@gotcos/glasses-server 6.95.0 → 6.98.0

package/CHANGELOG.md

@@ -1,3 +1,136 @@
+## 6.98.0 - Live cues with five kinds, phone tuning, and a meeting assistant that reads links (public)
+
+2026-11-03. The public release of the private 6.95.0 to 6.97.9 line, merged with everything 6.94.4 published. Pairs with COS Glasses 6.11.669 and works with COS Control 0.5.363.
+
+- Live cues stay off until a person turns them on. Once on: G2 meetings armed by the phone get all five kinds (reinforce, challenge, decision, promise, follow-up), cues are paced across the meeting instead of spending the cap early, a cue that repeats a recent opening line is held back, and names come from the meeting's own speakers.
+- For anyone who already has live cues on, pacing, the repeat hold, meeting speaker names sent to the cue writer, and grouped open items on Mac meetings start on install. Each has an env switch to turn it off.
+- Cue tuning from the phone and from COS Control uses `GET/POST /api/live-cues/v2/settings?v=3`.
+- The meeting assistant reads a public link typed in a question, runs up to three searches for a comparison or fact check and leads with a verdict, and treats "private" as a privacy word only when it means privacy. Web searches go out only with Public topics on, using only the words the user typed. A link the user types into a question is read even with Public topics off, unless the question says not to use the web. Pasted text over 400 characters and pages read from typed links are kept as meeting files for live cues.
+- Dropped `.xlsx` files give their text to the meeting assistant.
+- A daily web lookup count (`webToday`) on the cue settings and meeting assistant config.
+- Saved Mac calls no longer fail on one silent window, and a meeting that has stopped retrying no longer locks Restart and Update.
+- The token ledger records provider-reported usage where the provider gives it.
+- Opt-in only, unchanged by default: speaker merge shadow, general cues, grounded cues, the Tableau data arm (needs a local `data-facts.json`).
+
+## 6.97.9 - G2 meetings with all five cue kinds stay focused (private candidate)
+
+2026-11-02. Built on 6.97.8. Pairs with the phone build that arms G2 meetings with all five kinds. Private; npm latest stays 6.94.4.
+
+- A `meeting_` session armed with `kinds: 'extended'` gets the five cue kinds and writer v4, and nothing else of the Mac's: it is never offered to the general (web) cue runner and never gets an insight, cue mode `general` never switches its focused cues off, and the open-items fold never holds its cues (they show as written). Those three, and the insight emit path, now key on the session being a Mac recording (`mac_` id), not on the kind set.
+
+## 6.97.8 - Live cues: Tableau facts, shared links and pacing (private candidate)
+
+2026-11-02. Built on 6.97.7, which it carries. Pairs with COS Control 0.5.365. Private, for one Mac; npm latest stays 6.94.4.
+
+- Grounded cues gain a data arm: a local `data-facts.json` (written by COS from the Tableau report, contract v1) offers one candidate when the recent speech names a Quilt industry, brand or SBU/XBU and a funnel word or figure. The cue states the period, marketing-sourced scope and refresh time, and never presents it as revenue, MRR or locations. Quilt meetings only: a meeting with no confirmed domain needs a brand or SBU/XBU named, a Quilt-domain memory in the same evaluation, or a Quilt term in the calendar title; another confirmed domain or an unreadable context is off. Off when the file is missing, invalid or ahead of the clock; an open month expires 120 hours after its refresh, a closed month after 35 days. Sent as a `file` source with no locator, so older clients render it. Trace: `arms.data`, `dataArm`, `dataSignal`, `dataAgeH`; the cue log marks it `dataNote`.
+- The meeting assistant reads the same facts for funnel, budget, pacing or "check Tableau" questions, from the user's own typed words only. No network.
+- A public link typed in a meeting question is read as a page even without "search" wording (up to two; credentials, keys, private, NAT64, IPv4-compatible, site-local, multicast, 6to4 and Teredo addresses refused). Pasted text over 400 characters and pages read from typed links are kept as meeting files for live cues, after the user's own files, with unsafe links cut, and never used as transcript-cleanup vocabulary.
+- "Private" counts as a privacy word only when it means privacy (private notes, data, conversation, pricing, "keep this private", "in private"); private aviation, jets, equity or schools are public subjects again in the web gate, the public topic path, fact checks and general cues.
+- Public comparison and fact-check questions get up to three parallel searches on the user's own words (plus "average" or "comparison") and four page reads, a 55 s deadline (others keep 30 s) with the second plan hop, public topic call and claim planner skipped, and an answer that leads with a verdict naming who was right, then cited figures and one caveat. When no page could be read, one line starting "Not checked against a source:" gives the general-knowledge answer (never after a privacy withhold).
+- `.xlsx` text extraction on the media route: linear scanners, bounded by 2 s of scanning, 48 MB inflated, 12 sheets and 200 rows per sheet; no formulas.
+- New daily web lookup ledger, `webToday` on `GET /live-cues/v2/settings?v=3` and `GET /meeting-ask/config`: searches, pages read and pages failed for cues, the assistant and fact checks, and lookups held back after the trigger, by reason. `general.today` keeps its meaning.
+- Cue pacing: the per-meeting cap opens with half the cap, then refills across the meeting (calendar length when known, else 60 minutes; 5 minutes per cue at cap 25). Caps of 4 or less are not paced; a raised cap takes effect at once (`COS_LIVE_CUES_V2_PACING=0` turns it off).
+- On Mac recordings, "no owner or date" cues the writer marks `open` fold into one cue per 10 minutes headed by the first item; an item left alone 20 minutes is shown on its own when the meeting continues, unless the room talked about it since; every held cue is kept in the cue log marked `held` and left out of cue history, counts and ratings. G2 cues are shown as written (`COS_LIVE_CUES_V2_OPEN_ITEMS=0`).
+- A cue whose opening line repeats one of the last six is withheld (`COS_LIVE_CUES_V2_LEAD_REPEAT=0`). The writer gets the meeting's known names for spelling: this meeting's speakers, the owner and name-like vocabulary; enrolled voice names are never sent (`COS_LIVE_CUES_V2_KNOWN_NAMES=0`).
+
+## 6.97.7 - Live cues: grounded cues, cue modes and general cues (private candidate)
+
+2026-11-01. Built on 6.97.6 (SubQ session find), which it carries. Pairs with COS Control 0.5.364. Everything new is off by default: until the owner changes the cue mode or turns grounded cues on, this server answers, asks and writes exactly as 6.97.6 does.
+
+- `GET /api/live-cues/v2/settings?v=3` and `POST {v: 3, ...}` add the cue mode (`focused`, `general`, `all`; default focused), grounded cues (`classic`, `grounded`; default classic) and six general-cue limits to the v2 body. `?v=2`, `{v: 2}` and the unversioned calls answer byte for byte as before; an older server answers `?v=3` with 400 `unsupported_version`, which is Control's signal to hide the new controls. The values live in `live-cues-v2-settings.json` (schema 3). `COS_LIVE_CUES_MODE=focused` and `COS_LIVE_CUES_GROUNDING=classic` can only force the safe value; any other value defers to the setting.
+- Grounded cues: cue_memory.py and the owner's notes run together, the files attached to the meeting add their best matching passage, copies of this conversation and personal notes in a work meeting are dropped, one meeting is one candidate, and one judge request asks yes or no per candidate (`COS_LIVE_CUES_V2_JUDGE_YES`, default 0.65, the best two by yes are kept). The writer is told the confirmed calendar title. The trace gets the judge's probabilities, the kept ids (`keptIds`; `kept` stays a count), arm timings, an excluded count and a count of notes that named no domain, never text. A copy of this conversation is recognised against everything said since the meeting was armed (up to 50,000 6-word sequences), not only the last 400 words. With classic nothing in an evaluation changes.
+- A cue source may carry its kind (`meeting`, `memory`, `file`, `web`) and one locator (`recordId`, `memoryId`, `fileId`, `url`, https only). The cue log accepts them, the kind `insight`, and the optional `arms` and `general` fields; `memorySource` keeps its three values. `shared/live-cues-v2.ts` changed, so the companion's byte-identical copy is stale until a companion release takes it; the companion is never sent an insight or a source it cannot read.
+- General cues (cue mode `general` or `all`, Mac meetings only; G2 meetings keep focused cues and never get an insight; `general` turns focused cues off for Mac meetings). They need Ask's Public topics on. A server-wide runner, separate from focused cues, ticks each Mac meeting every `intervalSeconds` (default 300) once enough new speech arrived. Order: the meeting must not be confirmed personal, an orientation that cannot be read withholds, the window must not be about health, family, money, legal or school matters, and voice names must be readable; then one Jev or SubQ yes/no on whether the room is on a public topic (`trigger`, default 0.6), then a pinned Haiku call picks one short topic, then admission refuses any speaker, enrolled voice or calendar-title name, any digit or number word, any owner vocabulary term (also written without spaces), deny-list words, non-Latin script and repeats; a local topic gets the owner's city-level home area and is admitted again; then one web search (`auditCaller: live_cues_general`), then a writer whose numbers must appear in a cited source. Only the topic reaches the web, never the transcript. The cue is kind `insight`, sent as `coaching_nudge_v2` with no v1 twin, logged with `general: {category, query}`, and never touches focused cooldown, counters or breaker.
+- General caps, durable and charged before each call: attempts and cues per meeting, topic calls, web searches and (env-only, default 300) trigger calls per local day; a breaker after 3 failures opens for an hour. The trace row `general_tick` holds numbers, a category and, only for non-privacy refusals, a query hash; never the query. `GET /api/live-cues/status?sessionId=` adds `general {state, reason, cues, attempts}` for Mac meetings.
+- The ASR route passes each chunk's speakers to live cues (stored for the general name gate only). `end().nudgesGenerated` counts focused cues only. The topic module reads the profile lazily (a test that mocked the profile partially failed at import before).
+
+## 6.97.6 - SubQ session find shows every session that fits (private candidate)
+
+2026-11-01. Carries what 6.94.4 publishes, and replaces the measuring build 6.97.5. Pairs with COS Control 0.5.363.
+
+## 6.97.4 - Last review fixes (private candidate)
+
+2026-11-01. A private candidate for one Mac, carrying the fixes published in 6.94.3. Pairs with COS Control 0.5.363.
+
+- Merge checks every copy of a name stored in both Unicode forms and refuses on any below the bar; delete previews count them all; renames reach meetings in either form. `?name=a&name=b` answers 400.
+- A file reference like `meeting.ts:2452`, bare `localhost` and a bare IP are no longer treated as links.
+
+## 6.97.3 - Speaker names and session find, from QA (private candidate)
+
+2026-11-01. A private candidate for one Mac. Pairs with COS Control 0.5.363.
+
+- Accented names: merge, delete-person, calibration, the rename fan-out and the embeddings manager now match a stored name in either Unicode form, a meeting record id matches in either form (default-on), and a confirm on a decomposed name records the person's confirmation. Merge refuses if any stored copy of a name is below the similarity floor, and the delete preview counts every copy. `?name=a&name=b` on enroll is a 400.
+- Session find: a title or prompt cut inside an attachment is dropped instead of sent, Windows, volume and escaped-space home paths are masked, ordinary words like `/home/dashboard` stay, and links to an IP address or localhost with a port or path are masked. Only home-folder paths are masked, not every file path; bare domains, bare addresses and `file.ts:12` stay. Refusals log one line per reason, with no words.
+
+## 6.97.2 - Local paths stay off the search (private candidate)
+
+2026-11-01. A private candidate for one Mac. Pairs with COS Control 0.5.363.
+
+- Session find drops attachment paths at the start of a first prompt, so the 150 characters sent begin at the typed words, and it masks home paths, `~/`, `file://` and `C:\Users` in text, titles and queries. On this Mac 55 of the newest 508 first prompts started with an attachment and 105 held a home path in their first 400 characters.
+
+## 6.97.1 - Search sessions by meaning (private candidate)
+
+2026-11-01. A private candidate for one Mac, built on 6.97.0, carrying the same commits as the public line's session find route. Pairs with COS Control 0.5.362.
+
+- `POST /api/agent-sessions/find` asks the person's decision model (Jev or SubQ) which recent sessions a few typed words refer to, after consent for that provider, and returns up to 5 rows in order of likelihood.
+- `GET /api/decision-provider` adds `capabilities.sessionFind`. The session list and search are unchanged.
+- Accented speaker names now match. COS Control's helper receives names in decomposed Unicode, so "Yes, this is Brigitta Pólya" failed with "No chunk in this meeting is labelled" although her chunks carried that name. Speaker-name routes in meeting and voice now read names as NFC and compare NFC on both sides, and a new name is stored as NFC. Names already saved are not rewritten.
+
+## 6.97.0 - COS's token ledger records what providers report, and a stopped meeting no longer locks Update (private candidate)
+
+2026-10-31. A private candidate for one Mac, built on 6.96.4. Pairs with the COS cost view in the next COS Control build, which reads the ledger file directly; there is no new endpoint.
+
+**Restart and Update are no longer locked by a meeting that has stopped trying.** In 6.96.4 a saved meeting waiting on HQ held `meeting_sync.active`, `meeting_sync.blocksRestart` and `finalization.pending` for as long as its job existed, up to 30 days, though retries in one process end after three attempts. COS Control disabled Restart, Update Server and Sync now on those, so a fix could not reach the Mac.
+- A job that has used its retries now records that it stopped, in its own job file, and counts in none of those three. It stays visible as a `meeting_sync.meetings` row with phase `stopped` and a label that says so. `finalization` keeps its shape, and an older COS Control unlocks too, because `pending` reads 0. Its audio and job file stay. Nothing is deleted.
+- A job that is working still blocks: while an attempt runs, and between its retries.
+- A later start does not take the lock back every time. A stopped job is tried once, with no retry timers, on a start of a different server version or a start 6 hours or more after it stopped. Its lock lasts as long as that one attempt runs, and it is the same window as the maintenance lease. Any other start runs nothing and holds nothing.
+- A job that failed before this version recorded stops is tried once at its first start on 6.97.0, then stops the same way. A job the boot gate parked for crash-looping also stops holding the lock; it keeps the gate's own second chance and Retry.
+
+**The ledger.**
+- A token-audit row now carries real usage when the provider reported it: `input_tokens`, `output_tokens`, `cache_read_tokens`, `cache_write_tokens`, `cache_write_1h_tokens`, `cost_usd` and `resolved_model`, with `usage_kind` `provider_final`. That label now needs real numbers. All four counts are always written. `cache_write_1h_tokens` is part of `cache_write_tokens`; it and `cost_usd` appear only when the provider states them.
+- A row with none of these keeps every existing field byte for byte, so the Python readers are unaffected. Polish rows keep `input_chars` as the words dictated and add `prompt_chars`: what the model is sent, system prompt included.
+- What the numbers mean differs by provider. `input_tokens` never includes cache reads. It excludes cache writes only on Claude, the one provider that reports them. Codex's write field read 0 on all 31,670 rollout rows checked, and the direct lane reads none, so on both `cache_write_tokens` is 0 and any write stays in `input_tokens`. `resolved_model` is what the CLI says ran on Claude, and what COS asked for on Codex, direct and Ollama.
+- Real where a provider states it: the lens gist, cues and transcript cleanup; Meeting Ask; warm dictation polish; the Claude, Codex and direct bridges and the boot pre-warm; Claude attached and fork runs.
+- Still estimated: cold polish, whose plain text output has no usage (JSON there would add failures that feed the breaker); every Cursor path, whose cache parser has never produced a real row; Codex attached and fork runs, which share a thread with the desktop; and summaries that run through `spawnClaudeText`.
+- A resumed turn is charged only itself. Claude's `total_cost_usd` and `modelUsage` and Codex's `usage` are running totals that carry earlier turns of the session. Claude reads `model_usage_since_last_result`, and each result counts once however many a steered run writes. Usage on a result that arrives after the row is written gets one `:late_result` row under the same run id. On a CLI without that field, a resumed Claude run reports this turn's tokens and no cost.
+- Codex charges the difference from the last total this bridge saw on the thread, and only when it can show nothing else ran there since. The row stays estimated on the first resumed turn after a restart, after a turn that never reported a total, after an attached run, and when the thread's rollout grew between turns, which is how a desktop run shows. The turn after is real again.
+- Every row these paths log now names its run and provider session where known: `run_id` and `cli_session_id`. A provider id that has spaces, or is shaped like a key or a path, is refused rather than written.
+- Dispatched tasks and meeting reviews get their own caller, `dispatch_task` and `work_review`, in place of `full_query`. Attached and fork runs that reach an end get a row for the first time: source `g2-attached`, caller `attached_turn`; source `g2-fork`, caller `fork_thread`.
+- A missing or malformed usage block changes nothing: same answer, no failure, no breaker count, no retry, and the row stays estimated. No prompt or answer text enters the audit.
+- The test config now points the audit at a scratch file (`COS_TOKEN_AUDIT_FILE`), so a test's made-up numbers cannot reach a real ledger. Tests that did not mock the audit used to append to the home file.
+
+## 6.96.4 - Saved Mac calls no longer stick on one empty window (private candidate)
+
+2026-10-31. A private candidate for one Mac, built on 6.96.3 with nothing else in it.
+
+- A saved Mac or iPhone call no longer fails because Parakeet heard no words in one window over audio the speech detector counts as speech. The window is treated as an answer: it keeps any live words it had, stays empty if it had none, and says so in that window's `stt.fallbackReason`. Before, that one window failed the whole call, and every retry failed the same way.
+- A real Parakeet failure (a CLI exit, a timeout, a busy lane) still blocks the call and retries, as it did.
+- An error that never reached the CLI is no longer reported as `cli_failed`. It now reads `internal`, and the log names the window and the reason.
+- Cleanup no longer deletes the pending audio of a saved meeting still waiting on HQ, for up to 30 days. Before, it went 12 hours after the last attempt, and the next start finished the meeting on its streaming text.
+
+## 6.96.3 - Fewer voices in Mac speaker review, and suggested names on request (private candidate)
+
+2026-10-30. A private candidate for one Mac. Pairs with the matching private COS Control build.
+
+- Speaker review can show a Mac recording's voices as merged groups first, then a row for each voice with 15 seconds or more, then one expandable row for the shorter ones. It reads the merges speaker shadow already logged for that meeting. Display only: no label, name, sample or file changes, and every voice's words stay one click away. A voice named since the log was written leaves its group. A Mac with speaker shadow off sees no change.
+- A new on-click job compares each of a meeting's voices with the shared voice profiles, one at a time, using the rule frozen in the October 30 study (top score .70 or more, margin .05 or more). Voices in a merged group share one suggestion only when each passed on its own for the same person. On the 12 voices judged by ear it reproduced the study: 10 right, 0 wrong, 2 with no suggestion. That is three people, not proof across every profile, and suggestions on other voices are unverified. A result expires when the meeting or the voice profiles change.
+- A suggestion is never a name. Those scoring .80 or more with a .05 margin are marked high confidence, and they are still suggestions. A person confirms them, one at a time or as a previewed batch, through the same writes as naming a voice by hand. The job writes nothing, keeps its result in memory only, never suggests the owner, ignores samples taken from the same recording, and refuses during a recording or maintenance.
+- A batch stops at the first refusal and reports what was named. Undo reverses the whole batch and removes only the voice samples it added, so names set one at a time keep theirs. A voice a person changed afterward is left alone and reported. A batch never names the owner.
+- Automatic names are unchanged.
+
+## 6.96.2 - Source-bound anonymous speaker review (private local candidate)
+
+2026-10-30. Pairs with private COS Control 0.5.357 / build 411 for the interval review. Existing clients retain their compatible review path.
+
+- A separately qualified, source-bound whole-call packet can project anonymous groups onto fully supported timed words. Gaps, transitions and unsupported speech remain unresolved. This derived review does not rewrite the canonical meeting, correction ledger, names, profiles, words or timestamps.
+- The review separates supported anonymous groups, existing named rows and unresolved speech. These rows are not a count of people. Fragment counts and old root-level phrases do not stand in for interval evidence.
+- Human review supports exact timed-word naming, renaming and Undo while the automatic producer is off. Each action is bound to the reviewed source revision; prior corrections and protected words take precedence. For this private candidate, a name already asserted elsewhere in the source is refused rather than risking attribution of unrelated words.
+- A recording can return to its original review after its interval naming actions are undone. Interrupted transactions require recovery before another action; packet and state changes invalidate stale review tokens. Original files, earlier corrections and voice profiles remain untouched.
+- Held-naming Undo proceeds separately for each meeting: a call-wide review can block its own meeting without preventing unrelated meetings in the batch from reverting.
+- The accepted-only October 30 repair covers 3,423 previously unassigned timed words in four anonymous groups, leaves 9,471 words unresolved, and preserves 253 named words. Whole-call human comparison checks on two earlier calls found no conflicting names within this narrower accepted support; identity accuracy on the current call remains unconfirmed. Broader interval expansion failed that quality gate and remains excluded.
+- Includes the 6.96.1 bounded save-receipt lookup correction for large recording sidecars; retained audio and saved-meeting receipts remain separate from speaker quality.
+- Transcript cleanup, live cues and live speaker ID remain disabled. Automatic interval production, profile naming and enrollment are not enabled by this candidate. Historical repair requires the exact qualified packet and correction-preservation checks.
+
 ## 6.95.0 - Speaker merge shadow mode (opt-in, log only)
 
 2026-10-28. Compatible with COS Control 0.5.352; no Control or glasses change required.
@@ -12,6 +145,30 @@
 - **Known limits:** a recording's first run with a cold CoreML cache leaves up to four empty `NSIRD_fluidaudiocli_*` folders in the per-user temp dir (counted in the record, not removed). Recovered (orphan) Mac captures are not queued. The gates were fixed on one truth-labeled call; scoring the logged proposals is the next step.
 - **Switches:** the per-Mac setting and `COS_SPEAKER_SHADOW` (default off), `COS_SPEAKER_SHADOW_DAILY_RUNS`, `COS_SPEAKER_SHADOW_TIMEOUT_MS` (may only lower 180 s), `COS_SPEAKER_SHADOW_RSS_MB`, `COS_SPEAKER_SHADOW_MODELS`. No default-on change.
 
+## 6.94.4 - SubQ session find shows every session that fits
+
+2026-11-01. Pairs with COS Control 0.5.363. Only affects people who chose SubQ and said yes to find sessions by meaning. Jev and everything else are unchanged.
+
+- SubQ now scores each likely session on its own, as Jev does. Before, its scores across all sessions added up to one against a floor of 0.5, so usually one row could show and others that fit were hidden.
+- Measured through the real route on 26 of 27 queries: the right session was shown in 19 of 20 and first in 18. An answer 51 days old is now found. Of 6 no-answer queries, 5 say nothing close and 1 shows weak rows marked possible. Wrong rows can still score high below the right one.
+- A SubQ search now uses about 10,500 to 24,000 tokens against its 3M daily cap.
+
+## 6.94.3 - Search sessions by meaning, and accented speaker names
+
+2026-11-01. Pairs with COS Control 0.5.363. Control 0.5.361 and older keep working and never call the new route.
+
+**New, and off until you say yes in Control.**
+
+- `POST /api/agent-sessions/find` asks your decision model (Jev by default, SubQ if chosen) which recent sessions a few typed words refer to, and returns up to 5 rows in order of likelihood. It answers only for the provider you consented to in Control, and refuses before reading any session otherwise.
+- Each search sends the typed words, plus the title and first 150 characters of the first prompt from up to 254 recent sessions, then up to 508 if the first pass finds nothing strong. Emails, URLs, links to an IP address or localhost, home-folder paths (not every file path) and key-shaped text are removed first. Names and other details are not. SubQ keeps what it is sent. Archived, keyed and scheduled sessions are left out.
+- Its own daily caps (3M tokens per provider), breaker and `COS_SESSION_FIND=0` switch. `GET /api/decision-provider` adds `capabilities.sessionFind`.
+
+**Default-on, no setting.**
+
+- Accented speaker names now match in either Unicode form. "Yes, this is Brigitta Pólya" failed with "No chunk in this meeting is labelled" because Control's helper hands names over decomposed. Meeting and voice routes read names as NFC, compare both sides, and store new names as NFC. Merge, delete-person, calibration, the rename fan-out and the embeddings manager match a stored name in either form, and a meeting record id matches in either form too (a decomposed id from Control's helper opens the same record). Merge refuses if any stored copy of a name is below the similarity floor. Names already saved are not rewritten.
+
+No other route changes. The session list and search are unchanged.
+
 ## 6.94.2 - Scoped profile matches for saved Mac recordings
 
 2026-10-28. Compatible with COS Control 0.5.352; no Control or glasses package change required.

package/README.md

@@ -699,6 +699,10 @@ flag a Mac rename is text only. `GET /api/health` reports `capabilities.macLiveV
 The saved meeting is relabeled by the whole-meeting pass. Live numbers are kept;
 voices the live path did not prove are numbered above them at save.
 
+### Session find by meaning (6.94.3)
+
+`POST /api/agent-sessions/find` backs ⌘K in COS Control 0.5.363. It is off until the person says yes for one provider in Control. See `docs/decision-providers.md` for what leaves the Mac, the caps and `COS_SESSION_FIND=0`.
+
 ### Saved Mac profile reconciliation (6.94.2)
 
 After transcription and diarization, eligible Mac recordings receive a bounded

package/managed-runtime-contract.json

@@ -36,6 +36,19 @@
     "COS_LIVE_CUES_V2_MAX_PER_MEETING",
     "COS_LIVE_CUES_V2_DAILY_WRITER_CALLS",
     "COS_LIVE_CUES_V2_MAC",
+    "COS_LIVE_CUES_V2_JUDGE_YES",
+    "COS_LIVE_CUES_V2_LEAD_REPEAT",
+    "COS_LIVE_CUES_V2_KNOWN_NAMES",
+    "COS_LIVE_CUES_V2_PACING",
+    "COS_LIVE_CUES_V2_OPEN_ITEMS",
+    "COS_LIVE_CUES_MODE",
+    "COS_LIVE_CUES_GROUNDING",
+    "COS_LIVE_CUES_GENERAL_INTERVAL_S",
+    "COS_LIVE_CUES_GENERAL_TRIGGER",
+    "COS_LIVE_CUES_GENERAL_ATTEMPTS",
+    "COS_LIVE_CUES_GENERAL_MAX_PER_MEETING",
+    "COS_LIVE_CUES_GENERAL_DAILY_TOPIC_CALLS",
+    "COS_LIVE_CUES_GENERAL_DAILY_WEB_SEARCHES",
     "COS_TAILSCALE_NUDGE",
     "COS_MAC_VOICE_LABELS",
     "COS_MAC_LIVE_VOICES",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.95.0",
+  "version": "6.98.0",
   "description": "COS Glasses: self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {
@@ -52,6 +52,7 @@
     "!server/scripts/work-intake-mutation-gate.mjs",
     "!server/scripts/work-progress-mutation-gate.mjs",
     "!server/scripts/work-search-mutation-gate.mjs",
+    "!server/scripts/session-find-redact-mutation-gate.mjs",
     "!server/scripts/fact-check-mutation-gate.mjs",
     "!server/scripts/stale-session-mutation-gate.mjs",
     "!server/scripts/autonomous-save-mutation-gate.mjs",
@@ -77,6 +78,7 @@
     "!server/scripts/transcript-cleanup-mutation-gate.mjs",
     "!server/scripts/live-cues-v2-notes-mutation-gate.mjs",
     "!server/scripts/live-cues-verdicts-mutation-gate.mjs",
+    "!server/scripts/live-cues-general-mutation-gate.mjs",
     "!server/scripts/key-lanes-p1-mutation-gate.mjs",
     "!server/scripts/key-lanes-p2-mutation-gate.mjs",
     "!server/scripts/key-lanes-p3-mutation-gate.mjs",

package/server/index.ts

@@ -75,6 +75,7 @@ import { nativeHead, realNativeHeadDeps, registerClaudeTranscriptHint } from './
 import { threadOccupancy, holderActivity } from './lib/thread-occupancy.js'
 import { displayRouter } from './routes/display.js'
 import { transcribeStreamRouter, getActiveTranscriptionSessionCount, getTranscriptionSessionLiveness } from './routes/transcribe-stream.js'
+import { installCodexRolloutProbe } from './lib/codex-rollout-watermark.js'
 import { meetingRouter, resumeAutonomousMeetingSaves, resumeMeetingFinalizationJobs, scheduleTranscriptCleanupSweep, transcriptCleanupRouteDeps } from './routes/meeting.js'
 import { createTranscriptCleanupRouter } from './routes/transcript-cleanup.js'
 import { meetingsRouter } from './routes/meetings.js'
@@ -161,12 +162,15 @@ import { createWorkHandoffRequestsRouter } from './routes/work-handoff-requests.
 import { createSubqKeyRouter } from './routes/subq-key.js'
 import { createDecisionProviderRouter } from './routes/decision-provider.js'
 import { createJevRouter } from './routes/jev.js'
+import { createSessionFindRouter } from './routes/session-find.js'
+import { isSessionFindPost } from './lib/session-find.js'
 import { createWorkChatRouter } from './routes/work-chat.js'
 import { createWorkOrchestratorRouter } from './routes/work-orchestrator.js'
 import { createWorkLensRoundsRouter } from './routes/work-lens-rounds.js'
 import { startWorkOrchestrator } from './lib/work-orchestrator/runtime.js'
 import { createWorkSearchRouter } from './routes/work-search.js'
 import { isReadOnlyApiPost } from './lib/work-search.js'
+import { isMacVoiceNamingBatchPost } from './lib/mac-voice-naming-batch.js'
 import { dataPath } from './lib/data-dir.js'
 import { loadJsonOrQuarantine, durableAtomicWriteFileSync } from './lib/atomic-fs.js'
 import { BOOT_RESUME_LEDGER_FILE, createBootResumeGate, installBootResumeGate } from './lib/boot-resume.js'
@@ -396,6 +400,8 @@ app.use('/api', (req, res, next) => {
   // 6.65.0: a POST that only reads (Work search: a board read and one Jev question) is not a mutation. See
   // lib/work-search.ts isReadOnlyApiPost for why holding the lease would hurt and why skipping it is safe.
   if (isReadOnlyApiPost(req.method, req.path)) return next()
+  // Session find (Control 0.5.363) reads the session store and asks a model; it writes only its own token ledger. See lib/session-find.ts.
+  if (isSessionFindPost(req.method, req.path)) return next()
   // V2 video original chunks are bounded to the advertised session size (1 MiB
   // on new sessions, 256 KiB on leftover drafts) and commit through the upload
   // registry's own generation lock. Holding the global mutation lease while
@@ -442,6 +448,8 @@ app.use('/api', (req, res, next) => {
     || req.path.startsWith('/maintenance/drain')
     // 6.83.0 lens plans: each write takes the api_mutation lease itself and answers the contract's 503 `maintenance`.
     || req.path.startsWith('/work/chat/lens-')
+    // 6.96.3 voice naming batches: each write holds api_mutation itself; a drain gets the route's own refusal.
+    || isMacVoiceNamingBatchPost(req.path)
   if (lifecycleOwned) return next()
 
   // COS Control must prove the candidate while a committed cross-boot gate is
@@ -858,6 +866,8 @@ app.use('/api', createJevRouter(workReviewRuntime ? { review: async id => workRe
 app.use('/api', createDecisionProviderRouter())
 app.use('/api', createSubqKeyRouter())
 app.use('/api', createWorkSearchRouter())
+// Find a session by meaning (Control 0.5.363): consent per provider, its own ledgers and breakers (lib/session-find.ts).
+app.use('/api', createSessionFindRouter())
 app.use('/api', createWorkChatRouter())
 // 6.83.0 Work orchestrator: Control's Work snapshot, the planner input and plan usage (docs/work-orchestrator.md).
 app.use('/api', createWorkOrchestratorRouter())
@@ -1507,6 +1517,8 @@ listenRequiredServers(listeners).then(() => {
     if (admittedRuntimeStarted) return
     admittedRuntimeStarted = true
 
+    // 6.97.0: lets the Codex bridge show nothing else ran on a thread between its turns.
+    installCodexRolloutProbe()
     // 6.78.0: before any boot resume. Was the last exit clean? Only boots after a crash count.
     bootResume.openBoot()
     // Resume already-saved meetings whose post-response HQ/operations work

package/server/lib/attached-provider-adapter.ts

@@ -106,6 +106,8 @@ import { cursorIsolationUnavailableError, cursorSpawnEnv, isCursorIsolationUnava
 import type { PermissionAllowance } from './banned-permission-args.js'
 import { anyKeyedSessions, isKeyedSession } from './keyed-sessions.js'
 import { claudeKeySecretsGuardArgs } from './key-secrets-guard.js'
+import { forgetCodexThreadTotals, SideRunTap } from './provider-usage.js'
+import { logTokenAudit, type TokenAuditEntry } from './token-audit.js'
 import {
   continueAllowanceFor,
   validateContinuePlan,
@@ -333,6 +335,8 @@ export interface AttachedTurnDeps {
    * would not have performed.
    */
   preflight: () => AttachedPreflightVerdict
+  /** 6.97.0: where the run's audit row goes. Only production wiring sets it, so no test writes a real ledger. */
+  auditRun?: (entry: TokenAuditEntry) => void
   resolveBinary: (provider: AttachedProvider) => BinaryResolution
   spawn: (request: AttachedSpawnRequest) => AttachedChildProcess
   /** MUST be the measured kernel start. See the header. */
@@ -961,6 +965,8 @@ async function run(
   if (request.abortSignal?.aborted === true) {
     return fail('cancelled', 'not_attempted', { ...base, detail: 'before_spawn', reaped: true, durationMs: duration() })
   }
+  // 6.97.0: this run moves the thread's running total without the bridge seeing it.
+  if (provider === 'codex') forgetCodexThreadTotals(nativeThreadId)
   let child: AttachedChildProcess
   try {
     child = deps.spawn({ binaryPath, args, cwd, env: buildAttachedEnv(), provider })
@@ -1013,8 +1019,14 @@ async function run(
     })
   }
 
+  // 6.97.0: a passive reader, wired after the run's own listeners, for one audit row at the end.
+  const usageTap = deps.auditRun ? new SideRunTap(provider) : null
   try {
-    return await driveChild({ child, pid, deps, provider, nativeThreadId, prompt, timeoutMs, startedAt, abortSignal: request.abortSignal })
+    const running = driveChild({ child, pid, deps, provider, nativeThreadId, prompt, timeoutMs, startedAt, abortSignal: request.abortSignal })
+    usageTap?.attach(child.stdout as any)
+    const result = await running
+    auditAttachedRun(deps, usageTap, result, provider, nativeThreadId, prompt)
+    return result
   } finally {
     // Every path: success, mismatch, non-zero exit, timeout, throw. A leaked
     // entry lets a recycled pid inherit our self-ownership claim.
@@ -1022,6 +1034,27 @@ async function run(
   }
 }
 
+/** One row for a run that reached an end: a verified exit, or a result the provider wrote before failing. */
+function auditAttachedRun(deps: AttachedTurnDeps, tap: SideRunTap | null, result: AttachedTurnResult, provider: AttachedProvider, nativeThreadId: string, prompt: string): void {
+  try {
+    if (!tap || !deps.auditRun) return
+    const realUsage = tap.finish()
+    if (!result.ok && !tap.sawEnd) return
+    deps.auditRun({
+      source: 'g2-attached',
+      caller: result.ok ? 'attached_turn' : `attached_turn:${result.reason}`,
+      model: provider,
+      inputChars: prompt.length,
+      outputChars: tap.outputChars,
+      durationMs: result.durationMs,
+      cliSessionId: result.returnedNativeId ?? nativeThreadId,
+      ...(realUsage ? { realUsage } : {}),
+    })
+  } catch {
+    // The audit never changes a turn's outcome.
+  }
+}
+
 function safeTerminate(deps: AttachedTurnDeps, child: AttachedChildProcess, signal: NodeJS.Signals): void {
   try {
     deps.terminate(child, signal)
@@ -1870,6 +1903,7 @@ export function realAttachedTurnDeps(preflight: () => AttachedPreflightVerdict):
   return {
     now: () => Date.now(),
     preflight,
+    auditRun: entry => logTokenAudit(entry),
     resolveBinary: provider => resolveProviderBinary(provider),
     spawn: request => {
       // 6.53.3: read BEFORE the spawn call, so every process of this turn starts at or

package/server/lib/claude-bridge.ts

@@ -13,6 +13,7 @@ import { COS_SCRIPTS_DIR } from './python-bridge.js'
 import { cleanupModelImageInputs, type ModelImageInput } from './model-image-input.js'
 import { resolveProviderWorkDir } from './launch-dir.js'
 import { logTokenAudit } from './token-audit.js'
+import { ClaudeRunUsage } from './provider-usage.js'
 import { buildSystemPrompt, buildLightweightSystemPrompt, buildPrewarmSystemPrompt, getCachedContextInstant } from './context-builder.js'
 import { getHistory, addExchange, setExchangeAttachments, removeExchange, formatHistoryForPrompt, getOrCreateSession, isNewSession, markSessionNotified, getSessionModel, getSessionRaw, replaceLastExchangeWithSummary, type ModelPreference, type PromptReference } from './conversation.js'
 import { notifySessionStart, notifyExchange } from './telegram-notify.js'
@@ -263,6 +264,7 @@ export async function preWarmCLI(): Promise<void> {
     })
 
     let buffer = ''
+    const prewarmUsage = new ClaudeRunUsage(false)
 
     proc.stdout.on('data', (chunk: Buffer) => {
       buffer += chunk.toString()
@@ -274,6 +276,7 @@ export async function preWarmCLI(): Promise<void> {
         if (!trimmed) continue
         try {
           const event = JSON.parse(trimmed)
+          prewarmUsage.observe(event)
           if (event.type === 'result' && event.session_id && !claudeResultErrorMessage(event)) {
             preWarmedCliSessionId = event.session_id
             scheduleCliSessionSave()
@@ -287,6 +290,7 @@ export async function preWarmCLI(): Promise<void> {
     proc.on('close', () => {
       preWarmInProgress = false
       const elapsed = Date.now() - start
+      const prewarmRealUsage = prewarmUsage.take()
       logTokenAudit({
         source: 'g2-prewarm',
         model: DEFAULT_MODEL,
@@ -294,6 +298,8 @@ export async function preWarmCLI(): Promise<void> {
         outputChars: 50,
         durationMs: elapsed,
         caller: 'prewarm',
+        ...(prewarmRealUsage ? { realUsage: prewarmRealUsage } : {}),
+        ...(prewarmUsage.cliSessionId ? { cliSessionId: prewarmUsage.cliSessionId } : {}),
       })
       if (!preWarmedCliSessionId) {
         console.warn('[claude-bridge] CLI pre-warm completed but no session ID captured')
@@ -738,6 +744,9 @@ export async function callClaudeStreaming(
     effortLevel: resolvedEffort ?? getClaudeEffortLevel(),
     cliModelId: keyProfile ? keyProfile.model : resolveClaudeCliModelId(resolvedModel),
   })
+  // 6.97.0: what this run used, for the audit row only. --resume decides how its totals can be read.
+  const runUsage = new ClaudeRunUsage(!!existingCliSession)
+  let auditRowWritten = false
 
   // Ultracode is a CLI-only orchestration keyword; history/chat keeps the
   // original user text so the keyword never appears on the lens.
@@ -927,6 +936,7 @@ export async function callClaudeStreaming(
     const inputEstimate = systemPrompt.length + fullQuery.length + contextPrompt.length
     // Key lanes (P11): this turn's settled spend on the key. Keyed turns only.
     const keyUsdFields = keyTurnId ? { usd: Math.round(getSharedKeyMeter().turnSettledUsd(keyTurnId) * 1e6) / 1e6 } : {}
+    const realUsage = runUsage.take()
     logTokenAudit({
       source: options?.lightweight ? 'g2-voice' : 'g2-query',
       model: resolvedModel,
@@ -936,7 +946,11 @@ export async function callClaudeStreaming(
       caller: options?.auditCaller ?? (options?.lightweight ? 'voice_query' : 'full_query'),
       ...keyAuditFields,
       ...keyUsdFields,
+      runId: run.runId,
+      ...auditCliSession(),
+      ...(realUsage ? { realUsage } : {}),
     })
+    auditRowWritten = true
 
     finishClaudeRun(run.runId, {
       status: 'completed',
@@ -963,6 +977,33 @@ export async function callClaudeStreaming(
     notifyExchange(sid, query, text)
   }
 
+  function auditCliSession(): { cliSessionId?: string } {
+    const cliSessionId = runUsage.cliSessionId ?? existingCliSession
+    return cliSessionId ? { cliSessionId } : {}
+  }
+
+  /**
+   * A run can finish on its first result while background subagents are still going; their usage is
+   * stated on a later result, after the row above was written. It gets one row of its own under the
+   * same run id, so each result counts once and none is lost. Zero chars: it carries only real usage.
+   */
+  function auditLateUsage() {
+    if (!auditRowWritten) return
+    const realUsage = runUsage.take()
+    if (!realUsage) return
+    logTokenAudit({
+      source: options?.lightweight ? 'g2-voice' : 'g2-query',
+      model: resolvedModel,
+      inputChars: 0,
+      outputChars: 0,
+      durationMs: Date.now() - startTime,
+      caller: `${options?.auditCaller ?? (options?.lightweight ? 'voice_query' : 'full_query')}:late_result`,
+      ...keyAuditFields, runId: run.runId,
+      ...auditCliSession(),
+      realUsage,
+    })
+  }
+
   async function finalizeError(
     msg: string,
     exitCode?: number | null,
@@ -1120,6 +1161,7 @@ export async function callClaudeStreaming(
 
       try {
         const event = JSON.parse(trimmed)
+        runUsage.observe(event)
 
         // 6.58.2: the first event that carries the session id (a hook or init line, before any
         // answer text) links the run and the job to it. At completion the result's id is
@@ -1274,6 +1316,11 @@ export async function callClaudeStreaming(
     keyTurn?.childClosed()
     if (steerReaper) clearTimeout(steerReaper)
     steerPort?.close()
+    // 6.97.0: nothing more can arrive. A last line with no newline is read here, once, for the audit.
+    if (buffer.trim()) {
+      try { runUsage.observe(JSON.parse(buffer.trim())) } catch { /* not JSON: handled below */ }
+    }
+    auditLateUsage()
     if (terminationRequested) return
     // Process any remaining buffer
     if (buffer.trim()) {

package/server/lib/codex-bridge.ts

@@ -17,6 +17,7 @@ import {
   skipsCosServiceTier,
 } from './codex-extra-args.js'
 import { logTokenAudit } from './token-audit.js'
+import { CodexRunUsage } from './provider-usage.js'
 import { cleanupModelImageInputs, type ModelImageInput } from './model-image-input.js'
 import { buildSystemPrompt, buildLightweightSystemPrompt } from './context-builder.js'
 import {
@@ -644,6 +645,9 @@ export async function callCodexStreaming(
   // the user's own words, bound by the hash of exactly what goes on stdin; the file dies
   // with the child. See lib/turn-request.ts.
   const turnRequest = createTurnRequestBinding({ userText: query, prompt, turnId: options?.turnId })
+  // 6.97.0: what this run used, for the audit row only. Begins before the spawn, which writes to the rollout.
+  const runUsage = new CodexRunUsage(keyProfile ? keyProfile.model : !skipsCosModel(extra) ? resolvedCodexModel?.id : undefined)
+  runUsage.begin(engineSession?.codexThreadId)
   applyTurnRequestEnv(env, turnRequest)
 
   const proc = withKeyTurnRevokedOnThrow(keyTurn, () => spawnWithTurnRequest(turnRequest, () => spawn(resolvedCodex.path, args, {
@@ -811,6 +815,7 @@ export async function callCodexStreaming(
     const totalMs = Date.now() - startTime
     // Key lanes (P11): this turn's settled spend on the key. Keyed turns only.
     const keyUsdFields = keyTurnId ? { usd: Math.round(getSharedKeyMeter().turnSettledUsd(keyTurnId) * 1e6) / 1e6 } : {}
+    const realUsage = runUsage.finish(codexThreadId, engineSession?.codexThreadId)
     logTokenAudit({
       source: options?.lightweight ? 'g2-voice' : 'g2-query',
       model,
@@ -820,6 +825,9 @@ export async function callCodexStreaming(
       caller: options?.auditCaller ?? (options?.lightweight ? 'voice_query' : 'full_query'),
       ...keyAuditFields,
       ...keyUsdFields,
+      runId: run.runId,
+      ...(codexThreadId ? { cliSessionId: codexThreadId } : {}),
+      ...(realUsage ? { realUsage } : {}),
     })
     saveEngineSessionBestEffort()
 
@@ -948,6 +956,7 @@ export async function callCodexStreaming(
 
   let nativeSessionAnnounced = false
   function handleEvent(event: any) {
+    runUsage.observe(event)
     const nextThreadId = extractCodexThreadId(event)
     if (nextThreadId && nextThreadId !== codexThreadId) {
       codexThreadId = nextThreadId
@@ -1032,10 +1041,11 @@ export async function callCodexStreaming(
 
   proc.on('close', (code) => {
     keyTurn?.childClosed()
-    if (terminationRequested) return
+    if (terminationRequested) { runUsage.settle(); return }
     if (buffer.trim()) {
       try { handleEvent(JSON.parse(buffer.trim())) } catch { /* ignore */ }
     }
+    runUsage.settle()
     if (finalized) return
     if (fullText) {
       void finalize(fullText)

package/server/lib/codex-rollout-watermark.ts

@@ -0,0 +1,42 @@
+// 6.97.0: how far a Codex thread's rollout has been written, for the audit only. Codex's usage is a
+// running total for the thread, so charging a resumed turn the difference is only honest if nothing
+// else ran on the thread since. The rollout's size is the one thing that shows a desktop run.
+//
+// Any write moves it, including ones that are not a turn. That direction is safe: the row stays estimated.
+import { statSync } from 'node:fs'
+import { realNativeHeadDeps, transcriptPathFor, type NativeHeadDeps } from './native-head.js'
+import { registerCodexRolloutProbe } from './provider-usage.js'
+
+/** A located rollout stays put, so a turn start costs one stat, not a walk of the sessions tree. */
+const rolloutPaths = new Map<string, string>()
+const ROLLOUT_PATHS_MAX = 512
+
+/** Bytes written so far, or null for UNKNOWN: no rollout found, or it moved or was compressed. Never throws. */
+export function codexRolloutSize(threadId: string, deps?: NativeHeadDeps): number | null {
+  try {
+    const known = rolloutPaths.get(threadId)
+    if (known) {
+      try {
+        return statSync(known).size
+      } catch {
+        rolloutPaths.delete(threadId)
+      }
+    }
+    const path = transcriptPathFor('codex', threadId, deps ?? realNativeHeadDeps())
+    if (!path) return null
+    rolloutPaths.set(threadId, path)
+    if (rolloutPaths.size > ROLLOUT_PATHS_MAX) rolloutPaths.delete(rolloutPaths.keys().next().value!)
+    return statSync(path).size
+  } catch {
+    return null
+  }
+}
+
+/** Called once at boot, in production only. */
+export function installCodexRolloutProbe(): void {
+  registerCodexRolloutProbe(threadId => codexRolloutSize(threadId))
+}
+
+export function _resetCodexRolloutPathsForTest(): void {
+  rolloutPaths.clear()
+}

package/server/lib/cursor-bridge.ts

@@ -533,7 +533,8 @@ export async function callCursorStreaming(
       runId: run.runId,
       sessionId: sid,
       clientJobId: options?.clientJobId,
-      usageKind: 'estimated',
+      // 6.97.0: the chat id only. Cursor's usage stays estimated: its cache parser has no real rows.
+      ...(cursorChatId ? { cliSessionId: cursorChatId } : {}),
     })
     saveEngineSessionBestEffort()
 

package/server/lib/decision-provider.ts

@@ -154,11 +154,13 @@ export function resetSubqDecisionClients(): void { configuredSubqClients.forEach
 /** A SubQ client built outside createDecisionClient (live cues, 6.76.2) still starts clean when a new key is saved. */
 export function trackSubqDecisionClient(client: SubqDecisionClient): SubqDecisionClient { configuredSubqClients.add(client); return client }
 /** Snapshot selection per workflow request. Separate clients and cache identities prevent stale cross-provider answers. */
-export function createDecisionClient(useCase: DecisionUseCase, jev: Pick<JevClient, 'ask'> = new JevClient(), env: NodeJS.ProcessEnv = process.env): DecisionClient {
+export function createDecisionClient(useCase: DecisionUseCase, jev: Pick<JevClient, 'ask'> = new JevClient(), env: NodeJS.ProcessEnv = process.env,
+  /** Optional: a SubQ ledger file and daily cap of this feature's own. Without it SubQ uses `subq-<useCase>-usage.json` and COS_SUBQ_DAILY_TOKENS. */
+  subq: { usageFile?: string; cap?: () => number } = {}): DecisionClient {
   const clients: Partial<Record<DecisionProvider, DecisionClient>> = {}
   const snapshot = (): DecisionClient => {
     const selected = selectedDecisionProvider(useCase, env)
-    if (!clients[selected]) clients[selected] = selected === 'subq' ? new SubqDecisionClient(fetch, () => new Date(), dataPath(`subq-${useCase}-usage.json`)) : {
+    if (!clients[selected]) clients[selected] = selected === 'subq' ? new SubqDecisionClient(fetch, () => new Date(), subq.usageFile ?? dataPath(`subq-${useCase}-usage.json`), undefined, subq.cap) : {
       provider: 'jev', async ask(state, questions, estimate, options) {
         if (options?.images?.length) throw new DecisionProviderError('decision_images_unsupported')
         return { ...await jev.ask(state, questions, estimate, options), provider: 'jev' }