[glm-grade=B] fix: dead dashboard WS, corrupted error.log, auth-polling storm, re-auth freeze + CVE bumps

Adversarial audit 2026-08-16 (GLM-5.3 delegate, 2 rounds, 141 tool calls):

P0-1: Dashboard WebSocket (/api/v1/ws) dead on EVERY boot since DC-076.
server.js passed module exports (DependencyManager class, {AutoRestartManager}
namespace, SSLMonitor class) instead of createApp()'s live instances — first
.on() threw ERR_INVALID_ARG_TYPE, catch swallowed it. Fix: app.locals.ctx
exposed in src/app.js; server.js passes all 8 real EventEmitter instances.

P0-2: error.log corrupted since 2026-07-14. errorMiddleware called
logError(FILE, SIZE, path, err, meta) — 5 args into a 3-arg wrapper —
logging 'Error: 5242880' garbage every ~60s and DISCARDING the real error
object. Fix: correct 3-arg call + legacy-shape guard in logErrorWrapper +
~74 log.error sites swept to pass real error objects (AST-verified scope-
safe 71/71, 29/29 modules load clean).

P0-3: auth-polling storm (stranded grade=B commit never landed in prod):
401/403 behind TOTP gate hammered /api/v1/services/status + SSE reconnect
every 2-8s, with misleading direct-probe fallback marking services 'up'.
Fix landed + B-round MEDIUM follow-up: TOTP re-auth success now clears
_dcAuthLost, resumes SSE (new _sseResume clears the latch), and refreshes.

Also: eslintignore static-sites/ (33→0 errors); nodemailer 8→9.0.5 and
sharp 0.33→0.35.3 (3 high CVEs killed; jest green on new majors);
dockerode@5/uuid deferred (semver-major, Docker API surface).

Verification: 80/80 suites, 1837/1837 tests; ESLint 0 errors/743 warnings;
node --check all changed files; bundles rebuilt + SW cache bumped.

Judges: Codex quota-dead until Aug 19 (verified live) — GLM adversarial
delegate per operator directive 2026-08-07. Round 1: 98-call mechanical
verification (timed out pre-verdict). Round 2 (this grade): B, one MEDIUM
(re-auth freeze) — fixed in this commit as prescribed.

status/js/live-events.js

@@ -3,14 +3,18 @@
   let es = null;
   let reconnectDelay = 1000;
   const MAX_RECONNECT = 30000;
+  let _sseFailCount = 0;
+  let _sseManuallyClosed = false;
 
   function connect() {
     if (es) { try { es.close(); } catch (_) {} }
+    if (_sseManuallyClosed) return; // auth-lost: don't reconnect
 
     es = new EventSource('/api/v1/events/stream');
 
     es.addEventListener('connected', () => {
       reconnectDelay = 1000; // reset backoff
+      _sseFailCount = 0; // reset failure counter
       debug('[SSE] Connected to event stream');
     });
 
@@ -101,15 +105,46 @@
     // Reconnect on error
     es.onerror = () => {
       es.close();
+      // If auth was explicitly lost (401/403 from the polling loop),
+      // don't attempt reconnection at all.
+      if (window._dcAuthLost || _sseManuallyClosed) {
+        console.warn('[SSE] Auth lost — stopping reconnection');
+        return;
+      }
+      // Transient failures: retry with exponential backoff, stop after 5
+      _sseFailCount++;
+      if (_sseFailCount > 5) {
+        console.warn('[SSE] Max reconnect attempts reached — stopping (server unreachable)');
+        return;
+      }
       console.warn(`[SSE] Disconnected, reconnecting in ${reconnectDelay / 1000}s...`);
       setTimeout(connect, reconnectDelay);
       reconnectDelay = Math.min(reconnectDelay * 2, MAX_RECONNECT);
     };
   }
 
+  // Called by grid.js when the polling loop detects auth loss (401/403)
+  function closeAndStop() {
+    _sseManuallyClosed = true;
+    if (es) { try { es.close(); } catch (_) {} }
+  }
+
+  // Called by totp-auth.js after a successful mid-session re-auth:
+  // clears the latch so connect() can proceed again and resets the
+  // failure backoff. (Plain _sseReconnect/connect() would early-return
+  // on the latch forever — the user would need a manual F5.)
+  function resumeAfterReauth() {
+    _sseManuallyClosed = false;
+    _sseFailCount = 0;
+    reconnectDelay = 1000;
+    connect();
+  }
+
   // Start on page load
   connect();
 
-  // Expose for debugging
+  // Expose for debugging and cross-module coordination
   window._sseReconnect = connect;
+  window._sseClose = closeAndStop;
+  window._sseResume = resumeAfterReauth;
 })();