@gotcos/glasses-server 6.70.0 → 6.71.4

package/.env.example

@@ -234,6 +234,14 @@ BIND_HOST=0.0.0.0
 # COS_MEETING_PROGRESSIVE_HQ=1
 # COS_MEETING_PROGRESSIVE_HQ_THREADS=2   # optional lower override; cannot raise the tier cap
 
+# Experimental HQ timing and Meeting Ask evidence. Both default OFF. The native
+# timestamp candidate uses CLI JSON plus its own VAD mapping; live JSON and DTW
+# retain their crash protections. Ask additionally requires progressive HQ.
+# This path FAILED the 30-second live refinement gate on the test machine;
+# human-corrected fact accuracy is also pending. Do not enable for public use.
+# COS_BATCH_HQ_TIMESTAMPS=1
+# COS_MEETING_ASK_HQ_EVIDENCE=1
+
 # Early Sync writes stable meeting identity to the Operations pipeline before
 # HQ finishes, then enriches that same artifact in place. It is I/O-only and
 # deliberately independent from the progressive-HQ compute switch.

package/CHANGELOG.md

@@ -1,3 +1,50 @@
+## 6.71.4 · public meeting evidence release
+
+- New questions about completed G2 recordings receive accepted finalized transcript passages alongside original live evidence. Earlier answer quotations and turn targets stay unchanged. Final passages are frozen at admission, bounded, redacted and restricted to the requested audio cutoff.
+- Meeting Ask distinguishes an uncaptured commitment from an explicit refusal, recognizes evidenced fictional tests, and includes evidence confidence in each answer.
+- Includes 6.71.1 through 6.71.3 saved-Ask, file, model, COS search and confirmed meeting-context improvements. Live timestamp and progressive refinement canaries remain disabled by default; this release does not claim higher raw ASR accuracy or a passed 30-second refinement gate.
+
+## 6.71.3 · private meeting evidence candidate
+
+- Every completed Meeting Ask answer includes a qualitative evidence-confidence row. G2 microphone/ASR limitations guide reasoning; names remain unverified when unclear, explicit later corrections resolve the earlier value, and evidenced rehearsals are not treated as real commitments.
+- Per-meeting calendar suggestions match recording start. A user explicitly confirms a configured domain and optional calendar match; COS searches then focus on that domain. Context freezes at request admission, survives navigation/restart, and stale edits cannot overwrite newer confirmations. Calendar context never lends words to web queries or proves meeting decisions.
+- Includes every 6.71.2 saved-Ask, file, search and canary change. Timestamp and HQ refinement canaries remain disabled: prior live latency exceeded 30 seconds. No claim of improved raw ASR accuracy.
+- Plan: `docs/test-plan-6.71.3.md`. Old clients still receive sections and composed Markdown; the context capability is additive.
+
+## 6.71.2 · private combined candidate · transcription canary, disabled by default
+
+- Combines the 6.71.1 Meeting Ask changes with disabled transcription canaries. Saved meeting fallback, recent-topic questions, phone files and COS search settings are retained. See `docs/test-plan-6.71.2.md` for the combined acceptance gates.
+
+- An explicit `COS_BATCH_HQ_TIMESTAMPS=1` candidate enables ordinary timestamps for meeting batch CLI decoding and maps compressed VAD times through the table emitted by the same native process. Incomplete or inconsistent timing evidence rejects the candidate result. Empty PCM audio returns an empty result; missing JSON fails cleanly. Live ASR retains compact JSON and DTW remains disabled.
+- `COS_MEETING_ASK_HQ_EVIDENCE=1`, together with progressive HQ and the timestamp flag, can freeze verified sealed passages into a Meeting Ask request. It supports Control's direct transcript submissions, retains recent live turns, preserves source turn IDs and request idempotency, and withholds mixed speaker attribution. Corrupt, incomplete or changed caches leave the live transcript available. The canonical meeting transcript is untouched by an Ask.
+- Qualification is blocked: the production background CPU probe took 142.641 seconds after sealing, exceeding the accepted 30-second refinement delay. Human-corrected facts and a complete live pipeline replay remain pending. See `docs/asr-canaries.md`; this is not a rollout or accuracy claim.
+
+## 6.71.1 · private test candidate
+
+- Meeting Ask works after a meeting ends. In the Oct 11 live test, VIEWS offered a meeting that had ended at 10:42 and its Ask screen opened, but every question failed with 404 `session_not_available`: `GET /api/meeting-ask/transcript` read only the in-memory session, which is cleared on save. It now reads, in order, the live session, the durable active-session file of an unsaved capture, the saved record's chunk sidecar (same chunk ids as the live recording, so turn ids in earlier answers still match), and the saved Markdown transcript (without turn times). Nothing is written. An ended meeting answers with `ended: true`, `endedAt` when known (the close time, else start plus duration), `source` and a notice. Only when no source holds its words is it 404 `meeting_transcript_unavailable`. Contract: `MeetingAskTranscript` in `shared/meeting-ask.ts`.
+- What to ask leads with what is being discussed now. In the same test the conversation changed topic and the first questions were about how the meeting began.
+  - Evidence: when the meeting is over the 32,000-character budget, the last ten minutes are read in full (including the turn that straddles the start of that window), then earlier passages, evenly spaced across the rest of the recording, fill what is left. If the last ten minutes alone overflow, the newest turns win and nothing earlier is added. The notice says which happened. The other presets keep the whole-recording sample.
+  - The task tells the model to start with the most recent topic, not to ask about a topic the meeting has left unless it is still unresolved, and gives it `recentSinceMs`.
+  - The server orders the Ask rows newest first, by the latest transcript turn each one cites; a row that cites no transcript turn goes last and ties keep the model's order. So what stays first. Clients number them Ask 1, Ask 2, Ask 3 in this order.
+- What to ask may look in COS once. The model may request one search of COS memory and earlier meetings, planned from the recent discussion, so a question can draw on prior cases or notes, cited `[H1]`. It never reaches the web: a web-scoped request from any preset is searched in COS, the explicit web request is honored only for a typed question, and the runtime sends nothing from a preset to the web search even if asked. A typed question keeps its two lookups and three model calls; What to ask has at most one lookup and two model calls; Catch me up, Summarize and Action items never search.
+- The phone can add files to a meeting's Ask context. `POST /api/meeting-ask/files/media` `{ sessionId, serverInstanceId, media: [{ id, name? }] }` takes 1 to 10 uploads already made through `/api/media` (the CHAT tab's photo and file path, same 64 MB and type limits) and answers `{ files }`, the meeting's whole file list, as `PUT files` does. Each becomes a row `phone_<mediaId>` with `origin: "phone"`, beside COS Control's rows, in the same Meeting Ask file list, so the next Ask uses it and history and export show it. The same media id again updates the same row.
+  - Text comes from the media store's extract made at upload (TXT, MD, CSV, JSON and PDF text layers), capped at 100,000 bytes with a notice when cut. It then goes through the same rules as Control's files: a secret in the text makes it `secret-held`, and the meeting limits (100 files, 500,000 bytes, 413 `file_context_limit`) apply. Statuses are final in the answer: `ready`, `secret-held`, `unsupported` (files with no words; photos and videos, since the server has no OCR: "Photos can't be read from the phone yet. Add them from COS Control on your Mac.") or `failed` (no text extract).
+  - Errors: 400 `invalid_media` or `invalid_session_id`, 409 `server_instance_mismatch` or `media_conflict` (reserved by a CHAT queue item), 404 `media_not_found`, 410 `media_expired`, 503 `media_unavailable` or `maintenance`.
+  - `capabilities.phoneFiles: true` on `GET /api/meeting-ask/config` and `capabilities.meetingAsk` on `/api/health` (now built from one constant). `meeting_context.py list` in the COS scripts also lists these rows for a `g2:` key. COS Control's own drop folder is not written by the server.
+- A Meeting assistant setting chooses how Meeting Ask searches COS memory and earlier meetings, for typed questions and What to ask alike. `cosSearch: "meaning"` (the default) adds the embedding search: the search phrase is embedded by the COS install's embedding provider (the memory and meeting indexes' `embedding_client`). For What to ask that phrase is written by the model from the meeting, so meeting words can reach that provider. `cosSearch: "keyword"` matches words locally only: no embedding request, no tokens, and each Ask that searched says "COS search used keywords only, as set in Meeting assistant settings." Neither is a web search. `GET /api/meeting-ask/config` returns `cosSearch` and `capabilities.cosSearchMode: true`; `PUT /api/meeting-ask/config {"cosSearch":"keyword"}` changes it alone (a model may be sent with it), saved in the journal folder beside the model setting; a bad value is 400 `invalid_cos_search` and nothing is written. It applies from the next question.
+
+## 6.71.0 · private test candidate
+
+- Meeting Ask answers come as labeled sections. The model returns `{"sections":[{"label","text"}],"searchQuery":null}` instead of free Markdown, and every answer leads with **So what**. Server only; additive to the 6.69.0 contract in `shared/meeting-ask.ts`. Pairs with the Meeting Ask polish round in COS Glasses and COS Control.
+  - Each action has its own labels, in this order. `catch_up`: So what, Decided, Open, You owe, Next. `summary`: So what, Covered, Decided, Open, Next. `actions`: So what, You owe, Others owe, Unowned, Proposed. `questions`: So what, then up to three Ask rows, each one question and one short reason. `ask`: So what, Details. "You asked" is the client's to render from the question; the model never writes it.
+  - The server checks every answer. Labels match regardless of case or a trailing colon and are written in their canonical case. Rows are put in the action's order. A repeated label joins into one row, except Ask, which keeps up to three. Empty rows and padding such as "None" or "n/a" are dropped. In a sections array, a label the action does not allow, a malformed row, more than 12 rows, or a missing or empty So what is 502 `invalid_answer`, as before, with no retry. Empty or non-JSON output is `invalid_answer` too.
+  - A reply in the 6.70.0 `{"answer":"..."}` shape still answers, because Codex, Cursor and Ollama can be picked for Meeting Ask. Its `**Label:** text` lines are read through the same rules; a line with no label continues the row above it. If that gives no valid So what (no labels, text above the first label, or a label the action does not allow), the whole answer becomes one So what row, line breaks kept, with the notice "This answer was not in the skim format." 
+  - **You owe** lists only actions the transcript ties to the wearer: a line spoken by "You", or one naming the wearer. The prompt now carries the wearer's profile name (`wearer`, null when unset) and the action's `labels`. A You owe row that cites no transcript passage is dropped; owners and dates are never guessed.
+  - Each section carries `sources`: the ids it cites (`T3`, `H1`, `W2`, `F1`), once each, in first-cited order. A citation to an id the evidence does not hold still reads `[source unavailable]` and is left out. Line breaks inside a row are flattened and secrets redacted per row.
+  - `answer` is still filled, as one `**Label:** text` paragraph per section (rows separated by a blank line, so CommonMark clients keep them apart) with inline citations kept, so older clients show the labeled look unchanged. `sections` is saved in the v2 journal and returned by `POST requests`, `GET requests/<id>`, `GET history`, and the legacy `POST /api/meetings/live-ask`. An answer kept in memory after a failed journal write keeps its sections too.
+- Catch me up reads the whole meeting. 6.70.0 read only the last 60 seconds. The task is now "Catch me up on the meeting so far." Long meetings keep the 32,000-character evidence budget, which samples across the whole recording, and its "selected passages" notice. A catch-up result is reused for at most one 10-second step of recording time; any new turn asks again.
+- `shared/meeting-ask.ts` adds helpers clients can import or copy: `MEETING_ASK_LABELS`, `meetingAskCitations`, `meetingAskAnswerMarkdown`, and `meetingAskFromLine` for the lens "From:" row. It returns null when an answer cites only this meeting, and otherwise one line of at most 80 characters, such as "the web, example.com", "COS memory", "earlier meeting, Sep 30 pricing sync" or "file, Q4 pricing.pdf". Only cited ids count; uncited results from the same web search do not.
+
 ## 6.70.0 — private test candidate
 
 - Meeting Ask public web search works for ordinary public questions. 6.69.0 withheld every search tried in the Oct 10 live test: "Who is alt coin daily?", "What's the latest news on our competitor Acme?" and the follow-up "Run the web search". Server only; no contract change. Works with COS Control 0.5.280 and later and COS Glasses 6.10.623 and later; COS Control 0.5.282 and COS Glasses 6.10.624 add a model control to the Ask chat.
@@ -4933,6 +4980,11 @@ unsaved capture, and makes batch status stop lying about finished work.
 
 # Changelog
 
+## 6.71.4
+
+- New questions about completed G2 recordings receive accepted finalized transcript passages alongside the original live evidence. Earlier answer quotations and turn targets remain unchanged. Final passages are frozen at admission, bounded, redacted and restricted to the requested audio cutoff.
+- Meeting Ask distinguishes an uncaptured commitment from an explicit refusal and reports evidence confidence. Live high-quality timestamp and progressive refinement canaries remain disabled by default.
+
 ## [6.36.4] - 2026-08-17
 
 ### A cloned Codex conversation gets its own identity

package/README.md

@@ -943,3 +943,9 @@ Runtime/model setup is local; the existing provider sign-in requirements remain.
 
 Candidate only: publish the versioned runtime asset and server package before
 promoting the matching Control appcast entry.
+
+### Meeting evidence in server 6.71.4
+
+Meeting Ask includes a qualitative evidence-confidence note. New questions about completed G2 recordings can use accepted final transcript passages alongside preliminary live evidence. Those final quotations are frozen at admission and bounded by the submitted audio cutoff; earlier answer quotations and original turn IDs stay unchanged. Final quotations have no precise word timestamp or live turn target.
+
+Transcription can mishear names, numbers, negations and speakers. Missing or incomplete words do not prove a refusal or commitment. Calendar and user-confirmed meeting context guide retrieval, without proving what was said. Timestamp and progressive-refinement canaries remain disabled by default; this release does not claim improved raw ASR accuracy or a passed 30-second refinement gate. Existing companion clients remain compatible.

package/docs/asr-canaries.md

@@ -0,0 +1,103 @@
+# Transcription qualification
+
+The objective is reliable answers during a live meeting: names, quantities,
+negation, owners, deadlines, decisions and corrections must survive ASR. The
+initial live transcript remains available immediately. Refined passages must be
+available within 30 seconds of speech, including buffering, scheduling and decode.
+
+## Current decision
+
+**Hold rollout. Both new flags default off.** Ordinary CLI timestamps plus native
+VAD remapping are promising on the private silver corpus. The historical live
+verbose-JSON and DTW crash mechanisms retain their existing protections.
+
+Native probes exercised silence, near silence, a 5 ms clip, empty PCM WAV,
+malformed/truncated input, eight real speech clips, cancellation, Metal
+preemption and CPU retry. Eight remapped clips had finite ordered token clocks;
+some tokens still have zero duration. These are heuristic token timestamps, not
+human-validated word boundaries or speaker identities.
+
+A concurrent private probe ran 50 compact-JSON ASR requests and 50 warm ANE
+diarizer runs for each of the baseline and candidate. Candidate ASR p95 was
+325 ms versus 339 ms; diarizer p95 was 173 ms versus 185 ms. API health p95 rose
+from 53 ms to 87 ms (maximum 220 ms). These small samples do not establish zero
+regression risk. Initial isolated diarizer cold loads timed out; the successful
+comparison used the same warm, isolated model cache for both arms.
+
+The CPU batch used production progressive settings: six threads, CPU only and
+macOS background task policy. It took **142.641 seconds**, versus 131.797 seconds
+for baseline. Adding its 36.25-second sealed window gives a first-word delay
+lower bound of **178.891 seconds**, before ingest or queue time. Even the last
+words wait longer than 30 seconds. Foreground CPU and idle Metal timings cannot
+substitute for this production policy.
+
+## Experimental boundaries
+
+- `COS_BATCH_HQ_TIMESTAMPS=1` applies only to meeting batch CLI decoding. It omits
+  `--no-timestamps` and preserves native diagnostics needed for the exact VAD
+  table. Timestamp mode partitions checkpoint fingerprints. Missing JSON or
+  timing evidence fails closed; rollback uses the existing legacy decoder.
+- `COS_MEETING_ASK_HQ_EVIDENCE=1` additionally requires timestamps and
+  `COS_MEETING_PROGRESSIVE_HQ=1`. Ask reads completed sealed checkpoints; it
+  never starts a decode. Audio hash, configuration, context chain, session and
+  ASR completion must match. Runtime coverage/number/clock guards catch obvious
+  corruption; they cannot establish semantic accuracy.
+- Current Control submits live turns directly. Refinement occurs at v2 request
+  admission and in the optional transcript endpoint. Latest uncovered turns are
+  retained. Refined source IDs point to the first original chunk. Mixed voices
+  use `Unidentified`; no owner is inferred from guessed token attribution.
+- A request's submitted fingerprint remains unchanged. The answer's saved source
+  text records the evidence used. A retry reuses the saved exchange even if new
+  checkpoints arrive. Files, web search policy and answer model are unchanged.
+- The legacy live-ask endpoint retains its original transcript behavior.
+
+## Repeatable checks
+
+From the isolated server worktree:
+
+```sh
+npm run typecheck
+npm test
+npm run mutation:gate -- asr-canary-raw-clock asr-canary-native-count \
+  asr-canary-lost-tail asr-canary-changed-number \
+  asr-canary-control-bypasses-refinement asr-canary-future-evidence \
+  asr-canary-stale-cache
+```
+
+The native workers are excluded from the npm package. They require an explicit
+private `COS_ASR_CANARY_ROOT`, `COS_DATA_DIR`, `COS_PROFILE_PATH`, and a read-only
+`COS_ASR_CANARY_ACTIVE_DIR` pointing at the real server's active-session directory.
+Data, profile, audio and outputs must reside under the private root. The guard
+refuses work during a real meeting and aborts owned work if one starts. Native
+results and audio stay outside this public repository.
+
+```sh
+node --import tsx/esm server/scripts/hq-native-canary.ts INPUT.wav OUTPUT.json cpu
+# Other modes: metal, abort, preempt. Set the timestamp flag for candidate runs.
+```
+
+The contention worker additionally requires a separately owned persistent
+Whisper server at `COS_ASR_CANARY_PORT=18278`, an offline `COS_NEMOTRON_CLI` wrapper,
+and explicit `COS_NEMOTRON_MODELS`. The wrapper must preserve the isolated
+CoreFoundation home, model cache and network-denying sandbox. It accepts a batch
+WAV, live-chunk WAV and output JSON path. It reads the actual API health endpoint
+but never starts, restarts or sends transcription to the real live server.
+
+## Required before adoption
+
+1. Replace machine reference drafts with human-corrected transcripts across the
+   four speech strata and at least 200 verified entity mentions. Add question
+   fixtures for negation, changed decisions, numbers, owners and deadlines.
+2. Replay the actual capture-to-Ask pipeline on at least 13 meetings. Include
+   buffering, queue time, CPU fallback, concurrent ASR/diarization and time to
+   refined evidence. A faster preview estimate excludes lookahead and is not
+   this measurement. The current sealed-HQ mechanism fails this requirement.
+3. Preserve quality gains in the same production path, with paired meeting
+   confidence intervals and non-speech positive controls. Prompt removal was
+   rejected: WER rose from 15.47% to 16.87% on 13 paired silver windows. Its
+   confidence interval includes zero, so this is a rejection of qualification,
+   not proof that every use of a shorter prompt is worse.
+4. Repeat native failure/cancellation checks and confirm saved raw audio and
+   canonical transcript survive. Include cold start and longer thermal runs.
+
+No flag, silver score, unit test or native probe grants deployment approval.

package/docs/test-plan-6.71.2.md

@@ -0,0 +1,111 @@
+# Server 6.71.2 combined test plan
+
+Private candidate, October 11, 2026. Combines server 6.71.1 (`ce35151`)
+with the transcription canary branch. No client binary changes are included.
+Public distribution and transcription adoption are separate gates.
+
+## Release decision
+
+The production live decoder keeps compact JSON and disabled DTW. Both new flags
+remain unset/off: `COS_BATCH_HQ_TIMESTAMPS` and `COS_MEETING_ASK_HQ_EVIDENCE`.
+The legacy batch fingerprint is unchanged with timestamps off. The combined
+server retains the 6.71.1 Meeting Ask features. Do not enable refinement during
+normal meetings until its latency and human accuracy gates pass.
+
+## Automated regression checks
+
+Run from the combined worktree, with Vitest's isolated data/profile configuration:
+
+```sh
+npm run typecheck
+npm test
+npm run mutation:gate -- asr-canary-raw-clock asr-canary-native-count \
+  asr-canary-lost-tail asr-canary-changed-number \
+  asr-canary-control-bypasses-refinement asr-canary-future-evidence \
+  asr-canary-stale-cache asr-merge-ended-overlay asr-merge-lost-source
+npm pack --dry-run --json
+```
+
+| Contract | Required result |
+| --- | --- |
+| Disabled flags | Same live transcript response and batch cache identity as the released path; no HQ cache read on GET. |
+| Ended meeting | Saved sidecar IDs, source, duration, ended notice and close time survive with HQ on or off. Active-file and Markdown fallback still work; missing words return the released 404. |
+| Direct Control submission | Refine only admitted, normalized evidence. Saved source quotes reflect the frozen evidence. Original request fingerprint governs retries. |
+| Live tail and cutoff | New uncovered speech remains; no checkpoint ending after the question cutoff may replace evidence. Mixed voices receive no inferred identity. |
+| Phone files | Real uploaded text remains ready/citable beside Control files; secret, unsupported, expired, missing and oversized statuses retain their contracts. |
+| COS lookup | Meaning is default; keyword causes no embedding request. Settings survive restart and malformed updates write nothing. |
+| What to ask | Recent topic gets evidence priority and citation ordering. At most one COS lookup/two model calls; no preset web request escapes to web. |
+| Combined answer | One refined direct request can cite the real phone document, use keyword COS search, preserve notices and replay once without re-running refinement/model. |
+| Capture protections | Compact live JSON, disabled DTW, raw audio persistence, cancellation, Metal preemption and CPU fallback remain covered. |
+| Packaging | Candidate version differs from installed 6.71.1. Private audio, receipts, fixtures, test suites and native canary workers are excluded. |
+
+The mutation run must start with a green baseline, reject every selected mutant
+through an assertion failure (not compilation/setup failure), and restore sources.
+Full-suite counts and artifact checksums are recorded in the private release receipt.
+
+## Native evidence carried into this merge
+
+The timestamp parser, native batch call and checkpoint validation are unchanged
+from the qualified canary commit `7479e21`; the merge adds the released Ask
+resolver and phone/search work. Previous private probes covered CPU/Metal silence,
+near silence, short/empty/malformed inputs, eight real speech clips, cancellation,
+preemption and CPU retry. Native output clocks were finite/bounded. Some tokens
+have zero duration; these are heuristic token clocks, not precise word boundaries.
+
+Concurrent probes used 50 compact-JSON ASR requests and 50 warm ANE diarizer runs
+per arm. ASR p95 was 339 ms baseline / 325 ms candidate; diarizer 185 / 173 ms;
+API health 53 / 87 ms (candidate maximum 220 ms). The cold isolated diarizer failed
+to load in the first bounded attempts; the paired comparison used a warm cache.
+This is limited evidence, not proof of zero regressions or of cold-start safety.
+Repeat native probes if decoder/parser/checkpoint code, native binary, model,
+thread policy or hardware changes. See [transcription qualification](asr-canaries.md).
+
+## Local installed acceptance and client checks
+
+Keep the previous managed 6.71.1 generation and package as rollback. Before a
+candidate switch, confirm no active capture or Ask; use the COS Control managed
+runtime installation, never the retired app LaunchAgent installer. Record before
+and after generation/version, exact listener ownership and API/Whisper health.
+New flags must remain off in the installed launch environment.
+
+The following require an actual client/device session and remain pending until
+observed; server tests alone do not count:
+
+- Start a short controlled meeting. Speak an owner, a number, a negative statement
+  and a deadline; change the topic and correct one decision. Verify initial text
+  continues immediately and ask about each fact. Check source quote, time and ID.
+- On Control and the current phone build, use Catch me up, Summarize, Action items,
+  What to ask and a typed question. Check recent-topic questions and the section
+  rendering. Retry one request after navigation; history/export remain consistent.
+- Add a real TXT or PDF text file from the phone and a file from Control. Ask a
+  question requiring both meeting text and the file. Verify ready/unsupported
+  notices, removal and saved historical citations.
+- Switch COS search to keyword and back. Trigger a COS lookup, check its notice,
+  and verify a preset cannot invoke web search. A public typed lookup retains its
+  established privacy policy.
+- End and save the meeting; reopen Ask, ask a follow-up, then open an earlier
+  source in the transcript. IDs and ended notice must still match.
+- Read the answer on the lens and phone, including sources and scrolling. Capture
+  glitches, wrong facts, missing text, crashes or an unhealthy service block release.
+
+Rollback the candidate through the managed generation selector if any installed
+regression occurs. Do not delete raw audio, canonical transcripts or Ask history.
+
+## Tangible transcription improvement gate (currently blocked)
+
+1. Human-correct the reference transcripts in all speech strata and verify at
+   least 200 entity mentions. ASR silver transcripts cannot certify fact fidelity.
+2. Replay the actual capture-to-Ask path across at least 13 meetings. Measure
+   speech-to-refined-evidence p95 including buffering, ingest, queueing and decode,
+   with concurrent capture, diarization, CPU fallback and cold start. It must be
+   within the accepted **30 seconds** and preserve the initial live transcript.
+3. Require paired meeting accuracy gains with uncertainty intervals, plus reliable
+   answers for names, amounts, negation, owners, deadlines and changed decisions.
+4. Run silence/non-speech positive controls, native failures and longer thermal
+   contention trials; preserve saved raw audio and canonical transcript hashes.
+
+Current production-policy CPU candidate decode took **142.641 seconds** after
+sealing a **36.25-second** window, so the first-word lower bound is **178.891 seconds**
+before ingest/queue time. The sealed window alone exceeds 30 seconds. This blocks
+refinement adoption even though the silver WER improved from 15.718% to 12.986%.
+No ASR engine, prompt or accuracy claim is being promoted by this combined build.

package/docs/test-plan-6.71.3.md

@@ -0,0 +1,30 @@
+# Private meeting-evidence release: 6.71.3 + Glasses 6.10.627 + Control 0.5.285
+
+This candidate includes 6.71.2, Glasses 626 and Control 284 without replacing their frozen artifacts. Production aliases and marketplace promotion stay on their current version until physical acceptance. Timestamp and HQ evidence flags remain unset/off.
+
+## Automated gates
+
+- Complete server tests and typecheck; complete companion tests, release typecheck and official Even SDK/manufacturer gate; guarded Control setup and Meeting Ask contracts, signed/notarized build and fresh extracted-app Gatekeeper proof.
+- Tools-off Haiku and Sonnet canaries: explicit correction 10 → 12 (exclude 20), truly unresolved proposals, negated approval/commitment. Every answer includes a qualitative confidence note and grounded citations. Names must not be silently normalized. Review semantic answers as well as assertions; lexical assertions are bounded checks, not calibrated accuracy.
+- Replay the submitted transcript and exact question from the user's reported failure with candidate prompt. No canonical transcript or original exchange is overwritten.
+- WKWebView replay at 320×568, 390×844, 844×390 and 390×420: twelve earlier/tail text updates and one new speaker; preserve visible line identity and offset within 1 px; composer, presets, jump and model controls remain reachable. Desktop replay is not physical iPhone acceptance.
+- Optional Jev alone must not keep Finish setup visible. Genuine counted gaps still appear. Existing Hide and Skip choices persist.
+- Calendar suggestions match recording start, never a later current event; stale, all-day, malformed and unrelated events excluded. No auto-confirmed match/domain. Domains come from the install's configured/discovered domain registry, not baked-in business names.
+- Context revision guards and meeting/server isolation; frozen request context on retries and mid-answer domain change; domain-restricted COS retrieval; no calendar/transcript/file words admitted to public web search; no AI call for confirmation.
+- Old clients/new server: 626 and Control 284 accept arbitrary section labels, including Confidence. New app/old server: context button absent without capability; original Ask/files/history remain compatible.
+
+## Physical acceptance
+
+1. Sideload 627. Start a fresh recording, scroll several paragraphs up, wait for validated text and a speaker change. Reading position should remain steady. Jump to now should follow the tail; selection, composer and tab positions should survive.
+2. Dictate an explicitly labeled test pilot: owner Nora, budget $2,400, deadline Friday October 16; order ten, then twelve replacing ten, not twenty. Ask the original factual question. Expect 12; flag an unclear owner spelling separately. A quantity proposed without a correction remains unresolved. Negated approval must remain negated.
+3. Run every preset and one typed question. Each new output on phone, Control and lens must include Confidence; low/limited evidence must identify the relevant uncertainty. Sources still open and saved answers retain their original model and context.
+4. Open Confirm meeting context. Confirm a configured domain and optional suggested calendar event. Next COS lookup must focus on that domain. Switch to All domains/No calendar match and confirm. Reopen the same meeting, then another meeting, to verify persistence and isolation. Calendar does not imply attendance or decisions.
+5. Stop/save/reopen; retain questions, file revisions and transcript citation IDs. Exercise phone file upload, COS keyword toggle and compact model details inherited from 626/284. Control Finish setup should clear when Jev is its only unfinished row.
+
+## Audio refinement hold
+
+Do not enable COS_BATCH_HQ_TIMESTAMPS or COS_MEETING_ASK_HQ_EVIDENCE on this release. Prior CPU end-to-end refinement exceeds the accepted 30-second limit, and the human-reference accuracy set is unfinished. Improvements here are transcript interpretation and display behavior, not proof of improved raw ASR. Future adoption requires paired human references, entity/negation fidelity, real incremental latency including sealing/queue/decode, crash/silence/cancellation and contention canaries, plus fallback to the existing live transcript.
+
+## Rollback
+
+Retain server 6.71.2 tarball/generation, EHPK 6.10.626 (f008d422...), and Control 0.5.284 build 337. Update only through the managed helper and only when every active-work/drain gate permits it. Never interrupt a recording or another session to install.

package/managed-runtime-contract.json

@@ -22,6 +22,8 @@
     "COS_LIVE_CUES_AUTO",
     "COS_BATCH_HQ_METAL",
     "COS_BATCH_HQ_FORCE_CPU",
+    "COS_BATCH_HQ_TIMESTAMPS",
+    "COS_MEETING_ASK_HQ_EVIDENCE",
     "COS_WHISPER_PREVIEW_MODEL",
     "COS_WHISPER_REALTIME_MODEL",
     "COS_UNSAVED_AUDIO_RETENTION_HOURS",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.70.0",
+  "version": "6.71.4",
   "description": "COS Glasses: self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {
@@ -41,6 +41,8 @@
     "shared",
     "!server/**/*.test.ts",
     "!server/scripts/engine-canary.ts",
+    "!server/scripts/hq-native-canary.ts",
+    "!server/scripts/hq-contention-canary.ts",
     "!server/scripts/live-cos-ask-canary.ts",
     "!server/scripts/work-review-candidate.ts",
     "!server/scripts/work-hardening-fixture.ts",
@@ -80,10 +82,14 @@
     "!server/scripts/build-work-task-runtime.py",
     "bin/hooks/cos-cursor-observer.cjs",
     "docs/provider-parity.md",
+    "docs/asr-canaries.md",
     "docs/pairing-contract.md",
     "docs/pairing-fixture.json",
     "bin/whisper-runtime.cjs",
-    "bin/whisper-runtime.d.cts"
+    "bin/whisper-runtime.d.cts",
+    "docs/test-plan-6.71.2.md",
+    "!server/scripts/meeting-evidence-canary.ts",
+    "docs/test-plan-6.71.3.md"
   ],
   "author": "COS Contributors",
   "license": "MIT",

package/server/lib/context-library-search.ts

@@ -337,11 +337,12 @@ export function mergeContextSearchHits(
     .slice(0, Math.max(1, Math.min(limit, 50)))
 }
 
-export async function searchMemories(options: { query: string; limit?: number; signal?: AbortSignal }): Promise<ContextSearchResult> {
+/** `semantic: false` (6.71.1, Meeting Ask "keyword only") skips the embedding search: no query leaves the Mac. */
+export async function searchMemories(options: { query: string; limit?: number; signal?: AbortSignal; semantic?: boolean }): Promise<ContextSearchResult> {
   const query = options.query.trim()
   const limit = Math.max(1, Math.min(options.limit ?? 20, 50))
   const keywordHits = keywordSearchMemories(query)
-  const semantic = await semanticSearchMemories(query, limit, options.signal)
+  const semantic = options.semantic === false ? { hits: [], reason: 'keyword_only' } : await semanticSearchMemories(query, limit, options.signal)
   return {
     hits: mergeContextSearchHits(keywordHits, semantic.hits, limit),
     keywordCount: keywordHits.length,