@gotcos/glasses-server 6.71.13 → 6.71.14

package/CHANGELOG.md

@@ -1,3 +1,16 @@
+## [6.71.14] - 2026-10-13 - A finished capture no longer reads as a live recording
+
+- Root cause. Boot recovery of persisted meeting sessions (`active-sessions/<id>.json`) and of closed-session tombstones ran only if the maintenance gate was already open when the module loaded. A managed update boots behind a closed gate, so recovery was skipped for the life of the process. A persisted session was then neither adopted nor tombstoned: the minute sweep quarantined its audio, auto-recovery receipted it, and its session file stayed on disk. On 2026-10-12 that left a receipted two-chunk capture listed by COS Control as "Live now, No audio for 1054m" for 17 hours, while the status route answered `missing`.
+- Recovery now runs once, when the gate opens. It runs the boot orphan-audio sweep and quarantine purge with it, never overwrites a session already live in memory, and does not quarantine a live session's audio (`isLive` also checks the session map). The minute sweep waits until recovery has run.
+- Boot recovery moves aside (reason `terminal_capture`), rather than adopts, an active-session file that is the leftover of a capture whose quarantined audio was already decoded: recovered into a meeting or receipted no_speech. A capture that is only quarantined, never decoded, is adopted as before, which covers a crash between a chunk's first audio write and its first session write.
+- No new chunk refusal. The phone treats any `410 session_closed` as "already saved" and deletes its local copy, so the server does not refuse a chunk because its capture is quarantined, recovered or receipted; such a chunk starts its own session and keeps the audio. The existing 4-hour closed-session 410 is unchanged, and because tombstones are now restored after a managed boot it applies there too, as it already did after an ordinary restart. Boot recovery adopts a session that resumed under a receipted id: a file counts as a leftover only when the quarantine is no older than its last activity and it has no chunk audio of its own, so a meeting is never split across a restart.
+- New minute-sweep step, in its own try beside the orphaned-audio sweep: an `active-sessions/*.json` whose session is not live and has been idle at least 4 hours (`LOCAL_FIRST_MEETING_IDLE_RETENTION_MS`) is moved to `data/stale-active-session-files/<id>.<ms>.json`. A `.reason.json` (reason `not_live_idle_expired`) is written atomically first; if it cannot be written nothing moves. Idle time uses the earlier of the file's `lastActivityAt` and its mtime, so a future-dated value cannot keep a dead file. Moved files are removed 7 days after the move time in their name, never by mtime. A live session's file is never touched. A failed move logs once per session on stderr and leaves no reason file behind; a purge that removes files logs the count.
+- `GET /api/meeting/sessions/:sessionId/status`: `state` keeps its 6.71.13 values and precedence (`saved`, `active`, `closed`, `missing`). Two additive fields: `outcome` (`receipted`: decoded, no speech; `recovered`: decoded and saved under a file the store no longer finds by session id; `quarantined`: audio held, not decoded yet) and `disposition` (`kind`, `reason`, `quarantinedAt`, `quarantineReason`, `receiptedAt`, `chunkFiles`, `savedFilename`, `recovering`, `audioRetainedUntil`). Both are null when `state` is `saved` or `active`, and when the quarantine holds nothing for the id. They cover every quarantine dir for the id: any undecoded one means `quarantined`. Older clients ignore both.
+- Until recovery has run, the status for an id with no saved meeting answers `503 {"reason": "recovery_pending", "retryable": true}` with `Retry-After: 5`, instead of `missing`, and logs that once. Phone status callers treat a thrown non-2xx as defer-and-retry (the uploader's finalize defers; origin-loss recovery backs off). A saved meeting is answered normally.
+- For COS Control: a gone file whose status is `closed` or `missing` with `outcome: "receipted"` can be shown as "No speech recorded", `recovered` as the saved row lookup, and `quarantined` as "Recovering capture". Control 0.5.287 ignores `outcome`.
+- Tests no longer read the live maintenance gate under ~/Library: `vitest.config.ts` points `COS_MAINTENANCE_GATE_PATH` into the isolated data home.
+- Mutation gate: `node server/scripts/stale-session-mutation-gate.mjs` (40 mutants over recovery, the boot sweep, the minute sweep and purge, the status route and the disposition reader; green baseline first).
+
 ## [6.71.13] - 2026-10-13 - Meeting-wide Fact check and follow-ups (candidate)
 
 - Fact check (the CTA, or a typed bare "Fact check") checks every checkable public claim in the meeting the first time, at most five, each in its own "Claim" row with a verdict (Supported, Mostly supported, Mixed, Contradicted, Unverified) and citations. Each later Fact check scans only what was said after the previous completed check. The span is on the durable exchange as `factCheckRange {fromMs, throughMs, full, claims}` in meeting-elapsed ms; `capabilities.factCheckScope: 1` advertises it. Older clients ignore both; transport stays `action=ask`. A named claim ("Fact check the flight to KC") checks that claim only.

package/README.md

@@ -359,7 +359,10 @@ the false fences 6.53.1 left, and never releases a fence when `ps` cannot answer
 Meetings: a closed meeting's record ages out after **4 hours**, after which its status
 reads `missing` and the phone stops asking to save it. Saving a known meeting that has no
 transcript answers **404 `nothing_to_save`** (with its state); only an unknown id answers
-`session_not_found`.
+`session_not_found`. From 6.71.14 a `missing` or `closed` capture whose audio reached the
+unsaved-audio quarantine also carries an `outcome` (`receipted`, `recovered` or
+`quarantined`) and a `disposition`, and for an id with no saved meeting the status answers **503 `recovery_pending`**
+until boot recovery has run (see [Finished captures never read as live](#finished-captures-never-read-as-live-67114)).
 
 ## The summary behind the prompt box (6.54.0)
 
@@ -987,3 +990,12 @@ Release receipt (2026-10-12): 6.71.12 is published to npm `latest`; registry int
 ### Meeting-wide Fact check (6.71.13 candidate)
 
 Fact check checks every checkable public claim in the meeting the first time (at most five, one `Claim` row each), then only what was said after the previous completed check. A completed check records `factCheckRange {fromMs, throughMs, full, claims}` on the exchange in meeting-elapsed milliseconds; `capabilities.factCheckScope: 1` advertises it. Follow-ups such as "check it now" continue the pending check. A claim with an implicit starting point uses the profile `home_city` (for example `"home_city": "Austin, TX"` in `.cos-profile.json`), else the phone's weather area from the last 24 hours, and says so. `COS_MEETING_FACT_CHECK_SCOPE=0` returns Fact check to the 6.71.12 latest-claim path; `COS_MEETING_ASK_DOSE_GUARD=0` turns off the fixed answer to medication-dose questions.
+
+### Finished captures never read as live (6.71.14)
+
+A server that boots behind a closed maintenance gate (every managed update) now runs meeting-session recovery once, when the gate opens. Until 6.71.13 that recovery was skipped for the life of the process, so a persisted `active-sessions/<id>.json` could outlive its capture and COS Control showed it as a live recording. Recovery never overwrites a session already live in memory, and the minute sweep waits for it.
+
+- `GET /api/meeting/sessions/:id/status` keeps `state` to `saved`, `active`, `closed` and `missing`, with the same precedence as before. When the quarantine holds the capture it adds `outcome` (`receipted`: decoded, no speech; `recovered`: decoded and saved; `quarantined`: held, not decoded yet) and `disposition` (`kind`, `reason`, `quarantinedAt`, `quarantineReason`, `receiptedAt`, `chunkFiles`, `savedFilename`, `recovering`, `audioRetainedUntil`). Both are null for a saved or live session.
+- Until recovery has run, a status for an id with no saved meeting answers `503 {"reason": "recovery_pending", "retryable": true}` with `Retry-After: 5`, instead of a `missing` that would tell the phone the Mac lost the meeting.
+- No new chunk refusal: a chunk for a quarantined or receipted capture starts its own session, because the phone treats a 410 as "already saved" and deletes its copy. The existing 4-hour closed-session 410 still applies, now after a managed boot too. A session that resumed under a receipted id is adopted at the next boot, never split off.
+- Each minute, an `active-sessions/*.json` whose session is not live and has been idle for 4 hours (the earlier of its `lastActivityAt` and its file time) is moved to `data/stale-active-session-files/`, with a `.reason.json` written first. Moved files are removed 7 days after the move. Boot recovery also moves aside, rather than adopts, a file whose capture was already recovered or receipted.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.71.13",
+  "version": "6.71.14",
   "description": "COS Glasses: self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {
@@ -51,6 +51,7 @@
     "!server/scripts/work-progress-mutation-gate.mjs",
     "!server/scripts/work-search-mutation-gate.mjs",
     "!server/scripts/fact-check-mutation-gate.mjs",
+    "!server/scripts/stale-session-mutation-gate.mjs",
     "!server/scripts/pairing-mutation-gate.mjs",
     "!server/scripts/away-hold-mutation-gate.mjs",
     "!server/scripts/nemotron-mutation-gate.mjs",

package/server/lib/stale-active-session-files.ts

@@ -0,0 +1,178 @@
+// Active-session files the server no longer owns.
+//
+// THE INCIDENT (2026-10-12, server 6.71.11). `active-sessions/<id>.json` is written by
+// the chunk route while a capture is live, and removed when the session closes. A
+// capture of two silent chunks was persisted, then the server restarted behind a
+// closed startup maintenance gate. Boot recovery was gated on admissions being open
+// and never ran once the controller released the gate, so the file was neither
+// adopted into the in-memory session map nor tombstoned. The audio was quarantined,
+// recovered and receipted no_speech, and the file stayed: COS Control lists the
+// directory directly and showed "Live now ... No audio for 1054m" for 17 hours, and
+// the status route answered `missing`.
+//
+// The deferred recovery fix in routes/transcribe-stream.ts closes that door. This
+// sweep is the backstop for any other door: a file whose session is not live and
+// that has been idle past the retention horizon is moved aside, never deleted in
+// place, with a reason written next to it. The horizon is the same one the session
+// itself would be promoted or tombstoned at, so this can never act earlier than the
+// server's own definition of "done".
+
+import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { atomicWriteFileSync } from './atomic-fs.js'
+
+export const STALE_ACTIVE_SESSION_DIR_NAME = 'stale-active-session-files'
+
+/** Moved files carry transcript text, so they are not kept forever either. */
+export const STALE_ACTIVE_SESSION_FILE_RETENTION_MS = 7 * 24 * 60 * 60 * 1000
+
+export type StaleActiveSessionReason =
+  /** Not in the live session map and idle past the retention horizon. */
+  | 'not_live_idle_expired'
+  /** Boot recovery found the capture already recovered or receipted no_speech. */
+  | 'terminal_capture'
+
+export interface StaleActiveSessionMove {
+  sessionId: string
+  reason: StaleActiveSessionReason
+  /** Where the file went, or null when the move failed and the file stayed put. */
+  target: string | null
+  lastActivityAt: number | null
+  idleMs: number | null
+}
+
+const SESSION_FILE_RE = /^([A-Za-z0-9:_-]{3,96})\.json$/
+/** `<id>.<move ms>[-n].json` and its `.reason.json`. The move time is in the NAME. */
+const MOVED_FILE_RE = /^[A-Za-z0-9:_-]{3,96}\.(\d{13})(?:-\d+)?(?:\.reason)?\.json$/
+const REASON_SUFFIX = '.reason.json'
+
+/**
+ * When the session in this file was last active, for staleness: the EARLIER of its
+ * own `lastActivityAt` and the file's mtime. The file is rewritten on every accepted
+ * chunk, so its mtime is a true upper bound; a future-dated or corrupt
+ * `lastActivityAt` therefore cannot pin a dead file forever. Null when neither can
+ * be read.
+ */
+export function activeSessionFileActivity(filePath: string): number | null {
+  let mtimeMs: number | null = null
+  try {
+    const stat = statSync(filePath)
+    if (Number.isFinite(stat.mtimeMs)) mtimeMs = stat.mtimeMs
+  } catch { /* fall through: a missing file has no age */ }
+  let recorded: number | null = null
+  try {
+    const data = JSON.parse(readFileSync(filePath, 'utf8')) as { lastActivityAt?: unknown }
+    if (typeof data?.lastActivityAt === 'number' && Number.isFinite(data.lastActivityAt)) recorded = data.lastActivityAt
+  } catch { /* torn or legacy file: the mtime still gives it an age */ }
+  if (recorded == null) return mtimeMs
+  if (mtimeMs == null) return recorded
+  return Math.min(recorded, mtimeMs)
+}
+
+/**
+ * Move one active-session file into the stale directory. The reason is written
+ * FIRST and atomically, so a moved file never exists without its reason; if the
+ * reason cannot be written nothing is moved. Returns the new path, or null when the
+ * move did not happen (the source then stays exactly where it was).
+ */
+export function moveActiveSessionFileAside(
+  sourcePath: string,
+  sessionId: string,
+  targetDir: string,
+  reason: StaleActiveSessionReason,
+  now: number,
+  detail: { lastActivityAt: number | null; note?: string } = { lastActivityAt: null },
+): string | null {
+  try {
+    if (!existsSync(sourcePath)) return null
+    mkdirSync(targetDir, { recursive: true, mode: 0o700 })
+    // Two moves in the same millisecond must not overwrite each other.
+    let base = `${sessionId}.${now}`
+    for (let n = 1; existsSync(resolve(targetDir, `${base}.json`)) || existsSync(resolve(targetDir, `${base}${REASON_SUFFIX}`)); n++) {
+      base = `${sessionId}.${now}-${n}`
+    }
+    const target = resolve(targetDir, `${base}.json`)
+    const reasonPath = resolve(targetDir, `${base}${REASON_SUFFIX}`)
+    atomicWriteFileSync(reasonPath, `${JSON.stringify({
+      schemaVersion: 1,
+      sessionId,
+      reason,
+      movedAt: new Date(now).toISOString(),
+      lastActivityAt: detail.lastActivityAt != null ? new Date(detail.lastActivityAt).toISOString() : null,
+      ...(detail.note ? { note: detail.note } : {}),
+    })}\n`, { mode: 0o600 })
+    try {
+      renameSync(sourcePath, target)
+    } catch (error) {
+      // No reason may outlive a move that did not happen.
+      try { rmSync(reasonPath, { force: true }) } catch { /* the next sweep's own reason supersedes it */ }
+      throw error
+    }
+    return target
+  } catch {
+    return null
+  }
+}
+
+/**
+ * One pass over the active-sessions directory. A file is moved aside only when its
+ * session is NOT live and it has been idle for at least `idleRetentionMs`. A live
+ * session's file is never touched, however old it looks. A failed move is returned
+ * with `target: null` so the caller can say so.
+ */
+export function sweepStaleActiveSessionFiles(opts: {
+  dir: string
+  targetDir: string
+  isLive: (sessionId: string) => boolean
+  now: number
+  idleRetentionMs: number
+}): StaleActiveSessionMove[] {
+  const moves: StaleActiveSessionMove[] = []
+  let entries: string[]
+  try { entries = readdirSync(opts.dir) } catch { return moves }
+  for (const name of entries) {
+    const match = SESSION_FILE_RE.exec(name)
+    if (!match) continue
+    const sessionId = match[1]
+    if (opts.isLive(sessionId)) continue
+    const filePath = resolve(opts.dir, name)
+    // The mtime bound inside activeSessionFileActivity is what defeats a
+    // future-dated value. A further min(..., now) would change no decision: a
+    // future activity is negative idle, and zero idle is just as far from the horizon.
+    const lastActivityAt = activeSessionFileActivity(filePath)
+    if (lastActivityAt == null) continue
+    const idleMs = opts.now - lastActivityAt
+    if (idleMs < opts.idleRetentionMs) continue
+    const target = moveActiveSessionFileAside(filePath, sessionId, opts.targetDir, 'not_live_idle_expired', opts.now, {
+      lastActivityAt,
+    })
+    moves.push({ sessionId, reason: 'not_live_idle_expired', target, lastActivityAt, idleMs })
+  }
+  return moves
+}
+
+/**
+ * Remove moved files (and their reasons) whose move time, read from the file NAME,
+ * is older than the retention. Ages never come from mtime: a rename keeps the old
+ * mtime, which would turn "move" into "delete a minute later". A name that does not
+ * carry a move time is never removed. Returns the count removed.
+ */
+export function purgeExpiredStaleActiveSessionFiles(
+  targetDir: string,
+  now: number,
+  retentionMs: number = STALE_ACTIVE_SESSION_FILE_RETENTION_MS,
+): number {
+  let removed = 0
+  let entries: string[]
+  try { entries = readdirSync(targetDir) } catch { return 0 }
+  for (const name of entries) {
+    const match = MOVED_FILE_RE.exec(name)
+    if (!match) continue
+    if (now - Number(match[1]) <= retentionMs) continue
+    try {
+      rmSync(resolve(targetDir, name), { force: true })
+      removed++
+    } catch { /* next sweep retries */ }
+  }
+  return removed
+}

package/server/lib/unsaved-audio-quarantine.ts

@@ -347,3 +347,117 @@ export function markRecovered(dirPath: string, savedFilename: string): void {
     )
   } catch { /* receipt is best-effort; findBySessionId remains the true guard */ }
 }
+
+// ── Terminal disposition of a capture the server no longer holds live ───────
+//
+// 6.71.14. The quarantine is the only record of what happened to a capture whose
+// live session is gone: its audio was quarantined, then recovered into a meeting or
+// receipted as no_speech. Two readers need that answer and used to get "missing":
+// the session status route (COS Control rendered "Recording ended without saving"
+// for a capture that had been recovered and receipted) and the chunk route, which
+// recreated a live session for a late chunk of a capture that was already done.
+
+export type CaptureDispositionKind = 'quarantined' | 'recovered' | 'no_speech'
+
+export interface CaptureDisposition {
+  kind: CaptureDispositionKind
+  sessionId: string
+  dirName: string
+  quarantinedAt: string | null
+  /** When the recovery receipt was written, for `recovered` and `no_speech`. */
+  receiptedAt: string | null
+  chunkFiles: number
+  /** The quarantine manifest's reason (why the audio was moved), when known. */
+  quarantineReason: string | null
+  /** Set for `recovered`: the meeting file the recovery saved. */
+  savedFilename: string | null
+  /** A recovery is decoding this capture right now. */
+  recovering: boolean
+  /** When quarantine retention removes the audio. */
+  retainedUntil: string | null
+}
+
+interface RecoveredReceipt {
+  recoveredAt?: unknown
+  outcome?: unknown
+  savedFilename?: unknown
+}
+
+function readRecoveredReceipt(dirPath: string): RecoveredReceipt | null {
+  const path = resolve(dirPath, RECOVERED_RECEIPT)
+  if (!existsSync(path)) return null
+  try {
+    const raw = JSON.parse(readFileSync(path, 'utf8')) as unknown
+    return raw && typeof raw === 'object' ? raw as RecoveredReceipt : {}
+  } catch {
+    // Present but unreadable still means a recovery finished: the receipt is only
+    // ever written at the end of one (listUnsavedCaptures counts it the same way).
+    return {}
+  }
+}
+
+/** Every quarantine dir for a session id: the exact name and any `<id>.<ms>` copies. */
+function quarantineDirsFor(sessionId: string, root: string): string[] {
+  const dirs: string[] = []
+  let entries: string[] = []
+  try { entries = readdirSync(root) } catch { return dirs }
+  for (const dir of entries) {
+    // Same match as findQuarantineDir: session ids carry no dots, so `<id>.` is this id.
+    if (dir !== sessionId && !dir.startsWith(`${sessionId}.`)) continue
+    const dirPath = resolve(root, dir)
+    try { if (statSync(dirPath).isDirectory()) dirs.push(dirPath) } catch { /* vanished: skip */ }
+  }
+  return dirs.sort()
+}
+
+function dispositionOf(sessionId: string, dirPath: string, retentionMs: number): CaptureDisposition {
+  const manifest = readManifest(dirPath)
+  const atMs = quarantinedAtMs(dirPath, manifest)
+  const receipt = readRecoveredReceipt(dirPath)
+  const receiptedMs = receipt && typeof receipt.recoveredAt === 'string' ? Date.parse(receipt.recoveredAt) : NaN
+  const savedFilename = receipt && typeof receipt.savedFilename === 'string' && receipt.savedFilename
+    ? receipt.savedFilename
+    : null
+  const kind: CaptureDispositionKind = !receipt
+    ? 'quarantined'
+    : receipt.outcome === 'no_speech'
+      ? 'no_speech'
+      : 'recovered'
+  return {
+    kind,
+    sessionId,
+    dirName: basename(dirPath),
+    quarantinedAt: atMs != null ? new Date(atMs).toISOString() : null,
+    receiptedAt: Number.isFinite(receiptedMs) ? new Date(receiptedMs).toISOString() : null,
+    chunkFiles: manifest?.chunkFiles ?? countChunkWavs(dirPath),
+    quarantineReason: manifest?.reason ?? null,
+    savedFilename,
+    recovering: isRecoveryActive(basename(dirPath)),
+    retainedUntil: atMs != null ? new Date(atMs + retentionMs).toISOString() : null,
+  }
+}
+
+const DISPOSITION_RANK: Record<CaptureDispositionKind, number> = { quarantined: 0, recovered: 1, no_speech: 2 }
+
+/**
+ * What became of a capture whose audio reached quarantine, or null when the
+ * quarantine holds nothing for this session id.
+ *
+ * `no_speech` and `recovered` are terminal: the capture was decoded once and its
+ * outcome receipted. `quarantined` is held audio that a recovery has not finished
+ * yet (the sweep picks one per minute, or a person presses Recover).
+ *
+ * One id can own SEVERAL dirs (`<id>` and `<id>.<ms>`, when the same id was
+ * quarantined twice). The answer covers all of them: ANY unrecovered dir means the
+ * capture is still `quarantined`; otherwise a saved recovery outranks no_speech.
+ */
+export function readCaptureDisposition(
+  sessionId: string,
+  root: string = unsavedAudioRoot(),
+  retentionMs: number = unsavedAudioRetentionMs(),
+): CaptureDisposition | null {
+  if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) return null
+  const all = quarantineDirsFor(sessionId, root).map(dir => dispositionOf(sessionId, dir, retentionMs))
+  if (all.length === 0) return null
+  return all.reduce((best, next) => DISPOSITION_RANK[next.kind] < DISPOSITION_RANK[best.kind] ? next : best)
+}

package/server/routes/meeting.ts

@@ -87,7 +87,9 @@ import {
   listUnsavedCaptures,
   markRecovered,
   markRecoveredNoSpeech,
+  readCaptureDisposition,
   registerActiveRecovery,
+  type CaptureDisposition,
 } from '../lib/unsaved-audio-quarantine.js'
 import {
   clearSessionHallucinationState,
@@ -101,6 +103,7 @@ import {
   analyzeTranscriptGaps,
   deleteSession,
   drainSessionAudioWrites,
+  durableSessionRecoveryHasRun,
   getSessionChunkEntries,
   getSessionChunks,
   getSessionProviderCandidates,
@@ -475,6 +478,48 @@ function publicSaveResponse(saved: SavedMeeting, replayed = false): Record<strin
   }
 }
 
+/**
+ * 6.71.14: what became of a capture whose live session is gone, as an ADDITIVE
+ * field beside `state`.
+ *
+ * `state` keeps its 6.71.13 values and precedence (saved > active > closed >
+ * missing) on purpose. Phones branch on it (`missing` is recovery-required or a
+ * collision, `closed` is terminal-unsaved), and a new value would fall through to
+ * their resume path. So the quarantine's answer rides alongside:
+ *   receipted    recovery finished and found no speech
+ *   recovered    recovery saved a meeting (the store may no longer find it by id)
+ *   quarantined  the audio is held and no recovery has finished yet
+ * Null when `state` is saved (the receipt is the answer) or active (a live session
+ * reports itself), and when the quarantine holds nothing for the id.
+ */
+export type MeetingCaptureOutcome = 'receipted' | 'recovered' | 'quarantined'
+
+export function captureOutcome(
+  state: 'saved' | 'active' | 'closed' | 'missing',
+  disposition: Pick<CaptureDisposition, 'kind'> | null,
+): MeetingCaptureOutcome | null {
+  if (state === 'saved' || state === 'active' || !disposition) return null
+  if (disposition.kind === 'no_speech') return 'receipted'
+  if (disposition.kind === 'recovered') return 'recovered'
+  return 'quarantined'
+}
+
+function publicDisposition(disposition: CaptureDisposition | null): Record<string, unknown> | null {
+  if (!disposition) return null
+  return {
+    kind: disposition.kind,
+    // Why the capture is terminal: `no_speech` or `recovered`; null while it is only held.
+    reason: disposition.kind === 'quarantined' ? null : disposition.kind,
+    quarantinedAt: disposition.quarantinedAt,
+    quarantineReason: disposition.quarantineReason,
+    receiptedAt: disposition.receiptedAt,
+    chunkFiles: disposition.chunkFiles,
+    savedFilename: disposition.savedFilename,
+    recovering: disposition.recovering,
+    audioRetainedUntil: disposition.retainedUntil,
+  }
+}
+
 function suppliedServerPin(
   req: { get: (name: string) => string | undefined },
   fallback: unknown,
@@ -497,6 +542,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
   const savingSessions = new Set<string>()
   setNamingSessionLiveness(id => sessions.getStartTime(id) !== null || savingSessions.has(id) || activeFinalizationJobs.has(id))
 
+  let recoveryPendingLogged = false
   router.get('/meeting/sessions/:sessionId/status', (req, res) => {
     const sessionId = String(req.params.sessionId ?? '')
     if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) {
@@ -514,11 +560,35 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       return
     }
     const saved = store.findBySessionId(sessionId)
+    // 6.71.14: before durable recovery has run (a boot behind a closed or stuck
+    // maintenance gate), a persisted meeting is not in memory YET, and answering
+    // `missing` would tell the phone the Mac lost it. Every phone status caller
+    // treats a thrown non-2xx as defer-and-retry (the uploader's finalize defers;
+    // origin-loss recovery backs off), so say "not yet" instead. A saved meeting
+    // is already authoritative and is answered as usual.
+    if (!saved && !durableSessionRecoveryHasRun()) {
+      if (!recoveryPendingLogged) {
+        recoveryPendingLogged = true
+        console.warn('[meeting/status] Answering 503 recovery_pending: durable session recovery has not run (maintenance gate closed)')
+      }
+      res.set('Cache-Control', 'private, no-store')
+      res.set('Retry-After', '5')
+      res.status(503).json({
+        error: 'Meeting session recovery has not run yet; retry shortly',
+        reason: 'recovery_pending',
+        retryable: true,
+      })
+      return
+    }
     const live = getMeetingSessionStatus(sessionId)
+    const state = saved ? 'saved' : live.state
+    // A saved meeting or a live session is the truth for itself; the quarantine is
+    // read only when neither is.
+    const disposition = state === 'saved' || state === 'active' ? null : readCaptureDisposition(sessionId)
     res.set('Cache-Control', 'private, no-store')
     res.json({
       sessionId,
-      state: saved ? 'saved' : live.state,
+      state,
       serverInstanceId,
       receivedRanges: live.receivedRanges,
       receivedCount: live.receivedCount,
@@ -530,6 +600,10 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       lastActivityAt: live.lastActivityAt,
       retainedUntil: saved ? null : live.retainedUntil,
       saveReceipt: saved ? publicSaveResponse(saved) : null,
+      // 6.71.14, additive: what became of a capture whose audio reached quarantine
+      // (null otherwise). Older clients ignore both.
+      outcome: captureOutcome(state, disposition),
+      disposition: publicDisposition(disposition),
     })
   })
 

package/server/routes/transcribe-stream.ts

@@ -77,8 +77,16 @@ import {
   listUnsavedCaptures,
   purgeExpiredQuarantine,
   quarantineSessionAudio,
+  readCaptureDisposition,
   sweepOrphanedSessionAudio,
 } from '../lib/unsaved-audio-quarantine.js'
+import {
+  STALE_ACTIVE_SESSION_DIR_NAME,
+  moveActiveSessionFileAside,
+  purgeExpiredStaleActiveSessionFiles,
+  sweepStaleActiveSessionFiles,
+  type StaleActiveSessionMove,
+} from '../lib/stale-active-session-files.js'
 import { durableAtomicWriteFileSync } from '../lib/atomic-fs.js'
 import { saveTrainingAudioSample } from '../lib/training-audio-save.js'
 import {
@@ -92,6 +100,7 @@ import {
   acquireMaintenanceWork,
   maintenanceAdmissionsOpen,
   maintenanceLifecycle,
+  onMaintenanceAdmissionsOpen,
   type MaintenanceWorkLease,
 } from '../lib/maintenance-lifecycle.js'
 import { feedLiveCueTranscript } from '../lib/live-cues-engine.js'
@@ -542,6 +551,8 @@ export function getTranscriptionSessionLiveness(now = Date.now()): Transcription
 // Incremental chunk persistence — survive server restarts
 const CHUNK_PERSIST_DIR = dataPath('active-sessions')
 ensurePrivateDirectory(CHUNK_PERSIST_DIR)
+/** 6.71.14: where an active-session file the server no longer owns is moved, never deleted in place. */
+const STALE_ACTIVE_SESSION_DIR = dataPath(STALE_ACTIVE_SESSION_DIR_NAME)
 
 function readClosedSessions(): Record<string, ClosedTranscriptSession> {
   if (!existsSync(CLOSED_SESSIONS_FILE)) return {}
@@ -691,6 +702,71 @@ function persistSessionBestEffort(sessionId: string): void {
   try { persistSessionRequired(sessionId) } catch { /* recovery cleanup is non-admission work */ }
 }
 
+/**
+ * 6.71.14: one pass of the stale active-session sweep, against the real session
+ * map. Exported so a test drives the exact wiring the minute interval runs.
+ */
+export function sweepStaleActiveSessionFilesNow(now: number): StaleActiveSessionMove[] {
+  const moves = sweepStaleActiveSessionFiles({
+    dir: CHUNK_PERSIST_DIR,
+    targetDir: STALE_ACTIVE_SESSION_DIR,
+    isLive: id => sessions.has(id),
+    now,
+    idleRetentionMs: LOCAL_FIRST_MEETING_IDLE_RETENTION_MS,
+  })
+  for (const move of moves) {
+    if (move.target) {
+      staleMoveFailuresLogged.delete(move.sessionId)
+      console.warn(
+        `[cleanup] Moved stale active-session file aside: ${move.sessionId} `
+        + `(${move.reason}, idle ${Math.round((move.idleMs ?? 0) / 60_000)}m, not live) \u2192 ${move.target}`,
+      )
+    } else {
+      logStaleMoveFailure(move.sessionId, `[cleanup] Could not move stale active-session file aside for ${move.sessionId} (${move.reason}); it stays in active-sessions`)
+    }
+  }
+  const purged = purgeExpiredStaleActiveSessionFiles(STALE_ACTIVE_SESSION_DIR, now)
+  if (purged > 0) console.log(`[cleanup] Purged ${purged} stale active-session file(s) past retention`)
+  return moves
+}
+
+/** A failed move repeats every minute; say so once per session id, not every tick. */
+const staleMoveFailuresLogged = new Set<string>()
+function logStaleMoveFailure(sessionId: string, message: string): void {
+  if (staleMoveFailuresLogged.has(sessionId)) return
+  staleMoveFailuresLogged.add(sessionId)
+  if (staleMoveFailuresLogged.size > 500) staleMoveFailuresLogged.delete(staleMoveFailuresLogged.values().next().value as string)
+  console.error(message)
+}
+
+/**
+ * 6.71.14: is this active-session file the leftover of a capture that is already
+ * decoded (recovered or receipted no_speech), rather than a session that RESUMED
+ * under the same id after that capture was quarantined?
+ *
+ * A late chunk is accepted (the phone deletes its copy on a 410), so a session can
+ * restart under an id whose older quarantine dir is already receipted. Its file is
+ * then newer than the quarantine and its own audio sits in session-audio/<id>.
+ * Only a file that is no newer than the quarantine AND has no chunk audio of its
+ * own is the leftover; anything else is adopted as 6.71.13 would, so a meeting is
+ * never split across a restart.
+ */
+function isTerminalCaptureFile(sessionId: string, recordedLastActivityAt: unknown, filePath: string): boolean {
+  const disposition = readCaptureDisposition(sessionId)
+  if (!disposition || (disposition.kind !== 'no_speech' && disposition.kind !== 'recovered')) return false
+  const terminalAtIso = disposition.quarantinedAt ?? disposition.receiptedAt
+  const terminalAt = terminalAtIso ? Date.parse(terminalAtIso) : NaN
+  if (!Number.isFinite(terminalAt)) return false
+  let fileActivity = typeof recordedLastActivityAt === 'number' && Number.isFinite(recordedLastActivityAt)
+    ? recordedLastActivityAt
+    : NaN
+  if (!Number.isFinite(fileActivity)) {
+    try { fileActivity = statSync(filePath).mtimeMs } catch { return false }
+  }
+  if (terminalAt < fileActivity) return false
+  return countChunkWavs(resolve(SESSION_AUDIO_DIR, sessionId)) === 0
+}
+
 /** Recover sessions from disk on server restart */
 function recoverSessions(): void {
   try {
@@ -701,6 +777,27 @@ function recoverSessions(): void {
       if (!file.endsWith('.json')) continue
       try {
         const data = JSON.parse(readFileSync(resolve(CHUNK_PERSIST_DIR, file), 'utf-8'))
+        // 6.71.14: recovery can now run after boot (deferred behind a closed
+        // maintenance gate). A session already in memory owns its file; the disk
+        // copy must never overwrite it.
+        if (typeof data.sessionId === 'string' && sessions.has(data.sessionId)) continue
+        // A capture whose quarantined audio was already decoded to a terminal
+        // outcome (a saved recovery or a no_speech receipt) is done. Adopting its
+        // file would bring back a live session for it; tombstoning would delete the
+        // file. Move it aside instead. Plain `quarantined` (never decoded) is NOT
+        // done: a crash between a chunk's first WAV write and its first
+        // active-session persist quarantines the audio, and the phone's retry then
+        // starts the session again. That file is adopted exactly as before.
+        if (typeof data.sessionId === 'string' && isTerminalCaptureFile(data.sessionId, data.lastActivityAt, resolve(CHUNK_PERSIST_DIR, file))) {
+          const terminal = readCaptureDisposition(data.sessionId)!
+          const target = moveActiveSessionFileAside(
+            resolve(CHUNK_PERSIST_DIR, file), data.sessionId, STALE_ACTIVE_SESSION_DIR, 'terminal_capture', Date.now(),
+            { lastActivityAt: typeof data.lastActivityAt === 'number' ? data.lastActivityAt : null },
+          )
+          if (target) console.warn(`[session-recovery] ${data.sessionId} was already ${terminal.kind}; moved its active-session file aside: ${target}`)
+          else logStaleMoveFailure(data.sessionId, `[session-recovery] Could not move the active-session file aside for ${data.sessionId} (already ${terminal.kind}); left in place, not adopted`)
+          continue
+        }
         // Reconstruct the (sparse) chunk array. New format keeps original
         // indices via chunksIndexed; legacy format stored a dense `chunks`.
         const indexed: Array<{ i: number; c: TranscriptChunk }> | null =
@@ -859,7 +956,9 @@ function recoverSessions(): void {
     try {
       if (existsSync(SESSION_AUDIO_DIR)) {
         const actions = sweepOrphanedSessionAudio(SESSION_AUDIO_DIR, {
-          isLive: id => recoveredIds.has(id),
+          // `|| sessions.has`: deferred recovery (6.71.14) can run while sessions
+          // are live in memory; their audio is not orphaned.
+          isLive: id => recoveredIds.has(id) || sessions.has(id),
           hasFreshPreservedMarker: hasFreshPreservedAudioMarker,
           reason: 'boot_sweep_unsaved',
         })
@@ -896,9 +995,40 @@ export function isSessionDeleted(sessionId: string): boolean {
 // A committed cross-boot maintenance operation owns durable state until the
 // trusted controller adopts the candidate. Boot recovery must not mutate or
 // promote sessions while that gate is closed.
-if (maintenanceAdmissionsOpen()) {
+//
+// 6.71.14: and once that gate opens, recovery MUST still run. Until 6.71.13 this was
+// a module-scope `if` evaluated once at import: a boot behind a closed gate (every
+// managed update) skipped it for the life of the process. Persisted sessions were
+// never adopted or tombstoned, and the closed-session tombstones were never
+// restored. On 2026-10-12 that left `active-sessions/<id>.json` for a receipted
+// capture on disk for 17 hours, reported as live by COS Control and `missing` by
+// the status route.
+let durableSessionRecoveryRan = false
+function runDurableSessionRecovery(trigger: 'boot' | 'admissions_open'): void {
+  if (durableSessionRecoveryRan) return
+  durableSessionRecoveryRan = true
   recoverClosedSessions()
   recoverSessions()
+  if (trigger === 'admissions_open') {
+    console.log(`[session-recovery] Ran deferred durable recovery after the maintenance gate opened (${sessions.size} live session(s))`)
+  }
+}
+if (maintenanceAdmissionsOpen()) {
+  runDurableSessionRecovery('boot')
+} else {
+  // Delivered on every later open; the flag above makes every delivery after the
+  // first a no-op, so disk is never re-read over a live session map.
+  onMaintenanceAdmissionsOpen(() => runDurableSessionRecovery('admissions_open'))
+}
+
+/**
+ * 6.71.14: has durable session recovery run in this process yet? Until it has, the
+ * in-memory map does not yet hold the persisted sessions, so "not in memory" is not
+ * evidence of anything. The status route answers 503 `recovery_pending` instead of
+ * `missing` while this is false.
+ */
+export function durableSessionRecoveryHasRun(): boolean {
+  return durableSessionRecoveryRan
 }
 
 /**
@@ -1011,6 +1141,10 @@ function promoteStrandedCapture(sessionId: string, lastActivityAt: number): void
 // Auto-cleanup sessions idle for the advertised retention horizon.
 setInterval(() => {
   if (!maintenanceAdmissionsOpen()) return
+  // 6.71.14: the sweeps below judge a session dead by its absence from the
+  // in-memory map. Before recovery has adopted the persisted sessions that map is
+  // empty by construction, so sweeping then would quarantine a live capture.
+  if (!durableSessionRecoveryRan) return
   // A capture whose phone went away must still become a meeting. This loop used
   // to close every idle session as 'expired', which quarantined its audio and
   // produced NO meeting — recoverable for 72h, but only by whoever thought to
@@ -1053,6 +1187,15 @@ setInterval(() => {
     // log, and nothing to reason about, because any throw in this block vanished.
     console.error(`[cleanup] Orphan-audio sweep failed: ${error instanceof Error ? error.message : error}`)
   }
+  // 6.71.14: its own try, for the same reason as auto-recovery below. An
+  // active-session file whose session is not live and has been idle past the
+  // retention horizon is moved aside; COS Control reads that directory directly
+  // and would otherwise show it as a live recording indefinitely.
+  try {
+    sweepStaleActiveSessionFilesNow(Date.now())
+  } catch (error) {
+    console.error(`[cleanup] Stale active-session sweep failed: ${error instanceof Error ? error.message : error}`)
+  }
   // DELIBERATELY ITS OWN TRY. This used to sit inside the block above, one line after
   // purgeExpiredQuarantine, so a throw anywhere in that sweep meant auto-recovery
   // silently never ran — which is exactly what happened in production on 6.23.1