@gotcos/glasses-server 6.99.29 → 7.0.7

package/server/routes/thread-turn-queue.ts

@@ -24,13 +24,13 @@ import {
   admitToQueue, drainDecision, queueableRefusal, queuePosition,
   MAX_DELIVERY_ATTEMPTS, type DrainObservation, type QueuedThreadTurn,
   queueReconcileEnabled, queueResendEnabled, queuedTurnReasonCopy, sessionSteerAvailability, sessionSteerEnabled,
-  type SessionSteerAvailability,
+  steerMidturnEnabled, type SessionSteerAvailability,
 } from '../lib/thread-turn-queue.js'
 import { readQueue, writeQueue, queuedThreadKeys } from '../lib/thread-turn-queue-store.js'
 import type { DeliveryEvidence } from '../lib/queue-turn-evidence.js'
 import { continueLiveEnabled } from '../lib/session-peer-inbox-deps.js'
 import { PEER_VERIFY_TIMEOUT_MS } from '../lib/session-peer-inbox.js'
-import { attachmentsDigest, FOOTER_LINE_REFUSED_COPY, hasFooterShapedLine, stripG2TurnFooter, TURN_ID_IN_USE_COPY, unvouched, type G2TurnProvenance, type OriginVerdict } from '../lib/g2-turn-provenance.js'
+import { attachmentsDigest, FOOTER_LINE_REFUSED_COPY, hasFooterShapedLine, sealMatches, stripG2TurnFooter, TURN_ID_IN_USE_COPY, unvouched, type G2TurnProvenance, type OriginVerdict } from '../lib/g2-turn-provenance.js'
 import { defaultTurnAttachmentStore, keepTurnAttachments, parseTurnAttachmentIds, TURN_ATTACHMENT_COPY, turnAttachmentManifest, type TurnAttachmentStore } from '../lib/session-turn-attachments.js'
 
 /**
@@ -115,6 +115,23 @@ export interface ThreadTurnQueueDeps {
     begin: (provider: string, threadId: string, clientTurnId: string, mode: 'turn' | 'steer', now: number) => boolean
     settle: (provider: string, threadId: string, clientTurnId: string, exit: 'sent' | 'not_sent' | 'unknown', now: number) => boolean
   }
+  /**
+   * Steer mid-turn (COS_STEER_MIDTURN), optional: ask for a drain pass for this thread now, so a
+   * turn parked at a busy session that can take it mid-turn goes in within seconds instead of at
+   * the next 20 s sweep. Production: the shared drain kick (one pass in flight, ever). Absent: the
+   * sweep still delivers it, only later.
+   */
+  kickDrain?: (threadId: string) => void
+}
+
+/**
+ * Can this thread take a parked turn mid-turn right now (COS_STEER_MIDTURN)? The same shared rule
+ * as Session steer, plus the switch and the two members the drain's steer needs. Never throws.
+ */
+export function midTurnAvailabilityFor(deps: Pick<ThreadTurnQueueDeps, 'steerProbe' | 'deliverLiveTurn' | 'continueLive' | 'attempts'>, provider: string, threadId: string, gateReason: string | null): SessionSteerAvailability | null {
+  if (!steerMidturnEnabled()) return null
+  if (typeof deps.deliverLiveTurn !== 'function' || !deps.attempts) return { available: false, reason: 'no_outside_channel' }
+  return steerAvailabilityFor(deps, provider, threadId, gateReason)
 }
 
 /**
@@ -210,6 +227,159 @@ function isRetryableDelivery(outcome: { reason?: string; serverRetryable?: boole
   return queueableRefusal(outcome.reason)
 }
 
+/**
+ * The verdict a drain hop with no parked origin is judged by: the loopback call it is. The front
+ * door reaches the same verdict through `originOf` on the drainer's own request (local socket,
+ * token shown), so a steered turn and a front-door turn are ledgered alike. Never footed.
+ */
+function localDrainVerdict(at: number): OriginVerdict {
+  return {
+    origin: { remote: '127.0.0.1', loopback: true, ownAddress: true, clientInstance: null, client: 'local', tokenPresented: true, webSession: false },
+    verifiedOrigin: false,
+    reason: 'local_socket',
+    judgedAt: at,
+  }
+}
+
+/** What one mid-turn attempt did to its row: delivered, settled some other way, or left waiting. */
+type MidTurnOutcome = 'delivered' | 'settled' | 'held'
+
+/**
+ * Steer mid-turn (COS_STEER_MIDTURN, Miles 2026-11-07): put ONE waiting row into the running turn
+ * of a busy Claude desk session through its peer inbox. Claude Code takes the frame at once (its
+ * `enqueue` row is the proof `deliverLiveTurn` waits for) and folds it in at its next tool step.
+ *
+ * Called only by `drainThread`, only for a row the drain would otherwise hold behind a busy gate,
+ * and only in FIFO order (the caller stops at the first row that holds).
+ *
+ * WHO MAY BE STEERED: a row never attempted (`attempts === 0`: no front-door attempt, no earlier
+ * steer, no restart requeue, so nothing about it is unknown), with no files (the peer inbox
+ * carries words only), on a thread the shared steer rule says can take it now.
+ *
+ * PROVENANCE IS CHECKED HERE AS THE TURNS ROUTE CHECKS IT, because this hop does not go through
+ * that front door: footer-shaped words are refused, the parked origin is carried (a single-use
+ * carry token, spent in this process), its seal must name this provider, thread and no files,
+ * a turn id held for another turn is refused, and only the server writes the footer. A refusal
+ * settles the row `refused` with its own reason, so it reads "Not sent" with the reason line.
+ *
+ * NEVER TWICE, in the same order as `steerTurn`: the intent row (`delivering`, `mode: 'steer'`,
+ * `journal: 1`, this boot) durably, then the attempt `pending`, then the frame, then the
+ * verdict, journal first. Unverified, a failed write or a throw: `refused`, `steer_unverified`,
+ * `deliveryState: 'unknown'`, never resent. Nothing reached the session: back to waiting, the
+ * attempt given back, so the turn-end front door sends it as before.
+ *
+ * NO AWAIT BEFORE THE INTENT ROW IS WRITTEN: the caller read this row as `waiting` in the same
+ * synchronous step, so a cancel cannot slip between that read and the `delivering` write.
+ */
+async function steerHeldTurn(
+  provider: string,
+  threadId: string,
+  turn: QueuedThreadTurn,
+  gateReason: string | null,
+  deps: ThreadTurnQueueDeps,
+): Promise<MidTurnOutcome> {
+  if (turn.status !== 'waiting' || turn.attempts !== 0) return 'held'
+  if (Array.isArray(turn.attachmentIds) && turn.attachmentIds.length > 0) return 'held'
+  const availability = midTurnAvailabilityFor(deps, provider, threadId, gateReason)
+  if (!availability || !availability.available) return 'held'
+  const { clientTurnId, prompt } = turn
+
+  const rewrite = (apply: (row: QueuedThreadTurn) => void): QueuedThreadTurn | null => {
+    const latest = readQueue(provider, threadId, deps.now())
+    const row = latest.find(t => t.clientTurnId === clientTurnId)
+    if (!row) return null
+    apply(row)
+    writeQueue(provider, threadId, latest, { durable: true })
+    return row
+  }
+  const refuse = (reason: string): MidTurnOutcome => {
+    const at = deps.now()
+    rewrite(row => { row.status = 'refused'; row.reason = reason; row.settledAt = at })
+    deps.provenance?.forgetQueued(provider, threadId, clientTurnId)
+    console.warn(`[thread-turn-queue] mid-turn refused provider=${provider} clientTurnId=${clientTurnId} reason=${reason}`)
+    return 'settled'
+  }
+
+  // The front door's provenance gates, in its order.
+  let verdict: OriginVerdict | null = null
+  if (deps.provenance) {
+    if (hasFooterShapedLine(prompt)) return refuse('footer_line_refused')
+    const token = deps.provenance.issueCarry({ provider, threadId, clientTurnId, prompt })
+    const carried = token ? deps.provenance.takeCarry(token, clientTurnId, prompt) : null
+    // No carry could be made: leave it for the front door, which decides with its own carry.
+    if (carried === null) return 'held'
+    if (carried.seal !== null && !sealMatches(carried.seal, { provider, threadId, attachments: '' })) return refuse('queued_turn_tampered')
+    verdict = carried.verdict ?? localDrainVerdict(deps.now())
+    if (deps.provenance.reusesTurnId(clientTurnId, { prompt, verdict, provider, sessionId: threadId }, { continues: true })) return refuse('turn_id_in_use')
+  }
+  const sent = deps.provenance && verdict ? deps.provenance.footed(prompt, clientTurnId, verdict, provider) : prompt
+  const ledger = (via: string): void => {
+    if (deps.provenance && verdict) deps.provenance.record({ turnId: clientTurnId, prompt, verdict, provider, sessionId: threadId, via, continues: true })
+  }
+
+  // 1. The intent row, durably.
+  const intent = rewrite(row => {
+    row.status = 'delivering'
+    row.attempts = 1
+    row.mode = 'steer'
+    row.journal = 1
+    if (typeof deps.bootId === 'string' && deps.bootId.length > 0) row.deliveringBootId = deps.bootId
+    else delete row.deliveringBootId
+  })
+  if (!intent) return 'held'
+  const backToWaiting = (row: QueuedThreadTurn): void => {
+    row.status = 'waiting'
+    row.attempts = 0
+    delete row.mode
+    delete row.journal
+    delete row.deliveringBootId
+  }
+
+  // 2. The attempt `pending`, durably, before any frame.
+  let begun = false
+  try { begun = deps.attempts!.begin(provider, threadId, clientTurnId, 'steer', deps.now()) === true } catch { begun = false }
+  if (!begun) {
+    rewrite(backToWaiting)
+    console.warn(`[thread-turn-queue] mid-turn not attempted provider=${provider} clientTurnId=${clientTurnId}: the attempt journal could not record it`)
+    return 'held'
+  }
+
+  // 3. The frame.
+  const startedAt = deps.now()
+  let live: { ok: boolean; reason: string } | null = null
+  try {
+    live = await deps.deliverLiveTurn!({ provider, sessionId: threadId, prompt: sent, verifyTimeoutMs: PEER_VERIFY_TIMEOUT_MS, clientTurnId })
+  } catch (error) {
+    console.error(`[thread-turn-queue] mid-turn delivery threw: ${error instanceof Error ? error.message : error}`)
+    live = null
+  }
+  const at = deps.now()
+  const journal = (exit: 'sent' | 'not_sent' | 'unknown'): void => {
+    try { deps.attempts!.settle(provider, threadId, clientTurnId, exit, at) } catch { /* the reconcile reads `pending` as unknown */ }
+  }
+  console.log(`[thread-turn-queue] mid-turn provider=${provider} clientTurnId=${clientTurnId} hop=${live?.reason ?? 'threw'} ms=${Math.max(0, at - startedAt)} waitedMs=${Math.max(0, at - turn.queuedAt)}`)
+
+  // 4. The verdict, journal first, then the row.
+  if (live?.ok === true) {
+    journal('sent')
+    ledger('drain-steer')
+    rewrite(row => { row.status = 'delivered'; row.reason = 'steered'; row.settledAt = at })
+    deps.provenance?.forgetQueued(provider, threadId, clientTurnId)
+    return 'delivered'
+  }
+  if (live === null || live.reason === 'unverified' || live.reason === 'write_failed') {
+    journal('unknown')
+    ledger('drain-steer-unverified')
+    rewrite(row => { row.status = 'refused'; row.reason = 'steer_unverified'; row.deliveryState = 'unknown'; row.settledAt = at })
+    deps.provenance?.forgetQueued(provider, threadId, clientTurnId)
+    return 'settled'
+  }
+  // The transport's own word that nothing reached a session: the row waits for the turn end.
+  journal('not_sent')
+  rewrite(backToWaiting)
+  return 'held'
+}
+
 /**
  * One drain pass over one thread.
  *
@@ -243,9 +413,14 @@ export async function drainThread(
     if (turn.status !== 'waiting') deps.provenance?.forgetQueued(provider, threadId, turn.clientTurnId)
   }
 
+  // Steer mid-turn (COS_STEER_MIDTURN): FIFO per thread. Once a row ahead cannot go in mid-turn
+  // (or is still being delivered), nothing behind it may jump it; it waits for the turn end too.
+  let midTurnOrderHeld = false
+
   for (const snapshot of queue) {
     const turn = readQueue(provider, threadId, deps.now()).find(t => t.clientTurnId === snapshot.clientTurnId)
     if (!turn) continue
+    if (turn.status === 'delivering') midTurnOrderHeld = true
     if (turn.status !== 'waiting') continue
 
     // Reuse only refusal within this synchronous pass. Rechecking a busy thread
@@ -284,7 +459,21 @@ export async function drainThread(
         }
     const decision = drainDecision(turn, seen, deps.now())
 
-    if (decision === 'hold') { held += 1; continue }
+    if (decision === 'hold') {
+      // Steer mid-turn: never during a cancel hold (the person said stop), only for the first
+      // rows in order, and only where the shared steer rule says this session can take it now,
+      // which also means the hold is the busy GATE: the rule answers only for a refusal that
+      // names a desk run (an attachable thread has no reason). Anything else holds as before.
+      const cancelHeld = typeof seen.cancelHoldUntil === 'number' && Number.isFinite(seen.cancelHoldUntil) && deps.now() < seen.cancelHoldUntil
+      if (!midTurnOrderHeld && !cancelHeld) {
+        const outcome = await steerHeldTurn(provider, threadId, turn, gate.reason, deps)
+        if (outcome === 'delivered') { delivered += 1; continue }
+        if (outcome === 'settled') { retired += 1; continue }
+      }
+      midTurnOrderHeld = true
+      held += 1
+      continue
+    }
     if (decision === 'expire' || decision === 'give_up') {
       turn.status = decision === 'expire' ? 'expired' : 'refused'
       turn.reason = decision === 'expire' ? 'queued_turn_expired' : 'delivery_attempts_exhausted'
@@ -710,12 +899,27 @@ export function createThreadTurnQueueRouter(deps: ThreadTurnQueueDeps): Router {
 
     writeQueue(provider, threadId, admitted.queue)
     if (deps.provenance && verdict) deps.provenance.record({ turnId: clientTurnId, prompt, verdict, provider, sessionId: threadId, via: 'queue' })
+    // Steer mid-turn (COS_STEER_MIDTURN): the park answer stays the 202 every client reads (a
+    // lens that sees anything else says "could not queue"); the drain is asked to run now, and it
+    // puts the words into the running turn. `landsAt` (additive, only with the switch on) tells a
+    // client which line to show: `next_step` only when this row is first in line, has no files,
+    // and the session can take it now; `turn_end` otherwise.
+    const midTurn = midTurnAvailabilityFor(deps, provider, threadId, gate.reason)
+    let landsAt: 'next_step' | 'turn_end' | null = null
+    if (midTurn) {
+      const firstInLine = queuePosition(admitted.queue, clientTurnId) === 0 && !admitted.queue.some(t => t.status === 'delivering')
+      landsAt = midTurn.available && firstInLine && attach.ids.length === 0 ? 'next_step' : 'turn_end'
+      if (landsAt === 'next_step') {
+        try { deps.kickDrain?.(threadId) } catch { /* the 20 s sweep still delivers it */ }
+      }
+    }
     return res.status(202).json({
       queued: true,
       clientTurnId,
       position: queuePosition(admitted.queue, clientTurnId),
       waitingOn: gate.reason,
       ...(steerFallback !== null ? { steerFallback } : {}),
+      ...(landsAt !== null ? { landsAt } : {}),
     })
   })
 

package/server/routes/today-brief.ts

@@ -4,10 +4,19 @@
  * - GET  /api/today/brief           the cached summary; never generates.
  * - POST /api/today/brief           an open Today's ask, with the rows it read (titles, states, how long, last lines,
  *                                   what needs you). Generates only when the switch is on, the inputs changed, 10 minutes
- *                                   passed and the day's 60 are not spent. The Work cards in progress come from the
+ *                                   passed and the day's cap (Summaries per day, 7.0.5) is not spent. The Work cards in progress come from the
  *                                   server's own shared board read, never the body.
+ *                                   7.0.1: `"force": true` in the body is the Today refresh button. It skips the
+ *                                   10-minute interval and the "inputs unchanged" check, at most once every 30 s,
+ *                                   inside the same daily cap. A throttled one answers reason `refresh_throttled` and
+ *                                   `retryAfterMs`.
+ *                                   7.0.5: `"reason": "reconnect"` says the client's read just recovered from a failed
+ *                                   one: that start skips the 10-minute interval, at most once per 10 minutes. The
+ *                                   "inputs unchanged" check, the breaker, the switch and the daily cap still apply.
  * - GET  /api/today/brief/settings  the switch and what set it.
  * - POST /api/today/brief/settings  { enabled: boolean }, the Settings toggle. COS_TODAY_BRIEF_LLM, when set, still wins.
+ * - GET  /api/today/brief/settings/cap   7.0.5 "Summaries per day": { dailyCap, min: 1, max: 100, default: 100, usedToday }.
+ * - PUT  /api/today/brief/settings/cap   { dailyCap: number }, clamped to 1 to 100 and saved; answers the same shape.
  * Auth is the parent /api gate (token or web session cookie). Every answer is private, no-store.
  */
 import { Router } from 'express'
@@ -61,7 +70,7 @@ export async function readSubagentsFor(keys: string[], now = Date.now()): Promis
   return out
 }
 
-/** The server's own brief: the data folder, Haiku through the isolated text runner, one audit row per start. */
+/** The server's own brief: the data folder, Sonnet (7.0.1) through the isolated text runner, one audit row per start. */
 export function defaultTodayBrief(): TodayBrief {
   return createTodayBrief({
     stateFile: dataPath(TODAY_BRIEF_STATE_FILE),
@@ -95,6 +104,18 @@ export function workInProgress(rows: TaskBoardRow[] | null): BriefWork[] {
   return out.sort((a, b) => Number(b.running) - Number(a.running)).slice(0, 12)
 }
 
+/**
+ * The body without `force` and `reason`, and what they asked. Anything but a boolean `force` is a bad request; 7.0.5
+ * `reason` may only be "reconnect".
+ */
+export function splitForce(raw: unknown): { body: unknown; force: boolean; reconnect: boolean } {
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw) || !('force' in raw || 'reason' in raw)) return { body: raw, force: false, reconnect: false }
+  const { force, reason, ...rest } = raw as Record<string, unknown>
+  if (force !== undefined && typeof force !== 'boolean') throw new TodayBriefInputError('invalid_today_brief')
+  if (reason !== undefined && reason !== 'reconnect') throw new TodayBriefInputError('invalid_today_brief')
+  return { body: rest, force: force === true, reconnect: reason === 'reconnect' }
+}
+
 export function createTodayBriefRouter(deps: TodayBriefRouterDeps): Router {
   const router = Router()
   router.use('/today/brief', (_req, res, next) => { res.set('Cache-Control', 'private, no-store'); next() })
@@ -108,18 +129,21 @@ export function createTodayBriefRouter(deps: TodayBriefRouterDeps): Router {
       if (Buffer.byteLength(JSON.stringify(req.body ?? null)) > TODAY_BRIEF_BODY_MAX_BYTES) {
         return res.status(413).json({ error: { code: 'today_brief_too_large', message: 'Too much for the Today summary.' } })
       }
+      // 7.0.1: `force` is the refresh button's flag, taken off before the rows are read (the rows reject unknown keys).
+      const { body, force, reconnect } = splitForce(req.body)
       // The switch first: off reads nothing, not even the board.
       if (!deps.brief.settings().enabled) {
-        normalizeTodayBriefInputs(req.body)
+        normalizeTodayBriefInputs(body)
         return res.json(deps.brief.peek())
       }
-      // Every gate that needs no reads goes first (switch, recording, drain, breaker, daily cap, interval): a gated ask
-      // answers from the page's rows alone and reads neither the board nor any transcript.
-      const pageInputs = normalizeTodayBriefInputs(req.body)
-      const closed = deps.brief.gate()
+      // Every gate that needs no reads goes first (switch, recording, drain, breaker, daily cap, interval or, forced,
+      // the 30 s refresh floor): a gated ask answers from the page's rows alone and reads neither the board nor any
+      // transcript.
+      const pageInputs = normalizeTodayBriefInputs(body)
+      const closed = deps.brief.gate({ force, reconnect })
       if (closed) return res.json(deps.brief.askGated(pageInputs, closed))
       const work = workInProgress(await deps.board().catch(() => null))
-      let inputs = normalizeTodayBriefInputs(req.body, work)
+      let inputs = normalizeTodayBriefInputs(body, work)
       const keys = subagentLookups(inputs)
       if (keys.length && deps.subagents) {
         let timer: ReturnType<typeof setTimeout> | undefined
@@ -127,7 +151,7 @@ export function createTodayBriefRouter(deps: TodayBriefRouterDeps): Router {
         const readings = await Promise.race([deps.subagents(keys).catch(() => new Map<string, SubagentReading>()), late]).finally(() => clearTimeout(timer))
         inputs = withSubagents(inputs, readings, (deps.now ?? Date.now)())
       }
-      res.json(await deps.brief.ask(inputs, todayBriefFingerprint(pageInputs)))
+      res.json(await deps.brief.ask(inputs, todayBriefFingerprint(pageInputs), { force, reconnect }))
     } catch (error) {
       if (error instanceof TodayBriefInputError) return res.status(400).json({ error: { code: error.code, message: 'That is not a Today summary request.' } })
       console.warn(`[today-brief] ask failed (${error instanceof Error ? error.name : 'error'})`)
@@ -144,5 +168,16 @@ export function createTodayBriefRouter(deps: TodayBriefRouterDeps): Router {
     }
     try { res.json(deps.brief.setEnabled(body.enabled)) } catch { failed(res) }
   })
+  // 7.0.5 "Summaries per day" (Control Web Settings and COS Control use the same route).
+  router.get('/today/brief/settings/cap', (_req, res) => {
+    try { res.json(deps.brief.cap()) } catch { failed(res) }
+  })
+  router.put('/today/brief/settings/cap', (req, res) => {
+    const body = req.body
+    if (!body || typeof body !== 'object' || Array.isArray(body) || Object.keys(body).some(k => k !== 'dailyCap') || typeof body.dailyCap !== 'number' || !Number.isFinite(body.dailyCap)) {
+      return res.status(400).json({ error: { code: 'invalid_today_brief_cap', message: 'Send { dailyCap: a number from 1 to 100 }.' } })
+    }
+    try { res.json(deps.brief.setDailyCap(body.dailyCap)) } catch { failed(res) }
+  })
   return router
 }

package/server/routes/welcome-context.ts

@@ -4,6 +4,7 @@
 
 import { Router } from 'express'
 import { callPython, pythonBridgeAvailable } from '../lib/python-bridge.js'
+import { calendarToday, readCalendar } from '../lib/calendar-source.js'
 import { parsePrepOccurrence } from '../lib/prep-store.js'
 import type { PrepOccurrence } from '../../shared/prep.js'
 
@@ -34,7 +35,8 @@ export function bridgeOccurrence(evt: Record<string, unknown> | null | undefined
       calendarId: pick('calendar_id', 'calendarId'),
       eventId: pick('event_id', 'eventId') ?? null,
       externalId: pick('external_id', 'externalId') ?? null,
-      startsAt: pick('start_time', 'start', 'startsAt'),
+      // occurrence_start (EventKit's original occurrence date) first, so a moved occurrence keeps its draft.
+      startsAt: pick('occurrence_start', 'start_time', 'start', 'startsAt'),
       endsAt: pick('end_time', 'end', 'endsAt') ?? null,
     }) ?? undefined
   } catch { return undefined }
@@ -327,7 +329,8 @@ export async function fetchNextEvent(): Promise<{ event: NextEventPayload | null
   }
 
   try {
-    const cal = await callPython(['calendar']) as {
+    const calRead = await readCalendar()
+    const cal = calRead.data as {
       today_remaining?: Array<{
         title?: string
         start_time?: string
@@ -338,10 +341,14 @@ export async function fetchNextEvent(): Promise<{ event: NextEventPayload | null
       minutes_until_next?: number
     } | null
 
-    const read = calendarAnswerWasRead(pythonBridgeAvailable(), cal)
+    // The EventKit snapshot is a real read without the bridge; 'none' (denied or expired) never is.
+    const sourceReady = calRead.source === 'bridge' ? pythonBridgeAvailable() : calRead.source !== 'none'
+    const read = calendarAnswerWasRead(sourceReady, cal)
     const remaining = cal?.today_remaining ?? []
     const meaningful = remaining.find((evt) => {
       if (evt.is_all_day) return false
+      // Snapshot rows say whether they may become next/prep (declined, shared-calendar travel, holidays).
+      if ((evt as { prep_worthy?: unknown }).prep_worthy === false) return false
       return !isGenericNoiseEvent(evt.title || '')
     })
 
@@ -394,6 +401,19 @@ export function _resetWelcomeContextCachesForTests(): void {
   lastFailureLogAt.clear()
 }
 
+/**
+ * PH plan P1: Today's calendar for Control Web and desktop. Behind the /api token gate. Selected calendars only, the
+ * next 3 events. `connected: false` means "Calendar not connected", never an empty day.
+ */
+welcomeContextRouter.get('/calendar/today', async (_req, res) => {
+  try {
+    res.set('Cache-Control', 'no-store')
+    res.json(await calendarToday())
+  } catch {
+    res.status(503).json({ error: 'calendar_unavailable' })
+  }
+})
+
 welcomeContextRouter.get('/welcome-context', async (req, res) => {
   const lat = parseCoord(req.query.lat, 'lat')
   const lon = parseCoord(req.query.lon, 'lon')

package/server/routes/work-board.ts

@@ -6,6 +6,7 @@ import { listBoard, listBoardWithDates, workBoardCapabilities, setTaskWorkStage,
 import { createWorkBoardReader, WORK_BOARD_READ_LIMITS, WorkBoardTimeoutError, type WorkBoardReader } from '../lib/work-board-reader.js'
 import type { MeetingDescriptor } from '../lib/work-review-store.js'
 import { isSafeDomainName } from '../lib/domains.js'
+import { workSessionActivity, waitingSessionIds } from '../lib/work-session-activity.js'
 import { resolveSavedMeetingDetail } from './meetings.js'
 import type { MeetingDetail } from '../lib/meeting-store.js'
 
@@ -28,11 +29,13 @@ export interface WorkBoardDependencies {
   requests: () => Pick<WorkActivityCapabilities, 'requests' | 'requestsInbox' | 'requestsConsumerSeenAt'>
   /** 6.59.0: the bounded, shared board read (5 s). Defaults to one over `list`. */
   readBoard?: WorkBoardReader<TaskBoardRow>
+  /** 7.0.1: each linked session's newest activity (lib/work-session-activity.ts), for the open list's supersede rule. */
+  sessionActivity: (sessionIds: readonly string[]) => Promise<ReadonlyMap<string, number>>
   now: () => number
 }
 const defaults: WorkBoardDependencies = { journal: () => readWorkJournal(), list: listBoard, capabilities: workBoardCapabilities,
   stage: setTaskWorkStage, link: linkTaskMeeting, edit: editWorkTask, capture: captureWorkItem, captureCapabilities: workIntakeCapabilities, resolveMeeting: resolveSavedMeetingDetail,
-  requests: () => ({ requests: 0, requestsInbox: 0, requestsConsumerSeenAt: null }), now: () => Date.now() }
+  requests: () => ({ requests: 0, requestsInbox: 0, requestsConsumerSeenAt: null }), sessionActivity: ids => workSessionActivity(ids), now: () => Date.now() }
 /** How old a board read the activity and open-work glances accept (the reader shares one read between them). */
 export const WORK_GLANCE_BOARD_AGE_MS = 10_000
 
@@ -82,7 +85,11 @@ export function createWorkBoardRouter(overrides: Partial<WorkBoardDependencies>
     if (!journal.available) return res.json({ version: 1, available: false, reason: journal.reason, capabilities, items: [], total: 0, truncated: false })
     const rows = await glanceBoard('open work')
     if (!rows) return res.json({ version: 1, available: false, reason: 'Work board is unavailable. Refresh before trying again.', capabilities, items: [], total: 0, truncated: false })
-    return res.json({ version: 1, available: true, capabilities, ...projectOpenWork(journal, rows, deps.now()) })
+    // 7.0.1: a waiting item whose session moved on since its report is not waiting. Only those sessions are read; a
+    // read that fails keeps the list as it was.
+    const now = deps.now(), first = projectOpenWork(journal, rows, now), waiting = waitingSessionIds(first.items)
+    const sessionActivityMs = waiting.length ? await deps.sessionActivity(waiting).catch(() => undefined) : undefined
+    return res.json({ version: 1, available: true, capabilities, ...(sessionActivityMs?.size ? projectOpenWork(journal, rows, now, { sessionActivityMs }) : first) })
   })
   router.get('/work-board', async (_req, res) => {
     try {

package/server/web-control/app.css

@@ -186,20 +186,26 @@ select.field {
   padding: 4px calc(var(--gutter) + var(--safe-right)) calc(var(--safe-bottom) + 96px) calc(var(--gutter) + var(--safe-left));
 }
 .pane { max-width: 880px; }
+/* 7.0.2 (A2, the Duo audit): the COS chat route ends at its composer (panes/messages.js sets ws-chat). The 96 px above
+   (and the 40 px from 600 px up) held room for a bottom bar that is gone; under the sticky composer it was blank page
+   that a focused box scrolled to and the closed keyboard left on screen. Two columns from 860 px keep a small margin. */
+.workspace.ws-chat { padding-bottom: 0; }
+@media (min-width: 860px) { .workspace.ws-chat { padding-bottom: calc(var(--safe-bottom) + 16px); } }
 .pane-head { margin: 8px 0 18px; }
 .pane-title { font: 500 40px/1.02 var(--display); letter-spacing: -0.015em; margin: 0; }
 .pane-sub { color: var(--sub); margin: 6px 0 0; font-size: 15px; }
 
-/* No bottom bar, on purpose. On the iPhone Duo, Safari owns the bottom edge on both screens
-   (a floating address pill on the closed screen), and iOS 26 WebKit stops drawing the page under
+/* No bottom bar, on purpose. On a phone the browser owns the bottom edge (Safari's floating
+   address pill, Comet's and Chrome's own bars), and iOS 26 WebKit stops drawing the page under
    its bar while any fixed element sits within ~60px of it. Navigation lives in the top bar
-   (closed screen) or the left rail (open screen and up). */
+   (folded screen) or the left rail (unfolded screen and up). */
 .badge-dot { position: absolute; width: 7px; height: 7px; border-radius: 50%; background: var(--hot); }
 
 .rail { display: none; }
 
 /* ── Today ───────────────────────────────────────────────── */
 .today-date { color: var(--sub); font-size: 15px; margin: 6px 0 0; }
+.today-weather { color: var(--sub); font-size: 15px; margin: 2px 0 0; }
 /* The session pet on Today: the pet COS Control shows, in the pose the Mac would pick. */
 .today-pet { display: flex; flex-direction: column; align-items: center; margin: 6px 0 14px; min-height: 166px; }
 .today-pet.hidden { display: none; }
@@ -287,6 +293,11 @@ select.field {
 .next-up .when { font: 500 24px/1 var(--display); white-space: nowrap; }
 .next-up .what { font-weight: 600; }
 .next-up .sub { color: var(--sub); font-size: 14px; }
+.next-later { padding: 0 16px 14px; font-size: 14px; }
+.next-later .later-row { display: flex; gap: 12px; padding: 3px 0; min-width: 0; }
+.next-later .later-when { color: var(--sub); font-variant-numeric: tabular-nums; white-space: nowrap; min-width: 4.5em; }
+.next-later .later-what { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.next-later .later-asof { color: var(--sub); margin-top: 4px; }
 
 /* ── Lists (sessions, meetings, messages) ────────────────── */
 .list { background: var(--panel); border: 1px solid var(--panel-border); border-radius: var(--radius-lg); overflow: hidden; box-shadow: var(--shadow); }
@@ -421,11 +432,13 @@ select.field {
   .pane:not(#pane-today) .pane-head .pane-sub { margin-top: 0; }
 }
 
-/* ── Short screens: the closed Duo is ~678px tall with ~76px under Safari's pill, the open
-   Duo ~626px. Height is the scarce axis, so the type steps down here, not by width. */
+/* ── Short screens: the folded Duo is about 382x678 with the browser's own bar under that, and
+   landscape tablets and laptop windows are often under 720px tall. Height is the scarce axis, so
+   the type steps down here, not by width. */
 @media (max-height: 720px) {
   .pane-title { font-size: 34px; }
   .today-date { font-size: 14px; margin-top: 4px; }
+  .today-weather { font-size: 14px; }
   .ask-bar { min-height: 46px; margin-top: 12px; }
   .story { font-size: 21px; line-height: 1.3; margin: 18px 2px; }
   .run-panel { padding-top: 8px; }
@@ -436,8 +449,8 @@ select.field {
   .rec-banner { margin-top: 10px; padding: 8px 8px 8px 14px; }
 }
 
-/* ── Open Duo (~890x626), tablets, desktop: a labelled left rail costs width, which is the
-   axis there is plenty of. */
+/* ── Unfolded Duo (about 1430x1000 landscape, 1000x1430 portrait), tablets, desktop: a labelled
+   left rail costs width, which is the axis there is plenty of. */
 @media (min-width: 600px) {
   :root { --gutter: 24px; }
   .topbar { display: none; }
@@ -468,11 +481,11 @@ select.field {
   .run-title, .run-meta { grid-column: 2; }
   .composer { position: sticky; bottom: calc(var(--safe-bottom) + 12px); }
   .toast { top: auto; bottom: 24px; }
-  .sheet-backdrop { padding-top: 8vh; }
+  .sheet-backdrop { padding-top: 8vh; padding-top: 8dvh; }
   .sheet { max-width: 620px; border-radius: 18px; padding: 16px 18px 18px; max-height: 80dvh; box-shadow: 0 24px 60px rgba(0, 0, 0, 0.25); }
 }
 
-/* Open Duo short screen: keep the rail's nine sections inside ~626px. */
+/* Wide but short (a landscape tablet, a short window): keep the rail's nine sections inside 720px. */
 @media (min-width: 600px) and (max-height: 720px) {
   .pane:not(#pane-today) .pane-head .pane-title { display: none; }
   .pane:not(#pane-today) .pane-head { margin: 0 0 12px; }
@@ -504,6 +517,28 @@ select.field {
   .pane.reading .pane-head.with-ask { display: flex; }
 }
 
+/* Duo tables: the divider between a list and its reader (app.js splitKit, W.splitKit), for Memories and Messages.
+   Hidden everywhere; each pane shows it only inside its own two-column breakpoint (panes/memories.css 760 px,
+   panes/cos-chat.css 860 px), so a phone never sees it. Sessions keeps its own copy of these rules (panes/sessions.css). */
+.split-handle, .split-full-btn { display: none; }
+.split-handle {
+  justify-content: center; align-items: center; position: sticky; top: calc(var(--safe-top) + 12px); align-self: start;
+  height: calc(100dvh - var(--safe-top) - 24px); cursor: col-resize; touch-action: none; user-select: none; -webkit-user-select: none;
+  -webkit-touch-callout: none; outline: none; z-index: 2;
+}
+/* The line is the split's own gap; the grip shows where to take it. */
+.split-handle::after { content: ''; width: 4px; height: 36px; border-radius: 2px; background: var(--panel-border); transition: background 120ms ease, height 120ms ease; }
+.split-handle:hover::after, .split-handle:focus-visible::after, .split-dragging > .split-handle::after { background: var(--accent); height: 52px; }
+.split-handle:focus-visible { box-shadow: inset 0 0 0 2px color-mix(in srgb, var(--accent) 45%, transparent); border-radius: 6px; }
+/* A finger gets at least a 44 px target, 13 px over each pane's edge; a mouse keeps the divider's own column. */
+@media (pointer: coarse) { .split-handle::before { content: ''; position: absolute; top: 0; bottom: 0; left: -13px; right: -13px; } }
+/* While dragging, nothing in the panes selects or takes the pointer. */
+.split-dragging { user-select: none; -webkit-user-select: none; cursor: col-resize; }
+.split-dragging > :not(.split-handle) { pointer-events: none; }
+.split-full-btn { margin-left: auto; flex: none; }
+@media (pointer: coarse) { .split-full-btn { min-height: 44px; } }
+@media (prefers-reduced-motion: reduce) { .split-handle::after { transition: none; } }
+
 /* ── Desktop ─────────────────────────────────────────────── */
 @media (min-width: 1100px) and (min-height: 721px) {
   :root { --gutter: 40px; }
@@ -538,3 +573,38 @@ select.field {
 .live-prose { margin-top: 8px; font-size: 15px; line-height: 1.45; white-space: pre-wrap; overflow-wrap: anywhere; max-height: 14em; overflow: auto; color: var(--run-title); }
 #session-status .link-btn { min-height: 0; padding: 0; }
 .turn.user.pending { opacity: 0.72; }
+
+/* ── Touch screens (6.99.30) ────────────────────────────── */
+/* Every field that types is 16 px on a touch screen, at every width: under 16 px a phone browser zooms the page in on
+   focus (the unfolded Duo did it on Sessions' selects, Search, Find and the model picker, 600 px and up). A floor, not
+   a size: no field anywhere is set above 16 px. !important because each pane sets its own compact size with more
+   specific selectors; this one rule beats them all only on touch. */
+@media (any-pointer: coarse) {
+  input:not([type='checkbox']):not([type='radio']):not([type='range']):not([type='color']):not([type='file']):not([type='button']):not([type='submit']):not([type='reset']):not([type='image']):not([type='hidden']),
+  select, textarea { font-size: 16px !important; }
+}
+/* Folded phones: every button and field is at least 44 px tall (design QA: .cx-btn came in six heights from 30 px). A
+   minimum only, so it grows the compact ones and leaves the taller ones; the per-pane phone heights that fought it are
+   gone. */
+/* 7.0.2 (A8): a short touch screen at any width too (the unfolded Duo, 951x539 in Comet, is touch first). */
+@media (max-width: 599px), (pointer: coarse) and (max-height: 720px) {
+  .cx-btn, .field { min-height: 44px !important; }
+}
+/* Touch screens: the small controls the canary measured under 44 px (nav 30, switches 30, a chip's remove and Retry 36,
+   camera and clip 38, Send 38, the question strip's steps 36, the calendar's days 34) reach 44. Floors only (min-*),
+   !important because each pane sizes its own with more specific rules. A text switch keeps its look and grows only its
+   hit area, so its gold rule stays under the word. */
+@media (any-pointer: coarse) {
+  .nav-btn, .btn.small, .cc-chip-retry, .sq-step, .mt-day { min-height: 44px !important; }
+  .cc-chip-x, .cc-attach, .cc-camera { min-width: 44px !important; min-height: 44px !important; }
+  .cx-switch button::before { content: ''; position: absolute; inset: -7px -4px; }
+}
+/* 7.0.2 (A8): a short touch screen 600 px wide or more (the unfolded Duo, 951x539) keeps the phone Ask sheet: full width
+   from the top, no centred desktop card with 8 % of a 539 px screen spent above it (app.js isPhone says phone too). */
+@media (min-width: 600px) and (pointer: coarse) and (max-height: 720px) {
+  .sheet-backdrop { padding-top: 0; }
+  .sheet { max-width: none; border-radius: 0 0 20px 20px; padding: calc(var(--safe-top) + 10px) var(--gutter) 14px; max-height: calc(100dvh - 90px); box-shadow: none; }
+}
+/* 6.99.30 (QA): an element with the hidden attribute is hidden, whatever display its classes give it ("Retry image"
+   showed under loaded images: .link-btn's inline-flex beat [hidden]). */
+[hidden] { display: none !important; }