@gotcos/glasses-server 6.99.33 → 7.0.18

package/server/lib/disk-io-meter.ts

@@ -0,0 +1,202 @@
+/**
+ * Opt-in per-path disk I/O meter (S1, 2026-11-09). COS_DISK_IO_METER=1 turns it on; default off.
+ *
+ * Why: macOS filed 12 "disk writes" resource reports against the server's node process
+ * (2.1 to 8.6 GB over 0.5 to 6 h) with JavaScript frames unsymbolicated, so no report could
+ * name a file. Measured from outside on 11/09 (proc_pid_rusage, idle, no meeting): 111.7 KB/s
+ * written and about 1.8 to 5 MB/s read. The largest writer (work-reviews/reviews.json) is fixed;
+ * the rest could not be attributed without root. With the meter on, the server logs once an
+ * hour which paths took the bytes:
+ *
+ *   [disk-io] 60 min: wrote 152.3 MB in 1,204 writes, read 3.1 GB in 9,880 reads; top writes: ...
+ *
+ * How: wraps the synchronous and promise write/read entry points of node:fs and
+ * node:fs/promises, then calls syncBuiltinESMExports() so modules that already imported
+ * named bindings see the wrappers. Each wrapper calls the original and only counts bytes;
+ * errors and return values pass through unchanged. Streams (createWriteStream) are not
+ * counted. Paths are folded so ids and temp suffixes group: "~/.cos-glasses/data/active-sessions/*.json".
+ */
+import fs from 'node:fs'
+import fsPromises from 'node:fs/promises'
+import { homedir } from 'node:os'
+import { syncBuiltinESMExports } from 'node:module'
+
+interface Tally { bytes: number; ops: number }
+interface Window { startedAt: number; writes: Map<string, Tally>; reads: Map<string, Tally> }
+
+let windowState: Window | null = null
+let restore: (() => void) | null = null
+let reportTimer: ReturnType<typeof setInterval> | null = null
+const fdPaths = new Map<number, string>()
+/** Node's own fs functions call each other (appendFileSync calls writeFileSync, which calls
+ * openSync and writeSync). Only the outermost wrapped call counts. */
+let depth = 0
+function nested<T>(run: () => T): T {
+  depth++
+  try { return run() } finally { depth-- }
+}
+
+const HOME = homedir()
+
+/** Group a path: home as ~, temp suffixes dropped, id-like segments as *. */
+export function foldPath(path: string): string {
+  let p = path.startsWith(HOME) ? `~${path.slice(HOME.length)}` : path
+  p = p.replace(/(\.\d+\.[0-9a-f]+)?\.tmp$/i, '')           // atomic-write temp names
+  p = p.replace(/\.corrupt-\d+$/, '.corrupt-*')
+  p = p.replace(/(^|[/._-])[0-9a-f]{8,}(?=$|[/._-])/gi, '$1*') // hashes, uuids, hex ids
+  p = p.replace(/(^|[/._-])\d{6,}(?=$|[/._-])/g, '$1*')      // epoch ms, pids in names
+  p = p.replace(/meeting_\*_[a-z0-9]+/gi, 'meeting_*')
+  return p
+}
+
+function byteLength(data: unknown, encoding?: unknown): number {
+  if (typeof data === 'string') return Buffer.byteLength(data, typeof encoding === 'string' ? encoding as BufferEncoding : 'utf8')
+  if (data && typeof (data as ArrayBufferView).byteLength === 'number') return (data as ArrayBufferView).byteLength
+  return 0
+}
+
+function keyFor(target: unknown): string {
+  if (typeof target === 'number') return fdPaths.get(target) ?? `fd:${target}`
+  if (typeof target === 'string') return foldPath(target)
+  if (target instanceof URL) return foldPath(target.pathname)
+  if (Buffer.isBuffer(target)) return foldPath(target.toString())
+  if (target && typeof (target as { fd?: unknown }).fd === 'number') return fdPaths.get((target as { fd: number }).fd) ?? 'filehandle'
+  return 'unknown'
+}
+
+function count(kind: 'writes' | 'reads', target: unknown, bytes: number, outer: boolean): void {
+  if (!windowState || bytes <= 0 || !outer) return
+  const map = windowState[kind]
+  const key = keyFor(target)
+  const tally = map.get(key)
+  if (tally) { tally.bytes += bytes; tally.ops++ } else map.set(key, { bytes, ops: 1 })
+}
+
+export interface DiskIoReport {
+  windowMs: number
+  wroteBytes: number; writeOps: number
+  readBytes: number; readOps: number
+  topWrites: Array<{ path: string; bytes: number; ops: number }>
+  topReads: Array<{ path: string; bytes: number; ops: number }>
+}
+
+/** The current window's totals (diagnostics, tests). Null when the meter is off. */
+export function diskIoSnapshot(top = 10): DiskIoReport | null {
+  if (!windowState) return null
+  const sum = (m: Map<string, Tally>) => [...m.values()].reduce((a, t) => ({ bytes: a.bytes + t.bytes, ops: a.ops + t.ops }), { bytes: 0, ops: 0 })
+  const rank = (m: Map<string, Tally>) => [...m.entries()].sort((a, b) => b[1].bytes - a[1].bytes).slice(0, top)
+    .map(([path, t]) => ({ path, bytes: t.bytes, ops: t.ops }))
+  const w = sum(windowState.writes), r = sum(windowState.reads)
+  return {
+    windowMs: Date.now() - windowState.startedAt,
+    wroteBytes: w.bytes, writeOps: w.ops, readBytes: r.bytes, readOps: r.ops,
+    topWrites: rank(windowState.writes), topReads: rank(windowState.reads),
+  }
+}
+
+function mb(bytes: number): string {
+  return bytes >= 1e9 ? `${(bytes / 1e9).toFixed(2)} GB` : `${(bytes / 1e6).toFixed(1)} MB`
+}
+
+/** One log line for the window, then start a new window. */
+export function reportDiskIo(log: (line: string) => void = line => console.log(line)): DiskIoReport | null {
+  const report = diskIoSnapshot(8)
+  if (!report || !windowState) return null
+  const fmt = (rows: DiskIoReport['topWrites']) => rows.map(r => `${r.path} ${mb(r.bytes)} (${r.ops})`).join('; ') || 'none'
+  log(`[disk-io] ${Math.round(report.windowMs / 60_000)} min: wrote ${mb(report.wroteBytes)} in ${report.writeOps} writes, `
+    + `read ${mb(report.readBytes)} in ${report.readOps} reads; top writes: ${fmt(report.topWrites)}; top reads: ${fmt(report.topReads)}`)
+  windowState = { startedAt: Date.now(), writes: new Map(), reads: new Map() }
+  return report
+}
+
+export function diskIoMeterRequested(env: NodeJS.ProcessEnv = process.env): boolean {
+  return env.COS_DISK_IO_METER === '1'
+}
+
+/** Install the wrappers. Idempotent. Returns false when already installed. */
+export function installDiskIoMeter(options: { reportEveryMs?: number } = {}): boolean {
+  if (restore) return false
+  windowState = { startedAt: Date.now(), writes: new Map(), reads: new Map() }
+  const f = fs as unknown as Record<string, any>
+  const p = fsPromises as unknown as Record<string, any>
+  const saved: Array<[Record<string, any>, string, unknown]> = []
+  const wrap = (obj: Record<string, any>, name: string, make: (orig: any) => any) => {
+    const orig = obj[name]
+    if (typeof orig !== 'function') return
+    saved.push([obj, name, orig])
+    obj[name] = make(orig)
+  }
+  wrap(f, 'openSync', orig => function (this: unknown, path: unknown, ...rest: unknown[]) {
+    const fd = nested(() => orig.call(this, path, ...rest))
+    if (typeof fd === 'number' && (typeof path === 'string' || path instanceof URL)) fdPaths.set(fd, keyFor(path))
+    return fd
+  })
+  wrap(f, 'closeSync', orig => function (this: unknown, fd: number, ...rest: unknown[]) {
+    fdPaths.delete(fd)
+    return orig.call(this, fd, ...rest)
+  })
+  wrap(f, 'writeFileSync', orig => function (this: unknown, target: unknown, data: unknown, options?: unknown) {
+    const outer = depth === 0
+    const result = nested(() => orig.call(this, target, data, options))
+    count('writes', target, byteLength(data, typeof options === 'string' ? options : (options as { encoding?: unknown } | undefined)?.encoding), outer)
+    return result
+  })
+  wrap(f, 'appendFileSync', orig => function (this: unknown, target: unknown, data: unknown, options?: unknown) {
+    const outer = depth === 0
+    const result = nested(() => orig.call(this, target, data, options))
+    count('writes', target, byteLength(data, typeof options === 'string' ? options : (options as { encoding?: unknown } | undefined)?.encoding), outer)
+    return result
+  })
+  wrap(f, 'writeSync', orig => function (this: unknown, fd: number, ...rest: unknown[]) {
+    const outer = depth === 0
+    const written = nested(() => orig.call(this, fd, ...rest))
+    count('writes', fd, typeof written === 'number' ? written : 0, outer)
+    return written
+  })
+  wrap(f, 'readFileSync', orig => function (this: unknown, target: unknown, ...rest: unknown[]) {
+    const outer = depth === 0
+    const result = nested(() => orig.call(this, target, ...rest))
+    count('reads', target, byteLength(result), outer)
+    return result
+  })
+  wrap(f, 'readSync', orig => function (this: unknown, fd: number, ...rest: unknown[]) {
+    const outer = depth === 0
+    const read = nested(() => orig.call(this, fd, ...rest))
+    count('reads', fd, typeof read === 'number' ? read : 0, outer)
+    return read
+  })
+  for (const name of ['writeFile', 'appendFile'] as const) {
+    wrap(p, name, orig => async function (this: unknown, target: unknown, data: unknown, options?: unknown) {
+      const result = await orig.call(this, target, data, options)
+      count('writes', target, byteLength(data, typeof options === 'string' ? options : (options as { encoding?: unknown } | undefined)?.encoding), true)
+      return result
+    })
+  }
+  wrap(p, 'readFile', orig => async function (this: unknown, target: unknown, ...rest: unknown[]) {
+    const result = await orig.call(this, target, ...rest)
+    count('reads', target, byteLength(result), true)
+    return result
+  })
+  syncBuiltinESMExports()
+  restore = () => {
+    for (const [obj, name, orig] of saved) obj[name] = orig
+    syncBuiltinESMExports()
+  }
+  const every = options.reportEveryMs ?? 60 * 60_000
+  if (every > 0) {
+    reportTimer = setInterval(() => { reportDiskIo() }, every)
+    reportTimer.unref?.()
+  }
+  console.log(`[disk-io] meter on (COS_DISK_IO_METER=1): ${every > 0 ? `one line every ${Math.round(every / 60_000)} min` : 'reports on request only'}`)
+  return true
+}
+
+/** Remove the wrappers (tests, and a clean shutdown). */
+export function uninstallDiskIoMeter(): void {
+  if (reportTimer) clearInterval(reportTimer)
+  reportTimer = null
+  restore?.()
+  restore = null
+  windowState = null
+  fdPaths.clear()
+}

package/server/lib/drop-p2-runtime.ts

@@ -38,7 +38,7 @@ export interface DropP2Deps {
   timezone: () => string
   now?: () => number
   /** The next calendar event; undefined when the calendar could not be read. */
-  nextEvent?: () => Promise<{ title?: unknown; time?: unknown } | null | undefined>
+  nextEvent?: () => Promise<{ title?: unknown; time?: unknown; occurrence?: unknown } | null | undefined>
   /** Open Work intake items; undefined when the store is not available. */
   intakeOpen?: () => IntakeRow[] | undefined
   /** operations/scripts, for the thread and signal caches (read only; no script is run). */

package/server/lib/drop-service.ts

@@ -97,7 +97,21 @@ const filesLine = (n: number): string => n === 1 ? 'The file stays here in the C
 const nextAsk = (drop: DropRecord): DropNextAsk =>
   ({ kind: 'ask', prompt: drop.text, ...(drop.attachments?.length ? { attachmentIds: drop.attachments.map(a => a.id) } : {}) })
 /** One item that waits on an answer: a live question, or a live item marked needsReply (6.99.10). */
-export const isWaiting = (i: FeedItem): boolean => i.state === 'live' && (i.kind === 'question' || i.needsReply === true)
+/**
+ * 7.0.9 (Miles 11/08, "Expire after 7 days"): an item that asks for a reply stops waiting on you this long after it
+ * was asked (its own createdAt, never when it was read). It is not answered or closed: it moves to the chat's older
+ * questions (GET /api/inbox/archive), where it can still be read and answered, and answering it there clears it.
+ * The one rule for every count: `asked`, the chat part of `waiting`, `archived`, and the web's split.
+ */
+export const WAITING_EXPIRY_DAYS = 7
+export const WAITING_EXPIRY_MS = WAITING_EXPIRY_DAYS * 86_400_000
+const asksForReply = (i: FeedItem): boolean => i.state === 'live' && (i.kind === 'question' || i.needsReply === true)
+/** How long ago it was asked, in ms; an unreadable time reads as just asked (it keeps waiting rather than vanish). */
+const askedAgo = (i: FeedItem, nowMs: number): number => { const t = Date.parse(i.createdAt); return Number.isFinite(t) ? nowMs - t : 0 }
+export const isWaiting = (i: FeedItem, nowMs: number = Date.now()): boolean => asksForReply(i) && askedAgo(i, nowMs) < WAITING_EXPIRY_MS
+/** Asks for a reply, but was asked WAITING_EXPIRY_DAYS or more ago: shown under older questions, never counted. */
+export const isArchivedQuestion = (i: FeedItem, nowMs: number = Date.now()): boolean => asksForReply(i) && askedAgo(i, nowMs) >= WAITING_EXPIRY_MS
+export const ARCHIVE_LIST_MAX = 200
 const A = {
   undo: { id: 'undo', label: 'Undo' }, move: { id: 'move', label: 'Move' },
   openCard: { id: 'open_card', label: 'Open card' }, openThread: { id: 'open_thread', label: 'Open thread' },
@@ -559,14 +573,24 @@ export class DropService {
    * waits on an answer from you, and clears only when it is answered, done or dismissed: every live question COS asked
    * (a router ask), every live item marked `needsReply` (a follow-up that needs a decision, a ping that asks), plus
    * `yourMove`, the Work items in Your move, when the caller could count them. Always a whole number, never negative.
+   *
+   * 7.0.9 (Miles 11/08: the web rail said 99+ and the pinned row "286 waiting" for things he had already seen): two
+   * more fields, so a client can say what each number is. `asked` is the chat's own part of `waiting`, the live
+   * questions and needsReply items, which truly wait on a reply in this chat. `yourMove` is the Work part (null when
+   * it could not be counted). `waiting` keeps its 6.99.10 meaning for COS Control, which reads it by that name.
    */
-  summary(extra: { yourMove?: number | null } = {}): { unread: number; waiting: number; lastLine: string; lastAt: string | null; version: number } {
+  summary(extra: { yourMove?: number | null } = {}): { unread: number; waiting: number; asked: number; archived: number; waitingExpiryDays: number; yourMove: number | null; lastLine: string; lastAt: string | null; version: number } {
     const items = this.deps.feed.list()
+    const nowMs = this.now().getTime()
     const unread = items.filter(i => i.readAt === null && (i.kind === 'ping' || i.kind === 'followup' || i.kind === 'question')).length
-    const asked = items.filter(i => isWaiting(i)).length
-    const work = typeof extra.yourMove === 'number' && Number.isSafeInteger(extra.yourMove) && extra.yourMove > 0 ? extra.yourMove : 0
+    // 7.0.9: a question asked WAITING_EXPIRY_DAYS ago or more is in older questions, out of `asked` and so out of the
+    // chat part of `waiting`. Work's part of `waiting` (yourMove) is untouched.
+    const asked = items.filter(i => isWaiting(i, nowMs)).length
+    const archived = items.filter(i => isArchivedQuestion(i, nowMs)).length
+    const counted = typeof extra.yourMove === 'number' && Number.isSafeInteger(extra.yourMove) && extra.yourMove >= 0
+    const work = counted && (extra.yourMove as number) > 0 ? extra.yourMove as number : 0
     const last = items[items.length - 1]
-    return { unread, waiting: asked + work, lastLine: last ? short(pinLine(last), 120) : '', lastAt: last?.createdAt ?? null, version: this.deps.feed.version() }
+    return { unread, waiting: asked + work, asked, archived, waitingExpiryDays: WAITING_EXPIRY_DAYS, yourMove: counted ? extra.yourMove as number : null, lastLine: last ? short(pinLine(last), 120) : '', lastAt: last?.createdAt ?? null, version: this.deps.feed.version() }
   }
 
   /**
@@ -574,7 +598,7 @@ export class DropService {
    * its buttons. Only an item marked `needsReply` can be dismissed; a question is answered by one of its choices
    * (Just a note among them). Idempotent: a second dismiss answers the same.
    */
-  dismiss(itemId: string): { unread: number; waiting: number; version: number } {
+  dismiss(itemId: string): { unread: number; waiting: number; asked: number; version: number } {
     const item = this.deps.feed.get(itemId)
     if (!item) throw new DropError('feed_item_not_found', 404)
     if (!item.needsReply) throw new DropError('not_dismissable', 409, 'Only something that waits on you can be dismissed.')
@@ -583,11 +607,21 @@ export class DropService {
       this.deps.feed.update(new Set([item.id]), i => ({ ...i, state: 'done', actions: [], readAt: i.readAt ?? at }))
     }
     const s = this.summary()
-    return { unread: s.unread, waiting: s.waiting, version: s.version }
+    return { unread: s.unread, waiting: s.waiting, asked: s.asked, version: s.version }
+  }
+
+  /**
+   * 7.0.9: the older questions, newest first: what still asks for a reply but was asked WAITING_EXPIRY_DAYS or more
+   * ago. Each answers exactly as in the chat (POST /api/inbox/action), and answering it takes it off this list.
+   */
+  archive(): { items: Array<FeedItem & { archived: true }>; total: number; waitingExpiryDays: number; version: number } {
+    const nowMs = this.now().getTime()
+    const all = this.deps.feed.list().filter(i => isArchivedQuestion(i, nowMs)).reverse()
+    return { items: all.slice(0, ARCHIVE_LIST_MAX).map(i => ({ ...i, archived: true as const })), total: all.length, waitingExpiryDays: WAITING_EXPIRY_DAYS, version: this.deps.feed.version() }
   }
 
-  /** The chat, oldest first. `after` is an item id: only items after it. */
-  feed(options: { after?: string; limit?: number } = {}): { items: FeedItem[]; version: number; more: boolean } {
+  /** The chat, oldest first. `after` is an item id: only items after it. 7.0.9: an older question carries `archived: true`. */
+  feed(options: { after?: string; limit?: number } = {}): { items: Array<FeedItem & { archived?: true }>; version: number; more: boolean } {
     const items = this.deps.feed.list()
     let start = 0
     if (options.after) {
@@ -599,7 +633,8 @@ export class DropService {
     const rest = items.slice(start)
     // Without `after` the newest page; with it, the next page forward.
     const page = options.after ? rest.slice(0, limit) : rest.slice(-limit)
-    return { items: page, version: this.deps.feed.version(), more: options.after ? rest.length > limit : rest.length > limit }
+    const nowMs = this.now().getTime()
+    return { items: page.map(i => isArchivedQuestion(i, nowMs) ? { ...i, archived: true as const } : i), version: this.deps.feed.version(), more: options.after ? rest.length > limit : rest.length > limit }
   }
 
   /** The drop a chat item belongs to. */
@@ -609,7 +644,7 @@ export class DropService {
     return item.threadId
   }
 
-  markRead(through: string): { unread: number; waiting: number; version: number } {
+  markRead(through: string): { unread: number; waiting: number; asked: number; version: number } {
     const items = this.deps.feed.list()
     const index = items.findIndex(i => i.id === through)
     if (index < 0) throw new DropError('feed_item_not_found', 404)
@@ -618,7 +653,7 @@ export class DropService {
     if (ids.size) this.deps.feed.update(ids, item => ({ ...item, readAt: at }))
     const s = this.summary()
     // Opening the chat clears unread only: what waits on you stays until it is answered, done or dismissed.
-    return { unread: s.unread, waiting: s.waiting, version: s.version }
+    return { unread: s.unread, waiting: s.waiting, asked: s.asked, version: s.version }
   }
 
   /** History (plan section 6), P1: words over drop text and link labels, with kind and status filters, newest first. */

package/server/lib/drop-store.ts

@@ -15,6 +15,8 @@ import { existsSync, lstatSync, mkdirSync, readFileSync } from 'node:fs'
 import { join, resolve } from 'node:path'
 import { durableAtomicWriteFileSync } from './atomic-fs.js'
 import { acquireServerInstanceLock, type ServerInstanceLock } from './server-instance-lock.js'
+import { parsePrepOccurrence } from './prep-store.js'
+import type { PrepOccurrence } from '../../shared/prep.js'
 
 export class DropStoreError extends Error {
   constructor(readonly code: string, readonly status = 409) { super(code) }
@@ -81,9 +83,10 @@ export const FEED_KINDS = ['drop', 'receipt', 'question', 'followup', 'ping', 'a
 export type FeedKind = typeof FEED_KINDS[number]
 /**
  * 6.99.19: the prep card's "Prep me" may carry the event it is about, so a client can open a Prep draft for it
- * (ping-sources.ts prepCandidates). Display fields only; occurrence is null until the calendar sends event ids.
+ * (ping-sources.ts prepCandidates). Display fields plus, since the EventKit calendar source (PH plan P1), the event's
+ * occurrence identity when the calendar gave one. Null when it did not (the starter-kit bridge sends no event ids).
  */
-export interface FeedActionPrep { title: string; startsAt: string; occurrence: null }
+export interface FeedActionPrep { title: string; startsAt: string; occurrence: PrepOccurrence | null }
 export interface FeedAction { id: string; label: string; prep?: FeedActionPrep }
 export interface FeedItem {
   id: string
@@ -245,8 +248,11 @@ export function parseDropRecord(raw: unknown): DropRecord {
 function feedActionPrep(raw: unknown): FeedActionPrep | undefined {
   if (!record(raw)) return undefined
   const title = str(raw.title, 300), startsAt = typeof raw.startsAt === 'string' && raw.startsAt.length <= 64 && Number.isFinite(Date.parse(raw.startsAt)) ? raw.startsAt : null
-  if (!title || !startsAt || raw.occurrence !== null) return undefined
-  return { title, startsAt, occurrence: null }
+  if (!title || !startsAt) return undefined
+  // Older rows carry occurrence: null. A present but invalid identity drops to null, never a guess.
+  let occurrence: PrepOccurrence | null = null
+  if (raw.occurrence != null) { try { occurrence = parsePrepOccurrence(raw.occurrence) } catch { occurrence = null } }
+  return { title, startsAt, occurrence }
 }
 
 export function parseFeedItem(raw: unknown): FeedItem {
@@ -381,6 +387,13 @@ export class InboxFeedStore {
   private items: FeedItem[] = []
   private quarantined: unknown[] = []
   private versionNo = 0
+  /**
+   * 7.0.9 (Miles 11/08, "99 plus messages, despite the fact that I've already seen all of those"): the moment this
+   * feed started counting unread as net new. Every item still unread when the first build with it opened the file is
+   * marked read once, at that open, so the rail never counts what was already on screen. A file this build wrote
+   * carries it; a file without it (an older build wrote it last) is migrated on open.
+   */
+  private readFloorAt: string
   private readonly path: string
   private readonly lock: ServerInstanceLock
   private closed = false
@@ -394,6 +407,19 @@ export class InboxFeedStore {
       this.versionNo = Number.isSafeInteger(v) && (v as number) >= 0 ? v as number : this.items.length
     } catch (e) { this.close(); throw e }
     if (this.quarantined.length) console.warn(`[inbox] ${this.quarantined.length} unreadable feed item(s) set aside`)
+    const floor = opened.journal?.readFloorAt
+    this.readFloorAt = this.now().toISOString()
+    if (typeof floor === 'string' && Number.isFinite(Date.parse(floor))) this.readFloorAt = floor
+    else if (opened.journal) this.migrateReadFloor()
+  }
+  /** When unread started meaning net new on this feed (see readFloorAt). */
+  readFloor(): string { return this.readFloorAt }
+  /** Once per file: what was unread before this build opened it had already been shown, so it reads as read now. */
+  private migrateReadFloor(): void {
+    const at = this.readFloorAt
+    const next = this.items.map(i => i.readAt === null ? { ...i, readAt: at } : i)
+    // A file that cannot be written now still opens; the next open tries again. Unread never blocks the chat.
+    try { this.write(next, 1) } catch (e) { console.warn(`[inbox] read floor not written: ${(e as Error).message}`) }
   }
   /** Oldest first, as a chat reads. */
   list(): FeedItem[] { return structuredClone(this.items) }
@@ -449,7 +475,7 @@ export class InboxFeedStore {
     if (kept.length > DROP_LIMITS.feed) throw new DropStoreError('inbox_store_full', 503)
     const version = this.versionNo + bump
     // Never write a file the reader would refuse: the oldest COS lines (receipts, answers, pings) go first.
-    const serialize = () => JSON.stringify({ version: 1, feedVersion: version, items: kept, quarantined: this.quarantined }) + '\n'
+    const serialize = () => JSON.stringify({ version: 1, feedVersion: version, readFloorAt: this.readFloorAt, items: kept, quarantined: this.quarantined }) + '\n'
     let body = serialize()
     while (Buffer.byteLength(body) > this.maxBytes) {
       const oldest = kept.findIndex(i => i.kind !== 'drop')

package/server/lib/event-loop-stall.ts

@@ -0,0 +1,62 @@
+/**
+ * Event-loop stall detector (S1, 2026-11-09). Logs only when the server's event loop was blocked.
+ *
+ * Why: COS Control's dictation asks GET /api/transcribe/capabilities with a 5 s timeout. Six
+ * dictations (11/03 13:01 CST, 11/04 15:32, and four between 18:12 and 18:32 on 11/04) failed at
+ * 5,052 to 5,072 ms with no answer, logged by Control as "refused:unknown". That route is a
+ * constant JSON object, so a 5 s silence means the process did not get to it: a blocked event
+ * loop, a process mid-restart, or a Mac under memory pressure. Nothing in the server logs could
+ * tell those apart. This line can:
+ *
+ *   [event-loop] stalled 6230 ms (rss 1840 MB, heap 910 MB; 1 stall(s) over 2000 ms since boot)
+ *
+ * A 500 ms unref'd timer measures its own lateness. A late tick above the threshold is one stall.
+ * At most one line per 10 s; stalls in between are counted into the next line.
+ */
+export const STALL_SAMPLE_MS = 500
+export const STALL_THRESHOLD_MS = 2_000
+const LOG_EVERY_MS = 10_000
+
+export interface StallMonitor {
+  stop(): void
+  stats(): { stalls: number; worstMs: number }
+}
+
+export function startEventLoopStallMonitor(options: {
+  sampleMs?: number
+  thresholdMs?: number
+  now?: () => number
+  log?: (line: string) => void
+  memory?: () => { rss: number; heapUsed: number }
+} = {}): StallMonitor {
+  const sampleMs = options.sampleMs ?? STALL_SAMPLE_MS
+  const thresholdMs = options.thresholdMs ?? STALL_THRESHOLD_MS
+  const now = options.now ?? (() => performance.now())
+  const log = options.log ?? (line => console.warn(line))
+  const memory = options.memory ?? (() => process.memoryUsage())
+  let last = now()
+  let stalls = 0
+  let worstMs = 0
+  let lastLogAt = -Infinity
+  let unlogged = 0
+  const timer = setInterval(() => {
+    const at = now()
+    const lateMs = at - last - sampleMs
+    last = at
+    if (lateMs < thresholdMs) return
+    stalls++
+    worstMs = Math.max(worstMs, lateMs)
+    if (at - lastLogAt < LOG_EVERY_MS) { unlogged++; return }
+    lastLogAt = at
+    const m = memory()
+    const extra = unlogged ? `; ${unlogged} more since the last line` : ''
+    unlogged = 0
+    log(`[event-loop] stalled ${Math.round(lateMs)} ms (rss ${Math.round(m.rss / 1e6)} MB, heap ${Math.round(m.heapUsed / 1e6)} MB; `
+      + `${stalls} stall(s) over ${thresholdMs} ms since boot${extra})`)
+  }, sampleMs)
+  timer.unref?.()
+  return {
+    stop: () => clearInterval(timer),
+    stats: () => ({ stalls, worstMs: Math.round(worstMs) }),
+  }
+}

package/server/lib/full-hold-engine.ts

@@ -0,0 +1,114 @@
+// X1 (Q1 review O2, 2026-11-09): WHICH engine asked, read from the process that ran the hook, never
+// from the session id alone.
+//
+// The hook script posts its own `$PPID`, which is the Claude Code process that ran it (measured: a
+// CLI 2.1.322 run and the Desktop engine 2.1.317 both, `~/.claude/sessions/<ppid>.json` names the
+// same session). Reading the record for the session id instead lets a second process that shares the
+// id (an older CLI, a `claude -p --resume <id>`) inherit a tab's version (Q1 O2).
+//
+// The entrypoint is not enough either. `claude -p` takes `CLAUDE_CODE_ENTRYPOINT` from whatever
+// started it: a print run launched from a Desktop tab's shell registers as `claude-desktop`, and its
+// `kind` reads `interactive` (measured 22:05). A print run has no dialog, and it does reach the
+// PermissionRequest hook for an approval and waits on it (measured: a 20 s hold blocked it 20 s), so a
+// full hold there would stall a headless job for up to an hour. What does tell them apart is where
+// the process runs (census of 25 live sessions, 22:06):
+//   - a Desktop tab's engine is a child of Claude.app's own `Contents/Helpers/disclaimer`;
+//   - an interactive CLI has a controlling terminal (`ttys000`) and none of the print or SDK flags;
+//   - a print run started from a shell or a tool has neither.
+// Q1 C3 (Codex second opinion), measured 22:42: a terminal alone is not enough. A `claude -p` run under
+// a terminal (typed there, or started by a CLI session's own Bash tool, whose children inherit its
+// terminal) has a tty too, and `-p` in its arguments. So a terminal engine must also carry none of
+// `-p`, `--print`, `--input-format`, `--output-format` (an SDK host passes the last two). Miles's two
+// interactive CLI sessions carried none of them.
+// Anything that cannot be read is `other`, and `other` is never proven.
+
+import { execFile } from 'node:child_process'
+import { readFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import type { EngineFacts, EngineHost } from './full-hold.js'
+
+export function claudeSessionsRegistryDir(): string {
+  const configDir = process.env.CLAUDE_CONFIG_DIR ? process.env.CLAUDE_CONFIG_DIR : join(homedir(), '.claude')
+  return join(configDir, 'sessions')
+}
+
+/** `~/.claude/sessions/<pid>.json` parsed, only when it names `sessionId` (and, if it says, that pid). Bounded; null on anything else. */
+function readRecord(pid: number, sessionId: string, dir: string): Record<string, unknown> | null {
+  if (!Number.isInteger(pid) || pid <= 1) return null
+  try {
+    const text = readFileSync(join(dir, `${pid}.json`), 'utf-8')
+    if (text.length > 256 * 1024) return null
+    const raw = JSON.parse(text) as Record<string, unknown>
+    if (typeof raw.sessionId !== 'string' || raw.sessionId.toLowerCase() !== sessionId.toLowerCase()) return null
+    if (typeof raw.pid === 'number' && raw.pid !== pid) return null
+    return raw
+  } catch {
+    return null
+  }
+}
+
+/** The engine's entrypoint and version from its own record. */
+export function registryRecordForPid(pid: number, sessionId: string, dir = claudeSessionsRegistryDir()): { entrypoint: string | null; version: string | null } | null {
+  const raw = readRecord(pid, sessionId, dir)
+  if (!raw) return null
+  return {
+    entrypoint: typeof raw.entrypoint === 'string' && raw.entrypoint ? raw.entrypoint : null,
+    version: typeof raw.version === 'string' && raw.version ? raw.version.slice(0, 32) : null,
+  }
+}
+
+type PsRun = (args: string[]) => Promise<string | null>
+
+/** A flag only a print run or an SDK host passes (Q1 C3). */
+const PRINT_OR_SDK_FLAG = /^(?:-p|--print|--input-format(?:=.*)?|--output-format(?:=.*)?)$/
+
+const runPs: PsRun = args => new Promise(resolve => {
+  try {
+    execFile('/bin/ps', args, { timeout: 1_000, maxBuffer: 64 * 1024 }, (error, stdout) => resolve(error ? null : String(stdout)))
+  } catch {
+    resolve(null)
+  }
+})
+
+/** Where a Claude Code process runs: Claude.app's helper, a terminal, or neither. */
+export async function processHost(pid: number, ps: PsRun = runPs): Promise<EngineHost> {
+  if (!Number.isInteger(pid) || pid <= 1) return 'other'
+  const own = await ps(['-o', 'ppid=,tty=', '-p', String(pid)])
+  if (!own) return 'other'
+  const [ppidRaw, tty] = own.trim().split(/\s+/)
+  const ppid = Number(ppidRaw)
+  if (tty && tty !== '??' && tty !== '-' && /^tty/.test(tty)) {
+    const args = await ps(['-o', 'args=', '-p', String(pid)])
+    if (args === null) return 'other'
+    return args.trim().split(/\s+/).some(token => PRINT_OR_SDK_FLAG.test(token)) ? 'other' : 'terminal'
+  }
+  if (!Number.isInteger(ppid) || ppid <= 1) return 'other'
+  const parent = await ps(['-o', 'comm=', '-p', String(ppid)])
+  const path = parent ? parent.trim() : ''
+  return /\/Claude\.app\/Contents\/Helpers\/disclaimer$/.test(path) ? 'desktop-app' : 'other'
+}
+
+/**
+ * X1 round 3: the engine's own status now (`waiting` while its dialog is up), from the same record, or
+ * null when the record is gone (the process ended) or names another session (the pid was reused).
+ * Measured 22:39 on both engines: `waiting` is written 0 to 5 ms before the PermissionRequest hook
+ * starts and leaves `waiting` within milliseconds of an answer at the desk (`busy`, or `idle` on Esc);
+ * the record is removed when the process exits.
+ */
+export function registryStatusForPid(pid: number, sessionId: string, dir = claudeSessionsRegistryDir()): { status: string | null; statusUpdatedAt: number | null } | null {
+  const raw = readRecord(pid, sessionId, dir)
+  if (!raw) return null
+  return {
+    status: typeof raw.status === 'string' ? raw.status : null,
+    statusUpdatedAt: typeof raw.statusUpdatedAt === 'number' && Number.isFinite(raw.statusUpdatedAt) ? raw.statusUpdatedAt : null,
+  }
+}
+
+/** The engine facts the full hold reads, for the process that ran the hook. Null when its record does not name the session. */
+export async function engineForHookProcess(sessionId: string, ppid: number | null, deps: { dir?: string; ps?: PsRun } = {}): Promise<EngineFacts | null> {
+  if (ppid === null) return null
+  const record = registryRecordForPid(ppid, sessionId, deps.dir)
+  if (!record) return null
+  return { ...record, host: await processHost(ppid, deps.ps) }
+}