@gotcos/glasses-server 7.0.29 → 7.0.30

package/CHANGELOG.md

@@ -1,3 +1,33 @@
+## 7.0.30 - Control Web: Back goes the way you came, a phone shows how you got here, a message shows who said what, Reply stays at the bottom, Meetings opens on today, and clearer copy buttons
+
+2026-11-12. 7.0.29 plus eight Control Web changes from a tester's phone feedback, one clearer sign-in error, and phone-approval changes that stay off unless switched on.
+
+- **Back goes the way you came.** Back now returns to the page you came from, not a fixed parent. Open a meeting from Speakers, and Back takes you to Speakers, not to Meetings. It is the browser's own Back, so the two always agree, and it adds nothing to the browser's history. Opened straight from a link or after a reload, Back goes one level up as before. Back names where it goes ("Speakers", "Meetings"). On screens 600 px and wider, the navigation bar's Back keeps the word "Back" and says where it goes in its name and tooltip ("Back to Speakers").
+- **Back stays in reach on a tall phone.** On a page you are reading (a session, a message, a meeting), the top bar with Back no longer slides away as you scroll down.
+- **Reply stays at the bottom of a message.** Opening a message from Messages, the Reply box now sits at the bottom of the screen while you read, and above the keyboard while you type, as the COS chat already did.
+- **Speakers: the copy buttons say they copy.** "Summary" and "Full (N KB)" now read "Copy summary" and "Copy full (N KB)". The one you tap says "Copied" for a moment, and a screen reader hears what was copied.
+- **Meetings opens on today.** The calendar opens on today, marked with a ring, even when today has no meetings. Then the list says "No meetings today." with one tap to the latest earlier day this month that has meetings (or to last month when this month has none).
+- **Settings says "your phone's camera"**, not "your iPhone Camera". The page is not only for iPhones.
+- **A message shows who said what by side.** Your words sit on the right in the COS chat's gold bubble, with "You" under it; COS's answer sits on the left beside its mark. The two cards marked YOU and COS are gone. The bubble's edge is darker in light mode, so it reads against the page (3.48 to 1; it was 1.52 to 1). A screen reader hears "You said" and "COS said". The same applies to a chat opened from the archive.
+- **A phone shows how you got here.** On a page you opened (a meeting, a message, a session), one line under the top bar names the steps that led there, for example "Today / Speakers / Naming voices / Meeting". Each earlier step is a link that goes back to it, the same way Back does; the page you are on is last and is not a link. The line never wraps: a long path drops steps from the middle and shows "…" in their place. There is no line on a pane's list, on a page opened from a link, or after a reload. Screens 600 px and wider are unchanged; they keep the navigation bar.
+- Tested in a browser (WebKit) at a tall iPhone size, the folded Duo with its side rail, and the open Duo, in light and dark. Before this build the same checks fail. Not yet tested on a real phone; Android was not tested.
+
+Server:
+
+- **A sign-in that ran out says so.** When Claude Code reports "Failed to authenticate: OAuth session expired and could not be refreshed", COS now names it as a sign-in problem, not "provider process exited". The fork check and the provider check read the same words, so they say so too.
+- **Phone approvals, off by default, unchanged for everyone until switched on:**
+  - A phone can sign every action this build supports except pushing main, which stays typed at the desk (Miles, 2026-11-12 11:11).
+  - The phone names what each approval includes, from one fixed line per channel (for example, the push that a publish makes).
+  - The phone-approval signer refuses a stored key or folder that other users can read (stored_readable). It runs only when the phone-approval switch is on.
+  - The web-key mutation gate's two dead targets now match. The script ships in the npm pack, so pack bytes change; server behaviour does not.
+
+**Default-on for every install:** yes, all eight, with no switch, at every screen size (the how-you-got-here line below 600 px only). The sign-in line is on for everyone. The phone-approval items do nothing while the switch is off, which is the default everywhere.
+
+### If you roll back
+
+- To 7.0.29: Back goes to a fixed parent again, the top bar tucks away on a reader, the message reader's Reply is at the end of the page, the copy buttons say Summary and Full, Meetings opens on today only when today has meetings, Settings says iPhone, a message shows the YOU and COS cards, the how-you-got-here line is gone, and an expired Claude sign-in reads "provider process exited" again. Nothing is stored.
+- Further back: as in 7.0.29 below.
+
 ## 7.0.29 - Control Web: on the folded Duo, the panes sit in a side rail at the right edge, and Back is at thumb height
 
 2026-11-12. 7.0.28 plus Control Web changes: a side rail for the folded Duo only, and small Sessions list changes for every screen.

package/docs/web-key-verifier-contract.md

@@ -84,8 +84,9 @@ bumps the epoch.
 - `WEB_ANCHOR_MATURITY_MS = 86_400_000` (24 h). An anchor younger than that vouches nothing
   (`anchor_too_new`).
 - `setAt` is file-backed, so a same-user process can backdate it. The 24 h rule binds the server's
-  own route; **the verifier's committed pin is the real check.** The verifier must refuse when the
-  pin file is missing, uncommitted, or its `spkiSha256` differs from `anchor.spkiSha256` in the answer.
+  own route, and the verifier refuses when the pin file is missing, uncommitted, or its `spkiSha256`
+  differs from `anchor.spkiSha256` in the answer. Accepted limit (Miles, 2026-11-12): a process running
+  as the owner on this Mac can forge the whole chain, pin included.
 
 ## 3. Enrollment (anchor-signed approval)
 
@@ -176,7 +177,7 @@ footer as received (CRLF to LF only) and needs no trimming rule of its own.
 
 | Field | Pattern |
 | --- | --- |
-| action | `install` \| `publish` \| `push-main` |
+| action | `install` \| `publish` |
 | artifact | `^[a-z0-9@][a-z0-9@._/-]{0,127}$` |
 | version | `^[0-9]{1,5}\.[0-9]{1,5}\.[0-9]{1,6}(-[0-9A-Za-z.-]{1,32})?$` |
 | digest | `^sha256:[0-9a-f]{64}$` or `^sha512:[0-9a-f]{128}$` or `^sha512-[A-Za-z0-9+/]{86}==$` (npm SRI) |
@@ -187,9 +188,34 @@ footer as received (CRLF to LF only) and needs no trimming rule of its own.
 | --- | --- |
 | install | `mac-local` |
 | publish | `npm-next`, `npm-latest`, `control-appcast`, `hub-alias`, `gotcos-site`, `control-downloads`, `release-docs` |
-| push-main | `git-main` |
 
-In this candidate `install` and `publish` are accepted only through exact scoped proof (`WEB_KEY_ENABLED_APPROVE_ACTIONS`). `push-main` remains refused with `approve_action_not_enabled`. A message scope never authorizes either action.
+**Pushing main is never signable by phone** (Miles, typed 2026-11-12 11:11: "allow for all action but the push to
+main. That way we can resolve when at the desk"). It stays typed at the desk. The `push-main` action and its `git-main`
+channel are not expressible: a scope naming them is refused at the grammar (`scope_not_allowed`), and the packet route
+refuses to create one (`action_not_allowed`). Pushing a feature branch and adding a versioned Hub file have no
+`approve` form. `install` and `publish` are accepted only through exact scoped proof (`WEB_KEY_ENABLED_APPROVE_ACTIONS`).
+A message scope never authorizes either action. The phone's signer page keeps its own copy of this table
+(`server/web-signer/signer-proof.js`); a test fails if the two differ.
+
+**What each channel's approval includes** (Miles, 2026-11-12: "Publish includes its own push"). A publish approval
+covers the push that the publish consists of, and nothing else. Pushing the code `main` of any repo (the server, the
+COS repo) stays typed at the desk. The phone shows the line below for the signed channel, taken from the channel alone
+(`APPROVE_CHANNEL_EFFECT` in `shared/web-turn-envelope.ts`, copied as `CHANNEL_EFFECT` in the signer page and pinned to
+it by test), never from text the requester sent. A channel not in the table shows nothing and is refused.
+
+| Channel | The push or upload it includes | Line the phone shows |
+| --- | --- | --- |
+| `mac-local` | none | Installs on this Mac. No git push. |
+| `npm-next` | none (npm registry only, from the tested package) | Publishes to npm under the next tag, from the tested package. No git push. |
+| `npm-latest` | none (npm registry only, from the tested package) | Publishes to npm under the latest tag, from the tested package. No git push. |
+| `control-appcast` | `ukaoma/cos-starter` `main` (`control/appcast.json`, served by GitHub Pages) | Pushes ukaoma/cos-starter main (control/appcast.json): the COS Control update feed on gotcos.com. |
+| `hub-alias` | `ukaoma/evenhub-g2-cos` `main` (the alias file) | Pushes ukaoma/evenhub-g2-cos main: moves the Even Hub alias to this package. |
+| `gotcos-site` | `ukaoma/cos-starter` `main` (GitHub Pages) | Pushes ukaoma/cos-starter main: republishes www.gotcos.com. |
+| `control-downloads` | a GitHub Release on `ukaoma/cos-starter` (tag `control-v<version>`, the ZIP and its `.sha256`); no branch push. The site's links move only with `gotcos-site` or `control-appcast`, each its own approval | Creates a GitHub Release on ukaoma/cos-starter (a tag, no branch push) with the ZIP and its SHA-256 file. |
+| `release-docs` | `ukaoma/cos-starter` `main` (`docs/`, GitHub Pages) | Pushes ukaoma/cos-starter main (docs/): republishes the public COS docs. |
+
+The npm release flow as practised also commits the release files to the server repo and pushes its `main`
+(cos-glasses skill, step 5). That push is NOT part of an npm approval: it is a code `main`, typed at the desk.
 
 ### Handoff from Control Web (3143) to the signer (3144), Phase 3
 
@@ -324,8 +350,8 @@ mirror) and refuses on difference; `approval.epoch` and `envelope.epoch` must eq
 `credentials`, `payment-details`, `moving-money`, `deleting-data`, `sending-messages`,
 `security-or-permission-settings`, `harness-permission-prompts`, `authority-rule-changes`.
 For `message` scope it also includes `install`, `publish`, `push-main`, `push-branch`, `hub-file`.
-For `approve` scope it also includes every action other than the signed one, and
-`other-artifact-version-digest-or-channel`.
+For `approve` scope it also includes every action other than the signed one (`push-main` always, though it is not
+signable), and `other-artifact-version-digest-or-channel`.
 
 **Attachments:** until `shared/turn-files-block.ts` exists, the verifier refuses any non-empty
 `envelope.attachments`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "7.0.29",
+  "version": "7.0.30",
   "description": "COS Glasses: self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {

package/server/lib/provider-failure-text.ts

@@ -6,7 +6,10 @@
  * process machinery. Leaf module: no imports.
  */
 export const PROVIDER_QUOTA_RE = /usage[ _]limit|hit your (?:usage |session )?limit|session limit|rate.?limit|too many requests|\b429\b|\bquota\b|resets? (?:at|in) |over capacity|overloaded|\b529\b|plan limit/i
-export const PROVIDER_AUTH_RE = /not logged in|please (?:log ?in|sign in)|invalid api key|authentication|unauthori[sz]ed|\b401\b|\b403\b|login required|token (?:has )?expired|no credentials/i
+export const PROVIDER_AUTH_RE = /not logged in|failed to authenticate|please (?:log ?in|sign in)|invalid api key|authentication|unauthori[sz]ed|\b401\b|\b403\b|login required|token (?:has )?expired|no credentials/i
+// "Failed to authenticate" (7.0.30): claude -p says "Failed to authenticate: OAuth session expired and could not
+// be refreshed" for an expired sign-in, which matched none of the words above, so the reason fell back to
+// "provider process exited N". The four messages Claude Code documents are pinned in provider-failure-text.test.ts.
 export const PROVIDER_OVERFLOW_RE = /prompt is too long|context window|too many tokens|exceeds the (?:model|context)/i
 
 /** Codes a provider bridge raises when it has nothing better to say. Only these are upgraded. */

package/server/lib/web-key-authority.ts

@@ -35,7 +35,7 @@ import {
 
 export const WEB_ENVELOPE_HEADER = 'x-cos-web-envelope'
 export const WEB_SIGNATURE_HEADER = 'x-cos-web-sig'
-/** Exact scoped install/publish only. Push-main remains refused (`approve_action_not_enabled`). */
+/** Exact scoped install/publish only. Push-main is not expressible at all (APPROVE_ACTIONS, Miles 2026-11-12). */
 export const WEB_KEY_ENABLED_APPROVE_ACTIONS: ReadonlySet<string> = new Set(['install', 'publish'])
 
 /** The served-asset integrity state the authority reads (review W1). Null: integrity is not running. */

package/server/lib/web-key-registry.ts

@@ -779,7 +779,7 @@ export class WebKeyPackets {
    * session that created its packet.
    */
   create(input: Record<string, unknown>, creator: { provider: unknown; sessionId: unknown } | null): { ok: true; packet: WebApprovalPacket; packetSha256: string } | { ok: false; reason: 'action_not_allowed' | 'invalid_packet' | 'packet_cap_reached' | 'session_from_context_only' | 'creator_unknown' } {
-    // The closed action list: install, publish, push-main. Every never-list action is refused here.
+    // The closed action list: install and publish (push-main is never signable by phone, 2026-11-12). Every never-list action is refused here.
     if (typeof input.action !== 'string' || !APPROVE_ACTIONS.has(input.action)) return { ok: false, reason: 'action_not_allowed' }
     if ('provider' in input || 'sessionId' in input) return { ok: false, reason: 'session_from_context_only' }
     // Strict patterns plus the action-to-channel table (shared/web-turn-envelope.ts).

package/server/lib/web-key-signer-tls.ts

@@ -178,6 +178,7 @@ export const SIGNER_TLS_REASONS = Object.freeze([
   'stored_owner',
   'stored_writable',
   'stored_too_large',
+  'stored_readable',
 ] as const)
 
 export type SignerTlsReason = typeof SIGNER_TLS_REASONS[number]
@@ -377,13 +378,22 @@ function firstLine(s: string): string {
   return (s.split('\n').find(l => l.trim()) ?? '').replace(/[^\x20-\x7e]/g, '').slice(0, 160)
 }
 
-type StoredRefusal = 'stored_symlink' | 'stored_not_file' | 'stored_owner' | 'stored_writable' | 'stored_too_large'
+type StoredRefusal = 'stored_symlink' | 'stored_not_file' | 'stored_owner' | 'stored_writable' | 'stored_too_large' | 'stored_readable'
 type StoredRead = { kind: 'none' } | { kind: 'refused'; reason: StoredRefusal } | { kind: 'ok'; text: string }
 
-/** SR-08: the owner and mode rules shared by the folder and each file. */
-function ownerOrModeRefusal(uid: number, mode: number, ownerUid: number | null): StoredRefusal | null {
+/**
+ * SR-08: the owner and mode rules shared by the folder and each file.
+ *
+ * `secret` (security review 2026-11-12, finding 5): the folder and the private key may carry no group or other
+ * bits at all, read and search included, so a key another user can read is never served. The certificate is
+ * public and the fetch state holds counts only, so there only write bits are refused. This server has written
+ * the folder 0700, the key 0600, the state 0600 and the certificate 0644 since the store was added (d4f3ee6,
+ * 2026-11-09), so no pair it wrote is refused by this rule.
+ */
+function ownerOrModeRefusal(uid: number, mode: number, ownerUid: number | null, secret = false): StoredRefusal | null {
   if (ownerUid !== null && uid !== ownerUid) return 'stored_owner'
   if ((mode & 0o022) !== 0) return 'stored_writable'
+  if (secret && (mode & 0o077) !== 0) return 'stored_readable'
   return null
 }
 
@@ -396,7 +406,7 @@ function storedDirRefusal(dir: string, ownerUid: number | null): 'none' | Stored
   if (!st) return 'none'
   if (st.isSymbolicLink()) return 'stored_symlink'
   if (!st.isDirectory()) return 'stored_not_file'
-  return ownerOrModeRefusal(st.uid, st.mode, ownerUid)
+  return ownerOrModeRefusal(st.uid, st.mode, ownerUid, true)
 }
 
 /**
@@ -404,7 +414,7 @@ function storedDirRefusal(dir: string, ownerUid: number | null): 'none' | Stored
  * (no swap between the check and the read): a regular file, owned by this server's user, not writable by
  * group or others, at most SIGNER_TLS_STORED_MAX_BYTES (read with that cap, never the whole file).
  */
-function readStoredFile(path: string, ownerUid: number | null): StoredRead {
+function readStoredFile(path: string, ownerUid: number | null, secret = false): StoredRead {
   const pre = lstatSync(path, { throwIfNoEntry: false })
   if (!pre) return { kind: 'none' }
   if (pre.isSymbolicLink()) return { kind: 'refused', reason: 'stored_symlink' }
@@ -420,7 +430,7 @@ function readStoredFile(path: string, ownerUid: number | null): StoredRead {
   try {
     const st = fstatSync(fd)
     if (!st.isFile()) return { kind: 'refused', reason: 'stored_not_file' }
-    const refusal = ownerOrModeRefusal(st.uid, st.mode, ownerUid)
+    const refusal = ownerOrModeRefusal(st.uid, st.mode, ownerUid, secret)
     if (refusal) return { kind: 'refused', reason: refusal }
     if (st.size > SIGNER_TLS_STORED_MAX_BYTES) return { kind: 'refused', reason: 'stored_too_large' }
     const buf = Buffer.alloc(SIGNER_TLS_STORED_MAX_BYTES + 1)
@@ -761,7 +771,7 @@ export class SignerTls {
       if (dir === 'none') { this.storedRefused = null; return }
       if (dir !== null) { this.storedRefused = dir; return }
       const cert = readStoredFile(join(this.deps.dir, SIGNER_TLS_CERT_FILE), this.ownerUid)
-      const key = readStoredFile(join(this.deps.dir, SIGNER_TLS_KEY_FILE), this.ownerUid)
+      const key = readStoredFile(join(this.deps.dir, SIGNER_TLS_KEY_FILE), this.ownerUid, true)
       if (cert.kind === 'none' || key.kind === 'none') { this.storedRefused = null; return }
       if (cert.kind === 'refused') { this.storedRefused = cert.reason; return }
       if (key.kind === 'refused') { this.storedRefused = key.reason; return }

package/server/web-control/.manifest.json

@@ -2,42 +2,42 @@
   "v": 1,
   "algorithm": "sha256",
   "files": {
-    "/app.css": "1204f3b57d312c94e96a1430ba036292873ecbe132073c8a4f03e37063172a70",
-    "/app.js": "1491f6dd957f47881e55a47caf98a3ce8fcb6df43a58b6e6877dd86807bebea6",
+    "/app.css": "bc5e29be841629261889aebfd439a3b126a50041c4e079c9866eac93a3552fe1",
+    "/app.js": "eb9e4b98ddf4982644c57ce7de11fb9a606e245b5e2169bb25adbe825c05773d",
     "/apple-touch-icon.png": "04ec7eca0bf6f53d89900d146ac32d4826759d6258bcdbd1ccdcc517f26f532c",
-    "/control.css": "e7b287aa4acc1b3895a9ce61512fe449c555b6335a7145684fd78108ae008c75",
+    "/control.css": "f5b7a2e0f800cc07072581b7e817fcd2b54bdb1d91f4662a3cdc9d80a7bc32ff",
     "/fonts/DMSans.ttf": "8cd08d97e89c24d0aa92edd2f0f4c8ee6195eee9b7c9f154865a58b02f0c1c0d",
     "/fonts/Fraunces.ttf": "177ff6c0f14e5550a3c624247cd1189611d4eb65d000b14944c63d967958abbb",
     "/fonts/JetBrainsMono.ttf": "48715a42ec242c21e9f02692891e147d022299a52e48d5e413e1a942193ffeda",
-    "/index.html": "8664ebf9ae7635c1fcf5fce333b89d272b6ce0df9529120523b99a3d49eb5ebb",
+    "/index.html": "c3a88479e5b9efa323129c5a425dada70dc7f0f27a0c787c1bc225c661f20a7b",
     "/mark.svg": "8e380d33d393027df192eb1afa08f15a380c2070c72d68f27311b49d9e94ca18",
     "/memories/d3.min.js": "f2094bbf6141b359722c4fe454eb6c4b0f0e42cc10cc7af921fc158fceb86539",
     "/memories/graph-explorer.css": "ec128de59811f45c71b6bededd737989309205e903951eb8211ade7664f87486",
     "/memories/graph-explorer.js": "98bde3df25f42022b098d047d2c8e7a22b972c1d817a18a24a0ab075d77871d3",
     "/memories/memory-workspace.js": "013f6c8c72c3474768f8c374edccde0e3656fc243e56528e258c3c29acca64f5",
     "/memory-review.js": "f27fe519f7ad7eccc3b44124fae724aa51e2eb3cb060d2f1795600e0e41b074f",
-    "/panes/cos-chat.css": "29a5d22d0f02d0707e65711d151ad7c8ac0ab4bfeb30ab04b1f9d9fcf7d457b8",
-    "/panes/cos-chat.js": "0005562525cab6353ef8fc002d7960b30a8bf9fc9a9a1059c0123c6cf343366e",
+    "/panes/cos-chat.css": "079af47855641bf21aae75c34727f7c7be4357e0dde4ed78414d0e60776b71d4",
+    "/panes/cos-chat.js": "b94fca907500be21f777c5d5fa23b7415be48dcbd41d9fa30a4295ed1e3415d3",
     "/panes/dictation.js": "e9434b353a1a3ab3f21d4cef5b2d5f927a733f6af5f58285fda6a78472761f91",
-    "/panes/meetings.css": "3ad4d0c5d59bd9f21c5ac9e234437cc0c81b381bd98ca4634b147efba5105a53",
-    "/panes/meetings.js": "e3839cd7d52c98510ca232e41d3a336806d740b4a1381eab1a367d56a765f925",
+    "/panes/meetings.css": "635470e4d5f5665b046eab7382734c9772df569069c9b1eb10cfde6151014bfa",
+    "/panes/meetings.js": "e057f4dae697138111a4c07e8ec6c2a0502b5d93023cf491460bc7bf20172c85",
     "/panes/memories.css": "36731d6fd21ad1516dfeccf34fe5b2d3d267d21e40b47704055a0685334b579e",
-    "/panes/memories.js": "28461f953ad0bf9d13287039594f2ce7ea29a46366e249240fa50f4b0f3b8c31",
-    "/panes/messages.js": "be7a7b294f67a43fcb4cc518da987d2da2990484cb677ada810afa93af25a8a5",
+    "/panes/memories.js": "66341dd5126c40275979d1c40f8db72e1f8229ac9634a4bb72b70140db277f2a",
+    "/panes/messages.js": "7262ad82b6337a610b11ffff0677663e9317d1fe537f9e4161ae3af1ddef35ef",
     "/panes/preview.js": "79f1aecb27f48d584ed4cf37c7f4f423f0f9b45dd6c2fb24a9d88c72625d8680",
     "/panes/questions.css": "5c5a9b32ce32386b508ce326b17d40ecacbb0f2e049df7f4fe2a0009bd3b7908",
     "/panes/questions.js": "228e8cd0a9651a290cbb380db487af677a2fc7e93a64b1e33c9411cd8b013478",
     "/panes/reader-media.js": "4cf892a855aa2d0dce6978e69296cd49b8036d8fc62f12773b3fcadc210b2ef0",
     "/panes/sessions.css": "654e0509ab2b699b9ea92b6d9e2f7522146df1f0b6355915bef03caaf63addc4",
-    "/panes/settings.js": "5c46c951fdcc2fc942486ec4b468b7e0bb0350a0a56a38d429948fc5147ab2f4",
+    "/panes/settings.js": "315458c5911f31592853800418dde6d87e9e61bbe96f90c77450c94f87d01951",
     "/panes/speakers.css": "49e70dae4266151b14b0057f2e43de169de225b8f3ac30343c81cf532735a487",
-    "/panes/speakers.js": "8132c9244fb3965de802680840d2985978571988b9b4462b347d079330251bc5",
+    "/panes/speakers.js": "e4fbcc147c44f8bf798e0694e0c8b152d5cde82dc46823641c8e8d37714b8fba",
     "/panes/threads.js": "45fd7b56480be53225e91193cfa4c41a4ee7167890f10560e439bc7d2461747f",
     "/panes/today-actions.css": "c82f95b2aaf09802b15d47b24eccdb5c974afcab38ff5f861b3a8d8630b60869",
-    "/panes/today-actions.js": "57ae8b378b1061060ae2a3f61d227d440d7806538085c1d5b310239c036e4bdc",
+    "/panes/today-actions.js": "c767b62b21a9f1debffd6e4ff4558891222b573535de1d78849b602030bb09bd",
     "/panes/work.css": "da50355dac690f712d1f6331f70ee5eadbf5982d37508648ae7786afc99ac7b1",
-    "/panes/work.js": "1ef872b8c7e1a57bd7bd314e11eee7ac5fa9668871da7e644a1fbf5fd9c0d9e8",
-    "/shell.js": "f1cc6a52c78e01ddba89ff27c6bd0e8f8bd8f29bdfcbb5150ee4ed66a8128d9d",
+    "/panes/work.js": "913c56084a6df463cc83358ce360da30d529466f1c583683fd3a4fd5eafe2d30",
+    "/shell.js": "cc7d0d771712607d4ba49eb1cfc83c50c7fcae2203f1c386778fee43d1803a81",
     "/theme.js": "e3e6422eaac43979d03149da114f5b83757b7361dd7b309cdf76be36a596044b",
     "/vendor/qrcode-encoder.js": "61d87cc7445cc66b862cff913de4571634746ea62bcd50d0f592be14f6d1ce46"
   }

package/server/web-control/app.css

@@ -206,8 +206,9 @@ select.field {
 
 /* No bottom bar, on purpose. On a phone the browser owns the bottom edge (Safari's floating
    address pill, Comet's and Chrome's own bars), and iOS 26 WebKit stops drawing the page under
-   its bar while any fixed element sits within ~60px of it. Navigation lives in the top bar
-   (folded screen) or the left rail (unfolded screen and up). */
+   its bar while any fixed element sits within ~60px of it. Navigation lives in the top bar (phones),
+   the side rail at the right edge (a short screen under 600 px: the folded Duo, html.short-screen),
+   or the left rail (600 px and up). */
 .badge-dot { position: absolute; width: 7px; height: 7px; border-radius: 50%; background: var(--hot); }
 
 .rail { display: none; }
@@ -702,8 +703,9 @@ html { touch-action: manipulation; }
   html.short-screen .rail-back:active { background: var(--rail-border); }
   /* The focus ring sits inside the button: the rail clips anything past its edge. */
   html.short-screen .rail :focus-visible { outline: 2px solid var(--accent); outline-offset: -4px; border-radius: 12px; }
-  /* One way to switch panes on a screen: the rail. The top bar keeps the pane's name, without the caret and its menu
-     (app.js makes the button inert), and its Back moves to the rail. */
+  /* One way to switch panes on a screen: the rail. On a list the top bar keeps the pane's name, without the caret and
+     its menu (app.js makes the button inert); on a reader its Back moves to the rail and the left of the top bar is
+     empty. */
   html.short-screen .section-btn .caret, html.short-screen #topbar-back { display: none !important; }
   html.short-screen .section-btn { cursor: default; }
 }

package/server/web-control/app.js

@@ -573,6 +573,133 @@
     var hash = '#/' + [pane].concat(args || []).map(encodeURIComponent).join('/');
     if (location.hash === hash) route(); else location.hash = hash;
   }
+  // ── Back by path (7.0.30, item 1: Anand on the 11-12 HC call, Miles's pick) ──
+  // Back goes where the person came from. Each address this page makes is marked in its own history entry
+  // (history.state.cosNav): this page load's id, the entry's position, and the address it came from. Back is then the
+  // browser's own Back (history.back), so the system Back and ours agree and Back adds no entry. With no mark (a deep
+  // link, a reload, the first page, or an entry an overlay took over), Back keeps the parent chain it always had, and it
+  // REPLACES the entry rather than adding one, so the two can never bounce between each other. The image viewer and
+  // Today's sheet push entries of their own (cosImageViewer, cosTodayOverlay): those are never marked, never stepped into,
+  // and an address made while one of them still sat behind gets no mark, because the entry behind it is not an address
+  // (its position is not the last address's position plus one).
+  var NAV = { doc: Math.random().toString(36).slice(2, 10), last: null, replace: null };
+  function navState() { try { return history.state; } catch (_e) { return null; } }
+  function navOverlay(st) { return !!(st && (st.cosImageViewer || st.cosTodayOverlay)); }
+  function navStamp() {
+    if (typeof history === 'undefined' || !history || typeof location === 'undefined') return;   // a page without them: the parent chain
+    var hash = location.hash || '', st = navState(), pos;
+    if (navOverlay(st)) { NAV.last = null; NAV.replace = null; return; }
+    if (st && st.cosNav && st.cosNav.doc === NAV.doc) { NAV.last = { hash: hash, pos: st.cosNav.pos, back: st.cosNav.back, trail: st.cosNav.trail || null, label: st.cosNav.label || '' }; NAV.replace = null; return; }
+    if (st && st.cosNav) {
+      // Marked by an earlier load of this page (a reload): what lies behind it belongs to that load, so no path.
+      pos = st.cosNav.pos;
+    } else if (st) { NAV.last = null; NAV.replace = null; return; }   // someone else's state: leave it alone
+    else pos = NAV.replace ? NAV.replace.pos : history.length - 1;
+    var back = null;
+    if (!st && !NAV.replace && NAV.last && typeof NAV.last.pos === 'number' && pos === NAV.last.pos + 1) back = NAV.last.hash;
+    NAV.replace = null;
+    // 7.0.30, Miles's pick B: the steps before this one ride in the same mark, the last of them being where Back goes.
+    var trail = back ? (NAV.last.trail || []).concat([{ h: NAV.last.hash, t: NAV.last.label || '' }]).slice(-NAV_TRAIL_MAX) : null;
+    var mark = { doc: NAV.doc, pos: pos, back: back };
+    if (trail) mark.trail = trail;
+    try { history.replaceState(Object.assign({}, st || {}, { cosNav: mark }), ''); } catch (_e) { /* no history API: the parent chain */ }
+    NAV.last = { hash: hash, pos: pos, back: back, trail: trail, label: '' };
+  }
+  var NAV_TRAIL_MAX = 12;
+  // The page's own name, kept in its mark, so the next page's trail can name it. setCrumb calls this.
+  function navLabel(text) {
+    var st = navState();
+    if (navOverlay(st) || !st || !st.cosNav || st.cosNav.doc !== NAV.doc || (st.cosNav.label || '') === text) return;
+    try { history.replaceState(Object.assign({}, st, { cosNav: Object.assign({}, st.cosNav, { label: text }) }), ''); } catch (_e) { return; }
+    if (NAV.last && NAV.last.pos === st.cosNav.pos) NAV.last.label = text;
+  }
+  // The way he came, oldest first, from this entry's mark: [{ label, hash, back }], back being how many steps back that
+  // one is. Null when Back has no path (a deep link, a reload, the first page, an overlay).
+  function navTrail() {
+    var st = navState();
+    if (navOverlay(st) || !st || !st.cosNav || !st.cosNav.back || !st.cosNav.trail || !st.cosNav.trail.length) return null;
+    var t = st.cosNav.trail;
+    return t.map(function (s, i) { return { label: trailName(s.h, s.t), hash: s.h, back: t.length - i }; });
+  }
+  // A step is named by what kind of page it is, not its title (the title is the heading under the row): "Meeting",
+  // "Session", "Naming voices". A list is its pane. A message, a day and a chat keep their own short name.
+  function trailName(hash, crumb) {
+    var a = String(hash || '').replace(/^#\/?/, '').split('/').filter(function (x) { return x !== ''; }), p = ROOT_PANES.indexOf(a[0]) >= 0 ? a[0] : 'today';
+    if (a.length < 2 || isTabRoute(a.slice(1))) return TITLES[p] || 'Today';
+    if (p === 'meetings') return 'Meeting';
+    if (p === 'sessions') return 'Session';
+    if (p === 'speakers' && a[1] === 'review') return 'Naming voices';
+    return crumb || TITLES[p] || 'Today';
+  }
+  // One line that never wraps. When it is too wide, steps leave from the middle (the one after the first, then the next),
+  // never the first, the one before this page, or this page; "…" stands where they were. widths: each step's, then this
+  // page's; more: the width "…" adds. Returns the indexes to leave out.
+  function trailCut(widths, more, avail) {
+    var n = widths.length - 1, total = widths.reduce(function (a, b) { return a + b; }, 0), cut = [];
+    if (total <= avail) return cut;
+    total += more;
+    for (var i = 1; i < n - 1 && total > avail; i++) { cut.push(i); total -= widths[i]; }
+    return cut;
+  }
+  // The row under the top bar, on a phone (below 600 px; wider screens have the navigation bar's crumbs). Only on a page
+  // you opened (a reader, a meeting, a session), and only when there is a path.
+  function paintTrail(r) {
+    var el = typeof document !== 'undefined' && document.getElementById('nav-trail');
+    if (!el) return;
+    r = r || parseRoute();
+    var steps = r.args.length && !isTabRoute(r.args) ? navTrail() : null;
+    if (!steps) { el.hidden = true; el.innerHTML = ''; return; }
+    var here = trailName(location.hash, crumbDetail);
+    el.innerHTML = '<ol>' + steps.map(function (s, i) {
+      return '<li class="trail-step"><a href="' + esc(s.hash) + '" data-trail-back="' + s.back + '">' + esc(s.label) + '</a></li>' +
+        (i === 0 ? '<li class="trail-more" aria-hidden="true" hidden>…</li>' : '');
+    }).join('') + '<li class="trail-here" aria-current="page"><span>' + esc(here) + '</span></li></ol>';
+    el.hidden = false;
+    var items = Array.prototype.slice.call(el.querySelectorAll('.trail-step,.trail-here')), more = el.querySelector('.trail-more');
+    if (!more || !el.clientWidth) return;
+    el.classList.add('trail-fit');   // each step at its full width, to measure
+    more.hidden = false;
+    var moreW = more.offsetWidth, widths = items.map(function (li) { return li.offsetWidth; });
+    more.hidden = true;
+    el.classList.remove('trail-fit');
+    var cut = trailCut(widths, moreW, el.clientWidth);
+    // A left-out step stays for a screen reader but takes no keyboard focus (Q1 L1): it is not on screen.
+    cut.forEach(function (i) { items[i].classList.add('trail-cut'); var a = items[i].querySelector('a'); if (a) a.setAttribute('tabindex', '-1'); });
+    more.hidden = !cut.length;
+  }
+  // Where Back goes from here: { pane, path } (path true: the way he came; false: the parent chain).
+  function navBackTo() {
+    var st = navState();
+    // navStamp has run on this entry (every landing routes), so its mark is this load's: an earlier load's was re-marked
+    // with no path there.
+    if (!navOverlay(st) && st && st.cosNav && st.cosNav.back) {
+      var p = String(st.cosNav.back).replace(/^#\/?/, '').split('/')[0];
+      return { pane: ROOT_PANES.indexOf(p) >= 0 ? p : 'today', path: true };
+    }
+    var r = parseRoute(), up = PANES[r.pane] && PANES[r.pane].up ? PANES[r.pane].up(r.args) : null;
+    return { pane: up || (r.args.length && !isTabRoute(r.args)) ? r.pane : 'today', path: false };
+  }
+  // The one way this page replaces an address (W.replace for the panes; Q1 7.0.30 H1). It tells navStamp the entry was
+  // replaced, never pushed, so a replaced entry never gets a path: a pane switching a tab with location.replace after a
+  // Back (a forward entry left) was stamped as a push at history.length - 1, and Back then called history.back() from
+  // the first entry, out of the app. Its position is this entry's mark, or one above the last mark when an overlay's
+  // entry (Today's sheet, the image viewer) is the one replaced. Returns false, doing nothing, when the address is the
+  // same (location.replace would not route, and the flag would wrongly mark the next address).
+  function navReplace(hash) {
+    if (location.hash === hash) return false;
+    var st = navState(), pos;
+    if (navOverlay(st)) pos = NAV.last && typeof NAV.last.pos === 'number' ? NAV.last.pos + 1 : history.length - 1;
+    else pos = st && st.cosNav && typeof st.cosNav.pos === 'number' ? st.cosNav.pos : history.length - 1;
+    NAV.replace = { pos: pos };
+    try { location.replace(location.pathname + location.search + hash); } catch (_e) { NAV.replace = null; location.hash = hash; }
+    return true;
+  }
+  // The parent chain, replacing this entry (never adding one).
+  function goReplace(pane, args) {
+    var hash = '#/' + [pane].concat(args || []).map(encodeURIComponent).join('/');
+    if (!navReplace(hash)) route();
+  }
+  // ── end back by path
   // 7.0.2 (A8): a phone is under 600 px wide, or a short touch screen at any width (the unfolded Duo is 951x539 in
   // Comet): height is its scarce axis, so it gets the phone Ask sheet and the 44 px tap floor (app.css), as folded does.
   var SHORT_TOUCH_MQ = '(pointer: coarse) and (max-height: 720px)';
@@ -639,6 +766,7 @@
     return !!(e.metaKey || e.ctrlKey || keyboardFirst());
   }
   function route(forceChanged) {
+    if (typeof navStamp === 'function') navStamp();
     var r = parseRoute();
     var changedPane = forceChanged === true || r.pane !== state.pane || !document.querySelector('#pane-' + r.pane + ':not(.hidden)');
     if (state.pane !== r.pane && PANES[state.pane] && PANES[state.pane].leave) { try { PANES[state.pane].leave(); } catch (err) { console.error(err); } }
@@ -664,8 +792,18 @@
     var railBack = $('rail-back');
     if (railBack) railBack.hidden = !reading;
     $('section-btn').classList.toggle('hidden', reading);
-    $('topbar-back-label').textContent = TITLES[r.pane] || 'Back';
+    // 7.0.30: Back names where it goes, the way he came or the parent (navBackTo).
+    var backTo = typeof navBackTo === 'function' ? navBackTo() : { pane: r.pane };
+    $('topbar-back-label').textContent = TITLES[backTo.pane] || 'Back';
+    var topBack = $('topbar-back');
+    if (topBack && topBack.setAttribute) topBack.setAttribute('aria-label', 'Back to ' + (TITLES[backTo.pane] || 'the list'));
+    if (railBack && railBack.setAttribute) railBack.setAttribute('aria-label', 'Back to ' + (TITLES[backTo.pane] || 'the list'));
+    // From 600 px Back is the navigation bar's (shell.js): its word stays "Back", as on the Mac's bar, and its name and
+    // tooltip say where it goes, as the rail's do (7.0.30 counted run, items_check B1 and B2 at the open Duo).
+    var navBack = $('nav-back');
+    if (navBack && navBack.setAttribute) { navBack.setAttribute('aria-label', 'Back to ' + (TITLES[backTo.pane] || 'the list')); navBack.setAttribute('title', 'Back to ' + (TITLES[backTo.pane] || 'the list')); }
     $('section-name').textContent = TITLES[r.pane] || 'Today';
+    if (typeof paintTrail === 'function') paintTrail(r);
     closeMenu();
     if (changedPane) window.scrollTo(0, 0);
     $('topbar').classList.remove('tucked');
@@ -701,26 +839,32 @@
     runHooks(routeHooks, r);
   }
   function runHooks(list, arg) { list.forEach(function (fn) { try { fn(arg); } catch (err) { console.error(err); } }); }
-  // Back unwinds one step, the way Control's Back does: a pane module may name the step above a
-  // nested reader (an archive chat goes back to its day, not to the list).
+  // Back (7.0.30): the way he came, when this page made the entry behind (navBackTo). Otherwise one step up, the way
+  // Control's Back does: a pane module may name the step above a nested reader (an archive chat goes back to its day,
+  // not to the list), replacing this entry.
   function goBack() {
+    if (typeof navBackTo === 'function' && navBackTo().path) { history.back(); return; }
     var r = parseRoute();
     var up = PANES[r.pane] && PANES[r.pane].up ? PANES[r.pane].up(r.args) : null;
-    if (up) go(r.pane, up);
-    else if (r.args.length && !isTabRoute(r.args)) go(r.pane);
-    else go('today');
+    var step = typeof goReplace === 'function' ? goReplace : go;
+    if (up) step(r.pane, up);
+    else if (r.args.length && !isTabRoute(r.args)) step(r.pane);
+    else step('today');
   }
   // '#/<pane>/t/<tab>' is the pane's list on one of its tabs, not a reader: the phone keeps the section switcher and Back
   // leaves the pane. Memories keeps its tab in the address this way, so a reload or a new browser lands on the same tab.
   function isTabRoute(args) { return args.length === 2 && args[0] === 't'; }
-  // On the closed Duo every vertical pixel counts: the top bar slides away while you scroll
-  // down and comes back the moment you scroll up.
+  // On a phone every vertical pixel counts: the top bar slides away while you scroll down a list and comes back the
+  // moment you scroll up. 7.0.30 (item 1): never on a reader, where the top bar holds Back, so Back stays in reach on a
+  // tall phone however far down he reads.
   var lastY = 0;
   function onScroll() {
     var y = Math.max(0, window.scrollY || 0);
-    var bar = $('topbar');
+    // On a reader the bar stays (its Back is there). The folded Duo's Back is on the side rail (the bar's is hidden by CSS,
+    // not the class), so there the bar tucks as before (Q1 7.0.30 M1).
+    var bar = $('topbar'), back = $('topbar-back'), onReader = !!(back && !back.classList.contains('hidden')) && !(typeof sideRail === 'function' && sideRail());
     bar.classList.toggle('scrolled', y > 8);
-    if (y < 60 || y < lastY - 4) bar.classList.remove('tucked');
+    if (y < 60 || y < lastY - 4 || onReader) bar.classList.remove('tucked');
     else if (y > lastY + 4 && isPhone()) bar.classList.add('tucked');
     lastY = y;
   }
@@ -760,7 +904,7 @@
     // 7.0.23 regression (lapse_check, 08:2x): a frame class left on keeps html and body at one screen with overflow
     // hidden, so the gate could not scroll and Connect sat below a keyboard-height screen. The gate is a normal page;
     // showShell's route() puts the frame back (sxFrameSync) when the shell returns.
-    document.documentElement.classList.remove('sx-frame', 'mx-frame');
+    document.documentElement.classList.remove('sx-frame');
     // A later 401 from a pane still polling (W.api passes no message) must not blank what the gate already says:
     // the reason it opened, or "That code did not match" while the person retypes.
     if (!message && alreadyOpen) return;
@@ -2588,7 +2732,7 @@
       var dest = session ? ['sessions', s[0], s.slice(1).join('|')] : kind === 'pet' ? ['sessions'] : ['work'].concat(kind === 'need' ? [] : ['sort']);
       console.error('[today] the overlay did not open (' + kind + '); opening ' + dest.join('/') + ' instead.', err);
       toast(session ? 'Could not open that here. Opening the session.' : kind === 'pet' ? 'Could not open that here. Opening Sessions.' : 'Could not open that here. Opening it in Work.');
-      if (history.state && history.state.cosTodayOverlay) location.replace('#/' + dest.map(encodeURIComponent).join('/'));
+      if (history.state && history.state.cosTodayOverlay) navReplace('#/' + dest.map(encodeURIComponent).join('/'));
       else go(dest[0], dest.slice(1));
     });
   }
@@ -5591,7 +5735,7 @@
   // estimates into them, and its rows keep Control's category titles.
   function loadUsage() {
     SX.view = 'usage'; sxSave();
-    location.replace('#/sessions');
+    navReplace('#/sessions');
   }
   function renderUsageView(force) {
     var box = $('sessions-usage'); if (!box) return;
@@ -7366,11 +7510,13 @@
 
   // ── events (one delegated listener) ─────────────────────
   document.addEventListener('click', function (e) {
-    var t = e.target.closest('[data-today-next],[data-next-prep],[data-next-prep-cancel],[data-next-prep-remove],[data-today-needs],[data-today],[data-goto],[data-pane],[data-session],[data-meeting],[data-speakers],[data-action],[data-open-ask],[data-theme-choice],#topbar-back,#rail-back,#section-btn,#sign-out,#copy-link,#ask-close,#auth-switch,#auth-token-show,#auth-retry,#device-code-btn');
+    var t = e.target.closest('[data-today-next],[data-next-prep],[data-next-prep-cancel],[data-next-prep-remove],[data-today-needs],[data-today],[data-goto],[data-pane],[data-session],[data-meeting],[data-speakers],[data-action],[data-open-ask],[data-theme-choice],[data-trail-back],#topbar-back,#rail-back,#section-btn,#sign-out,#copy-link,#ask-close,#auth-switch,#auth-token-show,#auth-retry,#device-code-btn');
     if (!t) { if (e.target.id === 'ask-sheet') closeAsk(); if (e.target.id === 'section-menu') closeMenu(); return; }
     var inSheet = !!t.closest('#ask-sheet');
     if (t.id === 'topbar-back') return goBack();
     if (t.id === 'rail-back') return goBack();
+    // 7.0.30 (pick B): a trail step is the browser's own Back, that many steps.
+    if (t.hasAttribute('data-trail-back')) { e.preventDefault(); history.go(-Number(t.getAttribute('data-trail-back'))); return; }
     if (t.id === 'section-btn') return openMenu();
     if (t.id === 'auth-retry') { t.disabled = true; t.textContent = 'Checking'; bootStatus().then(function () { t.disabled = false; t.textContent = 'Try again'; }); return; }
     if (t.id === 'auth-switch') {
@@ -7786,7 +7932,7 @@
     plural: plural, countWord: countWord, dayWord: dayWord, plainDay: plainDay, providerLabel: providerLabel, domainLabel: domainLabel,
     skeletonRows: skeletonRows, emptyBox: emptyBox, setStatus: setStatus, autoGrow: autoGrow,
     readStore: readStore, writeStore: writeStore, copyText: copyText, isPhone: isPhone,
-    state: state, titles: TITLES, go: go, parseRoute: parseRoute, goBack: goBack,
+    state: state, titles: TITLES, go: go, replace: navReplace, parseRoute: parseRoute, goBack: goBack,
     registerPane: function (name, def) { PANES[name] = def; },
     sessionList: sessionList,
     petPrefs: petPrefs,
@@ -7796,7 +7942,7 @@
     onShell: function (fn) { shellHooks.push(fn); },
     // The detail title after "COS Control > Section" (Control's breadcrumb). Pane modules set it
     // once a detail has loaded; route() clears it on every navigation.
-    setCrumb: function (text) { crumbDetail = String(text || ''); runHooks(routeHooks, parseRoute()); },
+    setCrumb: function (text) { crumbDetail = String(text || ''); navLabel(crumbDetail); paintTrail(); runHooks(routeHooks, parseRoute()); },
     crumb: function () { return crumbDetail; },
     // Panes that read with their own fetch call this on a 401 so the sign-in screen shows.
     showAuth: function (message) { showAuth(message); },

package/server/web-control/control.css

@@ -1,7 +1,7 @@
 /* COS Control Web: Control's own chrome and pane kit, loaded after app.css.
    Measurements follow Control 0.5.366 (ActivityWindow.swift, COSBrand.swift): the 248pt rail with a
    story under each name from 1100px, the icon rail below that, the navigation bar off Today, and
-   the shared pane pieces (tinted hero, text switch with a gold rule, rows, tags, YOU/COS cards).
+   the shared pane pieces (tinted hero, text switch with a gold rule, rows, tags, and the reader's sides for who said what).
    Phone sizes are set for reading on the iPhone Duo; the desktop steps down toward Control's. */
 
 :root {
@@ -236,6 +236,18 @@
 .cx-card { background: var(--panel); border: 1px solid var(--panel-border); border-radius: 14px; padding: 12px 14px 14px; margin-bottom: 12px; }
 .cx-card.you { background: var(--qopen); }
 .cx-card-label { font: 600 9.5px/1 var(--mono); letter-spacing: 0.08em; color: var(--tertiary); margin-bottom: 8px; display: flex; justify-content: space-between; align-items: center; gap: 10px; }
+/* 7.0.30, Miles's pick A (who said what): sides, in the COS chat's shapes (.cc-bubble, .cc-line.cos). His bubble's edge
+   is opaque in light, gold 85% with ink, 3.48:1 against the page; the chat's 45% gold edge composites to 1.52:1 there.
+   Dark keeps the chat's edge as it is (2.79:1 composited). */
+:root { --said-edge: color-mix(in srgb, var(--gold) 85%, var(--ink)); }
+:root[data-theme='dark'] { --said-edge: color-mix(in srgb, var(--gold) 45%, transparent); }
+@media (prefers-color-scheme: dark) { :root:not([data-theme='light']) { --said-edge: color-mix(in srgb, var(--gold) 45%, transparent); } }
+.cx-said.you { display: flex; flex-direction: column; align-items: flex-end; margin: 4px 0 16px; }
+.cx-said-bubble { max-width: min(80%, 560px); background: color-mix(in srgb, var(--gold) 22%, var(--panel)); border: 1px solid var(--said-edge);
+  border-radius: 18px 18px 6px 18px; padding: 10px 14px; line-height: 1.45; }
+.cx-said-who { font-size: 12px; color: var(--sub); margin: 4px 4px 0; }
+.cx-said.cos { display: grid; grid-template-columns: 30px minmax(0, 1fr); gap: 10px; align-items: start; margin: 0 0 14px; }
+.cx-said-text { min-width: 0; }
 .cx-card-body { font-size: 15px; line-height: 1.5; color: var(--ink); overflow-wrap: anywhere; }
 /* md() keeps line breaks as text (shared with the session reader), so the body keeps them too. */
 .cx-card-body.md { white-space: pre-wrap; }
@@ -262,9 +274,27 @@
 .cx-find .cx-find-count { font: 400 11.5px/1 var(--mono); color: var(--sub); }
 .cx-find button { width: 30px; height: 30px; border-radius: 8px; border: 1px solid var(--panel-border); display: grid; place-items: center; color: var(--ink); }
 .cx-find button .icon { width: 14px; height: 14px; }
-.cx-turn.match .cx-card { background: color-mix(in srgb, var(--green) 7%, var(--panel)); }
+.cx-turn.match .cx-said-bubble, .cx-turn.match .cx-said-text { background: color-mix(in srgb, var(--green) 7%, var(--panel)); }
+.cx-turn.match .cx-said-text { border-radius: 10px; }
 @media (max-width: 599px) { .cx-find { top: calc(var(--topbar-h) + var(--safe-top)); } .cx-thumb { width: 132px; height: 92px; } }
 
+/* 7.0.30, Miles's pick B (how you got here): one plain row of text links under the top bar, on a phone only (from 600 px
+   the navigation bar has its crumbs). No box, border or label. It never wraps: steps leave from the middle (app.js
+   trailCut) and a long name ends in an ellipsis. A left-out step stays for a screen reader. */
+.trail { display: none; }
+@media (max-width: 599px) {
+  .trail:not([hidden]) { display: block; margin: 0 0 2px; }
+  .trail ol { display: flex; align-items: center; list-style: none; margin: 0; padding: 0; overflow: hidden; white-space: nowrap; font-size: 13.5px; color: var(--sub); }
+  .trail li { display: flex; align-items: center; min-width: 0; flex: 0 1 auto; }
+  .trail li + li::before { content: '/'; content: '/' / ''; flex: none; padding: 0 6px; color: var(--tertiary); }
+  .trail a, .trail-here span { display: block; min-width: 0; overflow: hidden; text-overflow: ellipsis; line-height: 32px; }
+  .trail a { color: var(--accent); }
+  .trail-here span { color: var(--ink); font-weight: 600; }
+  .trail .trail-more[hidden] { display: none; }
+  .trail.trail-fit li { flex-shrink: 0; }
+  .trail .trail-cut { position: absolute; width: 1px; height: 1px; overflow: hidden; clip: rect(0 0 0 0); }
+}
+
 /* ── Dictation and Dictionary ─────────────────────────── */
 .cx-pair { display: inline-flex; flex-wrap: wrap; align-items: center; gap: 6px; }
 .cx-pair .heard { color: var(--sub); text-decoration: line-through; text-decoration-color: color-mix(in srgb, var(--sub) 60%, transparent); }

package/server/web-control/index.html

@@ -173,6 +173,8 @@
       </header>
 
       <main class="workspace" id="workspace">
+        <!-- 7.0.30, Miles's pick B: how you got here, on a phone (app.js paintTrail), from Back's own marks. -->
+        <nav class="trail" id="nav-trail" aria-label="How you got here" hidden></nav>
         <!-- W1: the Mac not answering, and the sign-in ending soon (app.js "Mac reachability and sign-in lifetime") -->
         <div id="conn-notice" class="conn-notice" hidden></div>
         <!-- SESSION QUESTIONS (panes/questions.js, 6.99.12): over every pane while one waits -->

package/server/web-control/panes/cos-chat.css

@@ -215,7 +215,11 @@ html.kb-up .cc-kb .cc-model .field { width: 100%; }
 .cx-reply-sub { margin: 2px 0 0; font-size: 13px; line-height: 1.4; color: var(--sub); }
 .cx-reply-feed { min-height: 0; padding: 10px 0 0; }
 .cx-reply-feed:empty { display: none; }
-.cx-reply .cc-composer { position: static; background: transparent; border-top: 0; padding: 10px 0 0; }
+/* 7.0.30 item 2: the Reply box is the reader's last child, outside .cx-reply, so .cc-composer's own rule pins it to the
+   bottom of the screen (sticky, the page's colour, a hairline above). With the keyboard up for it (cos-chat.js sets
+   html.kb-reply; app.js publishes --vv-below, the layout viewport under the visible box) it sits on the keyboard, the
+   same way the chat's box does; the home indicator is under the keyboard, so its inset goes. */
+html.kb-reply .cx-reply-form { bottom: var(--vv-below, 0px); padding-bottom: 8px; }
 
 /* ── the Messages badge in the rail and the section menu ─ */
 .inbox-count { min-width: 18px; height: 18px; padding: 0 5px; border-radius: 9px; background: var(--hot); color: var(--panel); font: 600 11px/18px var(--body); text-align: center; }

package/server/web-control/panes/cos-chat.js

@@ -1549,8 +1549,11 @@
     return '<section class="cc cx-reply" data-reply-host="' + esc(key) + '" aria-label="' + esc(label) + '">' +
       '<h3 class="cx-reply-title">Reply</h3>' +
       '<p class="cx-reply-sub">' + esc(k.sessionId ? 'Continues this conversation. The answer lands in Messages with its own number.' : 'Starts a conversation. The answer lands in Messages with its own number.') + '</p>' +
-      '<div class="cc-feed cx-reply-feed" data-reply-feed="' + esc(key) + '" aria-live="polite">' + replyFeedHtml(key) + '</div>' +
-      composerHtml(k, { drop: false, placeholder: label, label: label }) + '</section>';
+      '<div class="cc-feed cx-reply-feed" data-reply-feed="' + esc(key) + '" aria-live="polite">' + replyFeedHtml(key) + '</div>' + '</section>' +
+      // 7.0.30 item 2 (Anand: "the reply box stays at the bottom"): the box sits OUTSIDE the section, as a child of the
+      // reader's column, so the composer's own sticky rule keeps it at the bottom of the screen while he reads the
+      // message above (a sticky box cannot leave its parent, and the section is only at the end of the page).
+      composerHtml(k, { drop: false, placeholder: label, label: label }).replace('class="cc-composer"', 'class="cc-composer cx-reply-form"');
   }
   function replyFeedHtml(key) {
     return C.asks.filter(function (a) { return a.replyKey === replyName(key); }).map(function (a) { return askHtml(a, false); }).join('');
@@ -2396,6 +2399,9 @@
     if (form && form.classList) form.classList.add('cc-kb');
     var inChat = !!(a && C.host && C.host.contains && C.host.contains(a));
     if (de && de.classList) de.classList.toggle('kb-chat', inChat);
+    // 7.0.30 item 2: the message reader's Reply box, the same kit (cos-chat.css lifts it onto the keyboard).
+    var inReply = !!(form && form.classList && typeof form.classList.contains === 'function' && form.classList.contains('cx-reply-form'));
+    if (de && de.classList) de.classList.toggle('kb-reply', inReply);
     return inChat;
   }
   // The composer that has the keyboard, brought into view on open and on every later change of the visible box (a fold
@@ -2403,7 +2409,7 @@
   // (a steer box or the search box is left where it is).
   function revealComposer() {
     var a = document.activeElement, de = document.documentElement;
-    if (!a || !de || !de.classList || !de.classList.contains('kb-chat')) return false;
+    if (!a || !de || !de.classList || !(de.classList.contains('kb-chat') || de.classList.contains('kb-reply'))) return false;
     var form = a.closest ? a.closest('[data-cos-form]') : null;
     if (!form || !form.scrollIntoView) return false;
     form.scrollIntoView({ block: 'nearest' });

package/server/web-control/panes/meetings.css

@@ -28,6 +28,10 @@
 .mt-day:not(:disabled):hover { background: var(--qopen); }
 .mt-day[aria-pressed='true'] { background: color-mix(in srgb, var(--tint) 18%, transparent); font-weight: 600; }
 .mt-day:focus-visible { outline: 2px solid var(--accent); outline-offset: -2px; }
+/* 7.0.30 item 4: today is marked with a ring in the theme's accent (no fill, so a picked day still reads as picked). */
+.mt-day.mt-today { box-shadow: inset 0 0 0 1.5px var(--accent); }
+.mt-day.mt-today .mt-dnum { font-weight: 600; }
+.mt-jump-row { margin: 0 2px 12px; }
 .mt-dot { width: 5px; height: 5px; border-radius: 50%; background: transparent; }
 .mt-dot.on { background: var(--tint); }
 .mt-all { margin-top: 8px; }

package/server/web-control/panes/meetings.js

@@ -525,10 +525,12 @@
     for (var w = 0; w < 7; w++) heads += '<span class="mt-wd" aria-hidden="true">' + esc(new Date(2023, 0, 1 + (ws + w) % 7).toLocaleDateString(undefined, { weekday: 'narrow' })) + '</span>';
     var cells = '', n = 0;
     for (var i = 0; i < lead; i++) { cells += '<span class="mt-blank"></span>'; n++; }
+    // 7.0.30 item 4: today is marked (a ring, aria-current) and can be picked even with no meetings.
+    var todayKey = dayKey(new Date());
     for (var day = 1; day <= dim; day++) {
-      var key = S.month + '-' + pad2(day), c = counts[key] || 0, on = S.day === key;
-      cells += '<button type="button" class="mt-day" data-mt="day" data-day="' + key + '" aria-pressed="' + on + '"' + (c === 0 ? ' disabled' : '') +
-        ' aria-label="' + esc(key + (c === 0 ? ', no meetings' : ', ' + c + ' meetings')) + '"><span class="mt-dnum">' + day + '</span><span class="mt-dot' + (c > 0 ? ' on' : '') + '"></span></button>';
+      var key = S.month + '-' + pad2(day), c = counts[key] || 0, on = S.day === key, isToday = key === todayKey;
+      cells += '<button type="button" class="mt-day' + (isToday ? ' mt-today' : '') + '" data-mt="day" data-day="' + key + '" aria-pressed="' + on + '"' + (isToday ? ' aria-current="date"' : '') + (c === 0 && !isToday ? ' disabled' : '') +
+        ' aria-label="' + esc(key + (isToday ? ', today' : '') + (c === 0 ? ', no meetings' : ', ' + c + ' meetings')) + '"><span class="mt-dnum">' + day + '</span><span class="mt-dot' + (c > 0 ? ' on' : '') + '"></span></button>';
       n++;
     }
     while (n % 7 !== 0) { cells += '<span class="mt-blank"></span>'; n++; }
@@ -594,6 +596,20 @@
       (m.sessionId ? pillsHtml(m, isNew(m.sessionId)) : '') + '</span><span class="chev"></span></button>';
   }
   function emptyBox(text) { return '<div class="cx-list"><p class="cx-empty mt-empty">' + esc(text) + '</p></div>'; }
+  // 7.0.30 item 4: today with no meetings says so in plain words, with one tap to the latest earlier day that has some
+  // (this month), or to last month when this month has none. The calendar stays as it is.
+  function latestDayBefore(key) {
+    var best = '';
+    (S.days || []).forEach(function (d) { if (num(d.count) > 0 && d.date < key && d.date > best) best = d.date; });
+    return best;
+  }
+  function emptyToday() {
+    var last = latestDayBefore(dayKey(new Date()));
+    var jump = last
+      ? '<button type="button" class="cx-btn quiet mt-jump" data-mt="jump-day" data-day="' + esc(last) + '">Go to ' + esc(W.plainDay ? W.plainDay(last) : last) + '</button>'
+      : '<button type="button" class="cx-btn quiet mt-jump" data-mt="month" data-delta="-1">Go to last month</button>';
+    return '<div class="cx-list"><p class="cx-empty mt-empty">No meetings today.</p><p class="mt-jump-row">' + jump + '</p></div>';
+  }
   function paintList() {
     var el = $('mt-list'); if (!el) return;
     var html;
@@ -611,6 +627,7 @@
       var rows = visibleRows();
       html = rows.length ? '<div class="cx-list">' + rows.map(function (m) { return rowHtml(m, false); }).join('') + '</div>' +
           (monthCapped() ? '<p class="mt-capnote">Showing the newest ' + S.rows.length + ' of ' + monthTotal() + ' in ' + esc(monthTitle(S.month)) + '. Pick a day in the calendar to see all of its meetings.</p>' : '')
+        : S.day && S.day === dayKey(new Date()) ? emptyToday()
         : emptyBox(S.day ? 'No meetings stored on ' + S.day + '. Pick another day, or show the whole month.' : 'No meetings stored in ' + monthTitle(S.month) + '.');
     }
     if (S.listHtml === html) return;
@@ -643,9 +660,10 @@
       S.days = days;
       var kept = S.dayRows; S.dayRows = {};
       if (S.day && kept[S.day]) S.dayRows[S.day] = kept[S.day];
+      // 7.0.30 item 4 (Miles 10:15: "Meetings should SHOW the current day"): the current month opens on today, with
+      // meetings or without (the list then says so and offers the latest day that has some).
       if (!S.autoDay && S.month === monthKey(new Date())) {
-        var today = dayKey(new Date());
-        if (days.some(function (x) { return x.date === today && num(x.count) > 0; })) S.day = today;
+        S.day = dayKey(new Date());
         S.autoDay = true;
       }
       S.error = ''; S.loading = false;
@@ -2089,7 +2107,7 @@
       var hit = lists.reduce(function (all, l) { return all.concat(l); }, []).filter(function (m) { return m.sessionId === f.sid || (m.g2SessionIds || []).indexOf(f.sid) >= 0; })[0];
       if (hit && S.view === 'live' && S.liveSid === f.sid) {
         S.rowsStale = true;
-        location.replace('#/meetings/' + [hit.domain, hit.month, hit.filename].map(encodeURIComponent).join('/'));
+        W.replace('#/meetings/' + [hit.domain, hit.month, hit.filename].map(encodeURIComponent).join('/'));
       } else if (!hit && f.endedAt && now - (f.retryAt || f.endedAt) >= FINAL_DEADLINE_MS + (f.start ? Math.max(0, f.endedAt - f.start) / 12 : 0)) {
         f.notFound = true; paintLiveHead();
       }
@@ -2667,6 +2685,7 @@
       case 'month': shiftMonth(Number(t.getAttribute('data-delta')) || 0); return;
       case 'day': { var d = t.getAttribute('data-day'); S.day = S.day === d ? null : d; S.autoDay = true; paintBrowse(); ensureDay(); return; }
       case 'all-month': S.day = null; S.autoDay = true; paintBrowse(); return;
+      case 'jump-day': { S.day = t.getAttribute('data-day'); S.autoDay = true; paintBrowse(); ensureDay(); return; }
       case 'clear': {
         S.q = ''; S.hits = null; S.ranFor = ''; S.searching = false; S.searchError = ''; clearTimeout(S.qTimer);
         var q = $('mt-q'); if (q) { q.value = ''; q.focus(); }

package/server/web-control/panes/memories.js

@@ -105,7 +105,7 @@
   function readerArgs(r) { return r.pane === 'memories' && !tabRoute(r.args) ? r.args : []; }
   function showTab(v) {
     var h = '#/memories/t/' + encodeURIComponent(v);
-    if (location.hash === h) paint(); else location.replace(h);
+    if (location.hash === h) paint(); else W.replace(h);
   }
   function isWide() { return !!(window.matchMedia && window.matchMedia('(min-width: 760px)').matches); }
   function el(id) { return document.getElementById(id); }
@@ -2262,7 +2262,7 @@
       // #/memories/view/<view> (older links) and a bare #/memories become the tab's own address; an unknown tab, the stored one.
       if (args[0] === 'view' || !args.length || (args[0] === 't' && !knownView(args[1]))) {
         if (args[0] === 'view' && knownView(args[1])) { S.view = args[1]; persist(); }
-        location.replace('#/memories/t/' + encodeURIComponent(S.view)); return;
+        W.replace('#/memories/t/' + encodeURIComponent(S.view)); return;
       }
       if (tabRoute(args) && S.view !== args[1]) { S.view = args[1]; persist(); }
       if (args[0] === 'k') { S.view = 'knowledge'; if (KTABS.indexOf(args[1]) >= 0) { S.ktab = args[1]; S.ktabChosen = true; } persist(); }

package/server/web-control/panes/messages.js

@@ -469,9 +469,14 @@
   }
   function turnCards(t, msgKey) {
     var a = atts(t);
-    return '<div class="cx-card you"><div class="cx-card-label">YOU</div><div class="cx-card-body" data-hl>' + esc(String(t.query || '').trim() || '(empty query)').replace(/\n/g, '<br>') + '</div></div>' +
+    // 7.0.30, Miles's pick A: who said what by side, in the COS chat's own shapes. His words on the right in the chat's
+    // gold bubble with "You" under it; COS on the left beside its mark, on the page. A screen reader hears "You said"
+    // and "COS said" first, since the side and the mark are visual only.
+    return '<div class="cx-said you"><span class="sr-only">You said</span><div class="cx-said-bubble cx-card-body" data-hl>' + esc(String(t.query || '').trim() || '(empty query)').replace(/\n/g, '<br>') + '</div>' +
+      '<span class="cx-said-who" aria-hidden="true">You</span></div>' +
       stripHtml(a.filter(isUserAtt), true, msgKey) +
-      '<div class="cx-card"><div class="cx-card-label">COS</div><div class="cx-card-body md" data-hl>' + W.md(W.structureLensAnswer(String(t.text || ''))) + '</div></div>' +
+      '<div class="cx-said cos"><span class="cc-avatar" aria-hidden="true"><svg class="icon"><use href="#i-mark"/></svg></span><div class="cx-said-text"><span class="sr-only">COS said</span>' +
+      '<div class="cx-card-body md" data-hl>' + W.md(W.structureLensAnswer(String(t.text || ''))) + '</div></div></div>' +
       stripHtml(a.filter(function (x) { return !isUserAtt(x); }), false, msgKey);
   }
   function copyTurnText(t) {

package/server/web-control/panes/settings.js

@@ -123,7 +123,7 @@
     return '<section class="cx-set-cat"><h2 class="cx-col-title">This browser</h2>' +
       group('Appearance', '', themeBtn('system', 'Match this device') + themeBtn('light', 'Light') + themeBtn('dark', 'Dark')) +
       group('Sign-in', '',
-        '<button type="button" class="cx-set-row" id="device-code-btn"><span class="cx-set-text"><span class="cx-set-name">Use COS on another phone or browser</span><span class="cx-set-desc">A QR for your iPhone Camera, and a code to type. This is not glasses pairing; pair glasses from COS Control on your Mac.</span></span><span class="chev"></span></button>' +
+        '<button type="button" class="cx-set-row" id="device-code-btn"><span class="cx-set-text"><span class="cx-set-name">Use COS on another phone or browser</span><span class="cx-set-desc">A QR for your phone’s camera, and a code to type. This is not glasses pairing; pair glasses from COS Control on your Mac.</span></span><span class="chev"></span></button>' +
         '<div id="device-code-panel" class="device-code hidden" aria-live="polite"></div>' +
         '<button type="button" class="cx-set-row" id="copy-link"><span class="cx-set-text"><span class="cx-set-name">Copy link for your phone</span><span class="cx-set-desc" id="tailnet-url">' + esc(W.state.tailnetUrl || 'Checking Tailscale') + '</span></span></button>' +
         '<button type="button" class="cx-set-row" id="sign-out"><span class="cx-set-text"><span class="cx-set-name">Sign out of this browser</span></span></button>' +

package/server/web-control/panes/speakers.js

@@ -2363,8 +2363,11 @@
     var acts = '';
     if (rv && rv.recordId) acts += '<button type="button" class="cx-btn quiet" data-sp="open-meeting" title="Open this meeting’s transcript, summary and files">' + icon('meetings') + 'Open meeting</button>';
     if (R.content && R.content.clipboardSummary) {
-      acts += '<button type="button" class="cx-btn quiet" data-sp="copy-summary" title="Copy the meeting without the transcript">Summary</button>' +
-        '<button type="button" class="cx-btn quiet" data-sp="copy-full" title="Copy the meeting including the full transcript">Full (' + Math.max(1, Math.floor(R.content.fullChars / 1024)) + ' KB)</button>';
+      // 7.0.30 item 3 (Anand: Summary and Full did not say they copy): the buttons say Copy, and the one tapped says
+      // Copied for COPIED_MS (spCopied), while a status line the screen reader hears says what was copied.
+      var cp = R.copied && Date.now() - R.copied.at < COPIED_MS ? R.copied.which : '';
+      acts += '<button type="button" class="cx-btn quiet" id="sp-copy-summary" data-sp="copy-summary" title="Copy the meeting without the transcript">' + (cp === 'summary' ? 'Copied' : 'Copy summary') + '</button>' +
+        '<button type="button" class="cx-btn quiet" id="sp-copy-full" data-sp="copy-full" title="Copy the meeting including the full transcript">' + (cp === 'full' ? 'Copied' : 'Copy full (' + Math.max(1, Math.floor(R.content.fullChars / 1024)) + ' KB)') + '</button>';
     }
     var next = S.meetings ? nextUnnamed(R.sid) : null;
     acts += '<button type="button" class="cx-btn quiet" data-sp="next-unnamed"' + (next ? '' : ' disabled') + ' title="' +
@@ -2424,6 +2427,27 @@
 
   // ── render dispatch ────────────────────────────────────
   var expiryTimer = null;
+  // 7.0.30 item 3: a copy confirms on its own button, then the button goes back to Copy; the words go to a status region
+  // that lives outside the rebuilt pane, so a screen reader hears them (a region made in the same rebuild may not be).
+  var COPIED_MS = 2500;
+  function spAnnounce(text) {
+    var live = document.getElementById('sp-copy-live');
+    if (!live) {
+      live = document.createElement('div');
+      live.id = 'sp-copy-live'; live.className = 'sr-only';
+      live.setAttribute('role', 'status'); live.setAttribute('aria-live', 'polite');
+      document.body.appendChild(live);
+    }
+    live.textContent = '';
+    setTimeout(function () { live.textContent = text; }, 30);
+  }
+  function spCopied(R, which, words) {
+    var at = Date.now();
+    R.copied = { which: which, at: at };
+    render();
+    spAnnounce(words);
+    setTimeout(function () { if (R.copied && R.copied.at === at) { R.copied = null; render(); } }, COPIED_MS);
+  }
   function render() {
     if (W.parseRoute().pane !== 'speakers') return;
     var rt = route();
@@ -2641,7 +2665,8 @@
         if (!text) { R.copyNote = 'Nothing to copy'; render(); return; }
         W.copyText(text).then(function () {
           var kb = Math.max(1, Math.floor((full ? c.fullChars : c.summaryChars) / 1024));
-          R.copyNote = full ? 'Copied full meeting (' + kb + ' KB)' : 'Copied summary (' + kb + ' KB)'; render();
+          R.copyNote = full ? 'Copied full meeting (' + kb + ' KB)' : 'Copied summary (' + kb + ' KB)';
+          spCopied(R, full ? 'full' : 'summary', R.copyNote);
         }, function (err) { W.toast(err.message); });
         return;
       }

package/server/web-control/panes/today-actions.js

@@ -471,8 +471,8 @@
     close('leave');
     O.depth = 1;
     if (!replace) { W.go(pane, args || []); return; }
-    if (extra) { quietBack(extra, function () { location.replace(hash); }); return; }
-    location.replace(hash);
+    if (extra) { quietBack(extra, function () { W.replace(hash); }); return; }
+    W.replace(hash);
   }
   // A Back step the overlay takes itself (X, Back to sessions, leaving for a tab): its popstate is ours, not the phone's
   // Back, and `then` runs once it lands. If it never arrives (history.go with nothing to go back to, or a browser that

package/server/web-control/panes/work.js

@@ -2813,7 +2813,7 @@
       if (args[0] === 'sort') {
         S.tab = 'sort'; S.sortGroupId = ''; S.sortIndex = 0; S.moreOpen = false;
         if (!S.intake && !S.intakeLoading) loadIntake(true);
-        location.replace('#/work');
+        W.replace('#/work');
         return;
       }
       startPoll(); resumeHandoffPolls();

package/server/web-control/shell.js

@@ -263,7 +263,8 @@
     }
     crumbs.innerHTML = parts.join('');
     $('nav-back').disabled = onToday;
-    // The phone top bar (below 600 px, the same width test) names the detail too, so a reader says where it is.
+    // Below 600 px the section name gets the detail too. On a reader that label is hidden (the section button gives way
+    // to Back, which names where it goes), so this shows only on a list that has a detail.
     var label = $('section-name');
     if (label && detail && railHidden()) label.textContent = detail;
   }

package/server/web-signer/.manifest.json

@@ -3,9 +3,9 @@
   "algorithm": "sha256",
   "files": {
     "/index.html": "3bea8ab14118e48c8bbf5f09de2e8b65ca1225b7e7b564982a84477bafc8341e",
-    "/signer-proof.js": "a8f8f10608fa1ec0e8da0280fdb27c16c78c011e6ff935477593e25a8e6a26e0",
+    "/signer-proof.js": "13b2d3f2709501b3bacff63b5a041282cacdf5bce6be168779c59ba89cf2e0c3",
     "/signer-store.js": "ae123328f922a509eea4d8f9e8440c9ef6972eeb14bf90b9e8bde3c84f7132bc",
     "/signer.css": "e19f5ec70c9dae28347ad40cd08742842e964b3d0b973a5c39f48f9cafdd319b",
-    "/signer.js": "c92dae47694a42aec0995a8cb0e70ba54979183711d840b2935528a197b11735"
+    "/signer.js": "098f484b452c0c2b8ff33c9ca7764fb179e3e5f52c77bebf47eb540e73e7a566"
   }
 }

package/server/web-signer/signer-proof.js

@@ -129,13 +129,28 @@
       if (!Object.prototype.hasOwnProperty.call(channels, s.action) || channels[s.action].indexOf(s.channel) < 0
         || !/^[a-z0-9@][a-z0-9@._/-]{0,127}$/.test(s.artifact) || !/^[0-9]{1,5}\.[0-9]{1,5}\.[0-9]{1,6}(-[0-9A-Za-z.-]{1,32})?$/.test(s.version)
         || !/^(sha256:[0-9a-f]{64}|sha512:[0-9a-f]{128}|sha512-[A-Za-z0-9+/]{86}==)$/.test(s.digest) || !HEX64.test(s.packetSha256)) throw fail('scope_not_allowed')
-      var manifests = { 'gotcos-site': 'gotcos-site-manifest', 'control-downloads': 'cos-control-downloads-manifest', 'release-docs': 'cos-release-docs-manifest' }
-      if (Object.prototype.hasOwnProperty.call(manifests, s.channel) && (s.artifact !== manifests[s.channel] || !/^sha256:[0-9a-f]{64}$/.test(s.digest))) throw fail('scope_not_allowed')
+      var manifest = manifestArtifact(s.channel)
+      if (manifest && (s.artifact !== manifest || !/^sha256:[0-9a-f]{64}$/.test(s.digest))) throw fail('scope_not_allowed')
       return { kind: 'approve', action: s.action, artifact: s.artifact, version: s.version, digest: s.digest, channel: s.channel, packetSha256: s.packetSha256 }
     }
     throw fail('scope_not_allowed')
   }
 
+  // What an approval on each channel does, one fixed line per channel (Miles, 2026-11-12: a publish approval covers
+  // its own push). A copy of APPROVE_CHANNEL_EFFECT in shared/web-turn-envelope.ts; signer-proof.test.ts pins the two.
+  var CHANNEL_EFFECT = { 'mac-local': 'Installs on this Mac. No git push.', 'npm-next': 'Publishes to npm under the next tag, from the tested package. No git push.', 'npm-latest': 'Publishes to npm under the latest tag, from the tested package. No git push.', 'control-appcast': 'Pushes ukaoma/cos-starter main (control/appcast.json): the COS Control update feed on gotcos.com.', 'hub-alias': 'Pushes ukaoma/evenhub-g2-cos main: moves the Even Hub alias to this package.', 'gotcos-site': 'Pushes ukaoma/cos-starter main: republishes www.gotcos.com.', 'control-downloads': 'Creates a GitHub Release on ukaoma/cos-starter (a tag, no branch push) with the ZIP and its SHA-256 file.', 'release-docs': 'Pushes ukaoma/cos-starter main (docs/): republishes the public COS docs.' }
+  // Channels that approve one canonical deployment manifest, and the artifact each must name. A copy of
+  // PUBLISH_MANIFEST_ARTIFACTS in shared/web-turn-envelope.ts; signer-proof.test.ts pins the two (Q1, 2026-11-12).
+  var MANIFEST_ARTIFACTS = { 'gotcos-site': 'gotcos-site-manifest', 'control-downloads': 'cos-control-downloads-manifest', 'release-docs': 'cos-release-docs-manifest' }
+  /** The manifest artifact a channel requires, or '' when the channel is not a manifest channel. */
+  function manifestArtifact(channel) {
+    return typeof channel === 'string' && Object.prototype.hasOwnProperty.call(MANIFEST_ARTIFACTS, channel) ? MANIFEST_ARTIFACTS[channel] : ''
+  }
+  /** The fixed line for a channel this page can sign, or '' for anything else. Never built from packet text. */
+  function channelEffect(channel) {
+    return typeof channel === 'string' && Object.prototype.hasOwnProperty.call(CHANNEL_EFFECT, channel) ? CHANNEL_EFFECT[channel] : ''
+  }
+
   /** Verify the full packet before display AND again before signing. A packet is still only a request. */
   function validateHandoffPacket(h, nowMs) {
     return Promise.resolve().then(function () {
@@ -340,7 +355,7 @@
     canonicalJson: canonicalJson, jcsBytes: jcsBytes,
     signedWords: signedWords, wordsDigest: wordsDigest,
     buildEnvelope: buildEnvelope, passkeyChallenge: passkeyChallenge, passkeyHeader: passkeyHeader,
-    assembleTurnProof: assembleTurnProof, validateHandoffPacket: validateHandoffPacket,
+    assembleTurnProof: assembleTurnProof, validateHandoffPacket: validateHandoffPacket, channelEffect: channelEffect, manifestArtifact: manifestArtifact,
     sasCommit: sasCommit, sasCode: sasCode, kidOf: kidOf, fingerprintOf: fingerprintOf, enrollProofMessage: enrollProofMessage,
     spkiFromXY: spkiFromXY, xyFromSpki: xyFromSpki, coseFromXY: coseFromXY, xyFromCose: xyFromCose,
     xyFromAttestation: xyFromAttestation, passkeyXY: passkeyXY,

package/server/web-signer/signer.js

@@ -124,8 +124,10 @@
     return 'Unknown'
   }
   function deploymentMeaning(scope) {
-    var targets = { 'gotcos-site': 'gotcos.com website (cos-starter Pages)', 'control-downloads': 'COS Control GitHub release downloads and approved latest aliases', 'release-docs': 'Public COS release documentation' }
-    return scope && Object.prototype.hasOwnProperty.call(targets, scope.channel) ? '\nDeployment target: ' + targets[scope.channel] + '\nApproval is limited to this exact manifest SHA-256. The receiving release tool checks its files and destination.' : ''
+    // The fixed line for the channel (P.channelEffect), never text from the packet's requester (2026-11-12).
+    var effect = scope && scope.kind === 'approve' ? P.channelEffect(scope.channel) : ''
+    if (!effect) return ''
+    return '\nWhat this approves: ' + effect + (P.manifestArtifact(scope.channel) ? '\nApproval is limited to this exact manifest SHA-256. The receiving release tool checks its files and destination.' : '')
   }
   function claim(id) {
     show('loading')

package/shared/web-turn-envelope.ts

@@ -37,8 +37,15 @@ export const WEB_TURN_MAX_LIFETIME_S = 15 * 60
 /** How far in the future `iat` may sit (clock skew between the phone and this Mac), in seconds. */
 export const WEB_TURN_IAT_SKEW_S = 60
 
-/** The only actions an `approve` scope can name. Anything else, including every never-list item, is unexpressible. */
-export const APPROVE_ACTIONS: ReadonlySet<string> = new Set(['install', 'publish', 'push-main'])
+/**
+ * The only actions an `approve` scope can name. Anything else, including every never-list item, is unexpressible.
+ * Miles, 2026-11-12 11:11: a phone approval may sign everything the build allows except pushing main, which stays
+ * typed at the desk ("Keep allow for all action but the push to main. That way we can resolve when at the desk").
+ */
+export const APPROVE_ACTIONS: ReadonlySet<string> = new Set(['install', 'publish'])
+
+/** Actions a phone can never sign. Not expressible, and still named in every `notAuthorized` list. */
+export const APPROVE_ACTIONS_REMOVED: readonly string[] = Object.freeze(['push-main'])
 
 /** What a `message` scope means: conversation only (review B4). */
 export const MESSAGE_SCOPE_MEANING = 'conversation'
@@ -55,10 +62,28 @@ export const MESSAGE_SCOPE_NOT_AUTHORIZED: readonly string[] = Object.freeze([
 ])
 
 /** The channels each approve action may name. Nothing else is signable (review B4). */
-export const APPROVE_ACTION_CHANNELS: Readonly<Record<'install' | 'publish' | 'push-main', readonly string[]>> = Object.freeze({
+export const APPROVE_ACTION_CHANNELS: Readonly<Record<'install' | 'publish', readonly string[]>> = Object.freeze({
   install: Object.freeze(['mac-local']),
   publish: Object.freeze(['npm-next', 'npm-latest', 'control-appcast', 'hub-alias', 'gotcos-site', 'control-downloads', 'release-docs']),
-  'push-main': Object.freeze(['git-main']),
+})
+
+/**
+ * What an approval on each channel does, in one fixed line the phone shows (Miles, 2026-11-12: "Publish includes its
+ * own push"). A publish approval covers the push that publish consists of, and only that: cos-starter main for the
+ * site, the appcast and the docs; evenhub-g2-cos main for the Hub alias; npm goes out from the tested package with no
+ * push. Pushing the code main of any repo stays typed at the desk. The line is derived from the CHANNEL alone, never
+ * from text the requester sent. The phone's page keeps a copy (server/web-signer/signer-proof.js, CHANNEL_EFFECT),
+ * pinned to this one by signer-proof.test.ts.
+ */
+export const APPROVE_CHANNEL_EFFECT: Readonly<Record<string, string>> = Object.freeze({
+  'mac-local': 'Installs on this Mac. No git push.',
+  'npm-next': 'Publishes to npm under the next tag, from the tested package. No git push.',
+  'npm-latest': 'Publishes to npm under the latest tag, from the tested package. No git push.',
+  'control-appcast': 'Pushes ukaoma/cos-starter main (control/appcast.json): the COS Control update feed on gotcos.com.',
+  'hub-alias': 'Pushes ukaoma/evenhub-g2-cos main: moves the Even Hub alias to this package.',
+  'gotcos-site': 'Pushes ukaoma/cos-starter main: republishes www.gotcos.com.',
+  'control-downloads': 'Creates a GitHub Release on ukaoma/cos-starter (a tag, no branch push) with the ZIP and its SHA-256 file.',
+  'release-docs': 'Pushes ukaoma/cos-starter main (docs/): republishes the public COS docs.',
 })
 
 export const APPROVE_ARTIFACT_RE = /^[a-z0-9@][a-z0-9@._/-]{0,127}$/
@@ -88,13 +113,13 @@ export function approveFieldsValid(action: unknown, artifact: unknown, version:
 /** The verifier's `notAuthorized` list for a scope: the never-list plus what this scope does not cover. */
 export function notAuthorizedFor(scope: WebTurnScope): string[] {
   if (scope.kind === 'message') return [...WEB_KEY_NEVER_AUTHORIZED, ...MESSAGE_SCOPE_NOT_AUTHORIZED]
-  const others = [...APPROVE_ACTIONS].filter(a => a !== scope.action)
+  const others = [...APPROVE_ACTIONS, ...APPROVE_ACTIONS_REMOVED].filter(a => a !== scope.action)
   return [...WEB_KEY_NEVER_AUTHORIZED, ...others, 'push-branch', 'hub-file', 'other-artifact-version-digest-or-channel']
 }
 
 export type WebTurnScope =
   | { kind: 'message' }
-  | { kind: 'approve'; action: 'install' | 'publish' | 'push-main'; artifact: string; version: string; digest: string; channel: string; packetSha256: string }
+  | { kind: 'approve'; action: 'install' | 'publish'; artifact: string; version: string; digest: string; channel: string; packetSha256: string }
 
 export interface WebTurnAttachment { id: string; sha256: string; bytes: number; name: string }
 
@@ -194,7 +219,7 @@ export function parseWebTurnScope(v: unknown): WebTurnScope | null {
     // The closed action list, the strict field patterns and the channel table (approveFieldsValid).
     if (!approveFieldsValid(v.action, v.artifact, v.version, v.digest, v.channel)) return null
     if (typeof v.packetSha256 !== 'string' || !HEX64.test(v.packetSha256)) return null
-    return { kind: 'approve', action: v.action as 'install' | 'publish' | 'push-main', artifact: v.artifact as string, version: v.version as string, digest: v.digest as string, channel: v.channel as string, packetSha256: v.packetSha256 }
+    return { kind: 'approve', action: v.action as 'install' | 'publish', artifact: v.artifact as string, version: v.version as string, digest: v.digest as string, channel: v.channel as string, packetSha256: v.packetSha256 }
   }
   return null
 }
@@ -249,7 +274,7 @@ export function parseWebTurnEnvelope(v: unknown): { ok: true; envelope: WebTurnE
 export interface WebApprovalPacket {
   v: typeof WEB_APPROVAL_PACKET_VERSION
   packetId: string
-  action: 'install' | 'publish' | 'push-main'
+  action: 'install' | 'publish'
   artifact: string
   version: string
   digest: string