@gotcos/glasses-server 6.77.0 → 6.78.1

package/server/lib/query-job-types.ts

@@ -56,6 +56,10 @@ export type QueryJobEventType =
   // and reaches only a subscriber that asked for the trail. Its data is one draft plus
   // `trailSeq`, a dense 1..n per job.
   | 'trail'
+  // 6.78.0 (Messages steer): a steer's state, or the answer checkpoint of a steered run. A
+  // JOURNAL row type only, like `trail`: never a job event, never an eventSeq or a ring slot,
+  // never `updatedAt`. Builds before 6.78.0 skip it as malformed.
+  | 'steer'
 
 export type QueryJobActivityMode = 'off' | 'status' | 'preview'
 export type QueryJobActivityKind = 'status' | 'input' | 'output' | 'gap'
@@ -128,6 +132,12 @@ export interface QueryJobRequest {
    * it names the session, it does not change what is asked.
    */
   sessionName?: string
+  /**
+   * 6.78.0: the client can steer this run (it read `durableQueryJobs.steer`). Only `true` is
+   * kept. Excluded from the fingerprint: it says how the answer may be guided, not what is
+   * asked, and a build that does not know it must still hydrate the job.
+   */
+  steerable?: true
 }
 
 /** 6.58.2: longest session name kept (the Claude sidebar shows about 40 characters). */
@@ -198,6 +208,195 @@ export interface QueryJobError {
   message: string
   retryable?: boolean
   retryAfterMs?: number
+  /** 6.78.0: why the server ended the job, from QUERY_JOB_ERROR_CAUSES only. Additive: a
+   * client that does not read it sees the 6.77.0 error. */
+  cause?: string
+}
+
+/** 6.78.0: the only `error.cause` values a journaled error keeps. An allowlist, so no
+ * provider error (an Error's own `cause` included) can start carrying one. */
+export const QUERY_JOB_ERROR_CAUSES: ReadonlySet<string> = new Set(['server_restarted', 'server_shutdown', 'crash_loop_parked'])
+
+/** 6.78.0: why a restart ended a job: a crash then boot, a graceful shutdown, or crash-loop parking. */
+export const QUERY_JOB_RESTART_CAUSES = ['server_restarted', 'server_shutdown', 'crash_loop_parked'] as const
+export type QueryJobRestartCause = typeof QUERY_JOB_RESTART_CAUSES[number]
+
+/**
+ * 6.78.0: the message of a job either restart path cut off. The WHOLE message fits the lens's
+ * 32-column footer lead (P7 S8: the 34-character first copy was cut mid-word by companion
+ * 6.10.644). The hold menu offers Retry or Resume from `interruption.resumable`.
+ */
+export const QUERY_JOB_RESTART_MESSAGE = 'Server restarted. Tap to retry.'
+
+/** 6.78.0: the bounds of `snapshot.interruption` (contract interrupted-job.json `limits`). */
+export const QUERY_JOB_INTERRUPTION_LIMITS = Object.freeze({
+  alreadyDoneMax: 5,
+  alreadyDoneEntryChars: 60,
+  cutOffDuringChars: 60,
+})
+
+/**
+ * 6.78.0: what a restart cut off, built once from the job's own trail when the job ends
+ * (lib/query-job-resume.ts `buildInterruption`) and journaled with the terminal record.
+ *
+ *   cutOffDuring  the step that was running, or null when none was (or none is known)
+ *   alreadyDone   side-effect steps that finished (reads and searches are not listed), the
+ *                 newest QUERY_JOB_INTERRUPTION_LIMITS.alreadyDoneMax of them
+ *   incomplete    the list may be missing steps: tool activity was off, the trail hit its
+ *                 bound, a step had no outcome to match, older steps were dropped from the
+ *                 list, or the provider started and left no trail at all
+ *   resumable     the app may offer Resume (false for a crash-loop-parked job)
+ *
+ * Additive: absent on every job a restart did not end, and with COS_RESTART_NOTICE=0.
+ */
+export interface QueryJobInterruption {
+  cause: QueryJobRestartCause
+  at: string
+  cutOffDuring: string | null
+  alreadyDone: string[]
+  incomplete: boolean
+  resumable: boolean
+}
+
+const RESTART_CAUSES: ReadonlySet<string> = new Set(QUERY_JOB_RESTART_CAUSES)
+
+/** One line of the interruption record: redacted like activity, one line, at most `max` characters. */
+export function interruptionLine(value: unknown, max: number): string {
+  if (typeof value !== 'string' || !value.replace(CONTROL_RE, '').trim()) return ''
+  const text = sanitizeQueryJobActivity(value).text.replace(/\s+/g, ' ').trim()
+  return text.length <= max ? text : `${text.slice(0, Math.max(0, max - 3)).trimEnd()}...`
+}
+
+/** The only shape a journaled interruption may have, from anything. Undefined when it is not one. */
+export function parseQueryJobInterruption(raw: unknown): QueryJobInterruption | undefined {
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return undefined
+  const r = raw as Record<string, unknown>
+  if (typeof r.cause !== 'string' || !RESTART_CAUSES.has(r.cause)) return undefined
+  if (typeof r.at !== 'string' || !Number.isFinite(Date.parse(r.at))) return undefined
+  if (typeof r.incomplete !== 'boolean' || typeof r.resumable !== 'boolean' || !Array.isArray(r.alreadyDone)) return undefined
+  const limits = QUERY_JOB_INTERRUPTION_LIMITS
+  const cutOffDuring = typeof r.cutOffDuring === 'string' ? interruptionLine(r.cutOffDuring, limits.cutOffDuringChars) || null : null
+  const alreadyDone = r.alreadyDone
+    .filter((entry): entry is string => typeof entry === 'string')
+    .map(entry => interruptionLine(entry, limits.alreadyDoneEntryChars))
+    .filter(Boolean)
+    .slice(-limits.alreadyDoneMax)
+  return {
+    cause: r.cause as QueryJobRestartCause,
+    at: r.at,
+    cutOffDuring,
+    alreadyDone,
+    incomplete: r.incomplete,
+    resumable: r.resumable,
+  }
+}
+
+/** 6.78.0 Messages steer: the bounds (contract messages-steer.json `limits`). */
+export const QUERY_JOB_STEER_LIMITS = Object.freeze({
+  steerChars: 4_000,
+  /** Steers a client may send to one job. Carried steers (from an earlier generation) do not count. */
+  steersPerJob: 8,
+})
+
+/**
+ * 6.78.0: a steer's state (contract messages-steer.json `states`).
+ *
+ *   accepted     journaled; written to the CLI, or waiting for the first line
+ *   delivered    the CLI replayed it: it has it
+ *   folded       a result covered it: the answer includes it
+ *   included     composed into the first prompt (sent before the start, or carried from an
+ *                interrupted or failed generation)
+ *   too_late     the run could not take it any more (answering, ended, or near a deadline)
+ *   unsupported  this run cannot be steered (Codex, Cursor, Ollama, a dispatch, an old client)
+ *   not_applied  NEVER journaled: read for an accepted or delivered steer of an ended job
+ */
+export const QUERY_JOB_STEER_STATES = ['accepted', 'delivered', 'folded', 'included', 'too_late', 'unsupported', 'not_applied'] as const
+export type QueryJobSteerState = typeof QUERY_JOB_STEER_STATES[number]
+export type QueryJobJournaledSteerState = Exclude<QueryJobSteerState, 'not_applied'>
+const JOURNALED_STEER_STATES: ReadonlySet<string> = new Set(QUERY_JOB_STEER_STATES.filter(state => state !== 'not_applied'))
+
+export interface QueryJobSteer {
+  steerId: string
+  state: QueryJobSteerState
+  /** When the current state was journaled. */
+  at: string
+  text: string
+  /** The generation it was first sent to, when it was carried into this one. */
+  carriedFrom?: number
+}
+
+/** A steer state only moves forward: accepted, then delivered, then a final state. */
+export function steerStateRank(state: string): number {
+  return state === 'accepted' ? 1 : state === 'delivered' ? 2 : 3
+}
+
+/** The state a client reads: an accepted or delivered steer of an ended job did not apply. */
+export function steerReadState(state: QueryJobSteerState, jobStatus: QueryJobStatus): QueryJobSteerState {
+  return isTerminalQueryJobStatus(jobStatus) && (state === 'accepted' || state === 'delivered') ? 'not_applied' : state
+}
+
+/**
+ * What the client does with a steer that will not reach this run. `queue_follow_up`: send it as
+ * the next Ask. Null: nothing (it applied, it may have applied, it is carried by Retry or
+ * Resume, or the run was canceled).
+ *
+ * Decided from the JOURNALED state, never the read one (P7 S1). A steer the CLI replayed
+ * (`delivered`) reached the run: a deadline, inactivity, a restart or a second-turn error can
+ * still complete the job from its checkpoint, and the read state is then `not_applied`, but
+ * the guidance may already be in the answer or in Claude's session. Sending it again as an Ask
+ * would apply it twice, which the plan forbids, so a delivered steer never falls back.
+ */
+export function steerFallback(journaled: QueryJobSteerState, jobStatus: QueryJobStatus): 'queue_follow_up' | null {
+  if (journaled === 'too_late' || journaled === 'unsupported') return 'queue_follow_up'
+  if (journaled === 'delivered') return null
+  if (steerReadState(journaled, jobStatus) === 'not_applied' && jobStatus === 'completed') return 'queue_follow_up'
+  return null
+}
+
+/** One `steer` journal row: a state, or a steered run's answer checkpoint. */
+export type QueryJobSteerRow =
+  | { kind: 'state'; steerId: string; state: QueryJobJournaledSteerState; textSha256: string; text?: string; carriedFrom?: number }
+  | { kind: 'checkpoint'; text: string; truncated: boolean }
+
+/** The only shapes a `steer` row may have. Null means malformed. */
+export function parseQueryJobSteerRow(raw: unknown): QueryJobSteerRow | null {
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return null
+  const r = raw as Record<string, unknown>
+  if (r.checkpoint && typeof r.checkpoint === 'object') {
+    const c = r.checkpoint as Record<string, unknown>
+    if (typeof c.text !== 'string' || c.text.length > QUERY_JOB_LIMITS.partialChars) return null
+    return { kind: 'checkpoint', text: c.text, truncated: c.truncated === true }
+  }
+  if (typeof r.steerId !== 'string' || !CLIENT_JOB_ID_RE.test(r.steerId)) return null
+  if (typeof r.state !== 'string' || !JOURNALED_STEER_STATES.has(r.state)) return null
+  if (typeof r.textSha256 !== 'string' || !/^[0-9a-f]{64}$/.test(r.textSha256)) return null
+  if (r.text !== undefined && (typeof r.text !== 'string' || r.text.length > QUERY_JOB_STEER_LIMITS.steerChars)) return null
+  const carriedFrom = r.carriedFrom === undefined ? undefined : Number(r.carriedFrom)
+  if (carriedFrom !== undefined && (!Number.isSafeInteger(carriedFrom) || carriedFrom < 1)) return null
+  return {
+    kind: 'state', steerId: r.steerId, state: r.state as QueryJobJournaledSteerState, textSha256: r.textSha256,
+    ...(typeof r.text === 'string' ? { text: r.text } : {}),
+    ...(carriedFrom !== undefined ? { carriedFrom } : {}),
+  }
+}
+
+/** Steer text as the journal and the CLI get it: control characters out, trimmed, bounded. */
+export function parseSteerText(raw: unknown): string {
+  if (typeof raw !== 'string') throw new QueryJobValidationError('invalid_steer_text')
+  const text = raw.replace(CONTROL_RE, '').trim()
+  if (!text) throw new QueryJobValidationError('invalid_steer_text')
+  if (text.length > QUERY_JOB_STEER_LIMITS.steerChars) throw new QueryJobValidationError('steer_text_too_large')
+  return text
+}
+
+/** A steer id is a client-minted UUID v4, lowercased. */
+export function parseSteerId(raw: unknown): string {
+  if (typeof raw !== 'string' || !CLIENT_JOB_ID_RE.test(raw.toLowerCase())) throw new QueryJobValidationError('invalid_steer_id')
+  return raw.toLowerCase()
+}
+
+export function steerTextSha256(text: string): string {
+  return createHash('sha256').update(text, 'utf8').digest('hex')
 }
 
 export interface QueryJobActivity {
@@ -239,6 +438,14 @@ export interface QueryJobSnapshot extends QueryJobProviderLinkage {
   responseTruncated?: boolean
   outputImageStats?: QueryJobOutputImageStats
   error?: QueryJobError
+  /** 6.78.0: what a restart cut off (see QueryJobInterruption). Only on a job a restart ended. */
+  interruption?: QueryJobInterruption
+  /**
+   * 6.78.0: the steers sent to this job, in arrival order, with the state JOURNALED (a reader
+   * computes `not_applied`, see steerReadState). ABSENT on a job with no steer, and stripped
+   * from every snapshot sent to a client that did not ask with `?steer=1`.
+   */
+  steers?: QueryJobSteer[]
   activity: QueryJobActivity[]
   /** The readable trail (6.52.0), bounded by `QUERY_JOB_LIMITS.trailEntries` and
    * `trailChars`, rebuilt from the journal on restart. ABSENT, never `[]`, on a job
@@ -450,6 +657,7 @@ export function parseQueryJobRequest(raw: unknown, options: ParseQueryJobRequest
     ...(input.handoffLatest === true ? { handoffLatest: true } : {}),
     ...(clientQueueItemId ? { clientQueueItemId } : {}),
     ...(sessionName ? { sessionName } : {}),
+    ...(input.steerable === true ? { steerable: true as const } : {}),
     attachmentIds,
     attachmentRefs,
     activityToolMode,
@@ -519,7 +727,7 @@ export const FINGERPRINT_KEYS = [
 /** The request keys deliberately OUTSIDE the identity. Every key of
  * `QueryJobRequest` must appear in exactly one of the two lists: adding a key
  * without naming it here or above fails to compile, so the author picks a side. */
-export const FINGERPRINT_EXCLUDED = ['origin', 'dispatch', 'sessionName'] as const satisfies readonly (keyof QueryJobRequest)[]
+export const FINGERPRINT_EXCLUDED = ['origin', 'dispatch', 'sessionName', 'steerable'] as const satisfies readonly (keyof QueryJobRequest)[]
 type FingerprintUncovered = Exclude<keyof QueryJobRequest, typeof FINGERPRINT_KEYS[number] | typeof FINGERPRINT_EXCLUDED[number]>
 export const FINGERPRINT_KEYS_COVER_REQUEST: FingerprintUncovered extends never ? true : never = true
 
@@ -593,6 +801,7 @@ export function normalizeQueryJobError(error: unknown, fallbackCode = 'query_job
     ...(candidate.retryable === true ? { retryable: true } : {}),
     ...(typeof candidate.retryAfterMs === 'number' && Number.isFinite(candidate.retryAfterMs)
       ? { retryAfterMs: Math.max(0, Math.ceil(candidate.retryAfterMs)) } : {}),
+    ...(typeof candidate.cause === 'string' && QUERY_JOB_ERROR_CAUSES.has(candidate.cause) ? { cause: candidate.cause } : {}),
   }
 }
 

package/server/lib/queue-turn-evidence.ts

@@ -16,6 +16,9 @@
 // throw is `false` for each, which is what the composition root did before the move.
 
 import { cancelVoidsOpenTurn, type ThreadCancel } from './session-cancel.js'
+import { unwrapPeerMessage } from './session-stream-events.js'
+import type { TurnAttemptLookup } from './agent-session-binding-registry.js'
+import type { QueuedThreadTurn } from './thread-turn-queue.js'
 
 /** The hook signal fields these questions read (a `SessionSignal` satisfies it). */
 export interface TurnEvidenceSignal {
@@ -135,3 +138,213 @@ export function makeQueueTurnEvidence(deps: QueueTurnEvidenceDeps): QueueTurnEvi
 
   return { turnEnded, turnOpen }
 }
+
+// =====================================================================================
+// 6.78.0 (P3): WHAT HAPPENED TO A TURN A RESTART CUT OFF, AND WHETHER A KEY WAS ALREADY SENT
+// =====================================================================================
+//
+// Delivering a prompt is NOT replay-safe: a second copy lands in a real conversation. So
+// every answer below comes from POSITIVE evidence, and absence of evidence is "unknown",
+// never "not sent", with exactly one exception that is itself a positive fact: a row the
+// 6.78 drain stamped (`journal: 1`) whose attempt journal holds no attempt at all. The
+// journal is written in the same commit as the pin, and nothing is sent before the pin, so
+// that absence proves the turn never reached a delivery hop.
+
+
+/** What a `delivering` row from a dead boot is settled as. */
+export type DeliveryEvidence = 'delivered' | 'not_delivered' | 'unknown'
+
+/** A transcript row this far before the attempt still counts (one Mac, one clock; a writer may stamp before it appends). */
+export const EVIDENCE_BACKDATE_MS = 2_000
+
+/** The facts the reconcile decides on, each read by the caller. */
+export interface ReconcileFacts {
+  row: Pick<QueuedThreadTurn, 'queuedAt' | 'journal' | 'mode'>
+  /** `outcome` of the terminal ledger record for this key on the target, or null when there is none. */
+  ledgerOutcome: string | null
+  /** An exact, wrapper-aware transcript match after the attempt began. */
+  transcriptMatch: boolean
+  /** A Codex native queue row with the same text. */
+  codexQueueMatch: boolean
+  /** The attempt journal's answer, or null when the journal could not be read. */
+  attempt: TurnAttemptLookup | null
+}
+
+/**
+ * THE RECONCILE ORDER (plan v3.1 P3, V3 W4). Pure, every branch resolves:
+ *   1. a `completed` or `queued` ledger record, or an attempt that exited `sent`: delivered
+ *   2. an exact transcript match after the attempt began: delivered (it may upgrade an ambiguous record)
+ *   3. a Codex queue row with the same text: delivered
+ *   4. an ambiguous ledger record, an unstamped (legacy) row, a steer row, or an unreadable
+ *      journal, with none of the above: unknown
+ *   5. not_delivered ONLY when the attempt says `not_sent`, or a stamped turn row has no
+ *      attempt at all and the journal cannot have shed one; anything else is unknown
+ */
+export function reconcileVerdict(facts: ReconcileFacts): DeliveryEvidence {
+  if (facts.ledgerOutcome === 'completed' || facts.ledgerOutcome === 'queued') return 'delivered'
+  if (facts.attempt?.attempt?.exit === 'sent') return 'delivered'
+  if (facts.transcriptMatch) return 'delivered'
+  if (facts.codexQueueMatch) return 'delivered'
+  if (facts.ledgerOutcome === 'ambiguous') return 'unknown'
+  if (facts.row.journal !== 1) return 'unknown'
+  if (facts.row.mode === 'steer') return 'unknown'
+  if (facts.attempt === null) return 'unknown'
+  const attempt = facts.attempt.attempt
+  if (attempt !== null) return attempt.exit === 'not_sent' ? 'not_delivered' : 'unknown'
+  const shed = facts.attempt.evictedThrough
+  if (shed !== null && shed >= facts.row.queuedAt) return 'unknown'
+  return 'not_delivered'
+}
+
+function rowTime(row: Record<string, unknown>): number | null {
+  if (typeof row.timestamp !== 'string') return null
+  const ms = Date.parse(row.timestamp)
+  return Number.isFinite(ms) ? ms : null
+}
+
+function textOf(content: unknown): string | null {
+  if (typeof content === 'string') return content
+  if (!Array.isArray(content)) return null
+  const parts: string[] = []
+  for (const block of content) {
+    if (!block || typeof block !== 'object') continue
+    const b = block as Record<string, unknown>
+    if (b.type === 'tool_result') return null
+    if (typeof b.text === 'string' && (b.type === 'text' || b.type === 'input_text' || b.type === undefined)) parts.push(b.text)
+  }
+  return parts.length > 0 ? parts.join('\n') : null
+}
+
+/** The words, as typed or out of Claude Code's peer wrapper, equal the prompt exactly. */
+function sameWords(text: string | null, want: string): boolean {
+  if (text === null) return false
+  if (text.trim() === want) return true
+  return unwrapPeerMessage(text) === want
+}
+
+/**
+ * Does this transcript tail show the session took exactly these words, at or after
+ * `sinceMs`? WRAPPER-AWARE AND EXACT: the whole prompt, trimmed, either as typed or inside
+ * Claude Code's peer-message wrapper. A prefix, a substring or a row without a timestamp is
+ * never evidence, because a false "delivered" loses a turn the person is waiting on.
+ *
+ *   claude  a user row (including the `isMeta` peer row), an `enqueue` queue-operation,
+ *           a `queued_command` attachment
+ *   codex   an `event_msg` user_message, or a user `response_item` message
+ */
+export function transcriptShowsPrompt(provider: string, lines: readonly string[] | null, prompt: string, sinceMs: number): boolean {
+  const want = typeof prompt === 'string' ? prompt.trim() : ''
+  if (!want || !lines || !Number.isFinite(sinceMs)) return false
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const line = typeof lines[i] === 'string' ? lines[i].trim() : ''
+    if (!line.startsWith('{')) continue
+    let row: Record<string, unknown>
+    try { row = JSON.parse(line) as Record<string, unknown> } catch { continue }
+    if (!row || typeof row !== 'object') continue
+    const at = rowTime(row)
+    if (at === null || at < sinceMs) continue
+    if (provider === 'claude') {
+      if (row.type === 'user') {
+        const message = row.message as Record<string, unknown> | undefined
+        if (message && typeof message === 'object' && sameWords(textOf(message.content), want)) return true
+      } else if (row.type === 'queue-operation' && row.operation === 'enqueue') {
+        if (sameWords(textOf(row.content), want)) return true
+      } else if (row.type === 'attachment') {
+        const attachment = row.attachment as Record<string, unknown> | undefined
+        if (attachment && attachment.type === 'queued_command' && sameWords(textOf(attachment.prompt ?? attachment.content), want)) return true
+      }
+    } else if (provider === 'codex') {
+      const payload = row.payload as Record<string, unknown> | undefined
+      if (!payload || typeof payload !== 'object') continue
+      if (row.type === 'event_msg' && payload.type === 'user_message' && sameWords(typeof payload.message === 'string' ? payload.message : null, want)) return true
+      if (row.type === 'response_item' && payload.type === 'message' && payload.role === 'user' && sameWords(textOf(payload.content), want)) return true
+    }
+  }
+  return false
+}
+
+/** Where `makeDeliveryEvidence` reads each fact. Every read may throw; a throw is unknown. */
+export interface DeliveryEvidenceDeps {
+  /** The terminal ledger record's `outcome` for this key on the target, or null. */
+  ledgerOutcome: (provider: string, threadId: string, clientTurnId: string) => string | null
+  attempt: (provider: string, threadId: string, clientTurnId: string) => TurnAttemptLookup | null
+  /** The thread's transcript tail as lines, or null when unreadable. */
+  transcriptLines: (provider: string, threadId: string) => readonly string[] | null
+  /** The plain text of every row in the Codex app's own queue for this thread. */
+  codexQueueTexts?: (threadId: string) => Promise<readonly string[]> | readonly string[]
+}
+
+/** `ThreadTurnQueueDeps.deliveryEvidence`, built from the real reads. Never throws. */
+export function makeDeliveryEvidence(deps: DeliveryEvidenceDeps): (turn: QueuedThreadTurn) => Promise<DeliveryEvidence> {
+  return async turn => {
+    try {
+      const ledgerOutcome = deps.ledgerOutcome(turn.provider, turn.threadId, turn.clientTurnId)
+      const attempt = deps.attempt(turn.provider, turn.threadId, turn.clientTurnId)
+      const since = (attempt?.attempt?.at ?? turn.queuedAt) - EVIDENCE_BACKDATE_MS
+      const transcriptMatch = (turn.provider === 'claude' || turn.provider === 'codex')
+        && transcriptShowsPrompt(turn.provider, deps.transcriptLines(turn.provider, turn.threadId), turn.prompt, since)
+      let codexQueueMatch = false
+      if (!transcriptMatch && turn.provider === 'codex' && typeof deps.codexQueueTexts === 'function') {
+        const texts = await deps.codexQueueTexts(turn.threadId)
+        codexQueueMatch = texts.some(text => typeof text === 'string' && text.trim() === turn.prompt.trim())
+      }
+      return reconcileVerdict({ row: turn, ledgerOutcome, transcriptMatch, codexQueueMatch, attempt })
+    } catch {
+      return 'unknown'
+    }
+  }
+}
+
+/** A key the turns route must replay instead of sending. */
+export interface TurnReceipt {
+  kind: 'delivered' | 'unknown'
+  source: 'queue' | 'attempt' | 'transcript'
+}
+
+/**
+ * Which queue rows are receipts. ONLY a row whose outcome is settled: delivered, or refused
+ * with an unknown outcome. Never `waiting` or `delivering`: the drainer posts the turns route
+ * with the row's OWN key while the row is `delivering`, so counting that row would make the
+ * queue refuse its own delivery (V2 B2, V3 B3).
+ */
+export function isReceiptRow(row: Pick<QueuedThreadTurn, 'status' | 'deliveryState'>): boolean {
+  return row.status === 'delivered' || (row.status === 'refused' && row.deliveryState === 'unknown')
+}
+
+export interface TurnReceiptDeps {
+  queueRows: (provider: string, threadId: string) => readonly QueuedThreadTurn[]
+  attempt: (provider: string, threadId: string, clientTurnId: string) => TurnAttemptLookup | null
+  transcriptLines?: (provider: string, threadId: string) => readonly string[] | null
+  /** This process's boot: a `pending` attempt of THIS boot is a turn in flight, not an orphan. */
+  bootId: string
+}
+
+/**
+ * The turns POST's receipt check (6.78.0), after the ledger replay and before the claim.
+ *
+ *   queue row delivered                    delivered
+ *   queue row refused, delivery unknown    unknown
+ *   attempt sent                           delivered
+ *   attempt unknown, or pending from a     unknown, unless the transcript now shows the
+ *   dead boot                              exact words after it began (then delivered)
+ *   anything else (no row, not_sent,       null: not a receipt; the route's own gates
+ *   pending in this boot)                  decide (a turn in flight meets the claim)
+ */
+export function makeTurnReceiptLookup(deps: TurnReceiptDeps): (provider: string, threadId: string, clientTurnId: string, prompt: string) => TurnReceipt | null {
+  return (provider, threadId, clientTurnId, prompt) => {
+    const row = deps.queueRows(provider, threadId).find(t => t.clientTurnId === clientTurnId)
+    if (row && isReceiptRow(row)) return { kind: row.status === 'delivered' ? 'delivered' : 'unknown', source: 'queue' }
+    const lookup = deps.attempt(provider, threadId, clientTurnId)
+    const attempt = lookup?.attempt ?? null
+    if (attempt === null) return null
+    if (attempt.exit === 'sent') return { kind: 'delivered', source: 'attempt' }
+    const unknown = attempt.exit === 'unknown' || (attempt.exit === 'pending' && attempt.bootId !== deps.bootId)
+    if (!unknown) return null
+    if (typeof deps.transcriptLines === 'function') {
+      let lines: readonly string[] | null = null
+      try { lines = deps.transcriptLines(provider, threadId) } catch { lines = null }
+      if (transcriptShowsPrompt(provider, lines, prompt, attempt.at - EVIDENCE_BACKDATE_MS)) return { kind: 'delivered', source: 'transcript' }
+    }
+    return { kind: 'unknown', source: 'attempt' }
+  }
+}

package/server/lib/thread-turn-queue-deliver.ts

@@ -77,7 +77,7 @@ export async function deliverQueuedTurnOverLoopback(
   turn: QueuedThreadTurn,
   port: number,
   token: string,
-): Promise<{ ok: boolean; reason?: string; serverRetryable?: boolean }> {
+): Promise<{ ok: boolean; reason?: string; serverRetryable?: boolean; replayed?: boolean; deliveryState?: string }> {
   // 6.62.0 /qa (Q3): repeat the parking client's acknowledgement, and only that.
   const noteHeaders: Record<string, string> = turn.continueNoteAck === true ? { 'X-COS-Continue-Note': '1' } : {}
   try {
@@ -131,6 +131,11 @@ export async function deliverQueuedTurnOverLoopback(
       ok: false,
       reason: String(sent.body.reason ?? sent.body.error ?? `turn_${sent.status}`),
       serverRetryable: typeof sent.body.retryable === 'boolean' ? sent.body.retryable : undefined,
+      // 6.78.0: a REPLAY of a key whose delivery is unknown (a receipt, or an ambiguous
+      // ledger record). The drain settles it at once instead of retrying the key until the
+      // attempt ceiling: the route will give the same answer every time, by design.
+      ...(sent.body.replayed === true ? { replayed: true } : {}),
+      ...(typeof sent.body.deliveryState === 'string' ? { deliveryState: sent.body.deliveryState } : {}),
     }
   } catch (error) {
     return { ok: false, reason: error instanceof Error ? error.message : 'deliver_failed' }

package/server/lib/thread-turn-queue-store.ts

@@ -12,7 +12,7 @@ import { nativeQueuedCounts } from './codex-queue-control.js'
 
 import { closeSync, constants, existsSync, fstatSync, mkdirSync, openSync, readdirSync, readFileSync, readSync } from 'node:fs'
 import { join } from 'node:path'
-import { atomicWriteFileSync } from './atomic-fs.js'
+import { atomicWriteFileSync, durableAtomicWriteFileSync } from './atomic-fs.js'
 import { dataPath } from './data-dir.js'
 import { turnFromTail, type SessionStreamProvider, type TurnFromTail } from './session-stream-events.js'
 import { pruneQueue, type QueuedThreadTurn } from './thread-turn-queue.js'
@@ -64,9 +64,18 @@ export function readQueue(provider: string, threadId: string, now: number): Queu
   }
 }
 
-/** Replace a thread's queue. Atomic, so a crash mid-write cannot truncate it. */
-export function writeQueue(provider: string, threadId: string, queue: readonly QueuedThreadTurn[]): void {
-  atomicWriteFileSync(queuePath(provider, threadId), `${JSON.stringify(queue, null, 2)}\n`)
+/**
+ * Replace a thread's queue. Atomic, so a crash mid-write cannot truncate it.
+ *
+ * 6.78.0: `durable` also fsyncs the bytes and the directory before returning. Used for the
+ * one write that must survive a power cut as well as a crash: a row entering `delivering`,
+ * which is the intent the restart reconcile reads. Same bytes either way.
+ */
+export function writeQueue(provider: string, threadId: string, queue: readonly QueuedThreadTurn[], options: { durable?: boolean } = {}): void {
+  const path = queuePath(provider, threadId)
+  const text = `${JSON.stringify(queue, null, 2)}\n`
+  if (options.durable === true) durableAtomicWriteFileSync(path, text)
+  else atomicWriteFileSync(path, text)
 }
 
 /**