@gotcos/glasses-server 6.52.3 → 6.53.1

package/server/lib/permission-broker.ts

@@ -305,6 +305,18 @@ export function questionHookOutput(toolInput: Record<string, unknown>, answers:
   return { hookSpecificOutput: { hookEventName: 'PermissionRequest', decision: { behavior: 'allow', updatedInput: { ...toolInput, answers } } } }
 }
 
+/** 6.53.0: the message a held prompt gets when its session's run is cancelled from COS. */
+export const CANCEL_DENY_MESSAGE = 'Cancelled from COS'
+
+/**
+ * 6.53.0: a held prompt whose run was cancelled from the lens. Deny with `interrupt: true`,
+ * so Claude ends the RUN rather than trying something else in place of this tool. The one
+ * case where a broker reply interrupts, and only ever from `cancelSession`.
+ */
+export function cancelHookOutput(): Record<string, unknown> {
+  return { hookSpecificOutput: { hookEventName: 'PermissionRequest', decision: { behavior: 'deny', message: CANCEL_DENY_MESSAGE, interrupt: true } } }
+}
+
 /** A tool approval: allow once, or deny with the one message. Never a rule. */
 export function approvalHookOutput(decision: 'allow' | 'deny'): Record<string, unknown> {
   const body = decision === 'allow' ? { behavior: 'allow' } : { behavior: 'deny', message: DENY_MESSAGE }
@@ -933,6 +945,42 @@ export class PermissionBroker {
     return { status: 200, body: { ok: true, id: item.id, kind: item.kind, ...chosen } }
   }
 
+  /**
+   * 6.53.0: a desk run of this session was cancelled from COS. Every prompt the broker holds
+   * for it is answered deny with `interrupt: true` (the away-from-desk case: without this the
+   * run waits out the deadline and then shows the Mac's dialog, and a cancel "at the next
+   * tool call" never arrives, because the next tool is the one being asked about). Recorded
+   * as an answer, so a lens answering the same card afterwards reads 409 already_answered.
+   * A hook that already left is `hook_gone`, as for any answer. Returns how many it denied.
+   */
+  cancelSession(sessionId: string): number {
+    const wanted = typeof sessionId === 'string' ? sessionId.toLowerCase() : ''
+    if (!wanted) return 0
+    let denied = 0
+    for (const item of [...this.items.values()]) {
+      if (item.state !== 'pending' || item.sessionId !== wanted) continue
+      if (!item.channel || !item.channel.writable() || !item.channel.reply(cancelHookOutput())) {
+        this.settle(item, 'hook_gone')
+        continue
+      }
+      item.state = 'answered'
+      item.settledAt = this.deps.now()
+      item.answer = { clientAnswerId: 'cos-cancel', chosen: { decision: 'deny' } }
+      item.channel = null
+      item.toolInput = {}
+      item.questions = null
+      item.approval = null
+      if (item.timer) clearTimeout(item.timer)
+      item.timer = null
+      this.counters.answered++
+      try { this.deps.signals?.decided(item.sessionId, item.id, item.fingerprint) } catch { /* rows are advisory */ }
+      this.log(`cancelled ${item.id} kind=${item.kind} pending=${this.pendingCount()}`)
+      denied++
+    }
+    this.prune()
+    return denied
+  }
+
   /**
    * "Leave for the Mac" on a pending item. As for an answer, the hook must still be listening:
    * one that already left is `hook_gone` (the Mac shows its dialog either way).

package/server/lib/session-cancel.ts

@@ -0,0 +1,190 @@
+// Cancel a session run from the lens (6.53.0): the decisions, the copy, the ledger, and
+// the per-thread cancel time the turn queue reads.
+//
+// Miles, 2026-09-21: "a cancel button ... If there's a current run that's going, it
+// essentially clicks the cancel button ... similar to when they're at the desktop."
+//
+// WHO OWNS THE RUN DECIDES WHAT A CANCEL CAN DO (plan PLAN_g2_cancel_run_529_653):
+//   cos_turn     a Continue COS itself spawned (`claude -p --resume`, `codex exec resume`,
+//                `cursor-agent`). The route aborts its own child: immediate, every provider.
+//   desk_run     Claude Code at the desk (a Desktop tab, a terminal, a Continue delivered
+//                live into the open window). A halt marker plus the synchronous PreToolUse
+//                hook stops it at its NEXT tool call (canaries C1b, C5, C10).
+//   unsupported  the Codex app or Cursor. Nothing outside the app can reach the run.
+//   hooks_*      a desk Claude run on a Mac whose hooks cannot stop it yet.
+//
+// `cancelTargetFor` is the ONE function that decides, and both the cancel route and the
+// attachability body's `cancel` field call it, so the row the lens shows and the answer
+// the tap gets cannot disagree (plan validation B4).
+
+import { appendFileSync, chmodSync, mkdirSync } from 'node:fs'
+import { dirname } from 'node:path'
+import { dataPath } from './data-dir.js'
+
+export type CancelTarget = 'cos_turn' | 'desk_run' | 'unsupported' | 'hooks_outdated' | 'hooks_disabled'
+
+export interface CancelFacts {
+  provider: string
+  /** A COS turn is in flight on this thread (the route's own in-flight map). */
+  cosTurnInFlight: boolean
+  /** A run outside COS is working on this thread right now. */
+  runningOutsideCos: boolean
+  /** `sessionHooksEnabled()`: the hook signal store is applied at all. */
+  hooksEnabled: boolean
+  /** The hooks installed on this Mac carry the 6.53.0 script and subscription. */
+  hooksReady: boolean
+}
+
+/**
+ * PURE, and the precedence is the point:
+ *   1. COS's own turn first. It is the one run COS can end at once, and a marker would
+ *      also stop it only at its next tool (R3), so aborting the child is always better.
+ *   2. Nothing running: null. The lens shows no row at all.
+ *   3. Codex and Cursor cannot be stopped from outside their app.
+ *   4. A desk Claude run needs the hooks applied AND the new script installed; either
+ *      missing is its own answer, because the fixes differ (a setting vs Install hooks).
+ */
+export function cancelTargetFor(facts: CancelFacts): CancelTarget | null {
+  if (facts.cosTurnInFlight === true) return 'cos_turn'
+  if (facts.runningOutsideCos !== true) return null
+  if (facts.provider !== 'claude') return 'unsupported'
+  if (facts.hooksEnabled !== true) return 'hooks_disabled'
+  if (facts.hooksReady !== true) return 'hooks_outdated'
+  return 'desk_run'
+}
+
+/**
+ * `/api/health` `features.sessionCancel` (6.53.0). `cosTurn` is true in every 6.53 build: the
+ * route aborts its own child. `deskClaude` says whether a desk Claude run can be stopped
+ * NOW: the hooks applied AND the 6.53 script and subscription installed. False until
+ * Install hooks after the update, which is the rollout step Control's banner asks for.
+ */
+export function sessionCancelFeature(hooksEnabled: boolean, hooksInstalled: boolean): { cosTurn: true; deskClaude: boolean } {
+  return { cosTurn: true, deskClaude: hooksEnabled === true && hooksInstalled === true }
+}
+
+/** Refusal codes on the cancel route, with the lens's own words (app 6.9.529 matches). */
+export type CancelRefusal = 'not_running' | 'cancel_unsupported' | 'hooks_outdated' | 'hooks_disabled' | 'cancel_failed' | 'invalid_request'
+
+export const CANCEL_REASON_COPY: Record<Exclude<CancelRefusal, 'cancel_unsupported'>, string> = {
+  not_running: 'Nothing running now.',
+  hooks_outdated: 'Install hooks in COS Control, then retry.',
+  hooks_disabled: 'Session hooks are off on the Mac.',
+  cancel_failed: 'Could not cancel. Check the Mac.',
+  invalid_request: 'That cancel was not something COS could read. Nothing was stopped.',
+}
+
+/** Where an unsupported run lives, named so the user knows where to stop it. */
+export function cancelUnsupportedCopy(provider: string): string {
+  if (provider === 'codex') return 'Runs in Codex on your Mac. Stop it there.'
+  if (provider === 'cursor') return 'Runs in Cursor on your Mac. Stop it there.'
+  return 'Runs on your Mac. Stop it there.'
+}
+
+export function cancelRefusalCopy(reason: CancelRefusal, provider: string): string {
+  return reason === 'cancel_unsupported' ? cancelUnsupportedCopy(provider) : CANCEL_REASON_COPY[reason]
+}
+
+/** Client-supplied idempotency key for one tap. The app mints `cc<time><random>`. */
+export const CLIENT_CANCEL_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{3,127}$/
+
+// ---------------------------------------------------------------------------
+// The queue hold (plan validation: "Parked turns hold for 2 minutes after a cancel")
+// ---------------------------------------------------------------------------
+
+/**
+ * How long turns parked on a thread wait after a cancel before they send as normal. The
+ * person just said stop; a queued follow-up firing a second later would start the run
+ * they stopped all over again. Two minutes is long enough to decide, short enough that
+ * a turn they still want is not lost, and the lens says how many are held.
+ */
+export const CANCEL_QUEUE_HOLD_MS = 2 * 60_000
+
+/** Past this a cancel time can no longer change a decision (the open-turn ceiling is 30 min). */
+export const CANCEL_MEMORY_MS = 60 * 60_000
+const MAX_REMEMBERED_CANCELS = 256
+
+// In memory on purpose: every reader is a hold of minutes, and a restart that forgets
+// one lets the queue drain by the gate's ordinary rules, which is the pre-6.53 behaviour.
+const cancelledAtByThread = new Map<string, number>()
+const cancelKey = (provider: string, threadId: string) => `${provider}:${threadId.toLowerCase()}`
+
+export function noteThreadCancelled(provider: string, threadId: string, at: number): void {
+  if (!Number.isFinite(at)) return
+  const key = cancelKey(provider, threadId)
+  cancelledAtByThread.delete(key)
+  cancelledAtByThread.set(key, at)
+  if (cancelledAtByThread.size > MAX_REMEMBERED_CANCELS) {
+    for (const [k, when] of cancelledAtByThread) {
+      if (at - when > CANCEL_MEMORY_MS) cancelledAtByThread.delete(k)
+    }
+    while (cancelledAtByThread.size > MAX_REMEMBERED_CANCELS) {
+      const oldest = cancelledAtByThread.keys().next()
+      if (oldest.done) break
+      cancelledAtByThread.delete(oldest.value)
+    }
+  }
+}
+
+export function threadCancelledAt(provider: string, threadId: string): number | null {
+  return cancelledAtByThread.get(cancelKey(provider, threadId)) ?? null
+}
+
+/** Until when the thread's parked turns hold, or null when no cancel is on record. */
+export function cancelHoldUntil(provider: string, threadId: string): number | null {
+  const at = threadCancelledAt(provider, threadId)
+  return at === null ? null : at + CANCEL_QUEUE_HOLD_MS
+}
+
+/**
+ * Does a cancel END the turn the transcript or the hooks still show open?
+ *
+ * Yes when the cancel is at least as new as the session's last row (or event): nothing
+ * has happened since the stop, so a dangling `tool_use` is the killed child's, not a live
+ * tool. Without this a cancelled COS turn's unanswered tool call reads `tool_pending` for
+ * the whole 30-minute open-turn ceiling and holds every parked turn behind it (plan R1).
+ * Anything written AFTER the cancel is live evidence again, and the ordinary rules decide.
+ */
+export function cancelEndsTurn(cancelledAt: number | null, lastRowAt: number | null): boolean {
+  if (cancelledAt === null || !Number.isFinite(cancelledAt)) return false
+  if (lastRowAt === null || !Number.isFinite(lastRowAt)) return true
+  return cancelledAt >= lastRowAt
+}
+
+export function __resetThreadCancelsForTests(): void {
+  cancelledAtByThread.clear()
+}
+
+// ---------------------------------------------------------------------------
+// The ledger
+// ---------------------------------------------------------------------------
+
+export interface SessionCancelLedgerRow {
+  at: string
+  provider: string
+  threadId: string
+  /** What the cancel was aimed at, or null when nothing was running. */
+  target: CancelTarget | null
+  /** `accepted`, or the refusal code. */
+  outcome: 'accepted' | CancelRefusal
+  clientCancelId: string
+}
+
+export function sessionCancelLedgerPath(): string {
+  return dataPath('session-cancel.jsonl')
+}
+
+/**
+ * One line per cancel, appended (O_APPEND: a line either lands whole or not at all, as the
+ * other jsonl ledgers here). A failed write is logged and dropped: a ledger must never turn
+ * a cancel that worked into an error.
+ */
+export function appendSessionCancelLedger(row: SessionCancelLedgerRow, path = sessionCancelLedgerPath()): void {
+  try {
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 })
+    appendFileSync(path, `${JSON.stringify(row)}\n`, { encoding: 'utf8', mode: 0o600 })
+    chmodSync(path, 0o600)
+  } catch (error) {
+    console.warn(`[session-cancel] ledger write skipped: ${error instanceof Error ? (error as NodeJS.ErrnoException).code ?? error.message : error}`)
+  }
+}

package/server/lib/session-halt.ts

@@ -0,0 +1,156 @@
+// Halt markers: how a cancel from the lens stops a Claude run at the desk (6.53.0).
+//
+// Miles, 2026-09-21: "If there's a current run that's going, it essentially clicks the
+// cancel button ... similar to when they're at the desktop."
+//
+// COS has no handle on a Desktop tab or a terminal `claude`: nothing it can signal, no
+// socket that takes an interrupt. What it does have is the synchronous PreToolUse hook
+// every Claude session on this Mac runs (`bin/hooks/cos-session-hook`). So a cancel is a
+// FILE: `<data>/session-halt/<session id>`. The hook tests for it before every tool call
+// and, when it is there, prints the deny plus `continue: false` that canary C1b proved
+// stops the run. The run stops at its NEXT tool call; a reply that is pure text finishes
+// first, and the lens copy says "at its next step" for that reason.
+//
+// WHERE. `dataPath('session-halt')`, beside the spool: the hook finds the folder as
+// `$(dirname "$SPOOL")/session-halt`, exactly as it finds the Cursor queue folder, and the
+// spool is `<data>/hook-spool` (claude-hooks-installer.ts `hookSpoolDir`). The two agree
+// for the same reason the queue folder does.
+//
+// THE NAME IS THE LOWERCASE SESSION ID, validated. It becomes a path component here and a
+// `[ -f ]` test in a shell script, and the script lowercases what it reads, so an upper-case
+// file would never match and a malformed one must never be written at all.
+//
+// LIFETIME. A marker lives only within the run it was written for:
+//   - the hook deletes it itself on UserPromptSubmit (a new desk prompt, a Continue
+//     delivered into the open session, and a COS `-p` turn all fire it), so a new prompt
+//     is never stopped;
+//   - the server deletes it on that session's SessionEnd (session-hooks-runtime.ts);
+//   - a sweep deletes anything older than HALT_MARKER_TTL_MS.
+// It is NOT deleted on Stop: a background subagent reports its parent's session id (C8),
+// and it is exactly the work a cancel must also stop.
+
+import { mkdirSync, readFileSync, readdirSync, statSync, unlinkSync } from 'node:fs'
+import { join } from 'node:path'
+import { atomicWriteFileSync } from './atomic-fs.js'
+import { dataPath } from './data-dir.js'
+import { isValidNativeThreadId } from './native-thread-id.js'
+
+/**
+ * How long a marker may outlive its cancel. An hour, not the plan's first 15 minutes: the
+ * hook deliberately ignores age (a long build must still be cancellable), so this sweep is
+ * the only thing that ends a marker whose session neither prompted again nor ended.
+ */
+export const HALT_MARKER_TTL_MS = 60 * 60_000
+
+export interface HaltMarker {
+  at: number
+  clientCancelId: string
+}
+
+export function haltDir(): string {
+  return dataPath('session-halt')
+}
+
+/** The marker's path, or null for anything that is not a full native session id. */
+export function haltMarkerPath(sessionId: string, dir = haltDir()): string | null {
+  const id = typeof sessionId === 'string' ? sessionId.toLowerCase() : ''
+  return isValidNativeThreadId(id) ? join(dir, id) : null
+}
+
+/**
+ * Write (or refresh) the marker for one session. Atomic: the hook must never read a torn
+ * file, though it only tests existence. False when the id is not a session id or the write
+ * failed; the caller must then not report the cancel as accepted.
+ */
+export function writeHaltMarker(sessionId: string, marker: HaltMarker, dir = haltDir()): boolean {
+  const path = haltMarkerPath(sessionId, dir)
+  if (path === null) return false
+  try {
+    mkdirSync(dir, { recursive: true, mode: 0o700 })
+    atomicWriteFileSync(path, `${JSON.stringify({ at: marker.at, clientCancelId: marker.clientCancelId })}\n`, { mode: 0o600 })
+    return true
+  } catch (error) {
+    console.error(`[session-halt] write failed: ${error instanceof Error ? (error as NodeJS.ErrnoException).code ?? error.message : error}`)
+    return false
+  }
+}
+
+/** True when a marker was removed. A missing one is not an error. */
+export function clearHaltMarker(sessionId: string, dir = haltDir()): boolean {
+  const path = haltMarkerPath(sessionId, dir)
+  if (path === null) return false
+  try {
+    unlinkSync(path)
+    return true
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Clear the marker because the SESSION ended, but only a marker written at or before the
+ * event. A SessionEnd drained late from the spool must not remove a cancel written after
+ * it for the same session id (a resumed tab reuses its id).
+ */
+export function clearHaltMarkerOnSessionEnd(sessionId: string, endedAt: number, dir = haltDir()): boolean {
+  const path = haltMarkerPath(sessionId, dir)
+  if (path === null) return false
+  const at = markerAt(path)
+  if (at === null || !Number.isFinite(endedAt) || at > endedAt) return false
+  try {
+    unlinkSync(path)
+    return true
+  } catch {
+    return false
+  }
+}
+
+export function hasHaltMarker(sessionId: string, dir = haltDir()): boolean {
+  const path = haltMarkerPath(sessionId, dir)
+  if (path === null) return false
+  try {
+    return statSync(path).isFile()
+  } catch {
+    return false
+  }
+}
+
+/** The marker's own `at`, else the file's mtime; null when neither can be read. */
+function markerAt(path: string): number | null {
+  try {
+    const parsed = JSON.parse(readFileSync(path, 'utf-8')) as { at?: unknown }
+    if (typeof parsed.at === 'number' && Number.isFinite(parsed.at)) return parsed.at
+  } catch { /* fall back to the clock the filesystem kept */ }
+  try {
+    return statSync(path).mtimeMs
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Remove every marker older than `ttlMs`, and any leftover the atomic write abandoned.
+ * Returns how many were removed. A marker dated in the future (a clock step) is judged by
+ * its mtime instead, so it cannot live for ever.
+ */
+export function sweepHaltMarkers(now: number, ttlMs = HALT_MARKER_TTL_MS, dir = haltDir()): number {
+  let names: string[]
+  try { names = readdirSync(dir) } catch { return 0 }
+  let removed = 0
+  for (const name of names) {
+    const path = join(dir, name)
+    let at = markerAt(path)
+    if (at !== null && at > now) {
+      try { at = statSync(path).mtimeMs } catch { at = null }
+    }
+    // A name the server would never write (a `.tmp` from a crashed write, anything else)
+    // is removed on sight: nothing reads it, and the hook's glob would keep forking for it.
+    const foreign = !isValidNativeThreadId(name)
+    if (!foreign && at !== null && now - at < ttlMs) continue
+    try {
+      unlinkSync(path)
+      removed++
+    } catch { /* already gone, or a directory: leave it */ }
+  }
+  return removed
+}

package/server/lib/session-hooks-runtime.ts

@@ -16,7 +16,8 @@ import { dataPath } from './data-dir.js'
 import { SessionHookLedger } from './session-hook-ledger.js'
 import { startSpoolIngester, type SpoolIngester, type SpoolStats } from './session-hook-spool.js'
 import { SessionSignalStore, type SessionSignal } from './session-signal-store.js'
-import { deriveSessionState, type DerivedSessionState, type RegistryFacts, type TranscriptFacts } from './session-state-derive.js'
+import { OPEN_TURN_CEILING_MS, deriveSessionState, type DerivedSessionState, type RegistryFacts, type TranscriptFacts } from './session-state-derive.js'
+import { clearHaltMarkerOnSessionEnd, sweepHaltMarkers } from './session-halt.js'
 import { ensureHookRuntimeFiles, ensureStableHookScript, hookSpoolDir, hookStatus, type HookStatus } from './claude-hooks-installer.js'
 
 export function sessionHooksEnabled(): boolean {
@@ -162,6 +163,35 @@ export function registryIdleAfterStop(sessionId: string, stopAt: number, dir = c
   return record.status === 'idle' && typeof record.statusUpdatedAt === 'number' && record.statusUpdatedAt >= stopAt
 }
 
+/** `kill(pid, 0)`: EPERM is a live process we may not signal; only ESRCH is gone. */
+function pidAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0)
+    return true
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code === 'EPERM'
+  }
+}
+
+/**
+ * 6.53.0: is Claude working on this session AT THE DESK right now (a Desktop tab, a terminal,
+ * or a Continue delivered live into either)? The cancel route's `deskRunning`: a yes offers
+ * `desk_run`, which arms a halt marker. Two witnesses, either one is enough:
+ *   - the hooks: the turn is open, the session has not ended, and the newest event is inside
+ *     the open-turn ceiling (a tab that died mid-turn must not read running for ever);
+ *   - the registry: the session's own record (never a COS child's: that run is the route's
+ *     own in-flight turn) says `busy`, and its pid is alive.
+ * Canary C9 (2026-09-21): after a hook stop the registry read idle within a second, so a
+ * cancelled desk run stops reading as running at once.
+ */
+export function claudeDeskRunning(sessionId: string, now = Date.now(), dir = claudeSessionsDir()): boolean {
+  const signal = signalFor(sessionId)
+  if (signal && signal.turnOpen && signal.ended === null && now - signal.lastEventAt <= OPEN_TURN_CEILING_MS) return true
+  const record = registryRecordSync(sessionId, dir)
+  if (!record || record.status !== 'busy' || record.pid === null || isCosSpawnedPid(record.pid, now)) return false
+  return pidAlive(record.pid)
+}
+
 let ledger: SessionHookLedger | null = null
 let ingester: SpoolIngester | null = null
 let replayed: { rows: number; applied: number } | null = null
@@ -197,6 +227,14 @@ export function startSessionHooksRuntime(options: { port: number }): SessionHook
       if (entrypoint) sessionSignalStore.setEntrypoint(env.sessionId, entrypoint)
     } : undefined,
   })
+  // 6.53.0: a halt marker dies with its session. SessionEnd only, never Stop: a background
+  // subagent reports its parent's session id (canary C8) and is work a cancel must stop.
+  // Subscribed AFTER the replay above, so an old SessionEnd in the replay window cannot
+  // clear a cancel written since; the TTL sweep covers anything this misses.
+  const unsubscribeHalt = enabled ? sessionSignalStore.subscribe((_signal, env, child) => {
+    if (env.event === 'SessionEnd' && !child) clearHaltMarkerOnSessionEnd(env.sessionId, env.ts)
+  }) : () => {}
+  sweepHaltMarkers(Date.now())
   // Runtime files the script reads. The port can change per install; the token never does.
   // The script is copied only when MISSING here: a boot must never downgrade what a newer
   // `--hooks install` put at the stable path.
@@ -206,12 +244,17 @@ export function startSessionHooksRuntime(options: { port: number }): SessionHook
   } catch (error) {
     console.error(`[session-hooks] runtime files: ${error instanceof Error ? error.message : error}`)
   }
-  const pruneTimer = setInterval(() => { sessionSignalStore.prune() }, 10 * 60_000)
+  // The same ten-minute tick sweeps halt markers past their hour (6.53.0).
+  const pruneTimer = setInterval(() => {
+    sessionSignalStore.prune()
+    sweepHaltMarkers(Date.now())
+  }, 10 * 60_000)
   pruneTimer.unref()
   return {
     store: sessionSignalStore,
     stop() {
       clearInterval(pruneTimer)
+      unsubscribeHalt()
       ingester?.stop()
     },
   }

package/server/lib/thread-turn-queue.ts

@@ -201,6 +201,12 @@ export interface DrainObservation {
   /** The gate's reason when `attachable` is false. Carried ONLY so a fence -- the one
    *  hold a clock cannot end -- can be given a longer life than a busy thread. */
   reason?: string | null
+  /**
+   * 6.53.0: until when a cancel on this thread holds its parked turns (epoch ms), or
+   * null. The person just said stop; a follow-up parked behind the run must not start it
+   * again a second later. It holds, then sends as normal (CANCEL_QUEUE_HOLD_MS, 2 min).
+   */
+  cancelHoldUntil?: number | null
 }
 
 export type DrainDecision = 'deliver' | 'hold' | 'expire' | 'give_up'
@@ -225,6 +231,9 @@ export function drainDecision(
   const effectiveTtl = seen.reason === 'native_target_fenced' ? FENCE_HELD_TURN_TTL_MS : ttlMs
   if (now - turn.queuedAt >= effectiveTtl) return 'expire'
   if (turn.attempts >= MAX_DELIVERY_ATTEMPTS) return 'give_up'
+  // 6.53.0: AFTER the two retirements, so a hold can never keep alive a turn that ran out
+  // of time or tries; BEFORE the gate, because it is a hold whatever the gate says.
+  if (typeof seen.cancelHoldUntil === 'number' && Number.isFinite(seen.cancelHoldUntil) && now < seen.cancelHoldUntil) return 'hold'
   // THE GATE, unweakened. Everything below is about WHEN, never about whether.
   if (!seen.attachable) return 'hold'
   // Turn-ended is the precise signal; idle is the backstop for a holder that wrote no