@gotcos/glasses-server 6.1.0 → 6.2.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 6.2.0
+
+Reliability release — ports the hardening the full COS Glasses app shipped in June.
+
+- **Transfer integrity (lost-chunk detection).** The server now records every
+  received chunk index. A chunk lost in transit surfaces as an inline
+  `[… audio gap …]` marker in the gap-aware transcript instead of being
+  silently stitched over. Gap state survives a mid-meeting server restart;
+  legacy persisted sessions recover without false alarms. The Even Hub client
+  (1.0.153+) already retries failed uploads durably — this is the server half.
+- **Vocab-echo hallucination filter.** Whisper is seeded with your profile
+  vocabulary; on silence/music it can echo those terms back as phantom words
+  ("POS Nation. Thrift Cart.") the user never said. Bare-name echoes are now
+  dropped session-aware (silence echo, back-to-back run, or exact repeat) on
+  both the meeting and dictation paths. Real sentences that mention a term are
+  never dropped; plain single-word terms (names, cities) never trigger it.
+- **Name corrections on every path.** The `whisper_corrections` map now also
+  applies to iPhone-ASR candidate text and the cloud fallback, not just local
+  whisper.
+- **SIGTERM parity.** Production stops (service managers, `kill`) now flush
+  active session logs exactly like Ctrl-C did.
+- **`COS_G2_DEFAULT_MODEL` fix.** The documented default-model switch now
+  applies on the primary query path, not only the OpenAI-compat surface.
+
 ## 6.1.0
 
 - **Codex backend.** Chat now routes to your local **Codex CLI** (`codex-high`) in

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.1.0",
+  "version": "6.2.0",
   "description": "COS Glasses — self-hosted AI heads-up-display server for Even G2 smart glasses, powered by your local Claude Code or Codex CLI",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -138,7 +138,13 @@ app.get('/', (_req, res) => {
 })
 
 // Graceful shutdown — stop whisper-server child process
-process.on('SIGTERM', () => { stopWhisperServer(); process.exit(0) })
+process.on('SIGTERM', () => {
+  // Production stops (kill, service managers) send SIGTERM — flush session logs
+  // exactly like SIGINT so active conversations aren't lost on shutdown.
+  try { logActiveSessionsOnShutdown() } catch { /* best-effort flush */ }
+  stopWhisperServer()
+  process.exit(0)
+})
 process.on('SIGINT', () => { logActiveSessionsOnShutdown(); stopWhisperServer(); process.exit(0) })
 
 // Crash protection — log and survive instead of dying mid-meeting

package/server/lib/hallucination-filter.ts

@@ -11,7 +11,7 @@
 //   isFullHallucination(text) — returns true if the text IS a hallucination in its
 //     entirety (silence artifacts, caption training, foreign script, filler-only).
 
-import { getNegativeRules } from './profile.js'
+import { getNegativeRules, getVocabulary, getOwnerName, loadProfileField } from './profile.js'
 
 // ── Whole-chunk silence hallucinations ─────────────────────────────────────
 const KNOWN_HALLUCINATIONS = [
@@ -312,6 +312,76 @@ export function isRepeatedThankYouOnly(text: string): boolean {
   return content.length === 0
 }
 
+// ── Vocab-echo (prompt-regurgitation) hallucination ────────────────────────
+// Whisper is seeded with an initial_prompt = the profile vocabulary (owner +
+// brands + products + people). On silence / music / ambiguous audio it ECHOES
+// that prompt, emitting the seeded terms the user never said. The brand-URL
+// filters above only catch URL echoes; a bare brand-NAME echo slips through.
+// This detector drops a chunk that is NOTHING but seeded vocab terms (+
+// punctuation). Real speech that MENTIONS a term in a sentence keeps its
+// non-vocab content words and is never dropped.
+let _vocabEchoRe: RegExp | null = null
+
+/** Bust the cached vocab matcher after a profile write. */
+export function resetVocabEchoCache(): void { _vocabEchoRe = null }
+
+function getVocabEchoMatcher(): RegExp {
+  if (_vocabEchoRe) return _vocabEchoRe
+  const raw = new Set<string>()
+  const owner = getOwnerName()
+  if (owner) raw.add(owner)
+  for (const v of getVocabulary()) if (v && v.trim()) raw.add(v.trim())
+  // Include whisper_corrections key/value variants so the echo matches whatever
+  // spelling whisper emits ("POS Nation" ↔ "POSNation", "Jewel 360" ↔ "Jewel360").
+  try {
+    const corrRaw = loadProfileField('whisper_corrections', '')
+    if (corrRaw) {
+      const map = JSON.parse(corrRaw) as Record<string, string>
+      for (const [k, val] of Object.entries(map)) { if (k) raw.add(k); if (val) raw.add(val) }
+    }
+  } catch { /* malformed corrections — ignore */ }
+  // Only UNAMBIGUOUS terms trigger an echo drop: multi-word phrases ("POS Nation",
+  // "IT Retail", "Jeremy Sokolic") and brand-shaped single tokens with an internal
+  // capital or digit ("POSNation", "CaratIQ", "Jewel360"). Plain single-word tokens
+  // ("Austin", "Miles", "Ukaoma") are common words / ambiguous and are EXCLUDED —
+  // they carry too much false-drop risk for an always-on list rule.
+  const terms = [...raw].filter(t => {
+    if (t.length < 2) return false
+    if (/\s/.test(t)) return true                 // multi-word phrase
+    return /[A-Z0-9]/.test(t.slice(1))            // single token only if brand-shaped
+  }).sort((a, b) => b.length - a.length)
+  if (terms.length === 0) { _vocabEchoRe = /(?!)/g; return _vocabEchoRe }
+  // Escape regex metachars; flex internal whitespace so "IT Retail" also matches
+  // "ITRetail". Word-bounded so terms don't match inside larger words.
+  const alt = terms.map(t => t.replace(/[.*+?^${}()|[\]\\]/g, '\\$&').replace(/\s+/g, '\\s*')).join('|')
+  _vocabEchoRe = new RegExp(`\\b(?:${alt})\\b`, 'gi')
+  return _vocabEchoRe
+}
+
+/** Count distinct seeded-vocab terms present in `text`. */
+export function countVocabTerms(text: string): number {
+  if (!text) return 0
+  const re = getVocabEchoMatcher()
+  re.lastIndex = 0
+  const found = new Set<string>()
+  let m: RegExpExecArray | null
+  while ((m = re.exec(text)) !== null) {
+    found.add(m[0].toLowerCase().replace(/\s+/g, ''))
+    if (m.index === re.lastIndex) re.lastIndex++  // guard against a zero-width match loop
+  }
+  return found.size
+}
+
+/** True iff `text` is non-empty and contains NOTHING but seeded vocab terms (plus
+ *  punctuation/whitespace) — the prompt-echo hallucination shape. Any non-vocab
+ *  content word (incl. connectives like "and"/"the") makes it real speech → false. */
+export function isVocabEchoOnly(text: string): boolean {
+  if (!text || !text.trim()) return false
+  if (countVocabTerms(text) === 0) return false
+  const residual = text.replace(getVocabEchoMatcher(), ' ').replace(/[^a-z0-9]/gi, '')
+  return residual.length === 0
+}
+
 /** Streaming-chunk silence-drop decision. Pure + exported so the gate is testable
  *  (sanitizeStreamTranscript is private). Returns a fallbackReason or null. Contract:
  *    brand-URL-only  -> 'brand_url'        DROP ALWAYS — brand URLs are vocab-seeded,
@@ -320,6 +390,9 @@ export function isRepeatedThankYouOnly(text: string): boolean {
  *                                          third-party URL during speech is preserved.
  *    thank-you-only  -> 'thankyou_silence' DROP only when isQuiet — soft real closings
  *                                          stay (see isRepeatedThankYouOnly).
+ *  Vocab-echo (prompt regurgitation) is handled SEPARATELY in sanitizeStreamTranscript
+ *  because the safe rule is session-aware (drop a silence echo or a back-to-back RUN,
+ *  but keep a single loud one-off that could be a real terse brand/name list).
  *  Real speech (any chunk with content words) always returns null. */
 export function streamSilenceDropReason(text: string, isQuiet: boolean): 'brand_url' | 'url_silence' | 'thankyou_silence' | null {
   if (!text || !text.trim()) return null

package/server/lib/model-router.ts

@@ -24,7 +24,11 @@ export async function callModelStreaming(
 ): Promise<string> {
   const sid = getOrCreateSession(sessionId)
   const sessionModel = getSessionModel(sid)
-  const resolvedModel = normalizeModelPreference(model) ?? sessionModel ?? DEFAULT_MODEL
+  // COS_G2_DEFAULT_MODEL is the documented default-model switch (CHANGELOG 6.1.0);
+  // it must win over the hardcoded DEFAULT_MODEL on this primary query path, not
+  // just the OpenAI-compat surface.
+  const envDefault = normalizeModelPreference(process.env.COS_G2_DEFAULT_MODEL)
+  const resolvedModel = normalizeModelPreference(model) ?? sessionModel ?? envDefault ?? DEFAULT_MODEL
 
   setSessionModel(sid, resolvedModel)
 

package/server/lib/transcribe-audio.ts

@@ -17,6 +17,8 @@ import { enhanceAudio } from './audio-enhance.js'
 import {
   stripInlineHallucinationsOneShot,
   isFullHallucination,
+  isVocabEchoOnly,
+  countVocabTerms,
 } from './hallucination-filter.js'
 import { getOpenAIKey } from './openai-key.js'
 
@@ -173,7 +175,11 @@ export async function transcribeAudioBuffer(audioBuffer: Buffer, opts: { mode?:
   }
 
   const elapsedMs = performance.now() - tStart
-  if (!text || isFullHallucination(text)) {
+  // A one-shot message/dictation that is NOTHING but a list of seeded vocab terms
+  // (>=2 distinct) is a whisper prompt-echo, not speech — drop it like the meeting
+  // path does. A single terse brand mention stays (could be a real one-word message).
+  const vocabEcho = isVocabEchoOnly(text) && countVocabTerms(text) >= 2
+  if (!text || isFullHallucination(text) || vocabEcho) {
     throw new NoSpeechDetectedError(text || '')
   }
 

package/server/routes/transcribe-stream.ts

@@ -14,7 +14,7 @@ import { getOpenAIKey } from '../lib/openai-key.js'
 const __dirname = fileURLToPath(new URL('.', import.meta.url))
 import { emitDisplay } from '../lib/display-bus.js'
 import { errMsg } from '../lib/utils.js'
-import { transcribeLocal, isWhisperLocalAvailable, type WhisperWord } from '../lib/whisper-local.js'
+import { transcribeLocal, isWhisperLocalAvailable, applyCorrections, type WhisperWord } from '../lib/whisper-local.js'
 import { enhanceAudio } from '../lib/audio-enhance.js'
 import { trimSilence, isSileroAvailable } from '../lib/vad-silero.js'
 import { identifySpeaker, isEmbeddingAvailable, autoEnroll, getEmbeddingCount } from '../lib/speaker-embeddings.js'
@@ -29,6 +29,7 @@ import {
   isFullHallucination as sharedIsFullHallucination,
   clearSessionHallucinationState,
   streamSilenceDropReason,
+  isVocabEchoOnly,
 } from '../lib/hallucination-filter.js'
 
 // Silence-hallucination drops (2026-05-29, v5.9.73). Contract in streamSilenceDropReason:
@@ -170,6 +171,18 @@ interface TranscriptSession {
   startTime: number
   title: string
   providerCandidates?: Record<string, ProviderCandidateRecord>
+  // ── Transfer integrity (lost-chunk detection) ──────────────
+  // Every chunkIndex the server received an audio POST for — recorded at
+  // ingest BEFORE any text filtering, so a "received but silent" chunk counts
+  // as delivered (not a gap). A genuine hole (index in [0, maxChunkIndex] that
+  // never arrived = a chunk lost in transit) is the only thing flagged as a gap.
+  // Sorted, de-duplicated. See computeGapReport()/analyzeTranscriptGaps().
+  receivedIndices?: number[]
+  maxChunkIndex?: number
+  // Count of consecutive vocab-echo (prompt-regurgitation) chunks. Reset to 0 by
+  // any real-content chunk. Used to drop a RUN of echoed brand names while keeping
+  // a single loud one-off (which could be a real terse list). See sanitizeStreamTranscript.
+  vocabEchoStreak?: number
 }
 
 const sessions = new Map<string, TranscriptSession>()
@@ -238,11 +251,24 @@ function persistSession(sessionId: string): void {
     const session = sessions.get(sessionId)
     if (!session) return
     const filePath = resolve(CHUNK_PERSIST_DIR, `${sessionId}.json`)
+    // chunksIndexed preserves each chunk's original index (a plain filter()
+    // would collapse the sparse array and destroy gap positions on recovery).
+    const chunksIndexed: Array<{ i: number; c: TranscriptChunk }> = []
+    for (let i = 0; i < session.chunks.length; i++) {
+      const c = session.chunks[i]
+      if (c && c.text) chunksIndexed.push({ i, c })
+    }
     const data = JSON.stringify({
       sessionId,
       startTime: session.startTime,
       title: session.title,
-      chunks: session.chunks.filter(c => c && c.text),
+      // `chunks` = legacy dense form, kept for backward compatibility with
+      // existing readers; `chunksIndexed` preserves original indices so gap
+      // detection survives recovery. Recovery prefers chunksIndexed.
+      chunks: chunksIndexed.map(e => e.c),
+      chunksIndexed,
+      receivedIndices: session.receivedIndices ?? [],
+      maxChunkIndex: session.maxChunkIndex ?? -1,
       providerCandidates: session.providerCandidates ?? {},
     })
     writeFileSync(filePath, data, 'utf-8')
@@ -259,13 +285,52 @@ function recoverSessions(): void {
       if (!file.endsWith('.json')) continue
       try {
         const data = JSON.parse(readFileSync(resolve(CHUNK_PERSIST_DIR, file), 'utf-8'))
-        if (data.sessionId && data.chunks && data.chunks.length > 0) {
+        // Reconstruct the (sparse) chunk array. New format keeps original
+        // indices via chunksIndexed; legacy format stored a dense `chunks`.
+        const indexed: Array<{ i: number; c: TranscriptChunk }> | null =
+          Array.isArray(data.chunksIndexed) ? data.chunksIndexed : null
+        const legacy: TranscriptChunk[] | null = Array.isArray(data.chunks) ? data.chunks : null
+        const hasChunks = (indexed && indexed.length > 0) || (legacy && legacy.length > 0)
+        if (data.sessionId && hasChunks) {
           // Only recover sessions less than 4 hours old
           if (Date.now() - data.startTime < 4 * 60 * 60 * 1000) {
+            const chunks: TranscriptChunk[] = []
+            if (indexed) {
+              for (const e of indexed) {
+                if (e && Number.isInteger(e.i) && e.i >= 0 && e.c) chunks[e.i] = e.c
+              }
+            } else if (legacy) {
+              for (let k = 0; k < legacy.length; k++) if (legacy[k]) chunks[k] = legacy[k]
+            }
+            // Restore the received-index ledger. A legacy file (pre-feature)
+            // has no ledger and no way to know whether a chunk was truly lost,
+            // so deriving from stored positions would FALSELY flag a
+            // received-but-silent chunk as a gap. Instead, treat a legacy
+            // session as contiguous (0..maxStored) → it reports 100%, never a
+            // false alarm. New-format files carry their own ledger and are exact.
+            const hasLedger = Array.isArray(data.receivedIndices)
+            let receivedIndices: number[]
+            let maxChunkIndex: number
+            if (hasLedger) {
+              receivedIndices = Array.from(new Set(
+                (data.receivedIndices as unknown[]).filter((n): n is number => Number.isInteger(n) && (n as number) >= 0),
+              )).sort((a, b) => a - b)
+              maxChunkIndex = typeof data.maxChunkIndex === 'number' && data.maxChunkIndex >= 0
+                ? data.maxChunkIndex
+                : (receivedIndices.length > 0 ? receivedIndices[receivedIndices.length - 1] : -1)
+            } else {
+              let maxStored = -1
+              for (let k = 0; k < chunks.length; k++) if (chunks[k]) maxStored = k
+              receivedIndices = []
+              for (let k = 0; k <= maxStored; k++) receivedIndices.push(k)
+              maxChunkIndex = maxStored
+            }
             const session: TranscriptSession = {
-              chunks: data.chunks,
+              chunks,
               startTime: data.startTime,
               title: data.title || '',
+              receivedIndices,
+              maxChunkIndex,
               providerCandidates: data.providerCandidates && typeof data.providerCandidates === 'object'
                 ? data.providerCandidates
                 : {},
@@ -293,7 +358,8 @@ function recoverSessions(): void {
               console.log(`[session-recovery] Cleaned inline hallucinations from ${cleaned} chunks`)
               persistSession(data.sessionId)  // re-persist cleaned data to disk
             }
-            console.log(`[session-recovery] Recovered ${data.chunks.length} chunks for ${data.sessionId}`)
+            const gaps = computeGapReport(session).missingIndices.length
+            console.log(`[session-recovery] Recovered ${session.chunks.filter(c => c && c.text).length} chunks for ${data.sessionId}${gaps > 0 ? ` (${gaps} lost-chunk gap${gaps > 1 ? 's' : ''})` : ''}`)
           } else {
             // Stale — clean up
             unlinkSync(resolve(CHUNK_PERSIST_DIR, file))
@@ -410,13 +476,106 @@ export function getSession(sessionId: string): TranscriptSession {
   return session
 }
 
-/** Get full accumulated transcript for a session (with speaker labels) */
-export function getSessionTranscript(sessionId: string): string | null {
+/** Insert a non-negative integer into a sorted array, keeping it sorted and
+ *  unique. Common case (a new highest value) is O(1); out-of-order (a retry)
+ *  is a binary-search insert. Mutates `arr`. Exported for unit tests. */
+export function insertSortedUnique(arr: number[], value: number): void {
+  if (!Number.isInteger(value) || value < 0) return
+  const last = arr.length > 0 ? arr[arr.length - 1] : -1
+  if (value > last) { arr.push(value); return }
+  if (value === last) return
+  let lo = 0, hi = arr.length
+  while (lo < hi) {
+    const mid = (lo + hi) >> 1
+    if (arr[mid] < value) lo = mid + 1
+    else hi = mid
+  }
+  if (arr[lo] !== value) arr.splice(lo, 0, value)
+}
+
+/** Record that the server received an audio POST for this chunk index.
+ *  Called at ingest before any text filtering, so silent/empty chunks still
+ *  count as delivered (not a gap). */
+function recordReceivedChunk(session: TranscriptSession, chunkIndex: number): void {
+  if (!Number.isInteger(chunkIndex) || chunkIndex < 0) return
+  if (!session.receivedIndices) session.receivedIndices = []
+  insertSortedUnique(session.receivedIndices, chunkIndex)
+  if (session.maxChunkIndex == null || chunkIndex > session.maxChunkIndex) {
+    session.maxChunkIndex = chunkIndex
+  }
+}
+
+export interface TranscriptGapReport {
+  received: number          // distinct chunk indices the server got
+  stored: number            // chunks that survived filtering (have text)
+  maxIndex: number          // highest chunk index seen (-1 if none)
+  expected: number          // maxIndex + 1
+  missingIndices: number[]  // indices in [0, maxIndex] never received = lost in transit
+  completeness: number      // received / expected (1 when nothing expected)
+}
+
+/** Pure gap math over a received-index ledger. Exported for unit tests. */
+export function analyzeChunkGaps(receivedIndices: number[], maxChunkIndex: number, storedCount = 0): TranscriptGapReport {
+  const maxIndex = maxChunkIndex
+  const expected = maxIndex + 1
+  const recvSet = new Set(receivedIndices.filter(n => Number.isInteger(n) && n >= 0))
+  const missingIndices: number[] = []
+  for (let i = 0; i <= maxIndex; i++) {
+    if (!recvSet.has(i)) missingIndices.push(i)
+  }
+  const completeness = expected > 0 ? recvSet.size / expected : 1
+  return { received: recvSet.size, stored: storedCount, maxIndex, expected, missingIndices, completeness }
+}
+
+/** Gap report bound to a live session's ledger + stored-chunk count. */
+function computeGapReport(session: TranscriptSession): TranscriptGapReport {
+  const received = session.receivedIndices ?? []
+  const maxIndex = session.maxChunkIndex ?? (received.length > 0 ? received[received.length - 1] : -1)
+  const stored = session.chunks.filter(c => c && c.text).length
+  return analyzeChunkGaps(received, maxIndex, stored)
+}
+
+/** Transfer-integrity report for a live session — null if the session is gone. */
+export function analyzeTranscriptGaps(sessionId: string): TranscriptGapReport | null {
   const session = sessions.get(sessionId)
   if (!session) return null
-  return session.chunks
-    .map(c => c.speaker ? `[${c.speaker}]: ${c.text}` : c.text)
-    .join('\n')
+  return computeGapReport(session)
+}
+
+/** Get full accumulated transcript for a session (with speaker labels).
+ *  With { withGaps: true }, walks the index sequence and inserts an explicit
+ *  marker wherever one or more chunks were never received — so permanently
+ *  lost audio is visible in the saved transcript instead of silently stitched. */
+export function getSessionTranscript(sessionId: string, opts: { withGaps?: boolean } = {}): string | null {
+  const session = sessions.get(sessionId)
+  if (!session) return null
+  const renderChunk = (c: TranscriptChunk): string => (c.speaker ? `[${c.speaker}]: ${c.text}` : c.text)
+  if (!opts.withGaps) {
+    return session.chunks.map(renderChunk).join('\n')
+  }
+  const report = computeGapReport(session)
+  if (report.missingIndices.length === 0) {
+    return session.chunks.map(renderChunk).join('\n')
+  }
+  const missing = new Set(report.missingIndices)
+  const lines: string[] = []
+  let gapRun = 0
+  const flushGap = (): void => {
+    if (gapRun > 0) {
+      // Marker is intentionally >40 inner chars so it can't match the
+      // bracket-shaped hallucination filter (/^\s*\[[^\]\n]{1,40}\]\s*$/).
+      lines.push(`[… audio gap — ${gapRun} chunk${gapRun > 1 ? 's' : ''} lost in transit, not received by server …]`)
+      gapRun = 0
+    }
+  }
+  for (let i = 0; i <= report.maxIndex; i++) {
+    if (missing.has(i)) { gapRun++; continue }
+    flushGap()
+    const c = session.chunks[i]
+    if (c && c.text) lines.push(renderChunk(c))
+  }
+  flushGap()
+  return lines.join('\n')
 }
 
 /** Get structured chunks with timing + speaker confidence (for blended meeting pipeline) */
@@ -599,6 +758,26 @@ function sanitizeStreamTranscript(sessionId: string, session: TranscriptSession,
       return { text: '', fallbackReason: dropReason }
     }
   }
+  // Vocab-echo (whisper regurgitating its seeded vocab prompt — phantom brand names).
+  // Session-aware so we never drop a real one-off: a chunk that is NOTHING but seeded
+  // terms is dropped only when (a) the audio is quiet (a silence echo), (b) it's the
+  // 2nd+ consecutive such chunk (a RUN — the "repeated multiple times" symptom), or
+  // (c) it exactly repeats a recent chunk. A single loud, non-repeating vocab-only
+  // chunk is KEPT (it could be a real terse brand/name list). Accepted trade: if a
+  // user genuinely dictates a brand list with NO connectives across consecutive
+  // chunks ("POS Nation," | "Thrift Cart," | "and IT Retail"), the middle chunk can
+  // be dropped — rare (whisper usually bundles a spoken list into one chunk, which
+  // is kept) and far less harmful than the phantom-brand spam this prevents.
+  if (trimmedText && STRIP_BRAND_URLS && isVocabEchoOnly(trimmedText)) {
+    const streak = (session.vocabEchoStreak ?? 0) + 1
+    session.vocabEchoStreak = streak
+    if (isQuiet || streak >= 2 || isCrossChunkRepeat(session, trimmedText)) {
+      console.log(`[hallucination] Dropped (vocab_echo, q=${isQuiet ? 1 : 0}, streak=${streak}): "${trimmedText.slice(0, 60)}"`)
+      return { text: '', fallbackReason: 'vocab_echo' }
+    }
+  } else if (trimmedText) {
+    session.vocabEchoStreak = 0
+  }
   if (trimmedText && isServerHallucination(trimmedText)) {
     return { text: '', fallbackReason: 'hallucination' }
   }
@@ -741,6 +920,9 @@ async function processStreamChunk(opts: {
 
   const audioSha256 = sha256Hex(audioBuffer)
   const session = getSession(sessionId)
+  // Transfer integrity: log this index as delivered before any text filtering,
+  // so a silent/hallucination-filtered chunk is NOT mistaken for a lost one.
+  recordReceivedChunk(session, chunkIndex)
   const alreadyCanonical = session.chunks[chunkIndex]
 
   let candidateRecordKey: string | undefined
@@ -819,11 +1001,17 @@ async function processStreamChunk(opts: {
     backend = result.backend
   }
 
+  // Apply deterministic name corrections (whisper_corrections map) on EVERY live
+  // path: the iPhone-ASR candidate path and the cloud fallback skip
+  // transcribeLocal's internal pass, so without this the lens would show names
+  // uncorrected for those sources. Idempotent for the local path.
+  rawText = applyCorrections(rawText)
+
   let sanitized = sanitizeStreamTranscript(sessionId, session, rawText, isQuiet)
   if (candidate && (!sanitized.text || sanitized.fallbackReason)) {
     fallbackReason = sanitized.fallbackReason || 'empty_candidate'
     const result = await transcribeWithServerWhisper(audioBuffer, whisperAudio, whisperContext, isQuiet)
-    rawText = result.text
+    rawText = applyCorrections(result.text)
     words = result.words
     backend = result.backend
     asrProvider = 'server-whisper'