@gotcos/glasses-server 6.98.1 → 6.99.16

package/server/lib/query-job-runtime.ts

@@ -1,3 +1,6 @@
+import { resolveProviderWorkDir } from './launch-dir.js'
+import { COS_SCRIPTS_DIR } from './python-bridge.js'
+import { consolidationModelRunner } from './meeting-consolidation-run.js'
 import { routineAuditCaller } from './routines-config.js'
 import { jobAuditCaller } from './job-audit-caller.js'
 import { carriesBoundTo } from './agent-session-binding-store.js'
@@ -8,7 +11,9 @@ import { emitDisplay } from './display-bus.js'
 import { resolveQueryAttachments } from './query-attachments.js'
 import { getMediaStore } from './media-store.js'
 import { dataPath } from './data-dir.js'
-import { currentMessageEra, LEGACY_MESSAGE_ERA } from './message-era.js'
+import { currentMessageEra, exchangeBelongsToEra, LEGACY_MESSAGE_ERA } from './message-era.js'
+import { isWebAsk, prepareWebAsk } from './web-ask-admission.js'
+import { maxGlobalMsgNumInDir } from '../routes/message-ref.js'
 import { durableQueryJobsEnabled, messagesSteerEnabled, messagesTrailEnabled } from './query-job-feature.js'
 import { claudeSupportsSteer } from './claude-cli-support.js'
 import { steerProviderFor } from './claude-steer.js'
@@ -25,6 +30,9 @@ import {
 import { mergeMediaAttachmentRefs } from '../../shared/media-attachment.js'
 import { attachmentHistoryPrefix, defaultAttachmentRequest } from '../../shared/media-attachment.js'
 import {
+  createSession,
+  getActiveSessions,
+  getSessionRaw,
   findExchangesByJobIdentity,
   flushConversationToDisk,
   getSessionBinding,
@@ -44,7 +52,7 @@ import {
 } from './query-job-types.js'
 import { acquireMaintenanceWork } from './maintenance-lifecycle.js'
 import type { JobTrailDraft } from './job-trail.js'
-import { registerMessageReservationSource } from './message-reservations.js'
+import { maxReservedGlobalMsgNum, registerMessageReservationSource } from './message-reservations.js'
 import { bootResumeGate } from './boot-resume.js'
 import { keyAnswerCompletionFields, keyAnswerDoneFields } from './key-answer-fields.js'
 
@@ -69,9 +77,36 @@ export class QueryJobAdmissionPreparationError extends Error {
  * the strict QueryJobRequest parser before persistence. Once a reset era
  * exists, reject pre-era clients before they stamp five-digit numbers into
  * the fresh namespace. */
+/** 6.99.10: the next-number ceiling for a web Ask, the same arithmetic /api/message-counter serves. */
+function webAskCurrentMax(): number {
+  const era = currentMessageEra()
+  let liveMax = 0
+  for (const session of getActiveSessions()) {
+    for (const exchange of (session as { exchanges?: Array<{ globalMsgNum?: unknown; messageEra?: unknown }> }).exchanges ?? []) {
+      if (!exchangeBelongsToEra(exchange, era)) continue
+      if (typeof exchange?.globalMsgNum === 'number' && exchange.globalMsgNum > liveMax) liveMax = exchange.globalMsgNum
+    }
+  }
+  return Math.max(liveMax, maxGlobalMsgNumInDir(dataPath('archive'), era), maxReservedGlobalMsgNum(era))
+}
+
 export async function preparePublicDurableQueryAdmission(raw: unknown): Promise<unknown> {
   if (!raw || typeof raw !== 'object') return raw
-  const input = raw as Record<string, unknown>
+  let input = raw as Record<string, unknown>
+  // 6.99.10: Ask from COS Control Web (`source: 'web'`): the server picks the conversation and mints the message
+  // number (lib/web-ask-admission.ts). Every other caller is untouched.
+  if (isWebAsk(input) && !carriesBoundTo(input)) {
+    input = await prepareWebAsk(input, {
+      currentMax: webAskCurrentMax,
+      activeEra: currentMessageEra,
+      sessionExists: id => !!getSessionRaw(id),
+      createSession,
+      priorJob: async (clientJobId, generation) => {
+        const job = await queryJobCoordinator.getByClientGeneration(clientJobId, generation)
+        return job ? { sessionId: job.sessionId, globalMsgNum: job.globalMsgNum, messageEra: job.messageEra } : undefined
+      },
+    })
+  }
 
   // Plan 4.2: an attached turn must NEVER silently degrade into an ordinary COS
   // turn. The binding lives in the route path rather than the body, so a
@@ -255,7 +290,13 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
     ? { ...keyProfileLinkageProvider(keyTurn), resolvedModel: keyTurn.binding }
     : { provider: providerFor(model), resolvedModel: model }
 
-  await callModelStreaming(
+  const runModel = request.maintenanceWorkflow === 'meeting-consolidation-v1'
+    ? consolidationModelRunner(callModelStreaming, {
+        root: dataPath('meeting-consolidation'),
+        workspace: resolveProviderWorkDir({ scriptsDir: COS_SCRIPTS_DIR }),
+        runId: `${request.clientJobId}-g${request.generation}`,
+      }) : callModelStreaming
+  await runModel(
     request.query,
     request.sessionId,
     {

package/server/lib/query-job-types.ts

@@ -134,6 +134,8 @@ export interface QueryJobRequest {
    * it names the session, it does not change what is asked.
    */
   sessionName?: string
+  /** Explicit user-started, checkpointed maintenance. Changes execution semantics. */
+  maintenanceWorkflow?: 'meeting-consolidation-v1'
   /**
    * Key lanes (QA U9 / C10): run THIS turn on the key profile it names without binding the
    * session to it (the plan-limit "run this one on your key" offer). Kept only with a
@@ -599,6 +601,12 @@ export function parseQueryJobRequest(raw: unknown, options: ParseQueryJobRequest
   const handoffCode = optionalString(input.handoffCode, 'handoff_code', 128)
   const clientQueueItemId = optionalString(input.clientQueueItemId, 'client_queue_item_id', 120)
   const sessionName = sanitizeSessionName(input.sessionName)
+  const maintenanceWorkflow = input.maintenanceWorkflow
+  if (maintenanceWorkflow != null && (maintenanceWorkflow !== 'meeting-consolidation-v1'
+    || !['opus', 'codex-frontier'].includes(model ?? '') || input.dispatch != null || input.steerable === true
+    || (Array.isArray(input.attachmentIds) && input.attachmentIds.length > 0))) {
+    throw new QueryJobValidationError('invalid_maintenance_workflow')
+  }
   const globalMsgNum = input.globalMsgNum == null ? undefined : Number(input.globalMsgNum)
   if (globalMsgNum != null && (!Number.isSafeInteger(globalMsgNum) || globalMsgNum < 1)) {
     throw new QueryJobValidationError('invalid_global_msg_num')
@@ -670,6 +678,7 @@ export function parseQueryJobRequest(raw: unknown, options: ParseQueryJobRequest
     ...(input.handoffLatest === true ? { handoffLatest: true } : {}),
     ...(clientQueueItemId ? { clientQueueItemId } : {}),
     ...(sessionName ? { sessionName } : {}),
+    ...(maintenanceWorkflow === 'meeting-consolidation-v1' ? { maintenanceWorkflow } as const : {}),
     ...(input.keyTurnOnly === true && isProfilePreference(model) ? { keyTurnOnly: true as const } : {}),
     ...(input.steerable === true ? { steerable: true as const } : {}),
     attachmentIds,
@@ -735,7 +744,7 @@ export const FINGERPRINT_KEYS = [
   'clientJobId', 'generation', 'query', 'sessionId', 'model', 'effort',
   'cursorExecutionMode', 'messageEra', 'globalMsgNum', 'reference', 'handoffCode',
   'handoffLatest', 'clientQueueItemId', 'attachmentIds', 'attachmentRefs',
-  'activityToolMode', 'keyTurnOnly',
+  'activityToolMode', 'keyTurnOnly', 'maintenanceWorkflow',
 ] as const satisfies readonly (keyof QueryJobRequest)[]
 
 /** The request keys deliberately OUTSIDE the identity. Every key of

package/server/lib/reminder-scheduler.ts

@@ -0,0 +1,153 @@
+/**
+ * Drop it P2 (plan PLAN_drop_it_2026-11-04 section 7): firing the reminders he set.
+ *
+ * - The time lives on the drop: `remind: { at, tz, firedAt, ackAt, snoozes }`.
+ * - A 30-second tick (the morning-brief scheduler pattern). After sleep or a server restart the first tick fires
+ *   everything overdue, once each, and says how late it is when that is over 10 minutes.
+ * - `firedAt` is written under the drop store's writer lock BEFORE delivery, so a crash after the write can lose a
+ *   banner but never repeat one, and two ticks can never both fire it.
+ * - The banner uses the notification id `reminder-<drop id>`. Control mirrors each pending reminder as a local
+ *   calendar-trigger notification with the same id, so it fires with the server down and a later server fire
+ *   replaces it instead of doubling it.
+ * - Actions: Done, Snooze 1 hour, Tomorrow 9. A snooze sets a new `at`, which is a new exactly-once key.
+ *
+ * A reminder he set fires at any hour (the one quiet-hours exception, per CLAUDE.md). No model, no script.
+ */
+import type { DropRecord } from './drop-store.js'
+import { parseWhen, snoozeTargets, type WhenResult } from './drop-when.js'
+import { clip, PING_TEXT, type PingCandidate } from './ping-sources.js'
+
+export const REMINDER_TICK_MS = 30_000
+/** Over this late, the reminder says how late it is (plan section 7). */
+export const REMINDER_LATE_MS = 10 * 60_000
+export const REMINDER_ACTIONS = [
+  { id: 'reminder_done', label: 'Done' },
+  { id: 'snooze_1h', label: 'Snooze 1 hour' },  // the id stays; the length is Settings, Reminders, snooze
+  { id: 'snooze_tomorrow', label: 'Tomorrow 9' },
+] as const
+export type ReminderAction = typeof REMINDER_ACTIONS[number]['id']
+
+/** The two store calls the scheduler needs; DropStore has both. */
+export interface ReminderStore {
+  select(match: (row: Readonly<DropRecord>) => boolean): DropRecord[]
+  update(id: string, fn: (current: DropRecord) => DropRecord): DropRecord
+}
+
+/** The notification id Control's local backup uses for the same reminder. */
+export const reminderNotifyId = (dropId: string) => `reminder-${dropId}`
+
+/** What the drop asked to be reminded about: its words without "remind me" and the time. */
+export function reminderAbout(drop: Pick<DropRecord, 'text' | 'createdAt' | 'remind'>): string {
+  const tz = drop.remind?.tz || 'UTC'
+  const about = parseWhen(drop.text, Date.parse(drop.createdAt) || 0, tz).about
+  return clip(about || drop.text, PING_TEXT.title) || 'your reminder'
+}
+
+/** The ping's buttons, with the snooze named by its length ("Snooze 30 minutes"). */
+export function reminderActions(snoozeMinutes = 60): Array<{ id: ReminderAction; label: string }> {
+  const len = snoozeMinutes % 60 === 0 ? `${snoozeMinutes / 60} hour${snoozeMinutes === 60 ? '' : 's'}` : `${snoozeMinutes} minutes`
+  return REMINDER_ACTIONS.map(a => ({ id: a.id, label: a.id === 'snooze_1h' ? `Snooze ${len}` : a.label }))
+}
+
+/** "2 hours", "35 minutes", "1 day": how late a fire is. */
+export function lateWords(ms: number): string {
+  const min = Math.round(ms / 60_000)
+  if (min < 60) return `${min} minute${min === 1 ? '' : 's'}`
+  const h = Math.round(min / 60)
+  if (h < 48) return `${h} hour${h === 1 ? '' : 's'}`
+  const d = Math.round(h / 24)
+  return `${d} day${d === 1 ? '' : 's'}`
+}
+
+const pending = (r: Readonly<DropRecord>) => r.state !== 'undone' && r.dest === 'reminder' && !!r.remind?.at && !r.remind.firedAt && !r.remind.ackAt
+
+/** Every reminder still to fire, soonest first: what Control mirrors as local notifications. */
+export function pendingReminders(store: Pick<ReminderStore, 'select'>): Array<{ id: string; at: string; title: string; notifyId: string }> {
+  return store.select(pending)
+    .map(r => ({ id: r.id, at: r.remind!.at!, title: `Reminder: ${reminderAbout(r)}`, notifyId: reminderNotifyId(r.id) }))
+    .sort((a, b) => Date.parse(a.at) - Date.parse(b.at))
+}
+
+export interface FireResult { fired: number; late: number }
+
+/**
+ * Fire every reminder whose time has come. `deliver` receives the candidates only after each `firedAt` is on disk.
+ * A store write that fails (store closed, disk full) skips that reminder this tick; it is tried again next tick.
+ */
+export function fireDueReminders(store: ReminderStore, nowMs: number, deliver: (c: PingCandidate[]) => void, options?: { snoozeMinutes?: number }): FireResult {
+  const due = store.select(r => pending(r) && Date.parse(r.remind!.at!) <= nowMs)
+  const out: PingCandidate[] = []
+  let late = 0
+  for (const drop of due) {
+    const at = drop.remind!.at!
+    let written: DropRecord
+    try {
+      written = store.update(drop.id, cur => {
+        // Re-checked under the writer lock: another tick, an ack or an undo may have landed since the select.
+        if (!pending(cur) || cur.remind!.at !== at) throw new Error('reminder_moved')
+        return { ...cur, remind: { ...cur.remind!, firedAt: new Date(nowMs).toISOString() } }
+      })
+    } catch { continue }
+    const lateMs = nowMs - Date.parse(at)
+    const about = reminderAbout(written)
+    const isLate = lateMs > REMINDER_LATE_MS
+    if (isLate) late++
+    out.push({
+      source: 'reminder', key: `reminder:${drop.id}:${at}`, title: 'Reminder',
+      line: isLate ? `Reminder (${lateWords(lateMs)} late): ${about}` : `Reminder: ${about}`,
+      links: [{ kind: 'reminder', id: drop.id, label: about }],
+      actions: reminderActions(options?.snoozeMinutes),
+      createdAt: nowMs, notifyId: reminderNotifyId(drop.id),
+    })
+  }
+  if (out.length) deliver(out)
+  return { fired: out.length, late }
+}
+
+/**
+ * Done, Snooze 1 hour or Tomorrow 9, on a reminder that has fired (or a pending one: Done also cancels it).
+ * Returns the updated drop, or null when it is not a live reminder.
+ */
+export function applyReminderAction(store: ReminderStore, dropId: string, action: ReminderAction, nowMs: number,
+                                    options?: { snoozeMs?: number; dayMinutes?: number }): DropRecord | null {
+  const [row] = store.select(r => r.id === dropId)
+  if (!row || row.state === 'undone' || row.dest !== 'reminder' || !row.remind || row.remind.ackAt) return null
+  const iso = (ms: number) => new Date(ms).toISOString()
+  const targets = snoozeTargets(nowMs, row.remind.tz || 'UTC', options)
+  try {
+    return store.update(dropId, cur => {
+      if (!cur.remind || cur.remind.ackAt) throw new Error('reminder_gone')
+      if (action === 'reminder_done') return { ...cur, remind: { ...cur.remind, ackAt: iso(nowMs) } }
+      const at = action === 'snooze_1h' ? targets.hour : targets.tomorrow9
+      return { ...cur, remind: { ...cur.remind, at: iso(at), firedAt: null, snoozes: cur.remind.snoozes + 1 } }
+    })
+  } catch { return null }
+}
+
+/** The reminder time read from a drop's words at filing, or why it could not be read (COS then asks once). */
+export function reminderTimeFor(text: string, nowMs: number, timezone: string): WhenResult {
+  return parseWhen(text, nowMs, timezone)
+}
+
+/** The 30-second tick. `start` is idempotent; the timer never holds the process open. */
+export function createReminderScheduler(deps: { store: ReminderStore; deliver: (c: PingCandidate[]) => void; now?: () => number; intervalMs?: number; snoozeMinutes?: () => number }) {
+  const now = deps.now ?? (() => Date.now())
+  let timer: ReturnType<typeof setInterval> | null = null
+  let running = false
+  const tick = (): FireResult => {
+    if (running) return { fired: 0, late: 0 }
+    running = true
+    try {
+      let snoozeMinutes: number | undefined
+      try { snoozeMinutes = deps.snoozeMinutes?.() } catch { snoozeMinutes = undefined }
+      const r = fireDueReminders(deps.store, now(), deps.deliver, { snoozeMinutes })
+      if (r.fired) console.log(`[reminders] fired=${r.fired} late=${r.late}`)
+      return r
+    } catch { return { fired: 0, late: 0 } } finally { running = false }
+  }
+  return {
+    tick,
+    start() { if (timer) return; tick(); timer = setInterval(tick, deps.intervalMs ?? REMINDER_TICK_MS); timer.unref?.() },
+    stop() { if (timer) clearInterval(timer); timer = null },
+  }
+}

package/server/lib/tailnet-self-name.ts

@@ -0,0 +1,103 @@
+// This Mac's own Tailscale MagicDNS name, for COS Control Web's origin checks.
+//
+// WHY NOT THE TAILSCALE CLI. Under the server's LaunchAgent the `tailscale status --json` call
+// the nudger makes does not answer (server.log: "trigger=boot dropped: Tailscale did not answer
+// for 120s"), so the nudger never learns Self.DNSName and a phone at
+// http://<mac>.<tailnet>.ts.net:3141/control was refused by CORS on every write (6.99.1).
+// MagicDNS itself answers a reverse lookup of this Mac's own 100.x address at 100.100.100.100
+// in about a millisecond, with no CLI involved. The nudger's answer still wins when it has one.
+//
+// EXACT NAME ONLY. The answer is normalised by normalizeTailscaleDnsName (lowercase, one
+// trailing dot dropped, must end in .ts.net) and compared for equality; never a suffix match.
+// No answer means no name: the tailnet NAME is refused and the tailnet IP URL keeps working.
+
+import { Resolver } from 'node:dns/promises'
+import { networkInterfaces } from 'node:os'
+import { normalizeTailscaleDnsName, reachableIpv4Addresses } from './network-policy.js'
+
+export const TAILNET_NAME_HIT_TTL_MS = 10 * 60_000
+export const TAILNET_NAME_MISS_TTL_MS = 60_000
+export const TAILNET_REVERSE_TIMEOUT_MS = 1_500
+const MAGIC_DNS_RESOLVER = '100.100.100.100'
+
+export interface TailnetSelfNameDeps {
+  /** The nudger's own reading, preferred whenever it has one. */
+  nudgerName?: () => string | null
+  /** This Mac's Tailscale IPv4, or null when Tailscale is not up. */
+  tailscaleIpv4?: () => string | null
+  /** PTR lookup of an address; names may carry a trailing dot. */
+  reverse?: (ip: string) => Promise<string[]>
+  now?: () => number
+}
+
+export interface TailnetSelfName {
+  /** The name known right now, without waiting. */
+  currentSelfDnsName(): string | null
+  /** Look the name up (single-flight, cached); resolves to the name or null. Never throws. */
+  refresh(): Promise<string | null>
+  /** `SelfDnsSource` for isAllowedCorsOrigin: same as refresh(). */
+  queryStatus(): Promise<string | null>
+}
+
+function defaultTailscaleIpv4(): string | null {
+  return reachableIpv4Addresses(networkInterfaces()).find(a => a.kind === 'tailscale')?.address ?? null
+}
+
+function defaultReverse(ip: string): Promise<string[]> {
+  const resolver = new Resolver({ timeout: TAILNET_REVERSE_TIMEOUT_MS, tries: 1 })
+  resolver.setServers([MAGIC_DNS_RESOLVER])
+  return resolver.reverse(ip)
+}
+
+export function createTailnetSelfName(deps: TailnetSelfNameDeps = {}): TailnetSelfName {
+  const now = deps.now ?? (() => Date.now())
+  const ipv4 = deps.tailscaleIpv4 ?? defaultTailscaleIpv4
+  const reverse = deps.reverse ?? defaultReverse
+  let cached: { name: string | null; at: number } | null = null
+  let inflight: Promise<string | null> | null = null
+
+  const fromNudger = (): string | null => {
+    try { return normalizeTailscaleDnsName(deps.nudgerName?.() ?? null) } catch { return null }
+  }
+
+  const currentSelfDnsName = (): string | null => fromNudger() ?? cached?.name ?? null
+
+  const refresh = (): Promise<string | null> => {
+    const known = fromNudger()
+    if (known) return Promise.resolve(known)
+    const at = now()
+    if (cached && at - cached.at < (cached.name ? TAILNET_NAME_HIT_TTL_MS : TAILNET_NAME_MISS_TTL_MS)) {
+      return Promise.resolve(cached.name)
+    }
+    if (inflight) return inflight
+    inflight = (async () => {
+      let name: string | null = null
+      try {
+        const ip = ipv4()
+        if (ip) {
+          const names = await reverse(ip)
+          name = names.map(n => normalizeTailscaleDnsName(n)).find((n): n is string => n !== null) ?? null
+        }
+      } catch {
+        name = null
+      }
+      // A miss never erases a name we already had: a blip in MagicDNS must not lock the phone out.
+      cached = { name: name ?? cached?.name ?? null, at: now() }
+      return cached.name
+    })().finally(() => { inflight = null })
+    return inflight
+  }
+
+  return { currentSelfDnsName, refresh, queryStatus: refresh }
+}
+
+let singleton: TailnetSelfName | null = null
+/** index.ts installs the server's instance, wired to its nudger. */
+export function installTailnetSelfName(deps: TailnetSelfNameDeps): TailnetSelfName {
+  singleton = createTailnetSelfName(deps)
+  return singleton
+}
+export function getTailnetSelfName(): TailnetSelfName {
+  if (!singleton) singleton = createTailnetSelfName()
+  return singleton
+}

package/server/lib/tailscale-nudge.ts

@@ -39,7 +39,7 @@ import { execFile } from 'node:child_process'
 import { accessSync, constants as fsConstants } from 'node:fs'
 import { networkInterfaces } from 'node:os'
 import { readSwitch } from './env-switch.js'
-import { isTailscaleIpv4, normalizeRemoteIp } from './network-policy.js'
+import { isTailscaleIpv4, normalizeRemoteIp, normalizeTailscaleDnsName } from './network-policy.js'
 
 export const TAILSCALE_NUDGE_LIMITS = Object.freeze({
   tickMs: 10_000,
@@ -135,6 +135,8 @@ export interface PeerStatus {
 export interface TailscaleStatus {
   backendState: string
   selfIps: string[]
+  selfDnsName?: string | null
+  certDomains?: string[]
   peers: PeerStatus[]
   at: number
 }
@@ -145,6 +147,10 @@ export function parseTailscaleStatus(text: string, at: number): TailscaleStatus
   try { raw = JSON.parse(text) } catch { return null }
   if (!raw || typeof raw !== 'object' || typeof raw.BackendState !== 'string') return null
   const v4 = (ips: unknown): string[] => Array.isArray(ips) ? ips.filter((ip): ip is string => typeof ip === 'string' && isTailscaleIpv4(ip)) : []
+  const selfDnsName = normalizeTailscaleDnsName(raw.Self?.DNSName)
+  const certDomains = Array.isArray(raw.CertDomains)
+    ? (raw.CertDomains as unknown[]).filter((d): d is string => typeof d === 'string' && d.trim().length > 0).map((d: string) => d.trim().toLowerCase().replace(/\.$/, ''))
+    : []
   const peers: PeerStatus[] = []
   const peerMap = raw.Peer && typeof raw.Peer === 'object' ? raw.Peer : {}
   for (const p of Object.values(peerMap) as any[]) {
@@ -160,7 +166,7 @@ export function parseTailscaleStatus(text: string, at: number): TailscaleStatus
       lastHandshakeMs: Number.isFinite(hs) && hs > 0 ? hs : 0,
     })
   }
-  return { backendState: raw.BackendState, selfIps: v4(raw.Self?.TailscaleIPs).sort(), peers, at }
+  return { backendState: raw.BackendState, selfIps: v4(raw.Self?.TailscaleIPs).sort(), selfDnsName, certDomains, peers, at }
 }
 
 /** Disco ping output: "pong from <name> (<ip>) via <DERP(x) | ip:port | peer-relay(...)> in 91ms". */
@@ -419,6 +425,38 @@ export class TailscaleNudger {
     return read
   }
 
+  /**
+   * Cached or last-known Tailscale status, plus a single-flight on-demand refresh.
+   * Preserves the last known-good `selfDnsName` across transient read failures so CORS
+   * never tears or fails open under concurrent requests.
+   */
+  private statusRefreshInFlight: Promise<TailscaleStatus | null> | null = null
+  private lastKnownSelfDnsName: string | null = null
+
+  currentSelfDnsName(): string | null {
+    if (this.status?.selfDnsName) {
+      this.lastKnownSelfDnsName = this.status.selfDnsName
+    }
+    return this.lastKnownSelfDnsName
+  }
+
+  async queryStatus(forceRefresh = false): Promise<TailscaleStatus | null> {
+    const at = this.now()
+    if (!forceRefresh && this.status && at - this.status.at <= TAILSCALE_NUDGE_LIMITS.statusFreshMs) {
+      if (this.status.selfDnsName) this.lastKnownSelfDnsName = this.status.selfDnsName
+      return this.status
+    }
+    if (this.statusRefreshInFlight) return this.statusRefreshInFlight
+    if (!this.ensureBin(at)) return this.status
+    this.statusRefreshInFlight = this.readStatus(at).then(parsed => {
+      if (parsed?.selfDnsName) this.lastKnownSelfDnsName = parsed.selfDnsName
+      return parsed ?? this.status
+    }).finally(() => {
+      this.statusRefreshInFlight = null
+    })
+    return this.statusRefreshInFlight
+  }
+
   private async runEvent(pending: PendingEvent, at: number): Promise<void> {
     const L = TAILSCALE_NUDGE_LIMITS
     const status = await this.freshStatus(at)

package/server/lib/task-store.ts

@@ -853,3 +853,35 @@ export function liveLedgerFor(taskId: string, day: string, paths = taskStorePath
     run.taskId === taskId && run.day === day && (run.status === 'dispatching' || run.status === 'running'),
   )
 }
+
+/**
+ * Drop it (plan section 3): a new Inbox card from a drop, in one locked bridge write that answers the card's id
+ * (`task-capture-drop`, stdin `{ text, dropId }`). `captureTask` answers no id, and Undo needs one. Repeating the
+ * same dropId answers the same card (`created: false`). A bridge without the verb answers
+ * `cos_pipeline_not_configured`, which the caller turns into a plain note.
+ */
+export interface CapturedDropCard { id: string; workIdentity: string; created: boolean }
+export async function captureDropCard(domain: string, text: string, dropId: string): Promise<CapturedDropCard> {
+  if (!isSafeDomainName(domain) || !taskDomains().includes(domain)) throw new TaskRunError(400, 'invalid_domain', 'Unknown task domain')
+  const clean = text.replace(/\s+/g, ' ').trim()
+  if (!clean || clean.length > 2000) throw new TaskRunError(422, 'invalid_task_text', 'Card text must be 1 to 2,000 characters')
+  rejectReservedWorkText(clean)
+  const out = await withLockRetry(() => bridge(['task-capture-drop', domain], JSON.stringify({ text: clean, dropId }))) as Partial<CapturedDropCard> & { ok?: unknown }
+  if (out?.ok !== true || typeof out.id !== 'string' || !/^[a-f0-9]{12}$/.test(out.id) || typeof out.created !== 'boolean'
+    || (out.workIdentity !== undefined && (typeof out.workIdentity !== 'string' || !/^[a-f0-9]{12}$/.test(out.workIdentity)))) {
+    throw new TaskRunError(502, 'capture_unverified', 'The card could not be confirmed. Refresh Work before trying again.')
+  }
+  return { id: out.id, workIdentity: out.workIdentity ?? out.id, created: out.created }
+}
+
+/**
+ * Undo for captureDropCard: archive (`[~]`) the card only while it is untouched (`task-archive-drop`, stdin
+ * `{ dropId, expectedText }`). `touched` means it was edited, checked or moved since: Undo refuses with that reason.
+ * `gone` means the card is no longer there, which Undo treats as done.
+ */
+export async function archiveDropCard(domain: string, id: string, dropId: string, expectedText: string): Promise<'archived' | 'touched' | 'gone'> {
+  if (!isSafeDomainName(domain) || !/^[a-f0-9]{12}$/.test(id)) throw new TaskRunError(422, 'invalid_task_id', 'Use the exact card id')
+  const out = await withLockRetry(() => bridge(['task-archive-drop', domain, id], JSON.stringify({ dropId, expectedText: expectedText.replace(/\s+/g, ' ').trim() }))) as { ok?: unknown; result?: unknown }
+  if (out?.ok === true && (out.result === 'archived' || out.result === 'touched' || out.result === 'gone')) return out.result
+  throw new TaskRunError(502, 'archive_unverified', 'The card could not be confirmed. Refresh Work before trying again.')
+}

package/server/lib/web-ask-admission.ts

@@ -0,0 +1,56 @@
+/**
+ * 6.99.10 (Drop it plan section 12): Ask from COS Control Web goes through POST /api/query-jobs, the route the glasses
+ * use, with `source: 'web'`. The browser holds no message counter and no conversation, so the server fills in what the
+ * phone would send:
+ *
+ * - `sessionId`: kept when it names a live conversation (a follow-up), else a new conversation is made, as the morning
+ *   brief does. The answer projects into that conversation, so it reads in Messages (Recent on the Mac and the web)
+ *   and in the lens message list like any other turn.
+ * - `globalMsgNum`: the next message number, minted from the same ceiling /api/message-counter serves (live sessions,
+ *   the archive, and every number a not-yet-projected job holds), and never below a number this process minted
+ *   already, so two web asks at once take two numbers. One web Ask moves the counter by exactly one.
+ * - `messageEra`: the active era.
+ *
+ * A retry of the same clientJobId and generation (a lost 202) reuses the first admission's session and number, so it
+ * replays instead of conflicting. `source` itself is consumed here; the job journal does not store it.
+ *
+ * Any other source value, or none, is left exactly as it was: the glasses and Control paths are unchanged.
+ */
+export interface WebAskAdmissionDeps {
+  /** Highest message number in use in the active era (live, archive, reservations). */
+  currentMax: () => number
+  activeEra: () => string
+  sessionExists: (sessionId: string) => boolean
+  createSession: () => string
+  /** The admitted job for this client identity, if any (lost-202 replay). */
+  priorJob: (clientJobId: string, generation: number) => Promise<{ sessionId?: string; globalMsgNum?: number; messageEra?: string } | undefined>
+}
+
+export const WEB_ASK_SOURCE = 'web'
+let lastMinted = 0
+
+/** Test-only: forget the in-process floor. */
+export function resetWebAskMintForTests(): void { lastMinted = 0 }
+
+export function isWebAsk(input: Record<string, unknown>): boolean {
+  return input.source === WEB_ASK_SOURCE
+}
+
+/** Returns the request with `source` removed and the web fields filled. Synchronous after the replay lookup, so the
+ * mint and the floor update happen together. */
+export async function prepareWebAsk(input: Record<string, unknown>, deps: WebAskAdmissionDeps): Promise<Record<string, unknown>> {
+  const { source: _source, ...rest } = input
+  const clientJobId = typeof rest.clientJobId === 'string' ? rest.clientJobId.toLowerCase() : ''
+  const generation = Number(rest.generation)
+  const prior = clientJobId && Number.isSafeInteger(generation) && generation >= 1
+    ? await deps.priorJob(clientJobId, generation).catch(() => undefined)
+    : undefined
+  if (prior?.sessionId && prior.globalMsgNum) {
+    return { ...rest, sessionId: prior.sessionId, globalMsgNum: prior.globalMsgNum, messageEra: prior.messageEra ?? deps.activeEra() }
+  }
+  const asked = typeof rest.sessionId === 'string' ? rest.sessionId : ''
+  const sessionId = asked && deps.sessionExists(asked) ? asked : deps.createSession()
+  const globalMsgNum = Math.max(deps.currentMax(), lastMinted) + 1
+  lastMinted = globalMsgNum
+  return { ...rest, sessionId, globalMsgNum, messageEra: deps.activeEra() }
+}