@gotcos/glasses-server 6.98.1 → 6.99.16

package/CHANGELOG.md

@@ -1,3 +1,230 @@
+## 6.99.16 - The COS thread: one size-capped conversation behind the COS chat's Ask, stored to recover and search (private)
+
+Merged in: claude/iphone-dictionary (94323de, from the COS Glasses QA session; its own full suite on 94323de: 13,041 passed, 0 failed).
+
+- Default-on for iPhone microphone recordings: iPhone recordings now transcribe live with the same Whisper as the glasses, so your dictionary shows while you record. Saved transcripts are unchanged (strict Parakeet, as for G2 saves). If live Whisper fails, the chunk errors as retryable `local_asr_unavailable`; it never falls back to Parakeet live. The capability keeps `asrModel: 'parakeet-ultra'` (glasses clients 677 and older check it before offering the iPhone mic) and adds `liveAsrModel: 'server-whisper'`.
+- iPhone saved transcripts can use the dictionary when Second opinion is on (`phoneHqPlan` in meeting-batch-transcribe.ts): Parakeet stays the strict primary and the dictionary-prompted Whisper Large-v3 fills in names it missed. Off stays off; Miles's Mac has it off, so this changes nothing there until he turns it on.
+
+2026-11-05. Private build for one Mac, on top of 6.99.15. Pairs with COS Control 0.5.374 (written against this contract), and works with any COS Control that pairs with 6.99.15. Nothing changes for the glasses app. Everything here exists only while Drop it is on.
+
+Miles, 11/05 22:55: "As long as we're storing so we can easily recover and search for them, I like this plan let's build and deploy."
+
+- **Why.** Every Ask from the COS chat started a brand-new session, and a fresh session already starts at about 100K tokens of context (CLAUDE.md, gotchas, memory, tool definitions): 101,720 and 103,116 on the first call, read from two session logs on 11/05. Continuing a session while its prompt cache is warm is cheaper than starting fresh; what makes a forever thread expensive is its size. So the chat keeps one thread and continues the same session until that session's context passes a cap (`COS_THREAD_CAP_TOKENS`, a whole number from 20,000 to 1,000,000, default 150,000: about 50K of conversation on top of the baseline). The next Ask then starts a fresh session carrying a short summary.
+- **Routes** (`server/routes/cos-thread.ts`, logic in `server/lib/cos-thread.ts`), under the token-auth `/api` mount, `Cache-Control: private, no-store`, and gated like the Drop it routes: while Drop it is off, every one answers 404 `drop_it_off` and no file is created.
+  - `GET /api/cos-thread`: `{ protocol: 1, capTokens, thread: { id, startedAt, lastAskAt, asks, segments, sessionId, provider, contextTokens }, next: { mode, sessionId, reason, digest } }`. `reason` is `continue` (the session is known and its context is at or under the cap), `empty` (no session yet), `size` (over the cap), `missing_session` (the conversation is gone, as after the midnight archive, or its log cannot be found) or `manual` (right after New thread). Only `continue` continues; every other reason is `fresh` with no sessionId and the summary.
+  - `POST /api/cos-thread/new {}`: closes the thread (a `rollover` row with reason `manual` and the summary it carries, then a `close` row) and starts a new one with no session. Its first Ask still carries the summary, so it knows the last thread and the day's drops.
+  - `POST /api/cos-thread/turn { clientId, sessionId, query, answer?, messageNo?, provider? }`: records one Ask, idempotent on clientId. The first one adopts its session; a different session than the thread's is a rollover (a `rollover` row with the reason GET would have given and the summary) onto a new segment of the same thread. Anything out of contract is 400 `invalid_turn` and writes nothing. Answers the GET shape.
+  - `GET /api/cos-thread/search?q&limit` (q 2 to 200 characters, limit 1 to 50, default 20): `{ hits: [{ threadId, sessionId, at, query, answerHead, messageNo }], scanned }`, newest first, case-insensitive over the question and the answer's head.
+  - `GET /api/cos-thread/threads?limit`: `{ threads: [{ id, startedAt, endedAt, asks, segments, title }] }`, newest first; the title is the first question, cut to 80 characters. A thread with no asks is listed only while it is the current one.
+  - `/api/health` and `/api/models`: `capabilities.dropIt.thread: { protocol: 1 }`, only while Drop it is on. Every other dropIt key is unchanged.
+- **The summary** is mechanical (no model call), at most 6,000 characters, headed "Earlier in this COS thread (a summary carried over; ask COS to search History or Messages for more):": the thread's last 8 asks, oldest first (question cut to 200 characters, the answer's head to 300, with the message number when known), then up to 12 drops created since the thread started or in the last 24 hours, whichever is earlier, with where each was filed. A turn recorded without its answer takes it from the live conversation when it is still there. Over 6,000 characters, the oldest drops go first, then the oldest asks.
+- **Context size** is read from the session's Claude Code log, `~/.claude/projects/<any project>/<id>.jsonl` (`COS_CLAUDE_PROJECTS_DIR` overrides it, `CLAUDE_CONFIG_DIR` is honored), found through the CLI session the bridge holds for the COS conversation, or the one recorded with the last turn after a restart. Only the last 512 KB is read; the last non-sidechain assistant message's `input_tokens + cache_creation_input_tokens + cache_read_input_tokens` is the context. A log with no readable usage continues with `contextTokens` null. Checked on this Mac against a 412 MB live log: 4 ms to find, tail read only. A provider with no Claude log (Codex, Cursor) reads as `missing_session`, so it starts fresh with the summary each time rather than growing without a cap.
+- **Stored to recover and search**: `DATA_DIR/cos-thread/ledger.jsonl`, append-only and fsync'd, keeps every row (`thread`, `turn`, `rollover`, `close`), and `state.json`, written atomically after each append, is a snapshot of the current thread. When the snapshot is missing, corrupt or behind the ledger, the state is rebuilt from the ledger by the same code that builds it live. A torn last row is skipped and never swallows the next. The last 5,000 asks stay in memory for search. Directory 0700, files 0600. Both the log read and the ledger append open with O_NOFOLLOW and O_NONBLOCK, so a symlink or a FIFO planted at either path can never be followed or stop the server.
+- **COS Control Web** (`panes/cos-chat.js`), only when `/api/health` advertises `dropIt.thread`: an Ask from the chat's own composer reads `GET /api/cos-thread` first. `continue` sends that sessionId. `fresh` sends none and carries the summary as the Ask's `reference`, the existing query-jobs field for quoted context, so the question in Messages is only what was typed. While an Ask in the thread is still answering, the next one continues its conversation. When an Ask finishes, the page posts its turn once, with the answer and message number. A Reply in the message reader keeps its own turn's conversation, as before. The header gets "New thread" beside "Mark all read", and one quiet line under the title: "Continues your COS thread · N asks", or after a rollover or New thread, "New thread. It carries a short summary of the last one." Without the capability the per-day conversation stays, unchanged.
+- `DropService.recentDrops(since, limit)` reads the drop store for the summary; it never touches Work.
+- **Fix: Ask on COS Control Web read as off while durable query jobs were on.** The page looked for the switch in `capabilities.durableQueryJobs` (where `/api/models` carries it) or at the top of the body, but `/api/health` carries it at `features.durableQueryJobs`, so the chat said "Ask needs the durable query jobs switch on your Mac." on Miles's Mac with jobs on. It now reads `features.durableQueryJobs` too. The web Ask still sends `source: 'web'`, so the server fills in the message era and number as before (a bare POST without it answers 409 `message_era_mismatch`, as it always has).
+- Tests: `server/lib/cos-thread.test.ts` (every reason, the cap edge: exactly the cap continues and one over is `size`, idempotent turns, rollover rows, the CLI session recorded across a restart, the summary's bounds and drop window, the ledger rebuild from a missing, corrupt or stale snapshot, a torn row, search, the threads list, validation, file modes), `server/routes/cos-thread.test.ts` (the shapes over HTTP, 400s, `drop_it_off` with no file created, 503 when the store cannot open, the health capability on and off), `server/web-control/cos-thread-web.test.ts` (continue sends the sessionId, fresh sends none and carries the summary, the turn is posted once, a second Ask while one runs, New thread posts `/new`, the old rule without the capability, and Ask on for a health body shaped like the live one), and a `recentDrops` case in `drop-service.test.ts`. Mutation-checked: the cap comparison, the idempotency check, the rollover on a different session, the `drop_it_off` gate, the capability only while on, the web continue, the once-only turn post, and the `features.durableQueryJobs` read.
+- Default-on changes: none for anyone with Drop it off (the default). With Drop it on, the COS chat on the web continues one thread instead of one conversation per day, and `/api/health` gains `dropIt.thread`.
+
+## 6.99.15 - Messages cleanup on COS Control Web; the pinned COS line never says its title twice (private)
+
+2026-11-05. Private build for one Mac, on top of 6.99.14. Pairs with COS Control 0.5.374 (the same Messages cleanup on the Mac), and works with any COS Control that pairs with 6.99.14.
+
+Miles, 11/05 21:15, with a screenshot of Messages: "clean up the UI/UX on this, make sure it's clean on the browser and the desktop version".
+
+- The pinned COS row's line (`/api/inbox/summary` `lastLine`, `pinLine` in `server/lib/drop-service.ts`): a follow-up's line already names its card, so "Sprocket Rocket AI Unified Nav Approved (G2). 2 follow-ups from Sprocket Rocket AI Unified Nav Approved (G2)." now reads "2 follow-ups from Sprocket Rocket AI Unified Nav Approved (G2).". A title the line does not name still leads it, with one period. Both COS Control and the web show this line.
+- COS Control Web, Messages (`panes/messages.js`, `control.css`): each row leads with the ask, one line cut by width (was 57 characters), with its time beside it; the answer's two-line preview under it; one quiet line of facts (`#442`, Routine or Task, the model by name, attachments with their icon and "1 image"). No per-row glyph, no "ROUTINE and TASK" legend, no visible "Message view" label. The header says "30 messages, newest first". Previews put a space between progress sentences that ran together ("now.Reading").
+- COS Control Web, the COS chat (`panes/cos-chat.js`): a P2 follow-up that carries its own Dismiss no longer gets a second one. The pinned row's time is in the body font.
+- Tests: `drop-service.test.ts` covers `pinLine` (mutation-checked: always prefixing the title fails it); `cos-chat-p2.test.ts` counts one Dismiss on a follow-up that carries one, and one on a question that does not (mutation-checked).
+
+## 6.99.14 - The live meeting view on COS Control Web stops jumping, and gets the recording bar and Add file (private)
+
+2026-11-05. Private build for one Mac, on top of 6.99.13. Web only: no server route, no store and no glasses change. Pairs with any COS Control that pairs with 6.99.13.
+
+Miles, 11/05: "It currently keeps CLS jumping when the new transcription lines come in. We also don't have the ability to add rich text [files] or see the voice histogram coming in." The target is the Mac's live recording bar.
+
+- **New lines no longer move the page.** The cause: the live transcript was part of the page's own scroll, so following the newest line meant scrolling the whole page on every update. The title, the status, the Stop button and, on a phone, the Ask panel moved with each line. Measured in headless Chromium on 150 real-sized chunks with 20 lines appended one per poll: the page moved 1,279 px at 390 px wide and 1,002 px at 1280 px wide. Now the transcript scrolls inside its own box, as Control's does: following keeps the box on its newest line and the page moves 0 px at both widths. Reading higher up, a new line lands below you and nothing moves (0 px); turns above you that the speaker pass rewrites longer are held by the pane's own anchor, on every browser (iOS Safari has no scroll anchoring; the box sets `overflow-anchor: none` so Chrome's never corrects twice). A scroll write happens only when a turn above you changed height, so a fling on the iPhone is never stopped. Jump to live floats over the box's bottom edge, so showing it moves nothing.
+  - The layout-shift API reported 0 for this before and after: a scroll is not a layout shift, which is why the jump never showed up as CLS. (The 0.0007 it reports at 1280 px on load, before and after, is the app rail, not this pane.) The numbers above are page movement in CSS pixels, the user's unit.
+  - The header is the same height whatever it says (the status and duration lines stay one line), and everything that changes height while it records sits under the transcript, never above it. Before, the Files row landing with the Ask history pushed the transcript down 52 px; now 0 px.
+- **The recording bar, from the Mac's.** Under the transcript, one 50 px row: the red dot, the elapsed time on its own one-second clock (m:ss, then h:mm:ss; the row is not rebuilt each second), the level strip, Add file and Stop and save. Under 560 px of bar Add file is the paperclip alone; under 340 px the still glyph takes the strip's place. Copy transcript and Copy full context stay under it.
+  - The strip is Control's glasses level strip (`LiveChunkLevelStripView`): one bar per chunk from the live read's `levels`, the two numbers per chunk the quiet gate has kept on the active-session record since 6.87.0 (RMS on a dBFS scale, and Silero speech seconds). Newest at the right, a dot where a chunk held under 0.5 speech seconds (or level 0.27 and under without them), the oldest clipped and faded at the left. It trails the room by a chunk and says so to VoiceOver. Reduce Motion: one still bar for the newest chunk. It comes from the poll the page already makes every 1.5 s (`GET /api/meetings/live-chunks`), so nothing new is read and no route was added. A Mac recording's 10-a-second audiogram lives only in COS Control on that Mac; the web shows the same per-chunk strip for every recording.
+  - Stop and save is the glasses stop of 6.99.x, moved into the bar, and still asks first: "Stop and save this glasses meeting?" and nothing is sent until you confirm. A Mac recording says "Stop on your Mac" and an iPhone one "Stop on iPhone"; neither can be stopped from the web.
+- **Add file, paste and drop while it records.** The same upload as the Ask composer (photos resized to a 1024 px JPEG to `POST /api/media`, other files raw to `POST /api/media/file`), then `POST /api/meeting-ask/files/media`, the route the phone uses, so Meeting Ask reads the file and Copy full context carries it. Photos are read for their text on the Mac, as the phone's are. Up to 10 at a time; video is refused with what to attach instead. A paste or drop that holds a file is always taken as the file: if the browser will not hand the file over, the page says "This browser did not hand over the file. Use Add file to choose it." and never lets its name or path land as text in the Ask box. A file drag outlines the transcript column and moves nothing. Refusals say what happened and what to do (a full meeting, an update in progress, an expired upload, a restarted server, which is read again once); Retry adds the kept upload without sending the bytes again. Files are removed in COS Control on the Mac, as before.
+  - The Files row is drawn from the start while it records ("No files yet. Add file, paste or drop one here."), one line tall whatever it says, so files arriving with the Ask history, an upload starting and one finishing never move what is under it. Open, an upload is a row of the same height as a file and becomes its file in place.
+- Tests: `server/web-control/live-meeting-view.test.ts` runs the real `meetings.js` and `cos-chat.js` against a fake DOM that lays the transcript out (follow, reading, rewrite above the reader, the bar, the clock, the strip, Stop and save, Add file, paste, drop, refusals). `server/lib/web-live-files-canary.test.ts` runs Add file end to end through the real `/api` gate with the web session cookie, the real media routes and the real Meeting Ask routes, and checks that a write without `X-COS-Web`, from another origin or without the cookie is refused (401) and changes nothing. The page's requests are read out of the page's own source. The page-movement numbers come from `server/scripts/web-live-cls/` (a mock server, a CDP driver and the measurement).
+- Default-on changes, for every COS Control Web user (no server behavior changes):
+  - The live meeting view puts the transcript in its own scrolling box with the recording bar under it; Stop and save moves from the header into the bar.
+  - Add file, paste and drag-drop add files to a live meeting from the web (before: "Add or remove them in COS Control on your Mac").
+  - A meeting file that came from the media store is labelled "Added from a phone or browser" (was "Added from the phone").
+  - The Ask composer's upload code is shared with the live view (`W.cosChat.uploadMedia`); its requests are unchanged byte for byte.
+
+## 6.99.13 - The Mac asks first; Drop takes files on COS Control Web (private)
+
+2026-11-05. Private build for one Mac, on top of 6.99.12. Pairs with COS Control 0.5.371 or 0.5.372. Nothing changes for the glasses app.
+
+- **An open web tab never holds a session question from the Mac (option B).** Miles chose B on 11/05: the Mac shows its own dialog at once. A COS Control Web poll (`GET /api/session-questions?client=web`, browser session) no longer counts as a live answering client, so a tab left open on another computer never delays the Mac's pop-up. The web still lists and answers what the glasses or phone are holding, with the same cards and actions as 6.99.12. Token polls from the glasses and phone are unchanged.
+- **Drop takes files (COS Control Web).** Miles, 11/05: "I don't see the file attachment in drop. Can we ensure that functionality is there." The clip, paste and drag-drop already added files to the composer; now Drop sends them with the words, as Ask does.
+  - `POST /api/drops` takes `attachmentIds`: up to 5 fresh uploads from `POST /api/media` or `/api/media/file`, held to the Ask's own rules (media ids, deduplicated, 5 at most). Refusals are plain and save nothing: a sixth file (400 `too_many_attachments`), an id this Mac never gave out (400 `invalid_attachment`, 404 `attachment_not_found`), an upload past its 4 hour wait (410 `attachment_expired`), a file already queued with an Ask or held by another drop (409 `attachment_in_use`). Each says what to do ("Add it again, then Drop").
+  - Words are still required: a drop is filed by its words, so files alone are refused with "Add a few words with the files so COS knows where they go." (400 `words_needed`). The password and key check on the words runs exactly as before.
+  - Where the files live: in the media store, the same place an Ask's files live (`data/media/assets/<id>/`). The drop pins them (`MediaStore.pinForDrop`): the upload becomes `associated` with the drop's id, which no upload TTL and no GC pass touches, so the files stay as long as the drop holds them, across restarts. Nothing is copied, nothing leaves the data dir, and the index is written atomically as always.
+  - The drop record keeps each file's id, name, type and size (`attachments`). Your words in the chat show what you sent, and every receipt lists each file with Open (`GET /api/media/:id/content`). A card, a thread note and a memory take words only, so the receipt says where the files are: "The 2 files stay here in the COS chat with your words." History finds a drop by a file's name. Move keeps the files.
+  - A drop read as a question sends its files with the Ask (`next.attachmentIds`), so "what is on this shelf?" with a photo asks about the photo.
+  - Undo removes the files with the drop: the bytes are deleted, the drop forgets them, and no chat line offers them any more. Undo removes only what that drop pinned; a file an Ask has since sent with a message stays. A refused Undo (the card was edited) keeps them.
+  - `capabilities.dropIt.attachments: 5` on `/api/health` and `/api/drops/settings`. The web sends files only to a server that says so; against an older server Drop keeps the words-only note and sends nothing.
+  - On the web: Option-Return is still Drop and Return is still Ask. With files attached, Drop waits for the uploads (as Ask does), says so when a file failed, and keeps the words and files in the box when the Mac refuses one.
+- Default-on changes, for every user:
+  - The Mac's own session question dialog shows at once even while a COS Control Web tab is open (before, a visible tab could hold it up to the broker's deadline).
+  - `capabilities.dropIt.attachments` on `/api/health` and `/api/drops/settings` for every install (additive). Drop it itself stays off by default; files on a drop exist only where Drop it is on.
+
+## 6.99.12 - COS Control Web catches up with the Even app: Ask with files, Reply, session questions, wide Usage (private)
+
+2026-11-05. Private build for one Mac, on top of 6.99.11 (Drop it P2), which carries 6.99.10 (Drop it P1 and the web Ask sheet fix). Pairs with COS Control 0.5.371 or 0.5.372. Nothing changes for the glasses app.
+
+Miles, 11/04 23:38: "On click it shows that it sent but it never shows up in messages. Also there isn't the ability to send a message from the web view." The four gaps the parity audit put first (`PARITY_even_app_vs_control_web_2026-11-04.md`), closed:
+
+- **Ask COS in Messages, with or without Drop it.** Wherever durable query jobs are on (the default), Messages pins an Ask COS row first in Recent and opens a chat with a composer (`#/messages/cos`; beside the list from 860 px). Answers stream with their message number and land in Recent as numbered turns, here, on the Mac and on the lens. With Drop it on, the chat is the pinned COS chat of 6.99.10 with its Drop button; with it off, there is one Ask button and no inbox read. Return asks; Option-Return drops only where Drop shows; the buttons need no key on the phone. The Model menu now comes from `/api/models` (Claude Opus, Fable and Sonnet, Codex from the Mac's catalog, Cursor and Ollama when the Mac says they are ready), with an Effort menu (High, Extra high, Max, Ultracode) sent as `effort`.
+- **The Ask sheet's Ask COS now shows its answer.** It hands the words to the same composer path and opens the chat, so the answer streams on screen instead of a status line that vanished.
+- **Attachments on Ask, as in the Even app.** The clip opens Camera, Photo Library or Files on iOS (`<input type=file multiple>` for photos, PDF, TXT, MD, CSV, JSON, XLSX, MP4 and MOV); paste and drag-drop work too. Photos are drawn into a canvas at most 1024 px on the longest edge, JPEG quality 0.85, and posted to `POST /api/media` (`kind: user_photo`); documents and video go raw to `POST /api/media/file` with `X-COS-Filename`, `X-COS-Captured-At` and `X-COS-Web: 1`. The Ask sends up to five `attachmentIds`. Chips show a thumbnail, the name, the size, upload progress and Remove. The server caps are said plainly before anything uploads (5 per message, 2 MB per photo after resizing, 64 MB per document, 100 MB per video). HEIC is refused outside Safari with a line saying why. A 401 during an upload never opens the sign-in screen: the words and files stay, the chip says signed out, and Sign in again then Retry sends them. Drop takes words only; trying to drop with files attached says so. Uploads use XMLHttpRequest for progress (fetch has none); same origin, same cookie, same headers.
+- **Reply from the message reader.** The reader ends with the same composer, sending that turn's `sessionId`, so the answer continues that conversation while it is live (else the server starts a new one, as before). The reader is not rebuilt under a half-written reply when Recent refreshes.
+- **Session questions on the web.** `GET /api/session-questions` takes the COS Control Web session as well as `X-Cos-Token`, through the same cookie check the `/api` gate runs; the hook token still opens nothing. A browser poll counts as a live answering client only with `?client=web` (the page sends it only while a visible, signed-in tab shows the cards), in the phone's 30 s window, and never reports presence, so it never enables the away hold. A cookie poll naming `glasses` or `phone`, or no client, never counts; a token poll naming `web` never counts. `/api/models` `capabilities.sessionQuestions` gains `webClient: true`; the page never calls the route without it. Question and approval cards show over every pane, with the Even app's actions: pick (or Other), Send, Allow once, Deny (each tap then confirm), and Leave for the Mac, through the existing `POST .../answer`. A 401 on the poll stops it quietly. Plan approvals never reach the broker (ExitPlanMode is unbrokered), so there is no plan card.
+- **Usage on the web uses the Mac's layout from 860 px wide, and custom date ranges** (merged from `claude/web-usage-wide` 5dfebf0). Below 860 px it is byte for byte the 6.99.10 page.
+- Canary 12: with a message era active, a web Ask with a photo and a PDF through the real `/api/media`, `/api/media/file` and `/api/query-jobs` is admitted, the model receives both, the answer turn carries both refs, the counter moves by exactly one, and a Reply continues the same session.
+- Default-on changes, for every web user:
+  - Messages shows the pinned Ask COS row and the two-column layout from 860 px wherever durable query jobs are on (the default); before, only with Drop it on.
+  - The message reader shows Reply.
+  - The Ask sheet's Ask COS opens the chat and streams the answer.
+  - Session question and approval cards show on the web wherever the permission broker is on (the default), and a visible Control Web tab now counts as a client that can answer, so the Mac holds a question for it (up to the broker's deadline) instead of showing its own dialog at once.
+  - Usage uses the Mac's layout from 860 px wide.
+  - `capabilities.sessionQuestions.webClient` on `/api/models` for every install (additive).
+
+## 6.99.11 - Drop it P2: pings, follow-ups, reminders and History search (private)
+
+2026-11-04. Private build for one Mac, on top of 6.99.10 (Drop it P1, with the web Ask sheet fix), which carries 6.99.9, 6.99.8 (resumable meeting consolidation) and the 6.99.7 dictation hotfix. Pairs with COS Control 0.5.371 now; COS Control 0.5.372 adds the Mac banners and the local reminder backup. Nothing changes for the glasses app yet.
+
+Phase 2 of Drop it, the part that reaches out. Everything here runs only while Drop it is on (off for every user; on where `COS_DROP_IT=1` is set or Control turns it on), checked at boot and each minute. While off, nothing new opens and nothing is written.
+
+- **Reminders.** "remind me Thursday to send Gina the JCK numbers" now reads its time: today, tonight, tomorrow, weekdays, next week, "at 3", "3:30 p.m.", "15:00", noon, morning, afternoon, evening, "in 20 minutes", "in 2 weeks", "Nov 12" and ISO dates. A day alone means 9:00, today's weekday means next week, and a bare hour means the next one. A time already past is refused, never moved. The receipt says "Reminder set: tomorrow 9:00 AM". With no time it asks once (Tomorrow 9:00, Monday 9:00) and waits on you until you pick (`when:` on `POST /api/inbox/action`).
+- **Reminders fire.** A 30-second tick. After sleep the first tick fires what is overdue, once, and says how late past 10 minutes. `firedAt` is written before the notification, so nothing fires twice. Done, Snooze 1 hour and Tomorrow 9 on the ping. A reminder he set fires at any hour. `GET /api/drops/reminders` lists the pending ones for COS Control's local backup, which uses the same notification id (`reminder-<id>`), so the two never double.
+- **Pings.** COS posts to the pinned chat, reading signals that already exist: your next meeting 15 minutes before it starts, follow-ups ready from a meeting, a thread gone quiet (at most once a week each), a red signal, an agent finishing work you sent it, and a Monday 9:00 check-in. Fixed wording over each source's own titles; no model is called, and a test fails if the ping code can reach any AI, mail, Slack or Telegram module. Work pings that arrive after 6 PM, before 6 AM or on a weekend wait and post as one "While you were off" item at 8:00, minus anything that moved on.
+- **Follow-ups.** One line under the drop when what it became resolves: a card reaching QA or Complete, or archived; a handoff completed (with its report), failed or refused; a session you sent it to replied or stopped; a thread resolved. Exactly once per change, across restarts and a QA, Draft, QA bounce. Found by a 2-minute poll, sooner after a card write through this server, and at once when a session's turn ends.
+- **Banners.** At most 6 a weekday, 2 per source, 45 minutes apart, none in quiet hours or before 8:00. Reminders are exempt. On by default only for reminders and follow-ups to your own drops; the rest land silently in the chat. `GET /api/inbox/banners` is the outbox COS Control reads. A reminder also goes to the lens as display event `cos_ping` (withheld from any stream without a ticket; shipped glasses builds ignore it).
+- **Waiting on you.** Pings and follow-ups that need an answer (a card at QA, a failed or refused handoff, follow-ups ready, the check-in, a session that stopped, a reminder with no time) count toward `waiting` until answered, done or dismissed.
+- **History search by meaning.** `POST /api/drops/search`: one Jev Choice over your drops' words and where they went, charged to the drop budget (`COS_DROP_DAILY_TOKENS`) and off with `COS_DROP_ROUTER=0`. A drop that looks like it holds a password or key is never offered. Over 254 drops it searches the newest 254 and says so; word search still covers everything. Read-only, so it is not held during an update drain.
+- **COS Control Web.** The pinned chat's new buttons work: Done, Snooze, Tomorrow 9, the reminder time picks, Open result, Open, Review, Prep me, and Reply on the check-in.
+- **Settings: tune and steer it.** `GET`/`PUT /api/drops/settings/p2` (its own file, `data/drop-p2-settings.json`; the P1 switch and its route are unchanged), and a COS reaching out section in COS Control Web Settings. Every value is honored by the code that does the thing:
+  - Pings: on or off; interruptions a day (6), from one kind a day (2), minutes between (45); quiet from and until (6 PM to 6 AM) and weekends; the first interruption (8:00); a switch for meeting prep, agents finishing, follow-ups ready, threads gone quiet and red signals.
+  - Follow-ups on your drops: on or off, and Work cards, handoffs, sessions and threads one by one.
+  - Weekly check-in: on or off, its day and time (Monday 9:00).
+  - Reminders: the default time (what a day alone means, and Tomorrow and Monday), the snooze length (the button says it), notifications, and the glasses push.
+  - Which kinds may interrupt; the rest land in the chat without a notification.
+  - Steer: Ping me about (a ping that mentions one of these words may interrupt, even when its kind stays in the chat; the limits still hold) and Leave alone (a ping that mentions one is not posted; reminders and follow-ups always are). Whole words, 300 characters each, no model.
+  - Numbers are clamped and a save changes only what it names. Readable and writable while Drop it is off. `capabilities.dropIt.p2Settings` lets older clients hide the controls.
+- **Quiet during updates.** Every P2 loop skips its turn while the server drains; a reminder then fires on the next tick, marked late.
+- **State.** `data/pings/state.json` (the banner ledger, held items, consumed keys): one writer, a 0700 folder and a 0600 file. Logs carry counts only, never words.
+- Default-on changes: none for anyone with Drop it off, which is every install by default. With Drop it on: reminder times, reminder and follow-up banners, the Monday check-in, and silent pings in the chat, all adjustable in Settings. `capabilities.dropIt` gains `p2Settings: 1` for every install (additive).
+
+## 6.99.10 - Drop it P1, with Ask and Drop on the web (private)
+
+2026-11-04. Private build for one Mac, on top of 6.99.9 (web phone link and provider logos), which carries 6.99.8 (resumable meeting consolidation) and the 6.99.7 dictation hotfix. Pairs with COS Control 0.5.371. Nothing changes for the glasses app.
+
+Server half of Drop it phase 1: a pinned COS chat that takes a drop (a thought, a task, a reminder, a question), files it, and answers with a receipt. Off for every user; on only where `COS_DROP_IT=1` is set or Control writes `PUT /api/drops/settings {"enabled":true}`. While off, every new route except the settings pair answers 404 `drop_it_off` and no drop or chat file is created. Messages, the lens message counter, `all-messages` and `live-chats` are unchanged either way.
+
+- **Drops and the chat.** Two new stores beside the Messages store, never inside it: `data/drops/drops.json` (each drop, where it went, a status timeline) and `data/inbox/feed.json` (the chat: drop, receipt, question, answer, follow-up). One writer lock each, a 0700 folder and 0600 files, atomic writes, and a bad row set aside on its own. A drop is saved before it is filed, so a restart mid-filing keeps it as a note.
+- **Where a drop goes.** "remind me" is a reminder, "remember" a memory, and a question goes to the existing Ask job, all by rule with no Jev call. Anything else is one Jev request: it files on its own at 0.80 with a 0.25 lead (a memory needs 0.90), otherwise it asks one question with the top two readings and Just a note. When Jev cannot run, the drop is kept as a plain note and the receipt says why.
+- **Its own budget, Jev only.** Cap `COS_DROP_DAILY_TOKENS` (300,000 a day), its own ledger (`jev-drop-usage.json`) and breaker, and `COS_DROP_ROUTER=0` turns Jev routing off. Token audit caller `drop`, sizes only. Pinned to Jev for P1: the decision provider setting (SubQ) does not apply, and there is no `drop` decision use case, so the settings file stays readable by 6.99.4 and earlier. No claude -p and no new model caller.
+- **Privacy.** A drop that looks like it holds a password or key is checked before any rule and kept as a plain note: it never reaches memory, the Ask job or Jev, and Move to a memory is refused. Jev reads cleaned words only. Where words do leave the Mac: Jev (api.typesafe.ai) for routing, the existing Ask job for a question, and, for a memory, the COS bridge embeds the words through the embedding provider it uses for every memory (OpenAI today). Logs carry ids, codes and lengths, never words.
+- **Filing writes.** New card through the bridge verb `task-capture-drop` (answers the card id; an open card with the same words is linked, never copied), memory through `memory-capture` into To review (a new capture key per filing), thread notes through `thread-source`/`thread-unsource` by id. A bridge without a verb keeps a plain note and says so; a memory too short for the memory contract is kept as a note and says that. Existing card, session follow-up (held until Send), note and reminder live in the drop store only. Reminder times and firing come in P2.
+- **Undo and Move.** 24 hours, refused with a reason when the card or thread note was edited, or the memory reviewed, since (`memory-uncapture`). Undo never archives or removes something the drop did not create. Move is Undo, then filing where you picked, with no Jev call, and a target is checked before anything is undone. Nothing is deleted.
+- **Retention.** Drops a year; an undone drop 30 days; a drop's chat lines go when the drop goes. Neither store ever writes a file larger than it will read back (32 MB).
+- **Routes.** `POST/GET /api/drops`, `GET /api/drops/:id`, `POST /api/drops/:id/{undo,move,ask,sent}`, `GET /api/inbox/summary`, `GET /api/inbox/feed`, `POST /api/inbox/{read,action}`, `GET/PUT /api/drops/settings`. History is word search with kind and status filters.
+- **Capability.** `capabilities.dropIt` `{ protocol: 1, enabled, source }` on `/api/health` and `/api/models`. Additive.
+- **Waiting on you.** `GET /api/inbox/summary` adds `waiting`, a whole number: questions COS asked that you have not answered, chat items marked `needsReply` (a follow-up or ping that needs a decision), and the Work items in Your move that want an answer or a look (needs input, attention, done; a run still going does not count). Unread clears when the chat is opened; waiting clears only when the item is answered, done or dismissed (`POST /api/inbox/action {action: "dismiss"}`, for a `needsReply` item). `POST /api/inbox/read` answers `waiting` too. The Your move count shares Work's own board read and is kept 30 seconds, and the summary waits at most 1.5 seconds for it. COS Control 0.5.371's Messages badge reads this field.
+- **Ask from COS Control Web.** `POST /api/query-jobs` with `source: "web"` (the glasses' own route, behind the web sign-in and its write check): the server picks the conversation (the one the web is in today, or a new one) and gives the turn the next message number, from the same count `/api/message-counter` serves. The answer is a normal Messages turn: it shows in Recent on the Mac and the web, and in the glasses' Messages list. A retry of the same request reuses its number. Any other caller is unchanged.
+- **COS Control Web, while Drop it is on.** Messages pins a COS row first in Recent (`#/messages/cos` opens the chat), and from 860 px the list and the chat sit side by side. The chat's composer has two visible buttons, Ask (filled) and Drop (outlined), so a phone with no keyboard needs no key combination or long press; with a keyboard, Return asks and Option-Return drops. Ask streams its answer with its message number, with Steer (where the Mac allows it) and Cancel; the Model menu lists what meeting Ask offers. Drop shows the receipt with Undo and Move. The rail and the section menu show a number on Messages for what waits on you, and a dot when there is only something unread; both are read with the page's existing status check, with no new timer, and never redraw the pane. With Drop it off the web looks exactly as in 6.99.9.
+- **Fix: Ask COS in the web's Ask sheet did nothing.** Tapping it sent an older request (a non-standard id, no message era), so a Mac with a message era refused every one and only a small status line said so. It now sends the same request as the COS chat's Ask, and a refusal also shows a toast.
+- Default-on changes: none. Drop it stays off until it is turned on. The `waiting` field and the web Ask route change nothing until a client uses them.
+
+## 6.99.9 - Open COS on the web from the glasses app, and real provider logos (private)
+
+2026-11-04. Private build for one Mac, on top of 6.99.8 (meeting consolidation, with the 6.99.7 dictation hotfix). Pairs with COS Glasses 6.11.672. Nothing changes for the COS Control Mac app.
+
+- **A sign-in link for your phone's browser.** COS Glasses 6.11.672 adds Open COS on the web in Settings. It asks the Mac for a link, copies it, and you paste it into Safari or any browser to land on COS Activity already signed in, over Tailscale. The link works once and lasts 2 minutes; a short sign-in code is shown with it as a fallback. Links from the Even app open inside Even's own browser, never Safari, so copying is the way out (tested on an iPhone).
+- New route `POST /api/web-session/phone-link`, for the paired glasses app only (its token; a signed-in browser cookie is refused). Callers must be on this Mac, Tailscale or the home network. At most 5 links a minute. The link and the code are never written to the log. `/api/health` advertises `capabilities.webPhoneLink`, so older glasses builds and older servers simply do not show the row.
+- An expired link now says to get a new one from COS Control or the COS Glasses app.
+- **Sessions on the web show the real Claude, OpenAI and Cursor logos**, the same marks COS Control draws, instead of plain shapes.
+- Default-on changes: the web Sessions logos. The route answers only the paired glasses app.
+
+## 6.99.8 - Resumable meeting consolidation (private)
+
+- Explicit meeting cleanup jobs continue across bounded 15-minute provider passes under one durable job, model selection and cancellation control. Ordinary chats retain their current limits.
+- Each pass closes its provider process tree before continuation. Partial output at the pass limit is progress, never a completed cleanup.
+- A saved inventory, verified evidence hashes and final audit report gate completion. Provider failures, cancellation, three unchanged checkpoints or the 12-hour/48-pass safeguard stop honestly with saved work intact.
+- Exposes the maintenance workflow capability for compatible COS Control clients. Interrupted server boots retain the existing interruption/orphan recovery policy; this does not silently restart writes after a server crash.
+
+## 6.99.7 - Dictation no longer fails while meetings record (private hotfix)
+
+2026-11-04. Private hotfix for one Mac, on top of 6.99.5. 6.99.6 is a separate meeting consolidation build, not yet installed; it needs this fix merged before it ships. Nothing changes for the glasses, the phone companion or the COS Control Mac app.
+
+- **Fix: Mac dictation said "Server stopped" while a meeting was recording.** Asking whether a meeting was saved read and parsed every saved meeting's chunk file (813 files, 1.8 GB on the test Mac) whenever the meeting was not saved yet, which is every live recording. COS Control asks that of each live recording every few seconds, so two recordings kept the server busy for 4 to 17 seconds at a time. Dictation's 5 second check timed out, and live chunks took up to 26 seconds. Now each saved file's session is remembered until the file changes, and its first 4 KB is enough for most files. On the test Mac one lookup went from about 4.7 seconds to 5 ms (575 ms the first time after a start). Results were identical for 37 saved meetings, 6 of them Mac recordings.
+- Default-on changes: none. The lookup gives the same answers, only faster.
+
+## 6.99.5 - Control Web: questions asked on the Mac show on the phone (private)
+
+2026-11-04. Private build for one Mac, on top of 6.99.4. Fixes from the web and Mac meeting comparison. Nothing changes for the glasses, the phone companion or the COS Control Mac app.
+
+- **Meeting Ask stays in step.** A question asked on the Mac now appears on the phone while the live meeting is open. The page re-reads the Ask history every 12 seconds, and at once when you come back to the page. The panel redraws only when something changed.
+- **Files.** A meeting with files shows the Mac's "Files · N" row, in the live view and on the saved meeting. Open it for the names and any that could not be read. Files are still added and removed in COS Control on your Mac.
+- **The meeting's name.** A name typed in COS Control while recording now shows on the web. Without one, the web uses the calendar event that started within 20 minutes of the recording, as the Mac does.
+- **Opening a page right after signing in is fast again.** The side rail's story lines load two at a time instead of all at once, so the page you open is never stuck behind them. A meeting opened 4 seconds after sign-in waited 10 to 14 seconds for its first read; it now takes under 2.
+- Default-on changes: the web's background Ask history read (one GET every 12 seconds while a live meeting's panel is open). No change to the Mac app or the glasses.
+
+## 6.99.4 - Control Web matches the Mac (private)
+
+2026-11-04. Private build for one Mac, on top of 6.99.3. COS Control Web, the page at `/control`, now looks and behaves like the Mac app's panes. Nothing changes for the glasses, the phone companion or the COS Control Mac app.
+
+- **Work.** Sort leads with today's meetings. A `#/work/sort` link opens Sort directly. The board holds still while you read: background loads no longer repaint under your finger.
+- **Meetings.** Two columns from 860 px wide, so an unfolded phone reads like the Mac. The live transcript no longer jumps when new lines arrive. A Model menu picks the model for meeting Ask, and a refused change says why in words. When a sign-in lapses, every Meetings call stops and the reason stays on screen. Months that hit the list cap say N of M.
+- **Sessions and Speakers hold still and say when offline.** Nothing above the turns moves while you read, Speakers never rebuilds the whole pane under your finger, and a read that times out offers Retry.
+- **The sign-in screen keeps its message.** A later sign-out never blanks the words that say why you were signed out.
+- Default-on changes: none beyond the web page itself; the Model menu changes the one meeting-assistance model the Mac also uses.
+
+## 6.99.3 - Signing in on the phone says what went wrong (private)
+
+2026-11-04. Private build for one Mac, on top of 6.99.2. Pairs with COS Control 0.5.367, which adds Open COS on your phone. Nothing changes for the glasses or the phone companion.
+
+- **Fix: the sign-in page had no way in for a first phone.** A code only came from a browser that was already signed in, and the only code the Mac showed was the glasses pairing code, which the page refused. COS Control 0.5.367 adds Open COS on your phone: scan its QR with the phone camera and Safari opens signed in, or tap Show a sign-in code and type it. The server now gives Control that phone link: the handoff answer adds `phoneUrl` (this Mac's tailnet name, or its tailnet address when the name is not known yet) and `tailnet.ipUrl` / `tailnet.nameUrl`. The link works once and lasts 2 minutes.
+- **The page names what failed.** A wrong token, a wrong or expired code, an expired sign-in link, and the glasses pairing code each get their own message. Typing the glasses code says it only pairs the COS Glasses app, and the code is left untouched for the glasses. That answer is given at most 20 times per glasses code across every device, the same cap the glasses app has, so the page cannot be used to hunt for the code. After 8 failures in 10 minutes the lockout message says what the last try was. Every failure still counts toward that limit. If the phone cannot reach the Mac at all, the page now says so instead of showing the browser's "Load failed".
+- **A pasted token survives the paste.** The token is checked as typed, then again with spaces, line breaks, zero-width characters and wrapping quotes removed. The page has a Show token button and says the copy clears after 60 seconds.
+- **The server log says why a sign-in failed** (`[web-login] fail kind=wrong_code len=8 ip=...`): the kind, the length and the device address, never what was typed.
+
+## 6.99.2 - The phone address by name works (private)
+
+2026-11-04. Private build for one Mac, on top of 6.99.1. Nothing changes for the glasses, the phone companion or COS Control.
+
+- **Fix: signing in at `http://<your-mac>.<your-tailnet>.ts.net:3141/control` was refused.** The server learned this Mac's Tailscale name from the Tailscale command line, which does not answer when the server runs in the background, so every sign-in from the name address was turned away. It now asks Tailscale's own DNS for the name of this Mac's Tailscale address, which answers in milliseconds. Only this Mac's exact name is accepted. The address by number (`http://100.x.y.z:3141/control`) always worked.
+
+## 6.99.1 - COS Control in a browser on your phone, over Tailscale (private)
+
+2026-11-04. Private build for one Mac, on top of 6.99.0. Nothing changes for the glasses, the phone companion or COS Control.
+
+- **COS Control Web.** Open `http://<your-mac>.<your-tailnet>.ts.net:3141/control` on a phone or another computer on your tailnet: Today, Sessions, Meetings, Work, Messages, Memories, Speakers, Usage and Settings, against the same routes the Mac app uses. Built phone first for the iPhone Duo: on the closed screen one top bar that slides away while you scroll; on the open screen a labelled left rail and two columns. No bottom bar, because Safari owns that edge.
+- **Talk to your sessions from the phone.** Open a Claude Code, Codex or Cursor session and send it a message, the way the glasses' Continue does. If the Mac is busy with it, the message waits in that session's line and goes when it is free; if COS is still answering, it goes right after. Stop a running reply, or Fork to send your message to a copy. The reply streams in as it is written.
+- **Sign in once per browser.** On a signed-in browser choose Settings, Sign in another device, then type the 8-character code on the phone (single use, five minutes). The pairing token still works. The session is an HttpOnly cookie for 7 days; the page never holds the token. Settings, Sign out every browser ends every browser session at once; the glasses and the phone app stay paired.
+- **This Mac and your tailnet only.** The page and its sign-in answer loopback and Tailscale addresses. Home Wi-Fi is off unless `COS_WEB_CONTROL_LAN=1`. `COS_WEB_CONTROL_ENABLED=0` turns the whole thing off.
+- **Guards.** Changes from a browser need the page's own origin, matching the address it reached, plus an extra header, so another site or another machine cannot act for you. Eight wrong codes or tokens in ten minutes lock that device out for the rest of the window. The page runs only its own scripts. A browser session can do what the pairing token can, so sign out a browser you no longer use.
+- New routes: `/api/web-session/{login,logout,status,device-code,handoff,revoke-all}`, `/api/tailscale/web-url`, `/api/web-bridge/memories`, `/api/meetings/live-chunks`, `/api/usage/summary`, `/api/work-board/your-move`. Not in this build: answering session questions and approvals from the browser.
+
+## 6.99.0 - Rename a live meeting, and up to 50 cues per meeting (private)
+
+2026-11-03. Private build for one Mac, on top of the public 6.98.1. COS Control needs a later build to show the rename field; nothing changes for older clients.
+
+- A live meeting (a G2 meeting or a Mac recording) can be renamed while it records: `GET` and `PUT /api/meeting/title-steer`. The name is kept across a server restart, a second client editing at the same time is told the name changed, and the name text is never logged.
+- When the meeting saves without a title of its own, the name you gave becomes its title and helps file it in the right domain. It is also saved as a title steer, so the meeting sync names the meeting from your words and sharpens them, instead of starting from "Mac recording 9:05 PM".
+- A placeholder title such as "Mac recording 9:05 PM" never beats a name you gave; a real title sent with the save still wins. A rename sent while the meeting is saving is refused (409 `save_in_progress`) instead of being lost.
+- The live meeting file Control reads carries the name as soon as you change it. `capabilities.titleSteer` says a server supports it.
+- Live cues per meeting can be set up to 50 (was 25) in COS Control or the phone. The default stays 25. A meeting at 50 can use up to 100 of the 150 daily writer calls.
+- `GET /live-cues/history` now reports the per-meeting cap you set, not a fixed 25.
+
 ## 6.98.1 - Tableau answers by lead source (private)
 
 2026-11-03. Private build for one Mac, on top of the public 6.98.0.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.98.1",
+  "version": "6.99.16",
   "description": "COS Glasses: self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {
@@ -41,6 +41,7 @@
     "shared",
     "!server/**/*.test.ts",
     "!server/scripts/engine-canary.ts",
+    "!server/scripts/start-web-candidate.mjs",
     "!server/scripts/hq-native-canary.ts",
     "!server/scripts/hq-contention-canary.ts",
     "!server/scripts/live-cos-ask-canary.ts",

package/server/index.ts

@@ -15,7 +15,7 @@ import { randomBytes, randomUUID } from 'node:crypto'
 import { healthRouter } from './routes/health.js'
 import { diagRouter } from './routes/diag.js'
 import { createClientInstanceRouter, isMeetingChunkPost } from './routes/client-instance.js'
-import { installTailscaleNudger } from './lib/tailscale-nudge.js'
+import { getTailscaleNudger, installTailscaleNudger } from './lib/tailscale-nudge.js'
 import { queryRouter } from './routes/query.js'
 import { providerProofRouter } from './routes/provider-proof.js'
 import { transcribeRouter } from './routes/transcribe.js'
@@ -123,7 +123,7 @@ import { meetingAskRouter } from './routes/meeting-ask.js'
 import { meetingAskRuntime } from './lib/meeting-ask-runtime.js'
 import { lensGistRouter } from './routes/lens-gist.js'
 import { bookmarksRouter } from './routes/bookmarks.js'
-import { setWeatherPersistence, welcomeContextRouter } from './routes/welcome-context.js'
+import { fetchNextEvent, setWeatherPersistence, welcomeContextRouter } from './routes/welcome-context.js'
 import { liveCuesRouter } from './routes/live-cues.js'
 import { tasksRouter } from './routes/tasks.js'
 import { memoryRouter } from './routes/memory.js'
@@ -132,7 +132,7 @@ import { skillsRouter } from './routes/skills.js'
 import { shutdownLiveCues } from './lib/live-cues-engine.js'
 import { shutdownLiveCuesV2 } from './lib/live-cues-v2.js'
 import { prewarmContext } from './lib/context-builder.js'
-import { preWarmCLI } from './lib/claude-bridge.js'
+import { getCliSessionId, preWarmCLI } from './lib/claude-bridge.js'
 import { sweepStaleTurnRequests } from './lib/turn-request.js'
 import { getCodexRunConfig } from './lib/codex-run-ledger.js'
 import {
@@ -147,7 +147,7 @@ import { initSessionCache } from './lib/session-cache-writer.js'
 import { initSpeakerEmbeddings } from './lib/speaker-embeddings.js'
 import { startNemotronWarmup } from './lib/nemotron-live.js'
 import { killNemotronChildren } from './lib/nemotron-cli.js'
-import { logActiveSessionsOnShutdown, startAutoSnapshot } from './lib/conversation.js'
+import { getSessionRaw, logActiveSessionsOnShutdown, startAutoSnapshot } from './lib/conversation.js'
 import { getMediaStore } from './lib/media-store.js'
 import { listenRequiredServers, type RequiredListener } from './lib/listener-startup.js'
 import { serverMetrics } from './lib/server-metrics.js'
@@ -169,6 +169,23 @@ import { createWorkOrchestratorRouter } from './routes/work-orchestrator.js'
 import { createWorkLensRoundsRouter } from './routes/work-lens-rounds.js'
 import { startWorkOrchestrator } from './lib/work-orchestrator/runtime.js'
 import { createWorkSearchRouter } from './routes/work-search.js'
+import { createDropsRouter, lazyDropService, openDropService } from './routes/drops.js'
+import { createCosThreadRouter } from './routes/cos-thread.js'
+import { claudeContextReader, CosThread, describeDropFiling, lazyCosThread } from './lib/cos-thread.js'
+import { mediaDropAttachments } from './lib/drop-attachments.js'
+import { createDropRouter, sharedDropJevClient, dropDailyCap, dropRouterEnabled } from './lib/drop-router.js'
+import { createBridgeDropWriters } from './lib/drop-destinations.js'
+import { dropItEnabled } from './lib/drop-settings.js'
+import { serverTimezone } from './lib/morning-brief-config.js'
+import { createYourMoveCounter } from './lib/your-move-count.js'
+import { readWorkJournal } from './lib/work-activity.js'
+import { createDropP2Boot } from './lib/drop-p2-boot.js'
+import { createP2SettingsReader } from './lib/drop-p2-settings.js'
+import { createDropP2Runtime, journalReceiptsLite } from './lib/drop-p2-runtime.js'
+import { sessionTurnOutcome } from './lib/drop-resolution.js'
+import { DropHistorySearcher } from './lib/drop-history-search.js'
+import { emitDisplay } from './lib/display-bus.js'
+import { COS_SCRIPTS_DIR } from './lib/python-bridge.js'
 import { isReadOnlyApiPost } from './lib/work-search.js'
 import { isMacVoiceNamingBatchPost } from './lib/mac-voice-naming-batch.js'
 import { dataPath } from './lib/data-dir.js'
@@ -198,7 +215,10 @@ import {
 import { isPublicApiRequest, requireApiToken } from './lib/api-auth.js'
 import { PairingState, pairingHostsFrom } from './lib/glasses-pairing.js'
 import { createPairingRouter } from './routes/pairing.js'
-import { isManagedRuntime } from './lib/managed-runtime.js'
+import { createWebControlRouter, isAllowedCorsOrigin, webControlCsp, webControlEnabled } from './routes/web-control.js'
+import { isWebControlSocketAllowed, isWebSessionAuthorized, setWebSessionEpochFile } from './lib/web-session-auth.js'
+import { getTailnetSelfName, installTailnetSelfName } from './lib/tailnet-self-name.js'
+import { isManagedRuntime, managedServerVersion } from './lib/managed-runtime.js'
 import { reportClaudeExtraToolConfiguration } from './lib/claude-tool-access.js'
 import {
   acquireMaintenanceWork,
@@ -271,13 +291,17 @@ app.use((req, res, next) => {
   next()
 })
 
-// Allow localhost + LAN IPs (glasses WebView accesses server over LAN)
+// Allow localhost + LAN IPs (glasses WebView accesses server over LAN) + this Mac's verified Tailscale MagicDNS
 app.use(cors({
   origin: (origin, cb) => {
     // Allow requests with no origin (same-origin, curl, SSE) or "null" origin (file:// WebViews like Even Hub)
     if (!origin || origin === 'null') return cb(null, true)
-    if (isAllowedNetworkOrigin(origin)) return cb(null, true)
-    cb(new Error('CORS blocked'))
+    // Async only for an unrecognised *.ts.net origin (see isAllowedCorsOrigin); every other
+    // origin is decided from cached state, as before.
+    isAllowedCorsOrigin(origin, getTailnetSelfName()).then(
+      ok => ok ? cb(null, true) : cb(new Error('CORS blocked')),
+      () => cb(new Error('CORS blocked')),
+    )
   },
   // Without this, a cross-origin reader sees only the CORS-safelisted response
   // headers. The companion's origin is `null` (a file:// WebView), so it is
@@ -367,16 +391,31 @@ const pairingState = new PairingState({
 // request that arrives proves the tunnel carries COS traffic. Authenticated ones also mark the
 // address as a paired phone. Notes only, never answers; noteRequest never throws.
 const tailscaleNudger = installTailscaleNudger({ activeMeetings: () => getActiveTranscriptionSessionCount() })
+// COS Control Web: this Mac's MagicDNS name, from the nudger when it has one and otherwise
+// from a reverse lookup at MagicDNS (the CLI does not answer under this LaunchAgent; see
+// lib/tailnet-self-name.ts). Learned at boot so the first phone sign-in is not refused.
+const tailnetSelf = installTailnetSelfName({ nudgerName: () => tailscaleNudger.currentSelfDnsName() })
+if (webControlEnabled()) void tailnetSelf.refresh()
+// Browser sessions sign this Mac's session epoch; "Sign out every browser" bumps it.
+setWebSessionEpochFile(dataPath('web-session.json'))
 app.use('/api', (req, _res, next) => {
   tailscaleNudger.noteRequest(req.socket?.remoteAddress, { meetingChunk: isMeetingChunkPost(req.method, req.path) })
   next()
 })
+const HTTPS_PORT = parseInt(process.env.HTTPS_PORT ?? '3143', 10)
 app.use('/api', requireApiToken(API_TOKEN, {
   onAuthenticated: req => pairingState.noteAuthenticated(req.socket?.remoteAddress),
+  selfDnsName: () => tailnetSelf.currentSelfDnsName(),
+  allowedPorts: () => [PORT, HTTPS_PORT],
 }))
 // Past the token gate, a request on a non-public path carried the token: mark a paired phone.
+// Only the X-Cos-Token header counts: a browser signed in to COS Control Web passed the gate
+// with its cookie, and treating that laptop or tab as a paired phone would point the nudger's
+// phone checks at it (review note).
 app.use('/api', (req, _res, next) => {
-  if (!isPublicApiRequest(req.method, req.path)) tailscaleNudger.noteRequest(req.socket?.remoteAddress, { authenticated: true })
+  if (!isPublicApiRequest(req.method, req.path) && typeof req.headers['x-cos-token'] === 'string') {
+    tailscaleNudger.noteRequest(req.socket?.remoteAddress, { authenticated: true })
+  }
   next()
 })
 
@@ -854,6 +893,12 @@ app.use('/api', createWorkReviewsRouter(workReviewRuntime))
 const workHandoffRequestStore = createOptionalWorkHandoffRequestStore(() => new WorkHandoffRequestStore(dataPath('work-handoff-requests')))
 // One bounded board read (5 s) shared by the glasses' Work glances and the request inbox; GET /api/work-board primes it.
 const workBoardReader = createWorkBoardReader(() => listBoard())
+// Drop it P2: a card written through this server kicks the resolution poll (a few seconds, one poll per burst) instead
+// of waiting up to 2 minutes. Mounted before the Work and tasks routers so it sees their answers; it never changes them.
+app.use(['/api/work-board', '/api/tasks'], (req, res, next) => {
+  if (req.method !== 'GET') res.on('finish', () => { if (res.statusCode < 300) dropP2.runtime()?.kickPoll() })
+  next()
+})
 app.use('/api', createWorkBoardRouter({ readBoard: workBoardReader, requests: () => handoffRequestCapabilities(workHandoffRequestStore, Date.now()) }))
 app.use('/api', createWorkHandoffRequestsRouter({ store: workHandoffRequestStore, readBoard: workBoardReader }))
 // Work intake (6.57.0): meeting-derived suggestions, asks and review items. Optional: a bad journal never blocks boot.
@@ -866,6 +911,85 @@ app.use('/api', createJevRouter(workReviewRuntime ? { review: async id => workRe
 app.use('/api', createDecisionProviderRouter())
 app.use('/api', createSubqKeyRouter())
 app.use('/api', createWorkSearchRouter())
+// Drop it P1 (6.100 candidate): the pinned COS chat's drops, receipts and History. Off by default (COS_DROP_IT or
+// PUT /api/drops/settings); its stores open on first use, so an install with it off writes nothing. The router is one
+// Jev request per drop with its own cap (COS_DROP_DAILY_TOKENS), ledger, breaker and switch (COS_DROP_ROUTER).
+// 6.99.11: P2 settings (data/drop-p2-settings.json), read through a 15 s cache; a PUT updates it at once.
+const dropP2Settings = createP2SettingsReader()
+const dropService = lazyDropService(() => openDropService(part => dataPath(part), {
+  p2Settings: () => dropP2Settings.read(),
+  router: createDropRouter(),
+  writers: createBridgeDropWriters(),
+  timezone: () => serverTimezone(),
+  // 6.99.13: a drop's files are pinned in the media store (lib/drop-attachments.ts); Undo removes them.
+  attachments: mediaDropAttachments(() => getMediaStore()),
+  askLookup: async (clientJobId, generation) => {
+    const job = await queryJobCoordinator.getByClientGeneration(clientJobId, generation)
+    return job ? { status: job.status, response: job.response, sessionId: job.sessionId } : undefined
+  },
+}))
+// Drop it P2 (6.99.11 candidate): pings, reminders and follow-ups, running only while Drop it is on (checked at boot and
+// each minute). It reads signals that already exist (calendar, Work intake, the board, the Work journal, the thread and
+// signal caches) and calls no model; History search by meaning shares the drop router's Jev client and cap.
+const dropP2 = createDropP2Boot({
+  enabled: () => dropItEnabled(),
+  service: dropService,
+  pingRoot: dataPath('pings'),
+  make: (stores, pingState) => createDropP2Runtime({
+    ...stores, pingState,
+    timezone: () => serverTimezone(),
+    nextEvent: async () => { const r = await fetchNextEvent(); return r.read ? r.event : undefined },
+    intakeOpen: () => workIntakeStore?.open(),
+    scriptsDir: COS_SCRIPTS_DIR,
+    board: () => workBoardReader.read(60_000, 5_000),
+    journal: () => { const j = readWorkJournal(); return j.available ? journalReceiptsLite(j.receipts) : undefined },
+    emitLens: event => { emitDisplay(event) },
+    // Quiet while the server drains for an update or restart, as the morning brief is.
+    paused: () => gracefulShutdownStarted || !maintenanceAdmissionsOpen(),
+    settings: () => dropP2Settings.read(),
+  }),
+})
+// The turn after Send to session ended: its held drop gets one follow-up (replied, or stopped). Never throws.
+sessionSignalStore.subscribe((signal, env, child) => {
+  try {
+    const outcome = sessionTurnOutcome(env.event, child)
+    if (outcome) dropP2.runtime()?.onSessionTurn(signal.sessionId, outcome, env.ts)
+  } catch { /* a follow-up is never worth breaking another subscriber */ }
+})
+const dropSearcher = new DropHistorySearcher(sharedDropJevClient())
+app.use('/api', createDropsRouter({
+  enabled: () => dropItEnabled(),
+  service: dropService,
+  p2: () => dropP2.runtime(),
+  search: () => dropSearcher,
+  p2Settings: dropP2Settings,
+  routerStatus: () => {
+    const status = sharedDropJevClient().status()
+    return { on: dropRouterEnabled(), dailyCap: dropDailyCap(), usedToday: status.usedToday, breakerOpenUntil: status.breakerOpenUntil }
+  },
+  // 6.99.10: Work items in Your move count toward `waiting` (plan section 12). The board read is the one Work's own
+  // glances share (10 s old at most, 3 s bound), and the count is kept 30 s, so the summary poll adds no bridge load.
+  yourMove: createYourMoveCounter({
+    journal: () => readWorkJournal(),
+    rows: () => workBoardReader.read(10_000, 3_000).catch(() => null),
+  }),
+}))
+// 6.99.16: the COS thread (routes/cos-thread.ts): one size-capped conversation behind the COS chat's Ask, with a
+// ledger to recover and search it. Gated with Drop it; its store opens on first use, so an install with it off writes
+// nothing. It reads the Claude Code log tail of the thread's session and the drop store; it calls no model.
+const cosThread = lazyCosThread(() => new CosThread({
+  dir: dataPath('cos-thread'),
+  context: claudeContextReader({ sessionExists: id => !!getSessionRaw(id), nativeFor: id => getCliSessionId(id) }),
+  nativeFor: id => getCliSessionId(id),
+  drops: (since, limit) => (dropService()?.recentDrops(since, limit) ?? []).map(d => ({ text: d.text, createdAt: d.createdAt, filed: describeDropFiling(d) })),
+  answerFor: (sessionId, clientId, messageNo) => {
+    const exchanges = getSessionRaw(sessionId)?.exchanges ?? []
+    const id = clientId.toLowerCase()
+    const hit = exchanges.find(e => e.role === 'assistant' && (e.clientJobId === id || (messageNo !== null && e.globalMsgNum === messageNo)))
+    return hit?.content
+  },
+}))
+app.use('/api', createCosThreadRouter({ enabled: () => dropItEnabled(), thread: cosThread }))
 // Find a session by meaning (Control 0.5.363): consent per provider, its own ledgers and breakers (lib/session-find.ts).
 app.use('/api', createSessionFindRouter())
 app.use('/api', createWorkChatRouter())
@@ -898,7 +1022,12 @@ app.use('/api', createSessionHooksRouter({ port: PORT }))
 // 6.52.0: the permission broker's client API (the hook's door is mounted before the /api
 // gate, above). Behind the API token; a poll counts as a live answerer only with
 // `?client=glasses|phone`.
-app.use('/api', createSessionQuestionsRouter({ broker: permissionBroker, apiToken: () => API_TOKEN }))
+// 6.99.12: COS Control Web reads the questions with its browser session, checked exactly as the /api gate checks it.
+const webSessionCookieAuthorized = (req: express.Request): boolean => isWebSessionAuthorized(req, API_TOKEN, {
+  selfDnsName: tailnetSelf.currentSelfDnsName(),
+  allowedPorts: [PORT, HTTPS_PORT],
+})
+app.use('/api', createSessionQuestionsRouter({ broker: permissionBroker, apiToken: () => API_TOKEN, webSessionAuthorized: webSessionCookieAuthorized }))
 // Phase 0 of Continue Original Agent Thread: can COS write into a desktop thread
 // without colliding with a live writer? Read-only — it answers, it never attaches.
 // Registered AFTER agentSessionsRouter deliberately: its paths are 2 and 4 segments
@@ -1305,6 +1434,7 @@ async function gracefulShutdown(): Promise<void> {
   stopRoutineScheduler()
   tailscaleNudger.stop()
   await workReviewRuntime?.close()
+  dropP2.stop()
   workIntakeStore?.close()
   workHandoffRequestStore?.close()
   stopMeetingImportScheduler()
@@ -1361,6 +1491,34 @@ process.on('unhandledRejection', (reason: any) => {
 // Start HTTPS alongside HTTP — Even Hub WebView prefers HTTPS (iOS ATS).
 // Optional: drop cert.pem + key.pem in server/certs/ (e.g. via mkcert) to enable.
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
+if (webControlEnabled()) {
+  const webControlDir = path.join(__dirname, 'web-control')
+  app.use('/control', (req, res, next) => {
+    // Loopback and Tailscale only, unless COS_WEB_CONTROL_LAN=1 (review W2).
+    if (!isWebControlSocketAllowed(req.socket?.remoteAddress, process.env, req.headers)) {
+      res.status(403).type('text').send('COS Control Web is available on this Mac and over Tailscale.')
+      return
+    }
+    res.setHeader('Content-Security-Policy', webControlCsp(req.path))
+    res.setHeader('X-Content-Type-Options', 'nosniff')
+    res.setHeader('Referrer-Policy', 'no-referrer')
+    next()
+  }, express.static(webControlDir))
+  app.use('/api', createWebControlRouter({
+    apiToken: () => API_TOKEN,
+    serverVersion: () => managedServerVersion() ?? 'unknown',
+    port: () => PORT,
+    httpsPort: () => existsSync(path.join(__dirname, 'certs', 'cert.pem')) ? HTTPS_PORT : null,
+    selfDnsName: () => tailnetSelf.currentSelfDnsName(),
+    // A glasses pairing code typed on the web sign-in page gets its own message (read only).
+    glassesCodeIsLive: code => pairingState.isLiveCode(code),
+    liveGlassesCodeKey: () => pairingState.status().code?.expiresAt ?? null,
+    queryTailscaleStatus: async () => {
+      const name = await tailnetSelf.refresh()
+      return name ? { backendState: 'Running', selfIps: [], selfDnsName: name, certDomains: [] } : null
+    },
+  }))
+}
 /**
  * Let a slow large upload finish instead of killing its socket mid-body.
  *
@@ -1389,7 +1547,6 @@ function withRequestTimeout<T extends { requestTimeout: number }>(server: T): T
   return server
 }
 
-const HTTPS_PORT = parseInt(process.env.HTTPS_PORT ?? '3143', 10)
 const certDir = path.join(__dirname, 'certs')
 const listeners: RequiredListener[] = []
 if (existsSync(path.join(certDir, 'cert.pem'))) {
@@ -1604,6 +1761,8 @@ listenRequiredServers(listeners).then(() => {
       // still mounted, so the kill switch is an immediate rollback.
       console.error('[COS API] Durable query-job store unavailable:', error)
     })
+    // Drop it P2: off unless Drop it is on; the boot re-checks the switch each minute.
+    dropP2.start()
 
     if (COS_MODE) {
       initSessionCache()