@gotcos/glasses-server 6.16.5 → 6.17.0

package/.env.example

@@ -93,7 +93,10 @@ BIND_HOST=0.0.0.0
 
 # ── WELCOME WEATHER (optional) ──────────────────────────────────────────
 # Phone GPS (Even Hub location permission) is the primary source. The Mac only
-# proxies Open-Meteo. If the phone denies location, set a home fallback:
+# proxies Open-Meteo via GET /api/welcome-context?lat=&lon= (auth required).
+# Prove: curl -H "x-cos-token: $COS_API_TOKEN" \
+#   "http://127.0.0.1:3141/api/welcome-context?lat=30.27&lon=-97.74"
+# If the phone denies location, set a home fallback (omit weather otherwise):
 # COS_WEATHER_DEFAULT_LAT=30.5788
 # COS_WEATHER_DEFAULT_LON=-97.8531
 # COS_WEATHER_DEFAULT_CITY=Home

package/CHANGELOG.md

@@ -1,3 +1,74 @@
+## 6.17.0
+
+- **Speaker diarization is now a bolt-on any install can enable.** The ~26 MB
+  voiceprint model stays out of the npm package, but the loader no longer looks
+  only inside the package (where a managed install has no copy, and where a
+  hand-placed one is destroyed by the next update). Resolution order:
+  `COS_SPEAKER_MODEL_PATH` → `~/.cos-glasses/models/` → bundled `server/models/`
+  (source checkouts). Put the model in `~/.cos-glasses/models/` and restart.
+- **A bad model file can no longer take the server down.** onnxruntime aborts
+  the process on a malformed or mismatched model rather than throwing, which
+  under a KeepAlive LaunchAgent became a permanent restart loop that killed
+  queries, meetings, and transcription over an optional feature. The file is now
+  screened structurally and loaded in a throwaway child process first, so a
+  truncated download or an HTML error page saved as `.onnx` disables diarization
+  and nothing else.
+- **`/api/health` reports `speaker_id`** as `active` / `unavailable` / `error`,
+  so a server running without voiceprints is no longer indistinguishable from
+  one doing real diarization. `error` means a model is installed but the runtime
+  rejected it.
+- **Profile config is read from the data home.** `.cos-profile.json` is now
+  loaded from `~/.cos-glasses/` when present, ahead of the package-root copy.
+  Managed installs previously resolved it inside the generation directory, where
+  no profile exists and every field silently took its default — losing
+  transcription vocabulary, whisper corrections, and the wearer label.
+- **`/api/voice/enroll` and `/api/voice/status` no longer hardcode `MU`.** Both
+  use `owner_speaker_label` (default `Me`), matching what identification already
+  used. **Upgrade note:** an install that enrolled under the old default holds a
+  profile named `MU`; `/api/voice/status` will report `enrolled: false` until you
+  set `owner_speaker_label` to `MU`. Do that rather than re-enrolling, which
+  splits one voice across two profiles.
+
+## 6.16.9
+
+- **Message-era reset visible to a running server.** `currentMessageEraState`
+  re-reads `message-era.json` when mtime changes, so
+  `reset-message-era.ts --confirm` (separate process) is picked up without
+  depending on a stale in-memory `legacy` cache. Restart still recommended
+  so live sessions stop serving pre-reset stamps; reset script prints verify
+  steps.
+
+## 6.16.8
+
+- **Per-exchange model stamps on managed installs.** History badges were
+  defaulting to Opus whenever the server pair had no `modelPreference`
+  (Jul 19 `#228`–`#231` archives are unstamped — client `DEFAULT_MODEL`).
+  Bridges now stamp the actual run model on each exchange; archive +
+  today/all-messages emit via `resolveExchangePairModel`. Unstamped
+  legacy rows stay unlabeled server-side (phone still defaults those to
+  Opus — cannot invent Grok without evidence). New Cursor/Codex/Claude
+  turns keep truthful badges after reconnect/merge.
+
+## 6.16.7
+
+- **Message-number era reset on managed public installs.** Companion burn
+  fixes never lowered the archive ceiling (`/api/message-counter` still
+  reported `max: 17931` with no `era`). Ported `message-era` under
+  `~/.cos-glasses/data`, era-scoped counter + lookup, stamp `messageEra` on
+  exchanges, and `409 message_era_mismatch` on legacy `/api/query` + durable
+  admission after a reset. Ops: `npx tsx server/scripts/reset-message-era.ts
+  --confirm`, restart LaunchAgent, phone reconnect → live list clears and
+  numbering restarts near #1. Archives retained.
+
+## 6.16.6
+
+- **HQ finalize no longer loses to late Fast warm.** Fast warm and speculative
+  HQ warm share `warmTranscripts[chunk]`; a slow turbo decode could overwrite
+  large-v3 after HQ had already won. Warm/final writes are quality-monotonic
+  (hq > cloud > fast) for the same audio hash. Finalize reuses HQ/cloud only;
+  when Settings HQ is available, a degraded turbo warm is retried with
+  `automatic` instead of becoming the finished-chat question text.
+
 ## 6.16.5
 
 - **Welcome weather restored on managed installs.** Ported authenticated

package/README.md

@@ -130,6 +130,12 @@ range is the exact Tailscale/CGNAT allocation (`100.64.0.0/10`), not all of
 - Tasks / calendar / people context **if** you run the
   [COS Starter Kit](https://www.gotcos.com) (`COS_SCRIPTS_DIR`); otherwise it is
   glasses + AI only
+- Welcome weather on the glasses home screen via authenticated
+  `GET /api/welcome-context?lat=&lon=`. The phone supplies GPS (Even Hub
+  location permission); this server only proxies Open-Meteo. Without phone
+  coords the route uses last-known process coords, then optional
+  `COS_WEATHER_DEFAULT_*`, otherwise omits weather. Optional `nextEvent`
+  appears when `COS_SCRIPTS_DIR` calendar data is available.
 
 ## Configuration
 
@@ -147,6 +153,8 @@ optional except an installed CLI. Highlights: `BIND_HOST`, `PORT`,
 in the managed CLI working directory),
 `COS_CURSOR_AGENT_BIN` (optional absolute Cursor `agent` binary),
 `COS_CURSOR_PERSIST_SESSIONS=0` (disable Cursor session resume),
+`COS_WEATHER_DEFAULT_LAT` / `COS_WEATHER_DEFAULT_LON` /
+`COS_WEATHER_DEFAULT_CITY` (optional home fallback when phone GPS is denied),
 `COS_SCRIPTS_DIR` (full pipeline), `COS_DURABLE_QUERY_JOBS=1` (build 204+
 server-owned query recovery), and `COS_MEDIA_ROOT` (optional image-store
 location; default `~/.cos-glasses/data/media`). Your name + transcription vocabulary live in
@@ -155,6 +163,55 @@ Telegram activity export is disabled by default even when a private COS
 pipeline contains `.telegram_config.json`; enable it only with the explicit
 `COS_TELEGRAM_NOTIFICATIONS=1` opt-in.
 
+## Speaker diarization (opt-in)
+
+Without a voiceprint model this server does not classify speakers at all — it
+passes through whatever label the client sends (`Unknown` when the client sends
+nothing; the COS companion sends its own wearer/`Ext` labels). Named
+per-speaker diarization needs a ~26 MB voiceprint model that is deliberately
+**not** shipped in the npm package, so it is a bolt-on:
+
+```bash
+mkdir -p ~/.cos-glasses/models
+# put 3dspeaker_speech_eres2net_sv_en_voxceleb_16k.onnx there, then restart
+```
+
+The server searches, in order: `COS_SPEAKER_MODEL_PATH` (explicit full path to
+the `.onnx`), `~/.cos-glasses/models/`, then a bundled `server/models/` copy
+(source checkouts only). **Use the data home, not the installed package** —
+anything inside the package is destroyed by the next update, while
+`~/.cos-glasses/` survives.
+
+Use an **absolute** path if you set `COS_SPEAKER_MODEL_PATH` — a relative one
+resolves against the working directory, which under the managed LaunchAgent is
+the installed package.
+
+Verify with `/api/health` → `speaker_id`:
+
+| Value | Meaning |
+|---|---|
+| `active` | model loaded, diarization running |
+| `unavailable` | no model found — labels come from the client |
+| `error` | a model is present but the runtime rejected it (see the startup log) |
+
+The model is read once at startup, so restart after adding it. A corrupt or
+mismatched `.onnx` is screened and probed in a child process first, so a bad
+download disables diarization instead of taking the server down — but it does
+mean a wrong file fails silently apart from that log line.
+
+The wearer's label comes from `owner_speaker_label` in
+`~/.cos-glasses/.cos-profile.json` (default `Me`); set it to match the profile
+name you enrol under. Train voices via `/api/voice/enroll?name=…` (the default
+name is `owner_speaker_label`); profiles persist in
+`~/.cos-glasses/data/voice-profiles.json`.
+
+**Upgrading from an older server:** before this release the enrollment default
+was hardcoded to `MU`, so an existing install may hold a profile under that name
+while `owner_speaker_label` resolves to `Me`. `/api/voice/status` will then
+report `enrolled: false`. Set `owner_speaker_label` to `MU` to keep the existing
+voiceprints rather than re-enrolling, which would split the same voice across two
+profiles.
+
 ## HQ dictation
 
 Prompt dictation defaults to HQ. The phone owns the preference: **Fast mode

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.16.5",
-  "description": "COS Glasses — self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
+  "version": "6.17.0",
+  "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {
     "glasses-server": "bin/cli.cjs",

package/server/lib/archive.ts

@@ -14,6 +14,7 @@ import { mergeMediaAttachmentRefs, type MediaAttachmentRef } from '../../shared/
 import { secureExistingPrivateFile } from './secure-user-config.js'
 
 import type { Exchange } from './conversation.js'
+import { resolveExchangePairModel } from './conversation.js'
 
 import { dataPath } from './data-dir.js'
 const ARCHIVE_DIR = dataPath('archive')
@@ -435,11 +436,11 @@ export function getArchiveChatMessages(
  *  (sessionId, timestamp) instead of bare timestamp (collision-prone). */
 export function getArchiveDayMessages(
   date: string,
-): Array<{ query: string; text: string; timestamp: number; chatIndex: number; sessionId: string; no?: number; attachments?: MediaAttachmentRef[] }> {
+): Array<{ query: string; text: string; timestamp: number; chatIndex: number; sessionId: string; no?: number; globalMsgNum?: number; messageEra?: string; modelPreference?: string; attachments?: MediaAttachmentRef[] }> {
   const archive = loadArchive(date)
   if (!archive) return []
 
-  const messages: Array<{ query: string; text: string; timestamp: number; chatIndex: number; sessionId: string; no?: number; attachments?: MediaAttachmentRef[] }> = []
+  const messages: Array<{ query: string; text: string; timestamp: number; chatIndex: number; sessionId: string; no?: number; globalMsgNum?: number; messageEra?: string; modelPreference?: string; attachments?: MediaAttachmentRef[] }> = []
   for (const chat of archive.chats) {
     for (let i = 0; i < chat.exchanges.length; i++) {
       const ex = chat.exchanges[i]
@@ -447,13 +448,18 @@ export function getArchiveDayMessages(
         const next = chat.exchanges[i + 1]
         if (next && next.role === 'assistant') {
           const attachments = mergeMediaAttachmentRefs(ex.attachments, next.attachments)
+          const globalMsgNum = ex.globalMsgNum ?? next.globalMsgNum
+          const messageEra = ex.messageEra ?? next.messageEra
+          const modelPreference = resolveExchangePairModel(ex, next, null)
           messages.push({
             query: ex.content,
             text: next.content,
             timestamp: next.timestamp,
             chatIndex: chat.id,
             sessionId: chat.sessionId,
-            ...((ex.globalMsgNum ?? next.globalMsgNum) != null ? { no: ex.globalMsgNum ?? next.globalMsgNum } : {}),
+            ...(globalMsgNum != null ? { no: globalMsgNum, globalMsgNum } : {}),
+            ...(messageEra ? { messageEra } : {}),
+            ...(modelPreference ? { modelPreference } : {}),
             ...(attachments.length > 0 ? { attachments } : {}),
           })
           i++

package/server/lib/claude-bridge.ts

@@ -484,6 +484,7 @@ export async function callClaudeStreaming(
     globalMsgNum,
     undefined,
     exchangeProvenance,
+    resolvedModel,
   )
 
   // Vision queries need the Read tool to see the image files
@@ -646,6 +647,7 @@ export async function callClaudeStreaming(
       globalMsgNum,
       undefined,
       exchangeProvenance,
+      resolvedModel,
     )
     if (imagePaths.length > 0) {
       replaceLastExchangeWithSummary(sid, query, text, imagePaths.length)

package/server/lib/codex-bridge.ts

@@ -331,6 +331,7 @@ export async function callCodexStreaming(
     globalMsgNum,
     undefined,
     exchangeProvenance,
+    model,
   )
 
   let fullQuery: string
@@ -483,6 +484,7 @@ export async function callCodexStreaming(
       globalMsgNum,
       undefined,
       exchangeProvenance,
+      model,
     )
     if (imagePaths.length > 0) {
       replaceLastExchangeWithSummary(sid, query, text, imagePaths.length)

package/server/lib/conversation.ts

@@ -15,6 +15,7 @@ import { localDay } from './local-day.js'
 import { normalizeModelPreference, type ModelPreference } from '../../shared/model-preference.js'
 import { parseMediaAttachmentRefs, type MediaAttachmentRef } from '../../shared/media-attachment.js'
 import { secureExistingPrivateFile } from './secure-user-config.js'
+import { currentMessageEra } from './message-era.js'
 
 export type { ModelPreference }
 
@@ -26,6 +27,11 @@ export interface Exchange {
   /** Durable query provenance. Legacy exchanges omit both fields. */
   clientJobId?: string
   generation?: number
+  /** Short-number namespace. Missing means the original legacy era. */
+  messageEra?: string
+  /** Per-exchange model badge. Prefer this over session.modelPreference when
+   * rendering history so Cursor/Codex turns do not inherit an Opus default. */
+  modelPreference?: ModelPreference
   /** Public attachment refs may live on either half of a Q&A pair: request
    * photos on the user exchange, model-published images on the assistant
    * exchange. Bytes, filesystem paths, and capabilities never persist here. */
@@ -144,6 +150,9 @@ function loadFromDisk(): void {
     // the surrounding exchange or the rest of the recovered session.
     for (const exchange of session.exchanges) {
       validateLoadedExchangeProvenance(exchange)
+      const exchangeModel = normalizeModelPreference(exchange.modelPreference)
+      if (exchangeModel) exchange.modelPreference = exchangeModel
+      else delete exchange.modelPreference
       if ('attachments' in exchange && exchange.attachments !== undefined) {
         const refs = parseMediaAttachmentRefs(exchange.attachments)
         if (refs.length > 0) exchange.attachments = refs
@@ -403,6 +412,7 @@ export function addExchange(
   globalMsgNum?: number,
   attachments?: MediaAttachmentRef[],
   provenance?: ExchangeJobProvenance,
+  modelPreference?: ModelPreference | null,
 ): Exchange {
   let session = sessions.get(sessionId)
   if (!session) {
@@ -410,12 +420,15 @@ export function addExchange(
     sessions.set(sessionId, session)
   }
 
+  const stampedModel = normalizeModelPreference(modelPreference)
   const exchange: Exchange = {
     role,
     content,
     timestamp: Date.now(),
     globalMsgNum,
+    messageEra: currentMessageEra(),
     ...normalizedExchangeProvenance(provenance),
+    ...(stampedModel ? { modelPreference: stampedModel } : {}),
     ...(attachments && attachments.length > 0 ? { attachments } : {}),
   }
   session.exchanges.push(exchange)
@@ -512,6 +525,8 @@ export function reconcileExchangeByJobIdentity(
   content: string,
   globalMsgNum?: number,
   attachments?: MediaAttachmentRef[],
+  messageEra?: string,
+  modelPreference?: ModelPreference | null,
 ): ReconciledExchange {
   if (!validClientJobId(identity.clientJobId) || !validGeneration(identity.generation)) {
     throw new Error('conversation: invalid durable job identity')
@@ -538,6 +553,11 @@ export function reconcileExchangeByJobIdentity(
   }
 
   const validatedAttachments = parseMediaAttachmentRefs(attachments)
+  const projectedMessageEra = typeof messageEra === 'string'
+    && /^[a-z0-9][a-z0-9._-]{0,79}$/i.test(messageEra)
+    ? messageEra
+    : currentMessageEra()
+  const stampedModel = normalizeModelPreference(modelPreference)
   let exchange: Exchange
   const created = matchingIndexes.length === 0
   if (created) {
@@ -546,8 +566,10 @@ export function reconcileExchangeByJobIdentity(
       content,
       timestamp: Date.now(),
       globalMsgNum,
+      messageEra: projectedMessageEra,
       clientJobId: identity.clientJobId,
       generation: identity.generation,
+      ...(stampedModel ? { modelPreference: stampedModel } : {}),
       ...(validatedAttachments.length > 0 ? { attachments: validatedAttachments } : {}),
     }
     session.exchanges.push(exchange)
@@ -555,6 +577,8 @@ export function reconcileExchangeByJobIdentity(
     exchange = session.exchanges[matchingIndexes[0]]
     exchange.content = content
     exchange.globalMsgNum = globalMsgNum
+    exchange.messageEra = projectedMessageEra
+    if (stampedModel) exchange.modelPreference = stampedModel
     if (validatedAttachments.length > 0) exchange.attachments = validatedAttachments
     else delete exchange.attachments
 
@@ -617,6 +641,20 @@ export function getSessionModel(sessionId: string): ModelPreference | null {
   return sessions.get(sessionId)?.modelPreference ?? null
 }
 
+/** Prefer per-exchange stamps; fall back to session model for pre-stamp rows. */
+export function resolveExchangePairModel(
+  user: Pick<Exchange, 'modelPreference'> | undefined,
+  assistant: Pick<Exchange, 'modelPreference'> | undefined,
+  sessionModel: ModelPreference | null | undefined,
+): ModelPreference | undefined {
+  return normalizeModelPreference(
+    assistant?.modelPreference
+      ?? user?.modelPreference
+      ?? sessionModel
+      ?? undefined,
+  )
+}
+
 export function setSessionModel(sessionId: string, model: ModelPreference | null): void {
   const session = sessions.get(sessionId)
   if (session) {

package/server/lib/cursor-bridge.ts

@@ -310,9 +310,10 @@ export async function callCursorStreaming(
   const pendingUserExchange = durableIdentity
     ? reconcileExchangeByJobIdentity(
       sid, durableIdentity, 'user', historyQuery, globalMsgNum, inboundAttachments,
+      undefined, model,
     ).exchange
     : addExchange(
-      sid, 'user', historyQuery, globalMsgNum, inboundAttachments, durableIdentity,
+      sid, 'user', historyQuery, globalMsgNum, inboundAttachments, durableIdentity, model,
     )
 
   let fullQuery = query
@@ -446,8 +447,10 @@ export async function callCursorStreaming(
     }
 
     const assistantExchange = durableIdentity
-      ? reconcileExchangeByJobIdentity(sid, durableIdentity, 'assistant', text, globalMsgNum).exchange
-      : addExchange(sid, 'assistant', text, globalMsgNum, undefined, durableIdentity)
+      ? reconcileExchangeByJobIdentity(
+        sid, durableIdentity, 'assistant', text, globalMsgNum, undefined, undefined, model,
+      ).exchange
+      : addExchange(sid, 'assistant', text, globalMsgNum, undefined, durableIdentity, model)
     if (imagePaths.length > 0) {
       replaceLastExchangeWithSummary(sid, query, text, imagePaths.length)
     }

package/server/lib/message-era.ts

@@ -0,0 +1,94 @@
+// Message-number eras let Miles start again at #1 without deleting history.
+// Old sessions/day archives remain immutable and browseable; the current era
+// alone owns short voice references such as "reference message 4".
+//
+// Public package stores state under ~/.cos-glasses/data (dataPath), matching
+// sessions/archive — never a package-relative path that vanishes on npx upgrade.
+//
+// Disk is authoritative across processes: reset-message-era.ts writes the file
+// in a one-shot CLI; the long-lived server re-reads when mtime changes so a
+// reset is visible without relying solely on an in-process cache flush.
+
+import { statSync } from 'node:fs'
+import { atomicWriteFileSync, loadJsonOrQuarantine } from './atomic-fs.js'
+import { dataPath } from './data-dir.js'
+
+export const LEGACY_MESSAGE_ERA = 'legacy'
+
+export interface MessageEraState {
+  v: 1
+  era: string
+  startedAt: number
+}
+
+const MESSAGE_ERA_FILE = dataPath('message-era.json')
+
+let cached: MessageEraState | null = null
+let cachedMtimeMs = Number.NaN
+
+function fileMtimeMs(): number {
+  try {
+    return statSync(MESSAGE_ERA_FILE).mtimeMs
+  } catch {
+    return Number.NaN
+  }
+}
+
+function validState(value: unknown): value is MessageEraState {
+  if (!value || typeof value !== 'object') return false
+  const raw = value as Partial<MessageEraState>
+  return raw.v === 1
+    && typeof raw.era === 'string'
+    && /^[a-z0-9][a-z0-9._-]{0,79}$/i.test(raw.era)
+    && typeof raw.startedAt === 'number'
+    && Number.isFinite(raw.startedAt)
+    && raw.startedAt >= 0
+}
+
+export function currentMessageEraState(): MessageEraState {
+  const mtimeMs = fileMtimeMs()
+  if (cached && Object.is(mtimeMs, cachedMtimeMs)) return cached
+
+  const loaded = loadJsonOrQuarantine<unknown>(MESSAGE_ERA_FILE)
+  if (loaded.status === 'ok' && validState(loaded.data)) {
+    cached = loaded.data
+    cachedMtimeMs = mtimeMs
+    return cached
+  }
+  cached = { v: 1, era: LEGACY_MESSAGE_ERA, startedAt: 0 }
+  cachedMtimeMs = mtimeMs
+  return cached
+}
+
+export function currentMessageEra(): string {
+  return currentMessageEraState().era
+}
+
+export function exchangeBelongsToEra(
+  exchange: { messageEra?: unknown },
+  era = currentMessageEra(),
+): boolean {
+  if (era === LEGACY_MESSAGE_ERA) {
+    return exchange.messageEra == null || exchange.messageEra === LEGACY_MESSAGE_ERA
+  }
+  return exchange.messageEra === era
+}
+
+export function createMessageEra(now = Date.now()): MessageEraState {
+  const stamp = new Date(now).toISOString().replace(/[-:.TZ]/g, '').slice(0, 14)
+  const next: MessageEraState = {
+    v: 1,
+    era: `era-${stamp}`,
+    startedAt: now,
+  }
+  atomicWriteFileSync(MESSAGE_ERA_FILE, JSON.stringify(next, null, 2), { mode: 0o600 })
+  cached = next
+  cachedMtimeMs = fileMtimeMs()
+  return next
+}
+
+/** Test/helper: drop in-memory cache so the next read hits disk. */
+export function __resetMessageEraCacheForTests(): void {
+  cached = null
+  cachedMtimeMs = Number.NaN
+}

package/server/lib/profile.ts

@@ -1,16 +1,38 @@
 // Profile loader — reads user identity from .cos-profile.json (gitignored)
 // Falls back to generic defaults for users who haven't configured a profile
 
-import { readFileSync } from 'node:fs'
+import { existsSync, readFileSync } from 'node:fs'
+import { homedir } from 'node:os'
 import { resolve } from 'node:path'
 import { atomicWriteFileSync } from './atomic-fs.js'
 
 const APP_ROOT = resolve(import.meta.dirname, '../..')
+
+/** The profile in the data home. Survives updates; the APP_ROOT copy does not. */
+export function homeProfilePath(): string {
+  return resolve(homedir(), '.cos-glasses', '.cos-profile.json')
+}
+
 // Single canonical path — used by BOTH the reader and the writer so a glossary
 // PUT can never write to a different file than the cache reads from. Lazy +
 // env-overridable (COS_PROFILE_PATH) so tests can target a temp file.
+//
+// APP_ROOT is the INSTALLED PACKAGE root. For a managed install that is inside
+// the generation directory, which an update replaces wholesale — so a profile
+// there is destroyed on every upgrade, and a fresh managed install has no
+// profile at all (loadProfile() catches to {} and every field silently takes
+// its default). Relying on COS_PROFILE_PATH alone is not enough either: the
+// launcher rebuilds its environment from the release manifest rather than the
+// existing plist, so an operator-set value is dropped by the next
+// install/update/repair. Prefer the data home whenever a profile lives there.
+//
+// Order: explicit override → ~/.cos-glasses/.cos-profile.json → package root.
 function profilePath(): string {
-  return process.env.COS_PROFILE_PATH || resolve(APP_ROOT, '.cos-profile.json')
+  const override = process.env.COS_PROFILE_PATH?.trim()
+  if (override) return resolve(override)
+  const home = homeProfilePath()
+  if (existsSync(home)) return home
+  return resolve(APP_ROOT, '.cos-profile.json')
 }
 
 let profileCache: Record<string, unknown> | null = null

package/server/lib/prompt-draft-store.ts

@@ -24,6 +24,13 @@ export interface PromptDraftTranscriptRecord {
   acceptedDegraded?: boolean
 }
 
+/** Higher wins. Fast warm must never replace an HQ/cloud decode for the same audio. */
+export function transcriptQualityRank(quality: PromptDraftTranscriptRecord['actualQuality']): number {
+  if (quality === 'hq') return 3
+  if (quality === 'cloud') return 2
+  return 1
+}
+
 export interface PromptDraftMeta {
   v: 2
   draftId: string
@@ -224,10 +231,39 @@ export async function markPromptDraftChunkTranscript(
       ? { text: record, hash: meta.chunkHashes[key] ?? '', requestedMode: 'hq', actualQuality: 'fast', backend: 'legacy', degraded: true }
       : record
     if (meta.chunkHashes[key] && normalized.hash && meta.chunkHashes[key] !== normalized.hash) return meta
-    if (purpose === 'final') meta.finalTranscripts[key] = normalized
-    else meta.warmTranscripts[key] = normalized
+
+    if (purpose === 'final') {
+      const existingFinal = meta.finalTranscripts[key]
+      // Final is authoritative for its mode, but never downgrade a better decode
+      // of the same audio (late Fast warm finishing after HQ finalize).
+      if (
+        existingFinal
+        && existingFinal.hash === normalized.hash
+        && transcriptQualityRank(existingFinal.actualQuality) > transcriptQualityRank(normalized.actualQuality)
+      ) {
+        return meta
+      }
+      meta.finalTranscripts[key] = normalized
+    } else {
+      const existingWarm = meta.warmTranscripts[key]
+      // Speculative HQ and Fast warm share warmTranscripts[chunk]. Whichever
+      // finishes last used to win — a slow Fast warm could clobber HQ and make
+      // the next reader (or a racy finalize) prefer turbo text.
+      if (
+        existingWarm
+        && existingWarm.hash === normalized.hash
+        && transcriptQualityRank(existingWarm.actualQuality) > transcriptQualityRank(normalized.actualQuality)
+      ) {
+        return meta
+      }
+      meta.warmTranscripts[key] = normalized
+    }
+
     if (!meta.chunkTranscripts) meta.chunkTranscripts = {}
-    meta.chunkTranscripts[key] = normalized.text
+    const published = meta.finalTranscripts[key] ?? meta.warmTranscripts[key]
+    if (published && published.hash === (meta.chunkHashes[key] ?? published.hash)) {
+      meta.chunkTranscripts[key] = published.text
+    }
     return writeMeta(touchMeta(meta))
   })
 }

package/server/lib/query-job-runtime.ts

@@ -5,6 +5,7 @@ import { emitDisplay } from './display-bus.js'
 import { resolveQueryAttachments } from './query-attachments.js'
 import { getMediaStore } from './media-store.js'
 import { dataPath } from './data-dir.js'
+import { currentMessageEra, LEGACY_MESSAGE_ERA } from './message-era.js'
 import { durableQueryJobsEnabled } from './query-job-feature.js'
 import { QueryJobCoordinator, type QueryJobRunner } from './query-job-coordinator.js'
 import { QueryJobStore } from './query-job-store.js'
@@ -36,17 +37,42 @@ const TOOL_STATUS_MESSAGES: Record<string, string> = {
   Read: 'Analyzing photo...',
 }
 
+export class QueryJobAdmissionPreparationError extends Error {
+  constructor(readonly status: number, readonly code: string, message: string) {
+    super(message)
+    this.name = 'QueryJobAdmissionPreparationError'
+  }
+}
+
 /** Resolve image bytes/ids before returning 202. The journal receives only
  * validated refs and ids; base64 bytes and provider-local paths are dropped by
- * the strict QueryJobRequest parser before persistence. */
+ * the strict QueryJobRequest parser before persistence. Once a reset era
+ * exists, reject pre-era clients before they stamp five-digit numbers into
+ * the fresh namespace. */
 export async function preparePublicDurableQueryAdmission(raw: unknown): Promise<unknown> {
   if (!raw || typeof raw !== 'object') return raw
   const input = raw as Record<string, unknown>
-  const resolved = await resolveQueryAttachments(input)
-  return {
-    ...input,
-    attachmentIds: resolved.ids,
-    attachmentRefs: resolved.refs,
+  const activeEra = currentMessageEra()
+  if (activeEra !== LEGACY_MESSAGE_ERA && input.messageEra !== activeEra) {
+    throw new QueryJobAdmissionPreparationError(
+      409,
+      'message_era_mismatch',
+      'Reopen or update COS Glasses to start the fresh message list.',
+    )
+  }
+  try {
+    const resolved = await resolveQueryAttachments(input)
+    return {
+      ...input,
+      messageEra: activeEra,
+      attachmentIds: resolved.ids,
+      attachmentRefs: resolved.refs,
+    }
+  } catch (error: any) {
+    if (Number.isInteger(error?.status) && typeof error?.code === 'string') {
+      throw new QueryJobAdmissionPreparationError(error.status, error.code, error.message)
+    }
+    throw error
   }
 }
 
@@ -87,6 +113,8 @@ async function projectPublicConversationTerminal(
     userContent,
     request.globalMsgNum,
     request.attachmentRefs,
+    request.messageEra,
+    request.model,
   )
   reconcileExchangeByJobIdentity(
     request.sessionId,
@@ -95,6 +123,8 @@ async function projectPublicConversationTerminal(
     job.response ?? job.partialText,
     request.globalMsgNum,
     mergeMediaAttachmentRefs(outputAttachments, existingOutputAttachments),
+    request.messageEra,
+    request.model,
   )
   flushConversationToDisk()
 }