@gotcos/glasses-server 6.64.0 → 6.65.0

package/CHANGELOG.md

@@ -1,3 +1,22 @@
+## 6.65.0 — 2026-10-07 — Work search by meaning, and task dates
+
+- `POST /api/work/search` `{ query, domain?, scope?, ids? }` finds the Work card the user means, not only the words they typed. Pairs with COS Control 0.5.259, which shows its own word matches at once and asks this after a pause.
+  - One Jev Choice per search over the board's own cards, plus `none`. The client names a view or exact card ids, never task text. A domain board searches that domain's cards, open and completed. All work searches open cards only, although Control's All work view also shows completed ones. Completed searches completed cards. Needs attention and In progress send their card ids.
+  - What goes to TypeSafe: each card's task text, on one line, at most 300 characters, without `[Work details](…)` links. URLs, email addresses and opaque ids (the shape of a key or a document id) are removed, credentials are masked by the server's secret redaction, and a markdown link keeps only its label. A bare domain such as bottlepos.com stays.
+  - The query is 2 to 200 characters, counted in code points, so 150 emoji are 150.
+  - The answer is `{ available: true, results: [{ id, p }], none, cached, tokens }`: cards at p 0.02 or more, most likely first, at most 20.
+  - When it cannot search it answers HTTP 200 with `{ available: false, reason, message }`. The reasons are `jev_not_configured`, `jev_key_rejected`, `jev_cap_reached`, `jev_breaker_open`, `jev_request_rejected` (Jev refused the request: a 400, 413 or 422), `jev_unavailable` (no answer, a 5xx, or a malformed answer), `search_off` and `too_many_candidates`. A Choice holds 254 cards, so a bigger set is refused, never cut; Completed across all domains is 198 cards today. Control keeps its word search in every case. The server logs each reason at most once per 10 minutes.
+  - Its own cost controls, apart from Work intake and session advice. A daily cap of 1,000,000 input tokens (`COS_JEV_SEARCH_DAILY_TOKENS`), about 110 to 200 searches by board size, with its own ledger (`<data>/jev-search-usage.json`); it resets at midnight UTC. Its own breaker: 3 failures, then an hour; a refused request does not count, because the same cards would be refused again. A switch, `COS_JEV_SEARCH=0`. Both come from the server's environment, so changing them takes a restart. Saving a new TypeSafe key clears this breaker too. `COS_JEV_DAILY_TOKENS` is unchanged.
+  - The same query over the same cards is answered from memory for 10 minutes (up to 200 searches).
+  - Search is read-only, so it does not take the server's request lease: an update or restart never waits on a search, and a search during one is answered rather than refused.
+  - Measured on 2026-10-06 on the live board (293 cards, 95 open): 4 searches, the right card first at p 0.99 for each of 3 real queries, `none` at 1 for an unrelated one, 4,815 to 4,963 input tokens and 268 to 431 ms each including the board read. The repeat came from the cache with no call.
+- `GET /api/tasks` and `GET /api/work-board` rows carry `createdOn` (`YYYY-MM-DD` or null), `createdFrom` (`source`, `git` or null) and `lineChangedAt` (ISO time or null), for Control's date orders. Control reads `/api/work-board` for its Work board, so both routes carry them. Additive: every existing field and the task revision are unchanged, and the fields are present as null when unknown, so a client can tell this server from an older one.
+  - `createdOn` is the first date in the task's source label, usually the meeting date. Otherwise it is the day the task's words first appeared in the git history of its `tasks.md`, cached on disk (`<data>/task-created-dates.json`, at most 5,000) by file and a hash of the words. A lookup that times out or fails is not cached as "not in history"; it is tried again after 10 minutes.
+  - `lineChangedAt` is when git last changed the task's line (blame, once per HEAD and file change). A line that is not committed yet is null, never "now". tasks.md is committed by the COS sync every one to three days, so this is later than the real change.
+  - Every read of either route, the phone's and the glasses' included, keeps all of its git work inside 1.5 s, half the phone's 4 s timeout less an allowance for the board read. Past that the dates still unknown come back null and the git work finishes in the background for a later read.
+  - Read-only: nothing is written into tasks.md. Git runs only when a `.git` exists at or above the `tasks.md` folder. A public install keeps its tasks outside any repository, so no git process starts. If the home folder is itself a git repository, git does run, finds `tasks.md` untracked, and the git fields stay null. Both the COS bridge and the packaged task runtime get the fields.
+  - Measured on 2026-10-06 on the live board (293 cards, a read-only scratch run): 241 dated from the source label, 52 from git, none without a date; 278 with `lineChangedAt` (the other 15 are not committed yet). The first call took 1.2 s (68 git lookups), later calls about 20 ms, and a restart 74 ms with no git history lookup.
+
 ## 6.64.0 — 2026-10-06 — Meeting context keys
 
 - Meeting rows and details carry `contextKeys`, `contextSupported`, and, when files can't be added, `contextReason` (plus `contextAmbiguous`). The fields are additive and read-only. They are the keys COS Control 0.5.258 files a meeting's dropped screenshots, slides and documents under, so the files go to every Work card linked to the meeting.

package/docs/work-intake.md

@@ -35,6 +35,8 @@ Since 6.57.1 `POST /api/work-board/session-recommendation` also takes exactly `{
 
 Since 6.58.0 `POST /api/work-board/completion-check` takes exactly `{ domain, id, provider, sessionId }` plus an optional `after` (ISO time). It asks Jev whether the session's replies since `after` (or its newest reply) show the task finished, judged against its Done when or, without one, its own text. The server reads the task from the board and the replies from its own transcripts; the client sends names and a time only. It answers `{ provider: "jev", verdict: "done" | "not_done" | "unclear", confidence, basis: "done_when" | "task", model, cached }` or `{ provider: "none", reason }` (`no_reply`, `no_task_text`, a Jev condition, `completion_unavailable`). Errors: 400 `invalid_completion_request`, 404 `task_not_found`, 404 `session_not_found`. COS Control 0.5.247 asks only while the session is idle and its newest reply since the handoff has no `COS-WORK` status line, at most twice per handoff, and moves a card to QA only on done at 0.8 (0.85 without a Done when).
 
+Since 6.65.0 `POST /api/work/search` takes `{ query, domain?, scope?, ids? }`: a query of 2 to 200 characters (code points), an optional domain, an optional scope (`all`, `attention`, `progress` or `completed`) and optional card ids (12 hex). It asks Jev one Choice over the board's own cards, plus `none`, and answers `{ available: true, results: [{ id, p }], none, cached, tokens }` with cards at p 0.02 or more, most likely first, at most 20. Exact ids win (Control sends them for Needs attention and In progress). Otherwise a domain board covers that domain's cards, All work its open cards, and Completed its completed cards. Each card goes to TypeSafe as its task text without `[Work details](…)` links, URLs, email addresses or opaque ids, with credentials masked by the server's secret redaction, at most 300 characters. A search that cannot run answers 200 with `{ available: false, reason, message }`: `jev_not_configured`, `jev_key_rejected`, `jev_cap_reached`, `jev_breaker_open`, `jev_request_rejected` (a 400, 413 or 422 from Jev; not counted toward the breaker), `jev_unavailable`, `search_off` (`COS_JEV_SEARCH=0`) or `too_many_candidates` (more than 254 cards). Errors: 400 `invalid_search_request`, 503 `work_board_unavailable`. Search has its own daily cap (`COS_JEV_SEARCH_DAILY_TOKENS`, default 1,000,000, reset at midnight UTC), ledger (`data/jev-search-usage.json`) and breaker, so it never spends the cap Work intake and session advice share; the switch and the cap are read from the environment set at start, so a change takes a restart. The same query over the same cards is answered from memory for 10 minutes. The route is read-only and does not take the server's request lease.
+
 Since 6.58.2 `POST /api/query-jobs` also takes an optional `sessionName` (a string; the server cleans it as the 6.58.2 changelog says and keeps at most 100 characters; anything else is no name, never an error). It names only a Claude session the job starts itself (`claude --name=<name>`, when the installed CLI lists `--name`); a Continue, a dispatch, a Codex, Cursor or Ollama job, and an older server ignore it, and it is not part of the request fingerprint. A Claude job's snapshot carries `cliSessionId` from Claude's first stream event while the job is still `running`, not only at completion. COS Control 0.5.250 sends the Work item's title for New session, Start work and Fork to Claude, and links its receipt as soon as the running job names the session.
 
 Since 6.59.0 `GET /api/work-board/activity` also projects each handoff's progress (the report, its evidence of at most 280 characters, the newest move), the task's own revision and a saved destination, `GET /api/work-board/activity/open` lists every open handoff across the board, and `POST /api/work-board/handoff-requests` lets the glasses ask COS Control to start Work, reply, or say it is not done yet, which Control claims on this Mac and sends with its own guards. The server runs no provider and no Jev for any of it. See `docs/work-handoff-requests.md`.

package/docs/work-task-runtime.md

@@ -30,6 +30,17 @@ single-command child pins its domain as cwd instead of relying on unsupported
 atomic replacement writes use exclusive no-follow temporary files. Same-user
 modification of the installed package/manifest is outside this integrity boundary.
 
+Since 6.65.0 `GET /api/tasks` and `GET /api/work-board` rows also carry `createdOn`,
+`createdFrom` and `lineChangedAt`, for both the COS bridge and this runtime. The server reads them; the
+runtime does not. `createdOn` is the first `YYYY-MM-DD` in the source label, else the
+day the task's words first appeared in the git history of its `tasks.md`.
+`lineChangedAt` is the git blame time of a committed line. Each is null when unknown,
+including every git-derived value when no git repository tracks the `tasks.md`.
+All git work for one read (rev-parse, blame, first-seen lookups) shares a 1.5 s
+deadline; what is still unknown then comes back null, and the git work finishes in the
+background for a later read. Git runs only when a `.git` exists at or above the
+`tasks.md` folder. Nothing is written into `tasks.md`.
+
 The default lock namespace remains `~/Library/Application Support/COS/.task_locks.json`
 and canonical `file:<domain>` entries. `COS_TASK_LOCK_STORE` is an explicit override
 for isolated fixtures. Existing COS bridge calls keep their original environment

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.64.0",
+  "version": "6.65.0",
   "description": "COS Glasses: self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {
@@ -46,6 +46,7 @@
     "!server/scripts/work-review-mutation-gate.mjs",
     "!server/scripts/work-intake-mutation-gate.mjs",
     "!server/scripts/work-progress-mutation-gate.mjs",
+    "!server/scripts/work-search-mutation-gate.mjs",
     "!server/scripts/away-hold-mutation-gate.mjs",
     "!server/scripts/nemotron-mutation-gate.mjs",
     "!server/scripts/merged-scribe-mutation-gate.mjs",

package/server/index.ts

@@ -142,6 +142,8 @@ import { createWorkBoardRouter } from './routes/work-board.js'
 import { createWorkIntakeRouter } from './routes/work-intake.js'
 import { createWorkHandoffRequestsRouter } from './routes/work-handoff-requests.js'
 import { createJevRouter } from './routes/jev.js'
+import { createWorkSearchRouter } from './routes/work-search.js'
+import { isReadOnlyApiPost } from './lib/work-search.js'
 import { dataPath } from './lib/data-dir.js'
 import { loadJsonOrQuarantine, durableAtomicWriteFileSync } from './lib/atomic-fs.js'
 import { WorkIntakeStore, createOptionalWorkIntakeStore } from './lib/work-intake-store.js'
@@ -324,6 +326,9 @@ app.use('/api', requireApiToken(API_TOKEN))
 // through their true terminal boundary.
 app.use('/api', (req, res, next) => {
   if (req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS') return next()
+  // 6.65.0: a POST that only reads (Work search: a board read and one Jev question) is not a mutation. See
+  // lib/work-search.ts isReadOnlyApiPost for why holding the lease would hurt and why skipping it is safe.
+  if (isReadOnlyApiPost(req.method, req.path)) return next()
   // V2 video original chunks are bounded to the advertised session size (1 MiB
   // on new sessions, 256 KiB on leftover drafts) and commit through the upload
   // registry's own generation lock. Holding the global mutation lease while
@@ -756,6 +761,8 @@ app.use('/api', createWorkIntakeRouter({ store: workIntakeStore }))
 // Jev key (Control Settings), Continue/Fork/New session recommendations for Work tasks (6.57.0) and meeting reviews
 // (6.57.1), and the Work completion check (6.58.0).
 app.use('/api', createJevRouter(workReviewRuntime ? { review: async id => workReviewRuntime.peek(id) } : {}))
+// Work search by meaning (6.65.0, Control 0.5.259): one Jev Choice over the board's cards, with its own cap, switch and breaker.
+app.use('/api', createWorkSearchRouter())
 app.use('/api', queryRouter)
 // The scheduled start-of-day brief: settings, status, run-now. Same auth as
 // every other settings route; the brief itself is an ordinary durable job.

package/server/lib/jev.ts

@@ -88,8 +88,10 @@ export class JevClient {
   private failures = 0
   private breakerUntil = 0
   private lastError: string | null = null
+  /** `cap` is the daily input-token cap for THIS client's ledger. Work search (6.65.0) passes its own; the default is
+   *  COS_JEV_DAILY_TOKENS, shared by Work intake advice, session recommendations and completion checks. */
   constructor(private readonly fetchImpl: Fetch = fetch, private readonly now: () => Date = () => new Date(),
-              private readonly usageFile = JEV_USAGE_FILE) {}
+              private readonly usageFile = JEV_USAGE_FILE, private readonly cap: () => number = dailyCap) {}
 
   usedToday(): number {
     try {
@@ -121,7 +123,7 @@ export class JevClient {
   status(): { configured: boolean; source: JevKeySource; savedAt?: string; validatedAt?: string; usedToday: number; dailyCap: number; breakerOpenUntil: string | null; lastError: string | null } {
     const key = resolveJevKey()
     return { configured: !!key, source: key?.source ?? 'none', savedAt: key?.savedAt, validatedAt: key?.validatedAt,
-      usedToday: this.usedToday(), dailyCap: dailyCap(),
+      usedToday: this.usedToday(), dailyCap: this.cap(),
       breakerOpenUntil: this.breakerUntil > this.now().getTime() ? new Date(this.breakerUntil).toISOString() : null, lastError: this.lastError }
   }
 
@@ -130,7 +132,7 @@ export class JevClient {
     const key = resolveJevKey()
     if (!key) throw new JevError('jev_not_configured')
     if (this.breakerUntil > this.now().getTime()) throw new JevError('jev_breaker_open')
-    if (this.usedToday() + estimate > dailyCap()) this.fail('jev_cap_reached', false)
+    if (this.usedToday() + estimate > this.cap()) this.fail('jev_cap_reached', false)
     let res: Response
     try {
       res = await this.fetchImpl(`${JEV_ENDPOINT}/systemone`, { method: 'POST', signal: AbortSignal.timeout(JEV_LIMITS.timeoutMs),

package/server/lib/task-dates.ts

@@ -0,0 +1,369 @@
+/**
+ * When a Work task was created and when its line last changed (6.65.0, Control 0.5.259 "Newest created" and
+ * "Recent activity" orders). Read-only: nothing is ever written into tasks.md (canary C6).
+ *
+ * No task carries a creation time (0 of 293 on 2026-10-06), so the date is inferred, in this order:
+ *   1. createdOn from the source label: the first YYYY-MM-DD in it (241 of 293 live tasks carry one, usually the
+ *      meeting date). `createdFrom: 'source'`.
+ *   2. Else the day the task's text first appeared in the git history of its tasks.md
+ *      (`git log --reverse -S<text> -- tasks.md`, author date). `createdFrom: 'git'`. Each lookup is one git process,
+ *      so they are cached on disk by (file, text hash). A lookup that times out or fails is never cached as "not in
+ *      history"; it rests (TASK_DATE_LIMITS.lookupBackoffMs) and is tried again.
+ *   3. Else null.
+ * lineChangedAt is `git blame` of the line (author time), for committed lines only: an uncommitted line is null, never
+ * "now". tasks.md is auto-committed by the COS sync, so this is a coarse floor. Blame runs once per (HEAD, file mtime).
+ *
+ * Every dated read keeps ALL of its git work (rev-parse, blame, first-seen lookups) inside one deadline,
+ * TASK_DATE_LIMITS.deadlineMs (1.5 s, derived from the phone's 4 s request timeout below). Past it the read answers with
+ * what it has, and git work already started keeps running to fill the caches for a later read.
+ *
+ * Git runs only when a `.git` exists at or above the tasks.md folder. A public install keeps its tasks under
+ * ~/.cos-glasses/data, normally outside any repository, so no git process starts and the git-derived fields are null.
+ * If the home folder itself is a git repository, git does run: rev-parse on each dated read and blame once per HEAD or
+ * file change. Blame finds tasks.md untracked, so the git-derived fields stay null and no first-seen lookup runs.
+ */
+import { createHash } from 'node:crypto'
+import { execFile } from 'node:child_process'
+import { existsSync, mkdirSync, readFileSync, statSync } from 'node:fs'
+import { basename, dirname, join } from 'node:path'
+import { dataPath } from './data-dir.js'
+import { durableAtomicWriteFileSync } from './atomic-fs.js'
+
+export interface TaskDateFields {
+  /** 'YYYY-MM-DD' or null. */
+  createdOn: string | null
+  createdFrom: 'source' | 'git' | null
+  /** ISO time of the commit that last changed the task's line, or null (uncommitted, or no git). */
+  lineChangedAt: string | null
+}
+export const NO_TASK_DATES: Readonly<TaskDateFields> = Object.freeze({ createdOn: null, createdFrom: null, lineChangedAt: null })
+
+/**
+ * The phone and the glasses give up on a request after 4 s. A dated board read keeps all of its git work (rev-parse,
+ * blame, first-seen lookups) inside half of that, less an allowance for the board read itself (the task bridge answers
+ * in about 0.1 s) and the answer: 4,000 / 2 - 500 = 1,500 ms.
+ */
+const CLIENT_TIMEOUT_MS = 4_000
+const BOARD_READ_ALLOWANCE_MS = 500
+
+export const TASK_DATE_LIMITS = {
+  /** All git work for one request, overall. What does not finish keeps running and answers on a later call. */
+  deadlineMs: CLIENT_TIMEOUT_MS / 2 - BOARD_READ_ALLOWANCE_MS,
+  /** resolveTaskDatesWithin's grace past the deadline before it answers null dates for every row. */
+  answerSlackMs: 100,
+  /** One git process. It may outlive the request (it fills the caches); it is killed after this. */
+  gitTimeoutMs: 8_000,
+  /** A first-seen lookup that failed is not retried for this long; it is never cached as "not in history". */
+  lookupBackoffMs: 10 * 60_000,
+  /** A file whose rev-parse or blame timed out gets no git work for this long. */
+  fileBackoffMs: 60_000,
+  concurrency: 2,
+  cacheEntries: 5_000,
+  blameFiles: 32,
+  needleMin: 8,
+  needleMax: 200,
+  /** The leading characters of a task's text that must appear on its blamed line. */
+  guardChars: 40,
+} as const
+export const TASK_DATES_CACHE_FILE = dataPath('task-created-dates.json')
+
+/** What a bridge row offers (task-store.ts BridgeTaskRow). */
+export interface DateSourceRow { id: string; domain: string; line_number: number; source: string | null; description: string }
+export type DateGitRunner = (args: readonly string[], cwd: string, timeoutMs: number) => Promise<string>
+
+/** Homebrew's git first: `/usr/bin/git` without the developer tools opens an install dialog. */
+const GIT_BIN = ['/opt/homebrew/bin/git', '/usr/local/bin/git', '/usr/bin/git'].find(path => existsSync(path)) ?? '/usr/bin/git'
+export const realDateGitRunner: DateGitRunner = (args, cwd, timeoutMs) => new Promise((resolve, reject) => {
+  execFile(GIT_BIN, [...args], { cwd, timeout: timeoutMs, encoding: 'utf8', maxBuffer: 32 * 1024 * 1024,
+    env: { ...process.env, GIT_OPTIONAL_LOCKS: '0', GIT_TERMINAL_PROMPT: '0' } }, (error, stdout) => error ? reject(error) : resolve(String(stdout)))
+})
+
+export function taskDateKey(domain: string, id: string): string { return `${domain}\0${id}` }
+
+function isCalendarDay(day: string): boolean {
+  const at = new Date(`${day}T00:00:00Z`)
+  return !Number.isNaN(at.getTime()) && at.toISOString().slice(0, 10) === day
+}
+
+/** The first real YYYY-MM-DD in a source label. Link targets are not label text (a Work details token is base64). */
+export function sourceDate(source: string | null | undefined): string | null {
+  if (!source) return null
+  const label = source.replace(/\[([^\]]*)\]\([^)]*\)/g, '$1')
+  for (const match of label.matchAll(/20\d\d-\d\d-\d\d/g)) if (isCalendarDay(match[0])) return match[0]
+  return null
+}
+
+export interface BlameLine { content: string; at: string | null }
+/** `git blame --line-porcelain` output to line number -> content and author time (null for an uncommitted line). */
+export function parseBlamePorcelain(output: string): Map<number, BlameLine> {
+  const lines = new Map<number, BlameLine>()
+  let current: { sha: string; line: number; time: number | null } | null = null
+  for (const raw of output.split('\n')) {
+    if (raw.startsWith('\t')) {
+      if (current) {
+        const committed = !/^0+$/.test(current.sha) && current.time !== null && Number.isFinite(current.time)
+        lines.set(current.line, { content: raw.slice(1), at: committed ? new Date(current.time! * 1000).toISOString() : null })
+      }
+      current = null
+      continue
+    }
+    const head = /^([0-9a-f]{40}|[0-9a-f]{64}) \d+ (\d+)(?: \d+)?$/.exec(raw)
+    if (head) { current = { sha: head[1], line: Number(head[2]), time: null }; continue }
+    if (current && raw.startsWith('author-time ')) current.time = Number(raw.slice('author-time '.length))
+  }
+  return lines
+}
+
+/** The line still holds the task (the file can change between the board read and the blame). */
+export function lineHolds(content: string, description: string): boolean {
+  const probe = description.trim().slice(0, TASK_DATE_LIMITS.guardChars)
+  return probe.length > 0 && content.includes(probe)
+}
+
+/** The text to find in history: the task's own words (not its checkbox, source or markers, which change later). */
+export function pickaxeNeedle(description: string, content?: string): string | null {
+  const text = description.trim()
+  if (text.length < TASK_DATE_LIMITS.needleMin || text.includes('\0')) return null
+  const full = text.slice(0, TASK_DATE_LIMITS.needleMax)
+  if (!content || content.includes(full)) return full
+  const head = text.slice(0, TASK_DATE_LIMITS.guardChars)
+  return content.includes(head) ? head : full
+}
+
+/** The nearest folder at or above `dir` holding `.git` (a folder, or a pointer file), or null. */
+export function findGitWorkTree(dir: string): string | null {
+  let at = dir
+  for (let depth = 0; depth < 64; depth++) {
+    if (existsSync(join(at, '.git'))) return at
+    const up = dirname(at)
+    if (up === at) return null
+    at = up
+  }
+  return null
+}
+
+interface FileState { file: string; dir: string; head: string; lines: Map<number, BlameLine> }
+/** `d`: the day, or null when history has no such text yet; then `h` is the HEAD it was looked up at. */
+interface CreatedEntry { d: string | null; h?: string }
+interface PickaxeJob { key: string; needle: string; state: FileState }
+
+/** execFile kills a git that outlives its timeout: a timeout says nothing about the history or the file. */
+export function isGitTimeout(error: unknown): boolean {
+  const e = error as { killed?: unknown; signal?: unknown; code?: unknown } | null
+  return !!e && (e.killed === true || (typeof e.signal === 'string' && e.signal.length > 0) || e.code === 'ETIMEDOUT')
+}
+
+export interface TaskDateResolverOptions {
+  git?: DateGitRunner
+  cacheFile?: string
+  /** The overall deadline for one resolve (TASK_DATE_LIMITS.deadlineMs). */
+  deadlineMs?: number
+  now?: () => number
+  findRepo?: (dir: string) => string | null
+}
+
+export class TaskDateResolver {
+  private readonly git: DateGitRunner
+  private readonly cacheFile: string
+  private readonly deadlineMs: number
+  private readonly now: () => number
+  private readonly findRepo: (dir: string) => string | null
+  private blame = new Map<string, { key: string; lines: Promise<Map<number, BlameLine> | null> }>()
+  private created: Map<string, CreatedEntry> | null = null
+  private pending = new Map<string, Promise<void>>()
+  /** A first-seen lookup that failed (a timeout, a git error): not "absent", and not retried until this time. */
+  private lookupBackoff = new Map<string, number>()
+  /** A file whose rev-parse or blame timed out: no git for it until this time. */
+  private fileBackoff = new Map<string, number>()
+  private dirty = false
+  private flushTimer: ReturnType<typeof setTimeout> | null = null
+
+  constructor(options: TaskDateResolverOptions = {}) {
+    this.git = options.git ?? realDateGitRunner
+    this.cacheFile = options.cacheFile ?? TASK_DATES_CACHE_FILE
+    this.deadlineMs = options.deadlineMs ?? TASK_DATE_LIMITS.deadlineMs
+    this.now = options.now ?? Date.now
+    this.findRepo = options.findRepo ?? findGitWorkTree
+  }
+
+  /**
+   * Date fields for every row, keyed by taskDateKey(domain, id). Never throws; an unknown is null. Everything git does
+   * for this call (rev-parse, blame, first-seen lookups) shares ONE deadline: past it the call answers with what it
+   * has, source dates included, and git work already started keeps running to fill the caches for a later call.
+   */
+  async resolve(rows: readonly DateSourceRow[], root: string): Promise<Map<string, TaskDateFields>> {
+    const deadline = this.now() + this.deadlineMs
+    const out = new Map<string, TaskDateFields>()
+    const states = new Map<string, FileState | null>()
+    const reads = [...new Set(rows.map(row => row.domain))].map(domain =>
+      this.fileState(join(root, domain, 'tasks.md')).catch(() => null).then(state => { states.set(domain, state) }))
+    await this.until(Promise.all(reads), deadline)
+    const jobs = new Map<string, PickaxeJob>()
+    const waiting: Array<{ fields: TaskDateFields; key: string }> = []
+    for (const row of rows) {
+      const fields: TaskDateFields = { ...NO_TASK_DATES }
+      out.set(taskDateKey(row.domain, row.id), fields)
+      const fromSource = sourceDate(row.source)
+      if (fromSource) { fields.createdOn = fromSource; fields.createdFrom = 'source' }
+      const state = states.get(row.domain)
+      if (!state) continue
+      const line = state.lines.get(row.line_number)
+      if (line && lineHolds(line.content, row.description)) fields.lineChangedAt = line.at
+      if (fromSource) continue
+      const needle = pickaxeNeedle(row.description, line?.content)
+      if (!needle) continue
+      const key = createHash('sha256').update(state.file + '\0' + needle).digest('hex').slice(0, 32)
+      const known = this.lookup(key, state.head)
+      if (known === undefined) { jobs.set(key, { key, needle, state }); waiting.push({ fields, key }) }
+      else if (known) { fields.createdOn = known; fields.createdFrom = 'git' }
+    }
+    if (jobs.size) {
+      await this.runWithin([...jobs.values()], deadline)
+      for (const { fields, key } of waiting) {
+        const day = this.created?.get(key)?.d
+        if (day) { fields.createdOn = day; fields.createdFrom = 'git' }
+      }
+    }
+    return out
+  }
+
+  /** Write the first-seen cache now (it is otherwise written shortly after a lookup lands). */
+  flush(): void {
+    if (this.flushTimer) { clearTimeout(this.flushTimer); this.flushTimer = null }
+    if (!this.dirty || !this.created) return
+    this.dirty = false
+    try {
+      mkdirSync(dirname(this.cacheFile), { recursive: true, mode: 0o700 })
+      durableAtomicWriteFileSync(this.cacheFile, JSON.stringify({ version: 1, created: Object.fromEntries(this.created) }) + '\n', { mode: 0o600 })
+    } catch (e) { console.warn('[task-dates] cache not saved:', e instanceof Error ? e.message : e) }
+  }
+
+  /** Lookups still running in the background (tests). */
+  async settled(): Promise<void> {
+    while (this.pending.size) await Promise.allSettled([...this.pending.values()])
+    await Promise.allSettled([...this.blame.values()].map(entry => entry.lines))
+  }
+
+  /** Wait for `work` or the deadline, whichever comes first. */
+  private async until(work: Promise<unknown>, deadline: number): Promise<void> {
+    let timer: ReturnType<typeof setTimeout> | undefined
+    const late = new Promise<void>(resolve => { timer = setTimeout(resolve, Math.max(0, deadline - this.now())) })
+    try { await Promise.race([work, late]) } finally { clearTimeout(timer) }
+  }
+
+  private async fileState(file: string): Promise<FileState | null> {
+    const dir = dirname(file)
+    if (!this.findRepo(dir)) return null
+    if ((this.fileBackoff.get(file) ?? 0) > this.now()) return null
+    let stat: ReturnType<typeof statSync>
+    try { stat = statSync(file) } catch { return null }
+    if (!stat.isFile()) return null
+    let head: string
+    try { head = (await this.git(['rev-parse', '--verify', '-q', 'HEAD'], dir, TASK_DATE_LIMITS.gitTimeoutMs)).trim() } catch (e) {
+      if (isGitTimeout(e)) this.fileBackoff.set(file, this.now() + TASK_DATE_LIMITS.fileBackoffMs)
+      return null
+    }
+    if (!/^[0-9a-f]{40,64}$/.test(head)) return null
+    const key = `${head}|${stat.mtimeMs}|${stat.size}`
+    let entry = this.blame.get(file)
+    if (!entry || entry.key !== key) {
+      // An untracked file fails blame: nothing about it comes from git, until HEAD or the file changes. A blame that
+      // timed out says nothing about the file, so it is forgotten (and the file rests) rather than kept as "untracked".
+      const blamed = { key, lines: this.git(['blame', '--line-porcelain', '--', basename(file)], dir, TASK_DATE_LIMITS.gitTimeoutMs)
+        .then(parseBlamePorcelain, (e: unknown) => {
+          if (isGitTimeout(e)) {
+            this.fileBackoff.set(file, this.now() + TASK_DATE_LIMITS.fileBackoffMs)
+            if (this.blame.get(file) === blamed) this.blame.delete(file)
+          }
+          return null
+        }) }
+      entry = blamed
+      this.blame.delete(file)
+      this.blame.set(file, entry)
+      while (this.blame.size > TASK_DATE_LIMITS.blameFiles) this.blame.delete(this.blame.keys().next().value!)
+    }
+    const lines = await entry.lines
+    return lines ? { file, dir, head, lines } : null
+  }
+
+  /** The cached day, null when history had no such text at this HEAD, or undefined when it must be looked up. */
+  private lookup(key: string, head: string): string | null | undefined {
+    const entry = this.cache().get(key)
+    if (entry?.d) return entry.d
+    if (entry && entry.h === head) return null
+    // A lookup that failed recently is neither known nor retried yet: the field stays null for now.
+    if ((this.lookupBackoff.get(key) ?? 0) > this.now()) return null
+    return undefined
+  }
+
+  /** Start lookups until the deadline, then answer with what landed. Lookups already started keep running. */
+  private async runWithin(jobs: PickaxeJob[], deadline: number): Promise<void> {
+    let next = 0
+    const worker = async () => {
+      while (next < jobs.length && this.now() < deadline) await this.pickaxe(jobs[next++])
+    }
+    await this.until(Promise.all(Array.from({ length: Math.min(TASK_DATE_LIMITS.concurrency, jobs.length) }, worker)), deadline)
+  }
+
+  private pickaxe(job: PickaxeJob): Promise<void> {
+    const running = this.pending.get(job.key)
+    if (running) return running
+    const work = this.git(['log', '--reverse', '--format=%ad', '--date=short', `-S${job.needle}`, '--', basename(job.state.file)],
+      job.state.dir, TASK_DATE_LIMITS.gitTimeoutMs)
+      .then(out => {
+        const day = out.split('\n').map(line => line.trim()).find(line => /^\d{4}-\d{2}-\d{2}$/.test(line)) ?? null
+        this.lookupBackoff.delete(job.key)
+        this.remember(job.key, day ? { d: day } : { d: null, h: job.state.head })
+      }, () => {
+        // A timeout or a git error is not "not in history": nothing is cached, and the lookup rests before a retry.
+        this.lookupBackoff.set(job.key, this.now() + TASK_DATE_LIMITS.lookupBackoffMs)
+      })
+      .finally(() => this.pending.delete(job.key))
+    this.pending.set(job.key, work)
+    return work
+  }
+
+  private cache(): Map<string, CreatedEntry> {
+    if (this.created) return this.created
+    this.created = new Map()
+    try {
+      const parsed = JSON.parse(readFileSync(this.cacheFile, 'utf8')) as { version?: unknown; created?: Record<string, unknown> }
+      if (parsed?.version === 1 && parsed.created && typeof parsed.created === 'object') {
+        for (const [key, raw] of Object.entries(parsed.created)) {
+          const entry = raw as Partial<CreatedEntry>
+          if (typeof entry?.d === 'string' && isCalendarDay(entry.d)) this.created.set(key, { d: entry.d })
+          else if (entry?.d === null && typeof entry.h === 'string') this.created.set(key, { d: null, h: entry.h })
+        }
+      }
+    } catch { /* missing or unreadable: start empty */ }
+    return this.created
+  }
+
+  private remember(key: string, entry: CreatedEntry): void {
+    const cache = this.cache()
+    cache.delete(key)
+    cache.set(key, entry)
+    while (cache.size > TASK_DATE_LIMITS.cacheEntries) cache.delete(cache.keys().next().value!)
+    this.dirty = true
+    if (!this.flushTimer) {
+      this.flushTimer = setTimeout(() => this.flush(), 250)
+      this.flushTimer.unref?.()
+    }
+  }
+}
+
+/**
+ * The resolver, bounded from outside as well: if it has not answered by the deadline (plus a moment for the answer
+ * itself), every row gets null dates. A dated board read is never held past the deadline by git.
+ */
+export async function resolveTaskDatesWithin(resolver: Pick<TaskDateResolver, 'resolve'>, rows: readonly DateSourceRow[], root: string,
+                                             deadlineMs: number = TASK_DATE_LIMITS.deadlineMs): Promise<Map<string, TaskDateFields>> {
+  let timer: ReturnType<typeof setTimeout> | undefined
+  const late = new Promise<Map<string, TaskDateFields>>(resolve => {
+    timer = setTimeout(() => resolve(new Map()), deadlineMs + TASK_DATE_LIMITS.answerSlackMs)
+  })
+  try { return await Promise.race([resolver.resolve(rows, root), late]) } finally { clearTimeout(timer) }
+}
+
+let shared: TaskDateResolver | null = null
+export function sharedTaskDateResolver(): TaskDateResolver { return shared ??= new TaskDateResolver() }

package/server/lib/task-store.ts

@@ -10,6 +10,8 @@ import {
 } from './morning-brief-config.js'
 import { localClock, shiftDay, taskInstant } from './morning-brief-schedule.js'
 import { callTaskBridge, taskBridgeAvailable, taskOperationsRoot, taskBridgeUnavailableMessage } from './task-bridge.js'
+import { NO_TASK_DATES, TASK_DATE_LIMITS, resolveTaskDatesWithin, sharedTaskDateResolver, taskDateKey, type TaskDateFields,
+  type TaskDateResolver } from './task-dates.js'
 import { taskDomainNames, isSafeDomainName } from './domains.js'
 import { isClientJobId } from './query-job-types.js'
 import { DEFAULT_MODEL, isClaudeModel } from '../../shared/model-preference.js'
@@ -469,7 +471,7 @@ export function projectRow(
   }
 }
 
-export async function listBoard(columnFilter?: string, nowMs = Date.now()): Promise<TaskBoardRow[]> {
+async function boardPairs(columnFilter: string | undefined, nowMs: number): Promise<Array<{ source: BridgeTaskRow; row: TaskBoardRow }>> {
   if (!taskBridgeAvailable()) {
     throw new TaskRunError(503, 'cos_pipeline_not_configured', taskBridgeUnavailableMessage())
   }
@@ -479,8 +481,33 @@ export async function listBoard(columnFilter?: string, nowMs = Date.now()): Prom
     Promise.resolve(loadTaskLedger(taskStorePaths())),
   ])
   return rows
-    .map(row => projectRow(row, ledger, clock.day, nowMs, config.timezone, config.taskCatchUpMinutes))
-    .filter((row): row is TaskBoardRow => !!row && (!columnFilter || row.column === columnFilter))
+    .map(source => ({ source, row: projectRow(source, ledger, clock.day, nowMs, config.timezone, config.taskCatchUpMinutes) }))
+    .filter((pair): pair is { source: BridgeTaskRow; row: TaskBoardRow } => !!pair.row && (!columnFilter || pair.row.column === columnFilter))
+}
+
+export async function listBoard(columnFilter?: string, nowMs = Date.now()): Promise<TaskBoardRow[]> {
+  return (await boardPairs(columnFilter, nowMs)).map(pair => pair.row)
+}
+
+/**
+ * GET /api/tasks and GET /api/work-board rows (6.65.0): the board plus `createdOn`, `createdFrom` and `lineChangedAt`
+ * (lib/task-dates.ts). Every caller of those two routes pays for the dated read, the glasses' and the phone's /api/tasks
+ * reads included: its git work is bounded by TASK_DATE_LIMITS.deadlineMs (1.5 s, under the phone's 4 s timeout), past
+ * which the dates come back null. The shared Work board reader (the glasses' activity, open-work and request glances)
+ * and Jev advice use listBoard, which does no git work.
+ * Additive: every existing field is unchanged, and older Controls ignore the new ones. The dates come from the source
+ * label and from git, read-only, for both the configured COS bridge and the packaged task runtime; a date that cannot
+ * be known is null, and a failure to date never fails the board.
+ */
+export async function listBoardWithDates(columnFilter?: string, nowMs = Date.now(),
+                                         resolver: Pick<TaskDateResolver, 'resolve'> = sharedTaskDateResolver(),
+                                         deadlineMs: number = TASK_DATE_LIMITS.deadlineMs): Promise<Array<TaskBoardRow & TaskDateFields>> {
+  const pairs = await boardPairs(columnFilter, nowMs)
+  let dates = new Map<string, TaskDateFields>()
+  try { dates = await resolveTaskDatesWithin(resolver, pairs.map(pair => pair.source), taskOperationsRoot(), deadlineMs) } catch (e) {
+    console.warn('[tasks] dates unavailable:', e instanceof Error ? e.message : e)
+  }
+  return pairs.map(({ row }) => ({ ...row, ...(dates.get(taskDateKey(row.domain, row.id)) ?? NO_TASK_DATES) }))
 }
 
 export function workBadgeCount(rows: readonly TaskBoardRow[]): number {

package/server/lib/work-search.ts

@@ -0,0 +1,226 @@
+/**
+ * Work search by meaning (6.65.0, Control 0.5.259).
+ *
+ * Control searches the board's cards by words on its own, instantly. After a pause it asks this for the card the user
+ * MEANS: one Jev Choice over the board's task texts, with `none` as an option. Measured 2026-10-06 on 105 real Quilt
+ * tasks and 10 queries: the right card first 10 of 10 times in 0.2 s (keyword search alone found 7 of 10).
+ *
+ * The candidates are the board's own rows (the same listBoard read /api/tasks serves), never client text: the client
+ * names a scope, a domain, or exact ids. A Choice holds at most 254 options plus `none`, so a larger set is refused as
+ * `too_many_candidates` rather than truncated (a truncated search would silently miss cards).
+ *
+ * Cost controls of its own, separate from Work intake and session advice (COS_JEV_DAILY_TOKENS): a daily input-token
+ * cap (COS_JEV_SEARCH_DAILY_TOKENS, default 1,000,000, about 200 searches at the ~5k input tokens measured per search:
+ * 64.5k over 13 live calls), its own usage ledger, its own breaker (3 failures, then 1 hour), and a switch
+ * (COS_JEV_SEARCH=0 turns it off). Key resolution and the request timeout are jev.ts's. A search that cannot run
+ * answers HTTP 200 with `available: false` and a reason, so Control keeps its word search and says one line about why.
+ */
+import { createHash } from 'node:crypto'
+import { dataPath } from './data-dir.js'
+import { estimateJevTokens, JevClient, JevError } from './jev.js'
+import { boundForRedaction, redactSecretText } from './activity-preview.js'
+import { redactSecrets } from './lens-gist-engines.js'
+
+export const WORK_SEARCH_LIMITS = {
+  queryMin: 2, queryMax: 200,
+  /** A Jev Choice holds 255 options; one is `none`. */
+  maxCandidates: 254,
+  optionChars: 300,
+  /** How much of a task's text the redaction reads: four times what Jev gets, so no pattern ever scans a long input. */
+  optionScanChars: 1_200,
+  minP: 0.02, maxResults: 20,
+  cacheMs: 10 * 60_000, cacheEntries: 200,
+  defaultDailyTokens: 1_000_000,
+} as const
+export const WORK_SEARCH_USAGE_FILE = dataPath('jev-search-usage.json')
+export const WORK_SEARCH_SCOPES = ['all', 'attention', 'progress', 'completed'] as const
+export type WorkSearchScope = typeof WORK_SEARCH_SCOPES[number]
+
+export const WORK_SEARCH_INSTRUCTIONS = 'The user typed `query` into the search box of their task board. Which task are they trying '
+  + 'to find? Pick the task they mean even when it uses different words, or none if no task fits.'
+export const WORK_SEARCH_NONE = 'None of these tasks is what the user is looking for.'
+
+export type WorkSearchReason = 'jev_not_configured' | 'jev_key_rejected' | 'jev_cap_reached' | 'jev_breaker_open' | 'jev_request_rejected'
+  | 'jev_unavailable' | 'search_off' | 'too_many_candidates'
+export const WORK_SEARCH_MESSAGES: Record<WorkSearchReason, string> = {
+  jev_not_configured: 'Meaning search needs a TypeSafe key. Add one in Settings.',
+  jev_key_rejected: 'TypeSafe did not accept the saved key. Check it in Settings. Word search still works.',
+  jev_cap_reached: 'Meaning search has used today’s budget. It resets at midnight UTC. Word search still works.',
+  jev_breaker_open: 'Meaning search is paused for an hour after repeated failures. Word search still works.',
+  jev_request_rejected: 'Jev refused this search request. Word search still works.',
+  jev_unavailable: 'Meaning search got no answer from Jev. Word search still works.',
+  search_off: 'Meaning search is turned off on this server.',
+  too_many_candidates: `Meaning search covers up to ${WORK_SEARCH_LIMITS.maxCandidates} cards. Pick a domain to search this view.`,
+}
+
+export interface WorkSearchHit { id: string; p: number }
+export type WorkSearchResult =
+  | { available: true; results: WorkSearchHit[]; none: number | null; cached: boolean; tokens: number }
+  | { available: false; reason: WorkSearchReason; message: string }
+
+export function unavailable(reason: WorkSearchReason): Extract<WorkSearchResult, { available: false }> {
+  return { available: false, reason, message: WORK_SEARCH_MESSAGES[reason] }
+}
+
+/** The daily input-token cap for search alone. The ledger day is UTC, so the budget resets at midnight UTC. */
+export function workSearchDailyCap(): number {
+  const raw = Number(process.env.COS_JEV_SEARCH_DAILY_TOKENS)
+  return Number.isFinite(raw) && raw > 0 ? Math.floor(raw) : WORK_SEARCH_LIMITS.defaultDailyTokens
+}
+
+/**
+ * On unless COS_JEV_SEARCH says off (0, false, no, off). The value comes from the server's environment, which is fixed
+ * when the server starts (the LaunchAgent plist, or ~/.cos-glasses/.env read at boot), so changing it takes a restart.
+ * The cap, COS_JEV_SEARCH_DAILY_TOKENS, is the same.
+ */
+export function workSearchEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
+  return !['0', 'false', 'no', 'off'].includes((env.COS_JEV_SEARCH ?? '').trim().toLowerCase())
+}
+
+/** Search's own Jev client: its own ledger file, cap and breaker. jev.ts supplies the key and the timeout. */
+export function createWorkSearchJevClient(fetchImpl: typeof fetch = fetch, now: () => Date = () => new Date(),
+                                          usageFile = WORK_SEARCH_USAGE_FILE): JevClient {
+  return new JevClient(fetchImpl, now, usageFile, workSearchDailyCap)
+}
+
+let sharedSearchClient: JevClient | null = null
+/** One search client per process: it owns search's breaker. Saving a new key resets it (routes/jev.ts). */
+export function sharedWorkSearchJevClient(): JevClient { return sharedSearchClient ??= createWorkSearchJevClient() }
+
+const WORK_DETAILS_RE = /\[Work details\]\([^)]*\)/gi
+const MARKDOWN_LINK_RE = /\[([^\]]*)\]\([^)\s]*\)/g
+// Bounded scheme, as in activity-preview.ts: an unbounded one is retried from every position of a long run.
+const SCHEME_URL_RE = /\b(?:[a-z][a-z0-9+.-]{0,31}:\/\/|www\.)\S+/gi
+const EMAIL_RE = /[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9.-]{1,253}\.[A-Za-z]{2,24}\b/g
+// A host with a path (docs.google.com/document/d/…). A bare domain stays: it is usually a brand name people search for.
+const PATH_URL_RE = /\b(?:[a-z0-9-]{1,63}\.){1,8}[a-z]{2,24}\/\S*/gi
+const LONG_RUN_RE = /[A-Za-z0-9_-]{24,}/g
+
+/**
+ * What Jev reads for one card (6.65.0 QA, S-W6): the task text with `[Work details](…)` links dropped, other markdown
+ * links reduced to their label, credentials masked by the server's secret redaction (redactSecretText, then
+ * redactSecrets), and URLs, email addresses and opaque ids (24 or more letters, digits, `-` or `_` with both a letter and
+ * a digit, the shape of a key or a document id) removed. They add nothing to finding a card, and TypeSafe is a third
+ * party. One line, at most 300 characters.
+ */
+export function searchOptionText(text: string): string {
+  let out = boundForRedaction(text, WORK_SEARCH_LIMITS.optionScanChars).head.replace(WORK_DETAILS_RE, ' ')
+  out = redactSecrets(redactSecretText(out))
+  out = out.replace(MARKDOWN_LINK_RE, '$1').replace(SCHEME_URL_RE, ' ').replace(EMAIL_RE, ' ').replace(PATH_URL_RE, ' ')
+  out = out.replace(LONG_RUN_RE, run => /\d/.test(run) && /[A-Za-z]/.test(run) ? ' ' : run)
+  return out.replace(/\s+/g, ' ').trim().slice(0, WORK_SEARCH_LIMITS.optionChars).trim()
+}
+
+/**
+ * API POSTs that only read (6.65.0 QA). index.ts lets them past the global mutation lease. POST /work/search reads the
+ * board and asks Jev one question; it writes nothing but its own token ledger (one atomic write). Under the lease, a
+ * drain for an update or restart would wait up to 20 s (the Jev timeout) for a search, and a drain would answer every
+ * search 503. Outside it, a restart mid-search loses at most that search's token count.
+ */
+export function isReadOnlyApiPost(method: string, path: string): boolean {
+  return method === 'POST' && path === '/work/search'
+}
+
+/** A query's length as people count it: code points, not UTF-16 units, so 150 emoji are 150 (Control counts characters). */
+export function queryLength(query: string): number { return [...query].length }
+
+export interface SearchableRow { id: string; domain: string; text: string; checked: boolean; workIdentity?: string }
+export interface CandidateRequest { domain?: string; scope?: WorkSearchScope; ids?: string[] }
+
+/**
+ * The cards a search covers, in board order. Exact ids win: Control sends them for views only it can compute (Needs
+ * attention, In progress). Otherwise a domain board covers that domain's cards; All work covers open cards; Completed
+ * covers completed ones. Needs attention and In progress without ids cover open cards. Rows without searchable text
+ * are left out. Returns null when there are more than 254.
+ */
+export function selectCandidates<Row extends SearchableRow>(rows: readonly Row[], request: CandidateRequest): Row[] | null {
+  const inDomain = (row: Row) => !request.domain || row.domain === request.domain
+  let picked: Row[]
+  if (request.ids) {
+    const wanted = new Set(request.ids)
+    picked = rows.filter(row => wanted.has(row.id) || (!!row.workIdentity && wanted.has(row.workIdentity)))
+  } else if (request.scope === 'completed') {
+    picked = rows.filter(row => row.checked && inDomain(row))
+  } else if (request.scope === 'attention' || request.scope === 'progress') {
+    picked = rows.filter(row => !row.checked && inDomain(row))
+  } else if (request.domain) {
+    picked = rows.filter(row => row.domain === request.domain)
+  } else {
+    picked = rows.filter(row => !row.checked)
+  }
+  picked = picked.filter(row => searchOptionText(row.text).length > 0)
+  return picked.length > WORK_SEARCH_LIMITS.maxCandidates ? null : picked
+}
+
+/** Jev's probabilities as hits: offered cards only, p at least 0.02, most likely first, at most 20. */
+export function rankHits(probabilities: Record<string, unknown> | undefined, ids: readonly string[]): { results: WorkSearchHit[]; none: number | null } {
+  if (!probabilities || typeof probabilities !== 'object') throw new JevError('jev_bad_answer', 'Jev returned no probabilities')
+  const results: WorkSearchHit[] = []
+  let none: number | null = null
+  for (const [key, raw] of Object.entries(probabilities)) {
+    const p = typeof raw === 'number' && Number.isFinite(raw) ? raw : Number.NaN
+    if (Number.isNaN(p) || p < 0 || p > 1) throw new JevError('jev_bad_answer', 'Jev answered with a probability outside 0 to 1')
+    if (key === 'none') { none = round(p); continue }
+    const index = /^t(0|[1-9]\d*)$/.test(key) ? Number(key.slice(1)) : -1
+    if (index < 0 || index >= ids.length) throw new JevError('jev_bad_answer', 'Jev chose a card that was not offered')
+    if (p >= WORK_SEARCH_LIMITS.minP) results.push({ id: ids[index], p: round(p) })
+  }
+  results.sort((a, b) => b.p - a.p)
+  return { results: results.slice(0, WORK_SEARCH_LIMITS.maxResults), none }
+}
+const round = (n: number) => Math.round(n * 10_000) / 10_000
+
+/** Case, spacing and Unicode form do not change what was asked. */
+export function normalizeQuery(query: string): string {
+  return query.normalize('NFKC').replace(/\s+/g, ' ').trim().toLowerCase()
+}
+
+const PASSED_THROUGH = new Set<string>(['jev_not_configured', 'jev_key_rejected', 'jev_cap_reached', 'jev_breaker_open', 'jev_request_rejected'])
+
+export class WorkSearcher {
+  private cache = new Map<string, { at: number; results: WorkSearchHit[]; none: number | null }>()
+  private inflight = new Map<string, Promise<WorkSearchResult>>()
+  constructor(private readonly jev: JevClient, private readonly now: () => number = () => Date.now()) {}
+
+  /** One Jev Choice over `candidates` (already selected, at most 254). Never throws for a Jev failure. */
+  async search(query: string, candidates: readonly SearchableRow[]): Promise<WorkSearchResult> {
+    if (candidates.length > WORK_SEARCH_LIMITS.maxCandidates) return unavailable('too_many_candidates')
+    if (!candidates.length) return { available: true, results: [], none: 1, cached: false, tokens: 0 }
+    const texts = candidates.map(row => searchOptionText(row.text))
+    const set = createHash('sha256').update(JSON.stringify(candidates.map((row, i) => [row.id, texts[i]]))).digest('hex')
+    const key = createHash('sha256').update(normalizeQuery(query) + '\0' + set).digest('hex')
+    const hit = this.cache.get(key)
+    if (hit && this.now() - hit.at < WORK_SEARCH_LIMITS.cacheMs) {
+      return { available: true, results: hit.results, none: hit.none, cached: true, tokens: 0 }
+    }
+    if (hit) this.cache.delete(key)
+    // Typing can send the same search twice before the first answers; the second waits for the first.
+    const running = this.inflight.get(key)
+    if (running) return running
+    const work = this.ask(query, candidates.map(row => row.id), texts, key)
+    this.inflight.set(key, work)
+    try { return await work } finally { this.inflight.delete(key) }
+  }
+
+  private async ask(query: string, ids: string[], texts: string[], key: string): Promise<WorkSearchResult> {
+    const state = { query: query.trim() }
+    const criteria: Record<string, string> = Object.fromEntries(texts.map((text, i) => [`t${i}`, text]))
+    criteria.none = WORK_SEARCH_NONE
+    const questions = { c: { type: 'choice', instructions: WORK_SEARCH_INSTRUCTIONS, criteria } }
+    try {
+      const reply = await this.jev.ask(state, questions, estimateJevTokens({ state, questions }))
+      const { results, none } = rankHits(reply.answers.c?.probabilities, ids)
+      if (this.cache.size >= WORK_SEARCH_LIMITS.cacheEntries) this.cache.delete(this.cache.keys().next().value!)
+      this.cache.set(key, { at: this.now(), results, none })
+      return { available: true, results, none, cached: false, tokens: reply.inputTokens }
+    } catch (e) {
+      if (!(e instanceof JevError)) throw e
+      // Each says what happened. A 400, 413 or 422 is jev_request_rejected: the request itself was refused, which does
+      // not count toward the breaker (jev.ts), because the same cards would be refused again and an outage pause would
+      // only hide search for every other board. Unreachable, 5xx and a malformed answer are jev_unavailable.
+      if (PASSED_THROUGH.has(e.code)) return unavailable(e.code as WorkSearchReason)
+      console.warn('[work-search] Jev failed:', e.code)
+      return unavailable('jev_unavailable')
+    }
+  }
+}

package/server/routes/jev.ts

@@ -12,6 +12,7 @@ import { SessionRecommender, parseCandidates } from '../lib/session-recommendati
 import { CompletionChecker, readRepliesSince } from '../lib/work-completion.js'
 import { isSafeSessionId, type AgentProvider } from '../lib/agent-session-store.js'
 import { listBoard } from '../lib/task-store.js'
+import { sharedWorkSearchJevClient } from '../lib/work-search.js'
 import { isSafeDomainName } from '../lib/domains.js'
 
 /** What the route reads from a meeting review (6.57.1): the server's own record, never client text. */
@@ -30,6 +31,8 @@ export interface JevRouteDependencies {
   /** 6.58.0: a session's replies since a time (or its newest reply) from this server's transcripts; null when the
    *  session is not on this Mac. */
   replies: (provider: AgentProvider, sessionId: string, afterMs: number | null) => Promise<string | null>
+  /** 6.65.0: Work search keeps its own client and breaker; a newly saved key clears that breaker too. */
+  searchJev: Pick<JevClient, 'resetForNewKey'>
 }
 
 /** Work identity first: it survives a rename, while a new card's id could equal an old identity's text hash. */
@@ -40,7 +43,8 @@ function findTask<T extends { id: string; workIdentity?: string }>(rows: T[], id
 export function createJevRouter(overrides: Partial<JevRouteDependencies> = {}): Router {
   const jev = overrides.jev ?? sharedJevClient()
   const deps: JevRouteDependencies = { jev, recommender: new SessionRecommender(jev), list: listBoard, validate: validateJevKey, save: saveJevKey,
-    completion: new CompletionChecker(jev), replies: (provider, sessionId, afterMs) => readRepliesSince(provider, sessionId, afterMs), ...overrides }
+    completion: new CompletionChecker(jev), replies: (provider, sessionId, afterMs) => readRepliesSince(provider, sessionId, afterMs),
+    searchJev: sharedWorkSearchJevClient(), ...overrides }
   const router = Router()
   router.use(['/jev-key', '/work-board/session-recommendation', '/work-board/completion-check'], (_req, res, next) => { res.set('Cache-Control', 'private, no-store'); next() })
 
@@ -61,6 +65,7 @@ export function createJevRouter(overrides: Partial<JevRouteDependencies> = {}):
       return res.status(500).json({ error: { code: 'jev_key_not_saved', message: 'The key was valid but could not be saved. Check the server data folder.' } })
     }
     deps.jev.resetForNewKey()
+    deps.searchJev.resetForNewKey()
     return res.json({ ok: true, ...deps.jev.status() })
   })
 

package/server/routes/tasks.ts

@@ -10,6 +10,7 @@ import {
   captureTask,
   checkTask,
   listBoard,
+  listBoardWithDates,
   listProjectedTaskRuns,
   loadDispatchCap,
   moveTask,
@@ -175,7 +176,8 @@ tasksRouter.put('/domains', (req, res) => {
 tasksRouter.get('/tasks', async (req, res) => {
   try {
     const column = typeof req.query.column === 'string' ? req.query.column : undefined
-    const rows = await listBoard(column)
+    // 6.65.0: rows carry createdOn, createdFrom and lineChangedAt (null when unknown), as GET /api/work-board rows do.
+    const rows = await listBoardWithDates(column)
     res.json({ tasks: rows, workBadge: workBadgeCount(rows), gate: tasksGate() })
   } catch (error) {
     sendError(res, error)

package/server/routes/work-board.ts

@@ -1,7 +1,7 @@
 import { Router } from 'express'
 import { readWorkJournal, projectWorkActivity, projectOpenWork, savedDestinationFor, controlSnapshotRevision,
   type WorkActivityCapabilities, type WorkActivityResult } from '../lib/work-activity.js'
-import { listBoard, workBoardCapabilities, setTaskWorkStage, linkTaskMeeting, editWorkTask, TaskRunError, TaskBridgeError,
+import { listBoard, listBoardWithDates, workBoardCapabilities, setTaskWorkStage, linkTaskMeeting, editWorkTask, TaskRunError, TaskBridgeError,
   WORK_STAGES, type WorkStage, type WorkMeetingRef, type TaskBoardRow } from '../lib/task-store.js'
 import { createWorkBoardReader, WORK_BOARD_READ_LIMITS, WorkBoardTimeoutError, type WorkBoardReader } from '../lib/work-board-reader.js'
 import type { MeetingDescriptor } from '../lib/work-review-store.js'
@@ -13,6 +13,10 @@ export interface WorkBoardDependencies {
   /** The native journal reader. It takes no request-derived argument: there is no request-supplied path. */
   journal: () => ReturnType<typeof readWorkJournal>
   list: typeof listBoard
+  /** 6.65.0: the rows GET /api/work-board serves, with createdOn, createdFrom and lineChangedAt (task-store.ts
+   *  listBoardWithDates). COS Control reads this route for its Work board and reads /api/tasks only from an older
+   *  server, so the dates must be here too. Defaults to the dated read unless a caller supplies its own `list`. */
+  listDated?: () => Promise<TaskBoardRow[]>
   capabilities: typeof workBoardCapabilities
   stage: typeof setTaskWorkStage
   link: typeof linkTaskMeeting
@@ -33,6 +37,7 @@ export const WORK_GLANCE_BOARD_AGE_MS = 10_000
 /** Auth is supplied by the parent /api mount. No provider execution occurs here. */
 export function createWorkBoardRouter(overrides: Partial<WorkBoardDependencies> = {}): Router {
   const deps = { ...defaults, ...overrides }, router = Router()
+  const listForBoard = overrides.listDated ?? (overrides.list ? deps.list : () => listBoardWithDates())
   const board = deps.readBoard ?? createWorkBoardReader(() => deps.list())
   router.use('/work-board', (_req, res, next) => { res.set('Cache-Control', 'private, no-store'); next() })
   const fail = (res: import('express').Response, e: unknown) => {
@@ -80,7 +85,7 @@ export function createWorkBoardRouter(overrides: Partial<WorkBoardDependencies>
   router.get('/work-board', async (_req, res) => {
     try {
       const read = board.begin()
-      const [raw, capabilities] = await Promise.all([deps.list(), deps.capabilities()])
+      const [raw, capabilities] = await Promise.all([listForBoard(), deps.capabilities()])
       board.prime(raw, read)
       // 6.59.0: taskRevision is this task's own revision (COS Control's taskSnapshot), what a handoff request names.
       const tasks = raw.map(row => ({ ...row, workStage: row.checked ? 'complete' : row.workStage ?? (row.stage === 'active' ? 'draft' : row.stage === 'review' ? 'qa' : 'planned'), workIdentity: row.workIdentity || row.id, meetingRefs: row.meetingRefs ?? [], taskRevision: controlSnapshotRevision(row) }))

package/server/routes/work-search.ts

@@ -0,0 +1,72 @@
+/**
+ * POST /api/work/search (6.65.0): which board card the user means, by meaning. Auth comes from the parent /api mount.
+ *
+ * Body `{ query, domain?, scope?, ids? }`. The cards come from the board read /api/tasks serves; the client sends a
+ * view (domain, scope) or exact card ids, never task text. A search that cannot run answers 200 with
+ * `{ available: false, reason, message }`, so Control keeps its word search. See lib/work-search.ts.
+ */
+import { Router } from 'express'
+import { listBoard } from '../lib/task-store.js'
+import { isSafeDomainName } from '../lib/domains.js'
+import { queryLength, sharedWorkSearchJevClient, selectCandidates, unavailable, workSearchEnabled, WorkSearcher, WORK_SEARCH_LIMITS,
+  WORK_SEARCH_SCOPES, type WorkSearchResult, type WorkSearchScope } from '../lib/work-search.js'
+
+export interface WorkSearchRouteDependencies {
+  searcher: Pick<WorkSearcher, 'search'>
+  list: () => ReturnType<typeof listBoard>
+  enabled: () => boolean
+}
+
+const BODY_KEYS = new Set(['query', 'domain', 'scope', 'ids'])
+const TASK_ID = /^[a-f0-9]{12}$/
+/** One log line per degrade reason per 10 minutes: Control falls back quietly, so the server says why. */
+export const WORK_SEARCH_LOG_EVERY_MS = 10 * 60_000
+
+export function createWorkSearchRouter(overrides: Partial<WorkSearchRouteDependencies> = {}): Router {
+  const deps: WorkSearchRouteDependencies = { searcher: new WorkSearcher(sharedWorkSearchJevClient()), list: () => listBoard(),
+    enabled: () => workSearchEnabled(), ...overrides }
+  const router = Router()
+  const logged = new Map<string, number>()
+  const answer = (res: import('express').Response, result: WorkSearchResult) => {
+    if (!result.available) {
+      const at = Date.now(), last = logged.get(result.reason)
+      if (last === undefined || at - last >= WORK_SEARCH_LOG_EVERY_MS) {
+        logged.set(result.reason, at)
+        console.warn(`[work-search] meaning search unavailable: ${result.reason}`)
+      }
+    }
+    return res.json(result)
+  }
+  router.use('/work/search', (_req, res, next) => { res.set('Cache-Control', 'private, no-store'); next() })
+
+  router.post('/work/search', async (req, res) => {
+    const body = req.body
+    const bad = () => res.status(400).json({ error: { code: 'invalid_search_request',
+      message: `Send a query of ${WORK_SEARCH_LIMITS.queryMin} to ${WORK_SEARCH_LIMITS.queryMax} characters, and optionally a domain, a scope or card ids.` } })
+    if (!body || typeof body !== 'object' || Array.isArray(body) || Object.keys(body).some(k => !BODY_KEYS.has(k))) return bad()
+    const query = typeof body.query === 'string' ? body.query.trim() : ''
+    const length = queryLength(query)
+    if (length < WORK_SEARCH_LIMITS.queryMin || length > WORK_SEARCH_LIMITS.queryMax) return bad()
+    if (body.domain !== undefined && (typeof body.domain !== 'string' || !isSafeDomainName(body.domain))) return bad()
+    if (body.scope !== undefined && !(WORK_SEARCH_SCOPES as readonly unknown[]).includes(body.scope)) return bad()
+    if (body.ids !== undefined && (!Array.isArray(body.ids) || body.ids.some((id: unknown) => typeof id !== 'string' || !TASK_ID.test(id)))) return bad()
+    if (!deps.enabled()) return answer(res, unavailable('search_off'))
+    const ids: string[] | undefined = body.ids ? [...new Set<string>(body.ids)] : undefined
+    // Refused before reading the board: a Choice cannot hold them, and a cut list would silently miss cards.
+    if (ids && ids.length > WORK_SEARCH_LIMITS.maxCandidates) return answer(res, unavailable('too_many_candidates'))
+    let rows: Awaited<ReturnType<typeof listBoard>>
+    try { rows = await deps.list() } catch (e) {
+      console.error('[work-search] board read failed:', e instanceof Error ? e.message : e)
+      return res.status(503).json({ error: { code: 'work_board_unavailable', message: 'Work board is unavailable. Refresh before searching.' } })
+    }
+    const candidates = selectCandidates(rows, { domain: body.domain, scope: body.scope as WorkSearchScope | undefined, ids })
+    if (!candidates) return answer(res, unavailable('too_many_candidates'))
+    try {
+      return answer(res, await deps.searcher.search(query, candidates))
+    } catch (e) {
+      console.error('[work-search] search failed:', e instanceof Error ? e.message : e)
+      return answer(res, unavailable('jev_unavailable'))
+    }
+  })
+  return router
+}