@gotcos/glasses-server 6.49.0 → 6.49.1

package/CHANGELOG.md

@@ -1,3 +1,18 @@
+## 6.49.1
+
+Where a turn's time goes, and the two things the /qa pass on 6.49.0 found that made a follow-up wait or repeat.
+
+- **A lease yields.** A Continue binding held its thread for the whole 30 min TTL after its turn completed, and every client attaches per send (the phone on every Send, the queue drainer on every drain, the lens on every hold), so the second follow-up on a thread within half an hour was parked behind a binding nobody was using. Measured 2026-09-16: three phone follow-ups queued 17:19-17:28 landed at 17:52, the minute after the lens's binding expired, with the session idle throughout. Now an unpinned binding yields 90 s after its last turn ended (`IDLE_LEASE_YIELD_MS`): the next attach supersedes it in the same registry mutation, so the thread never has two live bindings and a late turn on the old one reads `binding_detached`. A binding with a turn in flight, or younger than 90 s (the lens attaches before the wearer dictates), still refuses `native_target_busy`. The queue drainer's `attachable` probe uses the same predicate, so it never holds behind a lease the attach would supersede.
+- **The turn ledger is per thread, not per binding.** A draft's idempotency key (app 6.9.487/488) can arrive through a new binding: the phone re-attaches on every Send, and a draft parked after `target_busy` drains through the drainer's own binding. `findTurn` read only that binding's rows, so the repeat was delivered again; QA reproduced it against the real registry. It now reads every binding of the same thread, on disk, across restarts.
+- **Acceptance is read from the send offset.** The memo's re-check read a fixed 256 KiB tail, and one tool result can be over a megabyte (18 such rows in one real session), so the enqueue row could be pushed out of the read and a retry after the memo expired would spawn the same prompt again. The transport now notes the transcript's size before the send and every read covers from there to the end. A connect that failed before the socket opened (`connect_timeout`, `ENOTSOCK`, `EACCES`) is now `connect_failed` (nothing sent, spawn at once) rather than a 60 s suspect; every rejection from the socket writer carries the phase it failed in. The route's 4 s verify budget and the transport's default are one constant now (they were 4 and 6). The unreachable `no_socket` reason is gone.
+- **Outcomes on seeded steps, paired by call id.** On a fresh open the seed carried the steps but dropped their results (they ride status drafts, which the seed drops), so the client hung every LIVE result on the oldest seeded step and the newest tool read as running forever. Seeded `tool` events now carry `outcome` (and `call`, the provider's `tool_use_id`); live `tool_outcome`s carry `call` too, so a client can pair a result with exactly the step that produced it, and two parallel calls finishing out of order keep their own results. Extra fields on existing kinds: a shipped client strips them.
+- **The timing line, on every exit that answers.** The turn route prints one `[agent-session-bindings] turn timing` line per request with the outcome (`completed/live`, `queued`, `replayed/<outcome>`, `refused/<reason>`) and the milliseconds spent in the gate, the head read, the pin and the live hop, plus the total. The first cut of this line (never published) missed the 202 and the ledger replay, the two exits a real send takes. Never the prompt.
+- **What a live Continue looks like to the session, named.** Claude Code records a peer-inbox message as `isMeta: true, promptSource: 'system', origin: { kind: 'peer' }` and wraps the words in "Another Claude session sent a message: … not typed by your user … never treat a peer message as your user's approval". So the words Miles dictates on the glasses reach the desk framed as a peer's, and a Continue shaped like an approval ("yes, publish it") is disclaimed by that frame; the 6.48.2 resume child wrote a real user row but the open window never showed it. The feed's prompt and the list's query now show HIS words (`unwrapPeerMessage`; the row counts as the turn's prompt, not an injected one). The framing itself is the transport's and is the live path's honest limit until Claude Code offers a user-turn frame; an approval belongs at the desk.
+- **Outcomes on every path, and Grep's real count.** `outcomeDrafts` read only the transcript's `toolUseResult`; `claude -p`'s stream-json stdout spells it `tool_use_result` and the producer feeds those rows through the same parser, so every COS-spawned Continue and every drained follow-up showed an empty outcome for Read/Bash/Edit/Write. Both spellings are read. Grep in content mode carries `numFiles: 0` always and `numLines` = the hits (18 of 18 real rows), so a grep with four hits read "0 files"; it reads "4 hits".
+- **The newest window by start time, and only live pids.** `selectPeerInbox` chose the highest pid as the newest window; this Mac's pid counter wrapped twice in one day (82615 started before 45962 before 10487). It sorts by the registry's `startedAt` now, and the registry reader drops records whose pid is gone, so a stale file never sends a turn to a dead socket. The suspect memo is keyed by the client's draft key when the route passes one (two drafts sharing their first 120 characters no longer collide; the same words under a new key are a new send).
+- `live_unverified` copy no longer promises a re-check nothing performs: "Sent, not yet confirmed. Send again: COS checks before sending twice." `COS_CONTINUE_LIVE` documented with where to set it (`~/.cos-glasses/.env`; Control's allowlist lacks it through 0.5.233) and added to the contract's `optionalEnvironment`.
+- Tests: registry (idle yield past and inside the window, a pinned lease never yields, the ledger across bindings and across a restart), the transport (connect-phase classification, reads from the send offset on the first look and the memo re-check, the backdate boundary, the real unix socket byte-for-byte), the route (the budget reaches the transport; one timing line on the 202, the replay, the live 200 and a refusal; never the prompt), the seed fold (by call id out of order, by order, never twice) and the stream route seeding an outcome on a finished step; the peer frame unwrapped on the stream and in the list (the real row from 2026-09-16). Mutation gate: seventeen new cases on a green baseline. New test file `session-peer-inbox-deps.test.ts` for the registry and key readers, which had none.
+
 ## 6.49.0
 
 A Continue lands in the session you left open, and the live feed says what every step produced.

package/README.md

@@ -212,7 +212,18 @@ when the session's transcript shows the message accepted; every other outcome ta
 acceptance row does the resume child run. `/api/health` reports `continueLive`
 (enabled, attempts, delivered, fallbacks by reason). The live stream also carries a
 `tool_outcome` on the status draft that follows each tool result (`+14 -2`,
-`235 lines`, `41 passed`, `exit 1`), which a client that predates it takes as a no-op.
+`235 lines`, `41 lines`, `exit 1`), which a client that predates it takes as a no-op.
+**Where to set the flag:** `~/.cos-glasses/.env` (read at boot; the plist wins when
+both carry it). COS Control's allowlist does not carry `COS_CONTINUE_LIVE` through
+0.5.233, so a value set only in the LaunchAgent plist is dropped by the next
+Install/Repair/Update Server; Control 0.5.234 is to add it.
+Since 6.49.1 a lease yields: a completed, unpinned Continue binding stops holding its
+thread 90 s after its turn ends (it held it for the whole 30 min TTL before), so a
+follow-up from another surface, or the queue drainer, attaches at once instead of
+waiting out the lease; a binding with a turn in flight still refuses `native_target_busy`.
+The turn ledger is read across every binding of a thread, so a draft re-sent through a
+new binding (the phone attaches per send; a parked draft drains through the drainer's
+own) replays rather than repeats.
 
 ## Configuration
 

package/managed-runtime-contract.json

@@ -28,6 +28,7 @@
     "COS_CODEX_SANDBOX",
     "COS_SCRIPTS_DIR",
     "COS_SESSION_HOOKS",
+    "COS_CONTINUE_LIVE",
     "COS_SESSION_HOOKS_SPOOL_DIR",
     "COS_SESSION_HOOK_SSE",
     "COS_PERMISSION_BROKER",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.49.0",
+  "version": "6.49.1",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -610,11 +610,15 @@ if (threadAttachEnabled()) {
       try {
         const v = threadOccupancy(provider, threadId, occupancyProbes, occupancyDirs)
         if (v.attachable !== true) return { attachable: false, reason: v.reason ?? null }
-        // Occupancy is happy; ask the registry the question it cannot answer.
-        // `getByThread` returns the binding ONLY when it actually blocks the target
-        // (`blocksTarget`), so an expired or terminal one correctly reads as free.
-        const holder = agentSessionBindingRegistry.getByThread(provider, threadId, Date.now())
-        if (holder !== null) return { attachable: false, reason: 'native_target_busy' }
+        // Occupancy is happy; ask the registry the question it cannot answer, with
+        // the SAME predicate the attach route's `create` applies (6.49.1): a pinned
+        // holder, or one touched within `IDLE_LEASE_YIELD_MS`, is busy; an idle lease
+        // past that is one the attach will supersede, so the drainer must not hold
+        // behind it. Until 6.49.0 this read `getByThread` (any live lease blocks), and a
+        // follow-up queued after a completed Continue waited out the full 30 min TTL.
+        if (agentSessionBindingRegistry.attachBlocked(provider, threadId, Date.now())) {
+          return { attachable: false, reason: 'native_target_busy' }
+        }
         // THE FENCE, for the same reason the binding is here and not one layer down.
         // This is ADVISORY: the attach route stays the authority that refuses. Saying
         // it here only means the drainer holds instead of spending an attempt, and a

package/server/lib/agent-session-binding-registry.ts

@@ -147,6 +147,26 @@ export const DEFAULT_STALE_PIN_MS = 24 * 60 * 60 * 1000
  */
 export const PIN_JOB_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}$/
 
+/**
+ * How long an UNPINNED lease keeps its target against a new attach (6.49.1).
+ *
+ * Until 6.49.0 a binding held its target for the whole TTL (30 min) after its turn
+ * completed, and every client attaches per send: the phone on every Send, the queue
+ * drainer on every drain, the lens on every hold. So the SECOND follow-up on a thread
+ * within half an hour was parked behind a binding nobody was using. Measured
+ * 2026-09-16: three phone follow-ups queued 17:19-17:28 landed at 17:52, the minute
+ * after the lens's binding expired, with the session idle the whole time.
+ *
+ * A PINNED holder (a turn in flight) still refuses: that is the two-writer hazard the
+ * lease exists for. An unpinned holder younger than this still refuses too, because
+ * the lens attaches BEFORE the wearer dictates and posts the turn after; superseding
+ * it mid-dictation would turn the send into `binding_detached`. Past this age the
+ * holder yields: it is detached in the same mutation that creates its successor, so
+ * the target never has two live bindings, a late turn on it reads `binding_detached`,
+ * and its turn ledger stays readable for a replay (see `findTurn`).
+ */
+export const IDLE_LEASE_YIELD_MS = 90_000
+
 export type RegistryRejection =
   | BindingRejection
   | 'store_unavailable'
@@ -735,7 +755,10 @@ export class AgentSessionBindingRegistry {
 
       const holderId = this.targets.get(key)
       const holder = holderId === undefined ? undefined : this.records.get(holderId)
-      if (holder && blocksTarget(holder.binding, now)) return reject('target_busy')
+      if (holder && holderBlocksAttach(holder, now)) return reject('target_busy')
+      // An idle lease past `IDLE_LEASE_YIELD_MS` yields (6.49.1): detached below, in
+      // this same mutation, so the target never carries two live bindings.
+      const superseded = holder && blocksTarget(holder.binding, now) ? holder : null
 
       const floor = this.floors.get(key) ?? 0
       if (!this.floors.has(key) && this.floors.size >= this.maxEpochTargets) {
@@ -766,6 +789,14 @@ export class AgentSessionBindingRegistry {
       // `binding_expired` / `binding_detached` rather than `unknown_binding`) but
       // gives up the target.
       if (holderId !== undefined) targets.delete(key)
+      if (superseded) {
+        records.set(superseded.binding.bindingId, {
+          ...superseded,
+          binding: freezeBinding(forceDetachBinding(superseded.binding)),
+          updatedAt: now,
+          terminalAt: superseded.terminalAt ?? now,
+        })
+      }
 
       if (records.size >= this.maxRetainedBindings) {
         const freed = evictOldestDisposable(records, targets, now, records.size - this.maxRetainedBindings + 1)
@@ -917,9 +948,41 @@ export class AgentSessionBindingRegistry {
   findTurn(bindingId: unknown, turnId: unknown): TurnRecord | null {
     if (typeof bindingId !== 'string' || typeof turnId !== 'string') return null
     if (!TURN_ID_RE.test(turnId)) return null
-    const rows = this.turns.get(bindingId)
-    if (!rows) return null
-    return rows.find(row => row.turnId === turnId) ?? null
+    const own = this.turns.get(bindingId)?.find(row => row.turnId === turnId) ?? null
+    if (own) return own
+    // 6.49.1: the key is per DRAFT (app 6.9.487/488), and a re-sent draft can arrive
+    // through a NEW binding on the same target: the phone attaches on every Send, and
+    // a draft parked after `target_busy` is drained through a binding of the drainer's
+    // own. A ledger scoped to one binding answered null there and the prompt was
+    // delivered a second time (QA, 2026-09-16, reproduced against this registry). The
+    // target is the unit the human sees, so the ledger is read across every binding
+    // that ever held it.
+    const record = this.records.get(bindingId)
+    if (!record) return null
+    const key = record.binding.targetKey
+    for (const [id, other] of this.records) {
+      if (id === bindingId || other.binding.targetKey !== key) continue
+      const hit = this.turns.get(id)?.find(row => row.turnId === turnId)
+      if (hit) return hit
+    }
+    return null
+  }
+
+  /**
+   * Would a new attach to this thread be refused `target_busy` right now?
+   *
+   * ONE predicate for the attach path and for the queue drainer's `attachable`
+   * probe, so the drainer never holds a turn behind a lease that `create` would
+   * supersede, and never attempts one that `create` would refuse. See
+   * `IDLE_LEASE_YIELD_MS`.
+   */
+  attachBlocked(provider: unknown, nativeThreadId: unknown, now: number): boolean {
+    if (!this.available()) return false
+    if (!isBindableProvider(provider) || !isValidNativeThreadId(nativeThreadId)) return false
+    const id = this.targets.get(makeTargetKey(provider, nativeThreadId))
+    if (id === undefined) return false
+    const record = this.records.get(id)
+    return record ? holderBlocksAttach(record, now) : false
   }
 
   /**
@@ -1201,6 +1264,17 @@ function blocksTarget(binding: NativeBinding, now: number): boolean {
   return !isExpired(binding, now)
 }
 
+/**
+ * Does this holder refuse a new attach? Pinned: always. Unpinned and alive: only
+ * while younger than `IDLE_LEASE_YIELD_MS` (`updatedAt` moves on every pin and
+ * unpin, so this is "since its last turn ended, or since it attached").
+ */
+function holderBlocksAttach(record: BindingRecord, now: number): boolean {
+  if (!blocksTarget(record.binding, now)) return false
+  if (isPinned(record.binding)) return true
+  return !(Number.isFinite(now) && now - record.updatedAt >= IDLE_LEASE_YIELD_MS)
+}
+
 /** Evict retained-but-dead records, oldest first. Never touches a blocking one. */
 function evictOldestDisposable(
   records: Map<string, BindingRecord>,

package/server/lib/agent-session-store.ts

@@ -11,6 +11,7 @@ import { homedir } from 'node:os'
 import { join } from 'node:path'
 import { createInterface } from 'node:readline'
 import { promisify } from 'node:util'
+import { unwrapPeerMessage } from './session-stream-events.js'
 
 const execFileAsync = promisify(execFile)
 
@@ -1740,9 +1741,15 @@ export async function parseAgentSession(
       }
       if (obj.type === 'user') {
         userCount += 1
-        collectTurn(text, tail, obj.isMeta === true || obj.isCompactSummary === true)
-        if (!firstPrompt) firstPrompt = firstLineTitle(text)
-        if (!title) title = firstLineTitle(text)
+        // 6.49.1: a live Continue arrives as a peer-inbox row (`isMeta`, `origin.kind`
+        // 'peer') wrapped in Claude Code's "Another Claude session sent a message"
+        // frame. It IS the user's prompt (dictated on the glasses), so it is the
+        // turn's query and never an injected row; the frame is stripped.
+        const peer = (obj.origin as { kind?: unknown } | undefined)?.kind === 'peer' ? unwrapPeerMessage(text) : null
+        const query = peer ?? text
+        collectTurn(query, tail, peer === null && (obj.isMeta === true || obj.isCompactSummary === true))
+        if (!firstPrompt) firstPrompt = firstLineTitle(query)
+        if (!title) title = firstLineTitle(query)
       } else {
         assistantCount += 1
         rememberAssistant(text, tail)

package/server/lib/session-peer-inbox-deps.ts

@@ -5,7 +5,7 @@
 // this file is the ONE place that knows where Claude Code keeps these things. All of
 // it is read-only: nothing here writes to `~/.claude`.
 
-import { lstatSync, readdirSync, readFileSync } from 'node:fs'
+import { lstatSync, readdirSync, readFileSync, statSync } from 'node:fs'
 import { join } from 'node:path'
 import { claudeSessionsDir, REGISTRY_FILENAME } from './claude-session-registry.js'
 import { transcriptPathFor, type NativeHeadDeps } from './native-head.js'
@@ -24,7 +24,12 @@ import {
  * The transport rides a protocol Claude Code documents in a help string, not a
  * contract, and the first days are for reading the health row on one Mac. A literal
  * '1' turns it on; anything else, including absence, keeps every Continue on the
- * 6.48.2 path. Control's env allowlist carries the key so Update Server keeps it.
+ * 6.48.2 path.
+ *
+ * WHERE TO SET IT. `~/.cos-glasses/.env` (read at boot by `env.ts`, the plist wins
+ * when both carry it). Control's `providerEnvironmentKeys` allowlist does NOT carry
+ * this key through 0.5.233, so a value set only in the LaunchAgent plist is dropped
+ * by the next Install/Repair/Update Server; Control 0.5.234 is to add it.
  */
 export function continueLiveEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
   return env.COS_CONTINUE_LIVE === '1'
@@ -34,11 +39,23 @@ export function continueLiveEnabled(env: NodeJS.ProcessEnv = process.env): boole
 const MAX_RECORD_BYTES = 64 * 1024
 /** `<pid>.<64 hex>.key`, the sibling of `<pid>.json`. */
 const KEY_FILENAME = /^(\d+)\.[0-9a-f]{64}\.key$/
-/** Enough of the tail to hold the acceptance row for any prompt we could have sent. */
+/** The default tail when the caller cannot say how much was appended since its send.
+ *  The caller normally can (`transcriptSize` below), and then asks for at least the
+ *  bytes written since plus slack, so a megabyte tool result landing after the
+ *  acceptance row cannot push the row out of the read. */
 const ACCEPTANCE_TAIL_BYTES = 256 * 1024
+/** Never read more than this in one verification, whatever was appended. */
+const ACCEPTANCE_TAIL_MAX_BYTES = 16 * 1024 * 1024
+
+/** Is a process with this pid alive (signal 0)? EPERM counts as alive: it exists, it is not ours. */
+export function pidAlive(pid: number): boolean {
+  try { process.kill(pid, 0); return true } catch (error) {
+    return (error as NodeJS.ErrnoException | undefined)?.code === 'EPERM'
+  }
+}
 
-/** One pass over `~/.claude/sessions`, records only. Never throws. */
-export function readPeerInboxRecords(dir: string = claudeSessionsDir()): PeerInboxRecord[] {
+/** One pass over `~/.claude/sessions`, live records only. Never throws. */
+export function readPeerInboxRecords(dir: string = claudeSessionsDir(), alive: (pid: number) => boolean = pidAlive): PeerInboxRecord[] {
   let names: string[]
   try { names = readdirSync(dir) } catch { return [] }
   const out: PeerInboxRecord[] = []
@@ -53,6 +70,10 @@ export function readPeerInboxRecords(dir: string = claudeSessionsDir()): PeerInb
       const pid = Number(raw.pid)
       const sessionId = typeof raw.sessionId === 'string' ? raw.sessionId.trim().toLowerCase() : ''
       if (!Number.isInteger(pid) || pid <= 0 || !sessionId) continue
+      // Liveness (6.49.1): a record whose pid is gone is a stale file the reaper has not
+      // reached; choosing it would send the turn to a dead socket and then to the spawn
+      // path, silently, on a session that may have a live window under another pid.
+      if (!alive(pid)) continue
       out.push({
         pid,
         sessionId,
@@ -60,6 +81,7 @@ export function readPeerInboxRecords(dir: string = claudeSessionsDir()): PeerInb
         peerProtocol: typeof raw.peerProtocol === 'number' && Number.isInteger(raw.peerProtocol) ? raw.peerProtocol : null,
         entrypoint: typeof raw.entrypoint === 'string' ? raw.entrypoint : null,
         status: typeof raw.status === 'string' ? raw.status : null,
+        startedAt: typeof raw.startedAt === 'number' && Number.isFinite(raw.startedAt) ? raw.startedAt : null,
       })
     } catch {
       // A torn read or a record the reaper just unlinked. Ordinary.
@@ -95,10 +117,19 @@ export function readPeerToken(record: PeerInboxRecord, dir: string = claudeSessi
   return null
 }
 
-/** The newest rows of the session's transcript, parsed; [] when there is no file. */
-export function readAcceptanceTail(sessionId: string, nativeHeadDeps: NativeHeadDeps): TranscriptRowLike[] {
+/** The transcript's size in bytes, or null when there is no file. */
+export function readTranscriptSize(sessionId: string, nativeHeadDeps: NativeHeadDeps): number | null {
+  const path = transcriptPathFor('claude', sessionId, nativeHeadDeps)
+  if (!path) return null
+  try { return statSync(path).size } catch { return null }
+}
+
+/** The newest rows of the session's transcript, parsed; [] when there is no file.
+ *  `minBytes` widens the read past the default tail (never narrows it). */
+export function readAcceptanceTail(sessionId: string, nativeHeadDeps: NativeHeadDeps, minBytes?: number): TranscriptRowLike[] {
   const path = transcriptPathFor('claude', sessionId, nativeHeadDeps)
-  const lines = readTranscriptTailLines(path, ACCEPTANCE_TAIL_BYTES)
+  const want = typeof minBytes === 'number' && Number.isFinite(minBytes) ? Math.ceil(minBytes) : 0
+  const lines = readTranscriptTailLines(path, Math.min(ACCEPTANCE_TAIL_MAX_BYTES, Math.max(ACCEPTANCE_TAIL_BYTES, want)))
   if (!lines) return []
   const rows: TranscriptRowLike[] = []
   for (const line of lines) {
@@ -129,13 +160,14 @@ export function liveDeliveryStats(): LiveDeliveryStats {
  * counted as an attempt, so the health row stays quiet while the flag is off.
  */
 export function makeLiveTurnDeliverer(nativeHeadDeps: NativeHeadDeps) {
-  return async (request: { provider: string; sessionId: string; prompt: string; verifyTimeoutMs?: number }): Promise<PeerDeliveryResult> => {
+  return async (request: { provider: string; sessionId: string; prompt: string; verifyTimeoutMs?: number; clientTurnId?: string }): Promise<PeerDeliveryResult> => {
     const result = await deliverOverPeerInbox(
       { ...request, enabled: continueLiveEnabled() },
       {
         records: () => readPeerInboxRecords(),
         token: record => readPeerToken(record),
-        transcriptTail: id => readAcceptanceTail(id, nativeHeadDeps),
+        transcriptTail: (id, minBytes) => readAcceptanceTail(id, nativeHeadDeps, minBytes),
+        transcriptSize: id => readTranscriptSize(id, nativeHeadDeps),
         isCosOwnedPid: pid => cosSpawnedPids().has(pid),
         log: (level, event, detail) => {
           const line = `[${event}] ${JSON.stringify(detail)}`

package/server/lib/session-peer-inbox.ts

@@ -68,24 +68,43 @@ export const PEER_CONNECT_TIMEOUT_MS = 1_500
 
 /** How long to wait for the session's transcript to show acceptance.
  *
- *  SIX SECONDS IS THE ACCEPTANCE WINDOW, NOT THE REPLY WINDOW. The enqueue row is
- *  written when the message is taken, not when the turn finishes, and the measured
- *  latency for that row was under a second on an idle session. Six leaves room for a
- *  session busy enough to be slow at its own bookkeeping without leaving the queue
- *  blocked on a socket that is never going to answer. */
-export const PEER_VERIFY_TIMEOUT_MS = 6_000
+ *  THE ACCEPTANCE WINDOW, NOT THE REPLY WINDOW. The enqueue row is written when the
+ *  message is taken, not when the turn finishes, and the measured latency for that
+ *  row was under a second on an idle session (257 ms on the first device delivery).
+ *  Four seconds leaves room for a session busy at its own bookkeeping and still
+ *  sits inside the phone's 10 s request budget with the gate, the head read and a
+ *  1.5 s connect in front of it. THE ONE SOURCE: the turn route passes this same
+ *  constant (6.49.1; it used to carry its own 4 s while this file defaulted to 6 s,
+ *  and a QA mutation deleting the route's field went unnoticed). */
+export const PEER_VERIFY_TIMEOUT_MS = 4_000
 
 /** Transcript poll interval while waiting for acceptance. */
 export const PEER_VERIFY_POLL_MS = 250
 
-/** Rows older than this before the send cannot be evidence of it. Covers clock skew
- *  between the transcript's ISO stamps and our own clock. */
+/** Rows older than this before the send cannot be evidence of it.
+ *
+ *  The transcript's ISO stamps and our clock are the SAME clock (one Mac, one
+ *  kernel), so this is not skew cover. It is the width of the window in which a
+ *  prompt typed at the desk with the same first 120 characters would be mistaken for
+ *  ours, traded against a row stamped a beat before our `now()` by a writer that
+ *  timestamps before it appends. Two seconds keeps the second and makes the first
+ *  need a same-words prompt inside two seconds of the lens send. */
 export const PEER_ACCEPTANCE_BACKDATE_MS = 2_000
 
 /** Enough of the prompt to identify the row without depending on the whole of it
  *  surviving verbatim (a long paste may be elided in some writers). */
 export const PEER_MARKER_CHARS = 120
 
+/** Bytes read PAST the transcript's size at send time when looking for acceptance.
+ *
+ *  The acceptance rows are small and land within a second of the send, but the rows
+ *  written AFTER them are not: a single tool result can be over a megabyte (18 rows
+ *  above 256 KiB in one real session, max 1.1 MB), and a fixed tail read would lose
+ *  the evidence behind one of them on the memo's re-check. So the caller notes the
+ *  file size before the send and every read covers from there to the end, plus this
+ *  slack for a row already mid-write at the moment of the size read. */
+export const PEER_ACCEPTANCE_READ_SLACK_BYTES = 64 * 1024
+
 /** One live session as the registry describes it. */
 export interface PeerInboxRecord {
   pid: number
@@ -95,6 +114,8 @@ export interface PeerInboxRecord {
   peerProtocol: number | null
   entrypoint: string | null
   status: string | null
+  /** Epoch ms the process started (registry `startedAt`), for the newest-window rule (6.49.1). */
+  startedAt?: number | null
 }
 
 export type PeerDeliveryReason =
@@ -102,7 +123,6 @@ export type PeerDeliveryReason =
   | 'disabled'
   | 'not_claude'
   | 'no_record'
-  | 'no_socket'
   | 'protocol_unsupported'
   | 'connect_failed'
   | 'write_failed'
@@ -153,9 +173,16 @@ export function selectPeerInbox(
   const theirs = matches.filter(r => !isCosOwnedPid(r.pid))
   const pool = theirs.length > 0 ? theirs : []
   if (pool.length === 0) return null
-  // Newest record wins when the user somehow has two windows on one session: the
-  // higher pid is the one started most recently, which is the one they are looking at.
-  const chosen = [...pool].sort((a, b) => b.pid - a.pid)[0]
+  // Newest record wins when the user somehow has two windows on one session: the one
+  // started most recently is the one they are looking at. BY START TIME, not pid
+  // (6.49.1): macOS recycles pids, and this Mac's counter wrapped twice in one day
+  // (registry on 2026-09-16: 82615 started before 45962 before 10487). A record with
+  // no start time sorts last, then by pid as before.
+  const chosen = [...pool].sort((a, b) => {
+    const sa = typeof a.startedAt === 'number' && Number.isFinite(a.startedAt) ? a.startedAt : -1
+    const sb = typeof b.startedAt === 'number' && Number.isFinite(b.startedAt) ? b.startedAt : -1
+    return sb !== sa ? sb - sa : b.pid - a.pid
+  })[0]
   return chosen ?? null
 }
 
@@ -192,14 +219,17 @@ export function peerAcceptanceMarker(prompt: string): string {
  * permission policy, lost with a dying process, or accepted with the transcript row
  * still on its way. Three of those must not get a second copy, and the fourth turns
  * into `delivered` on the next look. So the caller refuses the turn as retryable, and
- * the retry comes back HERE first: the transcript is checked from the ORIGINAL send
- * time (a late row counts), nothing is written to the socket again, and only once the
- * memo is older than `SUSPECT_TTL_MS` does the turn go to the spawn path -- the one
- * place a duplicate remains possible, and it is named in the health row when it does.
+ * when the retry reaches this module (the route's occupancy gate runs first, so a
+ * session busy with the turn we sent answers `native_thread_working` until it is
+ * done) the transcript is checked from the ORIGINAL send time AND from the file size
+ * at the original send (a late row counts, however much was written after it),
+ * nothing is written to the socket again, and only once the memo is older than
+ * `SUSPECT_TTL_MS` does the turn go to the spawn path -- the one place a duplicate
+ * remains possible, and it is named in the health row when it does.
  */
 export const SUSPECT_TTL_MS = 60_000
 
-interface SuspectSend { marker: string; sentAtMs: number }
+interface SuspectSend { marker: string; sentAtMs: number; sizeAtSend: number | null }
 const suspects = new Map<string, SuspectSend>()
 
 function suspectKey(sessionId: string, marker: string): string {
@@ -276,8 +306,13 @@ export interface PeerInboxDeps {
   records: () => readonly PeerInboxRecord[] | Promise<readonly PeerInboxRecord[]>
   /** The session's peer token, or null when unreadable. Absence is not a failure. */
   token: (record: PeerInboxRecord) => string | null | Promise<string | null>
-  /** The tail of the session's transcript, newest last. */
-  transcriptTail: (sessionId: string) => readonly TranscriptRowLike[] | Promise<readonly TranscriptRowLike[]>
+  /** The tail of the session's transcript, newest last. `minBytes`, when given, is
+   *  how far back the read must reach (the bytes appended since the send plus slack);
+   *  the reader may read more, never less. */
+  transcriptTail: (sessionId: string, minBytes?: number) => readonly TranscriptRowLike[] | Promise<readonly TranscriptRowLike[]>
+  /** The transcript's size in bytes right now, or null when unknown. Optional: without
+   *  it every read is the reader's default tail. */
+  transcriptSize?: (sessionId: string) => number | null | Promise<number | null>
   /** Pids COS itself spawned, so a resume child never receives the turn meant for the window. */
   isCosOwnedPid?: (pid: number) => boolean
   now?: () => number
@@ -293,21 +328,45 @@ export interface PeerInboxRequest {
   prompt: string
   enabled: boolean
   verifyTimeoutMs?: number
+  /** The client's idempotency key for this draft (6.49.1). When given, the suspect memo
+   *  is keyed by it, so two drafts sharing their first 120 characters cannot collide and
+   *  the same words under a NEW key are a new send, not a retry. The marker is still
+   *  what is searched for in the transcript. */
+  clientTurnId?: string
 }
 
 function defaultSleep(ms: number): Promise<void> {
   return new Promise(resolve => setTimeout(resolve, ms))
 }
 
-/** Open the socket, write the frames, close. Rejects on anything that is not a clean write. */
+/** Where a send failed. Before `connect` fired nothing was written, whatever the code. */
+export type PeerSendPhase = 'connect' | 'write'
+
+/** A rejection from `sendOverPeerSocket`, tagged with the phase it failed in. */
+export interface PeerSendError extends Error {
+  phase: PeerSendPhase
+  code?: string
+}
+
+function tagPhase(error: Error, phase: PeerSendPhase): PeerSendError {
+  const tagged = error as PeerSendError
+  tagged.phase = phase
+  return tagged
+}
+
+/** Open the socket, write the frames, close. Rejects on anything that is not a clean
+ *  write, and every rejection carries `phase`: `connect` means no byte left this
+ *  process (a missing path, a refused or hung socket, a file that is not a socket, a
+ *  permission refusal), `write` means some may have. */
 export function sendOverPeerSocket(socketPath: string, frames: readonly string[]): Promise<void> {
   return new Promise((resolve, reject) => {
     let settled = false
+    let phase: PeerSendPhase = 'connect'
     const finish = (error?: Error): void => {
       if (settled) return
       settled = true
       try { socket.destroy() } catch { /* already gone */ }
-      if (error) reject(error)
+      if (error) reject(tagPhase(error, phase))
       else resolve()
     }
     const socket = connect(socketPath)
@@ -316,6 +375,7 @@ export function sendOverPeerSocket(socketPath: string, frames: readonly string[]
     socket.on('error', error => { clearTimeout(timer); finish(error instanceof Error ? error : new Error('socket_error')) })
     socket.on('connect', () => {
       clearTimeout(timer)
+      phase = 'write'
       try {
         // One write, so a half-written pair cannot leave an auth line without its
         // message on a connection the receiver closes for silence.
@@ -368,7 +428,6 @@ export async function deliverOverPeerInbox(
   }
   const target = selectPeerInbox(request.sessionId, records, deps.isCosOwnedPid)
   if (!target) return done(false, 'no_record', null, null)
-  if (!target.socketPath) return done(false, 'no_socket', null, target.pid)
   // An unknown protocol is refused rather than attempted: the frames below are the
   // ones protocol 1 documents, and guessing at a successor is how a turn gets eaten.
   if (target.peerProtocol !== null && target.peerProtocol !== PEER_INBOX_PROTOCOL) {
@@ -376,13 +435,12 @@ export async function deliverOverPeerInbox(
   }
 
   const marker = peerAcceptanceMarker(request.prompt)
-  const key = suspectKey(request.sessionId, marker)
+  const key = suspectKey(request.sessionId, request.clientTurnId ? `id:${request.clientTurnId}` : marker)
 
   // A retry of a send that was never verified: look before writing anything.
   const suspect = suspects.get(key)
   if (suspect) {
-    let rows: readonly TranscriptRowLike[] = []
-    try { rows = await deps.transcriptTail(request.sessionId) } catch { rows = [] }
+    const rows = await readSince(request.sessionId, suspect.sizeAtSend)
     const seen = peerAcceptanceIn(rows, marker, suspect.sentAtMs)
     if (seen) {
       suspects.delete(key)
@@ -396,28 +454,45 @@ export async function deliverOverPeerInbox(
   let token: string | null = null
   try { token = await deps.token(target) } catch { token = null }
 
+  // The file size BEFORE the frame goes out, so every later read can start there.
+  let sizeAtSend: number | null = null
+  try { sizeAtSend = (await deps.transcriptSize?.(request.sessionId)) ?? null } catch { sizeAtSend = null }
   const sentAt = now()
   try {
-    await send(target.socketPath, peerInboxFrames(target.sessionId, request.prompt, token))
+    await send(target.socketPath!, peerInboxFrames(target.sessionId, request.prompt, token))
   } catch (error) {
+    const phase = (error as Partial<PeerSendError> | undefined)?.phase
     const code = (error as NodeJS.ErrnoException | undefined)?.code
-    // ENOENT and ECONNREFUSED are the stale-socket shapes: the pid is gone and the
-    // file outlived it. Both are ordinary, nothing was written, and both mean "spawn
-    // the child". Anything else may have written a partial frame, so it is a suspect.
-    if (code === 'ENOENT' || code === 'ECONNREFUSED') return done(false, 'connect_failed', null, target.pid)
-    suspects.set(key, { marker, sentAtMs: sentAt })
+    // Before `connect` fired nothing was written: a stale path (ENOENT), a dead
+    // listener (ECONNREFUSED), a hung one (connect_timeout), a file that is not a
+    // socket, a permission refusal. All ordinary, all mean "spawn the child" now. A
+    // failure AFTER connect may have written a partial frame, so it is a suspect.
+    // (The code check stays for a `send` seam that does not tag the phase.)
+    if (phase === 'connect' || code === 'ENOENT' || code === 'ECONNREFUSED') return done(false, 'connect_failed', null, target.pid)
+    suspects.set(key, { marker, sentAtMs: sentAt, sizeAtSend })
     return done(false, 'write_failed', null, target.pid)
   }
 
   const deadline = sentAt + Math.max(0, request.verifyTimeoutMs ?? PEER_VERIFY_TIMEOUT_MS)
   for (;;) {
-    let rows: readonly TranscriptRowLike[] = []
-    try { rows = await deps.transcriptTail(request.sessionId) } catch { rows = [] }
+    const rows = await readSince(request.sessionId, sizeAtSend)
     const seen = peerAcceptanceIn(rows, marker, sentAt)
     if (seen) return done(true, 'delivered', seen, target.pid)
     if (now() >= deadline) break
     await sleep(PEER_VERIFY_POLL_MS)
   }
-  suspects.set(key, { marker, sentAtMs: sentAt })
+  suspects.set(key, { marker, sentAtMs: sentAt, sizeAtSend })
   return done(false, 'unverified', null, target.pid)
+
+  /** The rows appended since the send (plus the reader's own default tail). Never throws. */
+  async function readSince(sessionId: string, since: number | null): Promise<readonly TranscriptRowLike[]> {
+    let minBytes: number | undefined
+    if (since !== null) {
+      try {
+        const size = (await deps.transcriptSize?.(sessionId)) ?? null
+        if (size !== null && size >= since) minBytes = size - since + PEER_ACCEPTANCE_READ_SLACK_BYTES
+      } catch { minBytes = undefined }
+    }
+    try { return await deps.transcriptTail(sessionId, minBytes) } catch { return [] }
+  }
 }

package/server/lib/session-stream-events.ts

@@ -24,7 +24,12 @@ export type SessionStreamVerb = 'read' | 'edit' | 'write' | 'bash' | 'search' |
 export type SessionStreamState = 'working' | 'idle' | 'done'
 
 export type SessionStreamDraft =
-  | { kind: 'tool'; verb: SessionStreamVerb; target: string; detail: string }
+  // `call` (6.49.1) is the provider's own id for the call (`toolu_…`), so a result
+  // can be paired with exactly the step that produced it; `outcome` is set only on a
+  // SEEDED step, whose result is already in the transcript when the client opens.
+  // Both are extra fields on an existing kind: a shipped client strips what it does
+  // not know and renders the step as before.
+  | { kind: 'tool'; verb: SessionStreamVerb; target: string; detail: string; call?: string; outcome?: ToolOutcome }
   // The user's own words for the turn being worked on. the user: "we should see the query
   // that the user has versus it just being a blank slate where it says working. That
   // way, the user at least knows what the agent is actively working on."
@@ -46,7 +51,7 @@ export type SessionStreamDraft =
  * What a finished tool produced, in the words a lens line has room for.
  *
  * `ok` says whether the tool itself reported failure; `detail` is the token the
- * client shows at the end of the step line (`+14 -2`, `41 passed`, `17 hits`,
+ * client shows at the end of the step line (`+14 -2`, `41 lines`, `17 hits`,
  * `exit 1`). Derived from the transcript's own `toolUseResult`, which is shape-keyed
  * (a Read result carries `file.numLines`, a Bash result `stdout`), so no tool name
  * and no hook is needed: the same row that announces the call carries its answer a
@@ -55,6 +60,17 @@ export type SessionStreamDraft =
 export interface ToolOutcome {
   ok: boolean
   detail: string
+  /** The `tool_use_id` this answers (6.49.1), when the provider names one. Without
+   *  it a client pairs by order (oldest step still waiting), which is right for a
+   *  single call and wrong for two parallel calls that finish out of order. */
+  call?: string
+}
+
+/** A tool-call id as the providers write them; anything else is not carried. */
+const CALL_ID_RE = /^[A-Za-z0-9_-]{4,96}$/
+
+function callId(value: unknown): string | undefined {
+  return typeof value === 'string' && CALL_ID_RE.test(value) ? value : undefined
 }
 
 /** A draft plus the transport's stamps. This is the JSON on the wire. */
@@ -317,6 +333,13 @@ export function outcomeForToolResult(
       if (out === 0) return { ok: true, detail: `stderr ${err} line${err === 1 ? '' : 's'}` }
       return { ok: true, detail: `${out} line${out === 1 ? '' : 's'}` }
     }
+    // Grep in CONTENT mode (6.49.1): the real row is `{ mode: 'content', numFiles: 0,
+    // filenames: [], content, numLines, totalLines }`, numFiles ALWAYS 0 there, so the
+    // file count below read "0 files" for a grep with hits (18 of 18 rows measured).
+    // The hits are the lines.
+    if (r.mode === 'content' && typeof r.numLines === 'number') {
+      return { ok: true, detail: r.numLines === 0 ? 'none' : `${r.numLines} hit${r.numLines === 1 ? '' : 's'}` }
+    }
     // Grep / Glob: counts when the tool gives them.
     if (typeof r.numFiles === 'number') return { ok: true, detail: `${r.numFiles} file${r.numFiles === 1 ? '' : 's'}` }
     if (typeof r.numMatches === 'number') return { ok: true, detail: `${r.numMatches} hit${r.numMatches === 1 ? '' : 's'}` }
@@ -352,18 +375,24 @@ export function outcomeDrafts(record: Record<string, unknown>, message: Record<s
       : Array.isArray(inner)
         ? inner.map(part => (asRecord(part)?.text as string | undefined) ?? '').join(' ')
         : ''
-    const outcome = outcomeForToolResult(block.is_error === true, text, record.toolUseResult)
+    // `toolUseResult` in the transcript, `tool_use_result` on `claude -p`'s stream-json
+    // stdout, which the producer feeds through this same parser for every COS-spawned
+    // turn (6.49.1: only the first was read, so every spawn-path Continue and every
+    // drained follow-up showed an empty outcome for Read/Bash/Edit/Write).
+    const outcome = outcomeForToolResult(block.is_error === true, text, record.toolUseResult ?? record.tool_use_result)
+    const call = callId(block.tool_use_id)
     // A tool result means the turn is working by definition: the model called a
     // tool and is about to read what came back.
-    out.push({ kind: 'status', state: 'working', tool_outcome: outcome })
+    out.push({ kind: 'status', state: 'working', tool_outcome: call ? { ...outcome, call } : outcome })
   }
   return out
 }
 
-function toolDraft(name: unknown, input: unknown): SessionStreamDraft {
+function toolDraft(name: unknown, input: unknown, id?: unknown): SessionStreamDraft {
   const verb = verbForToolName(name)
   const target = targetForTool(name, input)
   const readable = typeof name === 'string' ? oneLine(name, TARGET_MAX_CHARS) : ''
+  const call = callId(id)
   return {
     kind: 'tool',
     verb,
@@ -372,7 +401,34 @@ function toolDraft(name: unknown, input: unknown): SessionStreamDraft {
     // empty line the reader cannot interpret.
     target: verb === 'other' || target === '' ? (readable || target) : target,
     detail: detailForTool(name, input),
+    ...(call ? { call } : {}),
+  }
+}
+
+/**
+ * Fold each outcome onto the seeded step it answers (6.49.1).
+ *
+ * The seed drops status drafts (they describe a past moment), which through 6.49.0
+ * dropped the OUTCOMES with them: seven steps arrived with no result, the client's
+ * order-based pairing then hung every LIVE result on the oldest seeded step, and the
+ * newest tool read as running forever (QA, 2026-09-16, reproduced through the real
+ * parser and reducer). Pairs by `call` when both sides carry it, else by order; the
+ * outcome status drafts are removed since their content now rides on the step.
+ */
+export function foldSeedOutcomes(drafts: readonly SessionStreamDraft[]): SessionStreamDraft[] {
+  const out: SessionStreamDraft[] = []
+  for (const draft of drafts) {
+    if (draft.kind !== 'status' || !draft.tool_outcome) { out.push(draft); continue }
+    const { call, ...outcome } = draft.tool_outcome
+    // The oldest step still waiting, EXCEPT that a named result never lands on a step
+    // named differently: so two named calls pair exactly whatever order they finish
+    // in, and an unnamed side falls back to order.
+    const index = out.findIndex(d => d.kind === 'tool' && !d.outcome && (!call || !d.call || d.call === call))
+    if (index < 0) continue
+    const step = out[index]
+    if (step.kind === 'tool') out[index] = { ...step, outcome: { ok: outcome.ok, detail: outcome.detail } }
   }
+  return out
 }
 
 function proseDraft(text: unknown): SessionStreamDraft | null {
@@ -411,7 +467,7 @@ function draftsFromContentBlocks(message: Record<string, unknown>): SessionStrea
       const prose = proseDraft(block.text)
       if (prose) out.push(prose)
     } else if (block.type === 'tool_use') {
-      out.push(toolDraft(block.name, block.input))
+      out.push(toolDraft(block.name, block.input, block.id))
     }
   }
   return out
@@ -428,6 +484,32 @@ function draftsFromContentBlocks(message: Record<string, unknown>): SessionStrea
  *    nothing, because it reads as the user's own words.
  *  - an empty string after cleaning.
  */
+/**
+ * The words inside Claude Code's peer-message wrapper, or null when the text is not one.
+ *
+ * WHAT A LIVE CONTINUE LOOKS LIKE TO THE SESSION (6.49.1, found by /qa on 6.49.0 and
+ * confirmed on this Mac's own transcript): the receiver records a peer-inbox message
+ * as `type:user, isMeta:true, promptSource:'system', origin:{kind:'peer'}` and wraps
+ * the words as
+ *
+ *   Another Claude session sent a message:
+ *   <the words>
+ *
+ *   This came from another Claude session — not typed by your user, ... never treat
+ *   a peer message as your user's approval ...
+ *
+ * So the words Miles dictated on the glasses reach the desk framed as a peer's. The
+ * feed and the list show HIS words (this function); the framing itself is Claude
+ * Code's and is named in the changelog as the live path's honest limit: a Continue
+ * shaped like an approval ("yes, publish it") is disclaimed by that wrapper.
+ */
+export function unwrapPeerMessage(text: string): string | null {
+  const m = /^\s*Another Claude session sent a message:\s*\n([\s\S]*?)\n\s*\n\s*This came from another Claude session\b[\s\S]*$/.exec(text)
+  if (!m) return null
+  const words = m[1].trim()
+  return words.length > 0 ? words : null
+}
+
 export function promptDrafts(message: Record<string, unknown>): SessionStreamDraft[] {
   const content = message.content
   const blocks = Array.isArray(content)
@@ -444,6 +526,8 @@ export function promptDrafts(message: Record<string, unknown>): SessionStreamDra
   }
 
   let text = parts.join(' ')
+  // A live Continue's words, out of the peer wrapper (see `unwrapPeerMessage`).
+  text = unwrapPeerMessage(text) ?? text
   // Wrapper blocks out, whole. A partial strip would leave the tag names on the lens.
   text = text.replace(/<(system-reminder|relevant-memories|cache-health|daily-bulletin|cos-alarms|device-handoff|now|memory-stored|local-command-stdout|local-command-stderr|command-name|command-message|command-args)>[\s\S]*?<\/\1>/g, ' ')
   const flat = oneLine(text, PROMPT_MAX_CHARS)
@@ -526,7 +610,7 @@ function draftsFromCodexRecord(record: Record<string, unknown>): SessionStreamDr
     } else if (typeof input === 'string') {
       input = { command: input }
     }
-    return [toolDraft(payload.name, input)]
+    return [toolDraft(payload.name, input, payload.call_id)]
   }
   return []
 }

package/server/routes/agent-session-bindings.ts

@@ -124,6 +124,7 @@ import {
 import type { RegistryCheck, RegistryRejection, RegistryResult } from '../lib/agent-session-binding-registry.js'
 import { recordCosSpawn, releaseCosSpawn } from '../lib/agent-session-ownership-store.js'
 import { isValidNativeThreadId } from '../lib/native-thread-id.js'
+import { PEER_VERIFY_TIMEOUT_MS } from '../lib/session-peer-inbox.js'
 
 /**
  * Read side of the binding lease store.
@@ -341,7 +342,7 @@ export interface AgentSessionBindingsDeps {
    * absent, or when it answers anything but `ok`, the spawn path below runs unchanged.
    * Only `reason` is read here; the vocabulary is the pure module's.
    */
-  deliverLiveTurn?: (request: { provider: string; sessionId: string; prompt: string; verifyTimeoutMs?: number }) => Promise<{ ok: boolean; reason: string; verifiedBy?: string | null; pid?: number | null }>
+  deliverLiveTurn?: (request: { provider: string; sessionId: string; prompt: string; verifyTimeoutMs?: number; clientTurnId?: string }) => Promise<{ ok: boolean; reason: string; verifiedBy?: string | null; pid?: number | null }>
 
   /**
    * The self-recursion ledger. Defaults to the real process-wide one.
@@ -570,7 +571,7 @@ export const WRITE_REASON_COPY: Record<Exclude<WriteRefusal, OccupancyReason>, s
   delivery_ambiguous:
     'COS lost track of this turn after sending it. Open the thread on your Mac and check before sending again.',
   live_unverified:
-    'Sent to the open session, but not yet confirmed. COS will check again in a moment.',
+    'Sent, not yet confirmed. Send again: COS checks before sending twice.',
   turn_failed:
     'COS could not run this turn. Nothing was sent. You can try again.',
 
@@ -1286,13 +1287,17 @@ export const TURN_SENT_LIVE_COPY = 'Sent to the open session. It will show where
 /**
  * How long the route waits for the session's transcript to show acceptance.
  *
- * FOUR SECONDS, INSIDE THE CLIENT'S TEN. The phone's `fetchJSON` aborts at 10 s; the
- * gate ahead of this point costs about a second, the connect up to 1.5 s, so four
- * leaves margin. Measured acceptance on an idle session was under one second, so the
+ * FOUR SECONDS, INSIDE THE CLIENT'S BUDGET. The lens's turn POST allows 25 s since app
+ * 6.9.487 (every other call keeps `fetchJSON`'s 10 s); the gate ahead of this point
+ * costs about a second, the connect up to 1.5 s, so four leaves margin even for the
+ * older ten. Measured acceptance on an idle session was under one second, so the
  * budget only bites when the receiver is holding or dying, and those end as
  * `live_unverified`, which the client may retry.
+ *
+ * THE SAME CONSTANT the transport defaults to (6.49.1): two numbers for one window
+ * meant a mutation deleting the route's field silently changed the budget.
  */
-export const LIVE_VERIFY_BUDGET_MS = 4_000
+export const LIVE_VERIFY_BUDGET_MS = PEER_VERIFY_TIMEOUT_MS
 
 /**
  * The 202 copy. Says QUEUED and not sent, because at this instant the provider has
@@ -1908,6 +1913,24 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
     res.set('Cache-Control', 'private, no-store')
 
     const turnId = mintId()
+    // 6.49.1: where a turn's time goes, BEFORE the client's clock runs out. Miles's
+    // first three sends on 2026-09-16 read "lost track" on the lens with no server-side
+    // trace at all; this line is the trace. One `[turn timing]` per request at every
+    // exit that ANSWERS the client (the refusals and the live 200 through `respond`,
+    // the ledger replay and the 202 at their own `res.status` calls), with the stage
+    // ms and the first-byte-to-answer total, so a slow gate, a slow head read, a slow
+    // live hop and a request that never arrived are four different lines rather than
+    // one absence. Never the prompt.
+    const stageClock = process.hrtime.bigint()
+    const stages: string[] = []
+    let lastStage = stageClock
+    const stage = (name: string): void => {
+      const now = process.hrtime.bigint()
+      stages.push(`${name}=${Number((now - lastStage) / 1_000_000n)}ms`)
+      lastStage = now
+    }
+    const turnTiming = (outcome: string): string =>
+      `[agent-session-bindings] turn timing turnId=${turnId} outcome=${outcome} total=${Number((process.hrtime.bigint() - stageClock) / 1_000_000n)}ms ${stages.join(' ')}`
     /** The target we hold a claim on, released in the finally. */
     let claimedKey: string | null = null
     // Hoisted so the CATCH site can fence with evidence. `binding` and `head` are
@@ -1950,7 +1973,13 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
     let queued = false
 
     const respond = (status: number, payload: Record<string, unknown>): void => {
-      if (!res.headersSent) res.status(status).json(payload)
+      if (!res.headersSent) {
+        res.status(status).json(payload)
+        const outcome = typeof payload.outcome === 'string' ? payload.outcome : String(status)
+        const reason = typeof payload.reason === 'string' ? `/${payload.reason}` : ''
+        const via = typeof payload.via === 'string' ? `/${payload.via}` : ''
+        console.log(turnTiming(`${outcome}${reason}${via}`))
+      }
       // Remembered ONLY when the prompt may have reached the provider. A
       // pre-delivery refusal (stale epoch, malformed body, busy target) must stay
       // re-evaluatable: the binding may be fine by the time the client retries, and
@@ -2081,6 +2110,7 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
         const { status, ...rest } = already.result as Record<string, unknown>
         if (!res.headersSent) {
           res.status(typeof status === 'number' ? status : 200).json({ ...rest, replayed: true })
+          console.log(turnTiming(`replayed/${typeof rest.outcome === 'string' ? rest.outcome : String(status)}`))
         }
         return
       }
@@ -2124,9 +2154,11 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
       // open, and it is terminal here rather than a warning because COS has no
       // cross-process lock that could fence a live desktop writer.
       const verdict = runOccupancy(binding.provider, binding.nativeThreadId)
+      stage('gate')
       if (!verdict.attachable) return refuseTurn(verdict.reason ?? 'probe_failed')
 
       const head = await readHead(binding.provider, binding.nativeThreadId)
+      stage('head')
       if (head === null) return refuseTurn('native_head_unavailable')
       preTurnHeadDigest = head.digest
 
@@ -2150,6 +2182,7 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
       // A failed pin is FATAL, per the registry's own caller contract: an unpinned
       // binding can expire or be detached mid-turn, which defeats the lease.
       const pinned = deps.bindings.pin!(bindingId, turnId, now)
+      stage('pin')
       if (!pinned?.binding) return refuseTurn(registryRefusal(pinned?.reason))
       pinnedBindingId = bindingId
 
@@ -2173,6 +2206,7 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
             sessionId: binding.nativeThreadId,
             prompt,
             verifyTimeoutMs: LIVE_VERIFY_BUDGET_MS,
+            clientTurnId,
           })
         } catch (error) {
           // A throw is a bug in the transport, not a fact about the session; the
@@ -2180,6 +2214,7 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
           console.error(`[agent-session-bindings] live delivery threw: ${error instanceof Error ? error.message : error}`)
           live = null
         }
+        stage(`live(${live?.reason ?? 'threw'})`)
         if (live?.ok) {
           console.log(`[agent-session-bindings] turn delivered live provider=${binding.provider} turnId=${turnId} bindingId=${bindingId} verifiedBy=${live.verifiedBy ?? 'unknown'} pid=${live.pid ?? 'null'}`)
           respond(200, {
@@ -2199,8 +2234,8 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
           // Something may be in the session. Hold, never spawn over it.
           return refuseTurn('live_unverified', { retryable: true, deliveryState: 'unknown' })
         }
-        // disabled / not_claude / no_record / no_socket / protocol_unsupported /
-        // connect_failed / suspect_expired: nothing reached a session. Spawn as always.
+        // disabled / not_claude / no_record / protocol_unsupported / connect_failed /
+        // suspect_expired: nothing reached a session. Spawn as always.
       }
 
       // THE QUEUE POINT. Every gate is now behind us — body, replay, queued-prompt,
@@ -2224,6 +2259,11 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
         reason: null,
         reasonCopy: TURN_QUEUED_COPY,
       })
+      // The request's own timing line (6.49.1). `respond` cannot write it after this:
+      // its `headersSent` guard is what keeps the ledger-only outcome below from
+      // answering twice. QA found the two exits Miles actually hits (this 202 and the
+      // replay above) were the two with no line.
+      console.log(turnTiming('queued'))
 
       let delivery: Delivery
       deliveryAttempted = true

package/server/routes/agent-session-stream.ts

@@ -79,7 +79,7 @@ import {
   transcriptWatcherDegraded,
   readTranscriptSeedLines,
 } from '../lib/session-transcript-watcher.js'
-import { draftsFromLine, statusDraftWithDerived, type DerivedStatusFields } from '../lib/session-stream-events.js'
+import { foldSeedOutcomes, draftsFromLine, statusDraftWithDerived, type DerivedStatusFields } from '../lib/session-stream-events.js'
 import type { SessionStreamState } from '../lib/session-stream-events.js'
 import { RING_EPOCH, replaySessionStream, ringBounds } from '../lib/session-stream-bus.js'
 import { claudeSessionsDir, readClaudePeerRecords, registryFacts } from './claude-sessions.js'
@@ -387,7 +387,9 @@ agentSessionStreamRouter.get('/agent-sessions/:provider/:sessionId/stream', asyn
   if (!replayable && path !== null && startOffset > 0) {
     try {
       const lines = await readTranscriptSeedLines(path, startOffset)
-      const drafts = lines.flatMap(line => draftsFromLine(provider, line))
+      // 6.49.1: each seeded step carries its own outcome (`foldSeedOutcomes`), since
+      // the status drafts that carried them live are dropped from the seed below.
+      const drafts = foldSeedOutcomes(lines.flatMap(line => draftsFromLine(provider, line)))
       // Status drafts are dropped from the seed: they describe the state at some past
       // moment and the opening status above is the CURRENT one. Replaying an old
       // `done` after it would tell the client the live session had finished.