@gotcos/glasses-server 6.16.5 → 6.16.9

package/.env.example

@@ -93,7 +93,10 @@ BIND_HOST=0.0.0.0
 
 # ── WELCOME WEATHER (optional) ──────────────────────────────────────────
 # Phone GPS (Even Hub location permission) is the primary source. The Mac only
-# proxies Open-Meteo. If the phone denies location, set a home fallback:
+# proxies Open-Meteo via GET /api/welcome-context?lat=&lon= (auth required).
+# Prove: curl -H "x-cos-token: $COS_API_TOKEN" \
+#   "http://127.0.0.1:3141/api/welcome-context?lat=30.27&lon=-97.74"
+# If the phone denies location, set a home fallback (omit weather otherwise):
 # COS_WEATHER_DEFAULT_LAT=30.5788
 # COS_WEATHER_DEFAULT_LON=-97.8531
 # COS_WEATHER_DEFAULT_CITY=Home

package/CHANGELOG.md

@@ -1,3 +1,43 @@
+## 6.16.9
+
+- **Message-era reset visible to a running server.** `currentMessageEraState`
+  re-reads `message-era.json` when mtime changes, so
+  `reset-message-era.ts --confirm` (separate process) is picked up without
+  depending on a stale in-memory `legacy` cache. Restart still recommended
+  so live sessions stop serving pre-reset stamps; reset script prints verify
+  steps.
+
+## 6.16.8
+
+- **Per-exchange model stamps on managed installs.** History badges were
+  defaulting to Opus whenever the server pair had no `modelPreference`
+  (Jul 19 `#228`–`#231` archives are unstamped — client `DEFAULT_MODEL`).
+  Bridges now stamp the actual run model on each exchange; archive +
+  today/all-messages emit via `resolveExchangePairModel`. Unstamped
+  legacy rows stay unlabeled server-side (phone still defaults those to
+  Opus — cannot invent Grok without evidence). New Cursor/Codex/Claude
+  turns keep truthful badges after reconnect/merge.
+
+## 6.16.7
+
+- **Message-number era reset on managed public installs.** Companion burn
+  fixes never lowered the archive ceiling (`/api/message-counter` still
+  reported `max: 17931` with no `era`). Ported `message-era` under
+  `~/.cos-glasses/data`, era-scoped counter + lookup, stamp `messageEra` on
+  exchanges, and `409 message_era_mismatch` on legacy `/api/query` + durable
+  admission after a reset. Ops: `npx tsx server/scripts/reset-message-era.ts
+  --confirm`, restart LaunchAgent, phone reconnect → live list clears and
+  numbering restarts near #1. Archives retained.
+
+## 6.16.6
+
+- **HQ finalize no longer loses to late Fast warm.** Fast warm and speculative
+  HQ warm share `warmTranscripts[chunk]`; a slow turbo decode could overwrite
+  large-v3 after HQ had already won. Warm/final writes are quality-monotonic
+  (hq > cloud > fast) for the same audio hash. Finalize reuses HQ/cloud only;
+  when Settings HQ is available, a degraded turbo warm is retried with
+  `automatic` instead of becoming the finished-chat question text.
+
 ## 6.16.5
 
 - **Welcome weather restored on managed installs.** Ported authenticated

package/README.md

@@ -130,6 +130,12 @@ range is the exact Tailscale/CGNAT allocation (`100.64.0.0/10`), not all of
 - Tasks / calendar / people context **if** you run the
   [COS Starter Kit](https://www.gotcos.com) (`COS_SCRIPTS_DIR`); otherwise it is
   glasses + AI only
+- Welcome weather on the glasses home screen via authenticated
+  `GET /api/welcome-context?lat=&lon=`. The phone supplies GPS (Even Hub
+  location permission); this server only proxies Open-Meteo. Without phone
+  coords the route uses last-known process coords, then optional
+  `COS_WEATHER_DEFAULT_*`, otherwise omits weather. Optional `nextEvent`
+  appears when `COS_SCRIPTS_DIR` calendar data is available.
 
 ## Configuration
 
@@ -147,6 +153,8 @@ optional except an installed CLI. Highlights: `BIND_HOST`, `PORT`,
 in the managed CLI working directory),
 `COS_CURSOR_AGENT_BIN` (optional absolute Cursor `agent` binary),
 `COS_CURSOR_PERSIST_SESSIONS=0` (disable Cursor session resume),
+`COS_WEATHER_DEFAULT_LAT` / `COS_WEATHER_DEFAULT_LON` /
+`COS_WEATHER_DEFAULT_CITY` (optional home fallback when phone GPS is denied),
 `COS_SCRIPTS_DIR` (full pipeline), `COS_DURABLE_QUERY_JOBS=1` (build 204+
 server-owned query recovery), and `COS_MEDIA_ROOT` (optional image-store
 location; default `~/.cos-glasses/data/media`). Your name + transcription vocabulary live in

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.16.5",
+  "version": "6.16.9",
   "description": "COS Glasses — self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/lib/archive.ts

@@ -14,6 +14,7 @@ import { mergeMediaAttachmentRefs, type MediaAttachmentRef } from '../../shared/
 import { secureExistingPrivateFile } from './secure-user-config.js'
 
 import type { Exchange } from './conversation.js'
+import { resolveExchangePairModel } from './conversation.js'
 
 import { dataPath } from './data-dir.js'
 const ARCHIVE_DIR = dataPath('archive')
@@ -435,11 +436,11 @@ export function getArchiveChatMessages(
  *  (sessionId, timestamp) instead of bare timestamp (collision-prone). */
 export function getArchiveDayMessages(
   date: string,
-): Array<{ query: string; text: string; timestamp: number; chatIndex: number; sessionId: string; no?: number; attachments?: MediaAttachmentRef[] }> {
+): Array<{ query: string; text: string; timestamp: number; chatIndex: number; sessionId: string; no?: number; globalMsgNum?: number; messageEra?: string; modelPreference?: string; attachments?: MediaAttachmentRef[] }> {
   const archive = loadArchive(date)
   if (!archive) return []
 
-  const messages: Array<{ query: string; text: string; timestamp: number; chatIndex: number; sessionId: string; no?: number; attachments?: MediaAttachmentRef[] }> = []
+  const messages: Array<{ query: string; text: string; timestamp: number; chatIndex: number; sessionId: string; no?: number; globalMsgNum?: number; messageEra?: string; modelPreference?: string; attachments?: MediaAttachmentRef[] }> = []
   for (const chat of archive.chats) {
     for (let i = 0; i < chat.exchanges.length; i++) {
       const ex = chat.exchanges[i]
@@ -447,13 +448,18 @@ export function getArchiveDayMessages(
         const next = chat.exchanges[i + 1]
         if (next && next.role === 'assistant') {
           const attachments = mergeMediaAttachmentRefs(ex.attachments, next.attachments)
+          const globalMsgNum = ex.globalMsgNum ?? next.globalMsgNum
+          const messageEra = ex.messageEra ?? next.messageEra
+          const modelPreference = resolveExchangePairModel(ex, next, null)
           messages.push({
             query: ex.content,
             text: next.content,
             timestamp: next.timestamp,
             chatIndex: chat.id,
             sessionId: chat.sessionId,
-            ...((ex.globalMsgNum ?? next.globalMsgNum) != null ? { no: ex.globalMsgNum ?? next.globalMsgNum } : {}),
+            ...(globalMsgNum != null ? { no: globalMsgNum, globalMsgNum } : {}),
+            ...(messageEra ? { messageEra } : {}),
+            ...(modelPreference ? { modelPreference } : {}),
             ...(attachments.length > 0 ? { attachments } : {}),
           })
           i++

package/server/lib/claude-bridge.ts

@@ -484,6 +484,7 @@ export async function callClaudeStreaming(
     globalMsgNum,
     undefined,
     exchangeProvenance,
+    resolvedModel,
   )
 
   // Vision queries need the Read tool to see the image files
@@ -646,6 +647,7 @@ export async function callClaudeStreaming(
       globalMsgNum,
       undefined,
       exchangeProvenance,
+      resolvedModel,
     )
     if (imagePaths.length > 0) {
       replaceLastExchangeWithSummary(sid, query, text, imagePaths.length)

package/server/lib/codex-bridge.ts

@@ -331,6 +331,7 @@ export async function callCodexStreaming(
     globalMsgNum,
     undefined,
     exchangeProvenance,
+    model,
   )
 
   let fullQuery: string
@@ -483,6 +484,7 @@ export async function callCodexStreaming(
       globalMsgNum,
       undefined,
       exchangeProvenance,
+      model,
     )
     if (imagePaths.length > 0) {
       replaceLastExchangeWithSummary(sid, query, text, imagePaths.length)

package/server/lib/conversation.ts

@@ -15,6 +15,7 @@ import { localDay } from './local-day.js'
 import { normalizeModelPreference, type ModelPreference } from '../../shared/model-preference.js'
 import { parseMediaAttachmentRefs, type MediaAttachmentRef } from '../../shared/media-attachment.js'
 import { secureExistingPrivateFile } from './secure-user-config.js'
+import { currentMessageEra } from './message-era.js'
 
 export type { ModelPreference }
 
@@ -26,6 +27,11 @@ export interface Exchange {
   /** Durable query provenance. Legacy exchanges omit both fields. */
   clientJobId?: string
   generation?: number
+  /** Short-number namespace. Missing means the original legacy era. */
+  messageEra?: string
+  /** Per-exchange model badge. Prefer this over session.modelPreference when
+   * rendering history so Cursor/Codex turns do not inherit an Opus default. */
+  modelPreference?: ModelPreference
   /** Public attachment refs may live on either half of a Q&A pair: request
    * photos on the user exchange, model-published images on the assistant
    * exchange. Bytes, filesystem paths, and capabilities never persist here. */
@@ -144,6 +150,9 @@ function loadFromDisk(): void {
     // the surrounding exchange or the rest of the recovered session.
     for (const exchange of session.exchanges) {
       validateLoadedExchangeProvenance(exchange)
+      const exchangeModel = normalizeModelPreference(exchange.modelPreference)
+      if (exchangeModel) exchange.modelPreference = exchangeModel
+      else delete exchange.modelPreference
       if ('attachments' in exchange && exchange.attachments !== undefined) {
         const refs = parseMediaAttachmentRefs(exchange.attachments)
         if (refs.length > 0) exchange.attachments = refs
@@ -403,6 +412,7 @@ export function addExchange(
   globalMsgNum?: number,
   attachments?: MediaAttachmentRef[],
   provenance?: ExchangeJobProvenance,
+  modelPreference?: ModelPreference | null,
 ): Exchange {
   let session = sessions.get(sessionId)
   if (!session) {
@@ -410,12 +420,15 @@ export function addExchange(
     sessions.set(sessionId, session)
   }
 
+  const stampedModel = normalizeModelPreference(modelPreference)
   const exchange: Exchange = {
     role,
     content,
     timestamp: Date.now(),
     globalMsgNum,
+    messageEra: currentMessageEra(),
     ...normalizedExchangeProvenance(provenance),
+    ...(stampedModel ? { modelPreference: stampedModel } : {}),
     ...(attachments && attachments.length > 0 ? { attachments } : {}),
   }
   session.exchanges.push(exchange)
@@ -512,6 +525,8 @@ export function reconcileExchangeByJobIdentity(
   content: string,
   globalMsgNum?: number,
   attachments?: MediaAttachmentRef[],
+  messageEra?: string,
+  modelPreference?: ModelPreference | null,
 ): ReconciledExchange {
   if (!validClientJobId(identity.clientJobId) || !validGeneration(identity.generation)) {
     throw new Error('conversation: invalid durable job identity')
@@ -538,6 +553,11 @@ export function reconcileExchangeByJobIdentity(
   }
 
   const validatedAttachments = parseMediaAttachmentRefs(attachments)
+  const projectedMessageEra = typeof messageEra === 'string'
+    && /^[a-z0-9][a-z0-9._-]{0,79}$/i.test(messageEra)
+    ? messageEra
+    : currentMessageEra()
+  const stampedModel = normalizeModelPreference(modelPreference)
   let exchange: Exchange
   const created = matchingIndexes.length === 0
   if (created) {
@@ -546,8 +566,10 @@ export function reconcileExchangeByJobIdentity(
       content,
       timestamp: Date.now(),
       globalMsgNum,
+      messageEra: projectedMessageEra,
       clientJobId: identity.clientJobId,
       generation: identity.generation,
+      ...(stampedModel ? { modelPreference: stampedModel } : {}),
       ...(validatedAttachments.length > 0 ? { attachments: validatedAttachments } : {}),
     }
     session.exchanges.push(exchange)
@@ -555,6 +577,8 @@ export function reconcileExchangeByJobIdentity(
     exchange = session.exchanges[matchingIndexes[0]]
     exchange.content = content
     exchange.globalMsgNum = globalMsgNum
+    exchange.messageEra = projectedMessageEra
+    if (stampedModel) exchange.modelPreference = stampedModel
     if (validatedAttachments.length > 0) exchange.attachments = validatedAttachments
     else delete exchange.attachments
 
@@ -617,6 +641,20 @@ export function getSessionModel(sessionId: string): ModelPreference | null {
   return sessions.get(sessionId)?.modelPreference ?? null
 }
 
+/** Prefer per-exchange stamps; fall back to session model for pre-stamp rows. */
+export function resolveExchangePairModel(
+  user: Pick<Exchange, 'modelPreference'> | undefined,
+  assistant: Pick<Exchange, 'modelPreference'> | undefined,
+  sessionModel: ModelPreference | null | undefined,
+): ModelPreference | undefined {
+  return normalizeModelPreference(
+    assistant?.modelPreference
+      ?? user?.modelPreference
+      ?? sessionModel
+      ?? undefined,
+  )
+}
+
 export function setSessionModel(sessionId: string, model: ModelPreference | null): void {
   const session = sessions.get(sessionId)
   if (session) {

package/server/lib/cursor-bridge.ts

@@ -310,9 +310,10 @@ export async function callCursorStreaming(
   const pendingUserExchange = durableIdentity
     ? reconcileExchangeByJobIdentity(
       sid, durableIdentity, 'user', historyQuery, globalMsgNum, inboundAttachments,
+      undefined, model,
     ).exchange
     : addExchange(
-      sid, 'user', historyQuery, globalMsgNum, inboundAttachments, durableIdentity,
+      sid, 'user', historyQuery, globalMsgNum, inboundAttachments, durableIdentity, model,
     )
 
   let fullQuery = query
@@ -446,8 +447,10 @@ export async function callCursorStreaming(
     }
 
     const assistantExchange = durableIdentity
-      ? reconcileExchangeByJobIdentity(sid, durableIdentity, 'assistant', text, globalMsgNum).exchange
-      : addExchange(sid, 'assistant', text, globalMsgNum, undefined, durableIdentity)
+      ? reconcileExchangeByJobIdentity(
+        sid, durableIdentity, 'assistant', text, globalMsgNum, undefined, undefined, model,
+      ).exchange
+      : addExchange(sid, 'assistant', text, globalMsgNum, undefined, durableIdentity, model)
     if (imagePaths.length > 0) {
       replaceLastExchangeWithSummary(sid, query, text, imagePaths.length)
     }

package/server/lib/message-era.ts

@@ -0,0 +1,94 @@
+// Message-number eras let Miles start again at #1 without deleting history.
+// Old sessions/day archives remain immutable and browseable; the current era
+// alone owns short voice references such as "reference message 4".
+//
+// Public package stores state under ~/.cos-glasses/data (dataPath), matching
+// sessions/archive — never a package-relative path that vanishes on npx upgrade.
+//
+// Disk is authoritative across processes: reset-message-era.ts writes the file
+// in a one-shot CLI; the long-lived server re-reads when mtime changes so a
+// reset is visible without relying solely on an in-process cache flush.
+
+import { statSync } from 'node:fs'
+import { atomicWriteFileSync, loadJsonOrQuarantine } from './atomic-fs.js'
+import { dataPath } from './data-dir.js'
+
+export const LEGACY_MESSAGE_ERA = 'legacy'
+
+export interface MessageEraState {
+  v: 1
+  era: string
+  startedAt: number
+}
+
+const MESSAGE_ERA_FILE = dataPath('message-era.json')
+
+let cached: MessageEraState | null = null
+let cachedMtimeMs = Number.NaN
+
+function fileMtimeMs(): number {
+  try {
+    return statSync(MESSAGE_ERA_FILE).mtimeMs
+  } catch {
+    return Number.NaN
+  }
+}
+
+function validState(value: unknown): value is MessageEraState {
+  if (!value || typeof value !== 'object') return false
+  const raw = value as Partial<MessageEraState>
+  return raw.v === 1
+    && typeof raw.era === 'string'
+    && /^[a-z0-9][a-z0-9._-]{0,79}$/i.test(raw.era)
+    && typeof raw.startedAt === 'number'
+    && Number.isFinite(raw.startedAt)
+    && raw.startedAt >= 0
+}
+
+export function currentMessageEraState(): MessageEraState {
+  const mtimeMs = fileMtimeMs()
+  if (cached && Object.is(mtimeMs, cachedMtimeMs)) return cached
+
+  const loaded = loadJsonOrQuarantine<unknown>(MESSAGE_ERA_FILE)
+  if (loaded.status === 'ok' && validState(loaded.data)) {
+    cached = loaded.data
+    cachedMtimeMs = mtimeMs
+    return cached
+  }
+  cached = { v: 1, era: LEGACY_MESSAGE_ERA, startedAt: 0 }
+  cachedMtimeMs = mtimeMs
+  return cached
+}
+
+export function currentMessageEra(): string {
+  return currentMessageEraState().era
+}
+
+export function exchangeBelongsToEra(
+  exchange: { messageEra?: unknown },
+  era = currentMessageEra(),
+): boolean {
+  if (era === LEGACY_MESSAGE_ERA) {
+    return exchange.messageEra == null || exchange.messageEra === LEGACY_MESSAGE_ERA
+  }
+  return exchange.messageEra === era
+}
+
+export function createMessageEra(now = Date.now()): MessageEraState {
+  const stamp = new Date(now).toISOString().replace(/[-:.TZ]/g, '').slice(0, 14)
+  const next: MessageEraState = {
+    v: 1,
+    era: `era-${stamp}`,
+    startedAt: now,
+  }
+  atomicWriteFileSync(MESSAGE_ERA_FILE, JSON.stringify(next, null, 2), { mode: 0o600 })
+  cached = next
+  cachedMtimeMs = fileMtimeMs()
+  return next
+}
+
+/** Test/helper: drop in-memory cache so the next read hits disk. */
+export function __resetMessageEraCacheForTests(): void {
+  cached = null
+  cachedMtimeMs = Number.NaN
+}

package/server/lib/prompt-draft-store.ts

@@ -24,6 +24,13 @@ export interface PromptDraftTranscriptRecord {
   acceptedDegraded?: boolean
 }
 
+/** Higher wins. Fast warm must never replace an HQ/cloud decode for the same audio. */
+export function transcriptQualityRank(quality: PromptDraftTranscriptRecord['actualQuality']): number {
+  if (quality === 'hq') return 3
+  if (quality === 'cloud') return 2
+  return 1
+}
+
 export interface PromptDraftMeta {
   v: 2
   draftId: string
@@ -224,10 +231,39 @@ export async function markPromptDraftChunkTranscript(
       ? { text: record, hash: meta.chunkHashes[key] ?? '', requestedMode: 'hq', actualQuality: 'fast', backend: 'legacy', degraded: true }
       : record
     if (meta.chunkHashes[key] && normalized.hash && meta.chunkHashes[key] !== normalized.hash) return meta
-    if (purpose === 'final') meta.finalTranscripts[key] = normalized
-    else meta.warmTranscripts[key] = normalized
+
+    if (purpose === 'final') {
+      const existingFinal = meta.finalTranscripts[key]
+      // Final is authoritative for its mode, but never downgrade a better decode
+      // of the same audio (late Fast warm finishing after HQ finalize).
+      if (
+        existingFinal
+        && existingFinal.hash === normalized.hash
+        && transcriptQualityRank(existingFinal.actualQuality) > transcriptQualityRank(normalized.actualQuality)
+      ) {
+        return meta
+      }
+      meta.finalTranscripts[key] = normalized
+    } else {
+      const existingWarm = meta.warmTranscripts[key]
+      // Speculative HQ and Fast warm share warmTranscripts[chunk]. Whichever
+      // finishes last used to win — a slow Fast warm could clobber HQ and make
+      // the next reader (or a racy finalize) prefer turbo text.
+      if (
+        existingWarm
+        && existingWarm.hash === normalized.hash
+        && transcriptQualityRank(existingWarm.actualQuality) > transcriptQualityRank(normalized.actualQuality)
+      ) {
+        return meta
+      }
+      meta.warmTranscripts[key] = normalized
+    }
+
     if (!meta.chunkTranscripts) meta.chunkTranscripts = {}
-    meta.chunkTranscripts[key] = normalized.text
+    const published = meta.finalTranscripts[key] ?? meta.warmTranscripts[key]
+    if (published && published.hash === (meta.chunkHashes[key] ?? published.hash)) {
+      meta.chunkTranscripts[key] = published.text
+    }
     return writeMeta(touchMeta(meta))
   })
 }

package/server/lib/query-job-runtime.ts

@@ -5,6 +5,7 @@ import { emitDisplay } from './display-bus.js'
 import { resolveQueryAttachments } from './query-attachments.js'
 import { getMediaStore } from './media-store.js'
 import { dataPath } from './data-dir.js'
+import { currentMessageEra, LEGACY_MESSAGE_ERA } from './message-era.js'
 import { durableQueryJobsEnabled } from './query-job-feature.js'
 import { QueryJobCoordinator, type QueryJobRunner } from './query-job-coordinator.js'
 import { QueryJobStore } from './query-job-store.js'
@@ -36,17 +37,42 @@ const TOOL_STATUS_MESSAGES: Record<string, string> = {
   Read: 'Analyzing photo...',
 }
 
+export class QueryJobAdmissionPreparationError extends Error {
+  constructor(readonly status: number, readonly code: string, message: string) {
+    super(message)
+    this.name = 'QueryJobAdmissionPreparationError'
+  }
+}
+
 /** Resolve image bytes/ids before returning 202. The journal receives only
  * validated refs and ids; base64 bytes and provider-local paths are dropped by
- * the strict QueryJobRequest parser before persistence. */
+ * the strict QueryJobRequest parser before persistence. Once a reset era
+ * exists, reject pre-era clients before they stamp five-digit numbers into
+ * the fresh namespace. */
 export async function preparePublicDurableQueryAdmission(raw: unknown): Promise<unknown> {
   if (!raw || typeof raw !== 'object') return raw
   const input = raw as Record<string, unknown>
-  const resolved = await resolveQueryAttachments(input)
-  return {
-    ...input,
-    attachmentIds: resolved.ids,
-    attachmentRefs: resolved.refs,
+  const activeEra = currentMessageEra()
+  if (activeEra !== LEGACY_MESSAGE_ERA && input.messageEra !== activeEra) {
+    throw new QueryJobAdmissionPreparationError(
+      409,
+      'message_era_mismatch',
+      'Reopen or update COS Glasses to start the fresh message list.',
+    )
+  }
+  try {
+    const resolved = await resolveQueryAttachments(input)
+    return {
+      ...input,
+      messageEra: activeEra,
+      attachmentIds: resolved.ids,
+      attachmentRefs: resolved.refs,
+    }
+  } catch (error: any) {
+    if (Number.isInteger(error?.status) && typeof error?.code === 'string') {
+      throw new QueryJobAdmissionPreparationError(error.status, error.code, error.message)
+    }
+    throw error
   }
 }
 
@@ -87,6 +113,8 @@ async function projectPublicConversationTerminal(
     userContent,
     request.globalMsgNum,
     request.attachmentRefs,
+    request.messageEra,
+    request.model,
   )
   reconcileExchangeByJobIdentity(
     request.sessionId,
@@ -95,6 +123,8 @@ async function projectPublicConversationTerminal(
     job.response ?? job.partialText,
     request.globalMsgNum,
     mergeMediaAttachmentRefs(outputAttachments, existingOutputAttachments),
+    request.messageEra,
+    request.model,
   )
   flushConversationToDisk()
 }

package/server/routes/message-ref.ts

@@ -6,7 +6,7 @@
 // fresh client continues the sequence instead of reusing numbers.
 //
 //   GET /api/message/:num     → { globalMsgNum, date, query, response }  (404 when unknown)
-//   GET /api/message-counter  → { max }
+//   GET /api/message-counter  → { max, era }
 //
 // Resolution order (per the prompt-queue/archive plan): live in-memory
 // sessions first (covers the mirror's 15-minute lag), then day archives
@@ -19,6 +19,11 @@ import { getActiveSessions } from '../lib/conversation.js'
 import { dataPath } from '../lib/data-dir.js'
 import { localDay } from '../lib/local-day.js'
 import { mergeMediaAttachmentRefs, type MediaAttachmentRef } from '../../shared/media-attachment.js'
+import {
+  LEGACY_MESSAGE_ERA,
+  currentMessageEra,
+  exchangeBelongsToEra,
+} from '../lib/message-era.js'
 
 // v6.3.0 — read archives from the SAME persistent location the archive-mirror
 // writes to (~/.cos-glasses/data/archive via dataPath), not a package-relative
@@ -40,6 +45,7 @@ interface ExchangeLike {
   content?: string
   timestamp?: number
   globalMsgNum?: number
+  messageEra?: string
   attachments?: unknown
 }
 
@@ -60,9 +66,16 @@ function pairExchange(exchanges: ExchangeLike[], i: number): { query: string; re
   }
 }
 
-function scanExchanges(exchanges: ExchangeLike[], num: number, date: string): ResolvedGlobalMessage | null {
+function scanExchanges(
+  exchanges: ExchangeLike[],
+  num: number,
+  date: string,
+  /** Pass null to match any era (post-reset short-ref fallback). */
+  era: string | null = currentMessageEra(),
+): ResolvedGlobalMessage | null {
   for (let i = 0; i < exchanges.length; i++) {
     if (exchanges[i]?.globalMsgNum !== num) continue
+    if (era != null && !exchangeBelongsToEra(exchanges[i] ?? {}, era)) continue
     const { query, response, attachments } = pairExchange(exchanges, i)
     return {
       globalMsgNum: num, date, query, response,
@@ -74,7 +87,11 @@ function scanExchanges(exchanges: ExchangeLike[], num: number, date: string): Re
 
 /** Resolve a global message number from the day archives, newest-first.
  *  Exported with an explicit dir for tests. */
-export function resolveFromArchiveDir(dir: string, num: number): ResolvedGlobalMessage | null {
+export function resolveFromArchiveDir(
+  dir: string,
+  num: number,
+  era: string | null = LEGACY_MESSAGE_ERA,
+): ResolvedGlobalMessage | null {
   let files: string[] = []
   try {
     files = readdirSync(dir).filter((f) => /^\d{4}-\d{2}-\d{2}\.json$/.test(f)).sort().reverse()
@@ -87,7 +104,12 @@ export function resolveFromArchiveDir(dir: string, num: number): ResolvedGlobalM
       const chats = Array.isArray(day?.chats) ? day.chats : []
       for (const chat of chats) {
         const exchanges = Array.isArray(chat?.exchanges) ? chat.exchanges : []
-        const hit = scanExchanges(exchanges, num, typeof day?.date === 'string' ? day.date : f.slice(0, 10))
+        const hit = scanExchanges(
+          exchanges,
+          num,
+          typeof day?.date === 'string' ? day.date : f.slice(0, 10),
+          era,
+        )
         if (hit) return hit
       }
     } catch {
@@ -143,8 +165,8 @@ export function getArchiveChatMessagesNumbered(date: string, chatIndex: number)
   return readArchiveChatNumbered(ARCHIVE_DIR, date, chatIndex)
 }
 
-/** Highest stamped number across the day archives (0 when none). */
-export function maxGlobalMsgNumInDir(dir: string): number {
+/** Highest stamped number across the day archives for one era (0 when none). */
+export function maxGlobalMsgNumInDir(dir: string, era = LEGACY_MESSAGE_ERA): number {
   let max = 0
   let files: string[] = []
   try {
@@ -157,6 +179,7 @@ export function maxGlobalMsgNumInDir(dir: string): number {
       const day = JSON.parse(readFileSync(resolve(dir, f), 'utf8'))
       for (const chat of Array.isArray(day?.chats) ? day.chats : []) {
         for (const ex of Array.isArray(chat?.exchanges) ? chat.exchanges : []) {
+          if (!exchangeBelongsToEra(ex ?? {}, era)) continue
           if (typeof ex?.globalMsgNum === 'number' && ex.globalMsgNum > max) max = ex.globalMsgNum
         }
       }
@@ -165,11 +188,14 @@ export function maxGlobalMsgNumInDir(dir: string): number {
   return max
 }
 
-function resolveFromLiveSessions(num: number): ResolvedGlobalMessage | null {
+function resolveFromLiveSessions(
+  num: number,
+  era: string | null = currentMessageEra(),
+): ResolvedGlobalMessage | null {
   const today = localDay() // local calendar day, not UTC — a live ref in the user's evening must not label tomorrow
   for (const session of getActiveSessions()) {
     const exchanges = (session as { exchanges?: ExchangeLike[] }).exchanges ?? []
-    const hit = scanExchanges(exchanges, num, today)
+    const hit = scanExchanges(exchanges, num, today, era)
     if (hit) return hit
   }
   return null
@@ -183,7 +209,13 @@ messageRefRouter.get('/message/:num', (req, res) => {
     res.status(400).json({ error: 'invalid message number' })
     return
   }
-  const hit = resolveFromLiveSessions(num) ?? resolveFromArchiveDir(ARCHIVE_DIR, num)
+  // Prefer the current era so short refs stay unambiguous after a reset.
+  // Fall back across eras so "recall message 562" still works for pre-reset
+  // stamps once numbering restarts at #1.
+  const hit = resolveFromLiveSessions(num)
+    ?? resolveFromArchiveDir(ARCHIVE_DIR, num, currentMessageEra())
+    ?? resolveFromLiveSessions(num, null)
+    ?? resolveFromArchiveDir(ARCHIVE_DIR, num, null)
   if (!hit) {
     res.status(404).json({ error: `message ${num} not found` })
     return
@@ -192,11 +224,13 @@ messageRefRouter.get('/message/:num', (req, res) => {
 })
 
 messageRefRouter.get('/message-counter', (_req, res) => {
+  const era = currentMessageEra()
   let liveMax = 0
   for (const session of getActiveSessions()) {
     for (const ex of ((session as { exchanges?: ExchangeLike[] }).exchanges ?? [])) {
+      if (!exchangeBelongsToEra(ex, era)) continue
       if (typeof ex?.globalMsgNum === 'number' && ex.globalMsgNum > liveMax) liveMax = ex.globalMsgNum
     }
   }
-  res.json({ max: Math.max(liveMax, maxGlobalMsgNumInDir(ARCHIVE_DIR)) })
+  res.json({ max: Math.max(liveMax, maxGlobalMsgNumInDir(ARCHIVE_DIR, era)), era })
 })

package/server/routes/prompt-drafts.ts

@@ -13,6 +13,7 @@ import {
   markPromptDraftError,
   getMissingChunkIndexes,
   prunePromptDrafts,
+  transcriptQualityRank,
   type PromptDraftTranscriptRecord,
 } from '../lib/prompt-draft-store.js'
 import {
@@ -22,6 +23,7 @@ import {
   OpenAIWhisperBudgetExhaustedError,
   TranscriptionUnavailableError,
 } from '../lib/transcribe-audio.js'
+import { getHighQualityTranscriptionCapability } from '../lib/whisper-local.js'
 import {
   stripInlineHallucinationsOneShot,
   stripInlineHallucinations,
@@ -191,16 +193,31 @@ async function transcribeChunk(draftId: string, chunkIndex: number, audio: Buffe
         const current = loadPromptDraftMeta(draftId)
         const warm = current?.warmTranscripts?.[String(chunkIndex)]
         const cachedFinal = current?.finalTranscripts?.[String(chunkIndex)]
-        if (!cachedFinal || cachedFinal.hash !== hash) {
-          await markPromptDraftChunkTranscript(draftId, chunkIndex, {
-            text,
-            hash,
-            requestedMode: warm?.requestedMode ?? mode,
-            actualQuality: warm?.actualQuality ?? (mode === 'hq' ? 'hq' : 'fast'),
-            backend: warm?.backend ?? 'shared-inflight',
-            degraded: warm?.degraded ?? false,
-            ...(warm?.degradationReason ? { degradationReason: warm.degradationReason } : {}),
-          }, 'final')
+        // Trust the shared job text + mode key. Warm metadata is only used when
+        // it still matches this decode — a late Fast warm must not relabel HQ.
+        const warmMatches = Boolean(
+          warm
+          && warm.hash === hash
+          && warm.requestedMode === mode
+          && warm.text === text,
+        )
+        const record: PromptDraftTranscriptRecord = {
+          text,
+          hash,
+          requestedMode: mode,
+          actualQuality: warmMatches
+            ? warm!.actualQuality
+            : (mode === 'hq' ? 'hq' : 'fast'),
+          backend: warmMatches ? warm!.backend : 'shared-inflight',
+          degraded: warmMatches ? warm!.degraded : false,
+          ...(warmMatches && warm!.degradationReason ? { degradationReason: warm!.degradationReason } : {}),
+        }
+        if (
+          !cachedFinal
+          || cachedFinal.hash !== hash
+          || transcriptQualityRank(cachedFinal.actualQuality) < transcriptQualityRank(record.actualQuality)
+        ) {
+          await markPromptDraftChunkTranscript(draftId, chunkIndex, record, 'final')
         }
       }
       return text
@@ -245,6 +262,22 @@ async function transcribeChunk(draftId: string, chunkIndex: number, audio: Buffe
   return job
 }
 
+function isReusableTranscript(
+  cached: PromptDraftTranscriptRecord | undefined,
+  hash: string,
+  mode: 'hq' | 'fast',
+): boolean {
+  if (!cached || cached.hash !== hash || cached.requestedMode !== mode) return false
+  if (cached.backend.startsWith('legacy')) return false
+  if (mode === 'fast') return cached.actualQuality === 'fast' || cached.actualQuality === 'cloud'
+  // mode === 'hq'
+  if (cached.actualQuality === 'hq' || cached.actualQuality === 'cloud') return true
+  // Degraded turbo after an HQ request: retry when large-v3 can still run.
+  // If HQ is unavailable, reuse to avoid a pointless second turbo decode.
+  if (cached.actualQuality === 'fast') return !getHighQualityTranscriptionCapability().hqAvailable
+  return false
+}
+
 async function finalizeDraft(draftId: string, mode: 'hq' | 'fast', autoClean: AutoCleanRequest, signal?: AbortSignal) {
   const meta = loadPromptDraftMeta(draftId)
   if (!meta) throw Object.assign(new Error('draft not found'), { status: 404 })
@@ -262,17 +295,11 @@ async function finalizeDraft(draftId: string, mode: 'hq' | 'fast', autoClean: Au
       }
       const current = loadPromptDraftMeta(draftId)
       const cached = current?.finalTranscripts?.[String(chunk.chunkIndex)] ?? current?.warmTranscripts?.[String(chunk.chunkIndex)]
-      // Reuse the exact requested-mode decode even when HQ truthfully degraded
-      // to turbo. Finalize's automatic policy would make the same local choice
-      // again after a successful turbo result, so a second decode adds latency
-      // without improving quality. Legacy records stay excluded because their
-      // decoder provenance was reconstructed during migration.
-      const reusable = Boolean(
-        cached
-        && cached.hash === hash
-        && cached.requestedMode === mode
-        && !cached.backend.startsWith('legacy'),
-      )
+      // Reuse only a decode that still matches the requested mode's quality bar.
+      // When Settings HQ is available, never treat a degraded turbo warm as final
+      // — that left finished chats on Fast text while REVIEW looked "HQ ready".
+      // Legacy records stay excluded (reconstructed provenance).
+      const reusable = isReusableTranscript(cached, hash, mode)
       const raw = reusable ? cached!.text : await transcribeChunk(draftId, chunk.chunkIndex, chunk.audioBuffer, mode, 'final')
       const text = sanitizeTranscript(draftId, raw, !reusable)
       if (text.trim()) {

package/server/routes/query.ts

@@ -18,6 +18,7 @@ import {
   MaintenanceLifecycleError,
   maintenanceErrorPayload,
 } from '../lib/maintenance-lifecycle.js'
+import { currentMessageEra, LEGACY_MESSAGE_ERA } from '../lib/message-era.js'
 
 const TOOL_STATUS_MESSAGES: Record<string, string> = {
   WebSearch: 'Searching web...',
@@ -38,7 +39,7 @@ queryRouter.post('/query', async (req, res) => {
     }
     throw error
   }
-  const { query, sessionId, model, effort, reference, globalMsgNum } = req.body
+  const { query, sessionId, model, effort, reference, globalMsgNum, messageEra } = req.body
   const activityToolMode = req.body.activityToolMode === 'off' || req.body.activityToolMode === 'preview'
     ? req.body.activityToolMode
     : 'status'
@@ -46,6 +47,24 @@ queryRouter.post('/query', async (req, res) => {
   // omit/unknown must not silently force Ask (6.16.3 durable-only gap).
   const cursorExecutionMode = req.body.cursorExecutionMode === 'ask' ? 'ask' as const : 'agent' as const
 
+  // Once a reset era exists, reject pre-era clients before they can stamp a
+  // five-digit number into the fresh namespace. Companion learns the era from
+  // /api/message-counter and includes it on every query.
+  const activeMessageEra = currentMessageEra()
+  if (activeMessageEra !== LEGACY_MESSAGE_ERA && messageEra !== activeMessageEra) {
+    console.warn('[query] message era mismatch', {
+      sessionId: typeof sessionId === 'string' ? sessionId : undefined,
+      sentEra: typeof messageEra === 'string' ? messageEra : '(missing)',
+      expectedEra: activeMessageEra,
+    })
+    maintenanceLease.release()
+    return res.status(409).json({
+      error: 'message_era_mismatch',
+      detail: 'Reopen or update COS Glasses to start the fresh message list.',
+      era: activeMessageEra,
+    })
+  }
+
   // Resolve durable attachment ids and legacy base64 images through one
   // validation/normalization path before opening SSE.
   let resolvedAttachments

package/server/routes/sessions.ts

@@ -2,12 +2,13 @@
 import { Router } from 'express'
 import { readFileSync } from 'fs'
 import { join } from 'path'
-import { getRecentSessions, getHistory, sessionExists, addContextBreak, endSession, getSessionRaw, getActiveSessions } from '../lib/conversation.js'
+import { getRecentSessions, getHistory, sessionExists, addContextBreak, endSession, getSessionRaw, getActiveSessions, resolveExchangePairModel } from '../lib/conversation.js'
 import { buildSessionLogEntry, writeSessionLog } from '../lib/session-log.js'
 import { getArchiveDayMessages } from '../lib/archive.js'
 import { localDay } from '../lib/local-day.js'
 import { clearCodexEngineSession } from '../lib/codex-engine-sessions.js'
 import { mergeMediaAttachmentRefs, type MediaAttachmentRef } from '../../shared/media-attachment.js'
+import { currentMessageEra, exchangeBelongsToEra } from '../lib/message-era.js'
 
 export const sessionsRouter = Router()
 
@@ -57,20 +58,24 @@ sessionsRouter.get('/sessions/:id/messages', (req, res) => {
     timestamp: number
     no?: number
     sessionId: string
+    modelPreference?: string
     attachments?: MediaAttachmentRef[]
   }> = []
+  const session = getSessionRaw(req.params.id)
   for (let i = 0; i < exchanges.length; i++) {
     const ex = exchanges[i]
     if (ex.role === 'user') {
       const next = exchanges[i + 1]
       if (next && next.role === 'assistant') {
         const attachments = mergeMediaAttachmentRefs(ex.attachments, next.attachments)
+        const modelPreference = resolveExchangePairModel(ex, next, session?.modelPreference)
         messages.push({
           query: ex.content,
           text: next.content,
           timestamp: next.timestamp,
           sessionId: req.params.id,
           ...((ex.globalMsgNum ?? next.globalMsgNum) != null ? { no: ex.globalMsgNum ?? next.globalMsgNum } : {}),
+          ...(modelPreference ? { modelPreference } : {}),
           ...(attachments.length > 0 ? { attachments } : {}),
         })
         i++ // skip the assistant exchange
@@ -241,11 +246,14 @@ sessionsRouter.get('/sessions/today/live-chats', (_req, res) => {
 // back to the archived chat's sessionId via getArchiveDayMessages.
 sessionsRouter.get('/sessions/today/all-messages', (_req, res) => {
   const todayDate = localDay()
+  const era = currentMessageEra()
 
-  const archivedMessages = getArchiveDayMessages(todayDate).map(m => ({
-    ...m,
-    source: 'archive' as const,
-  }))
+  const archivedMessages = getArchiveDayMessages(todayDate)
+    .filter(m => exchangeBelongsToEra(m, era))
+    .map(m => ({
+      ...m,
+      source: 'archive' as const,
+    }))
 
   const liveMessages: Array<{
     query: string
@@ -255,6 +263,9 @@ sessionsRouter.get('/sessions/today/all-messages', (_req, res) => {
     sessionId: string
     source: 'live'
     no?: number
+    globalMsgNum?: number
+    messageEra?: string
+    modelPreference?: string
     attachments?: MediaAttachmentRef[]
   }> = []
   const liveSessions = getActiveSessions()
@@ -264,9 +275,13 @@ sessionsRouter.get('/sessions/today/all-messages', (_req, res) => {
     for (let i = 0; i < session.exchanges.length; i++) {
       const ex = session.exchanges[i]
       if (ex.role === 'user') {
+        if (!exchangeBelongsToEra(ex, era)) continue
         const next = session.exchanges[i + 1]
         if (next && next.role === 'assistant') {
           const attachments = mergeMediaAttachmentRefs(ex.attachments, next.attachments)
+          const globalMsgNum = ex.globalMsgNum ?? next.globalMsgNum
+          const messageEra = ex.messageEra ?? next.messageEra
+          const modelPreference = resolveExchangePairModel(ex, next, session.modelPreference)
           liveMessages.push({
             query: ex.content,
             text: next.content,
@@ -274,7 +289,9 @@ sessionsRouter.get('/sessions/today/all-messages', (_req, res) => {
             chatIndex: -1,
             sessionId: session.id,
             source: 'live',
-            ...((ex.globalMsgNum ?? next.globalMsgNum) != null ? { no: ex.globalMsgNum ?? next.globalMsgNum } : {}),
+            ...(globalMsgNum != null ? { no: globalMsgNum, globalMsgNum } : {}),
+            ...(messageEra ? { messageEra } : {}),
+            ...(modelPreference ? { modelPreference } : {}),
             ...(attachments.length > 0 ? { attachments } : {}),
           })
           i++

package/server/routes/welcome-context.ts

@@ -127,6 +127,19 @@ async function reverseGeocode(lat: number, lon: number): Promise<string> {
   }
 }
 
+/** Ensure a city label before any weather JSON leaves the server (3s capped). */
+async function ensureCityLabel(lat: number, lon: number, source: 'query' | 'last' | 'env'): Promise<void> {
+  if (lastKnownCity) return
+  if (source === 'env') {
+    const env = envDefaultCoords()
+    if (env?.city) {
+      lastKnownCity = env.city
+      return
+    }
+  }
+  await reverseGeocode(lat, lon)
+}
+
 export async function fetchWeather(
   queryLat?: number,
   queryLon?: number,
@@ -147,19 +160,21 @@ export async function fetchWeather(
     lastKnownLat = useLat
     lastKnownLon = useLon
     weatherFetchedAt = 0
-    // Blocker fix: wait for city before first paint (capped).
-    await reverseGeocode(useLat, useLon)
-  } else if (source === 'env' && !lastKnownCity) {
-    const env = envDefaultCoords()
-    if (env?.city) lastKnownCity = env.city
-    lastKnownLat = useLat
-    lastKnownLon = useLon
-  } else if (lastKnownLat == null) {
+    lastKnownCity = '' // force fresh reverse-geocode for the new place
+  } else if (lastKnownLat == null || lastKnownLon == null) {
     lastKnownLat = useLat
     lastKnownLon = useLon
   }
 
+  // Warning fix: never return weather (cached or fresh) without a city when
+  // we can still resolve one — closes reverse-geocode race on first paint.
+  await ensureCityLabel(useLat, useLon, source)
+
   if (cachedWeather && Date.now() - weatherFetchedAt < WEATHER_TTL_MS) {
+    // Refresh location string if geocode caught up after an older cache write.
+    if (lastKnownCity && cachedWeather.location !== lastKnownCity) {
+      cachedWeather = { ...cachedWeather, location: lastKnownCity }
+    }
     return cachedWeather
   }
 
@@ -177,13 +192,7 @@ export async function fetchWeather(
     const code = data.current?.weather_code
     if (typeof temp !== 'number' || typeof code !== 'number') return cachedWeather
 
-    if (!lastKnownCity && source === 'env') {
-      const env = envDefaultCoords()
-      if (env?.city) lastKnownCity = env.city
-    }
-    if (!lastKnownCity) {
-      await reverseGeocode(useLat, useLon)
-    }
+    await ensureCityLabel(useLat, useLon, source)
 
     cachedWeather = {
       temp: `${Math.round(temp)}\u00B0F`,

package/server/scripts/reset-message-era.ts

@@ -0,0 +1,28 @@
+#!/usr/bin/env tsx
+// Creates a fresh short-number namespace without touching sessions or archives.
+// Restart the server afterward so every new exchange is stamped into the era.
+//
+//   npx tsx server/scripts/reset-message-era.ts --confirm
+
+import { createMessageEra, currentMessageEraState } from '../lib/message-era.js'
+
+if (!process.argv.includes('--confirm')) {
+  const current = currentMessageEraState()
+  console.error(`Current message era: ${current.era}`)
+  console.error('Refusing to reset without --confirm. History will be retained.')
+  process.exit(2)
+}
+
+const next = createMessageEra()
+console.log(JSON.stringify({
+  status: 'created',
+  ...next,
+  history: 'retained',
+  restartRequired: true,
+  verify: 'GET /api/message-counter should return { max: 0 or small, era: "<era above>" } after server restart',
+  nextSteps: [
+    'Restart LaunchAgent / Control Update Server generation',
+    'Phone reconnect so syncMessageEra clears the live list',
+    'Send a test message — expect #1 (or low single digits)',
+  ],
+}, null, 2))