@gotcos/glasses-server 6.91.0 → 6.92.0

package/.env.example

@@ -82,11 +82,44 @@ BIND_HOST=0.0.0.0
 # COS_DICTATION_REGISTERS=1 makes it literal). On by default; 0 stops it applying
 # everywhere (the capability then says enabled false; the rules are kept).
 # COS_DICTATION_LEARNED_STYLE=0
-# The meaning guard runs where v4 runs on Sonnet (never on Haiku, Luna, other models,
+# The meaning guard runs only on Sonnet with v4 (never on Haiku, Luna, other models,
 # prompt v3 or meeting lines): it refuses a polish that lost a negation, number,
 # weekday or month, or name you said (or added a negation or number), and pastes the
 # unpolished text. 0 turns it off.
 # COS_DICTATION_MEANING_GUARD=0
+# Daily polish budgets, one per caller (local day): Mac dictation and G2 messages
+# (default 300; the older shared variable is its fallback), G2 meeting lines (200),
+# prompt drafts (200).
+# COS_DICTATION_AUTOCLEAN_MAX_PER_DAY=300
+# COS_DICTATION_AUTOCLEAN_MAX_PER_DAY_MESSAGE=300
+# COS_DICTATION_AUTOCLEAN_MAX_PER_DAY_MEETING=200
+# COS_DICTATION_AUTOCLEAN_MAX_PER_DAY_PROMPT_DRAFT=200
+# The polish prompt for every model (v1 to v4); the alias above takes 3 or v3.
+# COS_DICTATION_POLISH_PROMPT=v3
+# The deterministic um/uh pass before the model (English text only since 6.92.0;
+# never meeting lines). On by default; 0 sends the text to the model as heard.
+# COS_DICTATION_FILLER_PASS=0
+# "forward slash pricing" written "/pricing" before the model. On by default.
+# COS_DICTATION_SPOKEN_PATHS=0
+# Start the polish process at key press (Claude models). On by default.
+# COS_DICTATION_PREWARM=0
+# Skip the model when the text has nothing for it to fix. Off by default.
+# COS_DICTATION_POLISH_SKIP_CLEAN=1
+# 6.92.0: the polish breakers are keyed by model and caller group (Mac dictation, G2
+# messages and prompt drafts; meeting lines on their own). A client that stops waiting
+# never counts as a failure; this many such aborts in a row, each after 4 s or more of
+# model time, pause that model's polish for _MS (default 4 and 300000, 5 minutes).
+# COS_DICTATION_SLOW_BREAKER_ABORTS=4
+# COS_DICTATION_SLOW_BREAKER_MS=300000
+# 6.92.0: G2's prompt edit. On by default; 0 answers 503 "Edit is off". At most
+# _DAILY_CAP edits a local day (default 200, its own counter), then 429 "Edit limit
+# reached"; 3 failures in a row pause it 10 minutes (503 "Edit paused"). The model,
+# effort and timeout default to sonnet, low and 45000 ms.
+# COS_PROMPT_EDIT=0
+# COS_PROMPT_EDIT_DAILY_CAP=200
+# COS_PROMPT_EDIT_MODEL=sonnet
+# COS_PROMPT_EDIT_EFFORT=low
+# COS_PROMPT_EDIT_TIMEOUT_MS=45000
 
 # Build 204+ uses server-owned durable query jobs by default. The server fsyncs an
 # accepted prompt before returning 202, then keeps provider work running if the

package/CHANGELOG.md

@@ -1,3 +1,126 @@
+## 6.92.0 - Dictation parity, Wave A (server): breakers that tell an abort from a failure, bounded prompt edit, a filler pass that leaves other languages and paths alone
+
+2026-10-25, plan r3 ("dictation parity", Wave A; pairs with COS Control 0.5.345). Zero `claude -p` calls: every
+change is proven by execution tests, a fake CLI and mutation gates.
+
+**What changes by default:**
+- **Polish breakers** (`server/lib/dictation-polish-pipeline.ts`) are keyed by (model, bucket group): `dictation`
+  (Mac dictation, G2 messages, prompt drafts) and `meeting`. A G2 meeting that fails no longer turns off message polish.
+  - A client abort (Control stopped waiting, the request closed) is **neutral** to the 2-failure breaker: it neither
+    counts nor resets. Before, two slow Sonnet polishes past Control's wait could turn Sonnet polish off for 30 minutes.
+  - A new **slow breaker** per key: `COS_DICTATION_SLOW_BREAKER_ABORTS` (default 4) aborts in a row, each after at least
+    4 s of model time (stamped when the abort happens, not after the provider process is killed), with no success between, skip polish as `breaker_open` for
+    `COS_DICTATION_SLOW_BREAKER_MS` (default 300000, 5 minutes). An abort sooner than 4 s (a disconnect right after a
+    sidecar restart) does not count. Any success closes both breakers.
+  - Each abort writes a token-audit row with `polish_outcome: "aborted"`, codes only. `aborted` is audit-only: a
+    finalize answer's `polishOutcome` keeps its three values.
+  - `POST /api/dictation/polish/prewarm` asks the same keyed breaker as the finalize for its surface.
+- **The filler pass** (`server/lib/dictation-fillers.ts`, on since 6.79.1) had removed German and Portuguese words
+  ("um drei Uhr" became "drei Uhr", "Er kommt morgen." became "Kommt morgen.") and damaged paths ("src/um.txt" became
+  "src/.txt"). Now:
+  - **Token exemptions:** a filler is kept when the character right before it is one of `/ . @ _ : # $`, or the
+    character right after it is one of `/ @ _ # $`, or a `.` or `:` followed by a letter or digit. A sentence-final
+    "um." or "um:" still goes.
+  - **Language gate** (`stripFillersIfEnglish`, in the caller; `stripDisfluencies` stays the pure token rules) uses its
+    own function, `fillerTextLooksEnglish`. The meaning guard keeps 6.91.1's `looksEnglish` byte for byte, so "merci
+    Dana" and "gracias Marco" polished without the name are still refused. The filler gate: not English when
+    `looksEnglish` says so; under 12 words, English words (the function words, plus a short-reply list: yes, no, yeah,
+    yep, ok, okay, sure, thanks, thank, please, sorry, hi, hey, hello, good, great, fine, cool, done, right, maybe,
+    sounds, call, send, tell, ask, am, pm, weekdays, months but "may") must outnumber any foreign function word
+    (German, Portuguese, Spanish, French, Dutch; never an all-caps acronym), and an "um" or "er" said inline needs at
+    least one English word beside it. So "um yes", "er no", "um thanks Dana", "um Tuesday" and "um 5 pm works" lose
+    their filler as in 6.91.1, while "Comprei um carro", "Er kommt morgen." and "Wir treffen uns um 5 Uhr" keep it.
+    Known cost: an inline "um" beside only a name ("um Dana") is kept.
+  - **Canonical fixture** `server/lib/__fixtures__/dictation-fillers.json`, generated by the server's own functions
+    (`server/scripts/generate-dictation-fillers-fixture.ts`) from hand-written expectations: 140 rows, 108 scope `both`
+    (the token rules, which COS Control's port must match byte for byte; its 5 short-reply rows hold through both
+    repos' language gates too) and 32 scope `server` (the server's language gate). Its sha256,
+    `a531d0a99b4661dedcde5d81dbaa304eae73f916eb30e2efd7589e1e0a71de55`, is pinned in
+    `dictation-fillers-fixture.test.ts` and in Control's copy.
+- **G2 prompt edit** (`POST /api/prompt-edit`) now answers how it stops. Its limits and settings are unchanged (24,000
+  character drafts, 2,000 character instructions, `COS_PROMPT_EDIT_MODEL`, `_EFFORT`, `_TIMEOUT_MS`: sonnet, low,
+  45000), and so is its environment, so a Claude CLI signed in with an API key keeps working.
+  - Runs through a new isolated runner, `server/lib/claude-text-runner.ts`: `--tools ''`, no MCP, hooks off in exactly
+    one `--settings`, `--permission-mode dontAsk`, no session file, a scratch working directory, a verified absolute
+    binary. `spawnClaudeText` stays for meeting summaries (prompt-edit.ts stays TOOL_CAPABLE in the key-lanes census;
+    the runner is TOOL_LESS).
+  - Switch `COS_PROMPT_EDIT` (read with `readSwitch`, on by default): off answers `503 Edit is off`.
+  - Cap `COS_PROMPT_EDIT_DAILY_CAP` (default 200 a local day) in its own counter file (`.prompt_edit_count.json`),
+    never the dictation polish counter: `429 Edit limit reached`.
+  - Breaker: 3 CLI failures in a row open it for 10 minutes (`503 Edit paused`); a client abort is neutral.
+  - A failure answers `500 Edit failed`; the CLI's stdout and stderr tails are gone from the answer and the log.
+  - Every refusal is `text/plain` and 24 characters or fewer, so G2 6.10.654 shows `Edit failed.` then, for example,
+    `API 429: Edit limit reached` (40 characters at most). A contract test runs 654's own `ApiHTTPError` and
+    `applyVoicePromptEdit`, copied verbatim into `server/lib/__fixtures__/g2-6.10.654-prompt-edit.json`, against the
+    real refusals: the footer fits and no undo entry is pushed.
+  - One audit row per edit that ran (`caller: prompt_edit`, `prompt_edit_outcome` ok, failed or aborted; sizes only).
+- **`GET` and `PUT /api/dictation/polish/options`** add `meaningGuard` (false only with `COS_DICTATION_MEANING_GUARD=0`)
+  and `stylePairs` (the model and prompt pairs the guard, Your style and the register run on, as `/rules` computes
+  them), so Control 0.5.345's picker line tells the truth. Older servers omit both.
+
+**Corrections and housekeeping:**
+- The meaning guard runs **only on Sonnet with v4** (a Haiku forced to v4 gets none). The 6.91.0 wording "where v4
+  runs" is corrected in `.env.example` and the README.
+- Eval harness limits: the custom-polish default `--max-calls` is 205 (its default run is 201 calls; it was 200, so a
+  default run refused itself) and the format eval's is 50 (it was 40, under the canary's 45). Case counts are pinned
+  in `server/scripts/dictation-eval-harness.test.ts`. Nothing was run.
+- Managed runtime: `COS_DICTATION_SLOW_BREAKER_ABORTS`, `_MS`, `COS_PROMPT_EDIT`, `_DAILY_CAP`, `_MODEL`, `_EFFORT` and
+  `_TIMEOUT_MS` join `managed-runtime-contract.json` `optionalEnvironment`. `dictation-polish-budget.test.ts` now
+  checks all 20 dictation and prompt-edit keys there and in `.env.example`, including the five it missed
+  (`SPOKEN_PATHS`, `PROMPT_VERSION`, `LEARNED_STYLE`, `MEANING_GUARD`, `REGISTERS`).
+- Test isolation: the polish goldens (`dictation-polish-prompt-v4.test.ts`), `prompt-drafts`, `dictation-polish-settings`,
+  the prompt-edit tests, `dictation-polish-breakers` and `transcript-cleanup` each get a private `COS_PROFILE_PATH` as
+  well as a private `COS_DATA_DIR`, restored after the file. In a 4-worker run `transcript-cleanup.test.ts` wrote the
+  vocabulary "Jewel360" into the run's shared profile while the goldens read it.
+- The key-lanes off-identity recordings (`server/lib/__fixtures__/key-lanes/off-*.json`, recorded by hand, not run by
+  the suite) still show prompt edit's 6.91.1 argv; a re-recording will show the runner's.
+
+**Gates:** mutation gates, each from a green baseline:
+- new `server/scripts/dictation-parity-6920-mutation-gate.mjs`: **64 of 64**, each killed by its named test (baseline
+  360 tests in 13 files): abort-neutral, abort then error counts one, the slow threshold, open time and env read, the
+  4 s model-time rule and its boundary, the slow breaker consulted and reset, the aborted audit row, the bucket key
+  (meeting apart, prompt drafts with messages), prewarm keyed, prompt edit's switch and default, cap, cap boundary and
+  default, call counted, own counter, breaker, threshold, failure and success, abort neutral, text/plain refusal, no
+  CLI tails, the 24-character refusal, the runner (no tools, scratch directory, environment kept), the language gate
+  (wired in the filler step and the pipeline, its own function with the long-text ratio and the short-reply words,
+  foreign words, all-caps, inline um/er, a pause makes a hesitation, and the meaning guard keeping 6.91.1's check), each
+  token exemption character before and after, the dot and colon needing a letter or digit, both exemption checks
+  wired, the options `meaningGuard` and `stylePairs`, and both harness defaults;
+- dictation polish 92 of 92 (`prewarm-breaker` retargeted to the keyed breaker), format 63 of 63, custom polish 46 of
+  46, voice style 183 of 183 (its anchors unchanged from 6.91.1);
+- dictation STT 21 of 22: its two anchors in `stt-settings.ts` already matched twice at 6.91.1, so the gate stopped
+  before its first mutant; a leading newline now pins each. The survivor, `hq-parakeet-warms`
+  (`server/lib/stt-runtime.ts`), is in code this release does not touch and was hidden by that stop;
+- full suite, 4 workers, scratch HOME, COS_DATA_DIR and COS_PROFILE_PATH: 9,180 passed, 14 skipped, 0 failed;
+- `check-gate-anchors.mjs --base 96be0b8`: every anchor in a changed file matches once (the one pre-existing
+  `manifest-lock-version-drift` miss is unchanged); `tsc --noEmit` clean.
+
+## 6.91.1 - The meaning guard reads clock times, so a time format you asked for is not refused
+
+2026-10-25: canary C5 on the pair that ships (Sonnet, v4, instructions and the learned style) found the 6.91.0 guard
+refusing answers that followed the person's own instruction "write times in the form 10:30 am": "at ten" written
+"10:00 am" counted "am" and "00" as added numbers, and the unpolished text went out. 6.90.0 pasted that formatting, so
+this was a step backward for any Sonnet user with a time-format instruction. Fixed before npm latest moves. Zero
+`claude -p` calls.
+
+- **Clock times** (`server/lib/dictation-meaning-guard.ts`): every time, spoken or written, in the dictation and in the
+  answer, is read as minutes since midnight: "ten", "ten thirty", "half past ten", "quarter to five", "ten o'clock",
+  "ten oh five", 10, 10:00, 10:30, am, pm, a.m., p.m., "22:30" and "twenty two thirty". Without am or pm an hour from
+  1 to 12 reads both ways, so "ten thirty pm" written "22:30" and "ten thirty" written "22:30" are kept. am, pm and a
+  trailing ":00" are format only and never count as added numbers: "at ten" written "at 10:00 am", "ten thirty
+  Central" written "10:30 am Central" and "meet at 9" written "meet at 9:00" are kept. A real change still trips:
+  "ten thirty" written "11:30", "7 am" written "7 pm", "3:00 pm" written "3", and a time the speaker never said. A year
+  that reads like a time ("nineteen fifty" as "1950") still matches its plain form.
+- **C5 re-checked offline:** the 30 stored C5 answers (synthetic) run through the 6.91.1 guard: 0 of 15 stacked and 0
+  of 14 plain refused (6.91.0 refused b02 and b09), so what would go out is 11/11 backtracks on both arms. Every other
+  stored synthetic output: still 0 false trips in 356. Route test: on Sonnet v4 with the time-format instruction saved,
+  b02 and b09 go out polished, and a changed time is still refused.
+- **Eval:** `STACKED_INSTRUCTIONS` is 985 characters (it was 1,033, over the 1,000 cap, so the reader refused it and
+  the 6.91.0 Haiku stacked arm ran without instructions), and the eval now stops if the reader would refuse the set.
+- **Known limit, kept:** the largest possible stack (985-character instructions and all 13 learned-style rules) costs
+  Sonnet v4 +4.3% at p50 and **+46.7% at p90** (9,260 vs 6,311 ms, C5 2026-10-25, n=15). No user has that today: the
+  learned style starts empty and grows a rule at a time. Prompts are unchanged for it.
+
 ## 6.91.0 - Dictation that learns your voice: prompt v4 on Sonnet, Your style, the meaning guard, an opt-in literal register
 
 2026-10-24 22:45: extend AI polish into "a Grammarly but further for voice dictation", remove ungrammatical spoken
@@ -133,8 +256,14 @@ builds the capture, the classifier and Your style.
   (+3.2%); Sonnet p50 3,024 vs 2,949 (+2.5%), p90 4,460 vs 3,997 (+11.6%). Stacked arm (Haiku, v4 + 1,033-character
   instructions + the largest learned style, 767 characters): p50 3,147 vs 2,794 (+12.6%), p90 3,646 vs 3,520 (+3.6%),
   backtracks 11/11. C4 cold, Sonnet: v4 p50 4,346 vs v3 4,713. The absolute Haiku bar is measured after install.
-  **Pending before npm latest:** the stacked arm on the pair that ships, Sonnet with v4, instructions and the learned
-  style (about 15 calls). The stacked number above is Haiku, which does not get v4 or the style.
+  **Pending before npm latest, run 2026-10-25: DISPROVEN (p90).** The stacked arm on the pair that ships, Sonnet with
+  v4, 985-character instructions and the largest learned style (13 rules, 767 characters), against plain Sonnet v4, on
+  the 15-case backtrack and new-preserve slice, interleaved, warm (29 of 30 warm; 30 calls, 1 plain call timed out at
+  20 s): p50 4,968 vs 4,762 ms (+4.3%), p90 9,260 vs 6,311 ms (+46.7%, over the +25% bar; 4 of 15 stacked calls took
+  7.9 to 18.0 s, 1 of 14 plain). Backtracks 11/11 in the model's answers on both arms; new preserve 4/4 stacked, 3/3
+  plain. What would go out: 9/11 stacked, because the meaning guard refused two answers that followed the instruction
+  "write times in the form 10:30 am" ("at ten" as "10:00 am" adds "am" and "00"). The Haiku stacked number above ran
+  without its instructions: that set is 1,033 characters, over the 1,000 cap, so the reader refused it.
 - **C6: PROVEN** (route and golden tests). Every new route is 401 without the token; an old client body works; a skip
   path sends no `polishOutcome`; a port of the 0.5.343 helper and `choose` logs a guarded answer as
   `fillers_only:failed` or `skipped:failed`, never applied; all four switches off, and Haiku outside a terminal, give the

package/README.md

@@ -868,14 +868,17 @@ built-in polish rules, which keep precedence.
   answer says `learnedStyle: true` and `learnedStyleHash` (8 hex), never the
   rules.
 - **Meaning guard.** After the model, for messages and prompt drafts, and only
-  where v4 runs on Sonnet (Haiku, Luna, any other model and prompt v3 get no
+  on Sonnet with v4 (Haiku, Luna, any other model and prompt v3 get no
   guard, so their answers are 6.90.0's): if a negation, number, weekday or
   month, or name the speaker kept is missing from the answer (or a negation or
   number appears that was never said), the pre-polish text goes out with
   `polishOutcome: "guarded"`, `guard: "<kind>"` and `polishSkipped: "failed"`.
   A self-correction may drop what it replaced. "2 million", "25th",
   "dont", "half past ten" and a numbered list you asked for read as what you
-  said. The log line carries counts only. `COS_DICTATION_MEANING_GUARD=0` turns
+  said. 6.91.1: clock times compare as minutes since midnight, so "at ten"
+  written "10:00 am" and "ten thirty pm" written "22:30" are kept (am, pm and
+  ":00" are format only), while "ten thirty" written "11:30" trips. The log
+  line carries counts only. `COS_DICTATION_MEANING_GUARD=0` turns
   it off.
 - **Finalize answers** add, all optional: `polishOutcome` (`polished`,
   `unchanged` or `guarded`, about the model step; an empty model answer is a
@@ -886,6 +889,37 @@ built-in polish rules, which keep precedence.
   (`{protocol: 1, maxChars: 1500, maxRules: 20, enabled}`) and
   `capabilities.dictationCleanup.polishOptions` (`{protocol: 1}`).
 
+### Dictation reliability and prompt edit bounds (6.92.0)
+
+- **Breakers keyed by model and caller group.** Mac dictation, G2 messages and
+  prompt drafts share one group; G2 meeting lines have their own, so a failing
+  meeting can no longer turn off message polish. 2 CLI failures in a row open
+  a model's breaker for 30 minutes, as before. A client that stops waiting (the
+  request closes) is not a failure. `COS_DICTATION_SLOW_BREAKER_ABORTS` (4)
+  such aborts in a row, each after 4 s or more of model time, pause that model
+  for `COS_DICTATION_SLOW_BREAKER_MS` (300000). Either one open answers
+  `polishSkipped: "breaker_open"`, and the prewarm route asks the same keyed
+  breaker as its surface. An abort writes an audit row with `polish_outcome`
+  `aborted` (codes only); the finalize answer never says `aborted`.
+- **The filler pass** keeps a filler that is part of a path, handle or code
+  token (`src/um.txt`, `~/uh`, `@uh`, `um.py`, `um:8080`), and runs only when
+  the text is mostly English (`fillerTextLooksEnglish`; short replies such as
+  "um yes" count as English), so "um 5 Uhr", "um carro" and "Er kommt" go out
+  as said. The meaning guard keeps its 6.91.1 language check. The rules are pinned by `server/lib/__fixtures__/dictation-fillers.json`,
+  generated by the server's own functions; COS Control carries a byte-identical
+  copy and pins the same sha256.
+- **`GET /api/dictation/polish/options`** adds `meaningGuard` (the
+  `COS_DICTATION_MEANING_GUARD` switch) and `stylePairs` (the pairs the guard,
+  Your style and the register run on).
+- **G2 prompt edit** (`POST /api/prompt-edit`) runs through an isolated text
+  runner (no tools, MCP, hooks or session, a scratch directory) and now stops:
+  `COS_PROMPT_EDIT=0` answers `503 Edit is off`; `COS_PROMPT_EDIT_DAILY_CAP`
+  (default 200 a local day, its own counter) then `429 Edit limit reached`; 3
+  CLI failures in a row pause it 10 minutes (`503 Edit paused`). A failure is
+  `500 Edit failed`, never the CLI's output. Every refusal is `text/plain`.
+  `COS_PROMPT_EDIT_MODEL`, `_EFFORT` and `_TIMEOUT_MS` are unchanged
+  (sonnet, low, 45000).
+
 ### Parakeet (FluidAudio CoreML, offline)
 
 `POST /api/stt-settings/parakeet/install` installs FluidAudio's `fluidaudiocli`

package/managed-runtime-contract.json

@@ -90,7 +90,14 @@
     "COS_DICTATION_PROMPT_VERSION",
     "COS_DICTATION_LEARNED_STYLE",
     "COS_DICTATION_MEANING_GUARD",
-    "COS_DICTATION_REGISTERS"
+    "COS_DICTATION_REGISTERS",
+    "COS_DICTATION_SLOW_BREAKER_ABORTS",
+    "COS_DICTATION_SLOW_BREAKER_MS",
+    "COS_PROMPT_EDIT",
+    "COS_PROMPT_EDIT_DAILY_CAP",
+    "COS_PROMPT_EDIT_MODEL",
+    "COS_PROMPT_EDIT_EFFORT",
+    "COS_PROMPT_EDIT_TIMEOUT_MS"
   ],
   "maintenance": {
     "scope": "cross_boot",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.91.0",
+  "version": "6.92.0",
   "description": "COS Glasses: self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {

package/server/lib/claude-circuit.ts

@@ -15,16 +15,18 @@ export interface ClaudeBreaker {
 
 export function createBreaker(opts: {
   label: string
-  maxFailures?: number
-  cooldownMs?: number
+  /** 6.92.0: a function is read at each check, so an environment value applies after a restart. */
+  maxFailures?: number | (() => number)
+  cooldownMs?: number | (() => number)
 }): ClaudeBreaker {
-  const maxFailures = opts.maxFailures ?? 2
-  const cooldownMs = opts.cooldownMs ?? 30 * 60 * 1000 // 30 minutes
+  const read = (value: number | (() => number) | undefined, fallback: number) => typeof value === 'function' ? value() : value ?? fallback
   let consecutiveFailures = 0
   let openedAt = 0
 
   return {
     isOpen(): boolean {
+      const maxFailures = read(opts.maxFailures, 2)
+      const cooldownMs = read(opts.cooldownMs, 30 * 60 * 1000) // 30 minutes
       if (consecutiveFailures < maxFailures) return false
       const elapsed = Date.now() - openedAt
       if (elapsed >= cooldownMs) {
@@ -35,6 +37,8 @@ export function createBreaker(opts: {
       return true
     },
     recordFailure(): void {
+      const maxFailures = read(opts.maxFailures, 2)
+      const cooldownMs = read(opts.cooldownMs, 30 * 60 * 1000)
       consecutiveFailures++
       if (consecutiveFailures >= maxFailures) {
         openedAt = Date.now()

package/server/lib/claude-text-runner.ts

@@ -0,0 +1,113 @@
+/**
+ * 6.92.0 (plan r3, A-W0b): a small isolated `claude -p` text runner, for callers that only turn text
+ * into text (G2's prompt edit today). It replaces spawnClaudeText for those callers; spawnClaudeText
+ * stays in prompt-edit.ts for meeting summaries.
+ *
+ * Isolation, the dictation polish caller's (dictation-clean.ts claudePolishArgs) minus its env strip:
+ * - no tools (`--tools ''`), so the key-secrets deny layer has nothing to guard (key-lanes census:
+ *   TOOL_LESS_CLAUDE); no MCP servers (`--strict-mcp-config` with an empty config); no hooks, in
+ *   exactly ONE `--settings` layer; `--permission-mode dontAsk`; no session file;
+ * - `--model` is always passed, so it can never silently become Opus;
+ * - a fresh scratch working directory, never the server's own;
+ * - a verified absolute binary (provider-binary.ts), never a bare PATH lookup.
+ * The environment is kept as spawnClaudeText kept it (only CLAUDECODE is removed and PATH repaired),
+ * so a person who signs the Claude CLI in with an API key keeps working.
+ *
+ * Errors carry a code and never the CLI's stdout or stderr: those can hold the draft or login data.
+ */
+import { spawn } from 'node:child_process'
+import { mkdirSync, mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { resolveProviderBinary } from './provider-binary.js'
+import { terminateProviderProcess } from './provider-process-lifecycle.js'
+
+export type ClaudeTextErrorCode = 'unavailable' | 'aborted' | 'timeout' | 'failed' | 'empty' | 'too_large' | 'input'
+
+export class ClaudeTextError extends Error {
+  constructor(readonly code: ClaudeTextErrorCode, label: string) {
+    super(`${label} ${code}`)
+  }
+}
+
+export interface ClaudeTextRunOptions {
+  model: string
+  effort: string
+  timeoutMs: number
+  systemPrompt: string
+  /** Prefix for the error message ("Prompt edit"). */
+  label: string
+  signal?: AbortSignal
+}
+
+/** The argv: one `--settings`, no tools, no MCP, no hooks, no session. */
+export function claudeTextArgs(model: string, effort: string, systemPrompt: string): string[] {
+  return [
+    '-p', '--model', model, '--effort', effort, '--output-format', 'text',
+    '--no-session-persistence', '--strict-mcp-config', '--mcp-config', '{"mcpServers":{}}',
+    '--tools', '', '--settings', '{"disableAllHooks":true}', '--permission-mode', 'dontAsk',
+    '--system-prompt', systemPrompt,
+  ]
+}
+
+/** spawnClaudeText's environment: everything but CLAUDECODE (anti-recursion), with the binary's dir on PATH. */
+export function claudeTextEnv(binary: string, env: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
+  const out = { ...env }
+  delete out.CLAUDECODE
+  out.PATH = [dirname(binary), '/opt/homebrew/bin', out.PATH || ''].join(':')
+  out.NO_OPEN_BROWSER = '1'
+  return out
+}
+
+const MAX_OUTPUT_CHARS = 256_000
+
+/** Run the prompt on stdin; resolve the trimmed text answer, or reject with a ClaudeTextError. */
+export async function runClaudeText(prompt: string, opts: ClaudeTextRunOptions): Promise<string> {
+  if (opts.signal?.aborted) throw new ClaudeTextError('aborted', opts.label)
+  const binary = resolveProviderBinary('claude')
+  if (!binary.ok) throw new ClaudeTextError('unavailable', opts.label)
+  const timeoutMs = Number.isFinite(opts.timeoutMs) && opts.timeoutMs > 0 ? opts.timeoutMs : 45_000
+  const scratch = mkdtempSync(join(tmpdir(), 'cos-claude-text-'))
+  try {
+    const workspace = join(scratch, 'workspace')
+    mkdirSync(workspace, { mode: 0o700 })
+    return await new Promise<string>((resolve, reject) => {
+      const proc = spawn(binary.path, claudeTextArgs(opts.model, opts.effort, opts.systemPrompt), {
+        stdio: ['pipe', 'pipe', 'pipe'], env: claudeTextEnv(binary.path), cwd: workspace, detached: true,
+      })
+      let stdout = ''
+      let settled = false
+      const finish = (error?: ClaudeTextError, output?: string, terminate = false) => {
+        if (settled) return
+        settled = true
+        clearTimeout(timer)
+        opts.signal?.removeEventListener('abort', abort)
+        const complete = () => error ? reject(error) : resolve(output!)
+        if (terminate) void terminateProviderProcess(proc).then(complete, complete)
+        else complete()
+      }
+      const abort = () => finish(new ClaudeTextError('aborted', opts.label), undefined, true)
+      const timer = setTimeout(() => finish(new ClaudeTextError('timeout', opts.label), undefined, true), timeoutMs)
+      proc.stdout.on('data', (chunk: Buffer) => {
+        stdout += chunk.toString()
+        if (stdout.length > MAX_OUTPUT_CHARS) finish(new ClaudeTextError('too_large', opts.label), undefined, true)
+      })
+      // Never read or log stderr: it can carry login or draft data.
+      proc.stderr.resume()
+      proc.on('error', () => finish(new ClaudeTextError('unavailable', opts.label), undefined, true))
+      proc.on('close', (code) => {
+        if (settled) return
+        if (code !== 0) return finish(new ClaudeTextError('failed', opts.label))
+        const output = stdout.trim()
+        if (!output) return finish(new ClaudeTextError('empty', opts.label))
+        finish(undefined, output)
+      })
+      proc.stdin.on('error', () => finish(new ClaudeTextError('input', opts.label), undefined, true))
+      opts.signal?.addEventListener('abort', abort, { once: true })
+      if (opts.signal?.aborted) return abort()
+      try { proc.stdin.end(prompt) } catch { finish(new ClaudeTextError('input', opts.label), undefined, true) }
+    })
+  } finally {
+    rmSync(scratch, { recursive: true, force: true })
+  }
+}

package/server/lib/dictation-fillers-fixture-cases.ts

@@ -0,0 +1,214 @@
+/**
+ * 6.92.0 (plan r3, A-W10): the canonical filler fixture's cases, one source of truth for the server's
+ * filler pass and COS Control's port. `want` is written by hand, so the generated fixture is checked
+ * against an expectation, never only against the function that produced it.
+ *
+ *   scope "both"    the token rules alone (stripDisfluencies). Control's port must match 100%. The
+ *                   "language" rows among them (short English replies) also hold through the
+ *                   server's language gate, and must through Control's.
+ *   scope "server"  the server's outbound filler step (stripFillersIfEnglish: the language gate,
+ *                   then the token rules). The gate is the server's own detector, so these rows are
+ *                   not a parity target; Control gates with its own detector.
+ *
+ * Synthetic, fictional text only. Regenerate the fixture with
+ *   npx tsx server/scripts/generate-dictation-fillers-fixture.ts
+ * and update the sha256 pinned in dictation-fillers-fixture.test.ts (and in COS Control's copy).
+ */
+import { stripDisfluencies, stripFillersIfEnglish } from './dictation-fillers.js'
+
+export type FillerFixtureScope = 'both' | 'server' | 'client'
+export interface FillerFixtureCase { id: string; scope: FillerFixtureScope; group: 'english' | 'exemption' | 'language'; input: string; want: string }
+export interface FillerFixtureRow { id: string; scope: FillerFixtureScope; group: FillerFixtureCase['group']; input: string; expected: string }
+
+/** The 6.79.1 filler-pass tables (dictation-fillers.test.ts), as [input, want]. */
+const ENGLISH: Array<[string, string]> = [
+  ['We need uh the deck by Friday', 'We need the deck by Friday'],
+  ['Send the um the update', 'Send the the update'],
+  ['ship it er tomorrow', 'ship it tomorrow'],
+  ['ship it erm tomorrow', 'ship it tomorrow'],
+  ['Book the room uhm at noon', 'Book the room at noon'],
+  ['So, um, we should ship', 'So, we should ship'],
+  ['The plan, uh, is solid', 'The plan, is solid'],
+  ['Um, I think we are ready', 'I think we are ready'],
+  ['Uh, can you check the build', 'Can you check the build'],
+  ['um, so we go', 'so we go'],
+  ['Okay. Um, let us start', 'Okay. Let us start'],
+  ['Done? Uh, maybe not', 'Done? Maybe not'],
+  ['Hmm. Let me think about it.', 'Let me think about it.'],
+  ['Okay. Um. Let us go', 'Okay. Let us go'],
+  ['Mhm, sure thing', 'Sure thing'],
+  ['I think, uh.', 'I think.'],
+  ['Is that right, hmm?', 'Is that right?'],
+  ['Let us ship it, um', 'Let us ship it'],
+  ['Let us ship it um.', 'Let us ship it.'],
+  ['Call (uh) Dana', 'Call () Dana'],
+  ['It was um... great', 'It was great'],
+  ['It was um… great', 'It was great'],
+  ['well — um — we could', 'well — we could'],
+  ['Um... I forgot', 'I forgot'],
+  ['um um the deck', 'the deck'],
+  ['Uh, um, so the plan', 'So the plan'],
+  ['Ummm, yes', 'Yes'],
+  ['the hmmm thing', 'the thing'],
+  ['it is ahh fine', 'it is fine'],
+  ['Ahh, I see', 'I see'],
+  ['Mm, that works', 'That works'],
+  ['that uhh works', 'that works'],
+  ['He said "um, no"', 'He said "no"'],
+  ['First line\num, second line', 'First line\nsecond line'],
+  ['First line\nUm, second line', 'First line\nSecond line'],
+  ['Ask, um, Ah Kow to join', 'Ask, Ah Kow to join'],
+  ['uh uh the deck', 'the deck'],
+  ['uh hmm let me think', 'let me think'],
+  ['Uh hmm, the plan', 'The plan'],
+  ['Hmm. Let me check ... and Ah Kim\'s notes', 'Let me check ... and Ah Kim\'s notes'],
+  ['at 5 p.m. uh we meet', 'at 5 p.m. we meet'],
+  ['e.g. um the deck', 'e.g. the deck'],
+  ['We met Mr. uh Jones', 'We met Mr. Jones'],
+  ['I spoke to the U.S. uh team', 'I spoke to the U.S. team'],
+  ['Smith Jr. um signed', 'Smith Jr. signed'],
+  ['I think, Um, we should', 'I think, we should'],
+  ['Wait... Uh, maybe', 'Wait... maybe'],
+  ['Wait. Uh, maybe', 'Wait. Maybe'],
+  ['um,, so we go', 'so we go'],
+  ['Bring an umbrella and keep going ahead', 'Bring an umbrella and keep going ahead'],
+  ['To err is human', 'To err is human'],
+  ['The hummingbird hummed', 'The hummingbird hummed'],
+  ['Erma and Ahmed will join', 'Erma and Ahmed will join'],
+  ['Check the umami and the uhaul', 'Check the umami and the uhaul'],
+  ['Uh-oh, the build broke', 'Uh-oh, the build broke'],
+  ['She said uh-huh and mm-hmm', 'She said uh-huh and mm-hmm'],
+  ['UM beat ER in the final, AH was close', 'UM beat ER in the final, AH was close'],
+  ['HMM is the model name', 'HMM is the model name'],
+  ['Use a 5 mm bolt and a 10mm spacer', 'Use a 5 mm bolt and a 10mm spacer'],
+  ['Ask Ah Kow to join the call', 'Ask Ah Kow to join the call'],
+  ['Loop in Er Lin and Hm Tran', 'Loop in Er Lin and Hm Tran'],
+  ['The note from Mm Patel is attached', 'The note from Mm Patel is attached'],
+  ['We met Mr. Ah and Ms. Er yesterday', 'We met Mr. Ah and Ms. Er yesterday'],
+  ['Dr. Er said the scan is clear', 'Dr. Er said the scan is clear'],
+  ['Dr. Er said', 'Dr. Er said'],
+  ['Dr. Er said yes', 'Dr. Er said yes'],
+  ['Ask Jr. Ah and Sr. Um', 'Ask Jr. Ah and Sr. Um'],
+  ['Ship it to the U.S. Um, team first', 'Ship it to the U.S. Um, team first'],
+  ['Dr. Er, the surgeon, called', 'Dr. Er, the surgeon, called'],
+  ['Meet with J. Ah tomorrow', 'Meet with J. Ah tomorrow'],
+  ['Ask Mrs. Um and Prof. Hm about it', 'Ask Mrs. Um and Prof. Hm about it'],
+  ['"um" is a filler word', '"um" is a filler word'],
+  ['Say “uh” less often', 'Say “uh” less often'],
+  ['He said uh huh and left', 'He said uh huh and left'],
+  ['uh oh, the build broke', 'uh oh, the build broke'],
+  ['She went mm hmm and nodded', 'She went mm hmm and nodded'],
+  ['Plain text with no hesitation.', 'Plain text with no hesitation.'],
+  [', and a leading comma stays when nothing was removed', ', and a leading comma stays when nothing was removed'],
+]
+
+/** 6.92.0 token exemptions and quote rules: scope "both". A filler that is part of a path, handle or code token is kept. */
+const EXEMPTION: Array<[string, string]> = [
+  ['open src/um.txt now', 'open src/um.txt now'],
+  ['cd ~/uh and list it', 'cd ~/uh and list it'],
+  ['ping @uh about the deck', 'ping @uh about the deck'],
+  ['the tag #um is trending', 'the tag #um is trending'],
+  ['echo $um in the shell', 'echo $um in the shell'],
+  ['set the my_um field', 'set the my_um field'],
+  ['rename it to .um before lunch', 'rename it to .um before lunch'],
+  ['connect to host:um today', 'connect to host:um today'],
+  ['run um.py again', 'run um.py again'],
+  ['open port um:8080 first', 'open port um:8080 first'],
+  ['the um/bin folder', 'the um/bin folder'],
+  ['mail um@example.com later', 'mail um@example.com later'],
+  ['the um_id column', 'the um_id column'],
+  ['issue um#12 is open', 'issue um#12 is open'],
+  ['the um$ variable', 'the um$ variable'],
+  ['pass the -um flag', 'pass the -um flag'],
+  // A sentence-final period or colon is not part of a token.
+  ['Let us ship it um.', 'Let us ship it.'],
+  ['The reason is um: we ran out', 'The reason is: we ran out'],
+  ['src/um.txt and um, the notes', 'src/um.txt and the notes'],
+  // Meaning, places and quotes.
+  ['Uh-oh, the build broke', 'Uh-oh, the build broke'],
+  ['We flew to Umbria in May', 'We flew to Umbria in May'],
+  ['uh huh, sounds good', 'uh huh, sounds good'],
+  ['she said "um" twice', 'she said "um" twice'],
+  ['He said "um, no"', 'He said "no"'],
+  ['Erm, the uhaul is here', 'The uhaul is here'],
+]
+
+/** 6.92.0 language gate: scope "server". Not English goes out as said; English still loses its fillers. */
+const LANGUAGE: Array<[string, string]> = [
+  ['Wir treffen uns um 5 Uhr', 'Wir treffen uns um 5 Uhr'],
+  ['um drei Uhr', 'um drei Uhr'],
+  ['Er kommt morgen.', 'Er kommt morgen.'],
+  ['Er ist heute nicht da', 'Er ist heute nicht da'],
+  ['Ich komme um 9 Uhr', 'Ich komme um 9 Uhr'],
+  ['Er hat um 8 Uhr angerufen', 'Er hat um 8 Uhr angerufen'],
+  ['Comprei um carro novo', 'Comprei um carro novo'],
+  ['um carro', 'um carro'],
+  ['Ela tem um gato', 'Ela tem um gato'],
+  ['Vamos sair um pouco', 'Vamos sair um pouco'],
+  ['Isso custa um real', 'Isso custa um real'],
+  ['Han er hjemme nu', 'Han er hjemme nu'],
+  ['Det er fint', 'Det er fint'],
+  ['Er is een probleem', 'Er is een probleem'],
+  ['Er komt morgen', 'Er komt morgen'],
+  ['ship it er tomorrow', 'ship it tomorrow'],
+  ['We need um the deck by Friday', 'We need the deck by Friday'],
+  ['Um, sure thing', 'Sure thing'],
+  ['er, the plan works', 'the plan works'],
+  ['Ask Marco um about the pricing', 'Ask Marco about the pricing'],
+  ['um the MIT report', 'the MIT report'],
+  ['Send the deck to Dana, um, por favor', 'Send the deck to Dana, por favor'],
+  // A time said in English ("pm") is English evidence.
+  ['um 5 pm works', '5 pm works'],
+  // 6.92.0 QA: short English replies and commands lose their filler, as in 6.91.1.
+  ['um okay', 'okay'],
+  ['um sure', 'sure'],
+  ['um yeah', 'yeah'],
+  ['um no', 'no'],
+  ['um call Dana', 'call Dana'],
+  ['um Tuesday', 'Tuesday'],
+  ['ok um send', 'ok send'],
+  ['Um, thanks', 'Thanks'],
+  // The known cost: an inline um with no English word beside it is kept.
+  ['um Dana', 'um Dana'],
+]
+
+/**
+ * 6.92.0 QA: short English replies, scope "both". COS Control's port must give the same answer
+ * through its own gate and token rules; the server's gate and token rules both give it (pinned).
+ */
+const SHORT_REPLIES: Array<[string, string]> = [
+  ['um yes', 'yes'],
+  ['Um yes.', 'Yes.'],
+  ['er no', 'no'],
+  ['um thanks Dana', 'thanks Dana'],
+  ['um sounds good', 'sounds good'],
+]
+
+const pad = (n: number) => String(n).padStart(3, '0')
+export const FILLER_FIXTURE_CASES: FillerFixtureCase[] = [
+  ...ENGLISH.map(([input, want], i) => ({ id: `en${pad(i + 1)}`, scope: 'both' as const, group: 'english' as const, input, want })),
+  ...EXEMPTION.map(([input, want], i) => ({ id: `ex${pad(i + 1)}`, scope: 'both' as const, group: 'exemption' as const, input, want })),
+  ...LANGUAGE.map(([input, want], i) => ({ id: `la${pad(i + 1)}`, scope: 'server' as const, group: 'language' as const, input, want })),
+  ...SHORT_REPLIES.map(([input, want], i) => ({ id: `sr${pad(i + 1)}`, scope: 'both' as const, group: 'language' as const, input, want })),
+]
+
+/** The server function a row's scope names. */
+export function fillerFixtureOutput(scope: FillerFixtureScope, input: string): string {
+  return scope === 'server' ? stripFillersIfEnglish(input) : stripDisfluencies(input)
+}
+
+/** The fixture file's exact text: generated by the server functions, never by hand. */
+export function renderFillerFixture(): string {
+  const rows: FillerFixtureRow[] = FILLER_FIXTURE_CASES.map(c => ({ id: c.id, scope: c.scope, group: c.group, input: c.input, expected: fillerFixtureOutput(c.scope, c.input) }))
+  return JSON.stringify({
+    schema: 1,
+    generator: 'server/scripts/generate-dictation-fillers-fixture.ts',
+    tokens: ['um+', 'uhm', 'uh+', 'er', 'erm', 'ah+', 'hm+', 'mm+', 'mhm'],
+    scopes: {
+      both: 'stripDisfluencies: the token rules alone; a port must match every row',
+      server: 'stripFillersIfEnglish: the server language gate, then the token rules',
+      client: 'reserved for client-only rows; the server generates none',
+    },
+    rows,
+  }, null, 2) + '\n'
+}