@gotcos/glasses-server 7.0.27 → 7.0.30

package/server/web-control/theme.js

@@ -25,6 +25,32 @@
   if (media && media.addEventListener) media.addEventListener('change', function () { if (read() === 'system') apply('system'); });
 })();
 
+/* 7.0.29 (Miles 21:42): "for shorter screens like the duo we should use the side rail when it's folded"; tall phones keep
+   the top menu. The test is the SCREEN's shape, never the window's: a screen whose short side is under 600 and whose long
+   side is under 1.6 times its short side is short (html.short-screen). app.css draws the side rail only with this class
+   AND a page under 600 px wide on a touch screen. Missing or odd numbers give no class: no rail, the layout as before.
+   MEASURED: his phone's own device reports (2026-11-10 and 11-11) give screen.width 466 and screen.height 678 in rows laid
+   out 449, 548 and 1119 px wide at visualViewport.scale 0.85, and the canary (11-11 21:56) read screen.width 466 in a
+   Safari tab, folded, at scale 1. 678 / 466 is 1.46. Every iPhone's published screen is 1.78 (SE, 8 Plus) or 2.16 and up.
+   ASSUMED, not measured: which of those rows were the Home Screen app and which a tab, that other zoom settings report
+   the same, and that folding or opening never changes the numbers. So this one function runs at load (before the first
+   paint, so the rail never moves the page on load) and again on every resize and orientation change, and the page's
+   device report and a 'rail' report on each change carry screen.width and screen.height, so his phone settles it. */
+(function () {
+  function shortScreen() {
+    var de = document.documentElement, on = false;
+    try {
+      var s = window.screen, a = s ? Number(s.width) : 0, b = s ? Number(s.height) : 0;
+      if (a > 0 && b > 0 && isFinite(a) && isFinite(b)) { var lo = Math.min(a, b), hi = Math.max(a, b); on = lo < 600 && hi / lo < 1.6; }
+    } catch (_e) { on = false; }
+    try { if (de && de.classList) { if (on) de.classList.add('short-screen'); else de.classList.remove('short-screen'); } } catch (_e) { /* no class: no rail */ }
+    return on;
+  }
+  window.CosShortScreen = shortScreen;
+  shortScreen();
+  if (typeof window.addEventListener === 'function') { window.addEventListener('resize', shortScreen); window.addEventListener('orientationchange', shortScreen); }
+})();
+
 /* The app's scripts (index.html #boot-scripts), loaded one frame after the page is drawn so the first paint never waits
    for them. Same files, same order (async=false keeps insertion order), and app.js's boot runs only once every one of
    them has run, as when they were in the page: window.CosBoot.after(boot). The frame wait has a 50 ms fallback, because
@@ -40,10 +66,16 @@
     list = Array.isArray(list) ? list.filter(function (u) { return typeof u === 'string' && u.indexOf('/control/') === 0; }) : [];
     var left = list.length;
     if (!left) { settle(); return; }
+    // 7.0.28: after a reload that the restyle check below made because a script had failed, ask for every script with a
+    // fresh query, so none comes from the browser's memory of the failed request (WebKit kept the failure across the
+    // reload). Read once.
+    var bust = '';
+    try { bust = sessionStorage.getItem('cos_web_bust') || ''; sessionStorage.removeItem('cos_web_bust'); } catch (_e) { bust = ''; }
     list.forEach(function (src) {
       var el = document.createElement('script');
-      el.src = src; el.async = false;
-      el.onload = el.onerror = function () { if (--left === 0) settle(); };
+      el.src = /^\d{1,15}$/.test(bust) ? src + (src.indexOf('?') >= 0 ? '&' : '?') + 'r=' + bust : src; el.async = false;
+      el.onload = function () { if (--left === 0) settle(); };
+      el.onerror = function () { if (window.CosRestyle) window.CosRestyle.scriptFailed(src); if (--left === 0) settle(); };
       document.body.appendChild(el);
     });
   }
@@ -54,3 +86,138 @@
   }
   if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', afterFrame); else afterFrame();
 })();
+
+/* 7.0.28 (Miles 19:28, "Connect this browser" with no styling): the page's own files must not stay missing. When the
+   phone opens the page before it can reach the Mac (the tunnel still coming up, or the page drawn from the browser's
+   copy), the HTML draws but a stylesheet or a script can fail, and nothing asked for it again. index.html's inline
+   critical CSS keeps the sign-in card right meanwhile; this brings the rest back. While anything failed, it asks the
+   Mac for the failed file after 1, 2, 4 and 8 s, then every 30 s, only while the page is in front. When the Mac
+   answers: a failed script reloads the page (app.js cannot be re-run in place); failed stylesheets are asked for again
+   in place. A file that keeps failing never loops: at most 2 reloads in 5 minutes. What happened is kept for app.js's numbers-only 'restyle' row (window.CosRestyle.last, and sessionStorage
+   across the reload).
+   7.0.29 (Q1 FIX 1 and 2, the lead's R1 and R2): the page never reloads by itself over his words. While any text box
+   holds words, focus is in a text box, or a send is in flight (app.js's window.CosBusy; when app.js is the script that
+   failed, the boxes alone), it shows one line with a Reload button instead, and only his tap reloads. The cap fails
+   closed: if the reload count cannot be read, or does not read back after writing (storage blocked), it gives up and
+   shows the same line rather than reloading. */
+(function () {
+  var STEPS = [1000, 2000, 4000, 8000], SETTLED_MS = 30000, KEY = 'cos_web_restyle', RELOADS_KEY = 'cos_web_restyle_reloads';
+  var RELOAD_MAX = 2, RELOAD_WINDOW_MS = 5 * 60000;
+  var R = { scripts: [], sheets: 0, tries: 0, t0: 0, timer: null, done: false, last: null };
+  // Every real browser has these; a harness that runs this file without them gets no restyle check, not a throw that
+  // would stop the theme and the loader above from being tested.
+  if (typeof window.addEventListener !== 'function' || typeof document.querySelectorAll !== 'function' || typeof document.addEventListener !== 'function') return;
+  function missing() {
+    return [].filter.call(document.querySelectorAll('link[rel="stylesheet"]'), function (l) {
+      // A sheet that failed to load throws on read in WebKit (SecurityError); count it as missing.
+      try { return !l.sheet || !l.sheet.cssRules || l.sheet.cssRules.length === 0; } catch (_e) { return true; }
+    });
+  }
+  function bust(href) { return href + (href.indexOf('?') >= 0 ? '&' : '?') + 'r=' + Date.now(); }
+  function record(how) {
+    R.last = { how: how, sheets: R.sheets, scripts: R.scripts.length, tries: R.tries, ms: R.t0 ? Date.now() - R.t0 : 0 };
+    try { window.dispatchEvent(new CustomEvent('cos-restyle', { detail: R.last })); } catch (_e) {}
+  }
+  // What would be lost by a reload: words in a text box he can see, focus in one, or a send on its way (app.js).
+  function busy() {
+    var out = { words: false, focus: false, sending: false };
+    try {
+      [].forEach.call(document.querySelectorAll('textarea, input, [contenteditable]'), function (el) {
+        if (el.getAttribute && el.getAttribute('aria-hidden') === 'true') return;   // app.js's hidden measuring copy
+        if (el.tagName === 'INPUT' && !/^(|text|search|email|url|tel|password|number)$/i.test(el.getAttribute('type') || '')) return;
+        var v = el.isContentEditable ? el.textContent : el.value;
+        if (v && String(v).trim()) out.words = true;
+      });
+      var a = document.activeElement;
+      out.focus = !!(a && (a.tagName === 'TEXTAREA' || (a.tagName === 'INPUT' && /^(|text|search|email|url|tel|password|number)$/i.test(a.getAttribute('type') || '')) || a.isContentEditable));
+    } catch (_e) {}
+    try { out.sending = typeof window.CosBusy === 'function' && !!window.CosBusy(); } catch (_e) {}
+    out.any = out.words || out.focus || out.sending;
+    return out;
+  }
+  // The one line, in place of a reload. Inline styles with the theme's own colours where they exist, so it reads right
+  // on a page whose stylesheet failed too. At the top: a fixed bar near the bottom fights the phone browser's own bar.
+  // On the folded Duo it stops at the side rail (--rail-w is set only while that rail shows).
+  function offer(b) {
+    try { offerLine(b); } catch (_e) { /* no line, and still no reload by itself */ }
+  }
+  function offerLine(b) {
+    var line = document.getElementById('cos-reload-line');
+    if (!line) {
+      line = document.createElement('div');
+      line.id = 'cos-reload-line'; line.setAttribute('role', 'status');
+      line.style.cssText = 'position:fixed;left:12px;right:calc(12px + var(--rail-w, 0px));top:calc(env(safe-area-inset-top, 0px) + 8px);z-index:90;display:flex;align-items:center;gap:12px;' +
+        'padding:10px 10px 10px 14px;border-radius:12px;border:1px solid var(--panel-border, #a08a66);background:var(--panel, #ffffff);color:var(--ink, #1f1712);' +
+        'font:400 15px/1.4 -apple-system, BlinkMacSystemFont, "Helvetica Neue", sans-serif;max-width:560px;margin:0 auto;';
+      var p = document.createElement('p'); p.style.cssText = 'margin:0;flex:1 1 auto;min-width:0;'; p.id = 'cos-reload-words';
+      var btn = document.createElement('button'); btn.type = 'button'; btn.textContent = 'Reload';
+      btn.style.cssText = 'flex:none;min-height:44px;padding:0 16px;border-radius:10px;border:0;background:var(--accent, #89662d);color:var(--on-accent, #ffffff);font-family:inherit;font-size:15px;font-weight:600;line-height:1;';
+      btn.addEventListener('click', function () { reloadNow(); });
+      line.appendChild(p); line.appendChild(btn);
+      (document.body || document.documentElement).appendChild(line);
+    }
+    var words = document.getElementById('cos-reload-words');
+    if (words) words.textContent = 'Part of this page did not load.' + (b && b.words ? ' Send or copy what you have typed first. A reload clears it.' : '');
+  }
+  function reloadNow() {
+    try { sessionStorage.setItem(KEY, JSON.stringify(R.last)); sessionStorage.setItem('cos_web_bust', String(Date.now())); } catch (_e) {}
+    location.reload();
+  }
+  function recover() {
+    if (R.scripts.length) {
+      // Never by itself over his words (R1): the line, and only his tap reloads.
+      var b = busy();
+      if (b.any) { R.done = true; record('offered'); offer(b); return; }
+      // At most 2 reloads in 5 minutes: a file that keeps failing must never become a reload loop. Fails closed (R2): a
+      // count that cannot be read, or that does not read back after writing, means no reload by itself.
+      var recent = null, back = null;
+      try { recent = JSON.parse(sessionStorage.getItem(RELOADS_KEY) || '[]').filter(function (t) { return Date.now() - t < RELOAD_WINDOW_MS; }); } catch (_e) { recent = null; }
+      if (!recent || recent.length >= RELOAD_MAX) { R.done = true; record('gave-up'); offer(b); return; }
+      var now = Date.now();
+      try { recent.push(now); sessionStorage.setItem(RELOADS_KEY, JSON.stringify(recent)); back = JSON.parse(sessionStorage.getItem(RELOADS_KEY) || 'null'); } catch (_e) { back = null; }
+      if (!back || back.length !== recent.length || back[back.length - 1] !== now) { R.done = true; record('gave-up'); offer(b); return; }
+      record('reload');
+      reloadNow();
+      return;
+    }
+    var gone = missing();
+    gone.forEach(function (old) {
+      var el = document.createElement('link');
+      el.rel = 'stylesheet'; el.href = bust(old.getAttribute('href') || old.href);
+      el.onload = function () { if (old.parentNode) old.parentNode.removeChild(old); };
+      old.parentNode.insertBefore(el, old.nextSibling);
+    });
+    R.done = true; record('sheets');
+  }
+  function schedule() {
+    if (R.timer || R.done || document.hidden) return;
+    var ms = R.tries < STEPS.length ? STEPS[R.tries] : SETTLED_MS;
+    R.timer = setTimeout(check, ms);
+  }
+  function check() {
+    R.timer = null;
+    if (R.done || document.hidden) return;
+    R.tries++;
+    // Ask for the file that failed (a script first): it answering is what matters, and a file that is not there (404)
+    // never counts as the Mac being back.
+    var gone = missing(), url = R.scripts[0] || (gone[0] && (gone[0].getAttribute('href') || gone[0].href)) || '/control/app.css';
+    var probe = window.fetch ? window.fetch(bust(url), { cache: 'no-store', credentials: 'same-origin' }) : Promise.reject(new Error('no fetch'));
+    probe.then(function (r) { if (r && r.ok) recover(); else schedule(); }, function () { schedule(); });
+  }
+  function start() {
+    if (R.done || R.t0) return;
+    R.sheets = missing().length;
+    if (!R.sheets && !R.scripts.length) return;
+    R.t0 = Date.now();
+    schedule();
+  }
+  window.CosRestyle = {
+    scriptFailed: function (src) { if (R.scripts.indexOf(src) < 0) R.scripts.push(src); if (R.t0) schedule(); else start(); },
+    get last() { return R.last; },
+    // After a reload that this caused: what the page that reloaded had seen, read once.
+    takeSaved: function () { try { var v = sessionStorage.getItem(KEY); sessionStorage.removeItem(KEY); return v ? JSON.parse(v) : null; } catch (_e) { return null; } }
+  };
+  document.addEventListener('visibilitychange', function () { if (!document.hidden && R.t0 && !R.done && !R.timer) check(); });
+  // Every <link> in the head has finished (loaded or failed) by the time the page's load event fires.
+  if (document.readyState === 'complete') start(); else window.addEventListener('load', start);
+})();

package/server/web-signer/.manifest.json

@@ -3,9 +3,9 @@
   "algorithm": "sha256",
   "files": {
     "/index.html": "3bea8ab14118e48c8bbf5f09de2e8b65ca1225b7e7b564982a84477bafc8341e",
-    "/signer-proof.js": "a8f8f10608fa1ec0e8da0280fdb27c16c78c011e6ff935477593e25a8e6a26e0",
+    "/signer-proof.js": "13b2d3f2709501b3bacff63b5a041282cacdf5bce6be168779c59ba89cf2e0c3",
     "/signer-store.js": "ae123328f922a509eea4d8f9e8440c9ef6972eeb14bf90b9e8bde3c84f7132bc",
     "/signer.css": "e19f5ec70c9dae28347ad40cd08742842e964b3d0b973a5c39f48f9cafdd319b",
-    "/signer.js": "c92dae47694a42aec0995a8cb0e70ba54979183711d840b2935528a197b11735"
+    "/signer.js": "098f484b452c0c2b8ff33c9ca7764fb179e3e5f52c77bebf47eb540e73e7a566"
   }
 }

package/server/web-signer/signer-proof.js

@@ -129,13 +129,28 @@
       if (!Object.prototype.hasOwnProperty.call(channels, s.action) || channels[s.action].indexOf(s.channel) < 0
         || !/^[a-z0-9@][a-z0-9@._/-]{0,127}$/.test(s.artifact) || !/^[0-9]{1,5}\.[0-9]{1,5}\.[0-9]{1,6}(-[0-9A-Za-z.-]{1,32})?$/.test(s.version)
         || !/^(sha256:[0-9a-f]{64}|sha512:[0-9a-f]{128}|sha512-[A-Za-z0-9+/]{86}==)$/.test(s.digest) || !HEX64.test(s.packetSha256)) throw fail('scope_not_allowed')
-      var manifests = { 'gotcos-site': 'gotcos-site-manifest', 'control-downloads': 'cos-control-downloads-manifest', 'release-docs': 'cos-release-docs-manifest' }
-      if (Object.prototype.hasOwnProperty.call(manifests, s.channel) && (s.artifact !== manifests[s.channel] || !/^sha256:[0-9a-f]{64}$/.test(s.digest))) throw fail('scope_not_allowed')
+      var manifest = manifestArtifact(s.channel)
+      if (manifest && (s.artifact !== manifest || !/^sha256:[0-9a-f]{64}$/.test(s.digest))) throw fail('scope_not_allowed')
       return { kind: 'approve', action: s.action, artifact: s.artifact, version: s.version, digest: s.digest, channel: s.channel, packetSha256: s.packetSha256 }
     }
     throw fail('scope_not_allowed')
   }
 
+  // What an approval on each channel does, one fixed line per channel (Miles, 2026-11-12: a publish approval covers
+  // its own push). A copy of APPROVE_CHANNEL_EFFECT in shared/web-turn-envelope.ts; signer-proof.test.ts pins the two.
+  var CHANNEL_EFFECT = { 'mac-local': 'Installs on this Mac. No git push.', 'npm-next': 'Publishes to npm under the next tag, from the tested package. No git push.', 'npm-latest': 'Publishes to npm under the latest tag, from the tested package. No git push.', 'control-appcast': 'Pushes ukaoma/cos-starter main (control/appcast.json): the COS Control update feed on gotcos.com.', 'hub-alias': 'Pushes ukaoma/evenhub-g2-cos main: moves the Even Hub alias to this package.', 'gotcos-site': 'Pushes ukaoma/cos-starter main: republishes www.gotcos.com.', 'control-downloads': 'Creates a GitHub Release on ukaoma/cos-starter (a tag, no branch push) with the ZIP and its SHA-256 file.', 'release-docs': 'Pushes ukaoma/cos-starter main (docs/): republishes the public COS docs.' }
+  // Channels that approve one canonical deployment manifest, and the artifact each must name. A copy of
+  // PUBLISH_MANIFEST_ARTIFACTS in shared/web-turn-envelope.ts; signer-proof.test.ts pins the two (Q1, 2026-11-12).
+  var MANIFEST_ARTIFACTS = { 'gotcos-site': 'gotcos-site-manifest', 'control-downloads': 'cos-control-downloads-manifest', 'release-docs': 'cos-release-docs-manifest' }
+  /** The manifest artifact a channel requires, or '' when the channel is not a manifest channel. */
+  function manifestArtifact(channel) {
+    return typeof channel === 'string' && Object.prototype.hasOwnProperty.call(MANIFEST_ARTIFACTS, channel) ? MANIFEST_ARTIFACTS[channel] : ''
+  }
+  /** The fixed line for a channel this page can sign, or '' for anything else. Never built from packet text. */
+  function channelEffect(channel) {
+    return typeof channel === 'string' && Object.prototype.hasOwnProperty.call(CHANNEL_EFFECT, channel) ? CHANNEL_EFFECT[channel] : ''
+  }
+
   /** Verify the full packet before display AND again before signing. A packet is still only a request. */
   function validateHandoffPacket(h, nowMs) {
     return Promise.resolve().then(function () {
@@ -340,7 +355,7 @@
     canonicalJson: canonicalJson, jcsBytes: jcsBytes,
     signedWords: signedWords, wordsDigest: wordsDigest,
     buildEnvelope: buildEnvelope, passkeyChallenge: passkeyChallenge, passkeyHeader: passkeyHeader,
-    assembleTurnProof: assembleTurnProof, validateHandoffPacket: validateHandoffPacket,
+    assembleTurnProof: assembleTurnProof, validateHandoffPacket: validateHandoffPacket, channelEffect: channelEffect, manifestArtifact: manifestArtifact,
     sasCommit: sasCommit, sasCode: sasCode, kidOf: kidOf, fingerprintOf: fingerprintOf, enrollProofMessage: enrollProofMessage,
     spkiFromXY: spkiFromXY, xyFromSpki: xyFromSpki, coseFromXY: coseFromXY, xyFromCose: xyFromCose,
     xyFromAttestation: xyFromAttestation, passkeyXY: passkeyXY,

package/server/web-signer/signer.js

@@ -124,8 +124,10 @@
     return 'Unknown'
   }
   function deploymentMeaning(scope) {
-    var targets = { 'gotcos-site': 'gotcos.com website (cos-starter Pages)', 'control-downloads': 'COS Control GitHub release downloads and approved latest aliases', 'release-docs': 'Public COS release documentation' }
-    return scope && Object.prototype.hasOwnProperty.call(targets, scope.channel) ? '\nDeployment target: ' + targets[scope.channel] + '\nApproval is limited to this exact manifest SHA-256. The receiving release tool checks its files and destination.' : ''
+    // The fixed line for the channel (P.channelEffect), never text from the packet's requester (2026-11-12).
+    var effect = scope && scope.kind === 'approve' ? P.channelEffect(scope.channel) : ''
+    if (!effect) return ''
+    return '\nWhat this approves: ' + effect + (P.manifestArtifact(scope.channel) ? '\nApproval is limited to this exact manifest SHA-256. The receiving release tool checks its files and destination.' : '')
   }
   function claim(id) {
     show('loading')

package/shared/web-turn-envelope.ts

@@ -37,8 +37,15 @@ export const WEB_TURN_MAX_LIFETIME_S = 15 * 60
 /** How far in the future `iat` may sit (clock skew between the phone and this Mac), in seconds. */
 export const WEB_TURN_IAT_SKEW_S = 60
 
-/** The only actions an `approve` scope can name. Anything else, including every never-list item, is unexpressible. */
-export const APPROVE_ACTIONS: ReadonlySet<string> = new Set(['install', 'publish', 'push-main'])
+/**
+ * The only actions an `approve` scope can name. Anything else, including every never-list item, is unexpressible.
+ * Miles, 2026-11-12 11:11: a phone approval may sign everything the build allows except pushing main, which stays
+ * typed at the desk ("Keep allow for all action but the push to main. That way we can resolve when at the desk").
+ */
+export const APPROVE_ACTIONS: ReadonlySet<string> = new Set(['install', 'publish'])
+
+/** Actions a phone can never sign. Not expressible, and still named in every `notAuthorized` list. */
+export const APPROVE_ACTIONS_REMOVED: readonly string[] = Object.freeze(['push-main'])
 
 /** What a `message` scope means: conversation only (review B4). */
 export const MESSAGE_SCOPE_MEANING = 'conversation'
@@ -55,10 +62,28 @@ export const MESSAGE_SCOPE_NOT_AUTHORIZED: readonly string[] = Object.freeze([
 ])
 
 /** The channels each approve action may name. Nothing else is signable (review B4). */
-export const APPROVE_ACTION_CHANNELS: Readonly<Record<'install' | 'publish' | 'push-main', readonly string[]>> = Object.freeze({
+export const APPROVE_ACTION_CHANNELS: Readonly<Record<'install' | 'publish', readonly string[]>> = Object.freeze({
   install: Object.freeze(['mac-local']),
   publish: Object.freeze(['npm-next', 'npm-latest', 'control-appcast', 'hub-alias', 'gotcos-site', 'control-downloads', 'release-docs']),
-  'push-main': Object.freeze(['git-main']),
+})
+
+/**
+ * What an approval on each channel does, in one fixed line the phone shows (Miles, 2026-11-12: "Publish includes its
+ * own push"). A publish approval covers the push that publish consists of, and only that: cos-starter main for the
+ * site, the appcast and the docs; evenhub-g2-cos main for the Hub alias; npm goes out from the tested package with no
+ * push. Pushing the code main of any repo stays typed at the desk. The line is derived from the CHANNEL alone, never
+ * from text the requester sent. The phone's page keeps a copy (server/web-signer/signer-proof.js, CHANNEL_EFFECT),
+ * pinned to this one by signer-proof.test.ts.
+ */
+export const APPROVE_CHANNEL_EFFECT: Readonly<Record<string, string>> = Object.freeze({
+  'mac-local': 'Installs on this Mac. No git push.',
+  'npm-next': 'Publishes to npm under the next tag, from the tested package. No git push.',
+  'npm-latest': 'Publishes to npm under the latest tag, from the tested package. No git push.',
+  'control-appcast': 'Pushes ukaoma/cos-starter main (control/appcast.json): the COS Control update feed on gotcos.com.',
+  'hub-alias': 'Pushes ukaoma/evenhub-g2-cos main: moves the Even Hub alias to this package.',
+  'gotcos-site': 'Pushes ukaoma/cos-starter main: republishes www.gotcos.com.',
+  'control-downloads': 'Creates a GitHub Release on ukaoma/cos-starter (a tag, no branch push) with the ZIP and its SHA-256 file.',
+  'release-docs': 'Pushes ukaoma/cos-starter main (docs/): republishes the public COS docs.',
 })
 
 export const APPROVE_ARTIFACT_RE = /^[a-z0-9@][a-z0-9@._/-]{0,127}$/
@@ -88,13 +113,13 @@ export function approveFieldsValid(action: unknown, artifact: unknown, version:
 /** The verifier's `notAuthorized` list for a scope: the never-list plus what this scope does not cover. */
 export function notAuthorizedFor(scope: WebTurnScope): string[] {
   if (scope.kind === 'message') return [...WEB_KEY_NEVER_AUTHORIZED, ...MESSAGE_SCOPE_NOT_AUTHORIZED]
-  const others = [...APPROVE_ACTIONS].filter(a => a !== scope.action)
+  const others = [...APPROVE_ACTIONS, ...APPROVE_ACTIONS_REMOVED].filter(a => a !== scope.action)
   return [...WEB_KEY_NEVER_AUTHORIZED, ...others, 'push-branch', 'hub-file', 'other-artifact-version-digest-or-channel']
 }
 
 export type WebTurnScope =
   | { kind: 'message' }
-  | { kind: 'approve'; action: 'install' | 'publish' | 'push-main'; artifact: string; version: string; digest: string; channel: string; packetSha256: string }
+  | { kind: 'approve'; action: 'install' | 'publish'; artifact: string; version: string; digest: string; channel: string; packetSha256: string }
 
 export interface WebTurnAttachment { id: string; sha256: string; bytes: number; name: string }
 
@@ -194,7 +219,7 @@ export function parseWebTurnScope(v: unknown): WebTurnScope | null {
     // The closed action list, the strict field patterns and the channel table (approveFieldsValid).
     if (!approveFieldsValid(v.action, v.artifact, v.version, v.digest, v.channel)) return null
     if (typeof v.packetSha256 !== 'string' || !HEX64.test(v.packetSha256)) return null
-    return { kind: 'approve', action: v.action as 'install' | 'publish' | 'push-main', artifact: v.artifact as string, version: v.version as string, digest: v.digest as string, channel: v.channel as string, packetSha256: v.packetSha256 }
+    return { kind: 'approve', action: v.action as 'install' | 'publish', artifact: v.artifact as string, version: v.version as string, digest: v.digest as string, channel: v.channel as string, packetSha256: v.packetSha256 }
   }
   return null
 }
@@ -249,7 +274,7 @@ export function parseWebTurnEnvelope(v: unknown): { ok: true; envelope: WebTurnE
 export interface WebApprovalPacket {
   v: typeof WEB_APPROVAL_PACKET_VERSION
   packetId: string
-  action: 'install' | 'publish' | 'push-main'
+  action: 'install' | 'publish'
   artifact: string
   version: string
   digest: string