@gotcos/glasses-server 6.18.8 → 6.19.0

package/.env.example

@@ -139,6 +139,17 @@ BIND_HOST=0.0.0.0
 # keeps working if the default ever flips to Metal-on.
 # COS_BATCH_HQ_FORCE_CPU=1
 
+# ── UNSAVED-CAPTURE QUARANTINE (6.19.0) ─────────────────────────────────
+# Meeting audio whose save never landed is QUARANTINED, never deleted. It
+# surfaces on /api/health (unsaved_captures) and, with COS Control 0.3.1+,
+# as an "Unsaved captures" row in the status card. One authenticated call
+# recovers a capture into a durable meeting scribe:
+#   curl -X POST -H "x-cos-token: $COS_API_TOKEN" \
+#     http://127.0.0.1:3141/api/meeting/orphans/<sessionId>/recover
+# Quarantined audio expires on this retention clock (hours, clamped 1-720).
+# 72 covers a long weekend away from the Mac.
+# COS_UNSAVED_AUDIO_RETENTION_HOURS=72
+
 # ── LIVE CUES (optional — requires the FULL COS PIPELINE above) ──────────
 # Live meeting coaching cues on the lens: transcript window -> Composer
 # planner -> Qdrant -> LightRAG -> Composer insight -> coaching_nudge.

package/CHANGELOG.md

@@ -1,3 +1,44 @@
+## 6.19.0
+
+Meeting audio is evidence. This release stops the server from ever deleting an
+unsaved capture, and makes batch status stop lying about finished work.
+
+- **Unsaved-capture quarantine (the 2026-08-01 data-loss fix).** The
+  session-audio purge (boot sweep + 60s interval + non-saved session close)
+  DELETED any directory not tracked in memory once the 4h idle retention
+  passed — an offline meeting whose deferred save never landed lost its
+  full-fidelity audio within a minute. Two real meetings were destroyed this
+  way on 2026-08-01; only speaker-enrollment fragments survived. Audio-bearing
+  directories are now MOVED to `data/unsaved-audio/` with a manifest, never
+  deleted in place. Empty directories are still cleaned. A failed quarantine
+  move leaves the source untouched. Quarantine expires on
+  `COS_UNSAVED_AUDIO_RETENTION_HOURS` (default 72, clamped 1–720) — the only
+  place quarantined audio is ever deleted.
+- **Unsaved captures are visible.** `/api/health` gains `unsaved_captures`
+  (count + compact items, same exposure level as `meeting_sync`). The
+  authenticated `GET /api/meeting/orphans` returns full detail.
+- **Miles-triggered recovery, surface-only by decision (2026-08-02).**
+  `POST /api/meeting/orphans/:sessionId/recover` batch-transcribes the
+  quarantined WAVs (same segment/enhance/Metal-preempt contract as HQ polish,
+  under a new `orphan_recovery` maintenance lease), writes a durable scribe,
+  and hands off to operations when the COS pipeline is configured. Idempotent
+  via the save-receipt short-circuit; the server never drives recovery on its
+  own, and audio stays in quarantine until the retention clock — a failed
+  recovery is retryable.
+- **Rejected HQ batches release their status.** A terminal batch outcome
+  (rejected quality, pipeline failure, accepted-but-unpersisted) now writes
+  `_batch_terminal.json` next to the retained WAVs. `meeting_sync` reports
+  those as `retained` — never as active work — so a rejected batch no longer
+  shows "HQ polish · N chunks" with `blocksRestart: true` for the 12h WAV
+  retention after the work already finished (observed on
+  meeting_1785695339502_mvqm0p, reason `repetitive-output`). A retry clears
+  the terminal record; live progress always wins. `meeting_sync.retained` is
+  additive — older consumers ignore it.
+- Deferred by design: the realtime-model fallback port (W3) ships in its own
+  release. The app-side module has diverged ~1,100 lines from this repo's
+  whisper path; transplanting it alongside the data-loss fix would couple the
+  release's safest change to its riskiest. No default flips either way.
+
 ## 6.18.8
 
 - **Prompt draft peeks for live ASR.** `POST /api/prompt-drafts/:draftId/peek`

package/README.md

@@ -123,6 +123,12 @@ range is the exact Tailscale/CGNAT allocation (`100.64.0.0/10`), not all of
   locally through a network interruption. Reconnecting reconciles the exact
   chunks already stored by the Mac, uploads only missing audio, and finalizes
   through an idempotent save receipt without duplicating the meeting.
+- Since 6.19.0, meeting audio whose save never lands is quarantined for 72 hours
+  (`COS_UNSAVED_AUDIO_RETENTION_HOURS`) instead of being cleaned up, surfaces on
+  `/api/health` as `unsaved_captures`, and can be recovered into a durable
+  meeting scribe with one authenticated call
+  (`POST /api/meeting/orphans/:sessionId/recover`; list via
+  `GET /api/meeting/orphans`).
 - Local whisper.cpp transcription (free and local-only by default). OpenAI
   Whisper fallback is optional and requires both the exact
   `COS_OPENAI_WHISPER_FALLBACK=1` opt-in and a configured key; a key alone never

package/managed-runtime-contract.json

@@ -21,6 +21,7 @@
     "COS_LIVE_CUES_AUTO",
     "COS_BATCH_HQ_METAL",
     "COS_BATCH_HQ_FORCE_CPU",
+    "COS_UNSAVED_AUDIO_RETENTION_HOURS",
     "COS_CLAUDE_TRUST_MODE",
     "COS_CODEX_SANDBOX",
     "COS_SCRIPTS_DIR"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.18.8",
+  "version": "6.19.0",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/lib/maintenance-lifecycle.ts

@@ -54,6 +54,14 @@ export type MaintenanceWorkKind =
   // budget must stay under COS Control's 90s drain timeout (main.swift:1853)
   // or every drain that catches a cue in flight hard-fails to Repair.
   | 'live_cue_pipeline'
+  // Miles-triggered recovery of a quarantined unsaved capture (6.19.0):
+  // batch-transcribes retained WAVs into a durable scribe. Held for the whole
+  // background run so an Update Server drain waits for it like any batch.
+  // Long runs are made visible: the active-recovery registry renders a
+  // meeting_sync row with blocksRestart so COS Control warns BEFORE
+  // committing a drain into a decode that outlives its 90s timeout
+  // (main.swift:1963 waitForRestartProof).
+  | 'orphan_recovery'
 
 export type MaintenanceWorkPhase = 'queued' | 'active'
 export type MaintenanceOperationScope = 'same_boot' | 'cross_boot'

package/server/lib/meeting-batch-progress.ts

@@ -5,9 +5,11 @@
 import { existsSync, readdirSync, readFileSync, statSync, writeFileSync, unlinkSync } from 'node:fs'
 import { basename, join } from 'node:path'
 import { dataPath } from './data-dir.js'
+import { listActiveRecoveries } from './unsaved-audio-quarantine.js'
 
 export const BATCH_PROGRESS_FILENAME = '_batch_progress.json'
 export const BATCH_PENDING_MARKER = '_batch_pending.marker'
+export const BATCH_TERMINAL_FILENAME = '_batch_terminal.json'
 
 export type MeetingBatchPhase =
   | 'queued'
@@ -44,6 +46,75 @@ export interface MeetingSyncSnapshot {
   label: string
   blocksRestart: boolean
   meetings: MeetingSyncMeeting[]
+  /** Batches that reached a terminal outcome but whose WAVs are deliberately
+   *  retained for retry (rejected quality, failed persist). Additive field —
+   *  older consumers ignore it. Never counts toward active/blocksRestart. */
+  retained: MeetingSyncRetainedMeeting[]
+}
+
+export type MeetingBatchOutcome = 'accepted' | 'rejected' | 'failed'
+
+export interface MeetingBatchTerminal {
+  schemaVersion: 1
+  meetingId: string
+  outcome: MeetingBatchOutcome
+  reason?: string
+  at: string
+}
+
+export interface MeetingSyncRetainedMeeting {
+  meetingId: string
+  outcome: MeetingBatchOutcome
+  reason: string | null
+  chunkFiles: number
+  at: string
+  label: string
+}
+
+/** Record the batch's terminal outcome next to its retained WAVs. Before this
+ *  file existed (≤6.18.8), a rejected batch's dir kept rendering as active
+ *  "HQ polish · N chunks" with blocksRestart:true for the full 12h retention —
+ *  the status conflated "work running" with "evidence retained". */
+export function writeMeetingBatchTerminal(
+  audioDir: string,
+  input: { outcome: MeetingBatchOutcome; reason?: string; meetingId?: string },
+): void {
+  const payload: MeetingBatchTerminal = {
+    schemaVersion: 1,
+    meetingId: input.meetingId ?? basename(audioDir),
+    outcome: input.outcome,
+    ...(input.reason ? { reason: input.reason } : {}),
+    at: new Date().toISOString(),
+  }
+  try {
+    writeFileSync(join(audioDir, BATCH_TERMINAL_FILENAME), `${JSON.stringify(payload)}\n`, {
+      encoding: 'utf8',
+      mode: 0o600,
+    })
+  } catch {
+    // Status only — never fail the pipeline for a status write.
+  }
+}
+
+/** A retry invalidates the previous terminal state. */
+export function clearMeetingBatchTerminal(audioDir: string): void {
+  const path = join(audioDir, BATCH_TERMINAL_FILENAME)
+  try {
+    if (existsSync(path)) unlinkSync(path)
+  } catch { /* ignore */ }
+}
+
+function readTerminalFile(dir: string): MeetingBatchTerminal | null {
+  const path = join(dir, BATCH_TERMINAL_FILENAME)
+  if (!existsSync(path)) return null
+  try {
+    const raw = JSON.parse(readFileSync(path, 'utf8')) as MeetingBatchTerminal
+    if (raw?.schemaVersion !== 1) return null
+    if (raw.outcome !== 'accepted' && raw.outcome !== 'rejected' && raw.outcome !== 'failed') return null
+    return raw
+  } catch {
+    return null
+  }
 }
 
 function pendingBatchRoot(): string {
@@ -111,6 +182,11 @@ export function clearMeetingBatchProgress(audioDir: string): void {
   } catch { /* ignore */ }
 }
 
+/** Public read for surfaces outside this module (orphan recovery progress). */
+export function readMeetingBatchProgress(dir: string): MeetingBatchProgress | null {
+  return readProgressFile(dir)
+}
+
 function readProgressFile(dir: string): MeetingBatchProgress | null {
   const path = join(dir, BATCH_PROGRESS_FILENAME)
   if (!existsSync(path)) return null
@@ -140,8 +216,9 @@ export function getMeetingSyncSnapshot(
   root: string = pendingBatchRoot(),
 ): MeetingSyncSnapshot {
   const meetings: MeetingSyncMeeting[] = []
+  const retained: MeetingSyncRetainedMeeting[] = []
   if (!existsSync(root)) {
-    return { active: false, percent: null, label: 'Idle', blocksRestart: false, meetings }
+    return { active: false, percent: null, label: 'Idle', blocksRestart: false, meetings, retained }
   }
 
   let dirs: string[] = []
@@ -154,7 +231,7 @@ export function getMeetingSyncSnapshot(
       }
     })
   } catch {
-    return { active: false, percent: null, label: 'Idle', blocksRestart: false, meetings }
+    return { active: false, percent: null, label: 'Idle', blocksRestart: false, meetings, retained }
   }
 
   for (const name of dirs) {
@@ -165,6 +242,47 @@ export function getMeetingSyncSnapshot(
       chunkFiles = readdirSync(dir).filter(f => f.endsWith('.wav')).length
     } catch { /* ignore */ }
 
+    // A terminal outcome ends the meeting's ACTIVE life. Its WAVs stay for
+    // retry, reported as retained — never as running work. The gate is
+    // progress==null ONLY: the pending marker is refreshed every segment and
+    // every 60s during the run, so it is always fresh the moment a terminal
+    // is written — gating on marker freshness left the phantom alive for the
+    // first 15 minutes, exactly the post-meeting Update Server window. A
+    // genuine retry clears the terminal first (runMeetingBatchPipeline) and
+    // immediately writes queued progress, so progress presence is the true
+    // live signal.
+    const terminal = readTerminalFile(dir)
+    if (terminal && progress == null) {
+      const reasonSuffix = terminal.reason ? `: ${terminal.reason}` : ''
+      retained.push({
+        meetingId: terminal.meetingId || name,
+        outcome: terminal.outcome,
+        reason: terminal.reason ?? null,
+        chunkFiles,
+        at: terminal.at,
+        label: `Retained (${terminal.outcome}${reasonSuffix}) · ${chunkFiles} chunk${chunkFiles === 1 ? '' : 's'}`,
+      })
+      continue
+    }
+
+    // Backfill: a dir with WAVs, no progress, no fresh marker, and NO terminal
+    // file is a batch that ended before 6.19.0 existed (or whose terminal
+    // write failed). Pre-6.19.0 semantics rendered these as phantom active
+    // work with blocksRestart for the rest of the 12h retention — and the
+    // first boot after an upgrade is exactly when the user watches COS
+    // Control. Classify them as retained with an honest unknown outcome.
+    if (progress == null && !markerFresh(dir) && chunkFiles > 0) {
+      retained.push({
+        meetingId: name,
+        outcome: 'failed',
+        reason: 'pre-terminal batch (ended before 6.19.0 or terminal write lost)',
+        chunkFiles,
+        at: new Date(0).toISOString(),
+        label: `Retained (unknown outcome) · ${chunkFiles} chunk${chunkFiles === 1 ? '' : 's'}`,
+      })
+      continue
+    }
+
     const active = markerFresh(dir) || progress != null
     if (!active && chunkFiles === 0) continue
 
@@ -198,8 +316,36 @@ export function getMeetingSyncSnapshot(
     meetings.push({ ...row, label: labelFor(row) })
   }
 
+  // Active orphan recoveries decode in the quarantine root, which this scan
+  // never visits — surface them as active rows or COS Control shows "Idle"
+  // with blocksRestart:false while a 20-90 minute decode holds the
+  // maintenance lease, and an Update Server drain walks blind into its 90s
+  // timeout and hard-fails to Repair. Same contract as meeting_batch_finalization.
+  for (const recovery of listActiveRecoveries()) {
+    const progress = readProgressFile(recovery.dirPath)
+    const percent = progress && progress.segmentsTotal > 0
+      ? clampPercent(progress.segmentsDone, progress.segmentsTotal)
+      : null
+    const row: Omit<MeetingSyncMeeting, 'label'> = {
+      meetingId: recovery.sessionId,
+      phase: progress?.phase ?? 'queued',
+      percent,
+      segmentsDone: progress && progress.segmentsTotal > 0 ? progress.segmentsDone : null,
+      segmentsTotal: progress && progress.segmentsTotal > 0 ? progress.segmentsTotal : null,
+      chunkFiles: progress?.chunkFiles ?? 0,
+      updatedAt: progress?.updatedAt ?? null,
+    }
+    meetings.push({
+      ...row,
+      label: `Recovering unsaved capture${percent != null ? ` ${percent}%` : ''} · do not update/restart`,
+    })
+  }
+
   if (meetings.length === 0) {
-    return { active: false, percent: null, label: 'Idle', blocksRestart: false, meetings }
+    const label = retained.length > 0
+      ? `Idle · ${retained.length} retained batch${retained.length === 1 ? '' : 'es'}`
+      : 'Idle'
+    return { active: false, percent: null, label, blocksRestart: false, meetings, retained }
   }
 
   const withPercent = meetings.filter(m => m.percent != null)
@@ -217,5 +363,6 @@ export function getMeetingSyncSnapshot(
     label,
     blocksRestart: true,
     meetings,
+    retained,
   }
 }

package/server/lib/meeting-batch-transcribe.ts

@@ -9,7 +9,9 @@ import { transcribeHighQuality, type WhisperWord } from './whisper-local.js'
 import { isMetalBatchPreempted } from './whisper-metal-gate.js'
 import {
   clearMeetingBatchProgress,
+  clearMeetingBatchTerminal,
   writeMeetingBatchProgress,
+  writeMeetingBatchTerminal,
 } from './meeting-batch-progress.js'
 import type { IndexedTranscriptChunk } from '../routes/transcribe-stream.js'
 import {
@@ -165,7 +167,7 @@ function mapWordsToSpeakers(
   })
 }
 
-async function transcribeSegments(
+export async function transcribeSegments(
   audioDir: string,
   segments: BatchSegment[],
   entries: IndexedTranscriptChunk[],
@@ -237,6 +239,16 @@ async function transcribeSegments(
 
 let batchQueueTail: Promise<void> = Promise.resolve()
 
+/** Chain arbitrary HQ-decoder work onto the same serialization tail the batch
+ *  pipeline uses. Orphan recovery MUST go through this: transcribeSegments has
+ *  no internal queue, so calling it directly would run a second (or third)
+ *  16-thread large-v3 decoder in parallel with a live post-meeting batch. */
+export function enqueueSerializedHqWork<T>(work: () => Promise<T>): Promise<T> {
+  const job = batchQueueTail.then(work)
+  batchQueueTail = job.then(() => undefined, () => undefined)
+  return job
+}
+
 /** Serialize 16-thread HQ decoders across meetings on a public user's Mac. */
 export function runMeetingBatchPipeline(
   audioDir: string,
@@ -246,6 +258,8 @@ export function runMeetingBatchPipeline(
   // Lease immediately, including time spent behind another HQ decoder. Without
   // this, the two-hour cleanup could delete a queued meeting before it starts.
   refreshPendingLease(audioDir)
+  // A retry invalidates any prior terminal outcome — live signals must win.
+  clearMeetingBatchTerminal(audioDir)
   writeMeetingBatchProgress(audioDir, {
     phase: 'queued',
     segmentsDone: 0,
@@ -278,7 +292,12 @@ async function runMeetingBatchPipelineNow(
       return { transcriptionQuality: 'streaming' }
     }
     const segments = segmentTranscriptChunks(entries)
-    if (segments.length === 0) return { transcriptionQuality: 'streaming' }
+    if (segments.length === 0) {
+      // Terminal too: WAVs exist but nothing is transcribable. Without this,
+      // the dir re-creates the exact phantom-active state W2 removes.
+      writeMeetingBatchTerminal(audioDir, { outcome: 'failed', reason: 'no_segments' })
+      return { transcriptionQuality: 'streaming' }
+    }
 
     writeMeetingBatchProgress(audioDir, {
       phase: 'hq_polish',
@@ -302,12 +321,20 @@ async function runMeetingBatchPipelineNow(
         + `${qualityReport.streamingWordCount} live words, `
         + `${(qualityReport.duplicateWordRatio * 100).toFixed(1)}% duplicate`,
       )
+      // Terminal: the batch RAN and lost. WAVs stay for retry, but status must
+      // stop reporting active work (pre-6.19.0 this looked like 12h of
+      // "HQ polish · N chunks" with blocksRestart:true after the work ended).
+      writeMeetingBatchTerminal(audioDir, { outcome: 'rejected', reason: qualityReport.reason })
       return { transcriptionQuality: 'streaming', qualityReport }
     }
 
     return { transcriptionQuality: 'batch', batchTranscript, batchSegments, qualityReport }
   } catch (error) {
     console.error(`[meeting-batch] Pipeline failed: ${error instanceof Error ? error.message : String(error)}`)
+    writeMeetingBatchTerminal(audioDir, {
+      outcome: 'failed',
+      reason: error instanceof Error ? error.message.slice(0, 200) : String(error).slice(0, 200),
+    })
     return { transcriptionQuality: 'streaming' }
   }
 }

package/server/lib/unsaved-audio-quarantine.ts

@@ -0,0 +1,314 @@
+// Quarantine for unsaved meeting audio.
+//
+// Until 6.19.0 the session-audio purge (boot sweep + 60s interval) DELETED any
+// session-audio directory that was not in the in-memory sessions map and did
+// not carry a fresh save-preserved marker. An offline meeting whose deferred
+// save never landed therefore lost its full-fidelity audio within a minute of
+// the server no longer tracking the session — two real meetings were destroyed
+// this way on 2026-08-01. The only surviving fragments were in ext-audio,
+// which is a speaker-enrollment store (unrecognized-speaker chunks, hard
+// capped), not meeting audio.
+//
+// The rule now: audio evidence is moved here, never deleted in place. A
+// quarantined capture is surfaced on /api/health (unsaved_captures) and can be
+// driven to a durable scribe via POST /api/meeting/orphans/:sessionId/recover.
+// Quarantine expires on a retention clock (default 72h) — long enough to
+// survive a weekend away from the Mac, bounded enough not to grow forever.
+
+import {
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs'
+import { basename, join, resolve } from 'node:path'
+import { dataPath } from './data-dir.js'
+
+export const QUARANTINE_MANIFEST = '_quarantine.json'
+export const RECOVERED_RECEIPT = '_recovered.json'
+const CHUNK_WAV_RE = /^chunk_\d{4}\.wav$/
+
+const DEFAULT_RETENTION_HOURS = 72
+const MIN_RETENTION_HOURS = 1
+const MAX_RETENTION_HOURS = 720
+
+export interface QuarantineManifest {
+  schemaVersion: 1
+  sessionId: string
+  quarantinedAt: string
+  reason: string
+  chunkFiles: number
+  bytes: number
+}
+
+export interface UnsavedCapture {
+  sessionId: string
+  dirName: string
+  quarantinedAt: string | null
+  ageHours: number | null
+  chunkFiles: number
+  bytes: number
+  reason: string | null
+  expiresAt: string | null
+  recovered: boolean
+}
+
+export function unsavedAudioRoot(): string {
+  return dataPath('unsaved-audio')
+}
+
+export function unsavedAudioRetentionMs(env: NodeJS.ProcessEnv = process.env): number {
+  // An EMPTY value means unset, not zero: Number('') === 0, which would clamp
+  // to the 1h minimum and silently collapse the 72h safety net — on the one
+  // knob whose failure mode is losing the audio this module exists to keep.
+  const rawText = (env.COS_UNSAVED_AUDIO_RETENTION_HOURS ?? '').trim()
+  if (rawText === '') return DEFAULT_RETENTION_HOURS * 60 * 60 * 1000
+  const raw = Number(rawText)
+  const hours = Number.isFinite(raw)
+    ? Math.min(MAX_RETENTION_HOURS, Math.max(MIN_RETENTION_HOURS, raw))
+    : DEFAULT_RETENTION_HOURS
+  return hours * 60 * 60 * 1000
+}
+
+export function countChunkWavs(dirPath: string): number {
+  try {
+    return readdirSync(dirPath).filter(name => CHUNK_WAV_RE.test(name)).length
+  } catch {
+    return 0
+  }
+}
+
+function dirBytes(dirPath: string): number {
+  let total = 0
+  try {
+    for (const name of readdirSync(dirPath)) {
+      try { total += statSync(join(dirPath, name)).size } catch { /* skip */ }
+    }
+  } catch { /* empty */ }
+  return total
+}
+
+/** Move one session-audio dir into quarantine instead of deleting it.
+ *  Returns the quarantine path, or null when the move could not be made
+ *  (in which case the SOURCE IS LEFT IN PLACE — never deleted on failure). */
+export function quarantineSessionAudio(
+  sourceDir: string,
+  reason: string,
+  root: string = unsavedAudioRoot(),
+): string | null {
+  const sessionId = basename(sourceDir)
+  try {
+    if (!existsSync(sourceDir)) return null
+    mkdirSync(root, { recursive: true, mode: 0o700 })
+    let target = resolve(root, sessionId)
+    if (existsSync(target)) target = resolve(root, `${sessionId}.${Date.now()}`)
+    renameSync(sourceDir, target)
+    const manifest: QuarantineManifest = {
+      schemaVersion: 1,
+      sessionId,
+      quarantinedAt: new Date().toISOString(),
+      reason,
+      chunkFiles: countChunkWavs(target),
+      bytes: dirBytes(target),
+    }
+    try {
+      writeFileSync(resolve(target, QUARANTINE_MANIFEST), `${JSON.stringify(manifest)}\n`, {
+        encoding: 'utf8',
+        mode: 0o600,
+      })
+    } catch { /* manifest is observability; the audio move already succeeded */ }
+    return target
+  } catch {
+    // Rename failed (cross-device, permissions, race). Leave the source alone —
+    // a skipped purge is recoverable, a deleted capture is not.
+    return null
+  }
+}
+
+export type OrphanSweepAction =
+  | { dir: string; action: 'kept_live' }
+  | { dir: string; action: 'kept_preserved' }
+  | { dir: string; action: 'quarantined'; target: string }
+  | { dir: string; action: 'quarantine_failed' }
+  | { dir: string; action: 'deleted_empty' }
+
+/** Shared sweep for the boot path and the 60s interval. A directory that
+ *  still holds chunk audio is quarantined; only chunk-less directories are
+ *  deleted. A failed quarantine move keeps the source in place. */
+export function sweepOrphanedSessionAudio(
+  sessionAudioRoot: string,
+  opts: {
+    isLive: (sessionId: string) => boolean
+    hasFreshPreservedMarker: (dirPath: string) => boolean
+    reason: string
+    quarantineRoot?: string
+  },
+): OrphanSweepAction[] {
+  const actions: OrphanSweepAction[] = []
+  let entries: string[] = []
+  try {
+    entries = readdirSync(sessionAudioRoot)
+  } catch {
+    return actions
+  }
+  for (const dir of entries) {
+    const dirPath = resolve(sessionAudioRoot, dir)
+    try {
+      if (!statSync(dirPath).isDirectory()) continue
+    } catch { continue }
+    if (opts.isLive(dir)) { actions.push({ dir, action: 'kept_live' }); continue }
+    if (opts.hasFreshPreservedMarker(dirPath)) { actions.push({ dir, action: 'kept_preserved' }); continue }
+    if (countChunkWavs(dirPath) > 0) {
+      const target = quarantineSessionAudio(dirPath, opts.reason, opts.quarantineRoot)
+      actions.push(target
+        ? { dir, action: 'quarantined', target }
+        : { dir, action: 'quarantine_failed' })
+      continue
+    }
+    try {
+      rmSync(dirPath, { recursive: true, force: true })
+      actions.push({ dir, action: 'deleted_empty' })
+    } catch { /* next sweep retries */ }
+  }
+  return actions
+}
+
+function readManifest(dirPath: string): QuarantineManifest | null {
+  try {
+    const raw = JSON.parse(readFileSync(resolve(dirPath, QUARANTINE_MANIFEST), 'utf8')) as QuarantineManifest
+    if (raw?.schemaVersion !== 1 || typeof raw.sessionId !== 'string') return null
+    return raw
+  } catch {
+    return null
+  }
+}
+
+function quarantinedAtMs(dirPath: string, manifest: QuarantineManifest | null): number | null {
+  if (manifest) {
+    const parsed = Date.parse(manifest.quarantinedAt)
+    if (Number.isFinite(parsed)) return parsed
+  }
+  try {
+    return statSync(dirPath).mtimeMs
+  } catch {
+    return null
+  }
+}
+
+/** Everything currently in quarantine, newest first. Recovered captures are
+ *  flagged (they linger until the retention clock clears them) so health can
+ *  exclude them from the actionable count. */
+export function listUnsavedCaptures(
+  root: string = unsavedAudioRoot(),
+  retentionMs: number = unsavedAudioRetentionMs(),
+): UnsavedCapture[] {
+  const captures: UnsavedCapture[] = []
+  let entries: string[] = []
+  try {
+    entries = readdirSync(root)
+  } catch {
+    return captures
+  }
+  for (const dir of entries) {
+    const dirPath = resolve(root, dir)
+    try {
+      if (!statSync(dirPath).isDirectory()) continue
+    } catch { continue }
+    const manifest = readManifest(dirPath)
+    const atMs = quarantinedAtMs(dirPath, manifest)
+    captures.push({
+      sessionId: manifest?.sessionId ?? dir.replace(/\.\d+$/, ''),
+      dirName: dir,
+      quarantinedAt: atMs != null ? new Date(atMs).toISOString() : null,
+      ageHours: atMs != null ? Math.round(((Date.now() - atMs) / 3_600_000) * 10) / 10 : null,
+      chunkFiles: manifest?.chunkFiles ?? countChunkWavs(dirPath),
+      bytes: manifest?.bytes ?? dirBytes(dirPath),
+      reason: manifest?.reason ?? null,
+      expiresAt: atMs != null ? new Date(atMs + retentionMs).toISOString() : null,
+      recovered: existsSync(resolve(dirPath, RECOVERED_RECEIPT)),
+    })
+  }
+  captures.sort((a, b) => (b.quarantinedAt ?? '').localeCompare(a.quarantinedAt ?? ''))
+  return captures
+}
+
+/** Retention: quarantined captures past the clock are removed. This is the
+ *  ONLY place quarantined audio is ever deleted. */
+export function purgeExpiredQuarantine(
+  root: string = unsavedAudioRoot(),
+  retentionMs: number = unsavedAudioRetentionMs(),
+): string[] {
+  const purged: string[] = []
+  for (const capture of listUnsavedCaptures(root, retentionMs)) {
+    // Never delete a directory a recovery is actively decoding — a capture
+    // sitting exactly at the retention boundary would otherwise lose its
+    // audio mid-run, in the module whose thesis is "never delete evidence".
+    if (isRecoveryActive(capture.dirName)) continue
+    const atMs = capture.quarantinedAt ? Date.parse(capture.quarantinedAt) : NaN
+    if (!Number.isFinite(atMs)) continue
+    if (Date.now() - atMs > retentionMs) {
+      try {
+        rmSync(resolve(root, capture.dirName), { recursive: true, force: true })
+        purged.push(capture.dirName)
+      } catch { /* next sweep retries */ }
+    }
+  }
+  return purged
+}
+
+/** Resolve the quarantine dir for a sessionId (exact dir or timestamp-suffixed). */
+export function findQuarantineDir(
+  sessionId: string,
+  root: string = unsavedAudioRoot(),
+): string | null {
+  const exact = resolve(root, sessionId)
+  if (existsSync(exact)) return exact
+  try {
+    for (const dir of readdirSync(root)) {
+      if (dir === sessionId || dir.startsWith(`${sessionId}.`)) {
+        const dirPath = resolve(root, dir)
+        if (statSync(dirPath).isDirectory()) return dirPath
+      }
+    }
+  } catch { /* fall through */ }
+  return null
+}
+
+// ── Active recovery registry ─────────────────────────────────────────────
+// In-memory, single-process (matches the sessions map's own scope). Two
+// consumers: purgeExpiredQuarantine skips dirs being recovered (a capture at
+// the retention boundary must not be deleted mid-decode), and meeting_sync
+// renders an active row so COS Control warns BEFORE committing an Update
+// Server drain into a 20-90 minute recovery it cannot see.
+
+const activeRecoveries = new Map<string, { sessionId: string; dirPath: string; startedAt: number }>()
+
+export function registerActiveRecovery(sessionId: string, dirPath: string): void {
+  activeRecoveries.set(basename(dirPath), { sessionId, dirPath, startedAt: Date.now() })
+}
+
+export function clearActiveRecovery(dirPath: string): void {
+  activeRecoveries.delete(basename(dirPath))
+}
+
+export function listActiveRecoveries(): Array<{ sessionId: string; dirPath: string; startedAt: number }> {
+  return [...activeRecoveries.values()]
+}
+
+export function isRecoveryActive(dirName: string): boolean {
+  return activeRecoveries.has(dirName)
+}
+
+export function markRecovered(dirPath: string, savedFilename: string): void {
+  try {
+    writeFileSync(
+      resolve(dirPath, RECOVERED_RECEIPT),
+      `${JSON.stringify({ schemaVersion: 1, recoveredAt: new Date().toISOString(), savedFilename })}\n`,
+      { encoding: 'utf8', mode: 0o600 },
+    )
+  } catch { /* receipt is best-effort; findBySessionId remains the true guard */ }
+}

package/server/routes/health.ts

@@ -38,6 +38,7 @@ import { maintenanceLifecycle } from '../lib/maintenance-lifecycle.js'
 import { getLocalTtsHealth, refreshLocalTtsHealth } from '../lib/tts-local.js'
 import { liveCuesCapability } from '../lib/live-cues-capability.js'
 import { getMeetingSyncSnapshot } from '../lib/meeting-batch-progress.js'
+import { listUnsavedCaptures } from '../lib/unsaved-audio-quarantine.js'
 
 export const healthRouter = Router()
 
@@ -261,6 +262,20 @@ healthRouter.get('/health', async (_req, res) => {
   const cursorSnapshot = getCursorModelCatalogSnapshot()
   const { agentBinary: _cursorAgentBinary, ...cursor_models } = cursorSnapshot
   const meeting_sync = getMeetingSyncSnapshot()
+  // Quarantined unsaved captures (6.19.0). Compact on this unauthenticated
+  // surface — same exposure level as meeting_sync's meetingIds. Full detail
+  // plus the recover action live on the authenticated /api/meeting/orphans.
+  const unsavedList = listUnsavedCaptures()
+  const unsaved_captures = {
+    count: unsavedList.filter(item => !item.recovered).length,
+    items: unsavedList.slice(0, 10).map(item => ({
+      sessionId: item.sessionId,
+      ageHours: item.ageHours,
+      chunkFiles: item.chunkFiles,
+      expiresAt: item.expiresAt,
+      recovered: item.recovered,
+    })),
+  }
   res.json({
     ...checks,
     server_version: managedServerVersion(),
@@ -276,6 +291,7 @@ healthRouter.get('/health', async (_req, res) => {
     codex_models,
     cursor_models,
     meeting_sync,
+    unsaved_captures,
     capabilities: {
       transcription: { ...transcription, hq: transcriptionHq },
       recovery,

package/server/routes/meeting.ts

@@ -2,7 +2,8 @@
 // the standalone public meeting store. The live transcript and chunk metadata
 // are durable before the session is closed; batch improvement runs afterward.
 
-import { rmSync } from 'node:fs'
+import { readdirSync, rmSync, statSync, unlinkSync } from 'node:fs'
+import { resolve } from 'node:path'
 import { Router } from 'express'
 import { emitDisplay } from '../lib/display-bus.js'
 import { cleanTranscriptLines } from '../lib/hallucination-filter.js'
@@ -17,7 +18,29 @@ import {
   persistBatchDecisionSidecar,
   replaceMeetingTranscriptAtomic,
 } from '../lib/meeting-batch-persistence.js'
-import { runMeetingBatchPipeline } from '../lib/meeting-batch-transcribe.js'
+import {
+  BATCH_PENDING_MARKER,
+  clearMeetingBatchProgress,
+  readMeetingBatchProgress,
+  writeMeetingBatchTerminal,
+} from '../lib/meeting-batch-progress.js'
+import {
+  enqueueSerializedHqWork,
+  runMeetingBatchPipeline,
+  segmentTranscriptChunks,
+  transcribeSegments,
+} from '../lib/meeting-batch-transcribe.js'
+import {
+  clearActiveRecovery,
+  findQuarantineDir,
+  listUnsavedCaptures,
+  markRecovered,
+  registerActiveRecovery,
+} from '../lib/unsaved-audio-quarantine.js'
+import {
+  clearSessionHallucinationState,
+  stripInlineHallucinations,
+} from '../lib/hallucination-filter.js'
 import {
   selectBatchTranscriptForPersistence,
   type BatchTranscription,
@@ -376,9 +399,255 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     }
   })
 
+  // ── Unsaved-capture recovery (6.19.0) ─────────────────────────────────
+  // Surface-only by decision (Miles, 2026-08-02): the server NEVER drives
+  // recovery on its own. It lists what the quarantine holds, and one
+  // authenticated POST drives one capture to a durable scribe.
+  const recoveringOrphans = new Set<string>()
+
+  router.get('/meeting/orphans', (_req, res) => {
+    res.set('Cache-Control', 'private, no-store')
+    const items = listUnsavedCaptures()
+    // In-flight recovery progress: transcribeSegments writes its progress file
+    // into the quarantine dir, invisible to meeting_sync (different root) —
+    // surface it here so a long recovery is not a black box.
+    const recoveringProgress: Record<string, { segmentsDone: number; segmentsTotal: number } | null> = {}
+    for (const id of recoveringOrphans) {
+      const dir = findQuarantineDir(id)
+      const progress = dir ? readMeetingBatchProgress(dir) : null
+      recoveringProgress[id] = progress
+        ? { segmentsDone: progress.segmentsDone, segmentsTotal: progress.segmentsTotal }
+        : null
+    }
+    res.json({
+      count: items.filter(item => !item.recovered).length,
+      recovering: [...recoveringOrphans],
+      recoveringProgress,
+      items,
+    })
+  })
+
+  router.post('/meeting/orphans/:sessionId/recover', (req, res) => {
+    const sessionId = String(req.params.sessionId ?? '')
+    if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) {
+      res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
+      return
+    }
+    const body = (req.body ?? {}) as Record<string, unknown>
+    if (body.title !== undefined && typeof body.title !== 'string') {
+      res.status(400).json({ error: 'Invalid title', reason: 'invalid_title' })
+      return
+    }
+    if (body.domain !== undefined && typeof body.domain !== 'string') {
+      res.status(400).json({ error: 'Invalid domain', reason: 'invalid_domain' })
+      return
+    }
+    // Idempotent: a capture that already reached a durable save replays its
+    // receipt — same contract as POST /meeting/save.
+    const alreadySaved = store.findBySessionId(sessionId)
+    if (alreadySaved) {
+      // Stamp the quarantine receipt too, or a saved-but-quarantined capture
+      // (e.g. save succeeded but the pending handoff failed, marker expired,
+      // sweep quarantined the leftovers — the meeting IS saved) counts as
+      // "unsaved" on health forever, a false alarm that trains the user to
+      // ignore the one channel built to report real losses.
+      const staleQuarantine = findQuarantineDir(sessionId)
+      if (staleQuarantine) markRecovered(staleQuarantine, alreadySaved.filename)
+      res.set('Cache-Control', 'private, no-store')
+      res.json({ accepted: false, alreadySaved: true, receipt: publicSaveResponse(alreadySaved, true) })
+      return
+    }
+    const quarantineDir = findQuarantineDir(sessionId)
+    if (!quarantineDir) {
+      res.status(404).json({ error: 'No quarantined audio for this session', reason: 'orphan_not_found' })
+      return
+    }
+    if (recoveringOrphans.has(sessionId)) {
+      res.status(409).json({ error: 'Recovery already in progress', reason: 'recovery_in_progress' })
+      return
+    }
+    const capture = synthesizeEntriesFromChunkWavs(quarantineDir)
+    const entries = capture.entries
+    if (entries.length === 0) {
+      res.status(422).json({ error: 'Quarantined directory holds no readable chunk audio', reason: 'no_chunk_audio' })
+      return
+    }
+
+    // Acquire BEFORE marking the session as recovering: if a drain gate makes
+    // acquire throw, nothing must linger in recoveringOrphans — a leaked entry
+    // would 409 every retry for the exact capture this route exists to save.
+    let lease: MaintenanceWorkLease
+    try {
+      lease = acquireMaintenanceWork('orphan_recovery', { phase: 'queued' })
+    } catch {
+      res.status(503).json({
+        error: 'Server is draining for maintenance — retry after the update completes',
+        reason: 'maintenance_drain',
+      })
+      return
+    }
+    recoveringOrphans.add(sessionId)
+    // Registry drives two protections: meeting_sync renders this as an active
+    // row (COS Control warns before an Update Server drain walks into a
+    // 20-90 min decode), and purgeExpiredQuarantine will not delete the dir
+    // mid-run even at the retention boundary.
+    registerActiveRecovery(sessionId, quarantineDir)
+    res.status(202).set('Cache-Control', 'private, no-store').json({
+      accepted: true,
+      sessionId,
+      chunkFiles: entries.length,
+      note: 'Recovery runs in the background behind the HQ decoder queue — expect minutes for a long meeting '
+        + '(watch recoveringProgress on GET /api/meeting/orphans). Speakers are labeled Unknown: no live ASR ever '
+        + 'ran for this capture. The capture leaves the unsaved count once its scribe is durable.',
+    })
+
+    const task = Promise.resolve().then(async () => {
+      lease.setPhase('active')
+      const startedAt = Date.now()
+      const segments = segmentTranscriptChunks(entries)
+      // transcribeSegments carries the batch contract (enhancement, Metal
+      // preemption discard + one CPU retry, overlap stripping) but NOT the
+      // decoder serialization — that lives in the queue tail. Chain onto it,
+      // or two back-to-back recoveries plus a live post-meeting batch would
+      // run parallel 16-thread large-v3 decoders on the user's Mac.
+      const results = await enqueueSerializedHqWork(
+        () => transcribeSegments(quarantineDir, segments, entries),
+      )
+      // Batch whisper over a dead session has no streaming baseline to
+      // compare against (evaluateBatchQuality needs one), but the inline
+      // hallucination filter needs none — run the same two-pass the boot
+      // session-recovery path uses: pass 1 builds the frequency blocklist
+      // across all segments, pass 2 strips with the final blocklist.
+      for (const item of results) {
+        if (item.text) stripInlineHallucinations(item.text, sessionId)
+      }
+      for (const item of results) {
+        if (item.text) item.text = stripInlineHallucinations(item.text, sessionId)
+      }
+      clearSessionHallucinationState(sessionId)
+      const transcript = cleanFinalTranscript(results.map(item => item.text).join(' '))
+      if (!transcript.trim()) {
+        throw new Error('recovery produced an empty transcript')
+      }
+      const recoveredChunks = results.map(item => ({
+        text: item.text,
+        speaker: 'Unknown',
+        elapsed: item.segment.startElapsed,
+        similarity: 0,
+        words: item.words,
+        canonical: true,
+      }))
+      const saved = store.save({
+        sessionId,
+        title: typeof body.title === 'string' && body.title.trim() ? body.title : undefined,
+        domain: typeof body.domain === 'string' && body.domain.trim() ? body.domain : undefined,
+        transcript,
+        startTime: capture.startTime,
+        durationMs: capture.durationMs,
+        chunks: recoveredChunks,
+        chunkEntries: recoveredChunks.map((chunk, position) => ({
+          chunkIndex: results[position]?.segment.startChunkIdx ?? position,
+          chunk,
+        })),
+        transferIntegrity: null,
+      })
+      markRecovered(quarantineDir, saved.filename)
+      console.log(
+        `[meeting/orphans] Recovered ${sessionId} → ${saved.filename} `
+        + `(${entries.length} chunks, ${Math.round((Date.now() - startedAt) / 1000)}s)`,
+      )
+      try {
+        emit({
+          type: 'recording_stop',
+          data: {
+            sessionId,
+            filename: saved.filename,
+            durationMin: saved.durationMin,
+            domain: saved.domain,
+          },
+        })
+      } catch { /* display is best-effort */ }
+      if (cosOpsPipelineConfigured()) {
+        await handoffMeetingToOperations(saved.filepath)
+      }
+    }).catch(error => {
+      // The quarantined audio is untouched on failure — retry stays possible
+      // until the retention clock clears it.
+      console.error(
+        `[meeting/orphans] Recovery failed for ${sessionId}: `
+        + `${error instanceof Error ? error.message : String(error)}`,
+      )
+    }).finally(() => {
+      // transcribeSegments wrote progress + a pending marker into the
+      // quarantine dir; the batch pipeline's own finally never runs here, so
+      // clean them up or the dir carries stale work files until retention.
+      try { clearMeetingBatchProgress(quarantineDir) } catch { /* best-effort */ }
+      try { unlinkSync(resolve(quarantineDir, BATCH_PENDING_MARKER)) } catch { /* best-effort */ }
+      clearActiveRecovery(quarantineDir)
+      recoveringOrphans.delete(sessionId)
+      lease.release()
+    })
+    scheduleBackground(task)
+  })
+
   return router
 }
 
+const CHUNK_WAV_NAME = /^chunk_(\d{4})\.wav$/
+const WAV_HEADER_BYTES = 44
+const PCM_BYTES_PER_MS = 32 // 16 kHz mono 16-bit
+
+interface RecoveredCapture {
+  entries: IndexedTranscriptChunk[]
+  /** Meeting start ≈ the earliest chunk's write time (chunk files keep their
+   *  original mtimes across renames — the pending-batch cleanup relies on the
+   *  same property). Falls back to now-minus-duration when mtimes are unusable. */
+  startTime: number
+  durationMs: number
+}
+
+/** Rebuild a chunk timeline for a dead session from its WAV files alone:
+ *  index from the filename, duration from PCM byte length, elapsed cumulative.
+ *  Text is empty — recovery exists precisely because no ASR ever ran. */
+function synthesizeEntriesFromChunkWavs(audioDir: string): RecoveredCapture {
+  const rows: Array<{ chunkIndex: number; durationMs: number; mtimeMs: number }> = []
+  try {
+    for (const name of readdirSync(audioDir)) {
+      const match = CHUNK_WAV_NAME.exec(name)
+      if (!match) continue
+      try {
+        const stats = statSync(resolve(audioDir, name))
+        rows.push({
+          chunkIndex: Number(match[1]),
+          durationMs: Math.max(0, Math.round((stats.size - WAV_HEADER_BYTES) / PCM_BYTES_PER_MS)),
+          mtimeMs: stats.mtimeMs,
+        })
+      } catch { /* unreadable chunk — skip */ }
+    }
+  } catch {
+    return { entries: [], startTime: Date.now(), durationMs: 0 }
+  }
+  rows.sort((a, b) => a.chunkIndex - b.chunkIndex)
+  let elapsed = 0
+  const entries = rows.map(row => {
+    const entry: IndexedTranscriptChunk = {
+      chunkIndex: row.chunkIndex,
+      chunk: { text: '', speaker: 'Unknown', elapsed, similarity: 0 },
+    }
+    elapsed += row.durationMs
+    return entry
+  })
+  const durationMs = elapsed
+  const earliestMtime = rows.reduce(
+    (minimum, row) => (Number.isFinite(row.mtimeMs) && row.mtimeMs > 0 ? Math.min(minimum, row.mtimeMs) : minimum),
+    Number.POSITIVE_INFINITY,
+  )
+  const startTime = Number.isFinite(earliestMtime) && earliestMtime !== Number.POSITIVE_INFINITY
+    ? Math.round(earliestMtime)
+    : Date.now() - durationMs
+  return { entries, startTime, durationMs }
+}
+
 async function finalizeBatch(options: {
   audioDir: string
   entries: IndexedTranscriptChunk[]
@@ -431,6 +700,16 @@ async function finalizeBatch(options: {
     rmSync(options.audioDir, { recursive: true, force: true })
   } else {
     console.warn('[meeting/save] Pending raw audio retained for bounded cleanup')
+    // The batch reached a terminal outcome but its WAVs stay behind. Record it
+    // so meeting_sync reports "retained", not perpetual active work. Rejected
+    // and pipeline-failed runs already wrote their terminal inside runBatch;
+    // this covers the accepted-but-not-fully-persisted case.
+    if (result.transcriptionQuality === 'batch') {
+      writeMeetingBatchTerminal(options.audioDir, {
+        outcome: 'accepted',
+        reason: transcriptApplied ? 'metadata_persist_failed' : 'transcript_apply_failed',
+      })
+    }
   }
 }
 

package/server/routes/transcribe-stream.ts

@@ -35,6 +35,12 @@ import {
   isVocabEchoOnly,
 } from '../lib/hallucination-filter.js'
 import { dataPath } from '../lib/data-dir.js'
+import {
+  countChunkWavs,
+  purgeExpiredQuarantine,
+  quarantineSessionAudio,
+  sweepOrphanedSessionAudio,
+} from '../lib/unsaved-audio-quarantine.js'
 import { durableAtomicWriteFileSync } from '../lib/atomic-fs.js'
 import {
   LOCAL_FIRST_MEETING_IDLE_RETENTION_MS,
@@ -612,16 +618,28 @@ function recoverSessions(): void {
         }
       } catch { /* skip corrupt files */ }
     }
-    // Remove orphaned session-audio dirs with no matching recovered session
+    // Orphaned session-audio dirs with no matching recovered session: audio
+    // evidence is QUARANTINED, never deleted (6.19.0 — two meetings were
+    // destroyed here on 2026-08-01 when their deferred saves never landed).
+    // Only chunk-less dirs are removed.
     try {
       if (existsSync(SESSION_AUDIO_DIR)) {
-        for (const dir of readdirSync(SESSION_AUDIO_DIR)) {
-          if (!recoveredIds.has(dir) && !hasFreshPreservedAudioMarker(resolve(SESSION_AUDIO_DIR, dir))) {
-            rmSync(resolve(SESSION_AUDIO_DIR, dir), { recursive: true, force: true })
-            console.log(`[session-recovery] Cleaned orphaned session-audio: ${dir}`)
+        const actions = sweepOrphanedSessionAudio(SESSION_AUDIO_DIR, {
+          isLive: id => recoveredIds.has(id),
+          hasFreshPreservedMarker: hasFreshPreservedAudioMarker,
+          reason: 'boot_sweep_unsaved',
+        })
+        for (const entry of actions) {
+          if (entry.action === 'quarantined') {
+            console.warn(`[session-recovery] Quarantined unsaved session-audio: ${entry.dir} → ${entry.target}`)
+          } else if (entry.action === 'deleted_empty') {
+            console.log(`[session-recovery] Cleaned empty session-audio: ${entry.dir}`)
+          } else if (entry.action === 'quarantine_failed') {
+            console.error(`[session-recovery] Quarantine move failed, source retained: ${entry.dir}`)
           }
         }
       }
+      purgeExpiredQuarantine()
     } catch {}
   } catch { /* non-critical */ }
 }
@@ -658,13 +676,24 @@ setInterval(() => {
       closeTranscriptSession(id, 'expired')
     }
   }
-  // Purge orphaned session-audio dirs (no matching active session)
+  // Orphaned session-audio dirs (no matching active session): quarantine any
+  // dir still holding chunk audio; delete only chunk-less dirs. Quarantine
+  // itself expires on the unsaved-audio retention clock, the ONLY place
+  // quarantined audio is ever deleted.
   try {
-    for (const dir of readdirSync(SESSION_AUDIO_DIR)) {
-      if (!sessions.has(dir) && !hasFreshPreservedAudioMarker(resolve(SESSION_AUDIO_DIR, dir))) {
-        rmSync(resolve(SESSION_AUDIO_DIR, dir), { recursive: true, force: true })
+    const actions = sweepOrphanedSessionAudio(SESSION_AUDIO_DIR, {
+      isLive: id => sessions.has(id),
+      hasFreshPreservedMarker: hasFreshPreservedAudioMarker,
+      reason: 'idle_expiry_unsaved',
+    })
+    for (const entry of actions) {
+      if (entry.action === 'quarantined') {
+        console.warn(`[cleanup] Quarantined unsaved session-audio: ${entry.dir} → ${entry.target}`)
+      } else if (entry.action === 'quarantine_failed') {
+        console.error(`[cleanup] Quarantine move failed, source retained: ${entry.dir}`)
       }
     }
+    purgeExpiredQuarantine()
   } catch {}
   // Purge stale pending-batch dirs. HQ large-v3 on long meetings + Control
   // restart can exceed 2h (2026-07-27: two sessions purged before batch).
@@ -1022,7 +1051,7 @@ function closeTranscriptSession(
     maxChunkIndex,
     reason,
   })
-  finishClosingTranscriptSession(sessionId, options)
+  finishClosingTranscriptSession(sessionId, { ...options, closeReason: reason })
 }
 
 /** Delete session after save */
@@ -1030,7 +1059,10 @@ export function deleteSession(sessionId: string, options: { preserveAudio?: bool
   closeTranscriptSession(sessionId, 'saved', options)
 }
 
-function finishClosingTranscriptSession(sessionId: string, options: { preserveAudio?: boolean }): void {
+function finishClosingTranscriptSession(
+  sessionId: string,
+  options: { preserveAudio?: boolean; closeReason?: ClosedTranscriptSession['reason'] },
+): void {
   sessions.delete(sessionId)
   sessionAudioBytes.delete(sessionId)
   sessionAudioWrites.delete(sessionId)
@@ -1049,8 +1081,28 @@ function finishClosingTranscriptSession(sessionId: string, options: { preserveAu
       writeFileSync(marker, String(Date.now()), { encoding: 'utf8', mode: 0o600 })
       chmodSync(marker, 0o600)
     } catch {}
-  } else {
-    try { rmSync(audioDir, { recursive: true, force: true }) } catch {}
+  } else if (options.closeReason === 'saved') {
+    // Saved sessions moved their audio to pending-batch (or explicitly
+    // preserved it above); a leftover dir here is residue, safe to delete.
+    // UNLESS chunks are still present — hasAudio() returns false on a
+    // transient statSync error, which makes preserveAudio false while the
+    // move never ran. Chunk-bearing evidence goes to quarantine, never rmSync.
+    if (countChunkWavs(audioDir) > 0) {
+      const target = quarantineSessionAudio(audioDir, 'close_saved_residual_chunks')
+      if (target) console.warn(`[transcribe-stream] Saved-close left chunk audio behind; quarantined: ${sessionId} → ${target}`)
+    } else {
+      try { rmSync(audioDir, { recursive: true, force: true }) } catch {}
+    }
+  } else if (existsSync(audioDir)) {
+    // Any non-saved close (expired, error, …) with chunk audio still on disk
+    // is an unsaved capture. Quarantine it — never delete evidence (6.19.0).
+    if (countChunkWavs(audioDir) > 0) {
+      const target = quarantineSessionAudio(audioDir, `close_${options.closeReason ?? 'unknown'}`)
+      if (target) console.warn(`[transcribe-stream] Quarantined unsaved session-audio on close: ${sessionId} → ${target}`)
+      else console.error(`[transcribe-stream] Quarantine move failed on close, source retained: ${sessionId}`)
+    } else {
+      try { rmSync(audioDir, { recursive: true, force: true }) } catch {}
+    }
   }
 }