@gotcos/glasses-server 6.71.4 → 6.71.9

package/.env.example

@@ -74,6 +74,10 @@ BIND_HOST=0.0.0.0
 #   unset / other    hold both
 # Keep these here, not only in the LaunchAgent plist: this file survives Update Server.
 # COS_PERMISSION_BROKER=questions
+# 6.71.7: after Reinstall hooks, stamped interactive questions can wait at the desk
+# while their native dialog stays available. Their card appears at the idle threshold
+# and remains until answer/cancel/expiry. Approvals and old hooks keep the prior rules.
+# Per-hook rollback without reinstall: echo 0 > ~/.cos-glasses/hook-ask-hold
 # COS_PERMISSION_BROKER_DESK_IDLE_S=90     # never below 30
 # COS_PERMISSION_BROKER_TIMEOUT_S=110      # clamped to 5..120 (under the hook's 125 s)
 

package/CHANGELOG.md

@@ -1,3 +1,32 @@
+## 6.71.9 · Phone image text in Meeting Ask (candidate)
+
+- Read text from phone screenshots and photos locally with Apple Vision on macOS, matching Control Meeting Ask's image-text path. Preserve table row positions and admit extracted text as revisioned F evidence. No extra model call or cloud OCR is introduced.
+- Check the full extract for credentials before truncation. Bound extraction concurrency/time/output; recheck media lifecycle and file revisions after extraction. Cancellation, removal and maintenance cannot revive image evidence. Saved answers keep their admitted revision.
+- Explain unreadable text and extraction failures. This supports image text, not general photo descriptions or video understanding. Small figures and skewed tables still require confirmation.
+- Includes 6.71.8 grounding and the pending 6.71.7 broker update. Existing 629 companions are compatible. Transcription/live-cue flags stay disabled. Acceptance gates: `docs/test-plan-6.71.9.md`.
+
+## 6.71.8 · Grounded Meeting Ask follow-ups (candidate)
+
+- Select connected transcript passages so corrections, historical dates, units and hypothetical scenarios stay with their amounts. Broad financial questions retain relevant topics across the recording within the existing evidence budget.
+- Follow-ups recover bounded, server-owned transcript quotations and remove prior request-local citation labels. A later answer cannot lend evidence to an earlier cutoff; changed file revisions are not silently restored. Finalized quotations keep unique citation IDs after recovery.
+- A narrow cash guard withholds hypothetical proceeds presented as current balances, including scenarios split across adjacent audio chunks. Financial summaries distinguish participant reports from verified documents and omit unrelated purchasing boilerplate. No additional model call or automatic web lookup is introduced.
+- Includes the pending 6.71.7 question broker changes and its hook reinstall requirement. Existing companions remain compatible; this server change does not require another EHPK or Control build.
+- Experimental transcription and live-cue flags remain disabled. Candidate replay and release gates: `docs/test-plan-6.71.8.md`. This is not a published release or a claim of general financial fact-checking.
+
+## 6.71.7 · Session questions stay answerable when you step away
+
+- After Reinstall hooks in COS Control, interactive AskUserQuestion requests from the new hook can stay pending while the native Mac dialog remains available. With an answering client connected, the glasses card appears when the Mac reaches its desk-idle threshold (90 seconds by default), then stays visible until answered, canceled, expired or handed back. First answer wins.
+- A current hold-capable client poll qualifies the new questions without fresh wearer input. No connected client or recent presence still means Mac-only. Approvals, unstamped hooks and background sessions retain their existing rules. Pending questions poll every three seconds; idle polling remains ten seconds.
+- Disable the new hook rule without reinstalling with `echo 0 > ~/.cos-glasses/hook-ask-hold`. Downgrading to 6.71.5 requires Reinstall hooks afterward. Codex may ask to trust the reinstalled hooks.
+- No Control update or app reinstall is required for the question rule. Companion 6.10.629 separately fixes the Meeting Ask status-row layout jump and includes 628. Physical phone/glasses acceptance remains a release gate. All transcription and grounded-cue experiments stay disabled.
+
+## 6.71.5 · public-topic meeting fact-checks
+
+- Meeting Ask can use recent public-topic passages for fact-checks and cost comparisons after an explicit persisted opt-in. It defaults off; private topics, speaker identities, unrelated passages, files, calendar and memory cannot lend search vocabulary. Older companion builds remain compatible.
+- A consented fact-check retrieves the admitted claim before answering. Questions about average costs reserve a further bounded lookup, cite available benchmarks, and distinguish an actual average from one comparable project. Missing dimensions limit precision rather than stopping research.
+- Read at most two linked text pages per search with bounded excerpts, time and bytes. Every destination and redirect is checked and DNS is pinned to the actual connection; no cookies or credentials are sent.
+- Timestamp and HQ transcription canaries remain disabled. This release improves retrieval and interpretation; it does not claim a passed 30-second audio-refinement gate.
+
 ## 6.71.4 · public meeting evidence release
 
 - New questions about completed G2 recordings receive accepted finalized transcript passages alongside original live evidence. Earlier answer quotations and turn targets stay unchanged. Final passages are frozen at admission, bounded, redacted and restricted to the requested audio cutoff.

package/README.md

@@ -232,20 +232,16 @@ own) replays rather than repeats.
 sub-agents omitted) and `recent_turns_more` to the detail payload, read backward from
 the end of the transcript; without `turns` the payload is unchanged. The glasses use it
 to scroll back through a running session's conversation.
-Since 6.52.0 a session question (the AskUserQuestion card) or a tool approval can be
-answered from the glasses or the phone while you are away from the Mac. There is nothing
-to reinstall: the hook script is the 6.51.0 one, and the server now answers the URL it
-already calls, `POST /api/permission-requests/ask` (hook-token auth, checked before the
-body is read; that one method and path is exempt from the API token, nothing else is).
-The hook posts only after the desk has been idle 90 s; the server holds the request only
-while the desk stays idle and a client that can answer keeps polling, and answers `{}`
-(the Mac's own dialog) to everything else at once. A client that never polls (COS
-Glasses 6.9.511 and earlier, COS Control) changes nothing.
+Session questions (AskUserQuestion) and tool approvals can be answered from the glasses or phone through `POST /api/permission-requests/ask`. That route uses the per-install hook token checked before the body is read; other routes retain API-token authentication.
+
+**6.71.7: Reinstall hooks in COS Control after updating.** The new hook stamps interactive questions with `askHold:1`. When an answering client is connected (a qualifying poll in the last 30 seconds), or wearer presence is still recent, COS holds the question while its native Mac dialog stays available. The card appears on the glasses after the Mac is idle for 90 seconds (the configured desk threshold). Once visible, returning to the desk does not remove it mid-read. The first desk or glasses answer wins; a matching completion, cancellation, session end, expired deadline, disconnected hook or maintenance drain clears it. A connected hold-capable app counts without a fresh touch. Without a connected client or recent presence, the question stays Mac-only.
+
+The existing away-hold and hook timeout ceilings still apply; a question never outlives its hook. Approvals, unstamped hooks and background/child sessions keep the older desk-idle and presence rules described below. Roll back only the new question rule with `echo 0 > ~/.cos-glasses/hook-ask-hold` (no reinstall). Restore it with `echo 1 > ~/.cos-glasses/hook-ask-hold`. Downgrading the server requires **Reinstall hooks** again. Until reinstalling, Codex/ Cursor desk-cancel can be unavailable; Codex may request hook trust again. No Control release is needed.
 
 The client contract (also at `/api/models` `capabilities.sessionQuestions`):
 
 - Poll `GET /api/session-questions?client=glasses` (or `client=phone`) with X-Cos-Token
-  every `pollIntervalMs` (10,000). Only those two `client` values count as a live
+  every `pollIntervalMs` (3,000 while requests are pending; otherwise 10,000). Only those two `client` values count as a live
   answerer; a poll without `client`, or with any other value, is answered but never
   counts. A client quiet for `liveWindowMs` (30,000) hands every held request back,
   except one the away hold holds (6.60.0, below).
@@ -261,10 +257,10 @@ The client contract (also at `/api/models` `capabilities.sessionQuestions`):
   404 `not_found` after a server restart or once a settled item is pruned (10 minutes);
   503 during a maintenance drain, when every held item has already gone back to the Mac.
 
-Touching the Mac hands a held request back to its dialog at once; the deadline is 110 s,
+For approvals and unstamped questions, touching the Mac hands a held request back to its dialog at once; the deadline is 110 s,
 or the away hold's.
 
-**The away hold (6.60.0).** A request that starts while you are away (the desk idle 90 s,
+**The older away hold (6.60.0, retained for approvals and unstamped questions).** A request that starts while you are away (the desk idle 90 s,
 the same threshold as above) is held for up to 10 minutes, but only when the glasses or the
 phone that show held questions report that you touched them in the last 30 minutes.
 The client contract (COS Glasses 6.9.563 and later):
@@ -472,7 +468,7 @@ both), `COS_PERMISSION_BROKER_DESK_IDLE_S` (default 90, never below 30),
 `COS_PERMISSION_BROKER_AWAY_HOLD_S` (6.60.0: default 600, clamped to 30 through 600, never
 past the installed hook's wait; `0` turns the away hold off),
 `COS_PERMISSION_BROKER_AWAY_RECENT_CLIENT_S` (6.60.0: default 1800; the away hold applies
-only when a `hold=1` client reported its wearer present within it; under 30 means the 30 s
+for unstamped questions/approvals only when a `hold=1` client reported its wearer present within it; under 30 means the 30 s
 live window),
 `COS_DIARIZER` (6.61.0: default `nemotron`; `embedding` keeps the voiceprint only),
 `COS_NEMOTRON_CLI` and `COS_NEMOTRON_MODELS` (6.61.0: the FluidAudio CLI and its
@@ -886,7 +882,7 @@ BIND_HOST=0.0.0.0 npm run start:server
   phone disconnects; COS Control's maintenance status counts it (`heldJobs`). The phone sends
   one prompt at a time, so anything you ask meanwhile waits on the phone behind it. The
   interrupted run itself is not re-run automatically; retry it if you want it.
-- *Session questions never reach the glasses?* The server holds one only when every
+- *Session questions never reach the glasses?* For 6.71.7 stamped questions, reinstall hooks, check the kill switch and a connected answering client; the card appears only after the desk-idle threshold. For older hooks the server holds one only when every
   gate passes. `/api/health` `permissionBroker.lastFastPath` names the last reason a
   request went straight to the Mac's dialog: `no_client` (no client could answer: no poll
   with `client=glasses|phone` and without `hold=1` in the last 30 s, no `hold=1` poll in the
@@ -949,3 +945,32 @@ promoting the matching Control appcast entry.
 Meeting Ask includes a qualitative evidence-confidence note. New questions about completed G2 recordings can use accepted final transcript passages alongside preliminary live evidence. Those final quotations are frozen at admission and bounded by the submitted audio cutoff; earlier answer quotations and original turn IDs stay unchanged. Final quotations have no precise word timestamp or live turn target.
 
 Transcription can mishear names, numbers, negations and speakers. Missing or incomplete words do not prove a refusal or commitment. Calendar and user-confirmed meeting context guide retrieval, without proving what was said. Timestamp and progressive-refinement canaries remain disabled by default; this release does not claim improved raw ASR accuracy or a passed 30-second refinement gate. Existing companion clients remain compatible.
+
+### Meeting Ask grounding in server 6.71.8 (candidate)
+
+The candidate selects connected transcript passages and recovers bounded original
+quotations for follow-ups. Previous answers' citation labels are removed before
+reasoning so an older label cannot be mistaken for another passage in the new
+selection. Hypothetical cash proceeds are kept separate from current balances,
+including scenarios split across short audio chunks. The guard is deliberately
+narrow: confidence notes and citations do not constitute a financial audit or
+verified tax treatment. Later files enrich a new Ask without rewriting earlier
+answers. Existing companions and COS Control remain compatible; no new EHPK is
+needed for these server changes. Transcription experiments stay disabled. See
+`docs/test-plan-6.71.8.md` for replay, regression and combined release gates.
+
+### Public-topic fact-checks in server 6.71.5
+
+Meeting Ask supports an explicit `publicTopics` choice in `/api/meeting-ask/config`. It defaults false; companion 6.10.628 exposes the choice in its Model sheet. Enabling it applies to the next Ask on that paired Mac, including COS Control. A bare “fact-check this” can select a public claim from recent transcript quotations. “How much more is that than the average?” retrieves public cost benchmarks using the previously admitted public topic. Summaries and action presets do not send transcript topics to the web.
+
+A tools-off selector proposes the public topic locally through the configured meeting provider. Admission requires selected supporting transcript passages and adjacent ASR fragments, a public category, observed subject words and amounts, and no sensitive details or speaker identity. Generic research terms may be added; unsupported descriptive words are dropped. Only the admitted query reaches web search. Linked pages are untrusted bounded excerpts; answers cite them and state confidence. The selector is semantic, so ambiguous topics are withheld rather than treated as public.
+
+The new companion also removes the native-console feedback loop observed during stale bridge errors. Physical iPhone/Even app crash recovery still requires device acceptance. Timestamp/HQ flags remain disabled.
+
+### Meeting Ask phone image text (6.71.9 candidate)
+
+On macOS, phone screenshots and photos containing text now use local Apple Vision
+OCR, like Control Meeting Ask. Extracted words become cited file evidence.
+Small numbers and tables may be misread; photos without text are not visually
+interpreted. No new EHPK or Control build is required for existing 629 companions.
+[Acceptance plan](docs/test-plan-6.71.9.md). Experimental transcription flags remain off.

package/bin/hooks/cos-session-hook

@@ -2,8 +2,8 @@
 # COS session hook (glasses-server 6.48.0; Cursor Stop follow-up 6.51.0; halt check 6.53.0; single entry 6.53.3; away hold wait 6.60.0; Codex and Cursor parity 6.62.0). Installed into ~/.claude/settings.json by
 # `--hooks install`; Claude Code runs it with the hook event name as $1 and the event
 # payload on stdin. It spools one JSON file per event into the hook spool and exits 0
-# on every path. Only PermissionRequest ever talks to the server, and only when the
-# desk has been idle. Everything else is a file write, so the server being down or
+# on every path. Only PermissionRequest ever talks to the server, for approvals only when the
+# desk has been idle; stamped questions can also wait while the Mac dialog is visible. Everything else is a file write, so the server being down or
 # restarting never delays a Claude session.
 #
 # 6.53.0: PreToolUse is SYNCHRONOUS with no matcher, so the first branch below runs before
@@ -157,9 +157,19 @@ if [ "$EVENT" = PermissionRequest ]; then
     if [ ${#2} -le 4 ] && [ "$2" -ge 20 ] && [ "$2" -le 3600 ]; then WAIT=$2; STAMP_WAIT=",\"hookWaitS\":$2"; fi ;;
   esac
 fi
+# 6.71.x: only a correctly read question from the new script skips the desk fast path.
+# The first tool_name is the payload's own. A failed read keeps the legacy path.
+STAMP_ASK=''
+if [ "$EVENT" = PermissionRequest ] && [ "$(cat "$GH/hook-ask-hold" 2>/dev/null)" != 0 ]; then
+  ASK_HEAD=$(head -c 4096 "$T.in")
+  case "$ASK_HEAD" in *'"tool_name"'*)
+    ASK_TN=${ASK_HEAD#*'"tool_name"'}; ASK_TN=${ASK_TN#"${ASK_TN%%[!:[:space:]]*}"}
+    case "$ASK_TN" in '"AskUserQuestion"'*) STAMP_ASK=',"askHold":1' ;; esac ;;
+  esac
+fi
 # 6.62.0: the provider, when the command said it (only the Codex command does).
 STAMP_PROV=''; [ -z "$PROV" ] || STAMP_PROV=",\"provider\":\"$PROV\""
-{ printf '{"ts":%s,"ppid":%s,"event":"%s"%s%s,"payload":' "$TS" "$PPID" "$EVENT" "$STAMP_WAIT" "$STAMP_PROV"; cat "$T.in"; printf '}\n'; } > "$T"
+{ printf '{"ts":%s,"ppid":%s,"event":"%s"%s%s%s,"payload":' "$TS" "$PPID" "$EVENT" "$STAMP_WAIT" "$STAMP_PROV" "$STAMP_ASK"; cat "$T.in"; printf '}\n'; } > "$T"
 rm -f "$T.in"
 # 6.51.0, CURSOR ONLY. Cursor runs this hook from ~/.claude/settings.json for its own
 # composers, and submits a Stop hook's {"followup_message":...} as that composer's next
@@ -193,9 +203,11 @@ cleanup() { rm -f "$T.req"; }
 # Desk-active fast path decided HERE (about 30 ms): no HTTP at all when someone is at the
 # keyboard. An unreadable idle time fails the same way: nothing is contacted, the native
 # dialog shows.
+if [ -z "$STAMP_ASK" ]; then
 IDLE_NS=$(ioreg -c IOHIDSystem 2>/dev/null | awk -F'= ' '/HIDIdleTime/{print $2; exit}')
 DESK_S=$(cat "$GH/hook-desk-idle-s" 2>/dev/null || echo 90)
 { [ -n "$IDLE_NS" ] && [ "$(( ${IDLE_NS%.*} / 1000000000 ))" -ge "$DESK_S" ]; } || { cleanup; exit 0; }
+fi
 TOK=$(cat "$GH/hook-token" 2>/dev/null); [ -n "$TOK" ] || { cleanup; exit 0; }   # no token, no request
 PORT=$(cat "$GH/hook-port" 2>/dev/null || echo 3141)
 # 6.60.0 (QA round 1, W7): curl runs as a tracked child, not only inside $(...), and this

package/docs/test-plan-6.71.5.md

@@ -0,0 +1,47 @@
+# Meeting public-topic fact-check acceptance: server 6.71.5 / companion 6.10.628
+
+The server retains 6.71.4 final-evidence behavior and remains compatible with older companion and Control builds. The public-topic setting starts false. Companion 628 exposes explicit consent; the setting is saved on the paired Mac and applies to subsequent Meeting Ask requests, including Control. No background search or preset transcript export is introduced. Timestamp and HQ evidence canaries remain disabled.
+
+## Automated gates
+
+- Full server suite, types, production dependency audit and frozen npm inventory; exact published integrity and a fresh-cache installation.
+- Public-topic admission: recent bounded public passages plus adjacent ASR fragments, observed names and amounts, selected passage IDs, no speaker names, no private categories, no secrets, no invented prices. Unsupported descriptive words are filtered. Semantic classification fails closed for ambiguous topics; this is not a guarantee against every classification error.
+- Consent defaults off, validates before persistence, survives restart and freezes at request admission. Identical request IDs keep the original evidence and consent. Comparisons preserve the admitted public subject in the same meeting only.
+- A consented fact-check retrieves the claim before planning. A cost comparison retrieves the claim plus a benchmark, with at most two searches. Links contain page excerpts or explicitly labeled search-result evidence. No page result is treated as instructions.
+- Article retrieval checks public destinations, all DNS addresses and every redirect, pins the verified socket address, excludes cookies and credentials, limits two redirects, 512 KB, 6,000 text characters and five seconds per page. Nontext, oversized, aborted, private and rebinding cases are refused.
+- Normalize a provider's final complete JSON correction and a confidence row without retrying inference. Reject unknown section labels and incomplete trailing JSON. Keep citation validation and one qualitative Confidence row.
+- Companion: strict WebKit suite, types, manufacturer contract, actual final-entry timer-failure probe, no native-console feedback in stale bridge rejection handling, and real WKWebView layouts at four viewport sizes. Preserve typed drafts, immutable uncertain-request retry, files, model choices and transcript anchors.
+
+## Live device script
+
+Use the current server and 628 on the iPhone. In Meeting Ask's Model sheet, explicitly select “Use public topics from this meeting.” Read this public claim aloud:
+
+> We saw a public report about New York City allocating $750,000 to replace a fire station roof. Someone said that was ten times normal. We do not have the roof area or a contract breakdown.
+
+Ask these exact questions separately:
+
+1. “Can you fact check this?” — find and cite the matching public article; distinguish an allocation from a contract and report uncertainty.
+2. “Compare cost to other similar fixes in that area.” — retrieve benchmarks; cite their scope, dates and geography. Do the permitted lookup without asking whether to search.
+3. “How much more is that than the average?” — retain the public subject. Calculate the difference, ratio and percentage when a defensible benchmark exists. Otherwise identify a comparable as an example rather than an average; do not claim the 10x assertion is established.
+4. “What remains unverified?” — flag roof area, scope and noisy numbers; do not infer an ASR correction without evidence.
+
+Then switch off public-topic consent. A subjectless fact-check must not export transcript words. A question naming a public topic still follows the existing typed-question search policy.
+
+In a separate private test recording, discuss a fictional private client contract and family medical details, then ask “Can you fact check this?” Public-topic consent must not produce a web query for those details. Do not use real credentials or private client data for this device test.
+
+During a 10-minute recording, scroll up in Transcript while fresh/refined chunks arrive: the visible passage remains anchored; Jump to now follows live text. Switch Ask/Transcript, lock/unlock, background/foreground and reconnect. Earlier answers, drafts, files and the recording identity remain intact. Check diagnostics after each transition: stale bridge errors must not create a console feedback storm.
+
+## Outstanding physical gate
+
+WKWebView probes and the reproduced error-loop negative canary do not establish that the Even host will survive every iPhone/G2 background transition. Public companion promotion requires the device test above. Server and Control can ship independently while the versioned 628 companion remains a private candidate. The frozen 627 artifact and public companion 624 remain available for rollback.
+
+## Public release verification — October 11, 2026
+
+- Frozen runtime source: `85a3e61`. Full suite: 424 files, 6,562 passed / two existing skips. Typecheck passed; production dependency audit reported zero vulnerabilities.
+- Published `@gotcos/glasses-server@6.71.5` as latest after official npm web/passkey approval. Registry download and integrity verified; fresh-cache npx installation and launcher help passed.
+- Exact tested tarball: 422 files, 3,981,207 bytes; shasum `24c194244a9ee5ac0b8dbc8c95d379d57f77944c`; integrity `sha512-C9ucAmOVYiN4pB+p7gpKkO6ofw/E0PWXqTRPY8ql3J6sV9wSYsTNWzMQPTYXOfr26KIERegmHW+XpO6dMSl4pA==`.
+- Six actual-provider field replays passed. Haiku fact/compare/average: 27.102 / 39.132 / 33.127 seconds; Sonnet: 21.906 / 31.129 / 28.601 seconds. Both fact-checks found the matching article; both comparisons and average follow-ups executed two public searches, provided evidence confidence and calculated cited example comparisons without claiming an established average. These timings measure research-answer completion, not audio refinement.
+- Eight real-provider privacy/topic-selection canaries passed: six private or injected topics produced no public query; two public topics admitted only observed vocabulary. Classification is not a universal privacy guarantee.
+- The unchanged 624 phone/lens renderers displayed all six answers, confidence and linked article sources. The current Hub main alias remains byte-identical to 624; the repository is private and no anonymous Hub download is claimed.
+- Companion 628 strict suite: 6,949 passed / one skip; types and manufacturer contracts passed. Twenty WKWebView cases passed, including four transcript anchors at zero pixel drift. Final timer-failure and bridge-error feedback gates passed. The iPhone/G2 physical transition and audio-continuity gate remains pending; 628 is a private candidate.
+- Control 0.5.285/build338 is signed, notarized, stapled and publicly downloadable; its full source suite and isolated onboarding with public server 6.71.4 passed. The ZIP SHA-256 is `5dd189f9ce9f7b49a404327a8bf5087de814fc765035122b95a8ed1756173696`. A clean-Mac/TCC/updater-swap test is not claimed.

package/docs/test-plan-6.71.7.md

@@ -0,0 +1,56 @@
+# 6.71.7 / companion 6.10.629 acceptance plan
+
+Candidate only. Server base is public 6.71.5; 6.71.6 is reserved by the separate God's Eye session. App base is frozen 628 (5a42294). Control 0.5.285/build338 can manage this update without a new Control build. This plan adds to the 6.71.5/628 meeting and bridge gates; it does not replace them.
+
+## Automated evidence
+
+- Desktop D1 passed before building: a synchronous 60-second PermissionRequest hook started at 21:32:43 CDT; the native question was visible and Red was accepted at 21:32:59, before the hook ended at 21:33:43. A second question canceled with Esc while its card had focus; the hook received SIGTERM and no process remained. Esc in the chat composer did not cancel the card. Remote Control remains untested.
+- Complete server suite: 6,574 passed / 2 skipped. A final focused installer/broker pass also covers the previous exact script fixture and current reinstall state.
+- New broker tests compare 144 approval/unstamped admission and tick cases to the actual 6.71.5 implementation. Stamped questions cover connected/no-client, active/idle/unknown desk, 90-second visibility latch, timeout ceilings, canceled hooks, session boundaries/Interrupt, child events, background requests, parallel questions and first-answer races. A desk completion may add either string or array answers to its input without changing which question it settles.
+- Eleven isolated guard mutations are killed by their named assertions after a green baseline. Original source bytes are restored and the release checkout is never mutated.
+- Companion status probe measures 20 updates per Ask/Transcript case at 390x844, 320x568 and 390x420, with long content scrolled above the bottom. Composer position, reading height, scroll position and status height must stay within 0.5 px. The private old-CSS control must fail. Standard/full WebKit-strict tests, release typechecks, manufacturer contracts, startup timer quarantine and package asset hashes must pass on final bundles.
+- Receipts/logs: `/Users/ukaoma/cos-release-candidates/glasses-question-answering-2026-10-11/`. Local automated evidence does not prove stability inside the physical Even host.
+
+## Phone status canary (629 on the current server)
+
+1. Sideload the new **6.10.629** file; preserve 628 for rollback. Start a five-minute G2 recording. Open VIEWS > live meeting > Ask.
+2. Ask: **“Catch me up on this meeting so far.”** Watch Checking COS appear and disappear. The composer and reading area must stay in place. Scroll up through an answer and repeat the question; your position must stay steady.
+3. Switch to Transcript, scroll up, and wait through at least two refreshes. New chunks and COS checks must not move the passage you are reading. Jump to live must still work.
+4. Open the keyboard and repeat in Ask, then hide it. The Ask button remains reachable. Changes caused by opening/closing the keyboard are expected; status polling while it is open must not cause additional movement.
+5. Briefly disconnect the phone's network. Connection notices remain readable, recording status remains honest, and reconnect restores Ask. A long notice/Retry must be accessible within the scrollable status area.
+6. Lock the phone for five minutes, return to Even, and verify G2 capture, transcript continuity, reconnect and no crash. Stop/save, reopen the meeting and check the saved transcript and Ask history. Include the original 628 dead-bridge/background gate; a WebKit layout probe does not qualify host crashes.
+
+Pass: no status-related movement, no inaccessible controls, no recording loss/crash, and saved evidence/history retained. Record actual observed results rather than assuming a pass.
+
+## Question broker canary (candidate server installed, hooks reinstalled)
+
+Install the frozen candidate through the supported Control-managed server path with the retained 6.71.5 generation/tarball available. Do not start an unmanaged second server. Then click **Reinstall hooks** in Control once. A Codex hook-trust prompt, if shown, must be approved by the user. Do not infer that an app upgrade reinstalled server hooks.
+
+Use a disposable interactive Claude Desktop Code session and this prompt:
+
+> Call AskUserQuestion once with the question "Pick a color" and options Red and Blue, then tell me which I picked.
+
+| Test | Action | Required result |
+| --- | --- | --- |
+| T1 desk answer | Answer Red immediately at the Mac, with glasses connected | Native dialog remains usable; model reports Red; no card appears later |
+| T2 step away | Ask again and leave the Mac untouched | Card appears after the configured desk-idle threshold (90 s default), within two 3-second polls; answer Blue from glasses; model reports Blue |
+| T3 return to desk | After T2's card appears, return and answer at the Mac | Card stays until the desk answer, then closes within two polls; no late duplicate answer |
+| T4 quiet wearer | Leave glasses connected but untouched for over 30 minutes, then ask and step away | Connected hold polling still qualifies; the card arrives after desk idle |
+| T5 no answerer | Disconnect all answering clients and ensure no recent wearer presence | Question stays Mac-only immediately; no ten-minute orphan hold |
+| T6 race | In separate runs, answer first at desk, then first on glasses; attempt late answer from the other surface | Exactly one model result; late answer ignored/rejected |
+| T7 Esc | Ask at desk, focus the question card, press Esc | Tool/hook stops; no delayed card, stuck request or stray curl process |
+| T8 approval | Request a harmless permission-controlled tool at desk, then while away | Existing approval policy and return-to-desk handback unchanged |
+| T9 reinstall/provider | Check Claude, Codex and Cursor hook status after reinstall | Current scripts; desk-cancel readiness restored; new question routing only where supported |
+| T10 rollback switch | `echo 0 > ~/.cos-glasses/hook-ask-hold`, then ask at desk | Today's immediate desk rule returns; `echo 1 > ~/.cos-glasses/hook-ask-hold` restores the new rule |
+| T11 old companion | Exercise question cards on frozen public 624 and 627/628 | Existing routes/answer shapes still work; no new client-ID rejection |
+| T12 stop/drain | Cancel a held tool; end its session; perform a controlled server drain | Corresponding card closes; no stale resurrection or orphan request |
+
+Known copy limitation: an answer at the Mac may close the old companion card with “Handed back to the Mac.” Answer-source provenance/security is deferred; this build does not require a new client identity header from 627/628.
+
+## Rollout and rollback
+
+All physical rows are pending until witnessed. Do not declare a public release qualified from the local checks alone. Preserve other sessions' worktrees, changes and 6.71.6 reservation. Merge only the tested source branches once all required gates pass; publish a frozen npm tarball and promote the companion/Hub only within explicit release authorization.
+
+Cue/transcription experiment flags stay off: `COS_LIVE_CUES_FOUNDATION_DEV`, `COS_LIVE_CUES_GROUNDED_V2`, `COS_LIVE_CUES_RESEARCH`, `COS_BATCH_HQ_TIMESTAMPS`, `COS_MEETING_ASK_HQ_EVIDENCE`. Existing `COS_MEETING_PROGRESSIVE_HQ=1` baseline is retained. There is no claim that the experimental transcription or Haiku cues passed accuracy qualification.
+
+To roll back the new question behavior quickly, write `0` to `~/.cos-glasses/hook-ask-hold`. To downgrade the server, reinstall retained 6.71.5 through Control and **Reinstall hooks again** (mandatory: the old package does not recognize the new script SHA). Roll the companion back to the preserved versioned 628 EHPK; the server question rule does not require 629. No Control upgrade is necessary.

package/docs/test-plan-6.71.8.md

@@ -0,0 +1,123 @@
+# Server 6.71.8 candidate: Meeting Ask grounding and citations
+
+Includes the pending 6.71.7 interactive-question broker update. This plan adds to
+`test-plan-6.71.7.md` and the 6.71.5 web/privacy acceptance gates; none is replaced.
+The candidate is built in `codex/meeting-grounding`, based on `595ebf4`. Server
+6.71.6 remains reserved for the separate workstream. No public release is implied.
+
+## Behavior and boundaries
+
+- Select complete neighborhoods within the existing 32,000-character transcript
+  budget. Broad money questions retain corrections, dates, units, balance
+  statements and conditional setups across the recording. The last-ten-minutes
+  contract for What to ask is unchanged.
+- Prior answers remain navigation context. Strip their request-local citation
+  tokens; recover at most 16 server-owned transcript quotations within 6,000
+  characters of quoted text and metadata. Current admitted wording wins for the
+  same turn. Keep the prior four question/answer pairs bounded. Scope by meeting,
+  server instance and audio cutoff. Do not restore old file revisions or invent
+  a canonical turn target for finalized quotations.
+- Keep current and recovered transcript IDs distinct from finalized quotation
+  IDs. Saved answer records remain immutable. Later uploads enrich a new Ask;
+  they do not rewrite an earlier answer.
+- A narrow cash backstop prevents cited hypothetical proceeds from becoming
+  current balances or a fabricated conflict with a current screenshot. It carries
+  scenario wording across nearby short chunks, preserves explicitly separate
+  current evidence, and does not use unrelated liability amounts as cash proof.
+  This is not general numeric entailment, tax validation or a financial audit.
+- Prompt guidance preserves explicit corrections while keeping final documents
+  unverified, distinguishes historical transactions from proposals, avoids
+  guessed bill types and unnecessary ordering language, and favors central
+  personal-conversation facts. Confidence remains qualitative on every answer.
+- No additional provider call, new dependency, automatic public lookup, ASR
+  rewrite, timestamp configuration or background job is introduced.
+
+## Automated gates
+
+1. Typecheck and the complete server suite on frozen source.
+2. Regression cases: conditional cash, independent current balances, false
+   current-versus-future conflicts, split scenario chunks, correction neighborhoods,
+   broad financial retrieval, repeated citation labels, future/cross-meeting
+   recovery, forged client source metadata, old file revisions and finalized-ID
+   collisions. Existing old-client routes, web consent/privacy, canceled requests,
+   completed-record immutability and question broker tests must stay green.
+3. Isolated mutation gate: stale labels, cross-meeting/future/file recovery,
+   disabled cash guard, fragmented evidence, finalized citation collision and
+   loss of scenario context. Require a green baseline and assertion failures for
+   all eight mutations. Never mutate the release checkout or live data.
+4. Pack inventory: test files and private recording/replay artifacts are absent;
+   the new runtime modules and this plan are present. Verify the frozen tarball
+   SHA-256 and a fresh-cache local-tarball CLI help invocation.
+
+## Private recording replay
+
+Keep the actual recordings, screenshots, request snapshots, provider answers and
+receipts outside this public repository and npm package. Use the original
+question cutoffs: Summary at 20:59.633 and money highlights at 37:53.548. Later
+financial passages and files must not leak backward into these comparisons.
+
+Replay the original selected provider with tools, connectors and hooks disabled,
+using isolated data/audit directories and a 30-second cancellation deadline.
+Compare the original field answers, a fresh baseline, and three candidate money
+answers. Also run one candidate summary and a new Ask with the uploaded files.
+Record all failed rounds; do not replace the original negative evidence with
+only a passing scorecard. Inspect actual prose and supporting quotations: a
+citation-membership check alone does not prove that a claim is true.
+
+Required observations:
+
+- Conditional proceeds stay conditional; present cash is not invented.
+- The explicit bill correction is available and recognized; the final invoice
+  remains unverified. A corrected subissue does not settle the entire bill.
+- Earlier reported savings retain an original quote and a current scoped citation.
+- Historical conversions are distinguished from the later stop-converting stance.
+- A file-aware answer cites the current file revision, distinguishes present
+  balances from future scenarios, leaves ambiguous OCR labels unresolved, and
+  treats nonmatching exact totals as a discrepancy rather than rounding them equal.
+- One provider call and no public/private search per replay; each observed run
+  completes within 30 seconds. This small recording replay is not a general
+  latency guarantee or a transcription-accuracy qualification.
+
+## Field acceptance before the combined public release
+
+Use the supported COS Control-managed candidate installation path. Preserve the
+known-good 6.71.5 generation; do not start another server. Reinstall hooks once
+because this candidate includes 6.71.7. Complete the existing phone 629 status
+and question-broker acceptance rows in `test-plan-6.71.7.md`.
+
+On a saved meeting, ask:
+
+> What are the money highlights so far?
+
+Then:
+
+> Separate current balances, past transactions, and hypothetical plans. Show what
+> still needs confirmation and cite each source.
+
+Attach a document or screenshot, then:
+
+> Update the highlights using the new file. Which figures are supported by the
+> file, and which were only discussed as possibilities?
+
+Open each citation on both phone and Control. It must show the supporting
+quotation/file revision, not the passage that happened to reuse an older number.
+Repeat while new chunks arrive; prior completed answers remain unchanged. Check
+old 624/627/628 companion compatibility and the existing 629 status stability gate.
+
+## Flags, rollout and rollback
+
+Keep `COS_BATCH_HQ_TIMESTAMPS`, `COS_MEETING_ASK_HQ_EVIDENCE`,
+`COS_LIVE_CUES_FOUNDATION_DEV`, `COS_LIVE_CUES_GROUNDED_V2` and
+`COS_LIVE_CUES_RESEARCH` disabled. Retain the existing progressive-HQ baseline
+configuration. These changes do not claim better raw transcription.
+
+The candidate combines both server updates without altering their other
+worktrees. Merge only tested branches. npm publication, registry integrity,
+clean-cache registry install and marketplace promotion remain separate release
+steps. Assess release notes/docs and current companion/Control compatibility at
+that time. The grounding change needs no new client API or EHPK; frozen 629
+remains the separate phone-status candidate.
+
+Rollback: reinstall retained public server 6.71.5 through Control and reinstall
+hooks again. The question-rule off switch from 6.71.7 remains available. Keep the
+previous 628 EHPK and its hash; no completed Ask records are migrated or rewritten.

package/docs/test-plan-6.71.9.md

@@ -0,0 +1,61 @@
+# Server 6.71.9 candidate: phone image text in Meeting Ask
+
+Adds to the 6.71.8 grounding, 6.71.7 question-broker and 6.71.5 web/privacy gates.
+Experimental transcription and live-cue flags remain disabled; the released
+progressive HQ baseline remains unchanged. Companion 6.10.629 is compatible;
+no new Control app or EHPK is required for this server addition.
+
+## Behavior
+
+Phone screenshots and photos containing text are read locally using macOS Apple
+Vision, like COS Control's Meeting Ask image-text companions. Results become
+revisioned file evidence with F citations. OCR rows preserve spatial association;
+small numbers, merged cells and skewed tables remain imperfect. The assistant
+must distinguish the displayed metric from overall strength or preference.
+This is text extraction, not general visual reasoning. Photos without readable
+text and videos are not silently treated as understood. Non-macOS servers return
+an explicit failed extraction. Existing TXT/MD/CSV/JSON/PDF-text behavior stays.
+
+Two OCR processes maximum, 10 seconds per image and 20 seconds per attachment
+batch, bounded output and no network/model call for extraction. Credential checks
+cover the whole extract before truncation. Removal, expiry, reservation, changed
+revisions and maintenance admission are rechecked after OCR. Shutdown aborts and
+waits for extraction. Historical answers retain the revision they actually used.
+Re-add an old unsupported image after installing; old answers are never rewritten.
+
+## Automated gates
+
+- Native Apple Vision replay of the actual uploaded IMG_7299.jpeg.
+- Replay the original "Who is miles top character?" and explicit Crit Value
+  question with the original transcript cutoff in an isolated Ask/media store.
+  Require completion, Mavuika first, named metric, a resolving F citation,
+  qualitative confidence, no unsupported overall-strength conclusion and less
+  than 30 seconds including OCR. Searches are disabled in this replay.
+- Credential screen labels, gutters and credentials past the text cap; empty and
+  failed OCR; retry; concurrent removal/deletion; maintenance/shutdown cancellation;
+  durable F evidence; table rows; output bounds; authenticated HTTP route.
+- Full server suite, TypeScript check, production audit, clean diff and packaged
+  native JXA helper. Production publish gates still apply.
+
+## Exact phone canary (Claude Sonnet)
+
+1. Open the saved test meeting on the phone. Re-add IMG_7299.jpeg with +. Wait for
+   the attachment to become readable. Do not submit before upload/read finishes.
+2. Ask: "Using the attached image, who is first in the displayed character table,
+   and what metric is shown? Cite the image."
+   Pass: Mavuika, Crit Value, an expandable image/file citation, uncertainty about
+   any unreadable digits. It must not substitute personality or writing style.
+3. Ask: "Does that prove this is my strongest character overall?"
+   Pass: distinguishes the displayed metric from overall strength, with a current
+   image citation; no invented damage/build/team assessment.
+4. Attach a clear screenshot of text or a price list. Ask for one exact visible
+   item/amount. Check the original and its citation. Then ask a follow-up.
+5. Attach a photo without text. Pass: explicitly no readable text; no invented
+   visual description. Upload a synthetic credential screenshot (never a real
+   password). Pass: held; credential absent from answer and export.
+6. Check Ask/Transcript, keyboard and background/resume behavior. The image row
+   should settle without losing the reading position. Saved history must retain
+   answers/citations. Repeat after reopening the saved meeting.
+
+Public latest promotion remains gated by phone acceptance and the outstanding
+question-broker / older-client / lifecycle checks from the earlier plans.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.71.4",
+  "version": "6.71.9",
   "description": "COS Glasses: self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {
@@ -89,7 +89,12 @@
     "bin/whisper-runtime.d.cts",
     "docs/test-plan-6.71.2.md",
     "!server/scripts/meeting-evidence-canary.ts",
-    "docs/test-plan-6.71.3.md"
+    "docs/test-plan-6.71.3.md",
+    "docs/test-plan-6.71.5.md",
+    "docs/test-plan-6.71.7.md",
+    "!server/scripts/question-hold-mutation-gate.mjs",
+    "docs/test-plan-6.71.8.md",
+    "docs/test-plan-6.71.9.md"
   ],
   "author": "COS Contributors",
   "license": "MIT",

package/server/index.ts

@@ -24,7 +24,7 @@ import { agentSessionStreamRouter } from './routes/agent-session-stream.js'
 import { createAttachedTurnStream } from './lib/session-stream-producer.js'
 import { claudeSessionsRouter } from './routes/claude-sessions.js'
 import { createSessionHooksRouter } from './routes/session-hooks.js'
-import { cachedHookStatus, claudeDeskRunning, onSessionRowEnded, deskIdleSeconds, deskTurnEndedAt, haltHandedOffTurn, providerHookSeen, registerDrainKickStats, registryIdleAfterStop, sessionHooksEnabled, sessionSignalStore, signalFor, startSessionHooksRuntime } from './lib/session-hooks-runtime.js'
+import { cachedHookStatus, isCosSpawnedPid, registryEntrypointSync, claudeDeskRunning, onSessionRowEnded, deskIdleSeconds, deskTurnEndedAt, haltHandedOffTurn, providerHookSeen, registerDrainKickStats, registryIdleAfterStop, sessionHooksEnabled, sessionSignalStore, signalFor, startSessionHooksRuntime } from './lib/session-hooks-runtime.js'
 import { clearingHaltOnSpawn, writeHaltMarker } from './lib/session-halt.js'
 import { startProviderObserveRefresh } from './lib/provider-observe.js'
 import { appendSessionCancelLedger, cancelHoldUntil as cancelHoldUntilFor, noteThreadCancelled, setDeskCancelReaders, threadCancel } from './lib/session-cancel.js'
@@ -277,6 +277,10 @@ const permissionBroker = new PermissionBroker({
   mode: () => permissionBrokerMode(process.env, sessionHooksEnabled()),
   admissionsOpen: maintenanceAdmissionsOpen,
   lastQuestionsPollAt,
+  isBackgroundRequest: body => {
+    const b = body as { ppid?: number; payload?: {session_id?: string; agent_id?: unknown} }
+    return !!b.payload?.agent_id || isCosSpawnedPid(b.ppid ?? null) || registryEntrypointSync(b.payload?.session_id ?? '') === 'sdk-cli'
+  },
   readDeskIdleSeconds: readHidIdleSeconds,
   deskIdleSeconds,
   timeoutMs: () => permissionBrokerTimeoutMs(process.env),

package/server/lib/claude-hooks-installer.ts

@@ -396,6 +396,7 @@ export const HALT_CAPABLE_PRIOR_SCRIPT_SHAS: readonly string[] = [
   'df54677f79908893509ee87608cfe3f4a53ced03f88f337f16a63741d6b3d547',
   '0e1bbb9816c9475436f89f6326d5504eccc9aa6519ff5e466b949d53a73d8439',
   '1877c90c5359571dfc74c6d03395104a73925868147e8a50cd9d7b4226b1b5ca',
+  '0fd4f98801333399625701bdc83ed1a5906bbf18c449d0586daa6b8e58ada7f3',
 ]
 
 /**