@gotcos/glasses-server 6.1.0 → 6.2.1

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # Changelog
 
+## 6.2.1
+
+Foolproofing release — driven by an adversarial onboarding QA pass.
+
+- **The server now prints URLs the phone can actually use.** Boot output lists
+  your real addresses (`http://100.x.x.x:3141` labeled Tailscale, LAN IPs labeled
+  same-Wi-Fi) instead of only the un-pasteable bind address `0.0.0.0`.
+- **Auto-generated API tokens survive restarts.** First boot saves the token to
+  `~/.cos-glasses/.env`, so re-running the server no longer silently rotates the
+  credential your app already saved (the "worked yesterday, 401 today" trap).
+- **Starter-Kit COS inheritance is real now.** Run `npx @gotcos/glasses-server`
+  from your COS folder and glasses chat loads its brain: the launcher records
+  your launch directory, and when it contains `.cos/manifest.json`, `AGENTS.md`,
+  or `CLAUDE.md`, Claude/Codex spawn there (explicit `COS_SCRIPTS_DIR` still wins).
+- **Transfer-integrity report actually surfaces.** 6.2.0 recorded lost chunks but
+  never returned them; the offline-session `finalize` response now includes
+  `transferIntegrity` (received/expected/missing/completeness) and a gap-aware
+  `transcript` with inline `[… audio gap …]` markers.
+- **One default model everywhere: Sonnet.** The query router, the OpenAI-compat
+  surface, and CLI pre-warm all default to Sonnet (was a mix of Opus and Haiku).
+  Set `COS_G2_DEFAULT_MODEL` to override; per-query picks unchanged.
+
+## 6.2.0
+
+Reliability release — ports the hardening the full COS Glasses app shipped in June.
+
+- **Transfer integrity (lost-chunk detection).** The server now records every
+  received chunk index. A chunk lost in transit surfaces as an inline
+  `[… audio gap …]` marker in the gap-aware transcript instead of being
+  silently stitched over. Gap state survives a mid-meeting server restart;
+  legacy persisted sessions recover without false alarms. The Even Hub client
+  (1.0.153+) already retries failed uploads durably — this is the server half.
+- **Vocab-echo hallucination filter.** Whisper is seeded with your profile
+  vocabulary; on silence/music it can echo those terms back as phantom words
+  ("POS Nation. Thrift Cart.") the user never said. Bare-name echoes are now
+  dropped session-aware (silence echo, back-to-back run, or exact repeat) on
+  both the meeting and dictation paths. Real sentences that mention a term are
+  never dropped; plain single-word terms (names, cities) never trigger it.
+- **Name corrections on every path.** The `whisper_corrections` map now also
+  applies to iPhone-ASR candidate text and the cloud fallback, not just local
+  whisper.
+- **SIGTERM parity.** Production stops (service managers, `kill`) now flush
+  active session logs exactly like Ctrl-C did.
+- **`COS_G2_DEFAULT_MODEL` fix.** The documented default-model switch now
+  applies on the primary query path, not only the OpenAI-compat surface.
+
 ## 6.1.0
 
 - **Codex backend.** Chat now routes to your local **Codex CLI** (`codex-high`) in

package/bin/cli.cjs

@@ -13,6 +13,12 @@ const { homedir } = require('os')
 const PKG_ROOT = resolve(__dirname, '..')
 const CONFIG_DIR = join(homedir(), '.cos-glasses')
 
+// Record where the user ran `npx @gotcos/glasses-server` from. The server spawns
+// with cwd = PKG_ROOT (the npx cache), so without this the user's Starter-Kit COS
+// (AGENTS.md / CLAUDE.md / .cos/) in their launch folder would never be seen.
+// Chat spawns of claude/codex use this dir when it contains a COS brain.
+if (!process.env.COS_LAUNCH_DIR) process.env.COS_LAUNCH_DIR = process.cwd()
+
 const green = (s) => `\x1b[32m${s}\x1b[0m`
 const red = (s) => `\x1b[31m${s}\x1b[0m`
 const yellow = (s) => `\x1b[33m${s}\x1b[0m`
@@ -185,6 +191,12 @@ if (!process.env.BIND_HOST) {
 }
 
 // Step 7: start the bundled server
+try {
+  const ld = process.env.COS_LAUNCH_DIR
+  if (ld && (existsSync(join(ld, '.cos', 'manifest.json')) || existsSync(join(ld, 'AGENTS.md')) || existsSync(join(ld, 'CLAUDE.md')))) {
+    console.log(green('  ✓') + ` COS detected in ${dim(ld)} — glasses chat will load its brain`)
+  }
+} catch { /* detection is best-effort */ }
 console.log('')
 console.log(dim('  Starting server...'))
 console.log('')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.1.0",
+  "version": "6.2.1",
   "description": "COS Glasses — self-hosted AI heads-up-display server for Even G2 smart glasses, powered by your local Claude Code or Codex CLI",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -7,7 +7,9 @@ import cors from 'cors'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { createServer as createHttpsServer } from 'node:https'
-import { readFileSync, existsSync } from 'node:fs'
+import { readFileSync, existsSync, appendFileSync, mkdirSync } from 'node:fs'
+import { networkInterfaces, homedir } from 'node:os'
+import { join } from 'node:path'
 import { execSync } from 'node:child_process'
 import { randomBytes } from 'node:crypto'
 import { healthRouter } from './routes/health.js'
@@ -43,6 +45,18 @@ const BIND_HOST = process.env.BIND_HOST ?? '0.0.0.0'
 const API_TOKEN_AUTO = !process.env.COS_API_TOKEN
 const API_TOKEN = process.env.COS_API_TOKEN ?? `_${randomBytes(32).toString('base64url')}`
 process.env.COS_API_TOKEN = API_TOKEN  // make available to routes that check it
+// Persist an auto-generated token to ~/.cos-glasses/.env so it SURVIVES restarts.
+// Without this, every re-run mints a new token and the app's saved token starts
+// returning 401 — the symptom looks like a broken app, not a rotated credential.
+let API_TOKEN_PERSISTED = false
+if (API_TOKEN_AUTO) {
+  try {
+    const envDir = join(homedir(), '.cos-glasses')
+    mkdirSync(envDir, { recursive: true })
+    appendFileSync(join(envDir, '.env'), `\n# auto-generated by the server so the app token survives restarts\nCOS_API_TOKEN=${API_TOKEN}\n`)
+    API_TOKEN_PERSISTED = true
+  } catch { /* read-only home — token stays per-session */ }
+}
 
 // Server metrics — shared with /api/health for monitoring
 export const serverMetrics = {
@@ -138,7 +152,13 @@ app.get('/', (_req, res) => {
 })
 
 // Graceful shutdown — stop whisper-server child process
-process.on('SIGTERM', () => { stopWhisperServer(); process.exit(0) })
+process.on('SIGTERM', () => {
+  // Production stops (kill, service managers) send SIGTERM — flush session logs
+  // exactly like SIGINT so active conversations aren't lost on shutdown.
+  try { logActiveSessionsOnShutdown() } catch { /* best-effort flush */ }
+  stopWhisperServer()
+  process.exit(0)
+})
 process.on('SIGINT', () => { logActiveSessionsOnShutdown(); stopWhisperServer(); process.exit(0) })
 
 // Crash protection — log and survive instead of dying mid-meeting
@@ -172,11 +192,31 @@ app.listen(PORT, BIND_HOST, () => {
   console.log(`[COS API] HTTP server running on http://${BIND_HOST}:${PORT}`)
   console.log(`[COS API] Mode: ${COS_MODE ? 'COS pipeline' : 'standalone'}`)
 
+  // Print ADDRESSES THE PHONE CAN ACTUALLY REACH. The bind address (0.0.0.0) is
+  // not paste-able — enumerate real interfaces and label the Tailscale one.
+  try {
+    const nets = networkInterfaces()
+    const addrs: Array<{ ip: string; label: string }> = []
+    for (const [name, infos] of Object.entries(nets)) {
+      for (const info of infos ?? []) {
+        if (info.family !== 'IPv4' || info.internal) continue
+        const isTailscale = info.address.startsWith('100.') || name.startsWith('utun') || name.startsWith('tailscale')
+        addrs.push({ ip: info.address, label: isTailscale ? 'Tailscale — works from anywhere' : `${name} — same Wi-Fi only` })
+      }
+    }
+    if (addrs.length > 0) {
+      addrs.sort((a, b) => Number(b.label.startsWith('Tailscale')) - Number(a.label.startsWith('Tailscale')))
+      console.log('')
+      console.log('[COS API] Server URL for the COS Glasses app:')
+      for (const a of addrs) console.log(`[COS API]   http://${a.ip}:${PORT}   (${a.label})`)
+    }
+  } catch { /* interface enumeration is best-effort */ }
+
   // Print the full API token when auto-generated — the user pastes it into the app.
   if (API_TOKEN_AUTO) {
     console.log('')
     console.log(`[COS API] API Token: ${API_TOKEN}`)
-    console.log('[COS API]   ^ paste this into the COS Glasses app (set COS_API_TOKEN in .env for a fixed token)')
+    console.log('[COS API]   ^ paste this into the COS Glasses app' + (API_TOKEN_PERSISTED ? ' — saved to ~/.cos-glasses/.env so it stays the same across restarts' : ' (set COS_API_TOKEN in .env for a fixed token)'))
     console.log('')
   }
 

package/server/lib/claude-bridge.ts

@@ -12,11 +12,12 @@ import { join } from 'node:path'
 import { appendFileSync } from 'node:fs'
 import crypto from 'node:crypto'
 import { COS_SCRIPTS_DIR } from './python-bridge.js'
+import { cosBrainDir } from './launch-dir.js'
 import { logTokenAudit } from './token-audit.js'
 import { buildSystemPrompt, buildLightweightSystemPrompt, buildPrewarmSystemPrompt, getCachedContextInstant } from './context-builder.js'
 import { getHistory, addExchange, formatHistoryForPrompt, getOrCreateSession, isNewSession, markSessionNotified, getSessionModel, getSessionRaw, replaceLastExchangeWithSummary, type ModelPreference, type PromptReference } from './conversation.js'
 import { notifySessionStart, notifyExchange } from './telegram-notify.js'
-import { isClaudeModel, type ClaudeModelPreference } from '../../shared/model-preference.js'
+import { isClaudeModel, DEFAULT_MODEL, type ClaudeModelPreference } from '../../shared/model-preference.js'
 import {
   finishClaudeRun,
   getClaudeEffortLevel,
@@ -182,7 +183,7 @@ export async function preWarmCLI(): Promise<void> {
 
     const proc = spawn('claude', [
       '-p',
-      '--model', 'opus',  // Must match default query model — --resume inherits session model
+      '--model', DEFAULT_MODEL,  // Must match default query model — --resume inherits session model
       '--effort', getClaudeEffortLevel(),
       '--output-format', 'stream-json',
       '--verbose',
@@ -191,7 +192,7 @@ export async function preWarmCLI(): Promise<void> {
     ], {
       stdio: ['pipe', 'pipe', 'pipe'],
       env,
-      cwd: COS_SCRIPTS_DIR ?? process.cwd(),
+      cwd: COS_SCRIPTS_DIR ?? cosBrainDir() ?? process.cwd(),
     })
 
     let buffer = ''
@@ -419,7 +420,7 @@ export async function callClaudeStreaming(
   // Strip CLAUDECODE env var so claude -p doesn't think it's nested
   const env = { ...process.env }
   delete env.CLAUDECODE
-  const cliCwd = COS_SCRIPTS_DIR ?? process.cwd()
+  const cliCwd = COS_SCRIPTS_DIR ?? cosBrainDir() ?? process.cwd()
   const inactivityMs = INACTIVITY_BY_MODEL[resolvedModel]
   const defaultWallMax = WALL_MAX_BY_MODEL[resolvedModel]
   const wallMax = isExtendedQuery(query) ? WALL_MAX_EXTENDED_MS : defaultWallMax

package/server/lib/codex-run-ledger.ts

@@ -2,6 +2,7 @@ import crypto from 'node:crypto'
 import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs'
 import { dirname, resolve } from 'node:path'
 import { COS_SCRIPTS_DIR } from './python-bridge.js'
+import { cosBrainDir } from './launch-dir.js'
 import { CODEX_ENGINE_SESSION_TTL_MS, type CodexTrustMode } from './codex-engine-sessions.js'
 import {
   CODEX_HIGH_REASONING_EFFORT,
@@ -80,6 +81,10 @@ export function getCodexExecutionCwd(): string {
   const configured = process.env.CODEX_GLASSES_WORKDIR?.trim()
   if (configured) return resolve(configured)
   if (COS_SCRIPTS_DIR) return resolve(COS_SCRIPTS_DIR, '..', '..')
+  // A Starter-Kit COS in the directory the user launched npx from — Codex
+  // loads its AGENTS.md brain natively when run there.
+  const brain = cosBrainDir()
+  if (brain) return brain
   // Last resort when neither CODEX_GLASSES_WORKDIR nor COS_SCRIPTS_DIR is set:
   // the server's own working dir (codex glasses is an optional, env-configured feature).
   return process.cwd()

package/server/lib/hallucination-filter.ts

@@ -11,7 +11,7 @@
 //   isFullHallucination(text) — returns true if the text IS a hallucination in its
 //     entirety (silence artifacts, caption training, foreign script, filler-only).
 
-import { getNegativeRules } from './profile.js'
+import { getNegativeRules, getVocabulary, getOwnerName, loadProfileField } from './profile.js'
 
 // ── Whole-chunk silence hallucinations ─────────────────────────────────────
 const KNOWN_HALLUCINATIONS = [
@@ -312,6 +312,76 @@ export function isRepeatedThankYouOnly(text: string): boolean {
   return content.length === 0
 }
 
+// ── Vocab-echo (prompt-regurgitation) hallucination ────────────────────────
+// Whisper is seeded with an initial_prompt = the profile vocabulary (owner +
+// brands + products + people). On silence / music / ambiguous audio it ECHOES
+// that prompt, emitting the seeded terms the user never said. The brand-URL
+// filters above only catch URL echoes; a bare brand-NAME echo slips through.
+// This detector drops a chunk that is NOTHING but seeded vocab terms (+
+// punctuation). Real speech that MENTIONS a term in a sentence keeps its
+// non-vocab content words and is never dropped.
+let _vocabEchoRe: RegExp | null = null
+
+/** Bust the cached vocab matcher after a profile write. */
+export function resetVocabEchoCache(): void { _vocabEchoRe = null }
+
+function getVocabEchoMatcher(): RegExp {
+  if (_vocabEchoRe) return _vocabEchoRe
+  const raw = new Set<string>()
+  const owner = getOwnerName()
+  if (owner) raw.add(owner)
+  for (const v of getVocabulary()) if (v && v.trim()) raw.add(v.trim())
+  // Include whisper_corrections key/value variants so the echo matches whatever
+  // spelling whisper emits ("POS Nation" ↔ "POSNation", "Jewel 360" ↔ "Jewel360").
+  try {
+    const corrRaw = loadProfileField('whisper_corrections', '')
+    if (corrRaw) {
+      const map = JSON.parse(corrRaw) as Record<string, string>
+      for (const [k, val] of Object.entries(map)) { if (k) raw.add(k); if (val) raw.add(val) }
+    }
+  } catch { /* malformed corrections — ignore */ }
+  // Only UNAMBIGUOUS terms trigger an echo drop: multi-word phrases ("POS Nation",
+  // "IT Retail", "Jeremy Sokolic") and brand-shaped single tokens with an internal
+  // capital or digit ("POSNation", "CaratIQ", "Jewel360"). Plain single-word tokens
+  // ("Austin", "Miles", "Ukaoma") are common words / ambiguous and are EXCLUDED —
+  // they carry too much false-drop risk for an always-on list rule.
+  const terms = [...raw].filter(t => {
+    if (t.length < 2) return false
+    if (/\s/.test(t)) return true                 // multi-word phrase
+    return /[A-Z0-9]/.test(t.slice(1))            // single token only if brand-shaped
+  }).sort((a, b) => b.length - a.length)
+  if (terms.length === 0) { _vocabEchoRe = /(?!)/g; return _vocabEchoRe }
+  // Escape regex metachars; flex internal whitespace so "IT Retail" also matches
+  // "ITRetail". Word-bounded so terms don't match inside larger words.
+  const alt = terms.map(t => t.replace(/[.*+?^${}()|[\]\\]/g, '\\$&').replace(/\s+/g, '\\s*')).join('|')
+  _vocabEchoRe = new RegExp(`\\b(?:${alt})\\b`, 'gi')
+  return _vocabEchoRe
+}
+
+/** Count distinct seeded-vocab terms present in `text`. */
+export function countVocabTerms(text: string): number {
+  if (!text) return 0
+  const re = getVocabEchoMatcher()
+  re.lastIndex = 0
+  const found = new Set<string>()
+  let m: RegExpExecArray | null
+  while ((m = re.exec(text)) !== null) {
+    found.add(m[0].toLowerCase().replace(/\s+/g, ''))
+    if (m.index === re.lastIndex) re.lastIndex++  // guard against a zero-width match loop
+  }
+  return found.size
+}
+
+/** True iff `text` is non-empty and contains NOTHING but seeded vocab terms (plus
+ *  punctuation/whitespace) — the prompt-echo hallucination shape. Any non-vocab
+ *  content word (incl. connectives like "and"/"the") makes it real speech → false. */
+export function isVocabEchoOnly(text: string): boolean {
+  if (!text || !text.trim()) return false
+  if (countVocabTerms(text) === 0) return false
+  const residual = text.replace(getVocabEchoMatcher(), ' ').replace(/[^a-z0-9]/gi, '')
+  return residual.length === 0
+}
+
 /** Streaming-chunk silence-drop decision. Pure + exported so the gate is testable
  *  (sanitizeStreamTranscript is private). Returns a fallbackReason or null. Contract:
  *    brand-URL-only  -> 'brand_url'        DROP ALWAYS — brand URLs are vocab-seeded,
@@ -320,6 +390,9 @@ export function isRepeatedThankYouOnly(text: string): boolean {
  *                                          third-party URL during speech is preserved.
  *    thank-you-only  -> 'thankyou_silence' DROP only when isQuiet — soft real closings
  *                                          stay (see isRepeatedThankYouOnly).
+ *  Vocab-echo (prompt regurgitation) is handled SEPARATELY in sanitizeStreamTranscript
+ *  because the safe rule is session-aware (drop a silence echo or a back-to-back RUN,
+ *  but keep a single loud one-off that could be a real terse brand/name list).
  *  Real speech (any chunk with content words) always returns null. */
 export function streamSilenceDropReason(text: string, isQuiet: boolean): 'brand_url' | 'url_silence' | 'thankyou_silence' | null {
   if (!text || !text.trim()) return null

package/server/lib/launch-dir.ts

@@ -0,0 +1,29 @@
+// COS brain auto-detection for the "glasses inherit your COS" promise.
+//
+// The npx launcher (bin/cli.cjs) records the directory the user ran `npx
+// @gotcos/glasses-server` from as COS_LAUNCH_DIR before re-spawning the server
+// with cwd = the package root. If that launch directory contains a COS brain
+// (a Starter-Kit scaffold: .cos/manifest.json, AGENTS.md, or CLAUDE.md), chat
+// spawns of claude/codex use IT as their working directory — so the CLIs load
+// the user's brain exactly as they would in a terminal session in that folder.
+//
+// Precedence stays: COS_SCRIPTS_DIR (full COS pipeline) > detected brain dir >
+// process.cwd(). Explicit config always wins.
+import { existsSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+
+let cached: string | null | undefined
+
+/** The user's launch directory IF it contains a COS brain; otherwise null. */
+export function cosBrainDir(): string | null {
+  if (cached !== undefined) return cached
+  const raw = process.env.COS_LAUNCH_DIR?.trim()
+  if (!raw) { cached = null; return cached }
+  const dir = resolve(raw)
+  const hasBrain =
+    existsSync(join(dir, '.cos', 'manifest.json')) ||
+    existsSync(join(dir, 'AGENTS.md')) ||
+    existsSync(join(dir, 'CLAUDE.md'))
+  cached = hasBrain ? dir : null
+  return cached
+}

package/server/lib/model-router.ts

@@ -24,7 +24,11 @@ export async function callModelStreaming(
 ): Promise<string> {
   const sid = getOrCreateSession(sessionId)
   const sessionModel = getSessionModel(sid)
-  const resolvedModel = normalizeModelPreference(model) ?? sessionModel ?? DEFAULT_MODEL
+  // COS_G2_DEFAULT_MODEL is the documented default-model switch (CHANGELOG 6.1.0);
+  // it must win over the hardcoded DEFAULT_MODEL on this primary query path, not
+  // just the OpenAI-compat surface.
+  const envDefault = normalizeModelPreference(process.env.COS_G2_DEFAULT_MODEL)
+  const resolvedModel = normalizeModelPreference(model) ?? sessionModel ?? envDefault ?? DEFAULT_MODEL
 
   setSessionModel(sid, resolvedModel)
 

package/server/lib/transcribe-audio.ts

@@ -17,6 +17,8 @@ import { enhanceAudio } from './audio-enhance.js'
 import {
   stripInlineHallucinationsOneShot,
   isFullHallucination,
+  isVocabEchoOnly,
+  countVocabTerms,
 } from './hallucination-filter.js'
 import { getOpenAIKey } from './openai-key.js'
 
@@ -173,7 +175,11 @@ export async function transcribeAudioBuffer(audioBuffer: Buffer, opts: { mode?:
   }
 
   const elapsedMs = performance.now() - tStart
-  if (!text || isFullHallucination(text)) {
+  // A one-shot message/dictation that is NOTHING but a list of seeded vocab terms
+  // (>=2 distinct) is a whisper prompt-echo, not speech — drop it like the meeting
+  // path does. A single terse brand mention stays (could be a real one-word message).
+  const vocabEcho = isVocabEchoOnly(text) && countVocabTerms(text) >= 2
+  if (!text || isFullHallucination(text) || vocabEcho) {
     throw new NoSpeechDetectedError(text || '')
   }
 

package/server/routes/openai-compat.ts

@@ -6,7 +6,7 @@
 import { Router } from 'express'
 import { preWarmCLI, logLatency } from '../lib/claude-bridge.js'
 import { callModelStreaming } from '../lib/model-router.js'
-import { normalizeModelPreference, type ModelPreference } from '../../shared/model-preference.js'
+import { normalizeModelPreference, DEFAULT_MODEL, type ModelPreference } from '../../shared/model-preference.js'
 import { tryInstantResponse } from '../lib/response-cache.js'
 import crypto from 'node:crypto'
 
@@ -79,7 +79,7 @@ function resolveModel(model?: string, _query?: string): ModelPreference {
   if (model === 'cos-sonnet') return 'sonnet'
   if (model === 'cos-haiku') return 'haiku'
   if (model === 'cos-codex-high' || model === 'cos-codex') return 'codex-high'
-  return normalizeModelPreference(process.env.COS_G2_DEFAULT_MODEL) ?? 'haiku'
+  return normalizeModelPreference(process.env.COS_G2_DEFAULT_MODEL) ?? DEFAULT_MODEL
 }
 
 const MODEL_NAMES: Record<ModelPreference, string> = {

package/server/routes/transcribe-stream.ts

@@ -14,7 +14,7 @@ import { getOpenAIKey } from '../lib/openai-key.js'
 const __dirname = fileURLToPath(new URL('.', import.meta.url))
 import { emitDisplay } from '../lib/display-bus.js'
 import { errMsg } from '../lib/utils.js'
-import { transcribeLocal, isWhisperLocalAvailable, type WhisperWord } from '../lib/whisper-local.js'
+import { transcribeLocal, isWhisperLocalAvailable, applyCorrections, type WhisperWord } from '../lib/whisper-local.js'
 import { enhanceAudio } from '../lib/audio-enhance.js'
 import { trimSilence, isSileroAvailable } from '../lib/vad-silero.js'
 import { identifySpeaker, isEmbeddingAvailable, autoEnroll, getEmbeddingCount } from '../lib/speaker-embeddings.js'
@@ -29,6 +29,7 @@ import {
   isFullHallucination as sharedIsFullHallucination,
   clearSessionHallucinationState,
   streamSilenceDropReason,
+  isVocabEchoOnly,
 } from '../lib/hallucination-filter.js'
 
 // Silence-hallucination drops (2026-05-29, v5.9.73). Contract in streamSilenceDropReason:
@@ -170,6 +171,18 @@ interface TranscriptSession {
   startTime: number
   title: string
   providerCandidates?: Record<string, ProviderCandidateRecord>
+  // ── Transfer integrity (lost-chunk detection) ──────────────
+  // Every chunkIndex the server received an audio POST for — recorded at
+  // ingest BEFORE any text filtering, so a "received but silent" chunk counts
+  // as delivered (not a gap). A genuine hole (index in [0, maxChunkIndex] that
+  // never arrived = a chunk lost in transit) is the only thing flagged as a gap.
+  // Sorted, de-duplicated. See computeGapReport()/analyzeTranscriptGaps().
+  receivedIndices?: number[]
+  maxChunkIndex?: number
+  // Count of consecutive vocab-echo (prompt-regurgitation) chunks. Reset to 0 by
+  // any real-content chunk. Used to drop a RUN of echoed brand names while keeping
+  // a single loud one-off (which could be a real terse list). See sanitizeStreamTranscript.
+  vocabEchoStreak?: number
 }
 
 const sessions = new Map<string, TranscriptSession>()
@@ -238,11 +251,24 @@ function persistSession(sessionId: string): void {
     const session = sessions.get(sessionId)
     if (!session) return
     const filePath = resolve(CHUNK_PERSIST_DIR, `${sessionId}.json`)
+    // chunksIndexed preserves each chunk's original index (a plain filter()
+    // would collapse the sparse array and destroy gap positions on recovery).
+    const chunksIndexed: Array<{ i: number; c: TranscriptChunk }> = []
+    for (let i = 0; i < session.chunks.length; i++) {
+      const c = session.chunks[i]
+      if (c && c.text) chunksIndexed.push({ i, c })
+    }
     const data = JSON.stringify({
       sessionId,
       startTime: session.startTime,
       title: session.title,
-      chunks: session.chunks.filter(c => c && c.text),
+      // `chunks` = legacy dense form, kept for backward compatibility with
+      // existing readers; `chunksIndexed` preserves original indices so gap
+      // detection survives recovery. Recovery prefers chunksIndexed.
+      chunks: chunksIndexed.map(e => e.c),
+      chunksIndexed,
+      receivedIndices: session.receivedIndices ?? [],
+      maxChunkIndex: session.maxChunkIndex ?? -1,
       providerCandidates: session.providerCandidates ?? {},
     })
     writeFileSync(filePath, data, 'utf-8')
@@ -259,13 +285,52 @@ function recoverSessions(): void {
       if (!file.endsWith('.json')) continue
       try {
         const data = JSON.parse(readFileSync(resolve(CHUNK_PERSIST_DIR, file), 'utf-8'))
-        if (data.sessionId && data.chunks && data.chunks.length > 0) {
+        // Reconstruct the (sparse) chunk array. New format keeps original
+        // indices via chunksIndexed; legacy format stored a dense `chunks`.
+        const indexed: Array<{ i: number; c: TranscriptChunk }> | null =
+          Array.isArray(data.chunksIndexed) ? data.chunksIndexed : null
+        const legacy: TranscriptChunk[] | null = Array.isArray(data.chunks) ? data.chunks : null
+        const hasChunks = (indexed && indexed.length > 0) || (legacy && legacy.length > 0)
+        if (data.sessionId && hasChunks) {
           // Only recover sessions less than 4 hours old
           if (Date.now() - data.startTime < 4 * 60 * 60 * 1000) {
+            const chunks: TranscriptChunk[] = []
+            if (indexed) {
+              for (const e of indexed) {
+                if (e && Number.isInteger(e.i) && e.i >= 0 && e.c) chunks[e.i] = e.c
+              }
+            } else if (legacy) {
+              for (let k = 0; k < legacy.length; k++) if (legacy[k]) chunks[k] = legacy[k]
+            }
+            // Restore the received-index ledger. A legacy file (pre-feature)
+            // has no ledger and no way to know whether a chunk was truly lost,
+            // so deriving from stored positions would FALSELY flag a
+            // received-but-silent chunk as a gap. Instead, treat a legacy
+            // session as contiguous (0..maxStored) → it reports 100%, never a
+            // false alarm. New-format files carry their own ledger and are exact.
+            const hasLedger = Array.isArray(data.receivedIndices)
+            let receivedIndices: number[]
+            let maxChunkIndex: number
+            if (hasLedger) {
+              receivedIndices = Array.from(new Set(
+                (data.receivedIndices as unknown[]).filter((n): n is number => Number.isInteger(n) && (n as number) >= 0),
+              )).sort((a, b) => a - b)
+              maxChunkIndex = typeof data.maxChunkIndex === 'number' && data.maxChunkIndex >= 0
+                ? data.maxChunkIndex
+                : (receivedIndices.length > 0 ? receivedIndices[receivedIndices.length - 1] : -1)
+            } else {
+              let maxStored = -1
+              for (let k = 0; k < chunks.length; k++) if (chunks[k]) maxStored = k
+              receivedIndices = []
+              for (let k = 0; k <= maxStored; k++) receivedIndices.push(k)
+              maxChunkIndex = maxStored
+            }
             const session: TranscriptSession = {
-              chunks: data.chunks,
+              chunks,
               startTime: data.startTime,
               title: data.title || '',
+              receivedIndices,
+              maxChunkIndex,
               providerCandidates: data.providerCandidates && typeof data.providerCandidates === 'object'
                 ? data.providerCandidates
                 : {},
@@ -293,7 +358,8 @@ function recoverSessions(): void {
               console.log(`[session-recovery] Cleaned inline hallucinations from ${cleaned} chunks`)
               persistSession(data.sessionId)  // re-persist cleaned data to disk
             }
-            console.log(`[session-recovery] Recovered ${data.chunks.length} chunks for ${data.sessionId}`)
+            const gaps = computeGapReport(session).missingIndices.length
+            console.log(`[session-recovery] Recovered ${session.chunks.filter(c => c && c.text).length} chunks for ${data.sessionId}${gaps > 0 ? ` (${gaps} lost-chunk gap${gaps > 1 ? 's' : ''})` : ''}`)
           } else {
             // Stale — clean up
             unlinkSync(resolve(CHUNK_PERSIST_DIR, file))
@@ -410,13 +476,106 @@ export function getSession(sessionId: string): TranscriptSession {
   return session
 }
 
-/** Get full accumulated transcript for a session (with speaker labels) */
-export function getSessionTranscript(sessionId: string): string | null {
+/** Insert a non-negative integer into a sorted array, keeping it sorted and
+ *  unique. Common case (a new highest value) is O(1); out-of-order (a retry)
+ *  is a binary-search insert. Mutates `arr`. Exported for unit tests. */
+export function insertSortedUnique(arr: number[], value: number): void {
+  if (!Number.isInteger(value) || value < 0) return
+  const last = arr.length > 0 ? arr[arr.length - 1] : -1
+  if (value > last) { arr.push(value); return }
+  if (value === last) return
+  let lo = 0, hi = arr.length
+  while (lo < hi) {
+    const mid = (lo + hi) >> 1
+    if (arr[mid] < value) lo = mid + 1
+    else hi = mid
+  }
+  if (arr[lo] !== value) arr.splice(lo, 0, value)
+}
+
+/** Record that the server received an audio POST for this chunk index.
+ *  Called at ingest before any text filtering, so silent/empty chunks still
+ *  count as delivered (not a gap). */
+function recordReceivedChunk(session: TranscriptSession, chunkIndex: number): void {
+  if (!Number.isInteger(chunkIndex) || chunkIndex < 0) return
+  if (!session.receivedIndices) session.receivedIndices = []
+  insertSortedUnique(session.receivedIndices, chunkIndex)
+  if (session.maxChunkIndex == null || chunkIndex > session.maxChunkIndex) {
+    session.maxChunkIndex = chunkIndex
+  }
+}
+
+export interface TranscriptGapReport {
+  received: number          // distinct chunk indices the server got
+  stored: number            // chunks that survived filtering (have text)
+  maxIndex: number          // highest chunk index seen (-1 if none)
+  expected: number          // maxIndex + 1
+  missingIndices: number[]  // indices in [0, maxIndex] never received = lost in transit
+  completeness: number      // received / expected (1 when nothing expected)
+}
+
+/** Pure gap math over a received-index ledger. Exported for unit tests. */
+export function analyzeChunkGaps(receivedIndices: number[], maxChunkIndex: number, storedCount = 0): TranscriptGapReport {
+  const maxIndex = maxChunkIndex
+  const expected = maxIndex + 1
+  const recvSet = new Set(receivedIndices.filter(n => Number.isInteger(n) && n >= 0))
+  const missingIndices: number[] = []
+  for (let i = 0; i <= maxIndex; i++) {
+    if (!recvSet.has(i)) missingIndices.push(i)
+  }
+  const completeness = expected > 0 ? recvSet.size / expected : 1
+  return { received: recvSet.size, stored: storedCount, maxIndex, expected, missingIndices, completeness }
+}
+
+/** Gap report bound to a live session's ledger + stored-chunk count. */
+function computeGapReport(session: TranscriptSession): TranscriptGapReport {
+  const received = session.receivedIndices ?? []
+  const maxIndex = session.maxChunkIndex ?? (received.length > 0 ? received[received.length - 1] : -1)
+  const stored = session.chunks.filter(c => c && c.text).length
+  return analyzeChunkGaps(received, maxIndex, stored)
+}
+
+/** Transfer-integrity report for a live session — null if the session is gone. */
+export function analyzeTranscriptGaps(sessionId: string): TranscriptGapReport | null {
   const session = sessions.get(sessionId)
   if (!session) return null
-  return session.chunks
-    .map(c => c.speaker ? `[${c.speaker}]: ${c.text}` : c.text)
-    .join('\n')
+  return computeGapReport(session)
+}
+
+/** Get full accumulated transcript for a session (with speaker labels).
+ *  With { withGaps: true }, walks the index sequence and inserts an explicit
+ *  marker wherever one or more chunks were never received — so permanently
+ *  lost audio is visible in the saved transcript instead of silently stitched. */
+export function getSessionTranscript(sessionId: string, opts: { withGaps?: boolean } = {}): string | null {
+  const session = sessions.get(sessionId)
+  if (!session) return null
+  const renderChunk = (c: TranscriptChunk): string => (c.speaker ? `[${c.speaker}]: ${c.text}` : c.text)
+  if (!opts.withGaps) {
+    return session.chunks.map(renderChunk).join('\n')
+  }
+  const report = computeGapReport(session)
+  if (report.missingIndices.length === 0) {
+    return session.chunks.map(renderChunk).join('\n')
+  }
+  const missing = new Set(report.missingIndices)
+  const lines: string[] = []
+  let gapRun = 0
+  const flushGap = (): void => {
+    if (gapRun > 0) {
+      // Marker is intentionally >40 inner chars so it can't match the
+      // bracket-shaped hallucination filter (/^\s*\[[^\]\n]{1,40}\]\s*$/).
+      lines.push(`[… audio gap — ${gapRun} chunk${gapRun > 1 ? 's' : ''} lost in transit, not received by server …]`)
+      gapRun = 0
+    }
+  }
+  for (let i = 0; i <= report.maxIndex; i++) {
+    if (missing.has(i)) { gapRun++; continue }
+    flushGap()
+    const c = session.chunks[i]
+    if (c && c.text) lines.push(renderChunk(c))
+  }
+  flushGap()
+  return lines.join('\n')
 }
 
 /** Get structured chunks with timing + speaker confidence (for blended meeting pipeline) */
@@ -599,6 +758,26 @@ function sanitizeStreamTranscript(sessionId: string, session: TranscriptSession,
       return { text: '', fallbackReason: dropReason }
     }
   }
+  // Vocab-echo (whisper regurgitating its seeded vocab prompt — phantom brand names).
+  // Session-aware so we never drop a real one-off: a chunk that is NOTHING but seeded
+  // terms is dropped only when (a) the audio is quiet (a silence echo), (b) it's the
+  // 2nd+ consecutive such chunk (a RUN — the "repeated multiple times" symptom), or
+  // (c) it exactly repeats a recent chunk. A single loud, non-repeating vocab-only
+  // chunk is KEPT (it could be a real terse brand/name list). Accepted trade: if a
+  // user genuinely dictates a brand list with NO connectives across consecutive
+  // chunks ("POS Nation," | "Thrift Cart," | "and IT Retail"), the middle chunk can
+  // be dropped — rare (whisper usually bundles a spoken list into one chunk, which
+  // is kept) and far less harmful than the phantom-brand spam this prevents.
+  if (trimmedText && STRIP_BRAND_URLS && isVocabEchoOnly(trimmedText)) {
+    const streak = (session.vocabEchoStreak ?? 0) + 1
+    session.vocabEchoStreak = streak
+    if (isQuiet || streak >= 2 || isCrossChunkRepeat(session, trimmedText)) {
+      console.log(`[hallucination] Dropped (vocab_echo, q=${isQuiet ? 1 : 0}, streak=${streak}): "${trimmedText.slice(0, 60)}"`)
+      return { text: '', fallbackReason: 'vocab_echo' }
+    }
+  } else if (trimmedText) {
+    session.vocabEchoStreak = 0
+  }
   if (trimmedText && isServerHallucination(trimmedText)) {
     return { text: '', fallbackReason: 'hallucination' }
   }
@@ -741,6 +920,9 @@ async function processStreamChunk(opts: {
 
   const audioSha256 = sha256Hex(audioBuffer)
   const session = getSession(sessionId)
+  // Transfer integrity: log this index as delivered before any text filtering,
+  // so a silent/hallucination-filtered chunk is NOT mistaken for a lost one.
+  recordReceivedChunk(session, chunkIndex)
   const alreadyCanonical = session.chunks[chunkIndex]
 
   let candidateRecordKey: string | undefined
@@ -819,11 +1001,17 @@ async function processStreamChunk(opts: {
     backend = result.backend
   }
 
+  // Apply deterministic name corrections (whisper_corrections map) on EVERY live
+  // path: the iPhone-ASR candidate path and the cloud fallback skip
+  // transcribeLocal's internal pass, so without this the lens would show names
+  // uncorrected for those sources. Idempotent for the local path.
+  rawText = applyCorrections(rawText)
+
   let sanitized = sanitizeStreamTranscript(sessionId, session, rawText, isQuiet)
   if (candidate && (!sanitized.text || sanitized.fallbackReason)) {
     fallbackReason = sanitized.fallbackReason || 'empty_candidate'
     const result = await transcribeWithServerWhisper(audioBuffer, whisperAudio, whisperContext, isQuiet)
-    rawText = result.text
+    rawText = applyCorrections(result.text)
     words = result.words
     backend = result.backend
     asrProvider = 'server-whisper'
@@ -982,11 +1170,16 @@ transcribeStreamRouter.post('/transcribe-stream/offline-sessions/:sessionId/fina
     const chunks = getSessionChunks(sessionId)
     if (!chunks || chunks.length === 0) throw makeHttpError(404, 'offline session has no chunks', 'session_not_found')
     await drainSessionAudioWrites(sessionId)
-    const transcript = getSessionTranscript(sessionId) ?? ''
+    // Gap-aware assembly: chunks lost in transit surface as inline
+    // "[… audio gap …]" markers instead of being silently stitched over.
+    const transcript = getSessionTranscript(sessionId, { withGaps: true }) ?? ''
+    const transferIntegrity = analyzeTranscriptGaps(sessionId)
     res.json({
       sessionId,
       chunks: chunks.length,
       transcriptChars: transcript.length,
+      transcript,
+      transferIntegrity,
       readyToSave: true,
     })
   } catch (err: unknown) {

package/shared/model-preference.ts

@@ -2,7 +2,7 @@ export type ClaudeModelPreference = 'opus' | 'sonnet' | 'haiku'
 export type CodexModelPreference = 'codex-high'
 export type ModelPreference = ClaudeModelPreference | CodexModelPreference
 
-export const DEFAULT_MODEL = 'opus' as const
+export const DEFAULT_MODEL = 'sonnet' as const
 export const CODEX_HIGH_MODEL: CodexModelPreference = 'codex-high'
 
 // Optional codex model passed to `codex exec --model`. Empty (the default) means