@gotcos/glasses-server 6.63.1 → 6.65.0

package/CHANGELOG.md

@@ -1,3 +1,41 @@
+## 6.65.0 — 2026-10-07 — Work search by meaning, and task dates
+
+- `POST /api/work/search` `{ query, domain?, scope?, ids? }` finds the Work card the user means, not only the words they typed. Pairs with COS Control 0.5.259, which shows its own word matches at once and asks this after a pause.
+  - One Jev Choice per search over the board's own cards, plus `none`. The client names a view or exact card ids, never task text. A domain board searches that domain's cards, open and completed. All work searches open cards only, although Control's All work view also shows completed ones. Completed searches completed cards. Needs attention and In progress send their card ids.
+  - What goes to TypeSafe: each card's task text, on one line, at most 300 characters, without `[Work details](…)` links. URLs, email addresses and opaque ids (the shape of a key or a document id) are removed, credentials are masked by the server's secret redaction, and a markdown link keeps only its label. A bare domain such as bottlepos.com stays.
+  - The query is 2 to 200 characters, counted in code points, so 150 emoji are 150.
+  - The answer is `{ available: true, results: [{ id, p }], none, cached, tokens }`: cards at p 0.02 or more, most likely first, at most 20.
+  - When it cannot search it answers HTTP 200 with `{ available: false, reason, message }`. The reasons are `jev_not_configured`, `jev_key_rejected`, `jev_cap_reached`, `jev_breaker_open`, `jev_request_rejected` (Jev refused the request: a 400, 413 or 422), `jev_unavailable` (no answer, a 5xx, or a malformed answer), `search_off` and `too_many_candidates`. A Choice holds 254 cards, so a bigger set is refused, never cut; Completed across all domains is 198 cards today. Control keeps its word search in every case. The server logs each reason at most once per 10 minutes.
+  - Its own cost controls, apart from Work intake and session advice. A daily cap of 1,000,000 input tokens (`COS_JEV_SEARCH_DAILY_TOKENS`), about 110 to 200 searches by board size, with its own ledger (`<data>/jev-search-usage.json`); it resets at midnight UTC. Its own breaker: 3 failures, then an hour; a refused request does not count, because the same cards would be refused again. A switch, `COS_JEV_SEARCH=0`. Both come from the server's environment, so changing them takes a restart. Saving a new TypeSafe key clears this breaker too. `COS_JEV_DAILY_TOKENS` is unchanged.
+  - The same query over the same cards is answered from memory for 10 minutes (up to 200 searches).
+  - Search is read-only, so it does not take the server's request lease: an update or restart never waits on a search, and a search during one is answered rather than refused.
+  - Measured on 2026-10-06 on the live board (293 cards, 95 open): 4 searches, the right card first at p 0.99 for each of 3 real queries, `none` at 1 for an unrelated one, 4,815 to 4,963 input tokens and 268 to 431 ms each including the board read. The repeat came from the cache with no call.
+- `GET /api/tasks` and `GET /api/work-board` rows carry `createdOn` (`YYYY-MM-DD` or null), `createdFrom` (`source`, `git` or null) and `lineChangedAt` (ISO time or null), for Control's date orders. Control reads `/api/work-board` for its Work board, so both routes carry them. Additive: every existing field and the task revision are unchanged, and the fields are present as null when unknown, so a client can tell this server from an older one.
+  - `createdOn` is the first date in the task's source label, usually the meeting date. Otherwise it is the day the task's words first appeared in the git history of its `tasks.md`, cached on disk (`<data>/task-created-dates.json`, at most 5,000) by file and a hash of the words. A lookup that times out or fails is not cached as "not in history"; it is tried again after 10 minutes.
+  - `lineChangedAt` is when git last changed the task's line (blame, once per HEAD and file change). A line that is not committed yet is null, never "now". tasks.md is committed by the COS sync every one to three days, so this is later than the real change.
+  - Every read of either route, the phone's and the glasses' included, keeps all of its git work inside 1.5 s, half the phone's 4 s timeout less an allowance for the board read. Past that the dates still unknown come back null and the git work finishes in the background for a later read.
+  - Read-only: nothing is written into tasks.md. Git runs only when a `.git` exists at or above the `tasks.md` folder. A public install keeps its tasks outside any repository, so no git process starts. If the home folder is itself a git repository, git does run, finds `tasks.md` untracked, and the git fields stay null. Both the COS bridge and the packaged task runtime get the fields.
+  - Measured on 2026-10-06 on the live board (293 cards, a read-only scratch run): 241 dated from the source label, 52 from git, none without a date; 278 with `lineChangedAt` (the other 15 are not committed yet). The first call took 1.2 s (68 git lookups), later calls about 20 ms, and a restart 74 ms with no git history lookup.
+
+## 6.64.0 — 2026-10-06 — Meeting context keys
+
+- Meeting rows and details carry `contextKeys`, `contextSupported`, and, when files can't be added, `contextReason` (plus `contextAmbiguous`). The fields are additive and read-only. They are the keys COS Control 0.5.258 files a meeting's dropped screenshots, slides and documents under, so the files go to every Work card linked to the meeting.
+  - The keys are read from ids the meeting already carries: `g2:<sessionId>` from its `.g2-chunks.json` (or the server's own recordings copy), `ff:<id>` from its `.fireflies.json` (the top-level id, in the first 4 KB), then `g2:<id>` for every `<!-- g2-session -->` it declares.
+  - Nothing is written into a meeting. Identity is an exact id, never a title or a date.
+  - Two live meetings whose own sidecars give the same primary key are `ambiguous`. A merged scribe that only declares its captures never counts as a second claimant, so a merge whose captures are not yet retired is not ambiguous.
+  - Files also can't be added to:
+    - an iCloud conflict copy (`conflict_copy`);
+    - a meeting with no source id (`no_source_id`);
+    - an imported, re-derived or direct-library record (`read_only_record`).
+  - A standalone recording is keyed by its session, and its detail keeps its old shape (no `librarySource`).
+- `GET /api/meetings/context-keys?recordId=…` (1 to 50 ids, read-only) answers the keys behind a Work card's saved meeting links.
+  - A `standalone:` id gives its session.
+  - An `ops:` id is found at its path, after the G2 rename (same month, by the date and time in the filename), or under the same name in another domain of the same month.
+  - Two candidates give no answer.
+  - Control asks before each send, so a card finds the files whichever record id it was linked under.
+- The primary-key index reads only sidecar heads (4 KB), never a meeting body. It is rebuilt per month when that folder changes, and at least once a minute. Measured on 2026-10-06: 649 of 656 meetings from August to October carry a key; an earlier build of the index, which also read meeting bodies, took 376 ms cold and 1 ms warm over the whole tree on the author's Mac (a read-only scratch script).
+- Pairs with COS Control 0.5.258. Older clients ignore the fields.
+
 ## 6.63.1 — 2026-10-06 — Weather survives a restart
 
 - Home weather survives a server restart. The last good weather and place are kept in `<data>/welcome-weather.json`; when a forecast lookup fails (timeout, HTTP error, bad payload), the route answers with that saved weather if it is under 3 hours old, never older. A failed forecast or place lookup is now logged once per kind per 10 minutes, with the cause and whether a saved weather was served. Before, after a restart the first failed lookup sent the glasses no weather and nothing said why. Pairs with glasses 6.10.603, which also retries on Home and keeps its own last good weather.

package/docs/work-intake.md

@@ -35,6 +35,8 @@ Since 6.57.1 `POST /api/work-board/session-recommendation` also takes exactly `{
 
 Since 6.58.0 `POST /api/work-board/completion-check` takes exactly `{ domain, id, provider, sessionId }` plus an optional `after` (ISO time). It asks Jev whether the session's replies since `after` (or its newest reply) show the task finished, judged against its Done when or, without one, its own text. The server reads the task from the board and the replies from its own transcripts; the client sends names and a time only. It answers `{ provider: "jev", verdict: "done" | "not_done" | "unclear", confidence, basis: "done_when" | "task", model, cached }` or `{ provider: "none", reason }` (`no_reply`, `no_task_text`, a Jev condition, `completion_unavailable`). Errors: 400 `invalid_completion_request`, 404 `task_not_found`, 404 `session_not_found`. COS Control 0.5.247 asks only while the session is idle and its newest reply since the handoff has no `COS-WORK` status line, at most twice per handoff, and moves a card to QA only on done at 0.8 (0.85 without a Done when).
 
+Since 6.65.0 `POST /api/work/search` takes `{ query, domain?, scope?, ids? }`: a query of 2 to 200 characters (code points), an optional domain, an optional scope (`all`, `attention`, `progress` or `completed`) and optional card ids (12 hex). It asks Jev one Choice over the board's own cards, plus `none`, and answers `{ available: true, results: [{ id, p }], none, cached, tokens }` with cards at p 0.02 or more, most likely first, at most 20. Exact ids win (Control sends them for Needs attention and In progress). Otherwise a domain board covers that domain's cards, All work its open cards, and Completed its completed cards. Each card goes to TypeSafe as its task text without `[Work details](…)` links, URLs, email addresses or opaque ids, with credentials masked by the server's secret redaction, at most 300 characters. A search that cannot run answers 200 with `{ available: false, reason, message }`: `jev_not_configured`, `jev_key_rejected`, `jev_cap_reached`, `jev_breaker_open`, `jev_request_rejected` (a 400, 413 or 422 from Jev; not counted toward the breaker), `jev_unavailable`, `search_off` (`COS_JEV_SEARCH=0`) or `too_many_candidates` (more than 254 cards). Errors: 400 `invalid_search_request`, 503 `work_board_unavailable`. Search has its own daily cap (`COS_JEV_SEARCH_DAILY_TOKENS`, default 1,000,000, reset at midnight UTC), ledger (`data/jev-search-usage.json`) and breaker, so it never spends the cap Work intake and session advice share; the switch and the cap are read from the environment set at start, so a change takes a restart. The same query over the same cards is answered from memory for 10 minutes. The route is read-only and does not take the server's request lease.
+
 Since 6.58.2 `POST /api/query-jobs` also takes an optional `sessionName` (a string; the server cleans it as the 6.58.2 changelog says and keeps at most 100 characters; anything else is no name, never an error). It names only a Claude session the job starts itself (`claude --name=<name>`, when the installed CLI lists `--name`); a Continue, a dispatch, a Codex, Cursor or Ollama job, and an older server ignore it, and it is not part of the request fingerprint. A Claude job's snapshot carries `cliSessionId` from Claude's first stream event while the job is still `running`, not only at completion. COS Control 0.5.250 sends the Work item's title for New session, Start work and Fork to Claude, and links its receipt as soon as the running job names the session.
 
 Since 6.59.0 `GET /api/work-board/activity` also projects each handoff's progress (the report, its evidence of at most 280 characters, the newest move), the task's own revision and a saved destination, `GET /api/work-board/activity/open` lists every open handoff across the board, and `POST /api/work-board/handoff-requests` lets the glasses ask COS Control to start Work, reply, or say it is not done yet, which Control claims on this Mac and sends with its own guards. The server runs no provider and no Jev for any of it. See `docs/work-handoff-requests.md`.

package/docs/work-task-runtime.md

@@ -30,6 +30,17 @@ single-command child pins its domain as cwd instead of relying on unsupported
 atomic replacement writes use exclusive no-follow temporary files. Same-user
 modification of the installed package/manifest is outside this integrity boundary.
 
+Since 6.65.0 `GET /api/tasks` and `GET /api/work-board` rows also carry `createdOn`,
+`createdFrom` and `lineChangedAt`, for both the COS bridge and this runtime. The server reads them; the
+runtime does not. `createdOn` is the first `YYYY-MM-DD` in the source label, else the
+day the task's words first appeared in the git history of its `tasks.md`.
+`lineChangedAt` is the git blame time of a committed line. Each is null when unknown,
+including every git-derived value when no git repository tracks the `tasks.md`.
+All git work for one read (rev-parse, blame, first-seen lookups) shares a 1.5 s
+deadline; what is still unknown then comes back null, and the git work finishes in the
+background for a later read. Git runs only when a `.git` exists at or above the
+`tasks.md` folder. Nothing is written into `tasks.md`.
+
 The default lock namespace remains `~/Library/Application Support/COS/.task_locks.json`
 and canonical `file:<domain>` entries. `COS_TASK_LOCK_STORE` is an explicit override
 for isolated fixtures. Existing COS bridge calls keep their original environment

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.63.1",
+  "version": "6.65.0",
   "description": "COS Glasses: self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {
@@ -46,6 +46,7 @@
     "!server/scripts/work-review-mutation-gate.mjs",
     "!server/scripts/work-intake-mutation-gate.mjs",
     "!server/scripts/work-progress-mutation-gate.mjs",
+    "!server/scripts/work-search-mutation-gate.mjs",
     "!server/scripts/away-hold-mutation-gate.mjs",
     "!server/scripts/nemotron-mutation-gate.mjs",
     "!server/scripts/merged-scribe-mutation-gate.mjs",

package/server/index.ts

@@ -142,6 +142,8 @@ import { createWorkBoardRouter } from './routes/work-board.js'
 import { createWorkIntakeRouter } from './routes/work-intake.js'
 import { createWorkHandoffRequestsRouter } from './routes/work-handoff-requests.js'
 import { createJevRouter } from './routes/jev.js'
+import { createWorkSearchRouter } from './routes/work-search.js'
+import { isReadOnlyApiPost } from './lib/work-search.js'
 import { dataPath } from './lib/data-dir.js'
 import { loadJsonOrQuarantine, durableAtomicWriteFileSync } from './lib/atomic-fs.js'
 import { WorkIntakeStore, createOptionalWorkIntakeStore } from './lib/work-intake-store.js'
@@ -324,6 +326,9 @@ app.use('/api', requireApiToken(API_TOKEN))
 // through their true terminal boundary.
 app.use('/api', (req, res, next) => {
   if (req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS') return next()
+  // 6.65.0: a POST that only reads (Work search: a board read and one Jev question) is not a mutation. See
+  // lib/work-search.ts isReadOnlyApiPost for why holding the lease would hurt and why skipping it is safe.
+  if (isReadOnlyApiPost(req.method, req.path)) return next()
   // V2 video original chunks are bounded to the advertised session size (1 MiB
   // on new sessions, 256 KiB on leftover drafts) and commit through the upload
   // registry's own generation lock. Holding the global mutation lease while
@@ -756,6 +761,8 @@ app.use('/api', createWorkIntakeRouter({ store: workIntakeStore }))
 // Jev key (Control Settings), Continue/Fork/New session recommendations for Work tasks (6.57.0) and meeting reviews
 // (6.57.1), and the Work completion check (6.58.0).
 app.use('/api', createJevRouter(workReviewRuntime ? { review: async id => workReviewRuntime.peek(id) } : {}))
+// Work search by meaning (6.65.0, Control 0.5.259): one Jev Choice over the board's cards, with its own cap, switch and breaker.
+app.use('/api', createWorkSearchRouter())
 app.use('/api', queryRouter)
 // The scheduled start-of-day brief: settings, status, run-now. Same auth as
 // every other settings route; the brief itself is an ordinary durable job.

package/server/lib/cos-operations-meetings.ts

@@ -20,6 +20,7 @@ import type { MeetingDetail, MeetingMeta } from './meeting-store.js'
 import { MEETING_SOURCE_MAX_BYTES, meetingDayCountsFromNames, meetingListLimit } from './meeting-store.js'
 import { meetingVoiceReview, parseSidecarListHead } from './meeting-voice-review.js'
 import { dataPath } from './data-dir.js'
+import { firefliesSidecarId, meetingContextFields, meetingContextKeys, type MeetingContextFields } from './meeting-context-keys.js'
 
 /**
  * The four domains of ONE user's COS. Retained as the documented example layout
@@ -743,6 +744,102 @@ export function resolveMergedScribe(
   return { status: 'resolved', ...only, path, content }
 }
 
+// ── Meeting context keys (6.64.0) ───────────────────────────────────────────
+//
+// What a meeting's dropped files are filed under in COS Control. See `meeting-context-keys.ts` for why the key is read
+// from source ids and never written. Two live meetings with the same PRIMARY key are ambiguous, so the list and the
+// detail both need to know how many meetings claim each primary key across every domain: that index is kept per month
+// folder and recomputed only when the folder's own stamp moves (every writer of meetings renames into place, so a new or
+// renamed meeting moves it). A warm read is one stat per month folder.
+
+/** The ordered keys for one canonical meeting, from what sits beside it and what it declares. */
+function meetingKeysFor(monthDir: string, filename: string, content: string | null, recordingsRoot: string | null, month: string): string[] {
+  let sessionId = sidecarListHints(monthDir, filename).sessionId
+  if (!sessionId && recordingsRoot) {
+    const fallbackDir = join(recordingsRoot, month)
+    if (existsSync(fallbackDir)) sessionId = sidecarListHints(fallbackDir, filename).sessionId
+  }
+  const firefliesId = firefliesSidecarId(monthDir, filename)
+  // The file is read for its markers only when neither sidecar names it: the primary key is then the first it declares.
+  let declared: string[] = []
+  if (content !== null) declared = mergedScribeSessions(content)
+  else if (!sessionId && !firefliesId) {
+    try { declared = mergedScribeSessions(readFileSync(join(monthDir, filename), 'utf-8')) } catch { declared = [] }
+  }
+  return meetingContextKeys({ g2SessionId: sessionId, firefliesId, declared })
+}
+
+interface PrimaryKeyMonth { stamp: string; primaries: string[]; builtAt: number }
+const primaryKeyCache = new Map<string, PrimaryKeyMonth>()
+let primaryKeyReads = 0
+/** A month is re-read at least this often even when its folder's stamp has not moved: a sidecar rewritten in place
+ *  leaves the folder alone (QA 2026-10-06). One month re-read costs about 3 ms. */
+const PRIMARY_KEY_MAX_AGE_MS = 60_000
+
+/** The primary key a meeting's OWN sidecars give it, or undefined. A meeting that only declares `<!-- g2-session -->`
+ *  markers (a merged scribe with no sidecar) claims nothing here: it holds those captures, and counting it would make
+ *  every merge whose captures are not yet retired read as two meetings fighting over one key (QA 2026-10-06). It also
+ *  means the index never reads a meeting body, so a cold build costs 4 KB heads only. */
+function sidecarPrimaryKey(monthDir: string, filename: string, recordingsRoot: string | null, month: string): string | undefined {
+  let sessionId = sidecarListHints(monthDir, filename).sessionId
+  if (!sessionId && recordingsRoot) {
+    const fallbackDir = join(recordingsRoot, month)
+    if (existsSync(fallbackDir)) sessionId = sidecarListHints(fallbackDir, filename).sessionId
+  }
+  return meetingContextKeys({ g2SessionId: sessionId, firefliesId: firefliesSidecarId(monthDir, filename) })[0]
+}
+
+/** How many live, canonical meetings take each key as their PRIMARY key from their own sidecars, across every domain. */
+export function meetingPrimaryKeyClaims(operationsDir: string, recordingsRoot: string | null = dataPath('recordings')): Map<string, number> {
+  const claims = new Map<string, number>()
+  for (const domain of discoverMeetingDomains(operationsDir)) {
+    const meetingsBase = join(operationsDir, domain, 'meetings')
+    let months: string[]
+    try { months = readdirSync(meetingsBase).filter(name => MONTH_PATTERN.test(name)) } catch { continue }
+    for (const month of months) {
+      const monthDir = join(meetingsBase, month)
+      let stamp: string
+      try { stamp = statStamp(statSync(monthDir)) } catch { primaryKeyCache.delete(monthDir); continue }
+      let entry = primaryKeyCache.get(monthDir)
+      if (!entry || entry.stamp !== stamp || Date.now() - entry.builtAt > PRIMARY_KEY_MAX_AGE_MS) {
+        let names: string[] = []
+        try {
+          names = readdirSync(monthDir).filter(name => name.endsWith('.md') && !ICLOUD_CONFLICT_COPY.test(name)).slice(0, MAX_LIST_CANDIDATES)
+        } catch { names = [] }
+        const primaries: string[] = []
+        for (const name of names) {
+          primaryKeyReads++
+          const key = sidecarPrimaryKey(monthDir, name, recordingsRoot, month)
+          if (key) primaries.push(key)
+        }
+        entry = { stamp, primaries, builtAt: Date.now() }
+        primaryKeyCache.set(monthDir, entry)
+      }
+      for (const key of entry.primaries) claims.set(key, (claims.get(key) ?? 0) + 1)
+    }
+  }
+  return claims
+}
+
+/** Diagnostics and the cost tests. */
+export function meetingPrimaryKeyCacheStats(): { months: number; reads: number } {
+  return { months: primaryKeyCache.size, reads: primaryKeyReads }
+}
+export function resetMeetingPrimaryKeyCache(): void {
+  primaryKeyCache.clear()
+  primaryKeyReads = 0
+}
+
+/** A meeting's context fields, given its keys and the claims index. The index counts meetings whose OWN sidecar gives
+ *  the key; a markers-only scribe is not in it, so beside its one live capture it reads 1 (fine), and beside two live
+ *  copies of that capture it reads 2: its key is contested, so it is ambiguous too. */
+function contextFieldsFor(filename: string, keys: string[], claims: Map<string, number>): MeetingContextFields {
+  return meetingContextFields(keys, {
+    conflictCopy: ICLOUD_CONFLICT_COPY.test(filename),
+    claimants: keys.length > 0 ? claims.get(keys[0]) ?? 1 : 1,
+  })
+}
+
 export type MeetingLibraryRecord = NonNullable<ReturnType<typeof findCosOperationsMeetingBySessionId>> & {
   recordId?: string
   librarySource?: 'direct_library' | 'cos_operations'
@@ -799,6 +896,7 @@ export function listCosOperationsMeetings(options: {
     : discovered.includes(domainFilter) ? [domainFilter] : []
 
   const allMeetings: CosOperationsMeetingMeta[] = []
+  let claims: Map<string, number> | undefined
 
   for (const domain of domains) {
     const meetingsBase = join(operationsDir, domain, 'meetings')
@@ -857,6 +955,11 @@ export function listCosOperationsMeetings(options: {
                 if (actionId) meta.actionId = actionId
               }
               if (options.day && meta.date !== options.day) continue
+              // 6.64.0: the keys this meeting's dropped files are filed under, from the ids just read (no extra read but
+              // the Fireflies sidecar's 4 KB head).
+              const firefliesId = firefliesSidecarId(monthDir, file)
+              const keys = meetingContextKeys({ g2SessionId: hints.sessionId, firefliesId, declared })
+              Object.assign(meta, contextFieldsFor(file, keys, claims ??= meetingPrimaryKeyClaims(operationsDir, recordingsRoot)))
               allMeetings.push(meta)
             } catch { /* skip unreadable files */ }
           }
@@ -1013,9 +1116,14 @@ export function getCosOperationsMeetingDetail(
   meta.mutable = true
   meta.canonicalRecord = `operations/${domain}/meetings/${month}/${resolvedFilename}`
   const source = boundedMeetingSource(content)
+  // 6.64.0: the same keys the list row carries, so Control files a drop from either surface under one key.
+  const recordingsRoot = dataPath('recordings')
+  const keys = meetingKeysFor(monthDir, resolvedFilename, content, recordingsRoot, month)
+  const context = contextFieldsFor(resolvedFilename, keys, meetingPrimaryKeyClaims(operationsDir, recordingsRoot))
 
   return {
     ...meta,
+    ...context,
     summary: extractSummary(content),
     topics: extractTopics(content),
     decisions: extractDecisions(content),
@@ -1026,6 +1134,73 @@ export function getCosOperationsMeetingDetail(
   }
 }
 
+/**
+ * 6.64.0: the context keys a Work card's saved meeting link answers to, without reading the meeting's body.
+ *
+ * WHY. A card links a meeting by record id, and a meeting's record id changes over its life: a fresh capture is
+ * `standalone:<sessionId>`, sync files it as `ops:<domain>:<month>:<file>`, the G2 enrichment renames the file, and a
+ * refile moves it to another domain. The files Miles dropped are filed under the meeting's KEY, which does not change.
+ * COS Control asks here for the keys of every link a card carries, so a card finds its meetings' files whichever record
+ * id it was linked under (QA, 2026-10-06).
+ *
+ * Exact ids only, as everywhere in this module: a `standalone:` id names its session; an `ops:` id is found at its own
+ * path, then by the rename rule the detail route already uses (the date and time in a G2 filename, in the same month),
+ * then by the SAME filename in another domain of the same month (a domain move keeps the name). Two candidates are no
+ * answer. Imported, re-derived and direct-library records are read-only.
+ */
+export function meetingContextForRecord(recordId: string, recordingsRoot: string | null = dataPath('recordings')): MeetingContextFields & { resolvedRecordId?: string } {
+  const standalone = /^standalone:([A-Za-z0-9_-]{3,96})$/.exec(recordId)
+  const operationsDir = resolveCosOperationsDir()
+  if (standalone) {
+    // A capture two operations meetings both carry is contested here too (QA round 2, N3).
+    const keys = meetingContextKeys({ g2SessionId: standalone[1] })
+    const claimants = operationsDir && keys.length > 0 ? meetingPrimaryKeyClaims(operationsDir, recordingsRoot).get(keys[0]) ?? 1 : 1
+    return meetingContextFields(keys, { claimants })
+  }
+  const ops = /^ops:([^:/\\]+):(\d{4}-\d{2}):([^/\\]+\.md)$/.exec(recordId)
+  if (!ops || !operationsDir) return { contextKeys: [], contextSupported: false, contextReason: 'read_only_record' }
+  const [, domain, month, filename] = ops
+  const domains = discoverMeetingDomains(operationsDir)
+  if (!safeName(domain) || !MONTH_PATTERN.test(month) || basename(filename) !== filename) {
+    return { contextKeys: [], contextSupported: false, contextReason: 'no_source_id' }
+  }
+  const at = (d: string, f: string) => join(operationsDir, d, 'meetings', month, f)
+  const isFile = (path: string) => { try { return statSync(path).isFile() } catch { return false } }
+  let found: { domain: string; filename: string } | null = domains.includes(domain) && isFile(at(domain, filename)) ? { domain, filename } : null
+  if (!found) {
+    const heads = (d: string) => {
+      try {
+        return readdirSync(join(operationsDir, d, 'meetings', month))
+          .filter(name => name.endsWith('.md') && !ICLOUD_CONFLICT_COPY.test(name))
+          .slice(0, MAX_LIST_CANDIDATES)
+          .map(name => ({ filename: name, content: safeRegularFile(realpathSync(join(operationsDir, d, 'meetings', month)), join(operationsDir, d, 'meetings', month, name), 4_000) ?? '' }))
+      } catch { return [] }
+    }
+    // Renamed in its own domain, then the same name in another domain, then renamed in another domain: one answer only.
+    const ownRename = domains.includes(domain) ? matchRenamedMeetingFilename(filename, heads(domain)) : undefined
+    if (ownRename) found = { domain, filename: ownRename }
+    else {
+      const sameName = domains.filter(d => d !== domain && isFile(at(d, filename)))
+      if (sameName.length === 1) found = { domain: sameName[0], filename }
+      else if (sameName.length === 0) {
+        const renamed = domains.filter(d => d !== domain)
+          .map(d => ({ domain: d, filename: matchRenamedMeetingFilename(filename, heads(d)) }))
+          .filter((hit): hit is { domain: string; filename: string } => Boolean(hit.filename))
+        if (renamed.length === 1) found = renamed[0]
+      }
+    }
+  }
+  if (!found) return { contextKeys: [], contextSupported: false, contextReason: 'no_source_id' }
+  const monthDir = join(operationsDir, found.domain, 'meetings', month)
+  // The same keys the row and the detail carry: the markers too, so the file is read (as the detail reads it).
+  let content: string | null = null
+  try { content = readFileSync(join(monthDir, found.filename), 'utf-8') } catch { content = null }
+  const keys = meetingKeysFor(monthDir, found.filename, content, recordingsRoot, month)
+  const fields = contextFieldsFor(found.filename, keys, meetingPrimaryKeyClaims(operationsDir, recordingsRoot))
+  const resolved = `ops:${found.domain}:${month}:${found.filename}`
+  return resolved === recordId ? fields : { ...fields, resolvedRecordId: resolved }
+}
+
 export function getDirectLibraryMeetingDetail(month: string, filename: string): MeetingDetail | null {
   const inspection = resolveMeetingLibrary()
   if (inspection.layout !== 'direct' || !inspection.root) return null

package/server/lib/jev.ts

@@ -88,8 +88,10 @@ export class JevClient {
   private failures = 0
   private breakerUntil = 0
   private lastError: string | null = null
+  /** `cap` is the daily input-token cap for THIS client's ledger. Work search (6.65.0) passes its own; the default is
+   *  COS_JEV_DAILY_TOKENS, shared by Work intake advice, session recommendations and completion checks. */
   constructor(private readonly fetchImpl: Fetch = fetch, private readonly now: () => Date = () => new Date(),
-              private readonly usageFile = JEV_USAGE_FILE) {}
+              private readonly usageFile = JEV_USAGE_FILE, private readonly cap: () => number = dailyCap) {}
 
   usedToday(): number {
     try {
@@ -121,7 +123,7 @@ export class JevClient {
   status(): { configured: boolean; source: JevKeySource; savedAt?: string; validatedAt?: string; usedToday: number; dailyCap: number; breakerOpenUntil: string | null; lastError: string | null } {
     const key = resolveJevKey()
     return { configured: !!key, source: key?.source ?? 'none', savedAt: key?.savedAt, validatedAt: key?.validatedAt,
-      usedToday: this.usedToday(), dailyCap: dailyCap(),
+      usedToday: this.usedToday(), dailyCap: this.cap(),
       breakerOpenUntil: this.breakerUntil > this.now().getTime() ? new Date(this.breakerUntil).toISOString() : null, lastError: this.lastError }
   }
 
@@ -130,7 +132,7 @@ export class JevClient {
     const key = resolveJevKey()
     if (!key) throw new JevError('jev_not_configured')
     if (this.breakerUntil > this.now().getTime()) throw new JevError('jev_breaker_open')
-    if (this.usedToday() + estimate > dailyCap()) this.fail('jev_cap_reached', false)
+    if (this.usedToday() + estimate > this.cap()) this.fail('jev_cap_reached', false)
     let res: Response
     try {
       res = await this.fetchImpl(`${JEV_ENDPOINT}/systemone`, { method: 'POST', signal: AbortSignal.timeout(JEV_LIMITS.timeoutMs),

package/server/lib/meeting-context-keys.ts

@@ -0,0 +1,135 @@
+/**
+ * Meeting context keys (6.64.0): the ids COS Control files a meeting's dropped files under.
+ *
+ * Miles, 2026-10-06: "link" meetings with files dragged onto them, the way Work cards take files, so a screen or slide
+ * shared in a meeting becomes agent context. COS Control keeps the files on the Mac (`~/cos-data/meeting-context`); the
+ * server only says which key a meeting answers to.
+ *
+ * READ-ONLY, FROM IDS THE MEETING ALREADY CARRIES. Plan v1 wrote a marker into the meeting file and failed review: more
+ * than a dozen writers regenerate, archive or race those files, and a write changes the hashes merge suggestions, merge
+ * decisions, Work review and speaker review depend on. So the key is read from the meeting's own source ids:
+ *   - `g2:<sessionId>` from its `.g2-chunks.json` sidecar (the speaker system's key; moves with every G2 rename);
+ *   - `ff:<id>` from its `.fireflies.json` sidecar;
+ *   - `g2:<id>` for every `<!-- g2-session -->` the file declares, which is how a merged meeting also shows the files of
+ *     the capture it absorbed.
+ * Measured 2026-10-06: 649 of 656 meetings from August to October carry at least one.
+ *
+ * IDENTITY IS AN EXACT ID. Never a title or a date (the rule `resolveMergedScribe` already keeps). Two live meetings whose
+ * own sidecars give the same PRIMARY key are `ambiguous`: Control adds and removes nothing there and never files a card
+ * link under their keys (files already dropped stay with the cards linked to the meeting they were dropped on).
+ */
+
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, realpathSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+
+/** A key as Control stores it. The id part is the server's own marker grammar (`G2_SESSION_MARKER`). */
+export const MEETING_CONTEXT_KEY = /^(?:g2|ff):[A-Za-z0-9:_-]{3,96}$/
+const SOURCE_ID = /^[A-Za-z0-9:_-]{3,96}$/
+
+const SIDECAR_HEAD_BYTES = 4096
+
+/**
+ * The value of a TOP-LEVEL string field in the head of a JSON object, or undefined.
+ *
+ * A Fireflies sidecar is up to megabytes of sentences, so only its head is read, and a regex alone would also match an
+ * `"id"` nested inside `participants` or `sentences` if the key order ever changed. This walks the head tracking depth
+ * and strings, and answers only for a key at depth 1.
+ */
+export function topLevelStringField(head: string, field: string): string | undefined {
+  let depth = 0
+  let i = 0
+  while (i < head.length) {
+    const c = head[i]
+    if (c === '"') {
+      let j = i + 1
+      let raw = ''
+      while (j < head.length && head[j] !== '"') {
+        if (head[j] === '\\') { raw += head.slice(j, j + 2); j += 2; continue }
+        raw += head[j]; j += 1
+      }
+      if (j >= head.length) return undefined
+      // A key at depth 1 is followed by a colon; read its value if it is the one asked for.
+      let k = j + 1
+      while (k < head.length && /\s/.test(head[k])) k += 1
+      if (depth === 1 && head[k] === ':' && raw === field) {
+        k += 1
+        while (k < head.length && /\s/.test(head[k])) k += 1
+        if (head[k] !== '"') return undefined
+        const end = head.indexOf('"', k + 1)
+        if (end < 0) return undefined
+        const value = head.slice(k + 1, end)
+        return value.includes('\\') ? undefined : value
+      }
+      i = j + 1
+      continue
+    }
+    if (c === '{' || c === '[') depth += 1
+    else if (c === '}' || c === ']') depth -= 1
+    i += 1
+  }
+  return undefined
+}
+
+/** The Fireflies transcript id in `<stem>.fireflies.json` beside a meeting, if there is one. Reads 4 KB, never a link. */
+export function firefliesSidecarId(monthDir: string, meetingFilename: string): string | undefined {
+  if (!meetingFilename.endsWith('.md')) return undefined
+  const path = join(monthDir, meetingFilename.replace(/\.md$/, '.fireflies.json'))
+  let fd: number | null = null
+  try {
+    const stat = lstatSync(path)
+    if (stat.isSymbolicLink() || !stat.isFile() || stat.size === 0) return undefined
+    if (dirname(realpathSync(path)) !== realpathSync(monthDir)) return undefined
+    // Non-blocking and no-follow (hazard-invariants): a FIFO planted under the sidecar's name must never hang the
+    // server's one thread, and a link swapped in after the lstat is refused at the open itself.
+    fd = openSync(path, constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW)
+    if (!fstatSync(fd).isFile()) return undefined
+    const buffer = Buffer.alloc(Math.min(SIDECAR_HEAD_BYTES, stat.size))
+    const read = readSync(fd, buffer, 0, buffer.length, 0)
+    const id = topLevelStringField(buffer.subarray(0, read).toString('utf8'), 'id')
+    return id && SOURCE_ID.test(id) ? id : undefined
+  } catch {
+    return undefined
+  } finally {
+    if (fd !== null) { try { closeSync(fd) } catch { /* already closed */ } }
+  }
+}
+
+/** The ordered, de-duplicated keys for one meeting. The first is primary: the capture's own sidecar, then Fireflies,
+ *  then what the file declares. */
+export function meetingContextKeys(sources: { g2SessionId?: string; firefliesId?: string; declared?: readonly string[] }): string[] {
+  const keys: string[] = []
+  const add = (prefix: 'g2' | 'ff', id: string | undefined) => {
+    if (!id || !SOURCE_ID.test(id)) return
+    const key = `${prefix}:${id}`
+    if (!keys.includes(key)) keys.push(key)
+  }
+  add('g2', sources.g2SessionId)
+  add('ff', sources.firefliesId)
+  for (const id of sources.declared ?? []) add('g2', id)
+  return keys
+}
+
+export interface MeetingContextFields {
+  contextKeys: string[]
+  contextSupported: boolean
+  contextAmbiguous?: true
+  contextReason?: 'no_source_id' | 'read_only_record' | 'conflict_copy' | 'ambiguous'
+}
+
+/**
+ * What a row or a detail says about its files.
+ *
+ * `claimants` is how many live meetings have this meeting's primary key as THEIR primary key (this one included). Two
+ * or more is ambiguous: the keys still go out, so Control can show files already there, but nothing is added or sent.
+ */
+export function meetingContextFields(keys: string[], options: { conflictCopy?: boolean; claimants?: number } = {}): MeetingContextFields {
+  if (options.conflictCopy) return { contextKeys: [], contextSupported: false, contextReason: 'conflict_copy' }
+  if (keys.length === 0) return { contextKeys: [], contextSupported: false, contextReason: 'no_source_id' }
+  if ((options.claimants ?? 1) > 1) return { contextKeys: keys, contextSupported: false, contextAmbiguous: true, contextReason: 'ambiguous' }
+  return { contextKeys: keys, contextSupported: true }
+}
+
+/** Fields for a record this release does not key: a direct library, an import or a re-derived (blended) record. */
+export function readOnlyContext(): MeetingContextFields {
+  return { contextKeys: [], contextSupported: false, contextReason: 'read_only_record' }
+}

package/server/lib/meeting-store.ts

@@ -136,6 +136,16 @@ export interface MeetingMeta {
   sources?: Array<{ kind: 'g2' | 'fireflies'; id: string; recordId?: string }>
   /** Present only when the server can state a truthful local record. */
   canonicalRecord?: string
+  /** 6.64.0, additive and read-only. The keys COS Control files a meeting's dropped files under, from source ids the
+   *  meeting already carries (`g2:<sessionId>`, `ff:<firefliesId>`, then every `<!-- g2-session -->` it declares).
+   *  First = primary. Never computed from a title or a date, and nothing is written into the meeting. See
+   *  `meeting-context-keys.ts`. */
+  contextKeys?: string[]
+  /** False when files cannot be added here: a re-derived or read-only record, a conflict copy, a meeting with no
+   *  source id, or two meetings claiming one key. `contextReason` says which. */
+  contextSupported?: boolean
+  contextAmbiguous?: boolean
+  contextReason?: 'no_source_id' | 'read_only_record' | 'conflict_copy' | 'ambiguous'
   /** Additive. Unique sidecar speakers + whether a human correction landed. */
   voiceReview?: {
     voices: number
@@ -579,6 +589,18 @@ export class MeetingStore {
     return detail
   }
 
+  /** 6.64.0: the session in a stored recording's sidecar, for its context key only. The detail itself keeps its shape
+   *  (no sessionId, its recordId unchanged). Undefined when the month, the file or the sidecar is not readable. */
+  storedSessionId(month: string, filename: string): string | undefined {
+    if (!MONTH_PATTERN.test(month) || !SAFE_FILENAME_PATTERN.test(filename) || basename(filename) !== filename) return undefined
+    const rootReal = this.rootRealpath()
+    if (!rootReal) return undefined
+    const monthDir = join(this.root, month)
+    const monthReal = safeDirectoryRealpath(monthDir, rootReal)
+    if (!monthReal) return undefined
+    return this.sidecarSessionId(monthDir, monthReal, filename)
+  }
+
   private rootRealpath(): string | null {
     return existingRootRealpath(
       this.root,