@gotcos/glasses-server 6.73.5 → 6.74.0

package/server/lib/dictation-stt.ts

@@ -15,11 +15,13 @@
 import { transcribeParakeet, ParakeetError } from './parakeet.js'
 import { asrFrontEnd } from './stt-live.js'
 import {
-  currentSttCapabilities, ensurePreviewWarm, noteParakeetDictationHit, noteParakeetDictationMiss,
+  currentSttCapabilities, ensurePreviewWarm, installCliKnown, noteParakeetDictationHit, noteParakeetDictationMiss,
   PARAKEET_PREVIEW_TIMEOUT_MS, PREVIEW_PARAKEET_MODEL,
 } from './stt-runtime.js'
+import { getWhisperHealth } from './whisper-local.js'
+import { parakeetInstallRunning } from './parakeet.js'
 import {
-  dictationPlan, readSttSettings, type DictationPlan, type DictationSlot, type FrontEndId,
+  desktopDictationPlan, dictationPlan, readSttSettings, type DesktopDictationPlan, type DictationPlan, type DictationSlot, type FrontEndId,
 } from './stt-settings.js'
 
 /** The plan for a dictation decode starting now. A Parakeet selection that is
@@ -37,6 +39,63 @@ export function currentDictationPlan(slot: DictationSlot): DictationPlan {
   return plan
 }
 
+/** 6.74.0: the plan for a Mac dictation decode starting now (its own setting, not the
+ *  Preview model). A Parakeet that is installed but cold starts warming here. */
+export function currentDesktopDictationPlan(slot: DictationSlot): DesktopDictationPlan {
+  try {
+    const plan = desktopDictationPlan(slot, readSttSettings(), currentSttCapabilities())
+    if (plan.reason === 'parakeet_warming' || plan.reason === 'parakeet_warm_failed') ensurePreviewWarm()
+    return plan
+  } catch (error) {
+    console.warn(`[stt] Mac dictation settings unreadable, using Whisper: ${error instanceof Error ? error.message : error}`)
+    return { slot, engine: 'whisper', reason: null, frontEnd: 'highpass', key: slot === 'final' ? 'final:large-v3' : `${slot}:turbo`, setting: 'auto', whisperAllowed: true }
+  }
+}
+
+/** The one action a Mac dictation failure offers (see the contract). */
+export type DesktopDictationAction = 'install_parakeet' | 'use_whisper' | 'retry_when_warm' | 'open_transcription_settings'
+export interface DesktopFailureHint { action: DesktopDictationAction; retryable: boolean; detail: string }
+export interface DesktopFailureFacts {
+  /** no_local_engine: nothing local could run. parakeet_unavailable: the setting is parakeet-ultra. */
+  kind: 'no_local_engine' | 'parakeet_unavailable'
+  /** The Parakeet reason code (plan or decode), when there is one. */
+  parakeetReason: string | null
+  parakeetInstallable: boolean
+  whisperStarting: boolean
+  whisperPresent: boolean
+}
+
+/** Pure. Retry is offered only when waiting can make it succeed. */
+export function desktopFailureHint(f: DesktopFailureFacts): DesktopFailureHint {
+  const waiting = f.parakeetReason === 'parakeet_warming' || f.parakeetReason === 'parakeet_busy'
+  if (f.kind === 'parakeet_unavailable') {
+    const detail = f.parakeetReason ?? 'parakeet_failed'
+    if (detail === 'parakeet_not_installed') return { action: f.parakeetInstallable ? 'install_parakeet' : 'use_whisper', retryable: false, detail }
+    if (waiting) return { action: 'retry_when_warm', retryable: true, detail }
+    return { action: 'use_whisper', retryable: false, detail }
+  }
+  if (f.whisperStarting) return { action: 'retry_when_warm', retryable: true, detail: 'whisper_starting' }
+  const detail = f.whisperPresent ? 'whisper_unavailable' : 'whisper_missing'
+  if (waiting) return { action: 'retry_when_warm', retryable: true, detail }
+  if (f.parakeetReason === 'parakeet_not_installed' && f.parakeetInstallable) return { action: 'install_parakeet', retryable: false, detail }
+  return { action: 'open_transcription_settings', retryable: false, detail }
+}
+
+/** Production facts for desktopFailureHint. Never throws. */
+export function currentDesktopFailureHint(kind: DesktopFailureFacts['kind'], parakeetReason: string | null): DesktopFailureHint {
+  let whisperStarting = false, whisperPresent = true, parakeetInstallable = false
+  try {
+    const h = getWhisperHealth()
+    whisperStarting = h.restarting || h.startupState === 'preflight' || h.startupState === 'loading'
+    whisperPresent = h.serverConfigured
+  } catch { /* unknown: treat as present and not starting */ }
+  try {
+    const installing = parakeetInstallRunning()
+    parakeetInstallable = installing || (process.platform === 'darwin' && process.arch === 'arm64' && installCliKnown().known === true)
+  } catch { /* not installable */ }
+  return desktopFailureHint({ kind, parakeetReason, parakeetInstallable, whisperStarting, whisperPresent })
+}
+
 /** Parakeet reads 16 kHz mono PCM16 WAV. The browser recorder posts WebM, which stays on Whisper. */
 export function isPcm16kMonoWav(audio: Buffer): boolean {
   if (audio.length < 44 || audio.toString('ascii', 0, 4) !== 'RIFF' || audio.toString('ascii', 8, 12) !== 'WAVE') return false

package/server/lib/glossary-learn.ts

@@ -0,0 +1,221 @@
+// One-word dictionary learning (6.73.11). "Fix a word" in COS Control, and any
+// other surface, teaches ONE correction at a time: heard → written joins the
+// corrections map and `written` joins the vocabulary, in one write. Every learn
+// is logged (bounded, newest first) so the person can see what COS learned, from
+// where, and undo exactly that one entry.
+//
+// Pure: no IO. The route in routes/glossary.ts reads the profile and the log,
+// calls these, and writes both back inside the glossary write chain.
+
+export const MAX_TERMS = 500
+export const MAX_TERM_LEN = 100
+export const MAX_LOG = 200
+export const CORRECTION_SOURCES = ['dictation', 'meeting', 'g2', 'manual'] as const
+export type CorrectionSource = typeof CORRECTION_SOURCES[number]
+
+export interface GlossaryWords {
+  vocabulary: string[]
+  corrections: Record<string, string>
+}
+
+export interface CorrectionLogEntry {
+  id: string
+  heard: string
+  written: string
+  source: CorrectionSource
+  at: string
+  /** The existing key this entry replaced (a case variant of `heard`, or `heard` itself), or null. */
+  replacedKey: string | null
+  /** What `replacedKey` mapped to before this entry, or null. */
+  previous: string | null
+  /** True when this entry put `written` into the vocabulary. */
+  addedVocabulary: boolean
+}
+
+export type LearnResult =
+  | { ok: true; unchanged: true }
+  | { ok: true; unchanged: false; words: GlossaryWords; entry: CorrectionLogEntry }
+  | { ok: false; status: number; error: string }
+
+export type UndoResult =
+  | { ok: true; words: GlossaryWords; log: CorrectionLogEntry[]; entry: CorrectionLogEntry }
+  | { ok: false; status: number; error: string }
+
+// Positive vocab is injected into the Whisper decoder prompt; URLs/emails/paths
+// there induce ".com"/handle hallucinations on quiet audio, so they are refused.
+export function looksLikeUrlEmailPath(s: string): boolean {
+  return /(?:https?:\/\/|www\.)/i.test(s)
+    || /@[\w.-]+\.\w/.test(s)
+    || /\.(?:com|net|org|io|ai|co|gov|edu|app|dev)\b/i.test(s)
+    || /[/\\]/.test(s)
+}
+
+const CONTROL = /[\u0000-\u001f\u007f]/
+const same = (a: string, b: string) => a.trim().toLowerCase() === b.trim().toLowerCase()
+
+export function isCorrectionSource(value: unknown): value is CorrectionSource {
+  return typeof value === 'string' && (CORRECTION_SOURCES as readonly string[]).includes(value)
+}
+
+export function learnCorrection(
+  words: GlossaryWords,
+  input: { heard: unknown; written: unknown; source: unknown },
+  stamp: { id: string; at: string },
+): LearnResult {
+  if (typeof input.heard !== 'string' || typeof input.written !== 'string') {
+    return { ok: false, status: 400, error: 'heard and written must be strings' }
+  }
+  if (!isCorrectionSource(input.source)) {
+    return { ok: false, status: 400, error: `source must be one of ${CORRECTION_SOURCES.join(', ')}` }
+  }
+  const heard = input.heard.trim()
+  const written = input.written.trim()
+  if (!heard || !written) return { ok: false, status: 400, error: 'heard and written must not be empty' }
+  if (heard.length > MAX_TERM_LEN || written.length > MAX_TERM_LEN) {
+    return { ok: false, status: 400, error: `a correction is at most ${MAX_TERM_LEN} characters` }
+  }
+  if (CONTROL.test(heard) || CONTROL.test(written)) {
+    return { ok: false, status: 400, error: 'a correction cannot contain line breaks or control characters' }
+  }
+  if (heard === written) return { ok: false, status: 400, error: 'the written spelling is the same as what was heard' }
+  if (looksLikeUrlEmailPath(written)) {
+    return { ok: false, status: 400, error: 'the written spelling cannot be a URL, email or path; it would join the decoder prompt' }
+  }
+
+  const existingKey = Object.keys(words.corrections).find(key => same(key, heard)) ?? null
+  const correctionChanged = existingKey !== heard || words.corrections[heard] !== written
+  const inVocabulary = words.vocabulary.some(term => same(term, written))
+  if (!correctionChanged && inVocabulary) return { ok: true, unchanged: true }
+
+  if (existingKey === null && Object.keys(words.corrections).length >= MAX_TERMS) {
+    return { ok: false, status: 409, error: `the dictionary already holds ${MAX_TERMS} corrections; remove one first` }
+  }
+  if (!inVocabulary && words.vocabulary.length >= MAX_TERMS) {
+    return { ok: false, status: 409, error: `the vocabulary already holds ${MAX_TERMS} terms; remove one first` }
+  }
+
+  const corrections = { ...words.corrections }
+  if (existingKey !== null && existingKey !== heard) delete corrections[existingKey]
+  corrections[heard] = written
+  const vocabulary = inVocabulary ? [...words.vocabulary] : [...words.vocabulary, written]
+  const entry: CorrectionLogEntry = {
+    id: stamp.id,
+    heard,
+    written,
+    source: input.source,
+    at: stamp.at,
+    replacedKey: existingKey,
+    previous: existingKey === null ? null : words.corrections[existingKey],
+    addedVocabulary: !inVocabulary,
+  }
+  return { ok: true, unchanged: false, words: { vocabulary, corrections }, entry }
+}
+
+/** Newest first, bounded. */
+export function appendLog(log: CorrectionLogEntry[], entry: CorrectionLogEntry): CorrectionLogEntry[] {
+  return [entry, ...log].slice(0, MAX_LOG)
+}
+
+/**
+ * Revert exactly one logged entry, and only while the dictionary still says
+ * what that entry wrote. A later entry for the same word, or a hand edit since,
+ * makes the undo refuse rather than clobber the newer choice.
+ */
+export function undoCorrection(words: GlossaryWords, log: CorrectionLogEntry[], id: unknown): UndoResult {
+  if (typeof id !== 'string' || !id) return { ok: false, status: 400, error: 'id is required' }
+  const index = log.findIndex(entry => entry.id === id)
+  if (index < 0) return { ok: false, status: 404, error: 'that correction is no longer in the recent list' }
+  const entry = log[index]
+  if (log.slice(0, index).some(newer => same(newer.heard, entry.heard))) {
+    return { ok: false, status: 409, error: `a newer correction changed "${entry.heard}"; undo that one first` }
+  }
+  if (words.corrections[entry.heard] !== entry.written) {
+    return { ok: false, status: 409, error: `"${entry.heard}" was changed since; edit it in the dictionary instead` }
+  }
+  const corrections = { ...words.corrections }
+  delete corrections[entry.heard]
+  if (entry.replacedKey !== null && entry.previous !== null) {
+    const collision = Object.keys(corrections).some(key => same(key, entry.replacedKey!))
+    if (collision) return { ok: false, status: 409, error: `"${entry.replacedKey}" was changed since; edit it in the dictionary instead` }
+    corrections[entry.replacedKey] = entry.previous
+  }
+  let vocabulary = [...words.vocabulary]
+  // The spelling stays while any remaining correction still writes it.
+  if (entry.addedVocabulary && !Object.values(corrections).some(value => same(value, entry.written))) {
+    vocabulary = vocabulary.filter(term => !same(term, entry.written))
+  }
+  return { ok: true, words: { vocabulary, corrections }, log: log.filter((_, i) => i !== index), entry }
+}
+
+/** Tolerant reader: a missing or corrupt log is an empty one; malformed rows are dropped. */
+export function parseLog(raw: unknown): CorrectionLogEntry[] {
+  const entries = raw && typeof raw === 'object' && Array.isArray((raw as { entries?: unknown }).entries)
+    ? (raw as { entries: unknown[] }).entries : []
+  const out: CorrectionLogEntry[] = []
+  for (const value of entries) {
+    if (!value || typeof value !== 'object') continue
+    const e = value as Record<string, unknown>
+    if (typeof e.id !== 'string' || typeof e.heard !== 'string' || typeof e.written !== 'string'
+      || !isCorrectionSource(e.source) || typeof e.at !== 'string' || typeof e.addedVocabulary !== 'boolean') continue
+    const replacedKey = typeof e.replacedKey === 'string' ? e.replacedKey : null
+    const previous = typeof e.previous === 'string' ? e.previous : null
+    out.push({ id: e.id, heard: e.heard, written: e.written, source: e.source, at: e.at, replacedKey, previous, addedVocabulary: e.addedVocabulary })
+    if (out.length >= MAX_LOG) break
+  }
+  return out
+}
+
+// ── Single-item edits (6.73.12) ──────────────────────────────────────────────
+// COS Control's Dictionary pane adds or removes ONE word or correction. Each is a
+// pure step over the stored words, run inside the glossary write chain, so a
+// concurrent learn can never be lost the way a client read-then-PUT could lose it.
+// These are hand edits; they are not logged for undo.
+
+export type EditResult =
+  | { ok: true; unchanged: true }
+  | { ok: true; unchanged: false; words: GlossaryWords }
+  | { ok: false; status: number; error: string }
+
+function validTerm(raw: unknown, what: string): { ok: true; value: string } | { ok: false; status: number; error: string } {
+  if (typeof raw !== 'string') return { ok: false, status: 400, error: `${what} must be a string` }
+  const value = raw.trim()
+  if (!value) return { ok: false, status: 400, error: `${what} must not be empty` }
+  if (value.length > MAX_TERM_LEN) return { ok: false, status: 400, error: `${what} is at most ${MAX_TERM_LEN} characters` }
+  if (CONTROL.test(value)) return { ok: false, status: 400, error: `${what} cannot contain line breaks or control characters` }
+  return { ok: true, value }
+}
+
+export function addVocabulary(words: GlossaryWords, raw: unknown): EditResult {
+  const term = validTerm(raw, 'term')
+  if (!term.ok) return term
+  if (looksLikeUrlEmailPath(term.value)) {
+    return { ok: false, status: 400, error: 'a vocabulary word cannot be a URL, email or path; it would join the decoder prompt' }
+  }
+  if (words.vocabulary.some(existing => same(existing, term.value))) return { ok: true, unchanged: true }
+  if (words.vocabulary.length >= MAX_TERMS) {
+    return { ok: false, status: 409, error: `the vocabulary already holds ${MAX_TERMS} terms; remove one first` }
+  }
+  return { ok: true, unchanged: false, words: { vocabulary: [...words.vocabulary, term.value], corrections: { ...words.corrections } } }
+}
+
+/** Removes the exact word; a word that is not there is not an error. */
+export function removeVocabulary(words: GlossaryWords, raw: unknown): EditResult {
+  const term = validTerm(raw, 'term')
+  if (!term.ok) return term
+  const vocabulary = words.vocabulary.filter(existing => existing.trim() !== term.value)
+  if (vocabulary.length === words.vocabulary.length) return { ok: true, unchanged: true }
+  return { ok: true, unchanged: false, words: { vocabulary, corrections: { ...words.corrections } } }
+}
+
+/** Removes the correction for `heard` (its exact key, else its one case variant). */
+export function removeCorrection(words: GlossaryWords, raw: unknown): EditResult {
+  const heard = validTerm(raw, 'heard')
+  if (!heard.ok) return heard
+  const key = heard.value in words.corrections
+    ? heard.value
+    : Object.keys(words.corrections).find(existing => same(existing, heard.value))
+  if (key === undefined) return { ok: true, unchanged: true }
+  const corrections = { ...words.corrections }
+  delete corrections[key]
+  return { ok: true, unchanged: false, words: { vocabulary: [...words.vocabulary], corrections } }
+}

package/server/lib/imported-library-rows.ts

@@ -48,7 +48,8 @@ import {
   importHash,
   importRecordId,
 } from './imported-meeting-library.js'
-import { getMeetingStore, type MeetingMeta, type MeetingStore } from './meeting-store.js'
+import { getMeetingStore, MEETING_LIST_CAP_SCOPED, type MeetingMeta, type MeetingStore } from './meeting-store.js'
+import { MAC_CAPTURE_ID } from './mac-recording.js'
 
 /** The merged-scribe markers live with the scribe reader; re-exported for callers. */
 export {
@@ -531,10 +532,63 @@ function operationsMergedSessions(
   return sessions
 }
 
+/**
+ * Sessions the operations rows of these month folders hold: each scribe's sidecar session (beside it, else under the
+ * server's recordings root by the same name, as `listCosOperationsMeetings` reads it), plus every session a merged
+ * scribe declares. A store Mac row whose session is here is already a row, and a dot, on the operations side.
+ */
+function operationsHeldSessions(
+  directories: readonly string[],
+  merged: ReadonlySet<string>,
+  recordingsRoot: string = dataPath('recordings'),
+): Set<string> {
+  const sessions = new Set(merged)
+  for (const directory of directories) {
+    let names: string[]
+    try {
+      names = readdirSync(directory).filter(name => name.endsWith('.md'))
+    } catch {
+      continue
+    }
+    for (const filename of names) {
+      const sessionId = droppedSessionId(directory, filename, recordingsRoot)
+      if (sessionId) sessions.add(sessionId)
+    }
+  }
+  return sessions
+}
+
+/**
+ * 6.73.14: day counts for the store's Mac recordings. A Mac capture never reaches the operations tree, so on a pipeline
+ * Mac these rows are counted nowhere else. A session the operations side already holds (`held`, read only when the store
+ * has a Mac recording in this month) is left out, as `withMacStoreRows` leaves its row out, so an operations copy counts
+ * once. Read through `list()`, filtered before its cap (MEETING_LIST_CAP_SCOPED, 200 rows): a month with more than 200
+ * such recordings undercounts its dots; nothing is counted twice.
+ */
+export function macStoreDayCounts(
+  store: MeetingStore,
+  month: string,
+  domain: string,
+  held: () => ReadonlySet<string> = () => new Set(),
+): Array<{ date: string; count: number }> {
+  const counts = new Map<string, number>()
+  let heldSessions: ReadonlySet<string> | undefined
+  const sessionMatch = (id: string | undefined) => typeof id === 'string' && MAC_CAPTURE_ID.test(id) && !(heldSessions ??= held()).has(id)
+  for (const row of store.list({ month, domain, limit: MEETING_LIST_CAP_SCOPED, sessionMatch })) {
+    // The day from the filename, as the store's own day dots read it (MeetingStore.listDayCounts).
+    const date = /^(\d{4}-\d{2}-\d{2})_/.exec(row.filename)?.[1]
+    if (!row.sessionId || !MAC_CAPTURE_ID.test(row.sessionId) || !date) continue
+    counts.set(date, (counts.get(date) ?? 0) + 1)
+  }
+  return [...counts.entries()].sort((a, b) => a[0].localeCompare(b[0])).map(([date, count]) => ({ date, count }))
+}
+
 /**
  * Day counts for one month across every source the list shows, with supersession
- * applied. The list and `probeMeetings` share it so a dot and a row can never
- * disagree about how many meetings a day holds.
+ * applied. The list and `probeMeetings` share it so a dot and a row agree about
+ * how many meetings a day holds: each source is counted by the rule that lists
+ * it. The counts are not capped the way a row page is, except the store's Mac
+ * recordings, which stop at 200 a month (macStoreDayCounts).
  */
 export function supersededDayCounts(
   month: string,
@@ -568,9 +622,13 @@ export function supersededDayCounts(
     // into this layout at all: on a pipeline Mac the operations tree is the one
     // library, and a derived record here would be a second row for one meeting.
     const directories = operationsMonthDirs(month, domain)
+    const merged = operationsMergedSessions(directories, options.declaredSessions)
     return mergeDayCounts([
       listCosOperationsMeetingDays(month, domain),
-      sessionDropCounts(directories, operationsMergedSessions(directories, options.declaredSessions), options.recordingsRoot),
+      sessionDropCounts(directories, merged, options.recordingsRoot),
+      // 6.73.14: the store's Mac recordings, which the list now shows (routes/meetings.ts withMacStoreRows), less any the
+      // operations side already counts.
+      macStoreDayCounts(store, month, domain, () => operationsHeldSessions(directories, merged, options.recordingsRoot)),
     ])
   }
 

package/server/lib/jev.ts

@@ -81,7 +81,7 @@ function dailyCap(): number {
   return Number.isFinite(raw) && raw > 0 ? Math.floor(raw) : JEV_LIMITS.defaultDailyTokens
 }
 
-export interface JevAnswers { answers: Record<string, { choice?: string; probabilities?: Record<string, number>; noul?: number }>; model?: string; inputTokens: number }
+export interface JevAnswers { provider?: 'jev' | 'subq'; answers: Record<string, { type?: 'choice' | 'noul' | 'score'; choice?: string; probabilities?: Record<string, number>; noul?: number; confidence?: number; score?: number; legend?: Record<string, unknown> }>; model?: string; inputTokens: number }
 
 /** One Jev client per process: it owns the breaker and the usage ledger. */
 export class JevClient {
@@ -128,14 +128,14 @@ export class JevClient {
   }
 
   /** Ask one request. `estimate` is the caller's input-token estimate, checked against the cap BEFORE sending. */
-  async ask(state: unknown, questions: Record<string, unknown>, estimate: number): Promise<JevAnswers> {
+  async ask(state: unknown, questions: Record<string, unknown>, estimate: number, options?: { signal?: AbortSignal }): Promise<JevAnswers> {
     const key = resolveJevKey()
     if (!key) throw new JevError('jev_not_configured')
     if (this.breakerUntil > this.now().getTime()) throw new JevError('jev_breaker_open')
     if (this.usedToday() + estimate > this.cap()) this.fail('jev_cap_reached', false)
     let res: Response
     try {
-      res = await this.fetchImpl(`${JEV_ENDPOINT}/systemone`, { method: 'POST', signal: AbortSignal.timeout(JEV_LIMITS.timeoutMs),
+      res = await this.fetchImpl(`${JEV_ENDPOINT}/systemone`, { method: 'POST', signal: AbortSignal.any([AbortSignal.timeout(JEV_LIMITS.timeoutMs), ...(options?.signal ? [options.signal] : [])]),
         headers: { Authorization: `Bearer ${key.key}`, 'Content-Type': 'application/json' },
         body: JSON.stringify({ state, model: JEV_MODEL, questions }) })
     } catch { return this.fail('jev_unavailable', true) }

package/server/lib/lens-gist-engines.ts

@@ -200,9 +200,14 @@ function lastJsonObject(stdout: string): any {
 
 // --- Claude ---------------------------------------------------------------------------
 
-export function buildClaudeGistArgs(model: string, system: string): string[] {
+/** `claude -p --effort` levels COS passes (6.73.12). The CLI also takes xhigh and max; COS does not use them. */
+export const CLAUDE_GIST_EFFORTS = ['low', 'medium', 'high'] as const
+export type ClaudeGistEffort = typeof CLAUDE_GIST_EFFORTS[number]
+
+/** `effort` defaults to low, so the lens gist and Meeting Ask argv stay exactly as before 6.73.12. */
+export function buildClaudeGistArgs(model: string, system: string, effort: ClaudeGistEffort = 'low'): string[] {
   return [
-    '-p', '--model', model, '--effort', 'low',
+    '-p', '--model', model, '--effort', effort,
     // No tools: nothing to act on an instruction hidden in the reply, and ~1.2k tokens a
     // call instead of a cache of tool definitions. claude-permissions.ts records an empty
     // --tools causing a spurious compaction and a synthetic 400 on the 2026-08-26 CLI, in

package/server/lib/live-cos-ask.ts

@@ -1,4 +1,5 @@
 // On-demand meeting assistance. No poll, background summary, chat persistence or write tools.
+import { MAC_ASK_SESSION } from './ask-session-id.js'
 import { connectedEvidence } from './meeting-ask-evidence.js'
 import { REVIEW_SYSTEM, normalizeReviewConfidence, reviewRepairDiagnostics, reviewProblem, unverifiedReview, isFactCheckCTA, pageWasRead } from './meeting-ask-review.js'
 import { followupContext } from './meeting-ask-followup.js'
@@ -35,7 +36,7 @@ const TASKS: Record<AskAction, string> = {
 }
 export function normalizeAsk(value: unknown): AskInput {
   const v = value as any
-  if (!v || typeof v !== 'object' || typeof v.sessionId !== 'string' || !/^meeting_[A-Za-z0-9_-]{1,100}$/.test(v.sessionId ?? '') || !ASK_ACTIONS.includes(v.action)) throw new AskError('invalid_request')
+  if (!v || typeof v !== 'object' || typeof v.sessionId !== 'string' || !(/^meeting_[A-Za-z0-9_-]{1,100}$/.test(v.sessionId ?? '') || MAC_ASK_SESSION.test(v.sessionId ?? '')) || !ASK_ACTIONS.includes(v.action)) throw new AskError('invalid_request')
   if (typeof v.question !== 'string' || v.question.length > 2000 || (v.action === 'ask' && !v.question.trim())) throw new AskError('invalid_question')
   if (!Number.isFinite(v.elapsedMs) || v.elapsedMs < 0 || v.elapsedMs > 7 * 86400_000) throw new AskError('invalid_time')
   if (!Array.isArray(v.turns) || v.turns.length < 1 || v.turns.length > 6000) throw new AskError('invalid_transcript')

package/server/lib/mac-recording-asr.ts

@@ -0,0 +1,59 @@
+// Manual Mac canonical chunks follow the saved-meeting model choice. The
+// normal preview resolver may fall back to Turbo; canonical Mac audio must not.
+import { ParakeetError, transcribeParakeet, type ParakeetFailure } from './parakeet.js'
+import type { WhisperWord } from './whisper-local.js'
+
+export const MAC_PARAKEET_TIMEOUT_MS = 30_000
+
+export class MacParakeetUnavailableError extends Error {
+  readonly status = 503
+  readonly retryable = true
+  readonly model = 'parakeet-ultra'
+  readonly reason: `mac_parakeet_${ParakeetFailure}`
+
+  constructor(cause: unknown) {
+    const reason = cause instanceof ParakeetError ? cause.reason : 'cli_failed'
+    super(`Selected Parakeet Ultra could not transcribe this Mac chunk (${reason}); audio is preserved for retry`)
+    this.name = 'MacParakeetUnavailableError'
+    this.reason = `mac_parakeet_${reason}`
+  }
+}
+
+/** Interactive admission is bounded and never queues behind saved HQ work.
+ * The shared worker verifies the pinned installation and offline sandbox.
+ * Cold compilation may use this deadline; no Whisper/cloud fallback is allowed. */
+export async function transcribeMacParakeet(audio: Buffer, speechSeconds: number | null): Promise<{
+  text: string
+  words: WhisperWord[]
+  model: 'parakeet-ultra'
+  backend: 'fluidaudio-coreml'
+  asrProvider: 'server-parakeet'
+  latencyMs: number
+}> {
+  try {
+    const result = await transcribeParakeet(audio, {
+      model: 'parakeet-ultra',
+      lane: 'interactive',
+      timeoutMs: MAC_PARAKEET_TIMEOUT_MS,
+    })
+    if (result.model !== 'parakeet-ultra') {
+      throw new ParakeetError('bad_output', 'Parakeet did not return the selected model')
+    }
+    // 6.73.8: no words over detected speech (laughter, music, crosstalk) is an answer, not a failure. As a retryable
+    // 503 it replayed the same audio forever and froze every later chunk of a live meeting (2026-10-15, chunk 51).
+    // The saved meeting re-transcribes the full audio with strict Parakeet, so these words are not lost.
+    if (!result.text.trim() && speechSeconds !== null && speechSeconds >= 0.5) {
+      console.warn(`[mac-asr] Parakeet returned no words over ${speechSeconds.toFixed(2)}s of detected speech; recorded empty`)
+    }
+    return {
+      text: result.text,
+      words: result.words.map(word => ({ ...word, probability: word.probability ?? 0 })),
+      model: result.model,
+      backend: 'fluidaudio-coreml',
+      asrProvider: 'server-parakeet',
+      latencyMs: result.wallMs,
+    }
+  } catch (error) {
+    throw new MacParakeetUnavailableError(error)
+  }
+}

package/server/lib/mac-recording.ts

@@ -0,0 +1,111 @@
+/** Manual, remote-playback-only Mac capture. This registry is independent of
+ * live transcription state so provenance and the strict policy survive save,
+ * quarantine, finalization and recovery. No capture or model is started here. */
+import { constants, closeSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { dataPath } from './data-dir.js'
+import { durableAtomicWriteFileSync } from './atomic-fs.js'
+import { readSpeakerPolicy, writeSpeakerPolicy } from './meeting-speaker-policy.js'
+
+export const MAC_SOURCE_TYPE = 'mac_system_audio' as const
+export const MAC_CAPTURE_ID = /^mac_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
+export const MAC_AUDIO = { sourceType: MAC_SOURCE_TYPE, sampleRate: 16000, channels: 1, bitsPerSample: 16, maxChunkMs: 30000, maxChunkBytes: 960044, speakerPolicy: 'high-confidence' as const }
+export interface MacRecording { version: 1; captureId: string; sessionId: string; sourceType: typeof MAC_SOURCE_TYPE; startTime: number; speakerPolicy: 'high-confidence'; closedAt?: number }
+export function macError(status: number, reason: string, message: string): Error & { status: number; reason: string } {
+  return Object.assign(new Error(message), { status, reason })
+}
+function registryPath(id: string): string {
+  if (!MAC_CAPTURE_ID.test(id)) throw macError(400, 'invalid_capture_id', 'Invalid Mac capture ID')
+  return join(dataPath('mac-recordings'), id + '.json')
+}
+export function readMacRecording(id: string): MacRecording | null {
+  if (!MAC_CAPTURE_ID.test(id)) return null
+  try {
+    const path = registryPath(id)
+    if (lstatSync(path).isSymbolicLink()) throw new Error('symbolic link')
+    const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK)
+    try {
+      const stat = fstatSync(fd)
+      if (!stat.isFile() || stat.size > 4096) throw new Error('invalid registry file')
+      const value = JSON.parse(readFileSync(fd, 'utf8'))
+      if (value.version !== 1 || value.captureId !== id || value.sessionId !== id || value.sourceType !== MAC_SOURCE_TYPE || value.speakerPolicy !== 'high-confidence' || !Number.isSafeInteger(value.startTime) || value.startTime <= 0) throw new Error('invalid registry metadata')
+      return value
+    } finally { closeSync(fd) }
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return null
+    throw macError(409, 'mac_capture_metadata_unreadable', 'Mac capture metadata is unreadable; recording was not admitted')
+  }
+}
+export function registerMacRecording(input: unknown): { recording: MacRecording; replayed: boolean } {
+  const body = input as Partial<MacRecording> | null
+  if (!body || typeof body.captureId !== 'string') throw macError(400, 'invalid_capture_id', 'Mac capture ID required')
+  const path = registryPath(body.captureId)
+  if (body.sourceType !== MAC_SOURCE_TYPE || !Number.isSafeInteger(body.startTime) || Number(body.startTime) <= 0 || Number(body.startTime) > Date.now() + 300000) throw macError(400, 'invalid_mac_capture', 'Source type and valid capture start time required')
+  const prior = readMacRecording(body.captureId)
+  if (prior) {
+    if (prior.closedAt) throw macError(410, 'session_closed', 'Capture is already saved')
+    if (prior.startTime !== body.startTime) throw macError(409, 'mac_capture_conflict', 'Capture ID already belongs to another start time')
+    if (readSpeakerPolicy(body.captureId).mode !== 'high-confidence') throw macError(409, 'mac_capture_policy_changed', 'Mac capture requires high-confidence identity policy')
+    return { recording: prior, replayed: true }
+  }
+  const policy = readSpeakerPolicy(body.captureId)
+  // A policy written before a crash can be reused, but never overwrite another policy.
+  if (policy.revision !== 'unset' && policy.mode !== 'high-confidence') throw macError(409, 'mac_capture_policy_conflict', 'Capture ID has an incompatible identity policy')
+  if (policy.revision === 'unset') writeSpeakerPolicy(body.captureId, 'high-confidence', policy.revision)
+  const recording: MacRecording = { version: 1, captureId: body.captureId, sessionId: body.captureId, sourceType: MAC_SOURCE_TYPE, startTime: Number(body.startTime), speakerPolicy: 'high-confidence' }
+  mkdirSync(dataPath('mac-recordings'), { recursive: true, mode: 0o700 })
+  // Registry is the admission commit marker; strict policy is durable first.
+  durableAtomicWriteFileSync(path, JSON.stringify(recording), { mode: 0o600 })
+  return { recording, replayed: false }
+}
+export function requireMacRecording(id: string): MacRecording {
+  registryPath(id)
+  const value = readMacRecording(id)
+  if (value?.closedAt) throw macError(410, 'session_closed', 'Capture is already saved')
+  if (!value) throw macError(409, 'mac_capture_not_started', 'Start this Mac capture before sending audio')
+  if (readSpeakerPolicy(id).mode !== 'high-confidence') throw macError(409, 'mac_capture_policy_changed', 'Mac capture requires high-confidence identity policy')
+  return value
+}
+/** Native bridge intentionally sends one canonical WAV format, never raw HAL buffers. */
+export function validateMacWav(audio: Buffer): number {
+  if (audio.length < 46 || audio.length > MAC_AUDIO.maxChunkBytes || audio.length % 2 !== 0 ||
+      audio.toString('ascii', 0, 4) !== 'RIFF' || audio.readUInt32LE(4) !== audio.length - 8 ||
+      audio.toString('ascii', 8, 12) !== 'WAVE' || audio.toString('ascii', 12, 16) !== 'fmt ' || audio.readUInt32LE(16) !== 16 ||
+      audio.readUInt16LE(20) !== 1 || audio.readUInt16LE(22) !== 1 || audio.readUInt32LE(24) !== 16000 || audio.readUInt32LE(28) !== 32000 || audio.readUInt16LE(32) !== 2 || audio.readUInt16LE(34) !== 16 ||
+      audio.toString('ascii', 36, 40) !== 'data' || audio.readUInt32LE(40) !== audio.length - 44) {
+    throw macError(400, 'invalid_mac_audio', 'Expected a bounded canonical 16-kHz mono PCM16 WAV')
+  }
+  return (audio.length - 44) / 32
+}
+
+export function closeMacRecording(id: string): void {
+  const value = readMacRecording(id)
+  if (value && !value.closedAt) durableAtomicWriteFileSync(registryPath(id), JSON.stringify({ ...value, closedAt: Date.now() }), { mode: 0o600 })
+}
+
+export interface MacChunkReceipt { chunkIndex: number; endElapsed: number; durationMs: number; audioSha256: string }
+export function macChunkReceipt(id: string, index: number): MacChunkReceipt | null {
+  registryPath(id)
+  if (!Number.isInteger(index) || index < 0 || index > 9999) throw macError(400, 'invalid_chunk_index', 'Invalid chunk index')
+  const path = join(dataPath('mac-recording-chunks'), id, index + '.json')
+  try {
+    const stat = lstatSync(path)
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1024) throw new Error('invalid receipt')
+    const value = JSON.parse(readFileSync(path, 'utf8'))
+    if (value.chunkIndex !== index || !Number.isFinite(value.endElapsed) || !Number.isFinite(value.durationMs) || value.durationMs <= 0 || value.durationMs > MAC_AUDIO.maxChunkMs || value.endElapsed < value.durationMs || !/^[0-9a-f]{64}$/.test(value.audioSha256)) throw new Error('invalid receipt')
+    return value
+  } catch(error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return null
+    throw macError(409, 'mac_chunk_metadata_unreadable', 'Mac chunk receipt is unreadable')
+  }
+}
+export function persistMacChunkReceipt(id: string, value: MacChunkReceipt): void {
+  const prior = macChunkReceipt(id, value.chunkIndex)
+  if (prior) {
+    if (prior.audioSha256 !== value.audioSha256 || prior.endElapsed !== value.endElapsed || prior.durationMs !== value.durationMs) throw macError(409, 'mac_chunk_conflict', 'Chunk index already holds different audio or timing')
+    return
+  }
+  const dir = join(dataPath('mac-recording-chunks'), id)
+  mkdirSync(dir, { recursive: true, mode: 0o700 })
+  durableAtomicWriteFileSync(join(dir, value.chunkIndex + '.json'), JSON.stringify(value), { mode: 0o600 })
+}

package/server/lib/meeting-actions.ts

@@ -282,6 +282,7 @@ export function toEngineSentences(rows: unknown): FirefliesSentenceInput[] {
 }
 
 function g2FromSidecar(doc: Record<string, unknown>, sessionId: string): G2RecordingInput | null {
+  if (doc.sourceType === 'mac_system_audio') return null // Mac pilot never enters the G2-only blend engine.
   const startMs = numberOr(doc.startTime, Number.NaN)
   const durationMs = numberOr(doc.durationMs, Number.NaN)
   if (!Number.isFinite(startMs) || !Number.isFinite(durationMs)) return null

package/server/lib/meeting-ask-follow-up.ts

@@ -35,8 +35,8 @@ export async function saveAskFollowUp(raw: unknown, deps: FollowUpDependencies):
   try { meeting = await deps.resolveMeeting(descriptor) } catch { throw new WorkIntakeError('meeting_unavailable', 409) }
   if (meeting.recordId !== descriptor.recordId) throw new WorkIntakeError('meeting_identity_changed', 409)
   const captures = new Set([meeting.sessionId, meeting.sourceSessionId, ...(meeting.g2SessionIds ?? []),
-    ...(meeting.contextKeys ?? []).filter(k => k.startsWith('g2:')).map(k => k.slice(3)),
-    ...(meeting.sources ?? []).filter(s => s.kind === 'g2').map(s => s.id)])
+    ...(meeting.contextKeys ?? []).filter(k => k.startsWith('g2:') || k.startsWith('mac:')).map(k => k.slice(k.indexOf(':') + 1)),
+    ...(meeting.sources ?? []).filter(s => s.kind === 'g2' || s.kind === 'mac').map(s => s.id)])
   if (!captures.has(exchange.sessionId) || meeting.contextAmbiguous) throw new WorkIntakeError('meeting_capture_mismatch', 409)
   const ids = body.sourceIds === undefined ? exchange.sources.slice(0, 8).map(s => s.id) : body.sourceIds
   if (!Array.isArray(ids) || ids.length > 8 || ids.some(id => typeof id !== 'string' || !exchange.sources.some(s => s.id === id))) throw new WorkIntakeError('invalid_follow_up_source', 400)