@gotcos/glasses-server 6.86.0 → 6.88.0

package/CHANGELOG.md

@@ -1,3 +1,93 @@
+## 6.88.0 - LAN first: a pre-token route proof and the Mac's addresses for the phone
+
+The server half of the glasses "LAN first" reconnect plan (plan of 2026-10-22, Miles's decisions of 2026-10-23: "Go
+with your picks on the reconnect plan. No regressions or loss of existing functionality."). After the 10/22 Mac restart
+the phone stayed on a stale Tailscale tunnel while the Mac answered fine on the same Wi-Fi. These two additions let a
+phone build reach the Mac over the home network first, without ever sending its token to the wrong machine. Contract
+for the phone side: `docs/lan-first.md`.
+
+- **`GET /api/route-proof?nonce=<22 to 64 base64url characters>`, public.** Answers `{ v: 1, serverInstanceId, proof }`,
+  where `proof` is lowercase hex HMAC-SHA256(token, "cos-route-proof:v1:" + nonce + ":" + serverInstanceId). The phone
+  computes the same HMAC with its stored token and sends `X-Cos-Token` to that address only on a match. The token is never
+  in the response, the nonce is never echoed or logged, and the caller chooses only the nonce, so the route is not a
+  general HMAC oracle; the fixed prefix also keeps a proof from ever being a display-stream ticket. Exact public door,
+  GET only (`server/lib/api-auth.ts`); every other verb and path stays behind the token. Errors: 400 `bad_nonce`,
+  404 `disabled`, 405 `method_not_allowed`, 429 `rate_limited` (with `Retry-After`), 503 `not_ready`.
+- **Rate limited.** 20 a minute per socket address and 240 a minute in all, in memory; bad nonces spend the same budget.
+- **Only for a strong token.** A proof lets anyone who reaches the port test guesses offline, so it is served (and
+  advertised) only when the token is 32 characters or more. Tokens made by COS Control (64) and by the server (44) qualify;
+  a short hand-set legacy token keeps today's behaviour.
+- **`routes` on authenticated `/api/models` only.** `{ v: 1, serverInstanceId, learnedAt, lan: [{ip, port, scheme}],
+  tailscale: [{ip, port, scheme}] }`: RFC1918 IPv4 on real interfaces (tunnels, Internet Sharing and VM bridges, Docker,
+  AirDrop and link-local left out) and 100.64/10 on Tailscale's own interface, plain http on `PORT` (3141). Re-read at
+  most every 10 s, so a new DHCP lease shows up; a failed interface read omits the field and leaves the rest of the
+  response alone. Never on public `/api/health`. The MagicDNS name is left out (reading it needs a `tailscale`
+  process per request).
+- **Capability flags.** `capabilities.routeProof: { protocol: 1 }` and `capabilities.lanRoutes: { protocol: 1 }` on
+  `/api/health` and `/api/models`, from one helper. An older server omits both, and a phone keeps today's single URL.
+- **Switch.** `COS_LAN_FIRST=0` turns both pieces off, read per request; the responses are then the 6.87.0 shape exactly.
+- **No regression.** Every existing field of `/api/health` and `/api/models` is unchanged, checked path for path against
+  a golden captured from the unmodified 6.87.0 base, and byte for byte against the same response with the switch off.
+- **Not built:** Phase 3's loopback `/api/glasses/link` for COS Control's banner. It needs new tracking of the phone's
+  last path and check-in, so it is not a purely additive change.
+- **No spend.** No LLM, no new caller, nothing written to disk.
+- **Checks (6.88.0 branch).** Full suite, serial (`--maxWorkers=1`), HOME, COS_DATA_DIR and COS_PROFILE_PATH in a scratch folder,
+  COS_SCRIPTS_DIR unset. Unmodified 6.87.0 base (601d807): 584 files (583 passed, 1 skipped), 8815 tests, 8801 passed,
+  14 skipped, 0 failed. This branch: 588 files (587 passed, 1 skipped), 8911 tests, 8897 passed, 14 skipped, 0 failed.
+  The 96 new tests are the only change per file (`lan-first.test.ts` 58, `route-proof.test.ts` 18, `health-lan-first.test.ts`
+  9, `lan-first-wiring.test.ts` 2, `api-auth.test.ts` 40 to 49); no existing test was changed. Mutation gate
+  `lan-first-mutation-gate.mjs` against a green baseline (136 tests in 5 files): 56 of 56 killed, each by a named test,
+  every target landing exactly once and restored byte for byte. Its first run left two survivors (the IPv4-only filter and
+  the de-duplication), each now covered by its own test and killed. `tsc --noEmit` clean. Pack dry run 549 files
+  (6.87.0: 546; the three new files are `server/lib/lan-first.ts`, `server/routes/route-proof.ts` and `docs/lan-first.md`).
+
+### Also in 6.88.0: transfer integrity counts what the phone captured, and recovery saves wait for it
+
+For glasses 6.10.652 (meeting t2xs9u, 2026-10-23 07:59): a relaunched COS window saved a meeting from the Mac's 74 chunks
+while the window still recording it had captured through index 120, and the file said "Transfer integrity 100%". One new
+file (`server/lib/transfer-integrity.ts`) and two edits in `performSave` (`server/routes/meeting.ts`).
+
+- **Integrity counts the phone's final index.** When the phone has said how far it captured (the Stop intent's
+  `finalChunkIndex`, or the save's own new optional `finalChunkIndex`), expected is that index plus one and every index past
+  the Mac's highest chunk is missing. 74 of 121 now reads 61.1% with 47 chunks not received, in the saved markdown, the
+  sidecar and the receipt. A final index more than 20,000 past the Mac's highest chunk is capped there; a malformed one is
+  ignored.
+- **A recovery save waits.** A save with `recovery: 'origin_wipe'` (glasses 6.10.652) is refused with 409
+  `chunks_outstanding` (`missingCount`, `finalChunkIndex`) while the phone's final index says the Mac lacks chunks, and
+  nothing is saved or closed. `acceptMissing: true` (the phone waited its 10 minutes) saves what the Mac has, honestly counted.
+- **Unchanged:** a save without `recovery` is never refused here; a save with no final index from anywhere writes exactly
+  what 6.87.0 wrote; an already saved meeting replays its receipt first; the autonomous save, the stop route and the status
+  route are untouched. No new log line, no LLM, no new disk write. Contract: `docs/meeting-autonomous-save.md`, section 6.88.0.
+- **Checks (integrity, on top of c593b91).** Full suite, serial, the same scratch folder rules: 590 files, 8926 tests, 8912
+  passed, 14 skipped, 0 failed (the LAN-first record above is 8911 tests; the 15 new ones are `transfer-integrity.test.ts` 5
+  and `meeting-save-integrity.test.ts` 10; no existing test was changed). Mutation gate `integrity-6880-mutation-gate.mjs`
+  against a green baseline (15 tests in 2 files): 15 of 15 killed, each by a named test. `tsc --noEmit` clean. Pack dry run
+  551 files (the LAN-first 549 plus `server/lib/transfer-integrity.ts` and the gate script).
+
+## 6.87.0 - A rough level per chunk for COS Control's glasses meeting strip
+
+The server half of the level strip COS Control 0.5.339 draws in a glasses meeting's bottom bar (plan of 2026-10-23,
+approved 09:25). The quiet gate already measured every live chunk (RMS, and Silero speech seconds) and only printed the
+numbers on the `[perf]` line. Now each chunk keeps them.
+
+- **Two numbers per chunk on the active-session record.** `chunkLevels[{i, level, speechSec}]` in
+  `active-sessions/<id>.json`: `level` is the chunk's RMS on a dBFS scale, 0 at -60 dBFS and under, 1 at -10 dBFS and
+  over, three decimals; `speechSec` is the Silero speech seconds (two decimals), or null when the gate fell back to
+  RMS. Every chunk the quiet gate sees gets one, quiet chunks included; a replayed index keeps its first answer, like
+  the chunk itself. Bounded to the newest 120 chunks (about 12 minutes of 6 s chunks) and restored, validated, after a
+  restart. It lives only as long as the record (deleted at save). `server/lib/chunk-levels.ts`.
+- **Control reads it from the file it already reads.** The helper's `live-transcript` read opens this same file, so
+  there is no new route. `capabilities.liveMeeting.chunkLevels: true` on `/api/health` and `/api/models` tells Control
+  the record carries levels; an older server omits it and Control keeps its still glyph.
+- **Not text, never logged.** Nothing new is logged, and no text is stored: the entries hold an index and two numbers.
+  `transcribe-stream-chunk-levels.test.ts` spies every console level and checks the record holds numbers only.
+- **No spend.** No LLM, no new caller, no new disk write: the numbers ride on the durable write each chunk already makes.
+- **Checks (6.87.0 branch).** Full suite, serial (`--maxWorkers=1`), HOME, COS_DATA_DIR and COS_PROFILE_PATH in a scratch folder,
+  COS_SCRIPTS_DIR unset: 584 files (583 passed, 1 skipped), 8815 tests, 8801 passed, 14 skipped, 0 failed. Mutation gate `live-meeting-6870-mutation-gate.mjs` against a green
+  baseline (32 tests in 4 files): 25 of 25 killed, each by a named
+  test, every target landing exactly once and restored byte for byte. `tsc --noEmit` clean. Pack dry run 546 files (6.86.0:
+  545; the one new file is `server/lib/chunk-levels.ts`).
+
 ## 6.86.0 - Decision, promise and follow-up cues, live cues on Mac recordings, and the grey provisional line
 
 The server half of COS Control's live meeting view (plan of 2026-10-22, decisions of 15:21). Three lanes: three more cue

package/SECURITY.md

@@ -43,6 +43,16 @@ reproduction you have. Do not include real transcripts.
   turns itself off after 10 minutes. Over Tailscale the traffic is encrypted.
 - Behind `tailscale serve` or `funnel`, requests arrive from a loopback proxy, so
   every claim is refused (`not_allowed_network`): pairing fails closed there.
+- `GET /api/route-proof` (6.88.0, `docs/lan-first.md`) is public by design. It returns
+  the server instance id and HMAC-SHA256(token, "cos-route-proof:v1:" + nonce + ":" +
+  instance id), never the token, so the phone can check which Mac answers at a home
+  Wi-Fi address before sending the token there. The caller picks only a 22 to 64
+  character base64url nonce. It is served only for a token of 32 characters or more,
+  because a proof lets anyone who reaches the port test guesses offline. Limits: 20 a
+  minute per connection address, 240 a minute in all. It does not stop an active
+  attacker on the same Wi-Fi who relays the request to the real Mac: the LAN path is
+  plain HTTP, as above. `COS_LAN_FIRST=0` turns it off. The Mac's addresses are
+  published only on authenticated `/api/models`, never on `/api/health`.
 - `GET /api/display-stream` is public by design and returns lifecycle events
   only. Content requires a ticket or the token header. See
   `server/routes/display.ts` for the allowlist.

package/docs/lan-first.md

@@ -0,0 +1,158 @@
+# LAN first: the server contract (6.88.0)
+
+The server half of the glasses "LAN first" reconnect plan (2026-10-22, decisions of 2026-10-23). The phone
+reaches the Mac over the home network first and over Tailscale second. The server adds two things, both
+additive and both capability gated:
+
+1. `GET /api/route-proof`, a public identity proof, so the phone can check WHICH Mac answers at an address
+   before it sends `X-Cos-Token` there.
+2. `routes` on authenticated `GET /api/models`: the addresses this Mac answers on, re-learned after a DHCP change.
+
+An older server has neither capability flag. A phone must then keep today's single stored URL and change
+nothing. `COS_LAN_FIRST=0` in the server environment turns both pieces off (read per request).
+
+## Capability flags
+
+Published on `GET /api/health` (public) and `GET /api/models` (token) under `capabilities`, from one helper,
+so the two surfaces always agree:
+
+```json
+"routeProof": { "protocol": 1 },
+"lanRoutes":  { "protocol": 1 }
+```
+
+| Flag | Present when | Absent means |
+|---|---|---|
+| `routeProof` | the switch is on, the server instance id is minted, and the token is at least 32 characters | do not call `/api/route-proof`; never send the token to an unproven address |
+| `lanRoutes` | the switch is on | `/api/models` will not carry `routes` |
+
+Public health carries only these flags. It never carries an address.
+
+## `GET /api/route-proof?nonce=<nonce>`
+
+Public: no `X-Cos-Token`. GET only.
+
+### Request
+
+| Part | Rule |
+|---|---|
+| `nonce` | exactly one query parameter, 22 to 64 characters of base64url (`A-Z a-z 0-9 - _`), no padding. Fresh random per request; 16 random bytes encode to 22 characters. |
+| Headers | none needed. Do not send `X-Cos-Token` to an address you have not proven. |
+| Timeout | the plan's 1.5 s for a LAN proof. |
+
+### Success: `200`
+
+```json
+{ "v": 1, "serverInstanceId": "<uuid v4>", "proof": "<64 lowercase hex>" }
+```
+
+`Cache-Control: no-store`.
+
+### The HMAC
+
+```
+message = "cos-route-proof:v1:" + nonce + ":" + serverInstanceId      (UTF-8)
+proof   = lowercase hex( HMAC-SHA256( key = token (UTF-8 bytes), message ) )
+```
+
+`token` is the exact pairing token string the phone stores (the `X-Cos-Token` value). `serverInstanceId` is the
+value in the response, which must also equal the phone's stored `active.serverInstanceId`.
+
+Known-answer vector:
+
+| Input | Value |
+|---|---|
+| token | `0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef` |
+| nonce | `AAAAAAAAAAAAAAAAAAAAAA` |
+| serverInstanceId | `00000000-0000-4000-8000-000000000000` |
+| message | `cos-route-proof:v1:AAAAAAAAAAAAAAAAAAAAAA:00000000-0000-4000-8000-000000000000` |
+| proof | `445fc7d579849fa3fdfb8c2831cf0ace04c6db74e2817b75e87139cc9a3cd207` |
+
+### Phone-side check (the whole point)
+
+The route counts only if ALL hold, and only then may the phone send `X-Cos-Token` to that address:
+
+1. Status 200 and `v === 1`.
+2. `serverInstanceId` equals the stored `active.serverInstanceId`.
+3. `proof` equals the phone's own HMAC over the nonce IT generated for this request and the STORED id.
+
+Anything else (timeout, any other status, a body that does not parse, a mismatch) means "not my Mac": drop that
+address for this cycle and never send the token there. Compare in constant time where the platform offers it;
+the comparison happens on the phone, so there is no remote timing oracle either way.
+
+### Errors
+
+Every error body is `{ "v": 1, "reason": "<code>" }` with `Cache-Control: no-store`.
+
+| Status | `reason` | When | Phone should |
+|---|---|---|---|
+| 400 | `bad_nonce` | nonce missing, repeated, wrong length or charset | fix the client; treat as not proven |
+| 401 | (the standard `pairing_token_rejected` body) | any verb other than GET without a token, or any path other than exactly `/api/route-proof` | treat as not proven |
+| 404 | `disabled` | `COS_LAN_FIRST=0` | stop LAN proofs until the capability returns |
+| 404 | (no body contract) | a server older than 6.88.0 | stop LAN proofs; it has no `routeProof` flag anyway |
+| 405 | `method_not_allowed` | a non-GET verb that carried a valid token. `Allow: GET` | fix the client |
+| 429 | `rate_limited` | over the limit below. `Retry-After` in seconds | wait `Retry-After`, keep the current route |
+| 503 | `not_ready` | the instance id is not minted yet (still binding after a restart), or the token is too short to expose. `Retry-After: 30` | keep the current route, retry later |
+| 403 | (network filter) | the caller is not on loopback, Tailscale or a private network | treat as not proven |
+
+### Rate limit
+
+Per socket address (never `X-Forwarded-For`): 20 requests in any 60 s window. Global: 240 in any 60 s window
+across all addresses. Bad-nonce requests spend the same budget. The plan's phone schedule (boot, foreground,
+reconnect, then one every 60 s while on Tailscale) stays far below it.
+
+## `routes` on `GET /api/models` (token)
+
+```json
+"routes": {
+  "v": 1,
+  "serverInstanceId": "<uuid v4, same as top-level serverInstanceId>",
+  "learnedAt": "<ISO time the interfaces were read>",
+  "lan":       [ { "ip": "192.168.1.204",   "port": 3141, "scheme": "http" } ],
+  "tailscale": [ { "ip": "100.108.149.114", "port": 3141, "scheme": "http" } ]
+}
+```
+
+| Field | Rule |
+|---|---|
+| `lan` | RFC1918 IPv4 (10/8, 172.16/12, 192.168/16) on a non-internal interface that is not a tunnel, bridge or VM network (`utun`, `tun`, `tap`, `ipsec`, `ppp`, `bridge`, `awdl`, `llw`, `vmnet`, `vboxnet`, `docker`, `br-`, `veth`, `virbr`, `lxc`, `lxd`, `cni`, `flannel`, `podman`, `cali`, `vnic`, `tailscale` are left out). Link-local 169.254/16 and public addresses never appear. |
+| `tailscale` | 100.64/10 on Tailscale's own interface (`utun*` on macOS, `tailscale*` elsewhere). A carrier-grade-NAT address on Wi-Fi is not Tailscale and is left out. |
+| `port` | the plain-http port (`PORT`, default 3141) for both kinds. HTTPS 3143 is never advertised: its certificate does not cover these addresses. |
+| `scheme` | always `http` in protocol 1. |
+| MagicDNS name | not published. Reading it means running `tailscale status --json` per request, which is not cheap; a later protocol may add `name`. |
+| order | interface order as the OS reports it; at most 8 per list; no duplicates. |
+| freshness | read from the interfaces at most every 10 s, so a new DHCP lease shows up on the next read after that. |
+| absent | the switch is off, the instance id is not minted, or the interface read failed. The rest of `/api/models` is unchanged in every case. |
+
+Node does not expose interface up/down flags; an address the OS still lists can appear. That is why every
+address must pass the route proof before the token goes there.
+
+Replace the stored LAN list each time `/api/models` is read on either path. Never hardcode an address.
+
+## What a stranger can learn
+
+| Surface | Without the token |
+|---|---|
+| `/api/route-proof` | the instance id (already public on `/api/health` as `server_instance_id`), an HMAC of a message it cannot choose, and whether the token is long enough to be proven (it gets `not_ready` otherwise) |
+| `/api/health` | the two protocol flags |
+| `/api/models` | the standard 401 |
+
+## Security decisions
+
+- **No token oracle.** The caller chooses only the nonce, its charset has no `:`, and the message always starts with
+  the fixed prefix and ends with the server's own id. The only other HMAC keyed by the token signs
+  `display-stream:<exp>` (display tickets), which can never start with the prefix, so a proof is never a ticket.
+- **Offline guessing.** A proof lets anyone who can reach the port test token guesses offline. Server- and
+  Control-generated tokens (44 and 64 characters of random) make that hopeless; a token under 32 characters gets no
+  proof and no `routeProof` flag, so that install keeps today's behaviour.
+- **What the proof does and does not stop.** It stops the token going to a DIFFERENT machine at a remembered
+  address (someone else's Wi-Fi, a reused DHCP lease). It does not stop an active attacker on the same Wi-Fi who relays
+  the proof request to the real Mac: the LAN path is plain HTTP, so the token crosses the home network unencrypted, as
+  a pasted token and "Allow pairing on this Wi-Fi" already do. Over Tailscale the traffic is encrypted.
+- **Nothing logged.** The route never logs or echoes the nonce or the proof.
+- **No state on disk.** The rate limiter is in memory; a restart clears it.
+
+## Not in this release
+
+Phase 3 of the plan (a loopback `GET /api/glasses/link` for COS Control's banner) is not built: it needs new
+tracking of the client's last path and check-in time, so it is not a trivially additive change.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.86.0",
+  "version": "6.88.0",
   "description": "COS Glasses: self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {
@@ -135,6 +135,10 @@
     "docs/test-plan-6.71.7.md",
     "!server/scripts/question-hold-mutation-gate.mjs",
     "!server/scripts/live-meeting-6860-mutation-gate.mjs",
+    "!server/scripts/live-meeting-6870-mutation-gate.mjs",
+    "!server/scripts/lan-first-mutation-gate.mjs",
+    "!server/scripts/integrity-6880-mutation-gate.mjs",
+    "docs/lan-first.md",
     "docs/test-plan-6.71.8.md",
     "docs/test-plan-6.71.9.md",
     "docs/test-plan-6.71.10.md",

package/server/index.ts

@@ -147,7 +147,7 @@ import { logActiveSessionsOnShutdown, startAutoSnapshot } from './lib/conversati
 import { getMediaStore } from './lib/media-store.js'
 import { listenRequiredServers, type RequiredListener } from './lib/listener-startup.js'
 import { serverMetrics } from './lib/server-metrics.js'
-import { initializeServerInstanceId } from './lib/server-instance-id.js'
+import { getServerInstanceId, initializeServerInstanceId } from './lib/server-instance-id.js'
 import { appendPrivateEnvBlock, UnsafeUserConfigPathError } from './lib/secure-user-config.js'
 import { getTranscriptionProfileStatus } from './lib/profile.js'
 import { createQueryJobsRouter } from './routes/query-jobs.js'
@@ -191,6 +191,7 @@ import {
 import { requireApiToken } from './lib/api-auth.js'
 import { PairingState, pairingHostsFrom } from './lib/glasses-pairing.js'
 import { createPairingRouter } from './routes/pairing.js'
+import { createRouteProofRouter } from './routes/route-proof.js'
 import { isManagedRuntime } from './lib/managed-runtime.js'
 import { reportClaudeExtraToolConfiguration } from './lib/claude-tool-access.js'
 import {
@@ -368,6 +369,14 @@ app.use('/api', createPairingRouter({
   state: () => pairingState,
   isDraining: () => gracefulShutdownStarted || !maintenanceAdmissionsOpen(),
 }))
+// 6.88.0 LAN first (docs/lan-first.md): the public pre-token identity proof. Writes nothing,
+// so it sits beside pairing, ahead of the lease catch-all and the global parser, and is
+// served during a drain. The instance id is read per request: it is minted only after
+// every listener binds, and until then the route answers 503 `not_ready`.
+app.use('/api', createRouteProofRouter({
+  token: () => API_TOKEN,
+  serverInstanceId: getServerInstanceId,
+}))
 
 // Fail-closed catch-all for mutation routes that do not own a more specific
 // lifecycle lease below. This closes the admission/drain race for secondary

package/server/lib/api-auth.ts

@@ -43,10 +43,17 @@ const DISPLAY_STREAM_CAPABILITY_PATH = /^\/display-stream\/\d{1,15}\.[0-9a-f]{64
 // Minting, status and decisions stay behind the token AND a loopback socket.
 const PAIRING_POLL_PATH = new RegExp(`^/pairing/claim/${PAIRING_NONCE_BODY}$`)
 
+// 6.88.0 LAN first (docs/lan-first.md): GET /route-proof is public because it exists to
+// prove which Mac answers at an address BEFORE the phone sends its token there. Exact path,
+// GET only (HEAD and every other verb stay behind the token). It returns an HMAC keyed by
+// the token over a fixed, domain-separated message, never the token (routes/route-proof.ts).
+const ROUTE_PROOF_PATH = '/route-proof'
+
 export function isPublicApiRequest(method: string, path: string): boolean {
   if (PUBLIC_API_PATHS.has(path)) return true
   if (method === 'POST' && path === '/pairing/claim') return true
   if (method === 'GET' && PAIRING_POLL_PATH.test(path)) return true
+  if (method === 'GET' && path === ROUTE_PROOF_PATH) return true
   if (method !== 'GET' && method !== 'HEAD') return false
   return TTS_PLAYBACK_CAPABILITY_PATH.test(path)
     || DISPLAY_STREAM_CAPABILITY_PATH.test(path)

package/server/lib/chunk-levels.ts

@@ -0,0 +1,64 @@
+// 6.87.0: a rough level per live chunk, for COS Control's level strip on glasses meetings.
+//
+// The quiet gate already measures every chunk (stt-live.ts decideQuiet: RMS and, with Silero, speech seconds). Until
+// 6.87.0 those numbers only reached the [perf] line. Now each chunk keeps two numbers on the active session record:
+// `level`, 0 to 1 from the chunk's RMS on a dBFS scale, and `speechSec`, the Silero speech seconds (null when the gate
+// fell back to RMS). Control reads them from the same active-session file its live transcript reads, so there is no
+// new route and no new log line.
+//
+// NOT TEXT. Two numbers per chunk, bounded to the newest CHUNK_LEVELS_LIMIT chunks, living only as long as the
+// active-session record (the 4-hour crash-recovery file, deleted at save). Nothing here logs.
+
+/** The newest chunks kept: about 12 minutes of 6 s chunks, far more than the strip draws. */
+export const CHUNK_LEVELS_LIMIT = 120
+/** The dBFS that reads as 0: under the quiet gate's RMS 150 (about -47 dBFS) and the room floor of a G2 mic. */
+export const LEVEL_FLOOR_DBFS = -60
+/** The dBFS that reads as 1: loud close speech. */
+export const LEVEL_CEILING_DBFS = -10
+
+export interface ChunkLevel {
+  /** The chunk's own index. */
+  i: number
+  /** 0 to 1, three decimals. */
+  level: number
+  /** Silero speech seconds, two decimals; null when the quiet gate used RMS. */
+  speechSec: number | null
+}
+
+/** A chunk's RMS (PCM16 units) as 0 to 1: LEVEL_FLOOR_DBFS and under is 0, LEVEL_CEILING_DBFS and over is 1. */
+export function normalizedLevel(rms: number): number {
+  if (!Number.isFinite(rms) || rms <= 0) return 0
+  const dbfs = 20 * Math.log10(rms / 32768)
+  const level = (dbfs - LEVEL_FLOOR_DBFS) / (LEVEL_CEILING_DBFS - LEVEL_FLOOR_DBFS)
+  return Math.round(Math.min(1, Math.max(0, level)) * 1000) / 1000
+}
+
+/** The stored entry for one chunk's quiet decision. */
+export function chunkLevel(chunkIndex: number, rms: number, speechSec: number | null): ChunkLevel {
+  const speech = speechSec !== null && Number.isFinite(speechSec) ? Math.round(Math.max(0, speechSec) * 100) / 100 : null
+  return { i: chunkIndex, level: normalizedLevel(rms), speechSec: speech }
+}
+
+/** `levels` with `entry` in index order (a second entry for an index replaces the first), the newest
+ *  CHUNK_LEVELS_LIMIT kept. Never mutates its input. */
+export function withChunkLevel(levels: readonly ChunkLevel[] | undefined, entry: ChunkLevel): ChunkLevel[] {
+  const next = (levels ?? []).filter(l => l.i !== entry.i)
+  next.push(entry)
+  next.sort((a, b) => a.i - b.i)
+  return next.length > CHUNK_LEVELS_LIMIT ? next.slice(next.length - CHUNK_LEVELS_LIMIT) : next
+}
+
+/** The levels from a recovered session file: only well-formed entries, one per index, in order, bounded. */
+export function restoreChunkLevels(value: unknown): ChunkLevel[] {
+  if (!Array.isArray(value)) return []
+  let levels: ChunkLevel[] = []
+  for (const raw of value) {
+    if (!raw || typeof raw !== 'object') continue
+    const { i, level, speechSec } = raw as Record<string, unknown>
+    if (!Number.isInteger(i) || (i as number) < 0) continue
+    if (typeof level !== 'number' || !Number.isFinite(level) || level < 0 || level > 1) continue
+    if (speechSec !== null && (typeof speechSec !== 'number' || !Number.isFinite(speechSec) || speechSec < 0)) continue
+    levels = withChunkLevel(levels, { i: i as number, level, speechSec: speechSec as number | null })
+  }
+  return levels
+}

package/server/lib/lan-first.ts

@@ -0,0 +1,236 @@
+// 6.88.0 LAN first (docs/lan-first.md). Two additive pieces for the phone:
+//
+// 1. A pre-token identity proof. `GET /api/route-proof?nonce=<phone nonce>` is public, so a
+//    phone can ask an address it has not used before "are you the Mac I paired with?"
+//    BEFORE it sends X-Cos-Token there. The answer is an HMAC keyed by the token over a
+//    fixed, domain-separated message; the phone computes the same HMAC with its stored
+//    token and sends the token only on a match. A machine without the token cannot make a
+//    matching proof, and the response never carries the token.
+// 2. The addresses this Mac answers on, published ONLY on authenticated /api/models (never
+//    on public /api/health), so the phone can learn its LAN route after a DHCP change.
+//
+// This module is pure apart from the cached interface read. Clock, interfaces, token and
+// instance id are injected so every rule is testable.
+
+import { createHmac } from 'node:crypto'
+import { networkInterfaces as osNetworkInterfaces } from 'node:os'
+import { isRfc1918Ipv4, isTailscaleIpv4, normalizeRemoteIp } from './network-policy.js'
+
+export const ROUTE_PROOF_PROTOCOL = 1
+export const LAN_ROUTES_PROTOCOL = 1
+
+/**
+ * The fixed domain-separation prefix. The caller chooses only the nonce, never the whole
+ * message, and the nonce charset has no `:`, so the message always parses one way. The only
+ * other HMAC keyed by the token signs `display-stream:<exp>` (lib/display-ticket.ts), which
+ * can never begin with this prefix, so a proof is never a usable display ticket.
+ */
+export const ROUTE_PROOF_PREFIX = 'cos-route-proof:v1:'
+/** base64url alphabet, 22 to 64 characters. 22 base64url characters carry 132 bits. */
+export const ROUTE_PROOF_NONCE_PATTERN = /^[A-Za-z0-9_-]{22,64}$/
+/**
+ * A proof lets anyone on the network check token guesses offline, so it is served only for
+ * a token long enough that guessing is hopeless. COS Control writes 64 hex characters and
+ * the server's own token is 44 base64url characters; a short hand-set legacy token gets no
+ * proof (the phone keeps today's single-route behaviour).
+ */
+export const ROUTE_PROOF_MIN_TOKEN_LENGTH = 32
+export const ROUTE_PROOF_IP_LIMIT = 20
+export const ROUTE_PROOF_GLOBAL_LIMIT = 240
+export const ROUTE_PROOF_WINDOW_MS = 60_000
+/** Past this many tracked addresses, idle ones are dropped. Live ones are bounded by the global ceiling. */
+export const ROUTE_PROOF_MAX_TRACKED_IPS = 1024
+
+export const LAN_ROUTES_CACHE_MS = 10_000
+export const LAN_ROUTES_MAX_PER_KIND = 8
+
+/** `COS_LAN_FIRST=0` turns off both pieces (read per request). Anything else leaves them on. */
+export function lanFirstEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
+  return env.COS_LAN_FIRST !== '0'
+}
+
+/** The plain-http port the phone uses on both paths (server/index.ts reads the same `PORT`). */
+export function lanFirstHttpPort(env: NodeJS.ProcessEnv = process.env): number {
+  const port = parseInt(env.PORT ?? '3141', 10)
+  return Number.isInteger(port) && port > 0 && port <= 65535 ? port : 3141
+}
+
+export function isValidRouteProofNonce(value: unknown): value is string {
+  return typeof value === 'string' && ROUTE_PROOF_NONCE_PATTERN.test(value)
+}
+
+export function routeProofTokenUsable(token: unknown): token is string {
+  return typeof token === 'string' && token.length >= ROUTE_PROOF_MIN_TOKEN_LENGTH
+}
+
+export function routeProofMessage(nonce: string, serverInstanceId: string): string {
+  return `${ROUTE_PROOF_PREFIX}${nonce}:${serverInstanceId}`
+}
+
+/** Lowercase hex HMAC-SHA256(token, "cos-route-proof:v1:" + nonce + ":" + serverInstanceId). */
+export function computeRouteProof(token: string, nonce: string, serverInstanceId: string): string {
+  return createHmac('sha256', token).update(routeProofMessage(nonce, serverInstanceId), 'utf8').digest('hex')
+}
+
+/** True when the proof is servable right now: switch on, instance id minted, token strong. */
+export function routeProofAvailable(input: { token: unknown; serverInstanceId: string | null; env?: NodeJS.ProcessEnv }): boolean {
+  return lanFirstEnabled(input.env) && !!input.serverInstanceId && routeProofTokenUsable(input.token)
+}
+
+/** `capabilities.routeProof` / `capabilities.lanRoutes`, or nothing. Absent means "do not try". */
+export function lanFirstCapabilities(input: { token: unknown; serverInstanceId: string | null; env?: NodeJS.ProcessEnv }): {
+  routeProof?: { protocol: number }
+  lanRoutes?: { protocol: number }
+} {
+  if (!lanFirstEnabled(input.env)) return {}
+  return {
+    ...(routeProofAvailable(input) ? { routeProof: { protocol: ROUTE_PROOF_PROTOCOL } } : {}),
+    lanRoutes: { protocol: LAN_ROUTES_PROTOCOL },
+  }
+}
+
+// ── Rate limit ───────────────────────────────────────────────────────────────
+
+export type RouteProofAdmission = { ok: true } | { ok: false; retryAfterSeconds: number }
+
+/** Sliding one-minute window per remote address, plus a global ceiling. In memory only. */
+export class RouteProofRateLimiter {
+  private readonly perIp = new Map<string, number[]>()
+  private global: number[] = []
+
+  constructor(private readonly now: () => number = () => Date.now()) {}
+
+  admit(remoteAddress: string | undefined | null): RouteProofAdmission {
+    const at = this.now()
+    const ip = normalizeRemoteIp(remoteAddress ?? '') || 'unknown'
+    const live = (times: number[]) => times.filter(t => at - t < ROUTE_PROOF_WINDOW_MS)
+    const retry = (oldest: number) => Math.max(1, Math.ceil((ROUTE_PROOF_WINDOW_MS - (at - oldest)) / 1000))
+
+    this.global = live(this.global)
+    const recent = live(this.perIp.get(ip) ?? [])
+    if (recent.length >= ROUTE_PROOF_IP_LIMIT) {
+      this.perIp.set(ip, recent)
+      return { ok: false, retryAfterSeconds: retry(recent[0]) }
+    }
+    if (this.global.length >= ROUTE_PROOF_GLOBAL_LIMIT) {
+      // Nothing is stored for a refused address, so a flood of new addresses grows nothing.
+      if (recent.length) this.perIp.set(ip, recent)
+      return { ok: false, retryAfterSeconds: retry(this.global[0]) }
+    }
+    recent.push(at)
+    this.global.push(at)
+    this.perIp.set(ip, recent)
+    // Live entries are bounded by the global ceiling, so dropping the idle ones is enough.
+    if (this.perIp.size > ROUTE_PROOF_MAX_TRACKED_IPS) {
+      for (const [key, times] of this.perIp) if (live(times).length === 0) this.perIp.delete(key)
+    }
+    return { ok: true }
+  }
+
+  /** For tests: how many addresses the limiter is holding. */
+  trackedAddressCount(): number {
+    return this.perIp.size
+  }
+}
+
+// ── Routes ───────────────────────────────────────────────────────────────────
+
+export interface RouteEntry {
+  ip: string
+  port: number
+  scheme: 'http'
+}
+
+export interface LanRoutes {
+  v: number
+  serverInstanceId: string
+  learnedAt: string
+  lan: RouteEntry[]
+  tailscale: RouteEntry[]
+}
+
+type InterfaceInfo = { address: string; family: string | number; internal: boolean }
+export type InterfaceTable = Record<string, InterfaceInfo[] | undefined>
+
+/**
+ * Interfaces a phone on the home Wi-Fi can never reach through: VPN tunnels (utun is checked
+ * separately for Tailscale), Internet Sharing and VM bridges, AirDrop (awdl), low-latency WLAN
+ * (llw), VM host-only networks, and Linux container bridges and veth pairs.
+ */
+const NOT_LAN_INTERFACE = /^(utun|tun|tap|ipsec|ppp|bridge|awdl|llw|vmnet|vboxnet|docker|br-|veth|virbr|lxc|lxd|cni|flannel|podman|cali|vnic|tailscale)/i
+/** Tailscale's own interface: utunN on macOS, tailscale0 on Linux, "Tailscale" on Windows. */
+const TAILSCALE_INTERFACE = /^(utun|tailscale)/i
+
+function ipv4(info: InterfaceInfo): boolean {
+  const family = typeof info.family === 'number' ? (info.family === 4 ? 'IPv4' : 'IPv6') : info.family
+  return family === 'IPv4' && !info.internal
+}
+
+/**
+ * Pure. LAN = RFC1918 IPv4 on a non-internal interface that is not a tunnel, bridge or VM
+ * network. Tailscale = 100.64/10 on Tailscale's own interface (a carrier-grade-NAT address
+ * on en0 is not Tailscale and is left out). Link-local 169.254/16 is neither. Each list keeps
+ * interface order, is de-duplicated, and is capped.
+ */
+export function buildRouteLists(nets: InterfaceTable, port: number): { lan: RouteEntry[]; tailscale: RouteEntry[] } {
+  const lan: RouteEntry[] = []
+  const tailscale: RouteEntry[] = []
+  const seen = new Set<string>()
+  for (const [name, infos] of Object.entries(nets)) {
+    for (const info of infos ?? []) {
+      if (!info || typeof info.address !== 'string' || !ipv4(info)) continue
+      const ip = info.address
+      if (seen.has(ip)) continue
+      if (isTailscaleIpv4(ip)) {
+        if (TAILSCALE_INTERFACE.test(name) && tailscale.length < LAN_ROUTES_MAX_PER_KIND) {
+          seen.add(ip)
+          tailscale.push({ ip, port, scheme: 'http' })
+        }
+        continue
+      }
+      if (isRfc1918Ipv4(ip) && !NOT_LAN_INTERFACE.test(name) && lan.length < LAN_ROUTES_MAX_PER_KIND) {
+        seen.add(ip)
+        lan.push({ ip, port, scheme: 'http' })
+      }
+    }
+  }
+  return { lan, tailscale }
+}
+
+let readInterfaces: () => InterfaceTable = () => osNetworkInterfaces() as InterfaceTable
+let cache: { at: number; port: number; lists: { lan: RouteEntry[]; tailscale: RouteEntry[] } } | null = null
+
+/**
+ * The `routes` field for authenticated /api/models, or null to omit it. Re-read from the
+ * interfaces at most every 10 s, so a DHCP change shows up within one cache period. Never
+ * throws: a failed interface read omits the field and leaves the rest of the response alone.
+ */
+export function lanRoutesField(input: {
+  port: number
+  serverInstanceId: string | null
+  env?: NodeJS.ProcessEnv
+  now?: () => number
+}): LanRoutes | null {
+  try {
+    if (!lanFirstEnabled(input.env) || !input.serverInstanceId) return null
+    const at = (input.now ?? Date.now)()
+    if (!cache || cache.port !== input.port || at - cache.at >= LAN_ROUTES_CACHE_MS || at < cache.at) {
+      cache = { at, port: input.port, lists: buildRouteLists(readInterfaces(), input.port) }
+    }
+    return {
+      v: LAN_ROUTES_PROTOCOL,
+      serverInstanceId: input.serverInstanceId,
+      learnedAt: new Date(cache.at).toISOString(),
+      lan: cache.lists.lan.map(r => ({ ...r })),
+      tailscale: cache.lists.tailscale.map(r => ({ ...r })),
+    }
+  } catch {
+    cache = null
+    return null
+  }
+}
+
+export function __setInterfaceReaderForTests(reader: (() => InterfaceTable) | null): void {
+  readInterfaces = reader ?? (() => osNetworkInterfaces() as InterfaceTable)
+  cache = null
+}

package/server/lib/live-provisional.ts

@@ -80,7 +80,8 @@ export function liveProvisional(): LiveProvisionalStore { return (store ??= new
 /** 6.86.0: what /api/health and /api/models publish as `capabilities.liveMeeting`, so COS Control gates the live meeting
  *  view by capability, never by a status code. Constants only (health is public). An older server omits the key.
  *  - macLiveCues: POST /api/mac-recording/start takes `liveCues: true` and answers `liveCues: {armed, ...}`.
- *  - provisional: GET <route>?sessionId= serves the newest preview of a live meeting. */
-export function liveMeetingCapability(): { protocol: 1; macLiveCues: true; provisional: { route: string; maxChars: number; ttlMs: number } } {
-  return { protocol: 1, macLiveCues: true, provisional: { route: '/api/transcribe-stream/provisional', maxChars: LIVE_PROVISIONAL_LIMITS.maxChars, ttlMs: LIVE_PROVISIONAL_LIMITS.ttlMs } }
+ *  - provisional: GET <route>?sessionId= serves the newest preview of a live meeting.
+ *  - chunkLevels (6.87.0): the active-session record keeps `chunkLevels[{i, level, speechSec}]` (lib/chunk-levels.ts). */
+export function liveMeetingCapability(): { protocol: 1; macLiveCues: true; provisional: { route: string; maxChars: number; ttlMs: number }; chunkLevels: true } {
+  return { protocol: 1, macLiveCues: true, provisional: { route: '/api/transcribe-stream/provisional', maxChars: LIVE_PROVISIONAL_LIMITS.maxChars, ttlMs: LIVE_PROVISIONAL_LIMITS.ttlMs }, chunkLevels: true }
 }

package/server/lib/transfer-integrity.ts

@@ -0,0 +1,59 @@
+// 6.88.0: transfer integrity counts what the phone captured, not only what the Mac heard of.
+//
+// WHAT HAPPENED. 2026-10-23 07:59, meeting t2xs9u (glasses 6.10.651). A relaunched COS window saved
+// the meeting from the 74 chunks the Mac held while the window still recording it had captured
+// through index 120. The saved file said "Transfer integrity 100%": the gap report only looks for
+// holes in [0, highest index received], so 47 chunks the Mac never heard of did not count.
+//
+// THE RULE. When the phone has said how far it captured (the Stop's `finalChunkIndex`, or a save's
+// own `finalChunkIndex`, glasses 6.10.652), the expected count is that index plus one, and every
+// index from the Mac's highest received chunk to it is missing. 74 of 121 reads 61.1%.
+//
+// And a phone's ORIGIN-WIPE RECOVERY save (`recovery: 'origin_wipe'`, glasses 6.10.652) is refused
+// with 409 `chunks_outstanding` while the phone has said it captured chunks the Mac does not hold,
+// unless it says it waited them out (`acceptMissing: true`). The phone checks the same thing before
+// it asks; this closes the moment between its status read and its save (a Stop landing in between).
+// A save without `recovery` is never refused here: every existing caller behaves as before.
+
+import type { TranscriptGapReport } from '../routes/transcribe-stream.js'
+
+/** The stop route's own bound on a final index. */
+export const PHONE_FINAL_INDEX_LIMIT = 1_000_000
+/** A phone-said index this far past the Mac's highest chunk is capped (about 30 hours of 6 s chunks),
+ *  so one bad number cannot write a huge missing list into the sidecar. */
+export const PHONE_FINAL_INDEX_MAX_AHEAD = 20_000
+
+/** A final index as the stop route accepts it (a whole number, -1 or more), else null. */
+export function parsePhoneFinalChunkIndex(value: unknown): number | null {
+  return typeof value === 'number' && Number.isInteger(value) && value >= -1 && value <= PHONE_FINAL_INDEX_LIMIT ? value : null
+}
+
+/** The highest index any phone window said it captured, or null when none said. */
+export function phoneFinalChunkIndex(...said: Array<number | null | undefined>): number | null {
+  const known = said.filter((v): v is number => typeof v === 'number' && Number.isInteger(v) && v >= 0)
+  return known.length > 0 ? Math.max(...known) : null
+}
+
+/** The gap report with the phone's final index counted. Unchanged when the phone said nothing new. */
+export function withPhoneFinalIndex(report: TranscriptGapReport | null, phoneFinal: number | null): TranscriptGapReport | null {
+  if (!report || phoneFinal === null || phoneFinal <= report.maxIndex) return report
+  const final = Math.min(phoneFinal, Math.max(report.maxIndex, 0) + PHONE_FINAL_INDEX_MAX_AHEAD)
+  const missingIndices = [...report.missingIndices]
+  for (let index = report.maxIndex + 1; index <= final; index++) missingIndices.push(index)
+  const expected = final + 1
+  return {
+    ...report,
+    maxIndex: final,
+    expected,
+    missingIndices,
+    completeness: expected > 0 ? report.received / expected : 1,
+  }
+}
+
+/** Chunks in [0, phoneFinal] the Mac does not hold. */
+export function chunksOutstanding(report: TranscriptGapReport | null, phoneFinal: number | null): number {
+  if (phoneFinal === null) return 0
+  const counted = withPhoneFinalIndex(report, phoneFinal)
+  if (!counted) return phoneFinal + 1
+  return counted.missingIndices.filter(index => index <= phoneFinal).length
+}

package/server/routes/health.ts

@@ -75,6 +75,7 @@ import { liveCuesCapability } from '../lib/live-cues-capability.js'
 import { liveCuesV2Advertised } from '../lib/live-cues-v2.js'
 import { liveMeetingCapability } from '../lib/live-provisional.js'
 import { CUE_KINDS } from '../../shared/live-cues-v2.js'
+import { lanFirstCapabilities, lanFirstHttpPort, lanRoutesField } from '../lib/lan-first.js'
 
 /** 6.86.0: `capabilities.liveCues.kinds`, the cue kinds this server can write (additive; an older server omits it, which
  *  is how a client knows to expect only reinforce and challenge). Which kinds a given meeting gets is in its arm answer. */
@@ -547,6 +548,9 @@ healthRouter.get('/health', async (_req, res) => {
       tasks: {
         gate: taskBridgeAvailable() ? 'ready' : 'disabled',
       },
+      // 6.88.0 LAN first (docs/lan-first.md): protocol flags only. This route is public, so
+      // the addresses themselves are published only on authenticated /api/models.
+      ...lanFirstCapabilities({ token: process.env.COS_API_TOKEN ?? '', serverInstanceId: getServerInstanceId() }),
     },
     // /api/health is intentionally unauthenticated for setup diagnostics.
     // Publish capability only; job counts, retention identities, subscriber
@@ -638,6 +642,10 @@ healthRouter.get('/models', async (req, res) => {
     // Key lanes (plan v4 3.1): `keyProfiles` only while a profile is active. Absent when off.
     ...keyProfilesModelsField(),
     serverInstanceId: getServerInstanceId(),
+    // 6.88.0 LAN first (docs/lan-first.md): the addresses this Mac answers on, behind the
+    // token. Absent when the switch is off, the instance id is not minted yet, or the
+    // interface read failed; never a reason for this response to fail.
+    ...lanRoutesModelsField(),
     // Minted here rather than on a route of its own: this response is already
     // authenticated, and the mint is stateless, so it costs nothing and stores
     // nothing.
@@ -733,9 +741,16 @@ healthRouter.get('/models', async (req, res) => {
       tasks: {
         gate: taskBridgeAvailable() ? 'ready' : 'disabled',
       },
+      // 6.88.0 LAN first: the same helper as /api/health, so the two surfaces cannot disagree.
+      ...lanFirstCapabilities({ token: apiToken, serverInstanceId: getServerInstanceId() }),
     },
   })
 })
+/** 6.88.0: `{ routes }` for /api/models, or nothing at all. lanRoutesField never throws. */
+function lanRoutesModelsField(): { routes?: NonNullable<ReturnType<typeof lanRoutesField>> } {
+  const routes = lanRoutesField({ port: lanFirstHttpPort(), serverInstanceId: getServerInstanceId() })
+  return routes ? { routes } : {}
+}
 /** 6.78.0: `{ steer }` for /api/models `durableQueryJobs`, or nothing at all. */
 export function steerCapabilityField(jobsEnabled: boolean): { steer?: { protocolVersion: 1; providers: ['claude'] } } {
   const steer = messagesSteerCapability({ jobsEnabled, cliSupported: claudeSteerSupportKnown() })

package/server/routes/meeting.ts

@@ -12,6 +12,7 @@ import { Router } from 'express'
 import { emitDisplay } from '../lib/display-bus.js'
 import { createStopRequestStore, isStopRequestRefusal, STOP_REQUEST_CLAIM_WINDOW_MS, type StopRequest, type StopRequestStore } from '../lib/meeting-stop-requests.js'
 import { appendAutonomousSaveLog, getStopIntentStore, type StopIntent, type StopIntentStore } from '../lib/meeting-stop-intents.js'
+import { chunksOutstanding, parsePhoneFinalChunkIndex, phoneFinalChunkIndex, withPhoneFinalIndex } from '../lib/transfer-integrity.js'
 import {
   AUTONOMOUS_FINALIZE_POLL_MS,
   AUTONOMOUS_FINALIZE_SETTLE_MS,
@@ -1128,6 +1129,24 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       if (MAC_CAPTURE_ID.test(sessionId)) {
         requireMacRecordingForSave(sessionId, body?.expectedChunkCount)
       }
+      // 6.88.0 (lib/transfer-integrity.ts): how far a phone window said it captured, from its Stop or
+      // from this save (glasses 6.10.652). The saved file's integrity counts against it.
+      const phoneFinal = phoneFinalChunkIndex(stopIntents.get(sessionId)?.finalChunkIndex, parsePhoneFinalChunkIndex(body?.finalChunkIndex))
+      // An origin-wipe recovery never finalizes a meeting a phone window still holds chunks for, unless
+      // it says it waited them out. A save without `recovery` is never refused here.
+      if (body?.recovery === 'origin_wipe' && body?.acceptMissing !== true) {
+        const report = sessions.getIntegrity(sessionId)
+        const outstanding = report ? chunksOutstanding(report, phoneFinal) : 0
+        if (outstanding > 0) {
+          respond(409, {
+            error: 'A phone window captured chunks this Mac does not hold yet',
+            reason: 'chunks_outstanding',
+            missingCount: outstanding,
+            finalChunkIndex: phoneFinal,
+          })
+          return null
+        }
+      }
       if (savingSessions.has(sessionId)) {
         respond(409, { error: 'Meeting save already in progress', reason: 'save_in_progress' })
         return null
@@ -1166,7 +1185,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       const durationMs = durationFromTimeline > 0
         ? durationFromTimeline
         : Math.max(0, Date.now() - startTime)
-      const integrity = sessions.getIntegrity(sessionId)
+      const integrity = withPhoneFinalIndex(sessions.getIntegrity(sessionId), phoneFinal)
       const needsOperations = cosOpsPipelineConfigured() && !macRecording
       // Standalone saves need a finalization pass too, for summary enrichment.
       // Before 6.37 a standalone save with no audio nulled the job below and

package/server/routes/route-proof.ts

@@ -0,0 +1,83 @@
+// 6.88.0 LAN first: the pre-token identity proof (docs/lan-first.md).
+//
+// GET /api/route-proof?nonce=<22-64 base64url chars> is PUBLIC (an exact GET door in
+// api-auth.ts), because it exists to prove which Mac answers at an address BEFORE the phone
+// sends its token there. Rules, each with its reason:
+// - The nonce is validated strictly (charset and length) and never echoed or logged.
+// - The message is fixed: "cos-route-proof:v1:" + nonce + ":" + serverInstanceId. The caller
+//   picks only the nonce, so this is never a general HMAC oracle, and the prefix keeps it
+//   apart from the display-stream ticket, the only other HMAC keyed by the token.
+// - The response carries the instance id (already on public /api/health as
+//   server_instance_id) and the HMAC. Never the token, never an address, never a version.
+// - Served only while lib/lan-first.ts `routeProofAvailable` holds: switch on, instance id
+//   minted, token at least 32 characters (a proof would let a stranger test guesses of a
+//   short token offline).
+// - Rate limited per socket address (never req.ip or X-Forwarded-For) plus a global ceiling.
+// - Writes nothing, so it takes no lease and is served during a drain.
+
+import { Router, type Request, type Response } from 'express'
+import {
+  ROUTE_PROOF_PROTOCOL,
+  RouteProofRateLimiter,
+  computeRouteProof,
+  isValidRouteProofNonce,
+  lanFirstEnabled,
+  routeProofTokenUsable,
+} from '../lib/lan-first.js'
+
+export type RouteProofReason = 'bad_nonce' | 'rate_limited' | 'not_ready' | 'disabled' | 'method_not_allowed'
+
+export const ROUTE_PROOF_REASON_STATUS: Record<RouteProofReason, number> = {
+  bad_nonce: 400,
+  disabled: 404,
+  method_not_allowed: 405,
+  rate_limited: 429,
+  not_ready: 503,
+}
+
+export interface RouteProofRouterOptions {
+  /** Read per request, so a token change is honoured without a remount. */
+  token: () => string
+  serverInstanceId: () => string | null
+  env?: () => NodeJS.ProcessEnv
+  limiter?: RouteProofRateLimiter
+}
+
+function send(res: Response, reason: RouteProofReason, retryAfterSeconds?: number): void {
+  if (retryAfterSeconds != null) res.setHeader('Retry-After', String(retryAfterSeconds))
+  res.setHeader('Cache-Control', 'no-store')
+  res.status(ROUTE_PROOF_REASON_STATUS[reason]).json({ v: ROUTE_PROOF_PROTOCOL, reason })
+}
+
+export function createRouteProofRouter(options: RouteProofRouterOptions): Router {
+  const router = Router()
+  const limiter = options.limiter ?? new RouteProofRateLimiter()
+  const env = options.env ?? (() => process.env)
+
+  router.all('/route-proof', (req: Request, res: Response) => {
+    // The public door in api-auth.ts is GET only, so any other method has already been
+    // refused without a token. With a token it is still refused here: one shape, one verb.
+    if (req.method !== 'GET') {
+      res.setHeader('Allow', 'GET')
+      return send(res, 'method_not_allowed')
+    }
+    if (!lanFirstEnabled(env())) return send(res, 'disabled')
+    // Counted before the nonce check, so malformed requests spend the same budget.
+    const admission = limiter.admit(req.socket?.remoteAddress)
+    if (!admission.ok) return send(res, 'rate_limited', admission.retryAfterSeconds)
+    const nonce = req.query.nonce
+    if (!isValidRouteProofNonce(nonce)) return send(res, 'bad_nonce')
+    let token = ''
+    try { token = options.token() } catch { token = '' }
+    const serverInstanceId = options.serverInstanceId()
+    if (!serverInstanceId || !routeProofTokenUsable(token)) return send(res, 'not_ready', 30)
+    res.setHeader('Cache-Control', 'no-store')
+    res.json({
+      v: ROUTE_PROOF_PROTOCOL,
+      serverInstanceId,
+      proof: computeRouteProof(token, nonce, serverInstanceId),
+    })
+  })
+
+  return router
+}

package/server/routes/transcribe-stream.ts

@@ -117,6 +117,7 @@ import {
 import { feedLiveCueTranscript } from '../lib/live-cues-engine.js'
 import { armMacLiveCues, type MacLiveCuesAnswer } from '../lib/live-cues-v2.js'
 import { liveProvisional } from '../lib/live-provisional.js'
+import { chunkLevel, restoreChunkLevels, withChunkLevel, type ChunkLevel } from '../lib/chunk-levels.js'
 import { preemptMetalBatchForLive, registerLiveActivityProbe } from '../lib/whisper-metal-gate.js'
 import {
   scheduleProgressiveHqCheckpoint,
@@ -348,6 +349,8 @@ interface TranscriptSession {
   /** Exact replay records for silent/filtered ASR completions. */
   emptyCompletions?: Record<string, EmptyTranscriptCompletion>
   maxChunkIndex?: number
+  /** 6.87.0: two numbers per chunk (level 0 to 1, Silero speech seconds) for Control's level strip. Never text. */
+  chunkLevels?: ChunkLevel[]
   /** Persisted idle-retention clock. Meeting date/duration still use startTime. */
   lastActivityAt: number
   // Count of consecutive vocab-echo (prompt-regurgitation) chunks. Reset to 0 by
@@ -713,6 +716,7 @@ function persistSessionRequired(sessionId: string): void {
       emptyCompletions: session.emptyCompletions ?? {},
       maxChunkIndex: session.maxChunkIndex ?? -1,
       providerCandidates: session.providerCandidates ?? {},
+      chunkLevels: session.chunkLevels ?? [],
     })
   try {
     durableAtomicWriteFileSync(filePath, data, { mode: 0o600 })
@@ -901,6 +905,7 @@ function recoverSessions(): void {
               providerCandidates: data.providerCandidates && typeof data.providerCandidates === 'object'
                 ? data.providerCandidates
                 : {},
+              chunkLevels: restoreChunkLevels(data.chunkLevels),
             }
             // Retroactively strip inline hallucinations from recovered chunks.
             // Two-pass: (1) scan all chunks to build frequency/blocklist,
@@ -2439,6 +2444,8 @@ async function processStreamChunk(opts: {
   const quiet = decideQuiet(audioBuffer, stt.quietGate)
   const rms = quiet.rms
   const isQuiet = quiet.isQuiet
+  // 6.87.0: the level strip's two numbers, on the record every terminal path below persists. Not text, never logged.
+  session.chunkLevels = withChunkLevel(session.chunkLevels, chunkLevel(chunkIndex, rms, quiet.speechSec))
   const whisperAudio = isQuiet ? audioBuffer : await asrFrontEnd(audioBuffer, stt.frontEnd)
   const whisperContext = recentWhisperContext(sessionId, session)
   console.log(`[perf] whisperContext: ${whisperContext.length}b | session.chunks: ${session.chunks.length}`)