@gotcos/glasses-server 6.99.33 → 7.0.18

package/server/routes/session-preview.ts

@@ -0,0 +1,200 @@
+/**
+ * The preview contract's routes (preview engine phase 1, PLAN 4c), mounted inside agentSessionsRouter, so behind the
+ * shared /api gate. Neither a request nor a response carries a filesystem path: a card or file is named by an opaque
+ * id that the resolver re-authorizes on every call (agent-session-output-images.ts `previewFile`).
+ *
+ *   GET /api/preview/agent-sessions/:provider/:sessionId/:id/meta
+ *   GET /api/preview/agent-sessions/:provider/:sessionId/:id/content?part=raw|inline|text|table|html|html-run|thumb
+ *   GET|POST /api/preview-folders/settings   the Settings extra folders (lib/preview-folders-setting.ts)
+ *
+ * "Show session files, screenshots and images" (7.0.4 name) off answers 403 previews_off before any transcript or file is read.
+ * A denied secret name answers 403 secret_file_denied (as the 7.0.4 output routes do). A folder card has no content (phase 2 lists folders).
+ * Every refusal or failure but a missing id logs one line (`logPreviewRefusal`): reason code, provider, part, kind.
+ */
+import { Router, type Request, type Response } from 'express'
+import { agentSessionOutputImages } from '../lib/agent-session-output-images.js'
+import { sessionFilesSetting } from '../lib/session-files-setting.js'
+import { previewFoldersSetting, folderDisplay, type PreviewFoldersStore } from '../lib/preview-folders-setting.js'
+import { previewThumbnailer } from '../lib/preview-thumbs.js'
+import {
+  HTML_PREVIEW_MAX, looksBinary, PREVIEW_PARTS, previewHeaders, tablePage, TEXT_WINDOW_MAX, textWindow, withCspMeta, type PreviewPart,
+} from '../lib/preview-content.js'
+import type { PreviewKind } from '../lib/session-links.js'
+import { previewErrorCode } from '../lib/preview-error-code.js'
+import { warnPreviewThrottled } from '../lib/preview-log-throttle.js'
+/** The 7.0.4 code (routes/agent-sessions.ts PREVIEWS_BUSY), repeated here so this router needs nothing from that one. */
+const PREVIEWS_BUSY = 'previews_busy'
+
+type Previews = Pick<typeof agentSessionOutputImages, 'previewFile' | 'previewImage'>
+type Thumbs = Pick<typeof previewThumbnailer, 'thumbnail'>
+export interface SessionPreviewDeps {
+  previews?: Previews
+  enabled?: () => boolean
+  thumbs?: Thumbs
+  folders?: PreviewFoldersStore
+  home?: () => string
+}
+
+const PROVIDERS = new Set(['claude', 'codex', 'cursor'])
+const TEXT_KINDS = new Set<PreviewKind>(['markdown', 'text', 'code', 'html', 'table'])
+const THUMB_KINDS = new Set<PreviewKind>(['pdf', 'document', 'slides', 'sheet', 'html'])
+const NORMALIZED = /\.(png|jpe?g|webp|hei[cf]|avif)$/i
+
+/** Which parts a kind has. The web reads this from `meta` and never asks for another. */
+export function partsFor(kind: PreviewKind, name: string): PreviewPart[] {
+  const parts: PreviewPart[] = []
+  if (kind === 'folder') return parts
+  parts.push('raw')
+  if (kind === 'pdf') parts.push('inline')
+  if (kind === 'image' && NORMALIZED.test(name)) parts.push('inline')
+  if (TEXT_KINDS.has(kind)) parts.push('text')
+  if (kind === 'table') parts.push('table')
+  if (kind === 'html') parts.push('html', 'html-run')
+  if (THUMB_KINDS.has(kind)) parts.push('thumb')
+  if (kind === 'image' && NORMALIZED.test(name)) parts.push('thumb')
+  return parts
+}
+
+/** What a refusal or failure is logged with. Only fixed words: never a path, a file name, an id, a token or content. */
+interface LogAt { route: 'meta' | 'content'; provider: string; part?: string; kind?: PreviewKind; detail?: string }
+const SAFE_WORD = /^[a-z0-9_-]{1,40}$/i
+/**
+ * QA 7.0.5 (the 7.0.4 promise, for the preview engine's routes): one line per refusal or failure, with a stable reason
+ * code and the provider, part and file kind. A missing id (404 preview_not_found) is ordinary and is not logged, as in
+ * the 7.0.4 output routes. 7.0.7 (final QA N1): a burst of the same line (a page of thumbnails while another client is
+ * busy) logs once per 10 seconds with the count it held back, through the 7.0.4 routes' own limiter.
+ */
+export function logPreviewRefusal(at: LogAt, error: string, now = Date.now()): void {
+  if (error === 'preview_not_found') return
+  const words = [`reason=${error}`, `provider=${PROVIDERS.has(at.provider) ? at.provider : 'unknown'}`]
+  if (at.part && SAFE_WORD.test(at.part)) words.push(`part=${at.part}`)
+  if (at.kind && SAFE_WORD.test(at.kind)) words.push(`kind=${at.kind}`)
+  if (at.detail && SAFE_WORD.test(at.detail)) words.push(`detail=${at.detail}`)
+  const line = `[preview] ${at.route} refused ${words.join(' ')}`
+  warnPreviewThrottled(line, line, now)
+}
+
+function refuse(res: Response, status: string, at: LogAt) {
+  const map: Record<string, [number, string]> = {
+    not_found: [404, 'preview_not_found'], unavailable: [503, 'preview_unavailable'], too_large: [413, 'preview_too_large'],
+    secret: [403, 'secret_file_denied'], folder: [404, 'preview_folder'], busy: [503, PREVIEWS_BUSY],
+  }
+  const [code, error] = map[status] ?? [503, 'preview_unavailable']
+  logPreviewRefusal(at, error)
+  if (status === 'busy') res.set('Retry-After', '2')
+  res.status(code).json({ error })
+}
+/** A refusal the route answers itself (not through `refuse`), logged the same way. */
+function answer(res: Response, code: number, error: string, at: LogAt) {
+  logPreviewRefusal(at, error)
+  res.status(code).json({ error })
+}
+
+export function createSessionPreviewRouter(deps: SessionPreviewDeps = {}): Router {
+  const router = Router()
+  const previews = deps.previews ?? agentSessionOutputImages
+  const enabled = deps.enabled ?? (() => sessionFilesSetting.read().enabled)
+  const thumbs = deps.thumbs ?? previewThumbnailer
+  const folders = deps.folders ?? previewFoldersSetting
+
+  const gate = (req: Request, res: Response, route: LogAt['route']): { provider: 'claude' | 'codex' | 'cursor'; sessionId: string; id: string } | null => {
+    res.set('Cache-Control', 'private, no-store')
+    res.set('X-Content-Type-Options', 'nosniff')
+    const provider = String(req.params.provider ?? '').toLowerCase()
+    // The switch decides before anything is read (no transcript, no file, no stat).
+    if (!enabled()) { answer(res, 403, 'previews_off', { route, provider }); return null }
+    if (!PROVIDERS.has(provider)) { res.status(404).json({ error: 'preview_not_found' }); return null }
+    return { provider: provider as 'claude' | 'codex' | 'cursor', sessionId: String(req.params.sessionId ?? ''), id: String(req.params.id ?? '') }
+  }
+
+  router.get('/preview/agent-sessions/:provider/:sessionId/:id/meta', async (req, res) => {
+    const g = gate(req, res, 'meta'); if (!g) return
+    const at: LogAt = { route: 'meta', provider: g.provider }
+    try {
+      const found = await previews.previewFile(g.provider, g.sessionId, g.id, true)
+      if (found.status === 'folder') { res.json({ id: g.id, name: '', kind: 'folder', type: 'Folder', state: 'available', parts: [] }); return }
+      if (found.status !== 'ok') { refuse(res, found.status, { ...at, detail: found.reason }); return }
+      res.json({ id: g.id, name: found.name, kind: found.kind, type: found.type, size: found.identity.size, ...(found.line ? { line: found.line } : {}), state: 'available', parts: partsFor(found.kind, found.name) })
+    } catch (error) { refuse(res, 'unavailable', { ...at, detail: 'error_' + previewErrorCode(error) }) }
+  })
+
+  router.get('/preview/agent-sessions/:provider/:sessionId/:id/content', async (req, res) => {
+    const g = gate(req, res, 'content'); if (!g) return
+    const part = String(req.query.part ?? 'raw') as PreviewPart
+    const at: LogAt = { route: 'content', provider: g.provider }
+    if (!PREVIEW_PARTS.includes(part)) { answer(res, 400, 'preview_part', at); return }
+    at.part = part
+    try {
+      const found = await previews.previewFile(g.provider, g.sessionId, g.id)
+      if (found.status !== 'ok') { refuse(res, found.status, { ...at, detail: found.reason }); return }
+      at.kind = found.kind
+      if (!partsFor(found.kind, found.name).includes(part)) { answer(res, 400, 'preview_part', at); return }
+      // A picture goes through the output-image normalizer, as a JPEG, never as the bytes a file claims to be.
+      if (found.kind === 'image' && part !== 'raw') {
+        const img = await previews.previewImage(g.provider, g.sessionId, g.id, part === 'thumb' ? 'thumb' : 'phone')
+        if (img.status !== 'ok') { refuse(res, img.status, { ...at, detail: 'reason' in img ? img.reason : undefined }); return }
+        if (!('path' in img)) { refuse(res, 'unavailable', at); return }
+        res.set({ 'Content-Type': 'image/jpeg', 'Content-Disposition': 'inline', 'Content-Security-Policy': "sandbox; default-src 'none'", 'Cross-Origin-Resource-Policy': 'same-origin' })
+        res.sendFile(img.path, { dotfiles: 'allow', headers: { 'Content-Type': 'image/jpeg' } }, err => {
+          if (!err) return
+          if (!res.headersSent) refuse(res, 'unavailable', { ...at, detail: 'send_' + previewErrorCode(err) }); else { logPreviewRefusal({ ...at, detail: 'send_' + previewErrorCode(err) }, 'preview_cut'); res.destroy() }
+        })
+        return
+      }
+      const bytes = found.bytes
+      if (part === 'raw' || part === 'inline') { res.set(previewHeaders(part, found.name)); res.status(200).end(bytes); return }
+      if (part === 'thumb') {
+        const t = await thumbs.thumbnail(bytes, found.name, found.identity)
+        if (t.status !== 'ok') {
+          if (t.status === 'busy') res.set('Retry-After', '2')
+          answer(res, 503, t.status === 'busy' ? PREVIEWS_BUSY : 'thumb_unavailable', { ...at, detail: t.status === 'unavailable' ? t.reason : undefined })
+          return
+        }
+        res.set(previewHeaders('thumb', found.name))
+        res.sendFile(t.path, { dotfiles: 'allow', headers: { 'Content-Type': 'image/png' } }, err => {
+          if (!err) return
+          if (!res.headersSent) answer(res, 503, 'thumb_unavailable', { ...at, detail: 'send_' + previewErrorCode(err) }); else { logPreviewRefusal({ ...at, detail: 'send_' + previewErrorCode(err) }, 'preview_cut'); res.destroy() }
+        })
+        return
+      }
+      if (looksBinary(bytes)) { answer(res, 415, 'preview_binary', at); return }
+      if (part === 'html' || part === 'html-run') {
+        if (bytes.length > HTML_PREVIEW_MAX) { refuse(res, 'too_large', at); return }
+        // PLAN 6: the policy is in the page itself too, before anything in it can load.
+        res.set(previewHeaders(part, found.name)); res.status(200).end(withCspMeta(bytes, part)); return
+      }
+      if (part === 'table') {
+        res.set(previewHeaders('table', found.name))
+        res.json(tablePage(bytes, found.name, Number(req.query.offset ?? 0)))
+        return
+      }
+      // Every text window, an HTML page's source included, is 512 KiB a call with "load more".
+      res.set(previewHeaders('text', found.name))
+      res.json({ ...textWindow(bytes, Number(req.query.offset ?? 0), Number(req.query.limit ?? TEXT_WINDOW_MAX), TEXT_WINDOW_MAX), ...(found.line ? { line: found.line } : {}) })
+    } catch (error) {
+      refuse(res, 'unavailable', { ...at, detail: 'error_' + previewErrorCode(error) })
+    }
+  })
+
+  // Settings, Privacy: the named extra folders. Shown as ~/x inside home. A refusal names each folder's problem.
+  router.get('/preview-folders/settings', (_req, res) => {
+    res.set('Cache-Control', 'private, no-store')
+    try {
+      const s = folders.read()
+      res.json({ folders: s.folders.map(f => folderDisplay(f, deps.home?.())), source: s.source })
+    } catch { res.status(500).json({ error: 'preview_folders_unavailable' }) }
+  })
+  router.post('/preview-folders/settings', (req, res) => {
+    res.set('Cache-Control', 'private, no-store')
+    const body = req.body
+    if (!body || typeof body !== 'object' || Array.isArray(body) || Object.keys(body).some(k => k !== 'folders') || !Array.isArray(body.folders)) {
+      res.status(400).json({ error: { code: 'invalid_preview_folders', message: 'Send { folders: ["~/cos-worktrees"] }.' } }); return
+    }
+    try {
+      const r = folders.set(body.folders)
+      if (!r.ok) { res.status(400).json({ error: { code: 'preview_folder_refused', message: r.errors[0]?.message ?? 'That folder cannot be used.' }, errors: r.errors }); return }
+      res.json({ folders: r.setting.folders.map(f => folderDisplay(f, deps.home?.())), source: r.setting.source })
+    } catch { res.status(500).json({ error: 'preview_folders_unavailable' }) }
+  })
+  return router
+}

package/server/routes/sessions.ts

@@ -1,9 +1,7 @@
 // Session endpoints — recent list, full history, existence check, client-format messages, context breaks, end
 import { Router } from 'express'
-import { readFileSync } from 'fs'
-import { join } from 'path'
 import { getRecentSessions, getHistory, sessionExists, addContextBreak, endSession, getSessionRaw, getActiveSessions, resolveExchangePairModel, ensureArchiveMirrorForDay } from '../lib/conversation.js'
-import { buildSessionLogEntry, writeSessionLog } from '../lib/session-log.js'
+import { buildSessionLogEntry, lookupRangesFromHistory, readSessionLogRanges, writeSessionLogIfChanged } from '../lib/session-log.js'
 import { getArchiveDayMessages, listArchiveDateStrings } from '../lib/archive.js'
 import { recentMessagesLimit, selectRecentMessages } from '../lib/recent-messages.js'
 import { localDay } from '../lib/local-day.js'
@@ -135,7 +133,7 @@ sessionsRouter.get('/sessions/:id/messages', (req, res) => {
 // instead of waiting for the 2hr TTL expiry.
 // POST /api/sessions/lookup — batch resolve timestamps to session IDs
 // Used to retroactively stamp messages that predate the sessionId feature
-sessionsRouter.post('/sessions/lookup', (req, res) => {
+sessionsRouter.post('/sessions/lookup', async (req, res) => {
   const { timestamps } = req.body as { timestamps: number[] }
   if (!timestamps || !Array.isArray(timestamps)) {
     res.status(400).json({ error: 'timestamps[] required' })
@@ -143,7 +141,6 @@ sessionsRouter.post('/sessions/lookup', (req, res) => {
   }
 
   // Build time ranges from BOTH JSONL history AND live server sessions
-  const logPath = join(process.env.COS_SCRIPTS_DIR || '', '.glasses_sessions.jsonl')
   const sessionRanges: Array<{ sid: string; start: number; end: number }> = []
 
   // 1. Live server sessions (always current — no snapshot lag)
@@ -155,25 +152,17 @@ sessionsRouter.post('/sessions/lookup', (req, res) => {
     }
   }
 
-  // 2. JSONL history (ended sessions + snapshots)
+  // 2. JSONL history (ended sessions + snapshots). S1 (2026-11-09): streamed and incremental
+  // (session-log.ts readSessionLogRanges); the old readFileSync().toString() threw on the 1.94 GB
+  // ledger and the catch read that as "no file". The range rule is the old one, unchanged: a
+  // session's end is widened by later lines only when it is NOT in memory (lookupRangesFromHistory).
   try {
-    const lines = readFileSync(logPath, 'utf-8').trim().split('\n')
-    for (const line of lines) {
-      const d = JSON.parse(line)
-      if (d.session_id && d.created_at) {
-        const start = new Date(d.created_at).getTime()
-        const end = d.ended_at ? new Date(d.ended_at).getTime() : start + 7200_000
-        // Live sessions take priority. For JSONL, keep the widest (latest) time range per session.
-        const existing = sessionRanges.find(s => s.sid === d.session_id)
-        if (!existing) {
-          sessionRanges.push({ sid: d.session_id, start, end })
-        } else if (end > existing.end && !getSessionRaw(d.session_id)) {
-          // Widen the JSONL range (but don't overwrite live sessions which extend to NOW)
-          existing.end = end
-        }
-      }
-    }
-  } catch { /* no log file */ }
+    const live = new Set(sessionRanges.map(s => s.sid))
+    const history = await readSessionLogRanges()
+    sessionRanges.push(...lookupRangesFromHistory(history, sid => Boolean(getSessionRaw(sid)), live))
+  } catch (err) {
+    console.warn('[sessions] lookup could not read the session ledger:', err instanceof Error ? err.message : err)
+  }
 
   // Match each timestamp to a session (live sessions checked first, then JSONL)
   const results: Record<number, string | null> = {}
@@ -242,7 +231,9 @@ sessionsRouter.post('/sessions/:id/snapshot', (req, res) => {
     slug: `[LIVE] ${(session.exchanges.find(e => e.role === 'user')?.content ?? '').slice(0, 50)}`,
   })
 
-  const logged = writeSessionLog(entry)
+  // Logged means the ledger holds this content: written now, or already there.
+  const result = writeSessionLogIfChanged(entry, 'snapshot')
+  const logged = result === 'written' || result === 'unchanged'
   res.json({
     ok: true,
     logged,

package/server/routes/thread-turn-queue.ts

@@ -24,13 +24,13 @@ import {
   admitToQueue, drainDecision, queueableRefusal, queuePosition,
   MAX_DELIVERY_ATTEMPTS, type DrainObservation, type QueuedThreadTurn,
   queueReconcileEnabled, queueResendEnabled, queuedTurnReasonCopy, sessionSteerAvailability, sessionSteerEnabled,
-  type SessionSteerAvailability,
+  steerMidturnEnabled, type SessionSteerAvailability,
 } from '../lib/thread-turn-queue.js'
 import { readQueue, writeQueue, queuedThreadKeys } from '../lib/thread-turn-queue-store.js'
 import type { DeliveryEvidence } from '../lib/queue-turn-evidence.js'
 import { continueLiveEnabled } from '../lib/session-peer-inbox-deps.js'
 import { PEER_VERIFY_TIMEOUT_MS } from '../lib/session-peer-inbox.js'
-import { attachmentsDigest, FOOTER_LINE_REFUSED_COPY, hasFooterShapedLine, stripG2TurnFooter, TURN_ID_IN_USE_COPY, unvouched, type G2TurnProvenance, type OriginVerdict } from '../lib/g2-turn-provenance.js'
+import { attachmentsDigest, FOOTER_LINE_REFUSED_COPY, hasFooterShapedLine, sealMatches, stripG2TurnFooter, TURN_ID_IN_USE_COPY, unvouched, type G2TurnProvenance, type OriginVerdict } from '../lib/g2-turn-provenance.js'
 import { defaultTurnAttachmentStore, keepTurnAttachments, parseTurnAttachmentIds, TURN_ATTACHMENT_COPY, turnAttachmentManifest, type TurnAttachmentStore } from '../lib/session-turn-attachments.js'
 
 /**
@@ -38,11 +38,11 @@ import { defaultTurnAttachmentStore, keepTurnAttachments, parseTurnAttachmentIds
  * the attachment digest its origin is sealed to. Files whose content cannot be read leave the turn
  * unvouched (it still parks); no files is the empty digest and reads nothing.
  */
-async function sealFiles(ids: readonly string[] | undefined, verdict: OriginVerdict, store: TurnAttachmentStore | undefined): Promise<{ verdict: OriginVerdict; attachments: string }> {
-  if (!Array.isArray(ids) || ids.length === 0) return { verdict, attachments: '' }
+async function sealFiles(ids: readonly string[] | undefined, verdict: OriginVerdict, store: TurnAttachmentStore | undefined): Promise<{ verdict: OriginVerdict; attachments: string; manifest: ReadonlyArray<{ id: string; sha256: string }> | null }> {
+  if (!Array.isArray(ids) || ids.length === 0) return { verdict, attachments: '', manifest: [] }
   const manifest = await turnAttachmentManifest(ids, store)
-  if (!manifest.ok) return { verdict: unvouched(verdict, 'attachments_unsealable'), attachments: '' }
-  return { verdict, attachments: attachmentsDigest(manifest.manifest) }
+  if (!manifest.ok) return { verdict: unvouched(verdict, 'attachments_unsealable'), attachments: '', manifest: null }
+  return { verdict, attachments: attachmentsDigest(manifest.manifest), manifest: manifest.manifest }
 }
 
 export interface ThreadTurnQueueDeps {
@@ -115,6 +115,23 @@ export interface ThreadTurnQueueDeps {
     begin: (provider: string, threadId: string, clientTurnId: string, mode: 'turn' | 'steer', now: number) => boolean
     settle: (provider: string, threadId: string, clientTurnId: string, exit: 'sent' | 'not_sent' | 'unknown', now: number) => boolean
   }
+  /**
+   * Steer mid-turn (COS_STEER_MIDTURN), optional: ask for a drain pass for this thread now, so a
+   * turn parked at a busy session that can take it mid-turn goes in within seconds instead of at
+   * the next 20 s sweep. Production: the shared drain kick (one pass in flight, ever). Absent: the
+   * sweep still delivers it, only later.
+   */
+  kickDrain?: (threadId: string) => void
+}
+
+/**
+ * Can this thread take a parked turn mid-turn right now (COS_STEER_MIDTURN)? The same shared rule
+ * as Session steer, plus the switch and the two members the drain's steer needs. Never throws.
+ */
+export function midTurnAvailabilityFor(deps: Pick<ThreadTurnQueueDeps, 'steerProbe' | 'deliverLiveTurn' | 'continueLive' | 'attempts'>, provider: string, threadId: string, gateReason: string | null): SessionSteerAvailability | null {
+  if (!steerMidturnEnabled()) return null
+  if (typeof deps.deliverLiveTurn !== 'function' || !deps.attempts) return { available: false, reason: 'no_outside_channel' }
+  return steerAvailabilityFor(deps, provider, threadId, gateReason)
 }
 
 /**
@@ -210,6 +227,159 @@ function isRetryableDelivery(outcome: { reason?: string; serverRetryable?: boole
   return queueableRefusal(outcome.reason)
 }
 
+/**
+ * The verdict a drain hop with no parked origin is judged by: the loopback call it is. The front
+ * door reaches the same verdict through `originOf` on the drainer's own request (local socket,
+ * token shown), so a steered turn and a front-door turn are ledgered alike. Never footed.
+ */
+function localDrainVerdict(at: number): OriginVerdict {
+  return {
+    origin: { remote: '127.0.0.1', loopback: true, ownAddress: true, clientInstance: null, client: 'local', tokenPresented: true, webSession: false },
+    verifiedOrigin: false,
+    reason: 'local_socket',
+    judgedAt: at,
+  }
+}
+
+/** What one mid-turn attempt did to its row: delivered, settled some other way, or left waiting. */
+type MidTurnOutcome = 'delivered' | 'settled' | 'held'
+
+/**
+ * Steer mid-turn (COS_STEER_MIDTURN, Miles 2026-11-07): put ONE waiting row into the running turn
+ * of a busy Claude desk session through its peer inbox. Claude Code takes the frame at once (its
+ * `enqueue` row is the proof `deliverLiveTurn` waits for) and folds it in at its next tool step.
+ *
+ * Called only by `drainThread`, only for a row the drain would otherwise hold behind a busy gate,
+ * and only in FIFO order (the caller stops at the first row that holds).
+ *
+ * WHO MAY BE STEERED: a row never attempted (`attempts === 0`: no front-door attempt, no earlier
+ * steer, no restart requeue, so nothing about it is unknown), with no files (the peer inbox
+ * carries words only), on a thread the shared steer rule says can take it now.
+ *
+ * PROVENANCE IS CHECKED HERE AS THE TURNS ROUTE CHECKS IT, because this hop does not go through
+ * that front door: footer-shaped words are refused, the parked origin is carried (a single-use
+ * carry token, spent in this process), its seal must name this provider, thread and no files,
+ * a turn id held for another turn is refused, and only the server writes the footer. A refusal
+ * settles the row `refused` with its own reason, so it reads "Not sent" with the reason line.
+ *
+ * NEVER TWICE, in the same order as `steerTurn`: the intent row (`delivering`, `mode: 'steer'`,
+ * `journal: 1`, this boot) durably, then the attempt `pending`, then the frame, then the
+ * verdict, journal first. Unverified, a failed write or a throw: `refused`, `steer_unverified`,
+ * `deliveryState: 'unknown'`, never resent. Nothing reached the session: back to waiting, the
+ * attempt given back, so the turn-end front door sends it as before.
+ *
+ * NO AWAIT BEFORE THE INTENT ROW IS WRITTEN: the caller read this row as `waiting` in the same
+ * synchronous step, so a cancel cannot slip between that read and the `delivering` write.
+ */
+async function steerHeldTurn(
+  provider: string,
+  threadId: string,
+  turn: QueuedThreadTurn,
+  gateReason: string | null,
+  deps: ThreadTurnQueueDeps,
+): Promise<MidTurnOutcome> {
+  if (turn.status !== 'waiting' || turn.attempts !== 0) return 'held'
+  if (Array.isArray(turn.attachmentIds) && turn.attachmentIds.length > 0) return 'held'
+  const availability = midTurnAvailabilityFor(deps, provider, threadId, gateReason)
+  if (!availability || !availability.available) return 'held'
+  const { clientTurnId, prompt } = turn
+
+  const rewrite = (apply: (row: QueuedThreadTurn) => void): QueuedThreadTurn | null => {
+    const latest = readQueue(provider, threadId, deps.now())
+    const row = latest.find(t => t.clientTurnId === clientTurnId)
+    if (!row) return null
+    apply(row)
+    writeQueue(provider, threadId, latest, { durable: true })
+    return row
+  }
+  const refuse = (reason: string): MidTurnOutcome => {
+    const at = deps.now()
+    rewrite(row => { row.status = 'refused'; row.reason = reason; row.settledAt = at })
+    deps.provenance?.forgetQueued(provider, threadId, clientTurnId)
+    console.warn(`[thread-turn-queue] mid-turn refused provider=${provider} clientTurnId=${clientTurnId} reason=${reason}`)
+    return 'settled'
+  }
+
+  // The front door's provenance gates, in its order.
+  let verdict: OriginVerdict | null = null
+  if (deps.provenance) {
+    if (hasFooterShapedLine(prompt)) return refuse('footer_line_refused')
+    const token = deps.provenance.issueCarry({ provider, threadId, clientTurnId, prompt })
+    const carried = token ? deps.provenance.takeCarry(token, clientTurnId, prompt) : null
+    // No carry could be made: leave it for the front door, which decides with its own carry.
+    if (carried === null) return 'held'
+    if (carried.seal !== null && !sealMatches(carried.seal, { provider, threadId, attachments: '' })) return refuse('queued_turn_tampered')
+    verdict = carried.verdict ?? localDrainVerdict(deps.now())
+    if (deps.provenance.reusesTurnId(clientTurnId, { prompt, verdict, provider, sessionId: threadId }, { continues: true })) return refuse('turn_id_in_use')
+  }
+  const sent = deps.provenance && verdict ? deps.provenance.footed(prompt, clientTurnId, verdict, provider) : prompt
+  const ledger = (via: string): void => {
+    if (deps.provenance && verdict) deps.provenance.record({ turnId: clientTurnId, prompt, verdict, provider, sessionId: threadId, via, continues: true })
+  }
+
+  // 1. The intent row, durably.
+  const intent = rewrite(row => {
+    row.status = 'delivering'
+    row.attempts = 1
+    row.mode = 'steer'
+    row.journal = 1
+    if (typeof deps.bootId === 'string' && deps.bootId.length > 0) row.deliveringBootId = deps.bootId
+    else delete row.deliveringBootId
+  })
+  if (!intent) return 'held'
+  const backToWaiting = (row: QueuedThreadTurn): void => {
+    row.status = 'waiting'
+    row.attempts = 0
+    delete row.mode
+    delete row.journal
+    delete row.deliveringBootId
+  }
+
+  // 2. The attempt `pending`, durably, before any frame.
+  let begun = false
+  try { begun = deps.attempts!.begin(provider, threadId, clientTurnId, 'steer', deps.now()) === true } catch { begun = false }
+  if (!begun) {
+    rewrite(backToWaiting)
+    console.warn(`[thread-turn-queue] mid-turn not attempted provider=${provider} clientTurnId=${clientTurnId}: the attempt journal could not record it`)
+    return 'held'
+  }
+
+  // 3. The frame.
+  const startedAt = deps.now()
+  let live: { ok: boolean; reason: string } | null = null
+  try {
+    live = await deps.deliverLiveTurn!({ provider, sessionId: threadId, prompt: sent, verifyTimeoutMs: PEER_VERIFY_TIMEOUT_MS, clientTurnId })
+  } catch (error) {
+    console.error(`[thread-turn-queue] mid-turn delivery threw: ${error instanceof Error ? error.message : error}`)
+    live = null
+  }
+  const at = deps.now()
+  const journal = (exit: 'sent' | 'not_sent' | 'unknown'): void => {
+    try { deps.attempts!.settle(provider, threadId, clientTurnId, exit, at) } catch { /* the reconcile reads `pending` as unknown */ }
+  }
+  console.log(`[thread-turn-queue] mid-turn provider=${provider} clientTurnId=${clientTurnId} hop=${live?.reason ?? 'threw'} ms=${Math.max(0, at - startedAt)} waitedMs=${Math.max(0, at - turn.queuedAt)}`)
+
+  // 4. The verdict, journal first, then the row.
+  if (live?.ok === true) {
+    journal('sent')
+    ledger('drain-steer')
+    rewrite(row => { row.status = 'delivered'; row.reason = 'steered'; row.settledAt = at })
+    deps.provenance?.forgetQueued(provider, threadId, clientTurnId)
+    return 'delivered'
+  }
+  if (live === null || live.reason === 'unverified' || live.reason === 'write_failed') {
+    journal('unknown')
+    ledger('drain-steer-unverified')
+    rewrite(row => { row.status = 'refused'; row.reason = 'steer_unverified'; row.deliveryState = 'unknown'; row.settledAt = at })
+    deps.provenance?.forgetQueued(provider, threadId, clientTurnId)
+    return 'settled'
+  }
+  // The transport's own word that nothing reached a session: the row waits for the turn end.
+  journal('not_sent')
+  rewrite(backToWaiting)
+  return 'held'
+}
+
 /**
  * One drain pass over one thread.
  *
@@ -243,9 +413,14 @@ export async function drainThread(
     if (turn.status !== 'waiting') deps.provenance?.forgetQueued(provider, threadId, turn.clientTurnId)
   }
 
+  // Steer mid-turn (COS_STEER_MIDTURN): FIFO per thread. Once a row ahead cannot go in mid-turn
+  // (or is still being delivered), nothing behind it may jump it; it waits for the turn end too.
+  let midTurnOrderHeld = false
+
   for (const snapshot of queue) {
     const turn = readQueue(provider, threadId, deps.now()).find(t => t.clientTurnId === snapshot.clientTurnId)
     if (!turn) continue
+    if (turn.status === 'delivering') midTurnOrderHeld = true
     if (turn.status !== 'waiting') continue
 
     // Reuse only refusal within this synchronous pass. Rechecking a busy thread
@@ -284,7 +459,21 @@ export async function drainThread(
         }
     const decision = drainDecision(turn, seen, deps.now())
 
-    if (decision === 'hold') { held += 1; continue }
+    if (decision === 'hold') {
+      // Steer mid-turn: never during a cancel hold (the person said stop), only for the first
+      // rows in order, and only where the shared steer rule says this session can take it now,
+      // which also means the hold is the busy GATE: the rule answers only for a refusal that
+      // names a desk run (an attachable thread has no reason). Anything else holds as before.
+      const cancelHeld = typeof seen.cancelHoldUntil === 'number' && Number.isFinite(seen.cancelHoldUntil) && deps.now() < seen.cancelHoldUntil
+      if (!midTurnOrderHeld && !cancelHeld) {
+        const outcome = await steerHeldTurn(provider, threadId, turn, gate.reason, deps)
+        if (outcome === 'delivered') { delivered += 1; continue }
+        if (outcome === 'settled') { retired += 1; continue }
+      }
+      midTurnOrderHeld = true
+      held += 1
+      continue
+    }
     if (decision === 'expire' || decision === 'give_up') {
       turn.status = decision === 'expire' ? 'expired' : 'refused'
       turn.reason = decision === 'expire' ? 'queued_turn_expired' : 'delivery_attempts_exhausted'
@@ -690,7 +879,9 @@ export function createThreadTurnQueueRouter(deps: ThreadTurnQueueDeps): Router {
     // with its content hash), so the drain can carry it (QUEUED_ORIGIN_TTL_MS at most).
     if (deps.provenance && verdict) {
       const sealed = await sealFiles(attach.ids, verdict, deps.turnAttachmentStore)
-      verdict = sealed.verdict
+      // 6.99.31: a signed web turn is judged here, once parking is decided, against this provider and
+      // thread (where it will drain), these exact words and these files. No envelope: unchanged.
+      verdict = deps.provenance.acceptWebKey(sealed.verdict, { provider, sessionId: threadId, turnId: clientTurnId, words: prompt, attachments: sealed.manifest })
       deps.provenance.noteQueued(provider, threadId, clientTurnId, prompt, verdict, sealed.attachments)
     }
 
@@ -710,12 +901,27 @@ export function createThreadTurnQueueRouter(deps: ThreadTurnQueueDeps): Router {
 
     writeQueue(provider, threadId, admitted.queue)
     if (deps.provenance && verdict) deps.provenance.record({ turnId: clientTurnId, prompt, verdict, provider, sessionId: threadId, via: 'queue' })
+    // Steer mid-turn (COS_STEER_MIDTURN): the park answer stays the 202 every client reads (a
+    // lens that sees anything else says "could not queue"); the drain is asked to run now, and it
+    // puts the words into the running turn. `landsAt` (additive, only with the switch on) tells a
+    // client which line to show: `next_step` only when this row is first in line, has no files,
+    // and the session can take it now; `turn_end` otherwise.
+    const midTurn = midTurnAvailabilityFor(deps, provider, threadId, gate.reason)
+    let landsAt: 'next_step' | 'turn_end' | null = null
+    if (midTurn) {
+      const firstInLine = queuePosition(admitted.queue, clientTurnId) === 0 && !admitted.queue.some(t => t.status === 'delivering')
+      landsAt = midTurn.available && firstInLine && attach.ids.length === 0 ? 'next_step' : 'turn_end'
+      if (landsAt === 'next_step') {
+        try { deps.kickDrain?.(threadId) } catch { /* the 20 s sweep still delivers it */ }
+      }
+    }
     return res.status(202).json({
       queued: true,
       clientTurnId,
       position: queuePosition(admitted.queue, clientTurnId),
       waitingOn: gate.reason,
       ...(steerFallback !== null ? { steerFallback } : {}),
+      ...(landsAt !== null ? { landsAt } : {}),
     })
   })
 
@@ -786,8 +992,11 @@ export function createThreadTurnQueueRouter(deps: ThreadTurnQueueDeps): Router {
     if (deps.provenance && resendVerdict) {
       // After the write: the read-modify-write above stays one synchronous step. Sealed to the copy's files.
       const sealed = await sealFiles(copy.attachmentIds, resendVerdict, deps.turnAttachmentStore)
-      deps.provenance.noteQueued(provider, threadId, newId, copy.prompt, sealed.verdict, sealed.attachments)
-      deps.provenance.record({ turnId: newId, prompt: copy.prompt, verdict: sealed.verdict, provider, sessionId: threadId, via: 'queue-resend', resendOf: original.clientTurnId })
+      // 6.99.31: Send again from the phone needs a fresh signature over the copy (its new id, the words,
+      // the files); without one the copy stays unvouched ('resend_not_reverified').
+      const copyVerdict = deps.provenance.acceptWebKey(sealed.verdict, { provider, sessionId: threadId, turnId: newId, words: copy.prompt, attachments: sealed.manifest })
+      deps.provenance.noteQueued(provider, threadId, newId, copy.prompt, copyVerdict, sealed.attachments)
+      deps.provenance.record({ turnId: newId, prompt: copy.prompt, verdict: copyVerdict, provider, sessionId: threadId, via: 'queue-resend', resendOf: original.clientTurnId })
     }
     console.log(`[thread-turn-queue] resend provider=${provider} from=${original.clientTurnId} as=${newId} unknown=${original.deliveryState === 'unknown'}`)
     return res.status(200).json(publicRow(copy, queuePosition(admitted.queue, newId)))
@@ -857,9 +1066,11 @@ export function createThreadTurnQueueRouter(deps: ThreadTurnQueueDeps): Router {
     if (deps.provenance && verdict) {
       // Sealed to the row's files as they are now (an edit changes only the words).
       const sealed = await sealFiles(row.attachmentIds, verdict, deps.turnAttachmentStore)
-      deps.provenance.noteQueued(provider, threadId, id, prompt, sealed.verdict, sealed.attachments)
+      // 6.99.31: an edit needs a fresh signature over the new words (same id, same files), or it is unvouched.
+      const editVerdict = deps.provenance.acceptWebKey(sealed.verdict, { provider, sessionId: threadId, turnId: id, words: prompt, attachments: sealed.manifest })
+      deps.provenance.noteQueued(provider, threadId, id, prompt, editVerdict, sealed.attachments)
       // The queue's own row, re-judged: it continues the record parked under this id.
-      deps.provenance.record({ turnId: id, prompt, verdict: sealed.verdict, provider, sessionId: threadId, via: 'queue-edit', continues: true })
+      deps.provenance.record({ turnId: id, prompt, verdict: editVerdict, provider, sessionId: threadId, via: 'queue-edit', continues: true })
     }
     return res.json({ updated: true })
   })