@gotcos/glasses-server 6.80.0 → 6.81.0

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## 6.81.0 - The Mac saves a stopped meeting on its own once it holds every chunk
+
+Miles, 2026-10-20: "if the application isn't in the foreground, it can fail to save the meetings". Both G2 meetings that day saved only once the phone came back on screen: the phone's Stop needs IndexedDB, and iOS suspends IndexedDB while the companion is hidden (11:19 qbbgyq: Stop 12:43, `stop_blocked`, "Load failed", saved 12:47 by a new WebView; 14:07 mip9qb: Stop 15:13:50, saved 15:14:37 only after the phone was visible). The full map is `docs/meeting-autonomous-save.md`.
+
+- **Client matrix.** Server only. Nothing changes until the companion sends the new Stop (a companion release, not in this one). Older companions never call the new route and save exactly as before.
+- **The phone's Stop, durable.** `POST /api/meeting/sessions/:id/stop` `{finalChunkIndex, serverInstanceId}`: one small fetch a hidden phone can still send. The server pin is required. It is written to `data/meeting-stop-intents.json` (0600, atomic) before the 202, so a restart keeps it. A repeat is idempotent; a higher index raises it, a lower one never lowers it. A Stop behind what the Mac already holds is refused 409 `final_index_behind_server`. It never closes the session and never refuses a chunk.
+- **The Mac saves only a complete capture.** Once every chunk 0..finalChunkIndex has arrived and finished ASR, and 45 s have passed since the Stop and since the last chunk (so a phone on screen saves first), the Mac runs the same save the phone's `POST /meeting/save` runs: one lock, one idempotent receipt. A gap means audio exists only on the phone, so the Mac waits and the late chunks land in the SAME live session. There is no timeout that saves with a gap: a gap that never fills is left to the existing 4 h stranded sweep, unchanged. A chunk past the Stop revokes it (the meeting is still recording). Checked every 15 s while a Stop waits, only while admissions are open and session recovery has run.
+- **The phone coming back.** Status answers `saved` with the receipt; `POST /meeting/save` replays it; and a chunk the phone re-sends because its answer was lost while hidden is answered from the saved sidecar instead of 410, so the phone no longer reads that state as a collision. This replay is only for meetings the Mac saved itself; every other closed session still answers 410.
+- **Telemetry.** `[meeting/auto-save]` lines and `data/meeting-autonomous-save.jsonl`: `stop_received`, `waiting` (once per change, with missing count and sample), `finalized` (chunks, canonical, gaps, waited ms), `phone_saved` (or `client_saved` for an unpinned save such as the stranded sweep's), `phone_confirmed` (how and how long after), `late_replay`, `late_chunk_refused`, `revoked`, `stood_down`, `finalize_failed`. The status route carries `stopIntent` additively. `recording_stop` carries `savedBy: "server"` for the Mac's own saves.
+- **Unchanged.** Transcription engines, the G2 matching thresholds, the restart and maintenance gate semantics, the stranded sweeper, and the save route's answers (its body moved into one shared `performSave`; the mutation gate anchor `cx-6533-save-nothing-to-save` follows it).
+- **Checks.** Full suite 8,462 passed, 0 failed, 3 skipped (557 files); `tsc --noEmit` clean. `server/scripts/autonomous-save-mutation-gate.mjs` (not packaged): green baseline (63 tests in 4 files), 42 of 42 mutants killed, each by a named test. The moved `cx-6533-save-nothing-to-save` anchor re-runs killed. Journeys: phone hidden after Stop (the Mac saves alone), phone back late with missing chunks (merged into one meeting), phone and Mac racing (one meeting), against the real chunk and save routes. Needs the companion release to send the Stop before it does anything on a real phone.
+
 ## 6.80.0 - Answer with your own key (opt in, off by default)
 
 You can now give COS your own provider key (OpenRouter, Anthropic, OpenAI, or a compatible endpoint) and pick a key profile for a thread, so that thread answers on the key instead of your Claude or ChatGPT plan. **This is opt in. Without a key, nothing changes:** with `COS_KEY_LANES` unset or `0`, or with lanes on but no key profile saved, the server answers, spawns and writes exactly as 6.79.1 did. Turning it on and saving keys happens in COS Control on this Mac.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.80.0",
+  "version": "6.81.0",
   "description": "COS Glasses: self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {
@@ -54,6 +54,7 @@
     "!server/scripts/work-search-mutation-gate.mjs",
     "!server/scripts/fact-check-mutation-gate.mjs",
     "!server/scripts/stale-session-mutation-gate.mjs",
+    "!server/scripts/autonomous-save-mutation-gate.mjs",
     "!server/scripts/stt-mutation-gate.mjs",
     "!server/scripts/dictation-stt-mutation-gate.mjs",
     "!server/scripts/pairing-mutation-gate.mjs",

package/server/index.ts

@@ -74,7 +74,7 @@ import { nativeHead, realNativeHeadDeps, registerClaudeTranscriptHint } from './
 import { threadOccupancy, holderActivity } from './lib/thread-occupancy.js'
 import { displayRouter } from './routes/display.js'
 import { transcribeStreamRouter, getActiveTranscriptionSessionCount } from './routes/transcribe-stream.js'
-import { meetingRouter, resumeMeetingFinalizationJobs, scheduleTranscriptCleanupSweep, transcriptCleanupRouteDeps } from './routes/meeting.js'
+import { meetingRouter, resumeAutonomousMeetingSaves, resumeMeetingFinalizationJobs, scheduleTranscriptCleanupSweep, transcriptCleanupRouteDeps } from './routes/meeting.js'
 import { createTranscriptCleanupRouter } from './routes/transcript-cleanup.js'
 import { meetingsRouter } from './routes/meetings.js'
 import { openaiCompatRouter } from './routes/openai-compat.js'
@@ -1473,6 +1473,8 @@ listenRequiredServers(listeners).then(() => {
     // Resume already-saved meetings whose post-response HQ/operations work
     // was interrupted by a prior server update or process exit.
     resumeMeetingFinalizationJobs()
+    // 6.81.0: Stops the phone sent before the last exit; the server saves them once complete.
+    resumeAutonomousMeetingSaves()
     // 6.77.0: transcript cleanup data whose meeting is gone, and screen text past retention.
     scheduleTranscriptCleanupSweep()
 

package/server/lib/meeting-autonomous-finalize.ts

@@ -0,0 +1,267 @@
+// The server finishes a stopped G2 meeting on its own (6.81.0).
+//
+// Miles, 2026-10-20: "if the application isn't in the foreground, it can fail to save the
+// meetings". Once the phone has told the server its meeting stopped (lib/meeting-stop-
+// intents.ts) and the server holds every chunk it captured, nothing is left that needs the
+// phone, so the server runs the same save the phone would have run. The phone, when it
+// comes back on screen, finds a saved meeting and adopts the receipt.
+//
+// THE ONE RULE: NEVER SAVE A CAPTURE THAT IS NOT COMPLETE. The server saves on its own only
+// when its ledger holds every index 0..N (N = the phone's last captured index) and every one
+// of them has finished ASR. A gap means audio exists only on the phone, so the server waits
+// and the session stays live: the phone's late upload lands in the SAME session (the merge)
+// and the next check saves. There is no shorter timeout that saves with the gap, because a
+// save closes the session, and a chunk that arrives after the close is refused (410) and the
+// phone reads "server closed, local audio pending" as a collision it cannot resolve: the
+// meeting splits or the tail is lost. A gap that never fills is handed to the existing
+// stranded sweeper at its existing 4 h horizon, exactly as before this release. Waiting
+// costs only time; saving early costs audio.
+//
+// Why a settle delay as well: a phone that is on screen saves within a few seconds of Stop.
+// The server stands back for AUTONOMOUS_FINALIZE_SETTLE_MS after the Stop and after the last
+// chunk arrived, so a healthy phone's own save is the normal path and the server's is the
+// fallback. Both racing is safe anyway (one save lock, an idempotent save route), but not
+// racing is quieter.
+
+import type { StopIntent } from './meeting-stop-intents.js'
+
+/** Quiet time after the Stop and after the last chunk before the server saves on its own. */
+export const AUTONOMOUS_FINALIZE_SETTLE_MS = 45_000
+/** How often a waiting Stop is checked again. Cheap: an in-memory ledger read. */
+export const AUTONOMOUS_FINALIZE_POLL_MS = 15_000
+/** Missing indices kept in a log line. */
+const MISSING_SAMPLE = 8
+
+export interface SessionLedger {
+  state: 'active' | 'closed' | 'missing'
+  received: readonly number[]
+  asrCompleted: readonly number[]
+  maxChunkIndex: number
+  /** ms since epoch of the last chunk arrival, or null. */
+  lastActivityAt: number | null
+}
+
+export type AutonomousWaitReason = 'settling' | 'missing_chunks' | 'asr_pending' | 'session_unknown' | 'saving' | 'not_ready'
+export type AutonomousStandDownReason = 'already_saved' | 'closed_unsaved' | 'nothing_captured' | 'server_instance_mismatch'
+
+export type AutonomousDecision =
+  | { action: 'finalize'; chunks: number }
+  | { action: 'wait'; reason: AutonomousWaitReason; missing: number[]; missingCount: number; retryInMs: number }
+  | { action: 'revoke'; reason: 'chunk_beyond_final'; maxChunkIndex: number }
+  | { action: 'stand_down'; reason: AutonomousStandDownReason }
+
+function missingFrom(finalIndex: number, have: readonly number[]): { sample: number[]; count: number } {
+  const present = new Set(have)
+  const sample: number[] = []
+  let count = 0
+  for (let index = 0; index <= finalIndex; index++) {
+    if (present.has(index)) continue
+    count++
+    if (sample.length < MISSING_SAMPLE) sample.push(index)
+  }
+  return { sample, count }
+}
+
+/**
+ * What to do with a waiting Stop right now. Pure: every input is passed in.
+ *
+ * Order matters and each step is pinned by a test: a saved meeting is never saved again, a
+ * chunk past the Stop means the meeting is still recording (revoke, never save), and only a
+ * complete, fully transcribed, quiet capture is saved.
+ */
+export function decideAutonomousFinalize(input: {
+  intent: Pick<StopIntent, 'finalChunkIndex' | 'receivedAt'>
+  ledger: SessionLedger
+  now: number
+  alreadySaved: boolean
+  saving: boolean
+}): AutonomousDecision {
+  const { intent, ledger, now } = input
+  if (input.alreadySaved) return { action: 'stand_down', reason: 'already_saved' }
+  if (input.saving) return { action: 'wait', reason: 'saving', missing: [], missingCount: 0, retryInMs: AUTONOMOUS_FINALIZE_POLL_MS }
+  // A session closed WITHOUT a save receipt (expired, quarantined) is the stranded and
+  // quarantine paths' to finish. Saving here would race them.
+  if (ledger.state === 'closed') return { action: 'stand_down', reason: 'closed_unsaved' }
+  if (intent.finalChunkIndex < 0) return { action: 'stand_down', reason: 'nothing_captured' }
+  // The server holds audio the phone says it never captured: the phone resumed after this
+  // Stop, or the Stop is stale. Either way the meeting may still be recording.
+  if (ledger.maxChunkIndex > intent.finalChunkIndex) {
+    return { action: 'revoke', reason: 'chunk_beyond_final', maxChunkIndex: ledger.maxChunkIndex }
+  }
+  // An offline capture: the Stop arrived before any chunk did. Wait for the upload.
+  if (ledger.state === 'missing') {
+    return { action: 'wait', reason: 'session_unknown', missing: [], missingCount: intent.finalChunkIndex + 1, retryInMs: AUTONOMOUS_FINALIZE_POLL_MS }
+  }
+  const absent = missingFrom(intent.finalChunkIndex, ledger.received)
+  if (absent.count > 0) {
+    return { action: 'wait', reason: 'missing_chunks', missing: absent.sample, missingCount: absent.count, retryInMs: AUTONOMOUS_FINALIZE_POLL_MS }
+  }
+  const pending = missingFrom(intent.finalChunkIndex, ledger.asrCompleted)
+  if (pending.count > 0) {
+    return { action: 'wait', reason: 'asr_pending', missing: pending.sample, missingCount: pending.count, retryInMs: AUTONOMOUS_FINALIZE_POLL_MS }
+  }
+  const quietSince = Math.max(intent.receivedAt, ledger.lastActivityAt ?? 0)
+  const settleLeft = quietSince + AUTONOMOUS_FINALIZE_SETTLE_MS - now
+  if (settleLeft > 0) {
+    return { action: 'wait', reason: 'settling', missing: [], missingCount: 0, retryInMs: Math.min(settleLeft, AUTONOMOUS_FINALIZE_POLL_MS) }
+  }
+  return { action: 'finalize', chunks: intent.finalChunkIndex + 1 }
+}
+
+/** Expand `[start, end]` ranges (the status route's shape) into indices. */
+export function indicesFromRanges(ranges: ReadonlyArray<readonly [number, number]>): number[] {
+  const out: number[] = []
+  for (const [start, end] of ranges) for (let index = start; index <= end; index++) out.push(index)
+  return out
+}
+
+export type AutonomousSaveOutcome =
+  | { ok: true; filename: string; sidecarPath: string; chunkCount: number; canonicalCount: number; missingIndices: number[] }
+  | { ok: false; status: number; reason: string }
+
+export interface AutonomousFinalizerDeps {
+  waiting(): StopIntent[]
+  get(sessionId: string): StopIntent | null
+  update(sessionId: string, patch: Partial<StopIntent>): void
+  ledger(sessionId: string): SessionLedger
+  alreadySaved(sessionId: string): boolean
+  saving(sessionId: string): boolean
+  save(intent: StopIntent): Promise<AutonomousSaveOutcome>
+  /** Maintenance admissions open AND durable session recovery has run. */
+  ready(): boolean
+  now(): number
+  /** Returns a cancel function. Production timers are unref'd so they never hold the process. */
+  schedule(fn: () => void, ms: number): () => void
+  log(event: string, fields: Record<string, unknown>): void
+}
+
+export interface AutonomousFinalizer {
+  /** Check one session now (a Stop arrived, a boot). Never throws. */
+  check(sessionId: string, trigger: string): Promise<AutonomousDecision | null>
+  /** Check every waiting Stop, then re-arm while any remain. */
+  tick(trigger?: string): Promise<void>
+  /** Make sure a tick is scheduled. */
+  arm(ms?: number): void
+}
+
+export function createAutonomousFinalizer(deps: AutonomousFinalizerDeps): AutonomousFinalizer {
+  const inFlight = new Set<string>()
+  let cancel: (() => void) | null = null
+  let armedFor = Infinity
+
+  const arm = (ms = AUTONOMOUS_FINALIZE_POLL_MS) => {
+    const due = deps.now() + Math.max(0, ms)
+    if (cancel && armedFor <= due) return
+    cancel?.()
+    armedFor = due
+    cancel = deps.schedule(() => {
+      cancel = null
+      armedFor = Infinity
+      void finalizer.tick('poll')
+    }, Math.max(0, ms))
+  }
+
+  const check = async (sessionId: string, trigger: string): Promise<AutonomousDecision | null> => {
+    if (inFlight.has(sessionId)) return null
+    const intent = deps.get(sessionId)
+    if (!intent || intent.state !== 'waiting') return null
+    // A boot behind a closed maintenance gate has not adopted the persisted sessions yet,
+    // so "the server holds no chunks" is not evidence of anything. Wait, never decide.
+    if (!deps.ready()) {
+      return { action: 'wait', reason: 'not_ready', missing: [], missingCount: 0, retryInMs: AUTONOMOUS_FINALIZE_POLL_MS }
+    }
+    inFlight.add(sessionId)
+    try {
+      const now = deps.now()
+      const decision = decideAutonomousFinalize({
+        intent,
+        ledger: deps.ledger(sessionId),
+        now,
+        alreadySaved: deps.alreadySaved(sessionId),
+        saving: deps.saving(sessionId),
+      })
+      if (decision.action === 'stand_down') {
+        // A save the phone (or anyone) already made is the phone's save, not ours.
+        deps.update(sessionId, decision.reason === 'already_saved'
+          ? { state: 'saved', savedBy: intent.savedBy ?? 'phone', savedAt: intent.savedAt ?? now }
+          : { state: 'stood_down', reason: decision.reason })
+        deps.log('stood_down', { sessionId, reason: decision.reason, trigger, waitedMs: now - intent.receivedAt })
+        return decision
+      }
+      if (decision.action === 'revoke') {
+        deps.update(sessionId, { state: 'revoked', reason: decision.reason })
+        deps.log('revoked', { sessionId, reason: decision.reason, finalChunkIndex: intent.finalChunkIndex, maxChunkIndex: decision.maxChunkIndex, trigger })
+        return decision
+      }
+      if (decision.action === 'wait') {
+        const last = intent.lastWait
+        // One line per change of state, not one per poll.
+        if (!last || last.reason !== decision.reason || last.missingCount !== decision.missingCount) {
+          deps.update(sessionId, { lastWait: { reason: decision.reason, missingCount: decision.missingCount, missingSample: decision.missing, at: now } })
+          deps.log('waiting', { sessionId, reason: decision.reason, missingCount: decision.missingCount, missingSample: decision.missing, finalChunkIndex: intent.finalChunkIndex, trigger })
+        }
+        return decision
+      }
+      const outcome = await deps.save(intent)
+      const at = deps.now()
+      if (outcome.ok) {
+        deps.update(sessionId, {
+          state: 'saved', savedBy: 'server', savedAt: at,
+          filename: outcome.filename, sidecarPath: outcome.sidecarPath,
+          chunkCount: outcome.chunkCount, canonicalCount: outcome.canonicalCount, lastWait: null,
+        })
+        deps.log('finalized', {
+          sessionId, reason: 'stop_received_complete', trigger,
+          finalChunkIndex: intent.finalChunkIndex, chunks: outcome.chunkCount, canonical: outcome.canonicalCount,
+          gaps: outcome.missingIndices.length, filename: outcome.filename,
+          waitedMs: at - intent.receivedAt, phoneConfirmed: false,
+        })
+        return decision
+      }
+      // The phone saved between the decision and the lock: its save, not ours.
+      if (outcome.reason === 'already_saved') {
+        deps.update(sessionId, { state: 'saved', savedBy: 'phone', savedAt: at, lastWait: null })
+        deps.log('stood_down', { sessionId, reason: 'already_saved', trigger, waitedMs: at - intent.receivedAt })
+        return { action: 'stand_down', reason: 'already_saved' }
+      }
+      // The phone pinned another server instance: this Mac is not where it meant to save.
+      if (outcome.reason === 'server_instance_mismatch') {
+        deps.update(sessionId, { state: 'stood_down', reason: outcome.reason })
+        deps.log('stood_down', { sessionId, reason: outcome.reason, trigger })
+        return { action: 'stand_down', reason: 'server_instance_mismatch' }
+      }
+      // The phone's own save holds the lock: it wins, and the next check reads its receipt.
+      if (outcome.status === 409 && outcome.reason === 'save_in_progress') {
+        return { action: 'wait', reason: 'saving', missing: [], missingCount: 0, retryInMs: AUTONOMOUS_FINALIZE_POLL_MS }
+      }
+      // Nothing to save (every chunk was silence): the phone's own Stop says so on the lens.
+      if (outcome.status === 404) {
+        deps.update(sessionId, { state: 'stood_down', reason: outcome.reason })
+        deps.log('stood_down', { sessionId, reason: outcome.reason, trigger })
+        return { action: 'stand_down', reason: 'nothing_captured' }
+      }
+      deps.log('finalize_failed', { sessionId, status: outcome.status, reason: outcome.reason, trigger })
+      return { action: 'wait', reason: 'saving', missing: [], missingCount: 0, retryInMs: AUTONOMOUS_FINALIZE_POLL_MS }
+    } catch (error) {
+      deps.log('finalize_failed', { sessionId, status: 500, reason: error instanceof Error ? error.message.slice(0, 200) : 'error', trigger })
+      return null
+    } finally {
+      inFlight.delete(sessionId)
+    }
+  }
+
+  const finalizer: AutonomousFinalizer = {
+    check,
+    async tick(trigger = 'poll') {
+      let soonest = Infinity
+      for (const intent of deps.waiting()) {
+        const decision = await check(intent.sessionId, trigger)
+        if (decision?.action === 'wait') soonest = Math.min(soonest, decision.retryInMs)
+        else if (decision === null && deps.get(intent.sessionId)?.state === 'waiting') soonest = Math.min(soonest, AUTONOMOUS_FINALIZE_POLL_MS)
+      }
+      if (Number.isFinite(soonest)) arm(soonest)
+    },
+    arm,
+  }
+  return finalizer
+}

package/server/lib/meeting-stop-intents.ts

@@ -0,0 +1,277 @@
+// The phone's Stop, as the server hears it (6.81.0).
+//
+// WHY THIS EXISTS. Until 6.81.0 the server learned that a G2 meeting had ended only from
+// POST /api/meeting/save, and the phone sends that save only after its own finalize has
+// read IndexedDB, reconciled the server's ledger and drained every chunk. iOS suspends
+// IndexedDB while the companion is off screen, so a Stop pressed with the phone in a pocket
+// sat unsaved until the app came back on screen (2026-10-20: 11:19 meeting qbbgyq, Stop at
+// 12:43, `stop_blocked` and `foreground_reconcile_failed` "Load failed", saved only by a new
+// WebView at 12:47; 14:07 meeting mip9qb, Stop at 15:13:50, saved at 15:14:37 only once
+// the phone was visible). A fetch works while hidden; IndexedDB does not.
+//
+// WHAT A STOP INTENT IS. One small POST the phone can send the moment Stop is pressed,
+// before any IndexedDB work: "this meeting has ended, and the last chunk I captured is
+// index N". The server records it durably and from then on can finish the save itself
+// once it holds every chunk 0..N (lib/meeting-autonomous-finalize.ts decides when).
+//
+// WHAT IT IS NOT. It never closes the session, never refuses a chunk, and never saves by
+// itself. Chunks keep arriving into the same live session after it (that is the merge),
+// and a chunk past N cancels it, because a meeting that is still recording must never be
+// finalized.
+
+import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, statSync } from 'node:fs'
+import { dirname } from 'node:path'
+import { durableAtomicWriteFileSync } from './atomic-fs.js'
+import { dataPath } from './data-dir.js'
+import { LOCAL_FIRST_MEETING_IDLE_RETENTION_MS } from './local-first-meetings-contract.js'
+
+export const STOP_INTENTS_FILE_NAME = 'meeting-stop-intents.json'
+export const AUTONOMOUS_SAVE_LOG_NAME = 'meeting-autonomous-save.jsonl'
+
+/** A finished intent stays readable this long, so a late phone can still be answered and logged. */
+export const STOP_INTENT_TERMINAL_RETAIN_MS = 24 * 60 * 60_000
+/**
+ * A waiting intent outlives the session it describes by one retention horizon. By then the
+ * stranded sweeper (4 h idle) has promoted or quarantined the session and owns it.
+ */
+export const STOP_INTENT_WAITING_RETAIN_MS = 2 * LOCAL_FIRST_MEETING_IDLE_RETENTION_MS
+
+export type StopIntentState = 'waiting' | 'saved' | 'revoked' | 'stood_down'
+/** `other`: an unpinned save (the stranded sweep's own POST, a manual curl). */
+export type StopIntentSavedBy = 'server' | 'phone' | 'other'
+
+export interface StopIntentWait {
+  reason: string
+  missingCount: number
+  /** The first few missing indices, for the log. Never the whole list. */
+  missingSample: number[]
+  at: number
+}
+
+export interface StopIntent {
+  sessionId: string
+  /** The highest chunk index the phone captured. -1 = it captured nothing. */
+  finalChunkIndex: number
+  source: string
+  title?: string
+  domain?: string
+  serverInstanceId: string
+  /** Server clock, first receipt. The phone's clock is never read. */
+  receivedAt: number
+  updatedAt: number
+  /** How many times the phone sent it (a hidden phone retries). */
+  posts: number
+  state: StopIntentState
+  /** Why it is revoked or stood down. */
+  reason?: string
+  savedBy?: StopIntentSavedBy
+  savedAt?: number
+  filename?: string
+  sidecarPath?: string
+  chunkCount?: number
+  canonicalCount?: number
+  lastWait?: StopIntentWait | null
+  /** Set when the phone first reports back after the server saved on its own. */
+  phoneConfirmedAt?: number
+  phoneConfirmedBy?: string
+  /** Chunks the phone re-sent after the save that the saved meeting already held. */
+  lateReplays?: number
+  /** Chunks the phone sent after the save that the saved meeting did NOT hold. Should stay 0. */
+  lateRefused?: number
+  /** The state of an earlier Stop for this session that this one replaced. */
+  replaced?: StopIntentState
+}
+
+export type RecordStopIntentResult =
+  | { ok: true; intent: StopIntent; created: boolean; raised: boolean }
+  | { ok: false; reason: 'terminal'; intent: StopIntent }
+
+export interface StopIntentStore {
+  readonly path: string
+  get(sessionId: string): StopIntent | null
+  /** Waiting intents, oldest first. */
+  waiting(): StopIntent[]
+  /**
+   * Record or refresh the phone's Stop. Re-posting is idempotent; a higher final index
+   * raises it (never lowers it: the server must never finalize before the highest index the
+   * phone ever claimed has arrived).
+   */
+  record(input: { sessionId: string; finalChunkIndex: number; source: string; title?: string; domain?: string; serverInstanceId: string }): RecordStopIntentResult
+  update(sessionId: string, patch: Partial<StopIntent>): StopIntent | null
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value) && typeof value === 'object' && !Array.isArray(value)
+}
+
+function readIntents(path: string): Record<string, StopIntent> {
+  if (!existsSync(path)) return {}
+  try {
+    const parsed = JSON.parse(readFileSync(path, 'utf-8')) as unknown
+    if (!isRecord(parsed) || !isRecord(parsed.intents)) return {}
+    const out: Record<string, StopIntent> = {}
+    for (const [id, raw] of Object.entries(parsed.intents)) {
+      if (!/^[A-Za-z0-9:_-]{3,96}$/.test(id) || !isRecord(raw)) continue
+      const intent = raw as unknown as StopIntent
+      if (intent.sessionId !== id) continue
+      if (!Number.isInteger(intent.finalChunkIndex) || intent.finalChunkIndex < -1) continue
+      if (!Number.isFinite(intent.receivedAt) || !Number.isFinite(intent.updatedAt)) continue
+      if (!['waiting', 'saved', 'revoked', 'stood_down'].includes(intent.state)) continue
+      out[id] = intent
+    }
+    return out
+  } catch {
+    // A corrupt ledger is set aside, never silently trusted or deleted.
+    try { renameSync(path, `${path}.corrupt.${Date.now()}`) } catch {}
+    return {}
+  }
+}
+
+export function createStopIntentStore(options: { path?: string; now?: () => number } = {}): StopIntentStore {
+  const path = options.path ?? dataPath(STOP_INTENTS_FILE_NAME)
+  const now = options.now ?? Date.now
+  let cache: Record<string, StopIntent> | null = null
+
+  const load = (): Record<string, StopIntent> => {
+    if (!cache) cache = readIntents(path)
+    return cache
+  }
+  const prune = (intents: Record<string, StopIntent>, at: number) => {
+    for (const [id, intent] of Object.entries(intents)) {
+      const retain = intent.state === 'waiting' ? STOP_INTENT_WAITING_RETAIN_MS : STOP_INTENT_TERMINAL_RETAIN_MS
+      if (at - intent.updatedAt > retain) delete intents[id]
+    }
+  }
+  // Persisted before the caller answers, so a 2xx means a restart still knows the Stop.
+  const persist = (intents: Record<string, StopIntent>) => {
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 })
+    durableAtomicWriteFileSync(path, JSON.stringify({ schemaVersion: 1, intents }, null, 2), { mode: 0o600 })
+  }
+
+  return {
+    path,
+    get(sessionId) {
+      const intent = load()[sessionId]
+      return intent ? { ...intent } : null
+    },
+    waiting() {
+      return Object.values(load())
+        .filter(intent => intent.state === 'waiting')
+        .sort((a, b) => a.receivedAt - b.receivedAt)
+        .map(intent => ({ ...intent }))
+    },
+    record(input) {
+      const at = now()
+      const intents = load()
+      prune(intents, at)
+      const prior = intents[input.sessionId]
+      // A saved Stop is final. A revoked or stood-down one is history: the phone resumed and
+      // stopped again, so this is a new Stop and replaces it.
+      if (prior && prior.state === 'saved') return { ok: false, reason: 'terminal', intent: { ...prior } }
+      const existing = prior?.state === 'waiting' ? prior : undefined
+      if (existing) {
+        const raised = input.finalChunkIndex > existing.finalChunkIndex
+        const next: StopIntent = {
+          ...existing,
+          finalChunkIndex: Math.max(existing.finalChunkIndex, input.finalChunkIndex),
+          title: input.title ?? existing.title,
+          domain: input.domain ?? existing.domain,
+          updatedAt: at,
+          posts: existing.posts + 1,
+        }
+        intents[input.sessionId] = next
+        persist(intents)
+        return { ok: true, intent: { ...next }, created: false, raised }
+      }
+      const intent: StopIntent = {
+        sessionId: input.sessionId,
+        finalChunkIndex: input.finalChunkIndex,
+        source: input.source,
+        ...(input.title ? { title: input.title } : {}),
+        ...(input.domain ? { domain: input.domain } : {}),
+        serverInstanceId: input.serverInstanceId,
+        receivedAt: at,
+        updatedAt: at,
+        posts: 1,
+        state: 'waiting',
+        lastWait: null,
+        ...(prior ? { replaced: prior.state } : {}),
+      }
+      intents[input.sessionId] = intent
+      persist(intents)
+      return { ok: true, intent: { ...intent }, created: true, raised: false }
+    },
+    update(sessionId, patch) {
+      const intents = load()
+      const existing = intents[sessionId]
+      if (!existing) return null
+      const next: StopIntent = { ...existing, ...patch, sessionId, updatedAt: now() }
+      intents[sessionId] = next
+      try { persist(intents) } catch (error) {
+        console.error(`[meeting/auto-save] Could not persist the stop intent for ${sessionId}: ${error instanceof Error ? error.message : error}`)
+      }
+      return { ...next }
+    },
+  }
+}
+
+let defaultStore: StopIntentStore | null = null
+/** The process-wide store, created on first use (never at import: tests import this module). */
+export function getStopIntentStore(): StopIntentStore {
+  if (!defaultStore) defaultStore = createStopIntentStore()
+  return defaultStore
+}
+
+/** One JSON line per autonomous-save event, beside the server log line that says the same. */
+export function appendAutonomousSaveLog(event: string, fields: Record<string, unknown>, path = dataPath(AUTONOMOUS_SAVE_LOG_NAME)): void {
+  try {
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 })
+    appendFileSync(path, `${JSON.stringify({ at: new Date().toISOString(), event, ...fields })}\n`, { mode: 0o600 })
+  } catch { /* the console line is the fallback record */ }
+}
+
+export interface SavedChunkText {
+  text: string
+  speaker: string
+  elapsed: number
+  [key: string]: unknown
+}
+export type SavedChunkReplay = { kind: 'canonical'; chunk: SavedChunkText } | { kind: 'empty' } | null
+
+let sidecarCache: { path: string; mtimeMs: number; entries: Map<number, SavedChunkText> } | null = null
+
+/**
+ * What a meeting the server saved on its own holds at one chunk index, for answering a
+ * phone that re-sends that chunk after the save (its upload response was lost while it was
+ * hidden). `canonical`: the saved text. `empty`: the chunk arrived and was silence. `null`:
+ * the saved meeting never held this index, so the replay is refused as before (410).
+ *
+ * Read from the saved sidecar, not from memory, so it survives a restart. One sidecar is
+ * cached at a time: replays arrive in a burst for one meeting.
+ */
+export function savedChunkReplay(sidecarPath: string, chunkIndex: number, asrCompleted: readonly number[]): SavedChunkReplay {
+  let entries: Map<number, SavedChunkText>
+  try {
+    const mtimeMs = statSync(sidecarPath).mtimeMs
+    if (sidecarCache && sidecarCache.path === sidecarPath && sidecarCache.mtimeMs === mtimeMs) {
+      entries = sidecarCache.entries
+    } else {
+      const sidecar = JSON.parse(readFileSync(sidecarPath, 'utf-8')) as { chunkEntries?: unknown }
+      entries = new Map()
+      for (const entry of Array.isArray(sidecar.chunkEntries) ? sidecar.chunkEntries : []) {
+        const candidate = entry as { chunkIndex?: unknown; chunk?: unknown }
+        const chunk = candidate?.chunk as Partial<SavedChunkText> | undefined
+        if (!Number.isInteger(candidate?.chunkIndex) || !chunk) continue
+        if (typeof chunk.text !== 'string' || !chunk.text || typeof chunk.speaker !== 'string') continue
+        if (typeof chunk.elapsed !== 'number' || !Number.isFinite(chunk.elapsed)) continue
+        entries.set(candidate.chunkIndex as number, chunk as SavedChunkText)
+      }
+      sidecarCache = { path: sidecarPath, mtimeMs, entries }
+    }
+  } catch {
+    return null
+  }
+  const chunk = entries.get(chunkIndex)
+  if (chunk) return { kind: 'canonical', chunk }
+  return asrCompleted.includes(chunkIndex) ? { kind: 'empty' } : null
+}

package/server/routes/meeting.ts

@@ -11,6 +11,16 @@ import { createHash } from 'node:crypto'
 import { Router } from 'express'
 import { emitDisplay } from '../lib/display-bus.js'
 import { createStopRequestStore, isStopRequestRefusal, STOP_REQUEST_CLAIM_WINDOW_MS, type StopRequest, type StopRequestStore } from '../lib/meeting-stop-requests.js'
+import { appendAutonomousSaveLog, getStopIntentStore, type StopIntent, type StopIntentStore } from '../lib/meeting-stop-intents.js'
+import {
+  AUTONOMOUS_FINALIZE_POLL_MS,
+  AUTONOMOUS_FINALIZE_SETTLE_MS,
+  createAutonomousFinalizer,
+  indicesFromRanges,
+  type AutonomousFinalizer,
+  type AutonomousSaveOutcome,
+  type SessionLedger,
+} from '../lib/meeting-autonomous-finalize.js'
 import { cleanTranscriptLines } from '../lib/hallucination-filter.js'
 import { durableAtomicWriteFileSync } from '../lib/atomic-fs.js'
 import { appendCorrection, appliedCorrections, pendingCorrections } from '../lib/meeting-corrections.js'
@@ -231,10 +241,25 @@ interface MeetingSessionSource {
   delete(sessionId: string, options?: { preserveAudio?: boolean }): void
   /** 6.53.3: live, closed within its retention, or unknown (`getMeetingSessionStatus`). */
   getState?(sessionId: string): 'active' | 'closed' | 'missing'
+  /** 6.81.0: the received/ASR ledger the server's own save of a stopped meeting reads. */
+  getLedger?(sessionId: string): SessionLedger
 }
 
 const defaultSessionState = (sessionId: string): 'active' | 'closed' | 'missing' => getMeetingSessionStatus(sessionId).state
 
+/** 6.81.0: the live ledger as the autonomous finalizer reads it (the status route's own numbers). */
+function defaultSessionLedger(sessionId: string): SessionLedger {
+  const status = getMeetingSessionStatus(sessionId)
+  const lastActivityAt = status.lastActivityAt ? Date.parse(status.lastActivityAt) : NaN
+  return {
+    state: status.state,
+    received: indicesFromRanges(status.receivedRanges),
+    asrCompleted: indicesFromRanges(status.asrCompletedRanges),
+    maxChunkIndex: status.maxChunkIndex,
+    lastActivityAt: Number.isFinite(lastActivityAt) ? lastActivityAt : null,
+  }
+}
+
 export interface MeetingRouteDependencies {
   store?: MeetingStore
   sessions?: MeetingSessionSource
@@ -252,6 +277,16 @@ export interface MeetingRouteDependencies {
   stopRequests?: StopRequestStore
   /** 6.77.0: the post-save transcript cleanup (lib/transcript-cleanup.ts). */
   transcriptCleanup?: TranscriptCleanupRunner
+  /** 6.81.0: the phone's Stop, durable (lib/meeting-stop-intents.ts). */
+  stopIntents?: StopIntentStore
+  /** 6.81.0: the server's own save of a stopped meeting. Tests inject the clock, timer and gate. */
+  autonomousFinalize?: {
+    now?: () => number
+    schedule?: (fn: () => void, ms: number) => () => void
+    ready?: () => boolean
+    log?: (event: string, fields: Record<string, unknown>) => void
+    onCreate?: (finalizer: AutonomousFinalizer) => void
+  }
 }
 
 const activeFinalizationJobs = new Set<string>()
@@ -584,6 +619,21 @@ function publicDisposition(disposition: CaptureDisposition | null): Record<strin
   }
 }
 
+/** 6.81.0: the Stop the server holds, as the status and stop routes show it. Never a path. */
+function publicStopIntent(intent: StopIntent): Record<string, unknown> {
+  return {
+    finalChunkIndex: intent.finalChunkIndex,
+    state: intent.state,
+    receivedAt: new Date(intent.receivedAt).toISOString(),
+    savedBy: intent.savedBy ?? null,
+    savedAt: intent.savedAt ? new Date(intent.savedAt).toISOString() : null,
+    reason: intent.reason ?? null,
+    waitingFor: intent.state === 'waiting' && intent.lastWait
+      ? { reason: intent.lastWait.reason, missingCount: intent.lastWait.missingCount, missingSample: intent.lastWait.missingSample }
+      : null,
+  }
+}
+
 function suppliedServerPin(
   req: { get: (name: string) => string | undefined },
   fallback: unknown,
@@ -608,6 +658,83 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
   const stopRequests = deps.stopRequests ?? createStopRequestStore()
   setNamingSessionLiveness(id => sessions.getStartTime(id) !== null || savingSessions.has(id) || activeFinalizationJobs.has(id))
 
+  // ── 6.81.0: the server finishes a stopped meeting on its own ─────────────────────
+  // lib/meeting-stop-intents.ts says what a Stop intent is; lib/meeting-autonomous-
+  // finalize.ts says when the server may save (only a complete capture, never early).
+  const stopIntents = deps.stopIntents ?? getStopIntentStore()
+  const autoDeps = deps.autonomousFinalize ?? {}
+  const autoNow = autoDeps.now ?? Date.now
+  const ledgerFor = (sessionId: string): SessionLedger => (sessions.getLedger ?? defaultSessionLedger)(sessionId)
+  const autoLog = autoDeps.log ?? ((event: string, fields: Record<string, unknown>) => {
+    const line = `[meeting/auto-save] ${event} ${String(fields.sessionId ?? '')} ${JSON.stringify(fields)}`
+    if (event === 'finalize_failed' || event === 'revoked' || event === 'late_chunk_refused') console.warn(line)
+    else console.log(line)
+    appendAutonomousSaveLog(event, fields)
+  })
+
+  /** Someone saved a meeting the phone had told us about before the server did: theirs, not ours. */
+  const notePhoneSavedFirst = (sessionId: string, savedBy: 'phone' | 'other') => {
+    const intent = stopIntents.get(sessionId)
+    if (!intent || intent.state !== 'waiting') return
+    const at = autoNow()
+    stopIntents.update(sessionId, { state: 'saved', savedBy, savedAt: at, lastWait: null })
+    autoLog(savedBy === 'phone' ? 'phone_saved' : 'client_saved', { sessionId, waitedMs: at - intent.receivedAt, finalChunkIndex: intent.finalChunkIndex })
+  }
+  /** The phone came back after the server saved on its own. Logged once, with how it showed up. */
+  const notePhoneAfterAutonomousSave = (sessionId: string, via: string) => {
+    const intent = stopIntents.get(sessionId)
+    if (!intent || intent.state !== 'saved' || intent.savedBy !== 'server' || intent.phoneConfirmedAt) return
+    const at = autoNow()
+    stopIntents.update(sessionId, { phoneConfirmedAt: at, phoneConfirmedBy: via })
+    autoLog('phone_confirmed', { sessionId, via, sinceSaveMs: at - (intent.savedAt ?? at), lateReplays: intent.lateReplays ?? 0, lateRefused: intent.lateRefused ?? 0 })
+  }
+
+  const autonomousSave = async (intent: StopIntent): Promise<AutonomousSaveOutcome> => {
+    // The phone pinned one server instance. A different one (a reinstall) is not its Mac.
+    if (intent.serverInstanceId !== getServerInstanceId()) return { ok: false, status: 409, reason: 'server_instance_mismatch' }
+    const entries = sessions.getChunkEntries(intent.sessionId) ?? []
+    const canonicalCount = entries.filter(entry => entry?.chunk?.text).length
+    const integrity = sessions.getIntegrity(intent.sessionId)
+    let status = 0
+    let payload: Record<string, unknown> = {}
+    const saved = await performSave(
+      intent.sessionId,
+      { ...(intent.title ? { title: intent.title } : {}), ...(intent.domain ? { domain: intent.domain } : {}) },
+      (code, body) => { status = code; payload = body },
+      'server',
+    )
+    if (!saved || status !== 200) return { ok: false, status, reason: String(payload.reason ?? 'meeting_save_error') }
+    // Someone saved it between the decision and the lock: theirs, not ours.
+    if (payload.replayed === true) return { ok: false, status: 200, reason: 'already_saved' }
+    return {
+      ok: true,
+      filename: saved.filename,
+      sidecarPath: saved.sidecarPath,
+      chunkCount: intent.finalChunkIndex + 1,
+      canonicalCount,
+      missingIndices: integrity?.missingIndices ?? [],
+    }
+  }
+
+  const autonomousFinalizer = createAutonomousFinalizer({
+    waiting: () => stopIntents.waiting(),
+    get: sessionId => stopIntents.get(sessionId),
+    update: (sessionId, patch) => { stopIntents.update(sessionId, patch) },
+    ledger: ledgerFor,
+    alreadySaved: sessionId => store.findBySessionId(sessionId) !== null,
+    saving: sessionId => savingSessions.has(sessionId),
+    save: autonomousSave,
+    ready: autoDeps.ready ?? (() => maintenanceAdmissionsOpen() && durableSessionRecoveryHasRun()),
+    now: autoNow,
+    schedule: autoDeps.schedule ?? ((fn, ms) => {
+      const timer = setTimeout(fn, ms)
+      timer.unref?.()
+      return () => clearTimeout(timer)
+    }),
+    log: autoLog,
+  })
+  autoDeps.onCreate?.(autonomousFinalizer)
+
   let recoveryPendingLogged = false
   router.get('/meeting/sessions/:sessionId/status', (req, res) => {
     const sessionId = String(req.params.sessionId ?? '')
@@ -651,6 +778,9 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     // A saved meeting or a live session is the truth for itself; the quarantine is
     // read only when neither is.
     const disposition = state === 'saved' || state === 'active' ? null : readCaptureDisposition(sessionId)
+    // 6.81.0: a pinned status read is the phone; one after the server saved on its own is its return.
+    if (saved && pin) notePhoneAfterAutonomousSave(sessionId, 'status')
+    const intent = stopIntents.get(sessionId)
     res.set('Cache-Control', 'private, no-store')
     res.json({
       sessionId,
@@ -670,6 +800,8 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       // (null otherwise). Older clients ignore both.
       outcome: captureOutcome(state, disposition),
       disposition: publicDisposition(disposition),
+      // 6.81.0, additive: the Stop the server holds for this meeting, if any. Older clients ignore it.
+      stopIntent: intent ? publicStopIntent(intent) : null,
     })
   })
 
@@ -781,43 +913,124 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     res.json(stopRequestBody(request, savingSessions.has(sessionId) ? { finalizing: true } : {}))
   })
 
-  router.post('/meeting/save', async (req, res) => {
+  // ── 6.81.0: the phone's Stop ──────────────────────────────────────────────────────
+  // POST /meeting/sessions/:id/stop {finalChunkIndex, serverInstanceId}. One small fetch the
+  // phone can send the moment Stop is pressed, before any IndexedDB work, so a phone that is
+  // off screen still tells the Mac. It never closes the session and never refuses a chunk:
+  // the server saves on its own only once it holds every chunk 0..finalChunkIndex.
+  router.post('/meeting/sessions/:sessionId/stop', (req, res) => {
+    const sessionId = String(req.params.sessionId ?? '')
+    if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) {
+      res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
+      return
+    }
+    if (MAC_CAPTURE_ID.test(sessionId)) {
+      res.status(400).json({ error: 'A Mac recording stops from Record on Mac', reason: 'mac_capture' })
+      return
+    }
+    const body = req.body as Record<string, unknown> | undefined
+    const finalChunkIndex = body?.finalChunkIndex
+    if (!Number.isInteger(finalChunkIndex) || (finalChunkIndex as number) < -1 || (finalChunkIndex as number) > 1_000_000) {
+      res.status(400).json({ error: 'finalChunkIndex must be a whole number, -1 or more', reason: 'invalid_final_chunk_index' })
+      return
+    }
+    if ((body?.title !== undefined && typeof body.title !== 'string') || (body?.domain !== undefined && typeof body.domain !== 'string')) {
+      res.status(400).json({ error: 'title and domain must be strings', reason: 'invalid_metadata' })
+      return
+    }
+    const serverInstanceId = getServerInstanceId()
+    if (!serverInstanceId) {
+      res.status(503).json({ error: 'Server identity unavailable', reason: 'server_identity_unavailable' })
+      return
+    }
+    // Required, not optional: only a phone pinned to THIS Mac may hand it a Stop.
+    const pin = suppliedServerPin(req, body?.serverInstanceId)
+    if (!pin) {
+      res.status(400).json({ error: 'Server identity pin required', reason: 'server_identity_pin_required' })
+      return
+    }
+    if (pin !== serverInstanceId) {
+      res.status(409).json({ error: 'Server identity mismatch', reason: 'server_instance_mismatch' })
+      return
+    }
+    res.set('Cache-Control', 'private, no-store')
+    const saved = store.findBySessionId(sessionId)
+    if (saved) {
+      notePhoneAfterAutonomousSave(sessionId, 'stop_retry')
+      res.json({ sessionId, state: 'saved', saveReceipt: publicSaveResponse(saved, true) })
+      return
+    }
+    const ready = (autoDeps.ready ?? (() => maintenanceAdmissionsOpen() && durableSessionRecoveryHasRun()))()
+    // Before recovery has run the ledger is empty by construction, so it proves nothing:
+    // record the Stop and let the finalizer judge it once the gate opens.
+    const ledger = ready ? ledgerFor(sessionId) : null
+    if (ledger?.state === 'closed') {
+      res.status(409).json({ error: 'This meeting is closed without a save', reason: 'not_live', state: 'closed' })
+      return
+    }
+    if (ledger && ledger.maxChunkIndex > (finalChunkIndex as number)) {
+      // The Mac holds audio past the phone's last chunk. Never take that Stop.
+      res.status(409).json({ error: 'The Mac holds chunks past finalChunkIndex', reason: 'final_index_behind_server', maxChunkIndex: ledger.maxChunkIndex })
+      return
+    }
+    const source = typeof body?.source === 'string' && /^[a-z][a-z0-9_-]{0,31}$/.test(body.source) ? body.source : 'companion'
+    let result: ReturnType<StopIntentStore['record']>
+    try {
+      result = stopIntents.record({
+        sessionId,
+        finalChunkIndex: finalChunkIndex as number,
+        source,
+        ...(typeof body?.title === 'string' && body.title.trim() ? { title: body.title.slice(0, 160) } : {}),
+        ...(typeof body?.domain === 'string' && body.domain.trim() ? { domain: body.domain } : {}),
+        serverInstanceId,
+      })
+    } catch (error) {
+      // Not durable means not received: the phone must keep its own Stop path.
+      console.error(`[meeting/auto-save] Could not record the Stop for ${sessionId}: ${error instanceof Error ? error.message : error}`)
+      res.status(503).json({ error: 'Stop could not be recorded; retry', reason: 'stop_persistence_failed', retryable: true })
+      return
+    }
+    if (!result.ok) {
+      res.json({ sessionId, state: 'saved', stopIntent: publicStopIntent(result.intent) })
+      return
+    }
+    const intent = result.intent
+    if (result.created || result.raised) {
+      autoLog(result.created ? 'stop_received' : 'stop_raised', {
+        sessionId, source, finalChunkIndex: intent.finalChunkIndex, posts: intent.posts,
+        received: ledger?.received.length ?? null, replaced: intent.replaced ?? null,
+      })
+    }
+    void autonomousFinalizer.tick('stop_received')
+    res.status(202).json({
+      sessionId,
+      state: 'stop_received',
+      finalChunkIndex: intent.finalChunkIndex,
+      receivedAt: new Date(intent.receivedAt).toISOString(),
+      posts: intent.posts,
+      autonomousSave: { settleMs: AUTONOMOUS_FINALIZE_SETTLE_MS, pollMs: AUTONOMOUS_FINALIZE_POLL_MS },
+    })
+  })
+
+  /**
+   * The save itself, shared by the phone's POST /meeting/save and the server's own save of a
+   * stopped meeting (6.81.0). One body so the two can never drift: the same lock, the same
+   * idempotent receipt, the same durable sidecar-then-job order, and the same maintenance
+   * lease order (the finalization job's lease is taken before the save lease is released).
+   *
+   * `respond` is called exactly once, before any background work is scheduled, as the route
+   * always did. `origin` changes only bookkeeping: who is recorded as having saved, and the
+   * phone-confirmed line when the phone replays a save the server already made.
+   */
+  async function performSave(
+    sessionId: string,
+    body: Record<string, unknown> | undefined,
+    respond: (status: number, payload: Record<string, unknown>, noStore?: boolean) => void,
+    origin: 'phone' | 'client' | 'server',
+  ): Promise<SavedMeeting | null> {
     let lockedSessionId: string | null = null
     let maintenanceLease: MaintenanceWorkLease | undefined
     try {
-      const body = req.body as Record<string, unknown> | undefined
-      const sessionId = typeof body?.sessionId === 'string' ? body.sessionId : ''
-      if (!sessionId) {
-        res.status(400).json({ error: 'sessionId required', reason: 'missing_session_id' })
-        return
-      }
-      if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) {
-        res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
-        return
-      }
-      if (body?.title !== undefined && typeof body.title !== 'string') {
-        res.status(400).json({ error: 'Invalid title', reason: 'invalid_title' })
-        return
-      }
-      if (body?.domain !== undefined && typeof body.domain !== 'string') {
-        res.status(400).json({ error: 'Invalid domain', reason: 'invalid_domain' })
-        return
-      }
-      const serverInstanceId = getServerInstanceId()
-      if (!serverInstanceId) {
-        res.status(503).json({ error: 'Server identity unavailable', reason: 'server_identity_unavailable' })
-        return
-      }
-      const pin = suppliedServerPin(req, body?.serverInstanceId)
-      if (MAC_CAPTURE_ID.test(sessionId) && !pin) {
-        res.status(400).json({ error: 'Server identity pin required', reason: 'server_identity_pin_required' })
-        return
-      }
-      if (pin && pin !== serverInstanceId) {
-        res.status(409).json({ error: 'Server identity mismatch', reason: 'server_instance_mismatch' })
-        return
-      }
-
       // A response can be lost after both durable files were committed. Find
       // the sidecar by session ID so client retry/restart is idempotent.
       const alreadySaved = store.findBySessionId(sessionId)
@@ -833,16 +1046,16 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
           sessions,
           finalDiarize,
         })
-        res.set('Cache-Control', 'private, no-store')
-        res.json(publicSaveResponse(alreadySaved, true))
-        return
+        if (origin === 'phone') notePhoneAfterAutonomousSave(sessionId, 'save_replay')
+        respond(200, publicSaveResponse(alreadySaved, true), true)
+        return alreadySaved
       }
       if (MAC_CAPTURE_ID.test(sessionId)) {
         requireMacRecordingForSave(sessionId, body?.expectedChunkCount)
       }
       if (savingSessions.has(sessionId)) {
-        res.status(409).json({ error: 'Meeting save already in progress', reason: 'save_in_progress' })
-        return
+        respond(409, { error: 'Meeting save already in progress', reason: 'save_in_progress' })
+        return null
       }
       // Saving/finalizing an already-recording session is a drain
       // continuation. It must remain admitted so existing audio can reach a
@@ -858,10 +1071,10 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
         // lets a client stop asking ("nothing to save") instead of retrying a 404 all day.
         // Still 404, so every existing client reads it exactly as before.
         const known = (sessions.getState ?? defaultSessionState)(sessionId)
-        res.status(404).json(known === 'active' || known === 'closed'
+        respond(404, known === 'active' || known === 'closed'
           ? { error: `Nothing to save for session ${sessionId}`, reason: 'nothing_to_save', state: known }
           : { error: `No transcript found for session ${sessionId}`, reason: 'session_not_found' })
-        return
+        return null
       }
 
       const chunks = sessions.getChunks(sessionId) ?? []
@@ -913,6 +1126,10 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
         finalizationRequired,
         claimPending,
       })
+      // 6.81.0: who saved. A pinned save is the phone's; an unpinned one (the stranded sweep's
+      // own POST, a manual curl) is someone else's. Either closes a waiting Stop. The server's
+      // own save is recorded by its finalizer.
+      if (origin !== 'server') notePhoneSavedFirst(sessionId, origin === 'phone' ? 'phone' : 'other')
 
       // Two-phase replay intent: the canonical sidecar above is the recovery
       // source of truth, and this indexed job is its fast execution ledger.
@@ -965,6 +1182,8 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
             filename: saved.filename,
             durationMin: saved.durationMin,
             domain: saved.domain,
+            // 6.81.0, additive: the server saved this on its own after the phone's Stop.
+            ...(origin === 'server' ? { savedBy: 'server' } : {}),
           },
         })
       } catch (error) {
@@ -994,8 +1213,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
         finalizationJob = null
       }
 
-      res.set('Cache-Control', 'private, no-store')
-      res.json(publicSaveResponse(saved))
+      respond(200, publicSaveResponse(saved), true)
 
       if (finalizationJob) {
         scheduleFinalizationJob(finalizationJob, {
@@ -1007,17 +1225,68 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
           transcriptCleanup,
         })
       }
+      return saved
     } catch (error) {
       if (error instanceof MeetingStoreError) {
-        res.status(error.status).json({ error: error.message, reason: error.code })
-        return
+        respond(error.status, { error: error.message, reason: error.code })
+        return null
       }
       console.error('[meeting/save] Finalization failed:', error)
-      res.status(500).json({ error: 'Meeting save failed', reason: 'meeting_save_error' })
+      respond(500, { error: 'Meeting save failed', reason: 'meeting_save_error' })
+      return null
     } finally {
       maintenanceLease?.release()
       if (lockedSessionId) savingSessions.delete(lockedSessionId)
     }
+  }
+
+  router.post('/meeting/save', async (req, res) => {
+    let responded = false
+    const respond = (status: number, payload: Record<string, unknown>, noStore = false) => {
+      if (responded) return
+      responded = true
+      if (noStore) res.set('Cache-Control', 'private, no-store')
+      res.status(status).json(payload)
+    }
+    try {
+      const body = req.body as Record<string, unknown> | undefined
+      const sessionId = typeof body?.sessionId === 'string' ? body.sessionId : ''
+      if (!sessionId) {
+        res.status(400).json({ error: 'sessionId required', reason: 'missing_session_id' })
+        return
+      }
+      if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) {
+        res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
+        return
+      }
+      if (body?.title !== undefined && typeof body.title !== 'string') {
+        res.status(400).json({ error: 'Invalid title', reason: 'invalid_title' })
+        return
+      }
+      if (body?.domain !== undefined && typeof body.domain !== 'string') {
+        res.status(400).json({ error: 'Invalid domain', reason: 'invalid_domain' })
+        return
+      }
+      const serverInstanceId = getServerInstanceId()
+      if (!serverInstanceId) {
+        res.status(503).json({ error: 'Server identity unavailable', reason: 'server_identity_unavailable' })
+        return
+      }
+      const pin = suppliedServerPin(req, body?.serverInstanceId)
+      if (MAC_CAPTURE_ID.test(sessionId) && !pin) {
+        res.status(400).json({ error: 'Server identity pin required', reason: 'server_identity_pin_required' })
+        return
+      }
+      if (pin && pin !== serverInstanceId) {
+        res.status(409).json({ error: 'Server identity mismatch', reason: 'server_instance_mismatch' })
+        return
+      }
+      // Only the phone pins its saves (the local-first contract); the stranded sweep does not.
+      await performSave(sessionId, body, respond, pin ? 'phone' : 'client')
+    } catch (error) {
+      console.error('[meeting/save] Finalization failed:', error)
+      respond(500, { error: 'Meeting save failed', reason: 'meeting_save_error' })
+    }
   })
 
   // ── Record identity for the speaker surfaces (6.47.0) ─────────────────
@@ -2669,7 +2938,17 @@ async function finalizeBatch(options: {
   }
 }
 
-export const meetingRouter = createMeetingRouter()
+let defaultAutonomousFinalizer: AutonomousFinalizer | null = null
+export const meetingRouter = createMeetingRouter({ autonomousFinalize: { onCreate: finalizer => { defaultAutonomousFinalizer = finalizer } } })
+
+/**
+ * 6.81.0: at boot (once admissions open), pick up every Stop the server was holding when it
+ * last exited and check it again. A Stop is durable, so a restart between the Stop and the
+ * last chunk loses nothing: the finalizer waits for recovery, then for the chunks.
+ */
+export function resumeAutonomousMeetingSaves(): void {
+  void defaultAutonomousFinalizer?.tick('boot')
+}
 
 /** 6.77.0: what the transcript cleanup routes need from the meeting layer. */
 export function transcriptCleanupRouteDeps(store: MeetingStore = getMeetingStore()): TranscriptCleanupRouteDeps {

package/server/routes/transcribe-stream.ts

@@ -1,5 +1,6 @@
 import { MacParakeetUnavailableError, transcribeMacParakeet } from '../lib/mac-recording-asr.js'
 import { getMeetingStore } from '../lib/meeting-store.js'
+import { appendAutonomousSaveLog, getStopIntentStore, savedChunkReplay, type StopIntent } from '../lib/meeting-stop-intents.js'
 import { MAC_AUDIO, MAC_CAPTURE_ID, persistMacChunkReceipt, macError, registerMacRecording, requireMacRecording, readMacRecording, validateMacWav } from '../lib/mac-recording.js'
 import { AUTO_ENROLL_THRESHOLD } from '../lib/voiceprint-floor.js'
 import { readSpeakerPolicy, policyLabel, type SpeakerMode } from '../lib/meeting-speaker-policy.js'
@@ -2164,6 +2165,47 @@ interface StreamCandidateInput {
   mode?: string
 }
 
+/**
+ * 6.81.0: the phone re-sends a chunk after the server saved its meeting on its own.
+ *
+ * WHY. The server saves a stopped meeting itself only once it holds every chunk, so any chunk
+ * the phone still lists as unconfirmed is one whose upload reached the Mac and whose answer
+ * was lost while the phone was off screen. Before 6.81.0 such a replay was refused 410 and the
+ * phone, holding a closed meeting with "unconfirmed" audio, called it a collision and kept the
+ * audio forever. The saved meeting already holds that chunk, so it answers with the saved
+ * text, exactly as a live session answers a replayed index, and the phone adopts the receipt.
+ *
+ * ONLY for meetings the SERVER saved after a Stop: every other closed session answers 410 as
+ * before. A chunk the saved meeting never held is still refused, and is logged loudly, because
+ * the finalizer's rule (never save an incomplete capture) says it cannot happen.
+ */
+function replayAfterAutonomousSave(sessionId: string, chunkIndex: number): StreamChunkCompletionResponse | null {
+  let intent: StopIntent | null
+  try { intent = getStopIntentStore().get(sessionId) } catch { return null }
+  if (!intent || intent.state !== 'saved' || intent.savedBy !== 'server' || !intent.sidecarPath) return null
+  const closed = closedSessionRecords.get(sessionId)
+  const replay = savedChunkReplay(intent.sidecarPath, chunkIndex, closed?.asrCompletedIndices ?? [])
+  const store = getStopIntentStore()
+  if (!replay) {
+    store.update(sessionId, { lateRefused: (intent.lateRefused ?? 0) + 1 })
+    const fields = { sessionId, chunkIndex, finalChunkIndex: intent.finalChunkIndex, lateRefused: (intent.lateRefused ?? 0) + 1 }
+    console.warn(`[meeting/auto-save] late_chunk_refused ${sessionId} ${JSON.stringify(fields)}`)
+    appendAutonomousSaveLog('late_chunk_refused', fields)
+    return null
+  }
+  const at = Date.now()
+  store.update(sessionId, {
+    lateReplays: (intent.lateReplays ?? 0) + 1,
+    ...(intent.phoneConfirmedAt ? {} : { phoneConfirmedAt: at, phoneConfirmedBy: 'chunk_replay' }),
+  })
+  const fields = { sessionId, chunkIndex, kind: replay.kind, lateReplays: (intent.lateReplays ?? 0) + 1, sinceSaveMs: at - (intent.savedAt ?? at) }
+  console.log(`[meeting/auto-save] late_replay ${sessionId} ${JSON.stringify(fields)}`)
+  appendAutonomousSaveLog('late_replay', fields)
+  if (!intent.phoneConfirmedAt) appendAutonomousSaveLog('phone_confirmed', { sessionId, via: 'chunk_replay', sinceSaveMs: at - (intent.savedAt ?? at) })
+  if (replay.kind === 'canonical') return canonicalChunkResponse(replay.chunk as unknown as TranscriptChunk, sessionId, chunkIndex)
+  return emptyChunkResponse({ text: '', speaker: 'Ext', elapsed: 0, canonical: false }, sessionId, chunkIndex)
+}
+
 async function processStreamChunk(opts: {
   sessionId: string
   chunkIndex: number
@@ -2182,7 +2224,12 @@ async function processStreamChunk(opts: {
   const tReq = performance.now()
   validateSessionId(sessionId)
   validateChunkIndex(chunkIndex)
-  if (isSessionDeleted(sessionId)) throw makeHttpError(410, 'session is closed', 'session_closed')
+  if (isSessionDeleted(sessionId)) {
+    // 6.81.0: a meeting the server saved on its own answers a chunk it already holds.
+    const replay = replayAfterAutonomousSave(sessionId, chunkIndex)
+    if (replay) return replay
+    throw makeHttpError(410, 'session is closed', 'session_closed')
+  }
   if (audioBuffer.length < 100) throw makeHttpError(400, 'audio too short', 'audio_too_short')
 
   const audioSha256 = sha256Hex(audioBuffer)