@gotcos/glasses-server 6.44.15 → 6.45.0

package/server/lib/meeting-summary.ts

@@ -89,7 +89,7 @@ export const meetingSummaryBreaker = breaker
  *  environment on update, and tests flip this per-case; a module-scope const
  *  would freeze the value at import and make both untestable.
  *
- *  DEFAULT ON since 6.37.0 (Miles 2026-08-25). Shipping this off meant the
+ *  DEFAULT ON since 6.37.0 (the user 2026-08-25). Shipping this off meant the
  *  headline fix — a meeting that comes back with a real summary — reached
  *  nobody unless they found an undocumented env var.
  *

package/server/lib/message-era-reset.ts

@@ -90,7 +90,7 @@ export async function resetLiveMessageEra(input: MessageEraResetInput): Promise<
   //
   // This used to endSession() every live session before rotating, which is what
   // made "reset the message count" also empty CHAT and kill the conversation the
-  // wearer was in the middle of. Miles wants the opposite shape: the next message
+  // wearer was in the middle of. the user wants the opposite shape: the next message
   // is #1, the old cards keep their numbers, and the thread survives.
   //
   // Numbers stay unique because they are {messageEra, globalMsgNum}, not a bare

package/server/lib/message-era.ts

@@ -1,4 +1,4 @@
-// Message-number eras let Miles start again at #1 without deleting history.
+// Message-number eras let the user start again at #1 without deleting history.
 // Old sessions/day archives remain immutable and browseable; the current era
 // alone owns short voice references such as "reference message 4".
 //

package/server/lib/morning-brief-config.ts

@@ -12,7 +12,7 @@
 // and connectors it already has. So a "source" here is an instruction the
 // composer turns into one section of the prompt, and a user personalises the
 // brief by choosing sources and their windows rather than by editing prose.
-// Miles (2026-09-01): "the user should be able to define the different sources
+// the user (2026-09-01): "the user should be able to define the different sources
 // that will be pulled into their brief so that it's as useful as possible."
 
 import { chmodSync, mkdirSync } from 'node:fs'

package/server/lib/morning-brief-coverage.ts

@@ -3,7 +3,7 @@
 // The Sources list names an INSTRUCTION ("Meetings", "Knowledge graph"); the
 // server can also say how deep the well is behind it: 2,312 meetings stored,
 // 6,705 memories and 66 threads, the /good-morning skill found under
-// .claude/skills. Miles (2026-09-01): "I'm assuming we should see all of these
+// .claude/skills. the user (2026-09-01): "I'm assuming we should see all of these
 // stats when we turn it on." Those are the same numbers COS Control's Activity
 // tiles show, read from the same places, so the card agrees with the tiles.
 //

package/server/lib/occupancy-probes.ts

@@ -86,8 +86,11 @@ export function realOccupancyDirs(): OccupancyDirs {
 const PS_BIN = existsSync('/bin/ps') ? '/bin/ps' : 'ps'
 const LSOF_BIN = existsSync('/usr/sbin/lsof') ? '/usr/sbin/lsof' : 'lsof'
 
-/** Both probes sit in the interactive attach path. lsof can block for seconds on a stale mount. */
+/** Both probes sit in the interactive attach path and remain hard bounded. */
 const PROBE_TIMEOUT_MS = 2_000
+// A whole-process descriptor scan measured ~2 s on a healthy busy Mac. Give
+// lsof its own budget; timeout still refuses attachment rather than assuming idle.
+const LOCK_PROBE_TIMEOUT_MS = 5_000
 const PROBE_MAX_BUFFER = 1 << 20
 
 /** A registry record is a few hundred bytes. Anything larger is not one. */
@@ -147,11 +150,11 @@ export interface ProbeOutcome {
   spawnError: string | null
 }
 
-function runProbe(bin: string, args: string[]): ProbeOutcome {
+function runProbe(bin: string, args: string[], timeoutMs = PROBE_TIMEOUT_MS): ProbeOutcome {
   try {
     const stdout = execFileSync(bin, args, {
       encoding: 'utf8',
-      timeout: PROBE_TIMEOUT_MS,
+      timeout: timeoutMs,
       killSignal: 'SIGKILL',
       maxBuffer: PROBE_MAX_BUFFER,
       env: probeEnv(),
@@ -355,7 +358,7 @@ export function lockHolders(path: string): number[] {
   // `--` terminates option parsing so a path can never be read as a flag; `-w`
   // suppresses mount-point warnings that would otherwise make a successful probe
   // look like the failure case below.
-  return interpretLockHolders(runProbe(LSOF_BIN, ['-w', '-t', '--', path]), path)
+  return interpretLockHolders(runProbe(LSOF_BIN, ['-w', '-t', '--', path], LOCK_PROBE_TIMEOUT_MS), path)
 }
 
 /**

package/server/lib/ollama-tools.ts

@@ -166,7 +166,7 @@ function capHits<T>(payload: Record<string, unknown>, hits: T[]): string {
  * it found nothing.
  *
  * Empty hits plus a reason describe THIS call. Without the reason a model reads
- * an empty list as proof the archive is empty and tells Miles he has no
+ * an empty list as proof the archive is empty and tells the user he has no
  * meetings. `semanticReason` is `"none"` rather than absent so the field can
  * never be silently missing.
  */

package/server/lib/python-bridge.ts

@@ -67,6 +67,7 @@ export const LEARNING_COMMANDS = [
   'graph-ingest-progress',
   'graph-setup-embedding',
   'graph-setup-extraction',
+  'memory-workspace',
   'memory-review',
   'memory-guardrails',
   'memory-guardrails-run',
@@ -116,9 +117,9 @@ if (pythonAvailable) {
  * pipeline is configured; otherwise resolves to an empty/no-op result so the
  * context builder degrades gracefully on a standalone install.
  */
-export function callPython(args: string[], timeoutMs = 30_000, input?: string): Promise<unknown> {
+export function callPython(args: string[], timeoutMs = 30_000, input?: string, signal?: AbortSignal): Promise<unknown> {
   if (pythonAvailable) {
-    return callPythonDirect(args, timeoutMs, input)
+    return callPythonDirect(args, timeoutMs, input, signal)
   }
   return Promise.resolve(standaloneNoop(args))
 }
@@ -257,6 +258,7 @@ function standaloneNoop(args: string[]): unknown {
     case 'graph-ingest-progress':
     case 'graph-setup-embedding':
     case 'graph-setup-extraction':
+    case 'memory-workspace':
     case 'memory-review':
     case 'memory-guardrails':
     case 'memory-guardrails-run':
@@ -285,12 +287,12 @@ function argLimit(args: string[], fallback: number): number {
 }
 
 /** Full Python bridge — requires the user's venv + cos_api_bridge.py. */
-function callPythonDirect(args: string[], timeoutMs: number, input?: string): Promise<unknown> {
+function callPythonDirect(args: string[], timeoutMs: number, input?: string, signal?: AbortSignal): Promise<unknown> {
   return new Promise((resolvePromise, reject) => {
     const child = execFile(
       PYTHON_BIN!,
       [BRIDGE_SCRIPT!, ...args],
-      { cwd: COS_SCRIPTS_DIR!, timeout: timeoutMs, maxBuffer: 1024 * 1024 },
+      { cwd: COS_SCRIPTS_DIR!, timeout: timeoutMs, maxBuffer: 1024 * 1024, signal },
       (err, stdout, stderr) => {
         if (err) {
           // The bridge prints its unknown-command answer to STDOUT and exits 1

package/server/lib/query-job-types.ts

@@ -55,7 +55,7 @@ export interface QueryJobPromptReference {
 /**
  * Who STARTED a job, when it was not the person holding the phone or the
  * glasses. A label, nothing more: the server never infers anything from its
- * absence (Miles, 2026-09-02). `routine` is the scheduler (`morning-brief`),
+ * absence (the user, 2026-09-02). `routine` is the scheduler (`morning-brief`),
  * `task` is a dispatch of a captured task (the id is the task's 12-hex id).
  * Human prompts typed on the phone carry no origin. The phone stamps `g2`
  * locally for prompts spoken on the glasses, as a bare string; if that string

package/server/lib/session-stream-events.ts

@@ -25,7 +25,7 @@ export type SessionStreamState = 'working' | 'idle' | 'done'
 
 export type SessionStreamDraft =
   | { kind: 'tool'; verb: SessionStreamVerb; target: string; detail: string }
-  // The user's own words for the turn being worked on. Miles: "we should see the query
+  // The user's own words for the turn being worked on. the user: "we should see the query
   // that the user has versus it just being a blank slate where it says working. That
   // way, the user at least knows what the agent is actively working on."
   //
@@ -145,7 +145,7 @@ function countLines(value: unknown): number {
 /**
  * The part of a shell command worth 40 columns.
  *
- * WHAT WENT WRONG ON HARDWARE. Miles's 9:20 screenshot showed `bash ses...` and
+ * WHAT WENT WRONG ON HARDWARE. the user's 9:20 screenshot showed `bash ses...` and
  * `bash s...` -- a shell command reduced to two characters. Two causes compounding:
  * the raw command was sent whole, and the CLIENT then treated it as a PATH and kept
  * only the text after the last `/`. So `cd /Users/.../cos-glasses-app && grep -n x
@@ -347,7 +347,7 @@ function draftsFromClaudeRecord(record: Record<string, unknown>): SessionStreamD
   //
   // This used to drop both, on the reasoning that "the prompt came from this device".
   // That is true of a Continue turn and FALSE of the case that matters most: a session
-  // running in a Mac window, where the user row is the question Miles typed there and
+  // running in a Mac window, where the user row is the question the user typed there and
   // the glasses have never seen it. Dropping it is what made the live view a blank
   // slate that said WORKING and nothing else.
   //

package/server/lib/session-transcript-watcher.ts

@@ -176,7 +176,7 @@ async function readRangeAt(path: string, offset: number, length: number): Promis
  * The last complete records before a byte offset, for the OPEN-time seed.
  *
  * WHY THIS EXISTS. The tail starts at the file's current size, so opening a session
- * that is already working showed an EMPTY page that filled one line at a time. Miles,
+ * that is already working showed an EMPTY page that filled one line at a time. the user,
  * on hardware: "the live session pulling is a little lackluster." You walk up to the
  * desk and the monitor is blank. The history is right there in the file; the tailer was
  * simply choosing not to read it.

package/server/lib/speaker-calibration-log.ts

@@ -29,7 +29,7 @@ export interface CalibrationPurgeResult {
  *
  * Pure so the matching rule can be tested without touching the filesystem.
  * Matching is exact on the `speaker` field only: a substring match would delete
- * every "Miles Mallard" row when removing "Miles", and the name also appears in
+ * every "Alex Other" row when removing "the user", and the name also appears in
  * no other field.
  */
 export function filterCalibrationRows(

package/server/lib/speaker-name.ts

@@ -1,6 +1,6 @@
 // What may become a voice-profile name.
 //
-// WHY THIS EXISTS (Chelsie Hodgkiss, first-time user, 2026-08-25)
+// WHY THIS EXISTS (Casey Example, first-time user, 2026-08-25)
 // Saying "enroll my voice" and continuing to talk produced a profile whose
 // NAME was the entire ~40-second transcript. Two runs, two junk profiles, one
 // embedding each. Because no junk name ever equals owner_speaker_label,

package/server/lib/thread-occupancy.ts

@@ -491,7 +491,7 @@ export interface OccupancyDirs {
 //
 // WHY THE OLD RULE WAS WRONG. The registry records an OPEN WINDOW, not active
 // generation. `~/.claude/sessions/<pid>.json` for a session that finished ten
-// minutes ago is byte-identical to one mid-turn. Miles keeps Claude Code
+// minutes ago is byte-identical to one mid-turn. the user keeps Claude Code
 // windows open, so Continue was refused for exactly the threads he cares about
 // and allowed only for the ones he had abandoned. The gate was measuring the
 // wrong thing, not measuring it too strictly.

package/server/lib/thread-turn-queue-deliver.ts

@@ -17,7 +17,7 @@
 // against a current baseline, which is what the user meant by queueing it: "append this
 // to whatever the thread is when it frees". An interactive turn still gets the full
 // divergence check, because there the user composed against a state they were looking
-// at and a silent change is genuinely surprising. Miles approved this explicitly.
+// at and a silent change is genuinely surprising. the user approved this explicitly.
 //
 // FAILS CLOSED, AND AMBIGUITY IS A FAILURE. Anything other than a clean admission
 // resolves `ok: false`, which returns the turn to the queue rather than marking it

package/server/lib/thread-turn-queue.ts

@@ -3,7 +3,7 @@
 // ---------------------------------------------------------------------------
 // WHY
 // ---------------------------------------------------------------------------
-// Miles, 2026-08-17, looking at a thread he could not continue: "This thread, the
+// the user, 2026-08-17, looking at a thread he could not continue: "This thread, the
 // COS-glasses server, has actually completed, but it's still locked. Ideally, what would
 // happen is if there's a session that's still running, that would just put it into the
 // queue the same way that the user has the ability to do so." His example was his own
@@ -31,7 +31,7 @@
 // when it can never run is worse than refusing.
 //
 // ---------------------------------------------------------------------------
-// THE WATERMARK EXEMPTION -- Miles approved this explicitly
+// THE WATERMARK EXEMPTION -- the user approved this explicitly
 // ---------------------------------------------------------------------------
 // A binding carries a content watermark, and a write is refused with
 // `native_thread_changed` when the thread's head digest moved since the turn was
@@ -46,7 +46,7 @@
 // divergence check, because there the user composed against a state they were looking
 // at and a silent change is genuinely surprising.
 //
-// Miles, asked directly before this was built: "Yeah, this is a fine exemption."
+// the user, asked directly before this was built: "Yeah, this is a fine exemption."
 //
 // ---------------------------------------------------------------------------
 // WHAT MAKES A TURN READY, AND WHY NOT "IDLE"

package/server/lib/video-upload-v2.ts

@@ -54,7 +54,7 @@ const CLIENT_REQUEST_RE = /^[A-Za-z0-9._:-]{16,160}$/
 const MEDIA_ID_RE = /^m_[0-9a-f]{24}$/
 
 export function videoUploadV2Enabled(): boolean {
-  // Default ON since 6.37.0 (Miles 2026-08-25). Absent key = on; only a
+  // Default ON since 6.37.0 (the user 2026-08-25). Absent key = on; only a
   // literal '0' disables. NOTE: an in-flight upload sets blocksRestart, so a
   // drain caught mid-upload waits for it — that is the intended contract, not
   // a stuck gate, and must never be --forced.

package/server/lib/voice-profile-store.ts

@@ -124,7 +124,7 @@ export function normalizeProfileStore(raw: unknown): { store: ProfileStore; repa
       ? (candidate as VoiceProfile).name.trim()
       : ''
     if (!rawName) { repairs.profilesDropped++; continue }
-    // Chelsie's store (2026-09-08) held two profiles named with the entire
+    // Casey's store (2026-09-08) held two profiles named with the entire
     // enrolment speech (~600 characters), written by a client older than the
     // 6.8.433 / server 8/25 guards. A name like that can never match a speaker
     // label, and the file cannot be repaired by hand because the server
@@ -445,7 +445,7 @@ export function profileCentroid(embeddings: number[][]): number[] {
 }
 
 /** How close two profiles' centroids are. This is the number a merge must be
- *  justified by: names are not evidence, and `Miles Mallard` / `Manoj Kumar`
+ *  justified by: names are not evidence, and `Alex Other` / `Jordan Other`
  *  are different humans who would merge happily on a name heuristic. */
 export function profileSimilarity(a: VoiceProfile, b: VoiceProfile): number {
   return rowCosine(profileCentroid(a.embeddings), profileCentroid(b.embeddings))

package/server/lib/whisper-metal-gate.ts

@@ -1,6 +1,6 @@
 // GPU admission control for post-meeting batch HQ transcription.
 //
-// THE PROBLEM: Miles goes meeting -> meeting. Meeting A's post-save HQ polish
+// THE PROBLEM: the user goes meeting -> meeting. Meeting A's post-save HQ polish
 // (whisper-cli large-v3) often overlaps Meeting B's live ASR. Both want Metal.
 // 6.14.1 fixed the clash bluntly by pinning batch to CPU forever, which taxes
 // every idle polish to protect the overlap case.

package/server/routes/agent-session-bindings.ts

@@ -1302,7 +1302,7 @@ export const TURN_UNKNOWN_COPY = 'COS has no record of that turn. Nothing was se
 export const CLIENT_TURN_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/
 
 export function threadAttachEnabled(): boolean {
-  // Default ON since 6.37.0 (Miles 2026-08-25): ship the capability active and
+  // Default ON since 6.37.0 (the user 2026-08-25): ship the capability active and
   // let users opt out. Absent key = on; only a literal '0' disables.
   return process.env.COS_THREAD_ATTACH_ENABLED !== '0'
 }
@@ -2252,7 +2252,7 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
         })
         // A fence shuts a thread until a human acts, and until now it wrote NO log
         // line at either site — so a fenced thread was discoverable only by trying
-        // to use it (Miles, 2026-08-18). Never log `key`: it embeds the private
+        // to use it (the user, 2026-08-18). Never log `key`: it embeds the private
         // native thread id, which this router does not emit anywhere.
         console.warn(`[agent-session-bindings] fence set site=ambiguous provider=${binding.provider} target=${opaqueRevision(key)} turnId=${turnId} bindingId=${bindingId} headBefore=${head.digest} adapterReason=${recordedReason} detail=${adapterEvidence.adapterDetail ?? 'none'} exitCode=${adapterEvidence.exitCode ?? 'null'} childReaped=${adapterEvidence.childReaped ?? 'unknown'} stderrClass=${adapterEvidence.stderrClass ?? 'none'} durationMs=${adapterEvidence.durationMs ?? 'unknown'} spawnCount=${recordedPids.length}`)
         return reportAmbiguous()

package/server/routes/agent-session-stream.ts

@@ -245,7 +245,7 @@ agentSessionStreamRouter.get('/agent-sessions/:provider/:sessionId/stream', asyn
   // THE SEED. The last few steps of what already happened, before anything live.
   //
   // Without it, opening a session that is already working shows an empty page that
-  // fills one line at a time, which is what Miles reported from hardware. The screen
+  // fills one line at a time, which is what the user reported from hardware. The screen
   // should look like a monitor you just walked up to, not one that was switched on.
   //
   // BOUNDED TO WHAT THE LENS CAN SHOW. `SEED_EVENTS` is the live window, so the seed

package/server/routes/agent-sessions.ts

@@ -198,7 +198,7 @@ export function withRunning<T extends { session_id: string }>(entry: T, scan: Oc
  * the hint from whichever list row the user tapped. That worked exactly once: the
  * detail page was a single fetch, so the borrowed flags were frozen at the moment
  * it opened and could never clear, which is half of why a finished session stayed
- * "active" on the glasses until Miles navigated away. A page that polls needs a
+ * "active" on the glasses until the user navigated away. A page that polls needs a
  * payload that carries its own liveness.
  *
  * NEARLY FREE HERE. The handler has already resolved the transcript path and
@@ -382,7 +382,7 @@ agentSessionsRouter.get('/agent-sessions/:provider/:sessionId', async (req, res)
       first_prompt: parsed.first_prompt,
       discussion_summary: parsed.discussion_summary || '',
       // Detail only. The list row (line 73) deliberately stays on the 180-char
-      // summary — Miles: "it should be in the body not the title, the row should
+      // summary — the user: "it should be in the body not the title, the row should
       // be no more than the 180 characters."
       discussion_digest: parsed.discussion_digest || '',
       // The newest assistant reply, whole. ADDITIVE: the digest above still carries

package/server/routes/claude-sessions.ts

@@ -43,7 +43,7 @@ export function claudeSessionsEnabled(): boolean {
  * Show real session names instead of the recomputed folder name?
  *
  * Default OFF, so the published package is safe for anyone: a `user` or `auto` name
- * describes the WORK ("Kevin/Miles grievance analysis"), and this socket binds
+ * describes the WORK ("Alex/Jordan grievance analysis"), and this socket binds
  * 0.0.0.0 behind a private-network allowlist, so anyone on the LAN holding the token
  * would read it off the wire.
  *

package/server/routes/health.ts

@@ -247,7 +247,7 @@ healthRouter.get('/health', async (_req, res) => {
     // COS Control's "Show Claude sessions" checkbox sourced its state from
     // GET /api/claude-sessions -- the call that also lists every session -- and the
     // panel never made that call. The box therefore rendered OFF whatever the
-    // setting was, and the setting was ON: Miles enabled it four times against a
+    // setting was, and the setting was ON: the user enabled it four times against a
     // control that could only ever show him false.
     //
     // This is a pure env read, so it costs nothing on a health poll, and health is

package/server/routes/meeting.ts

@@ -30,7 +30,7 @@ import { enrolNamedVoice } from '../lib/meeting-relabel-enrolment.js'
  * The label a de-attributed voice takes, numbered within its meeting.
  *
  * NOT a shared `Ext`. De-attributing to one label folded every corrected voice
- * into a single row — on the 2026-08-06 Ditto meeting Miles named five wrong
+ * into a single row — on the 2026-08-06 Ditto meeting the user named five wrong
  * attributions, and collapsing them would have destroyed his ability to tell
  * those five voices apart, which is precisely what he needs playback for next.
  *
@@ -807,7 +807,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
   // ── Per-meeting speaker relabel (6.21.16) ─────────────────────────────
   //
   // Corrects who a voice was in ONE meeting. Deliberately not a global merge:
-  // Miles, on the design — "changing it doesn't mean that all previous chunks
+  // the user, on the design — "changing it doesn't mean that all previous chunks
   // should also be moved. It should be meeting by meeting, with the goal of
   // hardening or refining the voice profiles." The identifier mishearing a voice
   // in one room is not evidence that every past attribution was wrong.
@@ -927,9 +927,9 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       durationMs: review.durationMs || 0,
       // Names this human explicitly de-attributed. The ledger has recorded
       // `proseStale` on every applied de-attribution since the feature shipped and
-      // NOTHING has ever read it: on 2026-08-07 Miles removed "Clem Ukaoma" from a
-      // call that was only him and Queen, all 8 label sites were rewritten, and the
-      // summary still opened "Miles, Queen, and Clem talk through..." with no
+      // NOTHING has ever read it: on 2026-08-07 the user removed "Morgan Example" from a
+      // call that had only two participants, all 8 label sites were rewritten, and the
+      // summary still opened "the user, Sam, and Morgan talk through..." with no
       // indication anywhere in the payload.
       removed: appliedCorrections(sessionId)
         .filter(r => isUnattributed(r.to))
@@ -1292,7 +1292,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
   //
   // The inverse of naming an unknown voice: this voice was NOT that person.
   //
-  // Miles, on the 2026-08-06 Ditto meeting: none of the eleven attributed
+  // the user, on the 2026-08-06 Ditto meeting: none of the eleven attributed
   // voices were actually in the room, and there was no way to say so. Naming an
   // unknown was possible; un-naming a wrong guess was not.
   //
@@ -1633,7 +1633,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
 
   // ── Review playback (6.21.18) ─────────────────────────────────────────
   //
-  // Miles: "I can quickly play that, and I'm going to hear the voice and know
+  // the user: "I can quickly play that, and I'm going to hear the voice and know
   // immediately who the speaker is. As a final confirmation."
   //
   // A phrase in the panel is a weaker signal than three seconds of the actual
@@ -1781,7 +1781,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
   })
 
   // ── Unsaved-capture recovery (6.19.0) ─────────────────────────────────
-  // Surface-only by decision (Miles, 2026-08-02): the server NEVER drives
+  // Surface-only by decision (the user, 2026-08-02): the server NEVER drives
   // recovery on its own. It lists what the quarantine holds, and one
   // authenticated POST drives one capture to a durable scribe.
   const recoveringOrphans = new Set<string>()

package/server/routes/memory.ts

@@ -54,6 +54,41 @@ import { normalizeReviewDecision, LEARNING_REVIEW_LIMIT,
 } from '../lib/cos-context-browser.js'
 
 export const memoryRouter = Router()
+memoryRouter.use((req, res, next) => {
+  if (['owner', 'audience', 'authority_host', 'authority_epoch'].some(key => key in req.query || (req.body && key in req.body))) {
+    res.status(400).json({ error: 'caller_authority_forbidden' }); return
+  }
+  next()
+})
+// Additive workspace protocol. The existing /memory array contract remains intact.
+// Authentication is the instance pairing token; caller fields cannot select an owner.
+const WORKSPACE_ACTIONS = new Set(['status', 'graph_expand', 'graph_paths', 'graph_resolve', 'list_explorations', 'get_exploration',
+  'save_exploration', 'save_assertion', 'policy_get', 'policy_set', 'memory_page', 'learning_page', 'review_page', 'get_memory', 'review_memory', 'trace_summary', 'source_status', 'refresh_source', 'current_sources', 'identity_split_preview', 'identity_status', 'identity_keep_apart', 'rule_page', 'propose_rule', 'review_rule', 'rollback_rule', 'activate_rule', 'rule_evaluation'])
+memoryRouter.post('/context/memory/workspace', async (req, res) => {
+  noStore(res)
+  const body = req.body
+  if (!body || typeof body !== 'object' || Array.isArray(body) || !WORKSPACE_ACTIONS.has(body.action)
+      || ['owner','audience','actor','path','authority_host','authority_epoch'].some(key => key in body)) {
+    res.status(400).json({ error: 'invalid_workspace_request' }); return
+  }
+  const input = JSON.stringify(body)
+  if (Buffer.byteLength(input) > 512 * 1024) { res.status(413).json({ error: 'request_too_large' }); return }
+  const cancellation = new AbortController()
+  res.once('close', () => { if (!res.writableEnded) cancellation.abort() })
+  try {
+    const result = await callPython(['memory-workspace'], 20_000, input, cancellation.signal) as Record<string, unknown>
+    if (!result || typeof result !== 'object' || result.error) {
+      res.status(409).json(result || { error: 'invalid_workspace_response' }); return
+    }
+    if (result.protocol !== 1 || Buffer.byteLength(JSON.stringify(result)) > 900 * 1024) {
+      res.status(502).json({ error: 'unsupported_workspace_response' }); return
+    }
+    res.json(result)
+  } catch (error) {
+    res.status(503).json({ error: 'workspace_unavailable', message: error instanceof Error ? error.message : 'Workspace unavailable' })
+  }
+})
+
 let overviewCache: { expiresAt: number; value: ReturnType<typeof normalizeMemoryOverview> } | null = null
 
 memoryRouter.get('/context/status', async (_req, res) => {
@@ -211,7 +246,7 @@ memoryRouter.post('/context/learning/:id/review', async (req, res) => {
 
 // ── Memory review and guardrails (6.44.13) ──────────────────────────
 //
-// Accept stamps a captured memory as reviewed; prune deletes it. Both are
+// Accept activates a captured memory; prune quarantines it. Both are
 // review-ledger rows the timeline shows. The guardrails are the user's own
 // rules; a run scans, judges (rules, then an optional bounded model pass),
 // and prunes only with apply.
@@ -228,10 +263,10 @@ memoryRouter.post('/context/memory/:id/review', async (req, res) => {
     const answer = await callPython(['memory-review', `--id=${memoryId}`, `--decision=${decision}`, ...(note ? [`--note=${note}`] : [])], 20_000)
     const code = bridgeErrorCode(answer)
     if (code) { sendSetupError(res, code, answer); return }
-    const a = answer as { decision?: unknown; deleted?: unknown }
+    const a = answer as { decision?: unknown; deleted?: unknown; quarantined?: unknown; receipt?: unknown }
     const row = normalizeReviewDecision({ decision: a.decision })
     if (!row) { res.status(503).json({ error: 'memory_review_unavailable' }); return }
-    res.json({ decision: row, deleted: a.deleted === true })
+    res.json({ decision: row, deleted: a.deleted === true, ...(a.quarantined === true ? { quarantined: true } : {}), ...(a.receipt ? { receipt: a.receipt } : {}) })
   } catch (error) {
     console.warn('[context] memory review bridge failure:', (error as Error).message)
     res.status(503).json({ error: 'memory_unavailable' })
@@ -297,12 +332,12 @@ memoryRouter.post('/context/memory-guardrails/run', async (req, res) => {
 
 // ── Curation (6.44.14): the Manage sheet's merge, with a preview, a worker and a receipt ──
 //
-// Miles 2026-09-08: "Build the Manage merge path with the preview" and "address any of
-// the obvious duplicates like the miels and queen example without clobbering entities."
+// the user 2026-09-08: "Build the Manage merge path with the preview" and "address any of
+// the obvious duplicates like the alxe and sam example without clobbering entities."
 // The merge is a DETACHED worker: the two hand merges of 2026-09-08 took ~2 minutes of
 // vector-store rewriting, far past any request budget. The kickoff answers 202 with a
 // ticket; GET /context/graph/merge is the receipt to poll. Two people the graph knows
-// to be different (Miles Ukaoma / Miles Mallard) come back 409 merge_blocked.
+// to be different (Alex Example / Alex Other) come back 409 merge_blocked.
 
 function mergeNames(body: unknown): { source: string; target: string } | null {
   const b = (body ?? {}) as { source?: unknown; target?: unknown }
@@ -572,6 +607,7 @@ memoryRouter.get('/context/graph/ingest/progress', async (_req, res) => {
 function sendSetupError(res: import('express').Response, code: string, data: unknown): void {
   const detail = asDetail(data)
   if (code === 'not_owner') { res.status(409).json({ error: code, message: detail.message, owner_host: detail.owner_host ?? null }); return }
+  if (code === 'governed_merge_unavailable') { res.status(409).json({ error: code, message: detail.message }); return }
   if (code === 'embedding_locked' || code === 'embedding_mismatch') { res.status(409).json({ error: code, message: detail.message }); return }
   if (code === 'merge_blocked') {
     // 6.44.14: two entities the graph knows to be different people. The preview rides along so the page can say why.
@@ -676,8 +712,10 @@ memoryRouter.post('/context/graph/ask', async (req, res) => {
   if (!contextConfigured()) { res.status(503).json({ error: pythonBridgeState() }); return }
   const q = typeof (req.body as { q?: unknown } | undefined)?.q === 'string' ? ((req.body as { q: string }).q).trim() : ''
   if (q.length < 3 || q.length > KNOWLEDGE_ASK_MAX_CHARS) { res.status(400).json({ error: 'invalid_query', message: `q must be 3 to ${KNOWLEDGE_ASK_MAX_CHARS} characters` }); return }
+  const cancellation = new AbortController()
+  res.once('close', () => { if (!res.writableEnded) cancellation.abort() })
   try {
-    const data = await callPython(['graph-ask', `--q=${q}`], 150_000)
+    const data = await callPython(['graph-ask', `--q=${q}`], 150_000, undefined, cancellation.signal)
     const code = bridgeErrorCode(data)
     if (code) { sendSetupError(res, code, data); return }
     const answer = normalizeGraphAnswer(data)

package/server/routes/prompt-drafts.ts

@@ -107,7 +107,7 @@ function routeAutoClean(req: { body?: any; query?: any }): AutoCleanRequest {
 async function cleanOutboundDictation(text: string, opts: AutoCleanRequest & { signal?: AbortSignal }): Promise<string> {
   let cleaned = applyNegativeRules(applyCorrections(text)).replace(/\s+/g, ' ').trim() || text
   // applyCorrections above is an EXACT string map, so it only fixes misspellings someone
-  // already hand-authored. A novel miss ("Miyala" for Niala, "Yukoma" for Ukaoma) sails
+  // already hand-authored. A novel miss ("Rileyy" for Riley, "Exampel" for Example) sails
   // through it. The Levenshtein pass is what catches those, and until now it had exactly
   // ONE call site — transcribe-audio.ts:252, the server-transcription route — so phone
   // Moonshine dictation, which arrives here as text, never got it. Same construction and

package/server/routes/session-index.ts

@@ -29,7 +29,7 @@
 //     process also streams live audio, so that blocked the event loop. Now async
 //     and cached against file identity.
 //  4. The filename filter matched iCloud sync-conflict duplicates. On this machine
-//     `.session_index_cache_Ukaoma-Mac-Studio 3.json` shares 543 of its 602 rows
+//     `.session_index_cache_Example-Mac-Studio 3.json` shares 543 of its 602 rows
 //     with the canonical file, so the merged list served 543 duplicates. Filtering
 //     ` N` filenames out would be wrong in the other direction: ` 2.json` holds 245
 //     rows that appear nowhere else. Dedupe therefore happens by session_id, newest

package/server/routes/thread-turn-queue.ts

@@ -102,13 +102,17 @@ export async function drainThread(
 
   let delivered = 0, held = 0, retired = 0
   let dirty = false
+  let refusedGate: ReturnType<ThreadTurnQueueDeps['occupancy']> | null = null
 
   for (const turn of queue) {
     if (turn.status !== 'waiting') continue
 
-    // Observed FRESH for each turn: delivering one makes the thread busy again, so a
-    // verdict from the top of the loop would be stale by the second item.
-    const gate = deps.occupancy(provider, threadId)
+    // Reuse only refusal within this synchronous pass. Rechecking a busy thread
+    // for every queued row repeats a whole-process descriptor scan. A refusal
+    // can delay delivery until the next sweep, but can never authorize a write.
+    // Positive verdicts and all checks after a delivery remain fresh.
+    const gate: ReturnType<ThreadTurnQueueDeps['occupancy']> = refusedGate ?? deps.occupancy(provider, threadId)
+    if (!gate.attachable) refusedGate = gate
     const seen: DrainObservation = {
       attachable: gate.attachable,
       turnEnded: deps.turnEnded(provider, threadId),
@@ -135,11 +139,13 @@ export async function drainThread(
     dirty = true
 
     let outcome: { ok: boolean; reason?: string; serverRetryable?: boolean }
+    refusedGate = null
     try {
       outcome = await deps.deliver(turn)
     } catch (error) {
       outcome = { ok: false, reason: error instanceof Error ? error.message : 'deliver_threw' }
     }
+    refusedGate = null
 
     if (outcome.ok) {
       turn.status = 'delivered'
@@ -147,7 +153,7 @@ export async function drainThread(
       delivered += 1
     } else if (isRetryableDelivery(outcome)) {
       // A GATE REFUSAL IS NOT A FAILED DELIVERY, so it must not spend the ceiling --
-      // measured cost of getting this wrong: three of Miles's turns retired in about
+      // measured cost of getting this wrong: three of the user's turns retired in about
       // two minutes each, never delivered, while the 6h TTL never got to matter.
       //
       // REFUNDED, not deferred. The increment and its fsync stay BEFORE the call

package/server/routes/transcribe-stream.ts

@@ -144,7 +144,7 @@ const THANKYOU_FILTER = process.env.COS_WHISPER_THANKYOU_FILTER !== '0'
 const MEETING_PREVIEW_MAX_BYTES = 512 * 1024
 let meetingPreviewBusy = false
 
-// DEFAULT ON as of 6.21.22 (Miles, 2026-08-06: "I want it to default to being
+// DEFAULT ON as of 6.21.22 (the user, 2026-08-06: "I want it to default to being
 // on... it's stable and makes meetings so much better"). Opt-OUT now, matching
 // STRIP_BRAND_URLS / THANKYOU_FILTER above: set COS_WHISPER_MEETING_PREVIEW=0
 // to disable. The committed Large-v3 transcript remains authoritative and