@floless/app 0.30.0 → 0.31.1

package/autostart.mjs

@@ -0,0 +1,251 @@
+// autostart — register/unregister FloLess to start at LOGIN via a per-user
+// "At log on" Scheduled Task (replaces the old HKCU\Run key).
+//
+// WHY a Scheduled Task and not the Run key (the bug this fixes):
+// FloLess is installed by Velopack INSIDE Claude's MSIX container — the binary
+// physically lives at
+//   %LOCALAPPDATA%\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Local\FlolessApp\…
+// (there is NO copy outside the container; %LOCALAPPDATA%\FlolessApp is just a
+// junction back into it). Explorer's logon Run-key processor silently SKIPS an
+// executable that resides inside another package's container. Verified on the
+// target machine 2026-05-30: at logon, every *other* enabled HKCU\Run entry
+// fired (Shell-Core Operational event 9707 logged OneDrive, GoogleDriveFS, …)
+// but the FloLess entry NEVER appeared — while the exact same command launches a
+// healthy server on demand (~0.8s) and via Task Scheduler (LastTaskResult 0x0).
+// It was not Fast Startup (Run keys fire fine here), not Mark-of-the-Web, not
+// Defender, not a StartupApproved disable (no such entry), and not timing (key
+// written before the boot). The single distinguishing factor is the container path.
+//
+// A per-user "At log on" Scheduled Task has none of these problems, and three
+// independent research passes (n8n / Docker / Ollama / Syncthing ecosystem +
+// Microsoft Learn) converge on it as THE mechanism for a per-user local server
+// that must come back after every reboot:
+//   • Fires on every Fast-Startup power-on — a real interactive logon always
+//     happens (Session 1 is torn down at shutdown; only the kernel session
+//     hibernates). The trap to avoid is the "At startup" trigger, which the
+//     Fast-Startup restore path skips — so we use a LOGON trigger, never a boot one.
+//   • Runs as the interactive user (InteractiveToken) → the supervisor sees the
+//     per-user license file (%LOCALAPPDATA%\FlolessApp-data) and ~/.aware. A
+//     Windows Service (LocalSystem/LocalService) would NOT — wrong profile.
+//   • Needs no admin / no UAC / no stored password (verified: Register-ScheduledTask
+//     for this user's own InteractiveToken logon task succeeds unelevated here).
+//   • Is NOT subject to the StartupApproved silent-disable that gates Run keys.
+//
+// The task's action is `"<exe>" --supervise` — the same headless, self-healing
+// watchdog as before (starts the server, respawns it within seconds if it dies).
+// Crash-recovery is the supervisor's job, NOT the autostart mechanism's (no OS
+// autostart primitive restarts a long-lived process — that's why --supervise exists).
+//
+// .mjs (not .ts) so it can be imported by BOTH main.ts (the SEA dispatcher, TS) and
+// — if ever needed — launch.mjs (plain JS), mirroring teardown.mjs / install-path.mjs.
+// Pure logic (the XML builder) is unit-tested; the imperative wrappers (schtasks.exe)
+// are exercised by the human's real Shut-Down → power-on E2E.
+import { execFileSync } from 'node:child_process';
+import { writeFileSync, rmSync, appendFileSync, mkdirSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { RUN_KEY, RUN_VALUE } from './teardown.mjs';
+import { logDir, logFilePath } from './log.mjs';
+
+// Stable per-user task name (root of the user's Task Scheduler namespace: \FloLess).
+export const TASK_NAME = 'FloLess';
+
+const isWin = process.platform === 'win32';
+
+/**
+ * Is autostart a meaningful, writable setting in THIS channel? True only for the
+ * packaged SEA exe (FlolessApp.exe) on Windows — that's the only build whose logon
+ * task makes sense. The npm/dev channel runs the server via node.exe (autostart is
+ * never wired, and registering node.exe would be wrong), and autostart is Windows-only.
+ * The /api/autostart endpoint reports this as `supported`; the UI HIDES the toggle
+ * (never shows a dead control) when it's false.
+ *
+ * @param {string} [platform]  defaults to process.platform
+ * @param {string} [execPath]  defaults to process.execPath
+ * @returns {boolean}
+ */
+export function autostartSupported(platform = process.platform, execPath = process.execPath) {
+  return platform === 'win32' && /flolessapp\.exe$/i.test(execPath || '');
+}
+
+/** Minimal XML text escaping (element content + the few chars a path/user could carry). */
+function escapeXml(s) {
+  return String(s)
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&apos;');
+}
+
+/**
+ * Build the Task Scheduler XML for the per-user logon autostart task.
+ * Pure + exported so the exact task definition is unit-tested (no side effects).
+ *
+ * @param {string} exePath  the (un-virtualized) FlolessApp.exe path to launch.
+ * @param {string} userId   the principal/trigger user, e.g. "MACHINE\\User".
+ * @returns {string} a Task Scheduler 1.2 XML document.
+ */
+export function buildAutostartTaskXml(exePath, userId) {
+  const exe = escapeXml(exePath);
+  const user = escapeXml(userId);
+  // Notes on load-bearing settings:
+  //   LogonTrigger          → fires at user logon (Fast-Startup-safe; NOT a BootTrigger).
+  //   InteractiveToken      → runs as the logged-in user with their profile loaded
+  //                           (sees the per-user license + ~/.aware); no stored password.
+  //   LeastPrivilege        → no elevation, no UAC.
+  //   ExecutionTimeLimit PT0S → never time-limit the action (default is 72h).
+  //   MultipleInstancesPolicy IgnoreNew → never stack supervisors.
+  //   battery flags false   → still start on laptops running on battery.
+  //   StartWhenAvailable    → run a missed trigger as soon as possible.
+  return `<?xml version="1.0" encoding="UTF-16"?>
+<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
+  <RegistrationInfo>
+    <Description>Keeps the FloLess local server running so your browser tab reconnects after every login.</Description>
+  </RegistrationInfo>
+  <Triggers>
+    <LogonTrigger>
+      <Enabled>true</Enabled>
+      <UserId>${user}</UserId>
+    </LogonTrigger>
+  </Triggers>
+  <Principals>
+    <Principal id="Author">
+      <UserId>${user}</UserId>
+      <LogonType>InteractiveToken</LogonType>
+      <RunLevel>LeastPrivilege</RunLevel>
+    </Principal>
+  </Principals>
+  <Settings>
+    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
+    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
+    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
+    <AllowHardTerminate>false</AllowHardTerminate>
+    <StartWhenAvailable>true</StartWhenAvailable>
+    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
+    <IdleSettings>
+      <StopOnIdleEnd>false</StopOnIdleEnd>
+      <RestartOnIdle>false</RestartOnIdle>
+    </IdleSettings>
+    <AllowStartOnDemand>true</AllowStartOnDemand>
+    <Enabled>true</Enabled>
+    <Hidden>false</Hidden>
+    <RunOnlyIfIdle>false</RunOnlyIfIdle>
+    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>
+    <Priority>7</Priority>
+  </Settings>
+  <Actions Context="Author">
+    <Exec>
+      <Command>${exe}</Command>
+      <Arguments>--supervise</Arguments>
+    </Exec>
+  </Actions>
+</Task>`;
+}
+
+/** The current interactive user as "DOMAIN\\User" (DOMAIN falls back to the machine name). */
+function currentUserId() {
+  const dom = process.env.USERDOMAIN || process.env.COMPUTERNAME || '';
+  const user = process.env.USERNAME || '';
+  return dom ? `${dom}\\${user}` : user;
+}
+
+/** Drop the legacy HKCU\Run autostart value (the broken mechanism this replaces). Best-effort. */
+function removeLegacyRunKey() {
+  try {
+    execFileSync('reg', ['delete', RUN_KEY, '/v', RUN_VALUE, '/f'], { stdio: 'ignore', windowsHide: true });
+  } catch {
+    /* value absent — nothing to remove */
+  }
+}
+
+/**
+ * Append one diagnostic line to the server logfile, best-effort (never throws).
+ * The original Run-key autostart failed SILENTLY — that is the exact failure class
+ * this rewrite kills, so a registration failure must always leave a breadcrumb
+ * (dual-review finding, 2026-05-30) rather than vanish.
+ */
+function logLine(msg) {
+  try {
+    mkdirSync(logDir(), { recursive: true });
+    appendFileSync(logFilePath(), `${new Date().toISOString()} ${msg}\n`);
+  } catch {
+    /* logging must never crash the caller */
+  }
+}
+
+/**
+ * Register (or refresh) the per-user logon autostart task to run `"<exe>" --supervise`.
+ * Idempotent (`/F` overwrites, so this also fixes a stale path after an update).
+ * Windows-only; no-op elsewhere. Also removes the legacy Run-key value (migration).
+ *
+ * Creates the task with `schtasks.exe /Create /XML` reading a UTF-16LE temp file
+ * directly — NOT PowerShell's `Register-ScheduledTask -Xml`. schtasks is a plain
+ * Win32 exe (no ScheduledTasks PS module / execution-policy / constrained-language
+ * dependency — important on locked-down corporate machines), it reads the UTF-16LE
+ * file directly — avoiding PowerShell's `-Xml` STRING round-trip that could silently
+ * corrupt the task definition — and makes register/query/delete all one tool.
+ * (schtasks REQUIRES the UTF-16 BOM: a BOM-less file is rejected as "the task XML is
+ * malformed" — verified 2026-05-30.) Also verified: schtasks /Create of the user's
+ * own InteractiveToken logon task succeeds UNELEVATED (SUCCESS, on-demand 0x0).
+ *
+ * Throws on a schtasks failure (after logging a breadcrumb) so the best-effort
+ * callers (the Velopack install hook, ensureAutostart) decide — they swallow it,
+ * but the failure is no longer invisible.
+ */
+export function registerAutostart(exePath) {
+  if (!isWin) return;
+  const xml = buildAutostartTaskXml(exePath, currentUserId());
+  // pid + timestamp so two registrations in one process can't clobber each other's temp.
+  const tmp = join(tmpdir(), `floless-autostart-${process.pid}-${Date.now()}.xml`);
+  // BOM is REQUIRED: schtasks /Create rejects a BOM-less file as "the task XML is
+  // malformed" (it needs the U+FEFF marker to detect UTF-16). Verified 2026-05-30.
+  writeFileSync(tmp, '' + xml, { encoding: 'utf16le' });
+  try {
+    execFileSync('schtasks', ['/Create', '/TN', TASK_NAME, '/XML', tmp, '/F'], {
+      stdio: ['ignore', 'ignore', 'ignore'],
+      windowsHide: true,
+    });
+  } catch (err) {
+    logLine(`autostart: schtasks /Create failed: ${err && err.message ? err.message : err}`);
+    throw err;
+  } finally {
+    try { rmSync(tmp, { force: true }); } catch { /* temp cleanup best-effort */ }
+  }
+  removeLegacyRunKey();
+}
+
+/** True iff the autostart task exists. Uses schtasks' exit code (0 = present). Win-only. */
+export function autostartPresent() {
+  if (!isWin) return false;
+  try {
+    execFileSync('schtasks', ['/query', '/tn', TASK_NAME], { stdio: 'ignore', windowsHide: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Self-heal: ensure the autostart task exists, registering it if missing. Cheap and
+ * idempotent — called on every packaged-app open (which runs OUTSIDE Claude's MSIX
+ * container, where task registration is reliable), so the task is guaranteed present
+ * after the user opens the app even once, regardless of whether the in-container
+ * install hook could register it. Best-effort; never throws. Win-only.
+ */
+export function ensureAutostart(exePath) {
+  if (!isWin) return;
+  if (autostartPresent()) return;
+  try { registerAutostart(exePath); } catch { /* failure already logged in registerAutostart */ }
+}
+
+/** Remove the autostart task AND any legacy Run-key value. Idempotent; Win-only. */
+export function unregisterAutostart() {
+  if (!isWin) return;
+  try {
+    execFileSync('schtasks', ['/delete', '/tn', TASK_NAME, '/f'], { stdio: 'ignore', windowsHide: true });
+  } catch {
+    /* task absent — nothing to remove */
+  }
+  removeLegacyRunKey();
+}

package/dist/floless-server.cjs

@@ -52835,7 +52835,7 @@ function appVersion() {
   return resolveVersion({
     isSea: isSea2(),
     sqVersionXml: readSqVersionXml(),
-    define: true ? "0.30.0" : void 0,
+    define: true ? "0.31.1" : void 0,
     pkgVersion: readPkgVersion()
   });
 }
@@ -52845,7 +52845,7 @@ function resolveChannel(s) {
   return "dev";
 }
 function appChannel() {
-  return resolveChannel({ isSea: isSea2(), define: true ? "0.30.0" : void 0 });
+  return resolveChannel({ isSea: isSea2(), define: true ? "0.31.1" : void 0 });
 }
 
 // oauth-presets.ts

package/dist/web/steel-editor.html

@@ -61,12 +61,30 @@
  rect.dethot{cursor:pointer;fill:rgba(168,85,247,.16);stroke:#a855f7;stroke-width:1;stroke-dasharray:3 3;vector-effect:non-scaling-stroke}
  rect.dethot:hover{fill:rgba(168,85,247,.34)}
  text.dettx{fill:#ddd6fe;font:bold 11px system-ui;text-anchor:middle;pointer-events:none}
- #detailsModal,#framesModal,#rfiModal,#askAiModal{position:fixed;inset:0;z-index:20;display:none;align-items:center;justify-content:center}
+ #detailsModal,#framesModal,#rfiModal,#confModal,#askAiModal{position:fixed;inset:0;z-index:20;display:none;align-items:center;justify-content:center}
  #askAiDrop:hover{border-color:var(--brand);color:var(--text)} #askAiDrop.has{border-style:solid;border-color:var(--brand)}
  .aithumb{position:relative;display:inline-flex} .aithumb img{height:60px;border-radius:4px;border:1px solid var(--line);background:#fff;display:block}
  .aithumb button{position:absolute;top:-5px;right:-5px;width:16px;height:16px;padding:0;border-radius:8px;font-size:10px;line-height:16px;text-align:center;background:#7f1d1d;border-color:#991b1b;color:#fecaca}
  #saveStat.dirty{color:#fbbf24} #saveStat.ok{color:#86efac} #saveStat.err{color:#fca5a5}
  #rfiStat{cursor:pointer;text-decoration:underline dotted} #rfiStat:hover b{color:#fff}
+ #confStat{cursor:pointer;text-decoration:underline dotted} #confStat:hover b{filter:brightness(1.25)}
+ .conf-cats{display:grid;grid-template-columns:repeat(2,1fr);gap:10px;padding:14px;border-bottom:1px solid var(--line)}
+ .ccard{background:var(--bg);border:1px solid var(--line);border-radius:8px;padding:10px 12px}
+ .ccard.click{cursor:pointer} .ccard.click:hover{border-color:var(--brand)} .ccard.on{border-color:var(--brand)}
+ .ccard .cc-label{font-size:10px;text-transform:uppercase;letter-spacing:.08em;color:var(--mut);margin-bottom:4px}
+ .ccard .cc-score{font-size:22px;font-weight:700;line-height:1;margin-bottom:6px}
+ .ccard .cc-bar{height:4px;border-radius:2px;background:var(--line);margin-bottom:6px;overflow:hidden}
+ .ccard .cc-fill{height:100%;border-radius:2px}
+ .ccard .cc-counts{font-size:11px;color:var(--mut);display:flex;gap:8px;flex-wrap:wrap}
+ .conf-filter{display:flex;gap:12px;flex-wrap:wrap;padding:12px 14px;border-bottom:1px solid var(--line);align-items:center}
+ .conf-filter .glab{font-size:10px;text-transform:uppercase;letter-spacing:.06em;color:var(--mut)}
+ .conf-filter .grp{display:inline-flex;border:1px solid var(--line);border-radius:6px;overflow:hidden}
+ .conf-filter .grp button{border:0;border-radius:0;background:transparent;color:var(--mut);font-size:11px;padding:4px 9px;cursor:pointer}
+ .conf-filter .grp button.on{background:var(--brand);color:#fff}
+ .conf-body{padding:0 14px 14px;overflow:auto;flex:1;min-height:0}
+ .chip{display:inline-block;padding:1px 6px;border-radius:4px;font-size:10px;border:1px solid var(--line);color:var(--mut);margin:0 3px 3px 0}
+ .chip.assumed,.chip.weak{border-color:#713f12;color:#fbbf24} .chip.fail{border-color:#7f1d1d;color:#fca5a5}
+ tr.confrow{cursor:pointer} .conf-expand{color:var(--mut);font-size:12px;line-height:1.6;background:#0b1220}
  .ftab td .combo{padding:4px 6px} .ftab .rea{color:var(--mut);font-size:12px} .rfichip{display:inline-block;min-width:18px;height:18px;line-height:18px;text-align:center;background:#7f1d1d;color:#fecaca;border-radius:9px;font-size:11px;padding:0 5px}
  .mbackdrop{position:absolute;inset:0;background:rgba(2,8,23,.62)}
  .mpanel{position:relative;background:var(--panel);border:1px solid var(--line);border-radius:10px;width:min(880px,92vw);max-height:86vh;display:flex;flex-direction:column;box-shadow:0 20px 60px rgba(0,0,0,.6)}
@@ -115,6 +133,7 @@
  <span class=stat>Members <b id=mc>0</b></span><span class=stat>Weight <b id=wt>0</b> tons · <b id=wtlb>0</b> lb</span>
  <span class=stat id=rfiStat title="Click to list unresolved members (RFI)">RFI <b id=rc>0</b></span>
  <span class=stat id=dupStat title="Overlapping/duplicate members (same geometry)">Dup <b id=dpc>0</b></span>
+ <span class=stat id=confStat title="Confidence report — score each AI-read element by evidence" style="display:none">Confidence <b id=confPct>—</b></span>
  <span class=stat id=saveStat title="Edits auto-save in this browser (localStorage)">Saved</span><span style="flex:1"></span>
  <button id=undoB title="Undo (Ctrl+Z)">↶</button>
  <button id=redoB title="Redo (Ctrl+Y / Ctrl+Shift+Z)">↷</button>
@@ -160,6 +179,11 @@
 <div id=rfiModal><div class=mbackdrop id=rfiBackdrop></div>
  <div class=mpanel><div class=mhead><b>Unresolved members — RFI</b><button id=rfiClose>✕</button></div>
  <div id=rfiGrid style="padding:14px;overflow:auto"></div></div></div>
+<div id=confModal><div class=mbackdrop id=confBackdrop></div>
+ <div class=mpanel><div class=mhead><b>Confidence report</b><button id=confClose>✕</button></div>
+ <div id=confCats class=conf-cats></div>
+ <div id=confFilter class=conf-filter></div>
+ <div id=confBody class=conf-body></div></div></div>
 <div id=askAiModal><div class=mbackdrop id=askAiBackdrop></div>
  <div class=mpanel style="width:min(560px,92vw)">
   <div class=mhead><b>Ask the AI</b><button id=askAiClose>✕</button></div>
@@ -429,7 +453,7 @@ function render(){
    selM.forEach((m,idx)=>{const c=mid(m),k=Math.round(c[0]/8)+','+Math.round(c[1]/8);(grp[k]=grp[k]||[]).push({idx,c});});
    for(const k in grp){const a=grp[k],n=a.length;a.forEach((it,j)=>{const x=it.c[0]+(j-(n-1)/2)*R*2,y=it.c[1];const d=`data-bx="${it.c[0]}" data-fi="${j}" data-gn="${n}"`;
      s+=`<circle class=numbg ${d} cx="${x}" cy="${y}" r="${R}"/><text class=numtx ${d} x="${x}" y="${y}" style="font-size:${F}px">${it.idx+1}</text>`;});}}
- svg.innerHTML=s; document.getElementById('profiles').innerHTML=profs.map(p=>`<option value="${esc(p)}">`).join(''); document.getElementById('details').innerHTML=(P.details||[]).map(d=>`<option value="${esc(d.text)}">`).join(''); stats(); panel(); updUR(); updDup();
+ svg.innerHTML=s; document.getElementById('profiles').innerHTML=profs.map(p=>`<option value="${esc(p)}">`).join(''); document.getElementById('details').innerHTML=(P.details||[]).map(d=>`<option value="${esc(d.text)}">`).join(''); stats(); panel(); updUR(); updDup(); updConf();
 }
 function updDup(){const n=redundantDups().length;
  document.getElementById('dpc').textContent=n;document.getElementById('dupStat').classList.toggle('has',n>0);
@@ -500,6 +524,7 @@ function panel(){
   <div class=row><label>Profile</label><div style="display:flex;gap:6px"><input id=pf class=combo data-src=profiles value="${esc(m.profile)}" style="flex:1" autocomplete=off><button id=pickProf class="ghost${(picking&&pickKind==='profile')?' on':''}" title="Pick profile by clicking a label in the drawing">⌖ pick</button></div>${(picking&&pickKind==='profile')?'<div class="hint" style="margin-top:4px;font-style:italic;color:var(--brand)">Click a profile label in the drawing…</div>':(picking&&pickKind==='detail')?'<div class="hint" style="margin-top:4px;font-style:italic;color:#a855f7">Click a detail callout in the drawing…</div>':''}</div>
   <div class="seg2 f"><button id=rBeam class="${col?'':'on'}">Beam</button><button id=rCol class="${col?'on':''}">Column</button></div>
   <div class="row hint">Length <b>${L} ft</b> · ${wpf==null?'<span class=pill style="background:#7f1d1d">RFI — size unresolved</span>':'Weight <b>'+(len(m.wp[0],m.wp[1])/FT*wpf).toFixed(0)+' lb</b> · '+wpf+' lb/ft'}</div>
+  <div class=row><button class=ghostw id=verifyBtn${m.verified?' style="border-color:#166534;color:#86efac"':''} title="Mark this member human-confirmed → 100% in the confidence report">${m.verified?'✓ Verified — human-confirmed':'Mark verified'}</button></div>
   ${mfSug.length?`<div class="row" style="border:1px solid #a855f7;border-radius:6px;padding:7px 8px;background:rgba(168,85,247,.07)"><div class=elab style="color:#c4b5fd;margin:0">Moment-frame girder · ${_lvl==='roof'?'roof':'2nd floor'} (from Frames)</div><div style="display:flex;flex-wrap:wrap;gap:5px;margin-top:5px">${mfSug.map(s=>`<button class="ghost mfsug${s===m.profile?' on':''}" data-s="${esc(s)}">${esc(s)}</button>`).join('')}</div></div>`:''}
   ${elev}
   <div class=divrow><hr><span class=sect style="margin:0">Modify geometry</span><hr></div>
@@ -510,7 +535,7 @@ function panel(){
  document.getElementById('pickProf').onclick=()=>{if(picking&&pickKind==='profile'){picking=false;}else{picking=true;pickKind='profile';pickEnd=null;}render();};
  document.getElementById('rBeam').onclick=()=>{if(col)edit(()=>{m.role='beam';});};
  document.getElementById('rCol').onclick=()=>{if(!col)edit(()=>{m.role='column';});};
- document.querySelectorAll('.mfsug').forEach(b=>b.onclick=()=>edit(()=>{m.profile=b.dataset.s;m.rfi=(WT[m.profile]==null);if(!profs.includes(m.profile)){profs.push(m.profile);profs.sort();}}));
+ document.querySelectorAll('.mfsug').forEach(b=>b.onclick=()=>edit(()=>{m.profile=b.dataset.s;m.mf=true;m.rfi=(WT[m.profile]==null);if(!profs.includes(m.profile)){profs.push(m.profile);profs.sort();}}));  // record the moment-frame provenance (drives the confidence "schedule-resolved" factor)
  const _gel=document.getElementById('geoEL'),_gsp=document.getElementById('geoSplit');
  if(_gel)_gel.onclick=()=>{geoMode=(geoMode==='el'?null:'el');setGeo();render();};
  if(_gsp)_gsp.onclick=()=>{geoMode=(geoMode==='split'?null:'split');setGeo();render();};
@@ -534,6 +559,7 @@ function panel(){
   document.getElementById('matchEnds').onclick=()=>edit(()=>{m.ends[1]={tos:m.ends[0].tos,note:m.ends[0].note,tosDef:m.ends[0].tosDef,detail:m.ends[0].detail};});
  }
  document.getElementById('del').onclick=()=>edit(()=>{P.members=P.members.filter(x=>x.id!==m.id);selIds.clear();});
+ {const vb=document.getElementById('verifyBtn');if(vb)vb.onclick=()=>edit(()=>{m.verified=!m.verified;});}
 }
 function addFromSeg(sid){const sg=P.segments.find(s=>s.id===sid);if(!sg)return;const P=addProfile;const id='m'+Date.now();const pv=snapshot();
  P.members.push(ensureMeta({id,profile:P,wp:[sg.a.slice(),sg.b.slice()],angle:sg.o,rfi:(WT[P]==null)}));
@@ -643,6 +669,7 @@ addEventListener('keydown',e=>{
  if(e.key==='Escape'&&detailsOpen()){closeDetails();return;}
  if(e.key==='Escape'&&framesOpen()){closeFrames();return;}
  if(e.key==='Escape'&&rfiOpen()){closeRFI();return;}
+ if(e.key==='Escape'&&confOpen()){closeConf();return;}
  if(e.key==='Home'){e.preventDefault();fitToWindow();return;}
  if(e.key==='Escape'){if(geoMode){geoMode=null;setGeo();render();return;}if(mode==='add'){mode='sel';setMode();}picking=false;pickKind='profile';pickEnd=null;selIds.clear();render();return;}
  if((e.key==='Delete'||e.key==='Backspace')&&selIds.size&&!inForm){e.preventDefault();edit(()=>{P.members=P.members.filter(m=>!selIds.has(m.id));selIds.clear();});return;}
@@ -780,6 +807,96 @@ function rfiOpen(){return document.getElementById('rfiModal').style.display==='f
 document.getElementById('rfiStat').onclick=openRFI;
 document.getElementById('rfiClose').onclick=closeRFI;
 document.getElementById('rfiBackdrop').onclick=closeRFI;
+// ===== Confidence report — evidence-based score (MIRROR of server/steel-confidence.ts; keep in sync) =====
+// Deterministic: scores ONLY observable evidence already in the contract, never a model self-report.
+const BANDW={verified:1,high:.9,med:.65,low:.35,rfi:0};
+const BANDLAB={verified:'Verified',high:'High',med:'Medium',low:'Low',rfi:'RFI'};
+const BANDC={verified:'#86efac',high:'#4ade80',med:'#fbbf24',low:'#fca5a5',rfi:'#fca5a5'};
+const BANDPILL={verified:'background:#166534;color:#86efac',high:'background:#14532d;color:#4ade80',med:'background:#713f12;color:#fbbf24',low:'background:#7f1d1d;color:#fca5a5',rfi:'background:#7f1d1d;color:#fca5a5'};
+function _wt(profile){if(!WT||!profile)return null;if(profile in WT)return WT[profile]==null?null:WT[profile];
+ const h=Object.entries(WT).find(([k])=>k.toUpperCase()===profile.toUpperCase());return h?(h[1]==null?null:h[1]):null;}
+const _isMf=p=>!!p&&/(^|[^A-Z])MF($|[^A-Z])/i.test(p);
+function _confDupIds(members){const g={};const key=m=>{if(!m.wp||m.wp.length<2)return null;const r=p=>Math.round(p[0]/3)+','+Math.round(p[1]/3);const a=r(m.wp[0]),b=r(m.wp[1]);return a<b?a+'|'+b:b+'|'+a;};
+ const rank=m=>{let s=0;if(m.profile&&!_isMf(m.profile))s++;if(m.profile&&m.profile.trim()!=='')s++;return s;};
+ for(const m of members){const k=key(m);if(!k)continue;(g[k]=g[k]||[]).push(m);}
+ const out=new Set();for(const k in g){const grp=g[k];if(grp.length<2)continue;grp.sort((a,b)=>rank(b)-rank(a));for(let i=1;i<grp.length;i++)out.add(grp[i].id);}return out;}
+function _elevAssumed(m){if(m.role==='column')return !(m.col&&m.col.tosDef===false);const en=m.ends||[];if(!en.length)return true;return en.some(e=>e.tosDef!==false);}
+function _scoreMember(m,dup){const plf=_wt(m.profile);const F=[];
+ if(plf==null){F.push({key:'profile',label:'Profile',state:'fail',detail:(!m.profile||!m.profile.trim())?'no profile assigned':_isMf(m.profile)?('unresolved mark "'+m.profile+'" — not an AISC size'):('"'+m.profile+'" not in the AISC weight table')});return {band:'rfi',factors:F};}
+ const sched=m.mf===true;F.push({key:'profile',label:'Profile',state:sched?'assumed':'ok',detail:sched?(m.profile+' — resolved from the frame schedule ('+plf+' plf)'):(m.profile+' ('+plf+' plf, AISC)')});
+ const asm=_elevAssumed(m);F.push({key:'elevation',label:'Elevation',state:asm?'assumed':'ok',detail:asm?'plan default (UNO) — no local callout':'from a drawing callout'});
+ const isd=dup.has(m.id);if(isd)F.push({key:'dup',label:'Duplicate',state:'fail',detail:'coincident with a kept member — deleting dedupes the BOM'});
+ if(m.verified===true)F.push({key:'verified',label:'Verified',state:'ok',detail:'human-confirmed'});
+ const band=m.verified===true?'verified':isd?'low':(sched||asm)?'med':'high';return {band,factors:F};}
+function _mTons(m,ptPerFt){const plf=_wt(m.profile);if(plf==null)return 0;let ft;
+ if(m.role==='column'){if(!m.col||m.col.tos==null||m.col.bos==null)return 0;ft=Math.abs(m.col.tos-m.col.bos)/12;}  // column length = height (TOS−BOS), inches→ft
+ else{if(!m.wp||m.wp.length<2)return 0;ft=Math.hypot(m.wp[0][0]-m.wp[1][0],m.wp[0][1]-m.wp[1][1])/(ptPerFt>0?ptPerFt:1);}
+ return ft*plf/2000;}
+function _detSheet(t){const m=String(t||'').toUpperCase().match(/S-?\s?\d{2,3}/);return m?m[0].replace(/\s/g,''):null;}
+const _cnt0=()=>({verified:0,high:0,med:0,low:0,rfi:0});
+function scoreContractJS(){const plans=C.plans||[];const byMember=[],byDetail=[];let segs=0;
+ const known=new Set();for(const p of plans)if(p.sheet)known.add(p.sheet.toUpperCase());for(const s of Object.keys(C.detail_bubbles||{}))known.add(s.toUpperCase());
+ plans.forEach((plan,pi)=>{segs+=(plan.segments||[]).length;const ms=plan.members||[];const dup=_confDupIds(ms);
+  for(const m of ms){const r=_scoreMember(m,dup);byMember.push({id:m.id,planIdx:pi,sheet:plan.sheet||'',role:m.role==='column'?'column':'beam',profile:m.profile||'',band:r.band,tons:r.band==='rfi'?0:_mTons(m,plan.pt_per_ft),factors:r.factors});}
+  for(const d of (plan.details||[])){const sh=_detSheet(d.text);const ok=sh!=null&&known.has(sh.toUpperCase());byDetail.push({text:d.text||'',planIdx:pi,sheet:plan.sheet||'',band:ok?'high':'low',reason:ok?('references '+sh+' (in the set)'):sh?('references '+sh+' — not found in the set'):'no sheet reference parsed'});}});
+ const roll=(arr,cw)=>{const c=_cnt0();let n=0,d=0,t=0;for(const m of arr){c[m.band]++;if(m.band==='rfi')continue;const w=cw?1:m.tons;n+=w*BANDW[m.band];d+=w;t+=m.tons;}return {score:d>0?Math.round(n/d*100):null,tons:t,counts:c};};
+ const dRoll=arr=>{const c=_cnt0();let n=0,d=0;for(const x of arr){c[x.band]++;n+=BANDW[x.band];d++;}return {score:d>0?Math.round(n/d*100):null,tons:0,counts:c};};
+ const beams=roll(byMember.filter(m=>m.role==='beam'));const columns=roll(byMember.filter(m=>m.role==='column'));const details=dRoll(byDetail);
+ const sc=byMember.filter(m=>m.band!=='rfi');const n=sc.reduce((s,m)=>s+m.tons*BANDW[m.band],0),d=sc.reduce((s,m)=>s+m.tons,0);
+ return {byMember,byDetail,byCategory:{beams,columns,details,connections:{score:null,note:'Not scored yet (reserved slot)',counts:_cnt0()}},coverage:{members:byMember.length,segments:segs,note:'Approximate in v1 — precise per-segment binding is Slice 2.'},overall:{score:d>0?Math.round(n/d*100):null,tons:d,rfiCount:byMember.filter(m=>m.band==='rfi').length}};}
+function bandColorForPct(p){return p==null?'var(--mut)':p>=95?BANDC.verified:p>=80?BANDC.high:p>=50?BANDC.med:BANDC.low;}
+function updConf(){const el=document.getElementById('confStat');if(!el)return;const s=scoreContractJS();
+ if(!s.byMember.length){el.style.display='none';return;}el.style.display='';
+ const b=document.getElementById('confPct');b.textContent=s.overall.score==null?'—':s.overall.score+'%';b.style.color=bandColorForPct(s.overall.score);
+ el.title='Confidence — '+s.overall.tons.toFixed(1)+' t scored · '+s.overall.rfiCount+' RFI. Click for the report.';}
+// --- the report modal ---
+let confBand='all',confCat='all',confExpand=null;
+function openConf(){confExpand=null;renderConf();document.getElementById('confModal').style.display='flex';}
+function closeConf(){document.getElementById('confModal').style.display='none';}
+function confOpen(){return document.getElementById('confModal').style.display==='flex';}
+function _bar(pct){return '<div class=cc-bar><div class=cc-fill style="width:'+(pct||0)+'%;background:'+bandColorForPct(pct)+';'+(pct==null?'opacity:0':'')+'"></div></div>';}
+function _countsHtml(c){const out=['verified','high','med','low','rfi'].filter(k=>c[k]>0).map(k=>'<span style="color:'+BANDC[k]+'">'+BANDLAB[k][0]+' <b>'+c[k]+'</b></span>').join('');return out||'<span>—</span>';}
+function renderConf(){const s=scoreContractJS();const cat=s.byCategory;
+ const card=(key,label,cs,stub)=>'<div class="ccard'+(stub?' stub':' click')+(confCat===key?' on':'')+'" data-cat="'+key+'"'+(stub?' title="not scored yet"':'')+'>'+
+   '<div class=cc-label>'+label+'</div>'+
+   '<div class=cc-score style="color:'+(stub?'var(--mut)':bandColorForPct(cs.score))+'">'+(stub||cs.score==null?'—':cs.score+'%')+'</div>'+
+   _bar(stub?null:cs.score)+
+   '<div class=cc-counts>'+(stub?'<span>reserved slot</span>':_countsHtml(cs.counts))+'</div></div>';
+ document.getElementById('confCats').innerHTML=card('beams','Beams',cat.beams)+card('columns','Columns',cat.columns)+card('details','Details',cat.details)+card('connections','Connections',cat.connections,true);
+ const bands=['all','verified','high','med','low','rfi'],cats=['all','beams','columns','details','connections'];
+ document.getElementById('confFilter').innerHTML=
+  '<span class=glab>Band</span><span class=grp>'+bands.map(b=>'<button data-band="'+b+'" class="'+(confBand===b?'on':'')+'">'+(b==='all'?'All':BANDLAB[b])+'</button>').join('')+'</span>'+
+  '<span class=glab>Category</span><span class=grp>'+cats.map(c=>'<button data-fcat="'+c+'" class="'+(confCat===c?'on':'')+'">'+(c==='all'?'All':c[0].toUpperCase()+c.slice(1))+'</button>').join('')+'</span>'+
+  '<span class=glab style="margin-left:auto">Coverage: '+s.coverage.members+' members · '+s.coverage.segments+' segments (approx, v1)</span>';
+ document.getElementById('confBody').innerHTML=confBodyHtml(s);
+ wireConf();}
+function confBodyHtml(s){
+ if(!s.byMember.length&&!s.byDetail.length)return '<div class=hint style="padding:14px 0">No members in the takeoff yet.</div>';
+ if(confCat==='connections')return '<div class=hint style="padding:14px 0">Connection scoring is not built yet (reserved slot).</div>';
+ let mem=s.byMember.slice();
+ if(confCat==='beams')mem=mem.filter(m=>m.role==='beam');else if(confCat==='columns')mem=mem.filter(m=>m.role==='column');else if(confCat==='details')mem=[];
+ if(confBand!=='all')mem=mem.filter(m=>m.band===confBand);
+ let det=(confCat==='all'||confCat==='details')?s.byDetail.slice():[];
+ if(confBand!=='all')det=det.filter(d=>d.band===confBand);
+ let h='<table class=ftab><thead><tr><th>Band</th><th>Element</th><th>Sheet</th><th>Tons</th><th>Evidence</th><th></th></tr></thead><tbody>';
+ mem.forEach(m=>{const chips=m.factors.map(f=>'<span class="chip '+(f.state==='ok'?'':f.state)+'">'+esc(f.label)+(f.state==='ok'?' ✓':f.state==='fail'?' ✗':' ●')+'</span>').join('');
+  h+='<tr class=confrow data-mid="'+esc(m.id)+'" data-pi="'+m.planIdx+'"><td><span class=pill style="'+BANDPILL[m.band]+'">'+BANDLAB[m.band]+'</span></td>'+
+   '<td>'+(esc(m.profile)||'<span style="color:var(--mut)">(no profile)</span>')+' <span style="color:var(--mut);font-size:11px">'+esc(m.role)+'</span></td>'+
+   '<td>'+esc(m.sheet)+'</td><td>'+(m.tons?m.tons.toFixed(2):'—')+'</td><td>'+chips+'</td>'+
+   '<td><button class=ghost data-loc="'+esc(m.id)+'" data-pi="'+m.planIdx+'">Locate</button></td></tr>';
+  if(confExpand===m.id)h+='<tr><td></td><td colspan=5 class=conf-expand>'+m.factors.map(f=>'<div>• <b>'+esc(f.label)+':</b> '+esc(f.detail)+'</div>').join('')+'</td></tr>';});
+ det.forEach(d=>{h+='<tr><td><span class=pill style="'+BANDPILL[d.band]+'">'+BANDLAB[d.band]+'</span></td><td>'+(esc(d.text)||'(detail)')+' <span style="color:var(--mut);font-size:11px">detail</span></td><td>'+esc(d.sheet)+'</td><td>—</td><td><span class=hint>'+esc(d.reason)+'</span></td><td></td></tr>';});
+ if(!mem.length&&!det.length)h+='<tr><td colspan=6><div class=hint style="padding:14px 0">Nothing matches this filter.</div></td></tr>';
+ h+='</tbody></table>';return h;}
+function wireConf(){
+ document.querySelectorAll('#confCats .ccard.click').forEach(c=>c.onclick=()=>{confCat=(confCat===c.dataset.cat?'all':c.dataset.cat);renderConf();});
+ document.querySelectorAll('#confFilter [data-band]').forEach(b=>b.onclick=()=>{confBand=b.dataset.band;renderConf();});
+ document.querySelectorAll('#confFilter [data-fcat]').forEach(b=>b.onclick=()=>{confCat=b.dataset.fcat;renderConf();});
+ document.querySelectorAll('#confBody tr.confrow').forEach(r=>r.onclick=e=>{if(e.target.closest('button'))return;const id=r.dataset.mid;confExpand=confExpand===id?null:id;renderConf();});
+ document.querySelectorAll('#confBody button[data-loc]').forEach(b=>b.onclick=e=>{e.stopPropagation();const pi=+b.dataset.pi;if(pi!==C.active)setPlan(pi);const m=byId(b.dataset.loc);if(!m)return;selIds=new Set([m.id]);geoMode=null;setGeo();closeConf();render();zoomToMember(m);});}
+document.getElementById('confStat').onclick=openConf;
+document.getElementById('confClose').onclick=closeConf;
+document.getElementById('confBackdrop').onclick=closeConf;
 // --- detail preview lightbox (click a card / an end's ⤢ to enlarge) ---
 const SHEET_PREV=C.sheet_previews||{}, DBUB=C.detail_bubbles||{};
 function sheetOf(text){const m=/(S-?\w+)/.exec(String(text||'').replace(/^\w+-/,''));if(!m)return null;const s=m[1].toUpperCase();return s.startsWith('S-')?s:'S-'+s.slice(1);}

package/install-path.mjs

@@ -0,0 +1,129 @@
+// install-path — escape Claude's MSIX bind-link virtualization for paths we
+// REGISTER with Windows (Run key, floless:// handler, Scheduled Task) and for
+// the license-store directory.
+//
+// Claude desktop ships as a Windows MSIX package (`Claude_pzs8sxrjxfjjc`) that
+// virtualizes `%LOCALAPPDATA%` for processes running inside its container. A
+// Velopack install targeting `%LOCALAPPDATA%\FlolessApp\` actually lands at
+// `%LOCALAPPDATA%\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Local\FlolessApp\`.
+// From INSIDE the container both paths appear via a transparent bind-link;
+// from OUTSIDE only the Packages\... path exists. So registering Windows-level
+// hooks with `process.execPath` (the apparent virtual path) makes them fail at
+// logon / from Explorer / from the browser's protocol launch with
+// ERROR_FILE_NOT_FOUND (0x80070002). The fix is to register the un-virtualized
+// REAL path. (Verified on this machine 2026-05-30: `fs.realpathSync` does NOT
+// un-virtualize — the bind-link is opaque to it — so we explicitly remap.)
+//
+// .mjs (not .ts) so launch.mjs (plain JS, shipped to npm as-is) can import it.
+// Pure functions accept dependency-injected fs helpers so they unit-test
+// without touching the real filesystem. Thin wrappers bind the real fs at the
+// edge.
+
+import { existsSync, readdirSync, realpathSync } from 'node:fs';
+
+/**
+ * @param {string} execPath  the path to (possibly) resolve.
+ * @param {string | undefined} localAppData  the `%LOCALAPPDATA%` env var (apparent value).
+ * @param {(p: string) => boolean} exists  `fs.existsSync` injection.
+ * @param {(p: string) => string[]} readdir  `fs.readdirSync` injection (Packages enumeration).
+ * @param {(p: string) => string} realpath  `fs.realpathSync` injection (may throw on failure).
+ * @returns {string} the resolved real path, or `execPath` unchanged when no remap applies.
+ */
+export function resolveRealInstallExePure(execPath, localAppData, exists, readdir, realpath) {
+  if (!execPath) return execPath;
+  // 1. realpath handles real symlinks/junctions cleanly (forward-compatible with
+  //    a future non-container install). Defensive: if realpath throws (e.g. on
+  //    a path that doesn't exist), keep the original — never block on this step.
+  let resolved = execPath;
+  try { resolved = realpath(execPath); } catch { resolved = execPath; }
+  if (resolved !== execPath) return resolved;
+
+  // 2. Container detection + remap. Only applies when execPath sits under the
+  //    apparent %LOCALAPPDATA% (i.e. we were launched from inside the container's
+  //    virtualized view). On non-Windows / non-container installs this returns
+  //    execPath unchanged.
+  if (!localAppData) return execPath;
+  // Normalize any trailing separator(s) on the env-var value before the prefix
+  // check — Windows env vars carry whatever the user/installer wrote and a
+  // trailing `\` would otherwise produce `...local\\` and silently fail to
+  // match `...Local\FlolessApp\…` (dual-review finding #3, 2026-05-30).
+  const laRoot = localAppData.replace(/[\\/]+$/, '');
+  const lcExec = execPath.toLowerCase();
+  const lcPrefix = laRoot.toLowerCase() + '\\';
+  if (!lcExec.startsWith(lcPrefix)) return execPath;
+  const tail = execPath.slice(laRoot.length); // e.g. \FlolessApp\current\FlolessApp.exe
+
+  // Already a Packages\<pkg>\LocalCache\Local\... path (i.e. the REAL location)?
+  // Don't double-map. Also handles the case where outside-container launches
+  // arrive here with the real path already.
+  if (/^\\Packages\\[^\\]+\\LocalCache\\Local\\/i.test(tail)) return execPath;
+
+  const packagesDir = `${laRoot}\\Packages`;
+  let packages;
+  try { packages = readdir(packagesDir); } catch { return execPath; }
+  if (!Array.isArray(packages)) return execPath;
+  for (const pkg of packages) {
+    const candidate = `${packagesDir}\\${pkg}\\LocalCache\\Local${tail}`;
+    if (exists(candidate)) return candidate;
+  }
+  return execPath;
+}
+
+/**
+ * Pure: if `execPath` is under an MSIX package's `\Packages\<pkg>\LocalCache\Local\`
+ * (i.e. we were launched from OUTSIDE the container at the real path), derive
+ * `<pkg>\LocalCache\Local\FlolessApp-data` as the matching license-store
+ * directory. This is how a logon Scheduled Task / Run key launch (which sees
+ * `%LOCALAPPDATA%` as the REAL user LocalAppData, not the sandbox) still finds
+ * the license file Velopack wrote into the sandbox.
+ *
+ * @param {string} execPath
+ * @returns {string | null}
+ */
+export function sandboxLicenseDirPure(execPath) {
+  if (!execPath) return null;
+  const m = execPath.match(/^(.*\\Packages\\[^\\]+\\LocalCache\\Local)\\/i);
+  return m ? `${m[1]}\\FlolessApp-data` : null;
+}
+
+// ── Real-fs wrappers ────────────────────────────────────────────────────────
+
+/**
+ * @param {string} [execPath]  defaults to `process.execPath`
+ * @returns {string}
+ */
+export function resolveRealInstallExe(execPath = process.execPath) {
+  return resolveRealInstallExePure(
+    execPath,
+    process.env.LOCALAPPDATA,
+    existsSync,
+    readdirSync,
+    realpathSync,
+  );
+}
+
+/**
+ * Side-effect: when `process.execPath` reveals we were launched from the
+ * sandbox-real path (i.e. by a logon Scheduled Task / Run key sitting outside
+ * the container), set `FLOLESS_LICENSE_DIR` to the sandbox `FlolessApp-data`
+ * dir BEFORE any module reads it. Idempotent and respectful of an
+ * already-set env var (tests + the dev workflow). No-op in dev (tsx) and
+ * for non-container installs (execPath doesn't match the Packages\… shape).
+ */
+export function deriveSandboxLicenseDir() {
+  if (process.env.FLOLESS_LICENSE_DIR) return;
+  const d = sandboxLicenseDirPure(process.execPath);
+  if (d) process.env.FLOLESS_LICENSE_DIR = d;
+}
+
+// Self-execute the side effect at module-evaluation time. ESM evaluates an
+// imported module BEFORE control returns to subsequent imports in the
+// importer, so making this top-level (rather than a call inside main.ts's
+// body) guarantees FLOLESS_LICENSE_DIR is set before licensing.ts (a
+// transitive import via main.ts → index.js) evaluates — even if some future
+// rewrite of licensing.ts reads the env var at module-load time rather than
+// lazily in storeDir(). Importing this module FIRST in main.ts preserves this
+// ordering. Idempotent + no-op when the var is already set or execPath isn't a
+// sandbox-real path, so the side effect is safe in every channel (SEA, npm,
+// tests).
+deriveSandboxLicenseDir();

package/log.mjs

@@ -0,0 +1,47 @@
+// Shared logfile location + rotation for the floless.app server. Dependency-free
+// (Node built-ins only) so BOTH launch.mjs (which routes the detached daemon's
+// stdout/stderr here) and index.ts (which records crash stacks) resolve ONE log
+// path — they must agree, or the daemon's output and the crash trace would land in
+// different files and "why did it vanish?" stays unanswerable.
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { existsSync, mkdirSync, statSync, renameSync, openSync } from 'node:fs';
+
+const MAX_BYTES = 2 * 1024 * 1024; // roll once to .1 past 2 MB
+
+// Where logs live: FLOLESS_LOG_DIR override (tests), else the licensing store's home
+// (%LocalAppData%\FlolessApp-data on Windows, ~/.aware elsewhere) under /logs.
+export function logDir() {
+  if (process.env.FLOLESS_LOG_DIR) return process.env.FLOLESS_LOG_DIR;
+  if (process.platform === 'win32' && process.env.LOCALAPPDATA) {
+    return join(process.env.LOCALAPPDATA, 'FlolessApp-data', 'logs');
+  }
+  return join(homedir(), '.aware', 'logs');
+}
+
+export function logFilePath() {
+  return join(logDir(), 'floless-server.log');
+}
+
+export function ensureLogDir() {
+  try { mkdirSync(logDir(), { recursive: true }); } catch { /* best-effort */ }
+}
+
+// Roll an oversized log to .1 (replacing any previous .1). Best-effort; never throws.
+// Safe to call from launch.mjs (before it opens the daemon's stdio fd) AND from the
+// server at startup: the second call no-ops because the file is then freshly small.
+export function rotateLog() {
+  try {
+    const p = logFilePath();
+    if (existsSync(p) && statSync(p).size > MAX_BYTES) renameSync(p, p + '.1');
+  } catch { /* best-effort */ }
+}
+
+// Open the logfile for appending (creating the dir first). Returns an fd, or null if
+// it can't be opened — the caller then falls back to 'ignore' rather than failing.
+export function openLogFd() {
+  try {
+    ensureLogDir();
+    return openSync(logFilePath(), 'a');
+  } catch { return null; }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floless/app",
-  "version": "0.30.0",
+  "version": "0.31.1",
   "type": "module",
   "description": "Thin localhost host for floless.app — serves web/ and shells the aware CLI. No engine, no LLM.",
   "bin": {
@@ -8,8 +8,7 @@
   },
   "files": [
     "bin/",
-    "launch.mjs",
-    "teardown.mjs",
+    "*.mjs",
     "dist/",
     "package.json"
   ],

package/post-update-marker.mjs

@@ -0,0 +1,83 @@
+// One-shot, time-fresh marker signalling "the next launch is a post-self-update relaunch" (#37).
+//
+// After a Velopack self-update, Update.exe swaps current\ and relaunches FlolessApp.exe
+// **bare** → the launcher defaults to `open` → a SECOND browser tab, while the user's existing
+// tab is meant to adopt the new build in place. The marker tells cmdOpen to start the server
+// WITHOUT opening a browser; the existing tab reloads itself onto the new build (see the health
+// poll in web/aware.js).
+//
+// Two hard-won constraints shape the path + freshness:
+//
+//  1. WRITER ≠ READER, ACROSS AN MSIX BOUNDARY. The marker is dropped by the build completing
+//     the update (the updater process and/or Velopack's `--veloapp-updated` hook) and read by a
+//     DIFFERENT process (the bare relaunch's cmdOpen). In the Claude desktop install the hook
+//     runs INSIDE the MSIX container (virtualized %LOCALAPPDATA%) while the relaunch runs
+//     OUTSIDE it — so an execPath-derived path can disagree between writer and reader. We anchor
+//     the marker at ~/.floless (FLOLESS_HOME), which is OUTSIDE the virtualized LocalAppData
+//     bind-link and therefore identical in and out of the container. (We still ALSO read the
+//     legacy install-root location 0.12.1 wrote to, so an update FROM 0.12.1 is honored.)
+//
+//  2. TIME-FRESH, NOT JUST ONE-SHOT. If a marker is dropped but the relaunch never reaches
+//     cmdOpen (a failed/odd update, or Velopack writing the hook AFTER the relaunch), a stale
+//     marker must NOT silently swallow the browser on the user's next MANUAL open. Only a marker
+//     dropped within the last couple of minutes counts; either way it's consumed (deleted).
+import { existsSync, writeFileSync, rmSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+
+const FRESH_MS = 120_000;
+
+/** Container-stable primary location (~/.floless/.post-update). FLOLESS_POST_UPDATE_MARKER overrides it (tests). */
+export function markerPath() {
+  const override = (process.env.FLOLESS_POST_UPDATE_MARKER ?? '').trim();
+  if (override) return override;
+  const root = process.env.FLOLESS_HOME ?? join(homedir(), '.floless');
+  return join(root, '.post-update');
+}
+
+/** Legacy location 0.12.1 wrote to (install root, execPath-derived). Read for back-compat. */
+function legacyMarkerPath() {
+  if ((process.env.FLOLESS_POST_UPDATE_MARKER ?? '').trim()) return null; // tests pin a single path
+  try {
+    return join(dirname(dirname(process.execPath)), '.floless-post-update');
+  } catch {
+    return null;
+  }
+}
+
+/** Best-effort: drop the one-shot marker before a self-update relaunch. Never throws. */
+export function writePostUpdateMarker() {
+  let wrote = false;
+  for (const p of [markerPath(), legacyMarkerPath()]) {
+    if (!p) continue;
+    try {
+      writeFileSync(p, new Date().toISOString());
+      wrote = true;
+    } catch {
+      /* worst case: the pre-fix extra tab — never block the update on this */
+    }
+  }
+  return wrote;
+}
+
+/**
+ * Best-effort one-shot read: returns true iff a FRESH marker existed (dropped within FRESH_MS).
+ * Always deletes any marker it finds so it fires at most once and never lingers.
+ */
+export function consumePostUpdateMarker() {
+  let fresh = false;
+  for (const p of [markerPath(), legacyMarkerPath()]) {
+    if (!p) continue;
+    try {
+      if (!existsSync(p)) continue;
+      const ageMs = Date.now() - statSync(p).mtimeMs;
+      rmSync(p, { force: true }); // consume regardless — one-shot, no lingering marker
+      // Fresh = written recently. No lower bound: a just-written file's mtime can read a few
+      // ms AHEAD of Date.now() (FS/clock granularity on Windows), which is still "recent".
+      if (ageMs < FRESH_MS) fresh = true;
+    } catch {
+      /* best-effort */
+    }
+  }
+  return fresh;
+}