@gotcos/glasses-server 6.77.0 → 6.78.0

package/server/lib/provider-actions.ts

@@ -13,6 +13,7 @@ import { continueFullPermissionsEnabled } from './continue-plan.js'
 import { permissionBrokerHealthFields } from './permission-broker.js'
 import { continueLiveEnabled } from './session-peer-inbox-deps.js'
 import { codexLiveQueueEnabled } from './codex-live-queue.js'
+import { sessionSteerEnabled } from './thread-turn-queue.js'
 
 export type ProviderName = 'claude' | 'codex' | 'cursor'
 
@@ -33,6 +34,11 @@ export interface ProviderAct {
   nativeQueue: ProviderCapability
   keepModel: ProviderCapability
   permissions: ProviderCapability
+  /**
+   * 6.78.0: can a turn go INTO a busy session's running turn (Sessions steer)? OPTIONAL and
+   * ABSENT while `COS_SESSION_STEER` is off, so the eight 6.62 keys stay the whole object.
+   */
+  steer?: ProviderCapability
 }
 
 export interface ProviderActInput {
@@ -48,6 +54,8 @@ export interface ProviderActInput {
   continueLive: boolean
   /** `COS_CODEX_LIVE_QUEUE` (Codex's app-queue hop, idle and busy). */
   codexLiveQueue: boolean
+  /** 6.78.0: `COS_SESSION_STEER`. Absent or false: no `steer` entry at all. */
+  sessionSteer?: boolean
   env?: NodeJS.ProcessEnv
 }
 
@@ -63,6 +71,10 @@ export function providerActs(input: ProviderActInput): Record<ProviderName, Prov
   const fork = (provider: ProviderName, mode?: string) =>
     (input.forkProviders.includes(provider) ? yes(mode) : no('fork_unsupported'))
   const desk = (key: string) => (cancel[key] === true ? yes('next_command') : no('hooks_not_ready'))
+  // 6.78.0: Sessions steer. Claude through the peer inbox (it needs the live hop); Codex has
+  // `turn/steer` only in an app-server COS does not hold; Cursor's only door is the Stop hook.
+  const steer = input.sessionSteer === true
+  const claudeSteer = !attach ? no('attach_disabled') : input.continueLive ? yes('peer_inbox') : no('no_outside_channel')
   return {
     claude: {
       continueIdle: continueIdle(input.continueLive ? 'live' : 'resume'),
@@ -74,6 +86,7 @@ export function providerActs(input: ProviderActInput): Record<ProviderName, Prov
       nativeQueue: no('engine_limit'),
       keepModel: yes(),
       permissions: yes('session'),
+      ...(steer ? { steer: claudeSteer } : {}),
     },
     codex: {
       continueIdle: continueIdle(input.codexLiveQueue ? 'app_queue' : 'resume'),
@@ -85,6 +98,7 @@ export function providerActs(input: ProviderActInput): Record<ProviderName, Prov
       nativeQueue: yes(),
       keepModel: full ? yes() : no('full_permissions_off'),
       permissions: full ? yes('session_posture') : no('full_permissions_off'),
+      ...(steer ? { steer: no('no_outside_channel') } : {}),
     },
     cursor: {
       // An idle IDE composer cannot take a message from outside; a CLI chat can.
@@ -97,6 +111,7 @@ export function providerActs(input: ProviderActInput): Record<ProviderName, Prov
       nativeQueue: no('engine_limit'),
       keepModel: full ? yes() : no('full_permissions_off'),
       permissions: full ? yes('run_everything') : no('full_permissions_off'),
+      ...(steer ? { steer: no('engine_limit') } : {}),
     },
   }
 }
@@ -145,5 +160,8 @@ export function liveProviderActInput(base: {
     brokerEnabled,
     continueLive: continueLiveEnabled(),
     codexLiveQueue: codexLiveQueueEnabled(),
+    // 6.78.0: present (and true) only while COS_SESSION_STEER is on, so the input object the
+    // 6.62 tests build is unchanged with the flag off.
+    ...(sessionSteerEnabled() ? { sessionSteer: true } : {}),
   }
 }

package/server/lib/query-job-coordinator.ts

@@ -1,6 +1,9 @@
 import { getOrCreateSession } from './conversation.js'
 import {
+  QueryJobNotFoundError,
+  QueryJobPersistenceError,
   QueryJobProviderOrphanFenceError,
+  QueryJobSteerConflictError,
   QueryJobStore,
   QueryJobStoreError,
   type QueryJobAdmissionResult,
@@ -9,17 +12,30 @@ import {
 } from './query-job-store.js'
 import {
   QUERY_JOB_LIMITS,
+  QUERY_JOB_STEER_LIMITS,
+  QueryJobValidationError,
   isTerminalQueryJobStatus,
   normalizeQueryJobError,
   parsePositiveInteger,
+  parseSteerId,
+  parseSteerText,
+  steerFallback,
+  steerReadState,
+  steerTextSha256,
   type QueryJobProviderLinkage,
   type QueryJobOutputImageStats,
   type QueryJobRequest,
   type QueryJobSnapshot,
+  type QueryJobStatus,
+  type QueryJobSteer,
+  type QueryJobSteerState,
   type QueryJobStoreHealth,
 } from './query-job-types.js'
+import { SteerPort, steerClock, steerCutoffMs, type PendingSteer, type QueryProvider } from './claude-steer.js'
 import type { MaintenanceWorkLease } from './maintenance-lifecycle.js'
 import { applyTrailToolMode, type JobTrailDraft } from './job-trail.js'
+import { crashLoopParkedError, type BootResumeGate } from './boot-resume.js'
+import { restartNoticeEnabled } from './query-job-feature.js'
 
 const CLIENT_JOB_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
 
@@ -63,6 +79,51 @@ export interface QueryJobRunnerContext {
   request: QueryJobRequest
   signal: AbortSignal
   callbacks: QueryJobRunnerCallbacks
+  /** 6.78.0: present only when this run is steerable (see QueryJobSteerOptions). */
+  steer?: SteerPort
+}
+
+/**
+ * 6.78.0 Messages steer. A run is steerable only when ALL hold: the switch is on
+ * (COS_MESSAGES_STEER), the client asked (`request.steerable`), it is not a dispatch, the
+ * provider (resolved as model-router resolves it) is Claude, and the installed CLI takes
+ * `--input-format stream-json --replay-user-messages`.
+ */
+export interface QueryJobSteerOptions {
+  enabled: () => boolean
+  provider: (request: QueryJobRequest) => QueryProvider
+  cliSupported: () => Promise<boolean>
+}
+
+/** 6.78.0: what POST /query-jobs/:jobId/steer and the steer lookup answer (contract messages-steer.json). */
+export interface QueryJobSteerReply {
+  steerId: string
+  state: QueryJobSteerState
+  fallback: 'queue_follow_up' | null
+  jobStatus: QueryJobStatus
+}
+
+export class QueryJobSteerLimitError extends Error {
+  readonly code = 'steer_limit'
+  constructor() {
+    super(`This run already has ${QUERY_JOB_STEER_LIMITS.steersPerJob} steers.`)
+    this.name = 'QueryJobSteerLimitError'
+  }
+}
+
+export class QueryJobSteerUnknownError extends Error {
+  readonly code = 'steer_unknown'
+  constructor() {
+    super('No steer with this id.')
+    this.name = 'QueryJobSteerUnknownError'
+  }
+}
+
+function steerReply(steer: QueryJobSteer, job: Pick<QueryJobSnapshot, 'status'>): QueryJobSteerReply {
+  const state = steerReadState(steer.state, job.status)
+  // The fallback reads the journaled state: a delivered steer reads not_applied on an ended
+  // job, and must still never be resent (P7 S1).
+  return { steerId: steer.steerId, state, fallback: steerFallback(steer.state, job.status), jobStatus: job.status }
 }
 
 export type QueryJobRunner = (context: QueryJobRunnerContext) => Promise<void>
@@ -86,8 +147,24 @@ export interface QueryJobCoordinatorOptions {
    * refusing its start lease) before the coordinator looks again. Bounded so a Mac
    * that slept through the end of a fence does not wait out a stale timer. */
   holdRecheckMs?: number
+  /** 6.78.0: the process's crash-loop gate (lib/boot-resume.ts), read when it is used. */
+  bootResumeGate?: () => Pick<BootResumeGate, 'admit' | 'retry' | 'forget' | 'limit'>
+  /** 6.78.0 restart truth: defaults to COS_RESTART_NOTICE (on), read at shutdown. */
+  restartNotice?: () => boolean
+  /** 6.78.0: the longest shutdown waits for steps a run already reported to reach the journal. */
+  shutdownDrainMs?: number
+  /** 6.78.0: Messages steer. Absent (the default) means no run is ever steerable. */
+  steer?: QueryJobSteerOptions
 }
 
+/**
+ * 6.78.0 restart truth: how long a graceful shutdown lets the steps, chunks and activity a run
+ * already reported reach the journal before it writes the interrupt, so the notice names them.
+ * All active runs drain at once, so this bounds the whole wait, far inside index.ts's 8-second
+ * force exit. A run whose writes are stuck (a broken disk) is interrupted when it runs out.
+ */
+export const SHUTDOWN_CALLBACK_DRAIN_MS = 1_000
+
 /** Margin past the fence before the start is retried, so the retry lands after it. */
 const FENCE_HOLD_SLACK_MS = 250
 
@@ -134,6 +211,10 @@ interface ActiveRun {
   providerTimeoutPromise: Promise<void>
   resolveProviderTimeout: () => void
   providerTimeoutTimer: ReturnType<typeof setTimeout> | null
+  /** 6.78.0: the run's steer port, present only when the run is steerable. */
+  steer?: SteerPort
+  /** 6.78.0: when the coordinator deadline fires, on the monotonic steer clock (`steerClock`), once the run is running. */
+  deadlineAt?: number
 }
 
 export interface QueryJobCoordinatorHealth {
@@ -168,6 +249,8 @@ export class QueryJobCoordinator {
   private readonly holds = new Map<string, () => void>()
   /** Admitted jobs inside execute that have not started (or given up) yet. */
   private readonly waiting = new Set<string>()
+  /** 6.78.0: steer ports by job, registered before a steerable run's runner starts. */
+  private readonly steerPorts = new Map<string, SteerPort>()
   private readonly holdRecheckMs: number
   private admissionTail: Promise<void> = Promise.resolve()
   private shuttingDown = false
@@ -200,12 +283,53 @@ export class QueryJobCoordinator {
     // 6.61.3: work the last boot admitted but never started runs now, with no
     // phone needed to send it again, in admission order. Each takes its own start
     // lease in execute.
+    const parked: string[] = []
     for (const { jobId, sessionId } of this.store.takeRequeuedOnBoot()) {
+      // 6.78.0: counted BEFORE its start is queued, so a start that kills the process is
+      // counted. Past the limit the job is parked: never started again by a boot.
+      if (!this.admitBootRequeue(jobId)) { parked.push(jobId); continue }
       queueMicrotask(() => { void this.execute(jobId, sessionId) })
     }
+    for (const jobId of parked) await this.parkBootRequeue(jobId)
     return this.getHealth()
   }
 
+  /** Keyed by lineage (clientJobId), so the app's Retry (a new generation) is the same item. */
+  private admitBootRequeue(jobId: string): boolean {
+    const gate = this.options.bootResumeGate?.()
+    if (!gate) return true
+    try {
+      return gate.admit('query_job', this.store.lineageOf(jobId) ?? jobId, 'start')
+    } catch {
+      return true
+    }
+  }
+
+  /**
+   * A parked job ends `interrupted` with `restart_limit` and `interruption.resumable: false`, so
+   * the app shows it and offers Retry (never Resume: its run never started).
+   */
+  private async parkBootRequeue(jobId: string): Promise<void> {
+    try {
+      const result = await this.store.interruptParked(jobId, crashLoopParkedError(this.options.bootResumeGate?.().limit))
+      if (!result.applied) return
+      console.warn(`[query-jobs] ${jobId.slice(0, 8)} parked: its start crashed the server on every boot; Retry runs it again`)
+      const execution = await this.store.getExecution(jobId)
+      await this.projectTerminal(execution.job, execution.request)
+    } catch (error) {
+      // Left `accepted`: the next boot offers it again and the gate keeps it parked.
+      console.error(`[query-jobs] ${jobId.slice(0, 8)} could not be parked:`, error)
+    }
+  }
+
+  private bootResumeLineage(op: 'retry' | 'forget', clientJobId: string): void {
+    try {
+      const gate = this.options.bootResumeGate?.()
+      if (op === 'retry') gate?.retry('query_job', clientJobId)
+      else gate?.forget('query_job', clientJobId)
+    } catch { /* the gate fails open on its own; never fail an admission or a start */ }
+  }
+
   /** Admission serialization makes first-run session allocation idempotent:
    * two simultaneous retries without a sessionId cannot allocate two sessions
    * and conflict solely because the client had not learned the first one. */
@@ -224,6 +348,9 @@ export class QueryJobCoordinator {
         const admission = await this.store.admit(normalized)
         resolve(admission)
         if (admission.created) {
+          // 6.78.0: a new generation of a lineage is the person's Retry (the app's Retry or
+          // Resume, or a Messages retry): a parked lineage is unparked and its count starts over.
+          if (admission.job.generation > 1) this.bootResumeLineage('retry', admission.job.clientJobId)
           if (maintenanceLease) this.admittedMaintenance.set(admission.job.jobId, maintenanceLease)
           queueMicrotask(() => { void this.execute(admission.job.jobId, admission.job.sessionId) })
         } else {
@@ -302,6 +429,8 @@ export class QueryJobCoordinator {
       try {
         const starting = await this.store.markStarting(jobId, () => !this.shuttingDown)
         if (starting.applied) {
+          // 6.78.0: a started job is never handed back by a boot again, so its count is done.
+          this.bootResumeLineage('forget', starting.job.clientJobId)
           if (heldSinceMs != null) console.info(`[query-jobs] ${id} starting after a ${Math.round((Date.now() - heldSinceMs) / 1000)}s hold`)
           return { lease }
         }
@@ -367,6 +496,7 @@ export class QueryJobCoordinator {
     this.waiting.add(jobId)
     let release: (() => void) | undefined
     let maintenanceLease: MaintenanceWorkLease | undefined
+    let steerMode = false
     let execution
     try {
       if (lockRequest) {
@@ -387,6 +517,10 @@ export class QueryJobCoordinator {
         release?.()
         return
       }
+      // 6.78.0: decided before the start (the CLI probe is cached), so nothing awaits between
+      // the start and the runner but the steer seeding below.
+      // With the switch off nothing is awaited here, so a 6.77.0 start keeps its exact timing.
+      if (this.options.steer?.enabled()) steerMode = await this.steerable(execution.request)
       const started = await this.startWhenClear(jobId, lockRequest ? undefined : admitted)
       if (!started) {
         release?.()
@@ -431,7 +565,23 @@ export class QueryJobCoordinator {
       resolveProviderTimeout,
       providerTimeoutTimer: null,
     }
+    if (steerMode) {
+      active.steer = this.steerPortFor(active)
+      this.steerPorts.set(jobId, active.steer)
+    }
     this.active.set(jobId, active)
+    if (active.steer) {
+      // Registered first, then seeded, so a steer journaled meanwhile is offered by one side or
+      // both (the port drops a repeat): the ones accepted while the job waited, then, for a
+      // Retry or Resume, the ones an interrupted or failed generation did not get to apply.
+      await this.seedSteers(active).catch(error => { this.handleCallbackPersistenceFailure(active, error) })
+      if (active.terminalPersisted || active.persistenceFailed) return
+      if (this.shuttingDown) {
+        // As above: never spawn under a closing server. The job stays `starting` for the boot.
+        this.abandonActive(active)
+        return
+      }
+    }
 
     const callbacks = this.callbacksFor(active)
     try {
@@ -441,6 +591,7 @@ export class QueryJobCoordinator {
         request: execution.request,
         signal: active.controller.signal,
         callbacks,
+        ...(active.steer ? { steer: active.steer } : {}),
       })
 
       const runnerFailed = runnerPromise.then(
@@ -568,6 +719,8 @@ export class QueryJobCoordinator {
 
   private armProviderDeadline(active: ActiveRun): void {
     if (active.providerTimeoutTimer || active.terminalPersisted || active.persistenceFailed) return
+    // On the monotonic steer clock (P7 S7): decideSteer compares it with the bridge's wall clock.
+    active.deadlineAt = steerClock() + this.providerTimeoutMs
     active.providerTimeoutTimer = setTimeout(() => active.resolveProviderTimeout(), this.providerTimeoutMs)
     active.providerTimeoutTimer.unref?.()
   }
@@ -734,17 +887,141 @@ export class QueryJobCoordinator {
     after: number,
     listener: Parameters<QueryJobStore['subscribe']>[3],
     trail?: Parameters<QueryJobStore['subscribe']>[4],
+    steer?: Parameters<QueryJobStore['subscribe']>[5],
   ): Promise<QueryJobSubscription> {
+    if (steer) return this.store.subscribe(jobId, generation, after, listener, trail, steer)
     return trail
       ? this.store.subscribe(jobId, generation, after, listener, trail)
       : this.store.subscribe(jobId, generation, after, listener)
   }
 
+  /**
+   * 6.78.0 Messages steer, in the plan's order: validate; look the steer id up across the
+   * lineage (the same text replays, other text is a conflict) BEFORE the generation check;
+   * decide and journal (fsynced) `accepted`, `too_late` or `unsupported`; then, for an
+   * accepted steer, write it through the run's port. The reply is the state after the write:
+   * a steer the port could no longer take is journaled `too_late` and answered so.
+   */
+  async steer(jobId: string, raw: unknown): Promise<QueryJobSteerReply> {
+    const body = raw && typeof raw === 'object' ? raw as Record<string, unknown> : {}
+    const generation = parsePositiveInteger(body.generation)
+    if (generation == null || generation < 1) throw new QueryJobValidationError('invalid_generation')
+    const steerId = parseSteerId(body.steerId)
+    const text = parseSteerText(body.text)
+    await this.store.init()
+    const clientJobId = this.store.lineageOf(jobId)
+    if (!clientJobId) throw new QueryJobNotFoundError(jobId)
+    const known = await this.store.findSteer(clientJobId, steerId)
+    if (known) {
+      if (known.textSha256 !== steerTextSha256(text)) throw new QueryJobSteerConflictError()
+      return steerReply(known.steer, known.job)
+    }
+    const job = await this.store.getSnapshot(jobId, generation)
+    if (await this.store.steerCount(jobId) >= QUERY_JOB_STEER_LIMITS.steersPerJob) throw new QueryJobSteerLimitError()
+    const decided = await this.decideSteer(job)
+    let result = await this.store.appendSteer(jobId, { steerId, state: decided, text, create: true })
+    if (result.applied && result.steer.state === 'accepted') {
+      const port = this.steerPorts.get(jobId)
+      if (port && port.offer({ steerId, text }) === 'closed') {
+        result = await this.store.appendSteer(jobId, { steerId, state: 'too_late' })
+      }
+    }
+    return steerReply(result.steer, result.job)
+  }
+
+  /** 6.78.0: GET /query-jobs/steers/:steerId?clientJobId=, from the newest generation. */
+  async steerStatus(clientJobId: string, rawSteerId: unknown): Promise<QueryJobSteerReply> {
+    const steerId = parseSteerId(rawSteerId)
+    const known = await this.store.findSteer(clientJobId, steerId)
+    if (!known) throw new QueryJobSteerUnknownError()
+    return steerReply(known.steer, known.job)
+  }
+
+  private async steerable(request: QueryJobRequest): Promise<boolean> {
+    const options = this.options.steer
+    if (!options || !options.enabled() || request.steerable !== true || request.dispatch) return false
+    try {
+      if (options.provider(request) !== 'claude') return false
+      return await options.cliSupported()
+    } catch {
+      return false
+    }
+  }
+
+  /** The state a new steer is journaled with (before the port is tried). */
+  private async decideSteer(job: QueryJobSnapshot): Promise<'accepted' | 'too_late' | 'unsupported'> {
+    if (isTerminalQueryJobStatus(job.status) || job.status === 'answer_ready') return 'too_late'
+    const active = this.active.get(job.jobId)
+    if (!active) {
+      // Not started yet (waiting its turn, fenced, or held by a drain): it reads the predicate.
+      const execution = await this.store.getExecution(job.jobId)
+      return await this.steerable(execution.request) ? 'accepted' : 'unsupported'
+    }
+    const port = active.steer
+    if (!port) return 'unsupported'
+    if (port.isClosed) return 'too_late'
+    // Monotonic, as the timers that end the run are (P7 S7): after a Mac sleep Date.now()
+    // has jumped and every steer would read too late.
+    const now = steerClock()
+    const wallMax = port.wallMax()
+    const margin = steerCutoffMs(wallMax ?? this.providerTimeoutMs)
+    const wallLeft = port.wallRemainingMs(now)
+    if (wallLeft !== null && wallLeft < margin) return 'too_late'
+    if (active.deadlineAt !== undefined && active.deadlineAt - now < margin) return 'too_late'
+    return 'accepted'
+  }
+
+  /** A steer port whose events journal through the run's ordered callback tail. */
+  private steerPortFor(active: ActiveRun): SteerPort {
+    const journal = (operation: () => Promise<unknown>) => {
+      void this.enqueueCallback(active, async () => {
+        try {
+          await operation()
+        } catch (error) {
+          // A broken journal is the run's failure; a steer bookkeeping refusal is not.
+          if (error instanceof QueryJobPersistenceError || !(error instanceof QueryJobStoreError)) throw error
+          console.warn(`[query-jobs] ${active.jobId.slice(0, 8)} steer not journaled:`, (error as Error).message)
+        }
+      })
+    }
+    const jobId = active.jobId
+    return new SteerPort({
+      onIncluded: steers => journal(async () => {
+        for (const steer of steers) {
+          await this.store.appendSteer(jobId, steer.carriedFrom !== undefined
+            ? { steerId: steer.steerId, state: 'included', text: steer.text, carriedFrom: steer.carriedFrom, create: true }
+            : { steerId: steer.steerId, state: 'included' })
+        }
+      }),
+      onDelivered: steerId => journal(() => this.store.appendSteer(jobId, { steerId, state: 'delivered' })),
+      onFolded: steerIds => journal(async () => {
+        for (const steerId of steerIds) await this.store.appendSteer(jobId, { steerId, state: 'folded' })
+      }),
+      onCheckpoint: text => journal(() => this.store.appendSteerCheckpoint(jobId, text)),
+    })
+  }
+
+  /** Offer the run's port what it must start with: this job's accepted steers, then carried ones. */
+  private async seedSteers(active: ActiveRun): Promise<void> {
+    const port = active.steer!
+    const own: PendingSteer[] = (await this.store.queuedSteers(active.jobId))
+      .filter(steer => steer.state === 'accepted' && steer.carriedFrom === undefined)
+      .map(steer => ({ steerId: steer.steerId, text: steer.text }))
+    for (const steer of own) port.offer(steer)
+    if (active.generation > 1) {
+      for (const steer of await this.store.listCarryableSteers(active.request.clientJobId, active.generation)) port.offer(steer)
+    }
+  }
+
   async shutdown(reason = 'server_shutdown'): Promise<void> {
     this.shuttingDown = true
     // Held jobs stay `accepted` in the journal; the next boot re-queues them.
     for (const end of [...this.holds.values()]) end()
     await this.admissionTail.catch(() => {})
+    // 6.78.0 restart truth: the notice is built from the journal, so the steps a run reported
+    // before this point reach it first (bounded; see SHUTDOWN_CALLBACK_DRAIN_MS). Off, the
+    // interrupt is written at once, as 6.77.0 did, ahead of any queued step.
+    if ((this.options.restartNotice ?? restartNoticeEnabled)()) await this.drainCallbacks([...this.active.values()])
     for (const active of [...this.active.values()]) {
       try {
         const result = await this.store.interrupt(active.jobId, reason)
@@ -759,9 +1036,25 @@ export class QueryJobCoordinator {
     }
   }
 
+  /** Every run's queued callback writes, all at once, for at most the drain bound. Never throws. */
+  private async drainCallbacks(runs: ActiveRun[]): Promise<void> {
+    if (runs.length === 0) return
+    let timer: ReturnType<typeof setTimeout> | undefined
+    const bound = new Promise<void>(resolve => {
+      timer = setTimeout(resolve, Math.max(0, this.options.shutdownDrainMs ?? SHUTDOWN_CALLBACK_DRAIN_MS))
+      timer.unref?.()
+    })
+    try {
+      await Promise.race([Promise.all(runs.map(run => run.callbackTail.catch(() => {}))), bound])
+    } finally {
+      if (timer) clearTimeout(timer)
+    }
+  }
+
   private finishActive(active: ActiveRun): void {
     if (active.terminalPersisted) return
     active.terminalPersisted = true
+    this.releaseSteerPort(active)
     active.resolveTerminal()
     if (active.providerTimeoutTimer) clearTimeout(active.providerTimeoutTimer)
     active.providerTimeoutTimer = null
@@ -775,7 +1068,14 @@ export class QueryJobCoordinator {
     }
   }
 
+  private releaseSteerPort(active: ActiveRun): void {
+    if (!active.steer) return
+    active.steer.close()
+    if (this.steerPorts.get(active.jobId) === active.steer) this.steerPorts.delete(active.jobId)
+  }
+
   private abandonActive(active: ActiveRun): void {
+    this.releaseSteerPort(active)
     if (active.providerTimeoutTimer) clearTimeout(active.providerTimeoutTimer)
     active.providerTimeoutTimer = null
     if (active.partialTimer) clearTimeout(active.partialTimer)

package/server/lib/query-job-feature.ts

@@ -1,3 +1,4 @@
+import { readSwitch } from './env-switch.js'
 import { QUERY_JOB_PROTOCOL_VERSION } from './query-job-types.js'
 
 /**
@@ -19,6 +20,44 @@ export function messagesTrailEnabled(env: NodeJS.ProcessEnv = process.env): bool
   return env.COS_MESSAGES_TRAIL !== '0'
 }
 
+// 6.78.0 switches all read through `readSwitch` (lib/env-switch.ts): `1`, `true` or `on`
+// force a switch on, `0`, `false` or `off` force it off, anything else is its DEFAULT.
+const triState = readSwitch
+
+/**
+ * 6.78.0 restart truth, default ON. An Ask a restart cut off (crash then boot, or a graceful
+ * shutdown) carries `error.cause` and an `interruption` record naming the step it was cut off
+ * during and the side-effect steps already done; a crash-loop-parked one carries its
+ * `interruption` too. Off is the MVP-C build exactly: the boot path's old message, the raw
+ * `server_shutdown` message on a graceful shutdown, and no `interruption` anywhere.
+ */
+export function restartNoticeEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
+  return triState(env.COS_RESTART_NOTICE, true)
+}
+
+/**
+ * 6.78.0 (MVP-D release 1): the delta-only chunk WRITER, default OFF. The reader is always
+ * on, so a journal a writer-on build wrote reads back whole on this build and on every later
+ * one. The writer ships on by default one release after its reader.
+ */
+export function queryJobDeltaJournalEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
+  return triState(env.COS_QUERY_JOB_DELTA_JOURNAL, false)
+}
+
+/**
+ * 6.78.0 Messages steer, default OFF in 6.78.0 (on for the candidate; the default flips after
+ * the field window). Read per job and per request, so a restart applies a change.
+ */
+export function messagesSteerEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
+  return triState(env.COS_MESSAGES_STEER, false)
+}
+
+/** 6.78.0: `capabilities.durableQueryJobs.steer`, or undefined (the key is then absent). */
+export function messagesSteerCapability(input: { jobsEnabled: boolean; cliSupported: boolean | null }, env: NodeJS.ProcessEnv = process.env): { protocolVersion: 1; providers: ['claude'] } | undefined {
+  if (!input.jobsEnabled || input.cliSupported !== true || !messagesSteerEnabled(env)) return undefined
+  return { protocolVersion: 1, providers: ['claude'] }
+}
+
 export function durableQueryJobsCapability(): {
   enabled: boolean
   protocolVersion: number