@gotcos/glasses-server 7.0.30 → 7.0.34

package/server/lib/full-hold.ts

@@ -16,11 +16,33 @@
 
 import { readSwitch } from './env-switch.js'
 
-/** `COS_QUESTION_FULL_HOLD`: hold a question for the whole hook wait. Default OFF. Read per request. */
+/** `COS_QUESTION_FULL_HOLD` set explicitly ON (`1`, `true`, `on`). Unset is the default below, never this. Read per request. */
 export function questionFullHoldEnabled(env: NodeJS.ProcessEnv): boolean {
   return readSwitch(env.COS_QUESTION_FULL_HOLD, false)
 }
 
+/**
+ * X1, 7.0.34 (Miles 2026-11-13 15:02, "I want the 8 hour question hold ON. please keep it on by default."): the
+ * question hold has THREE states, decided in this order:
+ *   1. `COS_QUESTION_FULL_HOLD` set to on (`1`, `true`, `on`) or off (`0`, `false`, `off`): that, source `env`.
+ *   2. Else the server-side setting Control's Settings row writes (`lib/question-hold-setting.ts`), source `setting`.
+ *   3. Else `default`: ON BY DEFAULT, PENDING PER REQUEST. A question is held for the whole wait only when ITS OWN
+ *      hook stamped a wait longer than DEFAULT_HOLD_MIN_STAMP_S, which only the split question block Reinstall hooks
+ *      writes ever sends. Until a Mac reinstalls, every request reads exactly as 7.0.33 with the switch off.
+ * The env value wins over the setting: it is what the launcher or the person at the terminal set on purpose, and
+ * every release since 7.0.16 documents it as the off switch (rollback included). A Settings click must never undo it.
+ */
+export type QuestionHoldMode = 'on' | 'off' | 'default'
+export type QuestionHoldSource = 'env' | 'setting' | 'default'
+export type QuestionHoldSetting = 'on' | 'off'
+
+export function questionHoldMode(env: NodeJS.ProcessEnv, setting: QuestionHoldSetting | null = null): { mode: QuestionHoldMode; source: QuestionHoldSource } {
+  if (readSwitch(env.COS_QUESTION_FULL_HOLD, false)) return { mode: 'on', source: 'env' }
+  if (!readSwitch(env.COS_QUESTION_FULL_HOLD, true)) return { mode: 'off', source: 'env' }
+  if (setting === 'on' || setting === 'off') return { mode: setting, source: 'setting' }
+  return { mode: 'default', source: 'default' }
+}
+
 /** `COS_APPROVAL_FULL_HOLD`: hold a tool approval for the whole hook wait while the desk stays idle. Default OFF. */
 export function approvalFullHoldEnabled(env: NodeJS.ProcessEnv): boolean {
   return readSwitch(env.COS_APPROVAL_FULL_HOLD, false)
@@ -45,10 +67,16 @@ export function questionRowText(question: unknown): string {
   return question.replace(/[\p{Cc}\p{Cf}]+/gu, ' ')
 }
 
-export interface FullHoldSwitches { questions: boolean; approvals: boolean }
+/**
+ * `questions`: the question hold is ON outright (env or setting). `questionsByDefault`: it is the 7.0.34 default,
+ * which holds a question only when its own hook stamped a long wait (`defaultHoldTakesStamp`). Both false: off.
+ * A caller that predates 7.0.34 and passes only `questions` and `approvals` reads as off, exactly as before.
+ */
+export interface FullHoldSwitches { questions: boolean; approvals: boolean; questionsByDefault?: boolean }
 
-export function fullHoldSwitches(env: NodeJS.ProcessEnv): FullHoldSwitches {
-  return { questions: questionFullHoldEnabled(env), approvals: approvalFullHoldEnabled(env) }
+export function fullHoldSwitches(env: NodeJS.ProcessEnv, setting: QuestionHoldSetting | null = null): FullHoldSwitches {
+  const q = questionHoldMode(env, setting)
+  return { questions: q.mode === 'on', approvals: approvalFullHoldEnabled(env), questionsByDefault: q.mode === 'default' }
 }
 
 /**
@@ -107,9 +135,37 @@ export function engineProvenForFullHold(engine: EngineFacts | null | undefined):
   return version !== null && versionAtLeast(version, floor)
 }
 
-/** The PermissionRequest wait the installer writes for a kind under the full hold. */
+/** The PermissionRequest wait the installer writes for an APPROVAL under the full hold (7.0.16; unchanged). */
 export const FULL_HOLD_HOOK_WAIT_S = 3600
 
+/**
+ * X1 (Miles 2026-11-12 17:42, "8 hours"): how long a fully held QUESTION stays answerable from the web and the
+ * glasses. Everything below is derived from this one number:
+ *   the question block's `timeout`      = FULL_HOLD_QUESTION_WAIT_S = 8 h x 60 min x 60 s = 28,800 s
+ *   the longest stamp the script takes  = 28,800 (5 digits; `bin/hooks/cos-session-hook`, pinned by a test)
+ *   the longest stamp the broker trusts = HOOK_WAIT_STAMP_MAX_S = 28,800
+ *   the script's curl gives up at       = 28,800 - 5 = 28,795 s
+ *   the broker's deadline               = holdCeilingS = 28,800 - HOOK_REPLY_MARGIN_S (10) = 28,790 s
+ * so the deadline stays under the hook's own wait, as every release since 6.52.0 keeps it. Approvals keep
+ * FULL_HOLD_HOOK_WAIT_S. The Mac's own dialog has no limit past this: only the remote answer ends.
+ */
+export const FULL_HOLD_QUESTION_WAIT_HOURS = 8
+export const FULL_HOLD_QUESTION_WAIT_S = FULL_HOLD_QUESTION_WAIT_HOURS * 60 * 60
+/** The question block 7.0.16 to 7.0.31 wrote: an install from then reads as an earlier wait (`priorWaitOnly`), still halt-ready. */
+export const FULL_HOLD_QUESTION_WAIT_PRIOR_S = 3600
+
+/**
+ * X1, 7.0.34: under the default, a question is held for the whole wait only when its hook stamped MORE than this.
+ * The one block 6.60.0 to 7.0.33 writes stamps 630 and the 7.0.16 to 7.0.31 question block 3600, so neither does;
+ * only the split question block Reinstall hooks writes under 7.0.32 or later (28,800) does. The gate is the
+ * invocation's own stamp, so a session still running on hooks it loaded before Reinstall keeps 7.0.33's behaviour.
+ */
+export const DEFAULT_HOLD_MIN_STAMP_S = FULL_HOLD_QUESTION_WAIT_PRIOR_S
+
+export function defaultHoldTakesStamp(hookWaitS: number | null | undefined): boolean {
+  return typeof hookWaitS === 'number' && Number.isFinite(hookWaitS) && hookWaitS > DEFAULT_HOLD_MIN_STAMP_S
+}
+
 /**
  * The matcher of the non-question PermissionRequest block once the hook is split (canary C9:
  * honoured on both engines; a question runs only the `AskUserQuestion` block, everything else

package/server/lib/glasses-pairing.ts

@@ -64,7 +64,8 @@ export const PAIRING_REASON_STATUS: Record<PairingReason, number> = {
 }
 
 export const PAIRING_REASON_MESSAGE: Record<PairingReason, string> = {
-  bad_request: 'That pairing request was not understood. Scan the code again.',
+  // 7.0.32 (Miles 11/13 06:34): the glasses pair by the typed code only, so no pairing answer says scan.
+  bad_request: 'That pairing request was not understood. Check the code in COS Control and type it again.',
   not_loopback: 'Pairing codes are made only by COS Control on this Mac.',
   not_allowed_network: 'Connect over Tailscale, or turn on "Allow pairing on this Wi-Fi" in COS Control.',
   denied: 'Pairing was denied on the Mac.',

package/server/lib/permission-broker.ts

@@ -140,7 +140,7 @@ import { randomBytes } from 'node:crypto'
 import { boundForRedaction } from './activity-preview.js'
 import { inferHookProvider, toolFingerprint, SESSION_ID_RE, type HookEnvelope } from './session-hook-events.js'
 import { ASK_USER_QUESTION_TOOL, type SessionSignalStore } from './session-signal-store.js'
-import { WEB_ANSWER_TOUCH_MAX_MS, WEB_CONFIRM_TTL_MS, engineProvenForFullHold, type EngineFacts, type FullHoldSwitches } from './full-hold.js'
+import { FULL_HOLD_QUESTION_WAIT_S, WEB_ANSWER_TOUCH_MAX_MS, WEB_CONFIRM_TTL_MS, defaultHoldTakesStamp, engineProvenForFullHold, type EngineFacts, type FullHoldSwitches } from './full-hold.js'
 
 // ---------------------------------------------------------------------------
 // Configuration
@@ -228,7 +228,7 @@ export const LEGACY_HOOK_WAIT_S = 130
  */
 export const HOOK_REPLY_MARGIN_S = 10
 /** A `hookWaitS` stamp outside this range is not one the installer writes: no stamp. */
-export const HOOK_WAIT_STAMP_MAX_S = 3_600
+export const HOOK_WAIT_STAMP_MAX_S = FULL_HOLD_QUESTION_WAIT_S
 
 /**
  * 6.60.0: the longest a request may be held, in seconds, from the hook's own start.
@@ -748,6 +748,46 @@ export type BrokerItemKind = 'question' | 'approval'
 /** 6.99.27: the door an answer came through: the Even app with the API token, or COS Control Web's browser session. */
 export type AnswerSurface = 'app' | 'web'
 
+/**
+ * X1 (the one queue, 7.0.32 candidate): which surface answered, as the queue says it ("Answered on the glasses").
+ * `web` is the browser door. The token door names its client when it says so (`X-Cos-Client` or `?client=`:
+ * glasses, phone, mac_app); otherwise `cos` (a COS surface that did not say which). `mac` is the Mac's own dialog.
+ */
+export type QueueSurface = 'mac' | 'web' | 'glasses' | 'phone' | 'mac_app' | 'cos'
+const CLIENT_SURFACES: ReadonlySet<string> = new Set(['glasses', 'phone', 'mac_app'])
+
+export function answerSurfaceOf(by: AnswerSurface, client: unknown): QueueSurface {
+  if (by === 'web') return 'web'
+  const said = typeof client === 'string' ? client.trim().toLowerCase().replace(/-/g, '_') : ''
+  return CLIENT_SURFACES.has(said) ? said as QueueSurface : 'cos'
+}
+
+/**
+ * X1: an answered entry stays in the queue this long, saying where it was answered. The same window the waiting list
+ * already keeps an answered question for (WAITING_ANSWERED_KEEP_MS), so a question's answered entry is dropped by the
+ * list's own prune; an approval's by the check in `queueSources`.
+ */
+export const QUEUE_ANSWERED_KEEP_MS = 120_000
+
+/** X1: one waiting thing the broker knows of, for the queue (`lib/question-queue.ts` builds the wire entries). */
+export interface BrokerQueueSource {
+  key: string
+  sessionId: string
+  provider: 'claude' | 'codex'
+  kind: 'question' | 'approval'
+  tool: string
+  questions: BrokerQuestion[]
+  approval: ApprovalCard | null
+  askedAt: number
+  /** `here`: a COS surface can answer it now (`heldId`); `mac`: only the Mac's own dialog can. */
+  where: 'here' | 'mac'
+  heldId: string | null
+  deadlineAt: number | null
+  state: 'waiting' | 'answered'
+  answeredBy: QueueSurface | null
+  answeredAt: number | null
+}
+
 export type BrokerResolution = 'answered' | 'handed_to_desk' | 'expired' | 'hook_gone' | 'retracted' | 'drained' | 'no_client'
 export type BrokerFastPath =
   | 'broker_off' | 'draining' | 'malformed' | 'cursor' | 'approvals_off' | 'unsupported_tool'
@@ -942,7 +982,7 @@ interface BrokerItem {
   deadlineAt: number
   state: 'pending' | BrokerResolution
   settledAt: number | null
-  answer: { clientAnswerId: string; chosen: Chosen } | null
+  answer: { clientAnswerId: string; chosen: Chosen; surface?: QueueSurface } | null
   /** The clientAnswerId of the "Leave for the Mac" that settled it, so its retry replays. */
   handedBackBy: string | null
   channel: HookReplyChannel | null
@@ -1287,20 +1327,31 @@ export class PermissionBroker {
     return typeof value === 'number' && Number.isFinite(value) && value > 0 ? value : null
   }
 
-  /** X1: the two switches now; both off when absent or unreadable. */
+  /** X1: the two switches now; both off when absent or unreadable. 7.0.34: plus the question default. */
   private fullHoldSwitches(): FullHoldSwitches {
     try {
       const on = this.deps.fullHold?.()
-      return { questions: on?.questions === true, approvals: on?.approvals === true }
+      return { questions: on?.questions === true, approvals: on?.approvals === true, questionsByDefault: on?.questionsByDefault === true }
     } catch {
-      return { questions: false, approvals: false }
+      return { questions: false, approvals: false, questionsByDefault: false }
     }
   }
 
-  /** X1: either switch is on (the web door then needs a touch, and an approval a confirm). */
+  /**
+   * X1: either switch is on (the web door then needs a touch, and an approval a confirm, and the `waiting` view
+   * shows). 7.0.34: under the question DEFAULT this is on only once this Mac's hooks carry the long question block,
+   * the same thing that makes its questions eligible (`defaultHoldTakesStamp` of the installed AskUserQuestion
+   * block). Before that a Mac reads exactly as 7.0.33 with the switch off: no `waiting`, the same web door.
+   */
   private anyFullHoldOn(): boolean {
     const on = this.fullHoldSwitches()
-    return on.questions || on.approvals
+    if (on.questions || on.approvals) return true
+    return on.questionsByDefault === true && defaultHoldTakesStamp(this.installedHookTimeoutS('question'))
+  }
+
+  /** X1, 7.0.34: a question of this kind may be fully held under the switches now: on, or the default with a long stamp. */
+  private questionHoldAllows(on: FullHoldSwitches, hookWaitS: number | null | undefined): boolean {
+    return on.questions || (on.questionsByDefault === true && defaultHoldTakesStamp(hookWaitS))
   }
 
   /**
@@ -1312,7 +1363,7 @@ export class PermissionBroker {
    */
   private fullHoldEligible(isQuestion: boolean, askHold: boolean, background: boolean, facts: Omit<PermissionRequestFacts, 'fingerprint'>): boolean {
     const on = this.fullHoldSwitches()
-    if (isQuestion ? !on.questions : !on.approvals) return false
+    if (isQuestion ? !this.questionHoldAllows(on, facts.hookWaitS) : !on.approvals) return false
     if (background || facts.provider === 'codex') return false
     if (isQuestion && !askHold) return false
     if (facts.hookWaitS === null) return false
@@ -1485,7 +1536,10 @@ export class PermissionBroker {
       ...(webOnly ? { webOnly: true as const, webPresenceAgeMs: Math.round(presence.webAgeMs ?? 0) } : {}),
       ...(full ? { fullHold: true as const } : {}),
     }
-    return { ok: true, request: { facts: { ...facts, fingerprint }, kind, questions, approval, deadlineAt, awayHold, askHold, lensVisible: !askHold || (idle !== null && idle >= this.deskIdleThreshold()), ...(webOnly ? { webOnly: true } : {}), ...(full ? { fullHold: true, enginePid } : {}), hold: holdFacts } }
+    // X1 (Miles 11/12 17:42, "At once, on all three"): a fully held question is on the web and the glasses the moment
+    // it is asked, beside the Mac's own dialog; the first answer wins. Only a full-hold item (its switch on, engine
+    // proven): with the switches off, a stamped question still waits for the desk to be idle, exactly as 7.0.31.
+    return { ok: true, request: { facts: { ...facts, fingerprint }, kind, questions, approval, deadlineAt, awayHold, askHold, lensVisible: !askHold || full || (idle !== null && idle >= this.deskIdleThreshold()), ...(webOnly ? { webOnly: true } : {}), ...(full ? { fullHold: true, enginePid } : {}), hold: holdFacts } }
   }
 
   /** Hold the hook's response until exactly one resolution. Returns the item id. */
@@ -1675,7 +1729,7 @@ export class PermissionBroker {
    * clientAnswerId) replays its 200. `handBack` wins over any answer fields in the same body:
    * it is the safe direction, since it only shows the dialog that would have shown anyway.
    */
-  answer(id: string, body: unknown, by: AnswerSurface = 'app'): AnswerResult {
+  answer(id: string, body: unknown, by: AnswerSurface = 'app', client?: unknown): AnswerResult {
     const item = BROKER_ID_RE.test(id) ? this.items.get(id) : undefined
     if (!item) return { status: 404, body: { error: 'not_found' } }
     const input = isRecord(body) ? body : {}
@@ -1700,7 +1754,9 @@ export class PermissionBroker {
     if (handBack) return this.handBack(item, clientAnswerId)
     // Q1 O1: while a switch is on, an item no device is shown yet (the desk-idle latch has not fired) is
     // not answerable by its id, from any door. A hand-back stays allowed: it only shows the Mac's dialog.
-    if (!item.lensVisible && (this.anyFullHoldOn() || item.fullHold)) {
+    // X1 (at once): a full-hold item is shown the moment it is parked, so only a stamped question the full hold
+    // did not take can be unshown here.
+    if (!item.lensVisible && this.anyFullHoldOn()) {
       this.log(`not_shown ${item.id} kind=${item.kind}`)
       return { status: 409, body: { error: 'not_shown' } }
     }
@@ -1740,7 +1796,7 @@ export class PermissionBroker {
     }
     item.state = 'answered'
     item.settledAt = this.deps.now()
-    item.answer = { clientAnswerId, chosen }
+    item.answer = { clientAnswerId, chosen, surface: answerSurfaceOf(by, client) }
     item.channel = null
     item.toolInput = {}
     item.questions = null
@@ -1918,6 +1974,11 @@ export class PermissionBroker {
 
   waitingList(): WaitingQuestionView[] {
     if (!this.extendedQuestionsView()) return []
+    return this.waitingViews()
+  }
+
+  /** X1: the waiting views, whatever the switches (the queue needs them; `waitingList` is gated as before). */
+  private waitingViews(): WaitingQuestionView[] {
     const now = this.deps.now()
     this.pruneWaiting(now)
     const answerable = (item: BrokerItem): boolean => item.state === 'pending' && item.lensVisible && now < item.deadlineAt
@@ -1962,6 +2023,60 @@ export class PermissionBroker {
     return views.sort((a, b) => a.askedAt.localeCompare(b.askedAt))
   }
 
+  /**
+   * X1 (the one queue): every question and approval a live session waits on that this server knows of, whatever
+   * the switches, plus what was answered in the last QUEUE_ANSWERED_KEEP_MS with where. Questions come from the
+   * waiting entries (held or at the Mac) and from settled questions the Mac still waits on that no entry speaks
+   * for (asked before a restart); approvals from pending items and settled ones the Mac still waits on. Text is
+   * kept only while it waits, as everywhere in this file. Turn-end asks are added by the queue builder.
+   */
+  queueSources(): BrokerQueueSource[] {
+    const now = this.deps.now()
+    this.prune()
+    const out: BrokerQueueSource[] = []
+    const views = this.waitingViews()
+    const settledSurface = (match: (item: BrokerItem) => boolean): QueueSurface | null => {
+      for (const item of this.items.values()) if (item.state === 'answered' && item.answer && item.answer.clientAnswerId !== 'cos-cancel' && match(item)) return item.answer.surface ?? 'cos'
+      return null
+    }
+    for (const v of views) {
+      if (v.state === 'answered') {
+        // `waitingViews` lists an answered question only within WAITING_ANSWERED_KEEP_MS (= QUEUE_ANSWERED_KEEP_MS).
+        const answeredAt = v.answeredAt ? Date.parse(v.answeredAt) : null
+        if (answeredAt === null) continue
+        const by: QueueSurface = v.answeredBy === 'cos'
+          ? settledSurface(item => item.kind === 'question' && item.sessionId === v.sessionId && (!!v.toolUseId && item.toolUseId === v.toolUseId)) ?? 'cos'
+          : 'mac'
+        out.push({ key: v.key, sessionId: v.sessionId, provider: v.provider, kind: 'question', tool: ASK_USER_QUESTION_TOOL, questions: [], approval: null, askedAt: Date.parse(v.askedAt), where: 'mac', heldId: null, deadlineAt: null, state: 'answered', answeredBy: by, answeredAt })
+        continue
+      }
+      out.push({ key: v.key, sessionId: v.sessionId, provider: v.provider, kind: 'question', tool: ASK_USER_QUESTION_TOOL, questions: v.questions, approval: null, askedAt: Date.parse(v.askedAt), where: v.answerable ? 'here' : 'mac', heldId: v.heldId, deadlineAt: v.deadlineAt ? Date.parse(v.deadlineAt) : null, state: 'waiting', answeredBy: null, answeredAt: null })
+    }
+    const listedQuestion = (item: BrokerItem): boolean => views.some(v => v.heldId === item.id || (v.sessionId === item.sessionId && !!v.toolUseId && v.toolUseId === item.toolUseId))
+    for (const item of this.items.values()) {
+      const key = `${item.sessionId}:${item.toolUseId ?? item.id}`
+      const base = { key, sessionId: item.sessionId, provider: item.provider, kind: item.kind, tool: item.toolName, askedAt: item.requestedAt }
+      if (item.kind === 'question') {
+        // A question the Mac still waits on that no waiting entry speaks for (asked before a restart): no words.
+        if (item.state !== 'pending' && item.waitingAtMac && !listedQuestion(item)) {
+          out.push({ ...base, questions: [], approval: null, where: 'mac', heldId: null, deadlineAt: null, state: 'waiting', answeredBy: null, answeredAt: null })
+        }
+        continue
+      }
+      if (item.state === 'pending') {
+        if (!item.lensVisible || now >= item.deadlineAt) continue
+        out.push({ ...base, questions: [], approval: item.approval, where: 'here', heldId: item.id, deadlineAt: item.deadlineAt, state: 'waiting', answeredBy: null, answeredAt: null })
+      } else if (item.waitingAtMac) {
+        out.push({ ...base, questions: [], approval: null, where: 'mac', heldId: null, deadlineAt: null, state: 'waiting', answeredBy: null, answeredAt: null })
+      } else if (item.settledAt !== null && now - item.settledAt <= QUEUE_ANSWERED_KEEP_MS && (item.state === 'answered' || item.state === 'retracted')) {
+        const by: QueueSurface | null = item.state === 'retracted' ? 'mac' : item.answer?.clientAnswerId === 'cos-cancel' ? null : (item.answer?.surface ?? 'cos')
+        if (by === null) continue
+        out.push({ ...base, questions: [], approval: null, where: 'mac', heldId: null, deadlineAt: null, state: 'answered', answeredBy: by, answeredAt: item.settledAt })
+      }
+    }
+    return out
+  }
+
   /** X1: what a web page must send with an answer right now (`webAnswer` on the questions route). */
   webAnswerRules(): { touchRequired: boolean; touchMaxMs: number; confirmApprovals: boolean } {
     const on = this.anyFullHoldOn()
@@ -2102,7 +2217,8 @@ export class PermissionBroker {
     // The switches are read only while one is held, so with both off nothing here runs.
     if ([...this.items.values()].some(item => item.state === 'pending' && item.fullHold)) {
       const on = this.fullHoldSwitches()
-      this.settleAll('handed_to_desk', item => item.fullHold && (item.kind === 'question' ? !on.questions : !on.approvals))
+      // 7.0.34: a question held under the default stays held while the default (or on) still stands; off hands it back.
+      this.settleAll('handed_to_desk', item => item.fullHold && (item.kind === 'question' ? !(on.questions || on.questionsByDefault === true) : !on.approvals))
       if (this.pendingCount() === 0) return
       // X1 round 3: a held item whose settling hook event never arrived (a lost spool event) must not sit
       // to its deadline. Its own engine's registry record says whether the session moved on: the record is

package/server/lib/question-hold-setting.ts

@@ -0,0 +1,38 @@
+// X1, 7.0.34: the server-side question-hold setting that Control's Settings row writes
+// (`PUT /api/session-hooks/question-hold`). One small file in the COS home: `{"mode":"on"}` or `{"mode":"off"}`.
+// No file means the default (lib/full-hold.ts `questionHoldMode`). `COS_QUESTION_FULL_HOLD` in the environment
+// always wins over this file; the route says so (`source: "env"`) rather than writing something that cannot apply.
+//
+// Read on every call, never cached: the broker reads it per question and the status per refresh, and a stale
+// value after a Settings click would be a hold the person just turned off. The file is a few bytes.
+
+import { existsSync, readFileSync, rmSync } from 'node:fs'
+import { join } from 'node:path'
+import { atomicWriteFileSync } from './atomic-fs.js'
+import { cosGlassesHome } from './claude-hooks-installer.js'
+import type { QuestionHoldSetting } from './full-hold.js'
+
+export const QUESTION_HOLD_SETTING_FILE = 'question-hold.json'
+
+export function questionHoldSettingPath(home: string = cosGlassesHome()): string {
+  return join(home, QUESTION_HOLD_SETTING_FILE)
+}
+
+/** `on`, `off`, or null for no setting (the default). An unreadable or malformed file is no setting. */
+export function readQuestionHoldSetting(path: string = questionHoldSettingPath()): QuestionHoldSetting | null {
+  try {
+    const parsed = JSON.parse(readFileSync(path, 'utf-8')) as { mode?: unknown }
+    return parsed && (parsed.mode === 'on' || parsed.mode === 'off') ? parsed.mode : null
+  } catch {
+    return null
+  }
+}
+
+/** `on` or `off` writes the file; `default` removes it. */
+export function writeQuestionHoldSetting(mode: QuestionHoldSetting | 'default', path: string = questionHoldSettingPath()): void {
+  if (mode === 'default') {
+    if (existsSync(path)) rmSync(path, { force: true })
+    return
+  }
+  atomicWriteFileSync(path, JSON.stringify({ mode }) + '\n', { mode: 0o600 })
+}

package/server/lib/question-queue.ts

@@ -0,0 +1,111 @@
+// X1 (Miles 2026-11-12 17:31, "a consistent way ... to access active questions that are in waiting and in queue"):
+// ONE list of everything a session waits on him for, oldest first, built here once and served additively on
+// GET /api/session-questions as `queue` and `queueCount`, so Control Web, the glasses and the Mac app list and
+// count the same things. Present whatever the full-hold switches say: it is also how he finds a question that
+// only the Mac's own dialog can answer.
+//
+// WHAT IS IN IT: questions COS holds (answerable here) or that wait at the Mac's dialog; tool approvals held or at
+// the Mac (listed so they are found; answering them keeps every existing rule, `where` says which door); turn-end
+// asks a row shows; and, for QUEUE_ANSWERED_KEEP_MS, what was just answered and on which surface, so a card can say
+// "Answered on the glasses" instead of vanishing.
+//
+// PRIVACY: the only words are `line` (a question's first 80 characters, cleaned; an approval's existing summary;
+// a turn-end ask's 80 characters) and a turn-end ask's reply labels, the same text the questions route, the
+// session rows and the cards already carry to the same authenticated clients (the API token or the paired web
+// session). With COS_WAITING_QUESTION_WORDS=0 a question's line is ''. Nothing here is logged.
+
+import { questionRowText } from './full-hold.js'
+import type { BrokerQueueSource, QueueSurface } from './permission-broker.js'
+import type { AnsweredTurnAsk, QueueTurnAsk } from './turn-end-ask.js'
+
+export const QUEUE_LINE_MAX = 80
+/** Entries past this are dropped, oldest answered first, then oldest waiting. */
+export const QUEUE_MAX = 64
+
+export type QueueKind = 'question' | 'approval' | 'turn_end'
+
+export interface QueueEntry {
+  key: string
+  sessionId: string
+  /** The session's title as the session list last showed it, or null (the client uses its own). */
+  title: string | null
+  provider: 'claude' | 'codex'
+  kind: QueueKind
+  /** One line: the question, the approval's summary, or the turn-end ask. '' when words are off or unknown. */
+  line: string
+  askedAt: string
+  /** `here`: answer it from COS now (`heldId` for questions and approvals; a turn-end ask by a reply). `mac`: only the Mac's dialog. */
+  where: 'here' | 'mac'
+  heldId: string | null
+  deadlineAt: string | null
+  /** A turn-end ask's reply labels (0 to 2); [] otherwise. */
+  choices: string[]
+  state: 'waiting' | 'answered'
+  answeredBy: QueueSurface | null
+  answeredAt: string | null
+}
+
+export interface QuestionQueue { queue: QueueEntry[]; queueCount: number }
+
+export interface QueueInput {
+  broker: readonly BrokerQueueSource[]
+  turnEnd: readonly QueueTurnAsk[]
+  turnEndAnswered: readonly AnsweredTurnAsk[]
+  titleFor(sessionId: string): string | null
+  /** COS_WAITING_QUESTION_WORDS. */
+  words: boolean
+}
+
+function clip(text: string, max = QUEUE_LINE_MAX): string {
+  const t = questionRowText(text).replace(/\s+/g, ' ').trim()
+  return t.length > max ? t.slice(0, max - 1) + '…' : t
+}
+
+const iso = (ms: number | null): string | null => ms === null || !Number.isFinite(ms) ? null : new Date(ms).toISOString()
+
+function safeTitle(titleFor: QueueInput['titleFor'], sessionId: string): string | null {
+  try { return titleFor(sessionId) } catch { return null }
+}
+
+export function buildQuestionQueue(input: QueueInput): QuestionQueue {
+  const entries: QueueEntry[] = []
+  for (const s of input.broker) {
+    const line = s.kind === 'question'
+      ? (input.words && s.questions.length > 0 ? clip(s.questions[0]!.question) : '')
+      : (s.approval ? clip(s.approval.summary) : '')
+    entries.push({
+      key: s.key, sessionId: s.sessionId, title: safeTitle(input.titleFor, s.sessionId), provider: s.provider, kind: s.kind,
+      line, askedAt: iso(s.askedAt)!, where: s.where, heldId: s.heldId, deadlineAt: iso(s.deadlineAt), choices: [],
+      state: s.state, answeredBy: s.answeredBy, answeredAt: iso(s.answeredAt),
+    })
+  }
+  for (const a of input.turnEnd) {
+    entries.push({
+      key: `${a.sessionId}:turn_end:${a.stoppedAt}`, sessionId: a.sessionId, title: safeTitle(input.titleFor, a.sessionId), provider: 'claude',
+      kind: 'turn_end', line: clip(a.ask), askedAt: iso(a.stoppedAt)!, where: 'here', heldId: null, deadlineAt: null,
+      choices: [...a.choices], state: 'waiting', answeredBy: null, answeredAt: null,
+    })
+  }
+  for (const a of input.turnEndAnswered) {
+    entries.push({
+      key: `${a.sessionId}:turn_end:${a.stoppedAt}`, sessionId: a.sessionId, title: safeTitle(input.titleFor, a.sessionId), provider: 'claude',
+      kind: 'turn_end', line: clip(a.ask), askedAt: iso(a.stoppedAt)!, where: 'here', heldId: null, deadlineAt: null,
+      choices: [], state: 'answered', answeredBy: a.by, answeredAt: iso(a.answeredAt),
+    })
+  }
+  // One entry per key (a waiting and an answered copy of the same ask: the answered one wins).
+  const byKey = new Map<string, QueueEntry>()
+  for (const e of entries) {
+    const had = byKey.get(e.key)
+    if (!had || (had.state === 'waiting' && e.state === 'answered')) byKey.set(e.key, e)
+  }
+  let queue = [...byKey.values()].sort((a, b) => a.askedAt.localeCompare(b.askedAt) || a.key.localeCompare(b.key))
+  if (queue.length > QUEUE_MAX) {
+    const waiting = queue.filter(e => e.state === 'waiting')
+    const answered = queue.filter(e => e.state === 'answered')
+    const keepAnswered = Math.max(0, QUEUE_MAX - waiting.length)
+    const keep = new Set([...waiting.slice(-QUEUE_MAX), ...answered.slice(answered.length - keepAnswered)])
+    queue = queue.filter(e => keep.has(e))
+  }
+  return { queue, queueCount: queue.filter(e => e.state === 'waiting').length }
+}

package/server/lib/session-hooks-runtime.ts

@@ -23,7 +23,7 @@ import { ensureHookRuntimeFiles, ensureStableHookScript, hookSpoolDir, hookStatu
 import { codexHooksHealthField, cursorObserverHealthField, type CodexHooksHealth, type CursorObserverHealth } from './provider-observe.js'
 import { readHidIdleSeconds } from './permission-broker.js'
 import { waitingQuestionWordsEnabled } from './full-hold.js'
-import { TurnEndAskTracker, turnEndAsksEnabled, type TurnEndAskCounters } from './turn-end-ask.js'
+import { TURN_ASK_MAX_AGE_MS, TurnEndAskTracker, turnEndAsksEnabled, type AnsweredTurnAsk, type QueueTurnAsk, type TurnEndAskCounters } from './turn-end-ask.js'
 
 export function sessionHooksEnabled(): boolean {
   const raw = process.env.COS_SESSION_HOOKS
@@ -44,6 +44,11 @@ export function deskIdleSeconds(): number {
 /** Replay this much ledger history into the store at boot. */
 export const LEDGER_REPLAY_WINDOW_MS = 6 * 60 * 60_000
 
+/** X1: how much further back than the store the turn-end ask tracker replays: its age-out minus the store's window (2 h). */
+export function turnAskReplayExtraMs(): number {
+  return Math.max(0, TURN_ASK_MAX_AGE_MS - LEDGER_REPLAY_WINDOW_MS)
+}
+
 // A hook's ppid is the claude process itself: macOS `sh -c '<script> <Event>'` execs the
 // single command, and every recorded session (fixtures, 2026-09-15) shows one ppid across all
 // of its events. The `ps` parent lookup below is the fallback for a shell that does not exec;
@@ -288,12 +293,22 @@ export function startSessionHooksRuntime(options: { port: number }): SessionHook
   }) : null
   const tracker = turnEndAskTracker
   const unsubscribeTurnAsk = tracker ? sessionSignalStore.subscribe((signal, env, child) => tracker.observe(env, child, signal)) : () => {}
-  const replay = ledger.replay(since, (env, _key, child, entrypoint) => {
+  // X1: a turn-end ask stays answerable TURN_ASK_MAX_AGE_MS (8 h) but the store replays LEDGER_REPLAY_WINDOW_MS (6 h),
+  // so an ask asked 6 to 8 h before a restart was lost. The tracker alone reads back to its own age-out: rows older
+  // than the store's window go to the tracker only, never into the store, so every other signal replays as before.
+  const trackerSince = tracker ? since - turnAskReplayExtraMs() : since
+  let trackerOnly = 0
+  const replay = ledger.replay(trackerSince, (env, _key, child, entrypoint) => {
     if (!enabled) return
+    if (env.ts < since) {
+      trackerOnly++
+      tracker?.observe(env, child, { entrypoint })
+      return
+    }
     sessionSignalStore.apply(env, child)
     if (entrypoint) sessionSignalStore.setEntrypoint(env.sessionId, entrypoint)
   })
-  replayed = { rows: replay.rows, applied: replay.applied }
+  replayed = { rows: replay.rows, applied: replay.applied - trackerOnly }
   ingester = startSpoolIngester({
     dir,
     ledger,
@@ -359,6 +374,8 @@ export interface SessionHooksHealth {
   /** The install state word; `installed` below is its boolean. */
   state: HookStatus['state']
   installed: boolean
+  /** X1, 7.0.34: the question hold for this Mac (additive). */
+  questionWait?: HookStatus['questionWait']
   scriptSha: string | null
   /**
    * 6.60.0: our PermissionRequest hook's `timeout` in the Claude settings file (630 after
@@ -418,6 +435,8 @@ export function sessionHooksHealthFields(): { sessionHooks: SessionHooksHealth }
       installed: status.installed,
       scriptSha: status.scriptSha,
       permissionHookTimeoutS: status.permissionHookTimeoutS,
+      // X1, 7.0.34: additive. `state` is untouched; Control 0.5.394 and Control Web read this to offer the long wait.
+      ...(status.questionWait ? { questionWait: status.questionWait } : {}),
       priorWaitOnly: status.priorWaitOnly,
       tokenPresent: status.tokenPresent,
       lastEventAt: newest ? new Date(newest).toISOString() : null,
@@ -515,6 +534,12 @@ export function turnEndAskStats(): (TurnEndAskCounters & { tracked: number }) |
   return turnEndAskTracker ? turnEndAskTracker.stats() : null
 }
 
+/** X1 (the one queue): the turn-end asks a row shows now, and those answered in the last two minutes. Empty when off. */
+export function turnEndAsksForQueue(): { asks: QueueTurnAsk[]; answered: AnsweredTurnAsk[] } {
+  if (!turnEndAskTracker) return { asks: [], answered: [] }
+  return { asks: turnEndAskTracker.visibleAsks(), answered: turnEndAskTracker.recentlyAnswered() }
+}
+
 /** Tests only: the tracker the runtime would build, installed directly. */
 export function __setTurnEndAskTrackerForTests(tracker: TurnEndAskTracker | null): void {
   turnEndAskTracker?.stop()

package/server/lib/session-title-cache.ts

@@ -0,0 +1,40 @@
+// X1 (the one queue, 7.0.32 candidate): the last title COS showed for each session, so the questions route can name
+// the asking session without reading a transcript on a 3 s poll. Filled by the session list route from the rows it
+// already built; read by `lib/question-queue.ts`. Memory only, bounded; a session not listed yet reads null and a
+// client falls back to its own list. The titles are the list's own (the same authenticated clients already get them).
+
+/** At most this many sessions are remembered; past it the oldest noted go first. */
+export const SESSION_TITLE_CACHE_MAX = 400
+const TITLE_MAX = 120
+
+const titles = new Map<string, string>()
+
+/** Remember a session's title (lower-cased id). Blank titles are ignored. */
+export function noteSessionTitle(sessionId: unknown, title: unknown): void {
+  if (typeof sessionId !== 'string' || !sessionId || typeof title !== 'string') return
+  const text = title.replace(/\s+/g, ' ').trim()
+  if (!text) return
+  const key = sessionId.toLowerCase()
+  titles.delete(key)
+  titles.set(key, text.length > TITLE_MAX ? text.slice(0, TITLE_MAX - 1) + '…' : text)
+  while (titles.size > SESSION_TITLE_CACHE_MAX) {
+    const oldest = titles.keys().next().value
+    if (oldest === undefined) break
+    titles.delete(oldest)
+  }
+}
+
+/** The last title COS listed for this session, or null. Takes a full id or the registry's eight-character form. */
+export function sessionTitleFor(sessionId: string): string | null {
+  const key = sessionId.toLowerCase()
+  const exact = titles.get(key)
+  if (exact !== undefined) return exact
+  if (key.length >= 8 && key.length < 36) {
+    for (const [id, title] of titles) if (id.startsWith(key)) return title
+  }
+  return null
+}
+
+export function __resetSessionTitlesForTests(): void {
+  titles.clear()
+}