@gotcos/glasses-server 6.53.0 → 6.53.3

package/CHANGELOG.md

@@ -1,3 +1,37 @@
+## 6.53.3
+
+### Cancel owns the whole process tree, desk cancels hold, and the hook is faster
+
+Built from a four-reviewer regression review of 6.53.0 to 6.53.2 and a real-process harness. 6.53.2 fixed the 6.53.1 false fence (40 of 40 runs), but the harness found it could report a cancelled turn as reaped while a detached background job survived (3 of 3), and that it regressed a case 6.52.3 handled: when the provider exited but a same-group child still held its output open, cancel and timeout never signalled that child (2 of 2 survivors, 0 on 6.52.3). 6.53.2 was never published; this release supersedes it.
+
+- **Every process a turn started is stopped.** The root process group is signalled while Node has not reaped the leader, including when the first process-table read fails. Every process group a tree member sits in is remembered with its leader's start time, so members re-parented to launchd are still owned, signalled and counted. `reaped: true` is never reported while an owned process survives. A failed or malformed read still latches doubt and fences.
+- **Cancel settles as soon as the tree is gone.** Liveness is read asynchronously every 200 ms after `close` and settles on the first read that shows nothing of ours, so a tool that exits one second after SIGTERM settles in about 1.2 s instead of 5.3 s. Once doubt is latched, no more process-table reads run (6.53.2 ran about 29 blocking reads in 2 s).
+- **A cancel before the prompt write ends cleanly.** The tree is killed and reaped, and the turn settles `turn_cancelled` with no fence. A cancel before spawn reports `reaped: true`.
+- **A desk cancel cannot be undone by a parked turn.** A cancel records its target. Only a `cos_turn` cancel lets silence end a turn; a `desk_run` cancel keeps the open-turn evidence until the desk itself ends the run (Stop, StopFailure, SessionEnd, or an idle flip newer than the cancel). The same rule removes the phantom desk Cancel run after a killed `claude -p`.
+- **Cancel during the live hand-off works.** It is latched and answered 202 `stopping` instead of 409 `cancel_failed`. If nothing reached the session the turn settles `turn_cancelled`; if it reached, the desk halt marker is written (and re-armed once on the delivered prompt's own UserPromptSubmit). Codex answers `cancel_unsupported`. Replaying the same `clientCancelId` returns the final outcome.
+- **Fences left by a cancel release themselves.** A fence is released and logged only when its reason is `cancelled`, it was set at the ambiguous-delivery site, and every recorded child is confirmed gone. This clears threads locked by 6.53.1's false "may not have been delivered".
+- **Closed meetings age out.** A closed-session record past its 4-hour retention is evicted, so status reads `missing` and the phone stops asking to save it. Saving a known session with no transcript answers 404 `nothing_to_save` (with its state); only an unknown id still answers `session_not_found`.
+- **The session hook is about 40% faster and never breaks a large tool input.** The halt check, tool-name check and session-id parse run in shell on the first 4 KiB (read with `dd`: macOS `head -c` over-reads a pipe), and the rest of stdin is drained on every path, so a 2.5 MB Write no longer hits EPIPE. There is no temp file, so a new prompt always clears its session's marker. Median per tool call: about 29 ms to 17 ms quiet, 35 to 42 ms to about 23 ms under load. `--hooks status` adds an `advice` line; installs read `script_outdated` until Install hooks is run once.
+- Tests: a real-process end-to-end suite (churn, idle, stubborn, graceful, orphan-stdout three ways, group-orphan, setsid escape; macOS) fails 5 of 9 on 6.53.2 and passes here; queue-turn evidence is tested against the real queue; hook tests run the real script (EPIPE, marker-clear and drain cases fail on the old script). Mutation gate: 74 new cases plus retargeted 6.53.0 cases, all killed on a green baseline. Hook and installer suites clean up their temp roots.
+
+## 6.53.2
+
+### Cancel verification no longer races a dying Codex tree
+
+The installed 6.53.1 live canary successfully stopped the Codex wrapper and its detached tool, but then falsely fenced the session as `unreaped`. The verifier captured ancestry in one process-table snapshot and queried each process start time in later subprocesses. A short-lived descendant could disappear between those reads, permanently converting a successful cancellation into doubt.
+
+Process identity and ancestry now come from one stable `ps` snapshot (`pid`, `ppid`, `pgid`, and `lstart`) under a fixed UTC/C locale. There are no per-PID identity probes in the cancellation walk, so ordinary process death cannot poison reaping proof. A failed snapshot or any malformed identity still fails closed. Real detached-process tests cover the disappearing-PID race, unreadable whole snapshots, malformed atomic identities, re-parenting, and SIGKILL escalation; three new mutation cases independently remove the atomic capture, restore the racy per-PID probe, and ignore malformed identity data.
+
+## 6.53.1
+
+### Cancel the whole Codex process tree
+
+The 6.53.0 live Codex canary found that `codex exec resume` can launch a tool in its own process group. Cancelling the wrapper group stopped the COS turn, but an in-flight tool could be re-parented to launchd and continue running. This hotfix snapshots verified descendant identities before signalling the wrapper, reaches separate descendant groups, retains PID/start-time identities across re-parenting, and escalates those retained processes to SIGKILL after the five-second cancel grace. A wrapper `close` no longer clears the escalation while any verified tree member remains. Probe failure fails closed, and PID reuse is never signalled.
+
+A spawned cancellation is now reported as ordinary `turn_cancelled` only after the adapter confirms the entire tree was reaped. An unverified or surviving tree takes the existing ambiguous-delivery fence path. A pre-spawn cancellation remains provably process-free; a spawned pre-write cancellation still requires reaping proof even though no prompt byte was sent.
+
+- Tests: a real detached Node wrapper launches a SIGTERM-resistant tool in a second process group; the wrapper dies, the retained tool survives TERM, SIGKILL reaches it after re-parenting, and the tree is confirmed gone. Fault-injected process-table and start-time probes stay uncertain instead of inventing death. Adapter coverage proves wrapper close cannot settle early; route coverage proves both post-write and pre-write unreaped cancellations fence. The mutation gate removes each of those protections independently.
+
 ## 6.53.0
 
 ### Cancel a session run from the glasses

package/bin/hooks/cos-session-hook

@@ -1,5 +1,5 @@
 #!/bin/sh
-# COS session hook (glasses-server 6.48.0; Cursor Stop follow-up 6.51.0; halt check 6.53.0). Installed into ~/.claude/settings.json by
+# COS session hook (glasses-server 6.48.0; Cursor Stop follow-up 6.51.0; halt check 6.53.0; single entry 6.53.3). Installed into ~/.claude/settings.json by
 # `--hooks install`; Claude Code runs it with the hook event name as $1 and the event
 # payload on stdin. It spools one JSON file per event into the hook spool and exits 0
 # on every path. Only PermissionRequest ever talks to the server, and only when the
@@ -19,48 +19,76 @@ PATH=/usr/bin:/bin:/usr/sbin; umask 077; trap '' PIPE
 HOME=${HOME:-$(cd ~ 2>/dev/null && pwd)}; [ -n "$HOME" ] || exit 0
 GH=${COS_GLASSES_HOME:-$HOME/.cos-glasses}
 SPOOL=${COS_HOOK_SPOOL:-$GH/data/hook-spool}; EVENT="$1"
-# 6.53.0, the halt check. FIRST, before mkdir, perl and the B8 guard below: a full spool or
-# a stale drain stamp must never stop a cancel, and an ordinary tool call must cost nothing
-# but this. The marker folder sits beside the spool, like the Cursor queue folder; the server
-# writes `<folder>/<session id>` (lib/session-halt.ts). stdin is read ONCE, to a temp file,
-# and handed to the spool path below when the event still needs spooling.
-IN=''
+# 6.53.0, the halt check; 6.53.3, one entry for both synchronous events (review A, option a).
+# FIRST, before mkdir, perl and the B8 guard below: a full spool or a stale drain stamp must
+# never stop a cancel. The marker folder sits beside the spool, like the Cursor queue
+# folder; the server writes `<folder>/<session id>` (lib/session-halt.ts).
+#
+# The common path, a tool call with no marker anywhere on the Mac, is one glob, one 4 KiB
+# read, a shell `case`, and `exec cat` to drain the rest of stdin: no temp file, no grep,
+# no dirname, no mkdir (median 29 ms to 17 ms per tool call on the release Mac, 40 runs
+# each). Draining, not leaving stdin unread, keeps Claude Code's writer from EPIPE at any
+# payload size (a 2.5 MB tool input did EPIPE against the 6.53.0 script).
+FRONT=''
 case "$EVENT" in PreToolUse|UserPromptSubmit)
-  IN=$(mktemp "${TMPDIR:-/tmp}/cos-hook.XXXXXX" 2>/dev/null || mktemp /tmp/cos-hook.XXXXXX 2>/dev/null) || IN=''
-  # No temp file: a tool call goes ahead unchecked (fail open), and a prompt is spooled
-  # below exactly as before, its stdin untouched.
-  [ -n "$IN" ] || [ "$EVENT" = UserPromptSubmit ] || exit 0
-  ;;
-esac
-[ -z "$IN" ] || {
-  HALT="$(dirname "$SPOOL")/session-halt"
-  trap 'rm -f "$IN"; exit 0' HUP INT TERM
-  head -c 1048576 > "$IN" 2>/dev/null
-  # Any marker at all? A glob is a builtin, so the common case (no cancel anywhere on the
-  # Mac) reads no session id and forks nothing for it.
-  SID=''; for F in "$HALT"/*; do [ -e "$F" ] && SID=x; break; done
+  HALT="${SPOOL%/*}/session-halt"
+  # Any marker at all? A glob is a builtin, and it runs before stdin is touched.
+  ANY=''; for F in "$HALT"/*; do [ -e "$F" ] && ANY=1; break; done
   # The FIRST session_id is the payload's own: Claude writes it first, and a tool's input
-  # that happens to carry one comes later.
-  [ -z "$SID" ] || SID=$(grep -Eo '"session_id"[[:space:]]*:[[:space:]]*"[0-9A-Fa-f-]{36}"' "$IN" 2>/dev/null | head -1 | grep -Eo '[0-9A-Fa-f-]{36}' | tr 'A-F' 'a-f')
-  if [ "$EVENT" = UserPromptSubmit ]; then
+  # that happens to carry one comes later. Any JSON spacing; 36 hex-and-dash characters
+  # inside a closed string, or nothing.
+  sid_of() {
+    SID=''
+    case "$HEAD" in *'"session_id"'*)
+      SID=${HEAD#*'"session_id"'}; SID=${SID#"${SID%%[!:[:space:]]*}"}
+      case "$SID" in '"'*'"'*) SID=${SID#?}; SID=${SID%%'"'*} ;; *) SID='' ;; esac ;;
+    esac
+    case "$SID" in *[!0-9A-Fa-f-]*) SID='' ;; esac
+    [ ${#SID} -eq 36 ] || SID=''
+  }
+  # dd, never head: macOS head fills a 16 KiB buffer from a pipe and keeps only what -c
+  # asks for, so the bytes after 4 KiB would be lost to the spool below. dd does ONE
+  # read(2) of at most 4 KiB, and the `cat` after it starts at exactly the next byte.
+  HEAD=$(dd bs=4096 count=1 2>/dev/null)
+  SID=''; [ -z "$ANY" ] || sid_of
+  # Claude writes the session id first and a tool call's name within a few hundred bytes.
+  # If this read came back without what the event needs, the writer's bytes arrived in
+  # pieces: read once more rather than guess.
+  MORE=''; case "$EVENT$HEAD" in PreToolUse*'"tool_name"'*|UserPromptSubmit*) ;; *) MORE=1 ;; esac
+  if [ -n "$MORE" ] || { [ -n "$ANY" ] && [ -z "$SID" ]; }; then
+    HEAD="$HEAD$(dd bs=4096 count=1 2>/dev/null)"
+    [ -z "$ANY" ] || sid_of
+  fi
+  NEED=''
+  if [ "$EVENT" = UserPromptSubmit ]; then NEED=1
+  else
+    # Only the two tools the reducer reads are spooled (the 6.48 matcher). The FIRST
+    # "tool_name" is the payload's own; a tool's input that carries one comes later.
+    case "$HEAD" in *'"AskUserQuestion"'*|*'"ExitPlanMode"'*)
+      TN=${HEAD#*'"tool_name"'}; TN=${TN#"${TN%%[!:[:space:]]*}"}
+      case "$TN" in '"AskUserQuestion"'*|'"ExitPlanMode"'*) NEED=1 ;; esac ;;
+    esac
+  fi
+  case "$SID" in *[A-F]*) SID=$(printf '%s' "$SID" | tr 'A-F' 'a-f') ;; esac
+  if [ -z "$SID" ]; then :
+  elif [ "$EVENT" = UserPromptSubmit ]; then
     # A new prompt is never stopped: the marker lives only within the run it was written
     # for. This covers a prompt typed at the desk, a Continue delivered into the open
-    # session, and a COS `-p` turn. Then the prompt is spooled exactly as before.
-    [ -z "$SID" ] || rm -f "$HALT/$SID" 2>/dev/null
-  elif [ -n "$SID" ] && [ -f "$HALT/$SID" ]; then
-    rm -f "$IN"
+    # session, and a COS `-p` turn. Nothing (no temp file, 6.53.3 review A10) stands between
+    # reading the id and clearing it. Then the prompt is spooled as before.
+    rm -f "$HALT/$SID" 2>/dev/null
+  elif [ -f "$HALT/$SID" ]; then
     printf '%s' '{"continue":false,"stopReason":"Cancelled from COS","hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"Cancelled from COS"}}'
-    exit 0
-  else
-    # Only the two tools the reducer reads were ever spooled (the 6.48 matcher); every
-    # other tool call ends here with nothing written and nothing printed.
-    TOOL=$(grep -Eo '"tool_name"[[:space:]]*:[[:space:]]*"[A-Za-z]+"' "$IN" 2>/dev/null | head -1)
-    case "$TOOL" in *'"AskUserQuestion"'|*'"ExitPlanMode"') ;; *) rm -f "$IN"; exit 0 ;; esac
+    exec cat >/dev/null
   fi
-  # The spool path below reads stdin: hand it the saved bytes. The open descriptor keeps
-  # them readable after the unlink, so no temp file outlives this line.
-  exec < "$IN"; rm -f "$IN"; trap - HUP INT TERM
-}
+  # Every other tool call ends here with nothing written and nothing printed.
+  [ -n "$NEED" ] || exec cat >/dev/null
+  FRONT=1
+  # Until the spool read below has taken stdin, any exit (a failed mkdir, the B8 guard)
+  # still drains it.
+  trap 'cat >/dev/null 2>&1' EXIT
+  ;;
+esac
 mkdir -p "$SPOOL/rejected" 2>/dev/null || exit 0
 TS=$(perl -MTime::HiRes -e 'printf "%.0f", Time::HiRes::time()*1000' 2>/dev/null || date +%s000)
 # B8 guard: a full spool or a stale drain stamp means nobody is reading; keep only permissions.
@@ -68,7 +96,15 @@ if [ "$EVENT" != PermissionRequest ]; then
   N=$(ls "$SPOOL" 2>/dev/null | wc -l | tr -d ' '); [ "${N:-0}" -lt 2000 ] || exit 0
   STAMP="$SPOOL/.last-drain"; [ ! -f "$STAMP" ] || [ -z "$(find "$STAMP" -mmin +1440 2>/dev/null)" ] || exit 0   # -mtime +1 would mean two days
 fi
-T="$SPOOL/.tmp.$$.$TS"; head -c 1048576 > "$T.in"                    # stdin to disk, 1 MiB cap
+T="$SPOOL/.tmp.$$.$TS"
+if [ -n "$FRONT" ]; then
+  # 6.53.3: the 4 KiB the halt check read, then the rest of stdin, to disk with the same
+  # 1 MiB cap; whatever lies past the cap is drained, never left for the writer to EPIPE on.
+  trap - EXIT
+  { printf '%s' "$HEAD"; exec cat; } | { head -c 1048576 > "$T.in"; exec cat >/dev/null; }
+else
+  head -c 1048576 > "$T.in"                    # stdin to disk, 1 MiB cap
+fi
 case "$(head -c 1 "$T.in")" in '{') ;; *) EVENT=rejected ;; esac
 { printf '{"ts":%s,"ppid":%s,"event":"%s","payload":' "$TS" "$PPID" "$EVENT"; cat "$T.in"; printf '}\n'; } > "$T"
 rm -f "$T.in"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.53.0",
+  "version": "6.53.3",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -24,9 +24,10 @@ import { agentSessionStreamRouter } from './routes/agent-session-stream.js'
 import { createAttachedTurnStream } from './lib/session-stream-producer.js'
 import { claudeSessionsRouter } from './routes/claude-sessions.js'
 import { createSessionHooksRouter } from './routes/session-hooks.js'
-import { cachedHookStatus, claudeDeskRunning, deskIdleSeconds, registerDrainKickStats, registryIdleAfterStop, sessionHooksEnabled, sessionSignalStore, signalFor, startSessionHooksRuntime } from './lib/session-hooks-runtime.js'
+import { cachedHookStatus, claudeDeskRunning, deskIdleSeconds, deskTurnEndedAt, haltHandedOffTurn, registerDrainKickStats, registryIdleAfterStop, sessionHooksEnabled, sessionSignalStore, signalFor, startSessionHooksRuntime } from './lib/session-hooks-runtime.js'
 import { writeHaltMarker } from './lib/session-halt.js'
-import { appendSessionCancelLedger, cancelEndsTurn, cancelHoldUntil as cancelHoldUntilFor, noteThreadCancelled, threadCancelledAt } from './lib/session-cancel.js'
+import { appendSessionCancelLedger, cancelHoldUntil as cancelHoldUntilFor, noteThreadCancelled, threadCancel } from './lib/session-cancel.js'
+import { makeQueueTurnEvidence } from './lib/queue-turn-evidence.js'
 import {
   PermissionBroker,
   brokerSignalSink,
@@ -148,8 +149,8 @@ import {
 const app = express()
 import { createThreadTurnQueueRouter, drainAllThreads } from './routes/thread-turn-queue.js'
 import { createCursorStopFollowupRouter } from './routes/cursor-stop-followup.js'
-import { queuedThreadKeys, readQueue, transcriptTurnEnded, transcriptTurnVerdict, writeQueue } from './lib/thread-turn-queue-store.js'
-import { readHookToken } from './lib/claude-hooks-installer.js'
+import { queuedThreadKeys, readQueue, transcriptTurnVerdict, writeQueue } from './lib/thread-turn-queue-store.js'
+import { hookHaltReady, readHookToken } from './lib/claude-hooks-installer.js'
 import { OPEN_TURN_CEILING_MS } from './lib/session-state-derive.js'
 import { createDrainKick, kickPlanFor } from './lib/thread-drain-kick.js'
 import { transcriptPathFor } from './lib/native-head.js'
@@ -667,6 +668,22 @@ const sharedTargetGuard = new TargetGuard(
     : null,
 )
 
+const queueTurnEvidence = makeQueueTurnEvidence({
+  signalFor: threadId => signalFor(threadId),
+  registryIdleAfterStop: (threadId, stopAt) => registryIdleAfterStop(threadId, stopAt),
+  deskEndedAt: threadId => deskTurnEndedAt(threadId),
+  transcriptMtimeMs: (provider, threadId) => {
+    const read = occupancyProbes.transcriptMtimeMs
+    const value = typeof read === 'function' ? read(provider as 'claude' | 'codex', threadId) : null
+    return typeof value === 'number' ? value : null
+  },
+  transcriptVerdict: (provider, threadId) =>
+    transcriptTurnVerdict(provider as 'claude' | 'codex', transcriptPathFor(provider as 'claude' | 'codex', threadId, nativeHeadDeps)),
+  threadCancel: (provider, threadId) => threadCancel(provider, threadId),
+  openTurnCeilingMs: OPEN_TURN_CEILING_MS,
+  now: () => Date.now(),
+})
+
 if (threadAttachEnabled()) {
   const queueDeps = {
     // TWO GATES, ONE ANSWER. `threadOccupancy` sees FOREIGN holders -- another app on
@@ -711,61 +728,12 @@ if (threadAttachEnabled()) {
         return { attachable: false, reason: 'probe_failed' }
       }
     },
-    turnEnded: (provider: string, threadId: string) => {
-      if (provider !== 'claude' && provider !== 'codex') return false
-      try {
-        // 6.53.0: a cancel with nothing written since it ENDED the turn. A killed COS child
-        // leaves its last tool_use unanswered, and no Stop or terminal record ever follows.
-        const cancelledAt = threadCancelledAt(provider, threadId)
-        if (cancelledAt !== null) {
-          const readMtime = occupancyProbes.transcriptMtimeMs
-          const lastRow = typeof readMtime === 'function' ? readMtime(provider, threadId) : null
-          if (cancelEndsTurn(cancelledAt, typeof lastRow === 'number' ? lastRow : null)) return true
-        }
-        // 6.48.1: the engine's own end of turn: a Stop hook newer than the turn's prompt
-        // AND the registry flipped idle after it (the Stop hooks have returned; a prompt
-        // typed during them is queued and dequeues only then). The transcript tail
-        // (`turnFromTail`) answers for everything the hooks did not see. Both refuse on doubt.
-        if (provider === 'claude') {
-          const signal = signalFor(threadId)
-          if (signal && !signal.turnOpen && signal.lastEvent === 'Stop' && typeof signal.stopAt === 'number'
-            && signal.stopAt >= (signal.turnStartedAt ?? 0) && signal.subagentsOpen === 0
-            && registryIdleAfterStop(threadId, signal.stopAt) === true) return true
-        }
-        return transcriptTurnEnded(provider, transcriptPathFor(provider, threadId, nativeHeadDeps))
-      } catch {
-        return false
-      }
-    },
-    // 6.48.1: positive evidence the holder's turn is OPEN, which outranks the 30 s idle
-    // backstop (a long tool leaves the transcript untouched while it runs). Bounded: a
-    // signal or a tail older than OPEN_TURN_CEILING_MS is not evidence any more, so a
-    // crashed mid-tool session still drains by the backstop rather than holding for the TTL.
-    turnOpen: (provider: string, threadId: string): boolean => {
-      if (provider !== 'claude' && provider !== 'codex') return false
-      try {
-        const now = Date.now()
-        // 6.53.0: evidence older than a cancel on this thread is the cancelled run's, not a
-        // live turn (plan R1: a killed child's dangling tool_use read `tool_pending` for the
-        // whole 30-minute ceiling and held every parked turn behind it).
-        const cancelledAt = threadCancelledAt(provider, threadId)
-        if (provider === 'claude') {
-          const signal = signalFor(threadId)
-          if (signal && signal.turnOpen && now - signal.lastEventAt <= OPEN_TURN_CEILING_MS
-            && !cancelEndsTurn(cancelledAt, signal.lastEventAt)) return true
-        }
-        const path = transcriptPathFor(provider, threadId, nativeHeadDeps)
-        const verdict = transcriptTurnVerdict(provider, path)
-        if (!verdict || verdict.ended) return false
-        if (verdict.reason !== 'tool_pending' && verdict.reason !== 'prompt_open') return false
-        const read = occupancyProbes.transcriptMtimeMs
-        const mtime = typeof read === 'function' ? read(provider, threadId) : null
-        if (cancelEndsTurn(cancelledAt, typeof mtime === 'number' ? mtime : null)) return false
-        return typeof mtime === 'number' && now - mtime <= OPEN_TURN_CEILING_MS
-      } catch {
-        return false
-      }
-    },
+    // 6.53.3: the two turn questions live in lib/queue-turn-evidence.ts, where a test drives
+    // them against the real drain decision. What a cancel on the thread may conclude now
+    // depends on what it was aimed at (review A1): a killed COS child's silence ends its
+    // turn; a desk run's silence does not, until the desk itself says the run is over.
+    turnEnded: queueTurnEvidence.turnEnded,
+    turnOpen: queueTurnEvidence.turnOpen,
     activity: (provider: string, threadId: string): 'working' | 'idle' | 'unknown' => {
       try {
         const read = occupancyProbes.transcriptMtimeMs
@@ -879,11 +847,14 @@ app.use('/api', createAgentSessionBindingsRouter({
   cancel: {
     deskRunning: sessionId => claudeDeskRunning(sessionId),
     hooksEnabled: () => sessionHooksEnabled(),
-    hooksReady: () => cachedHookStatus().installed,
+    // 6.53.3: installed, or a halt-capable earlier script still in place (`hookHaltReady`).
+    hooksReady: () => hookHaltReady(cachedHookStatus()),
     writeHalt: (sessionId, marker) => writeHaltMarker(sessionId, marker),
     settlePermissions: sessionId => permissionBroker.cancelSession(sessionId),
     queuedWaiting: (provider, threadId) => readQueue(provider, threadId, Date.now()).filter(t => t.status === 'waiting').length,
-    noteCancelled: (provider, threadId, at) => noteThreadCancelled(provider, threadId, at),
+    noteCancelled: (provider, threadId, at, target) => noteThreadCancelled(provider, threadId, at, target),
+    // 6.53.3 (review A6): a cancel that landed during a live hand-off whose turn reached the session.
+    haltHandedOffTurn: (sessionId, marker, turn) => haltHandedOffTurn(sessionId, marker, turn),
     ledger: row => appendSessionCancelLedger(row),
   },
 }))