@gotcos/glasses-server 6.99.33 → 7.0.18

package/server/routes/welcome-context.ts

@@ -4,6 +4,8 @@
 
 import { Router } from 'express'
 import { callPython, pythonBridgeAvailable } from '../lib/python-bridge.js'
+import { calendarToday, readCalendar } from '../lib/calendar-source.js'
+import { isCalendarHold } from '../lib/calendar-meetings.js'
 import { parsePrepOccurrence } from '../lib/prep-store.js'
 import type { PrepOccurrence } from '../../shared/prep.js'
 
@@ -21,7 +23,8 @@ type WeatherPayload = { temp: string; desc: string; location: string }
  * provider, calendar id, event id or external id, and start. The bridge sends no event ids today, so it is absent.
  * It lets a client find a Prep draft for this exact event; it never binds one, and nothing is inferred from the title.
  */
-type NextEventPayload = { title: string; time: string; inMinutes?: number; occurrence?: PrepOccurrence }
+// `hold` (11/09): present, true, only when the title is a hold or status block (calendar-meetings.ts isCalendarHold).
+type NextEventPayload = { title: string; time: string; inMinutes?: number; occurrence?: PrepOccurrence; hold?: true }
 
 /** The bridge event's provider identity, or undefined. snake_case (calendar_context.py) or camelCase is accepted. */
 export function bridgeOccurrence(evt: Record<string, unknown> | null | undefined): PrepOccurrence | undefined {
@@ -34,7 +37,8 @@ export function bridgeOccurrence(evt: Record<string, unknown> | null | undefined
       calendarId: pick('calendar_id', 'calendarId'),
       eventId: pick('event_id', 'eventId') ?? null,
       externalId: pick('external_id', 'externalId') ?? null,
-      startsAt: pick('start_time', 'start', 'startsAt'),
+      // occurrence_start (EventKit's original occurrence date) first, so a moved occurrence keeps its draft.
+      startsAt: pick('occurrence_start', 'start_time', 'start', 'startsAt'),
       endsAt: pick('end_time', 'end', 'endsAt') ?? null,
     }) ?? undefined
   } catch { return undefined }
@@ -327,7 +331,8 @@ export async function fetchNextEvent(): Promise<{ event: NextEventPayload | null
   }
 
   try {
-    const cal = await callPython(['calendar']) as {
+    const calRead = await readCalendar()
+    const cal = calRead.data as {
       today_remaining?: Array<{
         title?: string
         start_time?: string
@@ -338,10 +343,14 @@ export async function fetchNextEvent(): Promise<{ event: NextEventPayload | null
       minutes_until_next?: number
     } | null
 
-    const read = calendarAnswerWasRead(pythonBridgeAvailable(), cal)
+    // The EventKit snapshot is a real read without the bridge; 'none' (denied or expired) never is.
+    const sourceReady = calRead.source === 'bridge' ? pythonBridgeAvailable() : calRead.source !== 'none'
+    const read = calendarAnswerWasRead(sourceReady, cal)
     const remaining = cal?.today_remaining ?? []
     const meaningful = remaining.find((evt) => {
       if (evt.is_all_day) return false
+      // Snapshot rows say whether they may become next/prep (declined, shared-calendar travel, holidays).
+      if ((evt as { prep_worthy?: unknown }).prep_worthy === false) return false
       return !isGenericNoiseEvent(evt.title || '')
     })
 
@@ -357,6 +366,7 @@ export async function fetchNextEvent(): Promise<{ event: NextEventPayload | null
         time: meaningful.start_time || meaningful.start || '',
         ...(minsUntil != null ? { inMinutes: minsUntil } : {}),
         ...(occurrence ? { occurrence } : {}),
+        ...(isCalendarHold(meaningful.title) ? { hold: true as const } : {}),
       }
     } else if (cal?.next_event && !isGenericNoiseEvent(cal.next_event.title || '')) {
       const occurrence = bridgeOccurrence(cal.next_event as Record<string, unknown>)
@@ -365,6 +375,7 @@ export async function fetchNextEvent(): Promise<{ event: NextEventPayload | null
         time: cal.next_event.start_time || '',
         ...(cal.minutes_until_next != null ? { inMinutes: cal.minutes_until_next } : {}),
         ...(occurrence ? { occurrence } : {}),
+        ...(isCalendarHold(cal.next_event.title) ? { hold: true as const } : {}),
       }
     } else {
       cachedNextEvent = null
@@ -394,6 +405,19 @@ export function _resetWelcomeContextCachesForTests(): void {
   lastFailureLogAt.clear()
 }
 
+/**
+ * PH plan P1: Today's calendar for Control Web and desktop. Behind the /api token gate. Selected calendars only, the
+ * next 5 events (Today round 2, was 3), plus `endedRecently` (ended within 2 h). `connected: false` means "Calendar not connected", never an empty day.
+ */
+welcomeContextRouter.get('/calendar/today', async (_req, res) => {
+  try {
+    res.set('Cache-Control', 'no-store')
+    res.json(await calendarToday())
+  } catch {
+    res.status(503).json({ error: 'calendar_unavailable' })
+  }
+})
+
 welcomeContextRouter.get('/welcome-context', async (req, res) => {
   const lat = parseCoord(req.query.lat, 'lat')
   const lon = parseCoord(req.query.lon, 'lon')

package/server/routes/work-board.ts

@@ -6,6 +6,7 @@ import { listBoard, listBoardWithDates, workBoardCapabilities, setTaskWorkStage,
 import { createWorkBoardReader, WORK_BOARD_READ_LIMITS, WorkBoardTimeoutError, type WorkBoardReader } from '../lib/work-board-reader.js'
 import type { MeetingDescriptor } from '../lib/work-review-store.js'
 import { isSafeDomainName } from '../lib/domains.js'
+import { workSessionActivity, waitingSessionIds } from '../lib/work-session-activity.js'
 import { resolveSavedMeetingDetail } from './meetings.js'
 import type { MeetingDetail } from '../lib/meeting-store.js'
 
@@ -28,11 +29,13 @@ export interface WorkBoardDependencies {
   requests: () => Pick<WorkActivityCapabilities, 'requests' | 'requestsInbox' | 'requestsConsumerSeenAt'>
   /** 6.59.0: the bounded, shared board read (5 s). Defaults to one over `list`. */
   readBoard?: WorkBoardReader<TaskBoardRow>
+  /** 7.0.1: each linked session's newest activity (lib/work-session-activity.ts), for the open list's supersede rule. */
+  sessionActivity: (sessionIds: readonly string[]) => Promise<ReadonlyMap<string, number>>
   now: () => number
 }
 const defaults: WorkBoardDependencies = { journal: () => readWorkJournal(), list: listBoard, capabilities: workBoardCapabilities,
   stage: setTaskWorkStage, link: linkTaskMeeting, edit: editWorkTask, capture: captureWorkItem, captureCapabilities: workIntakeCapabilities, resolveMeeting: resolveSavedMeetingDetail,
-  requests: () => ({ requests: 0, requestsInbox: 0, requestsConsumerSeenAt: null }), now: () => Date.now() }
+  requests: () => ({ requests: 0, requestsInbox: 0, requestsConsumerSeenAt: null }), sessionActivity: ids => workSessionActivity(ids), now: () => Date.now() }
 /** How old a board read the activity and open-work glances accept (the reader shares one read between them). */
 export const WORK_GLANCE_BOARD_AGE_MS = 10_000
 
@@ -82,7 +85,11 @@ export function createWorkBoardRouter(overrides: Partial<WorkBoardDependencies>
     if (!journal.available) return res.json({ version: 1, available: false, reason: journal.reason, capabilities, items: [], total: 0, truncated: false })
     const rows = await glanceBoard('open work')
     if (!rows) return res.json({ version: 1, available: false, reason: 'Work board is unavailable. Refresh before trying again.', capabilities, items: [], total: 0, truncated: false })
-    return res.json({ version: 1, available: true, capabilities, ...projectOpenWork(journal, rows, deps.now()) })
+    // 7.0.1: a waiting item whose session moved on since its report is not waiting. Only those sessions are read; a
+    // read that fails keeps the list as it was.
+    const now = deps.now(), first = projectOpenWork(journal, rows, now), waiting = waitingSessionIds(first.items)
+    const sessionActivityMs = waiting.length ? await deps.sessionActivity(waiting).catch(() => undefined) : undefined
+    return res.json({ version: 1, available: true, capabilities, ...(sessionActivityMs?.size ? projectOpenWork(journal, rows, now, { sessionActivityMs }) : first) })
   })
   router.get('/work-board', async (_req, res) => {
     try {

package/server/routes/work-orchestrator.ts

@@ -13,7 +13,7 @@
  *        10 minutes (`refresh=1`: 2 minutes). No timer reads usage unless COS_WORK_USAGE_POLL=1.
  */
 import { Router } from 'express'
-import { parseSnapshot, type ControlSnapshot } from '../lib/work-orchestrator/snapshot.js'
+import { parseSnapshotReport, type ControlSnapshot } from '../lib/work-orchestrator/snapshot.js'
 import type { OrchestratorInput } from '../lib/work-orchestrator/input.js'
 import type { UsageMonitor, UsageView } from '../lib/work-orchestrator/usage.js'
 import { orchestratorInputFor, orchestratorSnapshots, orchestratorUsage } from '../lib/work-orchestrator/runtime.js'
@@ -67,8 +67,8 @@ export function createWorkOrchestratorRouter(given: Partial<WorkOrchestratorDeps
       return res.status(400).json({ error: 'invalid_snapshot_binding' })
     }
     if (Buffer.byteLength(JSON.stringify(body)) > ORCHESTRATOR_BODY_BYTES) return res.status(413).json({ error: 'snapshot_too_large' })
-    let snapshot: ControlSnapshot
-    try { snapshot = parseSnapshot(body.snapshot, deps.now()) }
+    let snapshot: ControlSnapshot, droppedLiveRows: number
+    try { ({ snapshot, droppedLiveRows } = parseSnapshotReport(body.snapshot, deps.now())) }
     catch { return res.status(400).json({ error: 'invalid_snapshot' }) }
     const binding = () => {
       const id = deps.serverInstanceId()
@@ -90,7 +90,9 @@ export function createWorkOrchestratorRouter(given: Partial<WorkOrchestratorDeps
       // This is the same paired-client evidence cache as /input, not execution authority. parseSnapshot
       // retains only its known fields; arbitrary automatic/forkable/capability fields never enter the cache.
       deps.putSnapshot(snapshot)
-      return res.json({ protocolVersion: 1, accepted: true, workID: body.workID, revision: body.revision, serverInstanceId })
+      if (droppedLiveRows) console.warn(`[work-orchestrator] snapshot work=${body.workID} droppedLiveRows=${droppedLiveRows}`)
+      return res.json({ protocolVersion: 1, accepted: true, workID: body.workID, revision: body.revision, serverInstanceId,
+        ...(droppedLiveRows ? { droppedLiveRows } : {}) })
     } catch (error) {
       if (res.destroyed) return
       const known = error instanceof AskWorkPlanError
@@ -105,16 +107,19 @@ export function createWorkOrchestratorRouter(given: Partial<WorkOrchestratorDeps
       || !Array.isArray(meetings) || meetings.length > 20 || !meetings.every(m => typeof m === 'string' && MEETING_ID.test(m))) {
       return res.status(400).json({ error: 'invalid_orchestrator_input' })
     }
+    // 7.0.13: live rows the snapshot left out (a short or malformed session id, or text over a bound). Reported in the
+    // answer and the log line only when a snapshot came with this request and something was left out.
+    let droppedLiveRows = 0
     if ('snapshot' in body) {
       if (Buffer.byteLength(JSON.stringify(body.snapshot)) > ORCHESTRATOR_BODY_BYTES) return res.status(413).json({ error: 'snapshot_too_large' })
       let snapshot: ControlSnapshot
-      try { snapshot = parseSnapshot(body.snapshot, deps.now()) } catch (e) { return res.status(400).json({ error: 'invalid_snapshot', reason: (e as Error).message }) }
+      try { ({ snapshot, droppedLiveRows } = parseSnapshotReport(body.snapshot, deps.now())) } catch (e) { return res.status(400).json({ error: 'invalid_snapshot', reason: (e as Error).message }) }
       deps.putSnapshot(snapshot)
     }
     try {
       const input = await deps.input(body.workID, meetings as string[])
-      console.log(`[work-orchestrator] input work=${body.workID} rows=${input.rows.length} discovered=${input.discovered} leftOut=${input.leftOut.length} snapshotAge=${input.snapshotAgeSec ?? '-'}s liveAge=${input.liveListAgeSec ?? '-'}s scan=${input.logScanComplete ? 'complete' : 'partial'}`)
-      return res.json(input)
+      console.log(`[work-orchestrator] input work=${body.workID} rows=${input.rows.length} discovered=${input.discovered} leftOut=${input.leftOut.length} snapshotAge=${input.snapshotAgeSec ?? '-'}s liveAge=${input.liveListAgeSec ?? '-'}s scan=${input.logScanComplete ? 'complete' : 'partial'}${droppedLiveRows ? ` droppedLiveRows=${droppedLiveRows}` : ''}`)
+      return res.json(droppedLiveRows ? { ...input, droppedLiveRows } : input)
     } catch (e) {
       console.warn(`[work-orchestrator] input failed for ${body.workID}: ${(e as Error).message}`)
       return res.status(503).json({ error: 'orchestrator_input_unavailable' })

package/server/scripts/write-web-control-manifest.mjs

@@ -0,0 +1,43 @@
+#!/usr/bin/env node
+// 6.99.31 (Phase 6): the pack step. Writes server/web-control/.manifest.json, the sha256 of every
+// file COS Control Web ships (every regular non-dot file except *.test.ts, which never ship). With
+// COS_WEB_CONTROL_INTEGRITY on, the server serves /control only while the files match it
+// (server/lib/web-control-integrity.ts, whose computeWebControlManifest must agree with this byte
+// for byte; web-control-integrity.test.ts pins that). Run by `npm pack` / `npm publish` (prepack).
+// Writes one file, prints its path and the file count. Never reads anything outside web-control/.
+import { createHash } from 'node:crypto'
+import { readdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+export function manifestFor(dir) {
+  const files = {}
+  const walk = (d, base) => {
+    let names
+    try { names = readdirSync(d) } catch { return }
+    for (const name of names.sort()) {
+      if (name.startsWith('.')) continue
+      const file = join(d, name)
+      let st
+      try { st = statSync(file) } catch { continue }
+      const urlPath = `${base}/${name}`
+      if (st.isDirectory()) walk(file, urlPath)
+      else if (st.isFile() && !name.endsWith('.test.ts')) files[urlPath] = createHash('sha256').update(readFileSync(file)).digest('hex')
+    }
+  }
+  walk(dir, '')
+  return { v: 1, algorithm: 'sha256', files }
+}
+
+const isMain = process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]
+if (isMain) {
+  const dir = process.argv[2] ?? join(dirname(fileURLToPath(import.meta.url)), '..', 'web-control')
+  const manifest = manifestFor(dir)
+  const out = join(dir, '.manifest.json')
+  const tmp = `${out}.tmp`
+  writeFileSync(tmp, `${JSON.stringify(manifest, null, 2)}\n`, { mode: 0o644 })
+  renameSync(tmp, out)
+  // stderr, never stdout: it runs as `prepack`, and `npm pack --json` callers (the release packager, package-contents and
+  // launcher-contract tests) parse stdout as JSON (7.0.9 full suite).
+  console.error(`[web-control-manifest] ${out} (${Object.keys(manifest.files).length} files)`)
+}

package/server/web-control/.manifest.json

@@ -0,0 +1,44 @@
+{
+  "v": 1,
+  "algorithm": "sha256",
+  "files": {
+    "/app.css": "0d3ebbf2ca167bc9ef6ab8efef41618f514cc4f505ae588642d36935249697af",
+    "/app.js": "3c489b154588908178de5b70b18ee8184ec9256e99f774177b9e35ceb27eb362",
+    "/apple-touch-icon.png": "04ec7eca0bf6f53d89900d146ac32d4826759d6258bcdbd1ccdcc517f26f532c",
+    "/control.css": "e7b287aa4acc1b3895a9ce61512fe449c555b6335a7145684fd78108ae008c75",
+    "/fonts/DMSans.ttf": "8cd08d97e89c24d0aa92edd2f0f4c8ee6195eee9b7c9f154865a58b02f0c1c0d",
+    "/fonts/Fraunces.ttf": "177ff6c0f14e5550a3c624247cd1189611d4eb65d000b14944c63d967958abbb",
+    "/fonts/JetBrainsMono.ttf": "48715a42ec242c21e9f02692891e147d022299a52e48d5e413e1a942193ffeda",
+    "/index.html": "26ee9cd1f68829ae5f47dcc7a0c2e45a40d28c4ee65d0537f0677b13ea727267",
+    "/mark.svg": "8e380d33d393027df192eb1afa08f15a380c2070c72d68f27311b49d9e94ca18",
+    "/memories/d3.min.js": "f2094bbf6141b359722c4fe454eb6c4b0f0e42cc10cc7af921fc158fceb86539",
+    "/memories/graph-explorer.css": "ec128de59811f45c71b6bededd737989309205e903951eb8211ade7664f87486",
+    "/memories/graph-explorer.js": "98bde3df25f42022b098d047d2c8e7a22b972c1d817a18a24a0ab075d77871d3",
+    "/memories/memory-workspace.js": "013f6c8c72c3474768f8c374edccde0e3656fc243e56528e258c3c29acca64f5",
+    "/memory-review.js": "f27fe519f7ad7eccc3b44124fae724aa51e2eb3cb060d2f1795600e0e41b074f",
+    "/panes/cos-chat.css": "29a5d22d0f02d0707e65711d151ad7c8ac0ab4bfeb30ab04b1f9d9fcf7d457b8",
+    "/panes/cos-chat.js": "0005562525cab6353ef8fc002d7960b30a8bf9fc9a9a1059c0123c6cf343366e",
+    "/panes/dictation.js": "e9434b353a1a3ab3f21d4cef5b2d5f927a733f6af5f58285fda6a78472761f91",
+    "/panes/meetings.css": "3ad4d0c5d59bd9f21c5ac9e234437cc0c81b381bd98ca4634b147efba5105a53",
+    "/panes/meetings.js": "e3839cd7d52c98510ca232e41d3a336806d740b4a1381eab1a367d56a765f925",
+    "/panes/memories.css": "36731d6fd21ad1516dfeccf34fe5b2d3d267d21e40b47704055a0685334b579e",
+    "/panes/memories.js": "28461f953ad0bf9d13287039594f2ce7ea29a46366e249240fa50f4b0f3b8c31",
+    "/panes/messages.js": "be7a7b294f67a43fcb4cc518da987d2da2990484cb677ada810afa93af25a8a5",
+    "/panes/preview.js": "79f1aecb27f48d584ed4cf37c7f4f423f0f9b45dd6c2fb24a9d88c72625d8680",
+    "/panes/questions.css": "5c5a9b32ce32386b508ce326b17d40ecacbb0f2e049df7f4fe2a0009bd3b7908",
+    "/panes/questions.js": "228e8cd0a9651a290cbb380db487af677a2fc7e93a64b1e33c9411cd8b013478",
+    "/panes/reader-media.js": "4cf892a855aa2d0dce6978e69296cd49b8036d8fc62f12773b3fcadc210b2ef0",
+    "/panes/sessions.css": "fa2e714e7b03459e12407f7125ab0e1eb7d12a4cc9341a2442dc73900f5a3081",
+    "/panes/settings.js": "5c46c951fdcc2fc942486ec4b468b7e0bb0350a0a56a38d429948fc5147ab2f4",
+    "/panes/speakers.css": "49e70dae4266151b14b0057f2e43de169de225b8f3ac30343c81cf532735a487",
+    "/panes/speakers.js": "8132c9244fb3965de802680840d2985978571988b9b4462b347d079330251bc5",
+    "/panes/threads.js": "45fd7b56480be53225e91193cfa4c41a4ee7167890f10560e439bc7d2461747f",
+    "/panes/today-actions.css": "c82f95b2aaf09802b15d47b24eccdb5c974afcab38ff5f861b3a8d8630b60869",
+    "/panes/today-actions.js": "4fbc51dc624f9e4cdc85db89905f019a8a5961e4984e8733e0525c71cf0e8657",
+    "/panes/work.css": "da50355dac690f712d1f6331f70ee5eadbf5982d37508648ae7786afc99ac7b1",
+    "/panes/work.js": "0425f53fba98ca34496486d914c3b03f95de3c2a651dc0c88a2a20bc4f6407cd",
+    "/shell.js": "f1cc6a52c78e01ddba89ff27c6bd0e8f8bd8f29bdfcbb5150ee4ed66a8128d9d",
+    "/theme.js": "700453683539c9efcde014ef1eb088c39478dad54f1ef53fa5e2dee9b36f0a3f",
+    "/vendor/qrcode-encoder.js": "61d87cc7445cc66b862cff913de4571634746ea62bcd50d0f592be14f6d1ce46"
+  }
+}

package/server/web-control/app.css

@@ -186,6 +186,11 @@ select.field {
   padding: 4px calc(var(--gutter) + var(--safe-right)) calc(var(--safe-bottom) + 96px) calc(var(--gutter) + var(--safe-left));
 }
 .pane { max-width: 880px; }
+/* 7.0.2 (A2, the Duo audit): the COS chat route ends at its composer (panes/messages.js sets ws-chat). The 96 px above
+   (and the 40 px from 600 px up) held room for a bottom bar that is gone; under the sticky composer it was blank page
+   that a focused box scrolled to and the closed keyboard left on screen. Two columns from 860 px keep a small margin. */
+.workspace.ws-chat { padding-bottom: 0; }
+@media (min-width: 860px) { .workspace.ws-chat { padding-bottom: calc(var(--safe-bottom) + 16px); } }
 .pane-head { margin: 8px 0 18px; }
 .pane-title { font: 500 40px/1.02 var(--display); letter-spacing: -0.015em; margin: 0; }
 .pane-sub { color: var(--sub); margin: 6px 0 0; font-size: 15px; }
@@ -249,6 +254,8 @@ select.field {
 .story { font: 400 24px/1.28 var(--display); letter-spacing: -0.005em; margin: 26px 2px; text-wrap: pretty; }
 /* The Today summary's quiet age line (app.js briefWhen). */
 .story-when { display: block; margin-top: 10px; font: 400 14px/1.35 var(--body); letter-spacing: 0; color: var(--sub); }
+/* Today round 2: "Ask about this" under the summary, the COS chat composer (panes/cos-chat.css) laid flat in the page. */
+.today-ask.cc-composer { position: static; background: transparent; border-top: 0; padding: 0 0 14px; }
 .story-skel { display: grid; gap: 12px; margin: 30px 0; }
 .story-skel .skeleton { height: 22px; }
 
@@ -288,6 +295,12 @@ select.field {
 .next-up .when { font: 500 24px/1 var(--display); white-space: nowrap; }
 .next-up .what { font-weight: 600; }
 .next-up .sub { color: var(--sub); font-size: 14px; }
+.next-later { padding: 0 16px 14px; font-size: 14px; }
+.next-later .later-row { display: flex; gap: 12px; padding: 3px 0; min-width: 0; }
+.next-later .later-when { color: var(--sub); font-variant-numeric: tabular-nums; white-space: nowrap; min-width: 4.5em; }
+.next-later .later-what { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.next-later .later-asof { color: var(--sub); margin-top: 4px; }
+.next-later .later-more { margin-top: 4px; padding: 3px 0; }
 
 /* ── Lists (sessions, meetings, messages) ────────────────── */
 .list { background: var(--panel); border: 1px solid var(--panel-border); border-radius: var(--radius-lg); overflow: hidden; box-shadow: var(--shadow); }
@@ -405,6 +418,11 @@ select.field {
 .menu-host { display: flex; align-items: center; gap: 8px; color: var(--sub); font-size: 14px; margin: 6px 4px 12px; }
 .sheet-head { display: flex; gap: 10px; align-items: center; }
 .sheet-head .field { flex: 1; }
+/* W1 (Miles 2026-11-09 21:24, closed Duo): the Ask field sat beside the camera, the clip and Cancel and its placeholder
+   was cut off. It needs at least 15rem; when the buttons do not fit beside that, they go to the row below, at its right. */
+#ask-form { flex-wrap: wrap; }
+#ask-form > .field { flex: 1 1 15rem; min-width: 0; }
+#ask-form > .ask-clip { margin-left: auto; }
 @keyframes fade { from { opacity: 0; } }
 @keyframes drop { from { transform: translateY(-24px); opacity: 0.5; } }
 
@@ -507,6 +525,28 @@ select.field {
   .pane.reading .pane-head.with-ask { display: flex; }
 }
 
+/* Duo tables: the divider between a list and its reader (app.js splitKit, W.splitKit), for Memories and Messages.
+   Hidden everywhere; each pane shows it only inside its own two-column breakpoint (panes/memories.css 760 px,
+   panes/cos-chat.css 860 px), so a phone never sees it. Sessions keeps its own copy of these rules (panes/sessions.css). */
+.split-handle, .split-full-btn { display: none; }
+.split-handle {
+  justify-content: center; align-items: center; position: sticky; top: calc(var(--safe-top) + 12px); align-self: start;
+  height: calc(100dvh - var(--safe-top) - 24px); cursor: col-resize; touch-action: none; user-select: none; -webkit-user-select: none;
+  -webkit-touch-callout: none; outline: none; z-index: 2;
+}
+/* The line is the split's own gap; the grip shows where to take it. */
+.split-handle::after { content: ''; width: 4px; height: 36px; border-radius: 2px; background: var(--panel-border); transition: background 120ms ease, height 120ms ease; }
+.split-handle:hover::after, .split-handle:focus-visible::after, .split-dragging > .split-handle::after { background: var(--accent); height: 52px; }
+.split-handle:focus-visible { box-shadow: inset 0 0 0 2px color-mix(in srgb, var(--accent) 45%, transparent); border-radius: 6px; }
+/* A finger gets at least a 44 px target, 13 px over each pane's edge; a mouse keeps the divider's own column. */
+@media (pointer: coarse) { .split-handle::before { content: ''; position: absolute; top: 0; bottom: 0; left: -13px; right: -13px; } }
+/* While dragging, nothing in the panes selects or takes the pointer. */
+.split-dragging { user-select: none; -webkit-user-select: none; cursor: col-resize; }
+.split-dragging > :not(.split-handle) { pointer-events: none; }
+.split-full-btn { margin-left: auto; flex: none; }
+@media (pointer: coarse) { .split-full-btn { min-height: 44px; } }
+@media (prefers-reduced-motion: reduce) { .split-handle::after { transition: none; } }
+
 /* ── Desktop ─────────────────────────────────────────────── */
 @media (min-width: 1100px) and (min-height: 721px) {
   :root { --gutter: 40px; }
@@ -550,11 +590,20 @@ select.field {
 @media (any-pointer: coarse) {
   input:not([type='checkbox']):not([type='radio']):not([type='range']):not([type='color']):not([type='file']):not([type='button']):not([type='submit']):not([type='reset']):not([type='image']):not([type='hidden']),
   select, textarea { font-size: 16px !important; }
+  /* 7.0.17 (Miles 2026-11-10, Duo web app zooming): the same floor for any element that types without being a field.
+     None exists in Control Web today (work.js only names the selector); this keeps a future editor from zooming. */
+  [contenteditable]:not([contenteditable='false']) { font-size: 16px !important; }
 }
+/* 7.0.17 (Miles 2026-11-10: "a lot of zooming in and out as I'm opening and closing keyboard"; the Duo's own breadcrumb
+   showed vvs=2.12 with the keyboard down, a double-tap zoom fitting a column). manipulation keeps pan and pinch and
+   turns off double-tap zoom. On the root only: touch-action is the intersection down the tree, so the splitter's
+   none and the charts' pan-y stay exactly as strict as they were. */
+html { touch-action: manipulation; }
 /* Folded phones: every button and field is at least 44 px tall (design QA: .cx-btn came in six heights from 30 px). A
    minimum only, so it grows the compact ones and leaves the taller ones; the per-pane phone heights that fought it are
    gone. */
-@media (max-width: 599px) {
+/* 7.0.2 (A8): a short touch screen at any width too (the unfolded Duo, 951x539 in Comet, is touch first). */
+@media (max-width: 599px), (pointer: coarse) and (max-height: 720px) {
   .cx-btn, .field { min-height: 44px !important; }
 }
 /* Touch screens: the small controls the canary measured under 44 px (nav 30, switches 30, a chip's remove and Retry 36,
@@ -566,6 +615,32 @@ select.field {
   .cc-chip-x, .cc-attach, .cc-camera { min-width: 44px !important; min-height: 44px !important; }
   .cx-switch button::before { content: ''; position: absolute; inset: -7px -4px; }
 }
+/* 7.0.2 (A8): a short touch screen 600 px wide or more (the unfolded Duo, 951x539) keeps the phone Ask sheet: full width
+   from the top, no centred desktop card with 8 % of a 539 px screen spent above it (app.js isPhone says phone too). */
+@media (min-width: 600px) and (pointer: coarse) and (max-height: 720px) {
+  .sheet-backdrop { padding-top: 0; }
+  .sheet { max-width: none; border-radius: 0 0 20px 20px; padding: calc(var(--safe-top) + 10px) var(--gutter) 14px; max-height: calc(100dvh - 90px); box-shadow: none; }
+}
 /* 6.99.30 (QA): an element with the hidden attribute is hidden, whatever display its classes give it ("Retry image"
    showed under loaded images: .link-btn's inline-flex beat [hidden]). */
 [hidden] { display: none !important; }
+
+/* W1: the Mac not answering, and the sign-in ending soon (app.js "Mac reachability and sign-in lifetime"). */
+.conn-notice { display: grid; gap: 8px; margin: 0 0 12px; }
+.conn-notice[hidden] { display: none; }
+.conn-line { display: flex; flex-wrap: wrap; align-items: center; gap: 6px 12px; padding: 12px 14px; border-radius: var(--radius-sm); border: 1px solid var(--panel-border); background: var(--panel); color: var(--ink); font-size: 15px; line-height: 1.4; }
+.conn-line strong { font-weight: 600; }
+.conn-line .conn-sub { color: var(--sub); flex: 1 1 220px; min-width: 0; }
+.conn-line .btn { margin: 0; }
+.auth-offline p { color: var(--sub); }
+.meaning-consent .row-actions { padding: 0 16px 14px; }
+/* W1 A5: a question waiting on the Mac's own prompt, at the top of the session reader. */
+.sx-mac-q { margin: 8px 0 12px; padding: 12px 14px; border-radius: var(--radius-sm); border: 1px solid var(--panel-border); background: var(--panel); }
+.sx-mac-q[hidden] { display: none; }
+.sx-mac-q .sx-mac-q-title { margin: 0 0 6px; }
+/* 7.0.18: a turn that ended asking him: the choices as buttons in a row that wraps under its own width (at most two,
+   each label at most 40 characters), so the closed Duo stacks them and the open Duo keeps them side by side. Labels wrap
+   inside a button rather than cut. */
+.sx-te-choices, .ta-te-choices { display: flex; flex-wrap: wrap; gap: 8px; margin: 8px 0 6px; }
+.sx-te-choices .cx-btn, .ta-te-choices .cx-btn { flex: 1 1 12rem; min-height: 44px; white-space: normal; text-align: center; line-height: 1.25; }
+.sx-mac-q .sx-note { margin: 6px 0 0; }