@gotcos/glasses-server 6.77.0 → 6.78.1

package/server/lib/thread-turn-queue.ts

@@ -63,6 +63,8 @@
 // event, and positive evidence of an OPEN turn outranks it. Same reasoning as the
 // session-trail handoff, one layer down.
 
+import { readSwitch } from './env-switch.js'
+
 /** Terminal-ish states a queued turn can reach. `waiting` is the only live one. */
 export type QueuedTurnStatus =
   | 'waiting'
@@ -93,6 +95,107 @@ export interface QueuedThreadTurn {
    * only for a client that said it would show it. Absent: the 6.61 Ask posture.
    */
   continueNoteAck?: true
+  // ---------------------------------------------------------------- 6.78.0 (P3)
+  // Every field below is OPTIONAL and written only while its flag is on, so with
+  // COS_QUEUE_RECONCILE, COS_QUEUE_RESEND and COS_SESSION_STEER all off a queue file is
+  // byte-for-byte what 6.77.0 writes. A 6.77 server reading a 6.78 file ignores them.
+  /**
+   * Stamped (`1`) when this row entered `delivering` under the attempt journal (6.78.0).
+   * Its ABSENCE on a `delivering` row is the whole point: a row with no stamp was written by
+   * a build that kept no attempt record, so "no attempt on file" proves nothing about it and
+   * the reconcile reads it as unknown, never as unsent.
+   */
+  journal?: 1
+  /** The server boot that moved this row to `delivering`. A different boot means it was cut off. */
+  deliveringBootId?: string
+  /** `unknown`: COS cannot establish whether the words reached the session. Never resent. */
+  deliveryState?: 'unknown'
+  /** `steer`: sent into the running turn through the session's peer inbox. Absent: `queue`. */
+  mode?: 'steer'
+  /** Send again: the row this one was copied from. */
+  resendOf?: string
+  /** Send again: the row that was copied from this one. Set once, and only once. */
+  resentAs?: string
+}
+
+// ------------------------------------------------------------------- 6.78.0 flags
+//
+// Read at CALL time through the one 6.78.0 switch reader (lib/env-switch.ts): `1`, `true`
+// or `on` is on, `0`, `false` or `off` is off, anything else is the default (P7 S3: an exact
+// `0`/`1` reader here made `COS_QUEUE_RECONCILE=false` read ON). One reader per flag, so
+// every caller (routes, registry, drain, health) decides with the same answer in the same tick.
+function triStateFlag(env: NodeJS.ProcessEnv, name: string, fallback: boolean): boolean {
+  return readSwitch(env[name], fallback)
+}
+
+/** `COS_QUEUE_RECONCILE`: the attempt journal, the restart reconcile, receipts, unknown-row retention and reason copy. Default ON. */
+export function queueReconcileEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
+  return triStateFlag(env, 'COS_QUEUE_RECONCILE', true)
+}
+
+/** `COS_PIN_BOOT_REAP`: release a pin a dead boot left, once its orphan child must be gone (21 min). Default ON. */
+export function pinBootReapEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
+  return triStateFlag(env, 'COS_PIN_BOOT_REAP', true)
+}
+
+/** `COS_QUEUE_RESEND`: Send again on a refused or expired row. Default ON. */
+export function queueResendEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
+  return triStateFlag(env, 'COS_QUEUE_RESEND', true)
+}
+
+/** `COS_SESSION_STEER`: steer a busy Claude session through its peer inbox. Default OFF. */
+export function sessionSteerEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
+  return triStateFlag(env, 'COS_SESSION_STEER', false)
+}
+
+/**
+ * Reasons whose outcome COS cannot establish. Such a row is never resent and is kept for
+ * UNKNOWN_DELIVERY_RETENTION_MS rather than 30 minutes, because the phone has to be able to
+ * read "may not have been sent" for as long as the person might come back to it.
+ */
+export const UNKNOWN_DELIVERY_REASONS: ReadonlySet<string> = new Set([
+  'delivery_unknown_after_restart',
+  'steer_unverified',
+  'delivery_ambiguous',
+])
+
+/** How long a settled row with an unknown outcome stays readable. */
+export const UNKNOWN_DELIVERY_RETENTION_MS = 6 * 60 * 60 * 1000
+
+/** The lens body is 62 columns; every reason line fits one. */
+export const QUEUED_TURN_REASON_COPY_MAX = 62
+
+/** One line per reason, server-authored. Keys are the reasons a row can carry. */
+const QUEUED_TURN_REASON_COPY: Readonly<Record<string, string>> = {
+  delivery_unknown_after_restart: 'May not have been sent. Read it, then say it again.',
+  steer_unverified: 'May not have been sent. Read it, then say it again.',
+  delivery_ambiguous: 'May not have been sent. Read it, then say it again.',
+  steered: 'Sent into the running turn.',
+  reconciled_after_restart: 'Sent before the server restarted.',
+  requeued_after_restart: 'Not sent before the restart. Waiting to send.',
+  queued_turn_expired: 'Not sent: the thread stayed busy too long.',
+  delivery_attempts_exhausted: 'Not sent: the session refused it five times.',
+  turn_cancelled: 'Cancelled before it was sent.',
+  steer_not_sent: 'Not sent: the session could not take it mid-turn.',
+  native_thread_working: 'Waiting for the current turn to end.',
+  live_desktop_process: 'Waiting for the current turn to end.',
+  native_target_busy: 'Waiting: another COS turn holds this thread.',
+  native_turn_in_progress: 'Waiting: a COS turn is running on this thread.',
+  native_target_fenced: 'Waiting: an earlier turn needs a check on your Mac.',
+}
+
+/**
+ * The reason line for a queue row, or null when there is nothing to say (no reason, or one
+ * this build has no words for: a raw code is never shown as if it were a sentence).
+ */
+export function queuedTurnReasonCopy(reason: string | null | undefined): string | null {
+  if (typeof reason !== 'string' || reason.length === 0) return null
+  return Object.prototype.hasOwnProperty.call(QUEUED_TURN_REASON_COPY, reason) ? QUEUED_TURN_REASON_COPY[reason] : null
+}
+
+/** Every reason with copy, for the column test. */
+export function queuedTurnReasonCopyKeys(): string[] {
+  return Object.keys(QUEUED_TURN_REASON_COPY)
 }
 
 /**
@@ -286,10 +389,14 @@ export function pruneQueue(
   now: number,
   settledRetentionMs: number = 30 * 60 * 1000,
 ): QueuedThreadTurn[] {
+  // 6.78.0: a row whose outcome is unknown stays for six hours (COS_QUEUE_RECONCILE). Read
+  // once per prune, so one pass cannot keep some rows by the new rule and drop others by the old.
+  const keepUnknown = queueReconcileEnabled()
   return queue.filter(t => {
     if (t.status === 'waiting' || t.status === 'delivering') return true
     const settled = typeof t.settledAt === 'number' ? t.settledAt : t.queuedAt
-    return now - settled < settledRetentionMs
+    const unknown = keepUnknown && (t.deliveryState === 'unknown' || (typeof t.reason === 'string' && UNKNOWN_DELIVERY_REASONS.has(t.reason)))
+    return now - settled < (unknown ? Math.max(settledRetentionMs, UNKNOWN_DELIVERY_RETENTION_MS) : settledRetentionMs)
   })
 }
 
@@ -297,3 +404,46 @@ export function pruneQueue(
 export function queuePosition(queue: readonly QueuedThreadTurn[], clientTurnId: string): number {
   return queue.filter(t => t.status === 'waiting').findIndex(t => t.clientTurnId === clientTurnId)
 }
+
+// ------------------------------------------------------------- 6.78.0 session steer
+
+/** Why a busy session cannot take a steer right now (the wire enum, plan v3.1 section 5.3). */
+export type SessionSteerUnavailable = 'no_outside_channel' | 'engine_limit' | 'permission_pending'
+
+export type SessionSteerAvailability =
+  | { available: true; mode: 'peer_inbox' }
+  | { available: false; reason: SessionSteerUnavailable }
+
+/** Occupancy reasons that mean "a session outside COS is running this thread". Only those can be steered. */
+const STEERABLE_GATE_REASONS: ReadonlySet<string> = new Set(['native_thread_working', 'live_desktop_process'])
+
+/**
+ * Can a turn go INTO the running turn of this thread now (6.78.0, COS_SESSION_STEER)?
+ *
+ * PURE, one rule for the attach refusal's `steer` field and the queued-turns POST, so the
+ * row the lens offers and the answer to the tap agree.
+ *   cursor                      engine_limit: the Stop hook is its only door
+ *   codex                       no_outside_channel: `turn/steer` lives in an app-server COS does not hold
+ *   claude, live hop off        no_outside_channel (`COS_CONTINUE_LIVE=0`)
+ *   claude, not a desk run      no_outside_channel: COS's own binding or turn, a fence, or a
+ *                               thread nobody could measure; nothing outside COS to fold into
+ *   claude, no peer inbox       no_outside_channel
+ *   claude, held on a prompt    permission_pending: a session waiting on a dialog reaches no
+ *                               tool boundary, and the steer verify window (4 s) is far shorter
+ *                               than the hook's wait (630 s); it is queued for the turn's end
+ */
+export function sessionSteerAvailability(input: {
+  provider: string
+  gateReason: string | null
+  continueLive: boolean
+  peerInbox: boolean
+  waitingOnPrompt: boolean
+}): SessionSteerAvailability {
+  if (input.provider === 'cursor') return { available: false, reason: 'engine_limit' }
+  if (input.provider !== 'claude') return { available: false, reason: 'no_outside_channel' }
+  if (!input.continueLive) return { available: false, reason: 'no_outside_channel' }
+  if (typeof input.gateReason !== 'string' || !STEERABLE_GATE_REASONS.has(input.gateReason)) return { available: false, reason: 'no_outside_channel' }
+  if (!input.peerInbox) return { available: false, reason: 'no_outside_channel' }
+  if (input.waitingOnPrompt) return { available: false, reason: 'permission_pending' }
+  return { available: true, mode: 'peer_inbox' }
+}

package/server/routes/agent-session-bindings.ts

@@ -122,7 +122,10 @@ import {
   type NativeBinding,
 } from '../lib/agent-session-binding-store.js'
 import { boundedContinueNote, CONTINUE_NOTE_HEADER, continueNoteAcknowledged, fallbackContinueNote } from '../lib/continue-plan.js'
-import type { RegistryCheck, RegistryRejection, RegistryResult } from '../lib/agent-session-binding-registry.js'
+import type { PinExtras, RegistryCheck, RegistryRejection, RegistryResult, UnpinExtras } from '../lib/agent-session-binding-registry.js'
+import { ORPHAN_CHILD_RUNNING_COPY } from '../lib/agent-session-binding-registry.js'
+import { pinBootReapEnabled, queueableRefusal, queueReconcileEnabled, sessionSteerEnabled, type SessionSteerAvailability } from '../lib/thread-turn-queue.js'
+import type { TurnReceipt } from '../lib/queue-turn-evidence.js'
 import { recordCosSpawn, releaseCosSpawn } from '../lib/agent-session-ownership-store.js'
 import { isValidNativeThreadId } from '../lib/native-thread-id.js'
 import { FORK_PROVIDER_FAILURES, type ForkProviderFailure } from '../lib/fork-thread.js'
@@ -212,9 +215,24 @@ export interface BindingRegistry {
     claim: { bindingId: string; epoch: number; targetKey: string },
     now: number,
   ) => RegistryCheck
-  /** A rejection here is FATAL to the turn, per the registry's own caller contract. */
-  pin?: (bindingId: string, jobId: string, now: number) => RegistryResult
-  unpin?: (bindingId: string, jobId: string, now: number) => RegistryResult
+  /**
+   * A rejection here is FATAL to the turn, per the registry's own caller contract.
+   * 6.78.0: `extras` carries the pin's client turn and opens its attempt in the same commit;
+   * passed only while COS_PIN_BOOT_REAP or COS_QUEUE_RECONCILE is on.
+   */
+  pin?: (bindingId: string, jobId: string, now: number, extras?: PinExtras) => RegistryResult
+  /** 6.78.0: `extras` records how the turn's delivery ended, in the same commit as the release. */
+  unpin?: (bindingId: string, jobId: string, now: number, extras?: UnpinExtras) => RegistryResult
+  /**
+   * 6.78.0: is this target held only by pins a dead boot left, and until when? Optional; the
+   * refusal copy says when the thread frees, or keeps its 6.77 words without it.
+   */
+  orphanPinHold?: (provider: string, nativeThreadId: string, now: number) => { releasesAt: number; childRunning?: true } | null
+  /**
+   * 6.78.0 (P7 S6): record the resume child a pinned turn spawned (pid and measured start),
+   * so a crash's orphan pin waits for that process. Optional; a failure changes nothing.
+   */
+  notePinChild?: (bindingId: string, jobId: string, child: { pid: number; startMs: number }) => RegistryResult
 }
 
 /** What attach resolves server-side because plan 4.2 forbids the client sending it. */
@@ -411,6 +429,21 @@ export interface AgentSessionBindingsDeps {
   /** Overrides the env gate. Tests only; production reads threadAttachEnabled(). */
   attachEnabled?: boolean
 
+  /**
+   * 6.78.0 (COS_QUEUE_RECONCILE): was this client turn already sent, or may it have been?
+   * `makeTurnReceiptLookup`: the queue's SETTLED rows (never waiting or delivering), the
+   * attempt journal, and the transcript for an unknown. Consulted after the ledger replay
+   * and before the claim; a hit is replayed, never sent again. Absent: 6.77 behaviour.
+   */
+  turnReceipt?: (provider: string, nativeThreadId: string, clientTurnId: string, prompt: string) => TurnReceipt | null
+
+  /**
+   * 6.78.0 (COS_SESSION_STEER): could a turn go INTO this thread's running turn? Added to an
+   * attach refusal as `steer`. The router also checks the flag itself, so with it off the
+   * field is absent whatever is wired.
+   */
+  sessionSteer?: (provider: string, nativeThreadId: string, gateReason: string) => SessionSteerAvailability | null
+
   ownership?: {
     record: (pid: number, startMs: number) => string
     release: (pid: number) => boolean
@@ -1607,6 +1640,17 @@ export const CONTINUE_NOTE_BUDGET_MS = 1_500
  */
 export const TURN_QUEUED_COPY = 'Queued to the original thread. It keeps running if you put your phone away.'
 
+/**
+ * 6.78.0: the refusal copy while a pin a dead boot left holds the thread. The time is the
+ * Mac's local clock, rounded UP to the minute, so the thread is never shown free early.
+ * 62 columns or fewer, no em dash, no arrow.
+ */
+export function orphanPinWaitCopy(releasesAt: number): string {
+  const at = new Date(Math.ceil(releasesAt / 60_000) * 60_000)
+  const hour = at.getHours() % 12 || 12
+  return `An earlier run may still be running · frees ${hour}:${String(at.getMinutes()).padStart(2, '0')}`
+}
+
 /** Status of a turn that is admitted and still running. */
 export const TURN_PENDING_COPY = 'Still working on your Mac.'
 
@@ -1878,14 +1922,39 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
   const runOccupancy = (provider: string, threadId: string): AttachabilityBody =>
     projectAttachability(routeOccupancy(provider, threadId))
 
-  const refuseAttach = (res: Response, reason: WriteRefusal): void => {
+  const refuseAttach = (res: Response, reason: WriteRefusal, extra: Record<string, unknown> = {}): void => {
     res.status(refusalStatus(reason)).json({
       attached: false,
       reason,
       reasonCopy: writeReasonCopy(reason),
+      ...extra,
     })
   }
 
+  /**
+   * 6.78.0: what an attach refusal on THIS thread adds. `steer` (COS_SESSION_STEER) on a
+   * refusal a turn may queue behind, from the shared rule. And when the holder is a pin a
+   * dead boot left (COS_PIN_BOOT_REAP), the copy says when it frees instead of telling the
+   * person to detach a chat that no longer exists. Empty with the flags off.
+   */
+  const attachRefusalExtras = (provider: string, threadId: string, reason: WriteRefusal, now: number | null): Record<string, unknown> => {
+    const extra: Record<string, unknown> = {}
+    if (reason === 'native_target_busy' && now !== null && typeof deps.bindings?.orphanPinHold === 'function') {
+      let hold: { releasesAt: number; childRunning?: true } | null = null
+      try { hold = deps.bindings.orphanPinHold(provider, threadId, now) } catch { hold = null }
+      if (hold && Number.isFinite(hold.releasesAt)) extra.reasonCopy = orphanPinWaitCopy(hold.releasesAt)
+      // P7 S6: past the window, the dead boot's child itself still runs: no time to promise
+      // (such a hold carries no finite releasesAt, so the line above never wrote).
+      if (hold?.childRunning === true) extra.reasonCopy = ORPHAN_CHILD_RUNNING_COPY
+    }
+    if (sessionSteerEnabled() && typeof deps.sessionSteer === 'function' && queueableRefusal(reason)) {
+      let steer: SessionSteerAvailability | null = null
+      try { steer = deps.sessionSteer(provider, threadId, reason) } catch { steer = null }
+      if (steer) extra.steer = steer
+    }
+    return extra
+  }
+
   /** Read a finite clock, or null. A route that cannot tell the time refuses. */
   const readNow = (): number | null => {
     try {
@@ -2335,7 +2404,10 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
       // or any doubt about whether it has one — is Fork-only, and attach is the
       // gate that makes that true.
       const verdict = runOccupancy(providerParam, threadIdParam)
-      if (!verdict.attachable) return refuseAttach(res, verdict.reason ?? 'probe_failed')
+      if (!verdict.attachable) {
+        const refused = verdict.reason ?? 'probe_failed'
+        return refuseAttach(res, refused, attachRefusalExtras(providerParam, threadIdParam, refused, now))
+      }
 
       // `runOccupancy` already proved both, provider first. These narrow the types
       // rather than re-deciding the rule — a second copy of the id rule is how the
@@ -2352,7 +2424,7 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
       // a per-binding fence.
       if (fenced !== null) {
         console.warn(`[agent-session-bindings] fence hit route=attach provider=${providerParam} target=${opaqueRevision(key)}`)
-        return refuseAttach(res, fenced)
+        return refuseAttach(res, fenced, attachRefusalExtras(providerParam, threadIdParam, fenced, now))
       }
 
       const resolve = deps.resolveTarget
@@ -2391,7 +2463,10 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
         ttlMs: attachTtlMs,
         now,
       })
-      if (!created?.binding) return refuseAttach(res, registryRefusal(created?.reason))
+      if (!created?.binding) {
+        const refused = registryRefusal(created?.reason)
+        return refuseAttach(res, refused, attachRefusalExtras(providerParam, threadIdParam, refused, now))
+      }
 
       const activated = deps.bindings.activate!(bindingId, now)
       if (!activated?.binding) {
@@ -2775,6 +2850,17 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
      * alone is backgrounded once the last gate passes.
      */
     let queued = false
+    /**
+     * 6.78.0 (COS_QUEUE_RECONCILE): the attempt journal. Opened with the pin (same commit),
+     * settled with the unpin. Where the turn MAY have gone: `proven` once a hop showed it
+     * arrived; `liveMay` / `spawnMay` once a hop that could have written was entered and did
+     * not prove nothing reached. `not_sent` only when every hop entered said nothing did.
+     */
+    let attemptOpened = false
+    let proven = false
+    let liveMay = false
+    let spawnMay = false
+    const attemptExit = (): 'sent' | 'not_sent' | 'unknown' => (proven ? 'sent' : liveMay || spawnMay ? 'unknown' : 'not_sent')
 
     const respond = (status: number, payload: Record<string, unknown>): void => {
       if (!res.headersSent) {
@@ -2919,6 +3005,46 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
         return
       }
 
+      // 6.78.0: RECEIPTS, before any gate, claim, pin or hop. The ledger above is dropped
+      // with its binding and records nothing for a pre-202 `live_unverified`; a crash after
+      // the pin leaves no record at all. The receipt covers those (target-scoped attempt
+      // journal, the queue's settled rows), so a phone that retries a key after a reconnect
+      // or a restart can never put the same words in twice. A hit is replayed, never sent:
+      // `delivered` as a completed turn, `unknown` as the ambiguous outcome every client
+      // already treats as "do not send again".
+      if (queueReconcileEnabled() && typeof deps.turnReceipt === 'function') {
+        const owner = deps.bindings.get?.(bindingId) ?? null
+        if (owner && isBindableProvider(owner.provider) && isValidNativeThreadId(owner.nativeThreadId)) {
+          let receipt: TurnReceipt | null
+          try {
+            receipt = deps.turnReceipt(owner.provider, owner.nativeThreadId, clientTurnId, prompt)
+          } catch (error) {
+            // A receipt we could not read is not "never sent". Fail closed: unknown.
+            console.error(`[agent-session-bindings] turn receipt read failed: ${error instanceof Error ? error.message : error}`)
+            receipt = { kind: 'unknown', source: 'attempt' }
+          }
+          if (receipt !== null) {
+            const delivered = receipt.kind === 'delivered'
+            if (!res.headersSent) {
+              res.status(delivered ? 200 : refusalStatus('delivery_ambiguous')).json({
+                turnId,
+                outcome: delivered ? 'completed' : 'ambiguous',
+                deliveryState: delivered ? 'delivered' : 'unknown',
+                retryable: false,
+                changed: false,
+                revision: null,
+                reason: delivered ? null : 'delivery_ambiguous',
+                reasonCopy: delivered ? TURN_SENT_COPY : writeReasonCopy('delivery_ambiguous'),
+                replayed: true,
+                receipt: receipt.source,
+              })
+              console.log(turnTiming(`receipt/${receipt.kind}/${receipt.source}`))
+            }
+            return
+          }
+        }
+      }
+
       // The client-queued-prompt gate, used rather than reimplemented: it is the
       // one place that orders state before epoch before target, and a second
       // opinion here is how the store's own header says the two drifted apart.
@@ -3004,10 +3130,19 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
 
       // A failed pin is FATAL, per the registry's own caller contract: an unpinned
       // binding can expire or be detached mid-turn, which defeats the lease.
-      const pinned = deps.bindings.pin!(bindingId, turnId, now)
+      // 6.78.0: the pin names its client turn (COS_PIN_BOOT_REAP) and opens the attempt
+      // (COS_QUEUE_RECONCILE) in its own commit: on disk before any frame or spawn below.
+      const pinExtras: PinExtras = {
+        ...(pinBootReapEnabled() ? { pinMeta: { clientTurnId } } : {}),
+        ...(queueReconcileEnabled() ? { attempt: { clientTurnId, mode: 'turn' as const } } : {}),
+      }
+      const pinned = Object.keys(pinExtras).length > 0
+        ? deps.bindings.pin!(bindingId, turnId, now, pinExtras)
+        : deps.bindings.pin!(bindingId, turnId, now)
       stage('pin')
       if (!pinned?.binding) return refuseTurn(registryRefusal(pinned?.reason))
       pinnedBindingId = bindingId
+      attemptOpened = pinExtras.attempt !== undefined
 
       // 6.53.0: a cancel that landed during the gate or the head read. Before the live hop,
       // which cannot be recalled once it writes into the open session. Nothing was sent;
@@ -3051,7 +3186,10 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
           live = null
         }
         stage(`live(${live?.reason ?? 'threw'})`)
+        // 6.78.0: a throw is a transport bug, not proof the frame never left.
+        if (live === null) liveMay = true
         if (live?.ok) {
+          proven = true
           // 6.53.3: delivered, so the turn runs in the open session now, and what stops it
           // there is the desk halt marker. The turn itself WAS delivered and says so.
           const latched = latchedHere()
@@ -3071,6 +3209,7 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
           return
         }
         if (live && (live.reason === 'unverified' || live.reason === 'write_failed')) {
+          liveMay = true
           // 6.53.3: something MAY be in the session and the person asked for it to stop: arm
           // the marker as for a landed turn, and settle this turn as cancelled, never as a
           // retryable hold that the queue would send again after the cancel's two minutes.
@@ -3123,7 +3262,10 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
           live = null
         }
         stage(`codex-live(${live?.reason ?? 'threw'})`)
+        // 6.78.0: a row MAY be in the Codex app's queue after a throw or an unverified write.
+        if (live === null || live.reason === 'unverified') liveMay = true
         if (live?.ok) {
+          proven = true
           // 6.53.3: queued in the Codex app, which only the app can stop ("Stop it there").
           const latched = latchedHere()
           if (latched) settleLatchedCancel(latched, binding.provider, binding.nativeThreadId, 'reached', { prompt, sentAt: handOffAt, busy: busyCodexHop })
@@ -3221,6 +3363,7 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
 
       let delivery: Delivery
       deliveryAttempted = true
+      spawnMay = true
       try {
         const result = await deliver({
           turnId,
@@ -3261,6 +3404,11 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
             // occupancy check.
             if (outcome !== 'recorded') return false
             recordedPids.push({ pid, startMs })
+            // 6.78.0 (P7 S6): the pin names this child, so after a crash the thread waits for
+            // THIS process to be gone, not only for the window. Never fails the turn.
+            if (pinBootReapEnabled() && typeof deps.bindings.notePinChild === 'function') {
+              try { deps.bindings.notePinChild(bindingId, turnId, { pid, startMs }) } catch { /* the window still bounds the pin */ }
+            }
             return true
           },
         })
@@ -3310,7 +3458,11 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
         return refuseTurn('turn_cancelled', { retryable: false, deliveryState: 'cancelled' })
       }
 
-      if (delivery.kind === 'aborted') return refuseTurn('provider_never_opened')
+      if (delivery.kind === 'aborted') {
+        // The adapter's own proof that the child never opened the session.
+        spawnMay = false
+        return refuseTurn('provider_never_opened')
+      }
 
       if (delivery.kind === 'ambiguous') {
         // Plan 4.6: the reservation is HELD, not released. A hand-crafted next
@@ -3356,6 +3508,7 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
         after = reread === null ? null : reread.digest
       }
       if (after !== null) guard.acknowledgeHead(bindingId, after)
+      proven = true
 
       // Phase 4 owns Message persistence. Nothing about the prompt or the reply is
       // written, logged or echoed here; the terminal outcome is the whole result.
@@ -3411,7 +3564,12 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
       }
       if (pinnedBindingId !== null) {
         try {
-          deps.bindings.unpin!(pinnedBindingId, turnId, readNow() ?? requestNow)
+          // 6.78.0: the attempt's exit rides the release, in one commit.
+          if (attemptOpened && clientTurnId !== null) {
+            deps.bindings.unpin!(pinnedBindingId, turnId, readNow() ?? requestNow, { attemptExit: { clientTurnId, exit: attemptExit() } })
+          } else {
+            deps.bindings.unpin!(pinnedBindingId, turnId, readNow() ?? requestNow)
+          }
         } catch (error) {
           console.error(`[agent-session-bindings] unpin failed: ${error instanceof Error ? error.message : error}`)
         }

package/server/routes/health.ts

@@ -57,7 +57,8 @@ import { G2_LENS_VARIANT_CAPABILITY } from '../lib/media-store.js'
 // The flag lives beside the endpoints it describes, so it cannot drift from
 // whether they are actually registered.
 import { MEDIA_CHUNKED_UPLOAD_ENABLED } from './media.js'
-import { durableQueryJobsCapability, messagesTrailEnabled } from '../lib/query-job-feature.js'
+import { durableQueryJobsCapability, messagesSteerCapability, messagesTrailEnabled } from '../lib/query-job-feature.js'
+import { claudeSteerSupportKnown } from '../lib/claude-cli-support.js'
 import { jobTrailStats } from '../lib/job-trail.js'
 import { getQueryJobRuntimeHealth } from '../lib/query-job-runtime.js'
 import { getMorningBriefScheduler } from '../lib/morning-brief-runtime.js'
@@ -100,6 +101,7 @@ import { permissionBrokerHealthFields, sessionQuestionsCapability } from '../lib
 import { continueLiveEnabled, liveDeliveryStats } from '../lib/session-peer-inbox-deps.js'
 import { codexLiveStats } from '../lib/codex-live-queue-deps.js'
 import { codexLiveQueueEnabled } from '../lib/codex-live-queue.js'
+import { bootResumeGate } from '../lib/boot-resume.js'
 
 /**
  * 6.49.0: which last hop a Continue takes, and how often each fell back.
@@ -544,9 +546,23 @@ healthRouter.get('/health', async (_req, res) => {
       enabled: durableJobs.enabled && messagesTrailEnabled(),
       ...jobTrailStats(),
     },
+    // 6.78.0 (P7 S5): how much boot-resumed work is parked for crash-looping the server. A
+    // count only (health is public); the items and their Retry are behind the token at
+    // GET /api/maintenance/status.
+    crash_loop_parking: crashLoopParkingHealth(),
   })
 })
 
+/** Never throws: health must not 500 because of the ledger. */
+function crashLoopParkingHealth(): { enabled: boolean; parked: number } {
+  try {
+    const status = bootResumeGate().status()
+    return { enabled: status.enabled, parked: status.parked.length }
+  } catch {
+    return { enabled: false, parked: 0 }
+  }
+}
+
 // Stable app slots backed by Codex + Cursor live catalogs. Authenticated by
 // global /api middleware; ?refresh=1 forces discovery.
 healthRouter.get('/models', async (req, res) => {
@@ -647,6 +663,9 @@ healthRouter.get('/models', async (req, res) => {
         // THIS surface (not /api/health) and falls back to the activity log without it.
         // False whenever jobs themselves are off or COS_MESSAGES_TRAIL=0.
         trail: durableJobs.enabled && messagesTrailEnabled(),
+        // 6.78.0 Messages steer: present only with COS_MESSAGES_STEER on and a Claude CLI that
+        // takes stream-json input (probed once). Absent, the app shows today's UI.
+        ...steerCapabilityField(durableJobs.enabled),
       },
       // 6.52.0: the session questions API and its client contract. A client polls
       // `GET /api/session-questions?client=glasses|phone` every `pollIntervalMs`; one
@@ -695,6 +714,12 @@ healthRouter.get('/models', async (req, res) => {
     },
   })
 })
+/** 6.78.0: `{ steer }` for /api/models `durableQueryJobs`, or nothing at all. */
+export function steerCapabilityField(jobsEnabled: boolean): { steer?: { protocolVersion: 1; providers: ['claude'] } } {
+  const steer = messagesSteerCapability({ jobsEnabled, cliSupported: claudeSteerSupportKnown() })
+  return steer ? { steer } : {}
+}
+
 // GET /api/cli-session — returns current CLI session ID for cross-device resume
 healthRouter.get('/cli-session', (req, res) => {
   const cosSessionId = req.query.sid as string | undefined

package/server/routes/maintenance.ts

@@ -17,6 +17,7 @@ import { getServerInstanceId } from '../lib/server-instance-id.js'
 import { getWhisperHealth } from '../lib/whisper-local.js'
 import { getActiveTranscriptionSessionCount, getTranscriptionSessionLiveness } from './transcribe-stream.js'
 import { getVideoUploadRegistry } from '../lib/video-upload-v2.js'
+import { bootResumeGate, isBootResumeKind, resumeRetriedItem, type ParkedBootResume } from '../lib/boot-resume.js'
 
 export const maintenanceRouter = Router()
 
@@ -69,6 +70,15 @@ function operationCredentials(req: Request): MaintenanceOperationCredentials {
   }
 }
 
+/** 6.78.0: boot-resumed work parked for crash-looping the server. Never throws. */
+function parkedSnapshot(): ParkedBootResume[] {
+  try {
+    return bootResumeGate().status().parked
+  } catch {
+    return []
+  }
+}
+
 function statusSnapshot(credentials: MaintenanceOperationCredentials = {}) {
   const jobs = getQueryJobRuntimeHealth()
   const activeTranscriptionSessions = getActiveTranscriptionSessionCount()
@@ -133,6 +143,9 @@ function statusSnapshot(credentials: MaintenanceOperationCredentials = {}) {
     // block a binary downgrade, where an old server could erase V2 evidence.
     safeToRestart: lifecycle.safeToRestart && !jobs.shuttingDown && !videoUploads.blocksRestart,
     whisper: getWhisperHealth(),
+    // 6.78.0, additive (contractVersion unchanged): work a boot no longer resumes because
+    // it crashed the server on RESTART_LIMIT boots in a row. Retry with the route below.
+    parked: parkedSnapshot(),
   }
 }
 
@@ -155,6 +168,27 @@ maintenanceRouter.get('/maintenance/status', (req, res) => {
   res.json(statusSnapshot(operationCredentials(req)))
 })
 
+// 6.78.0: the person's Retry of parked boot-resumed work (lib/boot-resume.ts). The API
+// token, like GET /maintenance/status, and not loopback-only, so the phone and the lens can
+// offer it; the /api mutation lease still refuses it during a drain. The count starts over;
+// a meeting finalization is resumed again now, and a query job (id = its clientJobId) runs
+// again when the app Retries it (a parked Ask is never resumable: it never started).
+maintenanceRouter.post('/maintenance/parked/:kind/:id/retry', (req, res) => {
+  const { kind, id } = req.params
+  if (!isBootResumeKind(kind)) {
+    res.status(400).json({ error: 'unknown_parked_kind', retryable: false })
+    return
+  }
+  const gate = bootResumeGate()
+  if (!gate.isParked(kind, id)) {
+    res.status(404).json({ error: 'not_parked', retryable: false })
+    return
+  }
+  const entry = gate.retry(kind, id)
+  const resumed = resumeRetriedItem(kind, id)
+  res.json({ retried: true, resumed, entry })
+})
+
 maintenanceRouter.post('/maintenance/drain', (req, res) => {
   if (!requireLoopback(req, res)) return
   try {