@gotcos/glasses-server 6.76.1 → 6.77.0

package/CHANGELOG.md

@@ -1,3 +1,43 @@
+## 6.77.0 - Transcript cleanup: the passages the engine was unsure of, resolved with the meeting's text and screen context (default off)
+
+Includes 6.76.2. Off until Miles turns it on. No COS Control or companion change is required; Control can add the toggle, the screen feed and the Dictionary suggestions later against the contracts below.
+
+- Miles, 2026-10-17: after a transcription (Parakeet Ultra or Whisper), run Haiku or Sonnet over the passages where the engine was unsure, with screen and textual awareness, so word hallucinations and misheard names ("Queen Ukoma", "Yukoma", "eucoma", "U coma" for Queen Ukaoma) are resolved.
+- Where it runs. Once per saved meeting, in the durable finalization job after the HQ batch text and the Nemotron relabel are written, and before the meeting is handed to COS operations or summarised, so both read the cleaned text. Orphan recovery runs it too. Never during live transcription: it is a separate module no transcription file imports (pinned by a test), and a meeting whose session is still live is skipped. It never fails a save.
+- Selection, no model (`transcript-cleanup-spans.ts`): low confidence (Parakeet below 0.50, Whisper below 0.40, from the batch words in the sidecar, aligned to the saved transcript); a word near a known name when the engine was unsure of it (below 0.9: one edit past fuzzy-correct's limit for a capitalised word, or the same consonant skeleton and onset, so eucoma reads like Ukaoma); two or three short pieces that join into a name ("U coma"), never function words; the leading-y rule at any confidence ("Yukoma"); an out-of-vocabulary capital mid-sentence beside a known name; a phrase repeated three times or more. Spans stay inside one speaker turn and one clause, hold at most 6 words (12 for a repeat), carry 12 words of context each side, and are cut to 40 per meeting with names first.
+- Deterministic fixes first, free (fuzzy-correct's own rule, exported as `fuzzyReplacementFor`): only capitalised words that are not already a known spelling; this meeting's own screen and file terms as a temporary per-meeting vocabulary at any confidence; the curated dictionary (vocabulary and corrections) and the owner only where the engine was unsure; never an inflection ("Setting" is never a "Settings" button). Measured read-only on 68 real meetings (38.5 hours): rewriting lowercase words, or using every enrolled name as a target, swapped everyday words and real names for other names (giant to grant, Kelsey to Kelley, Slack to Black), so neither is done; with these rules the same meetings got 27 fixes, all real (Manuj to Manoj, MarketPOS to MarktPOS).
+- Context pack: meeting title, date and attendees; COS people (enrolled speaker names); the owner card (6.76.0); the profile vocabulary and heard-to-written corrections (the COS dictionary dictation uses); text of files dropped on the meeting (the Meeting Ask file list); up to 6 local notes hits for the names the spans are near (memories and earlier meetings by keyword, and the memory bridge listing when memory search finds nothing, as the Live COS Ask does; never this meeting; nothing leaves the Mac; 3 s budget); and up to 3 screen lines per span, nearest in time (45 s) or naming the span's name. Every text is bounded and passed through the secret redactor.
+- The call: one per meeting, batched, through the shared Claude CLI runner (`--tools ""`, no MCP servers, no hooks, empty scratch workspace), pinned `claude-haiku-5-5` by default or `claude-sonnet-5-5`, low effort, 1,500 output tokens, 75 s timeout, 24,000-character prompt, token audit source `transcript-cleanup`. Never an SDK. The reply is strict JSON by span id (`keep` or `replace`); a fenced reply or one followed by prose still parses.
+- Guards on every edit (`transcript-cleanup-model.ts`): unknown or duplicate span id, bad action, no-op, a bracket or line break (a forged speaker label), more than one word over the span or twice its length, a neighbouring context word (text outside the span), a changed number or unit, an added or dropped negation, and any word that is neither a misheard span word (close spelling or same sound) nor a term this meeting's context knows. A repeat may only shrink to a run of its own words. Edits are applied by the span's offsets, never by the model's text.
+- Undoable ledger (`transcript-cleanup-ledger.ts`, modelled on `meeting-corrections.ts`): intent first, every edit with its original words, offset and surrounding text, then the files (sidecar first, markdown second, both re-read and compared first: a change while the model answered writes nothing). Only the `## Transcript` section, the sidecar's `batchTranscript` (kept equal to it), `transcriptCleanup` (counts only) and `lifecycleRevision` change. Any edit or a whole run can be restored; a line changed since refuses with 409 `stale`. A rerun on a cleaned meeting does nothing.
+- Stops: its own switch (`COS_TRANSCRIPT_CLEANUP=1` forces on, `=0` forces off, else the saved setting, else off; off means no read, no write, no trace); `ANTHROPIC_API_KEY` without `COS_ALLOW_API_FALLBACK=1` never calls; no Claude CLI never calls; 30 calls a day (`COS_TRANSCRIPT_CLEANUP_DAILY`) charged before the call; 400k tokens a day (`COS_TRANSCRIPT_CLEANUP_DAILY_TOKENS`); 40 spans a meeting (`COS_TRANSCRIPT_CLEANUP_MAX_SPANS`, at most 80); a breaker after 3 failures in a row (30 minutes, one trial call after) or one provider limit (60 minutes). Each stop is recorded as `modelSkipped` while the free fixes still apply. An unreadable or future-dated state file reads as a spent day. All six env names are forwarded by the managed runtime contract.
+- Trace (`transcript-cleanup/trace.jsonl`) and one log line per meeting: spans found and sent by reason, accepted, kept, rejected by reason, fixes, suggestions, screen lines, files, notes, prompt characters, tokens, model and total milliseconds. No transcript, screen or name text.
+- Dictionary suggestions: an accepted edit (fixed or model) whose written form came from this meeting's screen, files, owner card, COS people or notes, and that the dictionary lacks, becomes a suggestion with its evidence, never an automatic addition. Deduped by written form (case-insensitive), 200 kept, 5 heard forms and 5 evidence rows each; an accepted or dismissed form is never suggested again.
+- Routes (token authenticated like every /api route):
+  - `GET /api/transcript-cleanup/settings` and `POST {enabled?, model?: "haiku"|"sonnet"}`: `{protocol: 1, enabled, source: env|setting|default, model, modelId, modelSource, limits: {dailyCalls, dailyTokens, maxSpansPerMeeting}, today: {calls, tokens, breakerOpenUntil}}`; 409 `env_forced` when env pins the value; 400 `invalid_request`.
+  - `POST /api/meeting/:sessionId/screen-context {lines: [{at: epoch ms or ISO, text, app?}]}`: at most 100 lines and 32 KB of text a request (413 `too_many_lines`, `request_too_large`), 400 characters a line (cut and counted), 2,000 lines and 400 KB a meeting (the rest `dropped`), duplicates within 30 s skipped, a line that reads like a password, key or token `held` and never stored, clocks more than 5 minutes outside the session refused. Answers `{ok, protocol, accepted, duplicates, held, truncated, invalid, dropped, stored}`. Accepted while the session is live, and after save until the cleanup has run (then 409 `cleanup_done`); 404 `unknown_session` otherwise. `GET` answers counts only (`lines, bytes, firstAt, lastAt`), `DELETE` answers `{deleted}`. Stored per meeting in `transcript-cleanup/screen/`, text only, and deleted with the meeting: a boot sweep removes screen and ledger files whose meeting, live session and finalization are all gone (after 72 hours), and screen text after 30 days regardless (`COS_TRANSCRIPT_SCREEN_RETENTION_DAYS`).
+  - `GET /api/meeting/:sessionId/transcript-cleanup`: `{protocol, runs, edits (with original and replacement words, reverted), unusable, cleanedCurrent}`. `POST .../transcript-cleanup/undo {editId}` or `{runId}`: `{reverted: [ids]}`; 404 `edit_not_found`, 409 `already_reverted` or `stale`.
+  - `GET /api/transcript-cleanup/suggestions?status=pending|all`: `{protocol: 1, suggestions: [{id: "sug_<16 hex>", written, heard: [], status: pending|accepted|dismissed, count, createdAt, updatedAt, inVocabulary, evidence: [{source: screen|file|owner|people|notes, sessionId, heard, at, detail}]}]}`. `POST .../:id/accept {correction?: boolean}` adds the word through the glossary's own vocabulary writer, or with `correction: true` learns heard to written through the logged, undoable glossary learn (source `meeting`); answers `{suggestion, unchanged, glossary, entry}`; 409 `suggestion_dismissed`. `POST .../:id/dismiss` answers `{suggestion}`.
+- Capability: `/api/transcribe/capabilities` adds `transcriptCleanup: {protocol: 1, suggestions: 1, screenContext: 1}`; `/api/health` adds `capabilities.transcriptCleanup: {protocol: 1, enabled}` (codes only, it is public).
+- Older path, for the record: the app's former server had a whole-transcript `claude -p sonnet` rewrite (`correctTranscript`, 40 KB cap, breaker after 2 failures for 30 minutes, `correction_skipped`), deleted with that fork on 2026-08-11. This server had no transcript LLM pass until now, and the COS repo's `sync_meetings.py` gates only title, summary and action extraction (`COS_MEETING_LLM`); it never rewrites transcript text. This pass is span-level, guarded and undoable instead.
+- Evidence and limits: the 2026-10-13 silver eval of Haiku on doubtful Parakeet spans (no screen, owner or file context) was a WER tie with Parakeet alone. Real-model quality with this context is unmeasured. Read-only selection on 68 real meetings (38.5 h, 379,273 words, 100% aligned, no model call): 149 doubtful spans an hour found (low confidence 93%), 48.9 an hour sent, a median prompt of about 1,840 input tokens, 33 meetings at the 40-span cap, at most 333 ms to select.
+- Tests: `transcript-cleanup.test.ts` (33: end to end with a fake Claude provider, including the Ukoma, Yukoma, eucoma and U coma case with the owner card and a screen line, every stop, undo, the notes lookup, the per-meeting vocabulary and suggestions), `transcript-cleanup-spans.test.ts` (26: selection, fixes, edit guards, prompt), `transcript-cleanup-provider.test.ts` (1: the real runner wiring), `routes/transcript-cleanup.test.ts` (13: auth on every route, screen bounds, settings, suggestions through the real glossary writer, undo, the sweep), `meeting.test.ts` (2 new: runs once after the relabel and before the job completes; a throwing cleanup never fails the save, the default writes nothing), `health.test.ts` (1 new) and `transcribe.test.ts` (capability). `server/scripts/transcript-cleanup-mutation-gate.mjs` (`--check` validates every target): 107 mutants over the switch, model pin, every stop, selection, the fixes, every edit guard, the ledger and undo, the screen store and route, the notes lookup, suggestions and the save wiring, each killed by a named test against a green baseline (115 tests in 7 files). Full suite in isolated TMPDIR, HOME and data dir with COS_SCRIPTS_DIR unset: 7316 passed, 13 skipped, 0 failed; typecheck clean.
+
+## 6.76.2 - Live cues v2: a switch COS Control can flip, the owner's own notes as memory, and SubQ or Jev for the gate
+
+Pairs with COS Glasses companion 6.10.644 and COS Control 0.5.322. Includes 6.76.1.
+
+- Runtime switch. `GET /api/live-cues/v2/settings` answers `{ enabled, source, capability }`: `source` is `env` (`COS_LIVE_CUES_V2=1` forces v2 on), `setting` (saved) or `default` (off). `POST /api/live-cues/v2/settings {"enabled": true|false}` saves the choice in this server's data dir (`live-cues-v2-settings.json`, atomic and durable) and answers the same shape; turning it off while the env flag forces it on is 409 `{"error": "env_forced"}` and changes nothing; a body without a boolean `enabled` is 400 `invalid_request`. Both are token authenticated like every /api route. Only the exact env value `1` forces; any other value defers to the setting, and an unreadable settings file reads as off.
+- No restart needed. `capabilities.liveCuesV2` on `/api/health` and `/api/models` (and `v2` on the status route) follows the setting at once, and a v2-off server still advertises nothing, so a companion treats it as v1. Turning v2 off aborts every evaluation in flight (traced `cancelled` with `cancelReason: "v2_off"`; no cue is emitted, the lease is released) and no new evaluation starts; a cue that finishes after the switch is checked once more and withheld. Meetings v2 armed keep their v2 stop and status answers after the switch, and a saved meeting still ends them. Turning it on applies from each meeting's next evaluation.
+- Notes as memory. When `cue_memory.py` is missing (any Mac but Miles's), fails or times out, the memory arm now searches the owner's own COS instead of nothing: the Live COS Ask's `searchMemories` and `searchMeetingLibrary` in their keyword-only mode, plus the memory bridge listing (`cos_api_bridge.py memory`, COS Control's Memory list). The bridge matters: the public memory runtime 0.1.0 serves the owner's notes only there (its `bot_memory.py` has no `search` command, so `searchMemories` answers `memory_parse_error` for meaning and reads only markdown memory folders for keywords; measured on a scratch install). A few salient words from the window are the queries, never the window; candidates are fused by rank (k=60, as `cue_memory.py`), dated by their local day, bounded like `cue_memory.py`, at most 4, and go to the same judge and writer rules unchanged. The whole arm is bounded by `cue_memory.py`'s 3 s dense budget. No model call and no query leaves the Mac. `cue_memory.py` stays first whenever it answers, including an empty answer, so Miles's path does not change.
+- Each evaluation traces `cueMemorySource` (`cue_memory`, `notes` or `none`: whose candidates the judge saw), plus `notesMs` and `notesError` when the fallback ran. No note text or query terms are traced.
+- Decision provider. The gate and the memory judge run on Jev, or on SubQ when `COS_DECISION_PROVIDER_CUES=subq` says so or SubQ is the only decision key on this Mac (`COS_DECISION_PROVIDER_CUES=jev` pins Jev; both are forwarded by the managed runtime contract). Cues ignore COS Control's saved decision provider and `COS_DECISION_PROVIDER`, so a Mac whose Work decisions run on SubQ keeps Jev cues. One provider per evaluation. Both take the same questions (three `choice` questions with keyed criteria for the gate, one for the judge), and SubQ validates its answers against them. SubQ for cues has its own daily cap (`COS_LIVE_CUES_SUBQ_DAILY_TOKENS`, default 1.5M, ledger `subq-cues-usage.json`) and its own breaker, which a newly saved SubQ key clears; Jev keeps `COS_LIVE_CUES_JEV_DAILY_TOKENS` and `jev-cues-usage.json`.
+- The 0.8 gate and 0.8 judge thresholds were calibrated on Jev (jev-1.13.0) and have no SubQ replay yet.
+- When SubQ serves cues, the live transcript window (up to 2,200 characters per call) and the candidate notes go to SubQ, which retains data by default.
+- Capability additions (optional fields; `shared/live-cues-v2.ts` changed additively, new sha256 174728e7...): `memory` (`cue_memory`, `notes` or `none`) and `decisionProvider` (`jev` or `subq`). New reasons: `decision_not_configured` (no key for the chosen provider; `jev_not_configured` is kept for Jev chosen while only a SubQ key exists), `decision_cap_reached`, `decision_breaker_open` (SubQ) and `decision_invalid_provider`. The same decision codes stop a running meeting's cues quietly with that reason; other SubQ errors count toward the meeting breaker as Jev errors do.
+- Live COS Ask finds the owner's notes too. When `searchMemories` does not answer (it fails, its meaning arm fails as on the public runtime, or it finds nothing), the Ask's COS search also reads the memory bridge listing and matches it with the same keyword scorer, the same 0.35 floor and the same confirmed-domain filter as other COS hits, fused by rank with any memory hits (at most 3 memory sources). Listed notes are cited as COS memory sources (H ids, `memoryId`), counted in the `cos_search` phase time and result count, and the notices add "COS also searched the notes in its memory list by keyword." whenever one is cited. The listing is bounded at 3 s and the Ask's own cancel; a failed listing changes nothing. A memory search that answers is used exactly as before, the same sources in the same order and key order, and the listing is never read. With nothing found in either, the notices are the existing empty wording, word for word. On the public runtime this lets the 6.76.0 person lookup ("Who is X?") answer from the owner's note. One helper serves both cues and the Ask: `server/lib/cos-bridge-notes.ts` (bridge listing, keyword scoring, local dates, rank fusion).
+- Tests: `live-cues-v2.test.ts` (52, 13 new), `live-cues-v2-notes.test.ts` (11), `live-cues-v2-notes-bridge.test.ts` (2: the real searchers over a scratch bridge, a markdown note and a saved meeting), `live-cues-v2-settings.test.ts` (3), `live-cues-v2-settings-route.test.ts` (10: behind the real token gate, a module reload as the restart, and the real deps with faked network sending the gate to SubQ then Jev), `health.test.ts` (1 new: `/api/health` and `/api/models` flip with the setting), `live-cos-ask-memory-fallback.test.ts` (8), `live-cos-ask-queen-runtime.test.ts` (3: the shipped public memory runtime 0.1.0 installed in a scratch dir with one accepted note; `searchMemories` alone finds nothing, the Ask answers "Who is Delgado?" from the note). `server/scripts/live-cues-v2-notes-mutation-gate.mjs`: 85 mutants over the cue switch, the cue notes fallback, the shared helper, the decision provider selection (global setting ignored, only-key fallback, explicit override both ways) and the Ask fallback (13 Ask guards), each killed by a named test against a green baseline (160 tests in 12 files). Full suite 7240 passed, 13 skipped, 0 failed; typecheck clean.
+
 ## 6.76.1 - Stop a glasses meeting from COS Control
 
 Pairs with COS Glasses companion 6.10.644 and COS Control 0.5.321. Includes 6.76.0.

package/managed-runtime-contract.json

@@ -27,6 +27,14 @@
     "COS_LIVE_CUES_V2_WEEKLY",
     "COS_LIVE_CUES_V2_NUMBER_GUARD",
     "COS_LIVE_CUES_JEV_DAILY_TOKENS",
+    "COS_LIVE_CUES_SUBQ_DAILY_TOKENS",
+    "COS_DECISION_PROVIDER_CUES",
+    "COS_TRANSCRIPT_CLEANUP",
+    "COS_TRANSCRIPT_CLEANUP_MODEL",
+    "COS_TRANSCRIPT_CLEANUP_DAILY",
+    "COS_TRANSCRIPT_CLEANUP_DAILY_TOKENS",
+    "COS_TRANSCRIPT_CLEANUP_MAX_SPANS",
+    "COS_TRANSCRIPT_SCREEN_RETENTION_DAYS",
     "COS_BATCH_HQ_METAL",
     "COS_BATCH_HQ_FORCE_CPU",
     "COS_BATCH_HQ_TIMESTAMPS",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.76.1",
+  "version": "6.77.0",
   "description": "COS Glasses: self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -72,7 +72,8 @@ import { nativeHead, realNativeHeadDeps } from './lib/native-head.js'
 import { threadOccupancy, holderActivity } from './lib/thread-occupancy.js'
 import { displayRouter } from './routes/display.js'
 import { transcribeStreamRouter, getActiveTranscriptionSessionCount } from './routes/transcribe-stream.js'
-import { meetingRouter, resumeMeetingFinalizationJobs } from './routes/meeting.js'
+import { meetingRouter, resumeMeetingFinalizationJobs, scheduleTranscriptCleanupSweep, transcriptCleanupRouteDeps } from './routes/meeting.js'
+import { createTranscriptCleanupRouter } from './routes/transcript-cleanup.js'
 import { meetingsRouter } from './routes/meetings.js'
 import { openaiCompatRouter } from './routes/openai-compat.js'
 import { openaiKeyRouter } from './routes/openai-key.js'
@@ -1086,6 +1087,8 @@ app.use('/api', createAgentSessionBindingsRouter({
 app.use('/api', displayRouter)
 app.use('/api', transcribeStreamRouter)
 app.use('/api', meetingRouter)
+// 6.77.0: transcript cleanup settings, screen context, the cleanup ledger and dictionary suggestions.
+app.use('/api', createTranscriptCleanupRouter(transcriptCleanupRouteDeps()))
 app.use('/api', meetingsRouter)
 app.use('/api', memoryRouter)
 app.use('/api', threadsRouter)
@@ -1373,6 +1376,8 @@ listenRequiredServers(listeners).then(() => {
     // Resume already-saved meetings whose post-response HQ/operations work
     // was interrupted by a prior server update or process exit.
     resumeMeetingFinalizationJobs()
+    // 6.77.0: transcript cleanup data whose meeting is gone, and screen text past retention.
+    scheduleTranscriptCleanupSweep()
 
     // Debris from an import killed mid-write: a temp file, or a sidecar whose
     // markdown never landed. Both are invisible to every reader, so nothing

package/server/lib/cos-bridge-notes.ts

@@ -0,0 +1,73 @@
+// The owner's notes as the memory bridge lists them, searched by keyword, and reciprocal rank fusion (6.76.2). Shared by
+// the live cues notes fallback (live-cues-v2-notes.ts) and the Live COS Ask (searchAskHistory in live-cos-ask.ts).
+//
+// Why the listing: the public memory runtime 0.1.0 serves the owner's notes ONLY through `cos_api_bridge.py memory` (what
+// COS Control's Memory list shows). Its bot_memory.py has no `search` command, so searchMemories' meaning arm answers
+// memory_parse_error, and its keyword arm reads only markdown memory folders: on such a Mac, searchMemories finds none of
+// the owner's notes. Listing and scoring is local: no model call, no query leaves the Mac. Nothing here logs.
+
+import { callPython } from './python-bridge.js'
+import { scoreKeywordMatch, tokenizeMeetingQuery } from './meeting-library-search.js'
+
+export const BRIDGE_DAYS = 3650
+export const BRIDGE_LIMIT = 200
+/** The listing never takes longer than cue_memory.py's dense arm may (DENSE_BUDGET_S). */
+export const BRIDGE_TIMEOUT_MS = 3_000
+export const RRF_K = 60
+
+export interface BridgeMemory { id: string; content: string; summary?: string; created_at?: string; domain?: string }
+
+/** Rows the bridge listed: an id and some content, at most BRIDGE_LIMIT. Anything else (an error object) is no rows. */
+export function normalizeBridgeMemories(value: unknown): BridgeMemory[] {
+  if (!Array.isArray(value)) return []
+  const out: BridgeMemory[] = []
+  for (const row of value.slice(0, BRIDGE_LIMIT)) {
+    if (!row || typeof row !== 'object' || Array.isArray(row)) continue
+    const r = row as Record<string, unknown>
+    const id = typeof r.id === 'string' ? r.id.trim().slice(0, 170) : ''
+    const content = typeof r.content === 'string' ? r.content : ''
+    if (!id || !content.trim()) continue
+    out.push({ id, content,
+      ...(typeof r.summary === 'string' ? { summary: r.summary } : {}),
+      ...(typeof r.created_at === 'string' ? { created_at: r.created_at } : {}),
+      ...(typeof r.domain === 'string' && r.domain ? { domain: r.domain } : {}) })
+  }
+  return out
+}
+
+/** The bridge listing. Rejects when the bridge fails or the signal aborts; callers decide what that means. */
+export async function listBridgeMemories(signal?: AbortSignal, timeoutMs: number = BRIDGE_TIMEOUT_MS): Promise<BridgeMemory[]> {
+  return normalizeBridgeMemories(await callPython(['memory', '--days', String(BRIDGE_DAYS), '--limit', String(BRIDGE_LIMIT)], timeoutMs, undefined, signal))
+}
+
+/** Rows that match `query`, best first, scored by the library's own keyword scorer (score > 0 only). */
+export function scoreBridgeMemories(rows: BridgeMemory[], query: string): Array<{ row: BridgeMemory; score: number }> {
+  const tokens = tokenizeMeetingQuery(query)
+  return rows.map(row => ({ row, score: scoreKeywordMatch(tokens, row.summary || '', `${row.summary || ''}\n${row.content}`).score }))
+    .filter(x => x.score > 0).sort((a, b) => b.score - a.score)
+}
+
+/** A note's LOCAL calendar day: a date bound is a local day (live cues use "tomorrow"), and a memory written at 22:00 Central
+ *  carries a UTC timestamp dated the next day. A bare YYYY-MM-DD is already a local day. */
+export function localDateOf(v: unknown): string {
+  if (typeof v !== 'string') return ''
+  if (/^\d{4}-\d{2}-\d{2}$/.test(v)) return v
+  if (!/^\d{4}-\d{2}-\d{2}T/.test(v)) return ''
+  const ms = Date.parse(v)
+  return Number.isFinite(ms) ? new Date(ms).toLocaleDateString('en-CA') : ''
+}
+
+/** Reciprocal rank fusion over ranked lists (k=60, as cue_memory.py): an item in several lists, or high in one, ranks first.
+ *  The first item seen for a key is kept; ties keep the order items were first added. */
+export class RankFusion<T> {
+  private readonly items = new Map<string, { item: T; score: number; order: number }>()
+  add(list: ReadonlyArray<{ key: string; item: T }>): void {
+    list.forEach(({ key, item }, rank) => {
+      const prev = this.items.get(key)
+      this.items.set(key, { item: prev?.item ?? item, score: (prev?.score ?? 0) + 1 / (RRF_K + rank), order: prev?.order ?? this.items.size })
+    })
+  }
+  ranked(limit = Infinity): T[] {
+    return [...this.items.values()].sort((a, b) => b.score - a.score || a.order - b.order).slice(0, limit).map(x => x.item)
+  }
+}

package/server/lib/decision-provider.ts

@@ -82,6 +82,13 @@ export class SubqDecisionClient implements DecisionClient {
     private readonly cap = () => { const n = Number(process.env.COS_SUBQ_DAILY_TOKENS); return Number.isFinite(n) && n > 0 ? Math.floor(n) : SUBQ_LIMITS.dailyTokens },
     private readonly timeoutMs: number = SUBQ_LIMITS.timeoutMs) {}
   resetForNewKey(): void { this.failures = 0; this.breakerUntil = 0 }
+  /** For an honest capability (6.76.2, live cues). An unreadable ledger reads as the cap reached: it fails toward not spending. */
+  status(): { configured: boolean; usedToday: number; dailyCap: number; breakerOpenUntil: number | null } {
+    const dailyCap = this.cap()
+    let usedToday = dailyCap
+    try { usedToday = Number(this.ledger()[this.day()]) || 0 } catch { /* unreadable ledger: saturated */ }
+    return { configured: !!this.key(), usedToday, dailyCap, breakerOpenUntil: this.breakerUntil > this.now().getTime() ? this.breakerUntil : null }
+  }
   private ledger(): Record<string, number> {
     try {
       const stat = lstatSync(this.usageFile)
@@ -144,6 +151,8 @@ export class SubqDecisionClient implements DecisionClient {
 
 const configuredSubqClients = new Set<SubqDecisionClient>()
 export function resetSubqDecisionClients(): void { configuredSubqClients.forEach(client => client.resetForNewKey()) }
+/** A SubQ client built outside createDecisionClient (live cues, 6.76.2) still starts clean when a new key is saved. */
+export function trackSubqDecisionClient(client: SubqDecisionClient): SubqDecisionClient { configuredSubqClients.add(client); return client }
 /** Snapshot selection per workflow request. Separate clients and cache identities prevent stale cross-provider answers. */
 export function createDecisionClient(useCase: DecisionUseCase, jev: Pick<JevClient, 'ask'> = new JevClient(), env: NodeJS.ProcessEnv = process.env): DecisionClient {
   const clients: Partial<Record<DecisionProvider, DecisionClient>> = {}

package/server/lib/fuzzy-correct.ts

@@ -4,7 +4,11 @@
 //
 // Used by:
 //   - /api/transcribe       (short-form dictation / messaging)
-//   - /api/meeting/save     (batch post-processing, Phase 3.5 — via meeting.ts)
+//   - prompt drafts         (routes/prompt-drafts.ts)
+//   - the post-save transcript cleanup (6.77.0, transcript-cleanup.ts), one word at
+//     a time through fuzzyReplacementFor, with the meeting's own screen and file
+//     terms as extra targets. Not otherwise on the meeting save path: the Phase 3.5
+//     LLM pass this file once fed was deleted with the app's server fork.
 //
 // Zero LLM cost, ~5ms on typical dictation length.
 //
@@ -191,6 +195,72 @@ const COMMON_ENGLISH_WORDS = new Set<string>([
   'willie', 'zachary',
 ])
 
+/** True for a word the stop list protects from ever being replaced (lowercase compare). */
+export function isCommonEnglishWord(word: string): boolean {
+  return COMMON_ENGLISH_WORDS.has(word.toLowerCase())
+}
+
+/**
+ * The proper-noun targets fuzzy correction may write, in first-seen order: speaker
+ * tokens (Ext, Unknown, the owner label) and entries that do not start uppercase or
+ * are shorter than 4 characters are dropped.
+ */
+export function canonicalFuzzyTargets(targets: string[]): string[] {
+  const owner = getOwnerSpeakerLabel()
+  return Array.from(new Set(
+    targets
+      .filter(t => {
+        if (!t || t.length < 4) return false
+        if (t === 'Ext' || t === 'Unknown' || t === owner) return false
+        return /^[A-Z]/.test(t.trim())
+      })
+      .map(t => t.trim()),
+  ))
+}
+
+/**
+ * The replacement fuzzy correction would write for ONE word, or null to leave it.
+ * `canonical` comes from canonicalFuzzyTargets. Same rules as applyFuzzyCorrections,
+ * which calls this for every candidate word.
+ */
+export function fuzzyReplacementFor(word: string, canonical: string[], targetLowerSet?: ReadonlySet<string>): string | null {
+  if (!/^[A-Za-z][A-Za-z'-]{4,}$/.test(word)) return null
+  const lower = word.toLowerCase()
+
+  // Skip common English words (primary false-positive defense)
+  if (COMMON_ENGLISH_WORDS.has(lower)) return null
+
+  // Skip exact matches (already correct)
+  const exact = targetLowerSet ?? new Set(canonical.map(t => t.toLowerCase()))
+  if (exact.has(lower)) return null
+
+  // Length-scaled distance threshold
+  const len = word.length
+  const maxDist = len <= 8 ? 1 : len <= 11 ? 2 : 3
+
+  let bestTarget: string | null = null
+  let bestDist = maxDist + 1
+
+  for (const target of canonical) {
+    // Split multi-word targets — match on individual tokens
+    const tokens = target.split(/\s+/)
+    for (const token of tokens) {
+      if (token.length < 4) continue
+      // Length difference must be small to prevent collapses
+      if (Math.abs(token.length - len) > 2) continue
+      const dist = levenshtein(lower, token.toLowerCase())
+      if (dist > 0 && dist < bestDist && dist <= maxDist) {
+        bestDist = dist
+        bestTarget = token
+      }
+    }
+  }
+
+  if (!bestTarget) return null
+  // Preserve original capitalization pattern
+  return /^[A-Z]/.test(word) ? bestTarget : bestTarget.toLowerCase()
+}
+
 /**
  * Fuzzy-match transcript words against a canonical list of proper nouns.
  *
@@ -218,16 +288,7 @@ export function applyFuzzyCorrections(
 
   // Keep only targets that look like proper nouns.
   // Drop speaker tokens and entries that don't start with uppercase.
-  const owner = getOwnerSpeakerLabel()
-  const canonical = Array.from(new Set(
-    targets
-      .filter(t => {
-        if (!t || t.length < 4) return false
-        if (t === 'Ext' || t === 'Unknown' || t === owner) return false
-        return /^[A-Z]/.test(t.trim())
-      })
-      .map(t => t.trim()),
-  ))
+  const canonical = canonicalFuzzyTargets(targets)
   if (canonical.length === 0) return { text, replacements: 0 }
 
   const targetLowerSet = new Set(canonical.map(t => t.toLowerCase()))
@@ -237,44 +298,11 @@ export function applyFuzzyCorrections(
   // Match any 5+ char word (case-insensitive). Stop-list + strict distance
   // thresholds are the primary defenses against false positives.
   const result = text.replace(/\b[A-Za-z][A-Za-z'-]{4,}\b/g, (word) => {
-    const lower = word.toLowerCase()
-
-    // Skip common English words (primary false-positive defense)
-    if (COMMON_ENGLISH_WORDS.has(lower)) return word
-
-    // Skip exact matches (already correct)
-    if (targetLowerSet.has(lower)) return word
-
-    // Length-scaled distance threshold
-    const len = word.length
-    const maxDist = len <= 8 ? 1 : len <= 11 ? 2 : 3
-
-    let bestTarget: string | null = null
-    let bestDist = maxDist + 1
-
-    for (const target of canonical) {
-      // Split multi-word targets — match on individual tokens
-      const tokens = target.split(/\s+/)
-      for (const token of tokens) {
-        if (token.length < 4) continue
-        // Length difference must be small to prevent collapses
-        if (Math.abs(token.length - len) > 2) continue
-        const dist = levenshtein(lower, token.toLowerCase())
-        if (dist > 0 && dist < bestDist && dist <= maxDist) {
-          bestDist = dist
-          bestTarget = token
-        }
-      }
-    }
-
-    if (bestTarget) {
-      replacements++
-      fuzzyLog.push({ from: word, to: bestTarget })
-      // Preserve original capitalization pattern
-      const wasCapitalized = /^[A-Z]/.test(word)
-      return wasCapitalized ? bestTarget : bestTarget.toLowerCase()
-    }
-    return word
+    const replacement = fuzzyReplacementFor(word, canonical, targetLowerSet)
+    if (replacement === null) return word
+    replacements++
+    fuzzyLog.push({ from: word, to: replacement })
+    return replacement
   })
 
   if (fuzzyLog.length > 0) {

package/server/lib/live-cos-ask.ts

@@ -11,6 +11,7 @@ import { createHash } from 'node:crypto'
 import { runLensGistEngine, redactSecrets } from './lens-gist-engines.js'
 import { AskProcessError } from './meeting-ask-runner.js'
 import { searchMemories } from './context-library-search.js'
+import { listBridgeMemories, localDateOf, RankFusion, scoreBridgeMemories, type BridgeMemory } from './cos-bridge-notes.js'
 import { searchMeetingLibrary } from './meeting-library-search.js'
 import { MEETING_ASK_LABELS, meetingAskAnswerMarkdown, meetingAskCitations, type MeetingAskSection, type MeetingAskPhaseTiming, type MeetingAskTimings } from '../../shared/meeting-ask.js'
 import { ABSENCE_CLAIM, matchOwnerName, ownerCardSource, personLookupQuery, personQuestion, searchedDisclosure, type OwnerCard } from './meeting-ask-owner.js'
@@ -240,18 +241,51 @@ export function sectionsFromAnswer(action: AskAction, answer: string, allowed: R
 }
 /** 'meaning' adds the embedding search (default); 'keyword' stays on local keyword matching, so no query is embedded. */
 export type CosSearchMode = 'meaning' | 'keyword'
-export async function searchAskHistory(query: string, excludeSessionId?: string, signal?: AbortSignal, mode: CosSearchMode = 'meaning', domain?: string): Promise<{ sources: AskSource[]; notices: string[] }> {
+/** The memory bridge listing searchAskHistory falls back to (cos-bridge-notes.ts); a parameter so tests can fake it. */
+export type AskBridgeList = (signal?: AbortSignal) => Promise<BridgeMemory[]>
+const ASK_HIT_MIN = 0.35
+export async function searchAskHistory(query: string, excludeSessionId?: string, signal?: AbortSignal, mode: CosSearchMode = 'meaning', domain?: string, bridge: AskBridgeList = s => listBridgeMemories(s)): Promise<{ sources: AskSource[]; notices: string[] }> {
   const semantic = mode !== 'keyword'
   const results = await Promise.allSettled([searchMemories({ query, limit: domain ? 50 : 3, semantic, ...(signal?{signal}:{}) }), searchMeetingLibrary({ query, limit: 3, semantic, ...(domain ? {domain} : {}), ...(signal?{signal}:{}) })])
   const sources: AskSource[] = [], notices: string[] = semantic ? [] : ['COS search used keywords only, as set in Meeting assistant settings.']
   if (domain) notices.push(`COS search focused on the confirmed ${domain.replace(/_/g, ' ')} domain.`)
-  results.forEach((result, i) => {
-    if (result.status === 'rejected') { if(result.reason instanceof AskProcessError)throw result.reason; notices.push(`${i === 0 ? 'COS memory' : 'Earlier meeting'} search is unavailable.`); return }
-    if (semantic && !result.value.semanticAvailable) notices.push(`${i === 0 ? 'COS memory' : 'Earlier meeting'} semantic search is unavailable; local keyword results are shown.`)
-    result.value.hits.filter(h => (!domain || h.domain === domain) && (!excludeSessionId || !('sessionId' in h) || h.sessionId !== excludeSessionId) && Math.max(h.keywordScore, h.semanticScore) >= 0.35).slice(0, 3).forEach(h => {
-      sources.push({ id: `H${sources.length + 1}`, kind: i === 0 ? 'memory' : 'meeting', title: redactSecrets(h.title + ('date' in h && h.date ? ' · ' + h.date : '')).slice(0, 180), text: redactSecrets(h.snippet).slice(0, 1500), ...('recordId' in h ? { recordId: h.recordId, sessionId: h.sessionId, domain: h.domain, month: h.month, filename: h.filename } : { memoryId: h.id, domain: h.domain }) })
+  for (const result of results) if (result.status === 'rejected' && result.reason instanceof AskProcessError) throw result.reason
+  const keep = (h: { domain?: string; keywordScore: number; semanticScore: number; sessionId?: string }) =>
+    (!domain || h.domain === domain) && (!excludeSessionId || !('sessionId' in h) || h.sessionId !== excludeSessionId) && Math.max(h.keywordScore, h.semanticScore) >= ASK_HIT_MIN
+  // id first: the same key order as before, so an unchanged search yields the same prompt bytes.
+  const source = (s: Omit<AskSource, 'id'>): AskSource => ({ id: `H${sources.length + 1}`, ...s })
+  // Memories. 6.76.2: when memory search did not answer (it failed, its meaning arm failed, or it found nothing), the
+  // owner's notes are also read from the memory bridge listing and matched by keyword (cos-bridge-notes.ts, shared with
+  // live cues). The public memory runtime keeps them only there. A memory search that answers is used exactly as before.
+  const memory = results[0]
+  if (memory.status === 'rejected') notices.push('COS memory search is unavailable.')
+  else if (semantic && !memory.value.semanticAvailable) notices.push('COS memory semantic search is unavailable; local keyword results are shown.')
+  const memoryRaw = memory.status === 'fulfilled' ? memory.value.hits : []
+  const memoryHits = memoryRaw.filter(keep)
+  const fused = new RankFusion<Omit<AskSource, 'id'> & { listed?: true }>()
+  fused.add(memoryHits.map(h => ({ key: `memory:${h.id}`, item: { kind: 'memory' as const, title: redactSecrets(h.title).slice(0, 180), text: redactSecrets(h.snippet).slice(0, 1500), memoryId: h.id, domain: h.domain } })))
+  const memoryDidNotAnswer = memoryRaw.length === 0 || (memory.status === 'fulfilled' && semantic && !memory.value.semanticAvailable)
+  if (memoryDidNotAnswer && !signal?.aborted) {
+    let listed: BridgeMemory[] = []
+    try { listed = await bridge(signal) } catch { /* no listing: the notices above stand */ }
+    fused.add(scoreBridgeMemories(listed, query).filter(x => x.score >= ASK_HIT_MIN && (!domain || x.row.domain === domain)).map(({ row }) => {
+      const date = localDateOf(row.created_at)
+      const title = row.summary || row.content.split('\n').find(l => l.trim()) || row.id
+      return { key: `memory:${row.id}`, item: { kind: 'memory' as const, title: redactSecrets(title.replace(/\s+/g, ' ').trim().slice(0, 140) + (date ? ' · ' + date : '')).slice(0, 180), text: redactSecrets(row.content).slice(0, 1500), memoryId: row.id, domain: row.domain, listed: true as const } }
+    }))
+  }
+  const memorySources = fused.ranked(3)
+  for (const { listed, ...s } of memorySources) sources.push(source(s))
+  if (memorySources.some(s => s.listed)) notices.push('COS also searched the notes in its memory list by keyword.')
+  // Earlier meetings: unchanged.
+  const meetings = results[1]
+  if (meetings.status === 'rejected') notices.push('Earlier meeting search is unavailable.')
+  else {
+    if (semantic && !meetings.value.semanticAvailable) notices.push('Earlier meeting semantic search is unavailable; local keyword results are shown.')
+    meetings.value.hits.filter(keep).slice(0, 3).forEach(h => {
+      sources.push(source({ kind: 'meeting', title: redactSecrets(h.title + (h.date ? ' · ' + h.date : '')).slice(0, 180), text: redactSecrets(h.snippet).slice(0, 1500), recordId: h.recordId, sessionId: h.sessionId, domain: h.domain, month: h.month, filename: h.filename }))
     })
-  })
+  }
   if (!sources.length) notices.push('No relevant COS history was found.')
   return { sources, notices }
 }

package/server/lib/live-cues-v2-notes.ts

@@ -0,0 +1,152 @@
+// Live cues v2 notes fallback (6.76.2). When cue_memory.py is missing, fails or times out (any Mac but Miles's has no such
+// script), the memory arm looks in the owner's own COS instead, with no model call and no query leaving the Mac:
+//   - searchMemories and searchMeetingLibrary, the search the Live COS Ask uses, in its keyword-only mode (semantic: false),
+//   - the memory bridge listing (`cos_api_bridge.py memory`, what COS Control's Memory list shows), where the public memory
+//     runtime 0.1.0 keeps the owner's notes (cos-bridge-notes.ts, shared with the Live COS Ask).
+// The window is never sent as a query. A few salient words are taken from it, and the candidates are ranked by
+// reciprocal rank fusion (k=60, as cue_memory.py does). The Jev or SubQ judge then decides relevance, exactly as for
+// cue_memory candidates. The whole arm is bounded by the 3 s dense budget of cue_memory.py. Nothing here logs.
+
+import { searchMemories, type ContextSearchHit } from './context-library-search.js'
+import { searchMeetingLibrary, type MeetingSearchHit } from './meeting-library-search.js'
+import { listBridgeMemories, localDateOf, RankFusion, scoreBridgeMemories, type BridgeMemory } from './cos-bridge-notes.js'
+export { localDateOf, normalizeBridgeMemories, type BridgeMemory } from './cos-bridge-notes.js'
+
+/** Mirrors cue_memory.py DENSE_BUDGET_S: the notes arm never takes longer than its dense arm may. */
+export const NOTES_BUDGET_MS = 3_000
+export const NOTES_TOP = 4
+const NOTE_CHARS = 520
+const TITLE_CHARS = 90
+
+export interface NoteCandidate { id: string; date: string; title: string; notes: string; key: string }
+export interface NotesResult { notes: NoteCandidate[]; error?: string }
+
+export interface NotesSearchers {
+  memories(query: string, signal: AbortSignal): Promise<ContextSearchHit[]>
+  meetings(query: string, signal: AbortSignal): Promise<MeetingSearchHit[]>
+  bridge(signal: AbortSignal, timeoutMs: number): Promise<BridgeMemory[]>
+}
+
+// cue_memory.py STOP, plus conversational filler that ASR produces and that would match every note.
+const STOP = new Set(`a an the and or but if then so of to in on at for with from by as is are was were be been being it its this that these those
+i you he she we they me him her us them my your our their what which who whom whose when where why how all any both each few more most other
+some such no nor not only own same than too very can will just don should now do does did doing have has had having would could might must
+shall may yeah yes okay ok like um uh gonna wanna kind sort really right know think going get got one two also there here about into over again
+further once out up down off say said says thing things lot gotta yep nope hmm mhm let lets thats theres dont didnt doesnt cant wont isnt im ive
+youre were theyre hes shes its okay alright actually basically literally maybe probably pretty much well good great cool sure thank thanks
+because cause want wanted need needs make made take took come came look looking see saw tell told talk talking mean means time today tomorrow
+yesterday week year day back still even something someone anything everything nothing way guess feel`.split(/\s+/).filter(Boolean))
+
+// Capitalised in every sentence position, so a capital says nothing about them being a name.
+const CALENDAR = new Set('monday tuesday wednesday thursday friday saturday sunday january february march april may june july august september october november december'.split(' '))
+
+/** The most salient words of the window, most salient first: frequency, a bonus for the last ~600 characters (what the
+ *  room is on now, the slice cue_memory.py embeds) and for a capitalised use mid-sentence (likely a name). Tokens use the
+ *  library tokenizer's alphabet ([a-z0-9]) so every term can match. */
+export function notesQueryTerms(window: string, max = 6): string[] {
+  const recentFrom = Math.max(0, window.length - 600)
+  const stats = new Map<string, { n: number; recent: boolean; proper: boolean; last: number }>()
+  for (const m of window.matchAll(/[A-Za-z0-9]+/g)) {
+    const raw = m[0], term = raw.toLowerCase(), at = m.index ?? 0
+    if (term.length < 3 || STOP.has(term) || /^\d{1,2}$/.test(term)) continue
+    const st = stats.get(term) ?? { n: 0, recent: false, proper: false, last: 0 }
+    st.n += 1
+    st.last = at
+    if (at >= recentFrom) st.recent = true
+    const before = window.slice(Math.max(0, at - 2), at)
+    if (/^[A-Z]/.test(raw) && !/[.!?\n]\s*$/.test(before) && at > 0) st.proper = true
+    stats.set(term, st)
+  }
+  return [...stats.entries()]
+    .map(([term, st]) => ({ term, score: st.n + (st.recent ? 0.5 : 0) + (st.proper && !CALENDAR.has(term) ? 1 : 0), last: st.last }))
+    .sort((a, b) => b.score - a.score || b.last - a.last)
+    .slice(0, max)
+    .map(x => x.term)
+}
+
+/** Two keyword queries: the top four terms (a note must share two of them, or one in its title, to match) and the top
+ *  two (either one matches). Distinct, in that order. */
+export function notesQueries(terms: string[]): string[] {
+  const qs = [terms.slice(0, 4).join(' '), terms.slice(0, 2).join(' ')].filter(q => q.trim())
+  return [...new Set(qs)]
+}
+
+const dateOf = localDateOf
+const flat = (v: unknown, max: number): string => (typeof v === 'string' ? v.replace(/\s+/g, ' ').trim().slice(0, max) : '')
+
+function memoryCandidate(hit: ContextSearchHit): NoteCandidate | null {
+  if (!hit.id) return null
+  return { id: '', date: dateOf(hit.created_at), title: flat(hit.title || hit.id, TITLE_CHARS), notes: flat(hit.snippet || hit.title, NOTE_CHARS), key: `memory:${hit.id}` }
+}
+function meetingCandidate(hit: MeetingSearchHit): NoteCandidate | null {
+  if (!hit.recordId) return null
+  return { id: '', date: dateOf(hit.date), title: flat(hit.title, TITLE_CHARS), notes: flat(hit.snippet || hit.title, NOTE_CHARS), key: `meeting:${hit.recordId}` }
+}
+function bridgeCandidate(row: BridgeMemory): NoteCandidate {
+  const firstLine = row.content.split('\n').find(l => l.trim()) ?? row.id
+  return { id: '', date: dateOf(row.created_at), title: flat(row.summary || firstLine, TITLE_CHARS), notes: flat(row.content, NOTE_CHARS), key: `memory:${row.id}` }
+}
+
+/** Bridge rows ranked for one query, best first (the shared scorer). */
+export function rankBridgeMemories(rows: BridgeMemory[], query: string): BridgeMemory[] {
+  return scoreBridgeMemories(rows, query).map(x => x.row)
+}
+
+export const realNotesSearchers: NotesSearchers = {
+  memories: async (query, signal) => (await searchMemories({ query, limit: 10, semantic: false, signal })).hits,
+  meetings: async (query, signal) => (await searchMeetingLibrary({ query, limit: 10, semantic: false, signal })).hits,
+  bridge: (signal, timeoutMs) => listBridgeMemories(signal, timeoutMs),
+}
+
+/**
+ * Candidates for the judge from the owner's own COS. `before` is exclusive (YYYY-MM-DD), like cue_memory.py; a note with
+ * no date is kept. `sessionId` drops the meeting being recorded if the library already holds a copy of it. Never throws:
+ * a source that fails is skipped, and running out of budget returns what was found so far with `error: notes_timeout`.
+ */
+export async function notesMemory(window: string, before: string, signal: AbortSignal,
+  opts: { sessionId?: string; budgetMs?: number; searchers?: NotesSearchers; top?: number } = {}): Promise<NotesResult> {
+  const budgetMs = opts.budgetMs ?? NOTES_BUDGET_MS
+  const searchers = opts.searchers ?? realNotesSearchers
+  const top = opts.top ?? NOTES_TOP
+  const terms = notesQueryTerms(window)
+  if (!terms.length) return { notes: [], error: 'notes_no_terms' }
+  const queries = notesQueries(terms)
+  const local = new AbortController()
+  const onAbort = () => local.abort()
+  signal.addEventListener('abort', onAbort, { once: true })
+  if (signal.aborted) local.abort()
+
+  const fused = new RankFusion<NoteCandidate>()
+  const failed: string[] = []
+  // The date bound applies before ranking, so a dropped note never takes a rank from one that stays.
+  const add = (list: Array<NoteCandidate | null>) => {
+    fused.add(list.filter((c): c is NoteCandidate => !!c && !(c.date && c.date >= before)).map(c => ({ key: c.key, item: c })))
+  }
+  const dropLive = (hits: MeetingSearchHit[]) => hits.filter(h => !(opts.sessionId && h.sessionId === opts.sessionId))
+
+  const work = (async () => {
+    const bridge = searchers.bridge(local.signal, budgetMs).catch(() => { failed.push('bridge'); return [] as BridgeMemory[] })
+    for (const q of queries) {
+      if (local.signal.aborted) return
+      try { add((await searchers.memories(q, local.signal)).map(memoryCandidate)) } catch { failed.push('memories') }
+      if (local.signal.aborted) return
+      try { add(dropLive(await searchers.meetings(q, local.signal)).map(meetingCandidate)) } catch { failed.push('meetings') }
+    }
+    const rows = await bridge
+    if (local.signal.aborted) return
+    for (const q of queries) add(rankBridgeMemories(rows, q).map(bridgeCandidate))
+  })()
+
+  let timer: ReturnType<typeof setTimeout> | undefined
+  const timedOut = await Promise.race([
+    work.then(() => false),
+    new Promise<boolean>(r => { timer = setTimeout(() => r(true), budgetMs) }),
+  ])
+  clearTimeout(timer)
+  local.abort()
+  signal.removeEventListener('abort', onAbort)
+  const notes = fused.ranked(top).map((c, i) => ({ ...c, id: `M${i + 1}` }))
+  if (signal.aborted) return { notes: [] }
+  if (timedOut) return { notes, error: 'notes_timeout' }
+  return failed.length ? { notes, error: `notes_${[...new Set(failed)].sort().join('_')}_failed` } : { notes }
+}