@gotcos/glasses-server 6.85.0 → 6.87.0

package/CHANGELOG.md

@@ -1,3 +1,122 @@
+## 6.87.0 - A rough level per chunk for COS Control's glasses meeting strip
+
+The server half of the level strip COS Control 0.5.339 draws in a glasses meeting's bottom bar (plan of 2026-10-23,
+approved 09:25). The quiet gate already measured every live chunk (RMS, and Silero speech seconds) and only printed the
+numbers on the `[perf]` line. Now each chunk keeps them.
+
+- **Two numbers per chunk on the active-session record.** `chunkLevels[{i, level, speechSec}]` in
+  `active-sessions/<id>.json`: `level` is the chunk's RMS on a dBFS scale, 0 at -60 dBFS and under, 1 at -10 dBFS and
+  over, three decimals; `speechSec` is the Silero speech seconds (two decimals), or null when the gate fell back to
+  RMS. Every chunk the quiet gate sees gets one, quiet chunks included; a replayed index keeps its first answer, like
+  the chunk itself. Bounded to the newest 120 chunks (about 12 minutes of 6 s chunks) and restored, validated, after a
+  restart. It lives only as long as the record (deleted at save). `server/lib/chunk-levels.ts`.
+- **Control reads it from the file it already reads.** The helper's `live-transcript` read opens this same file, so
+  there is no new route. `capabilities.liveMeeting.chunkLevels: true` on `/api/health` and `/api/models` tells Control
+  the record carries levels; an older server omits it and Control keeps its still glyph.
+- **Not text, never logged.** Nothing new is logged, and no text is stored: the entries hold an index and two numbers.
+  `transcribe-stream-chunk-levels.test.ts` spies every console level and checks the record holds numbers only.
+- **No spend.** No LLM, no new caller, no new disk write: the numbers ride on the durable write each chunk already makes.
+- **Checks (6.87.0 branch).** Full suite, serial (`--maxWorkers=1`), HOME, COS_DATA_DIR and COS_PROFILE_PATH in a scratch folder,
+  COS_SCRIPTS_DIR unset: 584 files (583 passed, 1 skipped), 8815 tests, 8801 passed, 14 skipped, 0 failed. Mutation gate `live-meeting-6870-mutation-gate.mjs` against a green
+  baseline (32 tests in 4 files): 25 of 25 killed, each by a named
+  test, every target landing exactly once and restored byte for byte. `tsc --noEmit` clean. Pack dry run 546 files (6.86.0:
+  545; the one new file is `server/lib/chunk-levels.ts`).
+
+## 6.86.0 - Decision, promise and follow-up cues, live cues on Mac recordings, and the grey provisional line
+
+The server half of COS Control's live meeting view (plan of 2026-10-22, decisions of 15:21). Three lanes: three more cue
+kinds from the same single writer call, live cues on Mac recordings when COS Control asks for them, and the newest
+provisional (grey) line of a live meeting for Control to show before the final text replaces it.
+
+- **This adds spend for Mac meetings.** Until now a Mac recording never got live cues. From this release, a Mac
+  recording that COS Control starts with `liveCues: true` runs the live cues pipeline (the Jev gate and judge, and the
+  one Claude writer call per evaluation) for that meeting. It is capped by the same budgets as every meeting: the
+  master switch (COS Control's Live cues toggle, or `COS_LIVE_CUES_V2`), 25 cues and 50 writer calls a meeting, the
+  daily writer ceiling and gate COS Control sets, the weekly writer ceiling, the Jev daily token cap and breaker, and
+  the per-meeting breaker. There is no new LLM caller. `COS_LIVE_CUES_V2_MAC=0` switches Mac recordings off on their
+  own (answer `mac_cues_off`) and leaves glasses meetings alone. An older COS Control never sends `liveCues`, so it
+  starts no Mac cues and spends nothing new.
+- **Pairs with the COS Control live meeting view** (the Control half ships separately). An older Control and every
+  companion are unaffected: glasses meetings keep reinforce and challenge, byte-identical writer rules, and the
+  same wire shapes.
+- **Privacy: five more log lines stop printing what was said.** 6.85.0 took the text out of the per-chunk
+  `[perf] TOTAL` line. Five others still printed it: the three `[hallucination]` lines (a dropped brand URL, thank-you
+  or vocabulary echo, and a chunk the filter emptied, each with up to 60 characters of the chunk), the dictation
+  `[prompt-draft] tail_drop` line (up to 100 characters of the dropped sentence) and `[fuzzy-correct]` (the misheard
+  word and its correction, up to five pairs). Each now logs its reason and a character count; fuzzy-correct logs how
+  many words it fixed. `transcript-log-privacy-686.test.ts` scans every server and shared source for a console call
+  that prints a slice of transcript text, and drives fuzzy-correct; restoring each of the five old lines fails it
+  (5 of 5). Nothing new logs transcript text, and the provisional line is held in memory only, never written to disk
+  or the log.
+- **Checks (6.86.0 branch).** Full suite, serial (`--maxWorkers=1`), HOME, COS_DATA_DIR and COS_PROFILE_PATH in a
+  scratch folder, COS_SCRIPTS_DIR unset: 582 files (581 passed, 1 skipped), 8800 tests, 8786 passed, 14 skipped, 0
+  failed (re-run after the log-line fix). Mutation gate `live-meeting-6860-mutation-gate.mjs` against a green baseline (159 tests in 7 files): 63 of
+  63 killed, each by a named test, every target landing exactly once and restored byte for byte. The 6.79.x verdicts
+  gate's `schema-kind` mutant, retargeted to `isCueKind`, is still killed. `tsc --noEmit` clean. `npm pack --dry-run`:
+  545 files (6.85.0's 543 plus `server/lib/live-provisional.ts` and `server/lib/live-cues-v2-prompts-kinds.ts`), no
+  test, gate or fixture.
+
+### Cue kinds: decision, promise and followUp
+
+- **`CueKind`** (`shared/live-cues-v2.ts`) is now `reinforce | challenge | decision | promise | followUp`, with
+  `CUE_KINDS`, `LEGACY_CUE_KINDS`, `isCueKind` and `legacyCueKind`. `isLiveCueV2` and the cue log reader accept the
+  five kinds and still refuse anything else.
+- **Opt-in per meeting.** A meeting gets the new kinds only when its armer asks: a Mac recording (`mac_` capture id)
+  by default, or `POST /api/live-cues/start {sessionId, kinds: 'extended'}`. `kinds: 'legacy'` forces the two old
+  kinds; any other value is 400 `invalid_kinds` and arms nothing. A glasses meeting armed as before keeps reinforce and
+  challenge: a companion that has not taken the new contract validates `kind` against those two and would drop
+  anything else. The arm answer adds `kinds` (the list this meeting may carry). A repeat arm keeps the first kinds.
+- **Writer rules v4** (`server/lib/live-cues-v2-prompts-kinds.ts`) run only for those meetings: v3 with rule 3 (five
+  kinds: a decision says what was decided, a promise says who owes what, a followUp names what is still open), rule 4
+  (a decision, promise or followUp may record what the room said) and the schema kind list swapped. Everything else
+  is v3: one cue, at most 200 characters, the same evidence rules, null for noise. Built from v3 by exact swaps, so a
+  regenerated v3 fails the suite instead of shipping under the v4 label. Not replay-measured; rate them in Control.
+  The generated `live-cues-v2-prompts.ts` is unchanged, so the v2 and v3 replay pins hold.
+- **Old readers.** The v1 `coaching_nudge` twin and the stop answer's `nudges[].type` carry a legacy type (decision
+  and promise read as reinforce, followUp as challenge). The v2 cue, the status route and history keep the real kind.
+  COS Control before this release shows an unknown kind as its raw name (`MeetingAskCore.kindLabel` default).
+- **Trace.** An evaluation of an extended meeting traces `kindSet: 'extended'` and `prompt: 'v4'`; the trace still
+  carries no transcript text.
+
+### Live cues on Mac recordings
+
+- **Arm point.** `POST /api/mac-recording/start {captureId, startTime, sourceType, liveCues: true}`. Arming runs only
+  after the recording is admitted, and never fails the start: the answer adds `liveCues: {armed: true, kinds,
+  cuesGenerated, paused, pauseSeq}` or `{armed: false, reason}` (`master_flag_off`, `mac_cues_off`, `meeting_ended`,
+  `budget_exhausted`, `jev_cap_reached`, and the other capability reasons). With v2 off the engine is never built,
+  so a Mac recording never reaches the v1 Composer path. `liveCues` that is not a boolean is 400 `invalid_live_cues`
+  before anything is written. Without `liveCues` the answer is byte for byte 6.85.0's.
+- **Resume.** A Mac recording armed from the start route is remembered in `live-cues-v2-state.json` (`resume`, with
+  its kinds). A restarted server re-arms it on its next chunk and traces one `resume` row. Cleared when the meeting
+  ends; expires with the counters (24 h).
+- **Title.** Mac meetings are titled `Mac Recording <date> <time>` in the gate, the writer prompt and the cue log.
+- **Pause and stop** are the existing routes: `POST /api/live-cues/pause` and the save, which ends the meeting's
+  cues through `recording_stop`.
+
+### The grey provisional line
+
+- **Route.** `GET /api/transcribe-stream/provisional?sessionId=<id>` (token-protected, `private, no-store`) answers
+  `{v: 1, sessionId, live, provisional: {chunkIndex, previewGen, text, model, at} | null, serverInstanceId}`.
+- **What it holds.** The newest preview the preview route produced for a session this server holds open, one per
+  meeting: a later chunk, or the same chunk with a later `previewGen`, replaces it; a preview for a chunk that already
+  settled is refused. The canonical answer for that chunk (text, silence or a drop) removes it, and so does any close.
+  Bounded: the last 600 characters, 8 meetings, 30 s without an update reads as none.
+- **Why a route and not the active-session file.** That file is the 4-hour crash-recovery record and is written with
+  fsync before each chunk is acknowledged. Provisional text must not outlive the live session, and writing the file
+  per preview would add a durable write on the recording path and churn the stamp Control uses to skip reads.
+- **Mac recordings.** COS Control does not post previews today, so a Mac recording has no provisional text until it
+  does. The minimal path needs no server change: Control posts a copy of the still-open chunk (canonical 16 kHz mono
+  WAV, at most 512 KB, about 16 s) to the existing `POST /api/transcribe-stream/preview` with the capture id, the open
+  chunk index and a rising `previewGen`. The answer carries the text, and the route above serves it too. Preview runs
+  Whisper Turbo (or Parakeet when selected); transcription never calls an LLM.
+
+### Capabilities
+
+- `capabilities.liveCues.kinds`: the five kinds, beside the unchanged v1 `available` and `reason`.
+- `capabilities.liveMeeting: {protocol: 1, macLiveCues: true, provisional: {route, maxChars: 600, ttlMs: 30000}}`.
+- Both on `/api/health` and `/api/models` from one helper. An older server omits them, which is how COS Control knows
+  to hide the inline kinds, skip `liveCues` on the Mac start and skip the grey line.
+
 ## 6.85.0 - Your polish instructions, and COS Control can list the questions COS is answering right now
 
 Two lanes and a privacy fix in one release. Your own polish instructions for AI dictation polish, layered after
@@ -626,7 +745,7 @@ Pairs with COS Glasses companion 6.10.645. Includes 6.77.0. No COS Control chang
 
 Includes 6.76.2. Off until Miles turns it on. No COS Control or companion change is required; Control can add the toggle, the screen feed and the Dictionary suggestions later against the contracts below.
 
-- Miles, 2026-10-17: after a transcription (Parakeet Ultra or Whisper), run Haiku or Sonnet over the passages where the engine was unsure, with screen and textual awareness, so word hallucinations and misheard names ("Queen Ukoma", "Yukoma", "eucoma", "U coma" for Queen Ukaoma) are resolved.
+- Miles, 2026-10-17: after a transcription (Parakeet Ultra or Whisper), run Haiku or Sonnet over the passages where the engine was unsure, with screen and textual awareness, so word hallucinations and misheard names ("Grace Ukoma", "Yukoma", "eucoma", "U coma" for Grace Ukaoma) are resolved.
 - Where it runs. Once per saved meeting, in the durable finalization job after the HQ batch text and the Nemotron relabel are written, and before the meeting is handed to COS operations or summarised, so both read the cleaned text. Orphan recovery runs it too. Never during live transcription: it is a separate module no transcription file imports (pinned by a test), and a meeting whose session is still live is skipped. It never fails a save.
 - Selection, no model (`transcript-cleanup-spans.ts`): low confidence (Parakeet below 0.50, Whisper below 0.40, from the batch words in the sidecar, aligned to the saved transcript); a word near a known name when the engine was unsure of it (below 0.9: one edit past fuzzy-correct's limit for a capitalised word, or the same consonant skeleton and onset, so eucoma reads like Ukaoma); two or three short pieces that join into a name ("U coma"), never function words; the leading-y rule at any confidence ("Yukoma"); an out-of-vocabulary capital mid-sentence beside a known name; a phrase repeated three times or more. Spans stay inside one speaker turn and one clause, hold at most 6 words (12 for a repeat), carry 12 words of context each side, and are cut to 40 per meeting with names first.
 - Deterministic fixes first, free (fuzzy-correct's own rule, exported as `fuzzyReplacementFor`): only capitalised words that are not already a known spelling; this meeting's own screen and file terms as a temporary per-meeting vocabulary at any confidence; the curated dictionary (vocabulary and corrections) and the owner only where the engine was unsure; never an inflection ("Setting" is never a "Settings" button). Measured read-only on 68 real meetings (38.5 hours): rewriting lowercase words, or using every enrolled name as a target, swapped everyday words and real names for other names (giant to grant, Kelsey to Kelley, Slack to Black), so neither is done; with these rules the same meetings got 27 fixes, all real (Manuj to Manoj, MarketPOS to MarktPOS).
@@ -660,7 +779,7 @@ Pairs with COS Glasses companion 6.10.644 and COS Control 0.5.322. Includes 6.76
 - When SubQ serves cues, the live transcript window (up to 2,200 characters per call) and the candidate notes go to SubQ, which retains data by default.
 - Capability additions (optional fields; `shared/live-cues-v2.ts` changed additively, new sha256 174728e7...): `memory` (`cue_memory`, `notes` or `none`) and `decisionProvider` (`jev` or `subq`). New reasons: `decision_not_configured` (no key for the chosen provider; `jev_not_configured` is kept for Jev chosen while only a SubQ key exists), `decision_cap_reached`, `decision_breaker_open` (SubQ) and `decision_invalid_provider`. The same decision codes stop a running meeting's cues quietly with that reason; other SubQ errors count toward the meeting breaker as Jev errors do.
 - Live COS Ask finds the owner's notes too. When `searchMemories` does not answer (it fails, its meaning arm fails as on the public runtime, or it finds nothing), the Ask's COS search also reads the memory bridge listing and matches it with the same keyword scorer, the same 0.35 floor and the same confirmed-domain filter as other COS hits, fused by rank with any memory hits (at most 3 memory sources). Listed notes are cited as COS memory sources (H ids, `memoryId`), counted in the `cos_search` phase time and result count, and the notices add "COS also searched the notes in its memory list by keyword." whenever one is cited. The listing is bounded at 3 s and the Ask's own cancel; a failed listing changes nothing. A memory search that answers is used exactly as before, the same sources in the same order and key order, and the listing is never read. With nothing found in either, the notices are the existing empty wording, word for word. On the public runtime this lets the 6.76.0 person lookup ("Who is X?") answer from the owner's note. One helper serves both cues and the Ask: `server/lib/cos-bridge-notes.ts` (bridge listing, keyword scoring, local dates, rank fusion).
-- Tests: `live-cues-v2.test.ts` (52, 13 new), `live-cues-v2-notes.test.ts` (11), `live-cues-v2-notes-bridge.test.ts` (2: the real searchers over a scratch bridge, a markdown note and a saved meeting), `live-cues-v2-settings.test.ts` (3), `live-cues-v2-settings-route.test.ts` (10: behind the real token gate, a module reload as the restart, and the real deps with faked network sending the gate to SubQ then Jev), `health.test.ts` (1 new: `/api/health` and `/api/models` flip with the setting), `live-cos-ask-memory-fallback.test.ts` (8), `live-cos-ask-queen-runtime.test.ts` (3: the shipped public memory runtime 0.1.0 installed in a scratch dir with one accepted note; `searchMemories` alone finds nothing, the Ask answers "Who is Delgado?" from the note). `server/scripts/live-cues-v2-notes-mutation-gate.mjs`: 85 mutants over the cue switch, the cue notes fallback, the shared helper, the decision provider selection (global setting ignored, only-key fallback, explicit override both ways) and the Ask fallback (13 Ask guards), each killed by a named test against a green baseline (160 tests in 12 files). Full suite 7240 passed, 13 skipped, 0 failed; typecheck clean.
+- Tests: `live-cues-v2.test.ts` (52, 13 new), `live-cues-v2-notes.test.ts` (11), `live-cues-v2-notes-bridge.test.ts` (2: the real searchers over a scratch bridge, a markdown note and a saved meeting), `live-cues-v2-settings.test.ts` (3), `live-cues-v2-settings-route.test.ts` (10: behind the real token gate, a module reload as the restart, and the real deps with faked network sending the gate to SubQ then Jev), `health.test.ts` (1 new: `/api/health` and `/api/models` flip with the setting), `live-cos-ask-memory-fallback.test.ts` (8), `live-cos-ask-grace-runtime.test.ts` (3: the shipped public memory runtime 0.1.0 installed in a scratch dir with one accepted note; `searchMemories` alone finds nothing, the Ask answers "Who is Delgado?" from the note). `server/scripts/live-cues-v2-notes-mutation-gate.mjs`: 85 mutants over the cue switch, the cue notes fallback, the shared helper, the decision provider selection (global setting ignored, only-key fallback, explicit override both ways) and the Ask fallback (13 Ask guards), each killed by a named test against a green baseline (160 tests in 12 files). Full suite 7240 passed, 13 skipped, 0 failed; typecheck clean.
 
 ## 6.76.1 - Stop a glasses meeting from COS Control
 
@@ -674,10 +793,10 @@ Pairs with COS Glasses companion 6.10.644 and COS Control 0.5.321. Includes 6.76
 - Tests: `server/routes/meeting-stop-request.test.ts` (9) over a real router; seven mutants (window ignored, window off by one, a refused request claimable, a not-live session asked, a Mac capture asked, no display event, a request id from another session) each killed.
 ## 6.76.0 - Live COS Ask knows who owns this COS, looks in COS for person questions, and times every phase
 
-- Field report (Queen, 2026-10-17): on her own COS, "Who is Queen Ukaoma?" (heard as "Queen Ukoma") was answered "These sources say nothing about who Queen Ukaoma is" from one transcript passage.
+- Field report (Grace, 2026-10-17): on her own COS, "Who is Grace Ukaoma?" (heard as "Grace Ukoma") was answered "These sources say nothing about who Grace Ukaoma is" from one transcript passage.
 - Owner card. A typed question gets a `profile` source built from the profile the server already keeps: `owner_name`, `owner_speaker_label`, `home_city`, and the owner's own `system_prompt_context` notes with any sentence holding a street address, zip, phone number or email removed. It is cited with an H id like other COS history, returned in `sources` when cited, and named "COS profile" on the lens From line. No profile name: no card, and the prompt is byte-for-byte as before. Presets never get it.
-- ASR spellings of the owner's name read as the owner: one edit for names under seven letters (two from seven), one edit after a recognizer-added leading y (Ukoma and Yukoma both read as Ukaoma). Full name, a surname after a lead-in word ("who is Ukoma"), or an exact first name as the whole subject. A different first name with the same surname ("Isaiah Ukaoma") is not the owner. The answer's notices say how the question was read.
-- Person and self-history questions always look in COS first. "Who is X", "tell me about X" and the owner's own history ("what was going on with me when I was pregnant with Isaiah?") run one COS lookup (memories and earlier meetings, every domain, not only the confirmed meeting domain) before the first model call, whatever the planner would choose. It takes one of the two lookups and saves the planner hop. It never goes to the web: web search stays gated exactly as before, so a public "who is" question still reaches the gated web through the planner after an empty COS lookup.
+- ASR spellings of the owner's name read as the owner: one edit for names under seven letters (two from seven), one edit after a recognizer-added leading y (Ukoma and Yukoma both read as Ukaoma). Full name, a surname after a lead-in word ("who is Ukoma"), or an exact first name as the whole subject. A different first name with the same surname ("Rafael Ukaoma") is not the owner. The answer's notices say how the question was read.
+- Person and self-history questions always look in COS first. "Who is X", "tell me about X" and the owner's own history ("what was going on with me when I was pregnant with Rafael?") run one COS lookup (memories and earlier meetings, every domain, not only the confirmed meeting domain) before the first model call, whatever the planner would choose. It takes one of the two lookups and saves the planner hop. It never goes to the web: web search stays gated exactly as before, so a public "who is" question still reaches the gated web through the planner after an empty COS lookup.
 - An empty COS lookup is never proof of absence. The prompt lists each COS lookup with its result count, the notices say what was searched, and an answer that reads as "nothing about X" after an empty lookup gets one sentence saying what COS searched and that this does not mean COS has nothing on it.
 - Latency, measured on Miles's Mac before changing anything: "through 210666 ms" and "288457 ms" in the report are `throughMs`, the meeting position when the question was asked (3:30 and 4:48 into the recording), not how long the answer took. The 98 completed Asks in the journal took 3.2 s to 24.3 s (median 6.7 s), and the durable runtime stops any Ask at 30 s. Per model call (the live server's token audit since 2026-10-10): Sonnet median 4.6 s, max 9.4 s (n=121); Opus median 6.1 s, max 12.3 s (n=11); Haiku median 3.8 s, max 7.0 s (n=10); web search median 9.1 s, max 10.5 s (n=10). No search timing existed before this release.
 - Per-phase timing. Each exchange carries `timings` (`totalMs` and ordered `phases`: plan, answer, review, cos_search, web_search, public_topic, fact_check, with `forced`, `failed` and result counts), kept on failed and timed-out Asks too, and each Ask logs one line `[meeting-ask] timing <requestId> <action> <outcome> total=...ms <phase>=<ms>[/<results>] ...` with no question, answer or query text.
@@ -1795,7 +1914,7 @@ The phone can list the skills this Mac will actually run.
 
 - `GET /api/skills` returns the slash catalog from the selected workspace (`.agents/skills`, then `.claude/skills`) plus `~/.claude/skills`. Nested agent folders flatten with `:`. Generated `source-command-*` duplicates stay out. Paths never leave the box.
 - COS Glasses 6.9.468 paints that list on Views instead of a hardcoded cheat sheet.
-- A held voice can be heard before it is named. `GET /api/voice/ext-audio` lists `chunkIndices` per held session and `GET /api/voice/ext-audio/:sessionId/sample?chunk=<index>` serves that one chunk (no `chunk` still serves the newest). COS Control's Add-a-voice panel uses it to play portions of a session before naming it (Queen, 2026-09-12: "no way to listen to the voices that are here").
+- A held voice can be heard before it is named. `GET /api/voice/ext-audio` lists `chunkIndices` per held session and `GET /api/voice/ext-audio/:sessionId/sample?chunk=<index>` serves that one chunk (no `chunk` still serves the newest). COS Control's Add-a-voice panel uses it to play portions of a session before naming it (Grace, 2026-09-12: "no way to listen to the voices that are here").
 - Recent is a rolling window. `GET /api/sessions/today/all-messages` keeps its path for COS Control and the phone but now answers with the newest 30 messages (`?limit=` up to 100) across every live session and as many archived days as it takes, deduplicated against their archive mirrors. Messages leave Recent only by ageing out of the window; nothing is hidden by the calendar. Control's Recent view and the phone's history recovery read this without change.
 - Yesterday's turns no longer vanish for a day. The archive mirror ran every 24 h from boot (21:25 on the current uptime), so finished sessions from the previous local day were neither "today" for `GET /api/sessions/today/all-messages` nor in any day archive until the evening; on 2026-09-12 07:00 Control showed no turns while ten from the 11th sat live in `sessions.json`. The mirror now runs at boot, at the next local midnight, and lazily from the today and archive-listing routes, once per local day. `checkYesterdayArchive` keys on the local day like everything else.
 

package/managed-runtime-contract.json

@@ -35,6 +35,7 @@
     "COS_LIVE_CUES_V2_REPEAT_OVERLAP",
     "COS_LIVE_CUES_V2_MAX_PER_MEETING",
     "COS_LIVE_CUES_V2_DAILY_WRITER_CALLS",
+    "COS_LIVE_CUES_V2_MAC",
     "COS_LIVE_CUES_JEV_DAILY_TOKENS",
     "COS_LIVE_CUES_SUBQ_DAILY_TOKENS",
     "COS_DECISION_PROVIDER_CUES",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.85.0",
+  "version": "6.87.0",
   "description": "COS Glasses: self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {
@@ -134,6 +134,8 @@
     "docs/test-plan-6.71.5.md",
     "docs/test-plan-6.71.7.md",
     "!server/scripts/question-hold-mutation-gate.mjs",
+    "!server/scripts/live-meeting-6860-mutation-gate.mjs",
+    "!server/scripts/live-meeting-6870-mutation-gate.mjs",
     "docs/test-plan-6.71.8.md",
     "docs/test-plan-6.71.9.md",
     "docs/test-plan-6.71.10.md",

package/server/lib/chunk-levels.ts

@@ -0,0 +1,64 @@
+// 6.87.0: a rough level per live chunk, for COS Control's level strip on glasses meetings.
+//
+// The quiet gate already measures every chunk (stt-live.ts decideQuiet: RMS and, with Silero, speech seconds). Until
+// 6.87.0 those numbers only reached the [perf] line. Now each chunk keeps two numbers on the active session record:
+// `level`, 0 to 1 from the chunk's RMS on a dBFS scale, and `speechSec`, the Silero speech seconds (null when the gate
+// fell back to RMS). Control reads them from the same active-session file its live transcript reads, so there is no
+// new route and no new log line.
+//
+// NOT TEXT. Two numbers per chunk, bounded to the newest CHUNK_LEVELS_LIMIT chunks, living only as long as the
+// active-session record (the 4-hour crash-recovery file, deleted at save). Nothing here logs.
+
+/** The newest chunks kept: about 12 minutes of 6 s chunks, far more than the strip draws. */
+export const CHUNK_LEVELS_LIMIT = 120
+/** The dBFS that reads as 0: under the quiet gate's RMS 150 (about -47 dBFS) and the room floor of a G2 mic. */
+export const LEVEL_FLOOR_DBFS = -60
+/** The dBFS that reads as 1: loud close speech. */
+export const LEVEL_CEILING_DBFS = -10
+
+export interface ChunkLevel {
+  /** The chunk's own index. */
+  i: number
+  /** 0 to 1, three decimals. */
+  level: number
+  /** Silero speech seconds, two decimals; null when the quiet gate used RMS. */
+  speechSec: number | null
+}
+
+/** A chunk's RMS (PCM16 units) as 0 to 1: LEVEL_FLOOR_DBFS and under is 0, LEVEL_CEILING_DBFS and over is 1. */
+export function normalizedLevel(rms: number): number {
+  if (!Number.isFinite(rms) || rms <= 0) return 0
+  const dbfs = 20 * Math.log10(rms / 32768)
+  const level = (dbfs - LEVEL_FLOOR_DBFS) / (LEVEL_CEILING_DBFS - LEVEL_FLOOR_DBFS)
+  return Math.round(Math.min(1, Math.max(0, level)) * 1000) / 1000
+}
+
+/** The stored entry for one chunk's quiet decision. */
+export function chunkLevel(chunkIndex: number, rms: number, speechSec: number | null): ChunkLevel {
+  const speech = speechSec !== null && Number.isFinite(speechSec) ? Math.round(Math.max(0, speechSec) * 100) / 100 : null
+  return { i: chunkIndex, level: normalizedLevel(rms), speechSec: speech }
+}
+
+/** `levels` with `entry` in index order (a second entry for an index replaces the first), the newest
+ *  CHUNK_LEVELS_LIMIT kept. Never mutates its input. */
+export function withChunkLevel(levels: readonly ChunkLevel[] | undefined, entry: ChunkLevel): ChunkLevel[] {
+  const next = (levels ?? []).filter(l => l.i !== entry.i)
+  next.push(entry)
+  next.sort((a, b) => a.i - b.i)
+  return next.length > CHUNK_LEVELS_LIMIT ? next.slice(next.length - CHUNK_LEVELS_LIMIT) : next
+}
+
+/** The levels from a recovered session file: only well-formed entries, one per index, in order, bounded. */
+export function restoreChunkLevels(value: unknown): ChunkLevel[] {
+  if (!Array.isArray(value)) return []
+  let levels: ChunkLevel[] = []
+  for (const raw of value) {
+    if (!raw || typeof raw !== 'object') continue
+    const { i, level, speechSec } = raw as Record<string, unknown>
+    if (!Number.isInteger(i) || (i as number) < 0) continue
+    if (typeof level !== 'number' || !Number.isFinite(level) || level < 0 || level > 1) continue
+    if (speechSec !== null && (typeof speechSec !== 'number' || !Number.isFinite(speechSec) || speechSec < 0)) continue
+    levels = withChunkLevel(levels, { i: i as number, level, speechSec: speechSec as number | null })
+  }
+  return levels
+}

package/server/lib/fuzzy-correct.ts

@@ -293,7 +293,6 @@ export function applyFuzzyCorrections(
 
   const targetLowerSet = new Set(canonical.map(t => t.toLowerCase()))
   let replacements = 0
-  const fuzzyLog: Array<{ from: string; to: string }> = []
 
   // Match any 5+ char word (case-insensitive). Stop-list + strict distance
   // thresholds are the primary defenses against false positives.
@@ -301,13 +300,12 @@ export function applyFuzzyCorrections(
     const replacement = fuzzyReplacementFor(word, canonical, targetLowerSet)
     if (replacement === null) return word
     replacements++
-    fuzzyLog.push({ from: word, to: replacement })
     return replacement
   })
 
-  if (fuzzyLog.length > 0) {
-    const preview = fuzzyLog.slice(0, 5).map(x => `${x.from}→${x.to}`).join(', ')
-    console.log(`[fuzzy-correct] Applied ${replacements} correction(s): ${preview}${fuzzyLog.length > 5 ? '...' : ''}`)
+  if (replacements > 0) {
+    // 6.86.0: the count only. The pairs were the words someone said.
+    console.log(`[fuzzy-correct] Applied ${replacements} correction(s)`)
   }
 
   return { text: result, replacements }

package/server/lib/live-cue-verdicts.ts

@@ -22,7 +22,7 @@ import { durableAtomicWriteFileSync } from './atomic-fs.js'
 import { errMsg } from './utils.js'
 import { getMeetingStore } from './meeting-store.js'
 import { findCosOperationsMeetingBySessionId, findDirectLibraryMeetingBySessionId } from './cos-operations-meetings.js'
-import { CUE_FEEDBACK_REASON_MAX, type CueKind, type CueSourceRef, type LiveCuesV2MemorySource } from '../../shared/live-cues-v2.js'
+import { CUE_FEEDBACK_REASON_MAX, isCueKind, type CueKind, type CueSourceRef, type LiveCuesV2MemorySource } from '../../shared/live-cues-v2.js'
 import type { WouldWithhold } from './live-cues-filter.js'
 
 // ── Wire types (server-local: shared/live-cues-v2.ts is hash-pinned with the companion copy) ──
@@ -43,6 +43,7 @@ export interface LiveCueLogRow {
   meetingTitle: string
   createdAt: number
   armedAt?: number
+  /** reinforce | challenge, or (6.86.0, meetings with the extended kinds) decision | promise | followUp. */
   kind: CueKind
   headline: string
   detail: string
@@ -111,7 +112,7 @@ export function isLogRow(value: unknown): value is LiveCueLogRow {
   if (!value || typeof value !== 'object' || Array.isArray(value)) return false
   const r = value as Record<string, unknown>
   return r.v === 1 && str(r.cueId) && r.cueId.length > 0 && str(r.sessionId) && r.sessionId.length > 0 && str(r.meetingTitle)
-    && num(r.createdAt) && (r.kind === 'reinforce' || r.kind === 'challenge')
+    && num(r.createdAt) && isCueKind(r.kind)
     && str(r.headline) && str(r.detail) && num(r.gate) && str(r.model) && str(r.before)
     && Array.isArray(r.sources) && r.sources.every(s => !!s && typeof s === 'object' && str((s as CueSourceRef).id) && str((s as CueSourceRef).date) && str((s as CueSourceRef).title))
     && optional(r.armedAt, num) && optional(r.prompt, p => typeof p === 'string' && /^v\d{1,2}$/.test(p))

package/server/lib/live-cues-v2-prompts-kinds.ts

@@ -0,0 +1,38 @@
+// 6.86.0: the writer rules for a meeting armed with the extended kinds (decision, promise, followUp beside reinforce and
+// challenge). Hand-written, so it lives beside the GENERATED live-cues-v2-prompts.ts and never inside it: v2 and v3 stay
+// byte-identical to what the dev and held-out replays measured, and every meeting without the extended kinds (every
+// glasses meeting today) still runs them.
+//
+// v4 is v3 with three segments swapped: rule 3 (the kinds), rule 4 (a record of what the room settled is allowed to say
+// what the room said) and the kind list in the schema line. Nothing else changes: one cue, at most 200 characters, the
+// same evidence rules, the same null. The swap throws when v3 no longer holds a segment, so a regenerated v3 fails the
+// suite (live-cues-v2-kinds.test.ts) instead of silently shipping v3 under the v4 label.
+//
+// Not replay-measured. It runs only for meetings that opted in (Mac recordings in COS Control), whose cues are rated in
+// Control like every other cue.
+
+import { CUE_WRITER_SYSTEM_V3 } from './live-cues-v2-prompts.js'
+
+export const V3_RULE_3 = '3. Two kinds. reinforce: they are on track; name the evidence and the next step. challenge: the flaw, the missing piece, or the contradiction.\n'
+  + '   Check previousCues: do not only criticize, and never repeat a previous cue. No empty praise.\n'
+export const V4_RULE_3 = '3. Five kinds. reinforce: they are on track; name the evidence and the next step. challenge: the flaw, the missing piece, or the contradiction.\n'
+  + '   decision: the room just settled something; say what was decided. promise: someone took something on; say who owes what (rule 2 decides whether you may name them), and when only if a date was said.\n'
+  + '   followUp: something the room must come back to; name it and what is still open. suggestedKind is a hint; pick the kind that fits the window.\n'
+  + '   Check previousCues: do not only criticize, never repeat a previous cue, and never record the same decision or promise twice. No empty praise.\n'
+
+export const V3_RULE_4 = '4. Add something the room has not said: the missing owner, deadline or criterion, a risk, a contradiction, or a past decision from memory.\n'
+  + '   If the cue would only restate what was just said, output null.\n'
+export const V4_RULE_4 = '4. A reinforce or challenge cue must add something the room has not said: the missing owner, deadline or criterion, a risk, a contradiction, or a past decision from memory.\n'
+  + '   If it would only restate what was just said, output null. A decision, promise or followUp records what the room settled, took on or left open, in a few plain words.\n'
+
+export const V3_SCHEMA_KIND = '"kind":"reinforce|challenge"'
+export const V4_SCHEMA_KIND = '"kind":"reinforce|challenge|decision|promise|followUp"'
+
+function swap(text: string, from: string, to: string): string {
+  const at = text.indexOf(from)
+  if (at < 0 || text.indexOf(from, at + 1) >= 0) throw new Error('live cues v4: the v3 writer rules changed; rebuild v4 from the new v3')
+  return text.slice(0, at) + to + text.slice(at + from.length)
+}
+
+/** Writer v4: v3 plus the decision, promise and followUp kinds. */
+export const CUE_WRITER_SYSTEM_V4 = swap(swap(swap(CUE_WRITER_SYSTEM_V3, V3_RULE_3, V4_RULE_3), V3_RULE_4, V4_RULE_4), V3_SCHEMA_KIND, V4_SCHEMA_KIND)

package/server/lib/live-cues-v2.ts

@@ -43,9 +43,11 @@ import { cueBefore, liveCueVerdicts, type LiveCueLogRow } from './live-cue-verdi
 import { repeatOf, wouldWithhold } from './live-cues-filter.js'
 import { errMsg } from './utils.js'
 import { CUE_GATE_QUESTIONS, CUE_JUDGE_INSTRUCTIONS, CUE_JUDGE_NONE, CUE_WRITER_SYSTEM_V2, CUE_WRITER_SYSTEM_V3 } from './live-cues-v2-prompts.js'
+import { CUE_WRITER_SYSTEM_V4 } from './live-cues-v2-prompts-kinds.js'
+import { MAC_CAPTURE_ID } from './mac-recording.js'
 import {
-  CUE_DETAIL_MAX, CUE_FEEDBACK_REASON_MAX, CUE_HEADLINE_MAX, LIVE_CUES_V2_PROTOCOL, isLiveCueV2,
-  type CueKind, type CueSourceRef, type LiveCueV1Compat, type LiveCueV2, type LiveCuesV2Capability, type LiveCuesV2MemorySource,
+  CUE_DETAIL_MAX, CUE_FEEDBACK_REASON_MAX, CUE_HEADLINE_MAX, CUE_KINDS, LEGACY_CUE_KINDS, LIVE_CUES_V2_PROTOCOL, isLiveCueV2, legacyCueKind,
+  type CueKind, type CueKindSet, type CueSourceRef, type LiveCueV1Compat, type LiveCueV2, type LiveCuesV2Capability, type LiveCuesV2MemorySource,
   type LiveCuesV2SessionStatus, type LiveCuesV2StatusResponse, type LiveCuesV2StopReason,
 } from '../../shared/live-cues-v2.js'
 
@@ -174,9 +176,23 @@ export function liveCuesV2Model(env: NodeJS.ProcessEnv = process.env): string {
   if (raw === 'sonnet' || raw === '') return 'claude-sonnet-5-5'
   return /^claude-[a-z0-9.-]{3,40}$/.test(raw) ? raw : 'claude-sonnet-5-5'
 }
-export function liveCuesV2WriterSystem(env: NodeJS.ProcessEnv = process.env): { version: 'v2' | 'v3'; system: string } {
+/** The writer rules. A meeting with the extended kinds (6.86.0) always runs v4: v2 and v3 only know reinforce and challenge.
+ *  Every other meeting is unchanged: COS_LIVE_CUES_V2_PROMPT=v2 picks v2, anything else v3. */
+export function liveCuesV2WriterSystem(env: NodeJS.ProcessEnv = process.env, kinds: CueKindSet = 'legacy'): { version: 'v2' | 'v3' | 'v4'; system: string } {
+  if (kinds === 'extended') return { version: 'v4', system: CUE_WRITER_SYSTEM_V4 }
   return (env.COS_LIVE_CUES_V2_PROMPT ?? '').trim() === 'v2' ? { version: 'v2', system: CUE_WRITER_SYSTEM_V2 } : { version: 'v3', system: CUE_WRITER_SYSTEM_V3 }
 }
+/** 6.86.0: which kinds a meeting gets when its armer does not say. A Mac recording (`mac_` capture id) is read only by COS
+ *  Control, which shows any kind, so it gets the extended set; every other meeting keeps the two legacy kinds, because a
+ *  companion that validates `kind` drops a cue whose kind it does not know. */
+export function defaultCueKindSet(sessionId: string): CueKindSet {
+  return MAC_CAPTURE_ID.test(sessionId) ? 'extended' : 'legacy'
+}
+/** 6.86.0: env COS_LIVE_CUES_V2_MAC=0 refuses live cues on Mac recordings (reason mac_cues_off) without touching glasses
+ *  meetings. Unset or anything else: Mac recordings may be armed, under the same switch and limits as every meeting. */
+export function liveCuesV2MacAllowed(env: NodeJS.ProcessEnv = process.env): boolean {
+  return (env.COS_LIVE_CUES_V2_MAC ?? '').trim() !== '0'
+}
 export function liveCuesV2WeeklyCap(env: NodeJS.ProcessEnv = process.env): number {
   const raw = Number(env.COS_LIVE_CUES_V2_WEEKLY)
   return Number.isFinite(raw) && raw >= 0 ? Math.floor(raw) : LIVE_CUES_V2_LIMITS.defaultWeeklyWriterCalls
@@ -253,7 +269,10 @@ export interface ParsedCue { detail: string; kind: CueKind; memoryIds: string[];
 export type CueRejection = 'null' | 'unparseable' | 'empty' | 'too_long' | 'unsupported_number'
 /** `enforceNumbers` withholds a cue whose numbers are not in the source. Off by default: on the held-out replay the
  *  guard fired on 3 v3 cues and only 1 was unsupported (ASR writes "300 000" and "a hundred"), so it is traced, not enforced. */
-export function parseWriterCue(raw: string, fallbackKind: CueKind, window: string, kept: MemoryNote[], enforceNumbers = false): ParsedCue | CueRejection {
+/** `allowed` is the meeting's kind set (6.86.0): a kind outside it, or none, falls back to the gate's kind, so a legacy
+ *  meeting can never carry decision, promise or followUp even when the writer answers with one. */
+export function parseWriterCue(raw: string, fallbackKind: CueKind, window: string, kept: MemoryNote[], enforceNumbers = false,
+  allowed: readonly CueKind[] = LEGACY_CUE_KINDS): ParsedCue | CueRejection {
   const text = raw.trim().replace(/^```(?:json)?\s*/i, '').replace(/\s*```$/, '').trim()
   if (!text || text === 'null') return 'null'
   const start = text.indexOf('{'), end = text.lastIndexOf('}')
@@ -265,7 +284,7 @@ export function parseWriterCue(raw: string, fallbackKind: CueKind, window: strin
   if (cue.length > CUE_DETAIL_MAX) return 'too_long'
   const numberFlags = unsupportedNumbers(cue, window, kept)
   if (enforceNumbers && numberFlags.length) return 'unsupported_number'
-  const kind: CueKind = value.kind === 'reinforce' || value.kind === 'challenge' ? value.kind : fallbackKind
+  const kind: CueKind = typeof value.kind === 'string' && (allowed as readonly string[]).includes(value.kind) ? value.kind as CueKind : fallbackKind
   const ids = new Set(kept.map(m => m.id))
   const memoryIds = Array.isArray(value.memoryIds) ? [...new Set(value.memoryIds.filter((x): x is string => typeof x === 'string' && ids.has(x)))] : []
   return { detail: cue, kind, memoryIds, numberFlags }
@@ -296,6 +315,9 @@ interface DurableState {
   ended: Record<string, number>; paused: Record<string, boolean>; pauseSeq: Record<string, number>
   meetings: Record<string, MeetingCounters>
   day: string; today: LiveCuesV2DayUsage
+  /** 6.86.0: meetings armed with resume (Mac recordings): a restarted server re-arms them on their next chunk, with the
+   *  kind set they were armed with. Cleared at end; expires with the counters (24 h). */
+  resume: Record<string, { at: number; kinds: CueKindSet }>
 }
 /** Local calendar day (YYYY-MM-DD) in `zone`. Intl, never toISOString: a UTC key flips the day at 19:00 Central. */
 export function localDay(now: Date, zone: string): string {
@@ -326,6 +348,8 @@ export class LiveCuesV2Store {
       const meetings = keep<MeetingCounters>(s.meetings, c => !!c && typeof c.at === 'number' && c.at >= nowMs - LIVE_CUES_V2_LIMITS.counterTtlMs)
       const live = (id: string) => id in meetings || !(id in ended)
       const paused = keep<boolean>(s.paused, v => v === true)
+      const resume = keep<{ at: number; kinds: CueKindSet }>(s.resume, r => !!r && typeof r === 'object' && typeof r.at === 'number'
+        && r.at >= nowMs - LIVE_CUES_V2_LIMITS.counterTtlMs && (r.kinds === 'legacy' || r.kinds === 'extended'))
       const pauseSeq = keep<number>(s.pauseSeq, v => typeof v === 'number' && Number.isFinite(v))
       for (const id of Object.keys(paused)) if (!live(id) && !(id in meetings)) delete paused[id]
       const sameWeek = s.weekStart === week
@@ -341,12 +365,12 @@ export class LiveCuesV2Store {
       else today = DAY_FIELDS.every(f => t[f] === undefined || Number(t[f]) >= 0)
         ? Object.fromEntries(DAY_FIELDS.map(f => [f, Number(t[f] ?? 0)])) as unknown as LiveCuesV2DayUsage
         : spentDay()
-      return { zone, weekStart: week, writerCalls: saturated ? Number.MAX_SAFE_INTEGER : sameWeek ? calls : 0, ended, paused, pauseSeq, meetings, day, today }
+      return { zone, weekStart: week, writerCalls: saturated ? Number.MAX_SAFE_INTEGER : sameWeek ? calls : 0, ended, paused, pauseSeq, meetings, day, today, resume }
     } catch {
       // An unreadable file fails closed for this week and this day (no spending) but keeps cues off nothing else.
       const zone = validZone(Intl.DateTimeFormat().resolvedOptions().timeZone) ?? 'UTC'
       return { zone, weekStart: localWeekStart(this.now(), zone), writerCalls: Number.MAX_SAFE_INTEGER, ended: {}, paused: {}, pauseSeq: {}, meetings: {},
-        day: localDay(this.now(), zone), today: spentDay() }
+        day: localDay(this.now(), zone), today: spentDay(), resume: {} }
     }
   }
   private write(s: DurableState): void {
@@ -393,7 +417,16 @@ export class LiveCuesV2Store {
     return m ? { cues: m.cues, writerCalls: m.writerCalls } : null
   }
   weeklyUsed(): number { return this.read().writerCalls }
-  end(sessionId: string): void { const s = this.read(); s.ended[sessionId] = this.now().getTime(); delete s.paused[sessionId]; this.write(s) }
+  end(sessionId: string): void { const s = this.read(); s.ended[sessionId] = this.now().getTime(); delete s.paused[sessionId]; delete s.resume[sessionId]; this.write(s) }
+  /** 6.86.0: remember an armed meeting so a restarted server re-arms it on its next chunk. One write, only when new. */
+  setResume(sessionId: string, kinds: CueKindSet): void {
+    const s = this.read()
+    if (sessionId in s.ended || s.resume[sessionId]?.kinds === kinds) return
+    s.resume[sessionId] = { at: this.now().getTime(), kinds }
+    this.write(s)
+  }
+  /** The kind set a meeting was armed with for resume, or null. */
+  resumeKinds(sessionId: string): CueKindSet | null { return this.read().resume[sessionId]?.kinds ?? null }
   isEnded(sessionId: string): boolean { return sessionId in this.read().ended }
   /** Applies only when `seq` is absent or newer than the last applied one. */
   setPaused(sessionId: string, paused: boolean, seq?: number): { applied: boolean; paused: boolean; pauseSeq: number } {
@@ -600,8 +633,14 @@ interface Session {
   /** The last reason cues were not produced, cleared by the next evaluation that runs the writer. */
   stopReason: LiveCuesV2StopReason | null
   skipTracedAt: Record<string, number>
+  /** 6.86.0: the kinds this meeting's cues may carry, fixed at arm. */
+  kinds: CueKindSet
 }
 
+/** 6.86.0: how a meeting is armed. `kinds` defaults by session (defaultCueKindSet); `resume` makes a restarted server re-arm
+ *  it on its next chunk (the Mac recording start passes it). */
+export interface LiveCuesV2ArmOptions { kinds?: CueKindSet; resume?: boolean }
+
 export class LiveCuesV2ArmError extends Error {
   constructor(readonly code: string, readonly status: number, message: string) { super(message); this.name = 'LiveCuesV2ArmError' }
 }
@@ -658,22 +697,32 @@ export class LiveCuesV2Engine {
     }
   }
 
-  /** Idempotent. A repeat start for an armed meeting keeps its counters; an ended meeting cannot be re-armed. */
-  arm(sessionId: string): { armed: true; sessionId: string; protocol: 2; cuesGenerated: number; paused: boolean; pauseSeq: number } {
+  /** Idempotent. A repeat start for an armed meeting keeps its counters and its kinds; an ended meeting cannot be re-armed.
+   *  `kinds` (6.86.0, additive) is the kind list this meeting's cues may carry. */
+  arm(sessionId: string, opts: LiveCuesV2ArmOptions = {}): { armed: true; sessionId: string; protocol: 2; cuesGenerated: number; paused: boolean; pauseSeq: number; kinds: CueKind[] } {
     this.reap()
     const cap = this.capability()
     if (!cap.available) throw new LiveCuesV2ArmError(cap.reason ?? 'unavailable', cap.reason === 'master_flag_off' ? 403 : 503, `Live cues v2 unavailable: ${cap.reason}.`)
+    const mac = MAC_CAPTURE_ID.test(sessionId)
+    if (mac && !liveCuesV2MacAllowed(this.deps.env)) throw new LiveCuesV2ArmError('mac_cues_off', 403, 'Live cues are switched off for Mac recordings (COS_LIVE_CUES_V2_MAC=0).')
     if (this.deps.store.isEnded(sessionId)) throw new LiveCuesV2ArmError('meeting_ended', 409, 'This meeting has ended; live cues cannot be re-armed for it.')
     const existing = this.sessions.get(sessionId)
     const nowMs = this.deps.now().getTime()
-    const answer = (cues: number) => ({ armed: true as const, sessionId, protocol: 2 as const, cuesGenerated: cues, paused: this.deps.store.isPaused(sessionId), pauseSeq: this.deps.store.pauseSeq(sessionId) })
-    if (existing) { existing.lastSeenAt = nowMs; return answer(existing.cues.length) }
+    const answer = (cues: number, kinds: CueKindSet) => ({ armed: true as const, sessionId, protocol: 2 as const, cuesGenerated: cues, paused: this.deps.store.isPaused(sessionId),
+      pauseSeq: this.deps.store.pauseSeq(sessionId), kinds: [...(kinds === 'extended' ? CUE_KINDS : LEGACY_CUE_KINDS)] })
+    if (existing) {
+      existing.lastSeenAt = nowMs
+      if (opts.resume) this.deps.store.setResume(sessionId, existing.kinds)
+      return answer(existing.cues.length, existing.kinds)
+    }
+    const kinds = opts.kinds ?? defaultCueKindSet(sessionId)
     const d = this.deps.now()
-    const title = `G2 Recording ${d.toLocaleDateString('en-CA')} ${String(d.getHours()).padStart(2, '0')}${String(d.getMinutes()).padStart(2, '0')}`
+    const title = `${mac ? 'Mac' : 'G2'} Recording ${d.toLocaleDateString('en-CA')} ${String(d.getHours()).padStart(2, '0')}${String(d.getMinutes()).padStart(2, '0')}`
     this.sessions.set(sessionId, { sessionId, title, armedAt: nowMs, lastSeenAt: nowMs, chunks: [], wordsSinceEval: 0, lastEvalAt: 0, lastCueAt: 0,
-      inFlight: null, cues: [], evaluations: 0, failures: 0, breaker: false, stopReason: null, skipTracedAt: {} })
+      inFlight: null, cues: [], evaluations: 0, failures: 0, breaker: false, stopReason: null, skipTracedAt: {}, kinds })
+    if (opts.resume) this.deps.store.setResume(sessionId, kinds)
     this.deps.warmMemory()
-    return answer(this.deps.store.counters(sessionId).cues)
+    return answer(this.deps.store.counters(sessionId).cues, kinds)
   }
 
   /** Stop or save: tombstone FIRST (so trailing chunks cannot revive it), then abort any evaluation in flight. */
@@ -683,7 +732,8 @@ export class LiveCuesV2Engine {
     s?.inFlight?.abort()
     const cues = s ? [...s.cues] : []
     return { nudgesGenerated: cues.length, protocol: 2, cues,
-      nudges: cues.map(c => ({ nudge: c.headline, type: c.kind, priority: 2, timestamp: c.createdAt, cueId: c.cueId })) }
+      // v1 readers know two types: an extended kind is shown as its legacy kind there (the cues keep the real one).
+      nudges: cues.map(c => ({ nudge: c.headline, type: legacyCueKind(c.kind), priority: 2, timestamp: c.createdAt, cueId: c.cueId })) }
   }
 
   setPaused(sessionId: string, paused: boolean, seq?: number): { ok: true; paused: boolean; applied: boolean; pauseSeq: number } {
@@ -735,8 +785,11 @@ export class LiveCuesV2Engine {
     if (this.deps.store.isEnded(sessionId)) return                    // tombstone before any auto-arm
     let s = this.sessions.get(sessionId)
     if (!s) {
-      if (this.deps.env.COS_LIVE_CUES_AUTO !== '1') return
-      try { this.arm(sessionId) } catch { return }
+      // 6.86.0: a meeting armed with resume (a Mac recording) is re-armed with its kinds after a server restart.
+      const resume = this.deps.store.resumeKinds(sessionId)
+      if (this.deps.env.COS_LIVE_CUES_AUTO !== '1' && !resume) return
+      try { this.arm(sessionId, resume ? { kinds: resume } : {}) } catch { return }
+      if (resume) this.deps.trace({ kind: 'resume', at: this.deps.now().toISOString(), sessionId, kindSet: resume })
       s = this.sessions.get(sessionId)
       if (!s) return
     }
@@ -827,7 +880,8 @@ export class LiveCuesV2Engine {
       if (counters.cues >= lim.maxCues || counters.writerCalls >= lim.writerCap) { trace.outcome = 'meeting_cap'; return }
       if (this.deps.store.dailyWriterCalls() >= lim.dailyWriterCalls) { trace.outcome = 'daily_cap'; s.stopReason = 'budget_exhausted'; return }
       if (!this.deps.store.charge(liveCuesV2WeeklyCap(this.deps.env), s.sessionId)) { trace.outcome = 'budget_exhausted'; s.stopReason = 'budget_exhausted'; return }
-      const { version, system } = liveCuesV2WriterSystem(this.deps.env)
+      const { version, system } = liveCuesV2WriterSystem(this.deps.env, s.kinds)
+      if (s.kinds === 'extended') trace.kindSet = 'extended'
       const model = liveCuesV2Model(this.deps.env)
       const previous = s.cues.slice(-3).map(c => c.detail)
       const promptMemory = kept.map(m => ({ id: m.id, date: m.date, title: m.title, notes: m.notes }))  // the replay's exact keys
@@ -839,7 +893,8 @@ export class LiveCuesV2Engine {
       s.failures = 0
       s.stopReason = null
 
-      const parsed = parseWriterCue(out.text, gate.kind, window, kept, this.deps.env.COS_LIVE_CUES_V2_NUMBER_GUARD === 'withhold')
+      const parsed = parseWriterCue(out.text, gate.kind, window, kept, this.deps.env.COS_LIVE_CUES_V2_NUMBER_GUARD === 'withhold',
+        s.kinds === 'extended' ? CUE_KINDS : LEGACY_CUE_KINDS)
       if (typeof parsed === 'string') { trace.outcome = parsed === 'null' ? 'writer_null' : `withheld_${parsed}`; return }
       const elapsed = this.deps.now().getTime() - started
       if (s.wordsSinceEval > L.staleWords || elapsed > L.staleMs) { trace.outcome = 'stale'; return }
@@ -869,7 +924,7 @@ export class LiveCuesV2Engine {
       s.lastCueAt = cue.createdAt
       this.deps.store.recordCue(s.sessionId)
       this.deps.emit('coaching_nudge_v2', cue as unknown as Record<string, unknown>)
-      const v1: LiveCueV1Compat = { nudge: cue.headline, type: cue.kind, priority: 2, cueId: cue.cueId, sessionId: s.sessionId, protocol: 2 }
+      const v1: LiveCueV1Compat = { nudge: cue.headline, type: legacyCueKind(cue.kind), priority: 2, cueId: cue.cueId, sessionId: s.sessionId, protocol: 2 }
       this.deps.emit('coaching_nudge', v1 as unknown as Record<string, unknown>)
       Object.assign(trace, { outcome: 'cue', cueId: cue.cueId, cueChars: cue.detail.length, sources: sources.length, ...(parsed.numberFlags.length ? { numberFlags: parsed.numberFlags.length } : {}) })
     } catch (error) {
@@ -941,6 +996,25 @@ export function liveCuesV2(): LiveCuesV2Engine {
 export function peekLiveCuesV2(): LiveCuesV2Engine | null { return engine }
 export function liveCuesV2Capability(): LiveCuesV2Capability { return liveCuesV2().capability() }
 
+/** 6.86.0: what POST /api/mac-recording/start answers under `liveCues` when COS Control asked for cues. Never throws:
+ *  a refusal is a reason code and the recording starts regardless. */
+export type MacLiveCuesAnswer =
+  | { armed: true; kinds: CueKind[]; cuesGenerated: number; paused: boolean; pauseSeq: number }
+  | { armed: false; reason: string }
+/** Arms live cues for a Mac recording, under the same switch, caps and limits as every meeting, with the extended kinds and
+ *  resume (a restarted server re-arms it on its next chunk). With v2 off the answer is master_flag_off and the engine is
+ *  never built: a Mac recording never reaches the v1 Composer path. */
+export function armMacLiveCues(sessionId: string, env: NodeJS.ProcessEnv = process.env): MacLiveCuesAnswer {
+  if (!liveCuesV2Enabled(env)) return { armed: false, reason: 'master_flag_off' }
+  if (!liveCuesV2MacAllowed(env)) return { armed: false, reason: 'mac_cues_off' }
+  try {
+    const a = liveCuesV2().arm(sessionId, { resume: true })
+    return { armed: true, kinds: a.kinds, cuesGenerated: a.cuesGenerated, paused: a.paused, pauseSeq: a.pauseSeq }
+  } catch (error) {
+    return { armed: false, reason: error instanceof LiveCuesV2ArmError ? error.code : 'unavailable' }
+  }
+}
+
 /** GET/POST /api/live-cues/v2/settings (COS Control's toggle). */
 export interface LiveCuesV2SettingsResponse { enabled: boolean; source: LiveCuesV2SettingSource; capability: LiveCuesV2Capability }
 export function liveCuesV2SettingsView(env: NodeJS.ProcessEnv = process.env): LiveCuesV2SettingsResponse {

package/server/lib/live-provisional.ts

@@ -0,0 +1,87 @@
+// 6.86.0: the newest provisional (grey) line of a live meeting, for COS Control's live meeting view.
+//
+// The preview route (POST /transcribe-stream/preview) already turns the still-open phrase into fast provisional text and
+// hands it to the client that posted the audio. Control reads the meeting from the active-session file and does not post
+// the glasses audio, so it never saw that text. This keeps ONE entry per live meeting, the newest preview, in memory only,
+// and GET /transcribe-stream/provisional serves it. The canonical chunk that settles the same index removes it.
+//
+// Why memory and a route, not a field in active-sessions/<id>.json:
+//   - that file is the 4-hour crash-recovery record. Anything written there outlives a crash; this text must not outlive
+//     the live session, so it never touches disk;
+//   - the file is written with fsync before each chunk is acknowledged. Writing it again per preview would add a durable
+//     write on the recording path, and churn the stamp Control uses to skip unchanged reads.
+//
+// Never logged: this module has no console call, and the route answers only to an authenticated client. Bounded: at most
+// LIVE_PROVISIONAL_LIMITS.maxSessions meetings, the last maxChars characters, and an entry older than ttlMs reads as none.
+
+export const LIVE_PROVISIONAL_LIMITS = {
+  /** The last characters (code points) of the preview are kept: the newest words are the ones still changing. */
+  maxChars: 600,
+  maxSessions: 8,
+  /** A preview not replaced or settled within this long reads as none (the phone stopped posting, a stuck chunk). */
+  ttlMs: 30_000,
+} as const
+
+export interface LiveProvisional {
+  chunkIndex: number
+  previewGen: number
+  text: string
+  model: string
+  /** Epoch ms when the server stored it. */
+  at: number
+}
+
+export class LiveProvisionalStore {
+  private readonly entries = new Map<string, LiveProvisional>()
+  constructor(private readonly now: () => number = Date.now) {}
+
+  /** Keeps `entry` when it is newer than the one held: a later chunk, or the same chunk with a later previewGen. A
+   *  preview that arrives after its chunk settled is refused by the caller (settledThrough), never stored here. */
+  record(sessionId: string, entry: Omit<LiveProvisional, 'at'>): boolean {
+    const text = Array.from(entry.text.replace(/\s+/g, ' ').trim()).slice(-LIVE_PROVISIONAL_LIMITS.maxChars).join('')
+    if (!text) return false
+    const held = this.entries.get(sessionId)
+    if (held && !this.expired(held) && (entry.chunkIndex < held.chunkIndex || (entry.chunkIndex === held.chunkIndex && entry.previewGen <= held.previewGen))) return false
+    this.entries.delete(sessionId)                      // re-insert, so Map order is oldest first for eviction
+    this.entries.set(sessionId, { chunkIndex: entry.chunkIndex, previewGen: entry.previewGen, text, model: entry.model, at: this.now() })
+    for (const [id, e] of this.entries) if (this.expired(e)) this.entries.delete(id)
+    while (this.entries.size > LIVE_PROVISIONAL_LIMITS.maxSessions) {
+      const oldest = this.entries.keys().next().value
+      if (oldest === undefined) break
+      this.entries.delete(oldest)
+    }
+    return true
+  }
+
+  /** The canonical answer for `chunkIndex` landed (text, silence or a drop): a preview for it or an earlier chunk goes. */
+  settle(sessionId: string, chunkIndex: number): void {
+    const held = this.entries.get(sessionId)
+    if (held && held.chunkIndex <= chunkIndex) this.entries.delete(sessionId)
+  }
+
+  /** The meeting closed (saved, discarded, expired, quarantined). */
+  clear(sessionId: string): void { this.entries.delete(sessionId) }
+
+  read(sessionId: string): LiveProvisional | null {
+    const held = this.entries.get(sessionId)
+    if (!held) return null
+    if (this.expired(held)) { this.entries.delete(sessionId); return null }
+    return { ...held }
+  }
+
+  size(): number { return this.entries.size }
+
+  private expired(e: LiveProvisional): boolean { return this.now() - e.at > LIVE_PROVISIONAL_LIMITS.ttlMs }
+}
+
+let store: LiveProvisionalStore | null = null
+export function liveProvisional(): LiveProvisionalStore { return (store ??= new LiveProvisionalStore()) }
+
+/** 6.86.0: what /api/health and /api/models publish as `capabilities.liveMeeting`, so COS Control gates the live meeting
+ *  view by capability, never by a status code. Constants only (health is public). An older server omits the key.
+ *  - macLiveCues: POST /api/mac-recording/start takes `liveCues: true` and answers `liveCues: {armed, ...}`.
+ *  - provisional: GET <route>?sessionId= serves the newest preview of a live meeting.
+ *  - chunkLevels (6.87.0): the active-session record keeps `chunkLevels[{i, level, speechSec}]` (lib/chunk-levels.ts). */
+export function liveMeetingCapability(): { protocol: 1; macLiveCues: true; provisional: { route: string; maxChars: number; ttlMs: number }; chunkLevels: true } {
+  return { protocol: 1, macLiveCues: true, provisional: { route: '/api/transcribe-stream/provisional', maxChars: LIVE_PROVISIONAL_LIMITS.maxChars, ttlMs: LIVE_PROVISIONAL_LIMITS.ttlMs }, chunkLevels: true }
+}

package/server/lib/meeting-ask-owner.ts

@@ -83,7 +83,7 @@ export interface OwnerMatch { heard: string; owner: string }
 /**
  * Whether the question names the owner, allowing ASR spellings. Full name: first and last words, in
  * order and adjacent. Surname alone: only after a lead-in word ("who is Ukoma"), never after another
- * first name ("Isaiah Ukaoma" is someone else). First name alone: only when it is the whole subject of
+ * first name ("Rafael Ukaoma" is someone else). First name alone: only when it is the whole subject of
  * a who question, compared exactly.
  */
 export function matchOwnerName(question: string, ownerName: string | null | undefined): OwnerMatch | null {

package/server/lib/meeting-fact-check.ts

@@ -151,7 +151,7 @@ const LEAD_WORDS = new Set('i im am we were are it its is starting leaving going
 export const US_STATE_CODES = new Set('AL AK AZ AR CA CO CT DE FL GA HI ID IL IN IA KS KY LA ME MD MA MI MN MS MO MT NE NV NH NJ NM NY NC ND OH OK OR PA RI SC SD TN TX UT VT VA WA WV WI WY DC PR GU VI AS MP'.split(' '))
 /**
  * Larger US cities and the owner's Austin metro: a typed "City, ST" origin must name one of these (static, no
- * private data), so "Amira TX" or "Silas PM" are never places.
+ * private data), so "Talia TX" or "Silas PM" are never places.
  */
 const US_CITIES = new Set(`new york|los angeles|chicago|houston|phoenix|philadelphia|san antonio|san diego|dallas|san jose|austin|jacksonville|fort worth|columbus|charlotte|san francisco|indianapolis|seattle|denver|washington|boston|el paso|nashville|detroit|oklahoma city|portland|las vegas|memphis|louisville|baltimore|milwaukee|albuquerque|tucson|fresno|mesa|sacramento|atlanta|kansas city|colorado springs|omaha|raleigh|miami|long beach|virginia beach|oakland|minneapolis|tulsa|tampa|arlington|new orleans|wichita|cleveland|bakersfield|aurora|anaheim|honolulu|santa ana|riverside|corpus christi|lexington|henderson|stockton|saint paul|st paul|st louis|saint louis|cincinnati|pittsburgh|greensboro|anchorage|plano|lincoln|orlando|irvine|newark|durham|chula vista|toledo|fort wayne|st petersburg|laredo|jersey city|chandler|madison|lubbock|scottsdale|reno|buffalo|gilbert|glendale|north las vegas|winston salem|chesapeake|norfolk|fremont|garland|irving|hialeah|richmond|boise|spokane|baton rouge|tacoma|san bernardino|modesto|fontana|des moines|santa clarita|fayetteville|birmingham|oxnard|rochester|grand rapids|huntsville|salt lake city|frisco|yonkers|amarillo|huntington beach|mckinney|montgomery|augusta|akron|little rock|tempe|overland park|grand prairie|tallahassee|cape coral|mobile|knoxville|shreveport|worcester|sioux falls|chattanooga|brownsville|fort lauderdale|providence|santa rosa|peoria|salem|eugene|cary|fort collins|springfield|jackson|alexandria|lancaster|pasadena|naperville|bellevue|killeen|midland|odessa|savannah|syracuse|denton|waco|charleston|hartford|new haven|stamford|columbia|santa clara|ann arbor|cambridge|lansing|evansville|college station|beaumont|provo|boulder|tyler|las cruces|green bay|san mateo|burbank|south bend|davenport|tuscaloosa|san angelo|round rock|cedar park|georgetown|leander|pflugerville|san marcos|new braunfels|liberty hill|hutto|kyle|buda|lakeway|bee cave|temple|bryan|abilene|wichita falls|galveston|mcallen|edinburg|pearland|sugar land|the woodlands|conroe|katy|allen|richardson|carrollton|lewisville|flower mound|mesquite|harlingen|key west|palm springs|santa fe|flagstaff|billings|fargo|bismarck|cheyenne|casper|missoula|juneau|burlington|portsmouth|manchester|wilmington|dover|annapolis|trenton|albany|montpelier|concord|augusta|bangor|duluth|des plaines|evanston|topeka|lawrence|olathe|independence|st joseph|joplin|branson|springdale|bentonville|rogers|fayetteville|hot springs|jonesboro|norman|edmond|lafayette|lake charles|monroe|gulfport|biloxi|hattiesburg|pensacola|gainesville|daytona beach|sarasota|naples|fort myers|clearwater|lakeland|ocala|asheville|greenville|myrtle beach|columbia|athens|macon|dothan|chattanooga|knoxville|murfreesboro|clarksville|bowling green|owensboro|dayton|youngstown|canton|erie|scranton|allentown|reading|harrisburg|lancaster|altoona|morgantown|roanoke|lynchburg|charlottesville|norfolk|hampton|newport news`.split('|'))
 /** A full city label the user typed: a listed US city, then a real state code ("Dallas, TX", "San Antonio TX"). */

package/server/lib/transcript-cleanup-context.ts

@@ -10,7 +10,7 @@
 // SCREEN AWARENESS. On-screen text lines COS Control recorded during the meeting
 // (transcript-cleanup-screen.ts), shown beside each passage by time.
 //
-// TERMS. Every source contributes terms: capitalised words and runs of them ("Queen
+// TERMS. Every source contributes terms: capitalised words and runs of them ("Grace
 // Ukaoma", "Jewel360"). Terms are the per-meeting vocabulary: deterministic correction
 // may write a term from this meeting's screen or files, the model may write any term,
 // and a term the model writes that came from the meeting (not the dictionary) becomes a
@@ -86,7 +86,7 @@ export function extractTerms(text: string, max: number = CONTEXT_LIMITS.termsPer
     const w = words[i].w
     const capital = /^\p{Lu}/u.test(w)
     if (looksLikeName(w)) out.add(w)
-    // "Queen Ukaoma": a capitalised word directly before a name-like word, with nothing but a space between.
+    // "Grace Ukaoma": a capitalised word directly before a name-like word, with nothing but a space between.
     if (capital && i + 1 < words.length && text.slice(words[i].end, words[i + 1].at) === ' ' && looksLikeName(words[i + 1].w)) {
       out.add(`${w} ${words[i + 1].w}`)
     }

package/server/lib/transcript-cleanup-model.ts

@@ -5,7 +5,7 @@
 // servers, no hooks, an empty scratch workspace, a pinned model id, low effort, a
 // bounded output budget. Never a direct SDK. The doubtful spans of a meeting go in ONE
 // batched prompt; the answer is strict JSON, one entry per span id:
-//   {"edits":[{"id":"S1","action":"keep"},{"id":"S2","action":"replace","text":"Queen Ukaoma"}]}
+//   {"edits":[{"id":"S1","action":"keep"},{"id":"S2","action":"replace","text":"Grace Ukaoma"}]}
 //
 // THE GUARDS. Every replacement is checked before anything is applied. It is rejected if
 //   unknown_span      its id was not sent

package/server/lib/transcript-cleanup-spans.ts

@@ -19,7 +19,7 @@
 //                     adjacent pieces joined ("U coma"), none a function word; or the
 //                     leading-y rule at any confidence ("Yukoma" for Ukaoma)
 //    oov_capitalized  a capitalised word mid-sentence that is no known name and no common
-//                     word, within two words of a known name ("Queen Eucoma")
+//                     word, within two words of a known name ("Grace Eucoma")
 //    repeat           a phrase of 2 to 4 words (or one long word) said three or more
 //                     times in a row: the classic decoder loop
 //    Flagged words one word apart merge; a span holds at most 6 words (12 for a repeat)

package/server/lib/transcript-cleanup.ts

@@ -405,7 +405,7 @@ export function recordSuggestions(applied: readonly AppliedEdit[], pack: Context
   for (const edit of applied) {
     const heardKeys = new Set([...edit.original.matchAll(WORDS)].map(m => fold(m[0])))
     const ws = [...edit.replacement.matchAll(WORDS)].map(m => m[0])
-    // Longest first: "Queen Ukaoma" is one suggestion, not that plus "Ukaoma".
+    // Longest first: "Grace Ukaoma" is one suggestion, not that plus "Ukaoma".
     const candidates = [...new Set<string>([edit.replacement, ...ws.slice(0, -1).map((w, i) => `${w} ${ws[i + 1]}`), ...ws])]
       .sort((a, b) => b.split(' ').length - a.split(' ').length)
     const covered = new Set<string>()

package/server/routes/health.ts

@@ -73,6 +73,14 @@ import { maintenanceLifecycle } from '../lib/maintenance-lifecycle.js'
 import { getLocalTtsHealth, refreshLocalTtsHealth } from '../lib/tts-local.js'
 import { liveCuesCapability } from '../lib/live-cues-capability.js'
 import { liveCuesV2Advertised } from '../lib/live-cues-v2.js'
+import { liveMeetingCapability } from '../lib/live-provisional.js'
+import { CUE_KINDS } from '../../shared/live-cues-v2.js'
+
+/** 6.86.0: `capabilities.liveCues.kinds`, the cue kinds this server can write (additive; an older server omits it, which
+ *  is how a client knows to expect only reinforce and challenge). Which kinds a given meeting gets is in its arm answer. */
+function withCueKinds<T extends object>(capability: T): T & { kinds: string[] } {
+  return { ...capability, kinds: [...CUE_KINDS] }
+}
 import { transcriptCleanupAdvertised } from './transcript-cleanup.js'
 import { getMeetingSyncSnapshot } from '../lib/meeting-batch-progress.js'
 import { listUnsavedCaptures } from '../lib/unsaved-audio-quarantine.js'
@@ -506,8 +514,9 @@ healthRouter.get('/health', async (_req, res) => {
         carriedAcrossBoot: maintenance.operation?.carriedAcrossBoot ?? false,
       },
       cliDebug: CLI_DEBUG_CAPABILITY,
-      liveCues,
+      liveCues: withCueKinds(liveCues),
       ...(liveCuesV2Advertised() ? { liveCuesV2: liveCuesV2Advertised() } : {}),
+      liveMeeting: liveMeetingCapability(),
       // 6.77.0: codes only (this route is public): the protocol and whether the switch is on.
       transcriptCleanup: transcriptCleanupAdvertised(),
       richMedia: {
@@ -703,8 +712,9 @@ healthRouter.get('/models', async (req, res) => {
       // Same helper as /api/health — the companion's 15s liveness poll reads
       // THIS surface, so a value present only on /api/health leaves the
       // live-cues indicator blind.
-      liveCues: liveCuesCapability(),
+      liveCues: withCueKinds(liveCuesCapability()),
       ...(liveCuesV2Advertised() ? { liveCuesV2: liveCuesV2Advertised() } : {}),
+      liveMeeting: liveMeetingCapability(),
       richMedia: {
         video: richMedia.video,
         maxPromptVisuals: MAX_MODEL_IMAGE_INPUTS,

package/server/routes/live-cues.ts

@@ -1,7 +1,9 @@
 // Live Cues routes. Authenticated by the global /api X-Cos-Token middleware
 // (index.ts:148) like every other /api route — no route-local auth needed.
 //
-// POST /live-cues/start { sessionId }  -> { armed, sessionId, pipelinesUsed }
+// POST /live-cues/start { sessionId, kinds? }  -> { armed, sessionId, pipelinesUsed } (v1) or the v2 arm answer
+//   kinds (6.86.0, v2 only): 'legacy' (reinforce, challenge) or 'extended' (plus decision, promise, followUp). Absent: a
+//   Mac recording (mac_ id) gets extended, every other meeting legacy, so an older companion never sees a kind it drops.
 // POST /live-cues/stop  { sessionId }  -> { nudgesGenerated, nudges }
 // GET  /live-cues/status               -> engine snapshot + capability
 // GET  /live-cues/v2/settings           -> { enabled, source: env|setting|default, capability }       (6.76.2)
@@ -45,8 +47,12 @@ liveCuesRouter.post('/live-cues/start', async (req, res) => {
   if (!sessionId || !SESSION_ID.test(sessionId)) {
     return res.status(400).json({ error: 'sessionId required', reason: 'missing_session_id' })
   }
+  const kinds = (req.body as { kinds?: unknown } | undefined)?.kinds
+  if (kinds !== undefined && kinds !== 'legacy' && kinds !== 'extended') {
+    return res.status(400).json({ error: "kinds must be 'legacy' or 'extended'", reason: 'invalid_kinds' })
+  }
   try {
-    if (liveCuesV2Enabled()) return res.json(liveCuesV2().arm(sessionId))
+    if (liveCuesV2Enabled()) return res.json(liveCuesV2().arm(sessionId, kinds ? { kinds } : {}))
     const result = await armLiveCues(sessionId)
     return res.json(result)
   } catch (error) {

package/server/routes/prompt-drafts.ts

@@ -414,7 +414,7 @@ async function transcribeChunk(draftId: string, chunkIndex: number, audio: Buffe
       // plus the decoder's own low confidence (prompt-tail-guard.ts).
       const guarded = guardPromptTail({ text: result.text, words: result.words, speech: speechWindowsFromWav(audio) })
       for (const drop of guarded.dropped) {
-        console.warn(`[prompt-draft] tail_drop ${draftId}/${chunkIndex} ${purpose}/${mode} (${drop.reason}, start=${drop.startSec ?? '?'}s, lastSpeech=${guarded.lastSpeechEndSec ?? '?'}s, p=${drop.meanProbability?.toFixed(2) ?? '?'}): "${drop.text.slice(0, 100)}"`)
+        console.warn(`[prompt-draft] tail_drop ${draftId}/${chunkIndex} ${purpose}/${mode} (${drop.reason}, start=${drop.startSec ?? '?'}s, lastSpeech=${guarded.lastSpeechEndSec ?? '?'}s, p=${drop.meanProbability?.toFixed(2) ?? '?'}): chars=${drop.text.length}`)
       }
       if (guarded.dropped.length > 0 && !guarded.text.trim()) throw new NoSpeechDetectedError(result.text)
       const text = sanitizeTranscript(draftId, guarded.text)

package/server/routes/transcribe-stream.ts

@@ -115,6 +115,9 @@ import {
   type MaintenanceWorkLease,
 } from '../lib/maintenance-lifecycle.js'
 import { feedLiveCueTranscript } from '../lib/live-cues-engine.js'
+import { armMacLiveCues, type MacLiveCuesAnswer } from '../lib/live-cues-v2.js'
+import { liveProvisional } from '../lib/live-provisional.js'
+import { chunkLevel, restoreChunkLevels, withChunkLevel, type ChunkLevel } from '../lib/chunk-levels.js'
 import { preemptMetalBatchForLive, registerLiveActivityProbe } from '../lib/whisper-metal-gate.js'
 import {
   scheduleProgressiveHqCheckpoint,
@@ -346,6 +349,8 @@ interface TranscriptSession {
   /** Exact replay records for silent/filtered ASR completions. */
   emptyCompletions?: Record<string, EmptyTranscriptCompletion>
   maxChunkIndex?: number
+  /** 6.87.0: two numbers per chunk (level 0 to 1, Silero speech seconds) for Control's level strip. Never text. */
+  chunkLevels?: ChunkLevel[]
   /** Persisted idle-retention clock. Meeting date/duration still use startTime. */
   lastActivityAt: number
   // Count of consecutive vocab-echo (prompt-regurgitation) chunks. Reset to 0 by
@@ -711,6 +716,7 @@ function persistSessionRequired(sessionId: string): void {
       emptyCompletions: session.emptyCompletions ?? {},
       maxChunkIndex: session.maxChunkIndex ?? -1,
       providerCandidates: session.providerCandidates ?? {},
+      chunkLevels: session.chunkLevels ?? [],
     })
   try {
     durableAtomicWriteFileSync(filePath, data, { mode: 0o600 })
@@ -899,6 +905,7 @@ function recoverSessions(): void {
               providerCandidates: data.providerCandidates && typeof data.providerCandidates === 'object'
                 ? data.providerCandidates
                 : {},
+              chunkLevels: restoreChunkLevels(data.chunkLevels),
             }
             // Retroactively strip inline hallucinations from recovered chunks.
             // Two-pass: (1) scan all chunks to build frequency/blocklist,
@@ -1409,10 +1416,23 @@ function recordReceivedChunk(session: TranscriptSession, chunkIndex: number): vo
   }
 }
 
-function recordAsrCompleted(session: TranscriptSession, chunkIndex: number): void {
+function recordAsrCompleted(session: TranscriptSession, chunkIndex: number, sessionId: string): void {
   if (!Number.isInteger(chunkIndex) || chunkIndex < 0) return
   if (!session.asrCompletedIndices) session.asrCompletedIndices = []
   insertSortedUnique(session.asrCompletedIndices, chunkIndex)
+  // 6.86.0: the canonical answer replaces the grey provisional line for this chunk (live-provisional.ts).
+  liveProvisional().settle(sessionId, chunkIndex)
+}
+
+/** 6.86.0: keep the newest preview of a LIVE meeting for COS Control's grey line. Only a session this server holds (a
+ *  close removes it from `sessions`), and only while that chunk is still open: a preview that lands after its chunk (or a
+ *  later one) settled is stale. Memory only; never logged. */
+function noteLiveProvisional(sessionId: string, chunkIndex: number, previewGen: number, text: string, model: string): void {
+  const session = sessions.get(sessionId)
+  if (!session) return
+  const completed = session.asrCompletedIndices ?? []
+  if (completed.length && chunkIndex <= completed[completed.length - 1]) return
+  liveProvisional().record(sessionId, { chunkIndex, previewGen, text, model })
 }
 
 function canonicalIndices(session: TranscriptSession): number[] {
@@ -1773,6 +1793,7 @@ function finishClosingTranscriptSession(
   sessions.delete(sessionId)
   sessionAudioBytes.delete(sessionId)
   sessionAudioWrites.delete(sessionId)
+  liveProvisional().clear(sessionId)
   // Clean up inline hallucination tracking (was leaking until 4-hour interval fired)
   clearSessionHallucinationState(sessionId)
   // Track as deleted so orphan heartbeats get 410 Gone (prevents zombie client spam)
@@ -2088,7 +2109,7 @@ function sanitizeStreamTranscript(sessionId: string, session: TranscriptSession,
     const dropReason = streamSilenceDropReason(trimmedText, isQuiet)
     const flagAllows = dropReason === 'thankyou_silence' ? THANKYOU_FILTER : STRIP_BRAND_URLS
     if (dropReason && flagAllows) {
-      console.log(`[hallucination] Dropped (${dropReason}, q=${isQuiet ? 1 : 0}): "${trimmedText.slice(0, 60)}"`)
+      console.log(`[hallucination] Dropped (${dropReason}, q=${isQuiet ? 1 : 0}): chars=${trimmedText.length}`)
       return { text: '', fallbackReason: dropReason }
     }
   }
@@ -2106,7 +2127,7 @@ function sanitizeStreamTranscript(sessionId: string, session: TranscriptSession,
     const streak = (session.vocabEchoStreak ?? 0) + 1
     session.vocabEchoStreak = streak
     if (isQuiet || streak >= 2 || isCrossChunkRepeat(session, trimmedText)) {
-      console.log(`[hallucination] Dropped (vocab_echo, q=${isQuiet ? 1 : 0}, streak=${streak}): "${trimmedText.slice(0, 60)}"`)
+      console.log(`[hallucination] Dropped (vocab_echo, q=${isQuiet ? 1 : 0}, streak=${streak}): chars=${trimmedText.length}`)
       return { text: '', fallbackReason: 'vocab_echo' }
     }
   } else if (trimmedText) {
@@ -2377,7 +2398,7 @@ async function processStreamChunk(opts: {
   if (alreadyCanonical?.text) {
     session.lastActivityAt = Date.now()
     recordReceivedChunk(session, chunkIndex)
-    recordAsrCompleted(session, chunkIndex)
+    recordAsrCompleted(session, chunkIndex, sessionId)
     if (candidate && candidateRecordKey) {
       session.providerCandidates![candidateRecordKey].accepted =
         alreadyCanonical.asrProvider === 'iphone-whisperkit-beta' && alreadyCanonical.audioSha256 === audioSha256
@@ -2390,7 +2411,7 @@ async function processStreamChunk(opts: {
   if (alreadyEmpty) {
     session.lastActivityAt = Date.now()
     recordReceivedChunk(session, chunkIndex)
-    recordAsrCompleted(session, chunkIndex)
+    recordAsrCompleted(session, chunkIndex, sessionId)
     persistSessionRequired(sessionId)
     return emptyChunkResponse(alreadyEmpty, sessionId, chunkIndex)
   }
@@ -2423,6 +2444,8 @@ async function processStreamChunk(opts: {
   const quiet = decideQuiet(audioBuffer, stt.quietGate)
   const rms = quiet.rms
   const isQuiet = quiet.isQuiet
+  // 6.87.0: the level strip's two numbers, on the record every terminal path below persists. Not text, never logged.
+  session.chunkLevels = withChunkLevel(session.chunkLevels, chunkLevel(chunkIndex, rms, quiet.speechSec))
   const whisperAudio = isQuiet ? audioBuffer : await asrFrontEnd(audioBuffer, stt.frontEnd)
   const whisperContext = recentWhisperContext(sessionId, session)
   console.log(`[perf] whisperContext: ${whisperContext.length}b | session.chunks: ${session.chunks.length}`)
@@ -2524,7 +2547,7 @@ async function processStreamChunk(opts: {
   if (labels.segments) labels.segments = labels.segments.map(segment => policyLabel(segment, capturePolicy))
 
   if (!trimmedText) {
-    console.log(`[hallucination] Filtered (${sanitized.fallbackReason || fallbackReason || 'empty'}): "${rawText.slice(0, 60)}"`)
+    console.log(`[hallucination] Filtered (${sanitized.fallbackReason || fallbackReason || 'empty'}): chars=${rawText.length}`)
     if (candidate && candidateRecordKey && session.providerCandidates?.[candidateRecordKey]) {
       session.providerCandidates[candidateRecordKey].accepted = false
       session.providerCandidates[candidateRecordKey].fallbackReason = sanitized.fallbackReason || fallbackReason || 'empty'
@@ -2543,7 +2566,7 @@ async function processStreamChunk(opts: {
     }
     session.emptyCompletions ??= {}
     session.emptyCompletions[String(chunkIndex)] = emptyCompletion
-    recordAsrCompleted(session, chunkIndex)
+    recordAsrCompleted(session, chunkIndex, sessionId)
     persistSessionRequired(sessionId)
     scheduleSessionProgressiveHq(sessionId)
     return emptyChunkResponse(emptyCompletion, sessionId, chunkIndex)
@@ -2578,12 +2601,12 @@ async function processStreamChunk(opts: {
         session.providerCandidates[candidateRecordKey].accepted ? undefined : 'canonical_exists'
     }
     session.lastActivityAt = Date.now()
-    recordAsrCompleted(session, chunkIndex)
+    recordAsrCompleted(session, chunkIndex, sessionId)
     persistSessionRequired(sessionId)
     return canonicalChunkResponse(finalExisting, sessionId, chunkIndex)
   }
   session.chunks[chunkIndex] = chunk
-  recordAsrCompleted(session, chunkIndex)
+  recordAsrCompleted(session, chunkIndex, sessionId)
   if (candidate && candidateRecordKey) {
     if (session.providerCandidates?.[candidateRecordKey]) {
       session.providerCandidates[candidateRecordKey].accepted = asrProvider === 'iphone-whisperkit-beta'
@@ -2690,6 +2713,7 @@ transcribeStreamRouter.post('/transcribe-stream/preview', async (req, res) => {
       if (!cleaned || sharedIsFullHallucination(cleaned)) {
         return void res.status(204).send()
       }
+      noteLiveProvisional(sessionId, chunkIndex, previewGen, cleaned, result.model)
       return void res.json({
         sessionId,
         chunkIndex,
@@ -2708,6 +2732,20 @@ transcribeStreamRouter.post('/transcribe-stream/preview', async (req, res) => {
   }
 })
 
+/**
+ * 6.86.0: GET /transcribe-stream/provisional?sessionId=<id>. The newest provisional text of a live meeting, for COS
+ * Control's grey line (live-provisional.ts). Token-authenticated like every /api route; private, no-store. Memory only:
+ * a restart, a save or a settled chunk empties it. `live` is false when this server holds no open session by that id.
+ */
+transcribeStreamRouter.get('/transcribe-stream/provisional', (req, res) => {
+  res.set('Cache-Control', 'private, no-store')
+  const sessionId = typeof req.query.sessionId === 'string' ? req.query.sessionId : ''
+  if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) return void res.status(400).json({ error: 'invalid sessionId', reason: 'invalid_session_id' })
+  const live = sessions.has(sessionId)
+  const held = live ? liveProvisional().read(sessionId) : null
+  res.json({ v: 1, sessionId, live, provisional: held, serverInstanceId: getServerInstanceId() })
+})
+
 /** Unlike the received ledger, only these canonical completions acknowledge ASR.
  * A native stop supplies the total captured chunks, including its last tail. */
 export function assertMacCaptureComplete(sessionId: string, expectedChunkCount: unknown): void {
@@ -2741,6 +2779,9 @@ transcribeStreamRouter.post('/mac-recording/start', (req, res) => {
   try {
     const serverInstanceId = requireMacPin(req)
     if (typeof req.body?.captureId !== 'string' || !MAC_CAPTURE_ID.test(req.body.captureId)) throw macError(400, 'invalid_capture_id', 'Invalid Mac capture ID')
+    // 6.86.0: `liveCues: true` asks for live cues on this recording (COS Control's live meeting view). Checked before
+    // anything is written, so a bad body admits nothing.
+    if (req.body.liveCues !== undefined && typeof req.body.liveCues !== 'boolean') throw macError(400, 'invalid_live_cues', 'liveCues must be true or false')
     if (isSessionDeleted(req.body.captureId) || getMeetingStore().findBySessionId(req.body.captureId)) throw macError(410, 'session_closed', 'Capture is closed')
     // An existing non-Mac session may not acquire new source metadata.
     if (sessions.has(req.body.captureId) && !readMacRecording(req.body.captureId)) throw macError(409, 'mac_capture_conflict', 'Capture ID already exists')
@@ -2749,7 +2790,13 @@ transcribeStreamRouter.post('/mac-recording/start', (req, res) => {
     const session = getSession(recording.sessionId)
     if (!session.chunks.some(Boolean)) session.startTime = recording.startTime
     persistSessionRequired(recording.sessionId)
-    res.json({ ...MAC_AUDIO, ...recording, replayed, serverInstanceId })
+    // Arming happens only after the recording is admitted, and its answer never fails the start (armMacLiveCues returns a
+    // reason code instead of throwing). Without `liveCues: true` the answer is byte for byte what 6.85.0 sent.
+    let liveCues: MacLiveCuesAnswer | undefined
+    if (req.body.liveCues === true) {
+      try { liveCues = armMacLiveCues(recording.sessionId) } catch { liveCues = { armed: false, reason: 'unavailable' } }
+    }
+    res.json({ ...MAC_AUDIO, ...recording, replayed, serverInstanceId, ...(liveCues ? { liveCues } : {}) })
   } catch (error) { sendStreamError(res, error) } finally { lease?.release() }
 })
 const macChunkLocks = new Set<string>()

package/server/routes/voice.ts

@@ -341,7 +341,7 @@ voiceRouter.get('/voice/ext-audio', (_req, res) => {
         ageHours: parseFloat(ageHours),
         expiresIn: `${Math.max(0, 72 - parseFloat(ageHours)).toFixed(1)}h`,
         // 6.45.3 — the chunk indices a reviewer can ask to hear (`?chunk=` on
-        // the sample route). Queen, 2026-09-12: the Add-a-voice panel let her
+        // the sample route). Grace, 2026-09-12: the Add-a-voice panel let her
         // name a session but not listen to it; naming is a guess without this.
         chunkIndices: listExtAudioChunks(d.name),
       }

package/shared/live-cues-v2.ts

@@ -2,13 +2,29 @@
  * Live cues v2 wire contract (server 6.75 candidate, companion 6.10.641 candidate; optional capability fields since 6.76.2).
  * Additive to v1: old clients keep receiving `coaching_nudge` and ignore the new named event.
  * The companion keeps a byte-identical copy at src/lib/live-cues-v2-contract.ts.
+ * 6.86.0 widens CueKind (additive for every meeting that did not opt in; see CueKind). A companion that has not taken this
+ * copy keeps validating the two legacy kinds, which is safe because it is never sent anything else.
  */
 export const LIVE_CUES_V2_PROTOCOL = 2 as const
 export const CUE_HEADLINE_MAX = 64
 export const CUE_DETAIL_MAX = 220
 export const CUE_FEEDBACK_REASON_MAX = 200
 
-export type CueKind = 'reinforce' | 'challenge'
+/** 6.86.0: three more kinds for COS Control's live meeting view. A meeting gets them only when its armer opts in (a Mac
+ *  recording, or POST /live-cues/start with `kinds: 'extended'`). Every other meeting keeps the two legacy kinds, so a
+ *  companion that validates `kind` against reinforce | challenge never sees a cue it would drop. Readers must treat any
+ *  kind they do not know as a plain cue, never as an error. */
+export type CueKind = 'reinforce' | 'challenge' | 'decision' | 'promise' | 'followUp'
+export const LEGACY_CUE_KINDS = ['reinforce', 'challenge'] as const
+export const CUE_KINDS = ['reinforce', 'challenge', 'decision', 'promise', 'followUp'] as const
+export type CueKindSet = 'legacy' | 'extended'
+export function isCueKind(value: unknown): value is CueKind {
+  return typeof value === 'string' && (CUE_KINDS as readonly string[]).includes(value)
+}
+/** The legacy kind a v1 reader is shown for any kind (the `coaching_nudge` twin and the stop answer's `nudges`). */
+export function legacyCueKind(kind: CueKind): 'reinforce' | 'challenge' {
+  return kind === 'reinforce' || kind === 'decision' || kind === 'promise' ? 'reinforce' : 'challenge'
+}
 
 /** A past meeting the cue drew on (0 to 2 per cue). */
 export interface CueSourceRef { id: string; date: string; title: string }
@@ -31,7 +47,7 @@ export interface LiveCueV2 {
 }
 
 /** v1 `coaching_nudge` as the v2 engine emits it for old clients (headline only). */
-export interface LiveCueV1Compat { nudge: string; type: CueKind; priority: 2; cueId: string; sessionId: string; protocol: 2 }
+export interface LiveCueV1Compat { nudge: string; type: 'reinforce' | 'challenge'; priority: 2; cueId: string; sessionId: string; protocol: 2 }
 
 /** `reason` when unavailable: master_flag_off, api_key_in_env, decision_invalid_provider, decision_not_configured (no key
  *  for the selected decision provider; jev_not_configured when Jev was chosen and only a SubQ key exists), claude_not_found,
@@ -75,7 +91,7 @@ export function isLiveCueV2(value: unknown): value is LiveCueV2 {
   return v.protocol === 2 && typeof v.cueId === 'string' && v.cueId.length > 0 && typeof v.sessionId === 'string'
     && typeof v.headline === 'string' && v.headline.length > 0 && v.headline.length <= CUE_HEADLINE_MAX
     && typeof v.detail === 'string' && v.detail.length > 0 && v.detail.length <= CUE_DETAIL_MAX
-    && (v.kind === 'reinforce' || v.kind === 'challenge')
+    && isCueKind(v.kind)
     && Array.isArray(v.sources) && v.sources.length <= 2
     && v.sources.every(s => !!s && typeof (s as CueSourceRef).id === 'string' && typeof (s as CueSourceRef).date === 'string' && typeof (s as CueSourceRef).title === 'string')
     && typeof v.gate === 'number' && typeof v.createdAt === 'number' && typeof v.model === 'string'