@gotcos/glasses-server 6.73.3 → 6.73.14

package/server/lib/work-search.ts

@@ -1,3 +1,4 @@
+import { type DecisionClient, type DecisionProvider, createDecisionClient, DecisionProviderError } from './decision-provider.js'
 /**
  * Work search by meaning (6.65.0, Control 0.5.259).
  *
@@ -41,7 +42,7 @@ export const WORK_SEARCH_INSTRUCTIONS = 'The user typed `query` into the search
 export const WORK_SEARCH_NONE = 'None of these tasks is what the user is looking for.'
 
 export type WorkSearchReason = 'jev_not_configured' | 'jev_key_rejected' | 'jev_cap_reached' | 'jev_breaker_open' | 'jev_request_rejected'
-  | 'jev_unavailable' | 'search_off' | 'too_many_candidates'
+  | 'jev_unavailable' | DecisionProviderError['code'] | 'search_off' | 'too_many_candidates'
 export const WORK_SEARCH_MESSAGES: Record<WorkSearchReason, string> = {
   jev_not_configured: 'Meaning search needs a TypeSafe key. Add one in Settings.',
   jev_key_rejected: 'TypeSafe did not accept the saved key. Check it in Settings. Word search still works.',
@@ -49,13 +50,26 @@ export const WORK_SEARCH_MESSAGES: Record<WorkSearchReason, string> = {
   jev_breaker_open: 'Meaning search is paused for an hour after repeated failures. Word search still works.',
   jev_request_rejected: 'Jev refused this search request. Word search still works.',
   jev_unavailable: 'Meaning search got no answer from Jev. Word search still works.',
+  decision_invalid_provider: 'Meaning search has an invalid decision provider setting. Word search still works.',
+  decision_not_configured: 'The selected decision provider needs an API key. Word search still works.',
+  decision_cap_reached: 'The selected decision provider has used today’s budget. Word search still works.',
+  decision_usage_unavailable: 'The selected decision provider’s usage accounting is unavailable. Word search still works.',
+  decision_breaker_open: 'The selected decision provider is paused after repeated failures. Word search still works.',
+  decision_key_rejected: 'The selected decision provider did not accept its key. Word search still works.',
+  decision_credits_required: 'The selected decision provider needs available credits. Word search still works.',
+  decision_rate_limited: 'The selected decision provider is rate limited. Word search still works.',
+  decision_request_rejected: 'The selected decision provider refused this request. Word search still works.',
+  decision_unavailable: 'The selected decision provider could not answer. Word search still works.',
+  decision_bad_answer: 'The selected decision provider returned an unreadable answer. Word search still works.',
+  decision_cancelled: 'Meaning search was cancelled. Word search still works.',
+  decision_images_unsupported: 'The selected decision provider does not accept images. Word search still works.',
   search_off: 'Meaning search is turned off on this server.',
   too_many_candidates: `Meaning search covers up to ${WORK_SEARCH_LIMITS.maxCandidates} cards. Pick a domain to search this view.`,
 }
 
 export interface WorkSearchHit { id: string; p: number }
 export type WorkSearchResult =
-  | { available: true; results: WorkSearchHit[]; none: number | null; cached: boolean; tokens: number }
+  | { available: true; provider?: DecisionProvider | 'none'; results: WorkSearchHit[]; none: number | null; cached: boolean; tokens: number }
   | { available: false; reason: WorkSearchReason; message: string }
 
 export function unavailable(reason: WorkSearchReason): Extract<WorkSearchResult, { available: false }> {
@@ -179,42 +193,45 @@ export function normalizeQuery(query: string): string {
 const PASSED_THROUGH = new Set<string>(['jev_not_configured', 'jev_key_rejected', 'jev_cap_reached', 'jev_breaker_open', 'jev_request_rejected'])
 
 export class WorkSearcher {
-  private cache = new Map<string, { at: number; results: WorkSearchHit[]; none: number | null }>()
+  private cache = new Map<string, { at: number; provider: DecisionProvider; results: WorkSearchHit[]; none: number | null }>()
   private inflight = new Map<string, Promise<WorkSearchResult>>()
-  constructor(private readonly jev: JevClient, private readonly now: () => number = () => Date.now()) {}
+  constructor(private readonly jev: DecisionClient, private readonly now: () => number = () => Date.now()) {}
 
   /** One Jev Choice over `candidates` (already selected, at most 254). Never throws for a Jev failure. */
   async search(query: string, candidates: readonly SearchableRow[]): Promise<WorkSearchResult> {
     if (candidates.length > WORK_SEARCH_LIMITS.maxCandidates) return unavailable('too_many_candidates')
-    if (!candidates.length) return { available: true, results: [], none: 1, cached: false, tokens: 0 }
+    if (!candidates.length) return { available: true, provider: 'none', results: [], none: 1, cached: false, tokens: 0 }
+    let client: DecisionClient
+    try { client = this.jev.snapshot?.() ?? this.jev } catch (e) { if (e instanceof DecisionProviderError) return unavailable(e.code); throw e }
     const texts = candidates.map(row => searchOptionText(row.text))
     const set = createHash('sha256').update(JSON.stringify(candidates.map((row, i) => [row.id, texts[i]]))).digest('hex')
-    const key = createHash('sha256').update(normalizeQuery(query) + '\0' + set).digest('hex')
+    const key = createHash('sha256').update((client.provider ?? 'jev') + '\0' + normalizeQuery(query) + '\0' + set).digest('hex')
     const hit = this.cache.get(key)
     if (hit && this.now() - hit.at < WORK_SEARCH_LIMITS.cacheMs) {
-      return { available: true, results: hit.results, none: hit.none, cached: true, tokens: 0 }
+      return { available: true, provider: hit.provider, results: hit.results, none: hit.none, cached: true, tokens: 0 }
     }
     if (hit) this.cache.delete(key)
     // Typing can send the same search twice before the first answers; the second waits for the first.
     const running = this.inflight.get(key)
     if (running) return running
-    const work = this.ask(query, candidates.map(row => row.id), texts, key)
+    const work = this.ask(query, candidates.map(row => row.id), texts, key, client)
     this.inflight.set(key, work)
     try { return await work } finally { this.inflight.delete(key) }
   }
 
-  private async ask(query: string, ids: string[], texts: string[], key: string): Promise<WorkSearchResult> {
+  private async ask(query: string, ids: string[], texts: string[], key: string, client: DecisionClient): Promise<WorkSearchResult> {
     const state = { query: query.trim() }
     const criteria: Record<string, string> = Object.fromEntries(texts.map((text, i) => [`t${i}`, text]))
     criteria.none = WORK_SEARCH_NONE
     const questions = { c: { type: 'choice', instructions: WORK_SEARCH_INSTRUCTIONS, criteria } }
     try {
-      const reply = await this.jev.ask(state, questions, estimateJevTokens({ state, questions }))
+      const reply = await client.ask(state, questions, estimateJevTokens({ state, questions }))
       const { results, none } = rankHits(reply.answers.c?.probabilities, ids)
       if (this.cache.size >= WORK_SEARCH_LIMITS.cacheEntries) this.cache.delete(this.cache.keys().next().value!)
-      this.cache.set(key, { at: this.now(), results, none })
-      return { available: true, results, none, cached: false, tokens: reply.inputTokens }
+      this.cache.set(key, { at: this.now(), provider: reply.provider ?? 'jev', results, none })
+      return { available: true, provider: reply.provider ?? 'jev', results, none, cached: false, tokens: reply.inputTokens }
     } catch (e) {
+      if (e instanceof DecisionProviderError) return unavailable(e.code)
       if (!(e instanceof JevError)) throw e
       // Each says what happened. A 400, 413 or 422 is jev_request_rejected: the request itself was refused, which does
       // not count toward the breaker (jev.ts), because the same cards would be refused again and an outage pause would
@@ -225,3 +242,6 @@ export class WorkSearcher {
     }
   }
 }
+
+let sharedDecisionSearch: DecisionClient | null = null
+export function sharedWorkSearchDecisionClient(): DecisionClient { return sharedDecisionSearch ??= createDecisionClient('search', sharedWorkSearchJevClient()) }

package/server/routes/client-instance.ts

@@ -36,7 +36,7 @@ export interface ClientInstanceRouterDeps {
 
 /** A POST that carries a meeting chunk: a live one, or an iPhone offline chunk replayed. The preview is not one. */
 export function isMeetingChunkPost(method: string, path: string): boolean {
-  return method === 'POST' && (path === '/transcribe-stream' || /^\/transcribe-stream\/offline-sessions\/[^/]+\/chunks$/.test(path))
+  return method === 'POST' && (path === '/transcribe-stream' || /^\/mac-recording\/mac_[0-9a-f-]+\/chunks$/.test(path) || /^\/transcribe-stream\/offline-sessions\/[^/]+\/chunks$/.test(path))
 }
 
 /** `::ffff:100.64.1.2` and `100.64.1.2` are one device. */

package/server/routes/decision-provider.ts

@@ -0,0 +1,36 @@
+/** Mounted behind the ordinary /api token and mutation-lease middleware. Selection only; no credential egress. */
+import { Router } from 'express'
+import { JEV_MODEL, resolveJevKey } from '../lib/jev.js'
+import { resolveSubqKey, subqKeyStatus } from '../lib/subq-key.js'
+import { SUBQ_MODEL } from '../lib/decision-provider.js'
+import { decisionSettingsView, DecisionSettingsError, patchDecisionSettings, readDecisionSettings, writeDecisionSettings, type DecisionProvider, type DecisionSettings } from '../lib/decision-settings.js'
+export interface DecisionProviderRouteDeps {
+  read: () => DecisionSettings
+  write: (settings: DecisionSettings) => void
+  configured: () => Record<DecisionProvider, boolean>
+  env: NodeJS.ProcessEnv
+  keyStatus: () => { jev: { configured:boolean; source:string }; subq: { configured:boolean; source:string } }
+}
+export function createDecisionProviderRouter(overrides: Partial<DecisionProviderRouteDeps> = {}): Router {
+  const deps: DecisionProviderRouteDeps = { read: readDecisionSettings, write: writeDecisionSettings, configured: () => ({ jev: !!resolveJevKey(), subq: !!resolveSubqKey() }), env: process.env, keyStatus: () => { const jev = resolveJevKey(); return { jev: { configured:!!jev, source:jev?.source ?? 'none' }, subq:subqKeyStatus() } }, ...overrides }
+  const router = Router()
+  const view = (settings: DecisionSettings) => ({ ...decisionSettingsView(settings, deps.configured(), deps.env), models: { jev: JEV_MODEL, subq: SUBQ_MODEL }, keyStatus: deps.keyStatus(),
+    capabilities: { choices: ['jev','subq'], workflows: ['session','completion','search'], hotReload: true, fallback: false, subqImages: true, subqKeySource: 'config-or-env' } })
+  router.use('/decision-provider', (_req,res,next) => { res.set('Cache-Control','private, no-store'); next() })
+  router.get('/decision-provider', (_req,res) => {
+    try { res.json(view(deps.read())) } catch { res.status(503).json({ error: { code: 'decision_settings_unavailable', message: 'Decision provider settings could not be read.' } }) }
+  })
+  router.patch('/decision-provider', (req,res) => {
+    try {
+      const next = patchDecisionSettings(deps.read(), req.body)
+      const result = view(next) // validate effective environment and build safe response BEFORE committing
+      deps.write(next)
+      res.json(result)
+    } catch (e) {
+      if (e instanceof DecisionSettingsError && e.code === 'decision_settings_conflict') return void res.status(409).json({ error: { code: e.code, message: 'Decision settings changed. Reload them before saving.' } })
+      if (e instanceof DecisionSettingsError && e.code === 'invalid_decision_settings') return void res.status(400).json({ error: { code: e.code, message: 'Choose jev or subq, or null to clear a saved setting. Unknown fields are not accepted.' } })
+      res.status(503).json({ error: { code: 'decision_settings_unavailable', message: 'Decision provider settings could not be saved.' } })
+    }
+  })
+  return router
+}

package/server/routes/glossary.ts

@@ -7,34 +7,48 @@
 //   PUT /api/transcription-glossary → same shape; PARTIAL (any omitted field is
 //     left unchanged). whisper_corrections is stored as a JSON STRING in the
 //     profile (legacy decoder contract), so the route encodes/decodes it here.
+//   POST /api/transcription-glossary/correction {heard, written, source} → learn
+//     ONE correction and its spelling (6.73.11, Fix a word), logged for undo.
+//   GET  /api/transcription-glossary/recent → { entries } newest first.
+//   POST /api/transcription-glossary/correction/undo {id} → revert that entry.
+//   POST /api/transcription-glossary/vocabulary/add {term}, /vocabulary/remove {term},
+//        /correction/remove {heard} → one atomic hand edit (6.73.12), not logged.
 
 import { Router } from 'express'
+import { randomUUID } from 'node:crypto'
+import { readFileSync } from 'node:fs'
 import { errMsg } from '../lib/utils.js'
+import { atomicWriteFileSync } from '../lib/atomic-fs.js'
+import { dataPath } from '../lib/data-dir.js'
 import {
   getVocabulary,
   getNegativeRules,
   getWhisperCorrections,
+  loadProfileObject,
   updateProfileFields,
 } from '../lib/profile.js'
+import {
+  MAX_TERMS,
+  MAX_TERM_LEN,
+  addVocabulary,
+  appendLog,
+  learnCorrection,
+  looksLikeUrlEmailPath,
+  parseLog,
+  removeCorrection,
+  removeVocabulary,
+  undoCorrection,
+  type CorrectionLogEntry,
+  type GlossaryWords,
+} from '../lib/glossary-learn.js'
 import { resetDecoderCaches } from '../lib/whisper-local.js'
 import { resetVocabEchoCache } from '../lib/hallucination-filter.js'
 import { validateNegativeRule } from '../lib/hallucination-filter.js'
 
 export const glossaryRouter = Router()
 
-const MAX_TERMS = 500
-const MAX_TERM_LEN = 100
 const MAX_RULES = 500
 
-// Positive vocab is injected into the Whisper decoder prompt; URLs/emails/paths
-// there induce ".com"/handle hallucinations on quiet audio — reject them.
-function looksLikeUrlEmailPath(s: string): boolean {
-  return /(?:https?:\/\/|www\.)/i.test(s)
-    || /@[\w.-]+\.\w/.test(s)
-    || /\.(?:com|net|org|io|ai|co|gov|edu|app|dev)\b/i.test(s)
-    || /[/\\]/.test(s)
-}
-
 function readCorrections(): Record<string, string> {
   return getWhisperCorrections()
 }
@@ -142,3 +156,121 @@ glossaryRouter.put('/transcription-glossary', async (req, res) => {
     return res.status(500).json({ error: errMsg(err) })
   }
 })
+
+// ── One-word learning (6.73.11) ──────────────────────────────────────────────
+// The recent-corrections log lives in the data dir (private, atomic, bounded);
+// the dictionary itself stays in .cos-profile.json. Both writes run inside the
+// same putChain as PUT, so a learn can never interleave with a whole-map edit.
+
+function correctionsLogPath(): string {
+  return dataPath('transcription-corrections.json')
+}
+
+function readCorrectionsLog(): CorrectionLogEntry[] {
+  try {
+    return parseLog(JSON.parse(readFileSync(correctionsLogPath(), 'utf-8')))
+  } catch {
+    return []
+  }
+}
+
+function writeCorrectionsLog(entries: CorrectionLogEntry[]): void {
+  atomicWriteFileSync(correctionsLogPath(), JSON.stringify({ version: 1, entries }, null, 2), { mode: 0o600 })
+}
+
+/** The raw stored vocabulary (strings only), so a learn appends without rewriting placeholder handling. */
+function storedWords(): GlossaryWords {
+  const raw = loadProfileObject().vocabulary
+  const vocabulary = Array.isArray(raw) ? raw.filter((term): term is string => typeof term === 'string') : []
+  return { vocabulary, corrections: readCorrections() }
+}
+
+/** Log first, then the profile; a failed profile write puts the old log back. */
+function commitWords(words: GlossaryWords, nextLog: CorrectionLogEntry[], previousLog: CorrectionLogEntry[]): void {
+  writeCorrectionsLog(nextLog)
+  try {
+    updateProfileFields({ vocabulary: words.vocabulary, whisper_corrections: JSON.stringify(words.corrections) })
+  } catch (err) {
+    try { writeCorrectionsLog(previousLog) } catch { /* the profile is unchanged; a stale log row only refuses its own undo */ }
+    throw err
+  }
+  resetDecoderCaches()
+  resetVocabEchoCache()
+}
+
+type Outcome = { status: number; body: unknown }
+
+function serialized(work: () => Outcome): Promise<Outcome> {
+  const run = putChain.catch(() => {}).then(work)
+  putChain = run
+  return run
+}
+
+glossaryRouter.post('/transcription-glossary/correction', async (req, res) => {
+  const body = req.body ?? {}
+  try {
+    const outcome = await serialized(() => {
+      const previousLog = readCorrectionsLog()
+      const learned = learnCorrection(storedWords(), body, { id: randomUUID(), at: new Date().toISOString() })
+      if (!learned.ok) return { status: learned.status, body: { error: learned.error } }
+      if (learned.unchanged) return { status: 200, body: { unchanged: true, entry: null, glossary: currentGlossary() } }
+      commitWords(learned.words, appendLog(previousLog, learned.entry), previousLog)
+      return { status: 200, body: { unchanged: false, entry: learned.entry, glossary: currentGlossary() } }
+    })
+    return res.status(outcome.status).json(outcome.body)
+  } catch (err) {
+    return res.status(500).json({ error: errMsg(err) })
+  }
+})
+
+glossaryRouter.get('/transcription-glossary/recent', (_req, res) => {
+  try {
+    res.json({ entries: readCorrectionsLog() })
+  } catch (err) {
+    res.status(500).json({ error: errMsg(err) })
+  }
+})
+
+glossaryRouter.post('/transcription-glossary/correction/undo', async (req, res) => {
+  const id = (req.body ?? {}).id
+  try {
+    const outcome = await serialized(() => {
+      const previousLog = readCorrectionsLog()
+      const undone = undoCorrection(storedWords(), previousLog, id)
+      if (!undone.ok) return { status: undone.status, body: { error: undone.error } }
+      commitWords(undone.words, undone.log, previousLog)
+      return { status: 200, body: { undone: undone.entry, glossary: currentGlossary() } }
+    })
+    return res.status(outcome.status).json(outcome.body)
+  } catch (err) {
+    return res.status(500).json({ error: errMsg(err) })
+  }
+})
+
+// ── Single-item hand edits (6.73.12) ─────────────────────────────────────────
+// One word or one correction at a time, inside the same chain as PUT and learn,
+// so COS Control never has to read the whole map and write it back.
+function singleEdit(path: string, field: 'term' | 'heard', edit: (words: GlossaryWords, raw: unknown) => ReturnType<typeof addVocabulary>) {
+  glossaryRouter.post(path, async (req, res) => {
+    const raw = (req.body ?? {})[field]
+    try {
+      const outcome = await serialized(() => {
+        const result = edit(storedWords(), raw)
+        if (!result.ok) return { status: result.status, body: { error: result.error } }
+        if (!result.unchanged) {
+          updateProfileFields({ vocabulary: result.words.vocabulary, whisper_corrections: JSON.stringify(result.words.corrections) })
+          resetDecoderCaches()
+          resetVocabEchoCache()
+        }
+        return { status: 200, body: { unchanged: result.unchanged, glossary: currentGlossary() } }
+      })
+      return res.status(outcome.status).json(outcome.body)
+    } catch (err) {
+      return res.status(500).json({ error: errMsg(err) })
+    }
+  })
+}
+
+singleEdit('/transcription-glossary/vocabulary/add', 'term', addVocabulary)
+singleEdit('/transcription-glossary/vocabulary/remove', 'term', removeVocabulary)
+singleEdit('/transcription-glossary/correction/remove', 'heard', removeCorrection)

package/server/routes/jev.ts

@@ -1,3 +1,4 @@
+import { createDecisionClient } from '../lib/decision-provider.js'
 /**
  * Jev key management (COS Control Settings) and Work session recommendations. Auth comes from the parent /api mount.
  *
@@ -42,8 +43,8 @@ function findTask<T extends { id: string; workIdentity?: string }>(rows: T[], id
 
 export function createJevRouter(overrides: Partial<JevRouteDependencies> = {}): Router {
   const jev = overrides.jev ?? sharedJevClient()
-  const deps: JevRouteDependencies = { jev, recommender: new SessionRecommender(jev), list: listBoard, validate: validateJevKey, save: saveJevKey,
-    completion: new CompletionChecker(jev), replies: (provider, sessionId, afterMs) => readRepliesSince(provider, sessionId, afterMs),
+  const deps: JevRouteDependencies = { jev, recommender: new SessionRecommender(createDecisionClient('session', jev)), list: listBoard, validate: validateJevKey, save: saveJevKey,
+    completion: new CompletionChecker(createDecisionClient('completion', jev)), replies: (provider, sessionId, afterMs) => readRepliesSince(provider, sessionId, afterMs),
     searchJev: sharedWorkSearchJevClient(), ...overrides }
   const router = Router()
   router.use(['/jev-key', '/work-board/session-recommendation', '/work-board/completion-check'], (_req, res, next) => { res.set('Cache-Control', 'private, no-store'); next() })

package/server/routes/meeting.ts

@@ -1,3 +1,4 @@
+import { MAC_CAPTURE_ID, readMacRecording, requireMacRecording, macChunkReceipt, closeMacRecording } from '../lib/mac-recording.js'
 import { readSpeakerPolicy, writeSpeakerPolicy, isSpeakerMode } from '../lib/meeting-speaker-policy.js'
 // POST /api/meeting/save — finalize an existing transcribe-stream session into
 // the standalone public meeting store. The live transcript and chunk metadata
@@ -30,6 +31,16 @@ import {
 import { readVoiceProfiles, retractEmbeddingsBySource } from '../lib/speaker-embeddings.js'
 import { enrolNamedVoice } from '../lib/meeting-relabel-enrolment.js'
 
+function requireMacRecordingForSave(sessionId: string, expectedChunkCount: unknown): void {
+  try {
+    requireMacRecording(sessionId)
+    assertMacCaptureComplete(sessionId, expectedChunkCount)
+  } catch (error) {
+    const failure = error as Error & { status?: number; reason?: string }
+    throw new MeetingStoreError(failure.message, failure.status ?? 409, failure.reason ?? 'mac_capture_not_started')
+  }
+}
+
 /**
  * The label a de-attributed voice takes, numbered within its meeting.
  *
@@ -106,6 +117,7 @@ import {
 import {
   analyzeTranscriptGaps,
   deleteSession,
+  assertMacCaptureComplete,
   drainSessionAudioWrites,
   durableSessionRecoveryHasRun,
   getSessionChunkEntries,
@@ -357,7 +369,7 @@ function scheduleFinalizationJob(job: MeetingFinalizationJob, runtime: Finalizat
       markCanonicalFinalizationState(current.sidecarPath, 'ops_pending', current.claimPending)
     }
 
-    if (cosOpsPipelineConfigured()) {
+    if (cosOpsPipelineConfigured() && !MAC_CAPTURE_ID.test(current.sessionId)) {
       await handoffMeetingToOperations(current.meetingPath)
     } else {
       // Standalone: no sync_meetings.py to produce summary/topics/decisions.
@@ -370,7 +382,7 @@ function scheduleFinalizationJob(job: MeetingFinalizationJob, runtime: Finalizat
     // The capture is finished and its files are durable, so the merge engine may score it.
     // Fire-and-forget by contract: the runner queues, defers under a drain or a live
     // capture, and never throws back at the finalization path.
-    triggerMeetingMergeRun('g2_finalized')
+    if (!MAC_CAPTURE_ID.test(current.sessionId)) triggerMeetingMergeRun('g2_finalized')
     runtime.finalizationJobs.remove(current.sessionId)
     finalizationRetryCounts.delete(key)
   }).catch(error => {
@@ -463,6 +475,7 @@ function publicSaveResponse(saved: SavedMeeting, replayed = false): Record<strin
     : 100
   return {
     receiptVersion: 1,
+    ...(saved.sourceType === 'mac_system_audio' ? { sourceType: saved.sourceType, sessionId: saved.captureId, captureId: saved.captureId } : {}),
     serverInstanceId: getServerInstanceId(),
     saved: true,
     // Keep the build199 string field without leaking an absolute host path.
@@ -639,6 +652,10 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
         return
       }
       const pin = suppliedServerPin(req, body?.serverInstanceId)
+      if (MAC_CAPTURE_ID.test(sessionId) && !pin) {
+        res.status(400).json({ error: 'Server identity pin required', reason: 'server_identity_pin_required' })
+        return
+      }
       if (pin && pin !== serverInstanceId) {
         res.status(409).json({ error: 'Server identity mismatch', reason: 'server_instance_mismatch' })
         return
@@ -661,6 +678,9 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
         res.json(publicSaveResponse(alreadySaved, true))
         return
       }
+      if (MAC_CAPTURE_ID.test(sessionId)) {
+        requireMacRecordingForSave(sessionId, body?.expectedChunkCount)
+      }
       if (savingSessions.has(sessionId)) {
         res.status(409).json({ error: 'Meeting save already in progress', reason: 'save_in_progress' })
         return
@@ -689,7 +709,10 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       const chunkEntries = sessions.getChunkEntries(sessionId)
         ?? chunks.map((chunk, chunkIndex) => ({ chunkIndex, chunk }))
       const startTime = sessions.getStartTime(sessionId) ?? Date.now()
-      const durationFromTimeline = chunks.reduce(
+      const macRecording = readMacRecording(sessionId)
+      const durationFromTimeline = macRecording
+        ? macChunkReceipt(sessionId, Number(body?.expectedChunkCount) - 1)?.endElapsed ?? 0
+        : chunks.reduce(
         (maximum, chunk) => Math.max(maximum, chunk?.elapsed ?? 0),
         0,
       )
@@ -697,7 +720,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
         ? durationFromTimeline
         : Math.max(0, Date.now() - startTime)
       const integrity = sessions.getIntegrity(sessionId)
-      const needsOperations = cosOpsPipelineConfigured()
+      const needsOperations = cosOpsPipelineConfigured() && !macRecording
       // Standalone saves need a finalization pass too, for summary enrichment.
       // Before 6.37 a standalone save with no audio nulled the job below and
       // never reached the ops_pending slot, so enrichment could never run.
@@ -806,7 +829,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
         markCanonicalFinalizationState(saved.sidecarPath, finalizationJob.phase, claimPending)
       } else if (finalizationJob) {
         markCanonicalFinalizationState(saved.sidecarPath, 'complete', false)
-        triggerMeetingMergeRun('g2_finalized')
+        if (!readMacRecording(sessionId)) triggerMeetingMergeRun('g2_finalized')
         finalizationJobs.remove(sessionId)
         finalizationJob = null
       }
@@ -963,6 +986,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
   })
   router.post('/meeting/:sessionId/speaker-policy', (req, res) => {
     const sessionId = String(req.params.sessionId ?? '')
+    if (MAC_CAPTURE_ID.test(sessionId) && req.body?.mode !== 'high-confidence') { res.status(409).json({ reason: 'mac_capture_policy_locked', error: 'The Mac pilot requires high-confidence voice identity' }); return }
     const refusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(req.body?.recordId)
     if (refusal) { res.status(refusal.status).json(refusal.body); return }
     if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId) || !isSpeakerMode(req.body?.mode) || typeof req.body?.expectedPolicyRevision !== 'string') {
@@ -2170,7 +2194,13 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       return
     }
     const capture = synthesizeEntriesFromChunkWavs(quarantineDir)
-    const entries = capture.entries
+    const macCapture = readMacRecording(sessionId)
+    const entries = capture.entries.map(entry => {
+      if (!macCapture) return entry
+      const receipt = macChunkReceipt(sessionId, entry.chunkIndex)
+      return { ...entry, chunk: { ...entry.chunk, speaker: 'Ext', speakerPolicy: 'high-confidence' as const,
+        ...(receipt ? { elapsed: receipt.endElapsed - receipt.durationMs, audioDurationMs: receipt.durationMs } : {}) } }
+    })
     if (entries.length === 0) {
       res.status(422).json({ error: 'Quarantined directory holds no readable chunk audio', reason: 'no_chunk_audio' })
       return
@@ -2213,7 +2243,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       // decoder serialization — that lives in the queue tail. Chain onto it,
       // or two back-to-back recoveries plus a live post-meeting batch would
       // run parallel 16-thread large-v3 decoders on the user's Mac.
-      const hqJob = recoveryHqJob(quarantineDir, segments, entries)
+      const hqJob = recoveryHqJob(quarantineDir, segments, entries, undefined, sessionId)
       const plan = hqJob.plan
       const results = await enqueueSerializedHqWork(hqJob.run)
       // Batch whisper over a dead session has no streaming baseline to
@@ -2242,6 +2272,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
         // Receipt it and let it clear. The audio stays on disk for its full
         // retention window, so a capture wrongly judged silent is not lost.
         markRecoveredNoSpeech(quarantineDir, entries.length)
+        if (macCapture) closeMacRecording(sessionId)
         console.log(
           `[meeting/orphans] ${sessionId} held no speech `
           + `(${entries.length} chunks, ${Math.round((Date.now() - startedAt) / 1000)}s) `
@@ -2251,7 +2282,8 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       }
       const recoveredChunks = results.map(item => ({
         text: item.text,
-        speaker: 'Unknown',
+        speaker: macCapture ? 'Ext' : 'Unknown',
+        ...(macCapture ? { speakerPolicy: 'high-confidence' as const } : {}),
         elapsed: item.segment.startElapsed,
         similarity: 0,
         words: item.words,
@@ -2266,8 +2298,8 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
           resolveCosOperationsDir(),
         ),
         transcript,
-        startTime: capture.startTime,
-        durationMs: capture.durationMs,
+        startTime: macCapture?.startTime ?? capture.startTime,
+        durationMs: macCapture ? Math.max(...entries.map(e => e.chunk.elapsed + (e.chunk.audioDurationMs ?? 0))) : capture.durationMs,
         chunks: recoveredChunks,
         chunkEntries: recoveredChunks.map((chunk, position) => ({
           chunkIndex: results[position]?.segment.startChunkIdx ?? position,
@@ -2294,7 +2326,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
           },
         })
       } catch { /* display is best-effort */ }
-      if (cosOpsPipelineConfigured()) {
+      if (cosOpsPipelineConfigured() && !macCapture) {
         await handoffMeetingToOperations(saved.filepath)
       } else {
         // Orphan recovery is its own path and never reaches
@@ -2305,7 +2337,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
         // Control surfaces and warns on before committing a drain.
         await enrichStandaloneMeeting(saved.filepath, Date.now())
       }
-      triggerMeetingMergeRun('orphan_recovered')
+      if (!macCapture) triggerMeetingMergeRun('orphan_recovered')
     }).catch(error => {
       // The quarantined audio is untouched on failure — retry stays possible
       // until the retention clock clears it.

package/server/routes/meetings.ts

@@ -18,6 +18,7 @@ import { meetingListLimit } from '../lib/meeting-store.js'
 import { searchMeetingLibrary } from '../lib/meeting-library-search.js'
 import { meetingContextFields, meetingContextKeys, readOnlyContext } from '../lib/meeting-context-keys.js'
 import { g2RecordingsReachOperations } from '../lib/g2-ops-handoff.js'
+import { MAC_CAPTURE_ID } from '../lib/mac-recording.js'
 import {
   type ImportedMeetingLibrary,
   IMPORTED_DOMAIN,
@@ -67,11 +68,36 @@ function withStandaloneIdentity(meeting: MeetingMeta): MeetingMeta {
 export function withMeetingContext<T extends MeetingMeta>(meeting: T, source: MeetingMeta['librarySource'] = meeting.librarySource): T {
   if (meeting.contextKeys !== undefined) return meeting
   if (source === 'standalone_recordings') {
-    return { ...meeting, ...meetingContextFields(meetingContextKeys({ g2SessionId: meeting.sessionId })) }
+    return { ...meeting, ...meetingContextFields(meetingContextKeys({ g2SessionId: meeting.sessionId, sourceType: meeting.sourceType })) }
   }
   return { ...meeting, ...readOnlyContext() }
 }
 
+/** A Mac capture's session id, as routes/meeting.ts keys the pipeline skip. */
+export function isMacCaptureId(sessionId: string | undefined): boolean {
+  return typeof sessionId === 'string' && MAC_CAPTURE_ID.test(sessionId)
+}
+
+/**
+ * Operations rows plus the store's Mac recordings (6.73.14), newest first by date and time, capped at `limit`. Only Mac
+ * rows are added: a G2 store row is the pipeline's to file, and its operations copy is the row. A Mac row is left out
+ * when an operations row holds its session, or when `held` does (the sessions merged scribes declare), the same rule
+ * the day count applies (imported-library-rows macStoreDayCounts). Operations rows are never deduplicated against each
+ * other or reordered among themselves, but a newer Mac row can push the oldest of them past `limit`.
+ */
+export function withMacStoreRows(operations: MeetingMeta[], storeRows: MeetingMeta[], limit: number, held: ReadonlySet<string> = new Set()): MeetingMeta[] {
+  const sessions = new Set(operations.map(row => row.sessionId).filter(Boolean))
+  const mac = storeRows
+    // Keyed on the sidecar's session, as the save route keys the pipeline skip (MAC_CAPTURE_ID). The row's sourceType
+    // comes from the markdown's Capture source line instead, which an edited or older record can lack.
+    .filter(row => isMacCaptureId(row.sessionId) && !sessions.has(row.sessionId) && !held.has(row.sessionId!))
+    .map(withStandaloneIdentity)
+  if (mac.length === 0) return operations
+  return [...operations, ...mac]
+    .sort((a, b) => `${b.date}T${b.time || '00:00'}`.localeCompare(`${a.date}T${a.time || '00:00'}`) || b.filename.localeCompare(a.filename))
+    .slice(0, Math.max(limit, 1))
+}
+
 function mergeMeetingSources(groups: MeetingMeta[][], limit: number, max = 50): MeetingMeta[] {
   const seenSessions = new Set<string>()
   const seenExact = new Set<string>()
@@ -213,7 +239,7 @@ function savedMeetingDetailWithContext(
   const source = detail.librarySource ?? (detail.recordId?.startsWith('standalone:') ? 'standalone_recordings' : undefined)
   if (source === 'standalone_recordings' && detail.contextKeys === undefined) {
     const sessionId = detail.sessionId || store.storedSessionId(descriptor.month, detail.filename || descriptor.filename)
-    return { ...detail, ...meetingContextFields(meetingContextKeys({ g2SessionId: sessionId })) }
+    return { ...detail, ...meetingContextFields(meetingContextKeys({ g2SessionId: sessionId, sourceType: detail.sourceType })) }
   }
   return withMeetingContext(detail, source)
 }
@@ -312,7 +338,11 @@ export function createMeetingsRouter(
             day: filters.day,
           })
           const declaredSessions = supersededFromRows(rows).g2Sessions
-          const meetings = dropSupersededRows(rows, { g2Sessions: declaredSessions, importRecordIds: new Set<string>(), isEmpty: declaredSessions.size === 0 })
+          const operationsMeetings = dropSupersededRows(rows, { g2Sessions: declaredSessions, importRecordIds: new Set<string>(), isEmpty: declaredSessions.size === 0 })
+          // 6.73.14 (Miles 2026-10-15): routes/meeting.ts never hands a Mac recording to the pipeline (MAC_CAPTURE_ID),
+          // so on a pipeline Mac it lives only in this store and never appeared in Meetings; Control's hand-off read
+          // "Saved meeting not found yet" forever. The store's Mac rows join the operations rows here.
+          const meetings = withMacStoreRows(operationsMeetings, store.list({ ...listOptions, sessionMatch: isMacCaptureId }), limit, declaredSessions)
           // ONLY WHEN THE LIST SAW THE WHOLE MONTH. The row list is capped, and a capped
           // list knows about fewer merged scribes than the month holds, so handing its
           // sessions to an UNCAPPED day count would subtract too little and put the dot
@@ -320,7 +350,15 @@ export function createMeetingsRouter(
           const listSawWholeMonth = rows.length < limit
           res.json({
             meetings: meetings.map(meeting => withMeetingContext(meeting)),
-            months: listCosOperationsMeetingMonths(domain),
+            // 6.73.14: a month holding only Mac recordings still reaches the calendar pager. Only store months the
+            // operations tree lacks are read, so a usual request reads nothing extra.
+            months: (() => {
+              const operationsMonths = listCosOperationsMeetingMonths(domain)
+              const known = new Set(operationsMonths)
+              const macOnly = store.listMonths().filter(month => !known.has(month)
+                && store.list({ month, domain, limit: 1, sessionMatch: isMacCaptureId }).length > 0)
+              return macOnly.length ? uniqueSortedMonths([operationsMonths, macOnly]) : operationsMonths
+            })(),
             // The rows above already read every scribe in this month and told us which
             // sessions the merged ones hold. Handing that over is the difference between
             // one read per file and two on every month request.

package/server/routes/subq-key.ts

@@ -0,0 +1,27 @@
+/** Same authenticated push-only key workflow as Jev. No key values or upstream bodies are returned. */
+import { Router } from 'express'
+import { existsSync, unlinkSync } from 'node:fs'
+import { resetSubqDecisionClients } from '../lib/decision-provider.js'
+import { saveSubqKey, subqKeyStatus, SUBQ_KEY_FILE, validateSubqKey } from '../lib/subq-key.js'
+import { secureExistingPrivateFile } from '../lib/secure-user-config.js'
+interface SubqKeyRouteDeps { status: typeof subqKeyStatus; save: (key:string)=>void; validate: typeof validateSubqKey; remove:()=>void; reset:()=>void }
+export function createSubqKeyRouter(overrides: Partial<SubqKeyRouteDeps> = {}): Router {
+  const deps:SubqKeyRouteDeps={status:()=>subqKeyStatus(),save:key=>saveSubqKey(key),validate:validateSubqKey,remove:()=>{secureExistingPrivateFile(SUBQ_KEY_FILE);if(existsSync(SUBQ_KEY_FILE))unlinkSync(SUBQ_KEY_FILE)},reset:resetSubqDecisionClients,...overrides}
+  const router=Router();router.use('/subq-key',(_req,res,next)=>{res.set('Cache-Control','private, no-store');next()})
+  router.get('/subq-key/status',(_req,res)=>res.json(deps.status()))
+  router.post('/subq-key/set',async(req,res)=>{
+    const raw=req.body?.key
+    if (!req.body||typeof req.body!=='object'||Object.keys(req.body).some(k=>k!=='key')||typeof raw!=='string') return void res.status(400).json({error:{code:'invalid_subq_key',message:'Paste a SubQ API key.'}})
+    const key=raw.trim()
+    if(key.length<16||key.length>512||/[\s\x00-\x1f\x7f]/.test(key)) return void res.status(400).json({error:{code:'invalid_subq_key',message:'That does not look like a SubQ API key.'}})
+    const check=await deps.validate(key)
+    if(!check.ok)return void res.status(400).json({error:{code:'subq_key_not_accepted',message:check.reason,upstreamStatus:check.status}})
+    try{deps.save(key);deps.reset()}catch{return void res.status(500).json({error:{code:'subq_key_not_saved',message:'The key could not be saved. Check the server data folder.'}})}
+    res.json({ok:true,...deps.status()})
+  })
+  router.delete('/subq-key',(_req,res)=>{
+    try{deps.remove();deps.reset()}catch{return void res.status(500).json({error:{code:'subq_key_not_removed',message:'The saved key could not be removed.'}})}
+    res.json({ok:true,...deps.status()})
+  })
+  return router
+}