@gotcos/glasses-server 6.53.1 → 6.53.4

package/CHANGELOG.md

@@ -1,3 +1,41 @@
+## 6.53.4
+
+### The fixes from 6.53.3's review
+
+6.53.3 was published before its four-reviewer /qa round finished (the round was cut short by a usage limit and rerun the next morning). This release carries that round's server fixes, and corrects three claims 6.53.3 made. Install hooks once after updating.
+
+- **A `ps` that fails never releases a fence (blocker in 6.53.3).** 6.53.3's fence auto-release read every `execFileSync` error as "not running", so a `ps` killed at its 2 s timeout, an `EAGAIN` fork failure or a missing binary could release a cancel fence whose child might still be writing. Only the measured "no such process" answer (exit 1, no signal, not killed, no error code, nothing on stdout or stderr) counts as gone now; everything else, and a clean exit that printed nothing, is unverifiable and keeps the fence. `ps` is `/bin/ps` when present. A fence that reads unknown is re-checked on every fence check and can still be released by hand in COS Control.
+- **The halt re-arm matches the delivered prompt exactly.** 6.53.3 matched the first 120 characters with `includes`, so a short Continue ("yes") matched the person's own next desk prompt: their run was stopped "Cancelled from COS" and the cancelled COS turn then ran. Now the words must be equal (whitespace collapsed, Claude Code's peer-message wrapper taken off), and the first prompt after the hand-off decides: a different prompt spends the re-arm and is logged. Stated limit: if the person's own prompt reaches the session first, the queued COS turn is not stopped; an identical desk prompt typed after the send and taken first still re-arms. An unverified hand-off holds its re-arm 2 minutes, not an hour.
+- **The hook drains stdin on every event.** PermissionRequest, Stop, PostToolUse, SessionStart, SessionEnd and the other non-front events read only 1 MiB and left the rest unread, and the spool guard exited before reading; a larger payload could EPIPE the writer. The header comment no longer says the PreToolUse branch writes no spool. Script sha256 `df54677f...`; the 6.53.0 script (`1158bb06...`) and 6.53.3's (`c0b41bf8...`) still stop desk runs until Install hooks is run. The PreToolUse common path is unchanged (40 runs each, interleaved: 11.2 and 10.9 ms before, 11.4 and 11.0 ms after).
+- **The mutation gate needs a failing test.** A kill was any non-zero vitest exit; now a mutant is killed only when a named test fails, and a run that errors without one fails the gate. Every 6.53.x case was re-run under that rule on a green baseline: 137 of 137 killed by a failing test (16 added in this round), none errored.
+- **Every server suite removes its temp folders.** 39 test files made `mkdtemp` folders and never removed them (one run left 581 entries in `$TMPDIR`; now none made by a test). 6.53.3's "hook and installer suites clean up their temp roots" was true only for three suites.
+- **Corrections to 6.53.3's notes.** "`reaped: true` is never reported while an owned process survives" holds for cancel and timeout only: a natural exit settles as soon as the CLI is reaped, with no tree probe. The graceful end-to-end bound is now derived from the fixture's stop delay and `TREE_POLL_MS` (2.4 s, was 4 s). The closed-session test imports its retention constant. README gains a "Cancel a run from the glasses (6.53.x)" section.
+- Tests: full suite 5,128 passed, 2 skipped; typecheck clean; `npm audit --omit=dev` 0 vulnerabilities.
+
+## 6.53.3
+
+### Cancel owns the whole process tree, desk cancels hold, and the hook is faster
+
+Built from a four-reviewer regression review of 6.53.0 to 6.53.2 and a real-process harness. 6.53.2 fixed the 6.53.1 false fence (40 of 40 runs), but the harness found it could report a cancelled turn as reaped while a detached background job survived (3 of 3), and that it regressed a case 6.52.3 handled: when the provider exited but a same-group child still held its output open, cancel and timeout never signalled that child (2 of 2 survivors, 0 on 6.52.3). 6.53.2 was never published; this release supersedes it.
+
+- **Every process a turn started is stopped.** The root process group is signalled while Node has not reaped the leader, including when the first process-table read fails. Every process group a tree member sits in is remembered with its leader's start time, so members re-parented to launchd are still owned, signalled and counted. `reaped: true` is never reported while an owned process survives. A failed or malformed read still latches doubt and fences.
+- **Cancel settles as soon as the tree is gone.** Liveness is read asynchronously every 200 ms after `close` and settles on the first read that shows nothing of ours, so a tool that exits one second after SIGTERM settles in about 1.2 s instead of 5.3 s. Once doubt is latched, no more process-table reads run (6.53.2 ran about 29 blocking reads in 2 s).
+- **A cancel before the prompt write ends cleanly.** The tree is killed and reaped, and the turn settles `turn_cancelled` with no fence. A cancel before spawn reports `reaped: true`.
+- **A desk cancel cannot be undone by a parked turn.** A cancel records its target. Only a `cos_turn` cancel lets silence end a turn; a `desk_run` cancel keeps the open-turn evidence until the desk itself ends the run (Stop, StopFailure, SessionEnd, or an idle flip newer than the cancel). The same rule removes the phantom desk Cancel run after a killed `claude -p`.
+- **Cancel during the live hand-off works.** It is latched and answered 202 `stopping` instead of 409 `cancel_failed`. If nothing reached the session the turn settles `turn_cancelled`; if it reached, the desk halt marker is written (and re-armed once on the delivered prompt's own UserPromptSubmit). Codex answers `cancel_unsupported`. Replaying the same `clientCancelId` returns the final outcome.
+- **Fences left by a cancel release themselves.** A fence is released and logged only when its reason is `cancelled`, it was set at the ambiguous-delivery site, and every recorded child is confirmed gone. This clears threads locked by 6.53.1's false "may not have been delivered".
+- **Closed meetings age out.** A closed-session record past its 4-hour retention is evicted, so status reads `missing` and the phone stops asking to save it. Saving a known session with no transcript answers 404 `nothing_to_save` (with its state); only an unknown id still answers `session_not_found`.
+- **The session hook is about 40% faster and never breaks a large tool input.** The halt check, tool-name check and session-id parse run in shell on the first 4 KiB (read with `dd`: macOS `head -c` over-reads a pipe), and the rest of stdin is drained on every path, so a 2.5 MB Write no longer hits EPIPE. There is no temp file, so a new prompt always clears its session's marker. Median per tool call: about 29 ms to 17 ms quiet, 35 to 42 ms to about 23 ms under load. `--hooks status` adds an `advice` line; installs read `script_outdated` until Install hooks is run once.
+- Tests: a real-process end-to-end suite (churn, idle, stubborn, graceful, orphan-stdout three ways, group-orphan, setsid escape; macOS) fails 5 of 9 on 6.53.2 and passes here; queue-turn evidence is tested against the real queue; hook tests run the real script (EPIPE, marker-clear and drain cases fail on the old script). Mutation gate: 74 new cases plus retargeted 6.53.0 cases, all killed on a green baseline. Hook and installer suites clean up their temp roots.
+
+## 6.53.2
+
+### Cancel verification no longer races a dying Codex tree
+
+The installed 6.53.1 live canary successfully stopped the Codex wrapper and its detached tool, but then falsely fenced the session as `unreaped`. The verifier captured ancestry in one process-table snapshot and queried each process start time in later subprocesses. A short-lived descendant could disappear between those reads, permanently converting a successful cancellation into doubt.
+
+Process identity and ancestry now come from one stable `ps` snapshot (`pid`, `ppid`, `pgid`, and `lstart`) under a fixed UTC/C locale. There are no per-PID identity probes in the cancellation walk, so ordinary process death cannot poison reaping proof. A failed snapshot or any malformed identity still fails closed. Real detached-process tests cover the disappearing-PID race, unreadable whole snapshots, malformed atomic identities, re-parenting, and SIGKILL escalation; three new mutation cases independently remove the atomic capture, restore the racy per-PID probe, and ignore malformed identity data.
+
 ## 6.53.1
 
 ### Cancel the whole Codex process tree

package/README.md

@@ -265,6 +265,41 @@ Allow once or deny only: no permission rule is ever written. Rows carry
 row reads `waiting_kind: question` whatever the switch says; `/api/health` reports
 `permissionBroker` (counters and timestamps, no ids or text).
 
+## Cancel a run from the glasses (6.53.x)
+
+The glasses' Cancel run row stops what a session is doing, the way the desk's own stop
+button does. It needs **server 6.53.0 or later and COS Glasses 6.9.529 or later**;
+**6.53.4 is recommended** (it owns the whole process tree, holds a desk cancel, fixes
+the false fences 6.53.1 left, and never releases a fence when `ps` cannot answer).
+
+- **A turn COS started** (`cos_turn`) is stopped by the server: its whole process tree is
+  signalled and the turn settles `turn_cancelled`.
+- **A run at the desk** (`desk_run`: a Desktop tab or a terminal `claude`) is stopped by the
+  session hook at its next tool call, so a reply that is pure text finishes first. This
+  needs the hooks installed, and after every server update that changes the hook script
+  (6.53.0, 6.53.3, 6.53.4) you must **run Install hooks once** (COS Control, or
+  `npx --yes @gotcos/glasses-server@latest --hooks install`). Until then
+  `--hooks status` reads `script_outdated` and its `advice` line says so; a script from
+  6.53.0 to 6.53.3 can still stop desk runs meanwhile, anything older answers
+  `hooks_outdated`. The PreToolUse hook runs before every tool call on the Mac and never
+  contacts the server; it writes a spool file only for AskUserQuestion, ExitPlanMode and
+  prompts, and always drains its input.
+- **Codex and Cursor** runs at the desk answer `cancel_unsupported` ("Stop it there").
+- **Fences a cancel left release themselves** once every process the cancelled turn
+  started is confirmed gone: only `ps` answering "no such process" counts, and a `ps` that
+  times out, cannot start or is missing keeps the fence. Any other fence is still released
+  by hand (`GET /api/agent-sessions/fences`, then `POST .../fences/release` with
+  `confirm: true`).
+- **A cancel that lands while COS is handing a turn to the open session** writes the desk
+  marker, and re-arms it once if the next prompt that session starts is exactly the
+  delivered one. If your own prompt reaches the session first, the re-arm is dropped (and
+  logged) rather than stop your run.
+
+Meetings: a closed meeting's record ages out after **4 hours**, after which its status
+reads `missing` and the phone stops asking to save it. Saving a known meeting that has no
+transcript answers **404 `nothing_to_save`** (with its state); only an unknown id answers
+`session_not_found`.
+
 ## Configuration
 
 Config lives at `~/.cos-glasses/.env` (created on first run). Every key is
@@ -626,7 +661,8 @@ BIND_HOST=0.0.0.0 npm run start:server
   timers are frozen), `desk_active` (the Mac saw input), `approvals_off`
   (`COS_PERMISSION_BROKER=questions`), `broker_off`, `cursor`, `unsupported_tool`
   (ExitPlanMode is never held). `lastQuestionsPollAt` says when a client last counted.
-  `--hooks status` must read `installed`. To turn it off with no reinstall, set
+  `--hooks status` must read `installed` (right after updating to 6.53.4 it reads
+  `script_outdated` until Install hooks is run once; its `advice` line says so). To turn it off with no reinstall, set
   `COS_PERMISSION_BROKER=0` in `~/.cos-glasses/.env` and restart. For the Messages
   trail, `/api/health` `messages_trail.readerErrors` counts lines a reader could not map.
 - *Offline meeting recovery unavailable?* — build 209+ requires server 6.11.0+.

package/bin/hooks/cos-session-hook

@@ -1,5 +1,5 @@
 #!/bin/sh
-# COS session hook (glasses-server 6.48.0; Cursor Stop follow-up 6.51.0; halt check 6.53.0). Installed into ~/.claude/settings.json by
+# COS session hook (glasses-server 6.48.0; Cursor Stop follow-up 6.51.0; halt check 6.53.0; single entry 6.53.3). Installed into ~/.claude/settings.json by
 # `--hooks install`; Claude Code runs it with the hook event name as $1 and the event
 # payload on stdin. It spools one JSON file per event into the hook spool and exits 0
 # on every path. Only PermissionRequest ever talks to the server, and only when the
@@ -7,11 +7,15 @@
 # restarting never delays a Claude session.
 #
 # 6.53.0: PreToolUse is SYNCHRONOUS with no matcher, so the first branch below runs before
-# EVERY tool call in every Claude session on this Mac. It is file-only (no curl, no spool
-# write) and prints nothing unless the server left a halt marker for this session, when it
-# prints the one reply that stops the run (canary C1b, 2026-09-21: `continue:false` alone
-# still ran the tool; with the deny it did not). It never exits 2: exit 2 blocks the tool,
-# while a timeout or any other code fails open (C6, C7).
+# EVERY tool call in every Claude session on this Mac. It never contacts the server. For an
+# ordinary tool it writes nothing at all; it spools only AskUserQuestion and ExitPlanMode
+# (the two tools the reducer reads, the 6.48 matcher's set), and UserPromptSubmit, which
+# shares the branch, is always spooled. It prints nothing unless the server left a halt
+# marker for this session, when it prints the one reply that stops the run (canary C1b,
+# 2026-09-21: `continue:false` alone still ran the tool; with the deny it did not). It never
+# exits 2: exit 2 blocks the tool, while a timeout or any other code fails open (C6, C7).
+# Every path, every event, drains stdin before it exits, so Claude Code's writer never
+# EPIPEs whatever the payload's size (6.53.3; every other event since its /qa round).
 #
 # The installer bakes COS_GLASSES_HOME and COS_HOOK_SPOOL into the command, so this
 # script and the server can never disagree about where the token or the spool is.
@@ -19,48 +23,79 @@ PATH=/usr/bin:/bin:/usr/sbin; umask 077; trap '' PIPE
 HOME=${HOME:-$(cd ~ 2>/dev/null && pwd)}; [ -n "$HOME" ] || exit 0
 GH=${COS_GLASSES_HOME:-$HOME/.cos-glasses}
 SPOOL=${COS_HOOK_SPOOL:-$GH/data/hook-spool}; EVENT="$1"
-# 6.53.0, the halt check. FIRST, before mkdir, perl and the B8 guard below: a full spool or
-# a stale drain stamp must never stop a cancel, and an ordinary tool call must cost nothing
-# but this. The marker folder sits beside the spool, like the Cursor queue folder; the server
-# writes `<folder>/<session id>` (lib/session-halt.ts). stdin is read ONCE, to a temp file,
-# and handed to the spool path below when the event still needs spooling.
-IN=''
+# 6.53.0, the halt check; 6.53.3, one entry for both synchronous events (review A, option a).
+# FIRST, before mkdir, perl and the B8 guard below: a full spool or a stale drain stamp must
+# never stop a cancel. The marker folder sits beside the spool, like the Cursor queue
+# folder; the server writes `<folder>/<session id>` (lib/session-halt.ts).
+#
+# The common path, a tool call with no marker anywhere on the Mac, is one glob, one 4 KiB
+# read, a shell `case`, and `exec cat` to drain the rest of stdin: no temp file, no grep,
+# no dirname, no mkdir (median 29 ms to 17 ms per tool call on the release Mac, 40 runs
+# each). Draining, not leaving stdin unread, keeps Claude Code's writer from EPIPE at any
+# payload size (a 2.5 MB tool input did EPIPE against the 6.53.0 script).
+FRONT=''
 case "$EVENT" in PreToolUse|UserPromptSubmit)
-  IN=$(mktemp "${TMPDIR:-/tmp}/cos-hook.XXXXXX" 2>/dev/null || mktemp /tmp/cos-hook.XXXXXX 2>/dev/null) || IN=''
-  # No temp file: a tool call goes ahead unchecked (fail open), and a prompt is spooled
-  # below exactly as before, its stdin untouched.
-  [ -n "$IN" ] || [ "$EVENT" = UserPromptSubmit ] || exit 0
-  ;;
-esac
-[ -z "$IN" ] || {
-  HALT="$(dirname "$SPOOL")/session-halt"
-  trap 'rm -f "$IN"; exit 0' HUP INT TERM
-  head -c 1048576 > "$IN" 2>/dev/null
-  # Any marker at all? A glob is a builtin, so the common case (no cancel anywhere on the
-  # Mac) reads no session id and forks nothing for it.
-  SID=''; for F in "$HALT"/*; do [ -e "$F" ] && SID=x; break; done
+  HALT="${SPOOL%/*}/session-halt"
+  # Any marker at all? A glob is a builtin, and it runs before stdin is touched.
+  ANY=''; for F in "$HALT"/*; do [ -e "$F" ] && ANY=1; break; done
   # The FIRST session_id is the payload's own: Claude writes it first, and a tool's input
-  # that happens to carry one comes later.
-  [ -z "$SID" ] || SID=$(grep -Eo '"session_id"[[:space:]]*:[[:space:]]*"[0-9A-Fa-f-]{36}"' "$IN" 2>/dev/null | head -1 | grep -Eo '[0-9A-Fa-f-]{36}' | tr 'A-F' 'a-f')
-  if [ "$EVENT" = UserPromptSubmit ]; then
+  # that happens to carry one comes later. Any JSON spacing; 36 hex-and-dash characters
+  # inside a closed string, or nothing.
+  sid_of() {
+    SID=''
+    case "$HEAD" in *'"session_id"'*)
+      SID=${HEAD#*'"session_id"'}; SID=${SID#"${SID%%[!:[:space:]]*}"}
+      case "$SID" in '"'*'"'*) SID=${SID#?}; SID=${SID%%'"'*} ;; *) SID='' ;; esac ;;
+    esac
+    case "$SID" in *[!0-9A-Fa-f-]*) SID='' ;; esac
+    [ ${#SID} -eq 36 ] || SID=''
+  }
+  # dd, never head: macOS head fills a 16 KiB buffer from a pipe and keeps only what -c
+  # asks for, so the bytes after 4 KiB would be lost to the spool below. dd does ONE
+  # read(2) of at most 4 KiB, and the `cat` after it starts at exactly the next byte.
+  HEAD=$(dd bs=4096 count=1 2>/dev/null)
+  SID=''; [ -z "$ANY" ] || sid_of
+  # Claude writes the session id first and a tool call's name within a few hundred bytes.
+  # If this read came back without what the event needs, the writer's bytes arrived in
+  # pieces: read once more rather than guess.
+  MORE=''; case "$EVENT$HEAD" in PreToolUse*'"tool_name"'*|UserPromptSubmit*) ;; *) MORE=1 ;; esac
+  if [ -n "$MORE" ] || { [ -n "$ANY" ] && [ -z "$SID" ]; }; then
+    HEAD="$HEAD$(dd bs=4096 count=1 2>/dev/null)"
+    [ -z "$ANY" ] || sid_of
+  fi
+  NEED=''
+  if [ "$EVENT" = UserPromptSubmit ]; then NEED=1
+  else
+    # Only the two tools the reducer reads are spooled (the 6.48 matcher). The FIRST
+    # "tool_name" is the payload's own; a tool's input that carries one comes later.
+    case "$HEAD" in *'"AskUserQuestion"'*|*'"ExitPlanMode"'*)
+      TN=${HEAD#*'"tool_name"'}; TN=${TN#"${TN%%[!:[:space:]]*}"}
+      case "$TN" in '"AskUserQuestion"'*|'"ExitPlanMode"'*) NEED=1 ;; esac ;;
+    esac
+  fi
+  case "$SID" in *[A-F]*) SID=$(printf '%s' "$SID" | tr 'A-F' 'a-f') ;; esac
+  if [ -z "$SID" ]; then :
+  elif [ "$EVENT" = UserPromptSubmit ]; then
     # A new prompt is never stopped: the marker lives only within the run it was written
     # for. This covers a prompt typed at the desk, a Continue delivered into the open
-    # session, and a COS `-p` turn. Then the prompt is spooled exactly as before.
-    [ -z "$SID" ] || rm -f "$HALT/$SID" 2>/dev/null
-  elif [ -n "$SID" ] && [ -f "$HALT/$SID" ]; then
-    rm -f "$IN"
+    # session, and a COS `-p` turn. Nothing (no temp file, 6.53.3 review A10) stands between
+    # reading the id and clearing it. Then the prompt is spooled as before.
+    rm -f "$HALT/$SID" 2>/dev/null
+  elif [ -f "$HALT/$SID" ]; then
     printf '%s' '{"continue":false,"stopReason":"Cancelled from COS","hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"Cancelled from COS"}}'
-    exit 0
-  else
-    # Only the two tools the reducer reads were ever spooled (the 6.48 matcher); every
-    # other tool call ends here with nothing written and nothing printed.
-    TOOL=$(grep -Eo '"tool_name"[[:space:]]*:[[:space:]]*"[A-Za-z]+"' "$IN" 2>/dev/null | head -1)
-    case "$TOOL" in *'"AskUserQuestion"'|*'"ExitPlanMode"') ;; *) rm -f "$IN"; exit 0 ;; esac
+    exec cat >/dev/null
   fi
-  # The spool path below reads stdin: hand it the saved bytes. The open descriptor keeps
-  # them readable after the unlink, so no temp file outlives this line.
-  exec < "$IN"; rm -f "$IN"; trap - HUP INT TERM
-}
+  # Every other tool call ends here with nothing written and nothing printed.
+  [ -n "$NEED" ] || exec cat >/dev/null
+  FRONT=1
+  # Until the spool read below has taken stdin, any exit (a failed mkdir, the B8 guard)
+  # still drains it.
+  trap 'cat >/dev/null 2>&1' EXIT
+  ;;
+esac
+# Every other event: until the spool read below has taken stdin, any exit (a failed mkdir,
+# the B8 guard) drains it, as the front does.
+[ -n "$FRONT" ] || trap 'cat >/dev/null 2>&1' EXIT
 mkdir -p "$SPOOL/rejected" 2>/dev/null || exit 0
 TS=$(perl -MTime::HiRes -e 'printf "%.0f", Time::HiRes::time()*1000' 2>/dev/null || date +%s000)
 # B8 guard: a full spool or a stale drain stamp means nobody is reading; keep only permissions.
@@ -68,7 +103,17 @@ if [ "$EVENT" != PermissionRequest ]; then
   N=$(ls "$SPOOL" 2>/dev/null | wc -l | tr -d ' '); [ "${N:-0}" -lt 2000 ] || exit 0
   STAMP="$SPOOL/.last-drain"; [ ! -f "$STAMP" ] || [ -z "$(find "$STAMP" -mmin +1440 2>/dev/null)" ] || exit 0   # -mtime +1 would mean two days
 fi
-T="$SPOOL/.tmp.$$.$TS"; head -c 1048576 > "$T.in"                    # stdin to disk, 1 MiB cap
+T="$SPOOL/.tmp.$$.$TS"
+# Stdin to disk with a 1 MiB cap; whatever lies past the cap is drained, never left for the
+# writer to EPIPE on.
+trap - EXIT
+if [ -n "$FRONT" ]; then
+  # 6.53.3: the 4 KiB the halt check read, then the rest of stdin.
+  { printf '%s' "$HEAD"; exec cat; } | { head -c 1048576 > "$T.in"; exec cat >/dev/null; }
+else
+  # No `exec` here: this group runs in the script's own shell.
+  { head -c 1048576 > "$T.in"; cat >/dev/null; }
+fi
 case "$(head -c 1 "$T.in")" in '{') ;; *) EVENT=rejected ;; esac
 { printf '{"ts":%s,"ppid":%s,"event":"%s","payload":' "$TS" "$PPID" "$EVENT"; cat "$T.in"; printf '}\n'; } > "$T"
 rm -f "$T.in"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.53.1",
+  "version": "6.53.4",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -24,9 +24,10 @@ import { agentSessionStreamRouter } from './routes/agent-session-stream.js'
 import { createAttachedTurnStream } from './lib/session-stream-producer.js'
 import { claudeSessionsRouter } from './routes/claude-sessions.js'
 import { createSessionHooksRouter } from './routes/session-hooks.js'
-import { cachedHookStatus, claudeDeskRunning, deskIdleSeconds, registerDrainKickStats, registryIdleAfterStop, sessionHooksEnabled, sessionSignalStore, signalFor, startSessionHooksRuntime } from './lib/session-hooks-runtime.js'
+import { cachedHookStatus, claudeDeskRunning, deskIdleSeconds, deskTurnEndedAt, haltHandedOffTurn, registerDrainKickStats, registryIdleAfterStop, sessionHooksEnabled, sessionSignalStore, signalFor, startSessionHooksRuntime } from './lib/session-hooks-runtime.js'
 import { writeHaltMarker } from './lib/session-halt.js'
-import { appendSessionCancelLedger, cancelEndsTurn, cancelHoldUntil as cancelHoldUntilFor, noteThreadCancelled, threadCancelledAt } from './lib/session-cancel.js'
+import { appendSessionCancelLedger, cancelHoldUntil as cancelHoldUntilFor, noteThreadCancelled, threadCancel } from './lib/session-cancel.js'
+import { makeQueueTurnEvidence } from './lib/queue-turn-evidence.js'
 import {
   PermissionBroker,
   brokerSignalSink,
@@ -148,8 +149,8 @@ import {
 const app = express()
 import { createThreadTurnQueueRouter, drainAllThreads } from './routes/thread-turn-queue.js'
 import { createCursorStopFollowupRouter } from './routes/cursor-stop-followup.js'
-import { queuedThreadKeys, readQueue, transcriptTurnEnded, transcriptTurnVerdict, writeQueue } from './lib/thread-turn-queue-store.js'
-import { readHookToken } from './lib/claude-hooks-installer.js'
+import { queuedThreadKeys, readQueue, transcriptTurnVerdict, writeQueue } from './lib/thread-turn-queue-store.js'
+import { hookHaltReady, readHookToken } from './lib/claude-hooks-installer.js'
 import { OPEN_TURN_CEILING_MS } from './lib/session-state-derive.js'
 import { createDrainKick, kickPlanFor } from './lib/thread-drain-kick.js'
 import { transcriptPathFor } from './lib/native-head.js'
@@ -667,6 +668,22 @@ const sharedTargetGuard = new TargetGuard(
     : null,
 )
 
+const queueTurnEvidence = makeQueueTurnEvidence({
+  signalFor: threadId => signalFor(threadId),
+  registryIdleAfterStop: (threadId, stopAt) => registryIdleAfterStop(threadId, stopAt),
+  deskEndedAt: threadId => deskTurnEndedAt(threadId),
+  transcriptMtimeMs: (provider, threadId) => {
+    const read = occupancyProbes.transcriptMtimeMs
+    const value = typeof read === 'function' ? read(provider as 'claude' | 'codex', threadId) : null
+    return typeof value === 'number' ? value : null
+  },
+  transcriptVerdict: (provider, threadId) =>
+    transcriptTurnVerdict(provider as 'claude' | 'codex', transcriptPathFor(provider as 'claude' | 'codex', threadId, nativeHeadDeps)),
+  threadCancel: (provider, threadId) => threadCancel(provider, threadId),
+  openTurnCeilingMs: OPEN_TURN_CEILING_MS,
+  now: () => Date.now(),
+})
+
 if (threadAttachEnabled()) {
   const queueDeps = {
     // TWO GATES, ONE ANSWER. `threadOccupancy` sees FOREIGN holders -- another app on
@@ -711,61 +728,12 @@ if (threadAttachEnabled()) {
         return { attachable: false, reason: 'probe_failed' }
       }
     },
-    turnEnded: (provider: string, threadId: string) => {
-      if (provider !== 'claude' && provider !== 'codex') return false
-      try {
-        // 6.53.0: a cancel with nothing written since it ENDED the turn. A killed COS child
-        // leaves its last tool_use unanswered, and no Stop or terminal record ever follows.
-        const cancelledAt = threadCancelledAt(provider, threadId)
-        if (cancelledAt !== null) {
-          const readMtime = occupancyProbes.transcriptMtimeMs
-          const lastRow = typeof readMtime === 'function' ? readMtime(provider, threadId) : null
-          if (cancelEndsTurn(cancelledAt, typeof lastRow === 'number' ? lastRow : null)) return true
-        }
-        // 6.48.1: the engine's own end of turn: a Stop hook newer than the turn's prompt
-        // AND the registry flipped idle after it (the Stop hooks have returned; a prompt
-        // typed during them is queued and dequeues only then). The transcript tail
-        // (`turnFromTail`) answers for everything the hooks did not see. Both refuse on doubt.
-        if (provider === 'claude') {
-          const signal = signalFor(threadId)
-          if (signal && !signal.turnOpen && signal.lastEvent === 'Stop' && typeof signal.stopAt === 'number'
-            && signal.stopAt >= (signal.turnStartedAt ?? 0) && signal.subagentsOpen === 0
-            && registryIdleAfterStop(threadId, signal.stopAt) === true) return true
-        }
-        return transcriptTurnEnded(provider, transcriptPathFor(provider, threadId, nativeHeadDeps))
-      } catch {
-        return false
-      }
-    },
-    // 6.48.1: positive evidence the holder's turn is OPEN, which outranks the 30 s idle
-    // backstop (a long tool leaves the transcript untouched while it runs). Bounded: a
-    // signal or a tail older than OPEN_TURN_CEILING_MS is not evidence any more, so a
-    // crashed mid-tool session still drains by the backstop rather than holding for the TTL.
-    turnOpen: (provider: string, threadId: string): boolean => {
-      if (provider !== 'claude' && provider !== 'codex') return false
-      try {
-        const now = Date.now()
-        // 6.53.0: evidence older than a cancel on this thread is the cancelled run's, not a
-        // live turn (plan R1: a killed child's dangling tool_use read `tool_pending` for the
-        // whole 30-minute ceiling and held every parked turn behind it).
-        const cancelledAt = threadCancelledAt(provider, threadId)
-        if (provider === 'claude') {
-          const signal = signalFor(threadId)
-          if (signal && signal.turnOpen && now - signal.lastEventAt <= OPEN_TURN_CEILING_MS
-            && !cancelEndsTurn(cancelledAt, signal.lastEventAt)) return true
-        }
-        const path = transcriptPathFor(provider, threadId, nativeHeadDeps)
-        const verdict = transcriptTurnVerdict(provider, path)
-        if (!verdict || verdict.ended) return false
-        if (verdict.reason !== 'tool_pending' && verdict.reason !== 'prompt_open') return false
-        const read = occupancyProbes.transcriptMtimeMs
-        const mtime = typeof read === 'function' ? read(provider, threadId) : null
-        if (cancelEndsTurn(cancelledAt, typeof mtime === 'number' ? mtime : null)) return false
-        return typeof mtime === 'number' && now - mtime <= OPEN_TURN_CEILING_MS
-      } catch {
-        return false
-      }
-    },
+    // 6.53.3: the two turn questions live in lib/queue-turn-evidence.ts, where a test drives
+    // them against the real drain decision. What a cancel on the thread may conclude now
+    // depends on what it was aimed at (review A1): a killed COS child's silence ends its
+    // turn; a desk run's silence does not, until the desk itself says the run is over.
+    turnEnded: queueTurnEvidence.turnEnded,
+    turnOpen: queueTurnEvidence.turnOpen,
     activity: (provider: string, threadId: string): 'working' | 'idle' | 'unknown' => {
       try {
         const read = occupancyProbes.transcriptMtimeMs
@@ -879,11 +847,14 @@ app.use('/api', createAgentSessionBindingsRouter({
   cancel: {
     deskRunning: sessionId => claudeDeskRunning(sessionId),
     hooksEnabled: () => sessionHooksEnabled(),
-    hooksReady: () => cachedHookStatus().installed,
+    // 6.53.3: installed, or a halt-capable earlier script still in place (`hookHaltReady`).
+    hooksReady: () => hookHaltReady(cachedHookStatus()),
     writeHalt: (sessionId, marker) => writeHaltMarker(sessionId, marker),
     settlePermissions: sessionId => permissionBroker.cancelSession(sessionId),
     queuedWaiting: (provider, threadId) => readQueue(provider, threadId, Date.now()).filter(t => t.status === 'waiting').length,
-    noteCancelled: (provider, threadId, at) => noteThreadCancelled(provider, threadId, at),
+    noteCancelled: (provider, threadId, at, target) => noteThreadCancelled(provider, threadId, at, target),
+    // 6.53.3 (review A6): a cancel that landed during a live hand-off whose turn reached the session.
+    haltHandedOffTurn: (sessionId, marker, turn) => haltHandedOffTurn(sessionId, marker, turn),
     ledger: row => appendSessionCancelLedger(row),
   },
 }))