@gotcos/glasses-server 6.44.16 → 6.45.1

package/server/lib/agent-session-store.ts

@@ -111,7 +111,7 @@ export function isScratchCursorProject(folder: string): boolean {
 export const isSkippedCursorFolder = isScratchCursorProject
 
 /**
- * Titles that belong to a MACHINE, not to a conversation Miles had.
+ * Titles that belong to a MACHINE, not to a conversation the user had.
  *
  * Measured 2026-08-18 by driving the real collector over the 1,296 Claude transcripts on
  * this machine: of the 41 Claude docs it indexed, 28 were machine prompts -- 22 Slack
@@ -141,7 +141,7 @@ export function isKeepWarmSessionTitle(title: string): boolean {
 /**
  * The compaction preamble, which the harness writes as a USER turn.
  *
- * Miles's 2026-08-17 screenshot had this sitting in the DISCUSSION list as though he
+ * the user's 2026-08-17 screenshot had this sitting in the DISCUSSION list as though he
  * had asked it: "This session is being continued from a previous conversation… Summary:
  * ## 1. Primary Request and Intent". It is scaffolding, and it lands in the digest at
  * full length because it IS recent -- compaction happens mid-session -- so recency
@@ -251,7 +251,7 @@ export function proseSnippet(text: string, max = 160): string {
  * swipes of deliberate reading; 21,757 would be 109. Bounded on purpose: this
  * crosses a phone radio and renders on a 576x288 HUD.
  *
- * WHY NOT LOWER. 2,000 would still cut 7.5% of replies, and Miles's 1,821-char reply
+ * WHY NOT LOWER. 2,000 would still cut 7.5% of replies, and the user's 1,821-char reply
  * — the one that started this — sits inside the band that a 2,000 cap leaves with no
  * headroom at all.
  */
@@ -311,7 +311,7 @@ const DIGEST_TURN_MAX = 220
  * "frames everything after it" -- see the head-first block in composeDiscussionDigest,
  * which was itself a fix for a digest that spent everything on the tail.
  *
- * Miles overruled it from hardware, 2026-08-17, looking at a digest whose first two
+ * the user overruled it from hardware, 2026-08-17, looking at a digest whose first two
  * bullets were a question from the previous day and a compaction preamble: "It needs to
  * refresh to the most recent response inside of the thread. The discussion should show
  * the questions that we're asking and a summary of those most recent things, not
@@ -322,7 +322,7 @@ const DIGEST_TURN_MAX = 220
  * occupying the two most valuable slots in a list about what is happening NOW.
  *
  * Left as a constant rather than deleting the head path: this is a judgement call about
- * emphasis, and one number is the whole reversal if Miles wants some framing back.
+ * emphasis, and one number is the whole reversal if the user wants some framing back.
  */
 const DIGEST_HEAD_TURNS = 0
 
@@ -641,14 +641,96 @@ export function normalizeClaudeSessionId(raw: string): string {
   return id
 }
 
-export function peekClaudeDesktopHead(text: string): { title: string; cwd: string } {
-  const unescape = (value: string) => value.replace(/\\"/g, '"').replace(/\\\\/g, '\\')
-  const title = /"title"\s*:\s*"((?:\\.|[^"\\])*)"/.exec(text)
-  const cwd = /"cwd"\s*:\s*"((?:\\.|[^"\\])*)"/.exec(text)
+/** Read completed top-level fields from a bounded JSON prefix. Nested transcript
+ * strings are not metadata. Repeated keys and non-string values fail closed. */
+export function desktopMetadataPrefix(text: string): { fields: Map<string, string | null>; complete: boolean } {
+  const fields = new Map<string, string | null>()
+  let i = 0
+  const space = () => { while (/\s/.test(text[i] || '') && i < text.length) i++ }
+  const string = (): string | undefined => {
+    const start = i
+    if (text[i++] !== '"') return undefined
+    let escaped = false
+    while (i < text.length) {
+      const ch = text[i++]
+      if (!escaped && ch === '"') {
+        try { return JSON.parse(text.slice(start, i)) as string } catch { return undefined }
+      }
+      if (!escaped && ch === '\\') escaped = true
+      else escaped = false
+    }
+    return undefined
+  }
+  space()
+  if (text[i++] !== '{') return { fields, complete: false }
+  while (i < text.length) {
+    space()
+    if (text[i] === '}') return { fields, complete: true }
+    const key = string(); if (key === undefined) break
+    space(); if (text[i++] !== ':') break
+    space()
+    let value: string | null = null
+    if (text[i] === '"') { const parsed = string(); if (parsed === undefined) break; value = parsed }
+    else {
+      let depth = 0, inString = false, escaped = false
+      while (i < text.length) {
+        const ch = text[i]
+        if (!inString && depth === 0 && (ch === ',' || ch === '}')) break
+        i++
+        if (inString) {
+          if (!escaped && ch === '"') inString = false
+          if (!escaped && ch === '\\') escaped = true; else escaped = false
+        } else if (ch === '"') inString = true
+        else if (ch === '{' || ch === '[') depth++
+        else if (ch === '}' || ch === ']') depth--
+      }
+      if (i === text.length) break
+    }
+    fields.set(key, fields.has(key) ? null : value)
+    space()
+    if (text[i] === '}') return { fields, complete: true }
+    if (text[i++] !== ',') break
+  }
+  return { fields, complete: false }
+}
+
+export function peekClaudeDesktopHead(text: string): { title: string; cwd: string; cliSessionId: string } {
+  const { fields, complete } = desktopMetadataPrefix(text)
+  const cli = fields.get('cliSessionId')
+  const normalized = typeof cli === 'string' ? normalizeClaudeSessionId(cli) : ''
   return {
-    title: title ? unescape(title[1]).slice(0, 120) : '',
-    cwd: cwd ? unescape(cwd[1]) : '',
+    title: (fields.get('title') || '').slice(0, 120),
+    cwd: fields.get('cwd') || '',
+    cliSessionId: fields.has('cliSessionId')
+      ? (CLAUDE_UUID_JSONL.test(normalized + '.jsonl') ? normalized : '!invalid')
+      : (complete ? '' : '!unreadable'),
+  }
+}
+
+type ClaudeDesktopHead = ReturnType<typeof peekClaudeDesktopHead> & { file: string; mtimeMs: number }
+
+/** Explicit Desktop→CLI aliases only. A conflicting alias cannot select a transcript. */
+export async function loadClaudeDesktopAliases(root: string): Promise<Map<string, ClaudeDesktopHead | null>> {
+  const aliases = new Map<string, ClaudeDesktopHead | null>()
+  if (!root) return aliases
+  for (const account of await dirents(root)) {
+    for (const workspace of await dirents(join(root, account))) {
+      const dir = join(root, account, workspace)
+      for (const name of await dirents(dir)) {
+        if (!name.startsWith('local_') || !name.endsWith('.json')) continue
+        const id = normalizeClaudeSessionId(name.slice(0, -5))
+        if (!CLAUDE_UUID_JSONL.test(id + '.jsonl')) continue
+        const file = join(dir, name), st = await fileStat(file)
+        if (!st?.isFile) continue
+        const head = { ...peekClaudeDesktopHead(await readWindow(file, false)), file, mtimeMs: st.mtimeMs }
+        const previous = aliases.get(id)
+        if (previous === null) continue
+        if (previous && previous.cliSessionId !== head.cliSessionId) aliases.set(id, null)
+        else if (!previous || head.mtimeMs >= previous.mtimeMs) aliases.set(id, head)
+      }
+    }
   }
+  return aliases
 }
 
 export async function loadClaudeStarredIds(configPath: string): Promise<Set<string>> {
@@ -851,6 +933,16 @@ export async function listClaudeSessions(
   desktopSessionsRoot = '',
   dropped: AgentSessionListDropped = emptySessionListDropped(),
 ): Promise<AgentSessionRow[]> {
+  const aliases = await loadClaudeDesktopAliases(desktopSessionsRoot)
+  const canonical = (id: string) => { const cli = aliases.get(id)?.cliSessionId; return cli && CLAUDE_UUID_JSONL.test(cli + '.jsonl') ? cli : id }
+  const canonicalStars = new Set([...starredIds].map(canonical))
+  const canonicalLive = new Set([...liveIds].map(canonical))
+  const desktopByCli = new Map<string, ClaudeDesktopHead>()
+  for (const [id, head] of aliases) {
+    if (!head) continue
+    const key = canonical(id), prev = desktopByCli.get(key)
+    if (!prev || head.mtimeMs >= prev.mtimeMs) desktopByCli.set(key, head)
+  }
   const seen = new Set<string>()
   const pinnedCandidates: Array<{ file: string; native: string; project: string; mtimeMs: number; birthtimeMs: number; desktop?: string }> = []
   const recentCandidates: Array<{ file: string; native: string; project: string; mtimeMs: number; birthtimeMs: number; desktop?: string }> = []
@@ -862,11 +954,11 @@ export async function listClaudeSessions(
       if (!CLAUDE_UUID_JSONL.test(name)) continue
       const native = name.slice(0, -6)
       const shortId = native.slice(0, 8)
-      if (liveIds.has(shortId) || liveIds.has(native)) continue
+      if (canonicalLive.has(shortId) || canonicalLive.has(native)) continue
       const file = join(dir, name)
       const st = await fileStat(file)
       if (!st?.isFile) continue
-      const pinned = starredIds.has(native.toLowerCase())
+      const pinned = canonicalStars.has(native.toLowerCase())
       const fresh = now.getTime() - st.mtimeMs <= AGENT_SESSION_MAX_AGE_MS
       if (!pinned && !fresh) {
         dropped.age += 1
@@ -878,15 +970,16 @@ export async function listClaudeSessions(
         project: workspaceLabel(folder),
         mtimeMs: st.mtimeMs,
         birthtimeMs: st.birthtimeMs,
+        desktop: desktopByCli.get(native)?.file,
       }
       seen.add(native.toLowerCase())
       if (pinned) pinnedCandidates.push(candidate)
       else recentCandidates.push(candidate)
     }
   }
-  for (const starred of starredIds) {
-    if (seen.has(starred) || liveIds.has(starred) || liveIds.has(starred.slice(0, 8))) continue
-    const desktop = await findClaudeDesktopFile(desktopSessionsRoot, starred)
+  for (const starred of canonicalStars) {
+    if (seen.has(starred) || canonicalLive.has(starred) || canonicalLive.has(starred.slice(0, 8))) continue
+    const desktop = desktopByCli.get(starred)?.file
     if (!desktop) continue
     const st = await fileStat(desktop)
     if (!st?.isFile) continue
@@ -921,11 +1014,11 @@ export async function listClaudeSessions(
         title = peek.customTitle ?? firstPrompt
         latestAssistant = peek.latestAssistant
       }
-      if ((!title || !project) && (candidate.desktop || desktopSessionsRoot)) {
+      if (candidate.desktop || !title || !project) {
         const desktop = candidate.desktop || await findClaudeDesktopFile(desktopSessionsRoot, candidate.native)
         if (desktop) {
           const head = peekClaudeDesktopHead(await readWindow(desktop, false))
-          if (!title && head.title) title = head.title
+          if (head.title) title = head.title
           if (!project && head.cwd) project = workspaceLabel(head.cwd)
         }
       }
@@ -939,7 +1032,7 @@ export async function listClaudeSessions(
         modified: isoFromMtime(candidate.mtimeMs),
         created: isoFromMtime(candidate.birthtimeMs),
         alive: false,
-        pinned: starredIds.has(candidate.native.toLowerCase()),
+        pinned: canonicalStars.has(candidate.native.toLowerCase()),
         ...discussionFields(title, firstPrompt, latestAssistant),
       }))
     }
@@ -997,9 +1090,9 @@ export async function listCodexSessions(
       // `session_meta` record wholesale, so the new rollout carries the PARENT's id
       // while its filename carries its own.
       //
-      // Miles forked "Markt POS 2.0 build" into "POS Nation 3.0 build" and the fork
+      // the user forked "Example project 2.0 build" into "Example project 3.0 build" and the fork
       // never appeared in the session list. It had not failed to index -- it was indexed
-      // AS its parent, so the list showed one `Markt POS 2.0 build` row whose modified
+      // AS its parent, so the list showed one `Example project 2.0 build` row whose modified
       // time was the fork's activity. Two conversations, one identity, and the newer one
       // invisible.
       //
@@ -1183,7 +1276,11 @@ export async function listAgentSessions(
   sort: AgentSessionSort = 'updated',
   dropped: AgentSessionListDropped = emptySessionListDropped(),
 ): Promise<AgentSessionRow[]> {
-  const starredIds = await loadClaudeStarredIds(roots.claudeDesktopConfig)
+  const originalStars = await loadClaudeStarredIds(roots.claudeDesktopConfig)
+  const aliases = await loadClaudeDesktopAliases(roots.claudeCodeSessions)
+  const canonical = (id: string) => { const cli = aliases.get(id)?.cliSessionId; return cli && CLAUDE_UUID_JSONL.test(cli + '.jsonl') ? cli : id }
+  const starredIds = new Set([...originalStars].map(canonical))
+  live = live.map(row => row.provider === 'claude' ? { ...row, session_id: canonical(normalizeClaudeSessionId(row.session_id)) } : row)
   const cursorPinned = await loadCursorPinnedIds(roots.cursorWorkspaceStorage)
   const enrichedLive = (await Promise.all(live.map(row => enrichLiveClaude(row, roots))))
     .filter(entry => !isKeepWarmSessionTitle(entry.display_label))
@@ -1233,15 +1330,29 @@ export async function findAgentSessionFile(
   if (!isSafeSessionId(sessionId)) return null
   const needle = sessionId.trim().toLowerCase()
   if (provider === 'claude') {
+    const aliases = await loadClaudeDesktopAliases(roots.claudeCodeSessions)
+    const files = new Map<string, string[]>()
     for (const folder of await dirents(roots.claudeProjects)) {
       const dir = join(roots.claudeProjects, folder)
       for (const name of await dirents(dir)) {
-        if (!name.endsWith('.jsonl')) continue
+        if (!CLAUDE_UUID_JSONL.test(name)) continue
+        const file = join(dir, name)
+        if (!(await fileStat(file))?.isFile) continue
         const id = name.slice(0, -6).toLowerCase()
-        if (id === needle || id.startsWith(needle)) return join(dir, name)
+        files.set(id, [...(files.get(id) || []), file])
       }
     }
-    return null
+    const exact = aliases.has(needle) || files.has(needle)
+    const ids = new Set<string>()
+    for (const [id, head] of aliases) {
+      if (!(exact ? id === needle : id.startsWith(needle))) continue
+      if (!head) return null
+      ids.add(head.cliSessionId || id)
+    }
+    for (const id of files.keys()) if (exact ? id === needle : id.startsWith(needle)) ids.add(id)
+    if (ids.size !== 1) return null
+    const matches = files.get([...ids][0]) || []
+    return matches.length === 1 ? matches[0] : null
   }
   if (provider === 'codex') {
     for (const file of await listCodexJsonlFiles(roots.codexSessions)) {
@@ -1469,18 +1580,18 @@ export async function parseAgentSession(
   /**
    * Add a user turn to the recency digest -- or decline to.
    *
-   * TWO DECLINES, both found by parsing Miles's own 94 MiB session rather than by
+   * TWO DECLINES, both found by parsing the user's own 94 MiB session rather than by
    * reasoning about the code.
    *
    * `injected`: STRUCTURAL, not a heuristic. Claude marks a slash-command body with
    * `isMeta: true` and a compaction preamble with `isCompactSummary: true`. Both are
-   * written as USER rows, so both rendered in the digest as things Miles had asked --
+   * written as USER rows, so both rendered in the digest as things the user had asked --
    * his screenshot led with "This session is being continued from a previous
    * conversation… Summary: ## 1. Primary Request and Intent". Neither is an ask, and
    * both are recent, so recency ordering alone leaves them exactly where they were.
    *
    * `fromTail` on a TRUNCATED read: the head window IS the session opening. Feeding it
-   * into a recency list is the very thing Miles objected to -- "not something that's
+   * into a recency list is the very thing the user objected to -- "not something that's
    * the 'first' message" -- and on a large session the 60-turn window never fills, so
    * those opening turns survive to the top of the digest forever. Measured on his
    * session: the two leading bullets were both head-window turns from the previous day.

package/server/lib/archive-search.ts

@@ -72,7 +72,7 @@ function cleanSnippet(raw: string): string {
  * Count matches in `hayLower` but cut snippets from `hayOriginal`.
  *
  * Matching has to happen on the lowercased text for case-insensitivity, but a
- * snippet cut from that text renders as all-lowercase prose -- "chelsie owes the
+ * snippet cut from that text renders as all-lowercase prose -- "casey owes the
  * sales-vs-education split" -- which reads like broken data in a UI. The offsets
  * line up because toLowerCase() is length-preserving for effectively all real
  * archive text; where it is NOT (a handful of exotic codepoints expand), the

package/server/lib/attached-provider-adapter.ts

@@ -405,7 +405,7 @@ const STRIPPED_ENV_KEYS: readonly string[] = ['CLAUDECODE', 'COS_API_TOKEN']
  * the prompt is the user's private text; stdin also matches what both ordinary
  * bridges already do.
  *
- * THE TURN INHERITS THE SESSION'S OWN PERMISSIONS (Miles, 2026-08-16, explicit).
+ * THE TURN INHERITS THE SESSION'S OWN PERMISSIONS (the user, 2026-08-16, explicit).
  *
  * This used to force two independent read-only layers: `--permission-mode plan`
  * plus an empty `--tools`/`--allowedTools` pair. The result was a Continue that

package/server/lib/attached-workspace.ts

@@ -8,9 +8,9 @@
 // WHY NOT DECODE THE PROJECT SLUG. Claude files transcripts under
 // `~/.claude/projects/<slug>/<id>.jsonl` where the slug is the cwd with separators
 // replaced. Decoding it back is LOSSY and wrong on this very machine:
-//     slug   -Users-ukaoma-Documents-GitHub-Ukaoma-Chief-Of-Staff-MU-Chief-Staff
-//     naive  /Users/ukaoma/Documents/GitHub/Ukaoma/Chief/Of/Staff/MU/Chief/Staff
-//     real   /Users/ukaoma/Documents/GitHub/Ukaoma Chief Of Staff/MU-Chief-Staff
+//     slug   -Users-example-Documents-GitHub-Example-Chief-Of-Staff-MU-Chief-Staff
+//     naive  /Users/example/Documents/GitHub/Example/Chief/Of/Staff/MU/Chief/Staff
+//     real   /Users/example/Documents/GitHub/Example Chief Of Staff/MU-Chief-Staff
 // The real path contains spaces AND hyphens, so the mapping is not invertible.
 // Resuming in the wrong cwd is not a harmless error: Claude associates a session
 // with its project, so a mismatched cwd risks writing a NEW session instead of

package/server/lib/chunk-embedding-store.ts

@@ -38,7 +38,7 @@ export const EXPECTED_EMBEDDING_DIM = 192
  * non-invertible timbre vectors, so the privacy argument that motivates a short
  * audio window does not carry across unchanged.
  *
- * Flagged for Miles rather than assumed: if he wants these on the 8-hour clock
+ * Flagged for the user rather than assumed: if he wants these on the 8-hour clock
  * too, set the env var to a fraction and the correction loop becomes same-day
  * only.
  */

package/server/lib/context-files.ts

@@ -97,7 +97,7 @@ const NOTE_EXTENSIONS = ['.md', '.markdown', '.txt']
  *
  * SYMLINKS ARE FIRST-CLASS, and that is a correction. A `Dirent` reports a symlink
  * as `isSymbolicLink()`, NOT as `isDirectory()` or `isFile()`, so the first version
- * of this walk silently skipped every linked file and linked subfolder. Queen hit
+ * of this walk silently skipped every linked file and linked subfolder. Sam hit
  * exactly that on 2026-08-09: she wired `operations/memory` at her real note store
  * with a symlink, which worked only because `findDir` uses `statSync` and follows
  * links — anything linked one level deeper would have vanished with no error.

package/server/lib/cos-context-browser.ts

@@ -2,7 +2,7 @@
 // one id space, disjoint prefixes — so a reference is never ambiguous about which
 // one it means. `.` is permitted because a file id carries its extension; it
 // cannot traverse, since `/` is excluded and a bare `..` cannot match the prefix.
-export const MEMORY_ID_PATTERN = /^(?:mem|file)_[A-Za-z0-9._:-]{1,120}$/
+export const MEMORY_ID_PATTERN = /^(?:mem|file|point)_[A-Za-z0-9._:-]{1,160}$/
 export const THREAD_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/
 
 const CONTROL_CHARS = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g
@@ -33,7 +33,7 @@ const UNC_PATH = /\\\\[A-Za-z0-9._-]+\\(?:[^\\\r\n]+\\?)*/g
 /**
  * Trim a greedy path match back to its last plausible component.
  *
- * Keeps `…/Ukaoma Chief Of Staff/MU/ops/comp.md` whole (every space is followed by
+ * Keeps `…/Example Chief Of Staff/MU/ops/comp.md` whole (every space is followed by
  * more path) while not swallowing the trailing prose in `/Users/me/x.md here`.
  * A component qualifies if it is followed by a `/` or contains a dot.
  */
@@ -208,7 +208,7 @@ export function normalizeMemoryList(value: unknown, limit: number): MemoryListIt
   for (const row of value.slice(0, Math.max(0, Math.min(limit, 50)))) {
     if (!row || typeof row !== 'object' || Array.isArray(row)) continue
     const source = row as Record<string, unknown>
-    const id = cleanContextText(source.id, 128)
+    const id = cleanContextText(source.id, 170)
     if (!MEMORY_ID_PATTERN.test(id)) continue
     result.push({
       id,
@@ -242,7 +242,7 @@ export function normalizeMemoryDetail(value: unknown): (MemoryListItem & {
 function normalizeThread(value: unknown, detail: boolean): ThreadListItem | null {
   if (!value || typeof value !== 'object' || Array.isArray(value)) return null
   const source = value as Record<string, unknown>
-  const id = cleanContextText(source.id, 128)
+  const id = cleanContextText(source.id, 170)
   if (!THREAD_ID_PATTERN.test(id)) return null
   const rawMeetings = Array.isArray(source.meetings) && source.meetings.length
     ? source.meetings
@@ -663,6 +663,7 @@ export function normalizeGraphStatus(value: unknown): Record<string, unknown> {
   const processor = asRecord(source.processor) ?? {}
   const indexState = stringOrAbsent(source.index_state, 32)
   return {
+    engine: stringOrAbsent(source.engine, 48) ?? 'lightrag',
     entities: integerOrAbsent(source.entities) ?? null,
     relationships: integerOrAbsent(source.relationships) ?? null,
     source_updated_at: isoOrAbsent(source.source_updated_at) ?? null,
@@ -913,7 +914,16 @@ export function normalizeExtractionBlock(value: unknown): Record<string, unknown
     const r = asRecord(row); const id = r ? stringOrAbsent(r.id, 16) : undefined
     return id ? [{ id, label: stringOrAbsent(r!.label, 40) ?? id, detail: stringOrAbsent(r!.detail, 200) ?? '', selected: r!.selected === true }] : []
   })
-  return { tier: stringOrAbsent(x.tier, 16) ?? null, label: stringOrAbsent(x.label, 40) ?? null, detail: stringOrAbsent(x.detail, 200) ?? null, tiers }
+  const run = asRecord(x.execution)
+  const execution = run ? {
+    provider: stringOrAbsent(run.provider, 40) ?? null,
+    requested_model: stringOrAbsent(run.requested_model, 120) ?? null,
+    reasoning_effort: stringOrAbsent(run.reasoning_effort, 20) ?? null,
+    actual_identity: stringOrAbsent(run.actual_identity, 120) ?? 'unverified',
+    state: stringOrAbsent(run.state, 40) ?? 'unknown',
+    error: stringOrAbsent(run.error, 160) ?? null,
+  } : null
+  return { tier: stringOrAbsent(x.tier, 16) ?? null, label: stringOrAbsent(x.label, 40) ?? null, detail: stringOrAbsent(x.detail, 200) ?? null, tiers, execution }
 }
 export interface KnowledgeSetupSource { path: string; enabled: boolean; exists: boolean; files: number | null; added_at: string | null }
 
@@ -980,11 +990,19 @@ export function normalizeSampleKickoff(value: unknown): Record<string, unknown>
 }
 
 /** `graph-ask`: one answer from the graph, bounded. */
-export function normalizeGraphAnswer(value: unknown): { question: string; mode: string; answer: string; elapsed_s: number | null } | null {
+export function normalizeGraphAnswer(value: unknown): { question: string; mode: string; answer: string; elapsed_s: number | null; investigation?: Record<string, unknown> } | null {
   const s = asRecord(value) ?? {}
   const answer = typeof s.answer === 'string' ? s.answer.slice(0, 20_000) : null
   if (answer === null) return null
-  return { question: stringOrAbsent(s.question, KNOWLEDGE_ASK_MAX_CHARS) ?? '', mode: stringOrAbsent(s.mode, 16) ?? 'hybrid', answer, elapsed_s: typeof s.elapsed_s === 'number' && Number.isFinite(s.elapsed_s) ? s.elapsed_s : null }
+  const candidate = asRecord(s.investigation)
+  let investigation: Record<string, unknown> | undefined
+  if (candidate?.status === 'unavailable') investigation = { status: 'unavailable', message: stringOrAbsent(candidate.message, 500) ?? 'No verified graph plan is available.' }
+  if (candidate?.status === 'ready' && Array.isArray(candidate.nodes) && candidate.nodes.length <= 200 && Array.isArray(candidate.links) && candidate.links.length <= 500 && JSON.stringify(candidate).length <= 500_000) {
+    // Python validates this read-only plan against the policy-filtered graph and generation.
+    // Forward only the canvas contract; it never becomes an arbitrary workspace request.
+    investigation = Object.fromEntries(['status','message','nodes','links','anchors','waypoints','filters','paths','generation','truncated','truncation_reason','scope'].filter(key => candidate[key] !== undefined).map(key => [key, candidate[key]]))
+  }
+  return { question: stringOrAbsent(s.question, KNOWLEDGE_ASK_MAX_CHARS) ?? '', mode: stringOrAbsent(s.mode, 16) ?? 'hybrid', answer, elapsed_s: typeof s.elapsed_s === 'number' && Number.isFinite(s.elapsed_s) ? s.elapsed_s : null, ...(investigation ? { investigation } : {}) }
 }
 
 export interface IngestProgressItem { id: string; outcome: 'indexed' | 'failed' | 'unknown'; seconds: number | null; reason: string | null }
@@ -1032,7 +1050,8 @@ export function normalizeGuardrails(value: unknown): Record<string, unknown> | n
     max_repeat_ratio: typeof g.max_repeat_ratio === 'number' && Number.isFinite(g.max_repeat_ratio) ? g.max_repeat_ratio : 0.5,
     banned_patterns: (Array.isArray(g.banned_patterns) ? g.banned_patterns : []).filter((p): p is string => typeof p === 'string').slice(0, 50).map(p => p.slice(0, 200)),
     llm_review: {
-      enabled: llm.enabled === true,
+      ...(typeof llm.supported === 'boolean' ? { supported: llm.supported } : {}),
+      enabled: llm.supported !== false && llm.enabled === true,
       model: (GUARDRAIL_LLM_TIERS as readonly string[]).includes(String(llm.model)) ? String(llm.model) : 'haiku',
       max_per_run: integerOrAbsent(llm.max_per_run) ?? 20,
     },

package/server/lib/cos-operations-meetings.ts

@@ -574,7 +574,7 @@ export function listCosOperationsMeetings(options: {
               meta.mutable = true
               meta.canonicalRecord = `operations/${domain}/meetings/${month}/${file}`
               // The sidecar is gitignored in the operations tree, so a G2 recording
-              // whose markdown arrived through git or iCloud (three of Miles's KC-week
+              // whose markdown arrived through git or iCloud (three of the user's KC-week
               // recordings, 2026-09-08) sits there without one and the row loses its
               // session id, which reads as "cannot be reviewed". The server that saved
               // it still holds the sidecar under its own recordings root by the same

package/server/lib/domains.ts

@@ -160,7 +160,7 @@ export function discoveredTaskDomains(operationsDir: string | null): string[] {
 /**
  * Task domains: configured first, then any directory with a `tasks.md`.
  *
- * Same union rule as `resolveDomains` and for the same reason — Miles has no
+ * Same union rule as `resolveDomains` and for the same reason — the user has no
  * `domains` in his profile, discovery finds his four, and the union is exactly
  * his four, so switching the task store onto this changes nothing about his
  * install while removing one user's business units from everyone else's build.
@@ -182,7 +182,7 @@ export function taskDomainNames(operationsDir: string | null): string[] {
  *    ROUTED before any folder exists.
  *  - On disk but not configured: still listed, so a folder someone made by hand
  *    never becomes invisible. This is also what protects an existing install —
- *    Miles has no `domains` in his profile, discovery finds his four, and the
+ *    the user has no `domains` in his profile, discovery finds his four, and the
  *    union is exactly his four. Nothing is written to his profile and nothing
  *    about his setup changes.
  *  - Neither: the DEFAULTS. Only a genuinely fresh COS ever sees them, which is

package/server/lib/maintenance-lifecycle.ts

@@ -60,7 +60,7 @@ export type MaintenanceWorkKind =
   // Two `task_dispatch` leases (dispatch + reconcile) are expected —
   // acquire() is a concurrent Map, not a per-kind mutex.
   | 'task_dispatch'
-  // Miles-triggered recovery of a quarantined unsaved capture (6.19.0):
+  // the user-triggered recovery of a quarantined unsaved capture (6.19.0):
   // batch-transcribes retained WAVs into a durable scribe. Held for the whole
   // background run so an Update Server drain waits for it like any batch.
   // Long runs are made visible: the active-recovery registry renders a

package/server/lib/meeting-audio-archive.ts

@@ -6,7 +6,7 @@
 // review panel could show a phrase but never let anyone HEAR it, and its own
 // copy said "naming this needs its audio, which is no longer held."
 //
-// Miles's decision: keep a week, so review can happen on a weekend rather than
+// the user's decision: keep a week, so review can happen on a weekend rather than
 // only within hours of the meeting, and stay under 8 GB.
 //
 // SIZING IS MEASURED, NOT GUESSED. Real recording volume over the 14 days to
@@ -30,14 +30,14 @@ import { dataPath } from './data-dir.js'
 
 export const MEETING_AUDIO_DIR = 'meeting-audio'
 
-/** One week, per Miles: review should survive until a weekend. */
+/** One week, per the user: review should survive until a weekend. */
 export function meetingAudioTtlMs(): number {
   const raw = Number(process.env.COS_MEETING_AUDIO_RETENTION_DAYS)
   const days = Number.isFinite(raw) && raw > 0 ? raw : 7
   return days * 24 * 60 * 60 * 1000
 }
 
-/** Total budget for retained meeting audio. Miles: stay under 8 GB. */
+/** Total budget for retained meeting audio. the user: stay under 8 GB. */
 export function meetingAudioMaxBytes(): number {
   const raw = Number(process.env.COS_MEETING_AUDIO_MAX_BYTES)
   return Number.isFinite(raw) && raw > 0 ? raw : 8 * 1024 * 1024 * 1024

package/server/lib/meeting-corrections.ts

@@ -19,8 +19,8 @@
 // WHAT IS DELIBERATELY NOT CORRECTED. The meeting markdown's Summary, Topics,
 // Decisions and Action Items are LLM prose that refers to people by BARE FIRST
 // NAME ("Jeremy pushed back", "Chris raised Beamer sentiment"). Verified on a
-// real scribe: 6 of 12 speakers appear that way. This org has two Kyles, two
-// Jacobuses and two Chrises, so a find/replace on a first name in narrative text
+// real scribe: 6 of 12 speakers appear that way. This org has two Alexes, two
+// Jordans and two Chrises, so a find/replace on a first name in narrative text
 // would silently rewrite a sentence about a different person. Prose is left
 // alone and flagged stale instead — `proseStale` on the applied row.
 
@@ -41,7 +41,7 @@ export type CorrectionPhase = 'intent' | 'applied' | 'failed' | 'confirmed'
  * demoted.
  *
  * Distinct from a rename, and it has to be: `relabelSidecarJson` rejects
- * `from === to`, so "yes, this really is Queen Ukaoma" cannot be expressed as a
+ * `from === to`, so "yes, this really is Sam Example" cannot be expressed as a
  * correction at all. The floor exists because a 0.56 match is not evidence — but
  * a person who was in the room IS evidence, and there was no way to record it.
  * The panel demoted the row, told the reviewer to name it, and then offered a

package/server/lib/meeting-relabel-enrolment.ts

@@ -29,7 +29,7 @@
 //
 // Consequence, measured on `meeting_1786628481833_eagkaz`: naming one voice
 // enrolled 73 of 103 rows belonging to OTHER PEOPLE — 22 chunks of MU (the device
-// owner), 16 Vikas, 10 Vishnu, 8 Niranjan, 7 Anil, 6 Chris, 3 Manoj, 1 Navaz, and
+// owner), 16 Riley, 10 Taylor, 8 Casey, 7 Morgan, 6 Chris, 3 Jordan, 1 Jamie, and
 // only 30 that were actually the named voice. It reported SUCCESS, because rows do
 // come back from the store; they were simply the wrong rows.
 //

package/server/lib/meeting-relabel.ts

@@ -8,7 +8,7 @@
 // (2026-08-06 Health Score V2): 135 sidecar chunks collapse to 46 speaker runs,
 // while the markdown carries 70 turns — and they disagree on who spoke, with the
 // markdown's 4th turn attributed to Joe Karbowski where the sidecar's 4th run
-// says Richard Jenkins. The transcript was rendered from a different
+// says Riley Example. The transcript was rendered from a different
 // segmentation pass. So:
 //
 //   * There is NO mapping from a chunk index to a transcript turn.
@@ -22,7 +22,7 @@
 //
 // AND WHAT IS NEVER REWRITTEN: the Summary / Topics / Decisions / Action Items
 // prose. It refers to people by bare first name — 6 of 12 speakers did so on the
-// meeting above — and this org has two Kyles, two Jacobuses and two Chrises, so
+// meeting above — and this org has two Alexes, two Jordans and two Chrises, so
 // a first-name substitution in narrative text would rewrite sentences about
 // somebody else. Reported as `proseStale` instead.
 

package/server/lib/meeting-scribe-content.ts

@@ -4,7 +4,7 @@
 //
 // v1 floored the attendee block and shipped every other section verbatim. On the
 // 2026-08-06 IJO Post-Mortem — where the review asserts exactly ONE voice — all
-// 14 unasserted names still reached the clipboard, including one Miles had
+// 14 unasserted names still reached the clipboard, including one the user had
 // already confirmed was never in the room, as `[Name]:` transcript labels. The
 // stated contract, "only asserted voices are named", was false for the largest
 // output.
@@ -69,7 +69,7 @@ export interface ParsedScribe {
    * Sections that are none of the above, in document order.
    *
    * v1 discarded these, losing 116,820 characters across the corpus including
-   * `Granola Structured Notes (canonical)` — Miles's own write-up — and
+   * `Granola Structured Notes (canonical)` — the user's own write-up — and
    * `Fathom Action Items (with exact timestamps)`. "Copy the meeting" has to
    * copy the meeting.
    */
@@ -322,7 +322,7 @@ export interface AttendeeRenderOptions {
    *
    * Gating on `voicedMs` instead tripped on 16 of 23 real meetings, because any
    * overlap at all exceeds the union of voiced time — at 70% the line stops being
-   * a signal and becomes boilerplate on something Miles pastes into Slack. Rows
+   * a signal and becomes boilerplate on something the user pastes into Slack. Rows
    * adding to more than the meeting LENGTH is the genuinely confusing case (71m
    * of rows inside a 66-minute meeting), and that is ~10% of meetings.
    */
@@ -380,10 +380,10 @@ export function renderAttendees(voices: AttendeeLine[], o: AttendeeRenderOptions
  * written sentence mangles grammar and can hit the wrong person. So the applied
  * correction row records `proseStale: true` and, until now, NOTHING read it.
  *
- * Real case, 2026-08-07: Miles removed "Clem Ukaoma" from a personal call that
- * was only him and Queen (his father's voice matched a similar profile). All 8
- * label sites were rewritten correctly; the LLM summary still opened "Miles,
- * Queen, and Clem talk through..." and the payload said nothing. An allowlist
+ * Regression example (synthetic names): the user removed "Morgan Example" from a personal call that
+ * had only two participants (a third participant's voice matched a similar profile). All 8
+ * label sites were rewritten correctly; the LLM summary still opened "the user,
+ * Sam, and Morgan talk through..." and the payload said nothing. An allowlist
  * ("this name was not confirmed") is far too weak here — he did not fail to
  * confirm this person, he explicitly said they were not in the room.
  */

package/server/lib/meeting-speaker-review.ts

@@ -54,7 +54,7 @@ export const UNATTRIBUTED = new Set(['Unknown', 'Ext', '', 'Speaker 1', 'Speaker
  * distinct.
  *
  * De-attributing to a single shared `Ext` folded every corrected voice into one
- * row: on the 2026-08-06 Ditto meeting Miles named five wrong attributions, and
+ * row: on the 2026-08-06 Ditto meeting the user named five wrong attributions, and
  * collapsing them would have destroyed his ability to tell those five voices
  * apart afterwards — which is exactly what he then needs playback for. Numbering
  * keeps them separable while asserting no identity.
@@ -80,9 +80,9 @@ export const CONFIDENT_SIMILARITY = 0.65
  *
  * The identifier accepts a match at SEARCH_THRESHOLD = 0.55, so a single segment
  * scoring 0.55 currently arrives in the panel wearing somebody's full name. On
- * Miles's 2026-08-06 Ditto meeting that produced Richard Jenkins (1 segment,
+ * the user's 2026-08-06 Ditto meeting that produced Riley Example (1 segment,
  * 0.60), Luke Henry (1 segment, 0.55), Dylan Jackson (2 segments, 0.58) and
- * Navaz Sharif (3 segments, 0.58) — and he confirmed none of them were in the
+ * Jamie Sharif (3 segments, 0.58) — and he confirmed none of them were in the
  * room. Presenting those as names is the defect; the reviewer then has to undo
  * an assertion the system should never have made.
  *