	backend.Warm()
+	proc := openedEngineProcess()
+	callbacks := proc.serviceNoticesSnapshot()
+	if len(callbacks) != 1 {
+		t.Fatalf("app registered %d subscriptions, want 1", len(callbacks))
+	}
+	closed := make(chan error, 1)
+	go func() { closed <- backend.Close() }()
+	select {
+	case err := <-closed:
+		if err != nil {
+			t.Fatal(err)
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("Close waited for the provider listing")
+	}
+	if left := len(proc.serviceNoticesSnapshot()); left != 0 {
+		t.Fatalf("close left %d subscriptions", left)
+	}
+	release()
+	if !proc.Models.Warmed(t.Context()) {
+		t.Fatal("fixture did not finish its model listing")
+	}
+	for _, callback := range callbacks {
+		callback("provider", "fixture")
+	}
+	if count := appModelsChangedCount(rec); count != 0 {
+		t.Fatalf("closed app emitted %d model notices", count)
+	}
+}
+
+// Contract 4 and 5: app reads register once on the terminal's existing service
+// subscription, and each provider completion produces one app notification.
+func TestAppProviderModelCompletionsUseOneSubscription(t *testing.T) {
+	backend, rec, release := delayedAppModels(t)
+	backend.Warm()
+	for range 2 {
+		if _, err := backend.process(); err != nil {
+			t.Fatal(err)
+		}
+	}
+	proc := openedEngineProcess()
+	if n := len(proc.serviceNoticesSnapshot()); n != 1 {
+		t.Fatalf("repeated process reads registered %d subscriptions", n)
+	}
+	if n := appModelsChangedCount(rec); n != 0 {
+		t.Fatalf("no listing completed, but got %d notices", n)
+	}
+	proc.noteServiceModelsTo("provider", "fixture")
+	rec.waitFor(t, 2*time.Second, func(event string, _ any) bool { return event == appwire.EventModelsChanged })
+	if n := appModelsChangedCount(rec); n != 1 {
+		t.Fatalf("one provider completion emitted %d notices", n)
+	}
+	proc.noteServiceModelsTo("provider", "fixture")
+	seen := 0
+	rec.waitFor(t, 2*time.Second, func(event string, _ any) bool {
+		if event == appwire.EventModelsChanged {
+			seen++
+		}
+		return seen == 2
+	})
+	if n := appModelsChangedCount(rec); n != 2 {
+		t.Fatalf("two provider completions emitted %d notices", n)
+	}
+	backend.Close()
+	release()
+}
+
+type appModelPressureEmitter struct {
+	wire     *appwire.Server
+	entered  chan struct{}
+	returned chan struct{}
+}
+
+func (e *appModelPressureEmitter) Emit(event string, data any) {
+	close(e.entered)
+	e.wire.Emit(event, data)
+	close(e.returned)
+}
+
+func (e *appModelPressureEmitter) EmitContext(ctx context.Context, event string, data any) {
+	close(e.entered)
+	if emitter, ok := any(e.wire).(interface {
+		EmitContext(context.Context, string, any)
+	}); ok {
+		emitter.EmitContext(ctx, event, data)
+	} else {
+		e.wire.Emit(event, data)
+	}
+	close(e.returned)
+}
+
+// Contract 4: stdout pressure cannot stop backend reads or lifecycle cleanup.
+// The real wire writer is blocked and its documented 1,024-frame queue is full.
+func TestAppModelNoticeDoesNotBlockBackendOnWirePressure(t *testing.T) {
+	backend, _, release := delayedAppModels(t)
+	in, out := io.Pipe()
+	defer in.Close()
+	defer out.Close()
+	wire := appwire.NewServer(out)
+	t.Cleanup(func() {
+		in.Close()
+		_ = wire.Serve(context.Background(), bytes.NewReader(nil), appwire.Hello{Version: "test"}, backend)
+	})
+	wire.Emit(appwire.EventHello, appwire.Hello{Version: "test"})
+	// Reading part of hello proves the writer reached its blocking flush.
+	var first [1]byte
+	if _, err := in.Read(first[:]); err != nil {
+		t.Fatal(err)
+	}
+	for range 1024 {
+		wire.Emit(appwire.EventModelsChanged, appwire.Empty{})
+	}
+	emit := &appModelPressureEmitter{wire: wire, entered: make(chan struct{}), returned: make(chan struct{})}
+	backend.emit = backend.newAppInbox(emit)
+	backend.Warm()
+	proc := openedEngineProcess()
+	callbacks := proc.serviceNoticesSnapshot()
+	if len(callbacks) != 1 {
+		t.Fatalf("model subscriptions = %d", len(callbacks))
+	}
+	notified := make(chan struct{})
+	go func() { callbacks[0]("provider", "fixture"); close(notified) }()
+	select {
+	case <-emit.entered:
+	case <-time.After(2 * time.Second):
+		t.Fatal("completion never reached the wire")
+	}
+	read := make(chan struct{})
+	go func() { _ = backend.isClosing(); close(read) }()
+	closed := make(chan error, 1)
+	go func() { closed <- backend.Close() }()
+	for name, done := range map[string]<-chan struct{}{"backend read": read, "completion callback": notified} {
+		select {
+		case <-done:
+		case <-time.After(2 * time.Second):
+			// Drain only after recording failure so fixture cleanup can finish.
+			t.Errorf("%s waited for stdout", name)
+			in.Close()
+		}
+	}
+	select {
+	case err := <-closed:
+		if err != nil {
+			t.Fatal(err)
+		}
+	case <-time.After(2 * time.Second):
+		t.Error("Close waited for stdout")
+		in.Close()
+		<-closed
+	}
+	select {
+	case <-emit.returned:
+	case <-time.After(2 * time.Second):
+		t.Fatal("Close left a model sender behind")
+	}
+	if n := len(proc.serviceNoticesSnapshot()); n != 0 {
+		t.Fatalf("Close left %d subscriptions", n)
+	}
+	callbacks[0]("provider", "fixture")
+	release()
+}
diff --git a/docs/changes/unreleased/0-app-late-model-list.md b/docs/changes/unreleased/0-app-late-model-list.md
new file mode 100644
index 0000000000..91b275b68c
--- /dev/null
+++ b/docs/changes/unreleased/0-app-late-model-list.md
@@ -0,0 +1,8 @@
+---
+kind: fixed
+title: Announce late model lists to the desktop app
+pr: 0
+surface: [engine]
+invalidates:
+  - "A model catalog or provider list finishing after the app's three-second models.list wait had no completion event, leaving the desktop on its partial answer. The app now queues models.changed with empty data once per completion through one lifecycle-owned service subscription and an initial catalog waiter. A full writer queue does not hold the backend lock. Listing keeps its existing bound, and close removes the subscription and cancels and joins the waiter and wire sender."
+---
diff --git a/docs/design/app-v3/PROTOCOL.md b/docs/design/app-v3/PROTOCOL.md
index 8a007b83f8..2ae71cbeda 100644
--- a/docs/design/app-v3/PROTOCOL.md
+++ b/docs/design/app-v3/PROTOCOL.md
@@ -368,6 +368,14 @@ decides which combinations are accepted.
 
 ## models methods
 
+`models.list` waits at most three seconds for discovery already in flight and
+returns the models available then. When a pending catalog or provider listing
+completes, the app emits `models.changed` with empty data (`{}`) and the usual
+sequence number. Read `models.list` again to obtain the completed list. Repeated
+reads do not start polling. Notices enter an ordered queue without holding the
+backend lock while waiting for stdout. Close removes the completion subscription
+and cancels and joins the initial catalog waiter and wire sender.
+
 | method | params | result |
 |---|---|---|
 | `models.list` | `{}` | `ModelsResult` |
@@ -626,6 +634,7 @@ decides which combinations are accepted.
 | `log` | `Log` |
 | `media.changed` | `MediaSourceChanged` |
 | `member.changed` | `MemberChanged` |
+| `models.changed` | `Empty` |
 | `note.changed` | `NoteChanged` |
 | `order.asking` | `OrderFired` |
 | `order.changed` | `OrderChanged` |
diff --git a/internal/appwire/events.go b/internal/appwire/events.go
index 5b74c25835..84ebe55db1 100644
--- a/internal/appwire/events.go
+++ b/internal/appwire/events.go
@@ -48,6 +48,7 @@ var eventShapes = map[string]reflect.Type{
 	EventOrderAsking:       reflect.TypeFor[OrderFired](),
 	EventSettingsChanged:   reflect.TypeFor[SettingsChanged](),
 	EventProviderChanged:   reflect.TypeFor[ProviderChanged](),
+	EventModelsChanged:     reflect.TypeFor[Empty](),
 	EventDevicesChanged:    reflect.TypeFor[DevicesResult](),
 	EventLog:               reflect.TypeFor[Log](),
 
diff --git a/internal/appwire/server.go b/internal/appwire/server.go
index 61959f8c60..595e33d278 100644
--- a/internal/appwire/server.go
+++ b/internal/appwire/server.go
@@ -120,12 +120,31 @@ func (s *Server) Emit(event string, data any) {
 	s.send(frame{event: event, data: data})
 }
 
+// EmitContext lets a lifecycle-owned background sender cancel its queue wait.
+// Cancellation drops that event; frames already queued keep their wire order.
+func (s *Server) EmitContext(ctx context.Context, event string, data any) {
+	s.sendContext(ctx, frame{event: event, data: data})
+}
+
 func (s *Server) send(f frame) {
+	s.sendContext(context.Background(), f)
+}
+
+func (s *Server) sendContext(ctx context.Context, f frame) {
+	if ctx.Err() != nil {
+		return
+	}
+	put := func(f frame) {
+		select {
+		case <-ctx.Done():
+		case s.frames <- f:
+		}
+	}
 	s.mu.RLock()
 	if s.greeted || s.closed {
 		defer s.mu.RUnlock()
 		if !s.closed {
-			s.frames <- f
+			put(f)
 		}
 		return
 	}
@@ -135,12 +154,12 @@ func (s *Server) send(f frame) {
 	switch {
 	case s.closed:
 	case s.greeted:
-		s.frames <- f
+		put(f)
 	case f.event == EventHello:
 		s.greeted = true
-		s.frames <- f
+		put(f)
 		for _, held := range s.early {
-			s.frames <- held
+			put(held)
 		}
 		s.early = nil
 	default:
diff --git a/internal/appwire/wire.go b/internal/appwire/wire.go
index dce742b47c..d7df2aeab1 100644
--- a/internal/appwire/wire.go
+++ b/internal/appwire/wire.go
@@ -123,6 +123,7 @@ const (
 
 	EventSettingsChanged = "settings.changed"
 	EventProviderChanged = "provider.changed"
+	EventModelsChanged   = "models.changed"
 )
 
 // Error is a refusal the app can read: a code from the closed set above and a
diff --git a/internal/manual/chat/quick-switch-models.md b/internal/manual/chat/quick-switch-models.md
index 0c3392687f..c30a0fcb5e 100644
--- a/internal/manual/chat/quick-switch-models.md
+++ b/internal/manual/chat/quick-switch-models.md
@@ -22,3 +22,11 @@ when a response is running, it can redirect the next request in that response.
 It does not promise to leave an in-flight response on its original model.
 The model name itself still opens the full picker. The quick-switch control
 belongs to a chat, not to home, settings, or a task room.
+
+## Desktop model list — models arriving after discovery starts
+
+The desktop's model list waits up to three seconds for discovery already in
+progress, then answers with what is available. A provider's late list can still
+arrive after that first answer. The engine announces completion with
+`models.changed`, so the desktop can read the completed list without changing a
+setting or restarting. Reading the list adds no recurring discovery timer.

From d264b4b9075f830101f1f9efdbef93702c467e46 Mon Sep 17 00:00:00 2001
From: Abir Abbas <abirabbas1998@gmail.com>
Date: Wed, 28 Oct 2026 14:36:48 -0400
Subject: [PATCH 5/6] manual: name Inbox answer checks in the person's words

The new Inbox section said a landed task and a standing order need an
offered verdict; the manual keeps that word for the harness. Say one of the
offered choices instead.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 internal/manual/chat/permissions.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/internal/manual/chat/permissions.md b/internal/manual/chat/permissions.md
index d0d6cb111c..fee469102c 100644
--- a/internal/manual/chat/permissions.md
+++ b/internal/manual/chat/permissions.md
@@ -1254,8 +1254,8 @@ cannot be reached, the request returns the error immediately. Permission scopes,
 required options and budget payloads are checked before the hold too: raising an
 agent budget needs a positive amount, and Tell needs words and an idle agent.
 Service health answers must choose Restart or Stop, and standing order runs need
-an offered verdict. A crew decision needs an option or answer text. Landed tasks
-need an offered verdict, and Tell needs words. Fuel top-ups need a positive dollar
+one of the offered choices. A crew decision needs an option or answer text. A
+landed task needs one of its offered choices, and Tell needs words. Fuel top-ups need a positive dollar
 amount; finishing or stopping needs no amount. Text-only model answers and task
 redirects remain supported. A valid answer waits five seconds; Undo during that
 hold leaves the question waiting and sends nothing.

From c63331b1c047182d762eac3bd32b9fd0c2bd1ba4 Mon Sep 17 00:00:00 2001
From: Abir Abbas <abirabbas1998@gmail.com>
Date: Wed, 28 Oct 2026 16:00:47 -0400
Subject: [PATCH 6/6] manual: keep the late model list out of the
 model-switching page

The section on models.changed described a protocol detail no person sees, and
its wording pulled "why does this model start with ~" away from the lanes
page. The protocol document already covers the event.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 internal/manual/chat/quick-switch-models.md | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/internal/manual/chat/quick-switch-models.md b/internal/manual/chat/quick-switch-models.md
index c30a0fcb5e..0c3392687f 100644
--- a/internal/manual/chat/quick-switch-models.md
+++ b/internal/manual/chat/quick-switch-models.md
@@ -22,11 +22,3 @@ when a response is running, it can redirect the next request in that response.
 It does not promise to leave an in-flight response on its original model.
 The model name itself still opens the full picker. The quick-switch control
 belongs to a chat, not to home, settings, or a task room.
-
-## Desktop model list — models arriving after discovery starts
-
-The desktop's model list waits up to three seconds for discovery already in
-progress, then answers with what is available. A provider's late list can still
-arrive after that first answer. The engine announces completion with
-`models.changed`, so the desktop can read the completed list without changing a
-setting or restarting. Reading the list adds no recurring discovery timer.