@gotcos/glasses-server 6.57.1 → 6.58.1

package/CHANGELOG.md

@@ -1,3 +1,50 @@
+## 6.58.1
+
+### A copy that lost its audio no longer holds the ring
+
+- 2026-09-29, 07:36 to 07:51, glasses 6.9.558 on 6.57.1, the HC standup while driving: a hidden copy of COS (`mumnr7cf`) lost its audio at 07:38:19 (`meeting.audio.silent`, the bridge probe alive, the glasses connected) and went on claiming `recording: true`. Its timers were throttled: 24 log rows in 14 minutes, gaps of 30 s to 208 s. A new copy started the meeting at 07:38:48 and another at 07:45:10; each was told to yield within a second, which stopped its recording. Only the copy opened at 07:50:46 took the ring. About 12.5 minutes (07:38:19 to 07:51:02) never reached the Mac.
+- The cause: an owner's own `recording` word held the ring for as long as it kept claiming (QA round 3's allowance for uploads that lag after an outage), and nothing checked the word against its chunks.
+- **A copy that says it is not recording is believed over its own chunks.** Before, any chunk of its own in the last 30 s held the ring, including chunks committed before its audio stopped and still uploading or replayed. This applies to a claimant taking the ring, and to an owner holding it while that owner keeps claiming (45 s): a copy's start announcement is one claim with a 1.5 s deadline while its chunks get 30 s, so an older `false` can outlive a start the Mac never heard, and then the chunks speak for it. Glasses 6.9.560 says so within seconds of losing its audio. Only a claim that carries the `recording` field counts (glasses 6.9.510+); older copies keep the 6.50.4 rule.
+- **A copy's word alone holds for 150 s (`CLIENT_INSTANCE_WORD_HOLD_MS`) after its newest proof:** its own newest chunk, the start of its recording claims, or a grace after a gap. The worst gap between two chunks from a copy that is recording is one failed upload (the 30 s timeout) plus the longest backoff (60 s); the hold allows one more backoff on top, and is derived from those two constants. After a gap of more than two ticks (`CLIENT_INSTANCE_GRACE_GAP_MS`, an outage or a sleep) a copy still recording gets one fresh hold for its uploads to catch up, and another only after a chunk of its own has arrived since: the 9/29 zombie's gappy claims would otherwise have renewed it forever. The same test applies to a copy taking the ring and to one holding it.
+- **What each copy has said is kept per copy**, across changes of owner. Without that, a copy that lost the ring and took it back started a fresh clock, and a silent copy and an idle newer one traded the ring every few minutes for a whole meeting. Now the ring moves once. Glasses 6.9.560 then stands aside quietly, keeping its meeting until its audio returns or another copy records.
+- **Known limit for builds before 6.9.560:** once the ring has moved, the silent copy keeps its meeting and, told to yield by an owner that is not recording, keeps answering the ring (6.9.510's rule) alongside the new owner until that owner starts recording, when it is told to yield and saves. The Mac could end that sooner only by telling it the new owner records when it does not.
+- For the builds already out (the Even Hub 6.9.538 included), the hold is bounded, not removed: a copy opened while the silent copy's last chunks are under 30 s old, or its word under 150 s (plus one grace), is still told to yield. From then on the next copy to start the meeting keeps it.
+- Unchanged: a newer copy still waits while the owner's own chunks arrive, a duplicate recording still ends on the claimant, untagged chunks still hold only for an owner that claims, and the 6.52.3 reclaim rules.
+- Tests: the 9/29 timeline over HTTP (the new copy keeps the ring, and the zombie is then told to yield with `captureLive: true`); an older build that never stops saying `recording`, held for exactly the hold after its last chunk; a silent 6.9.538 copy and an idle newer one for 20 minutes (the ring moves once); a real recorder uploading on the worst cadence keeps the ring; a claimant that says `false` never takes on its chunks; a copy with nothing to show cannot take the ring back by saying `recording`; the hold's derivation; the one grace per chunk. Two HTTP fixtures that claimed to be 6.9.509 now omit `recording` as 6.9.509 did. Two review rounds (round 1 FIX FIRST: a claimant's own chunks and a fresh clock on every take-back let the ring alternate, and the 90 s hold had no margin over the uploader; round 2 FIX FIRST: believing an owner's old `false` forever let a second copy record alongside one whose start the Mac missed; all fixed, with a test for each).
+
+## 6.58.0
+
+### Work: did the session finish the task?
+
+- Miles, 2026-09-29: "If a session is responsible for completing multiple tasks and we have evidence of the session receiving the context necessary to complete that task (as well as a confirmation that it has), then we want to be moving those tasks through the Kanban as well automatically."
+  - COS Control 0.5.247 follows each Work handoff until the session reports on it.
+  - Every handoff asks the agent to make its first reply line `COS-WORK <id>: done: <evidence>`. Control reads it from the session's recent messages (`GET /api/agent-sessions/:provider/:id?turns=N`, served since 6.50.0) and moves the card itself, as far as QA and never to Complete.
+- **New `POST /api/work-board/completion-check`**, the fallback when the session's newest reply since the handoff has no status line and the session is idle.
+  - The body is exactly `{domain, id, provider, sessionId}`, plus an optional `after` (an ISO time).
+  - The task comes from the board. The replies come from this server's own transcripts: with `after`, every reply written since then, joined and kept to the newest 4,000 characters (`LATEST_REPLY_MAX`); without it, the newest reply.
+  - The client never sends work or reply text.
+  - Jev answers one choice question (done, not_done or unclear) with a probability.
+  - The task is judged against its Done when, or, when it has none, against its own text. No open task has one today. The answer says which, as `basis: "done_when" | "task"`.
+  - The answer is advice. Control moves a card only on done at 0.8 or more (`done_when`) or 0.85 (`task`). Confidence is not rounded, so 0.795 never reads as 0.8.
+- **Answers:**
+  - `{provider: "jev", verdict, confidence, basis, model, cached}`.
+  - Otherwise `{provider: "none", reason}`:
+    - `no_reply` when there is no reply;
+    - `no_task_text` when the task has no text;
+    - any Jev condition (`jev_not_configured`, `jev_cap_reached`, `jev_breaker_open` and the rest);
+    - `completion_unavailable` for an unexpected failure, which is logged and answered 200.
+  - An unknown task is 404 `task_not_found`, an unknown session 404 `session_not_found`, and any other body 400 `invalid_completion_request`.
+  - Answers are cached for 30 minutes per task text, Done when and reply.
+- **Cost:** Control asks at most twice per handoff, once per new reply, and only while the session is idle. The task text is clipped to 1,200 characters, the Done when to 500 and the replies to 4,000, so one check is at most about 2,500 input tokens, inside the shared daily Jev cap (`COS_JEV_DAILY_TOKENS`). The reply text goes to TypeSafe unredacted, as with every Jev question about Work.
+- **Other changes:**
+  - `server/routes/jev.ts` finds a task through one `findTask` (Work identity first, then row id) for both suggestions and completion checks.
+  - The local Work candidate answers completion checks with no session, so it never reads this Mac's transcripts.
+- **Tests:**
+  - The checker: policy, unrounded confidence, basis, the clipping of task, Done when and reply, cache and reasons.
+  - The replies reader, over a fixture transcript: `after` window, newest kept, unknown session.
+  - The route: board and transcripts as the only sources, `after` passed through and validated, exact bodies, 404s, a failure answered as advice.
+  - The mutation gate adds 16 mutants and runs `work-completion.test.ts`.
+
 ## 6.57.1
 
 ### Session suggestions for meeting reviews

package/docs/work-intake.md

@@ -32,3 +32,5 @@ The journal is `work-intake/intake.json` in the server data directory, owned by
 `POST /api/jev-key/set` `{ key }` validates the key against TypeSafe and saves it to `data/jev-key.json`; `GET /api/jev-key/status` returns `{ configured, source, usedToday, dailyCap, breakerOpenUntil, lastError }` and never the key; `DELETE /api/jev-key` removes the saved key. `POST /api/work-board/session-recommendation` `{ domain, id, sessions: [{ id, provider, title, summary? }] }` returns `{ provider: "jev", action: "continue" | "fork" | "new", sessionId, confidence, reason, alternatives }` or `{ provider: "none", reason }`. The COS meeting producer reads the same saved key when its own `.env` has none.
 
 Since 6.57.1 `POST /api/work-board/session-recommendation` also takes exactly `{ reviewId, sessions }` for a meeting review (`reviewId` = `wr_` + 32 hex). The server reads the review's meeting title and reviewed follow-up from its own store; the client never sends work text. Errors: 400 `invalid_review_request` (bad id or session list), 404 `review_not_found`, 404 `reviews_unavailable` (reviews off), 503 `review_store_unavailable` (defensive; the stock lookup reads memory).
+
+Since 6.58.0 `POST /api/work-board/completion-check` takes exactly `{ domain, id, provider, sessionId }` plus an optional `after` (ISO time). It asks Jev whether the session's replies since `after` (or its newest reply) show the task finished, judged against its Done when or, without one, its own text. The server reads the task from the board and the replies from its own transcripts; the client sends names and a time only. It answers `{ provider: "jev", verdict: "done" | "not_done" | "unclear", confidence, basis: "done_when" | "task", model, cached }` or `{ provider: "none", reason }` (`no_reply`, `no_task_text`, a Jev condition, `completion_unavailable`). Errors: 400 `invalid_completion_request`, 404 `task_not_found`, 404 `session_not_found`. COS Control 0.5.247 asks only while the session is idle and its newest reply since the handoff has no `COS-WORK` status line, at most twice per handoff, and moves a card to QA only on done at 0.8 (0.85 without a Done when).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.57.1",
+  "version": "6.58.1",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -629,7 +629,8 @@ app.use('/api', createWorkBoardRouter())
 // Work intake (6.57.0): meeting-derived suggestions, asks and review items. Optional: a bad journal never blocks boot.
 const workIntakeStore = createOptionalWorkIntakeStore(() => new WorkIntakeStore(dataPath('work-intake')))
 app.use('/api', createWorkIntakeRouter({ store: workIntakeStore }))
-// Jev key (Control Settings) and Continue/Fork/New session recommendations for Work tasks (6.57.0) and meeting reviews (6.57.1).
+// Jev key (Control Settings), Continue/Fork/New session recommendations for Work tasks (6.57.0) and meeting reviews
+// (6.57.1), and the Work completion check (6.58.0).
 app.use('/api', createJevRouter(workReviewRuntime ? { review: async id => workReviewRuntime.peek(id) } : {}))
 app.use('/api', queryRouter)
 // The scheduled start-of-day brief: settings, status, run-now. Same auth as

package/server/lib/client-instance-claim.ts

@@ -35,6 +35,28 @@ export const CLIENT_INSTANCE_AWAKE_MS = CLIENT_INSTANCE_LIVE_MS
  * intervals (~6 s each), so a stretch of silence or a slow upload does not end the hold.
  */
 export const CLIENT_INSTANCE_CAPTURE_LIVE_MS = 30_000
+/** The glasses uploader's longest wait between chunk attempts (cos-glasses-app local-first-meeting-uploader.ts, maxBackoffMs). */
+export const GLASSES_UPLOAD_MAX_BACKOFF_MS = 60_000
+/** The glasses chunk upload's request timeout (cos-glasses-app api-client.ts). A failed attempt can take this long. */
+export const GLASSES_UPLOAD_TIMEOUT_MS = 30_000
+/**
+ * 6.58.1: how long a copy's own `recording` word holds without proof. On 2026-09-29 (glasses
+ * 6.9.558) a hidden copy lost its audio at 07:38:19 and kept claiming `recording: true` for 12
+ * minutes; two newer copies started the meeting and were each told to stop within a second, and
+ * 12.5 minutes were never captured. The word exists for upload lag (QA round 3), which is bounded:
+ * the worst gap between two chunk arrivals from a copy that is recording is one failed attempt
+ * (the timeout) plus the longest backoff, 90 s. This allows one more backoff on top (QA, 6.58.1:
+ * exactly 90 s left no margin for a weak link, an ASR stall on the Mac or throttled timers).
+ */
+export const CLIENT_INSTANCE_WORD_HOLD_MS = GLASSES_UPLOAD_TIMEOUT_MS + 2 * GLASSES_UPLOAD_MAX_BACKOFF_MS
+/**
+ * 6.58.1: a gap between an owner's claims longer than two ticks is an outage or a sleep. When the
+ * owner comes back still saying `recording`, its word gets one fresh CLIENT_INSTANCE_WORD_HOLD_MS
+ * for its chunks to catch up, but only if a chunk of its own arrived since the last such grace:
+ * the 2026-09-29 zombie's timers were throttled (gaps of 30 s to 208 s between rows), so a grace
+ * on every gap would have held the ring for it indefinitely.
+ */
+export const CLIENT_INSTANCE_GRACE_GAP_MS = 2 * CLIENT_INSTANCE_TICK_MS
 /** App copies whose newest chunk is remembered; the least recent is dropped past this. */
 export const CLIENT_INSTANCE_MAX_TAGGED = 64
 /** A boot time this far past the server clock is a phone clock set wrong, not a newer copy. */
@@ -45,15 +67,41 @@ export interface ClientInstanceClaim {
   bootAt: number
   version: string
   /**
-   * The copy says it is recording (glasses 6.9.509+; false when absent). Chunk arrival
+   * The copy says it is recording (glasses 6.9.510+; false when absent). Chunk arrival
    * alone lags: after an outage the uploader backs off up to 60 s, and only a visible page
    * or a display reconnect resets it, which a hidden recording copy never gets (QA round 3).
    */
   recording: boolean
+  /**
+   * 6.58.1: the claim carried a `recording` field at all (glasses 6.9.510+). Only then is a
+   * `recording: false` a statement; from older copies it is merely absent.
+   */
+  recordingReported?: boolean
+}
+
+/**
+ * 6.58.1: what one copy has said about recording, kept per copy (not per owner) so it survives
+ * the ring moving between copies. Before this was per copy, a copy that lost the ring and took
+ * it back started a fresh clock each time, and a silent 6.9.538 copy and an idle newer one
+ * traded the ring every few minutes for a whole meeting, both answering the ring (QA, 6.58.1).
+ */
+export interface CopyWord {
+  recording: boolean
+  recordingReported: boolean
+  /** When this copy's current run of `recording: true` claims began. */
+  recordingSince?: number
+  /** When this copy last got a grace after a gap in its claims (see CLIENT_INSTANCE_GRACE_GAP_MS). */
+  graceAt?: number
+  /** When this copy last claimed, under any verdict. */
+  seenAt: number
 }
 
 export interface ClientInstanceOwner extends ClientInstanceClaim {
   seenAt: number
+  /** 6.58.1: the owner's CopyWord.recordingSince. */
+  recordingSince?: number
+  /** 6.58.1: the owner's CopyWord.graceAt. */
+  graceAt?: number
 }
 
 export type ClientInstanceVerdict = 'owner' | 'yield'
@@ -75,6 +123,10 @@ export interface CaptureEvidence {
   owner: boolean
   claimant: boolean
   untagged: boolean
+  /** 6.58.1: when the owner's own newest tagged chunk arrived, however long ago; absent: never (or forgotten). */
+  ownerChunkAt?: number
+  /** 6.58.1: the same for the claimant. */
+  claimantChunkAt?: number
 }
 
 export const NO_CAPTURE: CaptureEvidence = { owner: false, claimant: false, untagged: false }
@@ -97,10 +149,14 @@ export class ClientChunkLedger {
 
   evidence(device: string, ownerId: string, claimId: string, now: number): CaptureEvidence {
     const live = (at: number | undefined) => at !== undefined && now - at < CLIENT_INSTANCE_CAPTURE_LIVE_MS
+    const ownerChunkAt = this.tagged.get(ownerId)
+    const claimantChunkAt = this.tagged.get(claimId)
     return {
-      owner: live(this.tagged.get(ownerId)),
-      claimant: live(this.tagged.get(claimId)),
+      owner: live(ownerChunkAt),
+      claimant: live(claimantChunkAt),
       untagged: live(this.untagged.get(device)),
+      ...(ownerChunkAt !== undefined ? { ownerChunkAt } : {}),
+      ...(claimantChunkAt !== undefined ? { claimantChunkAt } : {}),
     }
   }
 }
@@ -111,10 +167,68 @@ export class ClientChunkLedger {
  * own last claim saying `recording`, and untagged chunks from the device (which could be
  * anyone's), count only while it is still claiming: a dead owner must never be pinned by
  * a stale flag or by the chunks of the copy that replaced it (QA round 2).
+ *
+ * 6.58.1, two limits from the 2026-09-29 zombie (see CLIENT_INSTANCE_WORD_HOLD_MS):
+ * - An owner still claiming that SAYS it is not recording is believed over its trailing chunks.
+ *   Glasses 6.9.560 says so within seconds of its audio stopping; the chunks it had already
+ *   committed can keep arriving and would hold the ring for a copy with nothing left to record.
+ *   Only while it claims (CLIENT_INSTANCE_LIVE_MS): a copy's start announcement is one claim with
+ *   a 1.5 s deadline while its chunks get 30 s, so a `false` from before a meeting can outlive a
+ *   start the Mac never heard, and its chunks must then speak for it (QA round 2: believing the
+ *   old `false` let a second copy record alongside). Only a claim that carries the field counts.
+ * - Its word alone holds for CLIENT_INSTANCE_WORD_HOLD_MS after its newest proof (wordBacked).
  */
 export function ownerIsRecording(owner: ClientInstanceOwner, evidence: CaptureEvidence, now: number): boolean {
-  if (evidence.owner) return true
-  return (owner.recording || evidence.untagged) && now - owner.seenAt <= CLIENT_INSTANCE_LIVE_MS
+  const claiming = now - owner.seenAt <= CLIENT_INSTANCE_LIVE_MS
+  if (evidence.owner && !(claiming && saysNotRecording(owner))) return true
+  if (!claiming) return false
+  if (evidence.untagged) return true
+  return wordBacked(owner, evidence.ownerChunkAt, now)
+}
+
+/** 6.58.1: the claim carried `recording: false` explicitly (glasses 6.9.510+). */
+export function saysNotRecording(claim: Pick<ClientInstanceClaim, 'recording' | 'recordingReported'>): boolean {
+  return claim.recordingReported === true && !claim.recording
+}
+
+/**
+ * 6.58.1: a copy's own `recording: true` still counts: its newest proof (its own newest chunk,
+ * the start of its run of recording claims, or its one grace after a gap) is no older than
+ * CLIENT_INSTANCE_WORD_HOLD_MS. The same rule for an owner holding the ring and a claimant
+ * taking it, so a copy with nothing to show cannot take the ring back by saying so (QA, 6.58.1).
+ */
+export function wordBacked(word: Pick<CopyWord, 'recording' | 'recordingSince' | 'graceAt'>, chunkAt: number | undefined, now: number): boolean {
+  if (!word.recording) return false
+  const provenAt = Math.max(chunkAt ?? 0, word.recordingSince ?? 0, word.graceAt ?? 0)
+  return now - provenAt <= CLIENT_INSTANCE_WORD_HOLD_MS
+}
+
+/**
+ * 6.58.1: a copy's word after its claim at `now`. `recordingSince` starts when its claims start
+ * saying `recording` and clears when they stop. A claim that comes back after a gap longer than
+ * CLIENT_INSTANCE_GRACE_GAP_MS, still recording, gets a grace for its uploads to catch up, once
+ * per chunk of its own: the first grace is free, and another needs a chunk newer than the last.
+ * `chunkAt` is this copy's own newest chunk.
+ */
+export function nextCopyWord(prev: CopyWord | undefined, claim: ClientInstanceClaim, now: number, chunkAt?: number): CopyWord {
+  const recordingReported = claim.recordingReported === true
+  if (!claim.recording) return { recording: false, recordingReported, seenAt: now }
+  if (!prev || !prev.recording || prev.recordingSince === undefined) return { recording: true, recordingReported, recordingSince: now, seenAt: now }
+  const cameBack = now - prev.seenAt > CLIENT_INSTANCE_GRACE_GAP_MS
+  const chunkSinceGrace = prev.graceAt === undefined || (chunkAt ?? 0) > prev.graceAt
+  const graceAt = cameBack && chunkSinceGrace ? now : prev.graceAt
+  return { recording: true, recordingReported, recordingSince: prev.recordingSince, ...(graceAt !== undefined ? { graceAt } : {}), seenAt: now }
+}
+
+/** The owner's word, as a CopyWord. */
+function wordOf(owner: ClientInstanceOwner): CopyWord {
+  return {
+    recording: owner.recording,
+    recordingReported: owner.recordingReported === true,
+    ...(owner.recordingSince !== undefined ? { recordingSince: owner.recordingSince } : {}),
+    ...(owner.graceAt !== undefined ? { graceAt: owner.graceAt } : {}),
+    seenAt: owner.seenAt,
+  }
 }
 
 /** A body the route may act on, or null. Never throws. */
@@ -127,7 +241,7 @@ export function parseClientInstanceClaim(body: unknown, now = Date.now()): Clien
   // as long as the clock stayed wrong (QA, 6.50.3).
   if (o.bootAt > now + CLIENT_INSTANCE_MAX_FUTURE_BOOT_MS) return null
   const version = typeof o.version === 'string' ? o.version.slice(0, 32) : ''
-  return { id: o.id, bootAt: o.bootAt, version, recording: o.recording === true }
+  return { id: o.id, bootAt: o.bootAt, version, recording: o.recording === true, recordingReported: typeof o.recording === 'boolean' }
 }
 
 function isNewer(a: ClientInstanceClaim, b: ClientInstanceClaim): boolean {
@@ -142,27 +256,44 @@ export function arbitrateClientInstance(
   evidence: CaptureEvidence = NO_CAPTURE,
   /** When this claimant last claimed (any verdict), or undefined: never seen. */
   claimantLastSeenAt?: number,
-): { owner: ClientInstanceOwner; verdict: ClientInstanceVerdict; took: boolean } {
-  const fresh: ClientInstanceOwner = { ...claim, seenAt: now }
-  if (!owner) return { owner: fresh, verdict: 'owner', took: true }
-  if (owner.id === claim.id) return { owner: { ...owner, seenAt: now, recording: claim.recording }, verdict: 'owner', took: false }
+  /**
+   * 6.58.1: this claimant's word before this claim (the route keeps one per copy). Undefined:
+   * the owner's own word when the claimant is the owner, otherwise a copy never heard from.
+   */
+  claimantWord?: CopyWord,
+): { owner: ClientInstanceOwner; verdict: ClientInstanceVerdict; took: boolean; word: CopyWord } {
+  const isOwner = owner !== null && owner.id === claim.id
+  const chunkAt = isOwner ? evidence.ownerChunkAt : evidence.claimantChunkAt
+  const word = nextCopyWord(claimantWord ?? (isOwner ? wordOf(owner) : undefined), claim, now, chunkAt)
+  const fresh: ClientInstanceOwner = {
+    ...claim,
+    seenAt: now,
+    ...(word.recordingSince !== undefined ? { recordingSince: word.recordingSince } : {}),
+    ...(word.graceAt !== undefined ? { graceAt: word.graceAt } : {}),
+  }
+  const decide = (o: ClientInstanceOwner, verdict: ClientInstanceVerdict, took: boolean) => ({ owner: o, verdict, took, word })
+  if (!owner) return decide(fresh, 'owner', true)
+  if (isOwner) return decide(fresh, 'owner', false)
   // 6.50.4: the yielding copy stops its recording (that is how a duplicate ends), so the
   // ring must never move in a way that stops the only recording.
   // (1) The claimant is recording and the owner is not: the claimant is the meeting.
   // Reopened offline, the Mac still names the dead copy from before; when signal returns,
   // the new copy's chunks land first and its claim must not be told to stop (QA round 2).
   // Its chunks or its own word: after an outage the uploads lag the claims (QA round 3).
-  if ((evidence.claimant || claim.recording) && !ownerIsRecording(owner, evidence, now)) return { owner: fresh, verdict: 'owner', took: true }
+  // 6.58.1: the claimant's chunks count unless it says it is not recording, and its word only
+  // while it is backed (wordBacked), the same tests the owner meets.
+  const claimantRecords = (evidence.claimant && !saysNotRecording(claim)) || wordBacked(word, chunkAt, now)
+  if (claimantRecords && !ownerIsRecording(owner, evidence, now)) return decide(fresh, 'owner', true)
   // (2) The owner is recording: a newer copy waits, however quiet the owner's claims.
   // Reopening COS on a blank phone page mid-meeting ended the meeting on 6.50.3 (QA).
   // The ring moves on the newer copy's first claim after the meeting stops.
-  if (ownerIsRecording(owner, evidence, now)) return { owner, verdict: 'yield', took: false }
-  if (isNewer(claim, owner)) return { owner: fresh, verdict: 'owner', took: true }
+  if (ownerIsRecording(owner, evidence, now)) return decide(owner, 'yield', false)
+  if (isNewer(claim, owner)) return decide(fresh, 'owner', true)
   // 6.52.3: an older boot takes a quiet ring back only after CLIENT_INSTANCE_RECLAIM_MS,
   // and only while it has itself been claiming (awake), never on the first tick after a
   // gap of its own. A dead newer copy is replaced when the user reopens COS (a newer boot
   // still takes at once); this rule is for the copy that is merely quiet.
   const claimantAwake = claimantLastSeenAt !== undefined && now - claimantLastSeenAt <= CLIENT_INSTANCE_AWAKE_MS
-  if (now - owner.seenAt > CLIENT_INSTANCE_RECLAIM_MS && claimantAwake) return { owner: fresh, verdict: 'owner', took: true }
-  return { owner, verdict: 'yield', took: false }
+  if (now - owner.seenAt > CLIENT_INSTANCE_RECLAIM_MS && claimantAwake) return decide(fresh, 'owner', true)
+  return decide(owner, 'yield', false)
 }

package/server/lib/work-completion.ts

@@ -0,0 +1,98 @@
+/**
+ * Did an agent session finish a Work task? (6.58.0)
+ *
+ * Control 0.5.247 follows a Work handoff until the session reports on it. Every handoff asks the agent to start its
+ * reply with a status line (`COS-WORK <id>: done: <evidence>`). When the session's newest reply since the handoff
+ * carries none and the session has gone idle, Control asks this (at most twice per handoff, once per reply). Jev reads
+ * the session's replies since the handoff arrived (`after`) against the task's Done when, or, when the task has none
+ * (most do), against the task itself. It answers done, not_done or unclear with a probability. Control moves the card
+ * to QA only on done at 0.8 or more (0.85 without a Done when), and never to Complete: that stays the user's.
+ *
+ * The task comes from the board and the replies from this server's own session transcripts. The client sends names
+ * and a time only.
+ */
+import { createHash } from 'node:crypto'
+import { estimateJevTokens, JevError, type JevClient } from './jev.js'
+import { agentSessionRoots, findAgentSessionFile, LATEST_REPLY_MAX, parseAgentSession, type AgentProvider } from './agent-session-store.js'
+import { readRecentSessionTurns, SESSION_TURNS_MAX, type SessionTurn } from './agent-session-turns.js'
+
+export const COMPLETION_LIMITS = { task: 1200, doneWhen: 500, reply: LATEST_REPLY_MAX, cacheMs: 30 * 60_000, cacheEntries: 200 } as const
+export const COMPLETION_CHOICES = ['done', 'not_done', 'unclear'] as const
+export type CompletionChoice = typeof COMPLETION_CHOICES[number]
+
+export interface CompletionInput { task: { text: string; doneWhen: string }; reply: string }
+/** `basis`: what the reply was read against, the task's Done when or (without one) the task itself. */
+export type CompletionVerdict =
+  | { provider: 'jev'; model: string; verdict: CompletionChoice; confidence: number; basis: 'done_when' | 'task'; cached: boolean }
+  | { provider: 'none'; reason: string }
+
+const AGAINST_DONE_WHEN = "Does the agent's reply in `reply` show that the task in `task` is finished, as `task.doneWhen` defines finished? "
+  + 'Choose done only when the reply reports the work complete and checked against that finish line.'
+const AGAINST_TASK = "Does the agent's reply in `reply` show that the task in `task.text` is finished? "
+  + 'Choose done only when the reply reports that exact work complete and checked, not merely started or planned.'
+const REST = ' A plan, a partial result, a question for the user, a blocker, or a promise to do it next is not_done. '
+  + 'Choose unclear when the reply does not say enough to tell.'
+
+const clip = (text: string, max: number) => text.trim().slice(0, max)
+
+/** Pure policy over Jev's answer: the most probable choice and its probability (unrounded: a threshold decides on it). */
+export function decideCompletion(probabilities: Record<string, number> | undefined): { verdict: CompletionChoice; confidence: number } {
+  const rows = Object.entries(probabilities ?? {})
+  if (!rows.length || rows.some(([k, v]) => !(COMPLETION_CHOICES as readonly string[]).includes(k) || typeof v !== 'number' || !Number.isFinite(v) || v < 0 || v > 1)) {
+    throw new JevError('jev_bad_answer', 'Jev answered outside done, not_done and unclear')
+  }
+  const [verdict, confidence] = rows.sort((a, b) => b[1] - a[1])[0] as [CompletionChoice, number]
+  return { verdict, confidence }
+}
+
+/** The replies among `turns` written at or after `afterMs`, joined oldest first, keeping the newest `max` characters. */
+export function joinRepliesSince(turns: SessionTurn[], afterMs: number, max: number = COMPLETION_LIMITS.reply): string {
+  const joined = turns.filter(t => t.role === 'assistant' && t.at !== undefined && Date.parse(t.at) >= afterMs).map(t => t.text).join('\n\n')
+  return joined.length <= max ? joined : `\u2026${joined.slice(joined.length - (max - 1))}`
+}
+
+export type SessionFileFinder = (provider: AgentProvider, sessionId: string) => Promise<string | null>
+const findInHome: SessionFileFinder = (provider, sessionId) => findAgentSessionFile(provider, sessionId, agentSessionRoots())
+
+/** What a completion check judges: the session's replies since `afterMs`, or its newest reply when no time is given.
+ *  Null when the session is not on this Mac. */
+export async function readRepliesSince(provider: AgentProvider, sessionId: string, afterMs: number | null,
+                                       find: SessionFileFinder = findInHome): Promise<string | null> {
+  const path = await find(provider, sessionId)
+  if (!path) return null
+  if (afterMs === null) return (await parseAgentSession(provider, path)).latest_reply || ''
+  return joinRepliesSince((await readRecentSessionTurns(provider, path, SESSION_TURNS_MAX)).turns, afterMs)
+}
+
+export class CompletionChecker {
+  private cache = new Map<string, { at: number; value: Extract<CompletionVerdict, { provider: 'jev' }> }>()
+  constructor(private readonly jev: JevClient, private readonly now: () => number = () => Date.now()) {}
+
+  async check(input: CompletionInput): Promise<CompletionVerdict> {
+    const state = { task: { text: clip(input.task.text, COMPLETION_LIMITS.task), doneWhen: clip(input.task.doneWhen, COMPLETION_LIMITS.doneWhen) },
+      reply: clip(input.reply, COMPLETION_LIMITS.reply) }
+    const basis = state.task.doneWhen ? 'done_when' as const : 'task' as const
+    if (!state.task.doneWhen && !state.task.text) return { provider: 'none', reason: 'no_task_text' }
+    if (!state.reply) return { provider: 'none', reason: 'no_reply' }
+    const key = createHash('sha256').update(JSON.stringify(state)).digest('hex')
+    const hit = this.cache.get(key)
+    if (hit && this.now() - hit.at < COMPLETION_LIMITS.cacheMs) return { ...hit.value, cached: true }
+    const questions = {
+      finished: { type: 'choice', instructions: (basis === 'done_when' ? AGAINST_DONE_WHEN : AGAINST_TASK) + REST, criteria: {
+        done: basis === 'done_when' ? 'The reply reports the task finished and checked against its Done when.' : 'The reply reports this task finished and checked.',
+        not_done: 'The reply shows work remaining, a plan, a question, a blocker, or a partial result.',
+        unclear: 'The reply does not say enough to tell.',
+      } },
+    }
+    try {
+      const reply = await this.jev.ask(state, questions, estimateJevTokens({ state, questions }))
+      const value = { provider: 'jev' as const, model: reply.model ?? 'jev', cached: false, basis, ...decideCompletion(reply.answers.finished?.probabilities) }
+      if (this.cache.size >= COMPLETION_LIMITS.cacheEntries) this.cache.delete(this.cache.keys().next().value!)
+      this.cache.set(key, { at: this.now(), value })
+      return value
+    } catch (e) {
+      if (e instanceof JevError) return { provider: 'none', reason: e.code }
+      throw e
+    }
+  }
+}

package/server/routes/client-instance.ts

@@ -21,8 +21,8 @@ import {
   parseClientInstanceClaim,
   parseInstanceTag,
   ClientChunkLedger,
-  NO_CAPTURE,
   type ClientInstanceOwner,
+  type CopyWord,
 } from '../lib/client-instance-claim.js'
 
 /** Owners kept at once; the least recently seen device is dropped past this. */
@@ -58,6 +58,13 @@ export function createClientInstanceRouter(deps: ClientInstanceRouterDeps | (()
     lastSeen.delete(id); lastSeen.set(id, at)
     while (lastSeen.size > CLIENT_INSTANCE_MAX_SEEN) lastSeen.delete(lastSeen.keys().next().value as string)
   }
+  // 6.58.1: what each copy has said about recording, kept across changes of owner (CopyWord).
+  // Bounded like lastSeen; a check updates it too (the copy still said it).
+  const words = new Map<string, CopyWord>()
+  const noteWord = (id: string, word: CopyWord) => {
+    words.delete(id); words.set(id, word)
+    while (words.size > CLIENT_INSTANCE_MAX_SEEN) words.delete(words.keys().next().value as string)
+  }
   router.use((req, _res, next) => {
     if (isMeetingChunkPost(req.method, req.path)) chunks.note(deviceKey(req.socket?.remoteAddress ?? req.ip), parseInstanceTag(req.query?.clientInstance), now())
     next()
@@ -68,11 +75,13 @@ export function createClientInstanceRouter(deps: ClientInstanceRouterDeps | (()
     if (!claim) return void res.status(400).json({ error: 'invalid_claim' })
     const device = deviceKey(req.socket?.remoteAddress ?? req.ip)
     const previous = owners.get(device) ?? null
-    const evidence = previous ? chunks.evidence(device, previous.id, claim.id, at) : NO_CAPTURE
+    // 6.58.1: evidence even with no owner, so a first claim still knows its own newest chunk.
+    const evidence = chunks.evidence(device, previous?.id ?? '', claim.id, at)
     const captureLive = previous ? ownerIsRecording(previous, evidence, at) : false
     const claimantLastSeenAt = lastSeen.get(claim.id)
     noteSeen(claim.id, at)
-    const result = arbitrateClientInstance(previous, claim, at, evidence, claimantLastSeenAt)
+    const result = arbitrateClientInstance(previous, claim, at, evidence, claimantLastSeenAt, words.get(claim.id))
+    noteWord(claim.id, result.word)
     if (req.body?.check === true) {
       const shown = previous ?? result.owner
       return void res.json({ verdict: result.verdict, owner: { id: shown.id, bootAt: shown.bootAt, version: shown.version, seenAt: shown.seenAt }, check: true, captureLive })

package/server/routes/jev.ts

@@ -9,6 +9,8 @@ import { Router } from 'express'
 import { existsSync, unlinkSync } from 'node:fs'
 import { JEV_KEY_FILE, saveJevKey, sharedJevClient, validateJevKey, type JevClient } from '../lib/jev.js'
 import { SessionRecommender, parseCandidates } from '../lib/session-recommendation.js'
+import { CompletionChecker, readRepliesSince } from '../lib/work-completion.js'
+import { isSafeSessionId, type AgentProvider } from '../lib/agent-session-store.js'
 import { listBoard } from '../lib/task-store.js'
 import { isSafeDomainName } from '../lib/domains.js'
 
@@ -23,13 +25,24 @@ export interface JevRouteDependencies {
   save: typeof saveJevKey
   /** Looks a meeting review up by its `wr_` id; throws or returns null when it does not exist. Absent when reviews are off. */
   review?: (id: string) => Promise<ReviewForAdvice | null>
+  /** 6.58.0: Jev's reading of a reply against a task's Done when. */
+  completion: Pick<CompletionChecker, 'check'>
+  /** 6.58.0: a session's replies since a time (or its newest reply) from this server's transcripts; null when the
+   *  session is not on this Mac. */
+  replies: (provider: AgentProvider, sessionId: string, afterMs: number | null) => Promise<string | null>
+}
+
+/** Work identity first: it survives a rename, while a new card's id could equal an old identity's text hash. */
+function findTask<T extends { id: string; workIdentity?: string }>(rows: T[], id: string): T | undefined {
+  return rows.find(r => r.workIdentity === id) ?? rows.find(r => r.id === id)
 }
 
 export function createJevRouter(overrides: Partial<JevRouteDependencies> = {}): Router {
   const jev = overrides.jev ?? sharedJevClient()
-  const deps: JevRouteDependencies = { jev, recommender: new SessionRecommender(jev), list: listBoard, validate: validateJevKey, save: saveJevKey, ...overrides }
+  const deps: JevRouteDependencies = { jev, recommender: new SessionRecommender(jev), list: listBoard, validate: validateJevKey, save: saveJevKey,
+    completion: new CompletionChecker(jev), replies: (provider, sessionId, afterMs) => readRepliesSince(provider, sessionId, afterMs), ...overrides }
   const router = Router()
-  router.use(['/jev-key', '/work-board/session-recommendation'], (_req, res, next) => { res.set('Cache-Control', 'private, no-store'); next() })
+  router.use(['/jev-key', '/work-board/session-recommendation', '/work-board/completion-check'], (_req, res, next) => { res.set('Cache-Control', 'private, no-store'); next() })
 
   router.get('/jev-key/status', (_req, res) => res.json(deps.jev.status()))
 
@@ -91,9 +104,8 @@ export function createJevRouter(overrides: Partial<JevRouteDependencies> = {}):
       return res.status(400).json({ error: { code: 'invalid_recommendation_request', message: 'Select an exact task and send at most 80 sessions.' } })
     }
     try {
-      // Work identity first: it survives a rename, while a new card's id could equal an old identity's text hash.
       const rows = (await deps.list()).filter(r => r.domain === body.domain)
-      const row = rows.find(r => r.workIdentity === body.id) ?? rows.find(r => r.id === body.id)
+      const row = findTask(rows, body.id)
       if (!row) return res.status(404).json({ error: { code: 'task_not_found', message: 'That task changed or was removed. Refresh Work.' } })
       const meetings = (row.meetingRefs ?? []).map(ref => ref.title ?? '').filter(Boolean)
       return res.json(await deps.recommender.recommend({ task: { text: row.text || row.title || '', domain: row.domain, meetings }, sessions }))
@@ -102,5 +114,31 @@ export function createJevRouter(overrides: Partial<JevRouteDependencies> = {}):
       return res.json({ provider: 'none', reason: 'recommendation_unavailable' })  // advice only: never block the workspace
     }
   })
+  /** 6.58.0 (Control 0.5.247): did a session finish a board task? Asked when the session's newest reply since the
+   *  handoff has no status line and the session is idle. The task comes from the board and the replies from this
+   *  server's transcripts; the client sends names and, optionally, `after` (judge replies from then on). An answer is
+   *  advice: Control moves a card to QA only on a confident done, never to Complete. */
+  router.post('/work-board/completion-check', async (req, res) => {
+    const body = req.body
+    const keys = body && typeof body === 'object' && !Array.isArray(body) ? Object.keys(body).filter(k => k !== 'after').sort().join(',') : ''
+    const afterMs = body?.after === undefined ? null : typeof body.after === 'string' && body.after.length <= 40 ? Date.parse(body.after) : Number.NaN
+    if (keys !== 'domain,id,provider,sessionId' || Number.isNaN(afterMs)
+      || typeof body.domain !== 'string' || !isSafeDomainName(body.domain) || typeof body.id !== 'string' || !/^[a-f0-9]{12}$/.test(body.id)
+      || !['claude', 'codex', 'cursor'].includes(body.provider) || typeof body.sessionId !== 'string' || !isSafeSessionId(body.sessionId)) {
+      return res.status(400).json({ error: { code: 'invalid_completion_request', message: 'Select an exact task and session.' } })
+    }
+    try {
+      const rows = (await deps.list()).filter(r => r.domain === body.domain)
+      const row = findTask(rows, body.id)
+      if (!row) return res.status(404).json({ error: { code: 'task_not_found', message: 'That task changed or was removed. Refresh Work.' } })
+      const reply = await deps.replies(body.provider as AgentProvider, body.sessionId, afterMs)
+      if (reply === null) return res.status(404).json({ error: { code: 'session_not_found', message: 'That session is not on this Mac.' } })
+      // A task with no Done when (most tasks) is judged against its own text; the answer says which (`basis`).
+      return res.json(await deps.completion.check({ task: { text: row.text || row.title || '', doneWhen: (row.doneWhen ?? '').trim() }, reply }))
+    } catch (e) {
+      console.error('[jev] completion check failed:', e instanceof Error ? e.message : e)
+      return res.json({ provider: 'none', reason: 'completion_unavailable' })  // advice only: tracking goes on without it
+    }
+  })
   return router
 }