@gotcos/glasses-server 7.0.7 → 7.0.27

package/server/routes/sessions.ts

@@ -1,9 +1,7 @@
 // Session endpoints — recent list, full history, existence check, client-format messages, context breaks, end
 import { Router } from 'express'
-import { readFileSync } from 'fs'
-import { join } from 'path'
 import { getRecentSessions, getHistory, sessionExists, addContextBreak, endSession, getSessionRaw, getActiveSessions, resolveExchangePairModel, ensureArchiveMirrorForDay } from '../lib/conversation.js'
-import { buildSessionLogEntry, writeSessionLog } from '../lib/session-log.js'
+import { buildSessionLogEntry, lookupRangesFromHistory, readSessionLogRanges, writeSessionLogIfChanged } from '../lib/session-log.js'
 import { getArchiveDayMessages, listArchiveDateStrings } from '../lib/archive.js'
 import { recentMessagesLimit, selectRecentMessages } from '../lib/recent-messages.js'
 import { localDay } from '../lib/local-day.js'
@@ -135,7 +133,7 @@ sessionsRouter.get('/sessions/:id/messages', (req, res) => {
 // instead of waiting for the 2hr TTL expiry.
 // POST /api/sessions/lookup — batch resolve timestamps to session IDs
 // Used to retroactively stamp messages that predate the sessionId feature
-sessionsRouter.post('/sessions/lookup', (req, res) => {
+sessionsRouter.post('/sessions/lookup', async (req, res) => {
   const { timestamps } = req.body as { timestamps: number[] }
   if (!timestamps || !Array.isArray(timestamps)) {
     res.status(400).json({ error: 'timestamps[] required' })
@@ -143,7 +141,6 @@ sessionsRouter.post('/sessions/lookup', (req, res) => {
   }
 
   // Build time ranges from BOTH JSONL history AND live server sessions
-  const logPath = join(process.env.COS_SCRIPTS_DIR || '', '.glasses_sessions.jsonl')
   const sessionRanges: Array<{ sid: string; start: number; end: number }> = []
 
   // 1. Live server sessions (always current — no snapshot lag)
@@ -155,25 +152,17 @@ sessionsRouter.post('/sessions/lookup', (req, res) => {
     }
   }
 
-  // 2. JSONL history (ended sessions + snapshots)
+  // 2. JSONL history (ended sessions + snapshots). S1 (2026-11-09): streamed and incremental
+  // (session-log.ts readSessionLogRanges); the old readFileSync().toString() threw on the 1.94 GB
+  // ledger and the catch read that as "no file". The range rule is the old one, unchanged: a
+  // session's end is widened by later lines only when it is NOT in memory (lookupRangesFromHistory).
   try {
-    const lines = readFileSync(logPath, 'utf-8').trim().split('\n')
-    for (const line of lines) {
-      const d = JSON.parse(line)
-      if (d.session_id && d.created_at) {
-        const start = new Date(d.created_at).getTime()
-        const end = d.ended_at ? new Date(d.ended_at).getTime() : start + 7200_000
-        // Live sessions take priority. For JSONL, keep the widest (latest) time range per session.
-        const existing = sessionRanges.find(s => s.sid === d.session_id)
-        if (!existing) {
-          sessionRanges.push({ sid: d.session_id, start, end })
-        } else if (end > existing.end && !getSessionRaw(d.session_id)) {
-          // Widen the JSONL range (but don't overwrite live sessions which extend to NOW)
-          existing.end = end
-        }
-      }
-    }
-  } catch { /* no log file */ }
+    const live = new Set(sessionRanges.map(s => s.sid))
+    const history = await readSessionLogRanges()
+    sessionRanges.push(...lookupRangesFromHistory(history, sid => Boolean(getSessionRaw(sid)), live))
+  } catch (err) {
+    console.warn('[sessions] lookup could not read the session ledger:', err instanceof Error ? err.message : err)
+  }
 
   // Match each timestamp to a session (live sessions checked first, then JSONL)
   const results: Record<number, string | null> = {}
@@ -242,7 +231,9 @@ sessionsRouter.post('/sessions/:id/snapshot', (req, res) => {
     slug: `[LIVE] ${(session.exchanges.find(e => e.role === 'user')?.content ?? '').slice(0, 50)}`,
   })
 
-  const logged = writeSessionLog(entry)
+  // Logged means the ledger holds this content: written now, or already there.
+  const result = writeSessionLogIfChanged(entry, 'snapshot')
+  const logged = result === 'written' || result === 'unchanged'
   res.json({
     ok: true,
     logged,

package/server/routes/thread-turn-queue.ts

@@ -21,7 +21,7 @@ import { CONTINUE_NOTE_HEADER, continueNoteAcknowledged } from '../lib/continue-
 import { nativeQueueControl, plainQueueText, type NativeQueueControl } from '../lib/codex-queue-control.js'
 import { CLIENT_TURN_ID_RE, COS_SESSION_ID_RE, DEFAULT_MAX_PROMPT_CHARS } from './agent-session-bindings.js'
 import {
-  admitToQueue, drainDecision, queueableRefusal, queuePosition,
+  admitToQueue, drainDecision, holdReasonFor, queueableRefusal, queuePosition,
   MAX_DELIVERY_ATTEMPTS, type DrainObservation, type QueuedThreadTurn,
   queueReconcileEnabled, queueResendEnabled, queuedTurnReasonCopy, sessionSteerAvailability, sessionSteerEnabled,
   steerMidturnEnabled, type SessionSteerAvailability,
@@ -38,11 +38,11 @@ import { defaultTurnAttachmentStore, keepTurnAttachments, parseTurnAttachmentIds
  * the attachment digest its origin is sealed to. Files whose content cannot be read leave the turn
  * unvouched (it still parks); no files is the empty digest and reads nothing.
  */
-async function sealFiles(ids: readonly string[] | undefined, verdict: OriginVerdict, store: TurnAttachmentStore | undefined): Promise<{ verdict: OriginVerdict; attachments: string }> {
-  if (!Array.isArray(ids) || ids.length === 0) return { verdict, attachments: '' }
+async function sealFiles(ids: readonly string[] | undefined, verdict: OriginVerdict, store: TurnAttachmentStore | undefined): Promise<{ verdict: OriginVerdict; attachments: string; manifest: ReadonlyArray<{ id: string; sha256: string }> | null }> {
+  if (!Array.isArray(ids) || ids.length === 0) return { verdict, attachments: '', manifest: [] }
   const manifest = await turnAttachmentManifest(ids, store)
-  if (!manifest.ok) return { verdict: unvouched(verdict, 'attachments_unsealable'), attachments: '' }
-  return { verdict, attachments: attachmentsDigest(manifest.manifest) }
+  if (!manifest.ok) return { verdict: unvouched(verdict, 'attachments_unsealable'), attachments: '', manifest: null }
+  return { verdict, attachments: attachmentsDigest(manifest.manifest), manifest: manifest.manifest }
 }
 
 export interface ThreadTurnQueueDeps {
@@ -153,6 +153,14 @@ export function steerAvailabilityFor(deps: Pick<ThreadTurnQueueDeps, 'steerProbe
   return sessionSteerAvailability({ provider, gateReason, continueLive, peerInbox: probe.peerInbox, waitingOnPrompt: probe.waitingOnPrompt })
 }
 
+/**
+ * When a sweep last decided each held row (epoch ms), in memory only: the row file is written when its hold
+ * reason CHANGES, not every 20 s. Bounded; a settled row is forgotten.
+ */
+const holdCheckedAt = new Map<string, number>()
+const HOLD_CHECKED_MAX = 1_000
+export function __resetHoldCheckedForTests(): void { holdCheckedAt.clear() }
+
 /** Public shape of a queued turn. No prompt echo beyond a short preview. */
 export function publicRow(turn: QueuedThreadTurn, position: number): Record<string, unknown> {
   const row: Record<string, unknown> = {
@@ -169,6 +177,12 @@ export function publicRow(turn: QueuedThreadTurn, position: number): Record<stri
     ...(turn.settledAt ? { settledAt: turn.settledAt } : {}),
     // 11/07: how many files wait with the words (never their ids or paths). Absent without files.
     ...(Array.isArray(turn.attachmentIds) && turn.attachmentIds.length > 0 ? { attachments: turn.attachmentIds.length } : {}),
+    // 2026-11-11: why a waiting row is held (a code), since when, and when a sweep last decided it. Additive.
+    ...(turn.status === 'waiting' && typeof turn.holdReason === 'string' ? {
+      waiting_reason: turn.holdReason,
+      ...(typeof turn.holdSince === 'number' ? { waiting_since: turn.holdSince } : {}),
+      ...(holdCheckedAt.has(turn.clientTurnId) ? { waiting_checked_at: holdCheckedAt.get(turn.clientTurnId) } : {}),
+    } : {}),
   }
   // 6.78.0: additive, and only while a P3 flag is on, so the row is the 6.77 bytes otherwise.
   // `resendable` is the per-row capability: present only when Send again can act on it.
@@ -242,7 +256,7 @@ function localDrainVerdict(at: number): OriginVerdict {
 }
 
 /** What one mid-turn attempt did to its row: delivered, settled some other way, or left waiting. */
-type MidTurnOutcome = 'delivered' | 'settled' | 'held'
+type MidTurnOutcome = 'delivered' | 'settled' | 'held' | 'held_files'
 
 /**
  * Steer mid-turn (COS_STEER_MIDTURN, Miles 2026-11-07): put ONE waiting row into the running turn
@@ -279,9 +293,11 @@ async function steerHeldTurn(
   deps: ThreadTurnQueueDeps,
 ): Promise<MidTurnOutcome> {
   if (turn.status !== 'waiting' || turn.attempts !== 0) return 'held'
-  if (Array.isArray(turn.attachmentIds) && turn.attachmentIds.length > 0) return 'held'
   const availability = midTurnAvailabilityFor(deps, provider, threadId, gateReason)
   if (!availability || !availability.available) return 'held'
+  // Files never go into a running turn (the peer inbox carries words only). Checked AFTER availability, so
+  // `held_files` means exactly this: the turn could have gone in now but for its files (the row's hold reason).
+  if (Array.isArray(turn.attachmentIds) && turn.attachmentIds.length > 0) return 'held_files'
   const { clientTurnId, prompt } = turn
 
   const rewrite = (apply: (row: QueuedThreadTurn) => void): QueuedThreadTurn | null => {
@@ -465,11 +481,19 @@ export async function drainThread(
       // which also means the hold is the busy GATE: the rule answers only for a refusal that
       // names a desk run (an attachable thread has no reason). Anything else holds as before.
       const cancelHeld = typeof seen.cancelHoldUntil === 'number' && Number.isFinite(seen.cancelHoldUntil) && deps.now() < seen.cancelHoldUntil
+      let reason = holdReasonFor(seen, deps.now())
       if (!midTurnOrderHeld && !cancelHeld) {
         const outcome = await steerHeldTurn(provider, threadId, turn, gate.reason, deps)
-        if (outcome === 'delivered') { delivered += 1; continue }
-        if (outcome === 'settled') { retired += 1; continue }
+        if (outcome === 'delivered') { holdCheckedAt.delete(turn.clientTurnId); delivered += 1; continue }
+        if (outcome === 'settled') { holdCheckedAt.delete(turn.clientTurnId); retired += 1; continue }
+        if (outcome === 'held_files') reason = 'files_wait_for_turn_end'
       }
+      // The hold reason: written only when it changes; the check time is kept in memory (2026-11-11).
+      const at = deps.now()
+      if (turn.holdReason !== reason) { turn.holdReason = reason; turn.holdSince = at; persist(turn) }
+      holdCheckedAt.delete(turn.clientTurnId)
+      holdCheckedAt.set(turn.clientTurnId, at)
+      while (holdCheckedAt.size > HOLD_CHECKED_MAX) holdCheckedAt.delete(holdCheckedAt.keys().next().value!)
       midTurnOrderHeld = true
       held += 1
       continue
@@ -480,6 +504,7 @@ export async function drainThread(
       turn.settledAt = deps.now()
       retired += 1; persist(turn)
       forgetIfSettled(turn)
+      holdCheckedAt.delete(turn.clientTurnId)
       continue
     }
 
@@ -488,6 +513,10 @@ export async function drainThread(
     // forever; the ceiling only bounds anything if it survives the crash it is bounding.
     turn.attempts += 1
     turn.status = 'delivering'
+    // No longer held: the reason belonged to the wait that just ended.
+    delete turn.holdReason
+    delete turn.holdSince
+    holdCheckedAt.delete(turn.clientTurnId)
     // 6.78.0: the stamp the restart reconcile reads. `journal: 1` says this build keeps an
     // attempt record for the delivery that follows; `deliveringBootId` says which boot owns
     // it, so a sweep never touches a row this process is delivering right now. Durable:
@@ -879,7 +908,9 @@ export function createThreadTurnQueueRouter(deps: ThreadTurnQueueDeps): Router {
     // with its content hash), so the drain can carry it (QUEUED_ORIGIN_TTL_MS at most).
     if (deps.provenance && verdict) {
       const sealed = await sealFiles(attach.ids, verdict, deps.turnAttachmentStore)
-      verdict = sealed.verdict
+      // 6.99.31: a signed web turn is judged here, once parking is decided, against this provider and
+      // thread (where it will drain), these exact words and these files. No envelope: unchanged.
+      verdict = deps.provenance.acceptWebKey(sealed.verdict, { provider, sessionId: threadId, turnId: clientTurnId, words: prompt, attachments: sealed.manifest })
       deps.provenance.noteQueued(provider, threadId, clientTurnId, prompt, verdict, sealed.attachments)
     }
 
@@ -990,8 +1021,11 @@ export function createThreadTurnQueueRouter(deps: ThreadTurnQueueDeps): Router {
     if (deps.provenance && resendVerdict) {
       // After the write: the read-modify-write above stays one synchronous step. Sealed to the copy's files.
       const sealed = await sealFiles(copy.attachmentIds, resendVerdict, deps.turnAttachmentStore)
-      deps.provenance.noteQueued(provider, threadId, newId, copy.prompt, sealed.verdict, sealed.attachments)
-      deps.provenance.record({ turnId: newId, prompt: copy.prompt, verdict: sealed.verdict, provider, sessionId: threadId, via: 'queue-resend', resendOf: original.clientTurnId })
+      // 6.99.31: Send again from the phone needs a fresh signature over the copy (its new id, the words,
+      // the files); without one the copy stays unvouched ('resend_not_reverified').
+      const copyVerdict = deps.provenance.acceptWebKey(sealed.verdict, { provider, sessionId: threadId, turnId: newId, words: copy.prompt, attachments: sealed.manifest })
+      deps.provenance.noteQueued(provider, threadId, newId, copy.prompt, copyVerdict, sealed.attachments)
+      deps.provenance.record({ turnId: newId, prompt: copy.prompt, verdict: copyVerdict, provider, sessionId: threadId, via: 'queue-resend', resendOf: original.clientTurnId })
     }
     console.log(`[thread-turn-queue] resend provider=${provider} from=${original.clientTurnId} as=${newId} unknown=${original.deliveryState === 'unknown'}`)
     return res.status(200).json(publicRow(copy, queuePosition(admitted.queue, newId)))
@@ -1061,9 +1095,11 @@ export function createThreadTurnQueueRouter(deps: ThreadTurnQueueDeps): Router {
     if (deps.provenance && verdict) {
       // Sealed to the row's files as they are now (an edit changes only the words).
       const sealed = await sealFiles(row.attachmentIds, verdict, deps.turnAttachmentStore)
-      deps.provenance.noteQueued(provider, threadId, id, prompt, sealed.verdict, sealed.attachments)
+      // 6.99.31: an edit needs a fresh signature over the new words (same id, same files), or it is unvouched.
+      const editVerdict = deps.provenance.acceptWebKey(sealed.verdict, { provider, sessionId: threadId, turnId: id, words: prompt, attachments: sealed.manifest })
+      deps.provenance.noteQueued(provider, threadId, id, prompt, editVerdict, sealed.attachments)
       // The queue's own row, re-judged: it continues the record parked under this id.
-      deps.provenance.record({ turnId: id, prompt, verdict: sealed.verdict, provider, sessionId: threadId, via: 'queue-edit', continues: true })
+      deps.provenance.record({ turnId: id, prompt, verdict: editVerdict, provider, sessionId: threadId, via: 'queue-edit', continues: true })
     }
     return res.json({ updated: true })
   })

package/server/routes/today-brief.ts

@@ -25,49 +25,87 @@ import { dataPath } from '../lib/data-dir.js'
 import { runClaudeText } from '../lib/claude-text-runner.js'
 import { logTokenAudit } from '../lib/token-audit.js'
 import type { TaskBoardRow } from '../lib/task-store.js'
-import { agentSessionRoots, findAgentSessionFile } from '../lib/agent-session-store.js'
+import type { TaskDateFields } from '../lib/task-dates.js'
+import { agentSessionRoots, codexSessionRootsOf, findAgentSessionFile, listCodexJsonlFiles, loadClaudeDesktopAliases, loadClaudeTranscriptIndex, type AgentProvider } from '../lib/agent-session-store.js'
 import { readClaudeSubagents, summarize, type SessionSubagents } from '../lib/session-subagents.js'
 import { readCodexSubagentDetails } from '../lib/codex-subagent-activity.js'
+import { readRecentActivity, type RecentActivity } from '../lib/agent-session-recent.js'
 import { acquireMaintenanceWork, maintenanceAdmissionsOpen } from '../lib/maintenance-lifecycle.js'
 import { isRecordingLive } from '../lib/stt-runtime.js'
 import {
   TODAY_BRIEF_BODY_MAX_BYTES, TODAY_BRIEF_EFFORT, TODAY_BRIEF_SETTINGS_FILE, TODAY_BRIEF_STATE_FILE, TODAY_BRIEF_TIMEOUT_MS,
-  TodayBriefInputError, createTodayBrief, normalizeTodayBriefInputs, subagentLookups, todayBriefFingerprint, withSubagents, type BriefWork, type SubagentReading, type TodayBrief,
+  TodayBriefInputError, createTodayBrief, normalizeTodayBriefInputs, sessionContextLookups, todayBriefFingerprint, withCalendar, withRecentActivity, withSubagents, type BriefWork, type CalendarReading, type SubagentReading, type TodayBrief,
 } from '../lib/today-brief.js'
 
 export interface TodayBriefRouterDeps {
   brief: TodayBrief
-  /** The Work board as the server already reads it (a shared, bounded read), or null when it cannot be read. */
-  board: () => Promise<TaskBoardRow[] | null>
-  /** Sub-agents for up to 8 sessions, by "provider|id". Missing keys mean "not read"; the page's counts stay. */
-  subagents?: (keys: string[]) => Promise<Map<string, SubagentReading>>
+  /** The Work board, dated when it can be (2026-11-09: listBoardWithDates, so a card's last move is known), or null
+   *  when it cannot be read. */
+  board: () => Promise<Array<TaskBoardRow & Partial<TaskDateFields>> | null>
+  /** Sub-agents and recent activity for up to 12 sessions, by "provider|id", written into `into` as each session is
+   *  read, so an ask that stops waiting keeps what was read by then. Missing keys mean "not read": the page's counts
+   *  and `line` stay, the line marked "may be old". */
+  context?: (keys: string[], into: SessionContext) => Promise<unknown>
+  /** Today round 2: today's calendar (lib/calendar-source.ts calendarToday). Read with the session reads, inside the
+   *  same wait; a failed, slow or unconnected read means no calendar in the prompt. */
+  calendar?: () => Promise<CalendarReading | null>
   now?: () => number
 }
 
-/** How long the sub-agent reads may hold the ask before it goes on without them. */
+/** How long the session reads may hold the ask before it goes on with what was read by then. */
 export const TODAY_BRIEF_SUBAGENT_WAIT_MS = 2_500
 
+/** What the server read per session: its sub-agents and its recent activity, by "provider|id". */
+export interface SessionContext { agents: Map<string, SubagentReading>; recent: Map<string, RecentActivity> }
+export const emptySessionContext = (): SessionContext => ({ agents: new Map(), recent: new Map() })
+
 /**
- * The server's own sub-agent reads: Claude from the session's transcript tail (lib/session-subagents.ts), Codex from
- * the spawn-edge snapshot (readCodexSubagentDetails, server home only). Cursor has none. Sequential, bounded, read-only.
+ * 2026-11-09: readSubagentsFor became this. For each key, most important first: the sub-agents (Claude from the
+ * transcript tail, Codex from the spawn-edge snapshot) and the recent activity (lib/agent-session-recent.ts). Claude
+ * and Cursor read one after another; Codex reads in parallel with them, because a Codex rollout's first scan is the
+ * slow one (32 GB files) and must not starve the rest. Results land in `into` as they arrive. Read-only.
  */
-export async function readSubagentsFor(keys: string[], now = Date.now()): Promise<Map<string, SubagentReading>> {
-  const out = new Map<string, SubagentReading>()
+export async function readSessionContext(keys: string[], into: SessionContext = emptySessionContext(), now = Date.now()): Promise<SessionContext> {
   const roots = agentSessionRoots()
-  const codex = keys.filter(k => k.startsWith('codex|')).map(k => k.slice(6))
-  for (const key of keys.filter(k => k.startsWith('claude|'))) {
-    const file = await findAgentSessionFile('claude', key.slice(7), roots).catch(() => null)
-    const read: SessionSubagents | null = file ? await readClaudeSubagents(file) : null
-    if (read && read.total) out.set(key, read)
-  }
-  if (codex.length) {
-    const details = await readCodexSubagentDetails(codex, roots.codexSessions, now)
+  const split = (k: string) => { const i = k.indexOf('|'); return { provider: k.slice(0, i) as AgentProvider, id: k.slice(i + 1) } }
+  const codexKeys = keys.filter(k => k.startsWith('codex|'))
+  const localKeys = keys.filter(k => k.startsWith('claude|') || k.startsWith('cursor|'))
+  const local = (async () => {
+    // One index for every Claude id in this ask, not one per call.
+    const claudeFiles = localKeys.some(k => k.startsWith('claude|')) ? await loadClaudeTranscriptIndex(roots).catch(() => undefined) : undefined
+    const aliases = claudeFiles ? await loadClaudeDesktopAliases(roots.claudeCodeSessions).catch(() => undefined) : undefined
+    for (const key of localKeys) {
+      const { provider, id } = split(key)
+      const file = await findAgentSessionFile(provider, id, roots, new Date(now), aliases, claudeFiles ? { claudeFiles } : undefined).catch(() => null)
+      if (!file) continue
+      if (provider === 'claude') {
+        const read: SessionSubagents | null = await readClaudeSubagents(file)
+        if (read && read.total) into.agents.set(key, read)
+      }
+      const recent = await readRecentActivity(provider, file, now)
+      if (recent) into.recent.set(key, recent)
+    }
+  })()
+  const codex = (async () => {
+    if (!codexKeys.length) return
+    const ids = codexKeys.map(k => k.slice(6))
+    const details = await readCodexSubagentDetails(ids, roots.codexSessions, now).catch(() => new Map())
     for (const [id, list] of details) {
-      const rows = list.map(d => ({ name: d.name, task: d.task, status: d.state === 'active' ? 'running' as const : d.state === 'completed' ? 'done' as const : 'unknown' as const, at: d.at }))
-      if (rows.length) out.set('codex|' + id, summarize(rows, false))
+      const rows = (list as Array<{ name: string; task: string; state: string; at: number }>).map(d => ({ name: d.name, task: d.task, status: d.state === 'active' ? 'running' as const : d.state === 'completed' ? 'done' as const : 'unknown' as const, at: d.at }))
+      // Every row, not six: the brief keeps the live and recent ones and counts the rest as history.
+      if (rows.length) into.agents.set('codex|' + id, summarize(rows, false, rows.length))
     }
-  }
-  return out
+    const lists = await Promise.all(codexSessionRootsOf(roots).map(root => listCodexJsonlFiles(root).catch(() => [] as string[])))
+    const codexFiles = lists.flat()
+    for (const key of codexKeys) {
+      const file = await findAgentSessionFile('codex', key.slice(6), roots, new Date(now), undefined, { codexFiles }).catch(() => null)
+      if (!file) continue
+      const recent = await readRecentActivity('codex', file, now)
+      if (recent) into.recent.set(key, recent)
+    }
+  })()
+  await Promise.all([local, codex])
+  return into
 }
 
 /** The server's own brief: the data folder, Sonnet (7.0.1) through the isolated text runner, one audit row per start. */
@@ -90,8 +128,12 @@ export function defaultTodayBrief(): TodayBrief {
 }
 
 const IN_PROGRESS = new Set(['draft', 'built', 'qa'])
-/** Work cards in progress, by title and stage: open, not delegated, drafting to QA, or with an agent on it. */
-export function workInProgress(rows: TaskBoardRow[] | null): BriefWork[] {
+/**
+ * Work cards in progress, by title and stage: open, not delegated, drafting to QA, or with an agent on it. 2026-11-09:
+ * with when each last moved (the dated board read: the line's git change time, else the day it was created; null when
+ * neither is known), running first, then the most recently moved, so the twelve kept are the live ones.
+ */
+export function workInProgress(rows: Array<TaskBoardRow & Partial<TaskDateFields>> | null, now = Date.now()): BriefWork[] {
   if (!rows) return []
   const out: BriefWork[] = []
   for (const row of rows) {
@@ -99,9 +141,11 @@ export function workInProgress(rows: TaskBoardRow[] | null): BriefWork[] {
     const stage = row.workStage ?? (row.stage === 'active' ? 'draft' : row.stage === 'review' ? 'qa' : 'planned')
     const running = row.agentState === 'running'
     if (!IN_PROGRESS.has(stage) && !running) continue
-    out.push({ title: row.title || row.text || '', stage, running })
+    const at = Date.parse(row.lineChangedAt ?? '') || Date.parse(row.createdOn ?? '') || 0
+    out.push({ title: row.title || row.text || '', stage, running, movedMinutes: at > 0 ? Math.max(0, Math.round((now - at) / 60000)) : null })
   }
-  return out.sort((a, b) => Number(b.running) - Number(a.running)).slice(0, 12)
+  const age = (w: BriefWork) => (w.movedMinutes == null ? Number.MAX_SAFE_INTEGER : w.movedMinutes)
+  return out.sort((a, b) => Number(b.running) - Number(a.running) || age(a) - age(b)).slice(0, 12)
 }
 
 /**
@@ -142,15 +186,26 @@ export function createTodayBriefRouter(deps: TodayBriefRouterDeps): Router {
       const pageInputs = normalizeTodayBriefInputs(body)
       const closed = deps.brief.gate({ force, reconnect })
       if (closed) return res.json(deps.brief.askGated(pageInputs, closed))
-      const work = workInProgress(await deps.board().catch(() => null))
-      let inputs = normalizeTodayBriefInputs(body, work)
-      const keys = subagentLookups(inputs)
-      if (keys.length && deps.subagents) {
-        let timer: ReturnType<typeof setTimeout> | undefined
-        const late = new Promise<Map<string, SubagentReading>>(resolve => { timer = setTimeout(() => resolve(new Map()), TODAY_BRIEF_SUBAGENT_WAIT_MS) })
-        const readings = await Promise.race([deps.subagents(keys).catch(() => new Map<string, SubagentReading>()), late]).finally(() => clearTimeout(timer))
-        inputs = withSubagents(inputs, readings, (deps.now ?? Date.now)())
-      }
+      const now = (deps.now ?? Date.now)()
+      // The board and the session reads run together; the reads stop being waited for after 2.5 s and the ask goes on
+      // with whatever they wrote by then (a Codex first scan that runs on still fills its memo for the next ask).
+      const keys = sessionContextLookups(normalizeTodayBriefInputs(body))
+      const context = emptySessionContext()
+      // Today round 2: the calendar reads alongside the sessions, inside the same wait; whatever has not answered by
+      // then is left out (a slow bridge never holds the ask).
+      const cal: { value: CalendarReading | null } = { value: null }
+      const work: Array<Promise<unknown>> = []
+      if (keys.length && deps.context) work.push(Promise.resolve().then(() => deps.context!(keys, context)).catch(() => undefined))
+      if (deps.calendar) work.push(Promise.resolve().then(() => deps.calendar!()).then(c => { cal.value = c }, () => undefined))
+      let timer: ReturnType<typeof setTimeout> | undefined
+      const reads = work.length
+        ? Promise.race([Promise.all(work), new Promise<void>(resolve => { timer = setTimeout(resolve, TODAY_BRIEF_SUBAGENT_WAIT_MS) })]).finally(() => clearTimeout(timer))
+        : Promise.resolve()
+      const [rows] = await Promise.all([deps.board().catch(() => null), reads])
+      // A snapshot: a read still running after the wait cannot change the inputs under the call.
+      const agents = new Map(context.agents), recent = new Map(context.recent), calendar = cal.value
+      let inputs = normalizeTodayBriefInputs(body, workInProgress(rows, now))
+      inputs = withCalendar(withRecentActivity(withSubagents(inputs, agents, now), recent, now), calendar, now)
       res.json(await deps.brief.ask(inputs, todayBriefFingerprint(pageInputs), { force, reconnect }))
     } catch (error) {
       if (error instanceof TodayBriefInputError) return res.status(400).json({ error: { code: error.code, message: 'That is not a Today summary request.' } })

package/server/routes/web-control.ts

@@ -24,6 +24,10 @@ import {
   type WebLoginFailure,
   WebGlassesCodeProbeBudget,
   WEB_SESSION_TTL_MS,
+  WEB_SESSION_COOKIE_NAME,
+  WEB_SESSION_MAX_LIFE_MS,
+  readWebSessionCookie,
+  webSessionCookieFrom,
   WebHandoffStore,
   WebLoginLimiter,
   WebDeviceCodeStore,
@@ -199,6 +203,18 @@ export function webControlCsp(_requestPath: string): string {
   ].join('; ')
 }
 
+/**
+ * The expiry (ISO) of the cos_web_session cookie on a request, read from the SAME value the verifier reads (Q1 S1:
+ * `parseCookies` keeps the last of several; another app on this host name can plant an earlier one). Read only after
+ * verification. Shapes: `<exp>.<epoch>.<sig>`, or a renewed `<exp>.<epoch>.<orig>.<sig>`.
+ */
+export function webSessionCookieExpiry(cookieHeader: unknown): string | null {
+  const value = webSessionCookieFrom(cookieHeader)
+  const exp = typeof value === 'string' ? /^(\d{1,15})\./.exec(value) : null
+  const ms = exp ? Number(exp[1]) * 1000 : NaN
+  return Number.isSafeInteger(ms) && ms > 0 ? new Date(ms).toISOString() : null
+}
+
 export function createWebControlRouter(deps: WebControlRouterDeps): Router {
   const router = Router()
   const handoffStore = deps.handoffStore ?? new WebHandoffStore()
@@ -287,11 +303,20 @@ export function createWebControlRouter(deps: WebControlRouterDeps): Router {
         ? { authenticated: false, mode: 'none' }
         : { authenticated: false, mode: 'none', network: 'tailscale_only' })
     }
+    // W1 (audit 02 F2): a signed-in browser learns when ITS OWN cookie ends, so the page can say so before it does.
+    // Only after the cookie verified (its signature covers the expiry), only for cookie mode, and nothing a caller without
+    // that cookie can read. The 7-day lifetime itself is unchanged.
+    const expiresAt = cookieOk && !headerOk ? webSessionCookieExpiry(req.headers.cookie) : null
+    // Renewal (Miles 2026-11-09): the latest this sign-in can last while in use, 30 days from its first sign-in.
+    const read = cookieOk && !headerOk ? readWebSessionCookie(webSessionCookieFrom(req.headers.cookie), token) : null
+    const renewUntil = read ? new Date((read.origUnixSec + Math.floor(WEB_SESSION_MAX_LIFE_MS / 1000)) * 1000).toISOString() : null
     res.json({
       authenticated: true,
       mode: headerOk ? 'header' : 'cookie',
       serverName: hostname().replace(/\.local$/i, ''),
       ownerName: getOwnerName(),
+      ...(expiresAt ? { expiresAt } : {}),
+      ...(renewUntil ? { renewUntil } : {}),
     })
   })
 
@@ -322,10 +347,13 @@ export function createWebControlRouter(deps: WebControlRouterDeps): Router {
     const token = deps.apiToken()
     const result = classifyWebLogin(body, token, handoffStore, deviceCodes, glassesCheck)
     if (!result.ok) {
-      // Every failure counts, the glasses-code one included, so that check cannot be used to
-      // probe codes faster than the limiter allows.
-      loginLimiter.fail(ip, result.reason)
-      log(`[web-login] fail kind=${result.reason} len=${result.length} ip=${ip}`)
+      // Every failure counts toward the per-IP limit, the glasses-code one included, so that check cannot be used to
+      // probe codes faster than the limiter allows. Except a failed sign-in LINK (Miles 2026-11-09 20:00, "Yes, stop
+      // counting stale links"): a ticket is 192 random bits, so guessing one is not a risk, and a person reopening an old
+      // QR or link should not lock themselves out of typing a code. It still fails with the same message.
+      if (result.reason !== 'handoff_expired') loginLimiter.fail(ip, result.reason)
+      // S1 item 7: why a handoff link failed (expired, used, evicted, unknown). The log only; the message is unchanged.
+      log(`[web-login] fail kind=${result.reason}${result.handoff ? ` sub=${result.handoff}` : ''} len=${result.length} ip=${ip}`)
       return res.status(401).json({
         ok: false,
         error: 'invalid_credentials',
@@ -340,6 +368,8 @@ export function createWebControlRouter(deps: WebControlRouterDeps): Router {
     return res.json({
       ok: true,
       expiresAt: new Date(minted.expiresAtMs).toISOString(),
+      // Renewal (Miles 2026-11-09): while in use this sign-in renews up to 30 days from now (lib/web-session-auth.ts).
+      renewUntil: new Date((Math.floor(minted.expiresAtMs / 1000) - Math.floor(WEB_SESSION_TTL_MS / 1000) + Math.floor(WEB_SESSION_MAX_LIFE_MS / 1000)) * 1000).toISOString(),
       serverName: hostname().replace(/\.local$/i, ''),
       ownerName: getOwnerName(),
     })
@@ -357,6 +387,9 @@ export function createWebControlRouter(deps: WebControlRouterDeps): Router {
   router.post('/web-session/revoke-all', (req: Request, res: Response) => {
     res.set('Cache-Control', 'private, no-store')
     const epoch = bumpWebSessionEpoch()
+    // Final review V7: a sign-in link or code made before the sign-out no longer signs a browser in after it.
+    handoffStore.revokeAll()
+    deviceCodes.revokeAll()
     res.setHeader('Set-Cookie', formatClearWebSessionCookie(req.secure))
     res.json({ ok: true, epoch })
   })