@gotcos/glasses-server 6.36.18 → 6.36.21

package/CHANGELOG.md

@@ -1,3 +1,147 @@
+## 6.36.21
+
+**Fence liveness: the one thing about a fence a machine can actually establish.**
+
+`GET /agent-sessions/fences` and the release preview now carry a `liveness`
+aggregate -- `state` (`running` / `none_running` / `unknown`) plus counts. It
+answers "is a child COS spawned for this turn still writing", which is the only
+way releasing is unsafe for a reason a machine can see: admit a new turn while an
+old child is still writing and two writers interleave in one transcript.
+
+IT IS NOT A SAFETY VERDICT and no surface may render it as one. Whether the
+ambiguous turn landed stays unknowable. Two automatic fence resolvers were
+designed and both rejected (thread-fence-store.ts:40) because the dominant shape
+is `timeout`, where the child had ~21 minutes to run tool calls before SIGKILL --
+and the only fence this system has ever produced was exactly that shape. A
+classifier built on n=1 would be guessing with a confident face.
+
+The module enforces the three traps FenceRecord warns about rather than repeating
+them: a pid is matched against its RECORDED start, because the OS recycles pids;
+an empty or missing spawn list resolves to `unknown`, never `none_running`,
+because "nothing was recorded" is not "nothing ran"; and any probe that throws or
+returns something unparseable resolves toward `unknown`. A live child outranks an
+unreadable probe.
+
+Only the aggregate crosses the wire. No pid, no spawn list, and the rest of the
+evidence block stays disk-only -- widening that is a deliberate contract change,
+not a side effect of this.
+
+`listFences` now REQUIRES the probe. It was optional, and the resulting
+`deps === undefined` branch was unreachable from the route: a mutation flipping
+its default to `none_running` left all 262 route tests green. An unreached line
+that returns a confident answer is worse than no line.
+
+
+**A turn queued against a fenced thread was thrown away in about two minutes.**
+
+The thread-turn queue is wired before the agent-session-bindings router, and that
+router built its own `TargetGuard`. So the queue's occupancy gate could not see a
+fence at all: a fenced target reported attachable, `drainDecision` returned
+'deliver', the loopback attach refused `native_target_fenced`, and the refusal
+spent one of five delivery attempts. Five 20-second ticks retire a turn -- long
+before anyone could reach the Mac, and the only fence this system has produced sat
+for roughly 40 hours because clearing it required a terminal.
+
+This is the SAME failure `native_target_busy` hit before the binding was made
+visible to occupancy, and the note recording that fix is three lines above the
+change. Fences never got the same treatment.
+
+The server now owns one `TargetGuard`, constructed above the queue and handed to
+the router, and occupancy consults it. A fenced target holds, and a hold spends
+nothing.
+
+`native_target_fenced` is now queueable -- the one entry in that set cleared by a
+person rather than a clock. The previous reasoning (waiting cannot resolve "may or
+may not have been delivered") was correct for a world where releasing needed a
+terminal. COS Control 0.5.63 ships a Release button that runs, so the wait ends on
+a real event. Queueing does not weaken anything: delivery re-enters the attach
+route and re-runs the fence check.
+
+Fence-held turns get `FENCE_HELD_TURN_TTL_MS` (72h) instead of the ordinary 6h.
+Six hours is right for a busy thread; it is wrong for a state that ends when a
+person looks. It still expires, and it still says so.
+
+Two existing tests were retargeted rather than deleted, both with the reasoning
+kept: the one asserting a fence is NOT queueable, and the one using a fence as its
+example of a refusal that can never clear -- that rule is unchanged and now uses a
+structurally permanent reason as its witness.
+
+Requires COS Control 0.5.63 for the Release button to actually work.
+
+Suite 3003 / 213 files, tsc 0. The wiring and liveness guards are mutation-verified: removing
+the fence check from occupancy, and moving the guard below the queue, each fail
+the assertion written for them.
+
+## 6.36.20
+
+Follow-up to 6.36.19, which was never published. QA found three things in it.
+
+**The reset CLI mutated production archives just by importing.**
+`message-era-reset.ts` imported `endSession`/`getActiveSessions` from
+`conversation.js` and used neither -- but that module's scope runs
+`loadFromDisk()` and a boot `runDailyArchiveMirror()`. In the one-shot CLI that
+is a second process concurrently loading and rewriting the archives the live
+server owns, and `appendToArchive` appends rather than upserts, so it can
+duplicate prior-day chats. The import is gone, and a test now asserts it stays
+gone. The previous canary injected an `archiveAndRelease` and asserted it was
+never called, which only ever caught a regression routed through the callback --
+the code it replaced called `endSession()` directly as its default. `sessions`
+and `archiveAndRelease` are deleted from the input type rather than left as a
+silent no-op for a future caller.
+
+**A corrupt `message-era.json` was indistinguishable from a reset.**
+`currentMessageEraState` fell back to `legacy` on missing OR invalid content.
+Reverting to `legacy` after a real era existed is the worst available answer: it
+re-reads every era-stamped exchange as a PREVIOUS era, hiding it from
+`/all-messages`, while promoting unstamped ones to current -- and to a client it
+looks exactly like a reset nobody asked for. Missing still means `legacy`, which
+is correct for a first upgrade whose exchanges carry no stamp at all. Corrupt
+now rotates explicitly, says so on stderr, and degrades to `legacy` without
+caching only if the replacement cannot be persisted.
+
+**The header described a code path that had been removed.** It still said
+rotation stops "if an archive write fails". There is no archive write. It now
+also records what 6.36.19 quietly changed: this path does NOT archive, and the
+daily mirror skips today by design, so a same-day copy exists only after an
+explicit session end or `POST /api/archive/now`.
+
+The 409 copy on both query paths no longer tells the wearer to reopen for a
+"fresh message list" -- as of app 6.8.423 the cards stay.
+
+Requires app 6.8.423. Suite 2976 / 209 files, tsc 0, measured on a CLEAN
+checkout of this commit rather than a working tree carrying another session's
+uncommitted files -- the 6.36.19 note quoted 2981/211 from a contaminated tree,
+and that tree's untracked code would have shipped in the tarball.
+
+The conversation-import canary is mutation-verified: reintroducing the import
+fails it. One unidentified test failed on a single clean-tree run and did not
+recur across six further runs; it is not attributed to this change and it is
+recorded here rather than rounded down to "clean".
+
+## 6.36.19
+- **Resetting the spoken message count no longer ends the conversation.**
+  `resetLiveMessageEra` used to `endSession` every live session before rotating
+  the era, so "reset the message count" also emptied CHAT and killed the thread
+  the wearer was in the middle of. It now rotates the era and nothing else.
+- Numbers stay unique because they were never bare ints: a number is
+  `{messageEra, globalMsgNum}`. The era rotates, the current-era ceiling
+  restarts at 0, and leftover cards keep their old era and their old number.
+  Lookup already prefers the current era (`message-ref.ts:231-234`) and the
+  counter is already era-scoped (`message-ref.ts:242-251`), so "message N" stays
+  unambiguous without a second ID scheme.
+- `archived` stays in the response and is now always `0`. Callers read the field,
+  so it is kept — but copy that reports it must stop claiming sessions were
+  archived. The `archive_failed` 503 path is **gone**, not relocated: there is no
+  archive step left to fail.
+- Tests inverted to match. A supplied `archiveAndRelease` is now asserted
+  *never to be called*, and a refusing one can no longer block the rotation.
+  Mutation-verified: reintroducing the release loop fails the suite.
+
+**Ship gate:** do not POST `/api/message-era/reset` from any surface until app
+6.8.422 is also live. Server-first plus the old companion still wipes local
+messages, and `/sessions/today/all-messages` is era-filtered so recover cannot
+bring the leftover cards back.
+
 ## 6.36.18
 - **Meetings list now carries voice-assignment tags.** Each row includes
   `voiceReview` from the sidecar head (`speakers[]`) plus whether a human

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.36.18",
+  "version": "6.36.21",
   "description": "COS Glasses — self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -24,10 +24,12 @@ import { createAttachedTurnStream } from './lib/session-stream-producer.js'
 import { claudeSessionsRouter } from './routes/claude-sessions.js'
 import {
   createAgentSessionBindingsRouter,
+  TargetGuard,
 
   threadAttachEnabled,
 } from './routes/agent-session-bindings.js'
 import { AgentSessionBindingRegistry } from './lib/agent-session-binding-registry.js'
+import { targetKey } from './lib/agent-session-binding-store.js'
 import { cosSpawnedPids } from './lib/agent-session-ownership-store.js'
 import { buildOccupancyProbes, realOccupancyDirs } from './lib/occupancy-probes.js'
 import { realAttachedWorkspaceDeps, resolveAttachedWorkspace } from './lib/attached-workspace.js'
@@ -516,6 +518,18 @@ app.use('/api', claudeSessionsRouter)
 // accounting; a second copy of that sequence in a background worker is a second place
 // for the gate to drift. One request per delivered turn, at a handful of turns a day,
 // buys the guarantee that the queue CANNOT weaken the gate even by accident.
+// ONE guard, owned here, because the thread-turn queue below is wired BEFORE the
+// bindings router and still has to see a fence. When the router made its own, the
+// queue read an empty one: a fenced target reported attachable, the drainer
+// ATTEMPTED, the attach route refused `native_target_fenced`, and five of those
+// retired the queued turn in about two minutes. That is the identical failure the
+// binding note in `occupancy` below records, one layer over.
+const sharedTargetGuard = new TargetGuard(
+  process.env.COS_THREAD_FENCE_DURABLE === '1'
+    ? { load: readFences, save: writeFences }
+    : null,
+)
+
 if (threadAttachEnabled()) {
   const queueDeps = {
     // TWO GATES, ONE ANSWER. `threadOccupancy` sees FOREIGN holders -- another app on
@@ -544,6 +558,12 @@ if (threadAttachEnabled()) {
         // (`blocksTarget`), so an expired or terminal one correctly reads as free.
         const holder = agentSessionBindingRegistry.getByThread(provider, threadId, Date.now())
         if (holder !== null) return { attachable: false, reason: 'native_target_busy' }
+        // THE FENCE, for the same reason the binding is here and not one layer down.
+        // This is ADVISORY: the attach route stays the authority that refuses. Saying
+        // it here only means the drainer holds instead of spending an attempt, and a
+        // turn can wait out a fence that a person will clear.
+        const fenced = sharedTargetGuard.fencedReason(targetKey(provider, threadId))
+        if (fenced !== null) return { attachable: false, reason: fenced }
         return { attachable: true, reason: null }
       } catch {
         // A throwing probe is not an open door.
@@ -597,6 +617,9 @@ app.use('/api', createAgentSessionBindingsRouter({
   // POST /agent-sessions/fences/release work either way — which already removes
   // the restart from the recovery path — and this flag flips on once COS Control
   // has a Fences card.
+  // The instance the queue's `occupancy` already reads. Constructing a second one
+  // here would give the queue a permanently empty fence view.
+  guard: sharedTargetGuard,
   fencePersistence: process.env.COS_THREAD_FENCE_DURABLE === '1'
     ? { load: readFences, save: writeFences }
     : undefined,

package/server/lib/fence-liveness.ts

@@ -0,0 +1,126 @@
+// Is any child COS spawned for a fenced turn STILL RUNNING?
+//
+// WHAT THIS IS NOT. It is not a safety verdict and it must never be presented as
+// one. Two plans for an automatic fence resolver were designed and both rejected
+// (thread-fence-store.ts:40), and the reasoning still holds: the dominant fence
+// shape is `timeout`, where the child had a ~21 minute budget to run tool calls
+// before SIGKILL, and nothing observable afterwards distinguishes "the turn landed"
+// from "it did not". This module answers a narrower question that IS mechanically
+// knowable, and leaves delivery to the person.
+//
+// WHY THE NARROW QUESTION IS WORTH ANSWERING. A still-running child is the one way
+// releasing a fence is unsafe for a reason a machine can see: admit a new turn while
+// an old child is still writing and two writers interleave in one transcript.
+// Everything else about a fence is judgement.
+//
+// PID ALONE IS NOT AN IDENTITY. `spawns` records a MEASURED start for each pid
+// precisely because the OS recycles pids; a live pid whose start time does not match
+// is a different process and says nothing about ours. FenceRecord's own comment says
+// so, and this module is where that warning is enforced rather than repeated.
+//
+// EMPTY IS NOT ABSENCE. An empty or missing `spawns` list means no child was ever
+// RECORDED, which is not the same as no child having run -- FenceRecord says no
+// resolver may read it as "nothing landed". It resolves to `unknown`, never to
+// `none_running`.
+//
+// FAIL CLOSED. Anything unmeasurable resolves toward `unknown`. The caller is a
+// human deciding whether to release; an over-confident `none_running` is worse than
+// admitting the probe could not see.
+
+/** Recorded spawn: a pid and the start COS measured when it created the child. */
+export interface RecordedSpawn {
+  pid: number
+  startMs: number
+}
+
+export type FenceLivenessState =
+  /** Every recorded child is provably gone. */
+  | 'none_running'
+  /** At least one recorded child is alive AND is identity-matched to ours. */
+  | 'running'
+  /** Nothing was recorded, or at least one probe could not answer. */
+  | 'unknown'
+
+export interface FenceLiveness {
+  state: FenceLivenessState
+  /** Spawns examined. Zero means nothing was recorded. */
+  recorded: number
+  /** Alive and identity-matched: the reason a release is mechanically unsafe. */
+  running: number
+  /** Alive but started too far from the recorded time -- a RECYCLED pid, not ours.
+   *  Counted, never treated as ours, and never treated as evidence about our child. */
+  recycled: number
+  /** Probes that threw or returned something unusable. */
+  unverifiable: number
+}
+
+export interface FenceLivenessDeps {
+  /** Epoch ms at which `pid` started, or null when it is not running.
+   *  MAY THROW; a throwing probe is not an answer and resolves to `unknown`. */
+  pidStartMs: (pid: number) => number | null
+}
+
+/**
+ * Clock skew between COS's own `Date.now()` at spawn time and the start `ps`
+ * reports, which has one-second resolution. Two seconds is comfortably wider than
+ * that rounding and far narrower than any realistic pid-recycling window.
+ */
+export const START_MATCH_TOLERANCE_MS = 2_000
+
+export function fenceLiveness(
+  spawns: ReadonlyArray<RecordedSpawn> | undefined | null,
+  deps: FenceLivenessDeps,
+  toleranceMs: number = START_MATCH_TOLERANCE_MS,
+): FenceLiveness {
+  const rows = Array.isArray(spawns) ? spawns : []
+  const out: FenceLiveness = {
+    state: 'unknown', recorded: rows.length, running: 0, recycled: 0, unverifiable: 0,
+  }
+
+  // Nothing recorded. NOT 'none_running' -- see the header.
+  if (rows.length === 0) return out
+
+  for (const row of rows) {
+    if (!row || !Number.isSafeInteger(row.pid) || row.pid <= 0
+      || !Number.isFinite(row.startMs)) {
+      out.unverifiable += 1
+      continue
+    }
+    let started: number | null
+    try {
+      started = deps.pidStartMs(row.pid)
+    } catch {
+      out.unverifiable += 1
+      continue
+    }
+    if (started === null) continue          // gone: the ordinary, good case
+    if (!Number.isFinite(started)) { out.unverifiable += 1; continue }
+    if (Math.abs(started - row.startMs) <= toleranceMs) out.running += 1
+    else out.recycled += 1                  // someone else's process wearing our pid
+  }
+
+  // A live child outranks an unreadable probe: it is the one thing we are sure of.
+  if (out.running > 0) out.state = 'running'
+  else if (out.unverifiable > 0) out.state = 'unknown'
+  else out.state = 'none_running'
+  return out
+}
+
+/** Real probe. `ps -o lstart=` is the only start-time keyword macOS ps offers --
+ *  `etimes` is not a valid keyword here, which is why this parses a date rather
+ *  than reading elapsed seconds. */
+export function makePidStartProbe(
+  run: (pid: number) => string | null,
+): (pid: number) => number | null {
+  return (pid: number) => {
+    const raw = run(pid)
+    if (raw === null) return null
+    const text = raw.trim()
+    if (!text) return null
+    const parsed = Date.parse(text)
+    // Unparseable is NOT "not running" -- throw so the caller counts it
+    // unverifiable rather than silently reading a live child as gone.
+    if (!Number.isFinite(parsed)) throw new Error(`unparseable process start: ${text}`)
+    return parsed
+  }
+}

package/server/lib/message-era-reset.ts

@@ -1,15 +1,23 @@
-// Archive live sessions, then start short-numbering at #1.
-// History is retained in day archives; only the current era's ceiling resets.
-// Disk mtime on message-era.json is enough — the live server re-reads it.
-// Do not rotate the era if a query is in flight or an archive write fails.
-
-import { endSession, getActiveSessions } from './conversation.js'
+// Rotate the short-number namespace. Live sessions are NOT ended and nothing
+// is archived here: the companion keeps every card, so the reset is a numbering
+// change rather than a history change.
+//
+// Do not rotate the era if a query is in flight.
+//
+// NOTE: this file deliberately imports nothing from ./conversation.js. Importing
+// it runs its module scope -- loadFromDisk() and a boot runDailyArchiveMirror()
+// -- which in the one-shot CLI means a second process concurrently loading and
+// rewriting the same archives the live server owns. appendToArchive appends
+// rather than upserts, so that duplicates prior-day chats.
+//
+// Today's exchanges are NOT archived by this path. The daily mirror skips
+// today by design (conversation.ts: `sessionDay >= todayLocal`), so a same-day
+// copy exists only after an explicit session end or POST /api/archive/now.
 import {
   createMessageEra,
   currentMessageEraState,
   type MessageEraState,
 } from './message-era.js'
-import type { SessionToArchive } from './archive.js'
 
 export class MessageEraResetError extends Error {
   readonly code: string
@@ -37,8 +45,6 @@ export interface MessageEraResetInput {
   now?: number
   activeRuns?: number
   shuttingDown?: boolean
-  sessions?: SessionToArchive[]
-  archiveAndRelease?: (session: SessionToArchive) => Promise<boolean>
 }
 
 async function resolveJobHealth(input: MessageEraResetInput): Promise<{ activeRuns: number; shuttingDown: boolean }> {
@@ -79,26 +85,29 @@ export async function resetLiveMessageEra(input: MessageEraResetInput): Promise<
   }
 
   const previous = currentMessageEraState()
-  const sessions = input.sessions ?? getActiveSessions()
-  const archiveAndRelease = input.archiveAndRelease ?? (async (session: SessionToArchive) => {
-    const result = await endSession(session.id)
-    if (!result) return true
-    if (result.exchangeCount > 0 && !result.logged) return false
-    return true
-  })
 
-  let archived = 0
-  for (const session of sessions) {
-    const released = await archiveAndRelease(session)
-    if (!released) {
-      throw new MessageEraResetError(
-        'archive_failed',
-        'Archive failed; message count was not reset.',
-        503,
-      )
-    }
-    archived++
-  }
+  // 6.36.19 — rotate the era, do NOT end the thread.
+  //
+  // This used to endSession() every live session before rotating, which is what
+  // made "reset the message count" also empty CHAT and kill the conversation the
+  // wearer was in the middle of. Miles wants the opposite shape: the next message
+  // is #1, the old cards keep their numbers, and the thread survives.
+  //
+  // Numbers stay unique because they are {messageEra, globalMsgNum}, not a bare
+  // int: the era rotates, the current-era ceiling restarts at 0, and leftover
+  // cards keep their old era. Lookup already prefers the current era
+  // (message-ref.ts:231-234) and the counter is already era-scoped
+  // (message-ref.ts:242-251), so nothing downstream needs to change to keep
+  // "message N" unambiguous.
+  //
+  // `archived` stays in the result and is now always 0. Control and the app read
+  // it, so removing the field would break them; the copy that reports it has to
+  // stop claiming sessions were archived.
+  //
+  // Deliberately no archive step here. There is nothing to release, so there is
+  // no 503 archive_failed path any more — that failure mode is gone rather than
+  // relocated. The day-archive mirror already retains history.
+  const archived = 0
 
   const next: MessageEraState = createMessageEra(input.now ?? Date.now())
   return {

package/server/lib/message-era.ts

@@ -55,9 +55,38 @@ export function currentMessageEraState(): MessageEraState {
     cachedMtimeMs = mtimeMs
     return cached
   }
-  cached = { v: 1, era: LEGACY_MESSAGE_ERA, startedAt: 0 }
-  cachedMtimeMs = mtimeMs
-  return cached
+  // Missing is not corrupt. A legacy install upgrading for the first time has
+  // no file AND no era stamps on its exchanges, and only LEGACY_MESSAGE_ERA
+  // classifies an unstamped exchange as current. Rotating here would file every
+  // one of them under a previous era and empty the chat on upgrade.
+  if (loaded.status === 'missing') {
+    cached = { v: 1, era: LEGACY_MESSAGE_ERA, startedAt: 0 }
+    cachedMtimeMs = mtimeMs
+    return cached
+  }
+
+  // Corrupt, or present-but-invalid: the file existed, so a real era almost
+  // certainly did too, and its value is now unrecoverable. Reverting to legacy
+  // would be the worst available answer -- it re-reads every era-stamped
+  // exchange as a PREVIOUS era (hiding it from /all-messages) while promoting
+  // unstamped ones to current, and it is indistinguishable from a reset nobody
+  // asked for. Rotate explicitly and say so, so the state is self-consistent
+  // and the event is diagnosable.
+  console.error(
+    `[message-era] ${MESSAGE_ERA_FILE} was unreadable (status=${loaded.status}); `
+    + 'rotating to a fresh era. Older messages stay in day archives and remain '
+    + 'reachable by session, but not by short number.',
+  )
+  try {
+    return createMessageEra()
+  } catch (err) {
+    // Read-only or full data dir: degrade to legacy rather than crash the
+    // server, but never cache it -- the next call retries the rotation.
+    console.error('[message-era] could not persist the replacement era:', err)
+    cached = null
+    cachedMtimeMs = Number.NaN
+    return { v: 1, era: LEGACY_MESSAGE_ERA, startedAt: 0 }
+  }
 }
 
 export function currentMessageEra(): string {

package/server/lib/query-job-runtime.ts

@@ -82,7 +82,7 @@ export async function preparePublicDurableQueryAdmission(raw: unknown): Promise<
     throw new QueryJobAdmissionPreparationError(
       409,
       'message_era_mismatch',
-      'Reopen or update COS Glasses to start the fresh message list.',
+      'Reopen or update COS Glasses. Your cards stay; the next message is #1.',
     )
   }
   try {

package/server/lib/thread-turn-queue.ts

@@ -94,6 +94,21 @@ export interface QueuedThreadTurn {
  */
 export const QUEUED_TURN_TTL_MS = 6 * 60 * 60 * 1000
 
+/**
+ * TTL for a turn held by a FENCE specifically.
+ *
+ * Six hours is right for a busy thread: the holder finishes or it never will. A
+ * fence is different in kind -- it ends when a PERSON looks, and the only fence this
+ * system has ever produced sat for about 40 hours before anyone could clear it,
+ * because clearing it needed a terminal. Expiring at six would have thrown the turn
+ * away roughly seven times over while the user was still waiting for a working
+ * Release button.
+ *
+ * It still expires. A turn that outlives this is one nobody is coming back for, and
+ * silently holding it forever is worse than telling the truth about losing it.
+ */
+export const FENCE_HELD_TURN_TTL_MS = 72 * 60 * 60 * 1000
+
 /** Waiting turns per thread. Small: this is a queue, not a backlog. */
 export const MAX_QUEUED_PER_THREAD = 8
 
@@ -141,6 +156,18 @@ const QUEUEABLE_REFUSALS: ReadonlySet<string> = new Set([
   'unverifiable_process_start',
   'unverifiable_liveness_socket',
   'probe_failed',
+  // A FENCE IS CLEARED BY A PERSON, NOT BY A CLOCK -- the one exception in this set.
+  //
+  // It is queueable because "COS sent a turn and never learned whether it arrived"
+  // is precisely the state a queued turn should outlive: the operator checks, releases,
+  // and the turn lands. Releasing kicks the drain, so the wait ends on a real event.
+  //
+  // It is ALSO why the fence had to become visible to `occupancy` (index.ts). Without
+  // that, a fenced target reads attachable, the drainer ATTEMPTS, the attach route
+  // refuses, and five of those retire the turn in about two minutes -- the identical
+  // failure the binding comment above records, and it would have made queue-and-release
+  // look like it worked while silently dropping the turn.
+  'native_target_fenced',
 ])
 
 /** Can a turn refused for this reason be parked, or must it refuse now? */
@@ -159,6 +186,9 @@ export interface DrainObservation {
   turnEnded: boolean
   /** The 30s transcript clock. `idle` is the backstop when no terminal record lands. */
   activity: 'working' | 'idle' | 'unknown'
+  /** The gate's reason when `attachable` is false. Carried ONLY so a fence -- the one
+   *  hold a clock cannot end -- can be given a longer life than a busy thread. */
+  reason?: string | null
 }
 
 export type DrainDecision = 'deliver' | 'hold' | 'expire' | 'give_up'
@@ -178,7 +208,10 @@ export function drainDecision(
 ): DrainDecision {
   if (turn.status !== 'waiting') return 'hold'
   if (!Number.isFinite(now) || !Number.isFinite(turn.queuedAt)) return 'hold'
-  if (now - turn.queuedAt >= ttlMs) return 'expire'
+  // A fence is cleared by a person, so it gets the longer clock. Everything else --
+  // including a fence we could not name -- keeps the ordinary one.
+  const effectiveTtl = seen.reason === 'native_target_fenced' ? FENCE_HELD_TURN_TTL_MS : ttlMs
+  if (now - turn.queuedAt >= effectiveTtl) return 'expire'
   if (turn.attempts >= MAX_DELIVERY_ATTEMPTS) return 'give_up'
   // THE GATE, unweakened. Everything below is about WHEN, never about whether.
   if (!seen.attachable) return 'hold'

package/server/routes/agent-session-bindings.ts

@@ -95,6 +95,8 @@
 // and answer 400. They never treat an unparsed body as an empty one.
 
 import type { FenceRecord } from '../lib/thread-fence-store.js'
+import { execFileSync } from 'node:child_process'
+import { fenceLiveness, makePidStartProbe, type FenceLiveness, type FenceLivenessDeps } from '../lib/fence-liveness.js'
 import { Router, type Request, type Response } from 'express'
 import { createHash, randomUUID } from 'node:crypto'
 import {
@@ -271,6 +273,11 @@ export type AttachedTurnResult =
   | { ok: boolean; delivery: 'not_attempted' | 'aborted' | 'ambiguous' | 'delivered' }
 
 export interface AgentSessionBindingsDeps {
+  /** Shared fence state. Omit and the router owns a private one, which is correct
+   *  for tests and wrong for the server -- see the wiring note at its use site. */
+  guard?: TargetGuard
+  /** Process-start probe behind the fence liveness aggregate. */
+  liveness?: FenceLivenessDeps
   /**
    * Durable fence storage. OPTIONAL, and omitting it is what keeps the existing
    * suite in memory: a test that silently began writing the real data home would
@@ -889,7 +896,14 @@ export interface FencePersistence {
  * the real data home would leak fences between cases and into the running server,
  * so the suite runs with `null` and stays in memory.
  */
-class TargetGuard {
+/** The fence question, narrowed for callers that must not touch anything else.
+ *  `occupancy` in index.ts reads this so a fenced target holds instead of burning
+ *  a delivery attempt; the ATTACH route remains the authority that refuses. */
+export interface TargetFenceView {
+  fencedReason(targetKey: string): WriteRefusal | null
+}
+
+export class TargetGuard {
   /** targetKey -> turnId of the single COS turn allowed to be in flight. */
   private readonly claims = new Map<string, string>()
   /** targetKey -> the fence record. DURABLE as of 6.36.10: persistence is injected
@@ -994,8 +1008,18 @@ class TargetGuard {
   }
 
   /** Every fence, REDACTED for the wire: the raw targetKey embeds the private
-   *  native thread id, so callers address a fence by its deterministic digest. */
-  listFences(): Array<{ target: string; provider: string; reason: string; headBefore: string | null; turnId: string; fencedAt: number }> {
+   *  native thread id, so callers address a fence by its deterministic digest.
+   *
+   *  `liveness` is the ONLY evidence field that crosses, and it crosses as an
+   *  aggregate: a state plus counts, never a pid. It answers "is a child from this
+   *  turn still writing", which is the one thing about a fence a machine can
+   *  actually establish. It is NOT a safety verdict and the UI must not render it
+   *  as one -- whether the ambiguous turn landed stays unknowable, which is why two
+   *  automatic resolvers were rejected (thread-fence-store.ts:40).
+   *
+   *  The rest of the evidence block stays disk-only. Widening that is a deliberate
+   *  contract change, not a side effect of adding this. */
+  listFences(deps: FenceLivenessDeps): Array<{ target: string; provider: string; reason: string; headBefore: string | null; turnId: string; fencedAt: number; liveness: FenceLiveness }> {
     return [...this.fences.values()].map(row => ({
       target: opaqueRevision(row.targetKey),
       provider: row.provider,
@@ -1003,6 +1027,12 @@ class TargetGuard {
       headBefore: row.headBefore,
       turnId: row.turnId,
       fencedAt: row.fencedAt,
+      // REQUIRED, not optional. An optional probe meant a `deps === undefined`
+      // branch that the route could never take -- a mutation flipping it to
+      // `none_running` left the whole 262-test suite green, which is the
+      // definition of an unreached line. A caller with no probe must construct a
+      // deliberate one rather than fall into a default answer.
+      liveness: fenceLiveness(row.spawns, deps),
     }))
   }
 
@@ -1287,7 +1317,23 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
   const canListBindings = bindingDepsUsable(deps)
   const canWriteBindings = bindingWriteDepsUsable(deps)
   const detect = deps?.occupancy ?? threadOccupancy
-  const guard = new TargetGuard(deps.fencePersistence ?? null)
+  // INJECTABLE. index.ts owns the instance because the thread-turn queue is wired
+  // BEFORE this router and must be able to see a fence; a second guard created here
+  // would be a disconnected copy, and the queue would go on reading an empty one.
+  const guard = deps.guard ?? new TargetGuard(deps.fencePersistence ?? null)
+  // `ps -o lstart=` is the only start-time keyword macOS ps offers. Injectable so a
+  // test drives recycled and unreadable pids without spawning real processes.
+  const livenessDeps: FenceLivenessDeps = deps.liveness ?? {
+    pidStartMs: makePidStartProbe((pid) => {
+      try {
+        return execFileSync('ps', ['-p', String(pid), '-o', 'lstart='], {
+          encoding: 'utf8', timeout: 2_000,
+        })
+      } catch {
+        return null   // not running, or ps refused the pid
+      }
+    }),
+  }
   const ownership = deps?.ownership ?? { record: recordCosSpawn, release: releaseCosSpawn }
   // One per router. Injectable so the follow-on (attach accepting a `forkRef`)
   // shares this instance rather than standing up a second, disconnected one.
@@ -1383,7 +1429,7 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
     // `degraded` is reported, never inferred: a memory-only fence set behaves
     // identically to a durable one until the process restarts, so a silent
     // fallback would be indistinguishable from working.
-    res.json({ fences: guard.listFences(), degraded: guard.degraded() })
+    res.json({ fences: guard.listFences(livenessDeps), degraded: guard.degraded() })
   })
 
   router.post('/agent-sessions/fences/release', (req, res) => {
@@ -1400,7 +1446,10 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
       // The API token is shared by the phone, the lens and every COS agent
       // session, so nothing is structurally prevented from asserting `confirm`.
       // It stops an accidental release, not an automated one.
-      const preview = guard.listFences().find(f => f.target === target) ?? null
+      // The preview carries the liveness aggregate too: this is the exact moment a
+      // person decides, and "a child from this turn is still running" is the one
+      // thing here a machine can tell them.
+      const preview = guard.listFences(livenessDeps).find(f => f.target === target) ?? null
       res.status(400).json({ released: false, reason: 'confirmation_required', preview })
       return
     }

package/server/routes/query.ts

@@ -60,7 +60,7 @@ queryRouter.post('/query', async (req, res) => {
     maintenanceLease.release()
     return res.status(409).json({
       error: 'message_era_mismatch',
-      detail: 'Reopen or update COS Glasses to start the fresh message list.',
+      detail: 'Reopen or update COS Glasses. Your cards stay; the next message is #1.',
       era: activeMessageEra,
     })
   }

package/server/routes/thread-turn-queue.ts

@@ -113,6 +113,7 @@ export async function drainThread(
       attachable: gate.attachable,
       turnEnded: deps.turnEnded(provider, threadId),
       activity: deps.activity(provider, threadId),
+      reason: gate.reason,
     }
     const decision = drainDecision(turn, seen, deps.now())
 

package/server/scripts/reset-message-era.ts

@@ -1,6 +1,7 @@
 #!/usr/bin/env tsx
-// Archives live sessions, then creates a fresh short-number namespace.
-// History stays in day archives. Disk mtime is enough — no server restart.
+// Creates a fresh short-number namespace. Live sessions are NOT ended and
+// nothing is archived -- the companion keeps every card. Disk mtime is enough
+// — no server restart.
 //
 //   npx tsx server/scripts/reset-message-era.ts --confirm
 
@@ -22,7 +23,7 @@ console.log(JSON.stringify({
   restartRequired: false,
   verify: 'GET /api/message-counter should return { max: 0, era: "<era above>" }',
   nextSteps: [
-    'Phone: tap RESET # or reopen the companion so the live list clears',
+    'Phone: reopen the companion — cards stay, the next message is #1',
     'Send a test message — expect #1',
   ],
 }, null, 2))