@gotcos/glasses-server 6.45.0 → 6.45.2

package/CHANGELOG.md

@@ -1,3 +1,20 @@
+## 6.45.2
+
+The G2 Sessions list answers in under a second again instead of eleven, and loading it no longer stalls the rest of the server.
+
+- Memoize Claude Desktop alias heads by file mtime and share one alias map across a list request. `findAgentSessionFile` rebuilt the map from every `local_*.json` (564 files, 119 MB) and stat'ed every transcript on each call, and the list route called it once per live row and once per held thread: sixteen loads per request measured 2026-09-10. It is one load now, and an unchanged file costs one lstat. The finder stats only the transcript it matched.
+- Probe Codex writer locks with one batched, asynchronous `lsof` per list, started alongside the walk and cached for ten seconds, served stale for up to a minute while a refresh runs behind it. The per-lock synchronous probe cost 2.3 s of whole-system descriptor scan per listed Codex row with a lock on disk and blocked the event loop for that long; a `/api/health` poll measured 2.5 s during one list. The attach and turn gates still run the synchronous probe at the moment of the write; the snapshot only feeds the display hint. The detail route reads the same snapshot.
+- Measured on the same Mac, same eight running rows: cold list 2.6 s (was 11.4 to 12.5 s), warm list 0.5 s, detail open 72 ms (was about 650 ms), longest health poll during a list 19 ms (was 2,524 ms). `lsof` exits 1 whenever any requested file has no holder while still listing the others; the batch reads that as the ordinary mixed result rather than a failed probe.
+- Match the resolved spelling of a lock path. `lsof` prints the kernel's path (`/private/var/...` for a `/var/...` lock on macOS, and the target of any symlinked `CODEX_HOME`), so a holder reached through a symlink read as nobody. The attach and turn gates never depended on that reading; the running hint did.
+
+## 6.45.1
+
+Knowledge opens with a bounded graph and supports verified question plans for COS Control 0.5.208.
+
+- Expose the initial overview through the authenticated workspace route. Model-assisted graph answers may carry validated anchors, waypoints and traversal results from the configured advanced pipeline. Plans navigate only; they cannot save or activate knowledge.
+- Add paired owner-name setup and editing with conflict detection, durable private profile writes and preservation of existing vocabulary and settings. Display identity does not transfer journal or indexing authority.
+- Report whether retained captures have a saveable transcript, unfinished transcription, or completed audio with no usable speech. Empty session shells are not advertised as recoverable recordings. Audio and late-upload admission retain their existing protections.
+
 ## 6.45.0
 
 Versioned local memory and explicit session identity for COS Control 0.5.207.

package/memory-runtime/runtime.json

@@ -3,5 +3,5 @@
   "protocol": 1,
   "version": "0.1.0",
   "file": "cos-memory-runtime-0.1.0.tar.gz",
-  "sha256": "1f03e8d3bcc878709bae7580a8c685c1c5494839cebd7f2c79248dbc17e4d512"
+  "sha256": "5dfe8454f3bad21b0bfd38aafd567990337a7cc58c2bcdc1b2dbb84f8af0ae13"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.45.0",
-  "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
+  "version": "6.45.2",
+  "description": "COS Glasses — self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {
     "glasses-server": "bin/cli.cjs",

package/server/lib/agent-session-store.ts

@@ -709,10 +709,41 @@ export function peekClaudeDesktopHead(text: string): { title: string; cwd: strin
 
 type ClaudeDesktopHead = ReturnType<typeof peekClaudeDesktopHead> & { file: string; mtimeMs: number }
 
+/** The alias map one request shares. Null marks an id whose alias records conflict. */
+export type ClaudeAliasMap = Map<string, ClaudeDesktopHead | null>
+
+/**
+ * Per-file memo of the parsed desktop head, keyed by path, invalidated by (mtime, size).
+ *
+ * MEASURED 2026-09-10 on the owner's Mac: 564 `local_*.json` records, 292 of them
+ * over the 256 KB head window, 119 MB read and prefix-parsed per load, 635 ms per
+ * load — and the list route loaded it SIXTEEN times per request (twice in the walk,
+ * once per live row, once per held thread), which was 1.9 GB and ten of the twelve
+ * seconds the G2 Sessions page waited. 547 of the 564 files were older than a week
+ * and had not changed. A record is re-read only when its stat moves; an unchanged
+ * file costs one lstat. Entries for files that vanish are dropped on the next load
+ * of their root, so the memo never outgrows the directory it mirrors.
+ *
+ * `desktopAliasStats` is the test seam: a load that hits the memo reports it there,
+ * so "read once per mtime" is asserted by counting reads rather than by timing.
+ */
+const desktopHeadMemo = new Map<string, { mtimeMs: number; size: number; head: ReturnType<typeof peekClaudeDesktopHead> }>()
+export const desktopAliasStats = { loads: 0, reads: 0, memoHits: 0 }
+
+/** Tests only: forget every memoized head and zero the counters. */
+export function resetDesktopAliasMemo(): void {
+  desktopHeadMemo.clear()
+  desktopAliasStats.loads = 0
+  desktopAliasStats.reads = 0
+  desktopAliasStats.memoHits = 0
+}
+
 /** Explicit Desktop→CLI aliases only. A conflicting alias cannot select a transcript. */
-export async function loadClaudeDesktopAliases(root: string): Promise<Map<string, ClaudeDesktopHead | null>> {
-  const aliases = new Map<string, ClaudeDesktopHead | null>()
+export async function loadClaudeDesktopAliases(root: string): Promise<ClaudeAliasMap> {
+  const aliases: ClaudeAliasMap = new Map()
   if (!root) return aliases
+  desktopAliasStats.loads += 1
+  const seen = new Set<string>()
   for (const account of await dirents(root)) {
     for (const workspace of await dirents(join(root, account))) {
       const dir = join(root, account, workspace)
@@ -722,7 +753,18 @@ export async function loadClaudeDesktopAliases(root: string): Promise<Map<string
         if (!CLAUDE_UUID_JSONL.test(id + '.jsonl')) continue
         const file = join(dir, name), st = await fileStat(file)
         if (!st?.isFile) continue
-        const head = { ...peekClaudeDesktopHead(await readWindow(file, false)), file, mtimeMs: st.mtimeMs }
+        seen.add(file)
+        const memo = desktopHeadMemo.get(file)
+        let peeked: ReturnType<typeof peekClaudeDesktopHead>
+        if (memo && memo.mtimeMs === st.mtimeMs && memo.size === st.size) {
+          peeked = memo.head
+          desktopAliasStats.memoHits += 1
+        } else {
+          peeked = peekClaudeDesktopHead(await readWindow(file, false))
+          desktopHeadMemo.set(file, { mtimeMs: st.mtimeMs, size: st.size, head: peeked })
+          desktopAliasStats.reads += 1
+        }
+        const head = { ...peeked, file, mtimeMs: st.mtimeMs }
         const previous = aliases.get(id)
         if (previous === null) continue
         if (previous && previous.cliSessionId !== head.cliSessionId) aliases.set(id, null)
@@ -730,6 +772,10 @@ export async function loadClaudeDesktopAliases(root: string): Promise<Map<string
       }
     }
   }
+  const prefix = root.endsWith('/') ? root : root + '/'
+  for (const key of desktopHeadMemo.keys()) {
+    if (key.startsWith(prefix) && !seen.has(key)) desktopHeadMemo.delete(key)
+  }
   return aliases
 }
 
@@ -932,8 +978,9 @@ export async function listClaudeSessions(
   starredIds: ReadonlySet<string> = new Set(),
   desktopSessionsRoot = '',
   dropped: AgentSessionListDropped = emptySessionListDropped(),
+  preloadedAliases?: ClaudeAliasMap,
 ): Promise<AgentSessionRow[]> {
-  const aliases = await loadClaudeDesktopAliases(desktopSessionsRoot)
+  const aliases = preloadedAliases ?? await loadClaudeDesktopAliases(desktopSessionsRoot)
   const canonical = (id: string) => { const cli = aliases.get(id)?.cliSessionId; return cli && CLAUDE_UUID_JSONL.test(cli + '.jsonl') ? cli : id }
   const canonicalStars = new Set([...starredIds].map(canonical))
   const canonicalLive = new Set([...liveIds].map(canonical))
@@ -1210,9 +1257,9 @@ export async function listCursorSessions(
   ]
 }
 
-async function enrichLiveClaude(row: AgentSessionRow, roots: AgentSessionRoots): Promise<AgentSessionRow> {
+async function enrichLiveClaude(row: AgentSessionRow, roots: AgentSessionRoots, aliases?: ClaudeAliasMap): Promise<AgentSessionRow> {
   if (row.provider !== 'claude') return row
-  const found = await findAgentSessionFile('claude', row.session_id, roots)
+  const found = await findAgentSessionFile('claude', row.session_id, roots, new Date(), aliases)
   if (!found) return row
   const peek = await peekClaudeDiscussion(found)
   const firstPrompt = await firstClaudeUserTitle(found)
@@ -1275,14 +1322,17 @@ export async function listAgentSessions(
   limit = AGENT_SESSION_LIST_LIMIT,
   sort: AgentSessionSort = 'updated',
   dropped: AgentSessionListDropped = emptySessionListDropped(),
+  preloadedAliases?: ClaudeAliasMap,
 ): Promise<AgentSessionRow[]> {
   const originalStars = await loadClaudeStarredIds(roots.claudeDesktopConfig)
-  const aliases = await loadClaudeDesktopAliases(roots.claudeCodeSessions)
+  // ONE alias load for the whole walk. Before this the walk loaded it here AND
+  // inside listClaudeSessions AND once per live row through the finder.
+  const aliases = preloadedAliases ?? await loadClaudeDesktopAliases(roots.claudeCodeSessions)
   const canonical = (id: string) => { const cli = aliases.get(id)?.cliSessionId; return cli && CLAUDE_UUID_JSONL.test(cli + '.jsonl') ? cli : id }
   const starredIds = new Set([...originalStars].map(canonical))
   live = live.map(row => row.provider === 'claude' ? { ...row, session_id: canonical(normalizeClaudeSessionId(row.session_id)) } : row)
   const cursorPinned = await loadCursorPinnedIds(roots.cursorWorkspaceStorage)
-  const enrichedLive = (await Promise.all(live.map(row => enrichLiveClaude(row, roots))))
+  const enrichedLive = (await Promise.all(live.map(row => enrichLiveClaude(row, roots, aliases))))
     .filter(entry => !isKeepWarmSessionTitle(entry.display_label))
     .map(entry => {
       if (entry.provider === 'claude' && starredIds.has(normalizeClaudeSessionId(entry.session_id))) {
@@ -1297,7 +1347,7 @@ export async function listAgentSessions(
   const cap = AGENT_SESSION_PER_PROVIDER_LIMIT
   let rows = dedupeSessions([
     ...enrichedLive,
-    ...await listClaudeSessions(roots.claudeProjects, now, liveIds, cap, starredIds, roots.claudeCodeSessions, dropped),
+    ...await listClaudeSessions(roots.claudeProjects, now, liveIds, cap, starredIds, roots.claudeCodeSessions, dropped, aliases),
     ...await listCodexSessions(roots.codexSessions, now, cap, dropped),
     ...await listCursorSessions(roots.cursorProjects, now, cap, roots.cursorComposerDb, cursorPinned, dropped),
   ])
@@ -1326,20 +1376,26 @@ export async function findAgentSessionFile(
   sessionId: string,
   roots: AgentSessionRoots,
   now = new Date(),
+  preloadedAliases?: ClaudeAliasMap,
 ): Promise<string | null> {
   if (!isSafeSessionId(sessionId)) return null
   const needle = sessionId.trim().toLowerCase()
   if (provider === 'claude') {
-    const aliases = await loadClaudeDesktopAliases(roots.claudeCodeSessions)
+    // A caller that resolves several ids in one request (the list route: every
+    // live row, then every held thread) hands the map in; each call used to
+    // rebuild it from disk, which is the 16-loads-per-request the memo above
+    // describes. Absent, the memo still makes a rebuild cheap.
+    const aliases = preloadedAliases ?? await loadClaudeDesktopAliases(roots.claudeCodeSessions)
+    // Names only. This used to lstat every transcript on this Mac (1,697 of
+    // them) to keep directories out of the candidate set, on every call. The
+    // isFile check now runs on the one id that matched, below.
     const files = new Map<string, string[]>()
     for (const folder of await dirents(roots.claudeProjects)) {
       const dir = join(roots.claudeProjects, folder)
       for (const name of await dirents(dir)) {
         if (!CLAUDE_UUID_JSONL.test(name)) continue
-        const file = join(dir, name)
-        if (!(await fileStat(file))?.isFile) continue
         const id = name.slice(0, -6).toLowerCase()
-        files.set(id, [...(files.get(id) || []), file])
+        files.set(id, [...(files.get(id) || []), join(dir, name)])
       }
     }
     const exact = aliases.has(needle) || files.has(needle)
@@ -1351,7 +1407,10 @@ export async function findAgentSessionFile(
     }
     for (const id of files.keys()) if (exact ? id === needle : id.startsWith(needle)) ids.add(id)
     if (ids.size !== 1) return null
-    const matches = files.get([...ids][0]) || []
+    const matches: string[] = []
+    for (const file of files.get([...ids][0]) || []) {
+      if ((await fileStat(file))?.isFile) matches.push(file)
+    }
     return matches.length === 1 ? matches[0] : null
   }
   if (provider === 'codex') {

package/server/lib/cos-context-browser.ts

@@ -990,11 +990,19 @@ export function normalizeSampleKickoff(value: unknown): Record<string, unknown>
 }
 
 /** `graph-ask`: one answer from the graph, bounded. */
-export function normalizeGraphAnswer(value: unknown): { question: string; mode: string; answer: string; elapsed_s: number | null } | null {
+export function normalizeGraphAnswer(value: unknown): { question: string; mode: string; answer: string; elapsed_s: number | null; investigation?: Record<string, unknown> } | null {
   const s = asRecord(value) ?? {}
   const answer = typeof s.answer === 'string' ? s.answer.slice(0, 20_000) : null
   if (answer === null) return null
-  return { question: stringOrAbsent(s.question, KNOWLEDGE_ASK_MAX_CHARS) ?? '', mode: stringOrAbsent(s.mode, 16) ?? 'hybrid', answer, elapsed_s: typeof s.elapsed_s === 'number' && Number.isFinite(s.elapsed_s) ? s.elapsed_s : null }
+  const candidate = asRecord(s.investigation)
+  let investigation: Record<string, unknown> | undefined
+  if (candidate?.status === 'unavailable') investigation = { status: 'unavailable', message: stringOrAbsent(candidate.message, 500) ?? 'No verified graph plan is available.' }
+  if (candidate?.status === 'ready' && Array.isArray(candidate.nodes) && candidate.nodes.length <= 200 && Array.isArray(candidate.links) && candidate.links.length <= 500 && JSON.stringify(candidate).length <= 500_000) {
+    // Python validates this read-only plan against the policy-filtered graph and generation.
+    // Forward only the canvas contract; it never becomes an arbitrary workspace request.
+    investigation = Object.fromEntries(['status','message','nodes','links','anchors','waypoints','filters','paths','generation','truncated','truncation_reason','scope'].filter(key => candidate[key] !== undefined).map(key => [key, candidate[key]]))
+  }
+  return { question: stringOrAbsent(s.question, KNOWLEDGE_ASK_MAX_CHARS) ?? '', mode: stringOrAbsent(s.mode, 16) ?? 'hybrid', answer, elapsed_s: typeof s.elapsed_s === 'number' && Number.isFinite(s.elapsed_s) ? s.elapsed_s : null, ...(investigation ? { investigation } : {}) }
 }
 
 export interface IngestProgressItem { id: string; outcome: 'indexed' | 'failed' | 'unknown'; seconds: number | null; reason: string | null }

package/server/lib/meeting-batch-progress.ts

@@ -5,6 +5,7 @@
 import { existsSync, readdirSync, readFileSync, statSync, writeFileSync, unlinkSync } from 'node:fs'
 import { basename, join } from 'node:path'
 import { dataPath } from './data-dir.js'
+import { MeetingFinalizationJobStore, type MeetingFinalizationJob } from './meeting-finalization-jobs.js'
 import { listActiveRecoveries } from './unsaved-audio-quarantine.js'
 
 export const BATCH_PROGRESS_FILENAME = '_batch_progress.json'
@@ -211,27 +212,69 @@ function markerFresh(dir: string, maxAgeMs = 15 * 60_000): boolean {
   }
 }
 
+export interface MeetingSyncSnapshotOptions {
+  /** Test seam. Production health omits this and reads the durable job store
+   *  when `root` is the live pending-batch directory. Custom roots stay empty
+   *  unless the caller injects jobs, so unit tests cannot inherit live handoff. */
+  finalizationJobs?: MeetingFinalizationJob[]
+}
+
+function listFinalizationJobsForSnapshot(
+  root: string,
+  options?: MeetingSyncSnapshotOptions,
+): MeetingFinalizationJob[] {
+  if (options && 'finalizationJobs' in options) return options.finalizationJobs ?? []
+  if (root !== pendingBatchRoot()) return []
+  try {
+    return new MeetingFinalizationJobStore().list()
+  } catch {
+    return []
+  }
+}
+
+function finalizationSyncRow(job: MeetingFinalizationJob): MeetingSyncMeeting {
+  const phase: MeetingSyncMeeting['phase'] = job.phase === 'ops_pending'
+    ? 'persisting'
+    : job.phase === 'batch_pending'
+      ? 'hq_polish'
+      : 'queued'
+  const label = job.phase === 'ops_pending'
+    ? 'Saving to meeting library · do not update/restart'
+    : job.phase === 'batch_pending'
+      ? 'HQ polish · pending handoff'
+      : 'Finishing capture · do not update/restart'
+  return {
+    meetingId: job.sessionId,
+    phase,
+    percent: null,
+    segmentsDone: null,
+    segmentsTotal: null,
+    chunkFiles: 0,
+    updatedAt: job.updatedAt,
+    label,
+  }
+}
+
 /** Snapshot of pending HQ polish work for /api/health and COS Control. */
 export function getMeetingSyncSnapshot(
   root: string = pendingBatchRoot(),
+  options?: MeetingSyncSnapshotOptions,
 ): MeetingSyncSnapshot {
   const meetings: MeetingSyncMeeting[] = []
   const retained: MeetingSyncRetainedMeeting[] = []
-  if (!existsSync(root)) {
-    return { active: false, percent: null, label: 'Idle', blocksRestart: false, meetings, retained }
-  }
-
   let dirs: string[] = []
-  try {
-    dirs = readdirSync(root).filter(name => {
-      try {
-        return statSync(join(root, name)).isDirectory()
-      } catch {
-        return false
-      }
-    })
-  } catch {
-    return { active: false, percent: null, label: 'Idle', blocksRestart: false, meetings, retained }
+  if (existsSync(root)) {
+    try {
+      dirs = readdirSync(root).filter(name => {
+        try {
+          return statSync(join(root, name)).isDirectory()
+        } catch {
+          return false
+        }
+      })
+    } catch {
+      dirs = []
+    }
   }
 
   for (const name of dirs) {
@@ -341,6 +384,17 @@ export function getMeetingSyncSnapshot(
     })
   }
 
+  // After HQ polish clears pending-batch progress, the durable finalizer still
+  // holds meeting_batch_finalization while it writes the library copy. Control
+  // then showed Meeting sync Idle with restart locked (2026-09-09 local 6.45.1
+  // rollout). Same contract as active recoveries: this window is active work.
+  const seen = new Set(meetings.map(meeting => meeting.meetingId))
+  for (const job of listFinalizationJobsForSnapshot(root, options)) {
+    if (seen.has(job.sessionId)) continue
+    seen.add(job.sessionId)
+    meetings.push(finalizationSyncRow(job))
+  }
+
   if (meetings.length === 0) {
     const label = retained.length > 0
       ? `Idle · ${retained.length} retained batch${retained.length === 1 ? '' : 'es'}`

package/server/lib/occupancy-probes.ts

@@ -34,7 +34,8 @@
 //     That is the intended chain: detector_unavailable is for "no such install",
 //     probe_failed is for "the mechanism exists and broke".
 
-import { execFileSync } from 'node:child_process'
+import { execFile, execFileSync } from 'node:child_process'
+import { readdir } from 'node:fs/promises'
 import {
   closeSync,
   constants as fsConstants,
@@ -44,6 +45,7 @@ import {
   openSync,
   readFileSync,
   readdirSync,
+  realpathSync,
   statSync,
 } from 'node:fs'
 import { homedir } from 'node:os'
@@ -358,6 +360,7 @@ export function lockHolders(path: string): number[] {
   // `--` terminates option parsing so a path can never be read as a flag; `-w`
   // suppresses mount-point warnings that would otherwise make a successful probe
   // look like the failure case below.
+  lockSnapshotStats.single += 1
   return interpretLockHolders(runProbe(LSOF_BIN, ['-w', '-t', '--', path], LOCK_PROBE_TIMEOUT_MS), path)
 }
 
@@ -407,6 +410,280 @@ export function interpretLockHolders(out: ProbeOutcome, path: string): number[]
   return [...pids]
 }
 
+// ------------------------------------------------------------- batched lock probe
+//
+// MEASURED 2026-09-10. One `lsof -t` on one lock is a whole-system descriptor scan:
+// 2.25 to 2.35 s on this Mac across three runs, and `lockHolders` runs it with
+// `execFileSync`, so every listed Codex row that still has a writer lock on disk
+// froze the ENTIRE glasses server for that long — a `/api/health` poll measured
+// 2.52 s during one list request. Seven locks sat in `thread-writer-locks`, all held
+// open by the Codex app. Passing all seven paths to a single lsof cost 3.07 s, one
+// scan instead of seven, and the async form leaves the event loop free.
+//
+// THIS IS FOR THE DISPLAY HINT ONLY. `lockHolders` above is unchanged and is what
+// the write gate (`threadOccupancy` at attach and turn time) keeps calling: a fresh
+// synchronous probe at the moment of the write. A snapshot can be up to
+// LOCK_SNAPSHOT_TTL_MS stale, which is fine for a badge and not for a gate.
+//
+// Doubt stays doubt. A path lsof named in a status error is checked with our own
+// lstat exactly as the single probe does: absent means no holders, anything else is
+// recorded as doubt and the wrapper THROWS for that path, so the scan marks the
+// thread degraded rather than free.
+
+/** How long a lock snapshot is FRESH: a list inside this window spawns nothing. */
+export const LOCK_SNAPSHOT_TTL_MS = 10_000
+/**
+ * How long a STALE snapshot may still answer while a refresh runs behind it. A
+ * reopen between 10 s and 60 s after the last probe gets the old badge at once and
+ * the new one on the next poll; past 60 s the list waits for a fresh probe. The
+ * held-lock badge changes on the scale of minutes (a Codex window opening or
+ * closing), so a minute of lag on a display hint is the whole price.
+ */
+export const LOCK_SNAPSHOT_MAX_AGE_MS = 60_000
+
+export interface LockHolderSnapshot {
+  /** Locks directory the snapshot describes. */
+  dir: string
+  /** Epoch ms the probe finished. */
+  at: number
+  /** Holders per lock path. A path present with [] was probed and nobody holds it. */
+  holders: Map<string, number[]>
+  /** Paths the probe could not settle, with the reason. */
+  doubt: Map<string, string>
+}
+
+/**
+ * Counters for tests. `probes` is batched lsof runs; `single` is the synchronous
+ * per-lock `lockHolders` runs, which a list served from a snapshot must never make.
+ */
+export const lockSnapshotStats = { probes: 0, single: 0 }
+
+function refuseUnlessLockPath(path: string): void {
+  if (typeof path !== 'string' || path.length === 0 || path.includes('\0')) {
+    throw new Error('batchLockHolders: refusing an unusable path')
+  }
+  const name = basename(path)
+  if (!name.endsWith('.lock') || !NATIVE_THREAD_ID_RE.test(name.slice(0, -'.lock'.length))) {
+    throw new Error('batchLockHolders: refusing a path that is not a <native-thread-id>.lock')
+  }
+}
+
+/**
+ * Turn one batched `lsof -F pn` run into holders per requested path, or throw when
+ * the run as a whole cannot be trusted.
+ *
+ * Field output is one record per line: `p<pid>` opens a process, then `f<fd>` and
+ * `n<path>` pairs follow for each descriptor. Paths lsof was not asked about are
+ * ignored. A requested path missing from stdout is unheld unless stderr carries a
+ * `status error on <path>` for it, in which case our own lstat decides between
+ * absent (no holders) and doubt.
+ */
+/**
+ * The spellings under which lsof may report a requested lock.
+ *
+ * lsof prints the kernel's resolved path, not the caller's: a lock reached through
+ * macOS's `/var` symlink comes back as `/private/var/...`, and a symlinked
+ * CODEX_HOME does the same. Requested paths keep the caller's spelling as the map
+ * key; the match accepts either spelling. Unresolvable paths keep only the literal.
+ */
+function lsofPathSpellings(path: string): string[] {
+  try {
+    const resolved = realpathSync.native(path)
+    return resolved === path ? [path] : [path, resolved]
+  } catch {
+    return [path]
+  }
+}
+
+export function interpretBatchLockHolders(out: ProbeOutcome, paths: readonly string[]): { holders: Map<string, number[]>; doubt: Map<string, string> } {
+  const holders = new Map<string, number[]>()
+  const doubt = new Map<string, string>()
+  const wanted = new Set(paths)
+  const requestedBySpelling = new Map<string, string[]>()
+  for (const path of wanted) {
+    for (const spelling of lsofPathSpellings(path)) {
+      const list = requestedBySpelling.get(spelling) ?? []
+      list.push(path)
+      requestedBySpelling.set(spelling, list)
+    }
+  }
+  if (!out.ok) {
+    if (out.spawnError !== null) throw new Error(`batchLockHolders: lsof unavailable (${out.spawnError})`)
+    if (out.killed) throw new Error('batchLockHolders: lsof timed out')
+    // MEASURED: lsof exits 1 whenever ANY requested file has no holder, while
+    // still printing the holders of the others. So exit 1 is the ordinary mixed
+    // reading for a batch and its stdout is parsed like a clean run; empty
+    // stdout on exit 1 is "nobody holds any of them". Only another status is a
+    // run this reading cannot trust.
+    if (out.status !== 1) {
+      throw new Error(`batchLockHolders: lsof failed (status=${out.status}) ${out.stderr.trim().slice(0, 160)}`)
+    }
+  }
+  const pidsByPath = new Map<string, Set<number>>()
+  let pid: number | null = null
+  for (const raw of out.stdout.split('\n')) {
+    const line = raw.trimEnd()
+    if (line.length === 0) continue
+    const tag = line[0], value = line.slice(1)
+    if (tag === 'p') {
+      if (!/^\d+$/.test(value)) throw new Error('batchLockHolders: unrecognised lsof output')
+      const parsed = Number(value)
+      if (!isProbablePid(parsed)) throw new Error('batchLockHolders: lsof reported an implausible pid')
+      pid = parsed
+    } else if (tag === 'n') {
+      if (pid === null) throw new Error('batchLockHolders: unrecognised lsof output')
+      const requested = requestedBySpelling.get(value)
+      if (!requested) continue
+      for (const path of requested) {
+        const set = pidsByPath.get(path) ?? new Set<number>()
+        set.add(pid)
+        pidsByPath.set(path, set)
+      }
+    }
+    // `f` and any other field is descriptor detail this reading does not use.
+  }
+  for (const path of wanted) {
+    const pids = pidsByPath.get(path)
+    if (pids) {
+      holders.set(path, [...pids])
+      continue
+    }
+    if (out.stderr.includes(`status error on ${path}:`)) {
+      if (presence(path) === 'absent') holders.set(path, [])
+      else doubt.set(path, 'lsof could not inspect the lock')
+      continue
+    }
+    holders.set(path, [])
+  }
+  return { holders, doubt }
+}
+
+function runProbeAsync(bin: string, args: string[], timeoutMs: number): Promise<ProbeOutcome> {
+  return new Promise(resolve => {
+    execFile(bin, args, {
+      encoding: 'utf8',
+      timeout: timeoutMs,
+      killSignal: 'SIGKILL',
+      maxBuffer: PROBE_MAX_BUFFER,
+      env: probeEnv(),
+    }, (error: any, stdout, stderr) => {
+      if (!error) {
+        resolve({ ok: true, stdout: String(stdout), stderr: String(stderr ?? ''), status: 0, killed: false, spawnError: null })
+        return
+      }
+      const spawned = typeof error?.status === 'number' || typeof error?.code === 'number' || typeof error?.signal === 'string'
+      resolve({
+        ok: false,
+        stdout: String(error?.stdout ?? stdout ?? ''),
+        stderr: String(error?.stderr ?? stderr ?? ''),
+        status: typeof error?.code === 'number' ? error.code : (typeof error?.status === 'number' ? error.status : null),
+        killed: Boolean(error?.killed) || Boolean(error?.signal),
+        spawnError: spawned ? null : String(error?.code ?? error?.message ?? 'spawn failed'),
+      })
+    })
+  })
+}
+
+/**
+ * Holders for many locks in ONE lsof, off the event loop. Empty input spawns nothing.
+ * Throws when the run cannot be trusted; per-path doubt is returned, not thrown.
+ */
+export async function batchLockHolders(paths: readonly string[], timeoutMs = LOCK_PROBE_TIMEOUT_MS): Promise<{ holders: Map<string, number[]>; doubt: Map<string, string> }> {
+  const unique = [...new Set(paths)]
+  for (const path of unique) refuseUnlessLockPath(path)
+  if (unique.length === 0) return { holders: new Map(), doubt: new Map() }
+  lockSnapshotStats.probes += 1
+  const out = await runProbeAsync(LSOF_BIN, ['-w', '-F', 'pn', '--', ...unique], timeoutMs)
+  return interpretBatchLockHolders(out, unique)
+}
+
+let lockSnapshot: LockHolderSnapshot | null = null
+let lockSnapshotInFlight: { dir: string; promise: Promise<LockHolderSnapshot> } | null = null
+
+/** Tests only: drop the cached snapshot and zero the probe counter. */
+export function resetLockSnapshot(): void {
+  lockSnapshot = null
+  lockSnapshotInFlight = null
+  lockSnapshotStats.probes = 0
+  lockSnapshotStats.single = 0
+}
+
+/** The cached snapshot for this locks dir if it is not past MAX_AGE, else null. No I/O. */
+export function peekCodexLockSnapshot(locksDir: string, now = Date.now()): LockHolderSnapshot | null {
+  if (!lockSnapshot || lockSnapshot.dir !== locksDir) return null
+  return now - lockSnapshot.at <= LOCK_SNAPSHOT_MAX_AGE_MS ? lockSnapshot : null
+}
+
+/**
+ * Every lock in the directory, probed in one lsof, cached for LOCK_SNAPSHOT_TTL_MS.
+ *
+ * Reads the directory itself rather than taking the caller's thread ids, so it can be
+ * started before the session walk knows which rows it will list and run alongside
+ * it. Concurrent callers share one in-flight probe. A missing or unreadable
+ * directory yields an EMPTY snapshot: the scan's `fileExists` check already skips a
+ * lock that is not there, and a lock it does find that the snapshot does not cover
+ * falls back to the synchronous probe in `withLockSnapshot`.
+ */
+export async function codexLockSnapshot(locksDir: string, now = Date.now()): Promise<LockHolderSnapshot> {
+  const cached = peekCodexLockSnapshot(locksDir, now)
+  if (cached && now - cached.at <= LOCK_SNAPSHOT_TTL_MS) return cached
+  const inFlight = lockSnapshotInFlight && lockSnapshotInFlight.dir === locksDir ? lockSnapshotInFlight.promise : null
+  // Stale but inside MAX_AGE: answer now, refresh behind the answer.
+  if (cached) {
+    if (!inFlight) void startLockProbe(locksDir, now).catch(() => { /* the next caller retries */ })
+    return cached
+  }
+  if (inFlight) return inFlight
+  return startLockProbe(locksDir, now)
+}
+
+async function startLockProbe(locksDir: string, now: number): Promise<LockHolderSnapshot> {
+  const promise = (async () => {
+    let names: string[] = []
+    try {
+      names = await readdir(locksDir)
+    } catch {
+      names = []
+    }
+    const paths = names
+      .filter(name => name.endsWith('.lock') && NATIVE_THREAD_ID_RE.test(name.slice(0, -'.lock'.length)))
+      .map(name => join(locksDir, name))
+    const result = await batchLockHolders(paths)
+    // Aged from the moment the probe was ASKED for, not from when lsof finished:
+    // a reading is only as fresh as its start, and the caller's clock is the
+    // test seam.
+    const snapshot: LockHolderSnapshot = { dir: locksDir, at: now, holders: result.holders, doubt: result.doubt }
+    lockSnapshot = snapshot
+    return snapshot
+  })()
+  lockSnapshotInFlight = { dir: locksDir, promise }
+  try {
+    return await promise
+  } finally {
+    if (lockSnapshotInFlight?.promise === promise) lockSnapshotInFlight = null
+  }
+}
+
+/**
+ * A probe set whose `lockHolders` answers from the snapshot for the paths it covers.
+ *
+ * A covered path answers synchronously with no spawn; a path in `doubt` THROWS, which
+ * is the same signal the live probe sends and lands the thread on degraded; a path
+ * the snapshot never saw (a lock created after the directory was read) goes to the
+ * wrapped probe, so the fallback is the exact behaviour that shipped before.
+ */
+export function withLockSnapshot(probes: OccupancyProbes, snapshot: LockHolderSnapshot): OccupancyProbes {
+  return {
+    ...probes,
+    lockHolders: (path: string) => {
+      const doubt = snapshot.doubt.get(path)
+      if (doubt !== undefined) throw new Error(`lockHolders: ${doubt}`)
+      const held = snapshot.holders.get(path)
+      return held !== undefined ? [...held] : probes.lockHolders(path)
+    },
+  }
+}
+
 /** Supplies the pid -> process-start map that is the only route to a self-owned verdict. */
 export type SpawnLedgerAccessor = () => ReadonlyMap<number, number>
 

package/server/lib/profile.ts

@@ -1,14 +1,14 @@
 // Profile loader — reads user identity from .cos-profile.json (gitignored)
 // Falls back to generic defaults for users who haven't configured a profile
 
-import { existsSync, readFileSync } from 'node:fs'
+import { existsSync, readFileSync, mkdirSync } from 'node:fs'
 import { homedir } from 'node:os'
-import { resolve } from 'node:path'
+import { resolve, dirname } from 'node:path'
 import { atomicWriteFileSync } from './atomic-fs.js'
 
 const APP_ROOT = resolve(import.meta.dirname, '../..')
 
-const PLACEHOLDER_OWNER_NAMES = new Set(['your name', 'user'])
+const PLACEHOLDER_OWNER_NAMES = new Set(['your name', 'user', 'me', 'owner', 'wearer'])
 const PLACEHOLDER_VOCABULARY = new Set(['nameone', 'nametwo', 'yourcompany', 'productname'])
 const PLACEHOLDER_CORRECTIONS = new Set(['soundalike\u0000yourname'])
 
@@ -53,8 +53,9 @@ export function loadProfileObject(): Record<string, unknown> {
 function loadProfile(): Record<string, unknown> {
   if (profileCache) return profileCache
   try {
-    profileCache = JSON.parse(readFileSync(profilePath(), 'utf-8'))
-    return profileCache!
+    const parsed: unknown = JSON.parse(readFileSync(profilePath(), 'utf-8'))
+    profileCache = parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed as Record<string, unknown> : {}
+    return profileCache
   } catch {
     profileCache = {}
     return profileCache
@@ -98,6 +99,29 @@ export function getOwnerName(): string {
   return !value || PLACEHOLDER_OWNER_NAMES.has(value.toLowerCase()) ? 'User' : value
 }
 
+/** Display identity only. Never reassign journal authority or the ingestion-owner Mac. */
+export function setProfileOwnerName(name: unknown, expected: unknown): string {
+  if (typeof name !== 'string' || !name.trim() || name.trim().length > 120 || /[\x00-\x1f\x7f]/.test(name) || PLACEHOLDER_OWNER_NAMES.has(name.trim().toLowerCase())) throw new Error('invalid_owner_name')
+  if (expected !== null && typeof expected !== 'string') throw new Error('invalid_expected_owner')
+  let current: Record<string, unknown> = {}
+  const source = profilePath()
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(source, 'utf8'))
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) throw new Error('invalid_profile')
+    current = parsed as Record<string, unknown>
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw new Error('profile_unreadable')
+  }
+  const previous = typeof current.owner_name === 'string' ? current.owner_name.trim() : ''
+  const actual = !previous || PLACEHOLDER_OWNER_NAMES.has(previous.toLowerCase()) ? null : previous
+  if (actual !== expected) throw new Error('owner_changed')
+  const target = process.env.COS_PROFILE_PATH?.trim() ? source : homeProfilePath()
+  mkdirSync(dirname(target), { recursive: true, mode: 0o700 })
+  atomicWriteFileSync(target, JSON.stringify({ ...current, owner_name: name.trim() }, null, 2), { mode: 0o600 })
+  clearProfileCache()
+  return name.trim()
+}
+
 /** Short speaker label for the glasses wearer, used by diarization to fast-path
  *  the owner's voiceprint. Defaults to 'Me'. Configure via owner_speaker_label. */
 export function getOwnerSpeakerLabel(): string {

package/server/routes/agent-sessions.ts

@@ -26,9 +26,12 @@ import {
   findAgentSessionFile,
   listAgentSessions,
   emptySessionListDropped,
+  loadClaudeDesktopAliases,
   loadCursorComposerNames,
   parseAgentSession,
   type AgentProvider,
+  type AgentSessionRoots,
+  type ClaudeAliasMap,
   type AgentSessionRow,
   type AgentSessionSort,
 } from '../lib/agent-session-store.js'
@@ -43,7 +46,15 @@ import {
   type OccupiedScan,
   type OccupiedThread,
 } from '../lib/occupied-threads.js'
-import { realOccupancyDirs, realOccupancyProbes } from '../lib/occupancy-probes.js'
+import {
+  codexLockSnapshot,
+  peekCodexLockSnapshot,
+  realOccupancyDirs,
+  realOccupancyProbes,
+  withLockSnapshot,
+  type LockHolderSnapshot,
+} from '../lib/occupancy-probes.js'
+import type { OccupancyDirs } from '../lib/thread-occupancy.js'
 import { cosSpawnedPids } from '../lib/agent-session-ownership-store.js'
 
 export const agentSessionsRouter = Router()
@@ -86,12 +97,17 @@ function toSearchHit(row: AgentSessionSearchHit) {
  * seconds or minutes before the user acts and a desktop session opened in that gap
  * is exactly the race the per-write probe exists to catch.
  */
-function runningThreads(rows: readonly AgentSessionRow[]): OccupiedScan {
+function runningThreads(rows: readonly AgentSessionRow[], dirs: OccupancyDirs, snapshot: LockHolderSnapshot | null): OccupiedScan {
   try {
-    const dirs = realOccupancyDirs()
     // The spawn ledger is what lets a turn COS itself queued read as ours rather
     // than as a foreign desktop window holding the thread.
-    const probes = realOccupancyProbes(cosSpawnedPids)
+    //
+    // Codex lock holders come from ONE batched lsof taken for the whole request
+    // (see `codexLockSnapshot`), not one 2.3 s synchronous scan per listed row.
+    // With no snapshot — the batch failed — the wrapped probe runs exactly as
+    // before, so the worst case is the old cost, never a wrong verdict.
+    const base = realOccupancyProbes(cosSpawnedPids)
+    const probes = snapshot ? withLockSnapshot(base, snapshot) : base
     const byProvider = new Map<string, string[]>()
     for (const row of rows) {
       if (row.provider !== 'claude' && row.provider !== 'codex') continue
@@ -137,13 +153,14 @@ function runningThreads(rows: readonly AgentSessionRow[]): OccupiedScan {
 async function transcriptMtimes(
   scan: OccupiedScan,
   rows: readonly AgentSessionRow[],
+  roots: AgentSessionRoots,
+  aliases: ClaudeAliasMap,
 ): Promise<Map<string, number | null>> {
   const mtimes = new Map<string, number | null>()
   if (scan.occupied.size === 0) return mtimes
 
   const providerById = new Map<string, AgentProvider>()
   for (const row of rows) providerById.set(row.session_id, row.provider)
-  const roots = agentSessionRoots()
 
   await Promise.all([...scan.occupied.keys()].map(async threadId => {
     try {
@@ -155,7 +172,8 @@ async function transcriptMtimes(
         mtimes.set(threadId, null)
         return
       }
-      const file = await findAgentSessionFile(provider, threadId, roots)
+      // The shared alias map: this used to rebuild it from 564 files per held thread.
+      const file = await findAgentSessionFile(provider, threadId, roots, new Date(), aliases)
       mtimes.set(threadId, file ? (await stat(file)).mtimeMs : null)
     } catch {
       mtimes.set(threadId, null)
@@ -222,11 +240,16 @@ function runningForThread(provider: AgentProvider, threadId: string, mtimeMs: nu
   }
   if (provider !== 'claude' && provider !== 'codex') return { occupied: new Map(), degraded: false }
   try {
+    const dirs = realOccupancyDirs()
+    // A detail open inside LOCK_SNAPSHOT_TTL_MS of a list answers from that list's
+    // snapshot; otherwise the single synchronous probe runs as it always has.
+    const snapshot = peekCodexLockSnapshot(dirs.codexLocksDir)
+    const base = realOccupancyProbes(cosSpawnedPids)
     const scan = occupiedThreads(
       provider,
       [threadId],
-      realOccupancyProbes(cosSpawnedPids),
-      realOccupancyDirs(),
+      snapshot ? withLockSnapshot(base, snapshot) : base,
+      dirs,
     )
     return withActiveRecently(scan, new Map([[threadId, mtimeMs]]), Date.now())
   } catch (error) {
@@ -281,14 +304,26 @@ agentSessionsRouter.get('/agent-sessions', async (req, res) => {
   try {
     const limit = boundedInteger(req.query.limit, AGENT_SESSION_LIST_LIMIT, 1, AGENT_SESSION_LIST_MAX)
     const sort = asSort(req.query.sort)
+    const roots = agentSessionRoots()
+    const dirs = realOccupancyDirs()
+    // The lock probe is a 2-3 s lsof that needs only the locks directory, so it
+    // starts NOW and runs under the walk instead of after it. A failed batch is
+    // logged and the scan below falls back to the per-lock probe.
+    const snapshotPromise: Promise<LockHolderSnapshot | null> = codexLockSnapshot(dirs.codexLocksDir).catch(error => {
+      console.error(`[agent-sessions] lock snapshot failed: ${error instanceof Error ? error.message : error}`)
+      return null
+    })
+    // ONE alias load per request, shared by the walk, every live row and every
+    // held thread. Measured 2026-09-10: sixteen loads of 119 MB before this line.
+    const aliases = await loadClaudeDesktopAliases(roots.claudeCodeSessions)
     const live = await liveClaudeRows()
     const dropped = emptySessionListDropped()
-    const sessions = await listAgentSessions(agentSessionRoots(), new Date(), live, limit, sort, dropped)
-    const scan = runningThreads(sessions)
+    const sessions = await listAgentSessions(roots, new Date(), live, limit, sort, dropped, aliases)
+    const scan = runningThreads(sessions, dirs, await snapshotPromise)
     // Freshness is layered on AFTER occupancy, and only over what occupancy
     // found. Cursor has no process occupancy, so the list does not invent a
     // working hint from jsonl mtime — detail still can, from the file it stat'ed.
-    const running = withActiveRecently(scan, await transcriptMtimes(scan, sessions), Date.now())
+    const running = withActiveRecently(scan, await transcriptMtimes(scan, sessions, roots, aliases), Date.now())
     res.json({
       sessions: sessions.map(row => withRunning(toEntry(row), running)),
       total: sessions.length,

package/server/routes/health.ts

@@ -329,6 +329,8 @@ healthRouter.get('/health', async (_req, res) => {
       idleMinutes: item.idleMinutes,
       capturedMinutes: item.capturedMinutes,
       chunks: item.chunks,
+      transcriptState: item.transcriptState,
+      canSave: item.canSave,
       promotesAt: item.promotesAt,
       hasDraft: item.draftPath != null,
     })),

package/server/routes/memory.ts

@@ -1,6 +1,9 @@
 import { Router } from 'express'
 import { callPython, contextSourceAvailable, pythonBridgeState } from '../lib/python-bridge.js'
 import { searchMemories } from '../lib/context-library-search.js'
+import { getOwnerName, setProfileOwnerName } from '../lib/profile.js'
+import { resetDecoderCaches } from '../lib/whisper-local.js'
+import { resetVocabEchoCache } from '../lib/hallucination-filter.js'
 
 /**
  * Is there anything to serve — a Python bridge OR plain files on disk?
@@ -54,6 +57,24 @@ import { normalizeReviewDecision, LEARNING_REVIEW_LIMIT,
 } from '../lib/cos-context-browser.js'
 
 export const memoryRouter = Router()
+// Profile setup is available before a memory bridge is configured. API authentication still applies.
+memoryRouter.get('/context/profile/owner', (_req, res) => {
+  const name = getOwnerName()
+  res.json({ owner_name: name === 'User' ? null : name })
+})
+memoryRouter.post('/context/profile/owner', (req, res) => {
+  try {
+    const body = req.body as Record<string, unknown>
+    if (!body || typeof body !== 'object' || Array.isArray(body) || Object.keys(body).some(key => !['owner_name','expected_owner'].includes(key))) { res.status(400).json({ error: 'invalid_owner_profile' }); return }
+    const name = setProfileOwnerName(body.owner_name, body.expected_owner)
+    resetDecoderCaches(); resetVocabEchoCache()
+    res.json({ owner_name: name })
+  } catch (error) {
+    const message = error instanceof Error ? error.message : ''
+    const reason = ['owner_changed','invalid_owner_name','invalid_expected_owner','profile_unreadable'].includes(message) ? message : 'profile_save_failed'
+    res.status(reason === 'owner_changed' ? 409 : reason.startsWith('invalid_') ? 400 : 503).json({ error: reason })
+  }
+})
 memoryRouter.use((req, res, next) => {
   if (['owner', 'audience', 'authority_host', 'authority_epoch'].some(key => key in req.query || (req.body && key in req.body))) {
     res.status(400).json({ error: 'caller_authority_forbidden' }); return
@@ -62,7 +83,7 @@ memoryRouter.use((req, res, next) => {
 })
 // Additive workspace protocol. The existing /memory array contract remains intact.
 // Authentication is the instance pairing token; caller fields cannot select an owner.
-const WORKSPACE_ACTIONS = new Set(['status', 'graph_expand', 'graph_paths', 'graph_resolve', 'list_explorations', 'get_exploration',
+const WORKSPACE_ACTIONS = new Set(['status', 'graph_overview', 'graph_expand', 'graph_paths', 'graph_resolve', 'list_explorations', 'get_exploration',
   'save_exploration', 'save_assertion', 'policy_get', 'policy_set', 'memory_page', 'learning_page', 'review_page', 'get_memory', 'review_memory', 'trace_summary', 'source_status', 'refresh_source', 'current_sources', 'identity_split_preview', 'identity_status', 'identity_keep_apart', 'rule_page', 'propose_rule', 'review_rule', 'rollback_rule', 'activate_rule', 'rule_evaluation'])
 memoryRouter.post('/context/memory/workspace', async (req, res) => {
   noStore(res)

package/server/routes/transcribe-stream.ts

@@ -463,6 +463,8 @@ export interface StrandedCapture {
   /** Minutes of audio actually captured before it went quiet. */
   capturedMinutes: number
   chunks: number
+  transcriptState: 'ready' | 'processing' | 'no_speech'
+  canSave: boolean
   /** When the sweeper will save this on the user's behalf. */
   promotesAt: string
   /** Readable draft on disk, once the capture has been stale long enough. */
@@ -485,21 +487,30 @@ export interface StrandedCapture {
  */
 export function getStrandedCaptures(now = Date.now()): StrandedCapture[] {
   const drafts = new Map(listStrandedDrafts(STRANDED_DRAFT_DIR).map(d => [d.sessionId, d]))
-  return getTranscriptionSessionLiveness(now).staleSessions.map(stale => {
+  return getTranscriptionSessionLiveness(now).staleSessions.flatMap(stale => {
     const session = sessions.get(stale.sessionId)
     const lastActivityAt = session?.lastActivityAt ?? now - stale.silentForMs
     const draft = drafts.get(stale.sessionId) ?? null
-    return {
+    const received = session?.receivedIndices ?? []
+    // An empty session shell is not evidence that audio was lost. Leave its
+    // ledger open so a backgrounded phone can still upload before retention.
+    if (!stale.chunks && !received.length && !hasSessionAudio(stale.sessionId)) return []
+    const completed = new Set(session?.asrCompletedIndices ?? [])
+    const noSpeech = !stale.chunks && received.length > 0 && received.every(index => completed.has(index))
+    const transcriptState: StrandedCapture['transcriptState'] = stale.chunks ? 'ready' : noSpeech ? 'no_speech' : 'processing'
+    return [{
       sessionId: stale.sessionId,
       idleMinutes: Math.round(stale.silentForMs / 60_000),
       capturedMinutes: Math.round(
         Math.max(0, lastActivityAt - (session?.startTime ?? lastActivityAt)) / 60_000,
       ),
       chunks: stale.chunks,
+      transcriptState,
+      canSave: transcriptState === 'ready',
       promotesAt: new Date(lastActivityAt + LOCAL_FIRST_MEETING_IDLE_RETENTION_MS).toISOString(),
       draftPath: draft?.path ?? null,
       draftBytes: draft?.bytes ?? null,
-    }
+    }]
   })
 }