@gotcos/glasses-server 6.83.0 → 6.85.0

package/server/routes/meeting.ts

@@ -6,7 +6,7 @@ import { readSpeakerPolicy, writeSpeakerPolicy, isSpeakerMode } from '../lib/mee
 
 import { existsSync, readdirSync, readFileSync, rmSync, statSync, unlinkSync } from 'node:fs'
 import { isWorthRecovering } from '../lib/quarantine-auto-recover.js'
-import { resolve } from 'node:path'
+import { basename, resolve } from 'node:path'
 import { createHash } from 'node:crypto'
 import { Router } from 'express'
 import { emitDisplay } from '../lib/display-bus.js'
@@ -129,6 +129,7 @@ import {
   analyzeTranscriptGaps,
   deleteSession,
   assertMacCaptureComplete,
+  discardSilentMacCapture,
   drainSessionAudioWrites,
   durableSessionRecoveryHasRun,
   getSessionChunkEntries,
@@ -805,6 +806,80 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     })
   })
 
+  // ── 6.83.2: discard a stranded Mac capture that held no sound ──────────────────────
+  // POST /meeting/sessions/:id/discard {confirm: true, serverInstanceId}. COS Control offers it only for a capture the
+  // server called no_speech or whose audio was all zeros; the server re-checks everything itself
+  // (transcribe-stream.ts discardSilentMacCapture) and never touches a capture with speech. Without `confirm: true`
+  // it answers 400 confirmation_required with what it WOULD do, and changes nothing.
+  router.post('/meeting/sessions/:sessionId/discard', async (req, res) => {
+    const sessionId = String(req.params.sessionId ?? '')
+    if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) {
+      res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
+      return
+    }
+    res.set('Cache-Control', 'private, no-store')
+    if (!MAC_CAPTURE_ID.test(sessionId)) {
+      res.status(400).json({ error: 'Only a Mac recording can be discarded here', reason: 'not_mac_capture' })
+      return
+    }
+    const body = (req.body ?? {}) as Record<string, unknown>
+    const serverInstanceId = getServerInstanceId()
+    if (!serverInstanceId) {
+      res.status(503).json({ error: 'Server identity unavailable', reason: 'server_identity_unavailable' })
+      return
+    }
+    const pin = suppliedServerPin(req, body.serverInstanceId)
+    if (!pin) {
+      res.status(400).json({ error: 'Server identity pin required', reason: 'server_identity_pin_required' })
+      return
+    }
+    if (pin !== serverInstanceId) {
+      res.status(409).json({ error: 'Server identity mismatch', reason: 'server_instance_mismatch' })
+      return
+    }
+    if (store.findBySessionId(sessionId)) {
+      res.status(409).json({ error: 'This recording is saved as a meeting', reason: 'already_saved' })
+      return
+    }
+    if (savingSessions.has(sessionId)) {
+      res.status(409).json({ error: 'This recording is being saved', reason: 'saving' })
+      return
+    }
+    const confirmed = body.confirm === true
+    const result = await discardSilentMacCapture(sessionId, { dryRun: !confirmed })
+    if (!result.ok && result.reason === 'session_not_found') {
+      // Already discarded (a retry after a lost answer): the quarantine says so, and the answer is the same.
+      const disposition = readCaptureDisposition(sessionId)
+      if (disposition?.quarantineReason === 'discarded_no_sound') {
+        res.json({ sessionId, discarded: true, replayed: true, quarantined: disposition.dirName, retainedUntil: disposition.retainedUntil })
+        return
+      }
+      res.status(404).json({ error: 'The server holds no live session for this recording', reason: 'session_not_found' })
+      return
+    }
+    if (!result.ok) {
+      const message: Record<string, string> = {
+        has_speech: 'This recording has speech; save it instead',
+        asr_in_progress: 'Audio is still being transcribed; try again in a moment',
+        chunk_in_progress: 'An audio chunk is still arriving; try again in a moment',
+        not_idle: 'This recording is still receiving audio',
+        not_mac_capture: 'Only a Mac recording can be discarded here',
+      }
+      res.status(409).json({ error: message[result.reason ?? ''] ?? 'Not discarded', reason: result.reason, receivedCount: result.receivedCount })
+      return
+    }
+    if (!confirmed) {
+      res.status(400).json({
+        error: 'Confirmation required', reason: 'confirmation_required',
+        preview: { sessionId, chunkFiles: result.chunkFiles, receivedCount: result.receivedCount, retentionHours: 24 },
+      })
+      return
+    }
+    console.warn(`[meeting/discard] Discarded no-sound Mac capture ${sessionId}: ${result.receivedCount} chunk(s) received, audio quarantined for 24 h`)
+    res.json({ sessionId, discarded: true, replayed: false, quarantined: result.quarantined ? basename(result.quarantined) : null,
+      chunkFiles: result.chunkFiles, receivedCount: result.receivedCount, retainedUntil: result.retainedUntil })
+  })
+
   // ── Stop a live G2 meeting from the Mac (COS Control) ────────────────────────────
   // The Mac never saves a live G2 session itself (lib/meeting-stop-requests.ts says why).
   // It asks the glasses: POST records the request and puts `meeting_stop_requested` on the

package/server/routes/prompt-drafts.ts

@@ -49,7 +49,10 @@ import {
   discardPolishPrewarm, isPrewarmModel, prewarmEnabled, PrewarmUnavailableError, runWarmPolish,
   startPolishPrewarm, takePolishPrewarm,
 } from '../lib/dictation-prewarm.js'
-import { getVocabulary } from '../lib/profile.js'
+import { getVocabulary, getWhisperCorrections } from '../lib/profile.js'
+import { correctionOnlyForms } from '../lib/glossary-learn.js'
+import { polishLinkProblem, renderSpokenPaths, spokenPathsEnabled } from '../lib/dictation-format.js'
+import { customInstructionsHash, readCustomInstructions } from '../lib/dictation-polish-instructions.js'
 import { createBreaker } from '../lib/claude-circuit.js'
 import { logTokenAudit } from '../lib/token-audit.js'
 import { emitDisplay } from '../lib/display-bus.js'
@@ -90,7 +93,7 @@ const autoCleanBreakers = {
 const autoCleanDefaultEnabled = () => ['1', 'true', 'on'].includes((process.env.COS_DICTATION_AUTOCLEAN ?? '').toLowerCase())
 
 /** 6.79.1, additive on finalize answers: why the polish model did not run (or did not finish). */
-export type PolishSkipped = 'disabled' | 'too_long' | 'breaker_open' | 'daily_cap' | 'failed' | 'clean'
+export type PolishSkipped = 'disabled' | 'too_long' | 'breaker_open' | 'daily_cap' | 'failed' | 'clean' | 'link_guard'
 /** 6.79.2, additive when finalize was given a prewarmToken: what became of that warm process. */
 export type PrewarmOutcome = 'used' | 'missed' | 'discarded'
 
@@ -107,7 +110,7 @@ function routeAutoClean(req: { body?: any; query?: any }): AutoCleanRequest {
 async function cleanOutboundDictation(
   text: string,
   opts: AutoCleanRequest & { bucket: PolishBucket; signal?: AbortSignal; prewarmToken?: string },
-): Promise<{ text: string; polishSkipped?: PolishSkipped; prewarm?: PrewarmOutcome }> {
+): Promise<PolishResult> {
   const result = await polishOutboundDictation(text, opts)
   // A warm process the model call did not take must not sit until its TTL.
   if (opts.prewarmToken && !result.prewarm) {
@@ -116,10 +119,23 @@ async function cleanOutboundDictation(
   return result
 }
 
+/** 6.85.0, additive and present only when the model was given the user's polish instructions. */
+interface PolishInstructionsUse { customInstructions?: true; instructionsHash?: string }
+type PolishResult = { text: string; polishSkipped?: PolishSkipped; prewarm?: PrewarmOutcome } & PolishInstructionsUse
+
+/**
+ * 6.85.0: the user's polish instructions apply to dictation (Mac dictation and G2 messages, which
+ * are surface "message", and prompt drafts). Meeting lines are a faithful record, so they stay on
+ * the built-in rules alone, the same way they skip the filler pass and spoken paths.
+ */
+export function polishInstructionsFor(bucket: PolishBucket): string {
+  return bucket === 'meeting' ? '' : readCustomInstructions().customInstructions
+}
+
 async function polishOutboundDictation(
   text: string,
   opts: AutoCleanRequest & { bucket: PolishBucket; signal?: AbortSignal; prewarmToken?: string },
-): Promise<{ text: string; polishSkipped?: PolishSkipped; prewarm?: PrewarmOutcome }> {
+): Promise<PolishResult> {
   let cleaned = applyNegativeRules(applyCorrections(text)).replace(/\s+/g, ' ').trim() || text
   // applyCorrections above is an EXACT string map, so it only fixes misspellings someone
   // already hand-authored. A novel miss ("Rileyy" for Riley, "Exampel" for Example) sails
@@ -144,6 +160,9 @@ async function polishOutboundDictation(
   }
   // 6.79.1: um/uh never survive a skipped polish. Meeting lines stay faithful.
   if (opts.bucket !== 'meeting' && fillerPassEnabled()) cleaned = stripDisfluencies(cleaned)
+  // 6.83.1: "forward slash pricing," is "/pricing," even when the model is skipped. One word
+  // at a phrase end only; slugs of several words are the model's (dictation-format.ts).
+  if (opts.bucket !== 'meeting' && spokenPathsEnabled()) cleaned = renderSpokenPaths(cleaned)
   if (!(opts.enabled ?? autoCleanDefaultEnabled())) return { text: cleaned, polishSkipped: 'disabled' }
   const model = opts.model ?? 'haiku'
   const autoCleanBreaker = autoCleanBreakers[model]
@@ -154,6 +173,10 @@ async function polishOutboundDictation(
   if (polishBudgetExhausted(opts.bucket)) return { text: cleaned, polishSkipped: 'daily_cap' }
   const startedAt = Date.now()
   recordPolishCall(opts.bucket)
+  // Read once per polish: the warm and cold paths see the same instructions.
+  const customInstructions = polishInstructionsFor(opts.bucket)
+  const instructionsHash = customInstructionsHash(customInstructions)
+  const used: PolishInstructionsUse = customInstructions ? { customInstructions: true, instructionsHash } : {}
   // 6.79.2: a warm process started at key press answers without the CLI's start-up cost.
   const warmEntry = opts.prewarmToken ? takePolishPrewarm(opts.prewarmToken, model) : null
   let prewarm: PrewarmOutcome | undefined = opts.prewarmToken ? 'missed' : undefined
@@ -161,24 +184,33 @@ async function polishOutboundDictation(
     let polished: string | null = null
     if (warmEntry) {
       try {
-        polished = (await runWarmPolish(warmEntry, cleaned, getVocabulary(), { signal: opts.signal })).trim()
+        polished = (await runWarmPolish(warmEntry, cleaned, getVocabulary(), { signal: opts.signal, customInstructions })).trim()
         prewarm = 'used'
       } catch (err) {
         // Nothing was sent: the cold path below is the same call, not a second one.
         if (!(err instanceof PrewarmUnavailableError)) throw err
       }
     }
-    if (polished === null) polished = (await autoCleanDictation(cleaned, getVocabulary(), { model, signal: opts.signal })).trim()
+    if (polished === null) polished = (await autoCleanDictation(cleaned, getVocabulary(), { model, signal: opts.signal, customInstructions })).trim()
     autoCleanBreaker.recordSuccess()
     logTokenAudit({
       source: 'g2-dictation-autoclean', model, inputChars: cleaned.length, outputChars: polished.length,
       durationMs: Date.now() - startedAt, caller: `dictation_autoclean_${opts.bucket}`,
+      polishInstructions: { on: Boolean(customInstructions), hash: instructionsHash },
     })
-    return { text: polished || cleaned, ...(prewarm ? { prewarm } : {}) }
+    // 6.83.1: the model never invents a link and never drops one the dictionary wrote. Its
+    // answer is refused (the pre-polish text goes out, polishSkipped "link_guard") rather than
+    // pasting a URL nobody said. The call still counted: it ran.
+    const linkProblem = polished ? polishLinkProblem(cleaned, polished, correctionOnlyForms(getWhisperCorrections()), getVocabulary()) : null
+    if (linkProblem) {
+      console.warn(`[prompt-draft] auto-clean answer refused: ${linkProblem}`)
+      return { text: cleaned, ...(prewarm ? { prewarm } : {}), polishSkipped: 'link_guard', ...used }
+    }
+    return { text: polished || cleaned, ...(prewarm ? { prewarm } : {}), ...used }
   } catch (err: any) {
     autoCleanBreaker.recordFailure()
     console.warn(`[prompt-draft] auto-clean failed (glossary-only): ${err?.message ?? err}`)
-    return { text: cleaned, polishSkipped: 'failed', ...(prewarm ? { prewarm } : {}) }
+    return { text: cleaned, polishSkipped: 'failed', ...(prewarm ? { prewarm } : {}), ...used }
   }
 }
 
@@ -206,7 +238,7 @@ promptDraftsRouter.post('/dictation/finalize', async (req, res) => {
 
   const abort = new AbortController()
   res.on('close', () => { if (!res.writableEnded) abort.abort() })
-  const { text: finalText, polishSkipped, prewarm } = await cleanOutboundDictation(text, {
+  const { text: finalText, polishSkipped, prewarm, customInstructions, instructionsHash } = await cleanOutboundDictation(text, {
     enabled: true,
     model,
     bucket: surface,
@@ -218,6 +250,8 @@ promptDraftsRouter.post('/dictation/finalize', async (req, res) => {
   res.json({
     text: finalText, surface, polished: finalText !== text,
     ...(polishSkipped ? { polishSkipped } : {}), ...(prewarm ? { prewarm } : {}),
+    // 6.85.0: only when the model was given the user's polish instructions (a hash, never the text).
+    ...(customInstructions ? { customInstructions, instructionsHash } : {}),
   })
 })
 
@@ -505,7 +539,7 @@ async function finalizeDraft(draftId: string, mode: 'hq' | 'fast', autoClean: Au
     await markPromptDraftError(draftId, 'No speech detected')
     throw new NoSpeechDetectedError()
   }
-  const { text: finalText, polishSkipped } = await cleanOutboundDictation(text, { ...autoClean, bucket: 'prompt_draft', signal })
+  const { text: finalText, polishSkipped, customInstructions, instructionsHash } = await cleanOutboundDictation(text, { ...autoClean, bucket: 'prompt_draft', signal })
   const finalized = await markPromptDraftFinalized(draftId, finalText)
   const qualities = transcriptRecords.map(record => record.actualQuality)
   const actualQuality: 'hq' | 'fast' | 'cloud' = qualities.includes('cloud')
@@ -535,6 +569,8 @@ async function finalizeDraft(draftId: string, mode: 'hq' | 'fast', autoClean: Au
     ...(engineReason ? { engineReason } : {}),
     // 6.79.1, additive.
     ...(polishSkipped ? { polishSkipped } : {}),
+    // 6.85.0, additive.
+    ...(customInstructions ? { customInstructions, instructionsHash } : {}),
   }
 }
 

package/server/routes/query-jobs.ts

@@ -1,5 +1,6 @@
 import { Router, type Request, type Response } from 'express'
 import { durableQueryJobsEnabled, messagesSteerEnabled } from '../lib/query-job-feature.js'
+import { ACTIVE_QUERY_JOBS_LIST_MAX, ACTIVE_QUERY_JOBS_PROTOCOL } from '../lib/query-job-active.js'
 import {
   QueryJobCoordinator,
   QueryJobCoordinatorError,
@@ -197,6 +198,27 @@ export function createQueryJobsRouter(
     }
   })
 
+  // 6.84.1: the in-flight jobs for COS Control's Running panel (docs/active-query-jobs.md).
+  // Read-only and in memory; registered ahead of `/query-jobs/:jobId`, which would answer
+  // 400 invalid_job_id for "active". A title is the prompt's first line, cut to 80
+  // characters; no prompt body, answer, activity or trail is ever in this answer.
+  router.get('/query-jobs/active', (_req, res) => {
+    try {
+      const now = Date.now()
+      const { items, count } = coordinator.activeJobs(now)
+      return res.json({
+        protocolVersion: ACTIVE_QUERY_JOBS_PROTOCOL,
+        enabled: enabled(),
+        now: new Date(now).toISOString(),
+        count,
+        items: items.slice(0, ACTIVE_QUERY_JOBS_LIST_MAX),
+      })
+    } catch (error) {
+      const wire = wireError(error)
+      return res.status(wire.status).json(wire.body)
+    }
+  })
+
   // Lost-202 recovery is keyed by the immutable client identity. Keep this
   // route explicit and ahead of the dynamic job lookup for future router
   // changes that may broaden the latter's matcher.

package/server/routes/transcribe-stream.ts

@@ -1,7 +1,7 @@
 import { MacParakeetUnavailableError, transcribeMacParakeet } from '../lib/mac-recording-asr.js'
 import { getMeetingStore } from '../lib/meeting-store.js'
 import { appendAutonomousSaveLog, getStopIntentStore, savedChunkReplay, type StopIntent } from '../lib/meeting-stop-intents.js'
-import { MAC_AUDIO, MAC_CAPTURE_ID, persistMacChunkReceipt, macError, registerMacRecording, requireMacRecording, readMacRecording, validateMacWav } from '../lib/mac-recording.js'
+import { MAC_AUDIO, MAC_CAPTURE_ID, closeMacRecording, persistMacChunkReceipt, macError, registerMacRecording, requireMacRecording, readMacRecording, validateMacWav } from '../lib/mac-recording.js'
 import { AUTO_ENROLL_THRESHOLD } from '../lib/voiceprint-floor.js'
 import { readSpeakerPolicy, policyLabel, type SpeakerMode } from '../lib/meeting-speaker-policy.js'
 // POST /api/transcribe-stream — Streaming transcription for continuous meeting capture
@@ -15,7 +15,8 @@ import { chmodSync, readFileSync, writeFileSync, existsSync, lstatSync, mkdirSyn
 import { writeFile } from 'node:fs/promises'
 import { resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
-import { getVocabulary, getOwnerName, getOwnerSpeakerLabel } from '../lib/profile.js'
+import { getVocabulary, getOwnerName, getOwnerSpeakerLabel, getWhisperCorrections } from '../lib/profile.js'
+import { decoderContextWindow } from '../lib/glossary-learn.js'
 import { getOpenAIKey } from '../lib/openai-key.js'
 import { getTranscriptionPolicySnapshot, isOpenAIWhisperFallbackReady } from '../lib/transcription-policy.js'
 import { STRANDED_STALE_MS } from '../lib/stranded-sessions.js'
@@ -81,12 +82,14 @@ import {
 } from '../lib/even-hub-speaker-role.js'
 import { archiveSessionAudio, runMeetingAudioRetention } from '../lib/meeting-audio-archive.js'
 import {
+  DISCARDED_RETENTION_MS,
   countChunkWavs,
   listUnsavedCaptures,
   purgeExpiredQuarantine,
   quarantineSessionAudio,
   readCaptureDisposition,
   sweepOrphanedSessionAudio,
+  type QuarantineReceipt,
 } from '../lib/unsaved-audio-quarantine.js'
 import {
   STALE_ACTIVE_SESSION_DIR_NAME,
@@ -1728,11 +1731,14 @@ export function getMeetingSessionStatus(sessionId: string, now = Date.now()): Me
   }
 }
 
+/** 6.83.2: a close that quarantines under its own reason, clock and terminal receipt (the Mac discard). */
+type CloseQuarantine = { reason: string; retentionMs?: number; receipt?: QuarantineReceipt }
+
 function closeTranscriptSession(
   sessionId: string,
   reason: ClosedTranscriptSession['reason'],
-  options: { preserveAudio?: boolean } = {},
-): void {
+  options: { preserveAudio?: boolean; quarantine?: CloseQuarantine } = {},
+): string | null {
   // Progressive HQ is disposable cache state. Every terminal session path —
   // save, expiry, quarantine, or abandonment — must release the single owner.
   void stopProgressiveHqSession(sessionId)
@@ -1751,7 +1757,7 @@ function closeTranscriptSession(
     maxChunkIndex,
     reason,
   })
-  finishClosingTranscriptSession(sessionId, { ...options, closeReason: reason })
+  return finishClosingTranscriptSession(sessionId, { ...options, closeReason: reason })
 }
 
 /** Delete session after save */
@@ -1759,10 +1765,11 @@ export function deleteSession(sessionId: string, options: { preserveAudio?: bool
   closeTranscriptSession(sessionId, 'saved', options)
 }
 
+/** Where a close put the session's chunk audio (the quarantine dir), or null when it moved none. */
 function finishClosingTranscriptSession(
   sessionId: string,
-  options: { preserveAudio?: boolean; closeReason?: ClosedTranscriptSession['reason'] },
-): void {
+  options: { preserveAudio?: boolean; closeReason?: ClosedTranscriptSession['reason']; quarantine?: CloseQuarantine },
+): string | null {
   sessions.delete(sessionId)
   sessionAudioBytes.delete(sessionId)
   sessionAudioWrites.delete(sessionId)
@@ -1794,6 +1801,7 @@ function finishClosingTranscriptSession(
     if (countChunkWavs(audioDir) > 0) {
       const target = quarantineSessionAudio(audioDir, 'close_saved_residual_chunks')
       if (target) console.warn(`[transcribe-stream] Saved-close left chunk audio behind; quarantined: ${sessionId} → ${target}`)
+      return target
     } else {
       try { rmSync(audioDir, { recursive: true, force: true }) } catch {}
     }
@@ -1801,13 +1809,114 @@ function finishClosingTranscriptSession(
     // Any non-saved close (expired, error, …) with chunk audio still on disk
     // is an unsaved capture. Quarantine it — never delete evidence (6.19.0).
     if (countChunkWavs(audioDir) > 0) {
-      const target = quarantineSessionAudio(audioDir, `close_${options.closeReason ?? 'unknown'}`)
+      const quarantine = options.quarantine
+      const target = quarantineSessionAudio(audioDir, quarantine?.reason ?? `close_${options.closeReason ?? 'unknown'}`, undefined,
+        quarantine ? { retentionMs: quarantine.retentionMs, receipt: quarantine.receipt } : {})
       if (target) console.warn(`[transcribe-stream] Quarantined unsaved session-audio on close: ${sessionId} → ${target}`)
       else console.error(`[transcribe-stream] Quarantine move failed on close, source retained: ${sessionId}`)
+      return target
     } else {
       try { rmSync(audioDir, { recursive: true, force: true }) } catch {}
     }
   }
+  return null
+}
+
+// ── 6.83.2: discard a stranded Mac capture that holds no sound ─────────────────────
+// Miles, 2026-10-21: Record on Mac captured a 21-minute Zoom call as 211 chunks of exact zeros (macOS returns
+// zeros, not an error, when system audio recording is not allowed). The save refused it (no_speech), and the
+// capture then sat in the stranded list with a Save that can never work. COS Control asks the server to let it go.
+//
+// What it may touch: a Mac capture (Control is its only uploader, so nothing else will send it a chunk) that is in
+// memory, holds NO canonical chunk (no transcribed text, so no speech), has finished ASR on every chunk it received
+// (an in-flight chunk could still become speech), is idle past EMPTY_SESSION_STALE_MS, and has no chunk upload in
+// progress. Anything else is refused and left exactly as it was. The audio is never deleted here: it moves into the
+// existing quarantine with a terminal no_speech receipt and a 24-hour clock (DISCARDED_RETENTION_MS).
+export type MacDiscardRefusal =
+  | 'session_not_found' | 'not_mac_capture' | 'has_speech' | 'asr_in_progress' | 'not_idle' | 'chunk_in_progress'
+
+export interface MacDiscardResult {
+  ok: boolean
+  reason?: MacDiscardRefusal
+  sessionId: string
+  /** The quarantine dir the audio moved into, or null when the capture held no chunk audio. */
+  quarantined: string | null
+  chunkFiles: number
+  receivedCount: number
+  retainedUntil: string | null
+}
+
+export const MAC_DISCARD_IDLE_MS = EMPTY_SESSION_STALE_MS
+
+/** Why a session may not be discarded, or null when it may. Pure over the session's ledger. */
+export function macDiscardRefusal(input: {
+  sessionId: string
+  present: boolean
+  canonicalCount: number
+  receivedIndices: number[]
+  asrCompletedIndices: number[]
+  silentForMs: number
+  chunkInProgress: boolean
+}): MacDiscardRefusal | null {
+  if (!MAC_CAPTURE_ID.test(input.sessionId)) return 'not_mac_capture'
+  if (!input.present) return 'session_not_found'
+  if (input.canonicalCount > 0) return 'has_speech'
+  const completed = new Set(input.asrCompletedIndices)
+  if (input.receivedIndices.some(index => !completed.has(index))) return 'asr_in_progress'
+  if (input.chunkInProgress) return 'chunk_in_progress'
+  if (input.silentForMs < MAC_DISCARD_IDLE_MS) return 'not_idle'
+  return null
+}
+
+export async function discardSilentMacCapture(sessionId: string, options: { now?: number; dryRun?: boolean } = {}): Promise<MacDiscardResult> {
+  const now = options.now ?? Date.now()
+  const refusalFor = () => {
+    const session = sessions.get(sessionId)
+    return {
+      session,
+      refusal: macDiscardRefusal({
+        sessionId,
+        present: !!session,
+        canonicalCount: session ? canonicalIndices(session).length : 0,
+        receivedIndices: session?.receivedIndices ?? [],
+        asrCompletedIndices: session?.asrCompletedIndices ?? [],
+        silentForMs: session ? now - session.lastActivityAt : 0,
+        chunkInProgress: macChunkLocks.has(sessionId),
+      }),
+    }
+  }
+  const empty = (reason: MacDiscardRefusal, receivedCount = 0): MacDiscardResult =>
+    ({ ok: false, reason, sessionId, quarantined: null, chunkFiles: 0, receivedCount, retainedUntil: null })
+  const first = refusalFor()
+  if (first.refusal) return empty(first.refusal, first.session?.receivedIndices?.length ?? 0)
+  if (options.dryRun) {
+    const audioDir = getSessionAudioDirectory(sessionId)
+    return { ok: true, sessionId, quarantined: null, chunkFiles: audioDir ? countChunkWavs(audioDir) : 0,
+      receivedCount: first.session?.receivedIndices?.length ?? 0, retainedUntil: null }
+  }
+  // Every chunk write this session started reaches disk before its directory moves.
+  await drainSessionAudioWrites(sessionId)
+  // Ask again after the await: a chunk may have arrived meanwhile.
+  const second = refusalFor()
+  if (second.refusal) return empty(second.refusal, second.session?.receivedIndices?.length ?? 0)
+  const receivedCount = second.session?.receivedIndices?.length ?? 0
+  const quarantined = closeTranscriptSession(sessionId, 'closed', {
+    quarantine: {
+      reason: 'discarded_no_sound',
+      retentionMs: DISCARDED_RETENTION_MS,
+      receipt: { outcome: 'no_speech', discarded: true, note: 'Discarded from COS Control: no sound was captured. Audio retained until its 24-hour clock clears it.' },
+    },
+  })
+  // A late chunk or a replayed start for this capture answers 410 from here on.
+  closeMacRecording(sessionId)
+  return {
+    ok: true,
+    sessionId,
+    quarantined,
+    chunkFiles: quarantined ? countChunkWavs(quarantined) : 0,
+    receivedCount,
+    retainedUntil: quarantined ? new Date(Date.now() + DISCARDED_RETENTION_MS).toISOString() : null,
+  }
 }
 
 function isIosAsrCandidateEnabled(): boolean {
@@ -1946,7 +2055,13 @@ function recentWhisperContext(sessionId: string, session: TranscriptSession): st
     .map(c => c.text)
     .join(' ')
   const cleanedContext = stripInlineHallucinations(recentText, sessionId)
-  return cleanedContext.length > 250 ? cleanedContext.slice(-250) : cleanedContext
+  // 6.83.1: correction-only forms ("/pricing") go back to speech BEFORE the 250-character cut.
+  return decoderContextWindow(cleanedContext, decoderCorrections()) ?? ''
+}
+
+/** The corrections map for the decoder window; a test double without it reads as none. */
+function decoderCorrections(): Record<string, string> {
+  try { return getWhisperCorrections() } catch { return {} }
 }
 
 function isCrossChunkRepeat(session: TranscriptSession, text: string): boolean {
@@ -2493,7 +2608,9 @@ async function processStreamChunk(opts: {
   // The ASR await above lets a late chunk land after Stop or save; a closed session never feeds cues.
   if (!isSessionDeleted(sessionId)) void feedLiveCueTranscript(sessionId, trimmedText, Boolean(fallbackReason)).catch(() => {})
 
-  console.log(`[perf] TOTAL request: ${(performance.now() - tReq).toFixed(1)}ms | chunk #${chunkIndex} | ${audioBuffer.length}b | rms=${Math.round(rms)} q=${isQuiet ? 1 : 0} gate=${quiet.gate}${quiet.speechSec === null ? '' : ` speech=${quiet.speechSec.toFixed(2)}s`} fe=${stt.frontEnd} | ${asrProvider} | "${trimmedText.slice(0, 50)}"`)
+  // 6.85.0: timing and the character count only. This line runs for every chunk, so the meeting
+  // text itself never goes to the server log (transcribe-stream-log-privacy.test.ts).
+  console.log(`[perf] TOTAL request: ${(performance.now() - tReq).toFixed(1)}ms | chunk #${chunkIndex} | ${audioBuffer.length}b | rms=${Math.round(rms)} q=${isQuiet ? 1 : 0} gate=${quiet.gate}${quiet.speechSec === null ? '' : ` speech=${quiet.speechSec.toFixed(2)}s`} fe=${stt.frontEnd} | ${asrProvider} | chars=${trimmedText.length}`)
   return canonicalChunkResponse(chunk, sessionId, chunkIndex)
 }
 
@@ -2610,7 +2727,9 @@ export function assertMacCaptureComplete(sessionId: string, expectedChunkCount:
 
 // Manual Mac pilot: independent from iPhone candidate and cue rollout gates.
 transcribeStreamRouter.get('/mac-recording/capabilities', (_req, res) => {
-  res.set('Cache-Control', 'private, no-store').json({ available: true, ...MAC_AUDIO, serverInstanceId: getServerInstanceId() })
+  // 6.83.2: `discard` advertises POST /api/meeting/sessions/:id/discard for a stranded no-sound capture. Older
+  // servers omit it, and COS Control then discards only its own local copy and says so.
+  res.set('Cache-Control', 'private, no-store').json({ available: true, ...MAC_AUDIO, serverInstanceId: getServerInstanceId(), discard: true })
 })
 function requireMacPin(req: { get(name: string): string | undefined }): string {
   const pin = req.get('X-COS-Server-Instance')?.trim()

package/server/routes/welcome-context.ts

@@ -3,7 +3,7 @@
 // only proxies Open-Meteo / reverse-geocode — it is not "server location".
 
 import { Router } from 'express'
-import { callPython } from '../lib/python-bridge.js'
+import { callPython, pythonBridgeAvailable } from '../lib/python-bridge.js'
 
 export const welcomeContextRouter = Router()
 
@@ -24,6 +24,8 @@ let lastKnownCity = ''
 
 let cachedNextEvent: NextEventPayload | null = null
 let calendarFetchedAt = 0
+/** 6.84.1: whether the read that filled `cachedNextEvent` really reached the calendar. */
+let cachedCalendarRead = false
 
 // 6.63.1: after a server restart the first forecast lookup can fail and, with nothing cached, the
 // glasses Home got no weather until the app was relaunched. The last good weather and
@@ -282,9 +284,21 @@ function isGenericNoiseEvent(title: string): boolean {
   return /\booo\b|out of office|vacation|\bpto\b/i.test(t)
 }
 
-async function fetchNextEvent(): Promise<NextEventPayload | null> {
+/**
+ * 6.84.1: did the bridge answer with a calendar? False for no bridge (COS_SCRIPTS_DIR unset, or
+ * set without the venv and bridge script: callPython then answers an empty no-op), for a
+ * missing answer, and for the bridge's own error answer (`calendar_unavailable` on its
+ * deadline, or not configured). An empty calendar is a real read.
+ */
+export function calendarAnswerWasRead(bridgeReady: boolean, answer: unknown): boolean {
+  if (!bridgeReady) return false
+  if (!answer || typeof answer !== 'object' || Array.isArray(answer)) return false
+  return !('error' in answer)
+}
+
+async function fetchNextEvent(): Promise<{ event: NextEventPayload | null; read: boolean }> {
   if (cachedNextEvent && Date.now() - calendarFetchedAt < CALENDAR_TTL_MS) {
-    return cachedNextEvent
+    return { event: cachedNextEvent, read: cachedCalendarRead }
   }
 
   try {
@@ -299,6 +313,7 @@ async function fetchNextEvent(): Promise<NextEventPayload | null> {
       minutes_until_next?: number
     } | null
 
+    const read = calendarAnswerWasRead(pythonBridgeAvailable(), cal)
     const remaining = cal?.today_remaining ?? []
     const meaningful = remaining.find((evt) => {
       if (evt.is_all_day) return false
@@ -327,9 +342,11 @@ async function fetchNextEvent(): Promise<NextEventPayload | null> {
     }
 
     calendarFetchedAt = Date.now()
-    return cachedNextEvent
+    cachedCalendarRead = read
+    return { event: cachedNextEvent, read }
   } catch {
-    return cachedNextEvent
+    // Threw or timed out: whatever is cached was not read just now.
+    return { event: cachedNextEvent, read: false }
   }
 }
 
@@ -342,6 +359,7 @@ export function _resetWelcomeContextCachesForTests(): void {
   lastKnownCity = ''
   cachedNextEvent = null
   calendarFetchedAt = 0
+  cachedCalendarRead = false
   weatherPersistence = null
   weatherRestored = false
   lastFailureLogAt.clear()
@@ -354,13 +372,18 @@ welcomeContextRouter.get('/welcome-context', async (req, res) => {
   const pairLat = lat != null && lon != null ? lat : undefined
   const pairLon = lat != null && lon != null ? lon : undefined
 
-  const [weather, nextEvent] = await Promise.all([
+  const [weather, calendar] = await Promise.all([
     fetchWeather(pairLat, pairLon),
     fetchNextEvent(),
   ])
+  const nextEvent = calendar.event
 
   res.json({
     ...(weather ? { weather } : {}),
     ...(nextEvent ? { nextEvent } : {}),
+    // 6.84.1: true only when this answer's calendar came from a successful read (an empty
+    // calendar included); false when the read threw, timed out or there is no COS pipeline.
+    // Lets a client tell "no more events today" from "could not read the calendar".
+    calendarRead: calendar.read,
   })
 })