@gotcos/glasses-server 7.0.18 → 7.0.29

package/server/routes/agent-sessions.ts

@@ -91,6 +91,35 @@ import { resetPreviewLogThrottle, warnPreviewThrottled } from '../lib/preview-lo
 import { sessionFilesSetting, withoutPreviews } from '../lib/session-files-setting.js'
 import { withoutLinkMarkers } from '../lib/session-links.js'
 import { createSessionPreviewRouter } from './session-preview.js'
+import { organizerKey, sessionOrganizer, type OrganizerRowFields } from '../lib/session-organizer.js'
+import { listOlderSessions, shortRowFor, OLDER_DEFAULT_DAYS, OLDER_DEFAULT_LIMIT, OLDER_MAX_DAYS, OLDER_MAX_LIMIT, OLDER_MIN_DAYS } from '../lib/agent-session-older.js'
+import { cachedListModel, warmListModels } from '../lib/list-model-memo.js'
+import { cosStartedSessionIds } from '../lib/cos-started-sessions.js'
+
+/** Step 2a: the organizer, or null when it is unavailable or empty (the list is then exactly today's). */
+function organizerForList(): ReturnType<typeof sessionOrganizer> | null {
+  try {
+    const o = sessionOrganizer()
+    return o.isAvailable() && !o.isEmpty() ? o : null
+  } catch {
+    return null
+  }
+}
+/** Claude Desktop ids per CLI id, from the request's alias table (an entry written under a Desktop id still matches). */
+function desktopIdsByCli(aliases: ClaudeAliasMap | undefined): Map<string, string[]> {
+  const out = new Map<string, string[]>()
+  for (const [desktopId, head] of aliases ?? new Map()) {
+    const cli = head?.cliSessionId
+    if (!cli || cli.startsWith('!')) continue
+    out.set(cli, [...(out.get(cli) ?? []), desktopId])
+  }
+  return out
+}
+function organizerFieldsOf(o: ReturnType<typeof sessionOrganizer> | null, provider: string, sessionId: string, desktopIds?: Map<string, string[]>): OrganizerRowFields {
+  if (!o) return {}
+  const id = sessionId.toLowerCase()
+  return o.fieldsForAny([organizerKey(provider, id)], provider === 'claude' ? desktopIds?.get(id) ?? [] : [])
+}
 
 export const agentSessionsRouter = Router()
 // Preview engine phase 1: GET /api/preview/agent-sessions/... and /api/preview-folders/settings (routes/session-preview.ts).
@@ -511,7 +540,17 @@ agentSessionsRouter.get('/agent-sessions', async (req, res) => {
     const peers = await liveClaudePeerRecords()
     const live = liveClaudeRows(peers)
     const dropped = emptySessionListDropped()
-    const sessions = await listAgentSessions(roots, new Date(), live, limit, sort, dropped, aliases)
+    // Step 2a: COS pins and folder members are listed at any age, outside the cap and `limit`.
+    const organizer = organizerForList()
+    const desktopIds = organizer ? desktopIdsByCli(aliases) : undefined
+    // 7.0.25 (lead 2026-11-11 10:29): kept rows only for a client that ASKS (`kept=1`, Control Web). The public lens
+    // (6.11.681) and Control Mac (0.5.389) do not clamp to their own limit, so a server-only update would have added
+    // up to KEPT_LIST_MAX rows to their lists unasked. Without the parameter the walk gets no keep set at all: exactly
+    // the 7.0.18 selection (same rows, same limit). The organizer fields on rows stay (additive, ignored by them).
+    const wantsKept = req.query.kept === '1'
+    // Miles, 2026-11-10: sessions a COS job started in the last 7 days stay listed (memoized journal read).
+    const started = wantsKept ? await cosStartedSessionIds() : {}
+    const sessions = await listAgentSessions(roots, new Date(), live, limit, sort, dropped, aliases, wantsKept && organizer ? organizer.keptIds() : {}, started)
     // 6.45.5: each row's last real activity, read from its transcript records. Memoized on
     // mtime and size, so a steady poll re-reads nothing; bounded so a cold list of 80 rows
     // never holds 80 descriptors at once.
@@ -583,8 +622,12 @@ agentSessionsRouter.get('/agent-sessions', async (req, res) => {
         const signal = signalFor(row.session_id)
         const facts = rolloutById.get(row.session_id) ?? null
         const hint = runningHintFor(row.provider, derived, hintClock(signal, derived, facts), now, clocks.get(row.session_id) ?? null)
+        // Step 2a: the model only from the memo (never a read on the list path, 6.62.0 W11).
+        const model = cachedListModel(row.provider, row.file, Number.isFinite(Date.parse(row.modified)) ? Date.parse(row.modified) : null)
         return {
           ...withRunning(toEntry(row, activity[index], derived, queuedOf(row.provider, row.session_id)), running, hint),
+          ...organizerFieldsOf(organizer, row.provider, row.session_id, desktopIds),
+          ...(model ? { reported_model: model } : {}),
           ...cursorActivityFields(row.provider, signal),
           ...(row.provider === 'codex'
             ? { ...(subagents.has(row.session_id) ? { subagent_activity: subagents.get(row.session_id) } : {}), ...codexCompactionFields(workObservationFor(row.session_id), facts, now) }
@@ -602,13 +645,57 @@ agentSessionsRouter.get('/agent-sessions', async (req, res) => {
       // client ignores this key. Zero means the walk found nothing to hide, not
       // that the caps are off.
       dropped,
+      ...(organizer ? { organizer: { rev: organizer.rev() } } : {}),
     }))
+    // Step 2a: read the models this answer lacked, in the background, for a later poll. Never awaited.
+    warmListModels(sessions)
   } catch (error) {
     console.error(`[agent-sessions] list failed: ${error instanceof Error ? error.message : error}`)
     res.status(500).json({ error: 'Failed to read agent sessions', reason: 'agent_sessions_read_failed' })
   }
 })
 
+// Step 2a (S1_CONTRACT_step2a.md B2): the last `days` days in a short form, paged, for the compact groups. Not on the
+// list poll: fetched when the list opens and as a group unfolds. Live rows, COS-kept rows and each agent's own pins are
+// left out (the main list has them in full); a row may still also be in the main list, and the client keeps that one.
+agentSessionsRouter.get('/agent-sessions/older', async (req, res) => {
+  res.set('Cache-Control', 'private, no-store')
+  try {
+    const days = boundedInteger(req.query.days, OLDER_DEFAULT_DAYS, OLDER_MIN_DAYS, OLDER_MAX_DAYS)
+    const limit = boundedInteger(req.query.limit, OLDER_DEFAULT_LIMIT, 1, OLDER_MAX_LIMIT)
+    const beforeRaw = typeof req.query.before === 'string' ? Date.parse(req.query.before) : NaN
+    if (typeof req.query.before === 'string' && !Number.isFinite(beforeRaw)) {
+      res.status(400).json({ error: 'before must be an ISO time', reason: 'invalid_before' })
+      return
+    }
+    const roots = agentSessionRoots()
+    const aliases = await loadClaudeDesktopAliases(roots.claudeCodeSessions)
+    const organizer = organizerForList()
+    const kept = organizer ? organizer.keptIds() : { claude: new Set<string>(), codex: new Set<string>(), cursor: new Set<string>() }
+    const started = await cosStartedSessionIds()
+    for (const provider of ['claude', 'codex', 'cursor'] as const) for (const id of started[provider]) kept[provider].add(id)
+    // Kept Claude ids may be Desktop ids; the walk names transcripts by CLI id.
+    for (const id of [...kept.claude]) { const cli = aliases.get(id)?.cliSessionId; if (cli && !cli.startsWith('!')) kept.claude.add(cli) }
+    const liveIds = new Set(liveClaudeRows(await liveClaudePeerRecords()).map(row => row.session_id.toLowerCase()))
+    const result = await listOlderSessions(roots, new Date(), {
+      days, limit, aliases,
+      ...(Number.isFinite(beforeRaw) ? { before: beforeRaw } : {}),
+      // Kept rows come back here at any age: the main list holds at most KEPT_LIST_MAX of them (Q1 FIX 1).
+      exclude: { claude: liveIds },
+      keep: kept,
+    })
+    res.json(redactLocalPathsDeep({
+      sessions: result.rows.map(row => ({ ...row, ...organizerFieldsOf(organizer, row.provider, row.session_id, desktopIdsByCli(aliases)) })),
+      windowDays: days,
+      next_before: result.nextBefore,
+      ...(Number.isFinite(beforeRaw) ? {} : { older_than_window: result.olderThanWindow }),
+    }))
+  } catch (error) {
+    console.error(`[agent-sessions] older list failed: ${error instanceof Error ? error.message : error}`)
+    res.status(500).json({ error: 'Failed to read older agent sessions', reason: 'agent_sessions_read_failed' })
+  }
+})
+
 agentSessionsRouter.get('/agent-sessions/search', async (req, res) => {
   res.set('Cache-Control', 'private, no-store')
   const query = typeof req.query.q === 'string' ? req.query.q.trim() : ''
@@ -619,6 +706,23 @@ agentSessionsRouter.get('/agent-sessions/search', async (req, res) => {
   try {
     const limit = boundedInteger(req.query.limit, 20, 1, 50)
     const result = await searchAgentSessions({ query, limit })
+    // Step 2a: a session renamed in COS is found by its new title too (the agent's own title still matches as before).
+    const organizer = organizerForList()
+    if (organizer) {
+      const seen = new Set(result.hits.map(hit => organizerKey(hit.provider, hit.session_id)))
+      const roots = agentSessionRoots()
+      const extra: AgentSessionSearchHit[] = []
+      for (const match of organizer.titleMatches(query)) {
+        if (seen.has(organizerKey(match.provider, match.session_id)) || extra.length + result.hits.length >= limit) continue
+        const file = await findAgentSessionFile(match.provider, match.session_id, roots).catch(() => null)
+        const short = file ? await shortRowFor(match.provider, file, undefined, roots) : null
+        if (!short) continue
+        extra.push({ session_id: short.session_id, provider: short.provider, display_label: short.display_label, project: short.project,
+          modified: short.modified, created: short.created, alive: false, state: 'recent', pinned: false,
+          snippet: '', keywordScore: 1, semanticScore: 0, match: 'keyword' })
+      }
+      result.hits = [...extra, ...result.hits]
+    }
     const queuedOf = await allQueuedWaitingLookup(Date.now())
     // 6.48.1: search hits carry the same derived state as list rows (no list/search shape
     // drift), from the registry and the hook signal; a hit has no transcript walk.
@@ -644,7 +748,7 @@ agentSessionsRouter.get('/agent-sessions/search', async (req, res) => {
     // 7.0.4 S1: search hits carry snippets of the same words.
     res.json(redactLocalPathsDeep({
       ...result,
-      hits: result.hits.map(hit => toSearchHit(hit, queuedOf(hit.provider, hit.session_id), derivedFor(hit))),
+      hits: result.hits.map(hit => ({ ...toSearchHit(hit, queuedOf(hit.provider, hit.session_id), derivedFor(hit)), ...organizerFieldsOf(organizer, hit.provider, hit.session_id) })),
     }))
   } catch (error) {
     console.error(`[agent-sessions] search failed: ${error instanceof Error ? error.message : error}`)

package/server/routes/health.ts

@@ -10,6 +10,7 @@ import { DICTATION_CLEAN_MODELS } from '../lib/dictation-clean-models.js'
 import { customInstructionsCapability, learnedStyleCapability, polishOptionsCapability } from './dictation-polish-settings.js'
 import { PAIRING_PROTOCOL_VERSION } from '../lib/glasses-pairing.js'
 import { taskBridgeAvailable } from '../lib/task-bridge.js'
+import { modelEfforts } from '../lib/model-efforts.js'
 import { Router } from 'express'
 import { webKeyAuthorityEnabled } from '../lib/web-key-authority.js'
 import { isWorthRecovering } from '../lib/quarantine-auto-recover.js'
@@ -712,6 +713,8 @@ healthRouter.get('/models', async (req, res) => {
       ...cursorOptions,
       ...ollamaOptions,
     ],
+    // Step 2a (Sessions chat-style layout): each agent's efforts, the values POST /api/query-jobs accepts. Additive.
+    efforts: modelEfforts(),
     cursor: cursorCatalog,
     cursorReady: isCursorProviderReady(),
     ollama: {

package/server/routes/session-organizer.ts

@@ -0,0 +1,149 @@
+/**
+ * Session organizer routes (Sessions chat-style layout, step 2a; S1_CONTRACT_step2a.md, A1).
+ *
+ *   GET    /api/session-folders
+ *   POST   /api/session-folders                              { name }
+ *   PATCH  /api/session-folders/:id                          { name }
+ *   DELETE /api/session-folders/:id                          (its sessions leave it; no session is deleted)
+ *   PATCH  /api/agent-sessions/:provider/:sessionId/organizer { folder_id?, cos_pinned?, title? }
+ *
+ * Behind index.ts's /api gate (API token, or a browser cookie with `x-cos-web: 1` and a same-origin Origin).
+ * The session route canonicalizes the id from the transcript it finds, so a Claude Desktop id and its CLI id are
+ * one key, and a session the server cannot find is refused (404) instead of stored.
+ * Logs carry reason codes only: never a folder name or a title.
+ */
+import { Router, type Request, type Response } from 'express'
+import {
+  agentSessionRoots,
+  findAgentSessionFile,
+  idFromCodexFilename,
+  isSafeSessionId,
+  loadClaudeDesktopAliases,
+  normalizeClaudeSessionId,
+  type AgentProvider,
+  type AgentSessionRoots,
+} from '../lib/agent-session-store.js'
+import { OrganizerError, organizerKey, sessionOrganizer, type SessionOrganizer } from '../lib/session-organizer.js'
+
+const PROVIDERS: ReadonlySet<string> = new Set(['claude', 'codex', 'cursor'])
+
+export interface SessionOrganizerRouteDeps {
+  organizer: () => SessionOrganizer
+  roots: () => AgentSessionRoots
+  /** The canonical id of a session the server can find on disk, or null. */
+  canonicalId: (provider: AgentProvider, sessionId: string, roots: AgentSessionRoots) => Promise<SessionIdentity | null>
+}
+
+/** Where a session's organizer entry lives: its canonical id, and for Claude the Desktop id it was named by when one is
+ *  known. `null`: the server cannot find the session. Throws 409 alias_conflict while Claude Desktop's records disagree
+ *  about the session's CLI id (Q1 FIX 2): an entry written then could be orphaned when they settle. */
+export interface SessionIdentity { id: string; desktopId?: string }
+
+/** The id a found transcript names: Claude's CLI uuid (a Desktop id resolves to it), Codex's rollout id, Cursor's composer. */
+export async function canonicalSessionId(provider: AgentProvider, sessionId: string, roots: AgentSessionRoots): Promise<SessionIdentity | null> {
+  if (!isSafeSessionId(sessionId)) return null
+  if (provider === 'claude') {
+    // A Desktop id may arrive as `local_<uuid>`; the alias table and transcripts use the bare uuid.
+    sessionId = normalizeClaudeSessionId(sessionId)
+    const aliases = await loadClaudeDesktopAliases(roots.claudeCodeSessions)
+    if (aliases.has(sessionId) && aliases.get(sessionId) === null) throw new OrganizerError(409, 'alias_conflict')
+    const head = aliases.get(sessionId)
+    const file = await findAgentSessionFile('claude', sessionId, roots, new Date(), aliases)
+    if (file) {
+      const id = (file.split('/').pop() || '').replace(/\.jsonl$/, '').toLowerCase()
+      if (!id) return null
+      // The Desktop id: the one asked for when it is an alias, else the single Desktop record that names this CLI id.
+      let desktopId: string | undefined = head ? sessionId : undefined
+      if (!desktopId) {
+        const named = [...aliases].filter(([, h]) => h?.cliSessionId === id).map(([d]) => d)
+        if (named.length === 1) desktopId = named[0]
+      }
+      return { id, ...(desktopId && desktopId !== id ? { desktopId } : {}) }
+    }
+    // A Desktop-only session (no CLI transcript yet): keyed by its Desktop id, which the list also shows.
+    if (head) return { id: sessionId, desktopId: sessionId }
+    return null
+  }
+  const file = await findAgentSessionFile(provider, sessionId, roots)
+  if (!file) return null
+  const parts = file.split('/')
+  const id = provider === 'codex'
+    ? idFromCodexFilename(parts[parts.length - 1] || '')
+    : (parts[parts.length - 2] || '').toLowerCase() || null
+  return id ? { id } : null
+}
+
+function fail(res: Response, error: unknown): void {
+  if (error instanceof OrganizerError) {
+    res.status(error.status).json({ error: error.reason, reason: error.reason })
+    return
+  }
+  console.error(`[session-organizer] write failed (reason=${(error as NodeJS.ErrnoException)?.code ?? 'error'})`)
+  res.status(500).json({ error: 'organizer_write_failed', reason: 'organizer_write_failed' })
+}
+
+export function createSessionOrganizerRouter(deps: SessionOrganizerRouteDeps = {
+  organizer: sessionOrganizer,
+  roots: () => agentSessionRoots(),
+  canonicalId: canonicalSessionId,
+}): Router {
+  const router = Router()
+  const noStore = (res: Response) => res.set('Cache-Control', 'private, no-store')
+
+  router.get('/session-folders', (_req: Request, res: Response) => {
+    noStore(res)
+    const o = deps.organizer()
+    if (!o.isAvailable()) return void res.status(503).json({ error: 'organizer_unavailable', reason: 'organizer_unavailable' })
+    res.json({ rev: o.rev(), folders: o.listFolders() })
+  })
+
+  router.post('/session-folders', (req: Request, res: Response) => {
+    noStore(res)
+    try {
+      const o = deps.organizer()
+      const folder = o.createFolder((req.body as { name?: unknown } | undefined)?.name)
+      res.status(201).json({ rev: o.rev(), folder })
+    } catch (error) { fail(res, error) }
+  })
+
+  router.patch('/session-folders/:id', (req: Request, res: Response) => {
+    noStore(res)
+    try {
+      const o = deps.organizer()
+      const folder = o.renameFolder(String(req.params.id), (req.body as { name?: unknown } | undefined)?.name)
+      res.json({ rev: o.rev(), folder })
+    } catch (error) { fail(res, error) }
+  })
+
+  router.delete('/session-folders/:id', (req: Request, res: Response) => {
+    noStore(res)
+    try {
+      const o = deps.organizer()
+      const released = o.deleteFolder(String(req.params.id))
+      res.json({ rev: o.rev(), released })
+    } catch (error) { fail(res, error) }
+  })
+
+  router.patch('/agent-sessions/:provider/:sessionId/organizer', async (req: Request, res: Response) => {
+    noStore(res)
+    const provider = String(req.params.provider)
+    if (!PROVIDERS.has(provider)) return void res.status(400).json({ error: 'invalid_provider', reason: 'invalid_provider' })
+    // A Claude Desktop id arrives as `local_<uuid>`; the bare uuid is the id everywhere else.
+    const sessionId = provider === 'claude' ? normalizeClaudeSessionId(String(req.params.sessionId)) : String(req.params.sessionId)
+    if (!isSafeSessionId(sessionId)) return void res.status(400).json({ error: 'invalid_session_id', reason: 'invalid_session_id' })
+    const body = req.body && typeof req.body === 'object' && !Array.isArray(req.body) ? req.body as Record<string, unknown> : {}
+    const change: { folder_id?: unknown; cos_pinned?: unknown; title?: unknown } = {}
+    for (const key of ['folder_id', 'cos_pinned', 'title'] as const) if (Object.prototype.hasOwnProperty.call(body, key)) change[key] = body[key]
+    try {
+      const o = deps.organizer()
+      if (!o.isAvailable()) throw new OrganizerError(503, 'organizer_unavailable')
+      if (Object.keys(change).length === 0) throw new OrganizerError(400, 'empty_change')
+      const identity = await deps.canonicalId(provider as AgentProvider, sessionId, deps.roots())
+      if (!identity) throw new OrganizerError(404, 'session_not_found')
+      const fields = o.updateSession(organizerKey(provider, identity.id), change, { desktopId: identity.desktopId })
+      res.json({ rev: o.rev(), session: { provider, session_id: identity.id, ...fields } })
+    } catch (error) { fail(res, error) }
+  })
+
+  return router
+}

package/server/routes/thread-turn-queue.ts

@@ -21,7 +21,7 @@ import { CONTINUE_NOTE_HEADER, continueNoteAcknowledged } from '../lib/continue-
 import { nativeQueueControl, plainQueueText, type NativeQueueControl } from '../lib/codex-queue-control.js'
 import { CLIENT_TURN_ID_RE, COS_SESSION_ID_RE, DEFAULT_MAX_PROMPT_CHARS } from './agent-session-bindings.js'
 import {
-  admitToQueue, drainDecision, queueableRefusal, queuePosition,
+  admitToQueue, drainDecision, holdReasonFor, queueableRefusal, queuePosition,
   MAX_DELIVERY_ATTEMPTS, type DrainObservation, type QueuedThreadTurn,
   queueReconcileEnabled, queueResendEnabled, queuedTurnReasonCopy, sessionSteerAvailability, sessionSteerEnabled,
   steerMidturnEnabled, type SessionSteerAvailability,
@@ -153,6 +153,14 @@ export function steerAvailabilityFor(deps: Pick<ThreadTurnQueueDeps, 'steerProbe
   return sessionSteerAvailability({ provider, gateReason, continueLive, peerInbox: probe.peerInbox, waitingOnPrompt: probe.waitingOnPrompt })
 }
 
+/**
+ * When a sweep last decided each held row (epoch ms), in memory only: the row file is written when its hold
+ * reason CHANGES, not every 20 s. Bounded; a settled row is forgotten.
+ */
+const holdCheckedAt = new Map<string, number>()
+const HOLD_CHECKED_MAX = 1_000
+export function __resetHoldCheckedForTests(): void { holdCheckedAt.clear() }
+
 /** Public shape of a queued turn. No prompt echo beyond a short preview. */
 export function publicRow(turn: QueuedThreadTurn, position: number): Record<string, unknown> {
   const row: Record<string, unknown> = {
@@ -169,6 +177,12 @@ export function publicRow(turn: QueuedThreadTurn, position: number): Record<stri
     ...(turn.settledAt ? { settledAt: turn.settledAt } : {}),
     // 11/07: how many files wait with the words (never their ids or paths). Absent without files.
     ...(Array.isArray(turn.attachmentIds) && turn.attachmentIds.length > 0 ? { attachments: turn.attachmentIds.length } : {}),
+    // 2026-11-11: why a waiting row is held (a code), since when, and when a sweep last decided it. Additive.
+    ...(turn.status === 'waiting' && typeof turn.holdReason === 'string' ? {
+      waiting_reason: turn.holdReason,
+      ...(typeof turn.holdSince === 'number' ? { waiting_since: turn.holdSince } : {}),
+      ...(holdCheckedAt.has(turn.clientTurnId) ? { waiting_checked_at: holdCheckedAt.get(turn.clientTurnId) } : {}),
+    } : {}),
   }
   // 6.78.0: additive, and only while a P3 flag is on, so the row is the 6.77 bytes otherwise.
   // `resendable` is the per-row capability: present only when Send again can act on it.
@@ -242,7 +256,7 @@ function localDrainVerdict(at: number): OriginVerdict {
 }
 
 /** What one mid-turn attempt did to its row: delivered, settled some other way, or left waiting. */
-type MidTurnOutcome = 'delivered' | 'settled' | 'held'
+type MidTurnOutcome = 'delivered' | 'settled' | 'held' | 'held_files'
 
 /**
  * Steer mid-turn (COS_STEER_MIDTURN, Miles 2026-11-07): put ONE waiting row into the running turn
@@ -279,9 +293,11 @@ async function steerHeldTurn(
   deps: ThreadTurnQueueDeps,
 ): Promise<MidTurnOutcome> {
   if (turn.status !== 'waiting' || turn.attempts !== 0) return 'held'
-  if (Array.isArray(turn.attachmentIds) && turn.attachmentIds.length > 0) return 'held'
   const availability = midTurnAvailabilityFor(deps, provider, threadId, gateReason)
   if (!availability || !availability.available) return 'held'
+  // Files never go into a running turn (the peer inbox carries words only). Checked AFTER availability, so
+  // `held_files` means exactly this: the turn could have gone in now but for its files (the row's hold reason).
+  if (Array.isArray(turn.attachmentIds) && turn.attachmentIds.length > 0) return 'held_files'
   const { clientTurnId, prompt } = turn
 
   const rewrite = (apply: (row: QueuedThreadTurn) => void): QueuedThreadTurn | null => {
@@ -465,11 +481,19 @@ export async function drainThread(
       // which also means the hold is the busy GATE: the rule answers only for a refusal that
       // names a desk run (an attachable thread has no reason). Anything else holds as before.
       const cancelHeld = typeof seen.cancelHoldUntil === 'number' && Number.isFinite(seen.cancelHoldUntil) && deps.now() < seen.cancelHoldUntil
+      let reason = holdReasonFor(seen, deps.now())
       if (!midTurnOrderHeld && !cancelHeld) {
         const outcome = await steerHeldTurn(provider, threadId, turn, gate.reason, deps)
-        if (outcome === 'delivered') { delivered += 1; continue }
-        if (outcome === 'settled') { retired += 1; continue }
+        if (outcome === 'delivered') { holdCheckedAt.delete(turn.clientTurnId); delivered += 1; continue }
+        if (outcome === 'settled') { holdCheckedAt.delete(turn.clientTurnId); retired += 1; continue }
+        if (outcome === 'held_files') reason = 'files_wait_for_turn_end'
       }
+      // The hold reason: written only when it changes; the check time is kept in memory (2026-11-11).
+      const at = deps.now()
+      if (turn.holdReason !== reason) { turn.holdReason = reason; turn.holdSince = at; persist(turn) }
+      holdCheckedAt.delete(turn.clientTurnId)
+      holdCheckedAt.set(turn.clientTurnId, at)
+      while (holdCheckedAt.size > HOLD_CHECKED_MAX) holdCheckedAt.delete(holdCheckedAt.keys().next().value!)
       midTurnOrderHeld = true
       held += 1
       continue
@@ -480,6 +504,7 @@ export async function drainThread(
       turn.settledAt = deps.now()
       retired += 1; persist(turn)
       forgetIfSettled(turn)
+      holdCheckedAt.delete(turn.clientTurnId)
       continue
     }
 
@@ -488,6 +513,10 @@ export async function drainThread(
     // forever; the ceiling only bounds anything if it survives the crash it is bounding.
     turn.attempts += 1
     turn.status = 'delivering'
+    // No longer held: the reason belonged to the wait that just ended.
+    delete turn.holdReason
+    delete turn.holdSince
+    holdCheckedAt.delete(turn.clientTurnId)
     // 6.78.0: the stamp the restart reconcile reads. `journal: 1` says this build keeps an
     // attempt record for the delivery that follows; `deliveringBootId` says which boot owns
     // it, so a sweep never touches a row this process is delivering right now. Durable:

package/server/routes/web-key.ts

@@ -43,9 +43,21 @@ export interface WebKeyRouterDeps {
   isWebRequest: (req: Request) => boolean
   apiToken: () => string
   selfDnsName: () => string | null
+  /**
+   * 7.0.14: when selfDnsName() is null, GET status (after its auth check) awaits this before it
+   * answers, so a boot-time miss does not hand COS Control `origin: null` (lib/tailnet-self-name.ts
+   * refreshIfMissing: bounded, single-flight, rate-limited). Never called while a name is known.
+   */
+  refreshSelfDnsName?: () => Promise<unknown>
   expectedOrigin: () => string | null
   /** Served-asset integrity (Phase 6) for Control's audit; absent: not reported. */
   integrityStatus?: () => Record<string, unknown>
+  /**
+   * B2: whether 3144 presents a publicly trusted certificate for this Mac's tailnet name, and why not
+   * (lib/web-key-signer-tls.ts SignerTlsStatus, e.g. `tailnet_https_certs_off`). Authority mode only;
+   * absent or null (no 3144 listener): not reported.
+   */
+  signerTls?: () => object | null
   /**
    * Phase 3: whether this request reached the 3144 signer listener (index.ts: the socket's local
    * port). Given, the phone's key steps (enroll start and prove, nonce) and the handoff claim answer
@@ -97,13 +109,27 @@ export function createWebKeyRouter(deps: WebKeyRouterDeps): Router {
     next()
   }
 
-  router.get('/web-key/status', anchorRoutes, (req, res) => {
+  // 7.0.14: a request that passed the status route's own auth check, while this Mac's tailnet name is
+  // unknown, waits for one bounded lookup instead of answering a stale miss. Known name: no wait.
+  const learnSelfName = async (): Promise<void> => {
+    if (!deps.refreshSelfDnsName || deps.selfDnsName() !== null) return
+    try { await deps.refreshSelfDnsName() } catch { /* answer with what is known */ }
+  }
+
+  const signerTlsField = (): { signerTls?: object } => {
+    let state: object | null = null
+    try { state = deps.signerTls?.() ?? null } catch { state = null }
+    return state ? { signerTls: state } : {}
+  }
+
+  router.get('/web-key/status', anchorRoutes, async (req, res) => {
     const registry = deps.authority.registry
-    const selfDns = deps.selfDnsName()
     if (deps.authority.mode() !== 'authority') {
       // Bootstrap only: COS Control's anchor state, nothing that suggests approvals. Token only:
       // no web page needs it while no phone can enroll. `enabled: false` keeps older Controls hidden.
       if (!hasToken(req)) return refuse(res, 401, 'unauthorized')
+      await learnSelfName()
+      const selfDns = deps.selfDnsName()
       const anchor = registry.anchor()
       return void res.json({
         ok: true,
@@ -118,6 +144,8 @@ export function createWebKeyRouter(deps: WebKeyRouterDeps): Router {
       })
     }
     if (!hasToken(req) && !web(req)) return refuse(res, 401, 'unauthorized')
+    await learnSelfName()
+    const selfDns = deps.selfDnsName()
     res.json({
       ok: true,
       enabled: true,
@@ -131,6 +159,7 @@ export function createWebKeyRouter(deps: WebKeyRouterDeps): Router {
       epoch: registry.epoch(),
       activeKeys: registry.activeCount(selfDns),
       ...(deps.integrityStatus ? { integrity: deps.integrityStatus() } : {}),
+      ...signerTlsField(),
     })
   })
 

package/server/web-control/.manifest.json

@@ -2,14 +2,14 @@
   "v": 1,
   "algorithm": "sha256",
   "files": {
-    "/app.css": "0d3ebbf2ca167bc9ef6ab8efef41618f514cc4f505ae588642d36935249697af",
-    "/app.js": "3c489b154588908178de5b70b18ee8184ec9256e99f774177b9e35ceb27eb362",
+    "/app.css": "1204f3b57d312c94e96a1430ba036292873ecbe132073c8a4f03e37063172a70",
+    "/app.js": "1491f6dd957f47881e55a47caf98a3ce8fcb6df43a58b6e6877dd86807bebea6",
     "/apple-touch-icon.png": "04ec7eca0bf6f53d89900d146ac32d4826759d6258bcdbd1ccdcc517f26f532c",
     "/control.css": "e7b287aa4acc1b3895a9ce61512fe449c555b6335a7145684fd78108ae008c75",
     "/fonts/DMSans.ttf": "8cd08d97e89c24d0aa92edd2f0f4c8ee6195eee9b7c9f154865a58b02f0c1c0d",
     "/fonts/Fraunces.ttf": "177ff6c0f14e5550a3c624247cd1189611d4eb65d000b14944c63d967958abbb",
     "/fonts/JetBrainsMono.ttf": "48715a42ec242c21e9f02692891e147d022299a52e48d5e413e1a942193ffeda",
-    "/index.html": "26ee9cd1f68829ae5f47dcc7a0c2e45a40d28c4ee65d0537f0677b13ea727267",
+    "/index.html": "8664ebf9ae7635c1fcf5fce333b89d272b6ce0df9529120523b99a3d49eb5ebb",
     "/mark.svg": "8e380d33d393027df192eb1afa08f15a380c2070c72d68f27311b49d9e94ca18",
     "/memories/d3.min.js": "f2094bbf6141b359722c4fe454eb6c4b0f0e42cc10cc7af921fc158fceb86539",
     "/memories/graph-explorer.css": "ec128de59811f45c71b6bededd737989309205e903951eb8211ade7664f87486",
@@ -28,17 +28,17 @@
     "/panes/questions.css": "5c5a9b32ce32386b508ce326b17d40ecacbb0f2e049df7f4fe2a0009bd3b7908",
     "/panes/questions.js": "228e8cd0a9651a290cbb380db487af677a2fc7e93a64b1e33c9411cd8b013478",
     "/panes/reader-media.js": "4cf892a855aa2d0dce6978e69296cd49b8036d8fc62f12773b3fcadc210b2ef0",
-    "/panes/sessions.css": "fa2e714e7b03459e12407f7125ab0e1eb7d12a4cc9341a2442dc73900f5a3081",
+    "/panes/sessions.css": "654e0509ab2b699b9ea92b6d9e2f7522146df1f0b6355915bef03caaf63addc4",
     "/panes/settings.js": "5c46c951fdcc2fc942486ec4b468b7e0bb0350a0a56a38d429948fc5147ab2f4",
     "/panes/speakers.css": "49e70dae4266151b14b0057f2e43de169de225b8f3ac30343c81cf532735a487",
     "/panes/speakers.js": "8132c9244fb3965de802680840d2985978571988b9b4462b347d079330251bc5",
     "/panes/threads.js": "45fd7b56480be53225e91193cfa4c41a4ee7167890f10560e439bc7d2461747f",
     "/panes/today-actions.css": "c82f95b2aaf09802b15d47b24eccdb5c974afcab38ff5f861b3a8d8630b60869",
-    "/panes/today-actions.js": "4fbc51dc624f9e4cdc85db89905f019a8a5961e4984e8733e0525c71cf0e8657",
+    "/panes/today-actions.js": "57ae8b378b1061060ae2a3f61d227d440d7806538085c1d5b310239c036e4bdc",
     "/panes/work.css": "da50355dac690f712d1f6331f70ee5eadbf5982d37508648ae7786afc99ac7b1",
-    "/panes/work.js": "0425f53fba98ca34496486d914c3b03f95de3c2a651dc0c88a2a20bc4f6407cd",
+    "/panes/work.js": "1ef872b8c7e1a57bd7bd314e11eee7ac5fa9668871da7e644a1fbf5fd9c0d9e8",
     "/shell.js": "f1cc6a52c78e01ddba89ff27c6bd0e8f8bd8f29bdfcbb5150ee4ed66a8128d9d",
-    "/theme.js": "700453683539c9efcde014ef1eb088c39478dad54f1ef53fa5e2dee9b36f0a3f",
+    "/theme.js": "e3e6422eaac43979d03149da114f5b83757b7361dd7b309cdf76be36a596044b",
     "/vendor/qrcode-encoder.js": "61d87cc7445cc66b862cff913de4571634746ea62bcd50d0f592be14f6d1ce46"
   }
 }

package/server/web-control/app.css

@@ -106,6 +106,15 @@ a { color: var(--accent); }
 svg.icon { width: 22px; height: 22px; flex: none; fill: none; stroke: currentColor; stroke-width: 1.6; stroke-linecap: round; stroke-linejoin: round; }
 
 /* ── Sign in ─────────────────────────────────────────────── */
+/* 7.0.19 first paint: the mark on the page's background until the sign-in card or the app shows (index.html #first-paint).
+   Fixed, so it is out of the layout and nothing shifts when it goes. Only while theme.js has run (html.fp-wait), so it
+   never shows with JavaScript off. The failsafe hides it after 25 s, longer than the 20 s sign-in check, so it ends the
+   wait only when the scripts never ran; reduced motion shortens durations, not this delay. */
+.first-paint { display: none; }
+html.fp-wait .first-paint { position: fixed; inset: 0; z-index: 70; display: grid; place-items: center; background: var(--page); color: var(--ink); pointer-events: none; animation: fp-failsafe 1ms linear 25s forwards; }
+.first-paint .mark { width: 44px; height: 44px; }
+@keyframes fp-failsafe { to { visibility: hidden; } }
+.noscript-note { margin: 0; min-height: 100dvh; display: grid; place-items: center; padding: 24px var(--gutter); font-size: 17px; color: var(--ink); text-align: center; }
 .auth-gate { min-height: 100dvh; display: grid; place-items: center; padding: calc(var(--safe-top) + 24px) var(--gutter) calc(var(--safe-bottom) + 24px); }
 .auth-card { width: 100%; max-width: 420px; }
 .auth-card .mark { width: 44px; height: 44px; margin-bottom: 22px; }
@@ -644,3 +653,57 @@ html { touch-action: manipulation; }
 .sx-te-choices, .ta-te-choices { display: flex; flex-wrap: wrap; gap: 8px; margin: 8px 0 6px; }
 .sx-te-choices .cx-btn, .ta-te-choices .cx-btn { flex: 1 1 12rem; min-height: 44px; white-space: normal; text-align: center; line-height: 1.25; }
 .sx-mac-q .sx-note { margin: 6px 0 0; }
+
+/* ── 7.0.29: the folded Duo's side rail (Miles 21:39 "These side buttons are a must on the duo"; 21:42 tall phones keep
+   the top menu). theme.js sets html.short-screen from the screen's shape; this draws it only under 600 px on a touch
+   screen, so nothing changes from 600 px, on a mouse, or on a tall phone. It is the same nav.rail as the wide rail, so
+   the panes, their order, icons, badges and aria-current are one list: here it moves to the right edge as icons only,
+   with the top bar's Back at its foot on a reader. --rail-hit is 44 points on the phone: app.js railHitSync sets it from
+   the zoom (52 px at Safari's 85 percent Page Zoom, 44 px at 100); 52 px until it runs. Colours are the rail's own
+   tokens; the current pane keeps the wide rail's look (rail-active fill and its small shadow, no border). */
+.rail-back { display: none; }
+@media (max-width: 599px) and (pointer: coarse) {
+  html.short-screen { --rail-w: calc(var(--rail-hit, 52px) + 6px); }
+  html.short-screen .app-shell { display: flex; flex-direction: row; align-items: flex-start; }
+  html.short-screen.sx-frame .app-shell { flex-direction: row; align-items: stretch; }
+  html.short-screen .main-col { flex: 1 1 auto; min-width: 0; --safe-right: 0px; }
+  html.short-screen .rail {
+    order: 2; flex: none; width: calc(var(--rail-w) + var(--safe-right)); box-sizing: border-box;
+    display: flex; flex-direction: column; align-items: center; gap: 0;
+    position: sticky; top: 0; height: 100dvh; overflow-x: hidden; overflow-y: auto; overscroll-behavior: contain; scrollbar-width: none;
+    padding: calc(var(--safe-top) + 4px) var(--safe-right) calc(var(--safe-bottom) + 6px) 0;
+    background: var(--rail); border-left: 1px solid var(--rail-border);
+  }
+  html.short-screen.sx-frame .rail { position: static; height: auto; min-height: 0; }
+  html.short-screen .rail::-webkit-scrollbar { display: none; }
+  html.short-screen .rail-head, html.short-screen .rail-text, html.short-screen .rail-settings .rail-label, html.short-screen .server-line { display: none; }
+  html.short-screen .rail-btn, html.short-screen .rail-settings {
+    position: relative; flex: none; display: grid; place-items: center;
+    width: var(--rail-hit, 52px); height: var(--rail-hit, 52px); min-height: 0; padding: 0;
+    border-radius: 12px; color: var(--grey);
+  }
+  html.short-screen .rail-btn .icon, html.short-screen .rail-settings .icon { width: 22px; height: 22px; }
+  html.short-screen .rail-btn[aria-current='page'], html.short-screen .rail-settings[aria-current='page'] { background: var(--rail-active); color: var(--ink); box-shadow: 0 1px 2px rgba(43, 33, 26, 0.08); }
+  html.short-screen .rail-btn:active:not([aria-current='page']), html.short-screen .rail-settings:active:not([aria-current='page']) { background: var(--rail-border); color: var(--ink); }
+  html.short-screen .rail-btn .badge-dot { top: 9px; right: 9px; }
+  html.short-screen .rail-btn.hot::after { content: ''; position: absolute; top: 9px; right: 9px; width: 8px; height: 8px; border-radius: 50%; background: var(--hot); }
+  html.short-screen .rail-btn .inbox-count { position: absolute; top: 4px; right: 2px; }
+  html.short-screen .rail-btn .inbox-dot { position: absolute; top: 9px; right: 9px; }
+  html.short-screen .rail-sep { flex: none; width: 24px; height: 1px; margin: 3px 0; background: var(--rail-border); }
+  html.short-screen .rail-spacer { display: none; }
+  /* Back: alone at the foot, outlined so it never reads as a pane; it stays on screen when the panes scroll. */
+  html.short-screen .rail-back:not([hidden]) {
+    display: grid; place-items: center; flex: none; margin-top: auto;
+    position: sticky; bottom: 0; z-index: 1;
+    width: var(--rail-hit, 52px); height: var(--rail-hit, 52px);
+    border: 1px solid var(--btn-border); border-radius: 12px; background: var(--rail); color: var(--ink);
+  }
+  html.short-screen .rail-back .icon { width: 22px; height: 22px; stroke-width: 2; }
+  html.short-screen .rail-back:active { background: var(--rail-border); }
+  /* The focus ring sits inside the button: the rail clips anything past its edge. */
+  html.short-screen .rail :focus-visible { outline: 2px solid var(--accent); outline-offset: -4px; border-radius: 12px; }
+  /* One way to switch panes on a screen: the rail. The top bar keeps the pane's name, without the caret and its menu
+     (app.js makes the button inert), and its Back moves to the rail. */
+  html.short-screen .section-btn .caret, html.short-screen #topbar-back { display: none !important; }
+  html.short-screen .section-btn { cursor: default; }
+}