@gotcos/glasses-server 7.0.7 → 7.0.27

package/server/lib/web-key-signer-app.ts

@@ -0,0 +1,152 @@
+// What the 3144 signer listener serves (6.99.31, plan section 4.8, review B2 and W2). Only with
+// COS_WEB_KEY_AUTHORITY on: index.ts builds this handler and the 3144 listener only then
+// (lib/listener-startup.ts listenerPlan), so with the flag off none of it exists.
+//
+// THE ORIGIN HOLDS THE KEY AND NOTHING ELSE. The big Control Web app (transcripts, previews, the
+// memories frame) stays on 3143. On 3144:
+//   - the page and its three scripts and one stylesheet (server/web-signer/), served ONLY from bytes
+//     that matched their pack-time manifest (lib/web-control-integrity.ts, a second instance over
+//     web-signer/). No manifest, a changed file, an extra file: a plain error page, nothing signs.
+//   - a short allowlist of /api routes the page calls (key status, nonce, enrollment, revoke, the
+//     handoff claim, and the one turn route plus its status read). Everything else is 404 here, so
+//     no transcript, meeting or memory route answers on this origin.
+//   - an API request that names any other Origin is refused, and a write must name this one, so
+//     no other page (3143 included) can drive this origin's API with the phone's cookie.
+//   - every response: a strict CSP with no inline script or style and frame-ancestors 'none',
+//     X-Frame-Options DENY, COOP and CORP same-origin, no referrer, no caching.
+
+import type { IncomingMessage, ServerResponse } from 'node:http'
+import type { WebControlIntegrity } from './web-control-integrity.js'
+import type { IntegrityReport } from './web-key-authority.js'
+
+export const WEB_SIGNER_CSP = [
+  "default-src 'none'",
+  "script-src 'self'",
+  "style-src 'self'",
+  "img-src 'self'",
+  "connect-src 'self'",
+  "base-uri 'none'",
+  "form-action 'none'",
+  "frame-ancestors 'none'",
+  "frame-src 'none'",
+  "object-src 'none'",
+  "manifest-src 'none'",
+  "worker-src 'none'",
+  "require-trusted-types-for 'script'",
+  "trusted-types 'none'",
+].join('; ')
+
+export const WEB_SIGNER_HEADERS: Readonly<Record<string, string>> = Object.freeze({
+  'Content-Security-Policy': WEB_SIGNER_CSP,
+  'X-Frame-Options': 'DENY',
+  'Cross-Origin-Opener-Policy': 'same-origin',
+  'Cross-Origin-Resource-Policy': 'same-origin',
+  'Referrer-Policy': 'no-referrer',
+  'X-Content-Type-Options': 'nosniff',
+  'Cache-Control': 'no-store',
+  'Permissions-Policy': 'publickey-credentials-get=(self), publickey-credentials-create=(self), camera=(), microphone=(), geolocation=(), payment=()',
+})
+
+/** The only /api routes the signer origin answers. Method plus exact path shape. */
+export const WEB_SIGNER_API_ALLOWLIST: ReadonlyArray<{ method: 'GET' | 'POST'; path: RegExp }> = Object.freeze([
+  { method: 'GET', path: /^\/api\/web-key\/status$/ },
+  { method: 'GET', path: /^\/api\/web-key\/keys$/ },
+  { method: 'POST', path: /^\/api\/web-key\/nonce$/ },
+  { method: 'POST', path: /^\/api\/web-key\/enroll\/start$/ },
+  { method: 'POST', path: /^\/api\/web-key\/enroll\/prove$/ },
+  { method: 'GET', path: /^\/api\/web-key\/enroll\/status$/ },
+  { method: 'POST', path: /^\/api\/web-key\/revoke$/ },
+  { method: 'POST', path: /^\/api\/web-key\/handoff\/claim$/ },
+  { method: 'POST', path: /^\/api\/agent-sessions\/bindings\/[A-Za-z0-9][A-Za-z0-9_-]{0,127}\/turns$/ },
+  { method: 'GET', path: /^\/api\/agent-sessions\/bindings\/[A-Za-z0-9][A-Za-z0-9_-]{0,127}\/turns\/[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/ },
+])
+
+export function signerApiAllowed(method: string | undefined, pathname: string): boolean {
+  const m = String(method ?? 'GET').toUpperCase()
+  return WEB_SIGNER_API_ALLOWLIST.some(r => r.method === m && r.path.test(pathname))
+}
+
+const TYPES: Record<string, string> = {
+  '.html': 'text/html; charset=utf-8',
+  '.js': 'text/javascript; charset=utf-8',
+  '.css': 'text/css; charset=utf-8',
+}
+
+export const SIGNER_PAUSED_PAGE = '<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>COS approval paused</title></head><body><h1>COS approval is paused</h1><p>The approval page on this Mac does not match the one that shipped with this version, so it is not being served. Nothing was signed.</p><p>Open COS Control on the Mac to repair or reinstall the server.</p></body></html>'
+
+/**
+ * The integrity the authority reads (review W1), Phase 3: the signer page holds the key, so a turn is
+ * vouched only while BOTH the Control Web tree and the signer tree match their manifests. Null while
+ * Control Web integrity is off (`integrity_off`, as before). The shape is the contract's, unchanged.
+ */
+export function combinedIntegrityReport(webControl: Pick<WebControlIntegrity, 'state' | 'manifestSha256'> | null, signer: Pick<WebControlIntegrity, 'state'> | null): IntegrityReport | null {
+  if (!webControl) return null
+  const signerOk = signer !== null && signer.state.ok === true
+  return { enabled: true, lastCheckOk: webControl.state.ok === true && signerOk, checkedAt: webControl.state.checkedAt || null, manifestSha256: webControl.manifestSha256 }
+}
+
+export interface WebKeySignerDeps {
+  /** The integrity check over server/web-signer/. Null: nothing is served (the page is never read from disk unchecked). */
+  integrity: WebControlIntegrity | null
+  /** The main app, for the allowlisted /api routes. */
+  api: (req: IncomingMessage, res: ServerResponse) => void
+  /** `https://<MagicDNS name>:3144` (lib/web-key-origin.ts), or null when unknown. */
+  origin: () => string | null
+  /** How often the signer's files are re-checked. 0: never on a timer (tests call integrity.check()). */
+  recheckMs?: number
+}
+
+function applyHeaders(res: ServerResponse): void {
+  for (const [k, v] of Object.entries(WEB_SIGNER_HEADERS)) res.setHeader(k, v)
+}
+
+function send(res: ServerResponse, status: number, type: string, body: string | Buffer, head = false): void {
+  res.statusCode = status
+  res.setHeader('Content-Type', type)
+  const buf = typeof body === 'string' ? Buffer.from(body, 'utf8') : body
+  res.setHeader('Content-Length', String(buf.length))
+  res.end(head ? undefined : buf)
+}
+
+function json(res: ServerResponse, status: number, value: Record<string, unknown>): void {
+  send(res, status, 'application/json; charset=utf-8', JSON.stringify(value))
+}
+
+export function createWebKeySignerHandler(deps: WebKeySignerDeps): ((req: IncomingMessage, res: ServerResponse) => void) & { stop: () => void } {
+  let timer: ReturnType<typeof setInterval> | null = null
+  const every = deps.recheckMs ?? 60_000
+  if (deps.integrity && every > 0) {
+    const integrity = deps.integrity
+    timer = setInterval(() => { try { integrity.check() } catch { /* the next tick retries */ } }, every)
+    timer.unref?.()
+  }
+
+  const handler = (req: IncomingMessage, res: ServerResponse): void => {
+    applyHeaders(res)
+    let pathname: string
+    try { pathname = new URL(req.url ?? '/', 'https://signer.invalid').pathname } catch { json(res, 400, { ok: false, error: 'invalid_request' }); return }
+    const method = String(req.method ?? 'GET').toUpperCase()
+
+    if (pathname === '/api' || pathname.startsWith('/api/')) {
+      const expected = deps.origin()
+      const origin = typeof req.headers.origin === 'string' ? req.headers.origin : undefined
+      // Another origin's page never drives this one. A write must name this origin outright.
+      if (origin !== undefined && origin !== expected) { json(res, 403, { ok: false, error: 'origin_refused' }); return }
+      if (method !== 'GET' && method !== 'HEAD' && (expected === null || origin !== expected)) { json(res, 403, { ok: false, error: 'origin_refused' }); return }
+      if (!signerApiAllowed(method === 'HEAD' ? 'GET' : method, pathname)) { json(res, 404, { ok: false, error: 'not_found' }); return }
+      deps.api(req, res)
+      return
+    }
+
+    if (method !== 'GET' && method !== 'HEAD') { res.setHeader('Allow', 'GET, HEAD'); json(res, 405, { ok: false, error: 'method_not_allowed' }); return }
+    const head = method === 'HEAD'
+    const snapshot = deps.integrity ? deps.integrity.snapshot() : null
+    if (!snapshot) { send(res, 503, 'text/html; charset=utf-8', SIGNER_PAUSED_PAGE, head); return }
+    const file = pathname === '/' ? '/index.html' : pathname
+    const ext = file.slice(file.lastIndexOf('.')).toLowerCase()
+    const body = TYPES[ext] ? snapshot.get(file) : undefined
+    if (!body) { send(res, 404, 'text/plain; charset=utf-8', 'Not found', head); return }
+    send(res, 200, TYPES[ext], body, head)
+  }
+  return Object.assign(handler, { stop: () => { if (timer) clearInterval(timer); timer = null } })
+}

package/server/lib/web-session-auth.ts

@@ -1,4 +1,4 @@
-import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto'
+import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto'
 import { mkdirSync, readFileSync } from 'node:fs'
 import { durableAtomicWriteFileSync } from './atomic-fs.js'
 import { dirname } from 'node:path'
@@ -19,6 +19,12 @@ import { CROCKFORD_ALPHABET, PAIRING_CODE_ATTEMPT_LIMIT, PAIRING_CODE_LENGTH } f
 export const WEB_SESSION_COOKIE_NAME = 'cos_web_session'
 export const WEB_CSRF_HEADER = 'x-cos-web'
 export const WEB_SESSION_TTL_MS = 7 * 24 * 60 * 60_000
+/**
+ * 7.0.x sign-in renewal (Miles 2026-11-09, "Renew while in use, 30-day cap"). A browser that is used in the last
+ * RENEW_WINDOW of its cookie gets a fresh one, never running past MAX_LIFE from the time it first signed in.
+ */
+export const WEB_SESSION_RENEW_WINDOW_MS = 2 * 24 * 60 * 60_000
+export const WEB_SESSION_MAX_LIFE_MS = 30 * 24 * 60 * 60_000
 export const WEB_HANDOFF_TTL_MS = 2 * 60_000
 export const WEB_HANDOFF_MAX_ACTIVE = 16
 
@@ -43,6 +49,17 @@ function signSession(apiToken: string, expUnixSec: number, epoch: number): strin
     .digest('hex')
 }
 
+/**
+ * A RENEWED cookie also carries the time the browser first signed in (`orig`), so no renewal can pass the 30-day cap.
+ * Same key as above (derived from the API token: no new secret); the signed text starts with `v3:` and names `orig`,
+ * so a 3-part signature can never stand for a 4-part cookie, and `orig` cannot be edited without breaking it.
+ */
+function signRenewedSession(apiToken: string, expUnixSec: number, epoch: number, origUnixSec: number): string {
+  return createHmac('sha256', `cos_web_session_v2:${apiToken}`)
+    .update(`v3:${expUnixSec}:${epoch}:${origUnixSec}`)
+    .digest('hex')
+}
+
 // ── Revocation (review W1) ───────────────────────────────────────────────────
 // The cookie signs a session EPOCH kept on the Mac. "Sign out every browser" bumps it, so
 // every copy of every cookie stops working at once, without rotating the pairing token
@@ -117,19 +134,66 @@ export function verifyWebSessionCookieValue(
   nowMs = Date.now(),
   epoch = currentWebSessionEpoch(),
 ): boolean {
-  if (typeof cookieValue !== 'string' || !apiToken) return false
+  return readWebSessionCookie(cookieValue, apiToken, nowMs, epoch) !== null
+}
+
+/**
+ * The verified cookie's expiry and first sign-in time (unix seconds), or null for any cookie that does not verify.
+ * Two shapes verify:
+ *   `<exp>.<epoch>.<sig>`         minted at sign-in (unchanged). Its first sign-in time is its issue time, exp minus 7 days.
+ *   `<exp>.<epoch>.<orig>.<sig>`  minted by a renewal; exp may never pass orig plus 30 days, and orig is never in the future.
+ */
+export function readWebSessionCookie(
+  cookieValue: string | undefined,
+  apiToken: string,
+  nowMs = Date.now(),
+  epoch = currentWebSessionEpoch(),
+): { expUnixSec: number; origUnixSec: number; renewed: boolean } | null {
+  if (typeof cookieValue !== 'string' || !apiToken) return null
   const parts = cookieValue.split('.')
-  if (parts.length !== 3) return false
-  const [expPart, epochPart, sigPart] = parts
-  if (!/^\d{1,15}$/.test(expPart) || !/^\d{1,12}$/.test(epochPart) || !/^[0-9a-f]{64}$/.test(sigPart)) return false
+  if (parts.length !== 3 && parts.length !== 4) return null
+  const renewed = parts.length === 4
+  const expPart = parts[0], epochPart = parts[1], origPart = renewed ? parts[2] : null, sigPart = parts[parts.length - 1]
+  if (!/^\d{1,15}$/.test(expPart) || !/^\d{1,12}$/.test(epochPart) || !/^[0-9a-f]{64}$/.test(sigPart)) return null
+  if (origPart !== null && !/^\d{1,15}$/.test(origPart)) return null
   const expUnixSec = Number(expPart)
-  if (!Number.isSafeInteger(expUnixSec) || expUnixSec * 1000 <= nowMs) return false
+  if (!Number.isSafeInteger(expUnixSec) || expUnixSec * 1000 <= nowMs) return null
+  const origUnixSec = origPart !== null ? Number(origPart) : expUnixSec - Math.floor(WEB_SESSION_TTL_MS / 1000)
+  if (!Number.isSafeInteger(origUnixSec)) return null
+  if (renewed && (origUnixSec * 1000 > nowMs || expUnixSec > origUnixSec + Math.floor(WEB_SESSION_MAX_LIFE_MS / 1000))) return null
   // The signature covers the CURRENT epoch, so a cookie from before "Sign out every browser"
   // (or one whose epoch digits were edited) fails here; epochPart is only shape-checked.
-  const expected = signSession(apiToken, expUnixSec, epoch)
+  const expected = renewed ? signRenewedSession(apiToken, expUnixSec, epoch, origUnixSec) : signSession(apiToken, expUnixSec, epoch)
   const left = Buffer.from(sigPart, 'utf8')
   const right = Buffer.from(expected, 'utf8')
-  return left.length === right.length && timingSafeEqual(left, right)
+  if (left.length !== right.length || !timingSafeEqual(left, right)) return null
+  return { expUnixSec, origUnixSec, renewed }
+}
+
+/**
+ * The renewal for a cookie that ALREADY verified, or null. Only in the last 2 days of its life, and never past 30 days
+ * from its first sign-in: the new expiry is the earlier of now plus 7 days and that cap, and a renewal that would not
+ * move the expiry later is not made. The caller (the /api gate) calls this only after every other check passed.
+ */
+export function renewWebSessionCookieValue(
+  cookieValue: string | undefined,
+  apiToken: string,
+  nowMs = Date.now(),
+  epoch = currentWebSessionEpoch(),
+): { value: string; expiresAtMs: number; capAtMs: number } | null {
+  const read = readWebSessionCookie(cookieValue, apiToken, nowMs, epoch)
+  if (!read) return null
+  if (read.expUnixSec * 1000 - nowMs > WEB_SESSION_RENEW_WINDOW_MS) return null
+  const capUnixSec = read.origUnixSec + Math.floor(WEB_SESSION_MAX_LIFE_MS / 1000)
+  const expUnixSec = Math.min(Math.floor((nowMs + WEB_SESSION_TTL_MS) / 1000), capUnixSec)
+  if (expUnixSec <= read.expUnixSec) return null
+  const sig = signRenewedSession(apiToken, expUnixSec, epoch, read.origUnixSec)
+  return { value: `${expUnixSec}.${epoch}.${read.origUnixSec}.${sig}`, expiresAtMs: expUnixSec * 1000, capAtMs: capUnixSec * 1000 }
+}
+
+/** The raw session cookie on a request header, for the renewal (lib/api-auth.ts) and the status route. */
+export function webSessionCookieFrom(cookieHeader: unknown): string | undefined {
+  return parseCookies(typeof cookieHeader === 'string' ? cookieHeader : undefined)[WEB_SESSION_COOKIE_NAME]
 }
 
 export function formatSetWebSessionCookie(value: string, maxAgeSec: number, secure = false): string {
@@ -249,13 +313,36 @@ interface HandoffRecord {
  * open the user's browser directly into an authenticated session without putting
  * the standing `COS_API_TOKEN` in a URL or touching `PairingState`.
  */
+/**
+ * Why a handoff ticket did not sign in (S1 item 7, lead 20:11). Logged only; the person sees the same sentence for all.
+ *   expired  its 2 minutes ran out        used     it already signed a browser in
+ *   evicted  more than 16 were open        unknown  never issued here, or issued before this server started
+ */
+export type WebHandoffFailure = 'expired' | 'used' | 'evicted' | 'revoked' | 'unknown'
+/** A retired ticket is remembered (as a SHA-256, never the ticket) this long and at most this many, only to say why. */
+export const WEB_HANDOFF_RETIRED_MS = 60 * 60_000
+export const WEB_HANDOFF_RETIRED_MAX = 256
+
 export class WebHandoffStore {
   private readonly tickets = new Map<string, HandoffRecord>()
+  private readonly retired = new Map<string, { why: Exclude<WebHandoffFailure, 'unknown'>; at: number }>()
   constructor(private readonly now: () => number = () => Date.now()) {}
 
+  private static digest(ticket: string): string { return createHash('sha256').update(ticket).digest('hex') }
+
+  private retire(ticket: string, why: Exclude<WebHandoffFailure, 'unknown'>, at: number): void {
+    const key = WebHandoffStore.digest(ticket)
+    this.retired.delete(key)
+    this.retired.set(key, { why, at })
+    for (const [k, rec] of this.retired) {
+      if (this.retired.size <= WEB_HANDOFF_RETIRED_MAX && at - rec.at < WEB_HANDOFF_RETIRED_MS) break
+      this.retired.delete(k)
+    }
+  }
+
   private sweep(at: number): void {
     for (const [k, rec] of this.tickets) {
-      if (at >= rec.expiresAtMs) this.tickets.delete(k)
+      if (at >= rec.expiresAtMs) { this.tickets.delete(k); this.retire(k, 'expired', at) }
     }
   }
 
@@ -266,6 +353,7 @@ export class WebHandoffStore {
       const oldest = this.tickets.keys().next().value
       if (!oldest) break
       this.tickets.delete(oldest)
+      this.retire(oldest, 'evicted', at)
     }
     const ticket = randomBytes(24).toString('base64url')
     const expiresAtMs = at + ttlMs
@@ -274,13 +362,35 @@ export class WebHandoffStore {
   }
 
   consume(ticket: unknown): boolean {
+    return this.consumeWithReason(ticket).ok
+  }
+
+  /** As `consume`, and on failure why. Single use and expiry are unchanged. */
+  consumeWithReason(ticket: unknown): { ok: true } | { ok: false; why: WebHandoffFailure } {
     const at = this.now()
     this.sweep(at)
-    if (typeof ticket !== 'string' || !HANDOFF_TICKET_PATTERN.test(ticket)) return false
+    if (typeof ticket !== 'string' || !HANDOFF_TICKET_PATTERN.test(ticket)) return { ok: false, why: 'unknown' }
     const existing = this.tickets.get(ticket)
-    if (!existing) return false
+    if (!existing) {
+      const past = this.retired.get(WebHandoffStore.digest(ticket))
+      return { ok: false, why: past && at - past.at < WEB_HANDOFF_RETIRED_MS ? past.why : 'unknown' }
+    }
     this.tickets.delete(ticket)
-    return at < existing.expiresAtMs
+    if (at >= existing.expiresAtMs) { this.retire(ticket, 'expired', at); return { ok: false, why: 'expired' } }
+    this.retire(ticket, 'used', at)
+    return { ok: true }
+  }
+
+  /**
+   * Final review V7 (lead 2026-11-10 02:18): "Sign out every browser" also ends every sign-in link not yet used, so
+   * one made just before it cannot sign a browser in after it. Each is remembered as `revoked` for the log. Returns
+   * how many it ended.
+   */
+  revokeAll(): number {
+    const at = this.now()
+    const live = [...this.tickets.keys()]
+    for (const ticket of live) { this.tickets.delete(ticket); this.retire(ticket, 'revoked', at) }
+    return live.length
   }
 }
 
@@ -289,7 +399,7 @@ export type WebLoginFailure = 'wrong_token' | 'wrong_code' | 'glasses_code' | 'h
 
 export type WebLoginResult =
   | { ok: true; kind: 'token' | 'handoff' | 'code' }
-  | { ok: false; reason: WebLoginFailure; length: number }
+  | { ok: false; reason: WebLoginFailure; length: number; handoff?: WebHandoffFailure }
 
 // What a phone paste drags along with a token: spaces and line breaks (a copy out of a
 // terminal or a note), zero-width and no-break characters, and the quotes around a value
@@ -327,9 +437,10 @@ export function classifyWebLogin(
   }
   if (handoffStore && typeof input.handoff === 'string' && input.handoff.trim().length > 0) {
     const ticket = input.handoff.trim()
-    return handoffStore.consume(ticket)
+    const used = handoffStore.consumeWithReason(ticket)
+    return used.ok
       ? { ok: true, kind: 'handoff' }
-      : { ok: false, reason: 'handoff_expired', length: ticket.length }
+      : { ok: false, reason: 'handoff_expired', length: ticket.length, handoff: used.why }
   }
   if (codeStore && typeof input.code === 'string' && input.code.trim().length > 0) {
     if (codeStore.consume(input.code)) return { ok: true, kind: 'code' }
@@ -437,6 +548,13 @@ export class WebDeviceCodeStore {
     this.codes.delete(code)
     return true
   }
+
+  /** Final review V7: "Sign out every browser" also ends every sign-in code not yet typed. Returns how many it ended. */
+  revokeAll(): number {
+    const n = this.codes.size
+    this.codes.clear()
+    return n
+  }
 }
 
 export const WEB_LOGIN_MAX_FAILURES = 8

package/server/lib/whisper-local.ts

@@ -764,18 +764,66 @@ async function startWhisperServerAttempt(preflightCompleted = false): Promise<vo
 /**
  * Gracefully stop whisper-server (called on process exit).
  */
-export function stopWhisperServer(): void {
-  if (serverProcess) {
-    serverProcess.kill('SIGTERM')
+/** How whisper-server is stopped, and why it is never SIGTERM (S1, 2026-11-09).
+ * whisper-server's own SIGTERM/SIGINT handler calls exit(); exit runs static destructors,
+ * and ggml's Metal device teardown aborts in ggml_metal_rsets_free. Nine crash reports
+ * 11/03 to 11/08 show exactly that stack (signal_handler, exit, __cxa_finalize_ranges,
+ * ggml_metal_device_free, ggml_abort), each in the minute of a COS server restart, with the
+ * parent already launchd because node exited without waiting. The daemon holds no state
+ * worth flushing (the model is on disk, requests are retried by their callers), so SIGKILL
+ * stops it without running that teardown and leaves no crash report. The stop then waits
+ * for the close, so node never exits first and orphans the child. */
+export const WHISPER_STOP_SIGNAL: NodeJS.Signals = 'SIGKILL'
+export const WHISPER_STOP_WAIT_MS = 2_000
+
+/** Resolve true when `child` has closed, false after `timeoutMs`. */
+export function waitForChildClose(child: Pick<ChildProcess, 'exitCode' | 'signalCode' | 'once' | 'off'>, timeoutMs: number): Promise<boolean> {
+  if (child.exitCode !== null || child.signalCode !== null) return Promise.resolve(true)
+  return new Promise(resolvePromise => {
+    let settled = false
+    const finish = (closed: boolean) => {
+      if (settled) return
+      settled = true
+      clearTimeout(timer)
+      child.off('close', onClose)
+      resolvePromise(closed)
+    }
+    const onClose = () => finish(true)
+    const timer = setTimeout(() => finish(false), timeoutMs)
+    timer.unref?.()
+    child.once('close', onClose)
+  })
+}
+
+export interface WhisperStopResult { stopped: boolean; exited: boolean; waitedMs: number; hqChildren: number }
+
+export async function stopWhisperServer(options: { waitMs?: number } = {}): Promise<WhisperStopResult> {
+  const waitMs = options.waitMs ?? WHISPER_STOP_WAIT_MS
+  const started = Date.now()
+  const waits: Array<Promise<boolean>> = []
+  const child = serverProcess
+  if (child) {
     serverProcess = null
     serverAvailable = false
-    console.log('[whisper-local] whisper-server stopped')
+    try { child.kill(WHISPER_STOP_SIGNAL) } catch { /* already exited */ }
+    waits.push(waitForChildClose(child, waitMs))
   }
-  for (const proc of ownedHqChildren) {
+  const hq = [...ownedHqChildren]
+  for (const proc of hq) {
     try { proc.kill('SIGKILL') } catch { /* already exited */ }
+    waits.push(waitForChildClose(proc, waitMs))
   }
   ownedHqChildren.clear()
   serverStartupState = 'stopped'
+  const closed = await Promise.all(waits)
+  const exited = closed.every(Boolean)
+  const waitedMs = Date.now() - started
+  if (child || hq.length) {
+    // Q1 S4: name what was actually running.
+    const what = child ? `whisper-server stopped (${WHISPER_STOP_SIGNAL}, ${hq.length} HQ child(ren))` : `${hq.length} HQ child(ren) stopped (SIGKILL; whisper-server was not running)`
+    console.log(`[whisper-local] ${what}: ` + (exited ? `exited in ${waitedMs} ms` : `did not exit within ${waitMs} ms`))
+  }
+  return { stopped: Boolean(child), exited, waitedMs, hqChildren: hq.length }
 }
 
 export function isWhisperLocalAvailable(): boolean {
@@ -952,6 +1000,36 @@ export function parseWhisperCliFullJson(raw: string): { text: string; words: Whi
   }
 }
 
+/** S1 (2026-11-09): an HQ decode that hit its wall-clock ceiling. The message keeps the
+ * historical prefix ("whisper-cli HQ timeout (240s, model=large-v3)") that log scans count,
+ * then names what settles why: the audio length, the device and why, the thread count and
+ * whether the child ran at background QoS (taskpolicy -b, which keeps it off the
+ * performance cores). Field evidence 10/26 to 11/09: 290 progressive-checkpoint timeouts
+ * against 190 successes, every one on CPU at background QoS. */
+export class WhisperHqTimeoutError extends Error {
+  readonly hqTimeout = true
+  constructor(
+    readonly timeoutMs: number,
+    readonly model: 'large-v3' | 'turbo',
+    readonly details: { audioSeconds: number; device: 'metal' | 'cpu'; reason: string; threads: number; backgroundQos: boolean; elapsedMs: number },
+  ) {
+    super(`whisper-cli HQ timeout (${timeoutMs / 1000}s, model=${model}) `
+      + `audio=${details.audioSeconds.toFixed(1)}s device=${details.device} reason=${details.reason} `
+      + `threads=${details.threads} qos=${details.backgroundQos ? 'background' : 'default'} elapsed=${details.elapsedMs}ms`)
+    this.name = 'WhisperHqTimeoutError'
+  }
+}
+
+export function isWhisperHqTimeout(error: unknown): error is WhisperHqTimeoutError {
+  return error instanceof WhisperHqTimeoutError
+    || (typeof error === 'object' && error !== null && (error as { hqTimeout?: boolean }).hqTimeout === true)
+}
+
+/** Seconds of audio in a 16 kHz mono 16-bit WAV (the only shape the HQ path decodes). */
+export function wavAudioSeconds(buffer: Buffer): number {
+  return Math.max(0, buffer.length - 44) / 32_000
+}
+
 /**
  * High-quality transcription for batch/post-meeting use.
  * Uses the full Whisper large-v3 (32-layer) decoder + Silero VAD + beam search.
@@ -1152,7 +1230,14 @@ export async function transcribeHighQuality(
           return
         }
         if (timedOut) {
-          reject(new Error(`whisper-cli HQ timeout (${timeoutMs / 1000}s, model=${useLargeV3 ? 'large-v3' : 'turbo'})`))
+          reject(new WhisperHqTimeoutError(timeoutMs, useLargeV3 ? 'large-v3' : 'turbo', {
+            audioSeconds: wavAudioSeconds(audioBuffer),
+            device: decision.device,
+            reason: decision.reason,
+            threads: (isBatch && !useMetal) ? requestedThreads : 16,
+            backgroundQos: useBackgroundTaskPolicy,
+            elapsedMs: Date.now() - start,
+          }))
           return
         }
         if (code !== 0) {
@@ -1215,7 +1300,8 @@ export async function transcribeHighQuality(
     const modelTag = useLargeV3 ? 'large-v3' : 'turbo'
     console.log(
       `[whisper-hq] Batch transcribed in ${elapsed}ms ` +
-      `(${modelTag}${useVad ? '+vad' : ''}${captureWords ? '+words' : ''}` +
+      // S1: the audio length makes the real-time factor readable from the log.
+      `(${modelTag}${useVad ? '+vad' : ''}${captureWords ? '+words' : ''}, audio=${wavAudioSeconds(audioBuffer).toFixed(1)}s` +
       `${words ? `, ${words.length} words` : ''}` +
       // Device forensics: without these, "why is polish slow today" is
       // unanswerable after the fact.

package/server/lib/whisper-preview.ts

@@ -446,10 +446,12 @@ export async function stopWhisperPreviewServer(options: { final?: boolean } = {}
   previewStarting = false
   previewWorkerModel = null
   if (child) {
-    try { child.kill('SIGTERM') } catch { /* already exited */ }
+    // S1 (2026-11-09): never SIGTERM. The sidecar is the same whisper-server binary, whose
+    // SIGTERM handler exits through ggml's Metal teardown and aborts (see whisper-local.ts
+    // WHISPER_STOP_SIGNAL). SIGKILL leaves no crash report; then wait so node never exits first.
+    try { child.kill('SIGKILL') } catch { /* already exited */ }
     if (!await waitForPreviewClose(child, 2_000)) {
-      try { child.kill('SIGKILL') } catch { /* already exited */ }
-      await waitForPreviewClose(child, 1_000)
+      console.warn('[whisper-preview] sidecar did not exit within 2000 ms of SIGKILL')
     }
   }
 }

package/server/lib/work-orchestrator/snapshot.ts

@@ -34,6 +34,18 @@ export const epochSeconds = (v: unknown): number | null => typeof v === 'number'
 const sidOrNull = (v: unknown): string | null => typeof v === 'string' && SID.test(v.toLowerCase()) ? v.toLowerCase() : null
 
 export function parseSnapshot(v: unknown, now = Date.now()): ControlSnapshot {
+  return parseSnapshotReport(v, now).snapshot
+}
+
+/**
+ * 7.0.13: the snapshot plus how many live rows were left out. Live rows are evidence only (what the session list
+ * showed), so a row COS cannot name by a full session id, or whose text breaks a bound, is skipped and counted instead
+ * of refusing the whole snapshot. Control 0.5.384 sent a running Claude CLI peer as `claude:<8 hex>` (the prefix id
+ * /api/claude-sessions serves) and every Work chat plan on every card failed with 400 invalid_snapshot. A row that is
+ * not an object, and every link and receipt, stay strict: links and receipts decide which sessions belong to a card.
+ */
+export function parseSnapshotReport(v: unknown, now = Date.now()): { snapshot: ControlSnapshot; droppedLiveRows: number } {
+  let droppedLiveRows = 0
   if (!obj(v) || v.version !== SNAPSHOT_VERSION || !str(v.controlVersion, 40) || !Array.isArray(v.links) || v.links.length > SNAPSHOT_MAX_LINKS
     || !Array.isArray(v.receipts) || v.receipts.length > SNAPSHOT_MAX_RECEIPTS) throw new Error('invalid_snapshot')
   const links: SnapshotLink[] = []
@@ -56,15 +68,17 @@ export function parseSnapshot(v: unknown, now = Date.now()): ControlSnapshot {
     if (!obj(v.live) || checkedAt === null || !Array.isArray(v.live.rows) || v.live.rows.length > SNAPSHOT_MAX_LIVE) throw new Error('invalid_live')
     const rows: SnapshotLiveRow[] = []
     for (const r of v.live.rows) {
-      const id = sidOrNull(r?.id)
-      if (!obj(r) || !id || !str(r.title ?? '', 300) || !str(r.status ?? '', 100) || !str(r.summary ?? '', 2000)) throw new Error('invalid_live_row')
+      if (!obj(r)) throw new Error('invalid_live_row')
+      const id = sidOrNull(r.id)
+      if (!id) { droppedLiveRows++; continue }
+      if (!str(r.title ?? '', 300) || !str(r.status ?? '', 100) || !str(r.summary ?? '', 2000)) { droppedLiveRows++; continue }
       if (isGuardianRow(id, r.title ?? '', r.summary ?? '')) continue
       rows.push({ id, title: r.title ?? '', status: r.status ?? '', updatedAt: str(r.updatedAt, 40) ? r.updatedAt : null,
         busy: r.busy === true, waitingOnUser: r.waitingOnUser === true, appOwned: r.appOwned === true, summary: r.summary ?? '' })
     }
     live = { checkedAt, rows }
   }
-  return { version: 1, controlVersion: v.controlVersion, sentAt: epochSeconds(v.sentAt) ?? now / 1000, receivedAt: now / 1000, links, receipts, live }
+  return { snapshot: { version: 1, controlVersion: v.controlVersion, sentAt: epochSeconds(v.sentAt) ?? now / 1000, receivedAt: now / 1000, links, receipts, live }, droppedLiveRows }
 }
 
 /** Codex guardian review threads (canary C3: 17 in the live list) are never offered as work sessions. */

package/server/lib/work-review-runtime.ts

@@ -112,6 +112,19 @@ export class WorkReviewRuntime {
       return { review: publicReview(await this.reconcileRow(row, true)), replayed: false }
     })
   }
+  /** S1 (2026-11-09): write a reconciled row only when something other than updatedAt changed.
+   * The 5 s timer reconciles every row; a row whose meeting stays unavailable came back identical
+   * except for a fresh updatedAt, and each put is an fsync'd rewrite of the whole journal. On
+   * Miles's Mac three such rows rewrote the 114 KB journal three times every 5 s (about 68 KB/s,
+   * some 60% of the server's idle disk writes). An unchanged row keeps its original updatedAt. */
+  private saveIfChanged(before: StoredWorkReview, after: StoredWorkReview): StoredWorkReview {
+    const { updatedAt: _a, ...left } = before
+    const { updatedAt: _b, ...right } = after
+    if (JSON.stringify(left) === JSON.stringify(right)) return before
+    after.updatedAt = this.now()
+    this.deps.store.put(after)
+    return after
+  }
   private async reconcileRow(row: StoredWorkReview, allowAdmission: boolean): Promise<StoredWorkReview> {
     if (row.status === 'superseded') return row
     const updated = structuredClone(row)
@@ -119,12 +132,12 @@ export class WorkReviewRuntime {
       const current = await this.deps.resolveMeeting(row.source.descriptor); assertRecord(current, row.source.descriptor)
       if (sourceRevision(current) !== row.source.revision) {
         updated.status = 'superseded'; updated.error = { code: 'meeting_revision_changed', message: 'The saved meeting changed. Request a new review for its current revision.' }
-        updated.updatedAt = this.now(); this.deps.store.put(updated); return updated
+        return this.saveIfChanged(row, updated)
       }
     } catch {
       if (row.status === 'ready' || row.status === 'failed') updated.suspendedTerminal = { status: row.status, ...(row.error ? { error: row.error } : {}) }
       updated.status = 'source_unavailable'; updated.error = { code: 'meeting_source_unavailable', message: 'The original saved source cannot be verified. No new work was started.' }
-      updated.updatedAt = this.now(); this.deps.store.put(updated); return updated
+      return this.saveIfChanged(row, updated)
     }
     if (row.status === 'source_unavailable' && row.suspendedTerminal) {
       // Terminal receipts outlive query-job retention. Restore only after the
@@ -132,7 +145,7 @@ export class WorkReviewRuntime {
       updated.status = row.suspendedTerminal.status
       if (row.suspendedTerminal.error) updated.error = row.suspendedTerminal.error; else delete updated.error
       delete updated.suspendedTerminal
-      updated.updatedAt = this.now(); this.deps.store.put(updated); return updated
+      return this.saveIfChanged(row, updated)
     }
     if (row.status === 'ready' || row.status === 'failed') return row
     try {
@@ -170,7 +183,7 @@ export class WorkReviewRuntime {
       if (updated.status === 'ready') { updated.status = 'source_unavailable'; delete updated.markdown }
       updated.error = { code: e instanceof WorkReviewError ? e.code : 'review_reconciliation_unavailable', message: 'Review reconciliation is unavailable. No automatic duplicate is submitted.' }
     }
-    updated.updatedAt = this.now(); this.deps.store.put(updated); return updated
+    return this.saveIfChanged(row, updated)
   }
   async reconcile(allowAdmission = false): Promise<void> {
     await this.serial(async () => { if (this.stopping) return; for (const row of this.deps.store.list()) await this.reconcileRow(row, allowAdmission) })