@gotcos/glasses-server 6.77.0 → 6.78.0

package/.env.example

@@ -61,6 +61,38 @@ BIND_HOST=0.0.0.0
 # and drain safely.
 # COS_DURABLE_QUERY_JOBS=0
 
+# 6.78.0: crash-loop parking. Work the server resumes on boot (meeting finalization, a
+# question that never started) is parked after it was resumed on 3 boots in a row that each
+# followed a crash less than 30 minutes after the last, instead of restarting the server
+# forever. Update Server and other clean restarts never count, and a clean exit starts the
+# count over. Parked work stays saved and is listed under `parked` in
+# GET /api/maintenance/status (the count is on /api/health). Retry it with
+# POST /api/maintenance/parked/<kind>/<id>/retry with the API token (the phone and the lens
+# can, not only this Mac), or Retry the question in the app. A parked meeting finalization
+# also gets one automatic second chance on the first boot 30 minutes after it was parked.
+# On by default; 0 / false / off turns it off (6.77.0 behaviour).
+# COS_CRASH_LOOP_PARKING=0
+
+# 6.78.0: restart truth. A question a restart cut off (a crash, or a graceful stop such as
+# Update Server or a Mac restart) ends "Server restarted. Tap to retry." and its job record
+# names the step it was cut off during and the steps that had already changed something
+# (edits, commands), so you can choose Resume or Retry knowing what already happened. On by
+# default; 0 / false / off turns it off (the 6.77.0 messages, and no `interruption` record).
+# COS_RESTART_NOTICE=0
+
+# 6.78.0: the compact question journal. Off by default in this release: this release only
+# READS compact rows, so a rollback to it from the next one keeps every answer. 1 / true / on
+# stores each streamed piece once instead of the whole answer so far (much smaller journals).
+# Leave it off until the release after 6.78.0 turns it on.
+# COS_QUERY_JOB_DELTA_JOURNAL=1
+
+# 6.78.0: steer a running answer from the glasses (Claude only). Off by default in 6.78.0.
+# 1 / true / on lets COS Glasses 6.10.645 or later add guidance to an Ask while Claude is still
+# working on it: the guidance joins the running answer at its next step. Codex, Cursor and
+# Ollama answers are never steered; the app sends the guidance as the next Ask instead.
+# Needs a Claude Code CLI that lists --input-format and --replay-user-messages.
+# COS_MESSAGES_STEER=1
+
 # 6.52.0: the Messages trail (readable steps of a running Messages job, journaled and sent
 # only to a client that asks with ?trail=1). On by default. 0 is the rollback that needs no
 # downgrade: no trail is recorded and every job stream and snapshot is the 6.51.0 one.
@@ -377,3 +409,11 @@ COS_CONTINUE_FULL_PERMISSIONS=1
 # Drop-in alternative: link a folder holding parakeet-ultra/ to
 # <data>/stt/parakeet-sources and an install started with {} uses it, no download.
 
+
+# ── Sessions: restart safety, Send again and steer (6.78.0) ─────────────────
+# Read per request, like every 6.78.0 switch: 1 / true / on is on, 0 / false / off is off,
+# anything else the default.
+# COS_QUEUE_RECONCILE=1   # attempt journal, restart reconcile, receipts, reason copy (default on)
+# COS_PIN_BOOT_REAP=1     # free a thread a crashed run held, 31 min after the restart and once its child is gone (default on; 0 = the 24 h reap)
+# COS_QUEUE_RESEND=1      # Send again on a refused or expired queued turn (default on)
+# COS_SESSION_STEER=0     # steer a busy Claude session through its peer inbox (default off)

package/CHANGELOG.md

@@ -1,3 +1,19 @@
+## 6.78.0 - Steer from the glasses, Retry and Send again, and crash safety for Asks and desk turns (Pi Durable parity)
+
+Pairs with COS Glasses companion 6.10.645. Includes 6.77.0. No COS Control change is required (0.5.322 and 0.5.323 work; see the client matrix). Miles, 2026-10-18: steer from the glasses and retry, for Messages and Sessions; no regressions; better offline to online. Plan: Pi Durable parity build v3.1.
+
+- **Messages steer (`COS_MESSAGES_STEER`, default off).** A running Claude Ask that was admitted `steerable: true` (outside the fingerprint) runs with `--input-format stream-json --replay-user-messages`: the prompt is one stream-json user line and stdin stays open. `POST /api/query-jobs/:jobId/steer {generation, steerId, text}` journals the steer (fsync) before it is written to stdin, then answers `{steerId, state, fallback, jobStatus}`; `GET /api/query-jobs/steers/:steerId?clientJobId=` answers the same from the newest generation. States: accepted, delivered (the CLI replayed the line), folded (a result covered it), included (carried into a Resume), too_late, unsupported, not_applied (computed when read). The run finishes only when the results cover every line written; a result that covers the prompt with a steer still open journals an answer checkpoint, and every terminal path but cancel completes with it. Same id and text replays; other text is 409 `steer_identity_conflict`; 8 steers a job (429 `steer_limit`). `fallback` is `queue_follow_up` for too_late, unsupported, and not_applied on a completed job only; a failed or interrupted job answers null because Retry or Resume carries the steer into generation + 1. A steer the CLI replayed (delivered) never falls back, even when a deadline, a restart or a second-turn error then completes the job from its checkpoint and the steer reads not_applied: it may already be in the answer or the session, so sending it again would apply it twice. A run that ends with a steer line written and no result covering it kills the CLI (instead of closing stdin, which let the CLI run the line unwatched) and drops its CLI session mapping, so the next Ask does not `--resume` a session that holds the line. The steer cut-off is measured on the monotonic clock the run's timers use, so a Mac that slept does not refuse every steer as too late. SSE `?steer=1` adds `event: steer` frames with no `id:` and no eventSeq. Capability `capabilities.durableQueryJobs.steer = {protocolVersion: 1, providers: ["claude"]}` only with the switch on and the CLI probe passed. Codex, Cursor and Ollama answer `unsupported`. With the switch off every argument, stdin byte and route body is 6.77.0's (goldens recorded from 6.77.0).
+- **Session steer (`COS_SESSION_STEER`, default off).** `POST /api/agent-sessions/:provider/:threadId/queued-turns` takes `mode: "steer"` and `fallback: "queue"|"none"`. A busy Claude thread with a peer inbox, `COS_CONTINUE_LIVE` on and no pending permission prompt gets the steer through the peer inbox (200 `{state: delivered, reason: steered}`): the intent row is written durably, then the attempt, then the frame. Unverified, a write failure or a throw: 200 `refused`, `steer_unverified`, `deliveryState: unknown`, never resent. Otherwise it queues (202 with `steerFallback`). The attach refusal gains `steer: {available, mode | reason}` and `act.steer` per provider; both are absent with the switch off.
+- **Restart truth (`COS_RESTART_NOTICE`, default on).** An Ask cut off by a crash (`server_restarted`) or a graceful shutdown (`server_shutdown`) ends with `error: {code: interrupted, cause, message: "Server restarted. Tap to retry.", retryable: true}` (31 characters: the whole message fits the lens's 32-column lead) and an `interruption` block built from the job's own trail: `cutOffDuring`, `alreadyDone` (side effects only, 5 entries of 60 characters at most), `incomplete`, `resumable`. A graceful shutdown first lets the steps a run already reported reach the journal (1 s for all runs). The raw text `server_shutdown` no longer reaches the lens.
+- **Crash-loop parking (`COS_CRASH_LOOP_PARKING`, default on).** Boot-resumed work (a meeting finalization, a requeued Ask) that crashed the server on 3 consecutive boots within 30 minutes is parked instead of retried forever. Clean restarts never count; a missing or unreadable ledger reads as a clean boot; any I/O error fails open. A parked Ask ends `restart_limit`, `cause: crash_loop_parked`, "Stopped after 3 server crashes." `GET /api/maintenance/status` gains `parked[]` (contractVersion stays 2; a parked entry reads `attempts: 4`, the count past the limit); `POST /api/maintenance/parked/:kind/:id/retry` retries one (token auth, so the phone and the lens can, refused during a drain). `/api/health` adds `crash_loop_parking: {enabled, parked}`, a count only. A parked meeting finalization gets one automatic second chance on the first boot at least 30 minutes after it was parked (a kernel panic storm can park a meeting that was never the cause); a second park is permanent until Retry. A parked Ask never unparks by itself. The phone's Restart marks the exit clean before the kickstart, so a restart that ends in the 2 s `exit(1)` fallback is not counted as a crash.
+- **Queued desk turns after a crash (`COS_QUEUE_RECONCILE`, default on).** A durable attempt journal (target-scoped, 48 h) is written before any frame or spawn. A row entering `delivering` is stamped with its boot. At the next boot a row another boot left `delivering` is settled on evidence, in order: a completed or queued ledger record or a sent attempt, an exact transcript match, a Codex queue row with the same text (delivered); an ambiguous record, an unstamped 6.77 row or a steer row without evidence (unknown); only a `not_sent` attempt or a stamped row with no attempt goes back to waiting. Unknown is settled `refused`, `delivery_unknown_after_restart`, kept 6 h, never resent. The turns POST consults receipts (delivered rows, unknown rows, the attempt journal) before the claim, so a phone retry after a restart replays instead of sending twice; the drainer's own `delivering` row is never a receipt. Rows gain `reasonCopy`, `deliveryState`, `mode`, `resendOf`, `resentAs`.
+- **Orphan pins (`COS_PIN_BOOT_REAP`, default on).** A pin a dead boot left frees its thread 31 minutes after the later of the pin and the restart (the longest turn the attached adapter accepts, 30 minutes, plus one), not 24 h. A turn that spawned a resume child records the child's pid and measured start time on its pin, and that pin also waits until the child is gone (no such pid, or a reused one). Until then the attach refusal reads "An earlier run may still be running · frees h:mm", or, past the window with the child still running, "An earlier run is still running on this Mac".
+- **Send again (`COS_QUEUE_RESEND`, default on).** `POST .../queued-turns/:clientTurnId/resend` copies a refused or expired row's words into one new row, once from any surface (a repeat answers the first copy); an unknown original needs `acknowledge: "may_duplicate"` (409 `acknowledge_required`); a pruned one is 404 `unknown_turn`. Rows the flag can act on carry `resendable: true`.
+- **Ask journal size (MVP-D release 1).** The reader understands delta-only chunk rows and checks their length; `createQueryJobJournalStorage()` is exported. The writer stays behind `COS_QUERY_JOB_DELTA_JOURNAL` (default off) until the next release, so a rollback to 6.77.x never meets delta rows.
+- **Flags.** On by default with kill switches: `COS_CRASH_LOOP_PARKING`, `COS_RESTART_NOTICE`, `COS_QUEUE_RECONCILE`, `COS_PIN_BOOT_REAP`, `COS_QUEUE_RESEND`. Off by default (on for Miles's candidate, flipped after a 2-week field window): `COS_MESSAGES_STEER`, `COS_SESSION_STEER`, `COS_QUERY_JOB_DELTA_JOURNAL`. All eight are in `managed-runtime-contract.json` `optionalEnvironment`, `.env.example` and the README. All eight read the same way (one parser): `1`, `true` or `on` is on, `0`, `false` or `off` is off, case and spaces ignored, anything else the default.
+- **Client matrix.** Companion 6.10.645 shows the restart notice, Retry this ask, steer and Send again. Companion 6.10.644 shows an unknown row as "Refused" (its Edit parks the text as new and "Send as new" can duplicate), has no Send again, and still reads 409 `duplicate_turn` as parked. COS Control 0.5.322/0.5.323 shows "Refused · delivery unknown after restart", drops `reasonCopy` and has no Send again or parked-item row. A thread that had a stranded `delivering` row gets the busy-Codex hop back once the row is reconciled (intended).
+- **Known limits.** A parked meeting finalization shows in the maintenance status, the `/api/health` count and the `boot_resume.parked` log line until Control's row ships; it has its one automatic second chance meanwhile. Pre-6.78 pins and stranded rows settle as unknown, with no ledger record, during the upgrade window. A loop already running at install parks after 4 crashes, not 3. A pin with no recorded child (a 6.77 pin, a live delivery, a spawn whose record failed) has only the 31-minute window, a bound and not a proof the orphan is gone. Session steer is Claude only (Codex has `turn/steer`, but COS does not hold its app-server channel); with hooks off a session held on a permission prompt is steered and lands when the prompt is answered. Live-verified on Claude Code 2.1.302: Messages steer in the bridge's exact argument shape (`--include-partial-messages`, `--effort`, `--system-prompt`, `--allowedTools`) on a fresh session and on a `--resume`d persisted one. Not live-verified: a steer during a permission prompt (approval) on a Messages run, and MCP tools with stream-json input. Dispatch auto-resume (the restart planner ships uncalled, marked internal), phone steer buttons and the delta writer are deferred.
+
 ## 6.77.0 - Transcript cleanup: the passages the engine was unsure of, resolved with the meeting's text and screen context (default off)
 
 Includes 6.76.2. Off until Miles turns it on. No COS Control or companion change is required; Control can add the toggle, the screen feed and the Dictionary suggestions later against the contracts below.

package/README.md

@@ -464,7 +464,18 @@ No inline `#` on the EXTRA_ARGS line.),
 `COS_SCRIPTS_DIR` (full pipeline), `COS_DURABLE_QUERY_JOBS=0` (optional
 machine-wide rollback for build 204+ server-owned query recovery),
 `COS_MESSAGES_TRAIL=0` (6.52.0: no Messages trail; every job stream and snapshot is the
-6.51.0 one), `COS_PERMISSION_BROKER` (6.52.0: `0` answers every permission request with
+6.51.0 one), the 6.78.0 switches (each reads `1`, `true` or `on` as on and `0`, `false` or
+`off` as off; anything else is its default): `COS_CRASH_LOOP_PARKING` (default on: boot-resumed
+work that crashed the server on 3 boots in a row is parked; see `GET /api/maintenance/status`),
+`COS_RESTART_NOTICE` (default on: an Ask a restart cut off says so and names the step it was
+cut off during), `COS_QUEUE_RECONCILE` (default on: queued desk turns a crash cut off are
+settled on evidence, never sent twice), `COS_PIN_BOOT_REAP` (default on: a thread a crashed
+run held frees 31 minutes after the restart, once its child is gone), `COS_QUEUE_RESEND`
+(default on: Send again on a refused or expired queued turn), `COS_MESSAGES_STEER` (default
+off: steer a running Claude Ask from the glasses), `COS_SESSION_STEER` (default off: steer a
+busy Claude desk session through its peer inbox) and `COS_QUERY_JOB_DELTA_JOURNAL` (default
+off until the release after 6.78.0: the compact Ask journal writer),
+`COS_PERMISSION_BROKER` (6.52.0: `0` answers every permission request with
 the Mac's own dialog, `questions` holds questions but not tool approvals; unset holds
 both), `COS_PERMISSION_BROKER_DESK_IDLE_S` (default 90, never below 30),
 `COS_PERMISSION_BROKER_TIMEOUT_S` (default 110, clamped to 5 through 120),

package/managed-runtime-contract.json

@@ -14,7 +14,11 @@
     "HTTPS_PORT",
     "BIND_HOST",
     "COS_DURABLE_QUERY_JOBS",
+    "COS_CRASH_LOOP_PARKING",
     "COS_MESSAGES_TRAIL",
+    "COS_RESTART_NOTICE",
+    "COS_QUERY_JOB_DELTA_JOURNAL",
+    "COS_MESSAGES_STEER",
     "COS_LIVE_CUES",
     "COS_LIVE_CUES_MODEL",
     "COS_LIVE_CUES_GRAPH",
@@ -60,7 +64,11 @@
     "COS_LENS_GIST_DAILY_CAP",
     "COS_DIARIZER",
     "COS_NEMOTRON_CLI",
-    "COS_NEMOTRON_MODELS"
+    "COS_NEMOTRON_MODELS",
+    "COS_QUEUE_RECONCILE",
+    "COS_PIN_BOOT_REAP",
+    "COS_QUEUE_RESEND",
+    "COS_SESSION_STEER"
   ],
   "maintenance": {
     "scope": "cross_boot",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.77.0",
+  "version": "6.78.0",
   "description": "COS Glasses: self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {
@@ -62,7 +62,16 @@
     "!server/scripts/merged-scribe-mutation-gate.mjs",
     "!server/scripts/nemotron-replay.ts",
     "!server/scripts/turn-request-mutation-gate.mjs",
+    "!server/scripts/crash-loop-mutation-gate.mjs",
+    "!server/scripts/restart-notice-mutation-gate.mjs",
+    "!server/scripts/gate-anchor-check.mjs",
+    "!server/scripts/messages-steer-mutation-gate.mjs",
     "!server/scripts/mutation-gate.mjs",
+    "!server/scripts/turn-queue-durable-mutation-gate.mjs",
+    "!server/scripts/session-steer-mutation-gate.mjs",
+    "!server/scripts/check-gate-anchors.mjs",
+    "!server/scripts/transcript-cleanup-mutation-gate.mjs",
+    "!server/scripts/live-cues-v2-notes-mutation-gate.mjs",
     "!server/lib/meeting-engine/__fixtures__/**",
     "!server/lib/__fixtures__/**",
     "!shared/**/*.test.ts",

package/server/index.ts

@@ -28,7 +28,7 @@ import { cachedHookStatus, isCosSpawnedPid, registryEntrypointSync, claudeDeskRu
 import { clearingHaltOnSpawn, writeHaltMarker } from './lib/session-halt.js'
 import { startProviderObserveRefresh } from './lib/provider-observe.js'
 import { appendSessionCancelLedger, cancelHoldUntil as cancelHoldUntilFor, noteThreadCancelled, setDeskCancelReaders, threadCancel } from './lib/session-cancel.js'
-import { makeQueueTurnEvidence } from './lib/queue-turn-evidence.js'
+import { makeDeliveryEvidence, makeQueueTurnEvidence, makeTurnReceiptLookup } from './lib/queue-turn-evidence.js'
 import {
   PermissionBroker,
   brokerSignalSink,
@@ -48,10 +48,10 @@ import {
 
   threadAttachEnabled,
 } from './routes/agent-session-bindings.js'
-import { AgentSessionBindingRegistry } from './lib/agent-session-binding-registry.js'
+import { AgentSessionBindingRegistry, makePinChildProbe } from './lib/agent-session-binding-registry.js'
 import { targetKey } from './lib/agent-session-binding-store.js'
 import { cosSpawnedPids } from './lib/agent-session-ownership-store.js'
-import { buildOccupancyProbes, realOccupancyDirs, withCodexTurnClock, withCursorComposerTurn, withHookTurnClock } from './lib/occupancy-probes.js'
+import { buildOccupancyProbes, processStartMs, realOccupancyDirs, withCodexTurnClock, withCursorComposerTurn, withHookTurnClock } from './lib/occupancy-probes.js'
 import { readCodexTurnEndedAtMs } from './lib/codex-turn-clock.js'
 import { codexLiveQueueEnabled } from './lib/codex-live-queue.js'
 import { realAttachedWorkspaceDeps, resolveAttachedWorkspace } from './lib/attached-workspace.js'
@@ -64,7 +64,9 @@ import { readComposerFacts } from './lib/cursor-session-model.js'
 import { MAX_PROMPT_CHARS } from './lib/attached-provider-adapter.js'
 import { readRecentSessionTurns } from './lib/agent-session-turns.js'
 import { parseAgentSession } from './lib/agent-session-store.js'
-import { makeLiveTurnDeliverer } from './lib/session-peer-inbox-deps.js'
+import { makeLiveTurnDeliverer, readPeerInboxRecords } from './lib/session-peer-inbox-deps.js'
+import { selectPeerInbox } from './lib/session-peer-inbox.js'
+import { nativeQueueControl, plainQueueText } from './lib/codex-queue-control.js'
 import { makeCodexLiveDeliverer } from './lib/codex-live-queue-deps.js'
 import { forkThread, realForkDeps } from './lib/fork-thread.js'
 import { ForkJobLedger, fileForkJobPersistence } from './lib/fork-job-ledger.js'
@@ -158,6 +160,7 @@ import { createWorkSearchRouter } from './routes/work-search.js'
 import { isReadOnlyApiPost } from './lib/work-search.js'
 import { dataPath } from './lib/data-dir.js'
 import { loadJsonOrQuarantine, durableAtomicWriteFileSync } from './lib/atomic-fs.js'
+import { BOOT_RESUME_LEDGER_FILE, createBootResumeGate, installBootResumeGate } from './lib/boot-resume.js'
 import { WorkIntakeStore, createOptionalWorkIntakeStore } from './lib/work-intake-store.js'
 import { WorkHandoffRequestStore, createOptionalWorkHandoffRequestStore, handoffRequestCapabilities } from './lib/work-handoff-requests.js'
 import { createWorkBoardReader } from './lib/work-board-reader.js'
@@ -192,16 +195,16 @@ import {
 } from './lib/maintenance-lifecycle.js'
 
 const app = express()
-import { createThreadTurnQueueRouter, drainAllThreads } from './routes/thread-turn-queue.js'
+import { createThreadTurnQueueRouter, drainAllThreads, steerAvailabilityFor } from './routes/thread-turn-queue.js'
 import { createCursorStopFollowupRouter } from './routes/cursor-stop-followup.js'
-import { queuedThreadKeys, readQueue, transcriptTurnVerdict, writeQueue } from './lib/thread-turn-queue-store.js'
+import { queuedThreadKeys, readQueue, readTranscriptTailLines, transcriptTurnVerdict, writeQueue } from './lib/thread-turn-queue-store.js'
 import { cursorDeskHaltReady, hookHaltReady, readHookToken } from './lib/claude-hooks-installer.js'
 import { OPEN_TURN_CEILING_MS } from './lib/session-state-derive.js'
 import { createDrainKick, kickPlanFor } from './lib/thread-drain-kick.js'
 import { transcriptPathFor } from './lib/native-head.js'
 import { deliverQueuedTurnOverLoopback } from './lib/thread-turn-queue-deliver.js'
 import { readFences, writeFences } from './lib/thread-fence-store.js'
-import type { QueuedThreadTurn } from './lib/thread-turn-queue.js'
+import { sessionSteerEnabled, type QueuedThreadTurn } from './lib/thread-turn-queue.js'
 
 const PORT = parseInt(process.env.PORT ?? '3141', 10)
 
@@ -489,7 +492,9 @@ app.use((_req, _res, next) => {
 
 // Hydrated once at boot, before any route can read it. Never throws; a corrupt
 // or unreadable store yields a degraded registry rather than a silent empty one.
-const agentSessionBindingRegistry = AgentSessionBindingRegistry.open()
+// 6.78.0 (P7 S6): a crash's orphan pin that names its resume child waits for that pid, with
+// its MEASURED start time, so a reused pid reads as gone.
+const agentSessionBindingRegistry = AgentSessionBindingRegistry.open({ pinChildProbe: makePinChildProbe(processStartMs) })
 // Boot reap, and it is load-bearing rather than housekeeping. A turn pins its
 // binding and unpins in a `finally` that never runs if the process dies during the
 // provider run — a window of up to the 21-minute attached timeout, and exactly what
@@ -507,10 +512,23 @@ try {
 } catch (error) {
   console.warn('[binding-registry] boot reap failed', error)
 }
+// 6.78.0 (COS_PIN_BOOT_REAP): a pin a dead boot left frees its thread 21 minutes after the
+// later of its pin and this restart (the query jobs' orphan fence), not 24 h. Checked on the
+// tick below and lazily on every attach and occupancy check (`attachBlocked`, `create`).
+// Not at boot: nothing can be due until 21 minutes after this registry opened.
+const releaseOrphanPins = (when: string): void => {
+  try {
+    const orphans = agentSessionBindingRegistry.reapOrphanedPins(Date.now())
+    if (orphans.released > 0) console.log(`[binding-registry] ${when}: released ${orphans.released} pin(s) a dead boot left, ${orphans.recorded} recorded as delivery unknown`)
+  } catch (error) {
+    console.warn('[binding-registry] orphan pin release failed', error)
+  }
+}
 // And periodically, so a strand created mid-run clears without waiting for the next
 // restart. Unref'd so it never holds the process open during shutdown.
 const bindingReapTimer = setInterval(() => {
   try { agentSessionBindingRegistry.reap(Date.now()) } catch { /* next tick retries */ }
+  releaseOrphanPins('tick')
 }, 10 * 60_000)
 bindingReapTimer.unref()
 
@@ -865,6 +883,26 @@ const sharedTargetGuard = new TargetGuard(
     : null,
 )
 
+// 6.78.0 (P3): one live-turn transport for the turns route's live hop and Sessions steer,
+// so the health counters see both. And what a steer needs to know about a Claude session:
+// a peer inbox it can be reached through, and whether it is held on a dialog (hooks).
+const liveTurnDeliverer = makeLiveTurnDeliverer(nativeHeadDeps)
+const steerDeps = {
+  deliverLiveTurn: liveTurnDeliverer,
+  steerProbe: (_provider: string, threadId: string) => ({
+    peerInbox: selectPeerInbox(threadId, readPeerInboxRecords(), pid => cosSpawnedPids().has(pid)) !== null,
+    waitingOnPrompt: sessionHooksEnabled() ? (signalFor(threadId)?.waiting ?? null) !== null : false,
+  }),
+}
+/** The bounded transcript tail the reconcile and the receipts read evidence from. */
+const QUEUE_EVIDENCE_TAIL_BYTES = 4 * 1024 * 1024
+const queueEvidenceLines = (provider: string, threadId: string): readonly string[] | null =>
+  provider === 'claude' || provider === 'codex'
+    ? readTranscriptTailLines(transcriptPathFor(provider, threadId, nativeHeadDeps), QUEUE_EVIDENCE_TAIL_BYTES)
+    : null
+const queueAttempt = (provider: string, threadId: string, clientTurnId: string) =>
+  agentSessionBindingRegistry.attemptFor(provider, threadId, clientTurnId)
+
 const queueTurnEvidence = makeQueueTurnEvidence({
   signalFor: threadId => signalFor(threadId),
   registryIdleAfterStop: (threadId, stopAt) => registryIdleAfterStop(threadId, stopAt),
@@ -942,6 +980,28 @@ if (threadAttachEnabled()) {
       }
     },
     deliver: (turn: QueuedThreadTurn) => deliverQueuedTurnOverLoopback(turn, PORT, API_TOKEN),
+    // 6.78.0 (P3): the restart reconcile, the attempt journal and Sessions steer.
+    bootId: serverMetrics.bootId,
+    deliveryEvidence: makeDeliveryEvidence({
+      ledgerOutcome: (provider, threadId, clientTurnId) => {
+        const result = agentSessionBindingRegistry.findTurnForTarget(provider, threadId, clientTurnId)?.result
+        return result && typeof result === 'object' && typeof (result as { outcome?: unknown }).outcome === 'string'
+          ? (result as { outcome: string }).outcome
+          : null
+      },
+      attempt: queueAttempt,
+      transcriptLines: queueEvidenceLines,
+      codexQueueTexts: async threadId => (await nativeQueueControl.list(threadId))
+        .map(row => plainQueueText(row))
+        .filter((text): text is string => typeof text === 'string'),
+    }),
+    ...steerDeps,
+    attempts: {
+      begin: (provider: string, threadId: string, clientTurnId: string, mode: 'turn' | 'steer', now: number) =>
+        agentSessionBindingRegistry.beginAttempt(provider, threadId, clientTurnId, mode, now),
+      settle: (provider: string, threadId: string, clientTurnId: string, exit: 'sent' | 'not_sent' | 'unknown', now: number) =>
+        agentSessionBindingRegistry.settleAttempt(provider, threadId, clientTurnId, exit, now),
+    },
     // 6.53.0: parked turns hold for two minutes after a cancel on their thread.
     cancelHoldUntil: (provider: string, threadId: string) => cancelHoldUntilFor(provider, threadId),
     // 6.62.0 (W14): a busy Agent CLI chat's parked turn drains here (no Stop hook fires for `-p`).
@@ -1021,7 +1081,7 @@ app.use('/api', createAgentSessionBindingsRouter({
   // 6.49.0: the running session first (Desktop tab or iTerm, same registry record),
   // the resume child second. Reads `COS_CONTINUE_LIVE` per call, so the flag reports
   // on /api/health without a restart and every refusal falls back to the 6.48.2 path.
-  deliverLiveTurn: makeLiveTurnDeliverer(nativeHeadDeps),
+  deliverLiveTurn: liveTurnDeliverer,
   // 6.51.0: a Codex thread the Codex app holds goes into that app's own queue
   // (`codex queue`), never into a resume child that cannot open a held thread.
   // `COS_CODEX_LIVE_QUEUE=0` restores the 6.50 path.
@@ -1067,6 +1127,14 @@ app.use('/api', createAgentSessionBindingsRouter({
   // empty list — "nothing is bound" and "the store could not be read" must not
   // look the same.
   bindings: agentSessionBindingRegistry,
+  // 6.78.0 (P3): receipts before the claim, and the `steer` field on an attach refusal.
+  turnReceipt: makeTurnReceiptLookup({
+    queueRows: (provider, threadId) => readQueue(provider, threadId, Date.now()),
+    attempt: queueAttempt,
+    transcriptLines: queueEvidenceLines,
+    bootId: serverMetrics.bootId,
+  }),
+  sessionSteer: (provider, threadId, gateReason) => (sessionSteerEnabled() ? steerAvailabilityFor(steerDeps, provider, threadId, gateReason) : null),
   // 6.53.0: cancel a session run from the lens. The route's own in-flight map answers for
   // a COS turn; these answer for a run at the desk. Read per request, so Install hooks in
   // Control flips `hooks_outdated` to `desk_run` within the status cache's five seconds.
@@ -1151,6 +1219,15 @@ app.get('/', (_req, res) => {
   )
 })
 
+// 6.78.0: crash-loop parking (lib/boot-resume.ts). One gate per process. It opens its boot
+// in startAdmittedRuntime (after the listeners bind, so exits 74 and 75 never count), before
+// any boot resume, and gracefulShutdown marks a clean exit first thing, so only boots that
+// follow a crash count. A Retry of a parked meeting resumes that one job.
+// COS_CRASH_LOOP_PARKING=0 turns it off (default on).
+const bootResume = installBootResumeGate(createBootResumeGate({ path: dataPath(BOOT_RESUME_LEDGER_FILE) }), {
+  resume: { meeting_finalization: sessionId => resumeMeetingFinalizationJobs({ sessionId }) },
+})
+
 // Graceful shutdown persists an interrupted terminal before provider abort.
 // The bounded force-exit keeps service managers from hanging forever on a
 // broken disk while retaining the previous session/catalog/Whisper cleanup.
@@ -1158,6 +1235,10 @@ let gracefulShutdownStarted = false
 async function gracefulShutdown(): Promise<void> {
   if (gracefulShutdownStarted) return
   gracefulShutdownStarted = true
+  // 6.78.0: first, before the 8 s force exit can fire. A SIGTERM/SIGINT shutdown (Update
+  // Server, kickstart -k, bootout) is not a crash loop even if a later step hangs into exit(1),
+  // so the next boot does not count toward crash-loop parking.
+  bootResume.markCleanShutdown()
   const forceExit = setTimeout(() => process.exit(1), 8_000)
   forceExit.unref?.()
   await meetingAskRuntime.shutdown()
@@ -1373,6 +1454,8 @@ listenRequiredServers(listeners).then(() => {
     if (admittedRuntimeStarted) return
     admittedRuntimeStarted = true
 
+    // 6.78.0: before any boot resume. Was the last exit clean? Only boots after a crash count.
+    bootResume.openBoot()
     // Resume already-saved meetings whose post-response HQ/operations work
     // was interrupted by a prior server update or process exit.
     resumeMeetingFinalizationJobs()