@gotcos/glasses-server 6.53.3 → 6.53.4

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## 6.53.4
+
+### The fixes from 6.53.3's review
+
+6.53.3 was published before its four-reviewer /qa round finished (the round was cut short by a usage limit and rerun the next morning). This release carries that round's server fixes, and corrects three claims 6.53.3 made. Install hooks once after updating.
+
+- **A `ps` that fails never releases a fence (blocker in 6.53.3).** 6.53.3's fence auto-release read every `execFileSync` error as "not running", so a `ps` killed at its 2 s timeout, an `EAGAIN` fork failure or a missing binary could release a cancel fence whose child might still be writing. Only the measured "no such process" answer (exit 1, no signal, not killed, no error code, nothing on stdout or stderr) counts as gone now; everything else, and a clean exit that printed nothing, is unverifiable and keeps the fence. `ps` is `/bin/ps` when present. A fence that reads unknown is re-checked on every fence check and can still be released by hand in COS Control.
+- **The halt re-arm matches the delivered prompt exactly.** 6.53.3 matched the first 120 characters with `includes`, so a short Continue ("yes") matched the person's own next desk prompt: their run was stopped "Cancelled from COS" and the cancelled COS turn then ran. Now the words must be equal (whitespace collapsed, Claude Code's peer-message wrapper taken off), and the first prompt after the hand-off decides: a different prompt spends the re-arm and is logged. Stated limit: if the person's own prompt reaches the session first, the queued COS turn is not stopped; an identical desk prompt typed after the send and taken first still re-arms. An unverified hand-off holds its re-arm 2 minutes, not an hour.
+- **The hook drains stdin on every event.** PermissionRequest, Stop, PostToolUse, SessionStart, SessionEnd and the other non-front events read only 1 MiB and left the rest unread, and the spool guard exited before reading; a larger payload could EPIPE the writer. The header comment no longer says the PreToolUse branch writes no spool. Script sha256 `df54677f...`; the 6.53.0 script (`1158bb06...`) and 6.53.3's (`c0b41bf8...`) still stop desk runs until Install hooks is run. The PreToolUse common path is unchanged (40 runs each, interleaved: 11.2 and 10.9 ms before, 11.4 and 11.0 ms after).
+- **The mutation gate needs a failing test.** A kill was any non-zero vitest exit; now a mutant is killed only when a named test fails, and a run that errors without one fails the gate. Every 6.53.x case was re-run under that rule on a green baseline: 137 of 137 killed by a failing test (16 added in this round), none errored.
+- **Every server suite removes its temp folders.** 39 test files made `mkdtemp` folders and never removed them (one run left 581 entries in `$TMPDIR`; now none made by a test). 6.53.3's "hook and installer suites clean up their temp roots" was true only for three suites.
+- **Corrections to 6.53.3's notes.** "`reaped: true` is never reported while an owned process survives" holds for cancel and timeout only: a natural exit settles as soon as the CLI is reaped, with no tree probe. The graceful end-to-end bound is now derived from the fixture's stop delay and `TREE_POLL_MS` (2.4 s, was 4 s). The closed-session test imports its retention constant. README gains a "Cancel a run from the glasses (6.53.x)" section.
+- Tests: full suite 5,128 passed, 2 skipped; typecheck clean; `npm audit --omit=dev` 0 vulnerabilities.
+
 ## 6.53.3
 
 ### Cancel owns the whole process tree, desk cancels hold, and the hook is faster

package/README.md

@@ -265,6 +265,41 @@ Allow once or deny only: no permission rule is ever written. Rows carry
 row reads `waiting_kind: question` whatever the switch says; `/api/health` reports
 `permissionBroker` (counters and timestamps, no ids or text).
 
+## Cancel a run from the glasses (6.53.x)
+
+The glasses' Cancel run row stops what a session is doing, the way the desk's own stop
+button does. It needs **server 6.53.0 or later and COS Glasses 6.9.529 or later**;
+**6.53.4 is recommended** (it owns the whole process tree, holds a desk cancel, fixes
+the false fences 6.53.1 left, and never releases a fence when `ps` cannot answer).
+
+- **A turn COS started** (`cos_turn`) is stopped by the server: its whole process tree is
+  signalled and the turn settles `turn_cancelled`.
+- **A run at the desk** (`desk_run`: a Desktop tab or a terminal `claude`) is stopped by the
+  session hook at its next tool call, so a reply that is pure text finishes first. This
+  needs the hooks installed, and after every server update that changes the hook script
+  (6.53.0, 6.53.3, 6.53.4) you must **run Install hooks once** (COS Control, or
+  `npx --yes @gotcos/glasses-server@latest --hooks install`). Until then
+  `--hooks status` reads `script_outdated` and its `advice` line says so; a script from
+  6.53.0 to 6.53.3 can still stop desk runs meanwhile, anything older answers
+  `hooks_outdated`. The PreToolUse hook runs before every tool call on the Mac and never
+  contacts the server; it writes a spool file only for AskUserQuestion, ExitPlanMode and
+  prompts, and always drains its input.
+- **Codex and Cursor** runs at the desk answer `cancel_unsupported` ("Stop it there").
+- **Fences a cancel left release themselves** once every process the cancelled turn
+  started is confirmed gone: only `ps` answering "no such process" counts, and a `ps` that
+  times out, cannot start or is missing keeps the fence. Any other fence is still released
+  by hand (`GET /api/agent-sessions/fences`, then `POST .../fences/release` with
+  `confirm: true`).
+- **A cancel that lands while COS is handing a turn to the open session** writes the desk
+  marker, and re-arms it once if the next prompt that session starts is exactly the
+  delivered one. If your own prompt reaches the session first, the re-arm is dropped (and
+  logged) rather than stop your run.
+
+Meetings: a closed meeting's record ages out after **4 hours**, after which its status
+reads `missing` and the phone stops asking to save it. Saving a known meeting that has no
+transcript answers **404 `nothing_to_save`** (with its state); only an unknown id answers
+`session_not_found`.
+
 ## Configuration
 
 Config lives at `~/.cos-glasses/.env` (created on first run). Every key is
@@ -626,7 +661,8 @@ BIND_HOST=0.0.0.0 npm run start:server
   timers are frozen), `desk_active` (the Mac saw input), `approvals_off`
   (`COS_PERMISSION_BROKER=questions`), `broker_off`, `cursor`, `unsupported_tool`
   (ExitPlanMode is never held). `lastQuestionsPollAt` says when a client last counted.
-  `--hooks status` must read `installed`. To turn it off with no reinstall, set
+  `--hooks status` must read `installed` (right after updating to 6.53.4 it reads
+  `script_outdated` until Install hooks is run once; its `advice` line says so). To turn it off with no reinstall, set
   `COS_PERMISSION_BROKER=0` in `~/.cos-glasses/.env` and restart. For the Messages
   trail, `/api/health` `messages_trail.readerErrors` counts lines a reader could not map.
 - *Offline meeting recovery unavailable?* — build 209+ requires server 6.11.0+.

package/bin/hooks/cos-session-hook

@@ -7,11 +7,15 @@
 # restarting never delays a Claude session.
 #
 # 6.53.0: PreToolUse is SYNCHRONOUS with no matcher, so the first branch below runs before
-# EVERY tool call in every Claude session on this Mac. It is file-only (no curl, no spool
-# write) and prints nothing unless the server left a halt marker for this session, when it
-# prints the one reply that stops the run (canary C1b, 2026-09-21: `continue:false` alone
-# still ran the tool; with the deny it did not). It never exits 2: exit 2 blocks the tool,
-# while a timeout or any other code fails open (C6, C7).
+# EVERY tool call in every Claude session on this Mac. It never contacts the server. For an
+# ordinary tool it writes nothing at all; it spools only AskUserQuestion and ExitPlanMode
+# (the two tools the reducer reads, the 6.48 matcher's set), and UserPromptSubmit, which
+# shares the branch, is always spooled. It prints nothing unless the server left a halt
+# marker for this session, when it prints the one reply that stops the run (canary C1b,
+# 2026-09-21: `continue:false` alone still ran the tool; with the deny it did not). It never
+# exits 2: exit 2 blocks the tool, while a timeout or any other code fails open (C6, C7).
+# Every path, every event, drains stdin before it exits, so Claude Code's writer never
+# EPIPEs whatever the payload's size (6.53.3; every other event since its /qa round).
 #
 # The installer bakes COS_GLASSES_HOME and COS_HOOK_SPOOL into the command, so this
 # script and the server can never disagree about where the token or the spool is.
@@ -89,6 +93,9 @@ case "$EVENT" in PreToolUse|UserPromptSubmit)
   trap 'cat >/dev/null 2>&1' EXIT
   ;;
 esac
+# Every other event: until the spool read below has taken stdin, any exit (a failed mkdir,
+# the B8 guard) drains it, as the front does.
+[ -n "$FRONT" ] || trap 'cat >/dev/null 2>&1' EXIT
 mkdir -p "$SPOOL/rejected" 2>/dev/null || exit 0
 TS=$(perl -MTime::HiRes -e 'printf "%.0f", Time::HiRes::time()*1000' 2>/dev/null || date +%s000)
 # B8 guard: a full spool or a stale drain stamp means nobody is reading; keep only permissions.
@@ -97,13 +104,15 @@ if [ "$EVENT" != PermissionRequest ]; then
   STAMP="$SPOOL/.last-drain"; [ ! -f "$STAMP" ] || [ -z "$(find "$STAMP" -mmin +1440 2>/dev/null)" ] || exit 0   # -mtime +1 would mean two days
 fi
 T="$SPOOL/.tmp.$$.$TS"
+# Stdin to disk with a 1 MiB cap; whatever lies past the cap is drained, never left for the
+# writer to EPIPE on.
+trap - EXIT
 if [ -n "$FRONT" ]; then
-  # 6.53.3: the 4 KiB the halt check read, then the rest of stdin, to disk with the same
-  # 1 MiB cap; whatever lies past the cap is drained, never left for the writer to EPIPE on.
-  trap - EXIT
+  # 6.53.3: the 4 KiB the halt check read, then the rest of stdin.
   { printf '%s' "$HEAD"; exec cat; } | { head -c 1048576 > "$T.in"; exec cat >/dev/null; }
 else
-  head -c 1048576 > "$T.in"                    # stdin to disk, 1 MiB cap
+  # No `exec` here: this group runs in the script's own shell.
+  { head -c 1048576 > "$T.in"; cat >/dev/null; }
 fi
 case "$(head -c 1 "$T.in")" in '{') ;; *) EVENT=rejected ;; esac
 { printf '{"ts":%s,"ppid":%s,"event":"%s","payload":' "$TS" "$PPID" "$EVENT"; cat "$T.in"; printf '}\n'; } > "$T"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.53.3",
+  "version": "6.53.4",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {

package/server/lib/attached-provider-adapter.ts

@@ -186,6 +186,14 @@ export interface AttachedTurnFailureResult {
   /**
    * Did `close`/`exit` actually fire, i.e. did the kernel reap the child?
    *
+   * WHAT IT DOES AND DOES NOT PROMISE (6.53.3, scoped by its /qa round). On a CANCEL or a
+   * TIMEOUT, `reaped: true` also means the whole owned process tree was read gone after
+   * `close` (the tree poll); a tree that outlives SIGKILL settles `reaped: false`. On a
+   * NATURAL exit (the provider closed without a cancel or timeout) it means only that the
+   * CLI itself was reaped: that path settles at once, with no tree probe, so a detached
+   * background job the tool left running is not looked for. A pre-spawn cancel reports
+   * `reaped: true` because no process ever existed.
+   *
    * NOT DERIVABLE FROM `exitCode`. A child killed by a signal reports
    * `code === null`, and the handlers below only assign `exitCode` for a numeric
    * code — so the dominant timeout shape (SIGTERM, then SIGKILL) is reaped while

package/server/lib/claude-hooks-installer.ts

@@ -285,15 +285,21 @@ export function hookStatus(paths: { settingsPath?: string; scriptPath?: string;
 }
 
 /**
- * 6.53.3: sha256 of every EARLIER script that already carries the halt check: the one script
- * 6.53.0, 6.53.1 and 6.53.2 all shipped. 6.53.3 rewrote the script for speed (review A,
- * option a), so an install that has not run Install hooks since reads `script_outdated`
- * and Control shows its banner. Its script still stops a desk run exactly as before,
- * though, so a desk cancel is not refused `hooks_outdated` in the meantime
- * (`hookHaltReady`). A script older than 6.53.0 has no halt check and never qualifies.
+ * 6.53.3: sha256 of every EARLIER script that already carries the halt check. 6.53.3
+ * rewrote the script for speed (review A, option a), so an install that has not run Install
+ * hooks since reads `script_outdated` and Control shows its banner. Those scripts still stop
+ * a desk run exactly as before, though, so a desk cancel is not refused `hooks_outdated` in
+ * the meantime (`hookHaltReady`). A script older than 6.53.0 has no halt check and never
+ * qualifies.
+ *   - 1158bb06...: the one script 6.53.0, 6.53.1 and 6.53.2 all shipped.
+ *   - c0b41bf8...: the 6.53.3 script as first built, before its /qa round made every event
+ *     drain stdin. Never published, but installable from a local build of that commit
+ *     (7433b7f), and it carries the same halt check.
+ * Each is pinned against its bytes in `server/lib/__fixtures__/`.
  */
 export const HALT_CAPABLE_PRIOR_SCRIPT_SHAS: readonly string[] = [
   '1158bb06297550128f01fc47caa68806a5287d6da2d05b0d1c812e8ae20764e7',
+  'c0b41bf8581cfea498e1e1ac5220fe4e148bd97448d13b60a88879ee5992cc51',
 ]
 
 /**

package/server/lib/fence-liveness.ts

@@ -27,6 +27,9 @@
 // human deciding whether to release; an over-confident `none_running` is worse than
 // admitting the probe could not see.
 
+import { execFileSync } from 'node:child_process'
+import { existsSync } from 'node:fs'
+
 /** Recorded spawn: a pid and the start COS measured when it created the child. */
 export interface RecordedSpawn {
   pid: number
@@ -55,7 +58,7 @@ export interface FenceLiveness {
 }
 
 export interface FenceLivenessDeps {
-  /** Epoch ms at which `pid` started, or null when it is not running.
+  /** Epoch ms at which `pid` started, or null ONLY when it is provably not running.
    *  MAY THROW; a throwing probe is not an answer and resolves to `unknown`. */
   pidStartMs: (pid: number) => number | null
 }
@@ -116,7 +119,9 @@ export function makePidStartProbe(
     const raw = run(pid)
     if (raw === null) return null
     const text = raw.trim()
-    if (!text) return null
+    // A clean exit that printed nothing is not "not running" (only the runner's null is):
+    // throw, so it is counted unverifiable.
+    if (!text) throw new Error('empty process start from ps')
     const parsed = Date.parse(text)
     // Unparseable is NOT "not running" -- throw so the caller counts it
     // unverifiable rather than silently reading a live child as gone.
@@ -124,3 +129,72 @@ export function makePidStartProbe(
     return parsed
   }
 }
+
+/** What this module reads off the error `execFileSync` throws. */
+export interface ExecFailureLike {
+  status?: unknown
+  signal?: unknown
+  killed?: unknown
+  code?: unknown
+  error?: unknown
+  stdout?: unknown
+  stderr?: unknown
+}
+
+/** The slice of `execFileSync` the probe calls. Injectable so a test can throw every error
+ *  shape Node produces without spawning anything. */
+export type PsExec = (file: string, args: readonly string[], options: { encoding: 'utf8'; timeout: number }) => string
+
+/** How long one `ps` may take before Node kills it (the kill is NOT an answer). */
+export const PS_PROBE_TIMEOUT_MS = 2_000
+
+const PS_BIN = existsSync('/bin/ps') ? '/bin/ps' : 'ps'
+
+const emptyOutput = (value: unknown): boolean =>
+  (typeof value === 'string' && value.trim() === '') || (Buffer.isBuffer(value) && value.length === 0)
+
+/**
+ * 6.53.3 /qa BLOCKER: is this `execFileSync` failure `ps -p` saying "no such process"?
+ *
+ * THE ONE ANSWER THAT MEANS GONE. `ps -p <pid>` for a pid that is not running exits 1 on its
+ * own and prints nothing on either stream (measured, macOS 26 and node 24: `{status: 1,
+ * signal: null, stdout: '', stderr: ''}` with no `code` and no `error`). Everything else is
+ * ps failing to answer, and says nothing about the child: a kill at the timeout (`ETIMEDOUT`,
+ * SIGTERM), a fork that failed (`EAGAIN`), no binary (`ENOENT`), a signal, output on stdout or
+ * a complaint on stderr, any other status. Until 6.53.3's QA every one of those read as gone,
+ * and gone is `none_running`, which releases a cancel fence (`releaseSettledCancelFences`) on a
+ * child that may still be writing.
+ */
+export function psSaysNoSuchProcess(error: unknown): boolean {
+  if (error === null || typeof error !== 'object') return false
+  const e = error as ExecFailureLike
+  return e.status === 1
+    && (e.signal === null || e.signal === undefined)
+    && e.killed !== true
+    && (e.code === null || e.code === undefined)
+    && (e.error === null || e.error === undefined)
+    && emptyOutput(e.stdout)
+    && emptyOutput(e.stderr)
+}
+
+/**
+ * The production runner: `ps -p <pid> -o lstart=`'s stdout, or null ONLY when ps said the
+ * process does not exist (`psSaysNoSuchProcess`). Any other failure THROWS, which
+ * `fenceLiveness` counts unverifiable, so the fence stays.
+ */
+export function psLstartRunner(exec: PsExec = execFileSync as unknown as PsExec): (pid: number) => string | null {
+  return (pid: number) => {
+    try {
+      return exec(PS_BIN, ['-p', String(pid), '-o', 'lstart='], { encoding: 'utf8', timeout: PS_PROBE_TIMEOUT_MS })
+    } catch (error) {
+      if (psSaysNoSuchProcess(error)) return null
+      const e = (error ?? {}) as ExecFailureLike
+      throw new Error(`ps could not answer for pid ${pid} (status=${String(e.status ?? null)} signal=${String(e.signal ?? null)} code=${String(e.code ?? 'none')})`)
+    }
+  }
+}
+
+/** The probe the fence routes use in production. */
+export function defaultPidStartProbe(exec?: PsExec): (pid: number) => number | null {
+  return makePidStartProbe(psLstartRunner(exec))
+}

package/server/lib/session-halt.ts

@@ -38,6 +38,7 @@ import { join } from 'node:path'
 import { atomicWriteFileSync } from './atomic-fs.js'
 import { dataPath } from './data-dir.js'
 import { isValidNativeThreadId } from './native-thread-id.js'
+import { unwrapPeerMessage } from './session-stream-events.js'
 
 /**
  * How long a marker may outlive its cancel. An hour, not the plan's first 15 minutes: the
@@ -46,6 +47,14 @@ import { isValidNativeThreadId } from './native-thread-id.js'
  */
 export const HALT_MARKER_TTL_MS = 60 * 60_000
 
+/**
+ * 6.53.3 /qa: how long a re-arm waits when the hand-off was NOT verified (`maybe`: the frame
+ * may or may not have reached the session). A verified hand-off keeps the marker's hour; an
+ * unverified one that has not surfaced as a prompt within two minutes most likely never
+ * arrived, and holding it longer only widens the window for an identical desk prompt.
+ */
+export const HALT_REARM_UNVERIFIED_MS = 2 * 60_000
+
 export interface HaltMarker {
   at: number
   clientCancelId: string
@@ -121,15 +130,30 @@ export function clearHaltMarkerOnSessionEnd(sessionId: string, endedAt: number,
 // plain write would then be deleted by the very turn it was written to stop.
 //
 // So the marker is written, and when the delivered turn has not visibly started yet, it is
-// written AGAIN, once, on the first UserPromptSubmit for that session whose prompt carries
-// the delivered text. Matching the text keeps the person's own next desk prompt from ever
-// being the one that re-arms it; the window is the marker's own hour; SessionEnd drops it.
-// In memory on purpose: a restart forgets it, like every other hold here.
+// written AGAIN, once, on the first UserPromptSubmit for that session AFTER the send, if that
+// prompt IS the delivered one. The window is the marker's own hour (two minutes for an
+// unverified hand-off); SessionEnd drops it. In memory on purpose: a restart forgets it, like
+// every other hold here.
+//
+// 6.53.3 /qa (Skeptic W1): the first cut matched `prompt.includes(<first 120 characters>)`.
+// A short COS prompt ("yes") is inside most desk prompts, so the person's own next prompt
+// re-armed the marker: THEIR run was denied "Cancelled from COS", and the delivered turn's
+// own prompt, finding nothing pending, then ran the cancelled turn. Now:
+//   - EXACT: the delivered words and the prompt's words are equal once whitespace runs are
+//     collapsed and Claude Code's peer wrapper ("Another Claude session sent a message: ...",
+//     which a live Continue arrives in) is taken off. The frame carries no id of its own and
+//     its text is not changed to add one.
+//   - FIRST PROMPT DECIDES: the first prompt after the send spends the re-arm whether or not
+//     it matches. A non-match is logged (never the prompt). This gives up the cancel when
+//     the person's own prompt reaches the session first, rather than risk halting their run:
+//     a halted desk run is the worse error, and the lens already said "at its next step".
+//   - LIMIT, stated: a desk prompt with exactly the delivered words, typed after the send and
+//     taken first, is indistinguishable from the delivered turn and re-arms.
 
 interface PendingRearm {
   marker: HaltMarker
-  /** Text the delivered prompt carries (the peer-inbox acceptance marker). */
-  promptMarker: string
+  /** The delivered prompt's words, whitespace-normalised (`normalizePromptWords`). */
+  words: string
   /** Prompts submitted before this are someone else's. */
   after: number
   until: number
@@ -147,18 +171,22 @@ const MAX_PENDING_REARMS = 64
 export function haltDeliveredTurn(
   sessionId: string,
   marker: HaltMarker,
-  turn: { promptMarker: string; after: number; rearm: boolean; now?: number },
+  turn: { prompt: string; after: number; rearm: boolean; now?: number; windowMs?: number },
   dir = haltDir(),
 ): boolean {
   if (!writeHaltMarker(sessionId, marker, dir)) return false
   const id = sessionId.toLowerCase()
-  if (!turn.rearm || typeof turn.promptMarker !== 'string' || turn.promptMarker.trim().length === 0) {
+  const words = normalizePromptWords(turn.prompt)
+  if (!turn.rearm || words.length === 0) {
     pendingRearms.delete(id)
     return true
   }
   const now = turn.now ?? Date.now()
+  const windowMs = typeof turn.windowMs === 'number' && Number.isFinite(turn.windowMs) && turn.windowMs > 0
+    ? Math.min(turn.windowMs, HALT_MARKER_TTL_MS)
+    : HALT_MARKER_TTL_MS
   pendingRearms.delete(id)
-  pendingRearms.set(id, { marker, promptMarker: turn.promptMarker, after: turn.after, until: now + HALT_MARKER_TTL_MS })
+  pendingRearms.set(id, { marker, words, after: turn.after, until: now + windowMs })
   while (pendingRearms.size > MAX_PENDING_REARMS) {
     const oldest = pendingRearms.keys().next()
     if (oldest.done) break
@@ -167,10 +195,26 @@ export function haltDeliveredTurn(
   return true
 }
 
+/** Whitespace runs collapsed to one space, ends trimmed. Non-strings are empty. */
+export function normalizePromptWords(text: unknown): string {
+  return typeof text === 'string' ? text.replace(/\s+/g, ' ').trim() : ''
+}
+
+/**
+ * Is `prompt` (a UserPromptSubmit's `prompt`) the delivered prompt? Equal words, compared
+ * whole, after taking off Claude Code's peer wrapper when the prompt arrived in one.
+ */
+export function isDeliveredPrompt(prompt: unknown, delivered: string): boolean {
+  const want = normalizePromptWords(delivered)
+  if (want.length === 0 || typeof prompt !== 'string') return false
+  return normalizePromptWords(unwrapPeerMessage(prompt) ?? prompt) === want
+}
+
 /**
  * A UserPromptSubmit from the session itself (never a COS child): the hook has just deleted
- * the session's marker. When it was the delivered turn's own prompt, write the marker back.
- * One shot. True when the marker was re-armed.
+ * the session's marker. The FIRST such prompt after the send spends the pending re-arm: when
+ * it is the delivered turn's own prompt the marker is written back, otherwise the re-arm is
+ * dropped and logged. True when the marker was re-armed.
  */
 export function rearmHaltOnPrompt(sessionId: string, promptAt: number, prompt: unknown, dir = haltDir(), now = Date.now()): boolean {
   const id = typeof sessionId === 'string' ? sessionId.toLowerCase() : ''
@@ -181,8 +225,11 @@ export function rearmHaltOnPrompt(sessionId: string, promptAt: number, prompt: u
     return false
   }
   if (!Number.isFinite(promptAt) || promptAt < pending.after) return false
-  if (typeof prompt !== 'string' || !prompt.includes(pending.promptMarker)) return false
   pendingRearms.delete(id)
+  if (!isDeliveredPrompt(prompt, pending.words)) {
+    console.warn(`[session-halt] re-arm dropped: the first prompt after the hand-off was not the delivered turn session=${id.slice(0, 8)} clientCancelId=${pending.marker.clientCancelId}`)
+    return false
+  }
   return writeHaltMarker(id, pending.marker, dir)
 }
 

package/server/lib/session-hooks-runtime.ts

@@ -17,7 +17,7 @@ import { SessionHookLedger } from './session-hook-ledger.js'
 import { startSpoolIngester, type SpoolIngester, type SpoolStats } from './session-hook-spool.js'
 import { SessionSignalStore, type SessionSignal } from './session-signal-store.js'
 import { OPEN_TURN_CEILING_MS, deriveSessionState, type DerivedSessionState, type RegistryFacts, type TranscriptFacts } from './session-state-derive.js'
-import { clearHaltMarkerOnSessionEnd, dropHaltRearm, haltDeliveredTurn, rearmHaltOnPrompt, sweepHaltMarkers, type HaltMarker } from './session-halt.js'
+import { HALT_MARKER_TTL_MS, HALT_REARM_UNVERIFIED_MS, clearHaltMarkerOnSessionEnd, dropHaltRearm, haltDeliveredTurn, rearmHaltOnPrompt, sweepHaltMarkers, type HaltMarker } from './session-halt.js'
 import { cancelVoidsOpenTurn, threadCancel } from './session-cancel.js'
 import { ensureHookRuntimeFiles, ensureStableHookScript, hookSpoolDir, hookStatus, type HookStatus } from './claude-hooks-installer.js'
 
@@ -235,10 +235,17 @@ export function claudeDeskRunning(sessionId: string, now = Date.now(), dir = cla
  * hooks do not yet show the turn started (its UserPromptSubmit at or after `sentAt`), it is
  * re-armed once when that prompt's own UserPromptSubmit deletes it (`haltDeliveredTurn`).
  */
-export function haltHandedOffTurn(sessionId: string, marker: HaltMarker, turn: { promptMarker: string; sentAt: number }, now = Date.now()): boolean {
+export function haltHandedOffTurn(sessionId: string, marker: HaltMarker, turn: { prompt: string; sentAt: number; unverified?: boolean }, now = Date.now()): boolean {
   const signal = signalFor(sessionId)
   const started = !!signal && typeof signal.turnStartedAt === 'number' && signal.turnStartedAt >= turn.sentAt
-  return haltDeliveredTurn(sessionId, marker, { promptMarker: turn.promptMarker, after: turn.sentAt, rearm: !started, now })
+  return haltDeliveredTurn(sessionId, marker, {
+    prompt: turn.prompt,
+    after: turn.sentAt,
+    rearm: !started,
+    now,
+    // 6.53.3 /qa: an unverified hand-off (`maybe`) holds its re-arm two minutes, not an hour.
+    windowMs: turn.unverified === true ? HALT_REARM_UNVERIFIED_MS : HALT_MARKER_TTL_MS,
+  })
 }
 
 let ledger: SessionHookLedger | null = null

package/server/routes/agent-session-bindings.ts

@@ -96,8 +96,7 @@
 // and answer 400. They never treat an unparsed body as an empty one.
 
 import type { FenceRecord } from '../lib/thread-fence-store.js'
-import { execFileSync } from 'node:child_process'
-import { fenceLiveness, makePidStartProbe, type FenceLiveness, type FenceLivenessDeps } from '../lib/fence-liveness.js'
+import { defaultPidStartProbe, fenceLiveness, type FenceLiveness, type FenceLivenessDeps } from '../lib/fence-liveness.js'
 import { Router, type Request, type Response } from 'express'
 import { createHash, randomUUID } from 'node:crypto'
 import {
@@ -125,7 +124,7 @@ import {
 import type { RegistryCheck, RegistryRejection, RegistryResult } from '../lib/agent-session-binding-registry.js'
 import { recordCosSpawn, releaseCosSpawn } from '../lib/agent-session-ownership-store.js'
 import { isValidNativeThreadId } from '../lib/native-thread-id.js'
-import { PEER_VERIFY_TIMEOUT_MS, peerAcceptanceMarker } from '../lib/session-peer-inbox.js'
+import { PEER_VERIFY_TIMEOUT_MS } from '../lib/session-peer-inbox.js'
 import {
   CANCEL_QUEUE_HOLD_MS,
   CLIENT_CANCEL_ID_RE,
@@ -460,7 +459,7 @@ export interface CancelDeps {
    * have reached) the open session. Writes the halt marker, and re-arms it once when that
    * turn's own UserPromptSubmit deletes it (`haltHandedOffTurn`). False: not armed.
    */
-  haltHandedOffTurn?: (sessionId: string, marker: { at: number; clientCancelId: string }, turn: { promptMarker: string; sentAt: number }) => boolean
+  haltHandedOffTurn?: (sessionId: string, marker: { at: number; clientCancelId: string }, turn: { prompt: string; sentAt: number; unverified?: boolean }) => boolean
   /** Append to `data/session-cancel.jsonl`. */
   ledger?: (row: SessionCancelLedgerRow) => void
 }
@@ -1560,17 +1559,7 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
   const guard = deps.guard ?? new TargetGuard(deps.fencePersistence ?? null)
   // `ps -o lstart=` is the only start-time keyword macOS ps offers. Injectable so a
   // test drives recycled and unreadable pids without spawning real processes.
-  const livenessDeps: FenceLivenessDeps = deps.liveness ?? {
-    pidStartMs: makePidStartProbe((pid) => {
-      try {
-        return execFileSync('ps', ['-p', String(pid), '-o', 'lstart='], {
-          encoding: 'utf8', timeout: 2_000,
-        })
-      } catch {
-        return null   // not running, or ps refused the pid
-      }
-    }),
-  }
+  const livenessDeps: FenceLivenessDeps = deps.liveness ?? { pidStartMs: defaultPidStartProbe() }
   // 6.53.3 (review A4): at boot, release the fences a cancel left whose children are all
   // gone (6.53.1's false "unreaped" among them), then keep re-checking on every fence read.
   guard.adoptCancelLiveness(livenessDeps)
@@ -1691,8 +1680,11 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
       }) ?? 'unsupported'
       if (target === 'desk_run') {
         const armed = cancelProbe(() => cancelDeps.haltHandedOffTurn?.(threadId, { at: latch.at, clientCancelId: latch.clientCancelId }, {
-          promptMarker: peerAcceptanceMarker(turn.prompt),
+          // 6.53.3 /qa: the WHOLE delivered prompt (the re-arm matches it exactly), and whether
+          // the hand-off was only possibly delivered (`maybe`: a two-minute re-arm, not an hour).
+          prompt: turn.prompt,
           sentAt: turn.sentAt,
+          unverified: reached === 'maybe',
         }) === true, false)
         if (armed) {
           const settledPermissions = cancelProbe(() => cancelDeps.settlePermissions?.(threadId) ?? 0, 0)