@gotcos/glasses-server 6.71.13 → 6.72.0

package/server/lib/unsaved-audio-quarantine.ts

@@ -347,3 +347,117 @@ export function markRecovered(dirPath: string, savedFilename: string): void {
     )
   } catch { /* receipt is best-effort; findBySessionId remains the true guard */ }
 }
+
+// ── Terminal disposition of a capture the server no longer holds live ───────
+//
+// 6.71.14. The quarantine is the only record of what happened to a capture whose
+// live session is gone: its audio was quarantined, then recovered into a meeting or
+// receipted as no_speech. Two readers need that answer and used to get "missing":
+// the session status route (COS Control rendered "Recording ended without saving"
+// for a capture that had been recovered and receipted) and the chunk route, which
+// recreated a live session for a late chunk of a capture that was already done.
+
+export type CaptureDispositionKind = 'quarantined' | 'recovered' | 'no_speech'
+
+export interface CaptureDisposition {
+  kind: CaptureDispositionKind
+  sessionId: string
+  dirName: string
+  quarantinedAt: string | null
+  /** When the recovery receipt was written, for `recovered` and `no_speech`. */
+  receiptedAt: string | null
+  chunkFiles: number
+  /** The quarantine manifest's reason (why the audio was moved), when known. */
+  quarantineReason: string | null
+  /** Set for `recovered`: the meeting file the recovery saved. */
+  savedFilename: string | null
+  /** A recovery is decoding this capture right now. */
+  recovering: boolean
+  /** When quarantine retention removes the audio. */
+  retainedUntil: string | null
+}
+
+interface RecoveredReceipt {
+  recoveredAt?: unknown
+  outcome?: unknown
+  savedFilename?: unknown
+}
+
+function readRecoveredReceipt(dirPath: string): RecoveredReceipt | null {
+  const path = resolve(dirPath, RECOVERED_RECEIPT)
+  if (!existsSync(path)) return null
+  try {
+    const raw = JSON.parse(readFileSync(path, 'utf8')) as unknown
+    return raw && typeof raw === 'object' ? raw as RecoveredReceipt : {}
+  } catch {
+    // Present but unreadable still means a recovery finished: the receipt is only
+    // ever written at the end of one (listUnsavedCaptures counts it the same way).
+    return {}
+  }
+}
+
+/** Every quarantine dir for a session id: the exact name and any `<id>.<ms>` copies. */
+function quarantineDirsFor(sessionId: string, root: string): string[] {
+  const dirs: string[] = []
+  let entries: string[] = []
+  try { entries = readdirSync(root) } catch { return dirs }
+  for (const dir of entries) {
+    // Same match as findQuarantineDir: session ids carry no dots, so `<id>.` is this id.
+    if (dir !== sessionId && !dir.startsWith(`${sessionId}.`)) continue
+    const dirPath = resolve(root, dir)
+    try { if (statSync(dirPath).isDirectory()) dirs.push(dirPath) } catch { /* vanished: skip */ }
+  }
+  return dirs.sort()
+}
+
+function dispositionOf(sessionId: string, dirPath: string, retentionMs: number): CaptureDisposition {
+  const manifest = readManifest(dirPath)
+  const atMs = quarantinedAtMs(dirPath, manifest)
+  const receipt = readRecoveredReceipt(dirPath)
+  const receiptedMs = receipt && typeof receipt.recoveredAt === 'string' ? Date.parse(receipt.recoveredAt) : NaN
+  const savedFilename = receipt && typeof receipt.savedFilename === 'string' && receipt.savedFilename
+    ? receipt.savedFilename
+    : null
+  const kind: CaptureDispositionKind = !receipt
+    ? 'quarantined'
+    : receipt.outcome === 'no_speech'
+      ? 'no_speech'
+      : 'recovered'
+  return {
+    kind,
+    sessionId,
+    dirName: basename(dirPath),
+    quarantinedAt: atMs != null ? new Date(atMs).toISOString() : null,
+    receiptedAt: Number.isFinite(receiptedMs) ? new Date(receiptedMs).toISOString() : null,
+    chunkFiles: manifest?.chunkFiles ?? countChunkWavs(dirPath),
+    quarantineReason: manifest?.reason ?? null,
+    savedFilename,
+    recovering: isRecoveryActive(basename(dirPath)),
+    retainedUntil: atMs != null ? new Date(atMs + retentionMs).toISOString() : null,
+  }
+}
+
+const DISPOSITION_RANK: Record<CaptureDispositionKind, number> = { quarantined: 0, recovered: 1, no_speech: 2 }
+
+/**
+ * What became of a capture whose audio reached quarantine, or null when the
+ * quarantine holds nothing for this session id.
+ *
+ * `no_speech` and `recovered` are terminal: the capture was decoded once and its
+ * outcome receipted. `quarantined` is held audio that a recovery has not finished
+ * yet (the sweep picks one per minute, or a person presses Recover).
+ *
+ * One id can own SEVERAL dirs (`<id>` and `<id>.<ms>`, when the same id was
+ * quarantined twice). The answer covers all of them: ANY unrecovered dir means the
+ * capture is still `quarantined`; otherwise a saved recovery outranks no_speech.
+ */
+export function readCaptureDisposition(
+  sessionId: string,
+  root: string = unsavedAudioRoot(),
+  retentionMs: number = unsavedAudioRetentionMs(),
+): CaptureDisposition | null {
+  if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) return null
+  const all = quarantineDirsFor(sessionId, root).map(dir => dispositionOf(sessionId, dir, retentionMs))
+  if (all.length === 0) return null
+  return all.reduce((best, next) => DISPOSITION_RANK[next.kind] < DISPOSITION_RANK[best.kind] ? next : best)
+}

package/server/lib/vad-silero.ts

@@ -27,6 +27,12 @@ const MIN_SAMPLES = 512
 let sherpaOnnx: any = null
 let available = false
 let vadInstance: any = null
+// 6.72.0 quiet gate: its own detector, stricter than the trimming one. Chosen on
+// bake-off canary 5 (docs/stt-672-evaluation.md): probability 0.8 with a 0.25 s
+// minimum, and quiet below 0.5 s of speech, fired on 80.8% of Silero-negative
+// chunks and 0.91% of speech chunks.
+export const QUIET_GATE_VAD = { threshold: 0.8, minSilenceDuration: 0.3, minSpeechDuration: 0.25 } as const
+let gateVad: any = null
 
 export interface TrimResult {
   trimmedWav: Buffer
@@ -60,6 +66,11 @@ export function initSileroVAD(): boolean {
       10,  // bufferSizeInSeconds — chunks are max 6s
     )
     vadInstance.reset()  // verify it works
+    gateVad = new sherpaOnnx.Vad(
+      { sileroVad: { model: MODEL_PATH, ...QUIET_GATE_VAD, windowSize: 512 }, sampleRate: SAMPLE_RATE, numThreads: 1, provider: 'cpu' },
+      10,
+    )
+    gateVad.reset()
     available = true
     console.log('[silero-vad] Initialized: Silero VAD active (reused instance, bufferSize=10s)')
     return true
@@ -182,3 +193,44 @@ export function trimSilence(wavBuffer: Buffer): TrimResult {
     return fallback
   }
 }
+
+/**
+ * Seconds of speech the quiet-gate Silero (QUIET_GATE_VAD) hears in a WAV (6.72.0).
+ *
+ * Feeds the detector one 512-sample window at a time and drains finished
+ * segments after each window. Handing sherpa-onnx the whole chunk in one
+ * acceptWaveform call (as trimSilence does) keeps only the last segment:
+ * measured 2026-10-13, a 6 s chunk of continuous speech read 0.32 s that way
+ * and 5.03 s windowed. Null when the detector is unavailable or the audio is
+ * too short to measure: a caller must never read null as silence.
+ */
+export function measureSpeechSeconds(wavBuffer: Buffer): number | null {
+  if (!available || !gateVad) return null
+  try {
+    if (wavBuffer.length <= WAV_HEADER_SIZE + MIN_SAMPLES * BYTES_PER_SAMPLE) return null
+    const pcmBytes = wavBuffer.buffer.slice(wavBuffer.byteOffset + WAV_HEADER_SIZE, wavBuffer.byteOffset + wavBuffer.length - ((wavBuffer.length - WAV_HEADER_SIZE) % 2))
+    const int16 = new Int16Array(pcmBytes)
+    if (int16.length < MIN_SAMPLES) return null
+    const float32 = new Float32Array(int16.length)
+    for (let i = 0; i < int16.length; i++) float32[i] = int16[i] / 32768
+    gateVad.reset()
+    let speechSamples = 0
+    const drain = () => {
+      while (!gateVad.isEmpty()) {
+        speechSamples += gateVad.front().samples.length
+        gateVad.pop()
+      }
+    }
+    for (let offset = 0; offset + MIN_SAMPLES <= float32.length; offset += MIN_SAMPLES) {
+      gateVad.acceptWaveform(float32.subarray(offset, offset + MIN_SAMPLES))
+      drain()
+    }
+    gateVad.flush()
+    drain()
+    gateVad.reset()
+    return speechSamples / SAMPLE_RATE
+  } catch (err: any) {
+    console.error('[silero-vad] measureSpeechSeconds error:', err.message)
+    return null
+  }
+}

package/server/lib/whisper-batch-timing.ts

@@ -1,11 +1,21 @@
 import type { WhisperWord } from './whisper-local.js'
+import { readSttSettings } from './stt-settings.js'
 
-/** Canary-only until human-corrected meeting/fact and native contention gates pass.
+/** Meeting batch HQ timestamps (6.72.0 default: on). The HQ setting decides:
+ * "large-v3" decodes with timestamps and remaps them through Whisper's own VAD
+ * table; "large-v3-legacy" keeps the pre-6.72 `--no-timestamps` decoder.
+ * COS_BATCH_HQ_TIMESTAMPS still overrides: "1" forces timestamps on, "0" off.
  * Live HTTP keeps compact JSON; interactive HQ and DTW are unchanged. */
-export function batchTimestampCanaryEnabled(): boolean {
-  return process.env.COS_BATCH_HQ_TIMESTAMPS === '1'
+export function batchTimestampsEnabled(hq?: string): boolean {
+  const flag = process.env.COS_BATCH_HQ_TIMESTAMPS
+  if (flag === '1') return true
+  if (flag === '0') return false
+  return (hq ?? readSttSettings().hq) !== 'large-v3-legacy'
 }
 
+/** Pre-6.72 name, kept for callers and tests. */
+export const batchTimestampCanaryEnabled = (): boolean => batchTimestampsEnabled()
+
 export interface VadTimeSegment {
   originalStart: number
   originalEnd: number

package/server/lib/whisper-local.ts

@@ -13,7 +13,8 @@ import { writeFileSync, unlinkSync, existsSync, readFileSync, statSync } from 'n
 import { basename, join } from 'node:path'
 import { homedir } from 'node:os'
 import crypto from 'node:crypto'
-import { batchTimestampCanaryEnabled, remapBatchWords } from './whisper-batch-timing.js'
+import { batchTimestampsEnabled, parseNativeVadTimeline, remapBatchWords } from './whisper-batch-timing.js'
+import { readSttSettings, type FrontEndId } from './stt-settings.js'
 import { getVocabulary, getOwnerName, getWhisperCorrections } from './profile.js'
 import { stripBrandUrls } from './hallucination-filter.js'
 import {
@@ -70,21 +71,34 @@ export interface HighQualityTranscriptionCapability {
 export interface HighQualityTranscriptionResult {
   text: string
   words?: WhisperWord[]
+  /** Sub-word tokens merged into spoken words (6.72.0), NOT name-corrected.
+   *  Clocks are only meaningful when the decode ran with timestamps. */
+  spokenWords?: WhisperWord[]
+  /** True when this decode ran with timestamps and the VAD remap. */
+  timestamps?: boolean
+  /** Where this decode's own VAD heard speech (seconds, input clock). Timestamp mode only. */
+  speechSpans?: Array<[number, number]>
   model: 'large-v3' | 'turbo'
   backend: 'whisper-cli' | 'whisper-server'
   actualQuality: 'hq' | 'fast'
   degradationReason?: HighQualityUnavailableReason
 }
 
-let highQualityCheckpointFingerprint: string | null = null
-let highQualityCheckpointTimingMode: boolean | null = null
+const highQualityCheckpointFingerprints = new Map<string, string>()
 
 /** Stable, path-free cache identity for progressive meeting HQ checkpoints.
  * Model/configuration is immutable for the lifetime of one server process, so
- * cache this instead of stat'ing multi-GB model files on every health poll. */
-export function getHighQualityCheckpointFingerprint(): string {
-  const timingMode = batchTimestampCanaryEnabled()
-  if (highQualityCheckpointFingerprint && highQualityCheckpointTimingMode === timingMode) return highQualityCheckpointFingerprint
+ * cache this instead of stat'ing multi-GB model files on every health poll.
+ * 6.72.0: the timing mode and the ASR front end are part of the identity, so a
+ * checkpoint decoded under one setting is never reused under another. With
+ * timestamps off and the full front end the identity is the pre-6.72 one, byte
+ * for byte. */
+export function getHighQualityCheckpointFingerprint(opts: { timestamps?: boolean; frontEnd?: FrontEndId } = {}): string {
+  const timingMode = opts.timestamps ?? batchTimestampsEnabled()
+  const frontEnd: FrontEndId = opts.frontEnd ?? readSttSettings().frontEnd
+  const cacheKey = `${timingMode ? 1 : 0}|${frontEnd}`
+  const cached = highQualityCheckpointFingerprints.get(cacheKey)
+  if (cached) return cached
   const identity = (path: string): Record<string, number | boolean> => {
     try {
       const stat = statSync(path)
@@ -93,9 +107,9 @@ export function getHighQualityCheckpointFingerprint(): string {
       return { present: false, size: 0, mtimeMs: 0 }
     }
   }
-  highQualityCheckpointFingerprint = crypto.createHash('sha256').update(JSON.stringify({
+  const fingerprint = crypto.createHash('sha256').update(JSON.stringify({
     schema: 2,
-    // Keep the existing legacy identity byte-for-byte when the canary is off.
+    // Keep the existing legacy identity byte-for-byte when timestamps are off.
     ...(timingMode ? { batchTiming: 'native-vad-timestamps-v1' } : {}),
     serverVersion: process.env.COS_SERVER_VERSION?.trim() || 'development',
     whisperCli: identity(WHISPER_CLI),
@@ -104,12 +118,12 @@ export function getHighQualityCheckpointFingerprint(): string {
     beam: 5,
     bestOf: 5,
     vadEnabled: hqCliVadEnabled('batch'),
-    enhancement: 'audio-enhance-v1',
+    enhancement: frontEnd === 'full' ? 'audio-enhance-v1' : 'audio-enhance-highpass-v1',
     prompt: buildWhisperPrompt(),
     corrections: getWhisperCorrections(),
   })).digest('hex')
-  highQualityCheckpointTimingMode = timingMode
-  return highQualityCheckpointFingerprint
+  highQualityCheckpointFingerprints.set(cacheKey, fingerprint)
+  return fingerprint
 }
 
 export function classifyHighQualityTranscriptionCapability(input: {
@@ -882,7 +896,7 @@ async function reconcileWhisperServerHealth(): Promise<boolean> {
  * Batch/save path only. Never uses whisper-server `verbose_json` (the live
  * VAD-empty crash vector). Special tokens like `[_BEG_]` / `<|...|>` are dropped.
  */
-export function parseWhisperCliFullJson(raw: string): { text: string; words: WhisperWord[] } {
+export function parseWhisperCliFullJson(raw: string): { text: string; words: WhisperWord[]; spokenWords: WhisperWord[] } {
   const data = JSON.parse(raw) as {
     transcription?: Array<{
       text?: unknown
@@ -896,6 +910,7 @@ export function parseWhisperCliFullJson(raw: string): { text: string; words: Whi
   const segments = Array.isArray(data.transcription) ? data.transcription : []
   const texts: string[] = []
   const words: WhisperWord[] = []
+  const spokenWords: WhisperWord[] = []
 
   for (const segment of segments) {
     if (typeof segment.text === 'string' && segment.text.trim()) {
@@ -909,18 +924,30 @@ export function parseWhisperCliFullJson(raw: string): { text: string; words: Whi
       const fromMs = typeof token.offsets?.from === 'number' ? token.offsets.from : Number(token.offsets?.from)
       const toMs = typeof token.offsets?.to === 'number' ? token.offsets.to : Number(token.offsets?.to)
       if (!Number.isFinite(fromMs) || !Number.isFinite(toMs)) continue
-      words.push({
+      const word: WhisperWord = {
         word: tokenText,
         start: fromMs / 1000,
         end: toMs / 1000,
         probability: typeof token.p === 'number' && Number.isFinite(token.p) ? token.p : 0,
-      })
+      }
+      words.push(word)
+      // A token without a leading space continues the previous word ("I" + "'m").
+      const rawText = typeof token.text === 'string' ? token.text : ''
+      const last = spokenWords.at(-1)
+      if (last && !/^\s/.test(rawText) && !/^[\s]*$/.test(rawText)) {
+        last.word += tokenText
+        last.end = Math.max(last.end, word.end)
+        last.probability = Math.min(last.probability, word.probability)
+      } else {
+        spokenWords.push({ ...word })
+      }
     }
   }
 
   return {
     text: texts.join(' ').replace(/\s+/g, ' ').trim(),
     words,
+    spokenWords,
   }
 }
 
@@ -949,6 +976,8 @@ export async function transcribeHighQuality(
     threads?: number
     backgroundCpu?: boolean
     signal?: AbortSignal
+    /** Meeting batch only: timestamps on/off for this decode (the job's snapshot). */
+    timestamps?: boolean
   } = {},
 ): Promise<HighQualityTranscriptionResult> {
   if (!cliAvailable) {
@@ -972,7 +1001,9 @@ export async function transcribeHighQuality(
   // Word clocks on post-meeting CPU polish, and on any decode that asks for
   // them (the prompt tail guard). Other live decodes stay compact JSON.
   const captureWords = opts.priority === 'batch' || opts.words === true
-  const timestampCanary = opts.priority === 'batch' && batchTimestampCanaryEnabled()
+  // 6.72.0: on by default for meeting batch (HQ setting "large-v3"); the job
+  // passes its own snapshot so a settings change never lands mid-meeting.
+  const timestampCanary = opts.priority === 'batch' && (opts.timestamps ?? batchTimestampsEnabled())
   let nativeDiagnostics = ''
 
   const modelPath = resolveBatchModel()
@@ -1144,6 +1175,8 @@ export async function transcribeHighQuality(
 
     let finalText = text
     let words: WhisperWord[] | undefined
+    let spokenWords: WhisperWord[] | undefined
+    let speechSpans: Array<[number, number]> | undefined
     if (captureWords) {
       try {
         if (existsSync(jsonPath)) {
@@ -1157,6 +1190,11 @@ export async function transcribeHighQuality(
           words = timed.length > 0
             ? timed.map(w => ({ ...w, word: applyCorrections(w.word) }))
             : []
+          // Spoken words stay uncorrected: the resolver joins them and corrects the text once.
+          spokenWords = timestampCanary ? remapBatchWords(parsed.spokenWords, nativeDiagnostics, useVad) : parsed.spokenWords
+          if (timestampCanary && useVad && parsed.words.length) {
+            speechSpans = parseNativeVadTimeline(nativeDiagnostics).map(s => [s.originalStart, s.originalEnd] as [number, number])
+          }
         } else if (timestampCanary) {
           throw new Error('HQ timestamp candidate did not produce CLI JSON')
         }
@@ -1193,7 +1231,10 @@ export async function transcribeHighQuality(
             ? 'large_v3_model_missing' as const
             : 'hq_disabled' as const,
         }
-    return words ? { text: corrected, words, ...metadata } : { text: corrected, ...metadata }
+    const timing = isBatch ? { timestamps: timestampCanary } : {}
+    return words
+      ? { text: corrected, words, ...(spokenWords ? { spokenWords } : {}), ...(speechSpans ? { speechSpans } : {}), ...timing, ...metadata }
+      : { text: corrected, ...timing, ...metadata }
   } finally {
     try { unlinkSync(tmpWav) } catch { /* cleanup */ }
     if (captureWords) {

package/server/routes/meeting.ts

@@ -66,6 +66,7 @@ import {
 import {
   canDeletePendingBatchAudio,
   persistBatchDecisionSidecar,
+  persistSttSidecar,
   replaceMeetingTranscriptAtomic,
 } from '../lib/meeting-batch-persistence.js'
 import {
@@ -77,6 +78,8 @@ import {
 import {
   enqueueSerializedHqWork,
   runMeetingBatchPipeline,
+  recoveryHqJob,
+  summarizeStt,
   segmentTranscriptChunks,
   stopProgressiveHqSession,
   transcribeSegments,
@@ -87,7 +90,9 @@ import {
   listUnsavedCaptures,
   markRecovered,
   markRecoveredNoSpeech,
+  readCaptureDisposition,
   registerActiveRecovery,
+  type CaptureDisposition,
 } from '../lib/unsaved-audio-quarantine.js'
 import {
   clearSessionHallucinationState,
@@ -101,6 +106,7 @@ import {
   analyzeTranscriptGaps,
   deleteSession,
   drainSessionAudioWrites,
+  durableSessionRecoveryHasRun,
   getSessionChunkEntries,
   getSessionChunks,
   getSessionProviderCandidates,
@@ -475,6 +481,48 @@ function publicSaveResponse(saved: SavedMeeting, replayed = false): Record<strin
   }
 }
 
+/**
+ * 6.71.14: what became of a capture whose live session is gone, as an ADDITIVE
+ * field beside `state`.
+ *
+ * `state` keeps its 6.71.13 values and precedence (saved > active > closed >
+ * missing) on purpose. Phones branch on it (`missing` is recovery-required or a
+ * collision, `closed` is terminal-unsaved), and a new value would fall through to
+ * their resume path. So the quarantine's answer rides alongside:
+ *   receipted    recovery finished and found no speech
+ *   recovered    recovery saved a meeting (the store may no longer find it by id)
+ *   quarantined  the audio is held and no recovery has finished yet
+ * Null when `state` is saved (the receipt is the answer) or active (a live session
+ * reports itself), and when the quarantine holds nothing for the id.
+ */
+export type MeetingCaptureOutcome = 'receipted' | 'recovered' | 'quarantined'
+
+export function captureOutcome(
+  state: 'saved' | 'active' | 'closed' | 'missing',
+  disposition: Pick<CaptureDisposition, 'kind'> | null,
+): MeetingCaptureOutcome | null {
+  if (state === 'saved' || state === 'active' || !disposition) return null
+  if (disposition.kind === 'no_speech') return 'receipted'
+  if (disposition.kind === 'recovered') return 'recovered'
+  return 'quarantined'
+}
+
+function publicDisposition(disposition: CaptureDisposition | null): Record<string, unknown> | null {
+  if (!disposition) return null
+  return {
+    kind: disposition.kind,
+    // Why the capture is terminal: `no_speech` or `recovered`; null while it is only held.
+    reason: disposition.kind === 'quarantined' ? null : disposition.kind,
+    quarantinedAt: disposition.quarantinedAt,
+    quarantineReason: disposition.quarantineReason,
+    receiptedAt: disposition.receiptedAt,
+    chunkFiles: disposition.chunkFiles,
+    savedFilename: disposition.savedFilename,
+    recovering: disposition.recovering,
+    audioRetainedUntil: disposition.retainedUntil,
+  }
+}
+
 function suppliedServerPin(
   req: { get: (name: string) => string | undefined },
   fallback: unknown,
@@ -497,6 +545,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
   const savingSessions = new Set<string>()
   setNamingSessionLiveness(id => sessions.getStartTime(id) !== null || savingSessions.has(id) || activeFinalizationJobs.has(id))
 
+  let recoveryPendingLogged = false
   router.get('/meeting/sessions/:sessionId/status', (req, res) => {
     const sessionId = String(req.params.sessionId ?? '')
     if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) {
@@ -514,11 +563,35 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       return
     }
     const saved = store.findBySessionId(sessionId)
+    // 6.71.14: before durable recovery has run (a boot behind a closed or stuck
+    // maintenance gate), a persisted meeting is not in memory YET, and answering
+    // `missing` would tell the phone the Mac lost it. Every phone status caller
+    // treats a thrown non-2xx as defer-and-retry (the uploader's finalize defers;
+    // origin-loss recovery backs off), so say "not yet" instead. A saved meeting
+    // is already authoritative and is answered as usual.
+    if (!saved && !durableSessionRecoveryHasRun()) {
+      if (!recoveryPendingLogged) {
+        recoveryPendingLogged = true
+        console.warn('[meeting/status] Answering 503 recovery_pending: durable session recovery has not run (maintenance gate closed)')
+      }
+      res.set('Cache-Control', 'private, no-store')
+      res.set('Retry-After', '5')
+      res.status(503).json({
+        error: 'Meeting session recovery has not run yet; retry shortly',
+        reason: 'recovery_pending',
+        retryable: true,
+      })
+      return
+    }
     const live = getMeetingSessionStatus(sessionId)
+    const state = saved ? 'saved' : live.state
+    // A saved meeting or a live session is the truth for itself; the quarantine is
+    // read only when neither is.
+    const disposition = state === 'saved' || state === 'active' ? null : readCaptureDisposition(sessionId)
     res.set('Cache-Control', 'private, no-store')
     res.json({
       sessionId,
-      state: saved ? 'saved' : live.state,
+      state,
       serverInstanceId,
       receivedRanges: live.receivedRanges,
       receivedCount: live.receivedCount,
@@ -530,6 +603,10 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       lastActivityAt: live.lastActivityAt,
       retainedUntil: saved ? null : live.retainedUntil,
       saveReceipt: saved ? publicSaveResponse(saved) : null,
+      // 6.71.14, additive: what became of a capture whose audio reached quarantine
+      // (null otherwise). Older clients ignore both.
+      outcome: captureOutcome(state, disposition),
+      disposition: publicDisposition(disposition),
     })
   })
 
@@ -2104,9 +2181,9 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       // decoder serialization — that lives in the queue tail. Chain onto it,
       // or two back-to-back recoveries plus a live post-meeting batch would
       // run parallel 16-thread large-v3 decoders on the user's Mac.
-      const results = await enqueueSerializedHqWork(
-        () => transcribeSegments(quarantineDir, segments, entries),
-      )
+      const hqJob = recoveryHqJob(quarantineDir, segments, entries)
+      const plan = hqJob.plan
+      const results = await enqueueSerializedHqWork(hqJob.run)
       // Batch whisper over a dead session has no streaming baseline to
       // compare against (evaluateBatchQuality needs one), but the inline
       // hallucination filter needs none — run the same two-pass the boot
@@ -2166,6 +2243,9 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
         })),
         transferIntegrity: null,
       })
+      try { persistSttSidecar(saved.sidecarPath, results, summarizeStt(plan, results, segments.length)) } catch (error) {
+        console.warn(`[meeting/orphans] ${sessionId}: STT hypotheses not saved: ${error instanceof Error ? error.message : error}`)
+      }
       markRecovered(quarantineDir, saved.filename)
       console.log(
         `[meeting/orphans] Recovered ${sessionId} → ${saved.filename} `

package/server/routes/stt-settings.ts

@@ -0,0 +1,85 @@
+// Speech-to-text settings (6.72.0). Token-protected by the /api middleware.
+//
+//   GET  /api/stt-settings                    the settings, every option with availability, Parakeet status
+//   PUT  /api/stt-settings                    partial body: {"hq":"parakeet-ultra"}, {"resolver":false}, ...
+//   POST /api/stt-settings/parakeet/install   install the pinned Parakeet CLI and models (202; poll GET)
+//        body {} | {"localSource":"/abs/path"} | {"localSource":"...","allowDownload":true}
+//   DELETE /api/stt-settings/parakeet/install cancel a running install (nothing partial is kept)
+//
+// Clients find the route with GET: a 404 means an older server, so they hide the switcher.
+// The contract is shared with COS Control and the phone (see README "Speech-to-text settings").
+
+import { Router } from 'express'
+import { errMsg } from '../lib/utils.js'
+import { cancelParakeetInstall, installParakeet, parakeetInstalled, parakeetInstallRunning, type InstallOptions } from '../lib/parakeet.js'
+import { currentSttCapabilities, ensurePreviewWarm, parakeetStatus } from '../lib/stt-runtime.js'
+import {
+  applySettingsPatch, readLastSttJob, readSttSettings, settingsView, SttSettingsError, writeSttSettings,
+  type SttCapabilities,
+} from '../lib/stt-settings.js'
+
+export interface SttSettingsRouterDeps {
+  recordingLive: () => boolean
+  capabilities?: () => SttCapabilities
+  install?: (options: InstallOptions) => Promise<void>
+  onChanged?: () => void
+}
+
+export function createSttSettingsRouter(deps: SttSettingsRouterDeps): Router {
+  const router = Router()
+  const caps = deps.capabilities ?? currentSttCapabilities
+  const install = deps.install ?? installParakeet
+  const view = () => settingsView(readSttSettings(), caps(), parakeetStatus(deps.recordingLive()), readLastSttJob())
+
+  router.get('/stt-settings', (_req, res) => {
+    try { res.json(view()) } catch (err) { res.status(500).json({ error: errMsg(err) }) }
+  })
+
+  router.put('/stt-settings', (req, res) => {
+    try {
+      const next = applySettingsPatch(readSttSettings(), req.body, caps())
+      writeSttSettings(next)
+      ensurePreviewWarm()
+      deps.onChanged?.()
+      res.json(view())
+    } catch (err) {
+      if (err instanceof SttSettingsError) return void res.status(400).json({ error: err.message })
+      res.status(500).json({ error: errMsg(err) })
+    }
+  })
+
+  router.post('/stt-settings/parakeet/install', (req, res) => {
+    try {
+      if (deps.recordingLive()) return void res.status(409).json({ error: 'A recording is live. Install Parakeet after it is saved.' })
+      if (parakeetInstalled().installed && !parakeetInstallRunning()) return void res.status(200).json({ started: false, ...view() })
+      const body = (req.body ?? {}) as { localSource?: unknown; allowDownload?: unknown }
+      const raw = body.localSource
+      if (raw !== undefined && (typeof raw !== 'string' || !raw.startsWith('/') || raw.length > 1024)) {
+        return void res.status(400).json({ error: 'localSource must be an absolute path.' })
+      }
+      if (body.allowDownload !== undefined && typeof body.allowDownload !== 'boolean') return void res.status(400).json({ error: 'allowDownload must be true or false.' })
+      // Only bytes whose SHA-256 matches the pinned manifest are ever copied from it.
+      // A named localSource that lacks a file fails plainly unless allowDownload is true.
+      const options: InstallOptions = raw ? { localSources: [raw], requireLocal: body.allowDownload !== true } : {}
+      if (!parakeetInstallRunning()) {
+        void install(options).then(() => { ensurePreviewWarm(); deps.onChanged?.() }).catch(error => {
+          console.warn(`[stt] Parakeet install failed: ${errMsg(error)}`)
+        })
+      }
+      res.status(202).json({ started: true, ...view() })
+    } catch (err) {
+      res.status(500).json({ error: errMsg(err) })
+    }
+  })
+
+  router.delete('/stt-settings/parakeet/install', (_req, res) => {
+    try {
+      const cancelled = cancelParakeetInstall()
+      res.status(cancelled ? 202 : 200).json({ cancelled, ...view() })
+    } catch (err) {
+      res.status(500).json({ error: errMsg(err) })
+    }
+  })
+
+  return router
+}