@gotcos/glasses-server 6.61.2 → 6.61.5

package/server/routes/meeting.ts

@@ -5,6 +5,7 @@
 import { existsSync, readdirSync, readFileSync, rmSync, statSync, unlinkSync } from 'node:fs'
 import { isWorthRecovering } from '../lib/quarantine-auto-recover.js'
 import { resolve } from 'node:path'
+import { createHash } from 'node:crypto'
 import { Router } from 'express'
 import { emitDisplay } from '../lib/display-bus.js'
 import { cleanTranscriptLines } from '../lib/hallucination-filter.js'
@@ -847,6 +848,31 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
   // rebuilding are the /api/voice/* routes, each with its own confirmation.
   //
   // Keyed on sessionId so it can reuse the store's traversal-hardened readers
+  function reviewRevision(meetingPath: string, sidecarPath: string): string {
+    const hash = createHash('sha256')
+    for (const path of [meetingPath, sidecarPath]) {
+      let text: string | null = null
+      try { text = readFileSync(path, 'utf-8') } catch { /* missing content is part of the revision */ }
+      hash.update(JSON.stringify(text))
+    }
+    return hash.digest('hex')
+  }
+
+  function selectedReadMatches(requested: unknown, sessionId: string, actual: string): boolean {
+    return requestedRecordMatches(requested, actual) || blendedRecordFor(requested, sessionId) !== undefined
+  }
+
+  function sourceRevisionRefusal(sessionId: string, body: any): { status: number; body: Record<string, unknown> } | null {
+    const ops = cosOperationsMeetingsConfigured() ? findCosOperationsMeetingBySessionId(sessionId) : null
+    if (ops?.mergedScribeConflict?.length) return { status: 409, body: { reason: 'record_source_mismatch', error: markdownUnreadableReason(ops) } }
+    if (body?.expectedRevision == null) return null // older clients keep their existing record guard
+    const saved = ops ? null : store.findBySessionId(sessionId)
+    if (!ops && !saved) return { status: 409, body: { reason: 'record_source_mismatch', error: 'Meeting source changed; reopen the meeting' } }
+    const actual = reviewRevision(ops?.meetingPath ?? saved!.filepath, ops?.sidecarPath ?? saved!.sidecarPath)
+    if (typeof body.expectedRevision !== 'string' || body.expectedRevision !== actual) return { status: 409, body: { reason: 'record_source_mismatch', error: 'Meeting changed since review; reopen before correcting it' } }
+    return null
+  }
+
   // (safeDirectoryRealpath / safeReadFile) instead of reassembling a path from
   // client-supplied domain and filename components.
   router.get('/meeting/:sessionId/speakers', (req, res) => {
@@ -878,6 +904,11 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       res.status(404).json({ error: 'No saved meeting for this session', reason: 'meeting_not_found' })
       return
     }
+    const identity = speakerRecordIdentity(sessionId, operations, direct, blendedRecordFor(req.query.recordId, sessionId))
+    if (!selectedReadMatches(req.query.recordId, sessionId, identity.recordId)) {
+      res.status(409).json({ error: 'Meeting source changed; reopen the selected meeting', reason: 'record_source_mismatch' })
+      return
+    }
     const sidecarPath = operations?.sidecarPath ?? direct?.sidecarPath ?? saved!.sidecarPath
     const title = operations?.title ?? direct?.title ?? saved!.title
     const domain = operations?.domain ?? direct?.domain ?? saved!.domain
@@ -932,7 +963,10 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       title,
       domain,
       filename,
-      ...speakerRecordIdentity(sessionId, operations, direct, blendedRecordFor(req.query.recordId, sessionId)),
+      ...identity,
+      reviewIdentityVersion: 1,
+      sourceRevision: reviewRevision(operations?.meetingPath ?? direct?.meetingPath ?? saved!.filepath, sidecarPath),
+      ...(operations?.mergedScribeConflict?.length ? { mutable: false, identityConflict: operations.mergedScribeConflict } : {}),
       ...(saved ? { durationMin: saved.durationMin } : {}),
       ...review,
     })
@@ -985,6 +1019,11 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       res.status(404).json({ error: 'No saved meeting for this session', reason: 'meeting_not_found' })
       return
     }
+    const identity = speakerRecordIdentity(sessionId, operations, direct, blendedRecordFor(req.query.recordId, sessionId))
+    if (!selectedReadMatches(req.query.recordId, sessionId, identity.recordId)) {
+      res.status(409).json({ error: 'Meeting source changed; reopen the selected meeting', reason: 'record_source_mismatch' })
+      return
+    }
     const sidecarPath = operations?.sidecarPath ?? direct?.sidecarPath ?? saved!.sidecarPath
     const title = operations?.title ?? direct?.title ?? saved!.title
     const mdPath = operations?.meetingPath ?? direct?.meetingPath ?? sidecarPath.replace(/\.g2-chunks\.json$/, '.md')
@@ -1112,7 +1151,10 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       // no write-up yet.
       capturedChars: clip.capturedChars,
       domain: clip.domain,
-      ...speakerRecordIdentity(sessionId, operations, direct, blendedRecordFor(req.query.recordId, sessionId)),
+      ...identity,
+      reviewIdentityVersion: 1,
+      sourceRevision: reviewRevision(operations?.meetingPath ?? direct?.meetingPath ?? saved!.filepath, sidecarPath),
+      ...(operations?.mergedScribeConflict?.length ? { mutable: false, identityConflict: operations.mergedScribeConflict } : {}),
       // So the panel can warn above the write-up, not just the clipboard.
       removedNames: clip.removed,
       coverage,
@@ -1169,7 +1211,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     // Enrolment writes to the voice store, so the same two gates as the other
     // corrections: the session must be a capture, and the record aimed at must
     // not be a derived one.
-    const evidenceRefusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(req.body?.recordId)
+    const evidenceRefusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(req.body?.recordId) ?? sourceRevisionRefusal(sessionId, req.body)
     if (evidenceRefusal) {
       res.status(evidenceRefusal.status).json(evidenceRefusal.body)
       return
@@ -1235,7 +1277,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     // A merged G2 session is NOT refused here: it is a real capture with real
     // audio, and relabelling it is how its profile gets better. Only an imported
     // or derived IDENTITY is refused.
-    const evidenceRefusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(req.body?.recordId) ?? finalizingRefusal(sessionId)
+    const evidenceRefusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(req.body?.recordId) ?? sourceRevisionRefusal(sessionId, req.body) ?? finalizingRefusal(sessionId)
     if (evidenceRefusal) {
       res.status(evidenceRefusal.status).json(evidenceRefusal.body)
       return
@@ -1478,7 +1520,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
       return
     }
-    const evidenceRefusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(req.body?.recordId)
+    const evidenceRefusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(req.body?.recordId) ?? sourceRevisionRefusal(sessionId, req.body)
     if (evidenceRefusal) {
       res.status(evidenceRefusal.status).json(evidenceRefusal.body)
       return
@@ -1569,7 +1611,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
       return
     }
-    const evidenceRefusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(req.body?.recordId) ?? finalizingRefusal(sessionId)
+    const evidenceRefusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(req.body?.recordId) ?? sourceRevisionRefusal(sessionId, req.body) ?? finalizingRefusal(sessionId)
     if (evidenceRefusal) {
       res.status(evidenceRefusal.status).json(evidenceRefusal.body)
       return

package/server/routes/prompt-drafts.ts

@@ -1,3 +1,4 @@
+import { isDictationCleanModel, type DictationCleanModel } from '../lib/dictation-clean-models.js'
 import { Router } from 'express'
 import { createHash } from 'node:crypto'
 import type { Response } from 'express'
@@ -75,7 +76,11 @@ function speculativeHqWarmEnabled(): boolean {
   return !['0', 'false', 'off'].includes((process.env.COS_HQ_SPECULATIVE_WARM ?? '1').toLowerCase())
 }
 
-const autoCleanBreaker = createBreaker({ label: 'dictation-autoclean' })
+const autoCleanBreakers = {
+  sonnet: createBreaker({ label: 'dictation-autoclean-sonnet' }),
+  'luna-5.6-fast': createBreaker({ label: 'dictation-autoclean-luna' }),
+  haiku: createBreaker({ label: 'dictation-autoclean-haiku' }),
+}
 const autoCleanCountFile = () => process.env.COS_DICTATION_AUTOCLEAN_COUNT_FILE || dataPath('.dictation_autoclean_count.json')
 const autoCleanDefaultEnabled = () => ['1', 'true', 'on'].includes((process.env.COS_DICTATION_AUTOCLEAN ?? '').toLowerCase())
 const autoCleanDailyCap = () => {
@@ -97,12 +102,14 @@ function recordAutoCleanCall(): void {
   } catch {}
 }
 
-interface AutoCleanRequest { enabled?: boolean; model?: 'haiku' | 'sonnet' }
+interface AutoCleanRequest { enabled?: boolean; model?: DictationCleanModel }
 function routeAutoClean(req: { body?: any; query?: any }): AutoCleanRequest {
   const rawEnabled = req.body?.autoclean ?? req.query?.autoclean
   const enabled = rawEnabled === undefined ? undefined : ['1', 'true', 'on'].includes(String(rawEnabled).toLowerCase())
   const rawModel = String(req.body?.autocleanModel ?? req.query?.autocleanModel ?? '').toLowerCase()
-  return { enabled, model: rawModel === 'sonnet' ? 'sonnet' : rawModel === 'haiku' ? 'haiku' : undefined }
+  // An unknown model must never silently select another provider.
+  if (rawModel && !isDictationCleanModel(rawModel)) return { enabled: false }
+  return { enabled, model: isDictationCleanModel(rawModel) ? rawModel : undefined }
 }
 
 async function cleanOutboundDictation(text: string, opts: AutoCleanRequest & { signal?: AbortSignal }): Promise<string> {
@@ -129,9 +136,10 @@ async function cleanOutboundDictation(text: string, opts: AutoCleanRequest & { s
     console.warn(`[prompt-draft] Fuzzy correction failed (non-fatal): ${fuzzyErr?.message ?? fuzzyErr}`)
   }
   if (!(opts.enabled ?? autoCleanDefaultEnabled())) return cleaned
+  const model = opts.model ?? 'sonnet'
+  const autoCleanBreaker = autoCleanBreakers[model]
   if (cleaned.length > AUTOCLEAN_MAX_CHARS || autoCleanBreaker.isOpen() || autoCleanCountToday() >= autoCleanDailyCap()) return cleaned
   const startedAt = Date.now()
-  const model = opts.model === 'sonnet' ? 'sonnet' : 'haiku'
   recordAutoCleanCall()
   try {
     const polished = (await autoCleanDictation(cleaned, getVocabulary(), { model, signal: opts.signal })).trim()
@@ -162,7 +170,7 @@ promptDraftsRouter.post('/dictation/finalize', async (req, res) => {
   if (surface !== 'message' && surface !== 'meeting') {
     return res.status(400).json({ error: 'invalid_surface' })
   }
-  if (model !== undefined && model !== 'haiku' && model !== 'sonnet') {
+  if (model !== undefined && !isDictationCleanModel(model)) {
     return res.status(400).json({ error: 'invalid_autoclean_model' })
   }
 

package/server/routes/query-jobs.ts

@@ -49,6 +49,8 @@ function wireError(error: unknown): { status: number; body: WireError } {
     || error instanceof QueryJobIdentityConflictError
     || error instanceof QueryJobActiveGenerationError
     || error instanceof QueryJobGenerationOrderError
+    // Since 6.61.3 admission never throws this (the fence holds a job at its start);
+    // kept so the store error map stays complete for any caller of markStarting.
     || error instanceof QueryJobProviderOrphanFenceError
     || error instanceof QueryJobAnswerCommittingError
     || error instanceof QueryJobNotTerminalError) status = 409

package/server/routes/work-board.ts

@@ -1,7 +1,7 @@
 import { Router } from 'express'
 import { readWorkJournal, projectWorkActivity, projectOpenWork, savedDestinationFor, controlSnapshotRevision,
   type WorkActivityCapabilities, type WorkActivityResult } from '../lib/work-activity.js'
-import { listBoard, workBoardCapabilities, setTaskWorkStage, linkTaskMeeting, TaskRunError, TaskBridgeError,
+import { listBoard, workBoardCapabilities, setTaskWorkStage, linkTaskMeeting, editWorkTask, TaskRunError, TaskBridgeError,
   WORK_STAGES, type WorkStage, type WorkMeetingRef, type TaskBoardRow } from '../lib/task-store.js'
 import { createWorkBoardReader, WORK_BOARD_READ_LIMITS, WorkBoardTimeoutError, type WorkBoardReader } from '../lib/work-board-reader.js'
 import type { MeetingDescriptor } from '../lib/work-review-store.js'
@@ -16,6 +16,7 @@ export interface WorkBoardDependencies {
   capabilities: typeof workBoardCapabilities
   stage: typeof setTaskWorkStage
   link: typeof linkTaskMeeting
+  edit: typeof editWorkTask
   resolveMeeting: (descriptor: MeetingDescriptor) => MeetingDetail | Promise<MeetingDetail>
   /** 6.59.0: the handoff request inbox as the glasses should see it (lib/work-handoff-requests.ts handoffRequestCapabilities). */
   requests: () => Pick<WorkActivityCapabilities, 'requests' | 'requestsInbox' | 'requestsConsumerSeenAt'>
@@ -24,7 +25,7 @@ export interface WorkBoardDependencies {
   now: () => number
 }
 const defaults: WorkBoardDependencies = { journal: () => readWorkJournal(), list: listBoard, capabilities: workBoardCapabilities,
-  stage: setTaskWorkStage, link: linkTaskMeeting, resolveMeeting: resolveSavedMeetingDetail,
+  stage: setTaskWorkStage, link: linkTaskMeeting, edit: editWorkTask, resolveMeeting: resolveSavedMeetingDetail,
   requests: () => ({ requests: 0, requestsInbox: 0, requestsConsumerSeenAt: null }), now: () => Date.now() }
 /** How old a board read the activity and open-work glances accept (the reader shares one read between them). */
 export const WORK_GLANCE_BOARD_AGE_MS = 10_000
@@ -87,10 +88,10 @@ export function createWorkBoardRouter(overrides: Partial<WorkBoardDependencies>
     }
     catch (e) { fail(res, e) }
   })
-  for (const action of ['stage', 'meeting'] as const) router.post('/work-board/' + action, async (req, res) => {
+  for (const action of ['stage', 'meeting', 'edit'] as const) router.post('/work-board/' + action, async (req, res) => {
     try {
       const body = req.body
-      const keys = ['domain', 'id', 'expectedText', 'expectedRevision', action === 'stage' ? 'workStage' : 'meeting']
+      const keys = ['domain', 'id', 'expectedText', 'expectedRevision', ...(action === 'edit' ? ['text', 'doneWhen'] : [action === 'stage' ? 'workStage' : 'meeting'])]
       if (!body || typeof body !== 'object' || Array.isArray(body) || Object.keys(body).some(k => !keys.includes(k))
         || Buffer.byteLength(JSON.stringify(body)) > 16_384 || !['domain','id','expectedText','expectedRevision'].every(k => typeof body[k] === 'string')
         || !isSafeDomainName(body.domain) || !/^[a-f0-9]{12}$/.test(body.id)
@@ -99,7 +100,14 @@ export function createWorkBoardRouter(overrides: Partial<WorkBoardDependencies>
       }
       const capability = await deps.capabilities()
       if (capability.version !== 1 || !capability.writable) throw new TaskRunError(409, 'work_board_read_only', 'The canonical task bridge needs a compatible update')
-      if (action === 'stage') {
+      if (action === 'edit') {
+        if (capability.editTasks !== 1) throw new TaskRunError(409, 'task_edit_unavailable', 'Update the canonical task bridge before editing task names')
+        if (typeof body.text !== 'string' || typeof body.doneWhen !== 'string') throw new TaskRunError(400, 'invalid_task_edit', 'Task name and finish line are required')
+        try {
+          const saved = await deps.edit(body.domain, body.id, body.text, body.doneWhen, body.expectedText, body.expectedRevision)
+          return res.json(saved)
+        } finally { board.invalidate() }
+      } else if (action === 'stage') {
         if (!WORK_STAGES.includes(body.workStage as WorkStage)) throw new TaskRunError(422, 'invalid_work_stage', 'Choose a valid Work stage')
         // The glasses' shared board read must not serve the board as it was before this write.
         try { await deps.stage(body.domain, body.id, body.workStage, body.expectedText, body.expectedRevision) } finally { board.invalidate() }

package/work-task-runtime/manifest.json

@@ -2,14 +2,14 @@
   "version": 1,
   "protocol": "cos-control-task-write/1",
   "pythonMinimum": "3.10",
-  "sourceCommit": "177d0bd875f446f5e3d57de52983d5ab4e679915",
+  "sourceCommit": "2fd2be86f072781adc9ca856194325ea263858ae",
   "sourceHashes": {
     "task_rows.py": "58b568fd4081072eddc3110b4c3397f5e5048ede9e052391e1d09f919e8c2e7d",
-    "task_write.py": "4d1d4c51cf5ec6fa75f941c2ce1aee05952fde9a6bac89be4fca51b0ffd37981",
+    "task_write.py": "fb618ba4a75cdd40859587cf0d74b5d5c8d005c0cc0eaab3573412ac028171a1",
     "task_work_metadata.py": "534c45910e2109ac1e18eeb236c6b286d8a899f96c7a153d0187aee5839854a5",
     "task_checkout.py": "56c94c5b28282398abc1f8daea9d910e64228afb8ac8cfae89b54117a7e30b86",
     "cos_atomic.py": "055f7d6bc3093aeec7b051f87cb68c543637603a538f383a614c1903bd1b503e",
-    "cos_api_bridge.py": "1e17960332e8b778c8e5923de355f4395c9244692cd4d988ccd944c6a30575ef",
+    "cos_api_bridge.py": "539cd27d3929d46205cfa77482b0d5f3e8d9385d0fc839cce7bdcd5437c7b2fd",
     "task_dedup.py": "5331fdea01c293ecd2773726acea110e9339ff26e72e5bcdce66777ab518bfe8"
   },
   "adaptations": [
@@ -22,12 +22,12 @@
   "files": {
     "cos_atomic.py": "0da53eecaf07331b008c10b1e06c39701ecc3291c511fd0779e35795b3b22534",
     "runtime_io.py": "e5b191b6af3a4966f517ecd05d3dcae9f4136a9e99cf36d7102303ca55ae928d",
-    "task_bridge.py": "8ec1f6533710c3de2c51e518586d2f6b120f90f7c3773480a08d53544ac07fd4",
+    "task_bridge.py": "45d5afcfa3b951b6ed3143a636ef6f36c49de1394728280b1ff7bfe7cd138006",
     "task_checkout.py": "669af045b2f64b9879df03aacae7a4550b46291974ed2df2ba2ed0775c1be78f",
-    "task_commands.py": "7e843b9164112d610190385df8e41d6044d6546d4ece92d09a60b6e4ad33cc75",
+    "task_commands.py": "b020b8249cbbf91661f63dd660b10994fe01b91bad1dfa9f92196cc94782cc6d",
     "task_dedup.py": "745971722898a3de520f8bb5246d714c70f3189dbe53bf8f42feafaaf241a51b",
     "task_rows.py": "9e48375d9d6ee5d29bf3cc1f92bdf1182a6eea40ee305ff1fe1632b9f3a9fcf7",
     "task_work_metadata.py": "534c45910e2109ac1e18eeb236c6b286d8a899f96c7a153d0187aee5839854a5",
-    "task_write.py": "238b869fac49c8e01bca72a1f28ffab74c7f94938e2323246936aec0241bbd16"
+    "task_write.py": "6aea995bd213515eaae00e6e9dae16d77c7de579151fe6a717e6ad9e83b7db63"
   }
 }

package/work-task-runtime/task_bridge.py

@@ -31,7 +31,7 @@ def main():
     raw=sys.stdin.buffer.read(32769)
     if len(raw)>32768: raise ValueError('Task input exceeds supported limit')
     sys.stdin=io.StringIO(raw.decode('utf-8'))
-    commands={'task-rows':'cmd_task_rows','task-capture':'cmd_task_capture','task-set-text':'cmd_task_set_text','task-set-run-at':'cmd_task_set_run_at','task-set-marker':'cmd_task_set_marker','task-set-stage':'cmd_task_set_stage','task-set-done-when':'cmd_task_set_done_when','task-move':'cmd_task_move','task-check':'cmd_task_check','task-set-work-stage':'cmd_task_work_write','task-link-meeting':'cmd_task_work_write'}
+    commands={'task-rows':'cmd_task_rows','task-capture':'cmd_task_capture','task-set-text':'cmd_task_set_text','task-set-run-at':'cmd_task_set_run_at','task-set-marker':'cmd_task_set_marker','task-set-stage':'cmd_task_set_stage','task-set-done-when':'cmd_task_set_done_when','task-move':'cmd_task_move','task-check':'cmd_task_check','task-set-work-stage':'cmd_task_work_write','task-link-meeting':'cmd_task_work_write','task-edit-work':'cmd_task_work_write'}
     if opts.command not in commands and opts.command!='task-work-capabilities': raise ValueError('Unsupported task command')
     rootfd=directory(opts.root,create=True); domainfds={}; lockfd=None
     try:
@@ -68,13 +68,14 @@ def main():
             original_write(domain,identity,path,text)
         task_write._guarded_write=guarded
         import task_commands
-        if opts.command=='task-work-capabilities': print(json.dumps({'version':1,'protocol':'cos-control-task-write/1'}));return
+        if opts.command=='task-work-capabilities': print(json.dumps({'version':1,'protocol':'cos-control-task-write/1','editTasks':1}));return
         if not opts.args or opts.args[0] not in domains: raise ValueError('Unknown task domain')
         path=domain_path(opts.args[0])
         try: safe_read_text(path)
         except FileNotFoundError: pass
         fn=getattr(task_commands,commands[opts.command])
         if opts.command=='task-link-meeting':fn(opts.args,linking=True)
+        elif opts.command=='task-edit-work':fn(opts.args,editing=True)
         else:fn(opts.args)
     finally:
         for fd in domainfds.values():os.close(fd)

package/work-task-runtime/task_commands.py

@@ -132,12 +132,12 @@ def cmd_task_set_text(args):
         return
     print(json.dumps({"ok": True}))
 
-def cmd_task_work_write(args, *, linking=False):
-    from task_write import set_work_stage, link_meeting
+def cmd_task_work_write(args, *, linking=False, editing=False):
+    from task_write import set_work_stage, link_meeting, edit_work_task
     domain = _bridge_domain(args)
     if domain is None:
         return
-    if len(args) != (2 if linking else 3):
+    if len(args) != (2 if linking or editing else 3):
         _bridge_error("argv_required", "Expected domain, task ID, and phase for stage writes.")
         return
     try:
@@ -147,20 +147,24 @@ def cmd_task_work_write(args, *, linking=False):
         body = json.loads(raw)
         if not isinstance(body, dict) or not isinstance(body.get("expectedText"), str) or not isinstance(body.get("expectedRevision"), str):
             raise ValueError()
-        allowed = {"expectedText", "expectedRevision", "meeting", "removeRecordId"} if linking else {"expectedText", "expectedRevision"}
+        allowed = {"expectedText", "expectedRevision", "text", "doneWhen"} if editing else {"expectedText", "expectedRevision", "meeting", "removeRecordId"} if linking else {"expectedText", "expectedRevision"}
         if set(body) - allowed:
             raise ValueError()
+        if editing and (not isinstance(body.get("text"), str) or not isinstance(body.get("doneWhen"), str)):
+            raise ValueError()
     except (ValueError, TypeError):
         _bridge_error("invalid_work_request", "Bounded JSON with expectedText and expectedRevision is required.")
         return
-    if linking:
+    if editing:
+        ok = _bridge_write(lambda: edit_work_task(domain, args[1], body["text"], body["doneWhen"], expected_text=body["expectedText"], expected_revision=body["expectedRevision"]))
+    elif linking:
         ok = _bridge_write(lambda: link_meeting(domain, args[1], expected_text=body["expectedText"], expected_revision=body["expectedRevision"], meeting=body.get("meeting"), remove_record_id=body.get("removeRecordId")))
     else:
         ok = _bridge_write(lambda: set_work_stage(domain, args[1], args[2], expected_text=body["expectedText"], expected_revision=body["expectedRevision"]))
     if ok is False:
         _bridge_error("task_not_found", "Task not found in this domain.")
     elif ok is not None:
-        print(json.dumps({"ok": True}))
+        print(json.dumps(ok if editing else {"ok": True}))
 
 def cmd_task_set_stage(args):
     """Move a task between board stages. Clearing returns it to planning, which

package/work-task-runtime/task_write.py

@@ -24,6 +24,7 @@ from task_rows import (
     classify_heading,
     domain_path,
     parse_path,
+    parse_owner,
     split_source,
     split_done_when,
     STAGES,
@@ -576,7 +577,106 @@ def check(domain: str, task_id: Optional[str] = None, *, text: Optional[str] = N
 LockStoreCorrupt = LockStoreCorrupt
 
 
-def _work_mutation(domain: str, task_id: str, expected_text: str, expected_revision: str, change) -> bool:
+def _probe_rows(full: str, line: str) -> list:
+    """Parse one rebuilt line exactly as parse_path will, in a scratch file, before it touches tasks.md."""
+    import tempfile
+    with tempfile.TemporaryDirectory() as scratch:
+        probe = Path(scratch) / "tasks.md"
+        probe.write_text("## INBOX\n" + line + "\n")
+        return parse_path(probe, full)
+
+
+def capture_work_item(domain: str, text: str, *, meeting, phase: str = "mentioned") -> dict:
+    """Create one Work card from a meeting action item, linked to that meeting, in ONE locked write.
+
+    The row lands at the top of INBOX as `<text> — **Source:** <meeting title> [<date>]` carrying
+    `workflowPhase` and the exact meeting reference, so no second write is needed to link it.
+
+    Never a second copy. Task ids are sha256(domain|normalized text|ordinal), so a copy inserted
+    above an existing row would silently shift that row's id; and a renamed card keeps its first id
+    as its Work identity, so recapturing the old wording would duplicate that identity and lock both
+    rows. Either kind of match returns the existing row instead: `created` False, `linked` says
+    whether it already carries this meeting, and checked/archived/delegated describe its state.
+    The rebuilt line is parsed in isolation first and refused unless it reads back as exactly this
+    text, meeting and phase (the parser drops leading owners, [REVIEW], a trailing dash, comments).
+    """
+    from task_dedup import TaskDeduplicator
+
+    text = " ".join(text.split()) if isinstance(text, str) else ""
+    if not text or len(text) > 2000:
+        raise WorkMetadataError("invalid_task_text", "Card text must be 1 to 2,000 characters.")
+    try:
+        reject_marker_text(text, "task text")
+    except WorkMetadataError:
+        raise
+    except ValueError as exc:
+        raise WorkMetadataError("invalid_task_text", str(exc)) from exc
+    meeting = validate_meeting(meeting)
+    if phase not in PHASES:
+        raise WorkMetadataError("invalid_work_stage", "Unknown Work phase.")
+    full = _full_domain(domain)
+    path = domain_path(full)
+    date = meeting["filename"][:10] if re.match(r"\d{4}-\d{2}-\d{2}_", meeting["filename"]) else datetime.now().strftime("%Y-%m-%d")
+    title = re.sub(r"[\[\]*]", "", meeting["title"]).strip() or "Meeting"
+    line = _rebuild_line(text, write_source(f"{title} [{date}]", {"workflowPhase": phase, "meetingRefs": [meeting]}),
+                         None, None, None, False, False)
+    probe = _probe_rows(full, line)
+    if (len(probe) != 1 or probe[0].description != text or probe[0].work_metadata_error
+            or probe[0].meeting_refs != [meeting] or probe[0].work_stage != phase):
+        raise WorkMetadataError("invalid_task_text", "This text would not read back as the same card.")
+    norm, candidate = TaskDeduplicator.normalize(text), probe[0].id
+    if not norm:
+        raise WorkMetadataError("invalid_task_text", "Card text has no words.")
+    with file_lock(full) as identity:
+        same = [r for r in parse_path(path, full)
+                if TaskDeduplicator.normalize(r.description) == norm or candidate in (r.id, r.work_identity)]
+        if same:
+            row = next((r for r in same if any(ref["recordId"] == meeting["recordId"] for ref in r.meeting_refs)), same[0])
+            return {"ok": True, "created": False, "id": row.id,
+                    "linked": any(ref["recordId"] == meeting["recordId"] for ref in row.meeting_refs),
+                    "checked": row.is_checked, "archived": row.archived, "delegated": row.delegated}
+        lines = safe_read_text(path).splitlines() if path.exists() else []
+        lines, heading_idx, _ = _locked_ensure_section(lines, "inbox")
+        _top_insert(lines, heading_idx, line)
+        _guarded_write(full, identity, path, "\n".join(lines) + "\n")
+        created = [r for r in parse_path(path, full) if r.id == candidate]
+    if len(created) != 1 or created[0].meeting_refs != [meeting]:
+        raise WorkMetadataError("capture_unverified", "The new card could not be read back exactly once.")
+    return {"ok": True, "created": True, "id": candidate, "linked": True,
+            "checked": False, "archived": False, "delegated": created[0].delegated}
+
+
+def archive_work_item(domain: str, task_id: str, *, record_id: str, expected_text: Optional[str] = None) -> str:
+    """Undo for capture_work_item: archive ([~]) the card only while it is still untouched.
+
+    Untouched means open and still Mentioned (so not completed or moved to another stage), no run or agent
+    marker, no finish line, linked to exactly the one meeting it was created from, and, when `expected_text`
+    is given, still worded as written. Anything else is left alone. A move between sections is not checked.
+    Returns archived | already_archived | changed | absent.
+    """
+    if not isinstance(task_id, str) or not re.fullmatch(r"[a-f0-9]{12}", task_id):
+        raise WorkMetadataError("invalid_task_id", "An exact canonical task ID is required.")
+    full = _full_domain(domain)
+    path = domain_path(full)
+    with file_lock(full) as identity:
+        matches = [r for r in parse_path(path, full) if r.id == task_id]
+        if len(matches) != 1:
+            return "absent"
+        row = matches[0]
+        if row.archived:
+            return "already_archived"
+        if (row.work_stage != "mentioned" or row.run_at or row.agent_state or row.done_when
+                or [ref["recordId"] for ref in row.meeting_refs] != [record_id]
+                or (expected_text is not None and row.description != expected_text)):
+            return "changed"
+        result = _rewrite_row(path, full, task_id, lambda state: state.update(archived=True))
+        if result is False:
+            return "absent"
+        _guarded_write(full, identity, path, result[1])
+        return "archived"
+
+
+def _work_mutation(domain: str, task_id: str, expected_text: str, expected_revision: str, change, *, return_row=False):
     if not isinstance(expected_text, str) or not expected_text or len(expected_text) > 20_000:
         raise WorkMetadataError("expected_text_required", "Full current task text is required.")
     if not isinstance(task_id, str) or not re.fullmatch(r"[a-f0-9]{12}", task_id):
@@ -612,9 +712,39 @@ def _work_mutation(domain: str, task_id: str, expected_text: str, expected_revis
             return False
         _, contents = result
         _guarded_write(full, identity, path, contents)
+        if return_row:
+            # Still under the file lock: the response describes this exact commit.
+            row = next(r for r in parse_path(path, full) if r.line_number == target.line_number)
+            return {"ok": True, "id": row.id, "workIdentity": row.work_identity,
+                    "workRevision": row.work_revision, "text": row.description,
+                    "doneWhen": row.done_when or ""}
         return True
 
 
+def edit_work_task(domain: str, task_id: str, text: str, done_when: str, *, expected_text: str, expected_revision: str):
+    """One guarded replacement for task name and finish line; preserve Work identity."""
+    if not isinstance(text, str) or not isinstance(done_when, str):
+        raise ValueError("Task name and finish line must be text")
+    clean = " ".join(text.split())
+    finish = " ".join(done_when.split())
+    if not clean or len(clean.encode("utf-16-le")) // 2 > 2000:
+        raise ValueError("Task name must contain 1 to 2,000 characters")
+    if len(finish.encode("utf-16-le")) // 2 > 500 or "**" in finish:
+        raise ValueError("Finish line must be at most 500 characters without ** markup")
+    reject_marker_text(clean, "task text")
+    reject_marker_text(finish, "done_when")
+    if parse_owner(clean)[0] is not None or "[REVIEW]" in clean:
+        raise WorkMetadataError("reserved_task_name", "Task names cannot contain an owner prefix or the reserved [REVIEW] flag.")
+
+    def change(state, metadata):
+        if state["agent_state"] == "running":
+            raise TaskRunning("This task is already running; its name cannot change during the run")
+        state["description"] = clean
+        state["done_when"] = finish or None
+
+    return _work_mutation(domain, task_id, expected_text, expected_revision, change, return_row=True)
+
+
 def set_work_stage(domain: str, task_id: str, phase: str, *, expected_text: str, expected_revision: str) -> bool:
     if phase not in (*PHASES, 'complete'):
         raise WorkMetadataError("invalid_work_stage", "Unknown Work phase.")