@gotcos/glasses-server 6.91.1 → 6.93.0

package/README.md

@@ -654,6 +654,64 @@ the warm-up and the final passes. `/api/health` is public, so this carries codes
 and counts only, never a speaker name, path or error text; those stay in
 `server.log`. A Nemotron fallback never degrades `readiness.status`.
 
+### Live Mac voices (6.92.1, 6.93.0)
+
+Live `Voice N` is **on by default** (6.93.0) and has one switch,
+`COS_MAC_LIVE_VOICES`: unset or `window` is the default, `anchors` is the older path and
+`off` (also `0`, `false`, `no`) gives every live chunk as one `Ext` speaker until it is
+saved, as in 6.92.0. A `Voice N` is anonymous: never a name, never enrolled and never
+trained on its own. Renaming one is text only unless you assign it to an existing voice
+profile (see below).
+
+- **`COS_MAC_LIVE_VOICES=anchors`** (6.92.1 path, opt-in): a chunk reads `Voice N` after two
+  independent clean observations agree. On natural audio this rarely fires.
+- **`COS_MAC_LIVE_VOICES=window`** or unset (6.93.0 path, the default, replaces the anchors): each chunk is
+  diarized inside the last five durable chunks (30 s) with the same pinned CLI, with a
+  timeout sized from the window. A carried voice is used only when the chunk diarized
+  alone agrees, which catches a merge of two voices speaking in the same chunk but not
+  yet a clean hand-over to a new voice at a chunk boundary. A timeout or refused window
+  falls back to the plain per-chunk run, and two of the last three window timeouts stop the window for
+  that capture. A voice silent for longer than the window comes back unidentified.
+- **`COS_MAC_VOICE_LABELS`** (on by default) governs the after-save pass; `0` also
+  turns both live modes off. Setting it to `1` is the default, not an opt-in.
+
+Known limit: a clean hand-over between two people exactly at a chunk boundary can give
+the new speaker the previous number. Set `COS_MAC_LIVE_VOICES=off` in
+`~/.cos-glasses/.env` and restart when nothing is recording to turn it off.
+
+**Assigning a Mac voice to a voice profile (6.93.0).** `POST /api/meeting/:sessionId/relabel`
+with `assignVoiceProfile: true` adds a Mac recording `Voice N`'s audio to an already
+enrolled person (never the wearer's own profile: `409 owner_profile`). A Mac recording banks
+no embeddings, so the server extracts them from the retained chunk audio (7 days), keeps only
+that voice, and applies the same coherence and diversity gates as a glasses rename. A dry run
+(`dryRun: true`) reports the person, the most samples it would add, how many units were
+embedded and thrown out as a different voice, and the similarity to the stored profile, and
+writes nothing. A confirm is refused with `409` when the voice sounds unlike the stored
+profile (`below_floor`, under 0.55), the label holds more than one voice (`mixed_voice`) or
+there is too little audio (`too_little_audio`), unless the request carries `force: true`; a
+confirm that would add nothing is refused whole (`422 nothing_to_enrol`). Samples are tagged
+`mac-assign:<sessionId>`: assisted, capped at 10 per profile, never evicting any other kind of
+sample, retracted by "Not in this meeting". It is refused (`409 capture_active`) while any
+meeting is being recorded, and it yields to the event loop while it reads audio. Without the
+flag a Mac rename is text only. `GET /api/health` reports `capabilities.macLiveVoices.mode`
+(`off`, `anchors` or `window`) and, for `window`, counts only.
+
+The saved meeting is relabeled by the whole-meeting pass. Live numbers are kept;
+voices the live path did not prove are numbered above them at save.
+
+### iPhone microphone meetings (6.93.0, off by default)
+
+With `COS_IPHONE_MICROPHONE_MEETINGS=1`, HQ set to Parakeet Ultra and Parakeet
+installed, `GET /api/health` reports `capabilities.phoneMicrophoneMeetings.enabled`,
+and COS Glasses 6.10.655 can record a meeting from the iPhone microphone without
+the glasses connected. Chunks upload through `POST /api/transcribe-stream` with
+`sourceType=iphone_microphone&speakerPolicy=anonymous`, transcribe with Parakeet
+Ultra and the profile dictionary (no Whisper or cloud fallback), and save like any
+meeting. Every line is `Ext`: no wearer label, no voice matching, no training.
+This is the microphone only, not iOS system audio, so it cannot record Zoom,
+YouTube or call audio playing on the phone. COS Control must be 0.5.351 or newer
+before this is switched on. Protocol: `docs/iphone-microphone-protocol.md`.
+
 ## Speech-to-text settings (6.72.0)
 
 One settings object chooses which engine previews live meeting speech, which
@@ -868,7 +926,7 @@ built-in polish rules, which keep precedence.
   answer says `learnedStyle: true` and `learnedStyleHash` (8 hex), never the
   rules.
 - **Meaning guard.** After the model, for messages and prompt drafts, and only
-  where v4 runs on Sonnet (Haiku, Luna, any other model and prompt v3 get no
+  on Sonnet with v4 (Haiku, Luna, any other model and prompt v3 get no
   guard, so their answers are 6.90.0's): if a negation, number, weekday or
   month, or name the speaker kept is missing from the answer (or a negation or
   number appears that was never said), the pre-polish text goes out with
@@ -889,6 +947,37 @@ built-in polish rules, which keep precedence.
   (`{protocol: 1, maxChars: 1500, maxRules: 20, enabled}`) and
   `capabilities.dictationCleanup.polishOptions` (`{protocol: 1}`).
 
+### Dictation reliability and prompt edit bounds (6.92.0)
+
+- **Breakers keyed by model and caller group.** Mac dictation, G2 messages and
+  prompt drafts share one group; G2 meeting lines have their own, so a failing
+  meeting can no longer turn off message polish. 2 CLI failures in a row open
+  a model's breaker for 30 minutes, as before. A client that stops waiting (the
+  request closes) is not a failure. `COS_DICTATION_SLOW_BREAKER_ABORTS` (4)
+  such aborts in a row, each after 4 s or more of model time, pause that model
+  for `COS_DICTATION_SLOW_BREAKER_MS` (300000). Either one open answers
+  `polishSkipped: "breaker_open"`, and the prewarm route asks the same keyed
+  breaker as its surface. An abort writes an audit row with `polish_outcome`
+  `aborted` (codes only); the finalize answer never says `aborted`.
+- **The filler pass** keeps a filler that is part of a path, handle or code
+  token (`src/um.txt`, `~/uh`, `@uh`, `um.py`, `um:8080`), and runs only when
+  the text is mostly English (`fillerTextLooksEnglish`; short replies such as
+  "um yes" count as English), so "um 5 Uhr", "um carro" and "Er kommt" go out
+  as said. The meaning guard keeps its 6.91.1 language check. The rules are pinned by `server/lib/__fixtures__/dictation-fillers.json`,
+  generated by the server's own functions; COS Control carries a byte-identical
+  copy and pins the same sha256.
+- **`GET /api/dictation/polish/options`** adds `meaningGuard` (the
+  `COS_DICTATION_MEANING_GUARD` switch) and `stylePairs` (the pairs the guard,
+  Your style and the register run on).
+- **G2 prompt edit** (`POST /api/prompt-edit`) runs through an isolated text
+  runner (no tools, MCP, hooks or session, a scratch directory) and now stops:
+  `COS_PROMPT_EDIT=0` answers `503 Edit is off`; `COS_PROMPT_EDIT_DAILY_CAP`
+  (default 200 a local day, its own counter) then `429 Edit limit reached`; 3
+  CLI failures in a row pause it 10 minutes (`503 Edit paused`). A failure is
+  `500 Edit failed`, never the CLI's output. Every refusal is `text/plain`.
+  `COS_PROMPT_EDIT_MODEL`, `_EFFORT` and `_TIMEOUT_MS` are unchanged
+  (sonnet, low, 45000).
+
 ### Parakeet (FluidAudio CoreML, offline)
 
 `POST /api/stt-settings/parakeet/install` installs FluidAudio's `fluidaudiocli`

package/docs/active-query-jobs.md

@@ -43,7 +43,7 @@ Values are illustrative.
       "model": "opus",
       "resolvedModel": "claude-opus-4-8",
       "messageNo": 1287,
-      "title": "What did Graham say about the October webinar numbers?"
+      "title": "What did Gordon say about the October webinar numbers?"
     },
     {
       "jobId": "9b2a7d40-1c3e-4f58-8e2d-6a0c4b9e7f21",

package/docs/test-plan-6.71.7.md

@@ -9,7 +9,7 @@ Candidate only. Server base is public 6.71.5; 6.71.6 is reserved by the separate
 - New broker tests compare 144 approval/unstamped admission and tick cases to the actual 6.71.5 implementation. Stamped questions cover connected/no-client, active/idle/unknown desk, 90-second visibility latch, timeout ceilings, canceled hooks, session boundaries/Interrupt, child events, background requests, parallel questions and first-answer races. A desk completion may add either string or array answers to its input without changing which question it settles.
 - Eleven isolated guard mutations are killed by their named assertions after a green baseline. Original source bytes are restored and the release checkout is never mutated.
 - Companion status probe measures 20 updates per Ask/Transcript case at 390x844, 320x568 and 390x420, with long content scrolled above the bottom. Composer position, reading height, scroll position and status height must stay within 0.5 px. The private old-CSS control must fail. Standard/full WebKit-strict tests, release typechecks, manufacturer contracts, startup timer quarantine and package asset hashes must pass on final bundles.
-- Receipts/logs: `/Users/ukaoma/cos-release-candidates/glasses-question-answering-2026-10-11/`. Local automated evidence does not prove stability inside the physical Even host.
+- Receipts/logs: the release owner's local `glasses-question-answering-2026-10-11` evidence directory (not bundled). Local automated evidence does not prove stability inside the physical Even host.
 
 ## Phone status canary (629 on the current server)
 

package/managed-runtime-contract.json

@@ -38,6 +38,8 @@
     "COS_LIVE_CUES_V2_MAC",
     "COS_TAILSCALE_NUDGE",
     "COS_MAC_VOICE_LABELS",
+    "COS_MAC_LIVE_VOICES",
+    "COS_IPHONE_MICROPHONE_MEETINGS",
     "COS_LIVE_CUES_JEV_DAILY_TOKENS",
     "COS_LIVE_CUES_SUBQ_DAILY_TOKENS",
     "COS_DECISION_PROVIDER_CUES",
@@ -90,7 +92,14 @@
     "COS_DICTATION_PROMPT_VERSION",
     "COS_DICTATION_LEARNED_STYLE",
     "COS_DICTATION_MEANING_GUARD",
-    "COS_DICTATION_REGISTERS"
+    "COS_DICTATION_REGISTERS",
+    "COS_DICTATION_SLOW_BREAKER_ABORTS",
+    "COS_DICTATION_SLOW_BREAKER_MS",
+    "COS_PROMPT_EDIT",
+    "COS_PROMPT_EDIT_DAILY_CAP",
+    "COS_PROMPT_EDIT_MODEL",
+    "COS_PROMPT_EDIT_EFFORT",
+    "COS_PROMPT_EDIT_TIMEOUT_MS"
   ],
   "maintenance": {
     "scope": "cross_boot",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.91.1",
+  "version": "6.93.0",
   "description": "COS Glasses: self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {
@@ -163,6 +163,7 @@
     "node": ">=20.11"
   },
   "dependencies": {
+    "body-parser": "^2.4.0",
     "cors": "^2.8.6",
     "express": "^5.2.1",
     "tsx": "^4.21.0"

package/server/lib/ask-session-id.ts

@@ -1,5 +1,6 @@
 // Which recordings may open live Ask, its history and Work evidence. 6.73.8: a Mac capture
 // (mac_<uuid>, lib/mac-recording.ts MAC_CAPTURE_ID) uses the same Ask as a G2 meeting; before this
 // every Mac request and saved-question read failed with invalid_session_id.
+// Future iPhone microphone captures share this store under their own phone_ IDs.
 export const MAC_ASK_SESSION = /^mac_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
-export const ASK_SESSION = /^(?:meeting_[A-Za-z0-9_-]{1,89}|mac_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/
+export const ASK_SESSION = /^(?:meeting_[A-Za-z0-9_-]{1,89}|(?:mac_|phone_(?:[0-9]{13}_)?)[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/

package/server/lib/claude-circuit.ts

@@ -15,16 +15,18 @@ export interface ClaudeBreaker {
 
 export function createBreaker(opts: {
   label: string
-  maxFailures?: number
-  cooldownMs?: number
+  /** 6.92.0: a function is read at each check, so an environment value applies after a restart. */
+  maxFailures?: number | (() => number)
+  cooldownMs?: number | (() => number)
 }): ClaudeBreaker {
-  const maxFailures = opts.maxFailures ?? 2
-  const cooldownMs = opts.cooldownMs ?? 30 * 60 * 1000 // 30 minutes
+  const read = (value: number | (() => number) | undefined, fallback: number) => typeof value === 'function' ? value() : value ?? fallback
   let consecutiveFailures = 0
   let openedAt = 0
 
   return {
     isOpen(): boolean {
+      const maxFailures = read(opts.maxFailures, 2)
+      const cooldownMs = read(opts.cooldownMs, 30 * 60 * 1000) // 30 minutes
       if (consecutiveFailures < maxFailures) return false
       const elapsed = Date.now() - openedAt
       if (elapsed >= cooldownMs) {
@@ -35,6 +37,8 @@ export function createBreaker(opts: {
       return true
     },
     recordFailure(): void {
+      const maxFailures = read(opts.maxFailures, 2)
+      const cooldownMs = read(opts.cooldownMs, 30 * 60 * 1000)
       consecutiveFailures++
       if (consecutiveFailures >= maxFailures) {
         openedAt = Date.now()

package/server/lib/claude-text-runner.ts

@@ -0,0 +1,113 @@
+/**
+ * 6.92.0 (plan r3, A-W0b): a small isolated `claude -p` text runner, for callers that only turn text
+ * into text (G2's prompt edit today). It replaces spawnClaudeText for those callers; spawnClaudeText
+ * stays in prompt-edit.ts for meeting summaries.
+ *
+ * Isolation, the dictation polish caller's (dictation-clean.ts claudePolishArgs) minus its env strip:
+ * - no tools (`--tools ''`), so the key-secrets deny layer has nothing to guard (key-lanes census:
+ *   TOOL_LESS_CLAUDE); no MCP servers (`--strict-mcp-config` with an empty config); no hooks, in
+ *   exactly ONE `--settings` layer; `--permission-mode dontAsk`; no session file;
+ * - `--model` is always passed, so it can never silently become Opus;
+ * - a fresh scratch working directory, never the server's own;
+ * - a verified absolute binary (provider-binary.ts), never a bare PATH lookup.
+ * The environment is kept as spawnClaudeText kept it (only CLAUDECODE is removed and PATH repaired),
+ * so a person who signs the Claude CLI in with an API key keeps working.
+ *
+ * Errors carry a code and never the CLI's stdout or stderr: those can hold the draft or login data.
+ */
+import { spawn } from 'node:child_process'
+import { mkdirSync, mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { resolveProviderBinary } from './provider-binary.js'
+import { terminateProviderProcess } from './provider-process-lifecycle.js'
+
+export type ClaudeTextErrorCode = 'unavailable' | 'aborted' | 'timeout' | 'failed' | 'empty' | 'too_large' | 'input'
+
+export class ClaudeTextError extends Error {
+  constructor(readonly code: ClaudeTextErrorCode, label: string) {
+    super(`${label} ${code}`)
+  }
+}
+
+export interface ClaudeTextRunOptions {
+  model: string
+  effort: string
+  timeoutMs: number
+  systemPrompt: string
+  /** Prefix for the error message ("Prompt edit"). */
+  label: string
+  signal?: AbortSignal
+}
+
+/** The argv: one `--settings`, no tools, no MCP, no hooks, no session. */
+export function claudeTextArgs(model: string, effort: string, systemPrompt: string): string[] {
+  return [
+    '-p', '--model', model, '--effort', effort, '--output-format', 'text',
+    '--no-session-persistence', '--strict-mcp-config', '--mcp-config', '{"mcpServers":{}}',
+    '--tools', '', '--settings', '{"disableAllHooks":true}', '--permission-mode', 'dontAsk',
+    '--system-prompt', systemPrompt,
+  ]
+}
+
+/** spawnClaudeText's environment: everything but CLAUDECODE (anti-recursion), with the binary's dir on PATH. */
+export function claudeTextEnv(binary: string, env: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
+  const out = { ...env }
+  delete out.CLAUDECODE
+  out.PATH = [dirname(binary), '/opt/homebrew/bin', out.PATH || ''].join(':')
+  out.NO_OPEN_BROWSER = '1'
+  return out
+}
+
+const MAX_OUTPUT_CHARS = 256_000
+
+/** Run the prompt on stdin; resolve the trimmed text answer, or reject with a ClaudeTextError. */
+export async function runClaudeText(prompt: string, opts: ClaudeTextRunOptions): Promise<string> {
+  if (opts.signal?.aborted) throw new ClaudeTextError('aborted', opts.label)
+  const binary = resolveProviderBinary('claude')
+  if (!binary.ok) throw new ClaudeTextError('unavailable', opts.label)
+  const timeoutMs = Number.isFinite(opts.timeoutMs) && opts.timeoutMs > 0 ? opts.timeoutMs : 45_000
+  const scratch = mkdtempSync(join(tmpdir(), 'cos-claude-text-'))
+  try {
+    const workspace = join(scratch, 'workspace')
+    mkdirSync(workspace, { mode: 0o700 })
+    return await new Promise<string>((resolve, reject) => {
+      const proc = spawn(binary.path, claudeTextArgs(opts.model, opts.effort, opts.systemPrompt), {
+        stdio: ['pipe', 'pipe', 'pipe'], env: claudeTextEnv(binary.path), cwd: workspace, detached: true,
+      })
+      let stdout = ''
+      let settled = false
+      const finish = (error?: ClaudeTextError, output?: string, terminate = false) => {
+        if (settled) return
+        settled = true
+        clearTimeout(timer)
+        opts.signal?.removeEventListener('abort', abort)
+        const complete = () => error ? reject(error) : resolve(output!)
+        if (terminate) void terminateProviderProcess(proc).then(complete, complete)
+        else complete()
+      }
+      const abort = () => finish(new ClaudeTextError('aborted', opts.label), undefined, true)
+      const timer = setTimeout(() => finish(new ClaudeTextError('timeout', opts.label), undefined, true), timeoutMs)
+      proc.stdout.on('data', (chunk: Buffer) => {
+        stdout += chunk.toString()
+        if (stdout.length > MAX_OUTPUT_CHARS) finish(new ClaudeTextError('too_large', opts.label), undefined, true)
+      })
+      // Never read or log stderr: it can carry login or draft data.
+      proc.stderr.resume()
+      proc.on('error', () => finish(new ClaudeTextError('unavailable', opts.label), undefined, true))
+      proc.on('close', (code) => {
+        if (settled) return
+        if (code !== 0) return finish(new ClaudeTextError('failed', opts.label))
+        const output = stdout.trim()
+        if (!output) return finish(new ClaudeTextError('empty', opts.label))
+        finish(undefined, output)
+      })
+      proc.stdin.on('error', () => finish(new ClaudeTextError('input', opts.label), undefined, true))
+      opts.signal?.addEventListener('abort', abort, { once: true })
+      if (opts.signal?.aborted) return abort()
+      try { proc.stdin.end(prompt) } catch { finish(new ClaudeTextError('input', opts.label), undefined, true) }
+    })
+  } finally {
+    rmSync(scratch, { recursive: true, force: true })
+  }
+}

package/server/lib/dictation-fillers-fixture-cases.ts

@@ -0,0 +1,214 @@
+/**
+ * 6.92.0 (plan r3, A-W10): the canonical filler fixture's cases, one source of truth for the server's
+ * filler pass and COS Control's port. `want` is written by hand, so the generated fixture is checked
+ * against an expectation, never only against the function that produced it.
+ *
+ *   scope "both"    the token rules alone (stripDisfluencies). Control's port must match 100%. The
+ *                   "language" rows among them (short English replies) also hold through the
+ *                   server's language gate, and must through Control's.
+ *   scope "server"  the server's outbound filler step (stripFillersIfEnglish: the language gate,
+ *                   then the token rules). The gate is the server's own detector, so these rows are
+ *                   not a parity target; Control gates with its own detector.
+ *
+ * Synthetic, fictional text only. Regenerate the fixture with
+ *   npx tsx server/scripts/generate-dictation-fillers-fixture.ts
+ * and update the sha256 pinned in dictation-fillers-fixture.test.ts (and in COS Control's copy).
+ */
+import { stripDisfluencies, stripFillersIfEnglish } from './dictation-fillers.js'
+
+export type FillerFixtureScope = 'both' | 'server' | 'client'
+export interface FillerFixtureCase { id: string; scope: FillerFixtureScope; group: 'english' | 'exemption' | 'language'; input: string; want: string }
+export interface FillerFixtureRow { id: string; scope: FillerFixtureScope; group: FillerFixtureCase['group']; input: string; expected: string }
+
+/** The 6.79.1 filler-pass tables (dictation-fillers.test.ts), as [input, want]. */
+const ENGLISH: Array<[string, string]> = [
+  ['We need uh the deck by Friday', 'We need the deck by Friday'],
+  ['Send the um the update', 'Send the the update'],
+  ['ship it er tomorrow', 'ship it tomorrow'],
+  ['ship it erm tomorrow', 'ship it tomorrow'],
+  ['Book the room uhm at noon', 'Book the room at noon'],
+  ['So, um, we should ship', 'So, we should ship'],
+  ['The plan, uh, is solid', 'The plan, is solid'],
+  ['Um, I think we are ready', 'I think we are ready'],
+  ['Uh, can you check the build', 'Can you check the build'],
+  ['um, so we go', 'so we go'],
+  ['Okay. Um, let us start', 'Okay. Let us start'],
+  ['Done? Uh, maybe not', 'Done? Maybe not'],
+  ['Hmm. Let me think about it.', 'Let me think about it.'],
+  ['Okay. Um. Let us go', 'Okay. Let us go'],
+  ['Mhm, sure thing', 'Sure thing'],
+  ['I think, uh.', 'I think.'],
+  ['Is that right, hmm?', 'Is that right?'],
+  ['Let us ship it, um', 'Let us ship it'],
+  ['Let us ship it um.', 'Let us ship it.'],
+  ['Call (uh) Dana', 'Call () Dana'],
+  ['It was um... great', 'It was great'],
+  ['It was um… great', 'It was great'],
+  ['well — um — we could', 'well — we could'],
+  ['Um... I forgot', 'I forgot'],
+  ['um um the deck', 'the deck'],
+  ['Uh, um, so the plan', 'So the plan'],
+  ['Ummm, yes', 'Yes'],
+  ['the hmmm thing', 'the thing'],
+  ['it is ahh fine', 'it is fine'],
+  ['Ahh, I see', 'I see'],
+  ['Mm, that works', 'That works'],
+  ['that uhh works', 'that works'],
+  ['He said "um, no"', 'He said "no"'],
+  ['First line\num, second line', 'First line\nsecond line'],
+  ['First line\nUm, second line', 'First line\nSecond line'],
+  ['Ask, um, Ah Kow to join', 'Ask, Ah Kow to join'],
+  ['uh uh the deck', 'the deck'],
+  ['uh hmm let me think', 'let me think'],
+  ['Uh hmm, the plan', 'The plan'],
+  ['Hmm. Let me check ... and Ah Kim\'s notes', 'Let me check ... and Ah Kim\'s notes'],
+  ['at 5 p.m. uh we meet', 'at 5 p.m. we meet'],
+  ['e.g. um the deck', 'e.g. the deck'],
+  ['We met Mr. uh Jones', 'We met Mr. Jones'],
+  ['I spoke to the U.S. uh team', 'I spoke to the U.S. team'],
+  ['Smith Jr. um signed', 'Smith Jr. signed'],
+  ['I think, Um, we should', 'I think, we should'],
+  ['Wait... Uh, maybe', 'Wait... maybe'],
+  ['Wait. Uh, maybe', 'Wait. Maybe'],
+  ['um,, so we go', 'so we go'],
+  ['Bring an umbrella and keep going ahead', 'Bring an umbrella and keep going ahead'],
+  ['To err is human', 'To err is human'],
+  ['The hummingbird hummed', 'The hummingbird hummed'],
+  ['Erma and Ahmed will join', 'Erma and Ahmed will join'],
+  ['Check the umami and the uhaul', 'Check the umami and the uhaul'],
+  ['Uh-oh, the build broke', 'Uh-oh, the build broke'],
+  ['She said uh-huh and mm-hmm', 'She said uh-huh and mm-hmm'],
+  ['UM beat ER in the final, AH was close', 'UM beat ER in the final, AH was close'],
+  ['HMM is the model name', 'HMM is the model name'],
+  ['Use a 5 mm bolt and a 10mm spacer', 'Use a 5 mm bolt and a 10mm spacer'],
+  ['Ask Ah Kow to join the call', 'Ask Ah Kow to join the call'],
+  ['Loop in Er Lin and Hm Tran', 'Loop in Er Lin and Hm Tran'],
+  ['The note from Mm Patel is attached', 'The note from Mm Patel is attached'],
+  ['We met Mr. Ah and Ms. Er yesterday', 'We met Mr. Ah and Ms. Er yesterday'],
+  ['Dr. Er said the scan is clear', 'Dr. Er said the scan is clear'],
+  ['Dr. Er said', 'Dr. Er said'],
+  ['Dr. Er said yes', 'Dr. Er said yes'],
+  ['Ask Jr. Ah and Sr. Um', 'Ask Jr. Ah and Sr. Um'],
+  ['Ship it to the U.S. Um, team first', 'Ship it to the U.S. Um, team first'],
+  ['Dr. Er, the surgeon, called', 'Dr. Er, the surgeon, called'],
+  ['Meet with J. Ah tomorrow', 'Meet with J. Ah tomorrow'],
+  ['Ask Mrs. Um and Prof. Hm about it', 'Ask Mrs. Um and Prof. Hm about it'],
+  ['"um" is a filler word', '"um" is a filler word'],
+  ['Say “uh” less often', 'Say “uh” less often'],
+  ['He said uh huh and left', 'He said uh huh and left'],
+  ['uh oh, the build broke', 'uh oh, the build broke'],
+  ['She went mm hmm and nodded', 'She went mm hmm and nodded'],
+  ['Plain text with no hesitation.', 'Plain text with no hesitation.'],
+  [', and a leading comma stays when nothing was removed', ', and a leading comma stays when nothing was removed'],
+]
+
+/** 6.92.0 token exemptions and quote rules: scope "both". A filler that is part of a path, handle or code token is kept. */
+const EXEMPTION: Array<[string, string]> = [
+  ['open src/um.txt now', 'open src/um.txt now'],
+  ['cd ~/uh and list it', 'cd ~/uh and list it'],
+  ['ping @uh about the deck', 'ping @uh about the deck'],
+  ['the tag #um is trending', 'the tag #um is trending'],
+  ['echo $um in the shell', 'echo $um in the shell'],
+  ['set the my_um field', 'set the my_um field'],
+  ['rename it to .um before lunch', 'rename it to .um before lunch'],
+  ['connect to host:um today', 'connect to host:um today'],
+  ['run um.py again', 'run um.py again'],
+  ['open port um:8080 first', 'open port um:8080 first'],
+  ['the um/bin folder', 'the um/bin folder'],
+  ['mail um@example.com later', 'mail um@example.com later'],
+  ['the um_id column', 'the um_id column'],
+  ['issue um#12 is open', 'issue um#12 is open'],
+  ['the um$ variable', 'the um$ variable'],
+  ['pass the -um flag', 'pass the -um flag'],
+  // A sentence-final period or colon is not part of a token.
+  ['Let us ship it um.', 'Let us ship it.'],
+  ['The reason is um: we ran out', 'The reason is: we ran out'],
+  ['src/um.txt and um, the notes', 'src/um.txt and the notes'],
+  // Meaning, places and quotes.
+  ['Uh-oh, the build broke', 'Uh-oh, the build broke'],
+  ['We flew to Umbria in May', 'We flew to Umbria in May'],
+  ['uh huh, sounds good', 'uh huh, sounds good'],
+  ['she said "um" twice', 'she said "um" twice'],
+  ['He said "um, no"', 'He said "no"'],
+  ['Erm, the uhaul is here', 'The uhaul is here'],
+]
+
+/** 6.92.0 language gate: scope "server". Not English goes out as said; English still loses its fillers. */
+const LANGUAGE: Array<[string, string]> = [
+  ['Wir treffen uns um 5 Uhr', 'Wir treffen uns um 5 Uhr'],
+  ['um drei Uhr', 'um drei Uhr'],
+  ['Er kommt morgen.', 'Er kommt morgen.'],
+  ['Er ist heute nicht da', 'Er ist heute nicht da'],
+  ['Ich komme um 9 Uhr', 'Ich komme um 9 Uhr'],
+  ['Er hat um 8 Uhr angerufen', 'Er hat um 8 Uhr angerufen'],
+  ['Comprei um carro novo', 'Comprei um carro novo'],
+  ['um carro', 'um carro'],
+  ['Ela tem um gato', 'Ela tem um gato'],
+  ['Vamos sair um pouco', 'Vamos sair um pouco'],
+  ['Isso custa um real', 'Isso custa um real'],
+  ['Han er hjemme nu', 'Han er hjemme nu'],
+  ['Det er fint', 'Det er fint'],
+  ['Er is een probleem', 'Er is een probleem'],
+  ['Er komt morgen', 'Er komt morgen'],
+  ['ship it er tomorrow', 'ship it tomorrow'],
+  ['We need um the deck by Friday', 'We need the deck by Friday'],
+  ['Um, sure thing', 'Sure thing'],
+  ['er, the plan works', 'the plan works'],
+  ['Ask Marco um about the pricing', 'Ask Marco about the pricing'],
+  ['um the MIT report', 'the MIT report'],
+  ['Send the deck to Dana, um, por favor', 'Send the deck to Dana, por favor'],
+  // A time said in English ("pm") is English evidence.
+  ['um 5 pm works', '5 pm works'],
+  // 6.92.0 QA: short English replies and commands lose their filler, as in 6.91.1.
+  ['um okay', 'okay'],
+  ['um sure', 'sure'],
+  ['um yeah', 'yeah'],
+  ['um no', 'no'],
+  ['um call Dana', 'call Dana'],
+  ['um Tuesday', 'Tuesday'],
+  ['ok um send', 'ok send'],
+  ['Um, thanks', 'Thanks'],
+  // The known cost: an inline um with no English word beside it is kept.
+  ['um Dana', 'um Dana'],
+]
+
+/**
+ * 6.92.0 QA: short English replies, scope "both". COS Control's port must give the same answer
+ * through its own gate and token rules; the server's gate and token rules both give it (pinned).
+ */
+const SHORT_REPLIES: Array<[string, string]> = [
+  ['um yes', 'yes'],
+  ['Um yes.', 'Yes.'],
+  ['er no', 'no'],
+  ['um thanks Dana', 'thanks Dana'],
+  ['um sounds good', 'sounds good'],
+]
+
+const pad = (n: number) => String(n).padStart(3, '0')
+export const FILLER_FIXTURE_CASES: FillerFixtureCase[] = [
+  ...ENGLISH.map(([input, want], i) => ({ id: `en${pad(i + 1)}`, scope: 'both' as const, group: 'english' as const, input, want })),
+  ...EXEMPTION.map(([input, want], i) => ({ id: `ex${pad(i + 1)}`, scope: 'both' as const, group: 'exemption' as const, input, want })),
+  ...LANGUAGE.map(([input, want], i) => ({ id: `la${pad(i + 1)}`, scope: 'server' as const, group: 'language' as const, input, want })),
+  ...SHORT_REPLIES.map(([input, want], i) => ({ id: `sr${pad(i + 1)}`, scope: 'both' as const, group: 'language' as const, input, want })),
+]
+
+/** The server function a row's scope names. */
+export function fillerFixtureOutput(scope: FillerFixtureScope, input: string): string {
+  return scope === 'server' ? stripFillersIfEnglish(input) : stripDisfluencies(input)
+}
+
+/** The fixture file's exact text: generated by the server functions, never by hand. */
+export function renderFillerFixture(): string {
+  const rows: FillerFixtureRow[] = FILLER_FIXTURE_CASES.map(c => ({ id: c.id, scope: c.scope, group: c.group, input: c.input, expected: fillerFixtureOutput(c.scope, c.input) }))
+  return JSON.stringify({
+    schema: 1,
+    generator: 'server/scripts/generate-dictation-fillers-fixture.ts',
+    tokens: ['um+', 'uhm', 'uh+', 'er', 'erm', 'ah+', 'hm+', 'mm+', 'mhm'],
+    scopes: {
+      both: 'stripDisfluencies: the token rules alone; a port must match every row',
+      server: 'stripFillersIfEnglish: the server language gate, then the token rules',
+      client: 'reserved for client-only rows; the server generates none',
+    },
+    rows,
+  }, null, 2) + '\n'
+}

package/server/lib/dictation-fillers.ts

@@ -20,9 +20,22 @@
  *   still loses "uh"), and any quoted mention ('"um"').
  * - "uh huh", "uh oh" and "mm hmm" written without a hyphen: answers, not hesitations.
  * - "like", "you know", "I mean": filler only sometimes, so the model decides, not a regex.
+ * - 6.92.0: a token that touches a path, handle or code character is part of that token, not a
+ *   hesitation: "src/um.txt", "~/uh", "@uh", "#um", "$um", "my_um", "um.py", "um:8080", "um/bin".
+ *   Kept when the character right before it is one of / . @ _ : # $ (a leading - is already
+ *   outside the token pattern), or the character right after it is one of / @ _ # $, or a . or :
+ *   followed by a letter or digit. A sentence-final "um." or "um:" (a space or the end after it)
+ *   still goes.
  * A filler inside a longer quote ("um, no") is removed like any other.
  * If nothing but fillers was said, the original text is returned unchanged.
+ *
+ * 6.92.0: the language gate lives in the caller, not here (`stripFillersIfEnglish`): "um" and "er"
+ * are words in German, Portuguese, Danish, Norwegian and Dutch ("um 5 Uhr", "um carro", "Er kommt
+ * morgen"). This function stays the pure token rules that the canonical fixture
+ * (__fixtures__/dictation-fillers.json, scope "both") pins for COS Control's port.
  */
+import { fillerTextLooksEnglish } from './dictation-meaning-guard.js'
+
 
 const FILLER = /(?<![\p{L}\p{N}'’-])(um+|uhm|uh+|erm?|ah+|hm+|mm+|mhm)(?![\p{L}\p{N}'’-])/giu
 /** After a filler: a pause mark (comma, ellipsis, dash) with its spacing. */
@@ -38,6 +51,10 @@ const QUOTE_OPEN = /["“”'‘’]$/
 const QUOTE_CLOSE = /^["“”'‘’]/
 /** A pause mark right after the token: a Titlecase filler set off this way is a hesitation. */
 const PAUSE_AFTER = /^[ \t]*(?:,|\.{2,}|…)/
+/** 6.92.0: a path, handle or code character right before the token ("~/uh", "@uh", "#um", ".um"). */
+const TOUCH_BEFORE = /[/.@_:#$]$/
+/** 6.92.0: right after it: / @ _ # $ ("um/bin", "um_id"), or . or : with a letter or digit next ("um.py", "um:8080"). */
+const TOUCH_AFTER = /^(?:[/@_#$]|[.:][\p{L}\p{N}])/u
 
 function afterAbbreviation(before: string): boolean {
   const trimmed = before.replace(/[ \t]+$/, '')
@@ -73,6 +90,9 @@ export function stripDisfluencies(text: string): string {
     const atStart = sentenceStart(out + before)
     const keep = (token.length > 1 && token === token.toUpperCase())
       || (/^mm+$/i.test(token) && /\d[ \t]*$/.test(out + before))
+      // 6.92.0: part of a path, handle or code token, never a hesitation.
+      || TOUCH_BEFORE.test(out + before)
+      || TOUCH_AFTER.test(after)
       // A capital away from a sentence start is a name ("Ask Ah Kow"), unless a pause mark
       // sets it off as a hesitation ("I think, Um, we should").
       || (!atStart && /^[A-Z]/.test(token) && !PAUSE_AFTER.test(after))
@@ -114,3 +134,13 @@ export function stripDisfluencies(text: string): string {
   const result = (out + rest).replace(/^[ \t]*[,;][ \t]*/, '')
   return result.trim() === '' ? text : result
 }
+
+/**
+ * 6.92.0: the server's outbound filler step. The token rules (stripDisfluencies) run only when the
+ * text is mostly English (dictation-meaning-guard.ts fillerTextLooksEnglish), so "Wir treffen uns um 5 Uhr",
+ * "Comprei um carro" and "Er kommt morgen." go out as said. COS Control gates its own port with
+ * its own language detector; that is why the fixture tags these rows scope "server".
+ */
+export function stripFillersIfEnglish(text: string): string {
+  return fillerTextLooksEnglish(text) ? stripDisfluencies(text) : text
+}