@gotcos/glasses-server 7.0.7 → 7.0.27

package/server/lib/full-hold.ts

@@ -0,0 +1,124 @@
+// X1 (2026-11-09): the full hold. A session question (AskUserQuestion) or a tool approval held for
+// the WHOLE wait of the PermissionRequest hook, whether or not a COS device is live when it is asked.
+//
+// WHY THIS IS SAFE AT THE DESK (canaries, operations/personal/wk46_2026/production_hardening/
+// x1_question_fetch/CANARIES.md): on the engines below, Claude Code shows its own question or
+// approval dialog at once WHILE the PermissionRequest hook is still waiting (C1, C5). An answer at
+// the Mac wins and a later hook answer is ignored (C3, C4); a hook answer withdraws the dialog (C2;
+// the desktop engine sends `control_cancel_request` to the app, C6). A hold of 3,703 s worked (C7).
+// So holding the hook never delays the Mac's own prompt (Miles's option B, 11/05) ON THESE ENGINES.
+// An engine that is not listed, or reads older, keeps today's rule: it may not show its dialog
+// until the hook returns, and a long hold there would keep the desk waiting.
+//
+// Both switches default OFF. With both off nothing in this file is read on the permission path.
+//
+// Pure, no imports beyond the one switch reader.
+
+import { readSwitch } from './env-switch.js'
+
+/** `COS_QUESTION_FULL_HOLD`: hold a question for the whole hook wait. Default OFF. Read per request. */
+export function questionFullHoldEnabled(env: NodeJS.ProcessEnv): boolean {
+  return readSwitch(env.COS_QUESTION_FULL_HOLD, false)
+}
+
+/** `COS_APPROVAL_FULL_HOLD`: hold a tool approval for the whole hook wait while the desk stays idle. Default OFF. */
+export function approvalFullHoldEnabled(env: NodeJS.ProcessEnv): boolean {
+  return readSwitch(env.COS_APPROVAL_FULL_HOLD, false)
+}
+
+/**
+ * `COS_WAITING_QUESTION_WORDS`: a session waiting on a question carries the first 80 characters of its
+ * first question (`waiting_detail`, through `toolTarget`), so Today and the Sessions rows say what it
+ * asks. Default ON: Miles, 2026-11-09 22:10 CST, "Yes, show by default", told that the text is written
+ * to the on-disk session-hook ledger and sent to any signed-in browser, including for questions
+ * answered at the desk. `0` restores 7.0.13's empty detail exactly. Question text only: never an
+ * option, a description or an answer. The `waiting` list with full words and options is NOT this
+ * switch: it is on only while a full-hold switch is.
+ */
+export function waitingQuestionWordsEnabled(env: NodeJS.ProcessEnv): boolean {
+  return readSwitch(env.COS_WAITING_QUESTION_WORDS, true)
+}
+
+/** Control and format characters (bidi overrides, zero-width) taken out of a question before it becomes row text. */
+export function questionRowText(question: unknown): string {
+  if (typeof question !== 'string') return ''
+  return question.replace(/[\p{Cc}\p{Cf}]+/gu, ' ')
+}
+
+export interface FullHoldSwitches { questions: boolean; approvals: boolean }
+
+export function fullHoldSwitches(env: NodeJS.ProcessEnv): FullHoldSwitches {
+  return { questions: questionFullHoldEnabled(env), approvals: approvalFullHoldEnabled(env) }
+}
+
+/**
+ * The oldest engine of each kind proven to show its own dialog while the hook waits, by the
+ * registry record's `entrypoint` and `version` (`~/.claude/sessions/<pid>.json`).
+ *   - `cli` 2.1.321: canaries C1 to C4, C7, C9 (2026-11-09, tmux, real TTY).
+ *   - `claude-desktop` 2.1.317: the engine Claude Desktop runs, driven over its stream-json
+ *     protocol, C5, C6, C9 (and the 6.71.7 Desktop D1 canary of 2026-10-11 in the real app).
+ * Anything else (`sdk-cli`, an unknown entrypoint, no version) is not proven.
+ */
+export const FULL_HOLD_ENGINE_FLOORS: Readonly<Record<string, readonly number[]>> = Object.freeze({
+  cli: Object.freeze([2, 1, 321]),
+  'claude-desktop': Object.freeze([2, 1, 317]),
+})
+
+/** Where the engine runs (`lib/full-hold-engine.ts` `processHost`): Claude.app's helper, a terminal, or neither. */
+export type EngineHost = 'desktop-app' | 'terminal' | 'other'
+
+export interface EngineFacts { entrypoint: string | null; version: string | null; host?: EngineHost }
+
+/**
+ * Q1 O2: the host each entrypoint must run in. A `claude -p` print run takes its entrypoint from
+ * whatever launched it, has no dialog, and runs under neither (`lib/full-hold-engine.ts`).
+ */
+export const FULL_HOLD_ENGINE_HOSTS: Readonly<Record<string, EngineHost>> = Object.freeze({
+  cli: 'terminal',
+  'claude-desktop': 'desktop-app',
+})
+
+/** `2.1.321` as numbers; null for anything that is not one to four dot-separated whole numbers. */
+export function parseEngineVersion(version: unknown): number[] | null {
+  if (typeof version !== 'string') return null
+  const trimmed = version.trim()
+  if (!/^\d{1,6}(?:\.\d{1,6}){0,3}$/.test(trimmed)) return null
+  return trimmed.split('.').map(Number)
+}
+
+/** True when `version` is at or above `floor`, part by part (a missing part reads 0). */
+export function versionAtLeast(version: readonly number[], floor: readonly number[]): boolean {
+  const length = Math.max(version.length, floor.length)
+  for (let i = 0; i < length; i++) {
+    const v = version[i] ?? 0
+    const f = floor[i] ?? 0
+    if (v !== f) return v > f
+  }
+  return true
+}
+
+/** Whether this engine is proven to keep its dialog on screen while the hook waits, and runs where that dialog is. */
+export function engineProvenForFullHold(engine: EngineFacts | null | undefined): boolean {
+  if (!engine || typeof engine.entrypoint !== 'string') return false
+  if (!Object.prototype.hasOwnProperty.call(FULL_HOLD_ENGINE_FLOORS, engine.entrypoint)) return false
+  if (engine.host !== FULL_HOLD_ENGINE_HOSTS[engine.entrypoint]) return false
+  const floor = FULL_HOLD_ENGINE_FLOORS[engine.entrypoint]!
+  const version = parseEngineVersion(engine.version)
+  return version !== null && versionAtLeast(version, floor)
+}
+
+/** The PermissionRequest wait the installer writes for a kind under the full hold. */
+export const FULL_HOLD_HOOK_WAIT_S = 3600
+
+/**
+ * The matcher of the non-question PermissionRequest block once the hook is split (canary C9:
+ * honoured on both engines; a question runs only the `AskUserQuestion` block, everything else
+ * only this one).
+ */
+export const NON_QUESTION_MATCHER = '^(?!AskUserQuestion$).*'
+export const QUESTION_MATCHER = 'AskUserQuestion'
+
+/** How a web (browser session) answer proves a person just touched the page, while a flag is on. */
+export const WEB_ANSWER_TOUCH_MAX_MS = 60_000
+/** How long a web approval's confirm step stays usable. */
+export const WEB_CONFIRM_TTL_MS = 60_000

package/server/lib/g2-turn-provenance.ts

@@ -56,6 +56,16 @@
 // even one with no origin left to carry, so the drain is the one caller allowed to add to the
 // parked turn's ledger record.
 //
+// WEB-KEY AUTHORITY (6.99.31, behind COS_WEB_KEY_AUTHORITY, default off). A web turn that also
+// carries a `cos-web-turn/1` envelope signed by an enrolled phone key (lib/web-key-authority.ts)
+// can be vouched as `authority: 'web-key'`. originOf only NOTES the envelope headers on a web
+// verdict (`webKeyCandidate`); nothing is vouched until the route, knowing its real target, the
+// exact words and the files, calls acceptWebKey. A route that never calls it leaves the web turn
+// exactly as 6.99.29 left it. Off, no candidate is ever noted, so every web turn is recorded with
+// WEB_UNVOUCHED_REASON and no footer, byte for byte as 6.99.29. A web-key record is self-proving
+// (envelope + signature), so the endpoint can vouch for it after a restart, unlike the in-memory
+// seal; a queued web-key origin is re-checked at its drain (expiry, revocation, epoch, words).
+//
 // TURN IDS ARE NOT REUSABLE. A record this process holds is never replaced by a different turn
 // under the same id (a client-chosen id could otherwise overwrite a vouched record: a denial of
 // service on verification). Only an identical retry (same target, same text, same origin) or the
@@ -67,6 +77,8 @@ import { appendFileSync, existsSync, renameSync, statSync } from 'node:fs'
 import { readFile } from 'node:fs/promises'
 import { networkInterfaces } from 'node:os'
 import { turnFooter } from './turn-footer.js'
+import { webKeyCandidateOf, type WebKeyAuthority, type WebKeyCandidate, type WebKeyContext, type WebKeyProof } from './web-key-authority.js'
+import { MESSAGE_SCOPE_MEANING, notAuthorizedFor } from '../../shared/web-turn-envelope.js'
 
 export { FOOTER_LINE_REFUSED_COPY, G2_TURN_FOOTER_RE, g2TurnFooter, hasFooterShapedLine, stripG2TurnFooter, TURN_FOOTER_SHAPED_RE, TURN_ID_IN_USE_COPY, turnFooter, turnFooterTag, withoutTurnFooter } from './turn-footer.js'
 
@@ -134,6 +146,14 @@ export interface OriginVerdict {
   reason?: string | null
   /** When this origin was judged (ms). A queued origin lapses from here, never later. */
   judgedAt?: number
+  /** 6.99.31: set only by acceptWebKey on a signed, accepted web turn. */
+  authority?: 'web-key'
+  /** 6.99.31: the accepted envelope and signature (self-proving). Present only with `authority`. */
+  webKey?: WebKeyProof
+  /** 6.99.31: envelope headers a web request carried, not yet judged (flag on only). Vouches for nothing. */
+  webKeyCandidate?: WebKeyCandidate
+  /** 6.99.31: why a signed web turn was not vouched (the route's acceptWebKey or a drain re-check). */
+  webKeyReason?: string
 }
 
 export interface G2TurnRecord {
@@ -155,6 +175,10 @@ export interface G2TurnRecord {
    * re-audit of 910eb90): the copy is judged by the request that sent it again, nothing is inherited.
    */
   resendOf?: string
+  /** 6.99.31: a vouched web turn signed by an enrolled phone key. */
+  authority?: 'web-key'
+  /** 6.99.31: the envelope bytes and signature that vouch for it (self-proving, so durable). */
+  webKey?: WebKeyProof
 }
 
 /** The shape of an Express request this module reads. Nothing else. */
@@ -186,12 +210,29 @@ export function turnTextSha256(text: string): string {
 export function footerApplies(verdict: OriginVerdict): boolean {
   if (verdict.verifiedOrigin !== true) return false
   const kind = originKindOf(verdict.origin.client)
+  // 6.99.31: a web turn is footed (COS-WEB) only when an enrolled phone key's envelope was accepted.
+  if (kind === 'web') return verdict.authority === 'web-key' && verdict.webKey !== undefined
   return kind === 'g2' || kind === 'phone'
 }
 
-/** The same verdict, never vouched, with the reason why. */
+/** Whether a verdict is a vouched web-key turn (the only vouched web turn there is). */
+function isWebKeyVerdict(verdict: OriginVerdict): boolean {
+  return verdict.verifiedOrigin === true && verdict.authority === 'web-key' && verdict.webKey !== undefined
+}
+
+/**
+ * The same verdict, never vouched, with the reason why. Any web-key authority is dropped; envelope
+ * headers not yet judged stay, so a Send again or an edit can still be judged on its own signature.
+ */
 export function unvouched(verdict: OriginVerdict, reason: string): OriginVerdict {
-  return { ...verdict, verifiedOrigin: false, reason }
+  const { authority: _a, webKey: _w, ...rest } = verdict
+  return { ...rest, verifiedOrigin: false, reason }
+}
+
+/** A signed web turn that was not vouched: unvouched, its envelope spent or dropped, the reason kept. */
+function webKeyRefused(verdict: OriginVerdict, reason: string): OriginVerdict {
+  const { authority: _a, webKey: _w, webKeyCandidate: _c, ...rest } = verdict
+  return { ...rest, verifiedOrigin: false, reason, webKeyReason: reason }
 }
 
 /** The vias of a turn still parked in the queue: the only records a continuation may extend. */
@@ -354,6 +395,11 @@ export interface G2TurnProvenanceDeps {
    * request with no X-Cos-Token header. Absent, or a throw: no turn is ever a web turn.
    */
   webSession?: (req: OriginRequest) => boolean
+  /**
+   * 6.99.31: the enrolled phone key authority. Absent, or its flag off: no envelope is ever read and
+   * every web turn is what 6.99.29 made it.
+   */
+  webKey?: WebKeyAuthority
   now?: () => number
   randomToken?: () => string
 }
@@ -448,14 +494,56 @@ export class G2TurnProvenance {
       verifiedOrigin = paired !== null && paired === clientInstance
       if (!verifiedOrigin) reason = 'not_ring_owner'
     }
+    // 6.99.31: a web request (cookie path, no token, not this Mac) that carries an envelope has it
+    // NOTED, not judged: acceptWebKey judges it once the route knows the target. Flag off: never noted.
+    let webKeyCandidate: WebKeyCandidate | null = null
+    if (client === 'web' && this.webKeyOn()) {
+      try { webKeyCandidate = webKeyCandidateOf(req.headers) } catch { webKeyCandidate = null }
+    }
     return {
       origin: { remote: known ? remote : 'unknown', loopback, ownAddress, clientInstance, client, tokenPresented, webSession },
       verifiedOrigin,
       reason,
       judgedAt: this.now(),
+      ...(webKeyCandidate ? { webKeyCandidate } : {}),
     }
   }
 
+  private webKeyOn(): boolean {
+    try { return this.deps.webKey?.enabled() === true } catch { return false }
+  }
+
+  /** The web-key authority, when wired (the routes and GET /api/g2-turns read it). */
+  get webKey(): WebKeyAuthority | null { return this.deps.webKey ?? null }
+
+  /**
+   * 6.99.31: judge the envelope a web verdict carries against the route's REAL target, the exact
+   * words and the ordered files. Accepted: vouched, `authority: 'web-key'`, footed COS-WEB. Refused:
+   * unvouched with the specific reason. A verdict with no envelope comes back unchanged, so every
+   * caller can pass every verdict. Never throws.
+   */
+  acceptWebKey(verdict: OriginVerdict, ctx: WebKeyContext): OriginVerdict {
+    const candidate = verdict.webKeyCandidate
+    if (!candidate) return verdict
+    // A fork's receiving child has no id the phone could have signed: never vouched (plan §4.4).
+    if (ctx.fork === true) return webKeyRefused(verdict, 'fork_destination_unbound')
+    if (verdict.origin.client !== 'web' || !this.deps.webKey) return webKeyRefused(verdict, 'web_key_authority_off')
+    const judged = this.deps.webKey.accept(candidate, ctx)
+    if (!judged.ok) {
+      console.warn(`[g2-turn-ledger] web-key turn not vouched turnId=${ctx.turnId} reason=${judged.reason}`)
+      return webKeyRefused(verdict, judged.reason)
+    }
+    const { webKeyCandidate: _c, webKeyReason: _r, ...rest } = verdict
+    return { ...rest, verifiedOrigin: true, reason: null, authority: 'web-key', webKey: judged.proof }
+  }
+
+  /** A held web-key origin still holds at its drain only while recheck passes (plan §4.5). */
+  private reheld(verdict: OriginVerdict, prompt: string, attachments: string): OriginVerdict {
+    if (verdict.authority !== 'web-key' || !verdict.webKey) return verdict
+    const reason = this.deps.webKey ? this.deps.webKey.recheck(verdict.webKey, prompt, attachments) : 'web_key_authority_off'
+    return reason === null ? verdict : webKeyRefused(verdict, reason)
+  }
+
   /**
    * The text to deliver: with the footer for a vouched glasses or phone turn, otherwise unchanged.
    * `provider` is the harness the text is delivered into (claude, codex or cursor), named in the
@@ -468,9 +556,10 @@ export class G2TurnProvenance {
 
   private build(input: { turnId: string; prompt: string; verdict: OriginVerdict; provider: string; sessionId: string; via: string; fork?: boolean; resendOf?: string }): G2TurnRecord {
     const originKind = originKindOf(input.verdict.origin.client)
-    // A web turn is never vouched, whatever verdict reached here (header).
-    const verifiedOrigin = input.verdict.verifiedOrigin === true && originKind !== 'web'
-    const reason = verifiedOrigin ? null : (originKind === 'web' ? WEB_UNVOUCHED_REASON : (input.verdict.reason ?? 'unverified'))
+    // A web turn is never vouched unless an enrolled phone key's envelope was accepted (6.99.31).
+    const webKey = originKind === 'web' && isWebKeyVerdict(input.verdict)
+    const verifiedOrigin = input.verdict.verifiedOrigin === true && (originKind !== 'web' || webKey)
+    const reason = verifiedOrigin ? null : (originKind === 'web' ? (input.verdict.webKeyReason ?? WEB_UNVOUCHED_REASON) : (input.verdict.reason ?? 'unverified'))
     return {
       turnId: input.turnId,
       createdAt: new Date(this.now()).toISOString(),
@@ -483,6 +572,7 @@ export class G2TurnProvenance {
       target: { provider: input.provider, sessionId: input.sessionId, ...(input.fork ? { fork: true as const } : {}) },
       via: input.via,
       ...(typeof input.resendOf === 'string' && input.resendOf.length > 0 ? { resendOf: input.resendOf } : {}),
+      ...(webKey && verifiedOrigin ? { authority: 'web-key' as const, webKey: input.verdict.webKey } : {}),
     }
   }
 
@@ -571,7 +661,8 @@ export class G2TurnProvenance {
    * within QUEUED_ORIGIN_TTL_MS of when it was judged. A lapsed origin is forgotten here.
    */
   queuedVerdict(provider: string, threadId: string, clientTurnId: string, prompt: string): OriginVerdict | null {
-    return this.queuedOrigin(provider, threadId, clientTurnId, prompt)?.verdict ?? null
+    const held = this.queuedOrigin(provider, threadId, clientTurnId, prompt)
+    return held ? this.reheld(held.verdict, prompt, held.attachments) : null
   }
 
   private queuedOrigin(provider: string, threadId: string, clientTurnId: string, prompt: string): QueuedOrigin | null {
@@ -613,7 +704,10 @@ export class G2TurnProvenance {
       // The seal rides with the origin: the turn route checks the binding's provider and thread and
       // the files it is about to compose against it, and refuses a vouched turn that no longer matches.
       const seal: QueueSeal | null = held ? { provider: turn.provider, threadId: turn.threadId, attachments: held.attachments } : null
-      this.carries.set(token, { clientTurnId: turn.clientTurnId, verdict: held?.verdict ?? null, seal, textSha256: turnTextSha256(turn.prompt), expiresAt: at + TURN_CARRY_TTL_MS })
+      // 6.99.31: a parked web-key approval is re-checked here, at its drain: expired, revoked, a moved
+      // epoch or changed words carry it unvouched (never re-dated).
+      const verdict = held ? this.reheld(held.verdict, turn.prompt, held.attachments) : null
+      this.carries.set(token, { clientTurnId: turn.clientTurnId, verdict, seal, textSha256: turnTextSha256(turn.prompt), expiresAt: at + TURN_CARRY_TTL_MS })
       return token
     } catch {
       return null
@@ -655,8 +749,18 @@ export async function describeG2Turn(provenance: G2TurnProvenance, turnId: strin
   // Only a record this process wrote and still holds vouches for anything (see the header), never a
   // web turn (its cookie is derivable from the token), and never past G2_TURN_VOUCH_MAX_MS.
   let reason: string | null = null
-  if (originKind === 'web') reason = WEB_UNVOUCHED_REASON
-  else if (record.verifiedOrigin !== true) reason = typeof record.reason === 'string' ? record.reason : 'unverified'
+  // 6.99.31: a web-key record is self-proving (envelope + signature): re-verified here against the
+  // registry, so it vouches after a restart too, and reads revoked the moment its key is revoked.
+  // Flag off: every web record reads WEB_UNVOUCHED_REASON, exactly as 6.99.29.
+  const authority = provenance.webKey
+  const webKeyOn = authority !== null && authority.enabled()
+  const webKeyRecord = originKind === 'web' && record.authority === 'web-key' && record.verifiedOrigin === true && !!record.webKey
+  const webKeyReview = webKeyRecord && webKeyOn && authority ? authority.review(record.webKey as WebKeyProof, { turnId: record.turnId, target: record.target }) : null
+  if (originKind === 'web') {
+    if (webKeyReview === null) reason = webKeyOn && typeof record.reason === 'string' && record.verifiedOrigin !== true ? record.reason : WEB_UNVOUCHED_REASON
+    else if (webKeyReview.reason !== null) reason = webKeyReview.reason
+    else if (ageMs === null || ageMs > G2_TURN_VOUCH_MAX_MS) reason = 'record_too_old'
+  } else if (record.verifiedOrigin !== true) reason = typeof record.reason === 'string' ? record.reason : 'unverified'
   else if (!sealed) reason = 'not_sealed'
   else if (ageMs === null || ageMs > G2_TURN_VOUCH_MAX_MS) reason = 'record_too_old'
   return {
@@ -675,5 +779,20 @@ export async function describeG2Turn(provenance: G2TurnProvenance, turnId: strin
     target: record.target,
     via: record.via,
     ...(typeof record.resendOf === 'string' ? { resendOf: record.resendOf } : {}),
+    ...(webKeyReview !== null && record.webKey ? {
+      authority: 'web-key',
+      kid: record.webKey.kid,
+      scope: record.webKey.scope,
+      // Review B4: what this scope means and what it never authorizes, in the answer itself.
+      scopeMeaning: record.webKey.scope?.kind === 'approve' ? 'approve' : MESSAGE_SCOPE_MEANING,
+      notAuthorized: notAuthorizedFor(record.webKey.scope?.kind === 'approve' ? record.webKey.scope : { kind: 'message' }),
+      envelope: record.webKey.envelope,
+      signature: record.webKey.signature,
+      passkey: record.webKey.passkey ?? null,
+      authId: record.webKey.authId,
+      registryEntry: webKeyReview.entry,
+      // Anchor (B1), epoch and revocations (W5), integrity (W1), consume keys (B3): docs/web-key-verifier-contract.md section 6.
+      ...(webKeyReview.facts ?? {}),
+    } : {}),
   }
 }

package/server/lib/list-model-memo.ts

@@ -0,0 +1,85 @@
+/**
+ * `reported_model` on LIST rows without the list ever waiting on a model read (step 2a, S1_CONTRACT_step2a.md B3).
+ *
+ * The 6.62.0 QA rule W11 (routes/agent-sessions.ts) keeps model reads off the list path: a list of 60 rows must not
+ * hold a tail read per row. So list rows carry the model ONLY from this memo. After a list answers, `warmListModels`
+ * reads the rows the memo missed in the background: at most 4 at a time, Claude and Codex only, and a file that keeps
+ * changing is re-read at most once a minute (a Codex posture scan can be long). The value then appears on a later poll.
+ *
+ * The value and format are exactly the detail route's (session-continue-facts.ts): Claude a bare slug, Codex
+ * `<model> <effort>`. Cursor rows are not warmed here (their model sits in Cursor's database; the detail route has it).
+ */
+import { stat } from 'node:fs/promises'
+import { codexReportedModel, readCodexSessionPosture } from './codex-session-posture.js'
+import { readClaudeReportedModel, sanitizeReportedModel } from './session-continue-facts.js'
+
+export const LIST_MODEL_WARM_CONCURRENCY = 4
+export const LIST_MODEL_REREAD_MS = 60_000
+const MEMO_MAX = 2_000
+
+interface Memo { mtimeMs: number; size: number; readAt: number; model: string | null }
+const memo = new Map<string, Memo>()
+const inflight = new Set<string>()
+let running = 0
+const queue: Array<() => Promise<void>> = []
+export const listModelStats = { reads: 0 }
+
+type Provider = 'claude' | 'codex' | 'cursor'
+const keyOf = (provider: Provider, file: string) => `${provider}:${file}`
+
+/** The memo's model for this file, or undefined. Never reads the file's contents. A value read within the last
+ *  minute is served even if the file has moved on since (a busy session's model rarely changes mid-minute). */
+export function cachedListModel(provider: Provider, file: string | undefined, fileMtimeMs: number | null, now = Date.now()): string | undefined {
+  if (!file) return undefined
+  const m = memo.get(keyOf(provider, file))
+  if (!m || m.model === null) return undefined
+  // `modified` on a row is an ISO time (whole milliseconds); the memo holds the stat's fractional mtime.
+  if (fileMtimeMs === null || Math.floor(m.mtimeMs) === Math.floor(fileMtimeMs) || now - m.readAt < LIST_MODEL_REREAD_MS) return m.model
+  return undefined
+}
+
+async function readModel(provider: Provider, file: string): Promise<string | null> {
+  listModelStats.reads++
+  if (provider === 'claude') return readClaudeReportedModel(file)
+  if (provider === 'codex') return sanitizeReportedModel(codexReportedModel(await readCodexSessionPosture(file)))
+  return null
+}
+
+function pump(): void {
+  while (running < LIST_MODEL_WARM_CONCURRENCY && queue.length) {
+    const job = queue.shift()!
+    running++
+    void job().finally(() => { running--; pump() })
+  }
+}
+
+/** Queue background reads for the rows the memo misses. Returns at once; never throws. */
+export function warmListModels(rows: ReadonlyArray<{ provider: Provider; file?: string }>, now = Date.now()): void {
+  for (const row of rows) {
+    if (row.provider === 'cursor' || !row.file) continue
+    const key = keyOf(row.provider, row.file)
+    if (inflight.has(key)) continue
+    const m = memo.get(key)
+    if (m && now - m.readAt < LIST_MODEL_REREAD_MS) continue
+    inflight.add(key)
+    const { provider, file } = row
+    queue.push(async () => {
+      try {
+        const st = await stat(file)
+        const prev = memo.get(key)
+        if (prev && prev.mtimeMs === st.mtimeMs && prev.size === st.size) { prev.readAt = Date.now(); return }
+        const model = await readModel(provider, file)
+        memo.delete(key)
+        memo.set(key, { mtimeMs: st.mtimeMs, size: st.size, readAt: Date.now(), model })
+        while (memo.size > MEMO_MAX) memo.delete(memo.keys().next().value!)
+      } catch { /* unknown stays unknown */ } finally { inflight.delete(key) }
+    })
+  }
+  pump()
+}
+
+/** Tests only. */
+export async function __drainListModelWarmForTests(): Promise<void> {
+  while (running > 0 || queue.length > 0) await new Promise(resolve => setTimeout(resolve, 5))
+}
+export function __resetListModelMemoForTests(): void { memo.clear(); inflight.clear(); queue.length = 0; listModelStats.reads = 0 }

package/server/lib/listener-startup.ts

@@ -27,3 +27,21 @@ export async function listenRequiredServers(listeners: RequiredListener[]): Prom
     throw error
   }
 }
+
+export interface ListenerPlanEntry { label: 'HTTPS' | 'HTTPS signer' | 'HTTP'; port: number; tls: boolean }
+
+/**
+ * Which listeners this boot REQUIRES (every one goes through listenRequiredServers, so a port another
+ * process holds fails the boot closed). 6.99.31: the phone key's signer origin (https, its own
+ * port, review B2/W2) is added only with COS_WEB_KEY_AUTHORITY on and only beside HTTPS. Flag off:
+ * exactly the 6.99.29 set.
+ */
+export function listenerPlan(opts: { httpsAvailable: boolean; webKeyAuthority: boolean; httpPort: number; httpsPort: number; signerPort: number }): ListenerPlanEntry[] {
+  const plan: ListenerPlanEntry[] = []
+  if (opts.httpsAvailable) {
+    plan.push({ label: 'HTTPS', port: opts.httpsPort, tls: true })
+    if (opts.webKeyAuthority) plan.push({ label: 'HTTPS signer', port: opts.signerPort, tls: true })
+  }
+  plan.push({ label: 'HTTP', port: opts.httpPort, tls: false })
+  return plan
+}

package/server/lib/meeting-batch-transcribe.ts

@@ -16,6 +16,7 @@ import {
   transcribeHighQuality,
   type HighQualityTranscriptionResult,
   type WhisperWord,
+  isWhisperHqTimeout,
 } from './whisper-local.js'
 import { asrFrontEnd } from './stt-live.js'
 import { measureSpeechSeconds } from './vad-silero.js'
@@ -412,6 +413,7 @@ export const __progressiveHqTesting = {
   segmentRangeIsComplete,
   nextMissingSealedSegment,
   progressiveFailureIdentity,
+  recordProgressiveFailure,
   resolveProgressiveHqPolicy,
   progressiveSessionIsIdle,
   yieldIdleProgressiveSessions,
@@ -1091,6 +1093,30 @@ function yieldIdleProgressiveSessions(activeSessionId: string, now = Date.now())
   }
 }
 
+/** Attempts a progressive checkpoint gets before it waits for the save-time job. */
+const PROGRESSIVE_MAX_ATTEMPTS = 3
+const PROGRESSIVE_RETRY_BACKOFF_MS = [60_000, 120_000, 300_000]
+
+/** S1 (2026-11-09): what one failed checkpoint decode means for its retries.
+ * A timeout is not retried. The retry would run the same audio on the same CPU lane at the
+ * same background QoS against the same 240 s ceiling: 10/26 to 11/09, 112 segments timed out
+ * and 85 of them timed out on all three attempts, so 178 of 290 timeouts (about 12 h of
+ * CPU during meetings) were retries. The checkpoint is disposable; the save-time job decodes
+ * that window. Any other failure keeps the 60/120/300 s backoff. Returns whether it is terminal. */
+function recordProgressiveFailure(
+  state: Pick<ProgressiveSessionState, 'failedIdentity' | 'failedAttempts' | 'retryAfter'>,
+  identity: string,
+  error: unknown,
+  now = Date.now(),
+): { terminal: boolean; timedOut: boolean } {
+  const timedOut = isWhisperHqTimeout(error)
+  const attempts = state.failedIdentity === identity ? state.failedAttempts + 1 : 1
+  state.failedAttempts = timedOut ? Math.max(attempts, PROGRESSIVE_MAX_ATTEMPTS) : attempts
+  state.failedIdentity = identity
+  state.retryAfter = now + PROGRESSIVE_RETRY_BACKOFF_MS[Math.min(PROGRESSIVE_RETRY_BACKOFF_MS.length - 1, state.failedAttempts - 1)]
+  return { terminal: state.failedAttempts >= PROGRESSIVE_MAX_ATTEMPTS, timedOut }
+}
+
 function segmentRangeIsComplete(segment: BatchSegment, completedIndices: number[]): boolean {
   const completed = new Set(completedIndices)
   for (let index = segment.startChunkIdx; index <= segment.endChunkIdx; index++) {
@@ -1111,7 +1137,7 @@ function nextMissingSealedSegment(
     if (!cached) {
       const identity = progressiveFailureIdentity(state.audioDir, segment, previousText)
       if (!identity) return null
-      if (state.failedIdentity === identity && (state.failedAttempts >= 3 || Date.now() < state.retryAfter)) return null
+      if (state.failedIdentity === identity && (state.failedAttempts >= PROGRESSIVE_MAX_ATTEMPTS || Date.now() < state.retryAfter)) return null
       return { segment, previousText }
     }
     previousText = cached.text
@@ -1191,12 +1217,13 @@ function queueProgressiveWork(sessionId: string, state: ProgressiveSessionState)
       if ((error as Error)?.name !== 'AbortError') {
         const identity = progressiveFailureIdentity(state.audioDir, pending.segment, pending.previousText)
         if (!identity) return
-        state.failedAttempts = state.failedIdentity === identity ? state.failedAttempts + 1 : 1
-        state.failedIdentity = identity
-        state.retryAfter = Date.now() + [60_000, 120_000, 300_000][Math.min(2, state.failedAttempts - 1)]
+        const outcome = recordProgressiveFailure(state, identity, error)
         console.warn(
           `[meeting-hq-checkpoint] ${sessionId} ${pending.segment.startChunkIdx}-${pending.segment.endChunkIdx}: `
-          + `${error instanceof Error ? error.message : String(error)}`,
+          + `${error instanceof Error ? error.message : String(error)}`
+          + (outcome.terminal
+            ? (outcome.timedOut ? ' (timeout: not retried; the save-time job decodes this window)' : ' (attempts exhausted; the save-time job decodes this window)')
+            : ` (attempt ${state.failedAttempts} of ${PROGRESSIVE_MAX_ATTEMPTS})`),
         )
       }
     } finally {

package/server/lib/model-efforts.ts

@@ -0,0 +1,40 @@
+/**
+ * Each agent's efforts for /api/models (Sessions chat-style layout, step 2a; S1_CONTRACT_step2a.md section C).
+ *
+ * One source for every picker, web and Mac: ghost report item 6 found the model and effort lists hard-coded in seven
+ * places. The values are exactly what POST /api/query-jobs accepts as `effort` (EFFORT_OPTIONS; anything else is
+ * dropped by the job route today, ghost item 5), and each entry says what the agent actually runs with it, from the
+ * same mapping functions the bridges call. Cursor's bridge takes no effort, so its list is empty.
+ */
+import {
+  DEFAULT_EFFORT,
+  EFFORT_OPTIONS,
+  effortLabel,
+  resolveCliEffortFlag,
+  resolveCodexReasoningEffort,
+  type EffortPreference,
+} from '../../shared/model-preference.js'
+import { resolveOllamaThink } from './ollama-bridge.js'
+
+export interface EffortChoice { value: EffortPreference; label: string; runs: string }
+export interface ModelEfforts {
+  default: EffortPreference
+  byAgent: { claude: EffortChoice[]; codex: EffortChoice[]; ollama: EffortChoice[]; cursor: EffortChoice[] }
+}
+
+export function modelEfforts(env: NodeJS.ProcessEnv = process.env): ModelEfforts {
+  const choices = (runs: (effort: EffortPreference) => string): EffortChoice[] =>
+    EFFORT_OPTIONS.map(value => ({ value, label: effortLabel(value), runs: runs(value) }))
+  return {
+    default: DEFAULT_EFFORT,
+    byAgent: {
+      // `--effort`; Ultracode is a COS choice that runs Claude at xhigh.
+      claude: choices(e => resolveCliEffortFlag(e)),
+      // `model_reasoning_effort`.
+      codex: choices(e => resolveCodexReasoningEffort(e)),
+      // Ollama's `think` (COS_OLLAMA_THINK, when set, pins it whatever the effort).
+      ollama: choices(e => { const think = resolveOllamaThink(env.COS_OLLAMA_THINK, e); return think === false ? 'off' : think === true ? 'on' : think }),
+      cursor: [],
+    },
+  }
+}