@gotcos/glasses-server 6.10.0 → 6.12.0

package/.env.example

@@ -58,8 +58,10 @@ BIND_HOST=0.0.0.0
 
 # ── VOICE (optional) ────────────────────────────────────────────────────
 # Local transcription is FREE via whisper.cpp (brew install whisper-cpp; the
-# model auto-downloads on first run). If whisper.cpp is absent, voice falls
-# back to the OpenAI API (~$0.006/min), which needs this key.
+# model auto-downloads on first run). Voice is local-only by default. Merely
+# configuring a key never uploads audio. To allow OpenAI Whisper only after a
+# local failure, set BOTH the exact opt-in and a key:
+# COS_OPENAI_WHISPER_FALLBACK=1
 # OPENAI_API_KEY=sk-...
 
 # ── FULL COS PIPELINE (optional — leave unset for standalone) ────────────

package/CHANGELOG.md

@@ -1,5 +1,56 @@
 # Changelog
 
+## 6.12.0
+
+Local-first transcription policy and capability-safe recovery diagnostics for
+COS Glasses build 210+.
+
+- **Local means local.** Prompt, one-shot, and meeting transcription now remain
+  on local Whisper by default. Finding an OpenAI key is not permission to upload
+  audio. Cloud Whisper is reachable only when the exact
+  `COS_OPENAI_WHISPER_FALLBACK=1` opt-in and a resolved key are both present.
+- **Every cloud chokepoint is fenced.** Both one-shot/prompt finalization and
+  continuous meeting transcription recheck the policy immediately before any
+  OpenAI request, preventing a future call-site regression from bypassing the
+  top-level selection logic.
+- **Failure stays recoverable.** A local ASR outage returns a typed retryable
+  `503` instead of silently switching providers. Durable prompt chunks and raw
+  meeting audio remain available for retry; meeting receipt and batch-audio
+  retention behavior is unchanged.
+- **Clients can tell policy from health.** `/api/health` and `/api/models`
+  publish additive `capabilities.transcription` fields. Public installs also
+  advertise every privileged recovery control as unsupported, allowing newer
+  phone Recovery Centers to hide controls instead of reporting false outages.
+- **Backward compatible.** Existing routes and response fields remain in place.
+  Older apps keep their current query, prompt, meeting, image, and display
+  paths; cloud fallback remains available to operators who explicitly enable it.
+
+## 6.11.0
+
+Local-first meeting recovery for COS Glasses build 209+.
+
+- **Record through network loss.** The server advertises a versioned
+  `localFirstMeetings` capability with its stable instance ID. Compatible
+  clients can keep audio locally, reconnect to the same server, and reconcile
+  the exact sparse set of chunks it durably received.
+- **Durable means acknowledged.** Raw meeting WAVs and the received-index
+  ledger are committed atomically before a chunk receives success. Storage
+  failures return typed retryable errors; capacity exhaustion returns `507`
+  instead of silently discarding audio.
+- **Long meetings stay alive.** Active-session retention is measured from the
+  last durable activity, not the meeting start time, so recordings longer than
+  four hours are not mistaken for abandoned sessions.
+- **Safe reconnect and close.** Authenticated session-status responses expose
+  exact compressed receive ranges, retention, and closed/saved state. Durable
+  tombstones prevent a late or replaying client from recreating a completed
+  meeting after a restart.
+- **Idempotent finalization.** Repeating `POST /api/meeting/save` for an already
+  saved session returns the original versioned receipt and filename without
+  creating a second meeting.
+- **Backward compatible.** Existing live transcription, meeting save, prompt
+  recovery, durable queries, and older clients retain their prior routes and
+  fields. The new capability, receipt fields, and status route are additive.
+
 ## 6.10.0
 
 Opt-in server-owned durable query jobs for COS Glasses build 204+.

package/README.md

@@ -27,7 +27,7 @@ without silently losing completed replies.
 - **Claude Code CLI** (Opus/Fable/Sonnet) — https://claude.ai/download, then `claude login`
   _or_ **Codex CLI** (GPT Frontier/Balanced) — https://developers.openai.com/codex/, then `codex login`
 - **Even G2 glasses** + the **COS Glasses** app from the Even Hub
-- _Optional:_ `brew install whisper-cpp` for free local voice (otherwise OpenAI API)
+- `brew install whisper-cpp` for free local voice (the launcher can download the model)
 - _Optional:_ `brew install ffmpeg` for phone/output image attachments (text chat remains available without it)
 - _Optional:_ **Tailscale** so your phone reaches your Mac from anywhere
 
@@ -72,7 +72,14 @@ The built-in IP allowlist blocks public-internet traffic regardless.
   compatible app builds, their warm transcript also appears live while speaking;
   final HQ transcription remains authoritative.
 - Live voice capture + transcription during meetings
-- Local whisper.cpp transcription (free) with OpenAI fallback (optional)
+- With COS Glasses build 209+ and server 6.11.0+, meetings continue recording
+  locally through a network interruption. Reconnecting reconciles the exact
+  chunks already stored by the Mac, uploads only missing audio, and finalizes
+  through an idempotent save receipt without duplicating the meeting.
+- Local whisper.cpp transcription (free and local-only by default). OpenAI
+  Whisper fallback is optional and requires both the exact
+  `COS_OPENAI_WHISPER_FALLBACK=1` opt-in and a configured key; a key alone never
+  uploads audio.
 - Tasks / calendar / people context **if** you run the
   [COS Starter Kit](https://www.gotcos.com) (`COS_SCRIPTS_DIR`); otherwise it is
   glasses + AI only
@@ -81,7 +88,8 @@ The built-in IP allowlist blocks public-internet traffic regardless.
 
 Config lives at `~/.cos-glasses/.env` (created on first run). Every key is
 optional except an installed CLI. Highlights: `BIND_HOST`, `PORT`,
-`COS_API_TOKEN` (auto if unset), `OPENAI_API_KEY` (cloud voice fallback),
+`COS_API_TOKEN` (auto if unset), `COS_OPENAI_WHISPER_FALLBACK=1` plus
+`OPENAI_API_KEY` (explicit cloud voice fallback),
 `COS_SCRIPTS_DIR` (full pipeline), `COS_DURABLE_QUERY_JOBS=1` (build 204+
 server-owned query recovery), and `COS_MEDIA_ROOT` (optional image-store
 location; default `~/.cos-glasses/data/media`). Your name + transcription vocabulary live in
@@ -101,13 +109,24 @@ BIND_HOST=0.0.0.0 npm run start:server
 - *Phone can't connect* — check `BIND_HOST=0.0.0.0`, the same Tailscale account on both devices, and the correct `100.x` IP + token.
 - *Safari connects but the app does not* — confirm `npx @gotcos/glasses-server@latest` is 6.6.0+, then use the app's server reconnect/edit control to verify the current URL and token. Do not run a second source or `npx` server alongside it.
 - *AI queries fail* — run `claude --version` / `codex --version`, then `claude login` / `codex login`.
-- *Voice getting billed?* — install `whisper-cpp` for free local transcription.
+- *Voice getting billed?* — voice is local-only by default in 6.12.0+. Confirm
+  `/api/health` reports `capabilities.transcription.mode: "local-only"`. Remove
+  `COS_OPENAI_WHISPER_FALLBACK` (or set it to `0`) to disable an earlier opt-in.
+- *Local voice unavailable?* — install `whisper-cpp`, restart the server, and
+  confirm `/api/health` reports `features.whisper: true`. A typed retryable 503
+  keeps compatible prompt/meeting audio available for retry instead of silently
+  sending it to OpenAI.
 - *Photos unavailable?* — install `ffmpeg`, restart the server, and confirm `/api/health` reports `features.mediaProcessingReady: true`.
 - *Prompt recovery unavailable?* — update with `npx @gotcos/glasses-server@latest`, then confirm `/api/health` reports `features.promptRecovery: true`.
 - *Durable query recovery unavailable?* — build 204+ requires server 6.10.0+ and
   `COS_DURABLE_QUERY_JOBS=1`. Restart once, then confirm `/api/health` reports
   `features.durableQueryJobs: true`, protocol `1`, and state `ready`. To roll
   back, remove the flag; accepted jobs still drain while new prompts use legacy streaming.
+- *Offline meeting recovery unavailable?* — build 209+ requires server 6.11.0+.
+  Restart once, then confirm `/api/health` reports
+  `features.localFirstMeetings: true` and
+  `capabilities.localFirstMeetings.protocolVersion: 1`. Older app builds keep
+  using their existing live-transcription and meeting-save paths.
 
 ## License
 

package/bin/cli.cjs

@@ -133,7 +133,8 @@ if (!existsSync(PROFILE_FILE) && existsSync(PROFILE_EXAMPLE)) {
 }
 if (!process.env.COS_PROFILE_PATH) process.env.COS_PROFILE_PATH = PROFILE_FILE
 
-// Step 5: local Whisper detection + model download (free voice; OpenAI fallback otherwise)
+// Step 5: local Whisper detection + model download. Voice stays local-only by
+// default; cloud fallback requires an explicit flag plus a configured key.
 const WHISPER_KNOWN_PATHS = ['/opt/homebrew/bin/whisper-cli', '/usr/local/bin/whisper-cli']
 const WHISPER_MODEL_DIR = join(homedir(), '.local/share/whisper-models')
 const WHISPER_MODEL_PATH = join(WHISPER_MODEL_DIR, 'ggml-large-v3-turbo.bin')
@@ -161,10 +162,10 @@ if (whisperCliPath && hasValidModel) {
   if (existsSync(WHISPER_MODEL_PATH)) { try { unlinkSync(WHISPER_MODEL_PATH) } catch {} }
   if (existsSync(WHISPER_MODEL_PARTIAL)) { try { unlinkSync(WHISPER_MODEL_PARTIAL) } catch {} }
   console.log(yellow('  ⚠') + ' whisper.cpp installed but model missing')
-  console.log('    ' + dim('Downloading ggml-large-v3-turbo (~1.5 GB). Ctrl-C to skip (uses OpenAI API instead).'))
+  console.log('    ' + dim('Downloading ggml-large-v3-turbo (~1.5 GB). Ctrl-C to skip (voice remains unavailable by default).'))
   console.log('    ' + dim('Skip permanently: SKIP_WHISPER_DOWNLOAD=1 npx @gotcos/glasses-server'))
   if (process.env.SKIP_WHISPER_DOWNLOAD === '1') {
-    console.log(yellow('  ⚠') + ' SKIP_WHISPER_DOWNLOAD=1 — voice will use OpenAI API')
+    console.log(yellow('  ⚠') + ' SKIP_WHISPER_DOWNLOAD=1 — local voice unavailable')
   } else {
     try {
       mkdirSync(WHISPER_MODEL_DIR, { recursive: true })
@@ -175,14 +176,19 @@ if (whisperCliPath && hasValidModel) {
       console.log(green('  ✓') + ' Model downloaded ' + dim('— voice = local (FREE)'))
     } catch (err) {
       try { unlinkSync(WHISPER_MODEL_PARTIAL) } catch {}
-      console.log(red('  ✗') + ' Model download failed ' + dim('— voice will use OpenAI API'))
+      console.log(red('  ✗') + ' Model download failed ' + dim('— local voice unavailable'))
       console.log('    ' + dim('Error: ' + (err.message || err).toString().slice(0, 120)))
     }
   }
 } else {
-  console.log(yellow('  ⚠') + ' whisper.cpp not installed ' + dim('— voice will use OpenAI API ($0.006/min)'))
+  console.log(yellow('  ⚠') + ' whisper.cpp not installed ' + dim('— local voice unavailable'))
   console.log('    Free local voice: ' + bold('brew install whisper-cpp') + dim('  (no Homebrew? https://brew.sh)'))
 }
+if (process.env.COS_OPENAI_WHISPER_FALLBACK === '1') {
+  console.log(yellow('  ⚠') + ' Explicit OpenAI Whisper fallback requested ' + dim('— activates only if a key resolves; see /api/health'))
+} else {
+  console.log(green('  ✓') + ' Transcription policy: local-only ' + dim('— a key alone never uploads audio'))
+}
 
 // Step 6: image capability — ffmpeg validates, strips metadata, normalizes,
 // and builds the exact 288x144 G2 variant. It is optional so text/voice remain

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.10.0",
+  "version": "6.12.0",
   "description": "COS Glasses — self-hosted AI heads-up-display server for Even G2 smart glasses, powered by your local Claude Code or Codex CLI",
   "type": "module",
   "bin": {

package/server/lib/local-first-meetings-contract.ts

@@ -0,0 +1,53 @@
+export const LOCAL_FIRST_MEETINGS_PROTOCOL_VERSION = 1 as const
+export const LOCAL_FIRST_MEETING_IDLE_RETENTION_MS = 4 * 60 * 60 * 1000
+
+export interface LocalFirstMeetingsCapability {
+  protocolVersion: typeof LOCAL_FIRST_MEETINGS_PROTOCOL_VERSION
+  serverInstanceId: string
+  idempotentSave: true
+  sessionStatus: true
+  retentionMs: number
+}
+
+export type MeetingSessionState = 'active' | 'closed' | 'saved' | 'missing'
+export type IndexRange = [start: number, end: number]
+
+export function localFirstMeetingsCapability(serverInstanceId: string | null): LocalFirstMeetingsCapability | null {
+  if (!serverInstanceId) return null
+  return {
+    protocolVersion: LOCAL_FIRST_MEETINGS_PROTOCOL_VERSION,
+    serverInstanceId,
+    idempotentSave: true,
+    sessionStatus: true,
+    retentionMs: LOCAL_FIRST_MEETING_IDLE_RETENTION_MS,
+  }
+}
+
+/** Exact, compact representation of a sparse received-index ledger. */
+export function compressIndexRanges(indices: readonly number[]): IndexRange[] {
+  const sorted = Array.from(new Set(
+    indices.filter(value => Number.isInteger(value) && value >= 0),
+  )).sort((a, b) => a - b)
+  if (sorted.length === 0) return []
+
+  const ranges: IndexRange[] = []
+  let start = sorted[0]
+  let end = start
+  for (let index = 1; index < sorted.length; index++) {
+    const value = sorted[index]
+    if (value === end + 1) {
+      end = value
+      continue
+    }
+    ranges.push([start, end])
+    start = value
+    end = value
+  }
+  ranges.push([start, end])
+  return ranges
+}
+
+export function retainedUntilIso(lastActivityAt: number | null): string | null {
+  if (lastActivityAt == null || !Number.isFinite(lastActivityAt)) return null
+  return new Date(lastActivityAt + LOCAL_FIRST_MEETING_IDLE_RETENTION_MS).toISOString()
+}

package/server/lib/transcribe-audio.ts

@@ -21,6 +21,7 @@ import {
   countVocabTerms,
 } from './hallucination-filter.js'
 import { getOpenAIKey, tryGetOpenAIKey } from './openai-key.js'
+import { getTranscriptionPolicySnapshot, isOpenAIWhisperFallbackReady } from './transcription-policy.js'
 
 export { OpenAIWhisperBudgetExhaustedError, estimateAudioSeconds }
 
@@ -61,17 +62,30 @@ export class NoSpeechDetectedError extends Error {
 // ceiling (anything longer is a dictation, not a query — use meetings instead).
 const HQ_MAX_SECONDS = 60
 
+function unavailableAfterLocalFailure(): TranscriptionUnavailableError | null {
+  const fallback = getTranscriptionPolicySnapshot()
+  if (fallback.openaiFallbackReady) return null
+  return fallback.openaiFallbackConfigured
+    ? new TranscriptionUnavailableError('openai_key_missing', 'Local transcription is unavailable and the explicitly configured OpenAI fallback has no key')
+    : new TranscriptionUnavailableError('local_asr_unavailable', 'Local transcription is unavailable; retry after Whisper recovers')
+}
+
 /** Transcribe via OpenAI Whisper API (cloud fallback).
  *  Budget-gated: throws OpenAIWhisperBudgetExhaustedError if today's $5 cap is spent.
  *  Ledger only ticks on SUCCESSFUL responses so retries that never reach the API
  *  aren't double-counted. */
 async function transcribeCloud(audioBuffer: Buffer): Promise<string> {
-  assertOpenAIWhisperBudget()
+  // Defense in depth: every cloud chokepoint rechecks the explicit two-factor
+  // opt-in. A key alone is never authority to upload user audio.
+  if (!isOpenAIWhisperFallbackReady()) {
+    throw unavailableAfterLocalFailure()!
+  }
 
   if (!tryGetOpenAIKey()) {
-    throw new TranscriptionUnavailableError('openai_key_missing', 'OpenAI key missing; local audio is preserved for retry')
+    throw new TranscriptionUnavailableError('openai_key_missing', 'OpenAI key missing; retry after local Whisper recovers')
   }
 
+  assertOpenAIWhisperBudget()
   const key = getOpenAIKey()
   const audioSeconds = estimateAudioSeconds(audioBuffer)
 
@@ -157,10 +171,14 @@ export async function transcribeAudioBuffer(
         backend = `fast-local-${result.backend}`
         actualQuality = 'fast'
       } catch (localErr: any) {
-        if (policy === 'local-only') {
-          throw new TranscriptionUnavailableError('local_asr_unavailable', `Local transcription unavailable; audio is preserved for retry (${localErr.message})`)
+        const unavailable = policy === 'local-only'
+          ? new TranscriptionUnavailableError('local_asr_unavailable', 'Local transcription is unavailable; retry after Whisper recovers')
+          : unavailableAfterLocalFailure()
+        if (unavailable) {
+          console.warn(`[transcribe] Fast local unavailable; preserving audio for retry: ${localErr.message}`)
+          throw unavailable
         }
-        console.warn(`[transcribe] Fast local also failed, falling back to cloud: ${localErr.message}`)
+        console.warn(`[transcribe] Fast local also failed; using explicitly enabled OpenAI fallback: ${localErr.message}`)
         text = await transcribeCloud(audioBuffer)
         backend = 'cloud'
         actualQuality = 'cloud'
@@ -173,17 +191,24 @@ export async function transcribeAudioBuffer(
       backend = `fast-local-${result.backend}`
       actualQuality = 'fast'
     } catch (localErr: any) {
-      if (policy === 'local-only') {
-        throw new TranscriptionUnavailableError('local_asr_unavailable', `Local transcription unavailable; audio is preserved for retry (${localErr.message})`)
+      const unavailable = policy === 'local-only'
+        ? new TranscriptionUnavailableError('local_asr_unavailable', 'Local transcription is unavailable; retry after Whisper recovers')
+        : unavailableAfterLocalFailure()
+      if (unavailable) {
+        console.warn(`[transcribe] Local unavailable; preserving audio for retry: ${localErr.message}`)
+        throw unavailable
       }
-      console.warn(`[transcribe] Local whisper failed (${getWhisperBackend()}), falling back to cloud: ${localErr.message}`)
+      console.warn(`[transcribe] Local whisper failed (${getWhisperBackend()}); using explicitly enabled OpenAI fallback: ${localErr.message}`)
       text = await transcribeCloud(audioBuffer)
       backend = 'cloud'
       actualQuality = 'cloud'
     }
   } else {
-    if (policy === 'local-only') {
-      throw new TranscriptionUnavailableError('local_asr_unavailable', 'Local transcription unavailable; audio is preserved for retry')
+    const unavailable = policy === 'local-only'
+      ? new TranscriptionUnavailableError('local_asr_unavailable', 'Local transcription is unavailable; retry after Whisper recovers')
+      : unavailableAfterLocalFailure()
+    if (unavailable) {
+      throw unavailable
     }
     text = await transcribeCloud(audioBuffer)
     backend = 'cloud'

package/server/lib/transcription-policy.ts

@@ -0,0 +1,29 @@
+import { getKeyStatus } from './openai-key.js'
+
+/**
+ * Cloud transcription is a two-factor opt-in. Merely having an OpenAI key on
+ * the machine must never route voice away from local Whisper.
+ */
+export const OPENAI_WHISPER_FALLBACK_ENV = 'COS_OPENAI_WHISPER_FALLBACK'
+
+export interface TranscriptionPolicySnapshot {
+  mode: 'local-only' | 'local-then-openai'
+  localRequired: true
+  openaiFallbackConfigured: boolean
+  openaiFallbackReady: boolean
+}
+
+export function getTranscriptionPolicySnapshot(): TranscriptionPolicySnapshot {
+  const openaiFallbackConfigured = process.env[OPENAI_WHISPER_FALLBACK_ENV] === '1'
+  const openaiFallbackReady = openaiFallbackConfigured && getKeyStatus().hasKey
+  return {
+    mode: openaiFallbackReady ? 'local-then-openai' : 'local-only',
+    localRequired: true,
+    openaiFallbackConfigured,
+    openaiFallbackReady,
+  }
+}
+
+export function isOpenAIWhisperFallbackReady(): boolean {
+  return getTranscriptionPolicySnapshot().openaiFallbackReady
+}

package/server/lib/whisper-local.ts

@@ -636,7 +636,7 @@ export async function transcribeLocal(audioBuffer: Buffer, context?: string, isQ
   }
 
   if (!serverAvailable && (serverStarting || serverRestarting)) {
-    throw new Error('whisper-server starting — use preserved/cloud fallback')
+    throw new Error('whisper-server starting — preserve audio for retry')
   }
 
   // Try whisper-server first (fastest: ~50-100ms, includes DTW word timestamps)
@@ -690,13 +690,15 @@ export async function transcribeLocal(audioBuffer: Buffer, context?: string, isQ
     restartWhisperServer()
   }
 
-  // Throw so caller uses cloud fallback — CLI is intentionally skipped for real-time
-  throw new Error('whisper-server unavailable — use cloud fallback')
+  // Throw so the caller applies the configured recovery policy. CLI is
+  // intentionally skipped for real-time transcription.
+  throw new Error('whisper-server unavailable — apply configured recovery policy')
 }
 
 /**
  * Auto-restart whisper-server after circuit breaker triggers.
- * Non-blocking — runs in background while callers use cloud fallback.
+ * Non-blocking — runs in background while callers preserve audio or apply the
+ * explicitly configured fallback policy.
  */
 async function restartWhisperServer(): Promise<void> {
   if (serverRestarting) return
@@ -734,7 +736,7 @@ async function restartWhisperServer(): Promise<void> {
       // Without this, the counter stays >= threshold but serverRestarting is false,
       // so every subsequent call would re-trigger restart in a tight loop
       serverConsecutiveFailures = 0
-      console.error('[whisper-local] Server restart failed — reset counter, will retry after next 3 failures. Using cloud fallback.')
+      console.error('[whisper-local] Server restart failed — reset counter, will retry after next 3 failures. Caller recovery policy remains active.')
     }
   } catch (err: any) {
     serverConsecutiveFailures = 0  // Same reset — allow future retry cycle

package/server/routes/health.ts

@@ -5,6 +5,7 @@ import { resolve } from 'node:path'
 import { COS_SCRIPTS_DIR, COS_MODE, PYTHON_BIN } from '../lib/python-bridge.js'
 import { serverMetrics } from '../lib/server-metrics.js'
 import { getServerInstanceId } from '../lib/server-instance-id.js'
+import { localFirstMeetingsCapability } from '../lib/local-first-meetings-contract.js'
 import { isSileroAvailable } from '../lib/vad-silero.js'
 import { getAvailableCliSessionId } from '../lib/claude-bridge.js'
 import { isWhisperLocalAvailable, getWhisperHealth } from '../lib/whisper-local.js'
@@ -18,6 +19,7 @@ import { isMediaProcessingReady } from '../lib/image-safety.js'
 import { G2_LENS_VARIANT_CAPABILITY } from '../lib/media-store.js'
 import { durableQueryJobsCapability } from '../lib/query-job-feature.js'
 import { getQueryJobRuntimeHealth } from '../lib/query-job-runtime.js'
+import { getTranscriptionPolicySnapshot } from '../lib/transcription-policy.js'
 
 export const healthRouter = Router()
 
@@ -138,6 +140,14 @@ healthRouter.get('/health', async (_req, res) => {
   // work can decide whether to prompt for a key.
   const keyStatus = getKeyStatus()
   const durableJobs = durableQueryJobStatus()
+  const localFirstMeetings = localFirstMeetingsCapability(getServerInstanceId())
+  const transcription = getTranscriptionPolicySnapshot()
+  const recovery = {
+    status: false,
+    restartWhisper: false,
+    restartServer: false,
+    managed: false,
+  }
   const features = {
     claude: claudeAvailable,
     codex: codexAvailable,
@@ -151,6 +161,8 @@ healthRouter.get('/health', async (_req, res) => {
     g2LensVariant: G2_LENS_VARIANT_CAPABILITY,
     durableQueryJobs: durableJobs.enabled,
     durableQueryJobsProtocol: durableJobs.protocolVersion,
+    localFirstMeetings: localFirstMeetings !== null,
+    transcriptionPolicy: transcription.mode,
   }
   const voice = {
     hasKey: keyStatus.hasKey,
@@ -170,6 +182,11 @@ healthRouter.get('/health', async (_req, res) => {
     whisper_health,
     openai_whisper_budget,
     codex_models,
+    capabilities: {
+      transcription,
+      recovery,
+      ...(localFirstMeetings ? { localFirstMeetings } : {}),
+    },
     // /api/health is intentionally unauthenticated for setup diagnostics.
     // Publish capability only; job counts, retention identities, subscriber
     // counts, and the storage fingerprint remain internal.
@@ -187,6 +204,8 @@ healthRouter.get('/health', async (_req, res) => {
 healthRouter.get('/models', async (req, res) => {
   const catalog = await getCodexModelCatalog(req.query.refresh === '1')
   const durableJobs = durableQueryJobStatus()
+  const localFirstMeetings = localFirstMeetingsCapability(getServerInstanceId())
+  const transcription = getTranscriptionPolicySnapshot()
   res.json({
     ...catalog,
     serverInstanceId: getServerInstanceId(),
@@ -195,6 +214,14 @@ healthRouter.get('/models', async (req, res) => {
         enabled: durableJobs.enabled,
         protocolVersion: durableJobs.protocolVersion,
       },
+      transcription,
+      recovery: {
+        status: false,
+        restartWhisper: false,
+        restartServer: false,
+        managed: false,
+      },
+      ...(localFirstMeetings ? { localFirstMeetings } : {}),
     },
   })
 })

package/server/routes/meeting.ts

@@ -31,6 +31,7 @@ import {
   getSessionProviderCandidates,
   getSessionStartTime,
   getSessionTranscript,
+  getMeetingSessionStatus,
   hasSessionAudio,
   moveSessionAudioToPending,
   type IndexedTranscriptChunk,
@@ -38,6 +39,7 @@ import {
   type TranscriptChunk,
   type TranscriptGapReport,
 } from './transcribe-stream.js'
+import { getServerInstanceId } from '../lib/server-instance-id.js'
 
 interface MeetingSessionSource {
   getTranscript(sessionId: string): string | null
@@ -98,6 +100,8 @@ function publicSaveResponse(saved: SavedMeeting, replayed = false): Record<strin
     ? Math.floor(integrity.completeness * 1_000) / 10
     : 100
   return {
+    receiptVersion: 1,
+    serverInstanceId: getServerInstanceId(),
     saved: true,
     // Keep the build199 string field without leaking an absolute host path.
     filepath: `recordings/${saved.month}/${saved.filename}`,
@@ -125,6 +129,33 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
   const router = Router()
   const savingSessions = new Set<string>()
 
+  router.get('/meeting/sessions/:sessionId/status', (req, res) => {
+    const sessionId = String(req.params.sessionId ?? '')
+    if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) {
+      res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
+      return
+    }
+    const serverInstanceId = getServerInstanceId()
+    if (!serverInstanceId) {
+      res.status(503).json({ error: 'Server identity unavailable', reason: 'server_identity_unavailable' })
+      return
+    }
+    const saved = store.findBySessionId(sessionId)
+    const live = getMeetingSessionStatus(sessionId)
+    res.set('Cache-Control', 'private, no-store')
+    res.json({
+      sessionId,
+      state: saved ? 'saved' : live.state,
+      serverInstanceId,
+      receivedRanges: live.receivedRanges,
+      receivedCount: live.receivedCount,
+      maxChunkIndex: live.maxChunkIndex,
+      lastActivityAt: live.lastActivityAt,
+      retainedUntil: saved ? null : live.retainedUntil,
+      saveReceipt: saved ? publicSaveResponse(saved) : null,
+    })
+  })
+
   router.post('/meeting/save', async (req, res) => {
     let lockedSessionId: string | null = null
     try {

package/server/routes/transcribe-stream.ts

@@ -1,5 +1,6 @@
 // POST /api/transcribe-stream — Streaming transcription for continuous meeting capture
-// Uses local Whisper (50ms) with OpenAI API fallback.
+// Uses local Whisper. OpenAI API fallback is disabled by default and requires
+// both COS_OPENAI_WHISPER_FALLBACK=1 and a configured key.
 // Streams speaker-labeled transcript chunks for live meeting capture.
 
 import { Router } from 'express'
@@ -10,11 +11,13 @@ import { resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { getVocabulary, getOwnerName } from '../lib/profile.js'
 import { getOpenAIKey } from '../lib/openai-key.js'
+import { getTranscriptionPolicySnapshot, isOpenAIWhisperFallbackReady } from '../lib/transcription-policy.js'
+import { TranscriptionUnavailableError } from '../lib/transcribe-audio.js'
 
 const __dirname = fileURLToPath(new URL('.', import.meta.url))
 import { emitDisplay } from '../lib/display-bus.js'
 import { errMsg } from '../lib/utils.js'
-import { transcribeLocal, isWhisperLocalAvailable, applyCorrections, type WhisperWord } from '../lib/whisper-local.js'
+import { transcribeLocal, applyCorrections, type WhisperWord } from '../lib/whisper-local.js'
 import { enhanceAudio } from '../lib/audio-enhance.js'
 import { trimSilence, isSileroAvailable } from '../lib/vad-silero.js'
 import { identifySpeaker, isEmbeddingAvailable, autoEnroll, getEmbeddingCount } from '../lib/speaker-embeddings.js'
@@ -32,6 +35,13 @@ import {
   isVocabEchoOnly,
 } from '../lib/hallucination-filter.js'
 import { dataPath } from '../lib/data-dir.js'
+import { durableAtomicWriteFileSync } from '../lib/atomic-fs.js'
+import {
+  LOCAL_FIRST_MEETING_IDLE_RETENTION_MS,
+  compressIndexRanges,
+  retainedUntilIso,
+  type IndexRange,
+} from '../lib/local-first-meetings-contract.js'
 
 function ensurePrivateDirectory(path: string): void {
   if (!existsSync(path)) mkdirSync(path, { recursive: true, mode: 0o700 })
@@ -200,6 +210,8 @@ interface TranscriptSession {
   // Sorted, de-duplicated. See computeGapReport()/analyzeTranscriptGaps().
   receivedIndices?: number[]
   maxChunkIndex?: number
+  /** Persisted idle-retention clock. Meeting date/duration still use startTime. */
+  lastActivityAt: number
   // Count of consecutive vocab-echo (prompt-regurgitation) chunks. Reset to 0 by
   // any real-content chunk. Used to drop a RUN of echoed brand names while keeping
   // a single loud one-off (which could be a real terse list). See sanitizeStreamTranscript.
@@ -207,22 +219,60 @@ interface TranscriptSession {
 }
 
 const sessions = new Map<string, TranscriptSession>()
-const CLOSED_SESSION_TTL_MS = 4 * 60 * 60 * 1000
+const CLOSED_SESSION_TTL_MS = LOCAL_FIRST_MEETING_IDLE_RETENTION_MS
 const CLOSED_SESSIONS_FILE = dataPath('closed-transcript-sessions.json')
 
+interface ClosedTranscriptSession {
+  closedAt: number
+  lastActivityAt: number
+  receivedIndices: number[]
+  maxChunkIndex: number
+  reason: 'saved' | 'expired' | 'closed'
+}
+
+const closedSessionRecords = new Map<string, ClosedTranscriptSession>()
+
 // Incremental chunk persistence — survive server restarts
 const CHUNK_PERSIST_DIR = dataPath('active-sessions')
 ensurePrivateDirectory(CHUNK_PERSIST_DIR)
 
-function readClosedSessions(): Record<string, number> {
+function readClosedSessions(): Record<string, ClosedTranscriptSession> {
   if (!existsSync(CLOSED_SESSIONS_FILE)) return {}
   try {
     const parsed = JSON.parse(readFileSync(CLOSED_SESSIONS_FILE, 'utf-8')) as unknown
     if (!parsed || typeof parsed !== 'object') return {}
-    return Object.fromEntries(
-      Object.entries(parsed as Record<string, unknown>)
-        .filter(([id, ts]) => /^[A-Za-z0-9:_-]{3,96}$/.test(id) && typeof ts === 'number'),
-    ) as Record<string, number>
+    const normalized: Record<string, ClosedTranscriptSession> = {}
+    for (const [id, value] of Object.entries(parsed as Record<string, unknown>)) {
+      if (!/^[A-Za-z0-9:_-]{3,96}$/.test(id)) continue
+      if (typeof value === 'number' && Number.isFinite(value)) {
+        normalized[id] = {
+          closedAt: value,
+          lastActivityAt: value,
+          receivedIndices: [],
+          maxChunkIndex: -1,
+          reason: 'closed',
+        }
+        continue
+      }
+      if (!value || typeof value !== 'object') continue
+      const raw = value as Record<string, unknown>
+      const closedAt = typeof raw.closedAt === 'number' && Number.isFinite(raw.closedAt) ? raw.closedAt : null
+      if (closedAt == null) continue
+      const lastActivityAt = typeof raw.lastActivityAt === 'number' && Number.isFinite(raw.lastActivityAt)
+        ? raw.lastActivityAt
+        : closedAt
+      const receivedIndices = Array.isArray(raw.receivedIndices)
+        ? Array.from(new Set(
+          raw.receivedIndices.filter((entry): entry is number => Number.isInteger(entry) && (entry as number) >= 0),
+        )).sort((a, b) => a - b)
+        : []
+      const maxChunkIndex = typeof raw.maxChunkIndex === 'number' && Number.isInteger(raw.maxChunkIndex)
+        ? raw.maxChunkIndex
+        : (receivedIndices.at(-1) ?? -1)
+      const reason = raw.reason === 'saved' || raw.reason === 'expired' ? raw.reason : 'closed'
+      normalized[id] = { closedAt, lastActivityAt, receivedIndices, maxChunkIndex, reason }
+    }
+    return normalized
   } catch {
     try {
       renameSync(CLOSED_SESSIONS_FILE, `${CLOSED_SESSIONS_FILE}.corrupt.${Date.now()}`)
@@ -234,25 +284,31 @@ function readClosedSessions(): Record<string, number> {
 function persistClosedSessions(): void {
   const now = Date.now()
   const merged = readClosedSessions()
-  for (const id of deletedSessions) merged[id] = now
-  for (const [id, closedAt] of Object.entries(merged)) {
-    if (now - closedAt > CLOSED_SESSION_TTL_MS) delete merged[id]
+  for (const id of deletedSessions) {
+    merged[id] = closedSessionRecords.get(id) ?? {
+      closedAt: now,
+      lastActivityAt: now,
+      receivedIndices: [],
+      maxChunkIndex: -1,
+      reason: 'closed',
+    }
+  }
+  for (const [id, record] of Object.entries(merged)) {
+    if (now - record.closedAt > CLOSED_SESSION_TTL_MS) delete merged[id]
   }
   try {
-    const tmp = `${CLOSED_SESSIONS_FILE}.tmp`
-    writeFileSync(tmp, JSON.stringify(merged, null, 2), { encoding: 'utf-8', mode: 0o600 })
-    renameSync(tmp, CLOSED_SESSIONS_FILE)
-    try { chmodSync(CLOSED_SESSIONS_FILE, 0o600) } catch {}
-  } catch { /* best-effort tombstones */ }
+    durableAtomicWriteFileSync(CLOSED_SESSIONS_FILE, JSON.stringify(merged, null, 2), { mode: 0o600 })
+  } catch { /* best-effort tombstones; saved receipts remain authoritative */ }
 }
 
 function recoverClosedSessions(): void {
   const now = Date.now()
   const closed = readClosedSessions()
   let dirty = false
-  for (const [id, closedAt] of Object.entries(closed)) {
-    if (now - closedAt <= CLOSED_SESSION_TTL_MS) {
-      deletedSessions.add(id)
+  for (const [id, record] of Object.entries(closed)) {
+    if (now - record.closedAt <= CLOSED_SESSION_TTL_MS) {
+      rememberDeletedSession(id)
+      closedSessionRecords.set(id, record)
     } else {
       delete closed[id]
       dirty = true
@@ -260,20 +316,17 @@ function recoverClosedSessions(): void {
   }
   if (dirty) {
     try {
-      const tmp = `${CLOSED_SESSIONS_FILE}.tmp`
-      writeFileSync(tmp, JSON.stringify(closed, null, 2), { encoding: 'utf-8', mode: 0o600 })
-      renameSync(tmp, CLOSED_SESSIONS_FILE)
-      try { chmodSync(CLOSED_SESSIONS_FILE, 0o600) } catch {}
+      durableAtomicWriteFileSync(CLOSED_SESSIONS_FILE, JSON.stringify(closed, null, 2), { mode: 0o600 })
     } catch {}
   }
 }
 
-/** Persist a session's chunks to disk (called after each new chunk) */
-function persistSession(sessionId: string): void {
-  try {
-    const session = sessions.get(sessionId)
-    if (!session) return
-    const filePath = resolve(CHUNK_PERSIST_DIR, `${sessionId}.json`)
+/** Persist a session before acknowledging any chunk. Throws on failure so a
+ *  client never interprets a non-durable index as accepted. */
+function persistSessionRequired(sessionId: string): void {
+  const session = sessions.get(sessionId)
+  if (!session) throw makeHttpError(404, 'session not found', 'session_not_found')
+  const filePath = resolve(CHUNK_PERSIST_DIR, `${sessionId}.json`)
     // chunksIndexed preserves each chunk's original index (a plain filter()
     // would collapse the sparse array and destroy gap positions on recovery).
     const chunksIndexed: Array<{ i: number; c: TranscriptChunk }> = []
@@ -281,9 +334,10 @@ function persistSession(sessionId: string): void {
       const c = session.chunks[i]
       if (c && c.text) chunksIndexed.push({ i, c })
     }
-    const data = JSON.stringify({
+  const data = JSON.stringify({
       sessionId,
       startTime: session.startTime,
+      lastActivityAt: session.lastActivityAt,
       title: session.title,
       // `chunks` = legacy dense form, kept for backward compatibility with
       // existing readers; `chunksIndexed` preserves original indices so gap
@@ -294,9 +348,16 @@ function persistSession(sessionId: string): void {
       maxChunkIndex: session.maxChunkIndex ?? -1,
       providerCandidates: session.providerCandidates ?? {},
     })
-    writeFileSync(filePath, data, { encoding: 'utf-8', mode: 0o600 })
-    try { chmodSync(filePath, 0o600) } catch { /* best effort on recovered installs */ }
-  } catch { /* non-critical — don't break transcription for persistence */ }
+  try {
+    durableAtomicWriteFileSync(filePath, data, { mode: 0o600 })
+  } catch (error) {
+    console.error(`[transcribe-stream] Durable session write failed for ${sessionId}: ${errMsg(error)}`)
+    throw makeHttpError(503, 'meeting session persistence unavailable', 'session_persistence_failed')
+  }
+}
+
+function persistSessionBestEffort(sessionId: string): void {
+  try { persistSessionRequired(sessionId) } catch { /* recovery cleanup is non-admission work */ }
 }
 
 /** Recover sessions from disk on server restart */
@@ -315,9 +376,14 @@ function recoverSessions(): void {
           Array.isArray(data.chunksIndexed) ? data.chunksIndexed : null
         const legacy: TranscriptChunk[] | null = Array.isArray(data.chunks) ? data.chunks : null
         const hasChunks = (indexed && indexed.length > 0) || (legacy && legacy.length > 0)
-        if (data.sessionId && hasChunks) {
-          // Only recover sessions less than 4 hours old
-          if (Date.now() - data.startTime < 4 * 60 * 60 * 1000) {
+        const persistedStat = statSync(resolve(CHUNK_PERSIST_DIR, file))
+        const lastActivityAt = typeof data.lastActivityAt === 'number' && Number.isFinite(data.lastActivityAt)
+          ? data.lastActivityAt
+          : (Number.isFinite(persistedStat.mtimeMs) ? persistedStat.mtimeMs : data.startTime)
+        if (data.sessionId && (hasChunks || Array.isArray(data.receivedIndices) || Number.isFinite(lastActivityAt))) {
+          // Active retention is idle-based. Long meetings are not purged merely
+          // because their original start time is old.
+          if (Date.now() - lastActivityAt < LOCAL_FIRST_MEETING_IDLE_RETENTION_MS) {
             const chunks: TranscriptChunk[] = []
             if (indexed) {
               for (const e of indexed) {
@@ -353,6 +419,7 @@ function recoverSessions(): void {
               chunks,
               startTime: data.startTime,
               title: data.title || '',
+              lastActivityAt,
               receivedIndices,
               maxChunkIndex,
               providerCandidates: data.providerCandidates && typeof data.providerCandidates === 'object'
@@ -380,12 +447,32 @@ function recoverSessions(): void {
             recoveredIds.add(data.sessionId)
             if (cleaned > 0) {
               console.log(`[session-recovery] Cleaned inline hallucinations from ${cleaned} chunks`)
-              persistSession(data.sessionId)  // re-persist cleaned data to disk
+              persistSessionBestEffort(data.sessionId)  // re-persist cleaned data to disk
             }
             const gaps = computeGapReport(session).missingIndices.length
             console.log(`[session-recovery] Recovered ${session.chunks.filter(c => c && c.text).length} chunks for ${data.sessionId}${gaps > 0 ? ` (${gaps} lost-chunk gap${gaps > 1 ? 's' : ''})` : ''}`)
           } else {
-            // Stale — clean up
+            // A stale unsaved session is a real closed state, not a missing
+            // session that a late/zombie client may silently recreate. Keep
+            // its exact receive ledger for one tombstone horizon after boot.
+            const receivedIndices = Array.isArray(data.receivedIndices)
+              ? Array.from(new Set(
+                (data.receivedIndices as unknown[])
+                  .filter((value): value is number => Number.isInteger(value) && (value as number) >= 0),
+              )).sort((left, right) => left - right)
+              : []
+            const maxChunkIndex = typeof data.maxChunkIndex === 'number' && Number.isInteger(data.maxChunkIndex)
+              ? data.maxChunkIndex
+              : (receivedIndices.at(-1) ?? -1)
+            closedSessionRecords.set(data.sessionId, {
+              closedAt: Date.now(),
+              lastActivityAt,
+              receivedIndices,
+              maxChunkIndex,
+              reason: 'expired',
+            })
+            rememberDeletedSession(data.sessionId)
+            persistClosedSessions()
             unlinkSync(resolve(CHUNK_PERSIST_DIR, file))
           }
         }
@@ -410,6 +497,12 @@ function recoverSessions(): void {
 // Declared BEFORE deleteSession to avoid TDZ hazard (deleteSession references these).
 const deletedSessions = new Set<string>()
 const DELETED_SESSION_CAP = 50  // keep last 50 deleted IDs, trim older on overflow
+function rememberDeletedSession(sessionId: string): void {
+  deletedSessions.add(sessionId)
+  if (deletedSessions.size <= DELETED_SESSION_CAP) return
+  const entries = Array.from(deletedSessions)
+  for (const id of entries.slice(0, entries.length - DELETED_SESSION_CAP)) deletedSessions.delete(id)
+}
 export function isSessionDeleted(sessionId: string): boolean {
   return deletedSessions.has(sessionId)
 }
@@ -418,19 +511,12 @@ export function isSessionDeleted(sessionId: string): boolean {
 recoverClosedSessions()
 recoverSessions()
 
-// Auto-cleanup sessions older than 4 hours
+// Auto-cleanup sessions idle for the advertised retention horizon.
 setInterval(() => {
-  const cutoff = Date.now() - 4 * 60 * 60 * 1000
+  const cutoff = Date.now() - LOCAL_FIRST_MEETING_IDLE_RETENTION_MS
   for (const [id, session] of sessions) {
-    if (session.startTime < cutoff) {
-      sessions.delete(id)
-      sessionAudioBytes.delete(id)
-      sessionAudioWrites.delete(id)
-      clearSessionHallucinationState(id)
-      // Clean up persisted file too
-      try { unlinkSync(resolve(CHUNK_PERSIST_DIR, `${id}.json`)) } catch {}
-      // Clean up session audio
-      try { rmSync(resolve(SESSION_AUDIO_DIR, id), { recursive: true, force: true }) } catch {}
+    if (session.lastActivityAt < cutoff) {
+      closeTranscriptSession(id, 'expired')
     }
   }
   // Purge orphaned session-audio dirs (no matching active session)
@@ -493,7 +579,8 @@ setInterval(() => {
 export function getSession(sessionId: string): TranscriptSession {
   let session = sessions.get(sessionId)
   if (!session) {
-    session = { chunks: [], startTime: Date.now(), title: '', providerCandidates: {} }
+    const now = Date.now()
+    session = { chunks: [], startTime: now, lastActivityAt: now, title: '', providerCandidates: {} }
     sessions.set(sessionId, session)
   }
   if (!session.providerCandidates) session.providerCandidates = {}
@@ -677,19 +764,81 @@ export function getSessionProviderCandidates(sessionId: string): Record<string,
   return sessions.get(sessionId)?.providerCandidates ?? {}
 }
 
+export interface MeetingSessionStatusSnapshot {
+  state: 'active' | 'closed' | 'missing'
+  receivedRanges: IndexRange[]
+  receivedCount: number
+  maxChunkIndex: number
+  lastActivityAt: string | null
+  retainedUntil: string | null
+}
+
+export function getMeetingSessionStatus(sessionId: string): MeetingSessionStatusSnapshot {
+  const active = sessions.get(sessionId)
+  if (active) {
+    const received = active.receivedIndices ?? []
+    return {
+      state: 'active',
+      receivedRanges: compressIndexRanges(received),
+      receivedCount: received.length,
+      maxChunkIndex: active.maxChunkIndex ?? (received.at(-1) ?? -1),
+      lastActivityAt: new Date(active.lastActivityAt).toISOString(),
+      retainedUntil: retainedUntilIso(active.lastActivityAt),
+    }
+  }
+  const closed = closedSessionRecords.get(sessionId)
+  if (closed) {
+    return {
+      state: 'closed',
+      receivedRanges: compressIndexRanges(closed.receivedIndices),
+      receivedCount: closed.receivedIndices.length,
+      maxChunkIndex: closed.maxChunkIndex,
+      lastActivityAt: new Date(closed.lastActivityAt).toISOString(),
+      retainedUntil: new Date(closed.closedAt + CLOSED_SESSION_TTL_MS).toISOString(),
+    }
+  }
+  return {
+    state: 'missing',
+    receivedRanges: [],
+    receivedCount: 0,
+    maxChunkIndex: -1,
+    lastActivityAt: null,
+    retainedUntil: null,
+  }
+}
+
+function closeTranscriptSession(
+  sessionId: string,
+  reason: ClosedTranscriptSession['reason'],
+  options: { preserveAudio?: boolean } = {},
+): void {
+  const session = sessions.get(sessionId)
+  const now = Date.now()
+  const receivedIndices = [...(session?.receivedIndices ?? [])]
+  const maxChunkIndex = session?.maxChunkIndex ?? (receivedIndices.at(-1) ?? -1)
+  closedSessionRecords.set(sessionId, {
+    closedAt: now,
+    lastActivityAt: session?.lastActivityAt ?? now,
+    receivedIndices,
+    maxChunkIndex,
+    reason,
+  })
+  finishClosingTranscriptSession(sessionId, options)
+}
+
 /** Delete session after save */
 export function deleteSession(sessionId: string, options: { preserveAudio?: boolean } = {}): void {
+  closeTranscriptSession(sessionId, 'saved', options)
+}
+
+function finishClosingTranscriptSession(sessionId: string, options: { preserveAudio?: boolean }): void {
   sessions.delete(sessionId)
   sessionAudioBytes.delete(sessionId)
+  sessionAudioWrites.delete(sessionId)
   // Clean up inline hallucination tracking (was leaking until 4-hour interval fired)
   clearSessionHallucinationState(sessionId)
   // Track as deleted so orphan heartbeats get 410 Gone (prevents zombie client spam)
-  deletedSessions.add(sessionId)
-  if (deletedSessions.size > DELETED_SESSION_CAP) {
-    // Trim oldest entries to prevent unbounded growth
-    const arr = Array.from(deletedSessions)
-    for (const id of arr.slice(0, arr.length - DELETED_SESSION_CAP)) deletedSessions.delete(id)
-  }
+  rememberDeletedSession(sessionId)
   persistClosedSessions()
   // Clean up persisted file
   try { unlinkSync(resolve(CHUNK_PERSIST_DIR, `${sessionId}.json`)) } catch {}
@@ -768,14 +917,27 @@ async function persistRawSessionAudioChunk(sessionId: string, chunkIndex: number
   ensurePrivateDirectory(sessionDir)
   const chunkPath = resolve(sessionDir, `chunk_${String(chunkIndex).padStart(4, '0')}.wav`)
   const existingSize = existsSync(chunkPath) ? statSync(chunkPath).size : 0
-  const currentBytes = sessionAudioBytes.get(sessionId) ?? 0
+  let currentBytes = sessionAudioBytes.get(sessionId)
+  if (currentBytes == null) {
+    currentBytes = 0
+    try {
+      for (const filename of readdirSync(sessionDir)) {
+        if (!/^chunk_\d{4}\.wav$/.test(filename)) continue
+        currentBytes += statSync(resolve(sessionDir, filename)).size
+      }
+    } catch (error) {
+      throw makeHttpError(503, `meeting audio inventory failed: ${errMsg(error)}`, 'session_audio_persistence_failed')
+    }
+  }
   const nextBytes = currentBytes - existingSize + audioBuffer.length
-  if (nextBytes > MAX_SESSION_AUDIO_BYTES && !existsSync(chunkPath)) {
-    if (chunkIndex % 50 === 0) console.warn(`[session-audio] Session ${sessionId} hit 500MB cap — skipping WAV saves`)
-    return
+  if (nextBytes > MAX_SESSION_AUDIO_BYTES) {
+    throw makeHttpError(507, 'meeting audio capacity exceeded', 'meeting_audio_capacity_exceeded')
+  }
+  try {
+    durableAtomicWriteFileSync(chunkPath, audioBuffer, { mode: 0o600 })
+  } catch (error) {
+    throw makeHttpError(503, `meeting audio persistence failed: ${errMsg(error)}`, 'session_audio_persistence_failed')
   }
-  const writeJob = writeFile(chunkPath, audioBuffer, { mode: 0o600 })
-  await trackSessionAudioWrite(sessionId, writeJob)
   sessionAudioBytes.set(sessionId, Math.max(0, nextBytes))
 }
 
@@ -885,18 +1047,26 @@ function canonicalChunkResponse(
 }
 
 async function transcribeWithServerWhisper(audioBuffer: Buffer, whisperAudio: Buffer, whisperContext: string, isQuiet: boolean): Promise<{ text: string; words?: WhisperWord[]; backend: string }> {
-  if (isWhisperLocalAvailable()) {
-    try {
-      const result = await transcribeLocal(whisperAudio, whisperContext || undefined, isQuiet)
-      return { text: result.text, words: result.words, backend: `local-${result.backend}` }
-    } catch (err: unknown) {
-      console.warn(`[transcribe-stream] Local Whisper failed, falling back to cloud: ${errMsg(err)}`)
-      const text = await transcribeViaCloud(whisperAudio)
-      return { text, words: undefined, backend: 'cloud' }
+  // The worker owns reconciliation of stale health. Always attempt local ASR
+  // once; an availability snapshot must not divert meeting audio to cloud.
+  try {
+    const result = await transcribeLocal(whisperAudio, whisperContext || undefined, isQuiet)
+    return { text: result.text, words: result.words, backend: `local-${result.backend}` }
+  } catch (err: unknown) {
+    if (!isOpenAIWhisperFallbackReady()) {
+      const fallback = getTranscriptionPolicySnapshot()
+      console.warn(`[transcribe-stream] Local Whisper unavailable; preserving chunk for retry: ${errMsg(err)}`)
+      throw new TranscriptionUnavailableError(
+        fallback.openaiFallbackConfigured ? 'openai_key_missing' : 'local_asr_unavailable',
+        fallback.openaiFallbackConfigured
+          ? 'Local transcription is unavailable; audio is preserved for retry and the configured OpenAI fallback has no key'
+          : 'Local transcription is unavailable; audio is preserved for retry',
+      )
     }
+    console.warn(`[transcribe-stream] Local Whisper failed; using explicitly enabled OpenAI fallback: ${errMsg(err)}`)
+    const text = await transcribeViaCloud(whisperAudio)
+    return { text, words: undefined, backend: 'cloud' }
   }
-  const text = await transcribeViaCloud(whisperAudio)
-  return { text, words: undefined, backend: 'cloud' }
 }
 
 function identifyChunkSpeaker(audioBuffer: Buffer, sessionId: string, chunkIndex: number, clientSpeaker: string): { speaker: string; similarity: number } {
@@ -995,9 +1165,6 @@ async function processStreamChunk(opts: {
   if (opts.startTimeOverride && session.chunks.filter(Boolean).length === 0) {
     session.startTime = opts.startTimeOverride
   }
-  // Transfer integrity: log this index as delivered before any text filtering,
-  // so a silent/hallucination-filtered chunk is NOT mistaken for a lost one.
-  recordReceivedChunk(session, chunkIndex)
   const alreadyCanonical = session.chunks[chunkIndex]
 
   let candidateRecordKey: string | undefined
@@ -1020,21 +1187,24 @@ async function processStreamChunk(opts: {
   // Do not let late duplicate/replayed candidates replace canonical raw audio.
   // Batch re-transcription relies on chunk_000N.wav matching the accepted chunk.
   if (alreadyCanonical?.canonical) {
+    session.lastActivityAt = Date.now()
+    recordReceivedChunk(session, chunkIndex)
     if (candidate && candidateRecordKey) {
       session.providerCandidates![candidateRecordKey].accepted =
         alreadyCanonical.asrProvider === 'iphone-whisperkit-beta' && alreadyCanonical.audioSha256 === audioSha256
       session.providerCandidates![candidateRecordKey].fallbackReason =
         session.providerCandidates![candidateRecordKey].accepted ? undefined : 'canonical_exists'
-      persistSession(sessionId)
     }
+    persistSessionRequired(sessionId)
     return canonicalChunkResponse(alreadyCanonical, sessionId, chunkIndex)
   }
 
   await persistRawSessionAudioChunk(sessionId, chunkIndex, audioBuffer)
-
-  if (candidate) {
-    persistSession(sessionId)
-  }
+  // Commit the received-index ledger only after the canonical raw WAV is
+  // durable. A failure is typed non-2xx and a retry remains safe.
+  session.lastActivityAt = Date.now()
+  recordReceivedChunk(session, chunkIndex)
+  persistSessionRequired(sessionId)
 
   const pcmData = audioBuffer.subarray(44)
   let sumSq = 0
@@ -1105,8 +1275,8 @@ async function processStreamChunk(opts: {
     if (candidate && candidateRecordKey && session.providerCandidates?.[candidateRecordKey]) {
       session.providerCandidates[candidateRecordKey].accepted = false
       session.providerCandidates[candidateRecordKey].fallbackReason = sanitized.fallbackReason || fallbackReason || 'empty'
-      persistSession(sessionId)
     }
+    persistSessionRequired(sessionId)
     return { text: '', speaker: clientSpeaker, chunkIndex, elapsed, sessionId, backend, asrProvider, fallbackReason: sanitized.fallbackReason || fallbackReason }
   }
 
@@ -1132,8 +1302,9 @@ async function processStreamChunk(opts: {
         finalExisting.asrProvider === 'iphone-whisperkit-beta' && finalExisting.audioSha256 === audioSha256
       session.providerCandidates[candidateRecordKey].fallbackReason =
         session.providerCandidates[candidateRecordKey].accepted ? undefined : 'canonical_exists'
-      persistSession(sessionId)
     }
+    session.lastActivityAt = Date.now()
+    persistSessionRequired(sessionId)
     return canonicalChunkResponse(finalExisting, sessionId, chunkIndex)
   }
   session.chunks[chunkIndex] = chunk
@@ -1144,7 +1315,8 @@ async function processStreamChunk(opts: {
     }
   }
   const tPersist = performance.now()
-  persistSession(sessionId)
+  session.lastActivityAt = Date.now()
+  persistSessionRequired(sessionId)
   console.log(`[perf] persistSession: ${(performance.now() - tPersist).toFixed(1)}ms (${session.chunks.filter(c => c).length} chunks)`)
 
   emitDisplay({ type: 'transcript_chunk', data: { text: trimmedText, speaker, chunkIndex, elapsed, sessionId } })
@@ -1154,6 +1326,14 @@ async function processStreamChunk(opts: {
 }
 
 function sendStreamError(res: { status: (code: number) => { json: (body: unknown) => unknown } }, err: unknown): unknown {
+  if (err instanceof TranscriptionUnavailableError) {
+    console.warn(`[transcribe-stream] ${err.message}`)
+    return res.status(err.status).json({
+      error: err.message,
+      reason: err.reason,
+      retryable: true,
+    })
+  }
   if (err instanceof OpenAIWhisperBudgetExhaustedError) {
     console.error(`[transcribe-stream] ${err.message}`)
     return res.status(503).json({
@@ -1207,7 +1387,8 @@ transcribeStreamRouter.post('/transcribe-stream/offline-sessions/start', async (
       : undefined
     if (startTime && session.chunks.filter(Boolean).length === 0) session.startTime = startTime
     if (typeof body.title === 'string') session.title = body.title.slice(0, 160)
-    persistSession(sessionId)
+    session.lastActivityAt = Date.now()
+    persistSessionRequired(sessionId)
     res.json({ sessionId, startTime: session.startTime, chunks: session.chunks.filter(Boolean).length })
   } catch (err: unknown) {
     sendStreamError(res, err)
@@ -1325,9 +1506,18 @@ transcribeStreamRouter.post('/transcribe-stream/candidates', async (req, res) =>
  *  A hung whisper-server + long meeting is the exact scenario this guards against —
  *  chunks stay empty on budget-exceeded instead of silently billing per chunk. */
 async function transcribeViaCloud(audioBuffer: Buffer): Promise<string> {
-  assertOpenAIWhisperBudget()
+  if (!isOpenAIWhisperFallbackReady()) {
+    const fallback = getTranscriptionPolicySnapshot()
+    throw new TranscriptionUnavailableError(
+      fallback.openaiFallbackConfigured ? 'openai_key_missing' : 'local_asr_unavailable',
+      fallback.openaiFallbackConfigured
+        ? 'Local transcription is unavailable; audio is preserved for retry and the configured OpenAI fallback has no key'
+        : 'Local transcription is unavailable; audio is preserved for retry',
+    )
+  }
 
   const key = getOpenAIKey()
+  assertOpenAIWhisperBudget()
   const audioSeconds = estimateAudioSeconds(audioBuffer)
 
   const isWav = audioBuffer.length >= 4 && audioBuffer.toString('ascii', 0, 4) === 'RIFF'

package/server/routes/transcribe.ts

@@ -9,6 +9,7 @@ import {
   resolveTranscribeMode,
   NoSpeechDetectedError,
   OpenAIWhisperBudgetExhaustedError,
+  TranscriptionUnavailableError,
 } from '../lib/transcribe-audio.js'
 
 export const transcribeRouter = Router()
@@ -50,6 +51,14 @@ transcribeRouter.post('/transcribe', async (req, res) => {
         cap_usd: err.capUsd,
       })
     }
+    if (err instanceof TranscriptionUnavailableError) {
+      console.warn(`[transcribe] ${err.message}`)
+      return res.status(err.status).json({
+        error: err.message,
+        reason: err.reason,
+        retryable: true,
+      })
+    }
     res.status(500).json({ error: err.message })
   }
 })