@gotcos/glasses-server 6.48.1 → 6.49.0

package/CHANGELOG.md

@@ -1,3 +1,23 @@
+## 6.49.0
+
+A Continue lands in the session you left open, and the live feed says what every step produced.
+
+- **The running session takes the turn.** Two of Miles's Continues from the lens on 2026-09-15 were delivered, answered, and invisible: the resume child appended them to the transcript, and the Desktop tab that was open on that session never re-reads its file, so the desk showed nothing until he resumed. The server now writes the turn into the session's own inbox first. Claude Code publishes one per live process in `~/.claude/sessions/<pid>.json` (`messagingSocketPath`, `peerProtocol: 1`) and documents the two-line format in its help text; a Desktop tab and a `claude` in iTerm carry the same record, so there is one path, not two. Measured on this Mac: an idle session took the message as a real turn and answered in about three seconds, painted in its own window. Off until `COS_CONTINUE_LIVE=1`; every refusal takes the 6.48.2 path.
+- **Delivered means the transcript says so.** Bytes on a socket prove nothing: the receiver drops a frame whose `session_id` is not its own, may hold one behind its permission policy, or may be shutting down. So the turn is `delivered` only when the session's transcript shows the `queue-operation: enqueue` row (or the user row) carrying it, which Claude Code writes the instant it accepts a message and before the turn runs. The frame is pinned to the full session id (a pid is recycled; a prefix is ambiguous), a COS-spawned resume child sharing the id is never the target, and a wrong token is not a failure because Claude Code accepts unauthenticated peers on this platform (measured) and the pin is the protection.
+- **Never twice.** A frame written but not seen accepted is a suspect, not a failure: the route answers `live_unverified` (retryable, not ledgered), the retry re-reads the transcript from the ORIGINAL send before doing anything, the socket is never written twice for one turn, and only after 60 s without an acceptance row does the resume child run. The one duplicate this leaves open is a session whose permission mode holds peer messages for approval, approved by hand after the child already answered; that is a Deny, and it is named here rather than hidden. The attach gate runs in full before the live hop: a busy Desktop holder is still refused first and queued, and the queue drains into the live session when the turn ends.
+- **Outcomes on the live feed.** Each tool result in the transcript now emits a `status` draft carrying `tool_outcome: { ok, detail }`, derived from the result's own shape and never from its content: `235 lines`, `+14 -2`, `41 lines`, `3 files`, `17 hits`, `200 · 13 KB`, `exit 1`, `denied`, `interrupted`. A client that predates it takes a repeated `status: working` as a no-op (nothing appended, no step counted, no gap), so 6.9.485 renders unchanged; the next EHPK and Control read it to show the result at the end of each step line and the step still running as the live row.
+- `/api/health` gains `continueLive` (enabled, attempts, delivered, fallbacks by reason, last reason). Control's env allowlist carries `COS_CONTINUE_LIVE` from its next build so Update Server keeps it.
+- Tests: the pure inbox module (full-id selection, the COS-child skip, the pinned frames, acceptance from the enqueue and user rows with the time floor, the suspect memo's three rules, every refusal never sends), the route (live completes without a spawn and replays; nothing-sent reasons spawn exactly as 6.48.2; unverified holds and never spawns; a throwing transport spawns; the gate runs first; absent dep is the 6.48.2 route), the outcome tokens from twenty-one recorded result shapes, the derived-status stamp keeping the outcome. Mutation gate: twelve new cases, all killed on a green baseline.
+- Requires nothing new on the clients. Claude Code 2.1.273 measured; the inbox protocol is read from the registry record and refused when it is not `1`.
+
+## 6.48.2
+
+Continue and Fork work again on a session whose transcript opens with a big row. Reported from the lens on 6.9.482 (Miles, 2026-09-15): Continue on a Claude session answered "Can't continue. Fork thread instead" while the row said the session was attachable.
+
+- The attach route reads the session's working directory out of the transcript's first rows. It read a fixed 512 KiB, and a session whose first prompt carried pasted screenshots opens with one row of about 1 MB, so the window held four bookkeeping rows and a torn fifth, no `cwd`, and every Continue and Fork on that session was refused `target_unresolvable`. The read now widens (512 KiB, 2 MiB, 8 MiB, 16 MiB) while the window keeps ending inside a row with no `cwd` seen, and stops as soon as the whole file has been read or a row boundary shows the transcript records none.
+- The first `cwd` in the transcript is the workspace. Two different values used to refuse the attach as a disagreement; on the release Mac every such transcript was one session whose shell had `cd`-ed into a subfolder inside a turn, and Claude stamps each row with the process cwd of the moment. The directory the session started in keys its project folder and is the only place `--resume` finds it, so it is the answer. On the release Mac 738 of 758 transcripts resolve (before: 703); the 20 that do not are scratch sessions whose temporary directory has since been deleted, which is a refusal by design.
+- Tests: the first-cwd rule for Claude and Codex, the torn-window signal, the widening sequence against the production shape (four bookkeeping rows, a 950 KB image row, then the cwd), a short file read once, a first row past the cap refused at the cap. Mutation gate: the widening and the first-cwd rule.
+
 ## 6.48.1
 
 One derivation everywhere, a Desktop turn ends when the engine says it ended, a queued follow-up drains then instead of on the 30 s idle window, and the live feed carries the same state every row does. No client change is required: the next Control and EHPK builds read the new keys, and today's consumers ignore them.

package/README.md

@@ -200,6 +200,20 @@ after a reconnect and seeds afresh when it holds nothing, `?seed=turn` opens at
 current prompt). `COS_SESSION_HOOK_SSE=0` omits the extra status fields and the live
 state drafts; the `cursor`, `epoch` and `id:` line stay.
 
+Since 6.49.0 a Continue can land in the running session itself, so the Desktop tab or
+the `claude` in a terminal that you left open shows the turn and answers it with its own
+context, instead of a resume child writing to the transcript behind that window. It is
+off until `COS_CONTINUE_LIVE=1`. The server writes the turn to the session's own inbox
+(the socket Claude Code publishes in `~/.claude/sessions/<pid>.json`, in the line format
+its help text documents), pinned to the full session id, and calls it delivered only
+when the session's transcript shows the message accepted; every other outcome takes the
+6.48.2 path unchanged. A frame written but not seen accepted holds the turn as
+`live_unverified` (retryable) and is never written twice; only after 60 s without an
+acceptance row does the resume child run. `/api/health` reports `continueLive`
+(enabled, attempts, delivered, fallbacks by reason). The live stream also carries a
+`tool_outcome` on the status draft that follows each tool result (`+14 -2`,
+`235 lines`, `41 passed`, `exit 1`), which a client that predates it takes as a no-op.
+
 ## Configuration
 
 Config lives at `~/.cos-glasses/.env` (created on first run). Every key is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.48.1",
+  "version": "6.49.0",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -36,6 +36,7 @@ import { cosSpawnedPids } from './lib/agent-session-ownership-store.js'
 import { buildOccupancyProbes, realOccupancyDirs, withHookTurnClock } from './lib/occupancy-probes.js'
 import { realAttachedWorkspaceDeps, resolveAttachedWorkspace } from './lib/attached-workspace.js'
 import { deliverAttachedTurn, realAttachedTurnDeps } from './lib/attached-provider-adapter.js'
+import { makeLiveTurnDeliverer } from './lib/session-peer-inbox-deps.js'
 import { forkThread, realForkDeps } from './lib/fork-thread.js'
 import { nativeHead, realNativeHeadDeps } from './lib/native-head.js'
 import { threadOccupancy, holderActivity } from './lib/thread-occupancy.js'
@@ -749,6 +750,10 @@ app.use('/api', createAgentSessionBindingsRouter({
   },
   nativeHead: (provider, threadId) => nativeHead(provider, threadId, nativeHeadDeps),
   deliverAttachedTurn: deliverAttachedTurnForRoute as never,
+  // 6.49.0: the running session first (Desktop tab or iTerm, same registry record),
+  // the resume child second. Reads `COS_CONTINUE_LIVE` per call, so the flag reports
+  // on /api/health without a restart and every refusal falls back to the 6.48.2 path.
+  deliverLiveTurn: makeLiveTurnDeliverer(nativeHeadDeps),
   forkThread: forkThreadForRoute,
   // The fork's real spawn directory. Separate from `resolveTarget` above, which
   // deliberately yields only fingerprints because plan 3.3 keeps a filesystem path

package/server/lib/attached-workspace.ts

@@ -61,9 +61,20 @@ export interface AttachedWorkspaceDeps {
   cursorSpawnWorkspace?: (threadId: string) => string | null
 }
 
-/** Enough to reach a Claude message row or the Codex session meta row. */
+/**
+ * The first window read for the cwd: enough to reach a Claude message row or the Codex
+ * session meta row in the common case. NOT enough on its own (6.48.2): a session whose
+ * first prompt carries pasted screenshots opens with a single row of ~1 MB, so 512 KiB
+ * held four bookkeeping rows and a torn fifth, no cwd, and every Continue on that
+ * session was refused `target_unresolvable` (Miles, 2026-09-15, from the lens; 55 of
+ * 758 transcripts on the release Mac). When a window ends inside a row before any cwd
+ * was seen, the read widens up to WORKSPACE_SCAN_BYTES_MAX.
+ */
 export const WORKSPACE_SCAN_BYTES = 512 * 1024
 
+/** The widest head read: a first prompt with ten screenshots fits; a 13 GB rollout does not get read. */
+export const WORKSPACE_SCAN_BYTES_MAX = 16 * 1024 * 1024
+
 /** Rows to inspect before giving up. Bounds a pathological single-line file. */
 export const WORKSPACE_SCAN_ROWS = 400
 
@@ -72,19 +83,37 @@ export function fingerprint(value: string): string {
 }
 
 /**
- * Pull the recorded cwd out of transcript text.
+ * Pull the recorded cwd out of transcript text: the FIRST row that records one.
  *
  * Claude puts it at the row's top level; Codex puts it in the session meta row's
  * `payload`. A torn trailing line is NORMAL — these files are appended to — so a
  * parse failure on any single row is skipped rather than fatal.
  *
- * Returns null when no row records one, and DISAGREEMENT is also null: a transcript
- * whose rows claim two different working directories is not something to guess at.
+ * THE FIRST cwd IS THE WORKSPACE (6.48.2). Until 6.48.1 two different values in the
+ * window refused the attach as a disagreement. On the release Mac every such
+ * transcript was one session whose shell `cd`-ed inside a turn (`operations/scripts`,
+ * a weekly folder): Claude stamps each row with the process cwd of the moment, all
+ * under the directory the session was started in. That starting directory is the
+ * workspace: it keys the transcript's project folder, it is the only place
+ * `claude --resume` finds the session, and it is what the first row records.
+ *
+ * Returns null only when no row in the window records one.
  */
 export function cwdFromTranscript(text: string): string | null {
-  const seen = new Set<string>()
+  return scanForCwd(text).cwd
+}
+
+/**
+ * The scan with its outcome: the cwd, or whether the window ended INSIDE a row before
+ * any cwd was seen (a first prompt of pasted screenshots is one row of ~1 MB), which
+ * tells the resolver that a wider read can still answer.
+ */
+export function scanForCwd(text: string): { cwd: string | null; endedMidRow: boolean; rows: number } {
   let rows = 0
-  for (const line of text.split('\n')) {
+  const lines = text.split('\n')
+  // A window that does not end with a newline ended inside whatever row came last.
+  const endedMidRow = text.length > 0 && !text.endsWith('\n')
+  for (const line of lines) {
     if (rows >= WORKSPACE_SCAN_ROWS) break
     const trimmed = line.trim()
     if (!trimmed) continue
@@ -94,18 +123,14 @@ export function cwdFromTranscript(text: string): string | null {
     if (!row || typeof row !== 'object' || Array.isArray(row)) continue
     const record = row as Record<string, unknown>
     const direct = record.cwd
-    if (typeof direct === 'string' && direct.length > 0) seen.add(direct)
+    if (typeof direct === 'string' && direct.length > 0) return { cwd: direct, endedMidRow: false, rows }
     const payload = record.payload
     if (payload && typeof payload === 'object' && !Array.isArray(payload)) {
       const nested = (payload as Record<string, unknown>).cwd
-      if (typeof nested === 'string' && nested.length > 0) seen.add(nested)
+      if (typeof nested === 'string' && nested.length > 0) return { cwd: nested, endedMidRow: false, rows }
     }
-    // One consistent answer found early is enough; keep scanning only while it is
-    // still the only one, so a disagreement is detected rather than short-circuited.
-    if (seen.size > 1) return null
   }
-  if (seen.size !== 1) return null
-  return [...seen][0]!
+  return { cwd: null, endedMidRow, rows }
 }
 
 /**
@@ -145,17 +170,27 @@ export function resolveAttachedWorkspace(
   }
   if (provider !== 'claude' && provider !== 'codex') return null
   let path: string | null
-  let text: string | null
+  let cwd: string | null = null
   try {
     path = deps.transcriptPath(provider, threadId)
     if (path === null) return null
-    text = deps.readHead(path, WORKSPACE_SCAN_BYTES)
+    // Widen the head read while the window keeps ending inside a row with no cwd seen:
+    // 512 KiB, 2 MiB, 8 MiB, then the cap. A window that ended on a row boundary with
+    // no cwd is a transcript that records none, and widening would not change that.
+    let window = WORKSPACE_SCAN_BYTES
+    for (;;) {
+      const text = deps.readHead(path, window)
+      if (text === null) return null
+      const scan = scanForCwd(text)
+      cwd = scan.cwd
+      // The whole file came back (shorter than the window): there is nothing wider to read.
+      const wholeFile = Buffer.byteLength(text, 'utf8') < window
+      if (cwd !== null || wholeFile || !scan.endedMidRow || scan.rows >= WORKSPACE_SCAN_ROWS || window >= WORKSPACE_SCAN_BYTES_MAX) break
+      window = Math.min(window * 4, WORKSPACE_SCAN_BYTES_MAX)
+    }
   } catch {
     return null
   }
-  if (text === null) return null
-
-  const cwd = cwdFromTranscript(text)
   if (cwd === null) return null
   // A relative cwd would resolve against the SERVER's working directory, which is
   // not a location we control and is never what the user meant.

package/server/lib/session-peer-inbox-deps.ts

@@ -0,0 +1,156 @@
+// The real world behind `session-peer-inbox.ts`: the registry directory, the key
+// file beside each record, the session's transcript, and the flag.
+//
+// Kept apart from the pure module so the contract there never touches a path, and so
+// this file is the ONE place that knows where Claude Code keeps these things. All of
+// it is read-only: nothing here writes to `~/.claude`.
+
+import { lstatSync, readdirSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { claudeSessionsDir, REGISTRY_FILENAME } from './claude-session-registry.js'
+import { transcriptPathFor, type NativeHeadDeps } from './native-head.js'
+import { cosSpawnedPids } from './agent-session-ownership-store.js'
+import { readTranscriptTailLines } from './thread-turn-queue-store.js'
+import {
+  deliverOverPeerInbox,
+  type PeerDeliveryResult,
+  type PeerInboxRecord,
+  type TranscriptRowLike,
+} from './session-peer-inbox.js'
+
+/**
+ * `COS_CONTINUE_LIVE`. OFF by default in 6.49.0.
+ *
+ * The transport rides a protocol Claude Code documents in a help string, not a
+ * contract, and the first days are for reading the health row on one Mac. A literal
+ * '1' turns it on; anything else, including absence, keeps every Continue on the
+ * 6.48.2 path. Control's env allowlist carries the key so Update Server keeps it.
+ */
+export function continueLiveEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
+  return env.COS_CONTINUE_LIVE === '1'
+}
+
+/** Registry files are small; anything larger is not one. */
+const MAX_RECORD_BYTES = 64 * 1024
+/** `<pid>.<64 hex>.key`, the sibling of `<pid>.json`. */
+const KEY_FILENAME = /^(\d+)\.[0-9a-f]{64}\.key$/
+/** Enough of the tail to hold the acceptance row for any prompt we could have sent. */
+const ACCEPTANCE_TAIL_BYTES = 256 * 1024
+
+/** One pass over `~/.claude/sessions`, records only. Never throws. */
+export function readPeerInboxRecords(dir: string = claudeSessionsDir()): PeerInboxRecord[] {
+  let names: string[]
+  try { names = readdirSync(dir) } catch { return [] }
+  const out: PeerInboxRecord[] = []
+  for (const name of names) {
+    if (!REGISTRY_FILENAME.test(name)) continue
+    const full = join(dir, name)
+    try {
+      // lstat, not stat: a symlink here would let anything on the filesystem be read.
+      const link = lstatSync(full)
+      if (!link.isFile() || link.size > MAX_RECORD_BYTES) continue
+      const raw = JSON.parse(readFileSync(full, 'utf-8')) as Record<string, unknown>
+      const pid = Number(raw.pid)
+      const sessionId = typeof raw.sessionId === 'string' ? raw.sessionId.trim().toLowerCase() : ''
+      if (!Number.isInteger(pid) || pid <= 0 || !sessionId) continue
+      out.push({
+        pid,
+        sessionId,
+        socketPath: typeof raw.messagingSocketPath === 'string' && raw.messagingSocketPath.length > 0 ? raw.messagingSocketPath : null,
+        peerProtocol: typeof raw.peerProtocol === 'number' && Number.isInteger(raw.peerProtocol) ? raw.peerProtocol : null,
+        entrypoint: typeof raw.entrypoint === 'string' ? raw.entrypoint : null,
+        status: typeof raw.status === 'string' ? raw.status : null,
+      })
+    } catch {
+      // A torn read or a record the reaper just unlinked. Ordinary.
+      continue
+    }
+  }
+  return out
+}
+
+/**
+ * The session's peer token, or null.
+ *
+ * Auth is optional on this platform (see the pure module's header), so null is the
+ * common, acceptable answer whenever the file is absent, unreadable, or not ours.
+ * The value is returned to the caller and never logged.
+ */
+export function readPeerToken(record: PeerInboxRecord, dir: string = claudeSessionsDir()): string | null {
+  let names: string[]
+  try { names = readdirSync(dir) } catch { return null }
+  for (const name of names) {
+    const m = KEY_FILENAME.exec(name)
+    if (!m || Number(m[1]) !== record.pid) continue
+    try {
+      const full = join(dir, name)
+      const link = lstatSync(full)
+      if (!link.isFile() || link.size > 4096) return null
+      const parsed = JSON.parse(readFileSync(full, 'utf-8')) as { peerToken?: unknown }
+      return typeof parsed.peerToken === 'string' && parsed.peerToken.length > 0 ? parsed.peerToken : null
+    } catch {
+      return null
+    }
+  }
+  return null
+}
+
+/** The newest rows of the session's transcript, parsed; [] when there is no file. */
+export function readAcceptanceTail(sessionId: string, nativeHeadDeps: NativeHeadDeps): TranscriptRowLike[] {
+  const path = transcriptPathFor('claude', sessionId, nativeHeadDeps)
+  const lines = readTranscriptTailLines(path, ACCEPTANCE_TAIL_BYTES)
+  if (!lines) return []
+  const rows: TranscriptRowLike[] = []
+  for (const line of lines) {
+    if (!line.startsWith('{')) continue
+    try { rows.push(JSON.parse(line) as TranscriptRowLike) } catch { /* torn tail line */ }
+  }
+  return rows
+}
+
+export interface LiveDeliveryStats {
+  attempts: number
+  delivered: number
+  /** By reason, so the health row says WHY the spawn path was taken. */
+  fallbacks: Record<string, number>
+  lastReason: string | null
+  lastAt: number | null
+}
+
+const stats: LiveDeliveryStats = { attempts: 0, delivered: 0, fallbacks: {}, lastReason: null, lastAt: null }
+
+/** For `/api/health`. A copy, never the live object. */
+export function liveDeliveryStats(): LiveDeliveryStats {
+  return { ...stats, fallbacks: { ...stats.fallbacks } }
+}
+
+/**
+ * The route's dep: try the running session, report honestly. `disabled` is not
+ * counted as an attempt, so the health row stays quiet while the flag is off.
+ */
+export function makeLiveTurnDeliverer(nativeHeadDeps: NativeHeadDeps) {
+  return async (request: { provider: string; sessionId: string; prompt: string; verifyTimeoutMs?: number }): Promise<PeerDeliveryResult> => {
+    const result = await deliverOverPeerInbox(
+      { ...request, enabled: continueLiveEnabled() },
+      {
+        records: () => readPeerInboxRecords(),
+        token: record => readPeerToken(record),
+        transcriptTail: id => readAcceptanceTail(id, nativeHeadDeps),
+        isCosOwnedPid: pid => cosSpawnedPids().has(pid),
+        log: (level, event, detail) => {
+          const line = `[${event}] ${JSON.stringify(detail)}`
+          if (level === 'warn') console.warn(line)
+          else console.log(line)
+        },
+      },
+    )
+    if (result.reason !== 'disabled') {
+      stats.attempts += 1
+      if (result.ok) stats.delivered += 1
+      else stats.fallbacks[result.reason] = (stats.fallbacks[result.reason] ?? 0) + 1
+      stats.lastReason = result.reason
+      stats.lastAt = Date.now()
+    }
+    return result
+  }
+}

package/server/lib/session-peer-inbox.ts

@@ -0,0 +1,423 @@
+// Delivering a queued turn INTO the running Claude session, instead of only into
+// its transcript (6.49.0).
+//
+// THE PROBLEM THIS SOLVES. A Continue from the glasses reaches the session by
+// spawning `claude -p --resume <id>`, which appends the turn and its reply to the
+// session file and exits. That is correct and it is durable, but the window Miles
+// left open -- a Desktop tab, or a `claude` running in iTerm -- read that file when
+// it opened and never reads it again, so the turn he sent from the lens is invisible
+// at the desk until he resumes the session. Two of his Continues on 2026-09-15 landed
+// exactly that way: delivered, answered, and not painted anywhere he was looking.
+//
+// WHAT CLAUDE CODE ACTUALLY OFFERS. Every live session publishes an inbox in its
+// registry record (`~/.claude/sessions/<pid>.json`): `messagingSocketPath`,
+// `peerProtocol`, `peerFeatures`. The wire format is not reverse-engineered here --
+// Claude Code documents it in its own help text, which is where these two lines come
+// from verbatim:
+//
+//     { echo '{"type":"auth","token":"'"$CLAUDE_CODE_MESSAGING_TOKEN"'"}';
+//       echo '{"type":"user","message":{"role":"user","content":"hello"}}'; } | socat - UNIX-CONNECT:<sock>
+//
+// Line-delimited JSON, one connection per message. Measured on this Mac
+// (2026-09-16 13:10, throwaway session `ec2e55b0` in a scratch cwd): the message
+// landed as a real user turn, the idle session woke, answered in about three
+// seconds, and the terminal it was running in painted the whole exchange. That is
+// the continuity this module is for.
+//
+// ONE MECHANISM, BOTH SURFACES. The registry census that afternoon showed ten live
+// records -- `claude-desktop`, `cli` and `sdk-cli` -- carrying the SAME fields and
+// the same `peerProtocol: 1`. Claude Code does not distinguish a Desktop tab from a
+// terminal for messaging, so neither does this file. There is no Desktop branch and
+// no iTerm branch to drift apart.
+//
+// AUTH IS OPTIONAL, AND THAT IS A REASON FOR THE PIN, NOT AGAINST IT. A canary with
+// a deliberately wrong token still delivered; Claude Code says so itself ("peers will
+// send unauthenticated (accepted: auth is optional on this platform)"). So the token
+// is sent when the key file is readable -- forward-compatible if that ever tightens --
+// and its absence is not a failure. What actually protects the delivery is the
+// `session_id` pin: the receiver drops any frame whose `session_id` is not its own
+// (`[uds-messaging] Dropping ... message: session_id mismatch`). Pids are recycled by
+// the OS and a socket path is just a pid; the pin is what stops a turn meant for a
+// dead session landing in whatever now owns that number. Every frame carries it, and
+// selection matches the FULL session id -- never the 8-char prefix the wire uses
+// elsewhere, because a prefix is exactly the ambiguity the pin exists to remove.
+//
+// A SEND IS NOT A DELIVERY. Writing bytes into a socket proves nothing: the receiver
+// may drop the frame on the pin, hold it behind its own permission policy, or be
+// shutting down. So this module reports `delivered` only when the session's own
+// transcript shows it accepted the message. Claude Code writes a `queue-operation`
+// row with `operation: 'enqueue'` and the verbatim content the instant it accepts one
+// -- before the turn runs -- so acceptance is provable in milliseconds even when the
+// session is mid-turn and will not answer for minutes. Anything else is `unverified`,
+// and unverified falls back to the spawn path that works today.
+//
+// FAILS TOWARD THE PATH THAT ALREADY WORKS. Every refusal in this file -- flag off,
+// no record, no socket, unknown protocol, connect error, write error, no acceptance
+// row -- returns `ok: false` with a reason, and the caller spawns the resume child
+// exactly as 6.48.2 does. This module can only ever make delivery BETTER; it has no
+// branch that can make it worse.
+
+import { connect } from 'node:net'
+
+/** The only protocol this file knows how to speak. Anything else falls back. */
+export const PEER_INBOX_PROTOCOL = 1
+
+/** How long to wait for the connection itself. A live socket accepts immediately;
+ *  a stale path fails with ENOENT/ECONNREFUSED in microseconds. */
+export const PEER_CONNECT_TIMEOUT_MS = 1_500
+
+/** How long to wait for the session's transcript to show acceptance.
+ *
+ *  SIX SECONDS IS THE ACCEPTANCE WINDOW, NOT THE REPLY WINDOW. The enqueue row is
+ *  written when the message is taken, not when the turn finishes, and the measured
+ *  latency for that row was under a second on an idle session. Six leaves room for a
+ *  session busy enough to be slow at its own bookkeeping without leaving the queue
+ *  blocked on a socket that is never going to answer. */
+export const PEER_VERIFY_TIMEOUT_MS = 6_000
+
+/** Transcript poll interval while waiting for acceptance. */
+export const PEER_VERIFY_POLL_MS = 250
+
+/** Rows older than this before the send cannot be evidence of it. Covers clock skew
+ *  between the transcript's ISO stamps and our own clock. */
+export const PEER_ACCEPTANCE_BACKDATE_MS = 2_000
+
+/** Enough of the prompt to identify the row without depending on the whole of it
+ *  surviving verbatim (a long paste may be elided in some writers). */
+export const PEER_MARKER_CHARS = 120
+
+/** One live session as the registry describes it. */
+export interface PeerInboxRecord {
+  pid: number
+  /** FULL session id. A prefix is never enough here; see the header. */
+  sessionId: string
+  socketPath: string | null
+  peerProtocol: number | null
+  entrypoint: string | null
+  status: string | null
+}
+
+export type PeerDeliveryReason =
+  | 'delivered'
+  | 'disabled'
+  | 'not_claude'
+  | 'no_record'
+  | 'no_socket'
+  | 'protocol_unsupported'
+  | 'connect_failed'
+  | 'write_failed'
+  | 'unverified'
+  | 'suspect_expired'
+
+/** How the transcript proved it. `enqueue` is the fast path; `user_row` covers a
+ *  session that admitted the turn straight into a running turn. */
+export type PeerAcceptanceKind = 'enqueue' | 'user_row'
+
+export interface PeerDeliveryResult {
+  ok: boolean
+  reason: PeerDeliveryReason
+  /** Null unless `ok`. */
+  verifiedBy: PeerAcceptanceKind | null
+  /** Wall clock from first connect attempt to verdict, for the health row. */
+  elapsedMs: number
+  /** The pid the frame was addressed to, for the audit line. Null when none was chosen. */
+  pid: number | null
+}
+
+/**
+ * Which live record, if any, should receive this turn.
+ *
+ * FULL-ID EQUALITY, AND THE NON-COS RECORD WINS. A COS-spawned resume child
+ * registers under the SAME session id as the tab it resumed (6.48.1 found this the
+ * hard way), so an id can name two live processes: the user's window and a child of
+ * ours. Delivering into our own short-lived child would paint nothing and race the
+ * child's own exit, so a record whose pid the ownership store claims is skipped
+ * whenever another record is available -- and skipped entirely rather than preferred,
+ * because a turn delivered to a process that is about to exit is worse than one that
+ * falls back to a fresh child.
+ */
+export function selectPeerInbox(
+  sessionId: string,
+  records: readonly PeerInboxRecord[],
+  isCosOwnedPid: (pid: number) => boolean = () => false,
+): PeerInboxRecord | null {
+  const id = String(sessionId || '').trim()
+  if (id.length === 0) return null
+  const matches = records.filter(r =>
+    r.sessionId === id
+    && typeof r.socketPath === 'string'
+    && r.socketPath.length > 0
+    && Number.isInteger(r.pid)
+    && r.pid > 0)
+  if (matches.length === 0) return null
+  const theirs = matches.filter(r => !isCosOwnedPid(r.pid))
+  const pool = theirs.length > 0 ? theirs : []
+  if (pool.length === 0) return null
+  // Newest record wins when the user somehow has two windows on one session: the
+  // higher pid is the one started most recently, which is the one they are looking at.
+  const chosen = [...pool].sort((a, b) => b.pid - a.pid)[0]
+  return chosen ?? null
+}
+
+/**
+ * The two lines that go on the wire, in order.
+ *
+ * The auth line is omitted entirely when no token was readable, rather than sent
+ * empty: an empty token is a failed auth attempt, and a missing one is the
+ * unauthenticated path Claude Code documents as acceptable.
+ */
+export function peerInboxFrames(sessionId: string, prompt: string, token: string | null): string[] {
+  const frames: string[] = []
+  if (typeof token === 'string' && token.length > 0) {
+    frames.push(JSON.stringify({ type: 'auth', token }))
+  }
+  frames.push(JSON.stringify({
+    type: 'user',
+    session_id: sessionId,
+    message: { role: 'user', content: prompt },
+  }))
+  return frames
+}
+
+/** The identifying slice of the prompt, as it will appear in the transcript row. */
+export function peerAcceptanceMarker(prompt: string): string {
+  return String(prompt ?? '').slice(0, PEER_MARKER_CHARS)
+}
+
+/**
+ * A send whose acceptance was never seen.
+ *
+ * NEVER RESENT, NEVER SPAWNED OVER, until it expires. A frame that was written but not
+ * verified is in one of four places: dropped by the receiver, held behind its
+ * permission policy, lost with a dying process, or accepted with the transcript row
+ * still on its way. Three of those must not get a second copy, and the fourth turns
+ * into `delivered` on the next look. So the caller refuses the turn as retryable, and
+ * the retry comes back HERE first: the transcript is checked from the ORIGINAL send
+ * time (a late row counts), nothing is written to the socket again, and only once the
+ * memo is older than `SUSPECT_TTL_MS` does the turn go to the spawn path -- the one
+ * place a duplicate remains possible, and it is named in the health row when it does.
+ */
+export const SUSPECT_TTL_MS = 60_000
+
+interface SuspectSend { marker: string; sentAtMs: number }
+const suspects = new Map<string, SuspectSend>()
+
+function suspectKey(sessionId: string, marker: string): string {
+  return `${sessionId}\u0000${marker}`
+}
+
+/** Test seam. */
+export function __resetPeerInboxSuspects(): void {
+  suspects.clear()
+}
+
+/** One transcript row, reduced to what acceptance needs. */
+export interface TranscriptRowLike {
+  type?: unknown
+  operation?: unknown
+  content?: unknown
+  message?: unknown
+  timestamp?: unknown
+  sessionId?: unknown
+}
+
+function rowText(row: TranscriptRowLike): string {
+  if (typeof row.content === 'string') return row.content
+  const message = row.message
+  if (message && typeof message === 'object') {
+    const content = (message as { content?: unknown }).content
+    if (typeof content === 'string') return content
+    if (Array.isArray(content)) {
+      return content
+        .map(part => (part && typeof part === 'object' && typeof (part as { text?: unknown }).text === 'string')
+          ? (part as { text: string }).text
+          : '')
+        .join(' ')
+    }
+  }
+  return ''
+}
+
+function rowTimeMs(row: TranscriptRowLike): number | null {
+  if (typeof row.timestamp !== 'string') return null
+  const ms = Date.parse(row.timestamp)
+  return Number.isFinite(ms) ? ms : null
+}
+
+/**
+ * Did these rows accept our message?
+ *
+ * PURE, so the contract can drive it over recorded rows. An `enqueue` row is the
+ * proof Claude Code writes the moment it takes a message; a `user` row carrying the
+ * same text is the same proof one step later. Rows that predate the send cannot be
+ * evidence of it -- without that clause a retry of the same prompt would "verify"
+ * against the previous delivery's own row and report a send that never happened.
+ */
+export function peerAcceptanceIn(
+  rows: readonly TranscriptRowLike[],
+  marker: string,
+  sentAtMs: number,
+): PeerAcceptanceKind | null {
+  if (!marker) return null
+  const floor = sentAtMs - PEER_ACCEPTANCE_BACKDATE_MS
+  for (let i = rows.length - 1; i >= 0; i--) {
+    const row = rows[i]
+    const at = rowTimeMs(row)
+    if (at !== null && at < floor) continue
+    if (!rowText(row).includes(marker)) continue
+    if (row.type === 'queue-operation' && row.operation === 'enqueue') return 'enqueue'
+    if (row.type === 'user') return 'user_row'
+  }
+  return null
+}
+
+export interface PeerInboxDeps {
+  /** Live registry records. The caller owns the read so this file stays pure of paths. */
+  records: () => readonly PeerInboxRecord[] | Promise<readonly PeerInboxRecord[]>
+  /** The session's peer token, or null when unreadable. Absence is not a failure. */
+  token: (record: PeerInboxRecord) => string | null | Promise<string | null>
+  /** The tail of the session's transcript, newest last. */
+  transcriptTail: (sessionId: string) => readonly TranscriptRowLike[] | Promise<readonly TranscriptRowLike[]>
+  /** Pids COS itself spawned, so a resume child never receives the turn meant for the window. */
+  isCosOwnedPid?: (pid: number) => boolean
+  now?: () => number
+  sleep?: (ms: number) => Promise<void>
+  /** Test seam. The real one opens the unix socket. */
+  send?: (socketPath: string, frames: readonly string[]) => Promise<void>
+  log?: (level: 'info' | 'warn', event: string, detail: Record<string, unknown>) => void
+}
+
+export interface PeerInboxRequest {
+  provider: string
+  sessionId: string
+  prompt: string
+  enabled: boolean
+  verifyTimeoutMs?: number
+}
+
+function defaultSleep(ms: number): Promise<void> {
+  return new Promise(resolve => setTimeout(resolve, ms))
+}
+
+/** Open the socket, write the frames, close. Rejects on anything that is not a clean write. */
+export function sendOverPeerSocket(socketPath: string, frames: readonly string[]): Promise<void> {
+  return new Promise((resolve, reject) => {
+    let settled = false
+    const finish = (error?: Error): void => {
+      if (settled) return
+      settled = true
+      try { socket.destroy() } catch { /* already gone */ }
+      if (error) reject(error)
+      else resolve()
+    }
+    const socket = connect(socketPath)
+    const timer = setTimeout(() => finish(new Error('connect_timeout')), PEER_CONNECT_TIMEOUT_MS)
+    timer.unref?.()
+    socket.on('error', error => { clearTimeout(timer); finish(error instanceof Error ? error : new Error('socket_error')) })
+    socket.on('connect', () => {
+      clearTimeout(timer)
+      try {
+        // One write, so a half-written pair cannot leave an auth line without its
+        // message on a connection the receiver closes for silence.
+        socket.write(frames.map(line => `${line}\n`).join(''), error => {
+          if (error) { finish(error); return }
+          // The receiver reads to end-of-line and acts; nothing is written back on
+          // this protocol, so the send is complete once the bytes are flushed.
+          socket.end()
+          finish()
+        })
+      } catch (error) {
+        finish(error instanceof Error ? error : new Error('write_failed'))
+      }
+    })
+  })
+}
+
+/**
+ * Try to put this turn into the running session. Never throws.
+ *
+ * The caller treats `ok: false` as "use the spawn path", which is what 6.48.2 does
+ * today for every turn, so a false here costs nothing that was not already the cost.
+ */
+export async function deliverOverPeerInbox(
+  request: PeerInboxRequest,
+  deps: PeerInboxDeps,
+): Promise<PeerDeliveryResult> {
+  const now = deps.now ?? (() => Date.now())
+  const sleep = deps.sleep ?? defaultSleep
+  const send = deps.send ?? sendOverPeerSocket
+  const log = deps.log ?? (() => {})
+  const startedAt = now()
+  const done = (ok: boolean, reason: PeerDeliveryReason, verifiedBy: PeerAcceptanceKind | null, pid: number | null): PeerDeliveryResult => {
+    const result: PeerDeliveryResult = { ok, reason, verifiedBy, elapsedMs: Math.max(0, now() - startedAt), pid }
+    log(ok ? 'info' : 'warn', 'peer_inbox.delivery', { ...result, session: request.sessionId.slice(0, 8) })
+    return result
+  }
+
+  if (!request.enabled) return done(false, 'disabled', null, null)
+  // Codex and Cursor sessions have no Claude Code inbox. They are not a failure here,
+  // they are simply not this transport's business.
+  if (request.provider !== 'claude') return done(false, 'not_claude', null, null)
+  if (typeof request.prompt !== 'string' || request.prompt.trim().length === 0) return done(false, 'no_record', null, null)
+
+  let records: readonly PeerInboxRecord[]
+  try {
+    records = await deps.records()
+  } catch {
+    return done(false, 'no_record', null, null)
+  }
+  const target = selectPeerInbox(request.sessionId, records, deps.isCosOwnedPid)
+  if (!target) return done(false, 'no_record', null, null)
+  if (!target.socketPath) return done(false, 'no_socket', null, target.pid)
+  // An unknown protocol is refused rather than attempted: the frames below are the
+  // ones protocol 1 documents, and guessing at a successor is how a turn gets eaten.
+  if (target.peerProtocol !== null && target.peerProtocol !== PEER_INBOX_PROTOCOL) {
+    return done(false, 'protocol_unsupported', null, target.pid)
+  }
+
+  const marker = peerAcceptanceMarker(request.prompt)
+  const key = suspectKey(request.sessionId, marker)
+
+  // A retry of a send that was never verified: look before writing anything.
+  const suspect = suspects.get(key)
+  if (suspect) {
+    let rows: readonly TranscriptRowLike[] = []
+    try { rows = await deps.transcriptTail(request.sessionId) } catch { rows = [] }
+    const seen = peerAcceptanceIn(rows, marker, suspect.sentAtMs)
+    if (seen) {
+      suspects.delete(key)
+      return done(true, 'delivered', seen, target.pid)
+    }
+    if (now() - suspect.sentAtMs < SUSPECT_TTL_MS) return done(false, 'unverified', null, target.pid)
+    suspects.delete(key)
+    return done(false, 'suspect_expired', null, target.pid)
+  }
+
+  let token: string | null = null
+  try { token = await deps.token(target) } catch { token = null }
+
+  const sentAt = now()
+  try {
+    await send(target.socketPath, peerInboxFrames(target.sessionId, request.prompt, token))
+  } catch (error) {
+    const code = (error as NodeJS.ErrnoException | undefined)?.code
+    // ENOENT and ECONNREFUSED are the stale-socket shapes: the pid is gone and the
+    // file outlived it. Both are ordinary, nothing was written, and both mean "spawn
+    // the child". Anything else may have written a partial frame, so it is a suspect.
+    if (code === 'ENOENT' || code === 'ECONNREFUSED') return done(false, 'connect_failed', null, target.pid)
+    suspects.set(key, { marker, sentAtMs: sentAt })
+    return done(false, 'write_failed', null, target.pid)
+  }
+
+  const deadline = sentAt + Math.max(0, request.verifyTimeoutMs ?? PEER_VERIFY_TIMEOUT_MS)
+  for (;;) {
+    let rows: readonly TranscriptRowLike[] = []
+    try { rows = await deps.transcriptTail(request.sessionId) } catch { rows = [] }
+    const seen = peerAcceptanceIn(rows, marker, sentAt)
+    if (seen) return done(true, 'delivered', seen, target.pid)
+    if (now() >= deadline) break
+    await sleep(PEER_VERIFY_POLL_MS)
+  }
+  suspects.set(key, { marker, sentAtMs: sentAt })
+  return done(false, 'unverified', null, target.pid)
+}

package/server/lib/session-stream-events.ts

@@ -34,9 +34,29 @@ export type SessionStreamDraft =
   // predates this renders exactly as it did before rather than breaking.
   | { kind: 'prompt'; text: string }
   | { kind: 'prose'; text: string }
-  | { kind: 'status'; state: SessionStreamState }
+  // 6.49.0: `tool_outcome` rides on a status draft, never on a new kind. A shipped
+  // client drops an unknown kind BEFORE seq accounting and paints a gap row for it
+  // (the B2 finding); the same client takes a repeated `status: working` as a no-op
+  // (`event.state !== status` is false, nothing appended, no step counted). So the
+  // result of a tool arrives on the one channel every client already survives.
+  | { kind: 'status'; state: SessionStreamState; tool_outcome?: ToolOutcome }
   | { kind: 'heartbeat' }
 
+/**
+ * What a finished tool produced, in the words a lens line has room for.
+ *
+ * `ok` says whether the tool itself reported failure; `detail` is the token the
+ * client shows at the end of the step line (`+14 -2`, `41 passed`, `17 hits`,
+ * `exit 1`). Derived from the transcript's own `toolUseResult`, which is shape-keyed
+ * (a Read result carries `file.numLines`, a Bash result `stdout`), so no tool name
+ * and no hook is needed: the same row that announces the call carries its answer a
+ * few lines later, in order. Nothing here is prompt text or file content.
+ */
+export interface ToolOutcome {
+  ok: boolean
+  detail: string
+}
+
 /** A draft plus the transport's stamps. This is the JSON on the wire. */
 export type SessionStreamEvent = SessionStreamDraft & { seq: number; at: number }
 
@@ -243,6 +263,103 @@ export function detailForTool(name: unknown, input: unknown): string {
   return ''
 }
 
+/**
+ * The outcome token for one tool result, from the transcript row that carries it.
+ *
+ * SHAPE-KEYED, because the user row that holds a result names no tool: only the
+ * `tool_use_id` it answers. The structured `toolUseResult` is distinctive enough per
+ * tool (measured across this Mac's transcripts, 2026-09-16) that the shape is the
+ * name. Every branch yields a token from a COUNT or a STATUS, never from content:
+ * the client has 40 characters for it and the ledger keeps no output.
+ *
+ * Nothing worth saying yields `ok` with an empty detail, which the client renders
+ * as nothing. A result the model marked `is_error` is `ok: false` with the first
+ * words of the error, since `exit 1` or `not found` is the whole point of looking.
+ */
+export function outcomeForToolResult(
+  isError: boolean,
+  resultText: string,
+  structured: unknown,
+): ToolOutcome {
+  const text = typeof resultText === 'string' ? resultText : ''
+  if (isError) {
+    const exit = /^\s*Exit code (\d+)/.exec(text)
+    if (exit) return { ok: false, detail: `exit ${exit[1]}` }
+    const tag = /<tool_use_error>\s*([^<\n]{1,40})/.exec(text)
+    if (tag) return { ok: false, detail: oneLine(tag[1], DETAIL_MAX_CHARS) }
+    const rejected = /rejected|doesn't want to proceed|denied/i.test(text)
+    return { ok: false, detail: rejected ? 'denied' : oneLine(text, DETAIL_MAX_CHARS) || 'error' }
+  }
+  const r = asRecord(structured)
+  if (r) {
+    // Read: `{ type: 'text', file: { numLines, totalLines } }`; an image `{ type: 'image' }`.
+    const file = asRecord(r.file)
+    if (file && typeof file.numLines === 'number') {
+      const total = typeof file.totalLines === 'number' && file.totalLines > file.numLines ? ` of ${file.totalLines}` : ''
+      return { ok: true, detail: `${file.numLines}${total} lines` }
+    }
+    if (r.type === 'image') return { ok: true, detail: 'image' }
+    // Write: `{ type: 'create' | 'update', filePath }`.
+    if (r.type === 'create') return { ok: true, detail: 'created' }
+    if (r.type === 'update' && typeof r.filePath === 'string') return { ok: true, detail: 'written' }
+    // Edit: `{ oldString, newString, structuredPatch }` and no `type`.
+    if (Array.isArray(r.structuredPatch) && typeof r.oldString === 'string') {
+      const removed = countLines(r.oldString)
+      const added = countLines(r.newString)
+      return { ok: true, detail: removed === 0 && added === 0 ? 'edited' : `+${added} -${removed}` }
+    }
+    // Bash: `{ stdout, stderr, interrupted }`.
+    if (typeof r.stdout === 'string' && typeof r.stderr === 'string') {
+      if (r.interrupted === true) return { ok: false, detail: 'interrupted' }
+      const out = countLines(r.stdout)
+      const err = countLines(r.stderr)
+      if (out === 0 && err === 0) return { ok: true, detail: 'no output' }
+      if (out === 0) return { ok: true, detail: `stderr ${err} line${err === 1 ? '' : 's'}` }
+      return { ok: true, detail: `${out} line${out === 1 ? '' : 's'}` }
+    }
+    // Grep / Glob: counts when the tool gives them.
+    if (typeof r.numFiles === 'number') return { ok: true, detail: `${r.numFiles} file${r.numFiles === 1 ? '' : 's'}` }
+    if (typeof r.numMatches === 'number') return { ok: true, detail: `${r.numMatches} hit${r.numMatches === 1 ? '' : 's'}` }
+    if (Array.isArray(r.filenames)) return { ok: true, detail: `${r.filenames.length} file${r.filenames.length === 1 ? '' : 's'}` }
+    // WebFetch: `{ code, bytes, durationMs }`. WebSearch: `{ searchCount, results }`.
+    if (typeof r.code === 'number' && typeof r.bytes === 'number') {
+      return { ok: r.code < 400, detail: `${r.code} · ${Math.max(1, Math.round(r.bytes / 1024))} KB` }
+    }
+    if (Array.isArray(r.results) && typeof r.searchCount === 'number') {
+      return { ok: true, detail: `${r.results.length} result${r.results.length === 1 ? '' : 's'}` }
+    }
+    // Agent / teammate spawn.
+    if (r.status === 'teammate_spawned' || typeof r.agent_id === 'string') return { ok: true, detail: 'spawned' }
+  }
+  // Grep's plain-text answer, when the structured form did not carry the count.
+  const found = /Found (\d+) (files?|matches?)/i.exec(text)
+  if (found) return { ok: true, detail: `${found[1]} ${found[2].startsWith('file') ? 'file' : 'hit'}${found[1] === '1' ? '' : 's'}` }
+  if (/^No (files|matches) found/i.test(text)) return { ok: true, detail: 'none' }
+  return { ok: true, detail: '' }
+}
+
+/** The result blocks of a user record, paired with the row's structured result. */
+export function outcomeDrafts(record: Record<string, unknown>, message: Record<string, unknown>): SessionStreamDraft[] {
+  const content = message.content
+  if (!Array.isArray(content)) return []
+  const out: SessionStreamDraft[] = []
+  for (const raw of content) {
+    const block = asRecord(raw)
+    if (!block || block.type !== 'tool_result') continue
+    const inner = block.content
+    const text = typeof inner === 'string'
+      ? inner
+      : Array.isArray(inner)
+        ? inner.map(part => (asRecord(part)?.text as string | undefined) ?? '').join(' ')
+        : ''
+    const outcome = outcomeForToolResult(block.is_error === true, text, record.toolUseResult)
+    // A tool result means the turn is working by definition: the model called a
+    // tool and is about to read what came back.
+    out.push({ kind: 'status', state: 'working', tool_outcome: outcome })
+  }
+  return out
+}
+
 function toolDraft(name: unknown, input: unknown): SessionStreamDraft {
   const verb = verbForToolName(name)
   const target = targetForTool(name, input)
@@ -351,10 +468,14 @@ function draftsFromClaudeRecord(record: Record<string, unknown>): SessionStreamD
   // the glasses have never seen it. Dropping it is what made the live view a blank
   // slate that said WORKING and nothing else.
   //
-  // Tool results stay dropped -- the call was already announced.
+  // A tool result is not a prompt, but since 6.49.0 it is not dropped either: it
+  // becomes the OUTCOME of the call announced a few rows earlier, on a status draft
+  // (see `ToolOutcome`). The prompt path still sees nothing for it.
   if (type === 'user') {
     const message = asRecord(record.message)
-    return message ? promptDrafts(message) : []
+    if (!message) return []
+    const outcomes = outcomeDrafts(record, message)
+    return outcomes.length > 0 ? outcomes : promptDrafts(message)
   }
 
   const role = typeof record.role === 'string' ? record.role : ''
@@ -577,10 +698,10 @@ export interface DerivedStatusFields {
   last_reply?: string
 }
 
-export type StatusDraftWithDerived = { kind: 'status'; state: SessionStreamState } & Partial<DerivedStatusFields>
+export type StatusDraftWithDerived = { kind: 'status'; state: SessionStreamState; tool_outcome?: ToolOutcome } & Partial<DerivedStatusFields>
 
 export function statusDraftWithDerived(
-  draft: { kind: 'status'; state: SessionStreamState },
+  draft: { kind: 'status'; state: SessionStreamState; tool_outcome?: ToolOutcome },
   derived: DerivedStatusFields | undefined,
 ): StatusDraftWithDerived {
   if (!derived) return draft
@@ -591,6 +712,8 @@ export function statusDraftWithDerived(
   return {
     kind: 'status',
     state,
+    // 6.49.0: the outcome is the draft's own fact, not the deriver's; it rides through.
+    ...(draft.tool_outcome ? { tool_outcome: draft.tool_outcome } : {}),
     agent_state: derived.agent_state,
     state_source: derived.state_source,
     state_since: derived.state_since,

package/server/lib/thread-turn-queue-store.ts

@@ -153,12 +153,22 @@ export function transcriptTurnEnded(provider: SessionStreamProvider, path: strin
 
 /** The bounded tail as lines, with the same two open flags; null when it cannot be read. */
 function readTail(path: string | null): string[] | null {
+  return readTranscriptTailLines(path, TURN_END_TAIL_BYTES)
+}
+
+/**
+ * The last `maxBytes` of a transcript as lines, null when unreadable. Exported (6.49.0)
+ * so the live-delivery verifier reads the transcript the same way the drain does: the
+ * same open flags, the same fragment rule. Two readers with different rules would
+ * disagree about the same file on the day it mattered.
+ */
+export function readTranscriptTailLines(path: string | null, maxBytes: number): string[] | null {
   if (!path || !existsSync(path)) return null
   try {
     const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK)
     try {
       const size = fstatSync(fd).size
-      const start = Math.max(0, size - TURN_END_TAIL_BYTES)
+      const start = Math.max(0, size - maxBytes)
       const buf = Buffer.alloc(size - start)
       readSync(fd, buf, 0, buf.length, start)
       const lines = buf.toString('utf-8').split('\n')

package/server/routes/agent-session-bindings.ts

@@ -333,6 +333,16 @@ export interface AgentSessionBindingsDeps {
   /** `deliverAttachedTurn` from `server/lib/attached-provider-adapter.ts`. */
   deliverAttachedTurn?: (request: AttachedTurnRequest) => Promise<unknown> | unknown
 
+  /**
+   * 6.49.0: put the turn INTO the running session before spawning a child for it.
+   *
+   * `makeLiveTurnDeliverer` from `server/lib/session-peer-inbox-deps.ts`. Optional so
+   * every existing test and every older wiring is byte-for-byte the 6.48.2 route; when
+   * absent, or when it answers anything but `ok`, the spawn path below runs unchanged.
+   * Only `reason` is read here; the vocabulary is the pure module's.
+   */
+  deliverLiveTurn?: (request: { provider: string; sessionId: string; prompt: string; verifyTimeoutMs?: number }) => Promise<{ ok: boolean; reason: string; verifiedBy?: string | null; pid?: number | null }>
+
   /**
    * The self-recursion ledger. Defaults to the real process-wide one.
    *
@@ -483,6 +493,10 @@ export type WriteRefusal =
   | 'provider_never_opened'
   | 'delivery_ambiguous'
   | 'turn_failed'
+  // 6.49.0: the live transport wrote a frame it could not see accepted. The turn is
+  // held as retryable and the retry re-reads before doing anything (see
+  // `session-peer-inbox.ts`); it is never a fence, because nothing here ran a child.
+  | 'live_unverified'
   // ------------------------------------------------------------------- fork
   //
   // Fork gets its OWN members rather than reusing the ones above, and the reason
@@ -555,6 +569,8 @@ export const WRITE_REASON_COPY: Record<Exclude<WriteRefusal, OccupancyReason>, s
     'The assistant never opened the thread, so nothing was sent. You can try again.',
   delivery_ambiguous:
     'COS lost track of this turn after sending it. Open the thread on your Mac and check before sending again.',
+  live_unverified:
+    'Sent to the open session, but not yet confirmed. COS will check again in a moment.',
   turn_failed:
     'COS could not run this turn. Nothing was sent. You can try again.',
 
@@ -1265,6 +1281,18 @@ function plainBody(req: Request): Record<string, unknown> | null {
 
 export const ATTACHED_COPY = 'Attached. COS is driving the original thread.'
 export const TURN_SENT_COPY = 'Sent to the original thread.'
+/** 6.49.0: the turn went into the running session, where the desk will see it. */
+export const TURN_SENT_LIVE_COPY = 'Sent to the open session. It will show where you left it.'
+/**
+ * How long the route waits for the session's transcript to show acceptance.
+ *
+ * FOUR SECONDS, INSIDE THE CLIENT'S TEN. The phone's `fetchJSON` aborts at 10 s; the
+ * gate ahead of this point costs about a second, the connect up to 1.5 s, so four
+ * leaves margin. Measured acceptance on an idle session was under one second, so the
+ * budget only bites when the receiver is holding or dying, and those end as
+ * `live_unverified`, which the client may retry.
+ */
+export const LIVE_VERIFY_BUDGET_MS = 4_000
 
 /**
  * The 202 copy. Says QUEUED and not sent, because at this instant the provider has
@@ -2125,6 +2153,56 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
       if (!pinned?.binding) return refuseTurn(registryRefusal(pinned?.reason))
       pinnedBindingId = bindingId
 
+      // 6.49.0: LIVE FIRST. If the session's own process is running -- a Desktop tab,
+      // a `claude` in iTerm, the same registry record either way -- the turn goes into
+      // it and paints where the user left the window, instead of into a resume child
+      // whose reply that window never shows. Before the 202 on purpose: a live delivery
+      // is a `completed` turn (terminal, ledgered, replay-safe), and a frame that could
+      // not be verified is a PRE-202 refusal, which the ledger does not record, so the
+      // client's retry re-evaluates rather than replaying a stale "no". The gate above
+      // still ran in full: this is the same admission, with a different last hop.
+      //
+      // The head is NOT acknowledged here. The session will move it when it answers,
+      // on its own clock; the next interactive turn reads that as a change and asks,
+      // which is the conservative side. Queued turns attach fresh and never notice.
+      if (typeof deps.deliverLiveTurn === 'function' && binding.provider === 'claude') {
+        let live: { ok: boolean; reason: string; verifiedBy?: string | null; pid?: number | null } | null = null
+        try {
+          live = await deps.deliverLiveTurn({
+            provider: binding.provider,
+            sessionId: binding.nativeThreadId,
+            prompt,
+            verifyTimeoutMs: LIVE_VERIFY_BUDGET_MS,
+          })
+        } catch (error) {
+          // A throw is a bug in the transport, not a fact about the session; the
+          // spawn path is the answer to both.
+          console.error(`[agent-session-bindings] live delivery threw: ${error instanceof Error ? error.message : error}`)
+          live = null
+        }
+        if (live?.ok) {
+          console.log(`[agent-session-bindings] turn delivered live provider=${binding.provider} turnId=${turnId} bindingId=${bindingId} verifiedBy=${live.verifiedBy ?? 'unknown'} pid=${live.pid ?? 'null'}`)
+          respond(200, {
+            turnId,
+            outcome: 'completed',
+            deliveryState: 'delivered',
+            via: 'live',
+            retryable: false,
+            changed: false,
+            revision: null,
+            reason: null,
+            reasonCopy: TURN_SENT_LIVE_COPY,
+          })
+          return
+        }
+        if (live && (live.reason === 'unverified' || live.reason === 'write_failed')) {
+          // Something may be in the session. Hold, never spawn over it.
+          return refuseTurn('live_unverified', { retryable: true, deliveryState: 'unknown' })
+        }
+        // disabled / not_claude / no_record / no_socket / protocol_unsupported /
+        // connect_failed / suspect_expired: nothing reached a session. Spawn as always.
+      }
+
       // THE QUEUE POINT. Every gate is now behind us — body, replay, queued-prompt,
       // lease, target, epoch, fence, claim, occupancy, head baseline, pin — so a
       // refusal still reaches the user immediately and precisely. Only the spawn is

package/server/routes/health.ts

@@ -80,6 +80,29 @@ import {
   threadAttachHealthFields,
 } from '../lib/thread-attach-capability.js'
 import { sessionHooksHealthFields } from '../lib/session-hooks-runtime.js'
+import { continueLiveEnabled, liveDeliveryStats } from '../lib/session-peer-inbox-deps.js'
+
+/**
+ * 6.49.0: which last hop a Continue takes, and how often each fell back.
+ *
+ * `enabled` is the flag as read RIGHT NOW; the counters are this process's. A
+ * reader who sees `enabled: true` and `delivered: 0` with fallbacks under
+ * `no_record` has a session registry the server cannot see; under `unverified`,
+ * a session that is holding or dying. Both are diagnoses, not guesses.
+ */
+export function continueLiveHealthFields(): Record<string, unknown> {
+  const stats = liveDeliveryStats()
+  return {
+    continueLive: {
+      enabled: continueLiveEnabled(),
+      attempts: stats.attempts,
+      delivered: stats.delivered,
+      fallbacks: stats.fallbacks,
+      lastReason: stats.lastReason,
+      lastAt: stats.lastAt,
+    },
+  }
+}
 
 export const healthRouter = Router()
 
@@ -351,6 +374,7 @@ healthRouter.get('/health', async (_req, res) => {
     server_version: managedServerVersion(),
     ...threadAttachHealthFields(threadAttach),
     ...sessionHooksHealthFields(),
+    ...continueLiveHealthFields(),
     server_instance_id: getServerInstanceId(),
     boot_id: serverMetrics.bootId,
     generation_id: getServerGenerationId(),