@gotcos/glasses-server 6.53.1 → 6.53.4

package/server/lib/session-hooks-runtime.ts

@@ -17,7 +17,8 @@ import { SessionHookLedger } from './session-hook-ledger.js'
 import { startSpoolIngester, type SpoolIngester, type SpoolStats } from './session-hook-spool.js'
 import { SessionSignalStore, type SessionSignal } from './session-signal-store.js'
 import { OPEN_TURN_CEILING_MS, deriveSessionState, type DerivedSessionState, type RegistryFacts, type TranscriptFacts } from './session-state-derive.js'
-import { clearHaltMarkerOnSessionEnd, sweepHaltMarkers } from './session-halt.js'
+import { HALT_MARKER_TTL_MS, HALT_REARM_UNVERIFIED_MS, clearHaltMarkerOnSessionEnd, dropHaltRearm, haltDeliveredTurn, rearmHaltOnPrompt, sweepHaltMarkers, type HaltMarker } from './session-halt.js'
+import { cancelVoidsOpenTurn, threadCancel } from './session-cancel.js'
 import { ensureHookRuntimeFiles, ensureStableHookScript, hookSpoolDir, hookStatus, type HookStatus } from './claude-hooks-installer.js'
 
 export function sessionHooksEnabled(): boolean {
@@ -173,6 +174,29 @@ function pidAlive(pid: number): boolean {
   }
 }
 
+/**
+ * 6.53.3: when the desk session's own engine said its run is over, AS IT STANDS NOW: the
+ * registry's `idle` flip (`statusUpdatedAt`), or the hooks' Stop / StopFailure / SessionEnd
+ * while no turn is open. Null when neither says so (a busy record, an open hook turn, no
+ * record at all). What a desk_run cancel waits for before it may discount the evidence
+ * that the run is still going (`cancelVoidsOpenTurn`, review A1).
+ */
+export function deskTurnEndedAt(sessionId: string, dir = claudeSessionsDir()): number | null {
+  let ended: number | null = null
+  const later = (at: unknown): void => {
+    if (typeof at === 'number' && Number.isFinite(at) && (ended === null || at > ended)) ended = at
+  }
+  const signal = signalFor(sessionId)
+  if (signal && !signal.turnOpen) {
+    later(signal.stopAt)
+    later(signal.failure?.at)
+    later(signal.ended?.at)
+  }
+  const record = registryRecordSync(sessionId, dir)
+  if (record && record.status === 'idle') later(record.statusUpdatedAt)
+  return ended
+}
+
 /**
  * 6.53.0: is Claude working on this session AT THE DESK right now (a Desktop tab, a terminal,
  * or a Continue delivered live into either)? The cancel route's `deskRunning`: a yes offers
@@ -183,15 +207,47 @@ function pidAlive(pid: number): boolean {
  *     own in-flight turn) says `busy`, and its pid is alive.
  * Canary C9 (2026-09-21): after a hook stop the registry read idle within a second, so a
  * cancelled desk run stops reading as running at once.
+ *
+ * 6.53.3 (review A5): the hooks' open turn is weighed against the cancel on record, by the
+ * rule the turn queue uses. A `claude -p` COS child killed by a cancel fires no Stop or
+ * SessionEnd; its open turn with nothing since the cancel is the dead child's, and must not
+ * put a phantom "Cancel run" (desk_run) on a thread where nothing runs.
  */
 export function claudeDeskRunning(sessionId: string, now = Date.now(), dir = claudeSessionsDir()): boolean {
   const signal = signalFor(sessionId)
-  if (signal && signal.turnOpen && signal.ended === null && now - signal.lastEventAt <= OPEN_TURN_CEILING_MS) return true
+  if (signal && signal.turnOpen && signal.ended === null && now - signal.lastEventAt <= OPEN_TURN_CEILING_MS) {
+    const cancel = threadCancel('claude', sessionId)
+    if (cancel === null || !cancelVoidsOpenTurn({
+      cancel,
+      lastActivityAt: signal.lastEventAt,
+      turnStartedAt: signal.turnStartedAt,
+      deskEndedAt: deskTurnEndedAt(sessionId, dir),
+    })) return true
+  }
   const record = registryRecordSync(sessionId, dir)
   if (!record || record.status !== 'busy' || record.pid === null || isCosSpawnedPid(record.pid, now)) return false
   return pidAlive(record.pid)
 }
 
+/**
+ * 6.53.3 (review A6): stop a turn COS has just handed into the open session, because a
+ * cancel arrived while the hand-off was in flight. The marker is written now; when the
+ * hooks do not yet show the turn started (its UserPromptSubmit at or after `sentAt`), it is
+ * re-armed once when that prompt's own UserPromptSubmit deletes it (`haltDeliveredTurn`).
+ */
+export function haltHandedOffTurn(sessionId: string, marker: HaltMarker, turn: { prompt: string; sentAt: number; unverified?: boolean }, now = Date.now()): boolean {
+  const signal = signalFor(sessionId)
+  const started = !!signal && typeof signal.turnStartedAt === 'number' && signal.turnStartedAt >= turn.sentAt
+  return haltDeliveredTurn(sessionId, marker, {
+    prompt: turn.prompt,
+    after: turn.sentAt,
+    rearm: !started,
+    now,
+    // 6.53.3 /qa: an unverified hand-off (`maybe`) holds its re-arm two minutes, not an hour.
+    windowMs: turn.unverified === true ? HALT_REARM_UNVERIFIED_MS : HALT_MARKER_TTL_MS,
+  })
+}
+
 let ledger: SessionHookLedger | null = null
 let ingester: SpoolIngester | null = null
 let replayed: { rows: number; applied: number } | null = null
@@ -233,6 +289,10 @@ export function startSessionHooksRuntime(options: { port: number }): SessionHook
   // clear a cancel written since; the TTL sweep covers anything this misses.
   const unsubscribeHalt = enabled ? sessionSignalStore.subscribe((_signal, env, child) => {
     if (env.event === 'SessionEnd' && !child) clearHaltMarkerOnSessionEnd(env.sessionId, env.ts)
+    // 6.53.3 (review A6): a turn COS handed into the open session while a cancel was on its
+    // way. Its own UserPromptSubmit just deleted the marker; write it back (once).
+    if (env.event === 'UserPromptSubmit' && !child) rearmHaltOnPrompt(env.sessionId, env.ts, env.payload.prompt)
+    if (env.event === 'SessionEnd' && !child) dropHaltRearm(env.sessionId)
   }) : () => {}
   sweepHaltMarkers(Date.now())
   // Runtime files the script reads. The port can change per install; the token never does.

package/server/routes/agent-session-bindings.ts

@@ -96,8 +96,7 @@
 // and answer 400. They never treat an unparsed body as an empty one.
 
 import type { FenceRecord } from '../lib/thread-fence-store.js'
-import { execFileSync } from 'node:child_process'
-import { fenceLiveness, makePidStartProbe, type FenceLiveness, type FenceLivenessDeps } from '../lib/fence-liveness.js'
+import { defaultPidStartProbe, fenceLiveness, type FenceLiveness, type FenceLivenessDeps } from '../lib/fence-liveness.js'
 import { Router, type Request, type Response } from 'express'
 import { createHash, randomUUID } from 'node:crypto'
 import {
@@ -450,8 +449,17 @@ export interface CancelDeps {
   settlePermissions?: (sessionId: string) => number
   /** Waiting turns parked on the thread (they hold for CANCEL_QUEUE_HOLD_MS). */
   queuedWaiting?: (provider: string, threadId: string) => number
-  /** Record the cancel time the turn queue reads (`noteThreadCancelled`). */
-  noteCancelled?: (provider: string, threadId: string, at: number) => void
+  /**
+   * Record the cancel the turn queue reads (`noteThreadCancelled`). 6.53.3: with its TARGET,
+   * because a killed COS child's silence ends its turn and a desk run's does not (review A1).
+   */
+  noteCancelled?: (provider: string, threadId: string, at: number, target: CancelTarget) => void
+  /**
+   * 6.53.3 (review A6): a cancel latched during a live hand-off whose turn reached (or may
+   * have reached) the open session. Writes the halt marker, and re-arms it once when that
+   * turn's own UserPromptSubmit deletes it (`haltHandedOffTurn`). False: not armed.
+   */
+  haltHandedOffTurn?: (sessionId: string, marker: { at: number; clientCancelId: string }, turn: { prompt: string; sentAt: number; unverified?: boolean }) => boolean
   /** Append to `data/session-cancel.jsonl`. */
   ledger?: (row: SessionCancelLedgerRow) => void
 }
@@ -998,6 +1006,14 @@ export interface TargetFenceView {
   fencedReason(targetKey: string): WriteRefusal | null
 }
 
+/** 6.53.3: how often a read may re-probe a settled-cancel fence's children (`ps` per child). */
+export const CANCEL_FENCE_RECHECK_MS = 30_000
+
+/** A fence a cancel left at the delivery-ambiguous site: the only kind `releaseSettledCancelFences` may touch. */
+function isSettledCancelCandidate(row: FenceRecord): boolean {
+  return row.adapterReason === 'cancelled' && row.fenceSite === 'ambiguous'
+}
+
 export class TargetGuard {
   /** targetKey -> turnId of the single COS turn allowed to be in flight. */
   private readonly claims = new Map<string, string>()
@@ -1006,6 +1022,9 @@ export class TargetGuard {
   private readonly fences = new Map<string, FenceRecord>()
   private readonly persistence: FencePersistence | null
   private persistDegraded = false
+  /** 6.53.3: set by the router; null keeps `fencedReason` a pure read (tests, older wiring). */
+  private cancelLiveness: FenceLivenessDeps | null = null
+  private cancelSweepAt = Number.NEGATIVE_INFINITY
 
   constructor(persistence: FencePersistence | null = null) {
     this.persistence = persistence
@@ -1099,7 +1118,63 @@ export class TargetGuard {
 
   fencedReason(targetKey: string): WriteRefusal | null {
     const row = this.fences.get(targetKey)
-    return row === undefined ? null : (row.reason as WriteRefusal)
+    if (row === undefined) return null
+    // 6.53.3: a settled-cancel fence is re-checked here too, throttled, so a thread whose
+    // cancelled child has since exited opens on its next use, not only on a restart or when
+    // someone opens the Fences card.
+    if (this.cancelLiveness !== null && isSettledCancelCandidate(row)) {
+      const now = Date.now()
+      if (now - this.cancelSweepAt >= CANCEL_FENCE_RECHECK_MS) {
+        this.cancelSweepAt = now
+        this.releaseSettledCancelFences(this.cancelLiveness)
+        if (!this.fences.has(targetKey)) return null
+      }
+    }
+    return row.reason as WriteRefusal
+  }
+
+  /**
+   * 6.53.3 (review A4): release every fence a CANCEL left behind whose recorded children
+   * are all provably gone (`fenceLiveness` says `none_running`), and log each one with its
+   * whole evidence record, as the operator release does.
+   *
+   * WHY THIS ONE CLASS, AND ONLY IT. A fence exists because a turn's delivery is unknowable
+   * and a second copy could reach a real conversation. For a cancel that question is moot:
+   * the person asked for the turn to stop, and the route settles it cancelled, never
+   * retried. What remains is a second WRITER, and only the recorded child (the CLI, the one
+   * process that writes the transcript) can be one. 6.53.1 fenced every Claude, Codex and
+   * Cursor cancel whose tool was churning subprocesses (review A4: 10/10 false fences per
+   * variant), and those fences are durable across restarts and upgrades.
+   *
+   * NEVER: a fence whose adapter reason is not `cancelled` (a timeout had 21 minutes of
+   * tool calls; that is still a person's call), one set at the route-error site (a route
+   * bug around a delivery), one whose children were never recorded or could not be probed
+   * (`unknown`), or one with a child still alive (`running`). Returns what was released.
+   */
+  releaseSettledCancelFences(deps: FenceLivenessDeps, log: (line: string) => void = line => console.warn(line)): FenceRecord[] {
+    const released: FenceRecord[] = []
+    for (const row of [...this.fences.values()]) {
+      if (!isSettledCancelCandidate(row)) continue
+      let state: string
+      try {
+        state = fenceLiveness(row.spawns, deps).state
+      } catch {
+        continue
+      }
+      if (state !== 'none_running') continue
+      const target = opaqueRevision(row.targetKey)
+      const outcome = this.releaseFence(target)
+      if (!outcome.ok) continue
+      const ev = outcome.row
+      released.push(ev)
+      log(`[agent-session-bindings] fence RELEASED automatically (cancelled turn, every recorded child gone) target=${target} provider=${ev.provider} fencedAt=${ev.fencedAt} fenceSite=${ev.fenceSite ?? 'unknown'} adapterReason=${ev.adapterReason ?? 'unknown'} detail=${ev.adapterDetail ?? 'none'} exitCode=${ev.exitCode ?? 'null'} childReaped=${ev.childReaped ?? 'unknown'} stderrClass=${ev.stderrClass ?? 'none'} durationMs=${ev.durationMs ?? 'unknown'} spawnCount=${ev.spawns?.length ?? 0}`)
+    }
+    return released
+  }
+
+  /** 6.53.3: the probe the lazy re-check in `fencedReason` uses; the router adopts its own. */
+  adoptCancelLiveness(deps: FenceLivenessDeps): void {
+    this.cancelLiveness = deps
   }
 
   /** Every fence, REDACTED for the wire: the raw targetKey embeds the private
@@ -1190,6 +1265,21 @@ interface InFlightTurn {
   startedAt: number
   /** False while a live hand-off is crossing its irreversible write boundary. */
   cancellable: boolean
+  /**
+   * 6.53.3 (review A6): a cancel that arrived while `cancellable` was false. It is LATCHED
+   * (answered 202 `stopping`) and settled by the turn route once the hop says where the
+   * turn went: nothing reached, `turn_cancelled` and no spawn; reached, the desk halt
+   * marker. Until 6.53.2 it was refused 409 `cancel_failed`, that refusal was cached for the
+   * tap, and a hop that reached nothing went on to spawn the turn the person had stopped.
+   */
+  latched: LatchedCancel | null
+}
+
+interface LatchedCancel {
+  at: number
+  clientCancelId: string
+  /** Every tap latched onto this turn: each one's cached answer is rewritten to the outcome. */
+  replayKeys: string[]
 }
 
 type Delivery =
@@ -1469,16 +1559,14 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
   const guard = deps.guard ?? new TargetGuard(deps.fencePersistence ?? null)
   // `ps -o lstart=` is the only start-time keyword macOS ps offers. Injectable so a
   // test drives recycled and unreadable pids without spawning real processes.
-  const livenessDeps: FenceLivenessDeps = deps.liveness ?? {
-    pidStartMs: makePidStartProbe((pid) => {
-      try {
-        return execFileSync('ps', ['-p', String(pid), '-o', 'lstart='], {
-          encoding: 'utf8', timeout: 2_000,
-        })
-      } catch {
-        return null   // not running, or ps refused the pid
-      }
-    }),
+  const livenessDeps: FenceLivenessDeps = deps.liveness ?? { pidStartMs: defaultPidStartProbe() }
+  // 6.53.3 (review A4): at boot, release the fences a cancel left whose children are all
+  // gone (6.53.1's false "unreaped" among them), then keep re-checking on every fence read.
+  guard.adoptCancelLiveness(livenessDeps)
+  try {
+    guard.releaseSettledCancelFences(livenessDeps)
+  } catch (error) {
+    console.error(`[agent-session-bindings] settled-cancel fence sweep failed: ${error instanceof Error ? error.message : error}`)
   }
   const ownership = deps?.ownership ?? { record: recordCosSpawn, release: releaseCosSpawn }
   // One per router. Injectable so the follow-on (attach accepting a `forkRef`)
@@ -1524,10 +1612,10 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
    */
   const cancelFactsFor = (provider: string, threadId: string, verdictReason: string | null): CancelFacts => {
     const entry = inFlight.get(targetKey(provider, threadId))
-    const cosTurnInFlight = entry?.cancellable === true
+    // 6.53.3: a live hand-off in flight is still OUR turn, and a cancel on it is latched
+    // (review A6), so it reads cos_turn too, never as a desk run while it commits.
+    const cosTurnInFlight = entry !== undefined
     let runningOutsideCos = false
-    // A live hand-off that has started is still ours, but cannot honestly be
-    // cancelled: do not misclassify the same run as a desk run while it commits.
     if (!entry) {
       runningOutsideCos = provider === 'claude' && typeof cancelDeps.deskRunning === 'function'
         ? cancelProbe(() => cancelDeps.deskRunning!(threadId) === true, false)
@@ -1548,6 +1636,93 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
   }
   /** Idempotency for POST .../cancel: the answer each (thread, clientCancelId) got. */
   const cancelReplies = new Map<string, { status: number; body: Record<string, unknown>; at: number }>()
+  const queuedHeldFor = (provider: string, threadId: string): number => {
+    const n = cancelProbe(() => cancelDeps.queuedWaiting?.(provider, threadId) ?? 0, 0)
+    return Number.isInteger(n) && n > 0 ? n : 0
+  }
+
+  /**
+   * 6.53.3 (review A6): settle a cancel LATCHED during a live hand-off, once the hop has said
+   * where the turn went, and rewrite the answer every latched tap replays to that outcome
+   * (never the transient 202 alone, never a refusal from before the latch).
+   *
+   *   none    nothing reached a session: the turn route answers `turn_cancelled` and never
+   *           spawns. The cached 202 `stopping` already says so.
+   *   reached the turn is in the open session (or MAY be: an unverified write). What stops it
+   *   / maybe there is what stops any desk run: the halt marker, re-armed once through the
+   *           turn's own UserPromptSubmit. Codex and Cursor have no marker, so the answer is
+   *           the ordinary `cancel_unsupported` ("Stop it there"); hooks that cannot stop a
+   *           desk run answer their own reason; a marker that could not be written is
+   *           `cancel_failed` 500, exactly as on the desk path.
+   */
+  const settleLatchedCancel = (
+    entry: InFlightTurn,
+    provider: string,
+    threadId: string,
+    reached: 'none' | 'reached' | 'maybe',
+    turn: { prompt: string; sentAt: number },
+  ): void => {
+    const latch = entry.latched
+    if (latch === null) return
+    const now = readNow() ?? Date.now()
+    const common = { turnId: entry.turnId, queuedHeld: queuedHeldFor(provider, threadId), queuedHoldMs: CANCEL_QUEUE_HOLD_MS }
+    let status = 202
+    let target: CancelTarget = 'cos_turn'
+    let outcome: 'accepted' | CancelRefusal = 'accepted'
+    let body: Record<string, unknown> = { cancelled: true, target, state: 'stopping', ...common }
+    if (reached !== 'none') {
+      target = cancelTargetFor({
+        provider,
+        cosTurnInFlight: false,
+        runningOutsideCos: true,
+        hooksEnabled: cancelProbe(() => cancelDeps.hooksEnabled?.() === true, false),
+        hooksReady: cancelProbe(() => cancelDeps.hooksReady?.() === true, false),
+      }) ?? 'unsupported'
+      if (target === 'desk_run') {
+        const armed = cancelProbe(() => cancelDeps.haltHandedOffTurn?.(threadId, { at: latch.at, clientCancelId: latch.clientCancelId }, {
+          // 6.53.3 /qa: the WHOLE delivered prompt (the re-arm matches it exactly), and whether
+          // the hand-off was only possibly delivered (`maybe`: a two-minute re-arm, not an hour).
+          prompt: turn.prompt,
+          sentAt: turn.sentAt,
+          unverified: reached === 'maybe',
+        }) === true, false)
+        if (armed) {
+          const settledPermissions = cancelProbe(() => cancelDeps.settlePermissions?.(threadId) ?? 0, 0)
+          body = {
+            cancelled: true,
+            target,
+            effective: 'next_tool_call',
+            ...common,
+            settledPermissions: Number.isInteger(settledPermissions) && settledPermissions > 0 ? settledPermissions : 0,
+          }
+        } else {
+          status = 500
+          outcome = 'cancel_failed'
+        }
+      } else {
+        status = 409
+        outcome = target === 'hooks_outdated' || target === 'hooks_disabled' ? target : 'cancel_unsupported'
+      }
+      if (outcome !== 'accepted') {
+        body = {
+          cancelled: false,
+          reason: outcome,
+          ...(outcome === 'cancel_unsupported' ? { provider } : {}),
+          reasonCopy: cancelRefusalCopy(outcome, provider),
+        }
+      }
+    }
+    for (const replayKey of latch.replayKeys) {
+      const previous = cancelReplies.get(replayKey)
+      cancelReplies.set(replayKey, { status, body, at: previous?.at ?? now })
+    }
+    // The first answer was ledgered `accepted`; a cancel that then could not be carried out
+    // gets a line of its own, so the ledger never records a stop that did not happen.
+    if (outcome !== 'accepted') {
+      cancelProbe(() => cancelDeps.ledger?.({ at: new Date(now).toISOString(), provider, threadId, target, outcome, clientCancelId: latch.clientCancelId }), undefined)
+    }
+    console.log(`[agent-session-bindings] latched cancel settled provider=${provider} turnId=${entry.turnId} hop=${reached} target=${target} outcome=${outcome} status=${status} taps=${latch.replayKeys.length}`)
+  }
 
   /**
    * One owner for "is this thread free right now", shared by the probe and both
@@ -1630,6 +1805,13 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
     // `degraded` is reported, never inferred: a memory-only fence set behaves
     // identically to a durable one until the process restarts, so a silent
     // fallback would be indistinguishable from working.
+    // 6.53.3: a read releases the settled-cancel fences first (logged), so the card never
+    // offers a person a fence the server can prove is safe to lift.
+    try {
+      guard.releaseSettledCancelFences(livenessDeps)
+    } catch (error) {
+      console.error(`[agent-session-bindings] settled-cancel fence sweep failed: ${error instanceof Error ? error.message : error}`)
+    }
     res.json({ fences: guard.listFences(livenessDeps), degraded: guard.degraded() })
   })
 
@@ -1795,17 +1977,33 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
     // The occupancy verdict is read only when the decision needs it: never for a COS turn
     // (the map knows) and never for Claude with a desk probe wired (the hooks know).
     const key = targetKey(provider, threadId)
+    const queuedHeld = (): number => queuedHeldFor(provider, threadId)
     const activeEntry = inFlight.get(key)
     if (activeEntry && activeEntry.cancellable !== true) {
-      return refuseCancel(null, 'cancel_failed')
+      // 6.53.3 (review A6): the turn is crossing a live hand-off's write boundary, where no
+      // abort can recall it. LATCH the cancel on the turn and answer as for any COS turn;
+      // the turn route settles it when the hop reports (`settleLatchedCancel`). The abort
+      // is still signalled, so nothing after the hop can start the turn either.
+      if (activeEntry.latched === null) {
+        activeEntry.latched = { at: now, clientCancelId, replayKeys: [] }
+        activeEntry.controller.abort()
+        // Noted as what the run becomes if the hop lands it: a desk run (Claude) or one only
+        // its app can stop. Either way only the engine's own end discounts its open turn.
+        cancelProbe(() => cancelDeps.noteCancelled?.(provider, threadId, now, provider === 'claude' ? 'desk_run' : 'unsupported'), undefined)
+      }
+      activeEntry.latched.replayKeys.push(replayKey)
+      return answer(202, 'cos_turn', 'accepted', {
+        cancelled: true,
+        target: 'cos_turn',
+        state: 'stopping',
+        turnId: activeEntry.turnId,
+        queuedHeld: queuedHeld(),
+        queuedHoldMs: CANCEL_QUEUE_HOLD_MS,
+      })
     }
     const needsVerdict = !inFlight.has(key) && !(provider === 'claude' && typeof cancelDeps.deskRunning === 'function')
     const verdictReason = needsVerdict && canDetect ? projectAttachability(detectOccupancy(provider, threadId)).reason : null
     const target = cancelTargetFor(cancelFactsFor(provider, threadId, verdictReason))
-    const queuedHeld = (): number => {
-      const n = cancelProbe(() => cancelDeps.queuedWaiting?.(provider, threadId) ?? 0, 0)
-      return Number.isInteger(n) && n > 0 ? n : 0
-    }
 
     if (target === 'cos_turn') {
       const entry = inFlight.get(key)
@@ -1813,7 +2011,7 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
       // The adapter stops the process group (SIGTERM, then SIGKILL after 5 s) and the turn
       // route records the outcome; this answer does not wait for either.
       entry.controller.abort()
-      cancelProbe(() => cancelDeps.noteCancelled?.(provider, threadId, now), undefined)
+      cancelProbe(() => cancelDeps.noteCancelled?.(provider, threadId, now, target), undefined)
       return answer(202, target, 'accepted', {
         cancelled: true,
         target,
@@ -1831,7 +2029,7 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
       // run waiting for its answer, and then show the Mac's own dialog. Deny it, with
       // interrupt, so the run ends now rather than at a tool that never comes.
       const settledPermissions = cancelProbe(() => cancelDeps.settlePermissions?.(threadId) ?? 0, 0)
-      cancelProbe(() => cancelDeps.noteCancelled?.(provider, threadId, now), undefined)
+      cancelProbe(() => cancelDeps.noteCancelled?.(provider, threadId, now, target), undefined)
       return answer(202, target, 'accepted', {
         cancelled: true,
         target,
@@ -2452,7 +2650,7 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
       if (!guard.tryClaim(key, turnId)) return refuseTurn('native_turn_in_progress')
       claimedKey = key
       // 6.53.0: cancellable from here, with the claim. Same key, same lifetime.
-      inFlight.set(key, { turnId, bindingId, clientTurnId, controller: cancelController, startedAt: now, cancellable: true })
+      inFlight.set(key, { turnId, bindingId, clientTurnId, controller: cancelController, startedAt: now, cancellable: true, latched: null })
 
       // Plan 4.3 step 6. The attach-time verdict is minutes old by now; a desktop
       // session started in the gap is exactly the residual risk option B leaves
@@ -2521,6 +2719,9 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
       if (typeof deps.deliverLiveTurn === 'function' && binding.provider === 'claude') {
         const liveEntry = inFlight.get(key)
         if (liveEntry?.turnId === turnId) liveEntry.cancellable = false
+        /** 6.53.3: a cancel latched onto THIS turn while the hop was in flight (review A6). */
+        const latchedHere = (): InFlightTurn | null => (liveEntry?.turnId === turnId && liveEntry.latched !== null ? liveEntry : null)
+        const handOffAt = Date.now()
         let live: { ok: boolean; reason: string; verifiedBy?: string | null; pid?: number | null } | null = null
         try {
           live = await deps.deliverLiveTurn({
@@ -2538,6 +2739,10 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
         }
         stage(`live(${live?.reason ?? 'threw'})`)
         if (live?.ok) {
+          // 6.53.3: delivered, so the turn runs in the open session now, and what stops it
+          // there is the desk halt marker. The turn itself WAS delivered and says so.
+          const latched = latchedHere()
+          if (latched) settleLatchedCancel(latched, binding.provider, binding.nativeThreadId, 'reached', { prompt, sentAt: handOffAt })
           console.log(`[agent-session-bindings] turn delivered live provider=${binding.provider} turnId=${turnId} bindingId=${bindingId} verifiedBy=${live.verifiedBy ?? 'unknown'} pid=${live.pid ?? 'null'}`)
           respond(200, {
             turnId,
@@ -2553,11 +2758,27 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
           return
         }
         if (live && (live.reason === 'unverified' || live.reason === 'write_failed')) {
+          // 6.53.3: something MAY be in the session and the person asked for it to stop: arm
+          // the marker as for a landed turn, and settle this turn as cancelled, never as a
+          // retryable hold that the queue would send again after the cancel's two minutes.
+          const latched = latchedHere()
+          if (latched) {
+            settleLatchedCancel(latched, binding.provider, binding.nativeThreadId, 'maybe', { prompt, sentAt: handOffAt })
+            return refuseTurn('turn_cancelled', { retryable: false, deliveryState: 'unknown' })
+          }
           // Something may be in the session. Hold, never spawn over it.
           return refuseTurn('live_unverified', { retryable: true, deliveryState: 'unknown' })
         }
-        // Every remaining result is documented as "nothing reached a session";
-        // the abortable child path is safe to expose again before it starts.
+        // Every remaining result is documented as "nothing reached a session".
+        // 6.53.3: with a cancel latched on the way, that is the whole turn: cancelled, no
+        // spawn. Until 6.53.2 the refused cancel was forgotten here and the child ran.
+        const latched = latchedHere()
+        if (latched) {
+          settleLatchedCancel(latched, binding.provider, binding.nativeThreadId, 'none', { prompt, sentAt: handOffAt })
+          console.log(`[agent-session-bindings] turn cancelled during live hand-off provider=${binding.provider} turnId=${turnId} bindingId=${bindingId} hop=${live?.reason ?? 'threw'}`)
+          return refuseTurn('turn_cancelled', { retryable: false })
+        }
+        // The abortable child path is safe to expose again before it starts.
         if (liveEntry?.turnId === turnId) liveEntry.cancellable = true
         // disabled / not_claude / no_record / protocol_unsupported / connect_failed /
         // suspect_expired: nothing reached a session. Spawn as always.
@@ -2573,6 +2794,9 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
       if (binding.provider === 'codex' && foreignHolder && typeof deps.deliverCodexLiveTurn === 'function') {
         const liveEntry = inFlight.get(key)
         if (liveEntry?.turnId === turnId) liveEntry.cancellable = false
+        /** 6.53.3: a cancel latched onto THIS turn while the hop was in flight (review A6). */
+        const latchedHere = (): InFlightTurn | null => (liveEntry?.turnId === turnId && liveEntry.latched !== null ? liveEntry : null)
+        const handOffAt = Date.now()
         let live: { ok: boolean; reason: string; verifiedBy?: string | null; queuedId?: string | null } | null = null
         try {
           live = await deps.deliverCodexLiveTurn({
@@ -2587,6 +2811,9 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
         }
         stage(`codex-live(${live?.reason ?? 'threw'})`)
         if (live?.ok) {
+          // 6.53.3: queued in the Codex app, which only the app can stop ("Stop it there").
+          const latched = latchedHere()
+          if (latched) settleLatchedCancel(latched, binding.provider, binding.nativeThreadId, 'reached', { prompt, sentAt: handOffAt })
           console.log(`[agent-session-bindings] turn delivered live provider=codex turnId=${turnId} bindingId=${bindingId} verifiedBy=${live.verifiedBy ?? 'unknown'} queuedId=${live.queuedId ?? 'null'}`)
           respond(200, {
             turnId,
@@ -2601,6 +2828,14 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
           })
           return
         }
+        // 6.53.3: anything but a proven or possible queue row reached nothing; with a cancel
+        // latched on the way that is the whole turn: cancelled, and no child.
+        const codexLatched = latchedHere()
+        if (codexLatched && live !== null && live.reason !== 'unverified') {
+          settleLatchedCancel(codexLatched, binding.provider, binding.nativeThreadId, 'none', { prompt, sentAt: handOffAt })
+          console.log(`[agent-session-bindings] turn cancelled during live hand-off provider=codex turnId=${turnId} bindingId=${bindingId} hop=${live.reason}`)
+          return refuseTurn('turn_cancelled', { retryable: false })
+        }
         // The operator switched this off: nothing was queued, so the abortable
         // 6.50 child path is cancellable again before it starts.
         if (live?.reason === 'disabled' && liveEntry?.turnId === turnId) liveEntry.cancellable = true
@@ -2624,6 +2859,8 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
               spawns: [],
             })
             console.warn(`[agent-session-bindings] fence set site=codex_live provider=codex target=${opaqueRevision(key)} turnId=${turnId} bindingId=${bindingId} headBefore=${head.digest} adapterReason=codex_queue_unverified`)
+            // 6.53.3: a row MAY be in the Codex app's queue; a latched cancel says where to stop it.
+            if (codexLatched) settleLatchedCancel(codexLatched, binding.provider, binding.nativeThreadId, 'maybe', { prompt, sentAt: handOffAt })
             return reportAmbiguous()
           }
           // Nothing was queued, and the child cannot run against a held thread. Not

package/server/routes/health.ts

@@ -82,6 +82,7 @@ import {
 } from '../lib/thread-attach-capability.js'
 import { cachedHookStatus, sessionHooksEnabled, sessionHooksHealthFields } from '../lib/session-hooks-runtime.js'
 import { sessionCancelFeature } from '../lib/session-cancel.js'
+import { hookHaltReady } from '../lib/claude-hooks-installer.js'
 import { permissionBrokerHealthFields, sessionQuestionsCapability } from '../lib/permission-broker.js'
 import { continueLiveEnabled, liveDeliveryStats } from '../lib/session-peer-inbox-deps.js'
 import { codexLiveStats } from '../lib/codex-live-queue-deps.js'
@@ -297,7 +298,7 @@ healthRouter.get('/health', async (_req, res) => {
     // 6.53.0: cancel a session run. `cosTurn` always; `deskClaude` only once the hooks are
     // applied and the 6.53 hook is installed (Install hooks in COS Control after updating).
     // The status read is the same cached one `sessionHooks` below reports.
-    sessionCancel: sessionCancelFeature(sessionHooksEnabled(), cachedHookStatus().installed),
+    sessionCancel: sessionCancelFeature(sessionHooksEnabled(), hookHaltReady(cachedHookStatus())),
   }
   const voice = {
     available: keyStatus.hasKey || tts_local.ready,

package/server/routes/meeting.ts

@@ -182,8 +182,12 @@ interface MeetingSessionSource {
   hasAudio(sessionId: string): boolean
   moveAudioToPending(sessionId: string): string | null
   delete(sessionId: string, options?: { preserveAudio?: boolean }): void
+  /** 6.53.3: live, closed within its retention, or unknown (`getMeetingSessionStatus`). */
+  getState?(sessionId: string): 'active' | 'closed' | 'missing'
 }
 
+const defaultSessionState = (sessionId: string): 'active' | 'closed' | 'missing' => getMeetingSessionStatus(sessionId).state
+
 export interface MeetingRouteDependencies {
   store?: MeetingStore
   sessions?: MeetingSessionSource
@@ -404,6 +408,7 @@ const defaultSessionSource: MeetingSessionSource = {
   hasAudio: hasSessionAudio,
   moveAudioToPending: moveSessionAudioToPending,
   delete: deleteSession,
+  getState: defaultSessionState,
 }
 
 function countWords(text: string): number {
@@ -566,10 +571,14 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
 
       const transcript = sessions.getTranscript(sessionId)
       if (!transcript?.trim()) {
-        res.status(404).json({
-          error: `No transcript found for session ${sessionId}`,
-          reason: 'session_not_found',
-        })
+        // 6.53.3 (review D3): a session the server KNOWS (live, or closed within its
+        // retention) that holds no transcript is not one it never heard of. Its own reason
+        // lets a client stop asking ("nothing to save") instead of retrying a 404 all day.
+        // Still 404, so every existing client reads it exactly as before.
+        const known = (sessions.getState ?? defaultSessionState)(sessionId)
+        res.status(404).json(known === 'active' || known === 'closed'
+          ? { error: `Nothing to save for session ${sessionId}`, reason: 'nothing_to_save', state: known }
+          : { error: `No transcript found for session ${sessionId}`, reason: 'session_not_found' })
         return
       }
 

package/server/routes/transcribe-stream.ts

@@ -437,6 +437,9 @@ export interface TranscriptionSessionLiveness {
  */
 export const __sessionsForTests = sessions
 
+/** 6.53.3: the closed-session records, for tests only (same reasoning as above). */
+export const __closedSessionRecordsForTests = closedSessionRecords
+
 export interface StrandedCapture {
   sessionId: string
   /** Minutes since the last ACK'd chunk. */
@@ -1151,6 +1154,8 @@ setInterval(() => {
       }
     }
   } catch {}
+  // 6.53.3 (review D3): the in-memory records age out with the file's.
+  try { sweepExpiredClosedSessions(Date.now()) } catch {}
   persistClosedSessions()
 }, 60_000)
 
@@ -1455,7 +1460,30 @@ export interface MeetingSessionStatusSnapshot {
   retainedUntil: string | null
 }
 
-export function getMeetingSessionStatus(sessionId: string): MeetingSessionStatusSnapshot {
+/**
+ * 6.53.3 (review D3): forget a closed session once its retention has passed, in memory as
+ * well as on disk. Until 6.53.2 only the persisted file was pruned, so a closed session read
+ * `closed` until the next restart, and a phone whose recovery hint named it POSTed save
+ * (which can only 404) on every boot and foreground, all day. Past `retainedUntil` the
+ * server now answers exactly as it would after a restart: `missing`, which every app since
+ * 6.9.465 settles as terminal ("the server no longer retains it").
+ */
+function evictExpiredClosedSession(sessionId: string, now: number): boolean {
+  const closed = closedSessionRecords.get(sessionId)
+  if (!closed || now - closed.closedAt <= CLOSED_SESSION_TTL_MS) return false
+  closedSessionRecords.delete(sessionId)
+  deletedSessions.delete(sessionId)
+  return true
+}
+
+export function sweepExpiredClosedSessions(now = Date.now()): number {
+  let evicted = 0
+  for (const id of [...closedSessionRecords.keys()]) if (evictExpiredClosedSession(id, now)) evicted++
+  return evicted
+}
+
+export function getMeetingSessionStatus(sessionId: string, now = Date.now()): MeetingSessionStatusSnapshot {
+  evictExpiredClosedSession(sessionId, now)
   const active = sessions.get(sessionId)
   if (active) {
     const received = active.receivedIndices ?? []