@gotcos/glasses-server 6.76.1 → 6.78.0

package/server/routes/agent-session-bindings.ts

@@ -122,7 +122,10 @@ import {
   type NativeBinding,
 } from '../lib/agent-session-binding-store.js'
 import { boundedContinueNote, CONTINUE_NOTE_HEADER, continueNoteAcknowledged, fallbackContinueNote } from '../lib/continue-plan.js'
-import type { RegistryCheck, RegistryRejection, RegistryResult } from '../lib/agent-session-binding-registry.js'
+import type { PinExtras, RegistryCheck, RegistryRejection, RegistryResult, UnpinExtras } from '../lib/agent-session-binding-registry.js'
+import { ORPHAN_CHILD_RUNNING_COPY } from '../lib/agent-session-binding-registry.js'
+import { pinBootReapEnabled, queueableRefusal, queueReconcileEnabled, sessionSteerEnabled, type SessionSteerAvailability } from '../lib/thread-turn-queue.js'
+import type { TurnReceipt } from '../lib/queue-turn-evidence.js'
 import { recordCosSpawn, releaseCosSpawn } from '../lib/agent-session-ownership-store.js'
 import { isValidNativeThreadId } from '../lib/native-thread-id.js'
 import { FORK_PROVIDER_FAILURES, type ForkProviderFailure } from '../lib/fork-thread.js'
@@ -212,9 +215,24 @@ export interface BindingRegistry {
     claim: { bindingId: string; epoch: number; targetKey: string },
     now: number,
   ) => RegistryCheck
-  /** A rejection here is FATAL to the turn, per the registry's own caller contract. */
-  pin?: (bindingId: string, jobId: string, now: number) => RegistryResult
-  unpin?: (bindingId: string, jobId: string, now: number) => RegistryResult
+  /**
+   * A rejection here is FATAL to the turn, per the registry's own caller contract.
+   * 6.78.0: `extras` carries the pin's client turn and opens its attempt in the same commit;
+   * passed only while COS_PIN_BOOT_REAP or COS_QUEUE_RECONCILE is on.
+   */
+  pin?: (bindingId: string, jobId: string, now: number, extras?: PinExtras) => RegistryResult
+  /** 6.78.0: `extras` records how the turn's delivery ended, in the same commit as the release. */
+  unpin?: (bindingId: string, jobId: string, now: number, extras?: UnpinExtras) => RegistryResult
+  /**
+   * 6.78.0: is this target held only by pins a dead boot left, and until when? Optional; the
+   * refusal copy says when the thread frees, or keeps its 6.77 words without it.
+   */
+  orphanPinHold?: (provider: string, nativeThreadId: string, now: number) => { releasesAt: number; childRunning?: true } | null
+  /**
+   * 6.78.0 (P7 S6): record the resume child a pinned turn spawned (pid and measured start),
+   * so a crash's orphan pin waits for that process. Optional; a failure changes nothing.
+   */
+  notePinChild?: (bindingId: string, jobId: string, child: { pid: number; startMs: number }) => RegistryResult
 }
 
 /** What attach resolves server-side because plan 4.2 forbids the client sending it. */
@@ -411,6 +429,21 @@ export interface AgentSessionBindingsDeps {
   /** Overrides the env gate. Tests only; production reads threadAttachEnabled(). */
   attachEnabled?: boolean
 
+  /**
+   * 6.78.0 (COS_QUEUE_RECONCILE): was this client turn already sent, or may it have been?
+   * `makeTurnReceiptLookup`: the queue's SETTLED rows (never waiting or delivering), the
+   * attempt journal, and the transcript for an unknown. Consulted after the ledger replay
+   * and before the claim; a hit is replayed, never sent again. Absent: 6.77 behaviour.
+   */
+  turnReceipt?: (provider: string, nativeThreadId: string, clientTurnId: string, prompt: string) => TurnReceipt | null
+
+  /**
+   * 6.78.0 (COS_SESSION_STEER): could a turn go INTO this thread's running turn? Added to an
+   * attach refusal as `steer`. The router also checks the flag itself, so with it off the
+   * field is absent whatever is wired.
+   */
+  sessionSteer?: (provider: string, nativeThreadId: string, gateReason: string) => SessionSteerAvailability | null
+
   ownership?: {
     record: (pid: number, startMs: number) => string
     release: (pid: number) => boolean
@@ -1607,6 +1640,17 @@ export const CONTINUE_NOTE_BUDGET_MS = 1_500
  */
 export const TURN_QUEUED_COPY = 'Queued to the original thread. It keeps running if you put your phone away.'
 
+/**
+ * 6.78.0: the refusal copy while a pin a dead boot left holds the thread. The time is the
+ * Mac's local clock, rounded UP to the minute, so the thread is never shown free early.
+ * 62 columns or fewer, no em dash, no arrow.
+ */
+export function orphanPinWaitCopy(releasesAt: number): string {
+  const at = new Date(Math.ceil(releasesAt / 60_000) * 60_000)
+  const hour = at.getHours() % 12 || 12
+  return `An earlier run may still be running · frees ${hour}:${String(at.getMinutes()).padStart(2, '0')}`
+}
+
 /** Status of a turn that is admitted and still running. */
 export const TURN_PENDING_COPY = 'Still working on your Mac.'
 
@@ -1878,14 +1922,39 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
   const runOccupancy = (provider: string, threadId: string): AttachabilityBody =>
     projectAttachability(routeOccupancy(provider, threadId))
 
-  const refuseAttach = (res: Response, reason: WriteRefusal): void => {
+  const refuseAttach = (res: Response, reason: WriteRefusal, extra: Record<string, unknown> = {}): void => {
     res.status(refusalStatus(reason)).json({
       attached: false,
       reason,
       reasonCopy: writeReasonCopy(reason),
+      ...extra,
     })
   }
 
+  /**
+   * 6.78.0: what an attach refusal on THIS thread adds. `steer` (COS_SESSION_STEER) on a
+   * refusal a turn may queue behind, from the shared rule. And when the holder is a pin a
+   * dead boot left (COS_PIN_BOOT_REAP), the copy says when it frees instead of telling the
+   * person to detach a chat that no longer exists. Empty with the flags off.
+   */
+  const attachRefusalExtras = (provider: string, threadId: string, reason: WriteRefusal, now: number | null): Record<string, unknown> => {
+    const extra: Record<string, unknown> = {}
+    if (reason === 'native_target_busy' && now !== null && typeof deps.bindings?.orphanPinHold === 'function') {
+      let hold: { releasesAt: number; childRunning?: true } | null = null
+      try { hold = deps.bindings.orphanPinHold(provider, threadId, now) } catch { hold = null }
+      if (hold && Number.isFinite(hold.releasesAt)) extra.reasonCopy = orphanPinWaitCopy(hold.releasesAt)
+      // P7 S6: past the window, the dead boot's child itself still runs: no time to promise
+      // (such a hold carries no finite releasesAt, so the line above never wrote).
+      if (hold?.childRunning === true) extra.reasonCopy = ORPHAN_CHILD_RUNNING_COPY
+    }
+    if (sessionSteerEnabled() && typeof deps.sessionSteer === 'function' && queueableRefusal(reason)) {
+      let steer: SessionSteerAvailability | null = null
+      try { steer = deps.sessionSteer(provider, threadId, reason) } catch { steer = null }
+      if (steer) extra.steer = steer
+    }
+    return extra
+  }
+
   /** Read a finite clock, or null. A route that cannot tell the time refuses. */
   const readNow = (): number | null => {
     try {
@@ -2335,7 +2404,10 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
       // or any doubt about whether it has one — is Fork-only, and attach is the
       // gate that makes that true.
       const verdict = runOccupancy(providerParam, threadIdParam)
-      if (!verdict.attachable) return refuseAttach(res, verdict.reason ?? 'probe_failed')
+      if (!verdict.attachable) {
+        const refused = verdict.reason ?? 'probe_failed'
+        return refuseAttach(res, refused, attachRefusalExtras(providerParam, threadIdParam, refused, now))
+      }
 
       // `runOccupancy` already proved both, provider first. These narrow the types
       // rather than re-deciding the rule — a second copy of the id rule is how the
@@ -2352,7 +2424,7 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
       // a per-binding fence.
       if (fenced !== null) {
         console.warn(`[agent-session-bindings] fence hit route=attach provider=${providerParam} target=${opaqueRevision(key)}`)
-        return refuseAttach(res, fenced)
+        return refuseAttach(res, fenced, attachRefusalExtras(providerParam, threadIdParam, fenced, now))
       }
 
       const resolve = deps.resolveTarget
@@ -2391,7 +2463,10 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
         ttlMs: attachTtlMs,
         now,
       })
-      if (!created?.binding) return refuseAttach(res, registryRefusal(created?.reason))
+      if (!created?.binding) {
+        const refused = registryRefusal(created?.reason)
+        return refuseAttach(res, refused, attachRefusalExtras(providerParam, threadIdParam, refused, now))
+      }
 
       const activated = deps.bindings.activate!(bindingId, now)
       if (!activated?.binding) {
@@ -2775,6 +2850,17 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
      * alone is backgrounded once the last gate passes.
      */
     let queued = false
+    /**
+     * 6.78.0 (COS_QUEUE_RECONCILE): the attempt journal. Opened with the pin (same commit),
+     * settled with the unpin. Where the turn MAY have gone: `proven` once a hop showed it
+     * arrived; `liveMay` / `spawnMay` once a hop that could have written was entered and did
+     * not prove nothing reached. `not_sent` only when every hop entered said nothing did.
+     */
+    let attemptOpened = false
+    let proven = false
+    let liveMay = false
+    let spawnMay = false
+    const attemptExit = (): 'sent' | 'not_sent' | 'unknown' => (proven ? 'sent' : liveMay || spawnMay ? 'unknown' : 'not_sent')
 
     const respond = (status: number, payload: Record<string, unknown>): void => {
       if (!res.headersSent) {
@@ -2919,6 +3005,46 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
         return
       }
 
+      // 6.78.0: RECEIPTS, before any gate, claim, pin or hop. The ledger above is dropped
+      // with its binding and records nothing for a pre-202 `live_unverified`; a crash after
+      // the pin leaves no record at all. The receipt covers those (target-scoped attempt
+      // journal, the queue's settled rows), so a phone that retries a key after a reconnect
+      // or a restart can never put the same words in twice. A hit is replayed, never sent:
+      // `delivered` as a completed turn, `unknown` as the ambiguous outcome every client
+      // already treats as "do not send again".
+      if (queueReconcileEnabled() && typeof deps.turnReceipt === 'function') {
+        const owner = deps.bindings.get?.(bindingId) ?? null
+        if (owner && isBindableProvider(owner.provider) && isValidNativeThreadId(owner.nativeThreadId)) {
+          let receipt: TurnReceipt | null
+          try {
+            receipt = deps.turnReceipt(owner.provider, owner.nativeThreadId, clientTurnId, prompt)
+          } catch (error) {
+            // A receipt we could not read is not "never sent". Fail closed: unknown.
+            console.error(`[agent-session-bindings] turn receipt read failed: ${error instanceof Error ? error.message : error}`)
+            receipt = { kind: 'unknown', source: 'attempt' }
+          }
+          if (receipt !== null) {
+            const delivered = receipt.kind === 'delivered'
+            if (!res.headersSent) {
+              res.status(delivered ? 200 : refusalStatus('delivery_ambiguous')).json({
+                turnId,
+                outcome: delivered ? 'completed' : 'ambiguous',
+                deliveryState: delivered ? 'delivered' : 'unknown',
+                retryable: false,
+                changed: false,
+                revision: null,
+                reason: delivered ? null : 'delivery_ambiguous',
+                reasonCopy: delivered ? TURN_SENT_COPY : writeReasonCopy('delivery_ambiguous'),
+                replayed: true,
+                receipt: receipt.source,
+              })
+              console.log(turnTiming(`receipt/${receipt.kind}/${receipt.source}`))
+            }
+            return
+          }
+        }
+      }
+
       // The client-queued-prompt gate, used rather than reimplemented: it is the
       // one place that orders state before epoch before target, and a second
       // opinion here is how the store's own header says the two drifted apart.
@@ -3004,10 +3130,19 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
 
       // A failed pin is FATAL, per the registry's own caller contract: an unpinned
       // binding can expire or be detached mid-turn, which defeats the lease.
-      const pinned = deps.bindings.pin!(bindingId, turnId, now)
+      // 6.78.0: the pin names its client turn (COS_PIN_BOOT_REAP) and opens the attempt
+      // (COS_QUEUE_RECONCILE) in its own commit: on disk before any frame or spawn below.
+      const pinExtras: PinExtras = {
+        ...(pinBootReapEnabled() ? { pinMeta: { clientTurnId } } : {}),
+        ...(queueReconcileEnabled() ? { attempt: { clientTurnId, mode: 'turn' as const } } : {}),
+      }
+      const pinned = Object.keys(pinExtras).length > 0
+        ? deps.bindings.pin!(bindingId, turnId, now, pinExtras)
+        : deps.bindings.pin!(bindingId, turnId, now)
       stage('pin')
       if (!pinned?.binding) return refuseTurn(registryRefusal(pinned?.reason))
       pinnedBindingId = bindingId
+      attemptOpened = pinExtras.attempt !== undefined
 
       // 6.53.0: a cancel that landed during the gate or the head read. Before the live hop,
       // which cannot be recalled once it writes into the open session. Nothing was sent;
@@ -3051,7 +3186,10 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
           live = null
         }
         stage(`live(${live?.reason ?? 'threw'})`)
+        // 6.78.0: a throw is a transport bug, not proof the frame never left.
+        if (live === null) liveMay = true
         if (live?.ok) {
+          proven = true
           // 6.53.3: delivered, so the turn runs in the open session now, and what stops it
           // there is the desk halt marker. The turn itself WAS delivered and says so.
           const latched = latchedHere()
@@ -3071,6 +3209,7 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
           return
         }
         if (live && (live.reason === 'unverified' || live.reason === 'write_failed')) {
+          liveMay = true
           // 6.53.3: something MAY be in the session and the person asked for it to stop: arm
           // the marker as for a landed turn, and settle this turn as cancelled, never as a
           // retryable hold that the queue would send again after the cancel's two minutes.
@@ -3123,7 +3262,10 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
           live = null
         }
         stage(`codex-live(${live?.reason ?? 'threw'})`)
+        // 6.78.0: a row MAY be in the Codex app's queue after a throw or an unverified write.
+        if (live === null || live.reason === 'unverified') liveMay = true
         if (live?.ok) {
+          proven = true
           // 6.53.3: queued in the Codex app, which only the app can stop ("Stop it there").
           const latched = latchedHere()
           if (latched) settleLatchedCancel(latched, binding.provider, binding.nativeThreadId, 'reached', { prompt, sentAt: handOffAt, busy: busyCodexHop })
@@ -3221,6 +3363,7 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
 
       let delivery: Delivery
       deliveryAttempted = true
+      spawnMay = true
       try {
         const result = await deliver({
           turnId,
@@ -3261,6 +3404,11 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
             // occupancy check.
             if (outcome !== 'recorded') return false
             recordedPids.push({ pid, startMs })
+            // 6.78.0 (P7 S6): the pin names this child, so after a crash the thread waits for
+            // THIS process to be gone, not only for the window. Never fails the turn.
+            if (pinBootReapEnabled() && typeof deps.bindings.notePinChild === 'function') {
+              try { deps.bindings.notePinChild(bindingId, turnId, { pid, startMs }) } catch { /* the window still bounds the pin */ }
+            }
             return true
           },
         })
@@ -3310,7 +3458,11 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
         return refuseTurn('turn_cancelled', { retryable: false, deliveryState: 'cancelled' })
       }
 
-      if (delivery.kind === 'aborted') return refuseTurn('provider_never_opened')
+      if (delivery.kind === 'aborted') {
+        // The adapter's own proof that the child never opened the session.
+        spawnMay = false
+        return refuseTurn('provider_never_opened')
+      }
 
       if (delivery.kind === 'ambiguous') {
         // Plan 4.6: the reservation is HELD, not released. A hand-crafted next
@@ -3356,6 +3508,7 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
         after = reread === null ? null : reread.digest
       }
       if (after !== null) guard.acknowledgeHead(bindingId, after)
+      proven = true
 
       // Phase 4 owns Message persistence. Nothing about the prompt or the reply is
       // written, logged or echoed here; the terminal outcome is the whole result.
@@ -3411,7 +3564,12 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
       }
       if (pinnedBindingId !== null) {
         try {
-          deps.bindings.unpin!(pinnedBindingId, turnId, readNow() ?? requestNow)
+          // 6.78.0: the attempt's exit rides the release, in one commit.
+          if (attemptOpened && clientTurnId !== null) {
+            deps.bindings.unpin!(pinnedBindingId, turnId, readNow() ?? requestNow, { attemptExit: { clientTurnId, exit: attemptExit() } })
+          } else {
+            deps.bindings.unpin!(pinnedBindingId, turnId, readNow() ?? requestNow)
+          }
         } catch (error) {
           console.error(`[agent-session-bindings] unpin failed: ${error instanceof Error ? error.message : error}`)
         }

package/server/routes/glossary.ts

@@ -198,7 +198,7 @@ function commitWords(words: GlossaryWords, nextLog: CorrectionLogEntry[], previo
   resetVocabEchoCache()
 }
 
-type Outcome = { status: number; body: unknown }
+export type Outcome = { status: number; body: unknown }
 
 function serialized(work: () => Outcome): Promise<Outcome> {
   const run = putChain.catch(() => {}).then(work)
@@ -206,17 +206,27 @@ function serialized(work: () => Outcome): Promise<Outcome> {
   return run
 }
 
+/**
+ * Learn one correction inside the glossary write chain, exactly as POST
+ * /transcription-glossary/correction does (logged, undoable). Exported for the transcript
+ * cleanup's dictionary suggestions (6.77.0), so an accepted suggestion uses this writer and
+ * never a second copy of it.
+ */
+export function glossaryLearnCorrection(body: unknown): Promise<Outcome> {
+  return serialized(() => {
+    const previousLog = readCorrectionsLog()
+    const learned = learnCorrection(storedWords(), (body ?? {}) as { heard: unknown; written: unknown; source: unknown }, { id: randomUUID(), at: new Date().toISOString() })
+    if (!learned.ok) return { status: learned.status, body: { error: learned.error } }
+    if (learned.unchanged) return { status: 200, body: { unchanged: true, entry: null, glossary: currentGlossary() } }
+    commitWords(learned.words, appendLog(previousLog, learned.entry), previousLog)
+    return { status: 200, body: { unchanged: false, entry: learned.entry, glossary: currentGlossary() } }
+  })
+}
+
 glossaryRouter.post('/transcription-glossary/correction', async (req, res) => {
   const body = req.body ?? {}
   try {
-    const outcome = await serialized(() => {
-      const previousLog = readCorrectionsLog()
-      const learned = learnCorrection(storedWords(), body, { id: randomUUID(), at: new Date().toISOString() })
-      if (!learned.ok) return { status: learned.status, body: { error: learned.error } }
-      if (learned.unchanged) return { status: 200, body: { unchanged: true, entry: null, glossary: currentGlossary() } }
-      commitWords(learned.words, appendLog(previousLog, learned.entry), previousLog)
-      return { status: 200, body: { unchanged: false, entry: learned.entry, glossary: currentGlossary() } }
-    })
+    const outcome = await glossaryLearnCorrection(body)
     return res.status(outcome.status).json(outcome.body)
   } catch (err) {
     return res.status(500).json({ error: errMsg(err) })
@@ -250,20 +260,29 @@ glossaryRouter.post('/transcription-glossary/correction/undo', async (req, res)
 // ── Single-item hand edits (6.73.12) ─────────────────────────────────────────
 // One word or one correction at a time, inside the same chain as PUT and learn,
 // so COS Control never has to read the whole map and write it back.
+function runSingleEdit(edit: (words: GlossaryWords, raw: unknown) => ReturnType<typeof addVocabulary>, raw: unknown): Promise<Outcome> {
+  return serialized(() => {
+    const result = edit(storedWords(), raw)
+    if (!result.ok) return { status: result.status, body: { error: result.error } }
+    if (!result.unchanged) {
+      updateProfileFields({ vocabulary: result.words.vocabulary, whisper_corrections: JSON.stringify(result.words.corrections) })
+      resetDecoderCaches()
+      resetVocabEchoCache()
+    }
+    return { status: 200, body: { unchanged: result.unchanged, glossary: currentGlossary() } }
+  })
+}
+
+/** Add one vocabulary word inside the glossary write chain (same as POST /transcription-glossary/vocabulary/add). */
+export function glossaryAddVocabulary(term: unknown): Promise<Outcome> {
+  return runSingleEdit(addVocabulary, term)
+}
+
 function singleEdit(path: string, field: 'term' | 'heard', edit: (words: GlossaryWords, raw: unknown) => ReturnType<typeof addVocabulary>) {
   glossaryRouter.post(path, async (req, res) => {
     const raw = (req.body ?? {})[field]
     try {
-      const outcome = await serialized(() => {
-        const result = edit(storedWords(), raw)
-        if (!result.ok) return { status: result.status, body: { error: result.error } }
-        if (!result.unchanged) {
-          updateProfileFields({ vocabulary: result.words.vocabulary, whisper_corrections: JSON.stringify(result.words.corrections) })
-          resetDecoderCaches()
-          resetVocabEchoCache()
-        }
-        return { status: 200, body: { unchanged: result.unchanged, glossary: currentGlossary() } }
-      })
+      const outcome = await runSingleEdit(edit, raw)
       return res.status(outcome.status).json(outcome.body)
     } catch (err) {
       return res.status(500).json({ error: errMsg(err) })

package/server/routes/health.ts

@@ -57,7 +57,8 @@ import { G2_LENS_VARIANT_CAPABILITY } from '../lib/media-store.js'
 // The flag lives beside the endpoints it describes, so it cannot drift from
 // whether they are actually registered.
 import { MEDIA_CHUNKED_UPLOAD_ENABLED } from './media.js'
-import { durableQueryJobsCapability, messagesTrailEnabled } from '../lib/query-job-feature.js'
+import { durableQueryJobsCapability, messagesSteerCapability, messagesTrailEnabled } from '../lib/query-job-feature.js'
+import { claudeSteerSupportKnown } from '../lib/claude-cli-support.js'
 import { jobTrailStats } from '../lib/job-trail.js'
 import { getQueryJobRuntimeHealth } from '../lib/query-job-runtime.js'
 import { getMorningBriefScheduler } from '../lib/morning-brief-runtime.js'
@@ -69,6 +70,7 @@ import { maintenanceLifecycle } from '../lib/maintenance-lifecycle.js'
 import { getLocalTtsHealth, refreshLocalTtsHealth } from '../lib/tts-local.js'
 import { liveCuesCapability } from '../lib/live-cues-capability.js'
 import { liveCuesV2Advertised } from '../lib/live-cues-v2.js'
+import { transcriptCleanupAdvertised } from './transcript-cleanup.js'
 import { getMeetingSyncSnapshot } from '../lib/meeting-batch-progress.js'
 import { listUnsavedCaptures } from '../lib/unsaved-audio-quarantine.js'
 import { getStrandedCaptures } from './transcribe-stream.js'
@@ -99,6 +101,7 @@ import { permissionBrokerHealthFields, sessionQuestionsCapability } from '../lib
 import { continueLiveEnabled, liveDeliveryStats } from '../lib/session-peer-inbox-deps.js'
 import { codexLiveStats } from '../lib/codex-live-queue-deps.js'
 import { codexLiveQueueEnabled } from '../lib/codex-live-queue.js'
+import { bootResumeGate } from '../lib/boot-resume.js'
 
 /**
  * 6.49.0: which last hop a Continue takes, and how often each fell back.
@@ -497,6 +500,8 @@ healthRouter.get('/health', async (_req, res) => {
       cliDebug: CLI_DEBUG_CAPABILITY,
       liveCues,
       ...(liveCuesV2Advertised() ? { liveCuesV2: liveCuesV2Advertised() } : {}),
+      // 6.77.0: codes only (this route is public): the protocol and whether the switch is on.
+      transcriptCleanup: transcriptCleanupAdvertised(),
       richMedia: {
         text: true,
         pdf: richMedia.pdf,
@@ -541,9 +546,23 @@ healthRouter.get('/health', async (_req, res) => {
       enabled: durableJobs.enabled && messagesTrailEnabled(),
       ...jobTrailStats(),
     },
+    // 6.78.0 (P7 S5): how much boot-resumed work is parked for crash-looping the server. A
+    // count only (health is public); the items and their Retry are behind the token at
+    // GET /api/maintenance/status.
+    crash_loop_parking: crashLoopParkingHealth(),
   })
 })
 
+/** Never throws: health must not 500 because of the ledger. */
+function crashLoopParkingHealth(): { enabled: boolean; parked: number } {
+  try {
+    const status = bootResumeGate().status()
+    return { enabled: status.enabled, parked: status.parked.length }
+  } catch {
+    return { enabled: false, parked: 0 }
+  }
+}
+
 // Stable app slots backed by Codex + Cursor live catalogs. Authenticated by
 // global /api middleware; ?refresh=1 forces discovery.
 healthRouter.get('/models', async (req, res) => {
@@ -644,6 +663,9 @@ healthRouter.get('/models', async (req, res) => {
         // THIS surface (not /api/health) and falls back to the activity log without it.
         // False whenever jobs themselves are off or COS_MESSAGES_TRAIL=0.
         trail: durableJobs.enabled && messagesTrailEnabled(),
+        // 6.78.0 Messages steer: present only with COS_MESSAGES_STEER on and a Claude CLI that
+        // takes stream-json input (probed once). Absent, the app shows today's UI.
+        ...steerCapabilityField(durableJobs.enabled),
       },
       // 6.52.0: the session questions API and its client contract. A client polls
       // `GET /api/session-questions?client=glasses|phone` every `pollIntervalMs`; one
@@ -692,6 +714,12 @@ healthRouter.get('/models', async (req, res) => {
     },
   })
 })
+/** 6.78.0: `{ steer }` for /api/models `durableQueryJobs`, or nothing at all. */
+export function steerCapabilityField(jobsEnabled: boolean): { steer?: { protocolVersion: 1; providers: ['claude'] } } {
+  const steer = messagesSteerCapability({ jobsEnabled, cliSupported: claudeSteerSupportKnown() })
+  return steer ? { steer } : {}
+}
+
 // GET /api/cli-session — returns current CLI session ID for cross-device resume
 healthRouter.get('/cli-session', (req, res) => {
   const cosSessionId = req.query.sid as string | undefined

package/server/routes/live-cues.ts

@@ -4,6 +4,8 @@
 // POST /live-cues/start { sessionId }  -> { armed, sessionId, pipelinesUsed }
 // POST /live-cues/stop  { sessionId }  -> { nudgesGenerated, nudges }
 // GET  /live-cues/status               -> engine snapshot + capability
+// GET  /live-cues/v2/settings           -> { enabled, source: env|setting|default, capability }       (6.76.2)
+// POST /live-cues/v2/settings { enabled } -> same shape; 409 { error: 'env_forced' } when env forces v2 on
 
 import { Router } from 'express'
 import { errMsg } from '../lib/utils.js'
@@ -14,7 +16,7 @@ import {
   LiveCuesArmError,
 } from '../lib/live-cues-engine.js'
 import { liveCuesCapability } from '../lib/live-cues-capability.js'
-import { LiveCuesV2ArmError, liveCuesV2, liveCuesV2Advertised, liveCuesV2Enabled } from '../lib/live-cues-v2.js'
+import { LiveCuesV2ArmError, liveCuesV2, liveCuesV2Advertised, liveCuesV2Enabled, liveCuesV2SettingsView, peekLiveCuesV2, setLiveCuesV2Enabled } from '../lib/live-cues-v2.js'
 
 const SESSION_ID = /^[A-Za-z0-9:_-]{3,96}$/
 const CUE_ID = /^[A-Za-z0-9-]{8,64}$/
@@ -22,6 +24,10 @@ function bodySessionId(body: unknown): string {
   const raw = (body as { sessionId?: unknown })?.sessionId
   return typeof raw === 'string' ? raw.trim() : ''
 }
+/** v2 owns this meeting: v2 is on, or it armed the meeting before v2 was switched off at runtime. */
+function v2Owns(sessionId: string): boolean {
+  return liveCuesV2Enabled() || (peekLiveCuesV2()?.knows(sessionId) ?? false)
+}
 
 export const liveCuesRouter = Router()
 
@@ -59,14 +65,14 @@ liveCuesRouter.post('/live-cues/stop', (req, res) => {
   // Shape matches the existing client stop handler: it reads nudgesGenerated
   // for its log line and hydrates meetingNudgeHistory from nudges when SSE
   // missed events (the 200-event replay buffer is flooded by transcript_chunk).
-  if (liveCuesV2Enabled()) return res.json(liveCuesV2().end(sessionId))
+  if (v2Owns(sessionId)) return res.json(liveCuesV2().end(sessionId))
   return res.json(disarmLiveCues(sessionId))
 })
 
 liveCuesRouter.get('/live-cues/status', (req, res) => {
   const sessionId = typeof req.query.sessionId === 'string' ? req.query.sessionId.trim() : ''
   // v2 with a sessionId answers the per-meeting shape; without one the v1 shape is unchanged (plus v2 capability).
-  if (sessionId && liveCuesV2Enabled()) {
+  if (sessionId && v2Owns(sessionId)) {
     if (!SESSION_ID.test(sessionId)) return res.status(400).json({ error: 'invalid sessionId', reason: 'invalid_session_id' })
     return res.json(liveCuesV2().status(sessionId))
   }
@@ -101,3 +107,26 @@ liveCuesRouter.post('/live-cues/feedback', (req, res) => {
   if (!liveCuesV2Enabled()) return res.status(404).json({ error: 'live cues v2 is off', reason: 'v2_disabled' })
   return res.json(liveCuesV2().recordFeedback({ sessionId, cueId, vote: body.vote, reason: body.reason as string | undefined }))
 })
+
+// COS Control's live cues v2 toggle (6.76.2). Token-authenticated like every /api route. The setting lives in this server's
+// data dir (live-cues-v2-settings.json, atomic write) and applies without a restart: /api/health and /api/models advertise
+// liveCuesV2 only while it is on. capability.memory and capability.decisionProvider say where notes and the gate come from.
+liveCuesRouter.get('/live-cues/v2/settings', (_req, res) => {
+  res.set('Cache-Control', 'private, no-store')
+  try { return res.json(liveCuesV2SettingsView()) } catch { return res.status(503).json({ error: 'settings_unavailable' }) }
+})
+
+liveCuesRouter.post('/live-cues/v2/settings', (req, res) => {
+  res.set('Cache-Control', 'private, no-store')
+  const body = req.body as { enabled?: unknown } | undefined
+  if (!body || typeof body !== 'object' || Array.isArray(body) || typeof body.enabled !== 'boolean') {
+    return res.status(400).json({ error: 'invalid_request' })
+  }
+  try {
+    const result = setLiveCuesV2Enabled(body.enabled)
+    if (!result.ok) return res.status(409).json({ error: result.error })
+    return res.json(result.view)
+  } catch {
+    return res.status(500).json({ error: 'settings_write_failed' })
+  }
+})

package/server/routes/maintenance.ts

@@ -17,6 +17,7 @@ import { getServerInstanceId } from '../lib/server-instance-id.js'
 import { getWhisperHealth } from '../lib/whisper-local.js'
 import { getActiveTranscriptionSessionCount, getTranscriptionSessionLiveness } from './transcribe-stream.js'
 import { getVideoUploadRegistry } from '../lib/video-upload-v2.js'
+import { bootResumeGate, isBootResumeKind, resumeRetriedItem, type ParkedBootResume } from '../lib/boot-resume.js'
 
 export const maintenanceRouter = Router()
 
@@ -69,6 +70,15 @@ function operationCredentials(req: Request): MaintenanceOperationCredentials {
   }
 }
 
+/** 6.78.0: boot-resumed work parked for crash-looping the server. Never throws. */
+function parkedSnapshot(): ParkedBootResume[] {
+  try {
+    return bootResumeGate().status().parked
+  } catch {
+    return []
+  }
+}
+
 function statusSnapshot(credentials: MaintenanceOperationCredentials = {}) {
   const jobs = getQueryJobRuntimeHealth()
   const activeTranscriptionSessions = getActiveTranscriptionSessionCount()
@@ -133,6 +143,9 @@ function statusSnapshot(credentials: MaintenanceOperationCredentials = {}) {
     // block a binary downgrade, where an old server could erase V2 evidence.
     safeToRestart: lifecycle.safeToRestart && !jobs.shuttingDown && !videoUploads.blocksRestart,
     whisper: getWhisperHealth(),
+    // 6.78.0, additive (contractVersion unchanged): work a boot no longer resumes because
+    // it crashed the server on RESTART_LIMIT boots in a row. Retry with the route below.
+    parked: parkedSnapshot(),
   }
 }
 
@@ -155,6 +168,27 @@ maintenanceRouter.get('/maintenance/status', (req, res) => {
   res.json(statusSnapshot(operationCredentials(req)))
 })
 
+// 6.78.0: the person's Retry of parked boot-resumed work (lib/boot-resume.ts). The API
+// token, like GET /maintenance/status, and not loopback-only, so the phone and the lens can
+// offer it; the /api mutation lease still refuses it during a drain. The count starts over;
+// a meeting finalization is resumed again now, and a query job (id = its clientJobId) runs
+// again when the app Retries it (a parked Ask is never resumable: it never started).
+maintenanceRouter.post('/maintenance/parked/:kind/:id/retry', (req, res) => {
+  const { kind, id } = req.params
+  if (!isBootResumeKind(kind)) {
+    res.status(400).json({ error: 'unknown_parked_kind', retryable: false })
+    return
+  }
+  const gate = bootResumeGate()
+  if (!gate.isParked(kind, id)) {
+    res.status(404).json({ error: 'not_parked', retryable: false })
+    return
+  }
+  const entry = gate.retry(kind, id)
+  const resumed = resumeRetriedItem(kind, id)
+  res.json({ retried: true, resumed, entry })
+})
+
 maintenanceRouter.post('/maintenance/drain', (req, res) => {
   if (!requireLoopback(req, res)) return
   try {