@gotcos/glasses-server 6.99.20 → 6.99.29

package/server/routes/health.ts

@@ -1,3 +1,5 @@
+import { MAX_ATTACHMENTS_PER_PROMPT } from '../../shared/media-attachment.js'
+import { TURN_FILE_MAX_BYTES } from '../lib/turn-file-store.js'
 import { dropItCapability } from '../lib/drop-settings.js'
 import { PREP_CAPABILITY } from '../../shared/prep.js'
 import { phoneMicrophoneMeetingsCapability } from '../lib/phone-recording.js'
@@ -446,6 +448,13 @@ healthRouter.get('/health', async (_req, res) => {
     ...checks,
     server_version: managedServerVersion(),
     ...threadAttachHealthFields(threadAttach),
+    // 11/07 (Control Web attach): a session turn takes up to this many media-store ids as `attachmentIds`, and the turns
+    // route writes each file's path on this Mac under the words. 0 with attach off; absent on an older server. Either
+    // way a client sends words only.
+    threadTurnAttachments: threadAttach.enabled ? MAX_ATTACHMENTS_PER_PROMPT : 0,
+    // 6.99.27: a session turn also takes ANY file up to this size (lib/turn-file-store.ts), sent to /api/media/file with
+    // X-COS-Purpose: session-turn. 0 with attach off; absent on an older server, which takes only what the media store reads.
+    threadTurnFileBytes: threadAttach.enabled ? TURN_FILE_MAX_BYTES : 0,
     ...sessionHooksHealthFields(),
     // 6.52.0: counts, the mode and two timestamps; never an id, a question, a command, or
     // how many are held (that is on the authenticated questions route).

package/server/routes/media.ts

@@ -22,6 +22,7 @@
 // /api/media/file STREAMS to disk rather than buffering: see
 // createMediaBinaryBodyParser below.
 
+import { getTurnFileStore } from '../lib/turn-file-store.js'
 import { Router, json, type NextFunction, type Request, type Response } from 'express'
 import { createReadStream, createWriteStream, openSync, statSync } from 'node:fs'
 import {
@@ -554,6 +555,15 @@ mediaRouter.post('/media', async (req: Request, res: Response) => {
  * bounded requests, but composer admission still owns the shared five-item
  * prompt cap. Filename and MIME are hints only; the store sniffs and validates
  * the actual staged bytes. */
+/**
+ * 6.99.27: does a refused upload become a turn file? Only for a session turn, and only when the media store refused the
+ * FORMAT (it cannot read the type, or the text is not UTF-8). Too large, too long, or the Mac unable to process media
+ * right now are said as they always were.
+ */
+export function keepsAsTurnFile(purpose: string | undefined, code: unknown): boolean {
+  return purpose === 'session-turn' && (code === 'unsupported_attachment_format' || code === 'corrupt_attachment')
+}
+
 mediaRouter.post('/media/file', async (req: Request, res: Response) => {
   const staged = takeStagedUploadBody(req)
   try {
@@ -566,14 +576,28 @@ mediaRouter.post('/media/file', async (req: Request, res: Response) => {
     if (rawLabel) {
       try { label = decodeURIComponent(rawLabel).slice(0, 120) } catch { label = rawLabel.slice(0, 120) }
     }
-    const attachment = await getMediaStore().ingestRichMediaFromFile({
-      sourcePath: staged.path,
-      byteLength: staged.bytes,
-      label,
-      declaredMime: safeString(req.header('content-type'), 120),
-      capturedAt: safeString(req.header('x-cos-captured-at'), 40),
-      sessionId: safeString(req.header('x-cos-session-id'), 64),
-    })
+    let attachment: unknown
+    try {
+      attachment = await getMediaStore().ingestRichMediaFromFile({
+        sourcePath: staged.path,
+        byteLength: staged.bytes,
+        label,
+        declaredMime: safeString(req.header('content-type'), 120),
+        capturedAt: safeString(req.header('x-cos-captured-at'), 40),
+        sessionId: safeString(req.header('x-cos-session-id'), 64),
+      })
+    } catch (err) {
+      // 6.99.27: a file for a Claude or Codex session turn, in a format the media store does not read (a .zip, a .docx,
+      // a log in another encoding). The session gets its path and opens it itself, so it is kept as a turn file, which
+      // only the turn and fork routes can resolve (lib/turn-file-store.ts). Anything else refuses as before.
+      if (!keepsAsTurnFile(req.header('x-cos-purpose'), (err as { code?: unknown } | null)?.code)) throw err
+      attachment = getTurnFileStore().ingestFromFile({
+        sourcePath: staged.path,
+        byteLength: staged.bytes,
+        label,
+        declaredMime: safeString(req.header('content-type'), 120),
+      })
+    }
     res.json({ attachment })
   } catch (err) {
     sendMediaError(res, err)

package/server/routes/permission-broker.ts

@@ -35,8 +35,14 @@
 // The hook token still opens nothing here. A browser poll counts as a live answering client
 // only with `?client=web`, which the page sends only while it shows the cards (a visible tab);
 // the same 30 s window as the phone. A cookie poll naming `glasses` or `phone`, or no client,
-// never counts, and a token poll naming `web` never counts either. A browser never reports
-// wearer presence, so it never enables the away hold.
+// never counts, and a token poll naming `web` never counts either.
+// 6.99.26 (Miles 11/07, "Away rule, like phone"): a browser poll `?client=web&hold=1&presenceAgeMs=<int>`
+// (the ms since a touch or a key while the page was in front) records COS Control Web's presence for the
+// away hold ONLY (lib/client-liveness noteWebPresence): never a live client, so at the desk the Mac's own
+// pop-up still comes at once (6.99.13). Without `hold=1` or a valid `presenceAgeMs` it records nothing. A
+// token poll naming `web`, and a browser poll naming anything else, still record nothing. QA round 1: neither
+// does a poll from the Mac itself (loopback, or one of its own addresses, with no proxy header): Control Web
+// open on the Mac is the desk, never away.
 // 6.60.0: a poll with `&hold=1&presenceAgeMs=<int>` (COS Glasses 6.9.563 and later) records
 // wearer presence for the away hold instead of the 6.59.0 liveness; a `hold=1` poll without
 // a valid `presenceAgeMs` makes no client live and enables no hold. The response adds
@@ -53,7 +59,9 @@ import {
   type HookReplyChannel,
   type PermissionBroker,
 } from '../lib/permission-broker.js'
-import { noteQuestionsPoll, validPresenceAgeMs, type QuestionsPollFacts } from '../lib/client-liveness.js'
+import { noteQuestionsPoll, noteWebPresence, validPresenceAgeMs, type QuestionsPollFacts } from '../lib/client-liveness.js'
+import { hasProxyForwardedHeaders, isLoopbackAddress, normalizeRemoteIp, reachableIpv4Addresses } from '../lib/network-policy.js'
+import { networkInterfaces } from 'node:os'
 
 export const PERMISSION_BROKER_HOOK_PATH = '/api/permission-requests/ask'
 /** The hook posts its spool envelope, capped at 1 MiB by the script itself. */
@@ -155,6 +163,10 @@ export interface SessionQuestionsRouterDeps {
   webSessionAuthorized?: (req: Request) => boolean
   /** Where a counted poll is recorded; `noteQuestionsPoll` in production. */
   notePoll?: (at: number, poll: QuestionsPollFacts) => void
+  /** 6.99.26: where COS Control Web's presence is recorded; `noteWebPresence` in production. */
+  noteWebPresence?: (at: number, presenceAgeMs: number) => void
+  /** 6.99.26 (QA round 1): whether a request comes from this Mac itself; `requestFromThisMac` in production. */
+  fromThisMac?: (req: Request) => boolean
   now?: () => number
   /** 6.60.0: when this server process started (ISO); defaults to the process's own start. */
   serverStartedAt?: string
@@ -176,9 +188,30 @@ export function questionsPollFacts(query: Record<string, unknown>): QuestionsPol
   return { hold, presenceAgeMs: hold && validPresenceAgeMs(parsed) ? parsed : null }
 }
 
+/**
+ * 6.99.26 (QA round 1): a request from this Mac itself: its socket is loopback or one of the Mac's own addresses (its
+ * tailnet address first), and no proxy header says it was forwarded for someone else (a `tailscale serve` hop arrives on
+ * loopback for a remote peer). Control Web open on the Mac is the desk: its touch never makes the Mac away.
+ */
+export function requestFromThisMac(
+  req: { socket?: { remoteAddress?: string | undefined } | null; headers?: Record<string, unknown> | null },
+  selfAddresses: () => readonly string[] = () => reachableIpv4Addresses(networkInterfaces()).map(a => a.address),
+): boolean {
+  if (hasProxyForwardedHeaders(req.headers)) return false
+  const remote = req.socket?.remoteAddress
+  if (isLoopbackAddress(remote)) return true
+  const ip = normalizeRemoteIp(remote ?? '')
+  if (!ip) return false
+  let own: readonly string[] = []
+  try { own = selfAddresses() } catch { own = [] }
+  return own.includes(ip)
+}
+
 export function createSessionQuestionsRouter(deps: SessionQuestionsRouterDeps): Router {
   const router = Router()
   const notePoll = deps.notePoll ?? noteQuestionsPoll
+  const noteWeb = deps.noteWebPresence ?? ((at: number, ageMs: number) => noteWebPresence(at, ageMs))
+  const fromThisMac = deps.fromThisMac ?? ((req: Request) => requestFromThisMac(req))
   const now = deps.now ?? Date.now
   router.get('/session-questions', (req: Request, res: Response) => {
     res.set('Cache-Control', 'private, no-store')
@@ -199,6 +232,11 @@ export function createSessionQuestionsRouter(deps: SessionQuestionsRouterDeps):
     if (byToken && ANSWERING_CLIENTS.has(client)) notePoll(now(), questionsPollFacts(req.query as Record<string, unknown>))
     // 6.99.13 (Miles, option B): a browser poll never counts as live, so an open web tab never holds a question
     // back from the Mac's own pop-up. The web still lists and answers what the glasses or phone are holding.
+    // 6.99.26: its touch counts for the away hold only, like the phone's (Miles 11/07, "Away rule, like phone").
+    if (byWebSession && client === WEB_ANSWERING_CLIENT) {
+      const facts = questionsPollFacts(req.query as Record<string, unknown>)
+      if (facts.presenceAgeMs !== null && facts.presenceAgeMs !== undefined && !fromThisMac(req)) noteWeb(now(), facts.presenceAgeMs)
+    }
     const health = deps.broker.health()
     // Listed first: a deadline the timer has not caught yet is settled by the listing.
     const items = deps.broker.list()
@@ -227,7 +265,12 @@ export function createSessionQuestionsRouter(deps: SessionQuestionsRouterDeps):
   })
   router.post('/session-questions/:id/answer', (req: Request, res: Response) => {
     res.set('Cache-Control', 'private, no-store')
-    const result = deps.broker.answer(String(req.params.id ?? ''), req.body)
+    // 6.99.27: label the answer by its door (the /api gate already let it in): the token is the Even app, anything else
+    // is COS Control Web's browser session.
+    let expected = ''
+    try { expected = deps.apiToken() } catch { expected = '' }
+    const by = timingSafeTokenEqual(req.headers['x-cos-token'], expected) ? 'app' : 'web'
+    const result = deps.broker.answer(String(req.params.id ?? ''), req.body, by)
     res.status(result.status).json(result.body)
   })
   return router

package/server/routes/thread-turn-queue.ts

@@ -15,6 +15,7 @@
 //
 // EVERY DEPENDENCY IS INJECTED so the whole path is testable without a live server.
 
+import { randomBytes } from 'node:crypto'
 import { Router, type Request, type Response } from 'express'
 import { CONTINUE_NOTE_HEADER, continueNoteAcknowledged } from '../lib/continue-plan.js'
 import { nativeQueueControl, plainQueueText, type NativeQueueControl } from '../lib/codex-queue-control.js'
@@ -29,8 +30,24 @@ import { readQueue, writeQueue, queuedThreadKeys } from '../lib/thread-turn-queu
 import type { DeliveryEvidence } from '../lib/queue-turn-evidence.js'
 import { continueLiveEnabled } from '../lib/session-peer-inbox-deps.js'
 import { PEER_VERIFY_TIMEOUT_MS } from '../lib/session-peer-inbox.js'
+import { attachmentsDigest, FOOTER_LINE_REFUSED_COPY, hasFooterShapedLine, stripG2TurnFooter, TURN_ID_IN_USE_COPY, unvouched, type G2TurnProvenance, type OriginVerdict } from '../lib/g2-turn-provenance.js'
+import { defaultTurnAttachmentStore, keepTurnAttachments, parseTurnAttachmentIds, TURN_ATTACHMENT_COPY, turnAttachmentManifest, type TurnAttachmentStore } from '../lib/session-turn-attachments.js'
+
+/**
+ * G2 authority Tier 1 (6.99.29, Codex audit of e4758a6): the verdict a parked turn's files allow, and
+ * the attachment digest its origin is sealed to. Files whose content cannot be read leave the turn
+ * unvouched (it still parks); no files is the empty digest and reads nothing.
+ */
+async function sealFiles(ids: readonly string[] | undefined, verdict: OriginVerdict, store: TurnAttachmentStore | undefined): Promise<{ verdict: OriginVerdict; attachments: string }> {
+  if (!Array.isArray(ids) || ids.length === 0) return { verdict, attachments: '' }
+  const manifest = await turnAttachmentManifest(ids, store)
+  if (!manifest.ok) return { verdict: unvouched(verdict, 'attachments_unsealable'), attachments: '' }
+  return { verdict, attachments: attachmentsDigest(manifest.manifest) }
+}
 
 export interface ThreadTurnQueueDeps {
+  /** 11/07: the media store a parked turn's `attachmentIds` are checked against. Absent: the real store. Tests pass a fake. */
+  turnAttachmentStore?: TurnAttachmentStore
   /** Re-runs the FULL occupancy gate. The drainer never decides attachability itself. */
   occupancy: (provider: string, threadId: string) => { attachable: boolean; reason: string | null }
   /** Did the holder's last transcript record end a turn? */
@@ -66,6 +83,13 @@ export interface ThreadTurnQueueDeps {
    * Stop hook. Absent: no Cursor turn is ever drained here, exactly as in 6.61.
    */
   cursorCliChat?: (threadId: string) => boolean
+  /**
+   * G2 authority Tier 1, with web origin (6.99.29), optional: the origin of each parked turn is
+   * captured here (and again on an edit or a Send again, each judged by its own request) and carried to
+   * its drain, forgotten on any settle; a steer and a native Codex queue edit are ledgered and
+   * footed like a turn. Absent: the 6.99.28 behaviour.
+   */
+  provenance?: G2TurnProvenance
   now: () => number
 
   // ------------------------------------------------------------- 6.78.0 (P3)
@@ -126,6 +150,8 @@ export function publicRow(turn: QueuedThreadTurn, position: number): Record<stri
     preview: turn.prompt.length > 80 ? `${turn.prompt.slice(0, 79)}…` : turn.prompt,
     ...(turn.reason ? { reason: turn.reason } : {}),
     ...(turn.settledAt ? { settledAt: turn.settledAt } : {}),
+    // 11/07: how many files wait with the words (never their ids or paths). Absent without files.
+    ...(Array.isArray(turn.attachmentIds) && turn.attachmentIds.length > 0 ? { attachments: turn.attachmentIds.length } : {}),
   }
   // 6.78.0: additive, and only while a P3 flag is on, so the row is the 6.77 bytes otherwise.
   // `resendable` is the per-row capability: present only when Send again can act on it.
@@ -211,6 +237,11 @@ export async function drainThread(
     if (index >= 0) { latest[index] = turn; writeQueue(provider, threadId, latest, durable ? { durable: true } : {}) }
   }
   let refusedGate: ReturnType<ThreadTurnQueueDeps['occupancy']> | null = null
+  // G2 authority Tier 1 (QA 6.99.29): a parked origin is forgotten on ANY settle (delivered,
+  // cancelled, refused, expired, given up). Only a row still `waiting` keeps it for its next attempt.
+  const forgetIfSettled = (turn: QueuedThreadTurn): void => {
+    if (turn.status !== 'waiting') deps.provenance?.forgetQueued(provider, threadId, turn.clientTurnId)
+  }
 
   for (const snapshot of queue) {
     const turn = readQueue(provider, threadId, deps.now()).find(t => t.clientTurnId === snapshot.clientTurnId)
@@ -259,6 +290,7 @@ export async function drainThread(
       turn.reason = decision === 'expire' ? 'queued_turn_expired' : 'delivery_attempts_exhausted'
       turn.settledAt = deps.now()
       retired += 1; persist(turn)
+      forgetIfSettled(turn)
       continue
     }
 
@@ -335,6 +367,7 @@ export async function drainThread(
       held += 1
     }
     persist(turn)
+    forgetIfSettled(turn)
   }
   return { delivered, held, retired }
 }
@@ -451,8 +484,15 @@ async function steerTurn(
   queue: QueuedThreadTurn[],
   gateReason: string | null,
   fallbackNone: boolean,
+  verdict: OriginVerdict | null = null,
 ): Promise<unknown> {
   const { provider, threadId, clientTurnId, prompt } = turn
+  // G2 authority Tier 1 (6.99.29): a steer goes straight into the running session through its peer
+  // inbox, so it is a delivery of its own and carries the footer like a turn.
+  const steerPrompt = deps.provenance && verdict ? deps.provenance.footed(prompt, clientTurnId, verdict, provider) : prompt
+  const ledgerSteer = (via: string): void => {
+    if (deps.provenance && verdict) deps.provenance.record({ turnId: clientTurnId, prompt, verdict, provider, sessionId: threadId, via })
+  }
   const intent: QueuedThreadTurn = {
     ...turn,
     status: 'delivering',
@@ -462,7 +502,10 @@ async function steerTurn(
     ...(typeof deps.bootId === 'string' && deps.bootId.length > 0 ? { deliveringBootId: deps.bootId } : {}),
   }
   const admitted = admitToQueue(queue, intent)
-  if (!admitted.ok) return res.status(409).json({ error: admitted.reason })
+  if (!admitted.ok) {
+    deps.provenance?.forgetQueued(provider, threadId, clientTurnId)
+    return res.status(409).json({ error: admitted.reason })
+  }
   writeQueue(provider, threadId, admitted.queue, { durable: true })
 
   /** Rewrite this row on the CURRENT file: other requests may have changed others meanwhile. */
@@ -470,6 +513,9 @@ async function steerTurn(
     const latest = readQueue(provider, threadId, deps.now())
     const row = latest.find(t => t.clientTurnId === clientTurnId)
     if (row) { apply(row); writeQueue(provider, threadId, latest, { durable: true }) }
+    // G2 authority Tier 1 (QA 6.99.29): a steer that settled (delivered or refused) forgets its
+    // parked origin; one put back to wait keeps it for the drain.
+    if (!row || row.status !== 'waiting') deps.provenance?.forgetQueued(provider, threadId, clientTurnId)
     return latest
   }
   const backToWaiting = (row: QueuedThreadTurn): void => {
@@ -502,7 +548,7 @@ async function steerTurn(
 
   let live: { ok: boolean; reason: string } | null = null
   try {
-    live = await deps.deliverLiveTurn!({ provider, sessionId: threadId, prompt, verifyTimeoutMs: PEER_VERIFY_TIMEOUT_MS, clientTurnId })
+    live = await deps.deliverLiveTurn!({ provider, sessionId: threadId, prompt: steerPrompt, verifyTimeoutMs: PEER_VERIFY_TIMEOUT_MS, clientTurnId })
   } catch (error) {
     console.error(`[thread-turn-queue] steer delivery threw: ${error instanceof Error ? error.message : error}`)
     live = null
@@ -515,11 +561,13 @@ async function steerTurn(
 
   if (live?.ok === true) {
     journal('sent')
+    ledgerSteer('steer')
     settleRow(row => { row.status = 'delivered'; row.reason = 'steered'; row.settledAt = at })
     return res.status(200).json({ state: 'delivered', reason: 'steered', clientTurnId })
   }
   if (live === null || live.reason === 'unverified' || live.reason === 'write_failed') {
     journal('unknown')
+    ledgerSteer('steer-unverified')
     settleRow(row => { row.status = 'refused'; row.reason = 'steer_unverified'; row.deliveryState = 'unknown'; row.settledAt = at })
     return res.status(200).json({
       state: 'refused',
@@ -560,10 +608,21 @@ export function createThreadTurnQueueRouter(deps: ThreadTurnQueueDeps): Router {
       return res.status(400).json({ error: 'invalid_request', reason: 'invalid_cos_session_id' })
     }
 
+    // G2 authority Tier 1 (QA 6.99.29): only the server writes a verify footer. Words carrying
+    // anything footer-shaped are refused where they were typed (this is also the steer's door).
+    if (deps.provenance && hasFooterShapedLine(prompt)) {
+      return res.status(400).json({ error: 'footer_line_refused', reasonCopy: FOOTER_LINE_REFUSED_COPY })
+    }
+
+    // 11/07 (Control Web attach): files with the words, as media-store ids. Absent is the old row, byte for byte.
+    const attach = parseTurnAttachmentIds(body.attachmentIds)
+    if (!attach.ok) return res.status(400).json({ error: 'invalid_request', reason: 'invalid_attachments' })
+
     // 6.78.0: `mode: 'steer'` asks for the running turn itself (COS_SESSION_STEER). Off, the
     // field is ignored exactly as a 6.77 server ignores it.
     const steerOn = sessionSteerEnabled()
-    const wantSteer = steerOn && body.mode === 'steer'
+    // A steer goes through the session's peer inbox, which carries words only: a turn with files always parks.
+    const wantSteer = steerOn && body.mode === 'steer' && attach.ids.length === 0
     const fallbackNone = wantSteer && body.fallback === 'none'
 
     // 6.78.0: REPLAY BEFORE THE GATE. A key this queue already holds answers with what that
@@ -584,6 +643,14 @@ export function createThreadTurnQueueRouter(deps: ThreadTurnQueueDeps): Router {
       }
     }
 
+    // G2 authority Tier 1 (6.99.29): who parked these words, judged on this request's own socket,
+    // token and cookie. A turn id this server already holds a record for, for a different turn, is
+    // never reused (QA 6.99.29: it would overwrite that record).
+    let verdict = deps.provenance ? deps.provenance.originOf(req) : null
+    if (deps.provenance && verdict && deps.provenance.reusesTurnId(clientTurnId, { prompt, verdict, provider, sessionId: threadId })) {
+      return res.status(409).json({ error: 'turn_id_in_use', reasonCopy: TURN_ID_IN_USE_COPY })
+    }
+
     // THE GATE DECIDES WHETHER PARKING IS EVEN HONEST. A structural refusal can never
     // clear, and telling someone their turn is queued when it can never run is worse
     // than refusing it. An attachable thread is not queued either -- it is sent now,
@@ -601,6 +668,14 @@ export function createThreadTurnQueueRouter(deps: ThreadTurnQueueDeps): Router {
       return res.status(423).json({ error: gate.reason ?? 'probe_failed', queueable: false })
     }
 
+    // 11/07: every file must be readable now, and is kept past the 4 hour staged TTL while the turn waits. A file
+    // that is gone refuses the park here, where the words are still in the box, never later at the drain.
+    if (attach.ids.length > 0) {
+      const store = deps.turnAttachmentStore ?? defaultTurnAttachmentStore()
+      const kept = await keepTurnAttachments(attach.ids, `session-turn:${clientTurnId}`, store)
+      if (!kept.ok) return res.status(409).json({ error: kept.code, attachmentError: kept.code, reasonCopy: TURN_ATTACHMENT_COPY[kept.code] })
+    }
+
     const now = deps.now()
     const queue = readQueue(provider, threadId, now)
     const turn: QueuedThreadTurn = {
@@ -608,20 +683,33 @@ export function createThreadTurnQueueRouter(deps: ThreadTurnQueueDeps): Router {
       queuedAt: now, status: 'waiting', attempts: 0,
       // 6.62.0 /qa (Q3): the acknowledgement travels with the row to its drain.
       ...(continueNoteAcknowledged(req.headers[CONTINUE_NOTE_HEADER]) ? { continueNoteAck: true as const } : {}),
+      ...(attach.ids.length > 0 ? { attachmentIds: attach.ids } : {}),
+    }
+
+    // Held in memory with the words' hash, sealed to this provider, thread and these files (each id
+    // with its content hash), so the drain can carry it (QUEUED_ORIGIN_TTL_MS at most).
+    if (deps.provenance && verdict) {
+      const sealed = await sealFiles(attach.ids, verdict, deps.turnAttachmentStore)
+      verdict = sealed.verdict
+      deps.provenance.noteQueued(provider, threadId, clientTurnId, prompt, verdict, sealed.attachments)
     }
 
     let steerFallback: string | null = null
     if (wantSteer) {
       const availability = steerAvailabilityFor(deps, provider, threadId, gate.reason)
-      if (availability.available) return steerTurn(req, res, deps, turn, queue, gate.reason, fallbackNone)
+      if (availability.available) return steerTurn(req, res, deps, turn, queue, gate.reason, fallbackNone, verdict)
       if (fallbackNone) return res.status(409).json({ error: 'steer_unavailable', reason: availability.reason })
       steerFallback = availability.reason
     }
 
     const admitted = admitToQueue(queue, turn)
-    if (!admitted.ok) return res.status(409).json({ error: admitted.reason })
+    if (!admitted.ok) {
+      deps.provenance?.forgetQueued(provider, threadId, clientTurnId)
+      return res.status(409).json({ error: admitted.reason })
+    }
 
     writeQueue(provider, threadId, admitted.queue)
+    if (deps.provenance && verdict) deps.provenance.record({ turnId: clientTurnId, prompt, verdict, provider, sessionId: threadId, via: 'queue' })
     return res.status(202).json({
       queued: true,
       clientTurnId,
@@ -639,7 +727,7 @@ export function createThreadTurnQueueRouter(deps: ThreadTurnQueueDeps): Router {
   // writing it, so two taps (lens and phone) in the same tick cannot both pass the check.
   // The new row is admitted even when the thread is free: the drain sends it through the
   // ordinary front door, with every gate.
-  router.post('/agent-sessions/:provider/:threadId/queued-turns/:clientTurnId/resend', (req: Request, res: Response, next) => {
+  router.post('/agent-sessions/:provider/:threadId/queued-turns/:clientTurnId/resend', async (req: Request, res: Response, next) => {
     // Off: not a route at all, exactly as on 6.77 (a client reads the 404 as "update the server").
     if (!queueResendEnabled()) return next()
     res.set('Cache-Control', 'private, no-store')
@@ -664,6 +752,14 @@ export function createThreadTurnQueueRouter(deps: ThreadTurnQueueDeps): Router {
         : { clientTurnId: original.resentAs, resendOf: original.clientTurnId, replayed: true })
     }
     if (original.status !== 'refused' && original.status !== 'expired') return res.status(409).json({ error: 'not_resendable' })
+    // G2 authority Tier 1 (QA 6.99.29): the copy's words go to a session, so they meet the footer
+    // rule like any typed words, and its id may not be one this server already holds a record for.
+    if (deps.provenance && hasFooterShapedLine(original.prompt)) {
+      return res.status(400).json({ error: 'footer_line_refused', reasonCopy: FOOTER_LINE_REFUSED_COPY })
+    }
+    if (deps.provenance && deps.provenance.holds(newId)) return res.status(409).json({ error: 'turn_id_in_use', reasonCopy: TURN_ID_IN_USE_COPY })
+    // Judged now, from THIS request (Codex re-audit of 910eb90, P1): never inherited from the row.
+    const resendVerdict = deps.provenance ? deps.provenance.resendVerdict(req) : null
     // "May not have been sent": a second copy is possible, so the person has to have been told.
     if (original.deliveryState === 'unknown' && body.acknowledge !== 'may_duplicate') {
       return res.status(409).json({ error: 'acknowledge_required' })
@@ -673,12 +769,26 @@ export function createThreadTurnQueueRouter(deps: ThreadTurnQueueDeps): Router {
       prompt: original.prompt,
       queuedAt: now, status: 'waiting', attempts: 0,
       ...(original.continueNoteAck === true ? { continueNoteAck: true as const } : {}),
+      // 11/07: Send again sends the same files; the turns route refuses it there if one has gone.
+      ...(Array.isArray(original.attachmentIds) && original.attachmentIds.length > 0 ? { attachmentIds: [...original.attachmentIds] } : {}),
       resendOf: original.clientTurnId,
     }
     const admitted = admitToQueue(queue, copy)
     if (!admitted.ok) return res.status(409).json({ error: admitted.reason })
     original.resentAs = newId
     writeQueue(provider, threadId, admitted.queue)
+    // G2 authority Tier 1 (Codex re-audit of 910eb90, P1): the row's words and files are mutable, so
+    // the copy NEVER inherits the original row's authority (that let a local caller change a refused
+    // G2 row and mint a new vouched turn from it). It carries the origin of the request that sent it
+    // again: a verified glasses or phone client is vouched on its own socket and instance, like any
+    // new turn; anyone else is recorded unvouched ('resend_not_reverified'), with no footer. The
+    // original id is kept only as the record's `resendOf` annotation.
+    if (deps.provenance && resendVerdict) {
+      // After the write: the read-modify-write above stays one synchronous step. Sealed to the copy's files.
+      const sealed = await sealFiles(copy.attachmentIds, resendVerdict, deps.turnAttachmentStore)
+      deps.provenance.noteQueued(provider, threadId, newId, copy.prompt, sealed.verdict, sealed.attachments)
+      deps.provenance.record({ turnId: newId, prompt: copy.prompt, verdict: sealed.verdict, provider, sessionId: threadId, via: 'queue-resend', resendOf: original.clientTurnId })
+    }
     console.log(`[thread-turn-queue] resend provider=${provider} from=${original.clientTurnId} as=${newId} unknown=${original.deliveryState === 'unknown'}`)
     return res.status(200).json(publicRow(copy, queuePosition(admitted.queue, newId)))
   })
@@ -693,7 +803,9 @@ export function createThreadTurnQueueRouter(deps: ThreadTurnQueueDeps): Router {
     if (provider === 'codex') {
       try {
         native = (await (deps.nativeQueue ?? nativeQueueControl).list(threadId)).map((row, position) => {
-          const text = plainQueueText(row)
+          // G2 authority Tier 1: the lens and the web show (and edit) the words, never the verify footer.
+          const plain = plainQueueText(row)
+          const text = plain === null ? null : stripG2TurnFooter(plain).text
           return { clientTurnId: `codex-native:${row.id}`, status: 'waiting', position, queuedAt: 0,
             attempts: 0, preview: text?.slice(0, 80) ?? 'Message with attachments · manage in Codex',
             ...(text !== null ? { prompt: text } : {}), editable: text !== null, owner: 'codex' }
@@ -711,17 +823,44 @@ export function createThreadTurnQueueRouter(deps: ThreadTurnQueueDeps): Router {
     const provider = String(req.params.provider), threadId = String(req.params.threadId), id = String(req.params.clientTurnId)
     const prompt = req.body?.prompt
     if (typeof prompt !== 'string' || !prompt.trim() || prompt.length > DEFAULT_MAX_PROMPT_CHARS) return res.status(400).json({ error: 'invalid_prompt' })
+    // G2 authority Tier 1 (QA 6.99.29): an edit is typed words like any other.
+    if (deps.provenance && hasFooterShapedLine(prompt)) {
+      return res.status(400).json({ error: 'footer_line_refused', reasonCopy: FOOTER_LINE_REFUSED_COPY })
+    }
     if (provider === 'codex' && id.startsWith('codex-native:')) {
       try {
-        await (deps.nativeQueue ?? nativeQueueControl).update(threadId, id.slice(13), prompt)
+        // G2 authority Tier 1: the edit replaces the text in the Codex app's own queue, so it is a
+        // delivery of its own, under an id minted here (the native row id is not ours).
+        let sent = prompt
+        if (deps.provenance) {
+          const verdict = deps.provenance.originOf(req)
+          const editId = `cnedit-${randomBytes(12).toString('hex')}`
+          sent = deps.provenance.footed(prompt, editId, verdict, provider)
+          deps.provenance.record({ turnId: editId, prompt, verdict, provider, sessionId: threadId, via: 'codex-native-edit' })
+        }
+        await (deps.nativeQueue ?? nativeQueueControl).update(threadId, id.slice(13), sent)
         return res.json({ updated: true })
       } catch { return res.status(409).json({ error: 'queue_edit_unconfirmed' }) }
     }
     const queue = readQueue(provider, threadId, deps.now())
     const row = queue.find(t => t.clientTurnId === id)
     if (!row || row.status !== 'waiting') return res.status(409).json({ error: 'already_delivering' })
+    // The words are now whoever edited them: their origin replaces the parked one. Only over a record
+    // that is still parked (QA 6.99.29): a row written into the queue file under a delivered turn's id
+    // cannot be edited over that turn's record.
+    const verdict = deps.provenance ? deps.provenance.originOf(req) : null
+    if (deps.provenance && verdict && deps.provenance.reusesTurnId(id, { prompt, verdict, provider, sessionId: threadId }, { continues: true })) {
+      return res.status(409).json({ error: 'turn_id_in_use', reasonCopy: TURN_ID_IN_USE_COPY })
+    }
     row.prompt = prompt
     writeQueue(provider, threadId, queue)
+    if (deps.provenance && verdict) {
+      // Sealed to the row's files as they are now (an edit changes only the words).
+      const sealed = await sealFiles(row.attachmentIds, verdict, deps.turnAttachmentStore)
+      deps.provenance.noteQueued(provider, threadId, id, prompt, sealed.verdict, sealed.attachments)
+      // The queue's own row, re-judged: it continues the record parked under this id.
+      deps.provenance.record({ turnId: id, prompt, verdict: sealed.verdict, provider, sessionId: threadId, via: 'queue-edit', continues: true })
+    }
     return res.json({ updated: true })
   })
 
@@ -748,6 +887,7 @@ export function createThreadTurnQueueRouter(deps: ThreadTurnQueueDeps): Router {
       row.status = 'cancelled'
       row.settledAt = now
       writeQueue(provider, threadId, queue)
+      deps.provenance?.forgetQueued(provider, threadId, clientTurnId)
     }
     return res.json({ cancelled: true, clientTurnId, status: row.status })
   })