@gotcos/glasses-server 6.63.0 → 6.64.0

package/CHANGELOG.md

@@ -1,3 +1,27 @@
+## 6.64.0 — 2026-10-06 — Meeting context keys
+
+- Meeting rows and details carry `contextKeys`, `contextSupported`, and, when files can't be added, `contextReason` (plus `contextAmbiguous`). The fields are additive and read-only. They are the keys COS Control 0.5.258 files a meeting's dropped screenshots, slides and documents under, so the files go to every Work card linked to the meeting.
+  - The keys are read from ids the meeting already carries: `g2:<sessionId>` from its `.g2-chunks.json` (or the server's own recordings copy), `ff:<id>` from its `.fireflies.json` (the top-level id, in the first 4 KB), then `g2:<id>` for every `<!-- g2-session -->` it declares.
+  - Nothing is written into a meeting. Identity is an exact id, never a title or a date.
+  - Two live meetings whose own sidecars give the same primary key are `ambiguous`. A merged scribe that only declares its captures never counts as a second claimant, so a merge whose captures are not yet retired is not ambiguous.
+  - Files also can't be added to:
+    - an iCloud conflict copy (`conflict_copy`);
+    - a meeting with no source id (`no_source_id`);
+    - an imported, re-derived or direct-library record (`read_only_record`).
+  - A standalone recording is keyed by its session, and its detail keeps its old shape (no `librarySource`).
+- `GET /api/meetings/context-keys?recordId=…` (1 to 50 ids, read-only) answers the keys behind a Work card's saved meeting links.
+  - A `standalone:` id gives its session.
+  - An `ops:` id is found at its path, after the G2 rename (same month, by the date and time in the filename), or under the same name in another domain of the same month.
+  - Two candidates give no answer.
+  - Control asks before each send, so a card finds the files whichever record id it was linked under.
+- The primary-key index reads only sidecar heads (4 KB), never a meeting body. It is rebuilt per month when that folder changes, and at least once a minute. Measured on 2026-10-06: 649 of 656 meetings from August to October carry a key; an earlier build of the index, which also read meeting bodies, took 376 ms cold and 1 ms warm over the whole tree on the author's Mac (a read-only scratch script).
+- Pairs with COS Control 0.5.258. Older clients ignore the fields.
+
+## 6.63.1 — 2026-10-06 — Weather survives a restart
+
+- Home weather survives a server restart. The last good weather and place are kept in `<data>/welcome-weather.json`; when a forecast lookup fails (timeout, HTTP error, bad payload), the route answers with that saved weather if it is under 3 hours old, never older. A failed forecast or place lookup is now logged once per kind per 10 minutes, with the cause and whether a saved weather was served. Before, after a restart the first failed lookup sent the glasses no weather and nothing said why. Pairs with glasses 6.10.603, which also retries on Home and keeps its own last good weather.
+- Security: `proxy-addr` 2.0.8 (through Express), for GHSA-jqcg-44mw-7w3h (IP spoofing through an IPv4-mapped IPv6 trust subnet). Lockfile only.
+
 ## 6.63.0 — 2026-10-05 — Background forks
 
 - Background forks. `POST /api/agent-sessions/:provider/:threadId/fork` accepts an optional `clientForkId`: once every gate passes it answers 202 and runs the fork in the background, and `GET /api/agent-session-forks/:clientForkId` returns `running` or the exact answer the synchronous route would have sent. A repeated id replays its job and never makes a second copy. Outcomes are kept in `<data>/fork-jobs.json` (7 days, 200 rows); a fork still running when the server stops reads back as orphan-possible ("look in Sessions before forking again"), never as failed. Without the id the route is unchanged. Why: on 2026-10-05 COS Control waited 5 minutes for a 6.5-minute fork that succeeded and told Miles the server had stopped. Pairs with COS Control 0.5.257; older clients keep the synchronous route.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.63.0",
+  "version": "6.64.0",
   "description": "COS Glasses: self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -106,7 +106,7 @@ import { recoveryRouter } from './routes/recovery.js'
 import { promptEditRouter } from './routes/prompt-edit.js'
 import { lensGistRouter } from './routes/lens-gist.js'
 import { bookmarksRouter } from './routes/bookmarks.js'
-import { welcomeContextRouter } from './routes/welcome-context.js'
+import { setWeatherPersistence, welcomeContextRouter } from './routes/welcome-context.js'
 import { liveCuesRouter } from './routes/live-cues.js'
 import { tasksRouter } from './routes/tasks.js'
 import { memoryRouter } from './routes/memory.js'
@@ -143,6 +143,7 @@ import { createWorkIntakeRouter } from './routes/work-intake.js'
 import { createWorkHandoffRequestsRouter } from './routes/work-handoff-requests.js'
 import { createJevRouter } from './routes/jev.js'
 import { dataPath } from './lib/data-dir.js'
+import { loadJsonOrQuarantine, durableAtomicWriteFileSync } from './lib/atomic-fs.js'
 import { WorkIntakeStore, createOptionalWorkIntakeStore } from './lib/work-intake-store.js'
 import { WorkHandoffRequestStore, createOptionalWorkHandoffRequestStore, handoffRequestCapabilities } from './lib/work-handoff-requests.js'
 import { createWorkBoardReader } from './lib/work-board-reader.js'
@@ -1065,6 +1066,11 @@ app.use('/api', recoveryRouter)
 app.use('/api', promptEditRouter)
 app.use('/api', lensGistRouter)
 app.use('/api', bookmarksRouter)
+// 6.63.1: the last good weather and place survive a restart (<data>/welcome-weather.json).
+setWeatherPersistence({
+  load: () => { const r = loadJsonOrQuarantine<unknown>(dataPath('welcome-weather.json')); return r.status === 'ok' ? r.data : null },
+  save: (value) => durableAtomicWriteFileSync(dataPath('welcome-weather.json'), `${JSON.stringify(value)}\n`),
+})
 app.use('/api', welcomeContextRouter)
 app.use('/api', liveCuesRouter)
 app.use('/api', tasksRouter)

package/server/lib/cos-operations-meetings.ts

@@ -20,6 +20,7 @@ import type { MeetingDetail, MeetingMeta } from './meeting-store.js'
 import { MEETING_SOURCE_MAX_BYTES, meetingDayCountsFromNames, meetingListLimit } from './meeting-store.js'
 import { meetingVoiceReview, parseSidecarListHead } from './meeting-voice-review.js'
 import { dataPath } from './data-dir.js'
+import { firefliesSidecarId, meetingContextFields, meetingContextKeys, type MeetingContextFields } from './meeting-context-keys.js'
 
 /**
  * The four domains of ONE user's COS. Retained as the documented example layout
@@ -743,6 +744,102 @@ export function resolveMergedScribe(
   return { status: 'resolved', ...only, path, content }
 }
 
+// ── Meeting context keys (6.64.0) ───────────────────────────────────────────
+//
+// What a meeting's dropped files are filed under in COS Control. See `meeting-context-keys.ts` for why the key is read
+// from source ids and never written. Two live meetings with the same PRIMARY key are ambiguous, so the list and the
+// detail both need to know how many meetings claim each primary key across every domain: that index is kept per month
+// folder and recomputed only when the folder's own stamp moves (every writer of meetings renames into place, so a new or
+// renamed meeting moves it). A warm read is one stat per month folder.
+
+/** The ordered keys for one canonical meeting, from what sits beside it and what it declares. */
+function meetingKeysFor(monthDir: string, filename: string, content: string | null, recordingsRoot: string | null, month: string): string[] {
+  let sessionId = sidecarListHints(monthDir, filename).sessionId
+  if (!sessionId && recordingsRoot) {
+    const fallbackDir = join(recordingsRoot, month)
+    if (existsSync(fallbackDir)) sessionId = sidecarListHints(fallbackDir, filename).sessionId
+  }
+  const firefliesId = firefliesSidecarId(monthDir, filename)
+  // The file is read for its markers only when neither sidecar names it: the primary key is then the first it declares.
+  let declared: string[] = []
+  if (content !== null) declared = mergedScribeSessions(content)
+  else if (!sessionId && !firefliesId) {
+    try { declared = mergedScribeSessions(readFileSync(join(monthDir, filename), 'utf-8')) } catch { declared = [] }
+  }
+  return meetingContextKeys({ g2SessionId: sessionId, firefliesId, declared })
+}
+
+interface PrimaryKeyMonth { stamp: string; primaries: string[]; builtAt: number }
+const primaryKeyCache = new Map<string, PrimaryKeyMonth>()
+let primaryKeyReads = 0
+/** A month is re-read at least this often even when its folder's stamp has not moved: a sidecar rewritten in place
+ *  leaves the folder alone (QA 2026-10-06). One month re-read costs about 3 ms. */
+const PRIMARY_KEY_MAX_AGE_MS = 60_000
+
+/** The primary key a meeting's OWN sidecars give it, or undefined. A meeting that only declares `<!-- g2-session -->`
+ *  markers (a merged scribe with no sidecar) claims nothing here: it holds those captures, and counting it would make
+ *  every merge whose captures are not yet retired read as two meetings fighting over one key (QA 2026-10-06). It also
+ *  means the index never reads a meeting body, so a cold build costs 4 KB heads only. */
+function sidecarPrimaryKey(monthDir: string, filename: string, recordingsRoot: string | null, month: string): string | undefined {
+  let sessionId = sidecarListHints(monthDir, filename).sessionId
+  if (!sessionId && recordingsRoot) {
+    const fallbackDir = join(recordingsRoot, month)
+    if (existsSync(fallbackDir)) sessionId = sidecarListHints(fallbackDir, filename).sessionId
+  }
+  return meetingContextKeys({ g2SessionId: sessionId, firefliesId: firefliesSidecarId(monthDir, filename) })[0]
+}
+
+/** How many live, canonical meetings take each key as their PRIMARY key from their own sidecars, across every domain. */
+export function meetingPrimaryKeyClaims(operationsDir: string, recordingsRoot: string | null = dataPath('recordings')): Map<string, number> {
+  const claims = new Map<string, number>()
+  for (const domain of discoverMeetingDomains(operationsDir)) {
+    const meetingsBase = join(operationsDir, domain, 'meetings')
+    let months: string[]
+    try { months = readdirSync(meetingsBase).filter(name => MONTH_PATTERN.test(name)) } catch { continue }
+    for (const month of months) {
+      const monthDir = join(meetingsBase, month)
+      let stamp: string
+      try { stamp = statStamp(statSync(monthDir)) } catch { primaryKeyCache.delete(monthDir); continue }
+      let entry = primaryKeyCache.get(monthDir)
+      if (!entry || entry.stamp !== stamp || Date.now() - entry.builtAt > PRIMARY_KEY_MAX_AGE_MS) {
+        let names: string[] = []
+        try {
+          names = readdirSync(monthDir).filter(name => name.endsWith('.md') && !ICLOUD_CONFLICT_COPY.test(name)).slice(0, MAX_LIST_CANDIDATES)
+        } catch { names = [] }
+        const primaries: string[] = []
+        for (const name of names) {
+          primaryKeyReads++
+          const key = sidecarPrimaryKey(monthDir, name, recordingsRoot, month)
+          if (key) primaries.push(key)
+        }
+        entry = { stamp, primaries, builtAt: Date.now() }
+        primaryKeyCache.set(monthDir, entry)
+      }
+      for (const key of entry.primaries) claims.set(key, (claims.get(key) ?? 0) + 1)
+    }
+  }
+  return claims
+}
+
+/** Diagnostics and the cost tests. */
+export function meetingPrimaryKeyCacheStats(): { months: number; reads: number } {
+  return { months: primaryKeyCache.size, reads: primaryKeyReads }
+}
+export function resetMeetingPrimaryKeyCache(): void {
+  primaryKeyCache.clear()
+  primaryKeyReads = 0
+}
+
+/** A meeting's context fields, given its keys and the claims index. The index counts meetings whose OWN sidecar gives
+ *  the key; a markers-only scribe is not in it, so beside its one live capture it reads 1 (fine), and beside two live
+ *  copies of that capture it reads 2: its key is contested, so it is ambiguous too. */
+function contextFieldsFor(filename: string, keys: string[], claims: Map<string, number>): MeetingContextFields {
+  return meetingContextFields(keys, {
+    conflictCopy: ICLOUD_CONFLICT_COPY.test(filename),
+    claimants: keys.length > 0 ? claims.get(keys[0]) ?? 1 : 1,
+  })
+}
+
 export type MeetingLibraryRecord = NonNullable<ReturnType<typeof findCosOperationsMeetingBySessionId>> & {
   recordId?: string
   librarySource?: 'direct_library' | 'cos_operations'
@@ -799,6 +896,7 @@ export function listCosOperationsMeetings(options: {
     : discovered.includes(domainFilter) ? [domainFilter] : []
 
   const allMeetings: CosOperationsMeetingMeta[] = []
+  let claims: Map<string, number> | undefined
 
   for (const domain of domains) {
     const meetingsBase = join(operationsDir, domain, 'meetings')
@@ -857,6 +955,11 @@ export function listCosOperationsMeetings(options: {
                 if (actionId) meta.actionId = actionId
               }
               if (options.day && meta.date !== options.day) continue
+              // 6.64.0: the keys this meeting's dropped files are filed under, from the ids just read (no extra read but
+              // the Fireflies sidecar's 4 KB head).
+              const firefliesId = firefliesSidecarId(monthDir, file)
+              const keys = meetingContextKeys({ g2SessionId: hints.sessionId, firefliesId, declared })
+              Object.assign(meta, contextFieldsFor(file, keys, claims ??= meetingPrimaryKeyClaims(operationsDir, recordingsRoot)))
               allMeetings.push(meta)
             } catch { /* skip unreadable files */ }
           }
@@ -1013,9 +1116,14 @@ export function getCosOperationsMeetingDetail(
   meta.mutable = true
   meta.canonicalRecord = `operations/${domain}/meetings/${month}/${resolvedFilename}`
   const source = boundedMeetingSource(content)
+  // 6.64.0: the same keys the list row carries, so Control files a drop from either surface under one key.
+  const recordingsRoot = dataPath('recordings')
+  const keys = meetingKeysFor(monthDir, resolvedFilename, content, recordingsRoot, month)
+  const context = contextFieldsFor(resolvedFilename, keys, meetingPrimaryKeyClaims(operationsDir, recordingsRoot))
 
   return {
     ...meta,
+    ...context,
     summary: extractSummary(content),
     topics: extractTopics(content),
     decisions: extractDecisions(content),
@@ -1026,6 +1134,73 @@ export function getCosOperationsMeetingDetail(
   }
 }
 
+/**
+ * 6.64.0: the context keys a Work card's saved meeting link answers to, without reading the meeting's body.
+ *
+ * WHY. A card links a meeting by record id, and a meeting's record id changes over its life: a fresh capture is
+ * `standalone:<sessionId>`, sync files it as `ops:<domain>:<month>:<file>`, the G2 enrichment renames the file, and a
+ * refile moves it to another domain. The files Miles dropped are filed under the meeting's KEY, which does not change.
+ * COS Control asks here for the keys of every link a card carries, so a card finds its meetings' files whichever record
+ * id it was linked under (QA, 2026-10-06).
+ *
+ * Exact ids only, as everywhere in this module: a `standalone:` id names its session; an `ops:` id is found at its own
+ * path, then by the rename rule the detail route already uses (the date and time in a G2 filename, in the same month),
+ * then by the SAME filename in another domain of the same month (a domain move keeps the name). Two candidates are no
+ * answer. Imported, re-derived and direct-library records are read-only.
+ */
+export function meetingContextForRecord(recordId: string, recordingsRoot: string | null = dataPath('recordings')): MeetingContextFields & { resolvedRecordId?: string } {
+  const standalone = /^standalone:([A-Za-z0-9_-]{3,96})$/.exec(recordId)
+  const operationsDir = resolveCosOperationsDir()
+  if (standalone) {
+    // A capture two operations meetings both carry is contested here too (QA round 2, N3).
+    const keys = meetingContextKeys({ g2SessionId: standalone[1] })
+    const claimants = operationsDir && keys.length > 0 ? meetingPrimaryKeyClaims(operationsDir, recordingsRoot).get(keys[0]) ?? 1 : 1
+    return meetingContextFields(keys, { claimants })
+  }
+  const ops = /^ops:([^:/\\]+):(\d{4}-\d{2}):([^/\\]+\.md)$/.exec(recordId)
+  if (!ops || !operationsDir) return { contextKeys: [], contextSupported: false, contextReason: 'read_only_record' }
+  const [, domain, month, filename] = ops
+  const domains = discoverMeetingDomains(operationsDir)
+  if (!safeName(domain) || !MONTH_PATTERN.test(month) || basename(filename) !== filename) {
+    return { contextKeys: [], contextSupported: false, contextReason: 'no_source_id' }
+  }
+  const at = (d: string, f: string) => join(operationsDir, d, 'meetings', month, f)
+  const isFile = (path: string) => { try { return statSync(path).isFile() } catch { return false } }
+  let found: { domain: string; filename: string } | null = domains.includes(domain) && isFile(at(domain, filename)) ? { domain, filename } : null
+  if (!found) {
+    const heads = (d: string) => {
+      try {
+        return readdirSync(join(operationsDir, d, 'meetings', month))
+          .filter(name => name.endsWith('.md') && !ICLOUD_CONFLICT_COPY.test(name))
+          .slice(0, MAX_LIST_CANDIDATES)
+          .map(name => ({ filename: name, content: safeRegularFile(realpathSync(join(operationsDir, d, 'meetings', month)), join(operationsDir, d, 'meetings', month, name), 4_000) ?? '' }))
+      } catch { return [] }
+    }
+    // Renamed in its own domain, then the same name in another domain, then renamed in another domain: one answer only.
+    const ownRename = domains.includes(domain) ? matchRenamedMeetingFilename(filename, heads(domain)) : undefined
+    if (ownRename) found = { domain, filename: ownRename }
+    else {
+      const sameName = domains.filter(d => d !== domain && isFile(at(d, filename)))
+      if (sameName.length === 1) found = { domain: sameName[0], filename }
+      else if (sameName.length === 0) {
+        const renamed = domains.filter(d => d !== domain)
+          .map(d => ({ domain: d, filename: matchRenamedMeetingFilename(filename, heads(d)) }))
+          .filter((hit): hit is { domain: string; filename: string } => Boolean(hit.filename))
+        if (renamed.length === 1) found = renamed[0]
+      }
+    }
+  }
+  if (!found) return { contextKeys: [], contextSupported: false, contextReason: 'no_source_id' }
+  const monthDir = join(operationsDir, found.domain, 'meetings', month)
+  // The same keys the row and the detail carry: the markers too, so the file is read (as the detail reads it).
+  let content: string | null = null
+  try { content = readFileSync(join(monthDir, found.filename), 'utf-8') } catch { content = null }
+  const keys = meetingKeysFor(monthDir, found.filename, content, recordingsRoot, month)
+  const fields = contextFieldsFor(found.filename, keys, meetingPrimaryKeyClaims(operationsDir, recordingsRoot))
+  const resolved = `ops:${found.domain}:${month}:${found.filename}`
+  return resolved === recordId ? fields : { ...fields, resolvedRecordId: resolved }
+}
+
 export function getDirectLibraryMeetingDetail(month: string, filename: string): MeetingDetail | null {
   const inspection = resolveMeetingLibrary()
   if (inspection.layout !== 'direct' || !inspection.root) return null

package/server/lib/meeting-context-keys.ts

@@ -0,0 +1,135 @@
+/**
+ * Meeting context keys (6.64.0): the ids COS Control files a meeting's dropped files under.
+ *
+ * Miles, 2026-10-06: "link" meetings with files dragged onto them, the way Work cards take files, so a screen or slide
+ * shared in a meeting becomes agent context. COS Control keeps the files on the Mac (`~/cos-data/meeting-context`); the
+ * server only says which key a meeting answers to.
+ *
+ * READ-ONLY, FROM IDS THE MEETING ALREADY CARRIES. Plan v1 wrote a marker into the meeting file and failed review: more
+ * than a dozen writers regenerate, archive or race those files, and a write changes the hashes merge suggestions, merge
+ * decisions, Work review and speaker review depend on. So the key is read from the meeting's own source ids:
+ *   - `g2:<sessionId>` from its `.g2-chunks.json` sidecar (the speaker system's key; moves with every G2 rename);
+ *   - `ff:<id>` from its `.fireflies.json` sidecar;
+ *   - `g2:<id>` for every `<!-- g2-session -->` the file declares, which is how a merged meeting also shows the files of
+ *     the capture it absorbed.
+ * Measured 2026-10-06: 649 of 656 meetings from August to October carry at least one.
+ *
+ * IDENTITY IS AN EXACT ID. Never a title or a date (the rule `resolveMergedScribe` already keeps). Two live meetings whose
+ * own sidecars give the same PRIMARY key are `ambiguous`: Control adds and removes nothing there and never files a card
+ * link under their keys (files already dropped stay with the cards linked to the meeting they were dropped on).
+ */
+
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, realpathSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+
+/** A key as Control stores it. The id part is the server's own marker grammar (`G2_SESSION_MARKER`). */
+export const MEETING_CONTEXT_KEY = /^(?:g2|ff):[A-Za-z0-9:_-]{3,96}$/
+const SOURCE_ID = /^[A-Za-z0-9:_-]{3,96}$/
+
+const SIDECAR_HEAD_BYTES = 4096
+
+/**
+ * The value of a TOP-LEVEL string field in the head of a JSON object, or undefined.
+ *
+ * A Fireflies sidecar is up to megabytes of sentences, so only its head is read, and a regex alone would also match an
+ * `"id"` nested inside `participants` or `sentences` if the key order ever changed. This walks the head tracking depth
+ * and strings, and answers only for a key at depth 1.
+ */
+export function topLevelStringField(head: string, field: string): string | undefined {
+  let depth = 0
+  let i = 0
+  while (i < head.length) {
+    const c = head[i]
+    if (c === '"') {
+      let j = i + 1
+      let raw = ''
+      while (j < head.length && head[j] !== '"') {
+        if (head[j] === '\\') { raw += head.slice(j, j + 2); j += 2; continue }
+        raw += head[j]; j += 1
+      }
+      if (j >= head.length) return undefined
+      // A key at depth 1 is followed by a colon; read its value if it is the one asked for.
+      let k = j + 1
+      while (k < head.length && /\s/.test(head[k])) k += 1
+      if (depth === 1 && head[k] === ':' && raw === field) {
+        k += 1
+        while (k < head.length && /\s/.test(head[k])) k += 1
+        if (head[k] !== '"') return undefined
+        const end = head.indexOf('"', k + 1)
+        if (end < 0) return undefined
+        const value = head.slice(k + 1, end)
+        return value.includes('\\') ? undefined : value
+      }
+      i = j + 1
+      continue
+    }
+    if (c === '{' || c === '[') depth += 1
+    else if (c === '}' || c === ']') depth -= 1
+    i += 1
+  }
+  return undefined
+}
+
+/** The Fireflies transcript id in `<stem>.fireflies.json` beside a meeting, if there is one. Reads 4 KB, never a link. */
+export function firefliesSidecarId(monthDir: string, meetingFilename: string): string | undefined {
+  if (!meetingFilename.endsWith('.md')) return undefined
+  const path = join(monthDir, meetingFilename.replace(/\.md$/, '.fireflies.json'))
+  let fd: number | null = null
+  try {
+    const stat = lstatSync(path)
+    if (stat.isSymbolicLink() || !stat.isFile() || stat.size === 0) return undefined
+    if (dirname(realpathSync(path)) !== realpathSync(monthDir)) return undefined
+    // Non-blocking and no-follow (hazard-invariants): a FIFO planted under the sidecar's name must never hang the
+    // server's one thread, and a link swapped in after the lstat is refused at the open itself.
+    fd = openSync(path, constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW)
+    if (!fstatSync(fd).isFile()) return undefined
+    const buffer = Buffer.alloc(Math.min(SIDECAR_HEAD_BYTES, stat.size))
+    const read = readSync(fd, buffer, 0, buffer.length, 0)
+    const id = topLevelStringField(buffer.subarray(0, read).toString('utf8'), 'id')
+    return id && SOURCE_ID.test(id) ? id : undefined
+  } catch {
+    return undefined
+  } finally {
+    if (fd !== null) { try { closeSync(fd) } catch { /* already closed */ } }
+  }
+}
+
+/** The ordered, de-duplicated keys for one meeting. The first is primary: the capture's own sidecar, then Fireflies,
+ *  then what the file declares. */
+export function meetingContextKeys(sources: { g2SessionId?: string; firefliesId?: string; declared?: readonly string[] }): string[] {
+  const keys: string[] = []
+  const add = (prefix: 'g2' | 'ff', id: string | undefined) => {
+    if (!id || !SOURCE_ID.test(id)) return
+    const key = `${prefix}:${id}`
+    if (!keys.includes(key)) keys.push(key)
+  }
+  add('g2', sources.g2SessionId)
+  add('ff', sources.firefliesId)
+  for (const id of sources.declared ?? []) add('g2', id)
+  return keys
+}
+
+export interface MeetingContextFields {
+  contextKeys: string[]
+  contextSupported: boolean
+  contextAmbiguous?: true
+  contextReason?: 'no_source_id' | 'read_only_record' | 'conflict_copy' | 'ambiguous'
+}
+
+/**
+ * What a row or a detail says about its files.
+ *
+ * `claimants` is how many live meetings have this meeting's primary key as THEIR primary key (this one included). Two
+ * or more is ambiguous: the keys still go out, so Control can show files already there, but nothing is added or sent.
+ */
+export function meetingContextFields(keys: string[], options: { conflictCopy?: boolean; claimants?: number } = {}): MeetingContextFields {
+  if (options.conflictCopy) return { contextKeys: [], contextSupported: false, contextReason: 'conflict_copy' }
+  if (keys.length === 0) return { contextKeys: [], contextSupported: false, contextReason: 'no_source_id' }
+  if ((options.claimants ?? 1) > 1) return { contextKeys: keys, contextSupported: false, contextAmbiguous: true, contextReason: 'ambiguous' }
+  return { contextKeys: keys, contextSupported: true }
+}
+
+/** Fields for a record this release does not key: a direct library, an import or a re-derived (blended) record. */
+export function readOnlyContext(): MeetingContextFields {
+  return { contextKeys: [], contextSupported: false, contextReason: 'read_only_record' }
+}

package/server/lib/meeting-store.ts

@@ -136,6 +136,16 @@ export interface MeetingMeta {
   sources?: Array<{ kind: 'g2' | 'fireflies'; id: string; recordId?: string }>
   /** Present only when the server can state a truthful local record. */
   canonicalRecord?: string
+  /** 6.64.0, additive and read-only. The keys COS Control files a meeting's dropped files under, from source ids the
+   *  meeting already carries (`g2:<sessionId>`, `ff:<firefliesId>`, then every `<!-- g2-session -->` it declares).
+   *  First = primary. Never computed from a title or a date, and nothing is written into the meeting. See
+   *  `meeting-context-keys.ts`. */
+  contextKeys?: string[]
+  /** False when files cannot be added here: a re-derived or read-only record, a conflict copy, a meeting with no
+   *  source id, or two meetings claiming one key. `contextReason` says which. */
+  contextSupported?: boolean
+  contextAmbiguous?: boolean
+  contextReason?: 'no_source_id' | 'read_only_record' | 'conflict_copy' | 'ambiguous'
   /** Additive. Unique sidecar speakers + whether a human correction landed. */
   voiceReview?: {
     voices: number
@@ -579,6 +589,18 @@ export class MeetingStore {
     return detail
   }
 
+  /** 6.64.0: the session in a stored recording's sidecar, for its context key only. The detail itself keeps its shape
+   *  (no sessionId, its recordId unchanged). Undefined when the month, the file or the sidecar is not readable. */
+  storedSessionId(month: string, filename: string): string | undefined {
+    if (!MONTH_PATTERN.test(month) || !SAFE_FILENAME_PATTERN.test(filename) || basename(filename) !== filename) return undefined
+    const rootReal = this.rootRealpath()
+    if (!rootReal) return undefined
+    const monthDir = join(this.root, month)
+    const monthReal = safeDirectoryRealpath(monthDir, rootReal)
+    if (!monthReal) return undefined
+    return this.sidecarSessionId(monthDir, monthReal, filename)
+  }
+
   private rootRealpath(): string | null {
     return existingRootRealpath(
       this.root,

package/server/routes/meetings.ts

@@ -10,11 +10,13 @@ import {
   listDirectLibraryMeetingMonths,
   listCosOperationsMeetings,
   listCosOperationsMeetingMonths,
+  meetingContextForRecord,
   resolveMeetingLibrary,
 } from '../lib/cos-operations-meetings.js'
 import type { MeetingMeta, MeetingDetail } from '../lib/meeting-store.js'
 import { meetingListLimit } from '../lib/meeting-store.js'
 import { searchMeetingLibrary } from '../lib/meeting-library-search.js'
+import { meetingContextFields, meetingContextKeys, readOnlyContext } from '../lib/meeting-context-keys.js'
 import { g2RecordingsReachOperations } from '../lib/g2-ops-handoff.js'
 import {
   type ImportedMeetingLibrary,
@@ -57,6 +59,19 @@ function withStandaloneIdentity(meeting: MeetingMeta): MeetingMeta {
   }
 }
 
+/**
+ * 6.64.0 context keys for a row or detail the operations tree did not key. A standalone recording is keyed by its own
+ * session (it is a capture this server holds); a direct library, an import and a re-derived record are read-only here.
+ * A row the operations tree keyed already carries its fields and is left alone.
+ */
+export function withMeetingContext<T extends MeetingMeta>(meeting: T, source: MeetingMeta['librarySource'] = meeting.librarySource): T {
+  if (meeting.contextKeys !== undefined) return meeting
+  if (source === 'standalone_recordings') {
+    return { ...meeting, ...meetingContextFields(meetingContextKeys({ g2SessionId: meeting.sessionId })) }
+  }
+  return { ...meeting, ...readOnlyContext() }
+}
+
 function mergeMeetingSources(groups: MeetingMeta[][], limit: number, max = 50): MeetingMeta[] {
   const seenSessions = new Set<string>()
   const seenExact = new Set<string>()
@@ -187,6 +202,22 @@ export function resolveSavedMeetingDetail(
   return { ...detail, recordId: withStandaloneIdentity(detail).recordId }
 }
 
+/** The detail the routes answer with: `resolveSavedMeetingDetail` plus its 6.64.0 context keys. */
+function savedMeetingDetailWithContext(
+  descriptor: { domain: string; month: string; filename: string },
+  store: MeetingStore,
+  importsLibrary: ImportedMeetingLibrary,
+): MeetingDetail {
+  const detail = resolveSavedMeetingDetail(descriptor, store, importsLibrary)
+  // The store's detail carries no librarySource (a pinned contract); the identity above made its recordId `standalone:`.
+  const source = detail.librarySource ?? (detail.recordId?.startsWith('standalone:') ? 'standalone_recordings' : undefined)
+  if (source === 'standalone_recordings' && detail.contextKeys === undefined) {
+    const sessionId = detail.sessionId || store.storedSessionId(descriptor.month, detail.filename || descriptor.filename)
+    return { ...detail, ...meetingContextFields(meetingContextKeys({ g2SessionId: sessionId })) }
+  }
+  return withMeetingContext(detail, source)
+}
+
 export function createMeetingsRouter(
   store: MeetingStore = getMeetingStore(),
   // Injectable so a test can drive a whole imports library without reaching the
@@ -255,7 +286,7 @@ export function createMeetingsRouter(
           ? supersededDayCounts(filters.month, 'direct', { domain, store, library: importsLibrary })
           : []
         res.json({
-          meetings,
+          meetings: meetings.map(meeting => withMeetingContext(meeting)),
           months,
           days,
           source: operations.length > 0 || imported.present ? 'mixed_library' : 'direct_library',
@@ -288,7 +319,7 @@ export function createMeetingsRouter(
           // back above the row. A capped page pays for the scan instead.
           const listSawWholeMonth = rows.length < limit
           res.json({
-            meetings,
+            meetings: meetings.map(meeting => withMeetingContext(meeting)),
             months: listCosOperationsMeetingMonths(domain),
             // The rows above already read every scribe in this month and told us which
             // sessions the merged ones hold. Handing that over is the difference between
@@ -329,7 +360,7 @@ export function createMeetingsRouter(
           ? supersededDayCounts(filters.month, 'multi_domain', { domain, store, library: importsLibrary, pipeline: false })
           : []
         res.json({
-          meetings,
+          meetings: meetings.map(meeting => withMeetingContext(meeting)),
           months: uniqueSortedMonths([
             listCosOperationsMeetingMonths(domain),
             store.listMonths(),
@@ -359,7 +390,7 @@ export function createMeetingsRouter(
         imported.drop(imported.imports),
       ], limit, sourceLimit)
       res.json({
-        meetings,
+        meetings: meetings.map(meeting => withMeetingContext(meeting)),
         months: uniqueSortedMonths([store.listMonths(), importedLibraryMonths(importsLibrary)]),
         days: filters.month ? supersededDayCounts(filters.month, 'standalone', { domain, store, library: importsLibrary }) : [],
         source: imported.present ? 'mixed_library' : 'standalone_recordings',
@@ -371,6 +402,26 @@ export function createMeetingsRouter(
     }
   })
 
+  // 6.64.0: the context keys behind a Work card's saved meeting links, by record id (at most 50 per call). Read-only and
+  // body-free: COS Control asks for every link a card carries, so a card finds the files dropped on its meetings
+  // whichever record id it was linked under (`meetingContextForRecord`).
+  router.get('/meetings/context-keys', (req, res) => {
+    const raw = req.query.recordId
+    const ids = (Array.isArray(raw) ? raw : raw === undefined ? [] : [raw]).filter((id): id is string => typeof id === 'string')
+    if (ids.length === 0 || ids.length > 50 || ids.some(id => id.length === 0 || id.length > 2048 || /[\u0000-\u001f]/.test(id))) {
+      res.status(400).json({ error: 'one to fifty recordId values are required', reason: 'invalid_record_ids' })
+      return
+    }
+    res.set('Cache-Control', 'private, no-store')
+    try {
+      const keys: Record<string, ReturnType<typeof meetingContextForRecord>> = {}
+      for (const id of [...new Set(ids)]) keys[id] = meetingContextForRecord(id)
+      res.json({ keys })
+    } catch (error) {
+      sendMeetingStoreError(res, error)
+    }
+  })
+
   // Literal path before /meetings/:domain/:month/:filename.
   router.get('/meetings/search', async (req, res) => {
     try {
@@ -406,7 +457,7 @@ export function createMeetingsRouter(
       }
       res.set('Cache-Control', 'private, no-store')
 
-      res.json(resolveSavedMeetingDetail({ domain, month, filename }, store, importsLibrary))
+      res.json(savedMeetingDetailWithContext({ domain, month, filename }, store, importsLibrary))
     } catch (error) {
       sendMeetingStoreError(res, error)
     }
@@ -418,7 +469,7 @@ export function createMeetingsRouter(
     try {
       res.set('Cache-Control', 'private, no-store')
 
-      res.json(resolveSavedMeetingDetail({ domain: String(req.params.domain), month: String(req.params.month), filename: String(req.params.filename) }, store, importsLibrary))
+      res.json(savedMeetingDetailWithContext({ domain: String(req.params.domain), month: String(req.params.month), filename: String(req.params.filename) }, store, importsLibrary))
     } catch (error) {
       sendMeetingStoreError(res, error)
     }

package/server/routes/welcome-context.ts

@@ -25,6 +25,72 @@ let lastKnownCity = ''
 let cachedNextEvent: NextEventPayload | null = null
 let calendarFetchedAt = 0
 
+// 6.63.1: after a server restart the first forecast lookup can fail and, with nothing cached, the
+// glasses Home got no weather until the app was relaunched. The last good weather and
+// place now survive a restart, and a failed lookup says why in the log (it was silent).
+/** A saved weather older than this is never served after a restart. */
+export const WEATHER_PERSIST_MAX_AGE_MS = 3 * 60 * 60_000
+const WEATHER_FAILURE_LOG_MS = 10 * 60_000
+
+export interface WeatherPersistence {
+  load(): unknown
+  save(value: unknown): void
+}
+let weatherPersistence: WeatherPersistence | null = null
+let weatherRestored = false
+const lastFailureLogAt = new Map<string, number>()
+
+/** Wired by the server (index.ts, `<data>/welcome-weather.json`); off by default so tests touch nothing. */
+export function setWeatherPersistence(p: WeatherPersistence | null): void {
+  weatherPersistence = p
+  weatherRestored = false
+}
+
+function restoreWeatherOnce(): void {
+  if (weatherRestored || !weatherPersistence) return
+  weatherRestored = true
+  try {
+    const v = weatherPersistence.load() as Record<string, unknown> | null
+    if (!v || typeof v !== 'object') return
+    const at = typeof v.fetchedAt === 'number' ? v.fetchedAt : 0
+    const w = v.weather as WeatherPayload | undefined
+    if (typeof v.lat === 'number' && typeof v.lon === 'number' && lastKnownLat == null) { lastKnownLat = v.lat; lastKnownLon = v.lon }
+    if (typeof v.city === 'string' && !lastKnownCity) lastKnownCity = v.city
+    const fresh = at > 0 && at <= Date.now() + 60_000 && Date.now() - at <= WEATHER_PERSIST_MAX_AGE_MS
+    if (fresh && w && typeof w.temp === 'string' && typeof w.desc === 'string' && !cachedWeather) {
+      cachedWeather = { temp: w.temp, desc: w.desc, location: typeof w.location === 'string' ? w.location : '' }
+      // Expired for the TTL check, so the next request still tries a fresh lookup; kept as the fallback.
+      weatherFetchedAt = 0
+    }
+  } catch (error) {
+    console.warn(`[welcome-context] saved weather unreadable: ${error instanceof Error ? error.message : error}`)
+  }
+}
+
+function persistWeather(): void {
+  if (!weatherPersistence) return
+  try {
+    weatherPersistence.save({ lat: lastKnownLat ?? null, lon: lastKnownLon ?? null, city: lastKnownCity, weather: cachedWeather, fetchedAt: weatherFetchedAt })
+  } catch (error) {
+    console.warn(`[welcome-context] saving weather failed: ${error instanceof Error ? error.message : error}`)
+  }
+}
+
+/** One line per failure kind per 10 minutes: the cause, never the coordinates. */
+function noteWeatherFailure(kind: 'forecast' | 'geocode', reason: string): void {
+  const key = `${kind}:${reason}`
+  const now = Date.now()
+  if (now - (lastFailureLogAt.get(key) ?? 0) < WEATHER_FAILURE_LOG_MS) return
+  lastFailureLogAt.set(key, now)
+  console.warn(`[welcome-context] ${kind} lookup failed: ${reason}${cachedWeather ? ' (serving the last good weather)' : ' (no weather to serve)'}`)
+}
+
+function failureReason(error: unknown): string {
+  const name = error instanceof Error ? error.name : ''
+  if (name === 'TimeoutError' || name === 'AbortError') return 'timeout'
+  return error instanceof Error ? (error.message.slice(0, 80) || name || 'error') : 'error'
+}
+
 /** Full WMO 4677 — discrete codes, exact match required. */
 export const WMO_CODES: Record<number, string> = {
   0: 'Clear',
@@ -108,7 +174,7 @@ async function reverseGeocode(lat: number, lon: number): Promise<string> {
       `https://api.bigdatacloud.net/data/reverse-geocode-client?latitude=${lat}&longitude=${lon}&localityLanguage=en`,
       { signal: AbortSignal.timeout(GEOCODE_TIMEOUT_MS) },
     )
-    if (!res.ok) return lastKnownCity
+    if (!res.ok) { noteWeatherFailure('geocode', `http ${res.status}`); return lastKnownCity }
     const data = await res.json() as {
       city?: string
       locality?: string
@@ -122,7 +188,8 @@ async function reverseGeocode(lat: number, lon: number): Promise<string> {
       lastKnownCity = region ? `${city}, ${region}` : city
     }
     return lastKnownCity
-  } catch {
+  } catch (error) {
+    noteWeatherFailure('geocode', failureReason(error))
     return lastKnownCity
   }
 }
@@ -144,6 +211,7 @@ export async function fetchWeather(
   queryLat?: number,
   queryLon?: number,
 ): Promise<WeatherPayload | null> {
+  restoreWeatherOnce()
   const resolved = resolveWeatherCoords(queryLat, queryLon)
   if (!resolved) return null
 
@@ -183,14 +251,14 @@ export async function fetchWeather(
       `https://api.open-meteo.com/v1/forecast?latitude=${useLat}&longitude=${useLon}&current=temperature_2m,weather_code&temperature_unit=fahrenheit&timezone=auto`,
       { signal: AbortSignal.timeout(FORECAST_TIMEOUT_MS) },
     )
-    if (!res.ok) return cachedWeather
+    if (!res.ok) { noteWeatherFailure('forecast', `http ${res.status}`); return cachedWeather }
 
     const data = await res.json() as {
       current?: { temperature_2m?: number; weather_code?: number }
     }
     const temp = data.current?.temperature_2m
     const code = data.current?.weather_code
-    if (typeof temp !== 'number' || typeof code !== 'number') return cachedWeather
+    if (typeof temp !== 'number' || typeof code !== 'number') { noteWeatherFailure('forecast', 'bad payload'); return cachedWeather }
 
     await ensureCityLabel(useLat, useLon, source)
 
@@ -200,8 +268,10 @@ export async function fetchWeather(
       location: lastKnownCity || `${useLat.toFixed(2)}, ${useLon.toFixed(2)}`,
     }
     weatherFetchedAt = Date.now()
+    persistWeather()
     return cachedWeather
-  } catch {
+  } catch (error) {
+    noteWeatherFailure('forecast', failureReason(error))
     return cachedWeather
   }
 }
@@ -272,6 +342,9 @@ export function _resetWelcomeContextCachesForTests(): void {
   lastKnownCity = ''
   cachedNextEvent = null
   calendarFetchedAt = 0
+  weatherPersistence = null
+  weatherRestored = false
+  lastFailureLogAt.clear()
 }
 
 welcomeContextRouter.get('/welcome-context', async (req, res) => {