@gotcos/glasses-server 6.73.5 → 6.73.14

package/server/lib/imported-library-rows.ts

@@ -48,7 +48,8 @@ import {
   importHash,
   importRecordId,
 } from './imported-meeting-library.js'
-import { getMeetingStore, type MeetingMeta, type MeetingStore } from './meeting-store.js'
+import { getMeetingStore, MEETING_LIST_CAP_SCOPED, type MeetingMeta, type MeetingStore } from './meeting-store.js'
+import { MAC_CAPTURE_ID } from './mac-recording.js'
 
 /** The merged-scribe markers live with the scribe reader; re-exported for callers. */
 export {
@@ -531,10 +532,63 @@ function operationsMergedSessions(
   return sessions
 }
 
+/**
+ * Sessions the operations rows of these month folders hold: each scribe's sidecar session (beside it, else under the
+ * server's recordings root by the same name, as `listCosOperationsMeetings` reads it), plus every session a merged
+ * scribe declares. A store Mac row whose session is here is already a row, and a dot, on the operations side.
+ */
+function operationsHeldSessions(
+  directories: readonly string[],
+  merged: ReadonlySet<string>,
+  recordingsRoot: string = dataPath('recordings'),
+): Set<string> {
+  const sessions = new Set(merged)
+  for (const directory of directories) {
+    let names: string[]
+    try {
+      names = readdirSync(directory).filter(name => name.endsWith('.md'))
+    } catch {
+      continue
+    }
+    for (const filename of names) {
+      const sessionId = droppedSessionId(directory, filename, recordingsRoot)
+      if (sessionId) sessions.add(sessionId)
+    }
+  }
+  return sessions
+}
+
+/**
+ * 6.73.14: day counts for the store's Mac recordings. A Mac capture never reaches the operations tree, so on a pipeline
+ * Mac these rows are counted nowhere else. A session the operations side already holds (`held`, read only when the store
+ * has a Mac recording in this month) is left out, as `withMacStoreRows` leaves its row out, so an operations copy counts
+ * once. Read through `list()`, filtered before its cap (MEETING_LIST_CAP_SCOPED, 200 rows): a month with more than 200
+ * such recordings undercounts its dots; nothing is counted twice.
+ */
+export function macStoreDayCounts(
+  store: MeetingStore,
+  month: string,
+  domain: string,
+  held: () => ReadonlySet<string> = () => new Set(),
+): Array<{ date: string; count: number }> {
+  const counts = new Map<string, number>()
+  let heldSessions: ReadonlySet<string> | undefined
+  const sessionMatch = (id: string | undefined) => typeof id === 'string' && MAC_CAPTURE_ID.test(id) && !(heldSessions ??= held()).has(id)
+  for (const row of store.list({ month, domain, limit: MEETING_LIST_CAP_SCOPED, sessionMatch })) {
+    // The day from the filename, as the store's own day dots read it (MeetingStore.listDayCounts).
+    const date = /^(\d{4}-\d{2}-\d{2})_/.exec(row.filename)?.[1]
+    if (!row.sessionId || !MAC_CAPTURE_ID.test(row.sessionId) || !date) continue
+    counts.set(date, (counts.get(date) ?? 0) + 1)
+  }
+  return [...counts.entries()].sort((a, b) => a[0].localeCompare(b[0])).map(([date, count]) => ({ date, count }))
+}
+
 /**
  * Day counts for one month across every source the list shows, with supersession
- * applied. The list and `probeMeetings` share it so a dot and a row can never
- * disagree about how many meetings a day holds.
+ * applied. The list and `probeMeetings` share it so a dot and a row agree about
+ * how many meetings a day holds: each source is counted by the rule that lists
+ * it. The counts are not capped the way a row page is, except the store's Mac
+ * recordings, which stop at 200 a month (macStoreDayCounts).
  */
 export function supersededDayCounts(
   month: string,
@@ -568,9 +622,13 @@ export function supersededDayCounts(
     // into this layout at all: on a pipeline Mac the operations tree is the one
     // library, and a derived record here would be a second row for one meeting.
     const directories = operationsMonthDirs(month, domain)
+    const merged = operationsMergedSessions(directories, options.declaredSessions)
     return mergeDayCounts([
       listCosOperationsMeetingDays(month, domain),
-      sessionDropCounts(directories, operationsMergedSessions(directories, options.declaredSessions), options.recordingsRoot),
+      sessionDropCounts(directories, merged, options.recordingsRoot),
+      // 6.73.14: the store's Mac recordings, which the list now shows (routes/meetings.ts withMacStoreRows), less any the
+      // operations side already counts.
+      macStoreDayCounts(store, month, domain, () => operationsHeldSessions(directories, merged, options.recordingsRoot)),
     ])
   }
 

package/server/lib/jev.ts

@@ -81,7 +81,7 @@ function dailyCap(): number {
   return Number.isFinite(raw) && raw > 0 ? Math.floor(raw) : JEV_LIMITS.defaultDailyTokens
 }
 
-export interface JevAnswers { answers: Record<string, { choice?: string; probabilities?: Record<string, number>; noul?: number }>; model?: string; inputTokens: number }
+export interface JevAnswers { provider?: 'jev' | 'subq'; answers: Record<string, { type?: 'choice' | 'noul' | 'score'; choice?: string; probabilities?: Record<string, number>; noul?: number; confidence?: number; score?: number; legend?: Record<string, unknown> }>; model?: string; inputTokens: number }
 
 /** One Jev client per process: it owns the breaker and the usage ledger. */
 export class JevClient {
@@ -128,14 +128,14 @@ export class JevClient {
   }
 
   /** Ask one request. `estimate` is the caller's input-token estimate, checked against the cap BEFORE sending. */
-  async ask(state: unknown, questions: Record<string, unknown>, estimate: number): Promise<JevAnswers> {
+  async ask(state: unknown, questions: Record<string, unknown>, estimate: number, options?: { signal?: AbortSignal }): Promise<JevAnswers> {
     const key = resolveJevKey()
     if (!key) throw new JevError('jev_not_configured')
     if (this.breakerUntil > this.now().getTime()) throw new JevError('jev_breaker_open')
     if (this.usedToday() + estimate > this.cap()) this.fail('jev_cap_reached', false)
     let res: Response
     try {
-      res = await this.fetchImpl(`${JEV_ENDPOINT}/systemone`, { method: 'POST', signal: AbortSignal.timeout(JEV_LIMITS.timeoutMs),
+      res = await this.fetchImpl(`${JEV_ENDPOINT}/systemone`, { method: 'POST', signal: AbortSignal.any([AbortSignal.timeout(JEV_LIMITS.timeoutMs), ...(options?.signal ? [options.signal] : [])]),
         headers: { Authorization: `Bearer ${key.key}`, 'Content-Type': 'application/json' },
         body: JSON.stringify({ state, model: JEV_MODEL, questions }) })
     } catch { return this.fail('jev_unavailable', true) }

package/server/lib/lens-gist-engines.ts

@@ -200,9 +200,14 @@ function lastJsonObject(stdout: string): any {
 
 // --- Claude ---------------------------------------------------------------------------
 
-export function buildClaudeGistArgs(model: string, system: string): string[] {
+/** `claude -p --effort` levels COS passes (6.73.12). The CLI also takes xhigh and max; COS does not use them. */
+export const CLAUDE_GIST_EFFORTS = ['low', 'medium', 'high'] as const
+export type ClaudeGistEffort = typeof CLAUDE_GIST_EFFORTS[number]
+
+/** `effort` defaults to low, so the lens gist and Meeting Ask argv stay exactly as before 6.73.12. */
+export function buildClaudeGistArgs(model: string, system: string, effort: ClaudeGistEffort = 'low'): string[] {
   return [
-    '-p', '--model', model, '--effort', 'low',
+    '-p', '--model', model, '--effort', effort,
     // No tools: nothing to act on an instruction hidden in the reply, and ~1.2k tokens a
     // call instead of a cache of tool definitions. claude-permissions.ts records an empty
     // --tools causing a spurious compaction and a synthetic 400 on the 2026-08-26 CLI, in

package/server/lib/live-cos-ask.ts

@@ -1,4 +1,5 @@
 // On-demand meeting assistance. No poll, background summary, chat persistence or write tools.
+import { MAC_ASK_SESSION } from './ask-session-id.js'
 import { connectedEvidence } from './meeting-ask-evidence.js'
 import { REVIEW_SYSTEM, normalizeReviewConfidence, reviewRepairDiagnostics, reviewProblem, unverifiedReview, isFactCheckCTA, pageWasRead } from './meeting-ask-review.js'
 import { followupContext } from './meeting-ask-followup.js'
@@ -35,7 +36,7 @@ const TASKS: Record<AskAction, string> = {
 }
 export function normalizeAsk(value: unknown): AskInput {
   const v = value as any
-  if (!v || typeof v !== 'object' || typeof v.sessionId !== 'string' || !/^meeting_[A-Za-z0-9_-]{1,100}$/.test(v.sessionId ?? '') || !ASK_ACTIONS.includes(v.action)) throw new AskError('invalid_request')
+  if (!v || typeof v !== 'object' || typeof v.sessionId !== 'string' || !(/^meeting_[A-Za-z0-9_-]{1,100}$/.test(v.sessionId ?? '') || MAC_ASK_SESSION.test(v.sessionId ?? '')) || !ASK_ACTIONS.includes(v.action)) throw new AskError('invalid_request')
   if (typeof v.question !== 'string' || v.question.length > 2000 || (v.action === 'ask' && !v.question.trim())) throw new AskError('invalid_question')
   if (!Number.isFinite(v.elapsedMs) || v.elapsedMs < 0 || v.elapsedMs > 7 * 86400_000) throw new AskError('invalid_time')
   if (!Array.isArray(v.turns) || v.turns.length < 1 || v.turns.length > 6000) throw new AskError('invalid_transcript')

package/server/lib/mac-recording-asr.ts

@@ -0,0 +1,59 @@
+// Manual Mac canonical chunks follow the saved-meeting model choice. The
+// normal preview resolver may fall back to Turbo; canonical Mac audio must not.
+import { ParakeetError, transcribeParakeet, type ParakeetFailure } from './parakeet.js'
+import type { WhisperWord } from './whisper-local.js'
+
+export const MAC_PARAKEET_TIMEOUT_MS = 30_000
+
+export class MacParakeetUnavailableError extends Error {
+  readonly status = 503
+  readonly retryable = true
+  readonly model = 'parakeet-ultra'
+  readonly reason: `mac_parakeet_${ParakeetFailure}`
+
+  constructor(cause: unknown) {
+    const reason = cause instanceof ParakeetError ? cause.reason : 'cli_failed'
+    super(`Selected Parakeet Ultra could not transcribe this Mac chunk (${reason}); audio is preserved for retry`)
+    this.name = 'MacParakeetUnavailableError'
+    this.reason = `mac_parakeet_${reason}`
+  }
+}
+
+/** Interactive admission is bounded and never queues behind saved HQ work.
+ * The shared worker verifies the pinned installation and offline sandbox.
+ * Cold compilation may use this deadline; no Whisper/cloud fallback is allowed. */
+export async function transcribeMacParakeet(audio: Buffer, speechSeconds: number | null): Promise<{
+  text: string
+  words: WhisperWord[]
+  model: 'parakeet-ultra'
+  backend: 'fluidaudio-coreml'
+  asrProvider: 'server-parakeet'
+  latencyMs: number
+}> {
+  try {
+    const result = await transcribeParakeet(audio, {
+      model: 'parakeet-ultra',
+      lane: 'interactive',
+      timeoutMs: MAC_PARAKEET_TIMEOUT_MS,
+    })
+    if (result.model !== 'parakeet-ultra') {
+      throw new ParakeetError('bad_output', 'Parakeet did not return the selected model')
+    }
+    // 6.73.8: no words over detected speech (laughter, music, crosstalk) is an answer, not a failure. As a retryable
+    // 503 it replayed the same audio forever and froze every later chunk of a live meeting (2026-10-15, chunk 51).
+    // The saved meeting re-transcribes the full audio with strict Parakeet, so these words are not lost.
+    if (!result.text.trim() && speechSeconds !== null && speechSeconds >= 0.5) {
+      console.warn(`[mac-asr] Parakeet returned no words over ${speechSeconds.toFixed(2)}s of detected speech; recorded empty`)
+    }
+    return {
+      text: result.text,
+      words: result.words.map(word => ({ ...word, probability: word.probability ?? 0 })),
+      model: result.model,
+      backend: 'fluidaudio-coreml',
+      asrProvider: 'server-parakeet',
+      latencyMs: result.wallMs,
+    }
+  } catch (error) {
+    throw new MacParakeetUnavailableError(error)
+  }
+}

package/server/lib/mac-recording.ts

@@ -0,0 +1,111 @@
+/** Manual, remote-playback-only Mac capture. This registry is independent of
+ * live transcription state so provenance and the strict policy survive save,
+ * quarantine, finalization and recovery. No capture or model is started here. */
+import { constants, closeSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { dataPath } from './data-dir.js'
+import { durableAtomicWriteFileSync } from './atomic-fs.js'
+import { readSpeakerPolicy, writeSpeakerPolicy } from './meeting-speaker-policy.js'
+
+export const MAC_SOURCE_TYPE = 'mac_system_audio' as const
+export const MAC_CAPTURE_ID = /^mac_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
+export const MAC_AUDIO = { sourceType: MAC_SOURCE_TYPE, sampleRate: 16000, channels: 1, bitsPerSample: 16, maxChunkMs: 30000, maxChunkBytes: 960044, speakerPolicy: 'high-confidence' as const }
+export interface MacRecording { version: 1; captureId: string; sessionId: string; sourceType: typeof MAC_SOURCE_TYPE; startTime: number; speakerPolicy: 'high-confidence'; closedAt?: number }
+export function macError(status: number, reason: string, message: string): Error & { status: number; reason: string } {
+  return Object.assign(new Error(message), { status, reason })
+}
+function registryPath(id: string): string {
+  if (!MAC_CAPTURE_ID.test(id)) throw macError(400, 'invalid_capture_id', 'Invalid Mac capture ID')
+  return join(dataPath('mac-recordings'), id + '.json')
+}
+export function readMacRecording(id: string): MacRecording | null {
+  if (!MAC_CAPTURE_ID.test(id)) return null
+  try {
+    const path = registryPath(id)
+    if (lstatSync(path).isSymbolicLink()) throw new Error('symbolic link')
+    const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK)
+    try {
+      const stat = fstatSync(fd)
+      if (!stat.isFile() || stat.size > 4096) throw new Error('invalid registry file')
+      const value = JSON.parse(readFileSync(fd, 'utf8'))
+      if (value.version !== 1 || value.captureId !== id || value.sessionId !== id || value.sourceType !== MAC_SOURCE_TYPE || value.speakerPolicy !== 'high-confidence' || !Number.isSafeInteger(value.startTime) || value.startTime <= 0) throw new Error('invalid registry metadata')
+      return value
+    } finally { closeSync(fd) }
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return null
+    throw macError(409, 'mac_capture_metadata_unreadable', 'Mac capture metadata is unreadable; recording was not admitted')
+  }
+}
+export function registerMacRecording(input: unknown): { recording: MacRecording; replayed: boolean } {
+  const body = input as Partial<MacRecording> | null
+  if (!body || typeof body.captureId !== 'string') throw macError(400, 'invalid_capture_id', 'Mac capture ID required')
+  const path = registryPath(body.captureId)
+  if (body.sourceType !== MAC_SOURCE_TYPE || !Number.isSafeInteger(body.startTime) || Number(body.startTime) <= 0 || Number(body.startTime) > Date.now() + 300000) throw macError(400, 'invalid_mac_capture', 'Source type and valid capture start time required')
+  const prior = readMacRecording(body.captureId)
+  if (prior) {
+    if (prior.closedAt) throw macError(410, 'session_closed', 'Capture is already saved')
+    if (prior.startTime !== body.startTime) throw macError(409, 'mac_capture_conflict', 'Capture ID already belongs to another start time')
+    if (readSpeakerPolicy(body.captureId).mode !== 'high-confidence') throw macError(409, 'mac_capture_policy_changed', 'Mac capture requires high-confidence identity policy')
+    return { recording: prior, replayed: true }
+  }
+  const policy = readSpeakerPolicy(body.captureId)
+  // A policy written before a crash can be reused, but never overwrite another policy.
+  if (policy.revision !== 'unset' && policy.mode !== 'high-confidence') throw macError(409, 'mac_capture_policy_conflict', 'Capture ID has an incompatible identity policy')
+  if (policy.revision === 'unset') writeSpeakerPolicy(body.captureId, 'high-confidence', policy.revision)
+  const recording: MacRecording = { version: 1, captureId: body.captureId, sessionId: body.captureId, sourceType: MAC_SOURCE_TYPE, startTime: Number(body.startTime), speakerPolicy: 'high-confidence' }
+  mkdirSync(dataPath('mac-recordings'), { recursive: true, mode: 0o700 })
+  // Registry is the admission commit marker; strict policy is durable first.
+  durableAtomicWriteFileSync(path, JSON.stringify(recording), { mode: 0o600 })
+  return { recording, replayed: false }
+}
+export function requireMacRecording(id: string): MacRecording {
+  registryPath(id)
+  const value = readMacRecording(id)
+  if (value?.closedAt) throw macError(410, 'session_closed', 'Capture is already saved')
+  if (!value) throw macError(409, 'mac_capture_not_started', 'Start this Mac capture before sending audio')
+  if (readSpeakerPolicy(id).mode !== 'high-confidence') throw macError(409, 'mac_capture_policy_changed', 'Mac capture requires high-confidence identity policy')
+  return value
+}
+/** Native bridge intentionally sends one canonical WAV format, never raw HAL buffers. */
+export function validateMacWav(audio: Buffer): number {
+  if (audio.length < 46 || audio.length > MAC_AUDIO.maxChunkBytes || audio.length % 2 !== 0 ||
+      audio.toString('ascii', 0, 4) !== 'RIFF' || audio.readUInt32LE(4) !== audio.length - 8 ||
+      audio.toString('ascii', 8, 12) !== 'WAVE' || audio.toString('ascii', 12, 16) !== 'fmt ' || audio.readUInt32LE(16) !== 16 ||
+      audio.readUInt16LE(20) !== 1 || audio.readUInt16LE(22) !== 1 || audio.readUInt32LE(24) !== 16000 || audio.readUInt32LE(28) !== 32000 || audio.readUInt16LE(32) !== 2 || audio.readUInt16LE(34) !== 16 ||
+      audio.toString('ascii', 36, 40) !== 'data' || audio.readUInt32LE(40) !== audio.length - 44) {
+    throw macError(400, 'invalid_mac_audio', 'Expected a bounded canonical 16-kHz mono PCM16 WAV')
+  }
+  return (audio.length - 44) / 32
+}
+
+export function closeMacRecording(id: string): void {
+  const value = readMacRecording(id)
+  if (value && !value.closedAt) durableAtomicWriteFileSync(registryPath(id), JSON.stringify({ ...value, closedAt: Date.now() }), { mode: 0o600 })
+}
+
+export interface MacChunkReceipt { chunkIndex: number; endElapsed: number; durationMs: number; audioSha256: string }
+export function macChunkReceipt(id: string, index: number): MacChunkReceipt | null {
+  registryPath(id)
+  if (!Number.isInteger(index) || index < 0 || index > 9999) throw macError(400, 'invalid_chunk_index', 'Invalid chunk index')
+  const path = join(dataPath('mac-recording-chunks'), id, index + '.json')
+  try {
+    const stat = lstatSync(path)
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1024) throw new Error('invalid receipt')
+    const value = JSON.parse(readFileSync(path, 'utf8'))
+    if (value.chunkIndex !== index || !Number.isFinite(value.endElapsed) || !Number.isFinite(value.durationMs) || value.durationMs <= 0 || value.durationMs > MAC_AUDIO.maxChunkMs || value.endElapsed < value.durationMs || !/^[0-9a-f]{64}$/.test(value.audioSha256)) throw new Error('invalid receipt')
+    return value
+  } catch(error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return null
+    throw macError(409, 'mac_chunk_metadata_unreadable', 'Mac chunk receipt is unreadable')
+  }
+}
+export function persistMacChunkReceipt(id: string, value: MacChunkReceipt): void {
+  const prior = macChunkReceipt(id, value.chunkIndex)
+  if (prior) {
+    if (prior.audioSha256 !== value.audioSha256 || prior.endElapsed !== value.endElapsed || prior.durationMs !== value.durationMs) throw macError(409, 'mac_chunk_conflict', 'Chunk index already holds different audio or timing')
+    return
+  }
+  const dir = join(dataPath('mac-recording-chunks'), id)
+  mkdirSync(dir, { recursive: true, mode: 0o700 })
+  durableAtomicWriteFileSync(join(dir, value.chunkIndex + '.json'), JSON.stringify(value), { mode: 0o600 })
+}

package/server/lib/meeting-actions.ts

@@ -282,6 +282,7 @@ export function toEngineSentences(rows: unknown): FirefliesSentenceInput[] {
 }
 
 function g2FromSidecar(doc: Record<string, unknown>, sessionId: string): G2RecordingInput | null {
+  if (doc.sourceType === 'mac_system_audio') return null // Mac pilot never enters the G2-only blend engine.
   const startMs = numberOr(doc.startTime, Number.NaN)
   const durationMs = numberOr(doc.durationMs, Number.NaN)
   if (!Number.isFinite(startMs) || !Number.isFinite(durationMs)) return null

package/server/lib/meeting-ask-follow-up.ts

@@ -35,8 +35,8 @@ export async function saveAskFollowUp(raw: unknown, deps: FollowUpDependencies):
   try { meeting = await deps.resolveMeeting(descriptor) } catch { throw new WorkIntakeError('meeting_unavailable', 409) }
   if (meeting.recordId !== descriptor.recordId) throw new WorkIntakeError('meeting_identity_changed', 409)
   const captures = new Set([meeting.sessionId, meeting.sourceSessionId, ...(meeting.g2SessionIds ?? []),
-    ...(meeting.contextKeys ?? []).filter(k => k.startsWith('g2:')).map(k => k.slice(3)),
-    ...(meeting.sources ?? []).filter(s => s.kind === 'g2').map(s => s.id)])
+    ...(meeting.contextKeys ?? []).filter(k => k.startsWith('g2:') || k.startsWith('mac:')).map(k => k.slice(k.indexOf(':') + 1)),
+    ...(meeting.sources ?? []).filter(s => s.kind === 'g2' || s.kind === 'mac').map(s => s.id)])
   if (!captures.has(exchange.sessionId) || meeting.contextAmbiguous) throw new WorkIntakeError('meeting_capture_mismatch', 409)
   const ids = body.sourceIds === undefined ? exchange.sources.slice(0, 8).map(s => s.id) : body.sourceIds
   if (!Array.isArray(ids) || ids.length > 8 || ids.some(id => typeof id !== 'string' || !exchange.sources.some(s => s.id === id))) throw new WorkIntakeError('invalid_follow_up_source', 400)

package/server/lib/meeting-ask-runner.ts

@@ -4,9 +4,28 @@ import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { resolveProviderBinary } from './provider-binary.js';
-import { buildClaudeGistArgs, buildCodexGistArgs, parseClaudeGistOutput, parseCodexGistOutput, lensGistChildEnv } from './lens-gist-engines.js';
+import { buildClaudeGistArgs, buildCodexGistArgs, parseClaudeGistOutput, parseCodexGistOutput, lensGistChildEnv, type ClaudeGistEffort } from './lens-gist-engines.js';
 import { logTokenAudit } from './token-audit.js';
 import type { MeetingAskModel } from '../../shared/meeting-ask.js';
+/** 6.73.12: how one caller's run is bounded. Omitted fields keep Meeting Ask's budget, unchanged since before 6.73.12. */
+export interface MeetingAskRunBudget {
+    /** Claude `--effort`. Omitted keeps the builder's low. */
+    effort?: ClaudeGistEffort;
+    /** Answer tokens, excluding thinking. The child's CLAUDE_CODE_MAX_OUTPUT_TOKENS is this plus maxThinkingTokens,
+     *  because the model's max_tokens counts thinking too. */
+    maxOutputTokens?: number;
+    /** MAX_THINKING_TOKENS for the child. 0 turns thinking off. */
+    maxThinkingTokens?: number;
+    /** Wall-clock limit before the child is stopped with provider_timeout. */
+    deadlineMs?: number;
+}
+export const MEETING_ASK_DEFAULT_BUDGET = { maxOutputTokens: 1400, maxThinkingTokens: 0, deadlineMs: 45000 } as const;
+/** The child environment's token limits for a budget; the default is exactly '1400' and '0'. */
+export function meetingAskTokenEnv(budget?: MeetingAskRunBudget): { CLAUDE_CODE_MAX_OUTPUT_TOKENS: string; MAX_THINKING_TOKENS: string } {
+    const output = budget?.maxOutputTokens ?? MEETING_ASK_DEFAULT_BUDGET.maxOutputTokens;
+    const thinking = budget?.maxThinkingTokens ?? MEETING_ASK_DEFAULT_BUDGET.maxThinkingTokens;
+    return { CLAUDE_CODE_MAX_OUTPUT_TOKENS: String(output + thinking), MAX_THINKING_TOKENS: String(thinking) };
+}
 export class AskProcessError extends Error {
     constructor(message: string, readonly terminationUnconfirmed = false) { super(message); }
 }
@@ -17,7 +36,9 @@ export function runMeetingAskModel(model: MeetingAskModel, prompt: string, syste
 }, audit?: {
     /** Token-audit caller label (6.71.13), e.g. meeting_fact_check_planner_hedge. A failed call appends ":<reason>". */
     caller: string;
-}): Promise<{
+},
+/** 6.73.12: effort, token budget and deadline. Omitted keeps Meeting Ask's, so every older caller is unchanged. */
+budget?: MeetingAskRunBudget): Promise<{
     text: string;
     model?: string;
 }> {
@@ -30,11 +51,11 @@ export function runMeetingAskModel(model: MeetingAskModel, prompt: string, syste
     if (!binary.ok)
         return Promise.reject(new AskProcessError('provider_unavailable'));
     const workspace = adapter?.workspace ?? mkdtempSync(join(tmpdir(), 'cos-meeting-ask-'));
-    const args = adapter?.args ?? (provider === 'claude' ? buildClaudeGistArgs(model.model, system) : buildCodexGistArgs(model.model, workspace));
+    const args = adapter?.args ?? (provider === 'claude' ? buildClaudeGistArgs(model.model, system, budget?.effort) : buildCodexGistArgs(model.model, workspace));
     // Codex has no system-prompt flag here: trusted instruction is separate, then JSON evidence.
     const stdin = adapter?.stdin ?? (provider === 'claude' ? prompt : `${system}\n\n${prompt}`);
     return new Promise((resolve, reject) => {
-        const child = spawn(binary.path, args, { cwd: workspace, detached: true, stdio: ['pipe', 'pipe', 'pipe'], env: { ...lensGistChildEnv(binary.path), CLAUDE_CODE_MAX_OUTPUT_TOKENS: '1400', MAX_THINKING_TOKENS: '0' } });
+        const child = spawn(binary.path, args, { cwd: workspace, detached: true, stdio: ['pipe', 'pipe', 'pipe'], env: { ...lensGistChildEnv(binary.path), ...meetingAskTokenEnv(budget) } });
         let stdout = '', failure: string | null = null, done = false, closeSeen = false, code: number | null = null;
         let killTimer: NodeJS.Timeout | undefined, proofTimer: NodeJS.Timeout | undefined;
         const kill = (sig: NodeJS.Signals) => { if (child.pid)
@@ -115,7 +136,7 @@ export function runMeetingAskModel(model: MeetingAskModel, prompt: string, syste
                 finish(true); }, 50);
         };
         const abort = () => stop('cancelled');
-        const deadline = setTimeout(() => stop('provider_timeout'), 45000);
+        const deadline = setTimeout(() => stop('provider_timeout'), budget?.deadlineMs ?? MEETING_ASK_DEFAULT_BUDGET.deadlineMs);
         signal?.addEventListener('abort', abort, { once: true });
         if (signal?.aborted)
             abort();

package/server/lib/meeting-ask-store.ts

@@ -8,7 +8,8 @@ import { emptyOrientation } from './meeting-ask-orientation.js';
 import type { MeetingAskOrientation } from '../../shared/meeting-ask.js';
 import { AskError } from './live-cos-ask.js';
 export const ASK_ID = /^[A-Za-z0-9_-]{8,100}$/;
-export const ASK_SESSION = /^meeting_[A-Za-z0-9_-]{1,89}$/;
+export { ASK_SESSION } from './ask-session-id.js';
+import { ASK_SESSION } from './ask-session-id.js';
 export interface AskRecord {
     version: 2;
     fingerprint: string;

package/server/lib/meeting-batch-transcribe.ts

@@ -20,6 +20,8 @@ import { measureSpeechSeconds } from './vad-silero.js'
 import { batchTimestampsEnabled } from './whisper-batch-timing.js'
 import { readSttSettings, recordLastSttJob, type FrontEndId, type HqId, type SecondOpinionId } from './stt-settings.js'
 import { currentEffectiveStt } from './stt-runtime.js'
+import { MAC_CAPTURE_ID } from './mac-recording.js'
+import { MacParakeetUnavailableError } from './mac-recording-asr.js'
 import { transcribeParakeet, type ParakeetResult, type ParakeetRunOptions } from './parakeet.js'
 import { isDeletionProneEngine, resolveHypotheses, RESOLVER_VERSION, type Hypothesis } from './stt-resolver.js'
 import { getVocabulary } from './profile.js'
@@ -450,9 +452,15 @@ export interface HqJobPlan {
   secondOpinion: SecondOpinionId
   resolver: boolean
   frontEnd: FrontEndId
+  /** Mac canonical Parakeet must never silently substitute Whisper. */
+  strictPrimary?: true
 }
 
-export function currentHqJobPlan(): HqJobPlan {
+export function currentHqJobPlan(sessionId?: string): HqJobPlan {
+  const selected = readSttSettings()
+  if (sessionId && MAC_CAPTURE_ID.test(sessionId) && selected.hq === 'parakeet-ultra') {
+    return { engine: selected.hq, secondOpinion: selected.secondOpinion, resolver: selected.resolver, frontEnd: selected.frontEnd, strictPrimary: true }
+  }
   const eff = currentEffectiveStt()
   return { engine: eff.hq.engine, secondOpinion: eff.secondOpinion.engine, resolver: eff.resolver, frontEnd: eff.frontEnd }
 }
@@ -668,6 +676,7 @@ async function decodeHqWindow(
     try {
       primary = await parakeetGuarded(job, () => decodeParakeetWindow(deps, input, parakeetTimeout(job), 'parakeet-ultra', true))
     } catch (error) {
+      if (plan.strictPrimary) throw new MacParakeetUnavailableError(error)
       fallbackReason = `parakeet_failed: ${errorReason(error)}`
       console.warn(`[meeting-batch] Parakeet HQ failed for ${segment.startChunkIdx}-${segment.endChunkIdx}; using Large-v3: ${errorReason(error)}`)
       const w = await decodeWhisperWindow(deps, input, previousText, 'large-v3', segment, audioDir)
@@ -766,6 +775,7 @@ export async function transcribeSegments(
   plan: HqJobPlan,
   deps: HqDecodeDeps = defaultHqDeps,
 ): Promise<BatchResult[]> {
+  if (expectedSessionId && MAC_CAPTURE_ID.test(expectedSessionId) && plan.engine === 'parakeet-ultra') plan = { ...plan, strictPrimary: true }
   const results: BatchResult[] = []
   const meetingId = basename(audioDir)
   const job: JobState = { parakeetRan: false, parakeetFailures: 0, parakeetStopped: false }
@@ -809,6 +819,9 @@ export async function transcribeSegments(
         meetingId,
       })
     } catch (error) {
+      // One failed strict Mac window invalidates the HQ candidate; preserve the
+      // already canonical Parakeet chunks, rather than accepting partial text.
+      if (plan.strictPrimary) throw error
       console.error(
         `[meeting-batch] Segment ${segment.startChunkIdx}-${segment.endChunkIdx} failed: `
         + `${error instanceof Error ? error.message : String(error)}`,
@@ -831,9 +844,10 @@ export function recoveryHqJob(
   segments: BatchSegment[],
   entries: IndexedTranscriptChunk[],
   deps: HqDecodeDeps = defaultHqDeps,
+  sessionId?: string,
 ): { plan: HqJobPlan; run: () => Promise<BatchResult[]> } {
-  const plan = currentHqJobPlan()
-  return { plan, run: () => transcribeSegments(quarantineDir, segments, entries, undefined, plan, deps) }
+  const plan = currentHqJobPlan(sessionId)
+  return { plan, run: () => transcribeSegments(quarantineDir, segments, entries, sessionId, plan, deps) }
 }
 
 export function summarizeStt(plan: HqJobPlan, results: readonly BatchResult[], segmentsPlanned = results.length): BatchSttSummary {
@@ -1229,7 +1243,7 @@ export function runMeetingBatchPipeline(
   lease.unref()
   // Frozen at SAVE time: a settings change applies to the next saved meeting,
   // never to one already queued behind another HQ job.
-  const plan = currentHqJobPlan()
+  const plan = currentHqJobPlan(sessionId)
   const job = batchQueueTail.then(() => runMeetingBatchPipelineNow(
     audioDir,
     entries,
@@ -1304,6 +1318,7 @@ async function runMeetingBatchPipelineNow(
       outcome: 'failed',
       reason: error instanceof Error ? error.message.slice(0, 200) : String(error).slice(0, 200),
     })
+    if (plan.strictPrimary) throw error
     return { transcriptionQuality: 'streaming' }
   }
 }

package/server/lib/meeting-context-keys.ts

@@ -1,3 +1,4 @@
+import { readMacRecording } from './mac-recording.js'
 /**
  * Meeting context keys (6.64.0): the ids COS Control files a meeting's dropped files under.
  *
@@ -10,6 +11,7 @@
  * decisions, Work review and speaker review depend on. So the key is read from the meeting's own source ids:
  *   - `g2:<sessionId>` from its `.g2-chunks.json` sidecar (the speaker system's key; moves with every G2 rename);
  *   - `ff:<id>` from its `.fireflies.json` sidecar;
+ *   - `mac:<captureId>` from an admitted Mac source and its saved sourceType;
  *   - `g2:<id>` for every `<!-- g2-session -->` the file declares, which is how a merged meeting also shows the files of
  *     the capture it absorbed.
  * Measured 2026-10-06: 649 of 656 meetings from August to October carry at least one.
@@ -23,7 +25,7 @@ import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, realpat
 import { dirname, join } from 'node:path'
 
 /** A key as Control stores it. The id part is the server's own marker grammar (`G2_SESSION_MARKER`). */
-export const MEETING_CONTEXT_KEY = /^(?:g2|ff):[A-Za-z0-9:_-]{3,96}$/
+export const MEETING_CONTEXT_KEY = /^(?:g2|ff|mac):[A-Za-z0-9:_-]{3,96}$/
 const SOURCE_ID = /^[A-Za-z0-9:_-]{3,96}$/
 
 const SIDECAR_HEAD_BYTES = 4096
@@ -96,11 +98,12 @@ export function firefliesSidecarId(monthDir: string, meetingFilename: string): s
 
 /** The ordered, de-duplicated keys for one meeting. The first is primary: the capture's own sidecar, then Fireflies,
  *  then what the file declares. */
-export function meetingContextKeys(sources: { g2SessionId?: string; firefliesId?: string; declared?: readonly string[] }): string[] {
+export function meetingContextKeys(sources: { g2SessionId?: string; firefliesId?: string; declared?: readonly string[]; sourceType?: string }): string[] {
   const keys: string[] = []
-  const add = (prefix: 'g2' | 'ff', id: string | undefined) => {
+  const add = (prefix: 'g2' | 'ff' | 'mac', id: string | undefined) => {
     if (!id || !SOURCE_ID.test(id)) return
-    const key = `${prefix}:${id}`
+    const actualPrefix = prefix === 'g2' && (sources.sourceType === 'mac_system_audio' || readMacRecording(id)) ? 'mac' : prefix
+    const key = `${actualPrefix}:${id}`
     if (!keys.includes(key)) keys.push(key)
   }
   add('g2', sources.g2SessionId)

package/server/lib/meeting-parse.ts

@@ -134,6 +134,7 @@ export function parseMeeting(content: string, filename: string, month: string):
     // codebase, disagreeing with each other.
     domainAbbr: domainAbbreviation(domain),
     source: parseField(content, 'Source'),
+    ...(parseField(content, 'Capture source') === 'mac_system_audio' ? { sourceType: 'mac_system_audio' as const } : {}),
     duration,
     ...(parseDurationMinutes(duration) !== undefined ? { durationMinutes: parseDurationMinutes(duration) } : {}),
     month,
@@ -171,6 +172,7 @@ export function toMeta(detail: MeetingDetail, sessionId?: string): MeetingMeta {
     domain: detail.domain,
     domainAbbr: detail.domainAbbr,
     source: detail.source,
+    ...(detail.sourceType ? { sourceType: detail.sourceType } : {}),
     duration: detail.duration,
     ...(detail.durationMinutes !== undefined ? { durationMinutes: detail.durationMinutes } : {}),
     month: detail.month,