@gotcos/glasses-server 6.53.0 → 6.53.3

package/server/lib/claude-hooks-installer.ts

@@ -284,6 +284,58 @@ export function hookStatus(paths: { settingsPath?: string; scriptPath?: string;
   return { state, installed: state === 'installed', settingsPath, scriptPath, scriptSha, packageScriptSha, ...events, tokenPresent }
 }
 
+/**
+ * 6.53.3: sha256 of every EARLIER script that already carries the halt check: the one script
+ * 6.53.0, 6.53.1 and 6.53.2 all shipped. 6.53.3 rewrote the script for speed (review A,
+ * option a), so an install that has not run Install hooks since reads `script_outdated`
+ * and Control shows its banner. Its script still stops a desk run exactly as before,
+ * though, so a desk cancel is not refused `hooks_outdated` in the meantime
+ * (`hookHaltReady`). A script older than 6.53.0 has no halt check and never qualifies.
+ */
+export const HALT_CAPABLE_PRIOR_SCRIPT_SHAS: readonly string[] = [
+  '1158bb06297550128f01fc47caa68806a5287d6da2d05b0d1c812e8ae20764e7',
+]
+
+/**
+ * 6.53.3: can the hooks on this Mac stop a desk Claude run now? `installed`, or the only
+ * difference is a halt-capable earlier script (above). What the cancel route's
+ * `hooksReady` and `/api/health` `features.sessionCancel.deskClaude` read.
+ */
+export function hookHaltReady(status: Pick<HookStatus, 'installed' | 'state' | 'scriptSha'>): boolean {
+  if (status.installed === true) return true
+  return status.state === 'script_outdated' && typeof status.scriptSha === 'string'
+    && HALT_CAPABLE_PRIOR_SCRIPT_SHAS.includes(status.scriptSha)
+}
+
+const INSTALL_COMMAND = 'npx --yes @gotcos/glasses-server@latest --hooks install'
+
+/**
+ * 6.53.3: one plain sentence for `--hooks status` saying what the state means and what fixes
+ * it. Null when installed. Carries no path: the status JSON beside it already names them.
+ */
+export function hookStatusAdvice(status: Pick<HookStatus, 'installed' | 'state' | 'scriptSha' | 'packageScriptSha'>): string | null {
+  const short = (sha: string | null): string => (sha ? sha.slice(0, 12) : 'none')
+  switch (status.state) {
+    case 'installed':
+      return null
+    case 'script_outdated':
+      return `The installed hook script is older than this package's (installed ${short(status.scriptSha)}, package ${short(status.packageScriptSha)}). `
+        + 'Every Claude session keeps running the old script until the hooks are reinstalled: '
+        + `run \`${INSTALL_COMMAND}\`, or press Install hooks in COS Control. `
+        + (hookHaltReady(status)
+          ? 'Cancel from the lens still stops desk runs with the installed script meanwhile.'
+          : 'Until then a desk run cannot be cancelled from the lens.')
+    case 'drift':
+    case 'missing':
+      return `The hook subscriptions in the Claude settings file are ${status.state === 'missing' ? 'not installed' : 'not the ones this package installs'}. `
+        + `Run \`${INSTALL_COMMAND}\`, or press Install hooks in COS Control.`
+    case 'disabled_by_settings':
+      return 'The Claude settings file sets disableAllHooks: no hook runs, installed or not.'
+    default:
+      return 'The Claude settings file could not be read as it is; nothing was changed. Fix or restore the file, then install again.'
+  }
+}
+
 export interface InstallOptions {
   settingsPath?: string
   scriptPath?: string

package/server/lib/queue-turn-evidence.ts

@@ -0,0 +1,137 @@
+// The thread-turn queue's two turn questions, `turnEnded` and `turnOpen` (6.53.3).
+//
+// Moved out of the composition root (index.ts) unchanged in shape, so the one rule that
+// changed in 6.53.3 can be driven by a test against the real `drainDecision`: WHAT a
+// cancel on the thread may conclude about a turn that still reads open depends on what the
+// cancel was aimed at (review A1, `cancelVoidsOpenTurn` in session-cancel.ts).
+//
+//   cos_turn   COS killed its own child: nothing written since the cancel ends the turn.
+//   desk_run   the run stops at its NEXT tool call, so the hooks' and the transcript's
+//              open-turn evidence stands until the desk's own engine says the run is over
+//              at or after the cancel (a Stop, StopFailure or SessionEnd, or the registry's
+//              idle flip). Until 6.53.2 a desk run inside a long tool read "over" 30 s after
+//              the cancel, and a parked follow-up was delivered live into it.
+//
+// Every read is injected; index.ts wires the real ones. Both answers refuse on doubt: a
+// throw is `false` for each, which is what the composition root did before the move.
+
+import { cancelVoidsOpenTurn, type ThreadCancel } from './session-cancel.js'
+
+/** The hook signal fields these questions read (a `SessionSignal` satisfies it). */
+export interface TurnEvidenceSignal {
+  turnOpen: boolean
+  lastEvent: string
+  lastEventAt: number
+  turnStartedAt: number | null
+  stopAt: number | null
+  subagentsOpen: number
+}
+
+/** The transcript tail's own verdict (`transcriptTurnVerdict`). */
+export interface TurnEvidenceVerdict {
+  ended: boolean
+  reason?: string | null
+}
+
+export interface QueueTurnEvidenceDeps {
+  /** The hooks' signal for a Claude session; undefined when the hooks are off or silent. */
+  signalFor: (threadId: string) => TurnEvidenceSignal | undefined
+  /** `registryIdleAfterStop`: true only when the live record flipped idle at or after `stopAt`. */
+  registryIdleAfterStop: (threadId: string, stopAt: number) => boolean | null
+  /** `deskTurnEndedAt`: when the desk session's engine said its run is over, as it stands now. */
+  deskEndedAt: (threadId: string) => number | null
+  /** The transcript's mtime, or null when unmeasurable. */
+  transcriptMtimeMs: (provider: string, threadId: string) => number | null
+  /** The transcript tail's verdict, or null when unreadable. */
+  transcriptVerdict: (provider: string, threadId: string) => TurnEvidenceVerdict | null
+  /** The cancel on record for the thread (`threadCancel`). */
+  threadCancel: (provider: string, threadId: string) => ThreadCancel | null
+  /** Past this age a signal or a tail is not evidence any more (OPEN_TURN_CEILING_MS). */
+  openTurnCeilingMs: number
+  now: () => number
+}
+
+export interface QueueTurnEvidence {
+  turnEnded: (provider: string, threadId: string) => boolean
+  turnOpen: (provider: string, threadId: string) => boolean
+}
+
+export function makeQueueTurnEvidence(deps: QueueTurnEvidenceDeps): QueueTurnEvidence {
+  const mtime = (provider: string, threadId: string): number | null => {
+    const value = deps.transcriptMtimeMs(provider, threadId)
+    return typeof value === 'number' && Number.isFinite(value) ? value : null
+  }
+  /** Read once per question, and only when a cancel is on record (it scans the registry). */
+  const deskEnded = (provider: string, threadId: string): (() => number | null) => {
+    let cached: number | null | undefined
+    return () => {
+      if (cached === undefined) cached = provider === 'claude' ? deps.deskEndedAt(threadId) : null
+      return cached
+    }
+  }
+
+  const turnEnded = (provider: string, threadId: string): boolean => {
+    if (provider !== 'claude' && provider !== 'codex') return false
+    try {
+      const signal = provider === 'claude' ? deps.signalFor(threadId) : undefined
+      // 6.53.0: a cancel ends the turn when nothing was written since it (a killed COS
+      // child leaves its last tool_use unanswered, and no Stop or terminal record follows).
+      // 6.53.3: only a cos_turn cancel concludes that; a desk_run cancel needs the desk's
+      // own end, stamped at or after the cancel.
+      const cancel = deps.threadCancel(provider, threadId)
+      if (cancel !== null && cancelVoidsOpenTurn({
+        cancel,
+        lastActivityAt: mtime(provider, threadId),
+        turnStartedAt: signal?.turnStartedAt ?? null,
+        deskEndedAt: deskEnded(provider, threadId)(),
+      })) return true
+      // 6.48.1: the engine's own end of turn: a Stop hook newer than the turn's prompt
+      // AND the registry flipped idle after it (the Stop hooks have returned; a prompt
+      // typed during them is queued and dequeues only then). The transcript tail
+      // answers for everything the hooks did not see. Both refuse on doubt.
+      if (provider === 'claude') {
+        if (signal && !signal.turnOpen && signal.lastEvent === 'Stop' && typeof signal.stopAt === 'number'
+          && signal.stopAt >= (signal.turnStartedAt ?? 0) && signal.subagentsOpen === 0
+          && deps.registryIdleAfterStop(threadId, signal.stopAt) === true) return true
+      }
+      return deps.transcriptVerdict(provider, threadId)?.ended === true
+    } catch {
+      return false
+    }
+  }
+
+  // 6.48.1: positive evidence the holder's turn is OPEN, which outranks the 30 s idle
+  // backstop (a long tool leaves the transcript untouched while it runs). Bounded: a
+  // signal or a tail older than the ceiling is not evidence any more, so a crashed
+  // mid-tool session still drains by the backstop rather than holding for the TTL.
+  const turnOpen = (provider: string, threadId: string): boolean => {
+    if (provider !== 'claude' && provider !== 'codex') return false
+    try {
+      const now = deps.now()
+      const cancel = deps.threadCancel(provider, threadId)
+      const ended = deskEnded(provider, threadId)
+      if (provider === 'claude') {
+        const signal = deps.signalFor(threadId)
+        if (signal && signal.turnOpen && now - signal.lastEventAt <= deps.openTurnCeilingMs
+          && !(cancel !== null && cancelVoidsOpenTurn({
+            cancel,
+            lastActivityAt: signal.lastEventAt,
+            turnStartedAt: signal.turnStartedAt,
+            deskEndedAt: ended(),
+          }))) return true
+      }
+      const verdict = deps.transcriptVerdict(provider, threadId)
+      if (!verdict || verdict.ended) return false
+      if (verdict.reason !== 'tool_pending' && verdict.reason !== 'prompt_open') return false
+      const last = mtime(provider, threadId)
+      // 6.53.0 / 6.53.3: a cos_turn cancel with nothing written since discounts a dangling
+      // tool_use (the killed child's); a desk_run cancel only once the desk said it ended.
+      if (cancel !== null && cancelVoidsOpenTurn({ cancel, lastActivityAt: last, turnStartedAt: null, deskEndedAt: ended() })) return false
+      return last !== null && now - last <= deps.openTurnCeilingMs
+    } catch {
+      return false
+    }
+  }
+
+  return { turnEnded, turnOpen }
+}

package/server/lib/session-cancel.ts

@@ -104,30 +104,47 @@ export const CANCEL_QUEUE_HOLD_MS = 2 * 60_000
 export const CANCEL_MEMORY_MS = 60 * 60_000
 const MAX_REMEMBERED_CANCELS = 256
 
+/**
+ * One cancel on record for a thread (6.53.3): WHEN, and WHAT it was aimed at. The target
+ * decides what the cancel may conclude about a turn that still reads open (see
+ * `cancelVoidsOpenTurn`). Null is an older caller that did not say; it is read as a desk
+ * run, the reading that concludes the least.
+ */
+export interface ThreadCancel {
+  at: number
+  target: CancelTarget | null
+}
+
 // In memory on purpose: every reader is a hold of minutes, and a restart that forgets
 // one lets the queue drain by the gate's ordinary rules, which is the pre-6.53 behaviour.
-const cancelledAtByThread = new Map<string, number>()
+const cancelsByThread = new Map<string, ThreadCancel>()
 const cancelKey = (provider: string, threadId: string) => `${provider}:${threadId.toLowerCase()}`
 
-export function noteThreadCancelled(provider: string, threadId: string, at: number): void {
+export function noteThreadCancelled(provider: string, threadId: string, at: number, target: CancelTarget | null = null): void {
   if (!Number.isFinite(at)) return
   const key = cancelKey(provider, threadId)
-  cancelledAtByThread.delete(key)
-  cancelledAtByThread.set(key, at)
-  if (cancelledAtByThread.size > MAX_REMEMBERED_CANCELS) {
-    for (const [k, when] of cancelledAtByThread) {
-      if (at - when > CANCEL_MEMORY_MS) cancelledAtByThread.delete(k)
+  cancelsByThread.delete(key)
+  cancelsByThread.set(key, { at, target })
+  if (cancelsByThread.size > MAX_REMEMBERED_CANCELS) {
+    for (const [k, when] of cancelsByThread) {
+      if (at - when.at > CANCEL_MEMORY_MS) cancelsByThread.delete(k)
     }
-    while (cancelledAtByThread.size > MAX_REMEMBERED_CANCELS) {
-      const oldest = cancelledAtByThread.keys().next()
+    while (cancelsByThread.size > MAX_REMEMBERED_CANCELS) {
+      const oldest = cancelsByThread.keys().next()
       if (oldest.done) break
-      cancelledAtByThread.delete(oldest.value)
+      cancelsByThread.delete(oldest.value)
     }
   }
 }
 
 export function threadCancelledAt(provider: string, threadId: string): number | null {
-  return cancelledAtByThread.get(cancelKey(provider, threadId)) ?? null
+  return cancelsByThread.get(cancelKey(provider, threadId))?.at ?? null
+}
+
+/** 6.53.3: the cancel on record for the thread, with its target; null when none. A copy. */
+export function threadCancel(provider: string, threadId: string): ThreadCancel | null {
+  const found = cancelsByThread.get(cancelKey(provider, threadId))
+  return found ? { at: found.at, target: found.target } : null
 }
 
 /** Until when the thread's parked turns hold, or null when no cancel is on record. */
@@ -151,8 +168,49 @@ export function cancelEndsTurn(cancelledAt: number | null, lastRowAt: number | n
   return cancelledAt >= lastRowAt
 }
 
+/** What `cancelVoidsOpenTurn` weighs for one piece of open-turn evidence. */
+export interface OpenTurnEvidence {
+  /** The cancel on record for the thread (`threadCancel`), or null. */
+  cancel: ThreadCancel | null
+  /** When the evidence was last written: the hook's newest event, or the transcript mtime. */
+  lastActivityAt: number | null
+  /** When the turn the evidence belongs to STARTED (the hook's UserPromptSubmit); null when unknown. */
+  turnStartedAt: number | null
+  /**
+   * When the desk session's own engine said the run is over, as it stands NOW: the
+   * registry's `idle` flip (`statusUpdatedAt`), or the hooks' Stop / StopFailure /
+   * SessionEnd while no turn is open. Null when nothing says so.
+   */
+  deskEndedAt: number | null
+}
+
+/**
+ * 6.53.3 (review A1): may the cancel on record discount evidence that the thread's turn
+ * is still OPEN?
+ *
+ *   cos_turn   COS killed its own child. Nothing written since the cancel means the turn
+ *              is over: the dangling `tool_use` is the dead child's (6.53.0, `cancelEndsTurn`).
+ *   desk_run   A halt marker stops a desk run only at its NEXT tool call, so a run inside a
+ *              long tool writes nothing for minutes and is still running. Silence proves
+ *              nothing here. Only the engine's own end, stamped at or after the cancel and
+ *              after the turn began, closes it. Until 6.53.2 the cos_turn rule applied to
+ *              both, and a turn parked behind a cancelled desk run was delivered live into
+ *              the run the person had just stopped (and its UserPromptSubmit then deleted
+ *              the marker, so the cancel was lost).
+ *   null       An older caller that did not say: read as desk_run, which concludes least.
+ */
+export function cancelVoidsOpenTurn(evidence: OpenTurnEvidence): boolean {
+  const { cancel } = evidence
+  if (cancel === null || !Number.isFinite(cancel.at)) return false
+  if (cancel.target === 'cos_turn') return cancelEndsTurn(cancel.at, evidence.lastActivityAt)
+  const ended = evidence.deskEndedAt
+  if (ended === null || !Number.isFinite(ended) || ended < cancel.at) return false
+  const started = evidence.turnStartedAt
+  return started === null || !Number.isFinite(started) || ended >= started
+}
+
 export function __resetThreadCancelsForTests(): void {
-  cancelledAtByThread.clear()
+  cancelsByThread.clear()
 }
 
 // ---------------------------------------------------------------------------

package/server/lib/session-halt.ts

@@ -28,6 +28,10 @@
 //   - a sweep deletes anything older than HALT_MARKER_TTL_MS.
 // It is NOT deleted on Stop: a background subagent reports its parent's session id (C8),
 // and it is exactly the work a cancel must also stop.
+//
+// 6.53.3: ONE exception to "a new prompt clears it": a turn COS itself handed into the open
+// session while a cancel was on its way (`haltDeliveredTurn`). That turn's own prompt must
+// not be the one that frees it, so the server writes the marker back, once, when it sees it.
 
 import { mkdirSync, readFileSync, readdirSync, statSync, unlinkSync } from 'node:fs'
 import { join } from 'node:path'
@@ -105,6 +109,96 @@ export function clearHaltMarkerOnSessionEnd(sessionId: string, endedAt: number,
   }
 }
 
+// ---------------------------------------------------------------------------
+// 6.53.3 (review A6): a cancel that landed while COS was HANDING a turn to the open session
+// ---------------------------------------------------------------------------
+//
+// The live hop writes the turn into the running session's inbox, where it waits its turn
+// (a busy session) or starts at once (an idle one). Once it has landed, the only stop is
+// this marker. But the hook deletes the marker on UserPromptSubmit, and the delivered
+// turn's OWN UserPromptSubmit may come after the marker is written: a busy session takes
+// the message only when its current run ends (which the marker itself brings about). A
+// plain write would then be deleted by the very turn it was written to stop.
+//
+// So the marker is written, and when the delivered turn has not visibly started yet, it is
+// written AGAIN, once, on the first UserPromptSubmit for that session whose prompt carries
+// the delivered text. Matching the text keeps the person's own next desk prompt from ever
+// being the one that re-arms it; the window is the marker's own hour; SessionEnd drops it.
+// In memory on purpose: a restart forgets it, like every other hold here.
+
+interface PendingRearm {
+  marker: HaltMarker
+  /** Text the delivered prompt carries (the peer-inbox acceptance marker). */
+  promptMarker: string
+  /** Prompts submitted before this are someone else's. */
+  after: number
+  until: number
+}
+
+const pendingRearms = new Map<string, PendingRearm>()
+const MAX_PENDING_REARMS = 64
+
+/**
+ * Write the marker for a turn COS just put into the open session. `rearm` is false when
+ * the turn has visibly started already (its UserPromptSubmit ran before this write, so
+ * nothing will delete the marker but the next prompt). False when the write failed; the
+ * caller must then not report the cancel as armed.
+ */
+export function haltDeliveredTurn(
+  sessionId: string,
+  marker: HaltMarker,
+  turn: { promptMarker: string; after: number; rearm: boolean; now?: number },
+  dir = haltDir(),
+): boolean {
+  if (!writeHaltMarker(sessionId, marker, dir)) return false
+  const id = sessionId.toLowerCase()
+  if (!turn.rearm || typeof turn.promptMarker !== 'string' || turn.promptMarker.trim().length === 0) {
+    pendingRearms.delete(id)
+    return true
+  }
+  const now = turn.now ?? Date.now()
+  pendingRearms.delete(id)
+  pendingRearms.set(id, { marker, promptMarker: turn.promptMarker, after: turn.after, until: now + HALT_MARKER_TTL_MS })
+  while (pendingRearms.size > MAX_PENDING_REARMS) {
+    const oldest = pendingRearms.keys().next()
+    if (oldest.done) break
+    pendingRearms.delete(oldest.value)
+  }
+  return true
+}
+
+/**
+ * A UserPromptSubmit from the session itself (never a COS child): the hook has just deleted
+ * the session's marker. When it was the delivered turn's own prompt, write the marker back.
+ * One shot. True when the marker was re-armed.
+ */
+export function rearmHaltOnPrompt(sessionId: string, promptAt: number, prompt: unknown, dir = haltDir(), now = Date.now()): boolean {
+  const id = typeof sessionId === 'string' ? sessionId.toLowerCase() : ''
+  const pending = pendingRearms.get(id)
+  if (!pending) return false
+  if (now > pending.until) {
+    pendingRearms.delete(id)
+    return false
+  }
+  if (!Number.isFinite(promptAt) || promptAt < pending.after) return false
+  if (typeof prompt !== 'string' || !prompt.includes(pending.promptMarker)) return false
+  pendingRearms.delete(id)
+  return writeHaltMarker(id, pending.marker, dir)
+}
+
+/** The session ended: nothing is left to stop. */
+export function dropHaltRearm(sessionId: string): void {
+  if (typeof sessionId === 'string') pendingRearms.delete(sessionId.toLowerCase())
+}
+
+export function hasPendingHaltRearm(sessionId: string): boolean {
+  return typeof sessionId === 'string' && pendingRearms.has(sessionId.toLowerCase())
+}
+
+export function __resetHaltRearmsForTests(): void {
+  pendingRearms.clear()
+}
+
 export function hasHaltMarker(sessionId: string, dir = haltDir()): boolean {
   const path = haltMarkerPath(sessionId, dir)
   if (path === null) return false

package/server/lib/session-hooks-runtime.ts

@@ -17,7 +17,8 @@ import { SessionHookLedger } from './session-hook-ledger.js'
 import { startSpoolIngester, type SpoolIngester, type SpoolStats } from './session-hook-spool.js'
 import { SessionSignalStore, type SessionSignal } from './session-signal-store.js'
 import { OPEN_TURN_CEILING_MS, deriveSessionState, type DerivedSessionState, type RegistryFacts, type TranscriptFacts } from './session-state-derive.js'
-import { clearHaltMarkerOnSessionEnd, sweepHaltMarkers } from './session-halt.js'
+import { clearHaltMarkerOnSessionEnd, dropHaltRearm, haltDeliveredTurn, rearmHaltOnPrompt, sweepHaltMarkers, type HaltMarker } from './session-halt.js'
+import { cancelVoidsOpenTurn, threadCancel } from './session-cancel.js'
 import { ensureHookRuntimeFiles, ensureStableHookScript, hookSpoolDir, hookStatus, type HookStatus } from './claude-hooks-installer.js'
 
 export function sessionHooksEnabled(): boolean {
@@ -173,6 +174,29 @@ function pidAlive(pid: number): boolean {
   }
 }
 
+/**
+ * 6.53.3: when the desk session's own engine said its run is over, AS IT STANDS NOW: the
+ * registry's `idle` flip (`statusUpdatedAt`), or the hooks' Stop / StopFailure / SessionEnd
+ * while no turn is open. Null when neither says so (a busy record, an open hook turn, no
+ * record at all). What a desk_run cancel waits for before it may discount the evidence
+ * that the run is still going (`cancelVoidsOpenTurn`, review A1).
+ */
+export function deskTurnEndedAt(sessionId: string, dir = claudeSessionsDir()): number | null {
+  let ended: number | null = null
+  const later = (at: unknown): void => {
+    if (typeof at === 'number' && Number.isFinite(at) && (ended === null || at > ended)) ended = at
+  }
+  const signal = signalFor(sessionId)
+  if (signal && !signal.turnOpen) {
+    later(signal.stopAt)
+    later(signal.failure?.at)
+    later(signal.ended?.at)
+  }
+  const record = registryRecordSync(sessionId, dir)
+  if (record && record.status === 'idle') later(record.statusUpdatedAt)
+  return ended
+}
+
 /**
  * 6.53.0: is Claude working on this session AT THE DESK right now (a Desktop tab, a terminal,
  * or a Continue delivered live into either)? The cancel route's `deskRunning`: a yes offers
@@ -183,15 +207,40 @@ function pidAlive(pid: number): boolean {
  *     own in-flight turn) says `busy`, and its pid is alive.
  * Canary C9 (2026-09-21): after a hook stop the registry read idle within a second, so a
  * cancelled desk run stops reading as running at once.
+ *
+ * 6.53.3 (review A5): the hooks' open turn is weighed against the cancel on record, by the
+ * rule the turn queue uses. A `claude -p` COS child killed by a cancel fires no Stop or
+ * SessionEnd; its open turn with nothing since the cancel is the dead child's, and must not
+ * put a phantom "Cancel run" (desk_run) on a thread where nothing runs.
  */
 export function claudeDeskRunning(sessionId: string, now = Date.now(), dir = claudeSessionsDir()): boolean {
   const signal = signalFor(sessionId)
-  if (signal && signal.turnOpen && signal.ended === null && now - signal.lastEventAt <= OPEN_TURN_CEILING_MS) return true
+  if (signal && signal.turnOpen && signal.ended === null && now - signal.lastEventAt <= OPEN_TURN_CEILING_MS) {
+    const cancel = threadCancel('claude', sessionId)
+    if (cancel === null || !cancelVoidsOpenTurn({
+      cancel,
+      lastActivityAt: signal.lastEventAt,
+      turnStartedAt: signal.turnStartedAt,
+      deskEndedAt: deskTurnEndedAt(sessionId, dir),
+    })) return true
+  }
   const record = registryRecordSync(sessionId, dir)
   if (!record || record.status !== 'busy' || record.pid === null || isCosSpawnedPid(record.pid, now)) return false
   return pidAlive(record.pid)
 }
 
+/**
+ * 6.53.3 (review A6): stop a turn COS has just handed into the open session, because a
+ * cancel arrived while the hand-off was in flight. The marker is written now; when the
+ * hooks do not yet show the turn started (its UserPromptSubmit at or after `sentAt`), it is
+ * re-armed once when that prompt's own UserPromptSubmit deletes it (`haltDeliveredTurn`).
+ */
+export function haltHandedOffTurn(sessionId: string, marker: HaltMarker, turn: { promptMarker: string; sentAt: number }, now = Date.now()): boolean {
+  const signal = signalFor(sessionId)
+  const started = !!signal && typeof signal.turnStartedAt === 'number' && signal.turnStartedAt >= turn.sentAt
+  return haltDeliveredTurn(sessionId, marker, { promptMarker: turn.promptMarker, after: turn.sentAt, rearm: !started, now })
+}
+
 let ledger: SessionHookLedger | null = null
 let ingester: SpoolIngester | null = null
 let replayed: { rows: number; applied: number } | null = null
@@ -233,6 +282,10 @@ export function startSessionHooksRuntime(options: { port: number }): SessionHook
   // clear a cancel written since; the TTL sweep covers anything this misses.
   const unsubscribeHalt = enabled ? sessionSignalStore.subscribe((_signal, env, child) => {
     if (env.event === 'SessionEnd' && !child) clearHaltMarkerOnSessionEnd(env.sessionId, env.ts)
+    // 6.53.3 (review A6): a turn COS handed into the open session while a cancel was on its
+    // way. Its own UserPromptSubmit just deleted the marker; write it back (once).
+    if (env.event === 'UserPromptSubmit' && !child) rearmHaltOnPrompt(env.sessionId, env.ts, env.payload.prompt)
+    if (env.event === 'SessionEnd' && !child) dropHaltRearm(env.sessionId)
   }) : () => {}
   sweepHaltMarkers(Date.now())
   // Runtime files the script reads. The port can change per install; the token never does.