🔧 review fixes — the five-angle audit's whole findings list

Correctness (four were my own regressions from the REVELATION wave):
· ☸ WHEELS polymeter permanently detuned after any skipped frame —
  seqAbsStep advanced by ++ per transition, but one frame can cross two
  16ths (bpm ≳155, or the clamped dt on every tab refocus). Proven to
  drift 12 steps out at 174bpm; now advances by the true distance, so
  seqAbsStep % 16 === seqCurStep always holds.
· Sample & hold with exactly one lit step froze on its first sample
  forever (guard keyed on the wrapped step, which never changed) — now
  keyed on the absolute step.
· PSALM double-activation left the MICROPHONE HOT after "stop": the
  re-entrancy guard sat after the getUserMedia await, orphaning the
  first stream/interval/context. Guard is now synchronous, a stop
  during the prompt is honoured, and a second tap while starting
  cancels. Mic off means off — the promise the feature makes.
· Live-recording a drum tap into a short wheel wrote steps past wlen
  that never played; the tap now folds onto the lane's own wheel.
· Switching MIDI out port left notes droning on the old port (pending
  off-timers fired at the NEW one) — midiFlushOut() releases every held
  note + all-notes-off before the swap.
· world_quakes' seen-set grew unbounded on long-running rigs.

Security: stored XSS via the commune room name — the one untrusted
string reaching innerHTML unescaped (hub only lower-cased it). Escaped
client-side at both sinks, and the hub now strips markup chars too.

Robustness: world_ephemeris/world_almanac imported swisseph unguarded,
so a machine without pyswisseph crash-looped them every 10s forever
against the supervisor's exit-0 contract — both now retire quietly
(verified by simulating the missing dep), and pyswisseph is documented
in requirements.

Mobile: the top bar's five separately-pinned chips collided below
~500px — the first thing a phone visitor saw was a broken header. Now
a clean row with the account chip on its own line and the source
counter moved left.

Housekeeping: dead measureSpaced(), dead #account .code selector, and
an 888K stale worktree removed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

hub.py

@@ -25,6 +25,7 @@ import json
 import math
 import os
 import queue
+import re
 import threading
 import time
 from functools import partial
@@ -406,7 +407,9 @@ class Hub:
         if not user:                     # local/trusted hub: take the claimed name
             user = str(c.get("from") or "guest")[:24]
             self.cnames[ws] = user
-        room = str(c.get("room") or "")[:40].strip().lower()
+        # room names are rendered by the clients — strip anything markup-ish here too,
+        # so a hostile name can never reach a browser even if a client forgets to escape
+        room = re.sub(r"[<>&\"'`]", "", str(c.get("room") or ""))[:40].strip().lower()
         R = self.communes
 
         def out(names, obj):

requirements.txt

@@ -4,6 +4,8 @@ websockets>=12.0
 
 # Satellites worker (workers/world_sats.py) — SGP4 propagation from Celestrak TLEs
 #   pip install sgp4        # pure-python, no build; worker is import-safe without it
+# Sky workers (workers/world_ephemeris.py, world_almanac.py) — Swiss Ephemeris planets
+#   pip install pyswisseph  # both workers are import-safe without it (they retire quietly)
 
 # Optional: MIDI output from the hub to Ableton/TouchDesigner via a virtual port
 #   pip install python-rtmidi

viz/index.html

@@ -522,7 +522,6 @@
   #account .fbitem b { color: #9fd0ff; }
   #account .ghost { background: rgba(255,255,255,0.05); color: #b9c8e2; border: 1px solid rgba(120,150,200,0.2);
     border-radius: 7px; padding: 6px 10px; cursor: pointer; font-size: 11px; }
-  #account .code { font-family: monospace; color: #7cffb2; margin-left: 8px; font-size: 12px; }
   #account .codes { display: flex; flex-wrap: wrap; gap: 6px; margin: 8px 0 2px; }
   #account .codechip { font-family: monospace; color: #7cffb2; font-size: 12px; cursor: pointer;
     background: rgba(124,255,178,0.08); border: 1px solid rgba(124,255,178,0.3); border-radius: 6px;
@@ -662,6 +661,18 @@
   #grimoire ol.steps li { padding-left: 4px; margin: 6px 0; font-size: 13.5px; line-height: 1.65; }
   #grimoire ol.steps li::before { content: none; }
   @media (max-width: 520px){ #grimoire .spec .row { grid-template-columns: 1fr; gap: 3px; } }
+  /* ---- narrow screens: the top bar is five separately-pinned chips (gear 14, ♪ 52,
+     account 90, 🗣 92, ⏺ 132) sized for a desktop. On a phone they collide into each
+     other and the canvas source-counter. Lay them out as one right-aligned strip and
+     drop the account chip to a second row so nothing overlaps. ---- */
+  @media (max-width: 560px){
+    #gear { right: 10px; }
+    #sound { right: 44px !important; }
+    #testament { right: 78px !important; }
+    #godspeakrec { right: 122px; }
+    #authchip { top: 48px; right: 10px; max-width: 46vw; overflow: hidden;
+      text-overflow: ellipsis; white-space: nowrap; }
+  }
   body.zen > :not(#stage):not(#ctxmenu) { display: none !important; }  /* zen — nothing but the sky */
   body.perform > :not(#stage):not(#ctxmenu) { display: none !important; }  /* performance — pure visuals, no chrome */
   /* 💤 the sleeper fold — quiet feeds tuck out of the field; this chip is the door back */
@@ -2581,6 +2592,11 @@
   communeEl.id = "commune";
   document.body.appendChild(communeEl);
   function closeCommunePanel() { communeEl.classList.remove("open"); }
+  // Room names are free text typed by another player and the hub only lower-cases
+  // them — so they are UNTRUSTED and must be escaped before any innerHTML. (Usernames
+  // are already charset-validated server-side, but escape them too: one rule, no gaps.)
+  const cEsc = (s) => String(s == null ? "" : s).replace(/[&<>"']/g, (c) =>
+    ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c]));
   function openCommune() {
     communeEl.innerHTML = "";
     const x2 = document.createElement("span"); x2.className = "close"; x2.textContent = "×";
@@ -2605,7 +2621,7 @@
       for (const rm of invRooms) {
         const row = document.createElement("div"); row.className = "hrow";
         const lbl = document.createElement("span"); lbl.style.flex = "1";
-        lbl.innerHTML = "✉ <b style='color:#cfe0f5'>" + commune.invites[rm] + "</b> invites you to “" + rm + "”";
+        lbl.innerHTML = "✉ <b style='color:#cfe0f5'>" + cEsc(commune.invites[rm]) + "</b> invites you to “" + cEsc(rm) + "”";
         const acc = document.createElement("button"); acc.className = "midibtn"; acc.textContent = "join";
         acc.onclick = () => communeAccept(rm);
         const dec = document.createElement("button"); dec.className = "midibtn"; dec.textContent = "decline";
@@ -2622,8 +2638,8 @@
     } else {
       const isHost = commune.host === communeMe();
       const inRoom = document.createElement("div"); inRoom.className = "sub";
-      inRoom.innerHTML = "room: <b style='color:#cfe0f5'>" + commune.room + "</b> · host: <b style='color:#cfe0f5'>" +
+      inRoom.innerHTML = "room: <b style='color:#cfe0f5'>" + cEsc(commune.room) + "</b> · host: <b style='color:#cfe0f5'>" +
-        commune.host + "</b><br>here: " + commune.members.map(m2 => m2 === communeMe() ? m2 + " (you)" : m2).join(", ");
+        cEsc(commune.host) + "</b><br>here: " + commune.members.map(m2 => cEsc(m2) + (m2 === communeMe() ? " (you)" : "")).join(", ");
       communeEl.appendChild(inRoom);
       const claims = document.createElement("div"); claims.className = "sub";
       const held = Object.keys(commune.alloc);
@@ -3438,9 +3454,14 @@
     psalmChip.textContent = "🕊 " + (psalm.on ? (psalm.curName || "…") : "");
   }
   async function psalmSet(v) {
-    if (v && psalm.on) return;
+    // `starting` is set SYNCHRONOUSLY before the getUserMedia await — psalm.on only
+    // becomes true after it resolves, so without this a second activation during the
+    // permission prompt would orphan the first stream/interval/context and leave the
+    // microphone hot after the user "stops" listening. The promise is: mic off means off.
+    if (v && (psalm.on || psalm.starting)) return;
+    if (v) psalm.starting = true;
     if (!v) {                                            // stop + fully release the mic
-      psalm.on = false;
+      psalm.on = false; psalm.starting = false;
       if (psalm.timer) { clearInterval(psalm.timer); psalm.timer = null; }
       if (psalm.stream) { psalm.stream.getTracks().forEach(t => t.stop()); psalm.stream = null; }
       if (psalm.ctx) { try { psalm.ctx.close(); } catch (e) {} psalm.ctx = null; }
@@ -3453,7 +3474,11 @@
       const src = actx.createMediaStreamSource(stream);
       const an = actx.createAnalyser(); an.fftSize = 2048; src.connect(an);
       const buf = new Float32Array(an.fftSize), dtMs = 25;
-      Object.assign(psalm, { on: true, stream, ctx: actx, an, lastNote: -1, stableNote: -1, stableCount: 0, gateOpen: false, silentMs: 0 });
+      if (!psalm.starting) {          // stopped while the permission prompt was up — honour it, release everything
+        stream.getTracks().forEach(t => t.stop()); try { actx.close(); } catch (e) {}
+        return;
+      }
+      Object.assign(psalm, { on: true, starting: false, stream, ctx: actx, an, lastNote: -1, stableNote: -1, stableCount: 0, gateOpen: false, silentMs: 0 });
       psalmChipEnsure(); psalmPaint();
       psalm.timer = setInterval(() => {                  // setInterval, not rAF — a hidden tab shouldn't freeze the ear
         an.getFloatTimeDomainData(buf);
@@ -3465,12 +3490,12 @@
         psalmPaint();
       }, dtMs);
     } catch (e) {
-      psalm.on = false;
+      psalm.on = false; psalm.starting = false;
       eventTicker.unshift({ text: "🕊 the instrument cannot hear you — allow the microphone", tAdded: now(), src: "sys" });
       psalmPaint();
     }
   }
-  function togglePsalm() { psalmSet(!psalm.on); }
+  function togglePsalm() { psalmSet(!(psalm.on || psalm.starting)); }   // a second tap while starting = cancel
 
   // the one place a drum voice sounds — shared by seqTick AND the finger-drum keys (E.1),
   // so the sequenced path and the played path can never drift: same guard, same GM MIDI.
@@ -3580,7 +3605,10 @@
       const sq = seqs[k];
       if (sq && sq.on) {                 // sample & hold: the world only speaks on your steps
         const cur = wheelStep(sq);       // ☸ WHEELS — a short source-wheel samples on its own turn
-        if (sq.steps[cur] && sq._sampled !== cur) { sq.held = v; sq._sampled = cur; }
+        // key the "already sampled" guard on the ABSOLUTE step, not the wrapped one:
+        // a lane with a single lit step returns to the same `cur` every pass, and a
+        // wrapped key would match forever — freezing the held value on its first sample.
+        if (sq.steps[cur] && sq._sampled !== seqAbsStep) { sq.held = v; sq._sampled = seqAbsStep; }
         if (sq.held != null) v = sq.held;
       }
       sv[k] = v;
@@ -5587,7 +5615,13 @@
     }
     const frac = seqPhase - Math.floor(seqPhase);
     const st16 = frac >= seqStepOnset ? rawStep : (rawStep + 15) % 16;      // hold until the onset
-    if (st16 !== seqCurStep) { seqCurStep = st16; seqAbsStep++; seqTick(); }   // seqAbsStep drives WHEELS' per-lane wrap
+    if (st16 !== seqCurStep) {
+      // advance by the DISTANCE travelled, not by one: a frame can cross two 16ths
+      // (bpm ≳155, or the clamped dt on a tab refocus). ++ would let seqAbsStep fall
+      // behind seqCurStep forever and permanently detune every ☸ WHEELS lane.
+      seqAbsStep += ((st16 - seqCurStep) % 16 + 16) % 16;
+      seqCurStep = st16; seqTick();
+    }
 
     // the arrangement advances one column per bar
     const barAbs = Math.floor(seqPhase / 16);
@@ -7644,14 +7678,17 @@
     // counts and the header line remain.
     ctx.textBaseline = "alphabetic";
 
-    // counts (right, kept clear of the ⚙ gear button)
+    // counts (right, kept clear of the ⚙ gear button). On a phone the top-right chips
-    ctx.textAlign = "right";
+    // already fill that strip, so the counter moves to the left edge instead of colliding.
+    const tight = W < 560;
+    ctx.textAlign = tight ? "left" : "right";
     ctx.font = "500 11px 'Helvetica Neue', Arial, sans-serif";
     ctx.fillStyle = "rgba(130,150,180,0.6)";
-    ctx.fillText(sources.size + " sources · " + routesArr.length + " cables · " + dests.size + " voices", W - 58, 34);
+    const cx0 = tight ? 20 : W - 58, cy0 = tight ? 84 : 34;
+    ctx.fillText(sources.size + " sources · " + routesArr.length + " cables · " + dests.size + " voices", cx0, cy0);
     if (lastServerT) {
       ctx.fillStyle = "rgba(110,130,160,0.5)";
-      ctx.fillText("t+" + lastServerT.toFixed(1) + "s", W - 58, 50);
+      ctx.fillText("t+" + lastServerT.toFixed(1) + "s", cx0, cy0 + 16);
     }
 
     // header underline glow
@@ -7757,14 +7794,6 @@
     ctx.restore();
   }
 
-  function measureSpaced(str, font) {
-    ctx.save();
-    ctx.font = font;
-    const w = ctx.measureText(str).width;
-    ctx.restore();
-    return w;
-  }
-
   // ---------------------------------------------------------------------------
   // Footer ticker
   // ---------------------------------------------------------------------------
@@ -8130,8 +8159,9 @@
         const name = DRUM_VOICES[di], vel = ev.shiftKey ? 0.5 : 0.9;   // ⇧ = the ghost note
         fireDrum(name, vel, 60000 / Math.max(40, godtime.bpm) / 4 * 0.9);
         if (beat.rec) {                                     // record: quantize the tap to the nearest 16th, write the step
-          const step = ((Math.round(seqPhase - (beat.recAnchor || 0)) % 16) + 16) % 16;   // anchored at arm when stopped; raw grid, swing rides at playback
           const sq = drumSeqFor("drum." + name);
+          const wl = (sq.wlen && sq.wlen < 16) ? sq.wlen : 16;                            // ☸ WHEELS — fold the tap onto the lane's own wheel,
+          const step = ((Math.round(seqPhase - (beat.recAnchor || 0)) % wl) + wl) % wl;   //   else a tap past wlen writes a step that never plays
           ungodlyGesture("beat rec"); sq.steps[step] = 1; sq.vel[step] = vel;
           if (beatRefresh) beatRefresh();
         }
@@ -9390,7 +9420,7 @@
 
   function populatePorts() {
     if (!midiAccess) return;
-    fillSelect(outSel, midiAccess.outputs, midiOut, (p) => { midiOut = p; });
+    fillSelect(outSel, midiAccess.outputs, midiOut, (p) => { midiFlushOut(); midiOut = p; });   // hang up cleanly before switching
     fillSelect(inSel, midiAccess.inputs, midiIn, (p) => {
       if (midiIn) midiIn.onmidimessage = null;
       midiIn = p;
@@ -9453,6 +9483,18 @@
   // mirror of the same-pitch clamp exportMid does). So retriggering a held pitch first
   // ends the earlier note cleanly, then re-strikes — no stale off cuts the new note.
   const midiOffTimers = {};
+  // Leaving a port (or shutting up): release every note WE turned on, on the port
+  // that's still current — otherwise the pending off-timers fire at the NEW port and
+  // the old one drones forever. Mirrors the input side, which already detaches cleanly.
+  function midiFlushOut() {
+    for (const key in midiOffTimers) {
+      clearTimeout(midiOffTimers[key]); delete midiOffTimers[key];
+      const k = +key, c = (k >> 8) & 15, n = k & 255;        // object keys are strings — coerce before the shift
+      if (midiOut) { try { midiOut.send([0x80 | c, n, 0]); } catch (e) {} }
+    }
+    if (midiOut) for (let c = 0; c < 16; c++)                  // and a courtesy all-notes-off per channel
+      { try { midiOut.send([0xb0 | c, 123, 0]); } catch (e) {} }
+  }
   function midiPluck(ch, note, vel, durMs) {
     if (!midiOut || note == null || note < 0 || note > 127) return;
     const c = ch & 15, n = Math.round(note), k = (c << 8) | n;

workers/world_almanac.py

@@ -27,7 +27,12 @@ import datetime
 import math
 import time
 
-import swisseph as swe
+try:                                     # house rule: import-safe (see world_sats.py) — a
+    import swisseph as swe               # missing pyswisseph retires this worker quietly
+except Exception:                        # rather than crash-looping under the supervisor.
+    import sys
+    print("world_almanac: pyswisseph not installed — skipping (optional)")
+    sys.exit(0)
 from pythonosc.udp_client import SimpleUDPClient
 
 FLG = swe.FLG_MOSEPH | swe.FLG_SPEED

workers/world_ephemeris.py

@@ -26,7 +26,12 @@ import itertools
 import math
 import time
 
-import swisseph as swe
+try:                                     # house rule: import-safe. Without pyswisseph this
+    import swisseph as swe               # worker retires quietly (exit 0) instead of crash-
+except Exception:                        # looping every 10s under run.py's supervisor.
+    import sys
+    print("world_ephemeris: pyswisseph not installed — skipping (optional)")
+    sys.exit(0)
 from pythonosc.udp_client import SimpleUDPClient
 
 FLG = swe.FLG_MOSEPH | swe.FLG_SPEED

workers/world_quakes.py

@@ -65,6 +65,9 @@ def main():
                 if fid is None or fid in seen:
                     continue
                 seen.add(fid)
+                if len(seen) > 4000:     # the all_hour feed ages ids out, so an unbounded
+                    seen.clear()         # set is a slow leak on a long-running rig; a reset
+                    seen.add(fid)        # can at worst re-fire a quake still in the window
 
                 props = feat.get("properties") or {}
                 mag = props.get("mag")