@gotcos/glasses-server 6.18.8 → 6.20.0

package/.cos-profile.example.json

@@ -1,7 +1,7 @@
 {
-  "owner_name": "Your Name",
+  "owner_name": "User",
   "owner_speaker_label": "Me",
-  "vocabulary": ["NameOne", "NameTwo", "YourCompany", "ProductName"],
-  "whisper_corrections": "{\"Soundalike\": \"YourName\"}",
+  "vocabulary": [],
+  "whisper_corrections": "{}",
   "negative_rules": []
 }

package/.env.example

@@ -83,6 +83,13 @@ BIND_HOST=0.0.0.0
 # COS_HQ_SPECULATIVE_WARM=0        # disable background HQ warm
 # COS_BATCH_LARGE_V3=0             # explicitly use turbo instead of full HQ
 # COS_HQ_BEAM_INTERACTIVE=2        # interactive only; meetings stay at beam 5
+# Adaptive prompt transcription keeps three quality lanes separate:
+#   Small.en provisional preview -> Large-v3-Turbo committed live text -> Large-v3 HQ polish.
+# Unset preserves the pre-6.20 Turbo behavior. `auto` uses Small.en when it has
+# been provisioned, otherwise Turbo. Guided Setup writes small.en explicitly
+# and downloads its ~466 MB model. `off` hides provisional peeks without
+# changing committed transcription or meeting audio.
+# COS_WHISPER_PREVIEW_MODEL=auto    # auto | small.en | turbo | off
 
 # Spoken reply playback defaults to local Kokoro on Apple silicon Macs. The
 # first run creates a private venv and downloads the model. Local mode fails
@@ -139,6 +146,17 @@ BIND_HOST=0.0.0.0
 # keeps working if the default ever flips to Metal-on.
 # COS_BATCH_HQ_FORCE_CPU=1
 
+# ── UNSAVED-CAPTURE QUARANTINE (6.19.0) ─────────────────────────────────
+# Meeting audio whose save never landed is QUARANTINED, never deleted. It
+# surfaces on /api/health (unsaved_captures) and, with COS Control 0.3.1+,
+# as an "Unsaved captures" row in the status card. One authenticated call
+# recovers a capture into a durable meeting scribe:
+#   curl -X POST -H "x-cos-token: $COS_API_TOKEN" \
+#     http://127.0.0.1:3141/api/meeting/orphans/<sessionId>/recover
+# Quarantined audio expires on this retention clock (hours, clamped 1-720).
+# 72 covers a long weekend away from the Mac.
+# COS_UNSAVED_AUDIO_RETENTION_HOURS=72
+
 # ── LIVE CUES (optional — requires the FULL COS PIPELINE above) ──────────
 # Live meeting coaching cues on the lens: transcript window -> Composer
 # planner -> Qdrant -> LightRAG -> Composer insight -> coaching_nudge.

package/CHANGELOG.md

@@ -1,3 +1,81 @@
+## 6.20.0
+
+Adaptive transcription makes fast feedback additive instead of a quality
+trade-off. The preview lane can be fast without changing the transcript that is
+saved, searched, or sent.
+
+- **Three explicit local transcription lanes.** Prompt previews can run on a
+  dedicated Small.en sidecar, committed live text remains on
+  Large-v3-Turbo, and HQ polish remains on Large-v3. The existing phone
+  `provisional` contract is unchanged. A late or failed preview cannot replace
+  committed text or advance the recovery ledger.
+- **Safe adaptive fallback.** `COS_WHISPER_PREVIEW_MODEL` accepts `auto`,
+  `small.en`, `turbo`, or `off`. `auto` uses Small.en only when provisioned;
+  otherwise it preserves the prior Turbo behavior. A Small.en failure falls
+  back to the non-circuit Turbo path and cannot trip or success-reset the
+  authoritative Whisper breaker. The early private
+  `COS_WHISPER_REALTIME_MODEL` name remains a migration alias.
+- **No surprise on update.** An unset preview setting keeps the pre-6.20 Turbo
+  behavior. Guided Setup explicitly opts users into Small.en after provisioning
+  its weights.
+- **One setup command.** `--setup-transcription` records the adaptive choice
+  and provisions Small.en preview, Turbo commit, and Large-v3 HQ weights.
+  Pair with `--prepare-only` for COS Control so provisioning exits before the
+  managed LaunchAgent takes ownership.
+- **Truthful health.** `/api/health` and `/api/models` add path-free
+  `capabilities.transcription.live` and `.profile` blocks alongside the
+  existing `.hq` block. COS Control can report the effective preview, commit,
+  and HQ models independently.
+- **Factory vocabulary can no longer reduce accuracy.** The shipped profile is
+  empty and safe. Existing `Your Name`, `NameOne`, `NameTwo`, `YourCompany`,
+  `ProductName`, and `Soundalike -> YourName` examples are ignored everywhere
+  decoder bias or correction data is consumed. Startup warns once, and health
+  reports the ignored count. Real terms are trimmed and deduplicated.
+- **Correction keys are literal.** User correction keys are escaped before
+  regular-expression construction, so punctuation in names cannot alter the
+  matcher.
+
+## 6.19.0
+
+Meeting audio is evidence. This release stops the server from ever deleting an
+unsaved capture, and makes batch status stop lying about finished work.
+
+- **Unsaved-capture quarantine (the 2026-08-01 data-loss fix).** The
+  session-audio purge (boot sweep + 60s interval + non-saved session close)
+  DELETED any directory not tracked in memory once the 4h idle retention
+  passed — an offline meeting whose deferred save never landed lost its
+  full-fidelity audio within a minute. Two real meetings were destroyed this
+  way on 2026-08-01; only speaker-enrollment fragments survived. Audio-bearing
+  directories are now MOVED to `data/unsaved-audio/` with a manifest, never
+  deleted in place. Empty directories are still cleaned. A failed quarantine
+  move leaves the source untouched. Quarantine expires on
+  `COS_UNSAVED_AUDIO_RETENTION_HOURS` (default 72, clamped 1–720) — the only
+  place quarantined audio is ever deleted.
+- **Unsaved captures are visible.** `/api/health` gains `unsaved_captures`
+  (count + compact items, same exposure level as `meeting_sync`). The
+  authenticated `GET /api/meeting/orphans` returns full detail.
+- **Miles-triggered recovery, surface-only by decision (2026-08-02).**
+  `POST /api/meeting/orphans/:sessionId/recover` batch-transcribes the
+  quarantined WAVs (same segment/enhance/Metal-preempt contract as HQ polish,
+  under a new `orphan_recovery` maintenance lease), writes a durable scribe,
+  and hands off to operations when the COS pipeline is configured. Idempotent
+  via the save-receipt short-circuit; the server never drives recovery on its
+  own, and audio stays in quarantine until the retention clock — a failed
+  recovery is retryable.
+- **Rejected HQ batches release their status.** A terminal batch outcome
+  (rejected quality, pipeline failure, accepted-but-unpersisted) now writes
+  `_batch_terminal.json` next to the retained WAVs. `meeting_sync` reports
+  those as `retained` — never as active work — so a rejected batch no longer
+  shows "HQ polish · N chunks" with `blocksRestart: true` for the 12h WAV
+  retention after the work already finished (observed on
+  meeting_1785695339502_mvqm0p, reason `repetitive-output`). A retry clears
+  the terminal record; live progress always wins. `meeting_sync.retained` is
+  additive — older consumers ignore it.
+- Deferred by design: the realtime-model fallback port (W3) ships in its own
+  release. The app-side module has diverged ~1,100 lines from this repo's
+  whisper path; transplanting it alongside the data-loss fix would couple the
+  release's safest change to its riskiest. No default flips either way.
+
 ## 6.18.8
 
 - **Prompt draft peeks for live ASR.** `POST /api/prompt-drafts/:draftId/peek`

package/README.md

@@ -123,6 +123,12 @@ range is the exact Tailscale/CGNAT allocation (`100.64.0.0/10`), not all of
   locally through a network interruption. Reconnecting reconciles the exact
   chunks already stored by the Mac, uploads only missing audio, and finalizes
   through an idempotent save receipt without duplicating the meeting.
+- Since 6.19.0, meeting audio whose save never lands is quarantined for 72 hours
+  (`COS_UNSAVED_AUDIO_RETENTION_HOURS`) instead of being cleaned up, surfaces on
+  `/api/health` as `unsaved_captures`, and can be recovered into a durable
+  meeting scribe with one authenticated call
+  (`POST /api/meeting/orphans/:sessionId/recover`; list via
+  `GET /api/meeting/orphans`).
 - Local whisper.cpp transcription (free and local-only by default). OpenAI
   Whisper fallback is optional and requires both the exact
   `COS_OPENAI_WHISPER_FALLBACK=1` opt-in and a configured key; a key alone never
@@ -168,6 +174,9 @@ in the managed CLI working directory),
 server-owned query recovery), and `COS_MEDIA_ROOT` (optional image-store
 location; default `~/.cos-glasses/data/media`). Your name + transcription vocabulary live in
 `~/.cos-glasses/.cos-profile.json` (see `.cos-profile.example.json`).
+Factory example values are ignored; add the real names, companies, acronyms,
+and specialist terms you say often. Guided Setup writes a safe empty profile
+instead of biasing Whisper toward placeholder text.
 Telegram activity export is disabled by default even when a private COS
 pipeline contains `.telegram_config.json`; enable it only with the explicit
 `COS_TELEGRAM_NOTIFICATIONS=1` opt-in.
@@ -227,6 +236,20 @@ Prompt dictation defaults to HQ. The phone owns the preference: **Fast mode
 OFF** requests HQ, and **Fast mode ON** requests turbo. The Mac performs all
 decoding; the phone does not run Whisper.
 
+For the recommended adaptive setup, run:
+
+```bash
+npx --yes @gotcos/glasses-server@latest --setup-transcription
+```
+
+That keeps three jobs separate: Small.en supplies provisional words on the
+lens, Large-v3-Turbo commits the authoritative live transcript, and Large-v3
+polishes saved prompts and meetings. Small.en never writes the recovery ledger.
+If its sidecar is missing or unhealthy, preview falls back to Turbo without
+changing final quality. Set `COS_WHISPER_PREVIEW_MODEL=turbo` to keep one live
+model, or `off` to disable provisional peeks. Existing installs that only
+update the server remain on Turbo until Guided Setup opts them into Small.en.
+
 The first server start downloads the real-time turbo model. True HQ additionally
 requires the full `ggml-large-v3.bin` model (about 3.1 GB):
 

package/bin/cli.cjs

@@ -15,6 +15,8 @@ const {
   unlinkSync,
   renameSync,
   chmodSync,
+  writeFileSync,
+  statfsSync,
 } = require('fs')
 const { delimiter, join, resolve } = require('path')
 const { homedir } = require('os')
@@ -22,6 +24,8 @@ const { homedir } = require('os')
 // bin/cli.cjs -> package root is one level up. The server lives at <root>/server.
 const PKG_ROOT = resolve(__dirname, '..')
 const CONFIG_DIR = join(homedir(), '.cos-glasses')
+const PREPARE_ONLY = process.argv.includes('--prepare-only')
+const SETUP_TRANSCRIPTION = process.argv.includes('--setup-transcription')
 
 // Record where the user ran `npx @gotcos/glasses-server` from. The server spawns
 // with cwd = PKG_ROOT (the npx cache), so without this the user's Starter-Kit COS
@@ -41,6 +45,7 @@ if (process.argv.includes('--help') || process.argv.includes('-h')) {
   console.log('')
   console.log('  Usage:')
   console.log('    npx --yes @gotcos/glasses-server@latest')
+  console.log('    npx --yes @gotcos/glasses-server@latest --setup-transcription')
   console.log('    npx --yes @gotcos/glasses-server@latest --prepare-only')
   console.log('')
   console.log('  Requirements:')
@@ -261,7 +266,7 @@ try {
 // and the packaged runtime without creating COS config, downloading Kokoro
 // models, installing Kokoro packages, changing COS permissions, or starting a
 // listener. An invoked agent CLI may still maintain its own user cache.
-if (process.argv.includes('--prepare-only')) {
+if (PREPARE_ONLY && !SETUP_TRANSCRIPTION) {
   if (process.platform === 'darwin' && process.arch === 'arm64') {
     const python = compatibleKokoroPython()
     if (python) {
@@ -329,6 +334,31 @@ if (existsSync(ENV_FILE)) {
     }
   } catch { /* config is optional */ }
 }
+
+function upsertEnvValue(file, key, value) {
+  const current = existsSync(file) ? readFileSync(file, 'utf8') : ''
+  const lines = current.split(/\r?\n/)
+  const prefix = `${key}=`
+  let replaced = false
+  const next = lines.map((line) => {
+    if (line.trimStart().startsWith('#')) return line
+    if (!line.startsWith(prefix)) return line
+    replaced = true
+    return `${prefix}${value}`
+  })
+  if (!replaced) {
+    if (next.length && next.at(-1) !== '') next.push('')
+    next.push(`${prefix}${value}`)
+  }
+  writeFileSync(file, next.join('\n').replace(/\n*$/, '\n'), { mode: 0o600 })
+  chmodSync(file, 0o600)
+}
+
+if (SETUP_TRANSCRIPTION) {
+  upsertEnvValue(ENV_FILE, 'COS_WHISPER_PREVIEW_MODEL', 'small.en')
+  process.env.COS_WHISPER_PREVIEW_MODEL = 'small.en'
+  console.log(green('  ✓') + ' Adaptive transcription selected ' + dim('— Small.en preview · Turbo commit · Large-v3 HQ'))
+}
 // Persistent profile (identity + transcription vocabulary)
 const PROFILE_FILE = join(CONFIG_DIR, '.cos-profile.json')
 const PROFILE_EXAMPLE = join(PKG_ROOT, '.cos-profile.example.json')
@@ -349,11 +379,23 @@ if (!process.env.COS_PROFILE_PATH) process.env.COS_PROFILE_PATH = PROFILE_FILE
 // Step 5: local Whisper detection + model download. Voice stays local-only by
 // default; cloud fallback requires an explicit flag plus a configured key.
 const WHISPER_KNOWN_PATHS = ['/opt/homebrew/bin/whisper-cli', '/usr/local/bin/whisper-cli']
+const WHISPER_SERVER_KNOWN_PATHS = ['/opt/homebrew/bin/whisper-server', '/usr/local/bin/whisper-server']
 const WHISPER_MODEL_DIR = join(homedir(), '.local/share/whisper-models')
 const WHISPER_MODEL_PATH = join(WHISPER_MODEL_DIR, 'ggml-large-v3-turbo.bin')
 const WHISPER_MODEL_PARTIAL = WHISPER_MODEL_PATH + '.partial'
 const WHISPER_MODEL_URL = 'https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-large-v3-turbo.bin'
 const WHISPER_MODEL_MIN_BYTES = 800_000_000
+const WHISPER_SMALL_MODEL_PATH = join(WHISPER_MODEL_DIR, 'ggml-small.en.bin')
+const WHISPER_SMALL_MODEL_PARTIAL = WHISPER_SMALL_MODEL_PATH + '.partial'
+const WHISPER_SMALL_MODEL_URL = 'https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-small.en.bin'
+const WHISPER_SMALL_MODEL_MIN_BYTES = 400_000_000
+const WHISPER_LARGE_MODEL_PATH = join(WHISPER_MODEL_DIR, 'ggml-large-v3.bin')
+const WHISPER_LARGE_MODEL_PARTIAL = WHISPER_LARGE_MODEL_PATH + '.partial'
+const WHISPER_LARGE_MODEL_URL = 'https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-large-v3.bin'
+const WHISPER_LARGE_MODEL_MIN_BYTES = 2_800_000_000
+const WHISPER_MODEL_EXPECTED_BYTES = 1_620_000_000
+const WHISPER_SMALL_MODEL_EXPECTED_BYTES = 466_000_000
+const WHISPER_LARGE_MODEL_EXPECTED_BYTES = 3_100_000_000
 function findWhisperCli() {
   for (const p of WHISPER_KNOWN_PATHS) { if (existsSync(p)) return p }
   try {
@@ -363,12 +405,58 @@ function findWhisperCli() {
     return null
   }
 }
-function isValidWhisperModel(p) {
+function findWhisperServer() {
+  for (const p of WHISPER_SERVER_KNOWN_PATHS) { if (existsSync(p)) return p }
+  try {
+    const found = execSync('command -v whisper-server 2>/dev/null', { shell: '/bin/sh', stdio: 'pipe', timeout: 2000 }).toString().trim()
+    return found || null
+  } catch {
+    return null
+  }
+}
+function isValidWhisperModel(p, minBytes = WHISPER_MODEL_MIN_BYTES) {
   if (!existsSync(p)) return false
-  try { return statSync(p).size >= WHISPER_MODEL_MIN_BYTES } catch { return false }
+  try { return statSync(p).size >= minBytes } catch { return false }
 }
 const whisperCliPath = findWhisperCli()
+const whisperServerPath = findWhisperServer()
 const hasValidModel = isValidWhisperModel(WHISPER_MODEL_PATH)
+
+if (SETUP_TRANSCRIPTION && (!whisperCliPath || !whisperServerPath)) {
+  console.log('')
+  console.log(red('  ✗ Adaptive transcription needs whisper.cpp'))
+  console.log('    Install it first: ' + bold('brew install whisper-cpp'))
+  console.log('    Then rerun this setup command. No model download was started.')
+  console.log('')
+  process.exit(1)
+}
+
+if (SETUP_TRANSCRIPTION && process.env.SKIP_WHISPER_DOWNLOAD !== '1') {
+  mkdirSync(WHISPER_MODEL_DIR, { recursive: true })
+  const targets = [
+    [WHISPER_MODEL_PATH, WHISPER_MODEL_PARTIAL, WHISPER_MODEL_MIN_BYTES, WHISPER_MODEL_EXPECTED_BYTES],
+    [WHISPER_SMALL_MODEL_PATH, WHISPER_SMALL_MODEL_PARTIAL, WHISPER_SMALL_MODEL_MIN_BYTES, WHISPER_SMALL_MODEL_EXPECTED_BYTES],
+    [WHISPER_LARGE_MODEL_PATH, WHISPER_LARGE_MODEL_PARTIAL, WHISPER_LARGE_MODEL_MIN_BYTES, WHISPER_LARGE_MODEL_EXPECTED_BYTES],
+  ]
+  const missingBytes = targets.reduce((sum, [path, , minimum, expected]) =>
+    sum + (isValidWhisperModel(path, minimum) ? 0 : expected), 0)
+  const reclaimableBytes = targets.reduce((sum, [, partial]) => {
+    try { return sum + statSync(partial).size } catch { return sum }
+  }, 0)
+  const fsStats = statfsSync(WHISPER_MODEL_DIR)
+  const availableBytes = (fsStats.bavail * fsStats.bsize) + reclaimableBytes
+  const safetyMarginBytes = 750_000_000
+  if (missingBytes > 0 && availableBytes < missingBytes + safetyMarginBytes) {
+    const requiredGB = ((missingBytes + safetyMarginBytes) / 1_000_000_000).toFixed(1)
+    const availableGB = (availableBytes / 1_000_000_000).toFixed(1)
+    console.log('')
+    console.log(red('  ✗ Not enough free disk space for adaptive transcription'))
+    console.log(`    Need about ${requiredGB} GB; ${availableGB} GB is available after reusable partial downloads.`)
+    console.log('    Free space, then rerun this setup command. Existing models were not removed.')
+    console.log('')
+    process.exit(1)
+  }
+}
 let localVoiceReady = Boolean(whisperCliPath && hasValidModel)
 if (whisperCliPath && hasValidModel) {
   console.log(green('  ✓') + ' whisper.cpp + model ready ' + dim('— voice = local (FREE)'))
@@ -383,7 +471,7 @@ if (whisperCliPath && hasValidModel) {
   } else {
     try {
       mkdirSync(WHISPER_MODEL_DIR, { recursive: true })
-      execSync(`curl -fL --progress-bar "${WHISPER_MODEL_URL}" -o "${WHISPER_MODEL_PARTIAL}"`, { stdio: 'inherit', timeout: 900000 })
+      execFileSync('curl', ['-fL', '--progress-bar', WHISPER_MODEL_URL, '-o', WHISPER_MODEL_PARTIAL], { stdio: 'inherit', timeout: 900000 })
       const stats = statSync(WHISPER_MODEL_PARTIAL)
       if (stats.size < WHISPER_MODEL_MIN_BYTES) throw new Error(`Downloaded file too small: ${stats.size} bytes`)
       renameSync(WHISPER_MODEL_PARTIAL, WHISPER_MODEL_PATH)
@@ -405,6 +493,70 @@ if (process.env.COS_OPENAI_WHISPER_FALLBACK === '1') {
   console.log(green('  ✓') + ' Transcription policy: local-only ' + dim('— a key alone never uploads audio'))
 }
 
+const previewChoice = (process.env.COS_WHISPER_PREVIEW_MODEL || process.env.COS_WHISPER_REALTIME_MODEL || 'auto').trim().toLowerCase()
+const wantsSmallPreview = ['small', 'small.en', 'ggml-small.en.bin'].includes(previewChoice)
+if (whisperCliPath && wantsSmallPreview) {
+  if (isValidWhisperModel(WHISPER_SMALL_MODEL_PATH, WHISPER_SMALL_MODEL_MIN_BYTES)) {
+    console.log(green('  ✓') + ' Small.en preview model ready ' + dim('— Turbo remains authoritative'))
+  } else {
+    if (existsSync(WHISPER_SMALL_MODEL_PATH)) { try { unlinkSync(WHISPER_SMALL_MODEL_PATH) } catch {} }
+    if (existsSync(WHISPER_SMALL_MODEL_PARTIAL)) { try { unlinkSync(WHISPER_SMALL_MODEL_PARTIAL) } catch {} }
+    console.log(yellow('  ⚠') + ' Adaptive preview model missing')
+    console.log('    ' + dim('Downloading ggml-small.en (~466 MB).'))
+    if (process.env.SKIP_WHISPER_DOWNLOAD === '1') {
+      console.log(yellow('  ⚠') + ' SKIP_WHISPER_DOWNLOAD=1 — previews use Turbo until Small.en is provisioned')
+    } else {
+      try {
+        mkdirSync(WHISPER_MODEL_DIR, { recursive: true })
+        execFileSync('curl', ['-fL', '--progress-bar', WHISPER_SMALL_MODEL_URL, '-o', WHISPER_SMALL_MODEL_PARTIAL], { stdio: 'inherit', timeout: 900000 })
+        const stats = statSync(WHISPER_SMALL_MODEL_PARTIAL)
+        if (stats.size < WHISPER_SMALL_MODEL_MIN_BYTES) throw new Error(`Downloaded file too small: ${stats.size} bytes`)
+        renameSync(WHISPER_SMALL_MODEL_PARTIAL, WHISPER_SMALL_MODEL_PATH)
+        console.log(green('  ✓') + ' Small.en preview model downloaded ' + dim('— Turbo commit unchanged'))
+      } catch (err) {
+        try { unlinkSync(WHISPER_SMALL_MODEL_PARTIAL) } catch {}
+        console.log(red('  ✗') + ' Small.en download failed ' + dim('— previews safely fall back to Turbo'))
+        console.log('    ' + dim('Error: ' + (err.message || err).toString().slice(0, 120)))
+      }
+    }
+  }
+}
+
+if (whisperCliPath && SETUP_TRANSCRIPTION) {
+  if (isValidWhisperModel(WHISPER_LARGE_MODEL_PATH, WHISPER_LARGE_MODEL_MIN_BYTES)) {
+    console.log(green('  ✓') + ' Large-v3 HQ model ready ' + dim('— saved meetings use full polish'))
+  } else {
+    if (existsSync(WHISPER_LARGE_MODEL_PATH)) { try { unlinkSync(WHISPER_LARGE_MODEL_PATH) } catch {} }
+    if (existsSync(WHISPER_LARGE_MODEL_PARTIAL)) { try { unlinkSync(WHISPER_LARGE_MODEL_PARTIAL) } catch {} }
+    console.log(yellow('  ⚠') + ' HQ polish model missing')
+    console.log('    ' + dim('Downloading ggml-large-v3 (~3.1 GB).'))
+    if (process.env.SKIP_WHISPER_DOWNLOAD === '1') {
+      console.log(yellow('  ⚠') + ' SKIP_WHISPER_DOWNLOAD=1 — HQ safely reports unavailable and live Turbo continues')
+    } else {
+      try {
+        mkdirSync(WHISPER_MODEL_DIR, { recursive: true })
+        execFileSync('curl', ['-fL', '--progress-bar', WHISPER_LARGE_MODEL_URL, '-o', WHISPER_LARGE_MODEL_PARTIAL], { stdio: 'inherit', timeout: 1800000 })
+        const stats = statSync(WHISPER_LARGE_MODEL_PARTIAL)
+        if (stats.size < WHISPER_LARGE_MODEL_MIN_BYTES) throw new Error(`Downloaded file too small: ${stats.size} bytes`)
+        renameSync(WHISPER_LARGE_MODEL_PARTIAL, WHISPER_LARGE_MODEL_PATH)
+        console.log(green('  ✓') + ' Large-v3 HQ model downloaded')
+      } catch (err) {
+        try { unlinkSync(WHISPER_LARGE_MODEL_PARTIAL) } catch {}
+        console.log(red('  ✗') + ' Large-v3 download failed ' + dim('— live Turbo remains available'))
+        console.log('    ' + dim('Error: ' + (err.message || err).toString().slice(0, 120)))
+      }
+    }
+  }
+}
+
+if (PREPARE_ONLY && SETUP_TRANSCRIPTION) {
+  console.log('')
+  console.log(green('  ✓ Adaptive transcription setup complete'))
+  console.log('    Return to COS Control and Restart, install, or update the managed server.')
+  console.log('')
+  process.exit(0)
+}
+
 // Step 6: image capability — ffmpeg validates, strips metadata, normalizes,
 // and builds the exact 288x144 G2 variant. It is optional so text/voice remain
 // useful on a minimal install, but the launcher should make the gap visible.

package/managed-runtime-contract.json

@@ -21,6 +21,9 @@
     "COS_LIVE_CUES_AUTO",
     "COS_BATCH_HQ_METAL",
     "COS_BATCH_HQ_FORCE_CPU",
+    "COS_WHISPER_PREVIEW_MODEL",
+    "COS_WHISPER_REALTIME_MODEL",
+    "COS_UNSAVED_AUDIO_RETENTION_HOURS",
     "COS_CLAUDE_TRUST_MODE",
     "COS_CODEX_SANDBOX",
     "COS_SCRIPTS_DIR"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.18.8",
+  "version": "6.20.0",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -48,6 +48,7 @@ import {
   stopCodexModelCatalogRefresh,
 } from './lib/codex-model-catalog.js'
 import { startWhisperServer, stopWhisperServer } from './lib/whisper-local.js'
+import { startWhisperPreviewServer, stopWhisperPreviewServer } from './lib/whisper-preview.js'
 import { startLocalTtsServer, stopLocalTtsServer } from './lib/tts-local.js'
 import { initSileroVAD } from './lib/vad-silero.js'
 import { initSessionCache } from './lib/session-cache-writer.js'
@@ -58,6 +59,7 @@ import { listenRequiredServers, type RequiredListener } from './lib/listener-sta
 import { serverMetrics } from './lib/server-metrics.js'
 import { initializeServerInstanceId } from './lib/server-instance-id.js'
 import { appendPrivateEnvBlock, UnsafeUserConfigPathError } from './lib/secure-user-config.js'
+import { getTranscriptionProfileStatus } from './lib/profile.js'
 import { createQueryJobsRouter } from './routes/query-jobs.js'
 import {
   initQueryJobRuntime,
@@ -296,6 +298,7 @@ async function gracefulShutdown(): Promise<void> {
   try { logActiveSessionsOnShutdown() } catch { /* best-effort flush */ }
   stopCodexModelCatalogRefresh()
   stopWhisperServer()
+  stopWhisperPreviewServer()
   stopLocalTtsServer()
   clearTimeout(forceExit)
   process.exit(0)
@@ -407,7 +410,19 @@ listenRequiredServers(listeners).then(() => {
     // known-good snapshot if Codex is temporarily unavailable.
     startCodexModelCatalogRefresh()
     // Start local whisper-server (model stays in RAM for ~50ms transcription)
-    startWhisperServer().catch(err => console.error('[startup] Whisper server error:', err))
+    const transcriptionProfile = getTranscriptionProfileStatus()
+    if (transcriptionProfile.ignoredPlaceholderTerms > 0 || transcriptionProfile.ignoredPlaceholderCorrection) {
+      console.warn(
+        '[whisper] .cos-profile.json still contains factory vocabulary. ' +
+        'Placeholder terms are ignored; add real names and terminology in Guided Setup for better accuracy.',
+      )
+    }
+    // Load the authoritative Turbo worker first. Starting both model loads at
+    // once made first boot slower on smaller Macs and could cause Control's
+    // readiness proof to time out even though both models were healthy.
+    startWhisperServer()
+      .then(() => startWhisperPreviewServer())
+      .catch(err => console.error('[startup] Whisper server/preview error:', err))
     startLocalTtsServer().catch(err => console.error('[startup] Local TTS server error:', err))
     // Initialize speaker embeddings (voiceprint-based diarization) — fails soft if model absent
     const embeddingOk = initSpeakerEmbeddings()

package/server/lib/hallucination-filter.ts

@@ -11,7 +11,7 @@
 //   isFullHallucination(text) — returns true if the text IS a hallucination in its
 //     entirety (silence artifacts, caption training, foreign script, filler-only).
 
-import { getNegativeRules, getVocabulary, getOwnerName, loadProfileField } from './profile.js'
+import { getNegativeRules, getVocabulary, getOwnerName, getWhisperCorrections } from './profile.js'
 
 // ── Whole-chunk silence hallucinations ─────────────────────────────────────
 const KNOWN_HALLUCINATIONS = [
@@ -333,13 +333,10 @@ function getVocabEchoMatcher(): RegExp {
   for (const v of getVocabulary()) if (v && v.trim()) raw.add(v.trim())
   // Include whisper_corrections key/value variants so the echo matches whatever
   // spelling whisper emits ("POS Nation" ↔ "POSNation", "Jewel 360" ↔ "Jewel360").
-  try {
-    const corrRaw = loadProfileField('whisper_corrections', '')
-    if (corrRaw) {
-      const map = JSON.parse(corrRaw) as Record<string, string>
-      for (const [k, val] of Object.entries(map)) { if (k) raw.add(k); if (val) raw.add(val) }
-    }
-  } catch { /* malformed corrections — ignore */ }
+  for (const [key, value] of Object.entries(getWhisperCorrections())) {
+    raw.add(key)
+    raw.add(value)
+  }
   // Only UNAMBIGUOUS terms trigger an echo drop: multi-word phrases ("POS Nation",
   // "IT Retail", "Jeremy Sokolic") and brand-shaped single tokens with an internal
   // capital or digit ("POSNation", "CaratIQ", "Jewel360"). Plain single-word tokens

package/server/lib/maintenance-lifecycle.ts

@@ -54,6 +54,14 @@ export type MaintenanceWorkKind =
   // budget must stay under COS Control's 90s drain timeout (main.swift:1853)
   // or every drain that catches a cue in flight hard-fails to Repair.
   | 'live_cue_pipeline'
+  // Miles-triggered recovery of a quarantined unsaved capture (6.19.0):
+  // batch-transcribes retained WAVs into a durable scribe. Held for the whole
+  // background run so an Update Server drain waits for it like any batch.
+  // Long runs are made visible: the active-recovery registry renders a
+  // meeting_sync row with blocksRestart so COS Control warns BEFORE
+  // committing a drain into a decode that outlives its 90s timeout
+  // (main.swift:1963 waitForRestartProof).
+  | 'orphan_recovery'
 
 export type MaintenanceWorkPhase = 'queued' | 'active'
 export type MaintenanceOperationScope = 'same_boot' | 'cross_boot'