@gotcos/glasses-server 6.16.5 → 6.17.0

package/server/lib/speaker-embeddings.ts

@@ -8,18 +8,62 @@
 import { resolve } from 'node:path'
 import { errMsg } from './utils.js'
 import { getOwnerSpeakerLabel } from './profile.js'
-import { readFileSync, writeFileSync, existsSync, appendFileSync, mkdirSync } from 'node:fs'
+import { readFileSync, writeFileSync, existsSync, appendFileSync, mkdirSync, statSync, openSync, readSync, closeSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { spawnSync } from 'node:child_process'
 import { fileURLToPath } from 'node:url'
 
+/** A real voiceprint model is ~26 MB; anything this small is a bad download. */
+const MIN_MODEL_BYTES = 1_000_000
+const PROBE_TIMEOUT_MS = 30_000
+
 // sherpa-onnx-node is CJS — use createRequire for ESM compat
 import { createRequire } from 'node:module'
 const require = createRequire(import.meta.url)
 
 const __dirname = fileURLToPath(new URL('.', import.meta.url))
 
-const MODEL_PATH = resolve(__dirname, '..', 'models',
-  '3dspeaker_speech_eres2net_sv_en_voxceleb_16k.onnx')
 import { DATA_DIR } from './data-dir.js'
+
+export const SPEAKER_MODEL_FILENAME = '3dspeaker_speech_eres2net_sv_en_voxceleb_16k.onnx'
+
+/** Where the voiceprint model may live, in priority order:
+ *
+ *  1. COS_SPEAKER_MODEL_PATH — explicit override (full path to the .onnx).
+ *  2. ~/.cos-glasses/models/ — the bolt-on location. The model is ~26 MB and is
+ *     deliberately NOT in the npm tarball, so a managed install has no bundled
+ *     copy. The data home survives generation swaps; anything inside the
+ *     installed package does not, and a model dropped there is destroyed by the
+ *     next update.
+ *  3. server/models/         — bundled, which only exists in a source checkout.
+ *
+ *  Anchored on homedir() rather than DATA_DIR/'..' on purpose: path.resolve is
+ *  purely lexical, so deriving a sibling of a relocated COS_DATA_DIR could point
+ *  the "durable" candidate at an unwritable root, or — if COS_DATA_DIR were ever
+ *  set inside the package — collapse it back onto the very directory an update
+ *  destroys, silently reintroducing the bug this ordering exists to fix.
+ *
+ *  Diarization is opt-in by design: with no model the system stays on amplitude
+ *  fallback (wearer vs Ext) rather than failing. speakerModelState() exists so
+ *  that choice is VISIBLE in /api/health instead of silently degrading.
+ */
+export function speakerModelCandidates(): string[] {
+  const override = process.env.COS_SPEAKER_MODEL_PATH?.trim()
+  return [
+    ...(override ? [resolve(override)] : []),
+    resolve(homedir(), '.cos-glasses', 'models', SPEAKER_MODEL_FILENAME),
+    resolve(__dirname, '..', 'models', SPEAKER_MODEL_FILENAME),
+  ]
+}
+
+function resolveSpeakerModelPath(): string | null {
+  // isFile, not existsSync: a directory passes an existence check and would be
+  // handed to the native loader as a model.
+  return speakerModelCandidates().find(p => {
+    try { return statSync(p).isFile() } catch { return false }
+  }) ?? null
+}
+
 const PROFILES_PATH = resolve(DATA_DIR, 'voice-profiles.json')
 const CALIBRATION_LOG = resolve(DATA_DIR, 'speaker-calibration.jsonl')
 
@@ -58,14 +102,109 @@ interface ProfileStore {
   profiles: VoiceProfile[]
 }
 
+/** Cheap structural screen for a downloaded model.
+ *
+ *  Catches the common bad downloads — an HTML error/redirect page saved as
+ *  .onnx, or a truncated transfer — before the file reaches the native runtime.
+ *  ONNX is protobuf: field 1 (ir_version, varint) encodes as a leading 0x08.
+ *  This is a screen, not validation; probeModelSafely() is the real gate. */
+function looksLikeOnnxModel(path: string): boolean {
+  try {
+    if (statSync(path).size < MIN_MODEL_BYTES) return false
+    const head = Buffer.alloc(1)
+    const fd = openSync(path, 'r')
+    try { readSync(fd, head, 0, 1, 0) } finally { closeSync(fd) }
+    return head[0] === 0x08
+  } catch { return false }
+}
+
+/** Load the model in a throwaway child process first.
+ *
+ *  onnxruntime does not throw on a malformed or mismatched model — it calls
+ *  std::terminate, so the process dies with SIGABRT (or SIGSEGV for a valid-but-
+ *  wrong model). No try/catch can intercept that. In a managed install the
+ *  LaunchAgent has KeepAlive, so the death becomes a permanent restart loop that
+ *  takes down queries, meetings, and transcription — the whole server, over an
+ *  optional feature.
+ *
+ *  Absorbing that crash in a child keeps a bad file a diarization problem
+ *  instead of an outage. Cost is one short-lived process, once, and only when a
+ *  model is actually present. */
+function probeModelSafely(modelPath: string): { ok: true } | { ok: false; reason: string } {
+  const script =
+    "const{SpeakerEmbeddingExtractor}=require('sherpa-onnx-node');" +
+    "new SpeakerEmbeddingExtractor({model:process.argv[1],numThreads:1,provider:'cpu'});"
+  const probe = spawnSync(process.execPath, ['-e', script, modelPath], {
+    cwd: resolve(__dirname, '..', '..'), // package root, so sherpa-onnx-node resolves
+    timeout: PROBE_TIMEOUT_MS,
+    stdio: ['ignore', 'ignore', 'pipe'],
+  })
+  if (probe.signal) return { ok: false, reason: `native runtime aborted (${probe.signal})` }
+  if (probe.error) return { ok: false, reason: probe.error.message }
+  if (probe.status !== 0) {
+    const stderr = String(probe.stderr ?? '').trim().split('\n').pop() ?? ''
+    return { ok: false, reason: stderr || `probe exited ${probe.status}` }
+  }
+  return { ok: true }
+}
+
 /** Initialize speaker embedding system. Returns false if model missing (graceful degradation). */
 export function initSpeakerEmbeddings(): boolean {
   if (initialized) return extractor !== null
 
   initialized = true
 
-  if (!existsSync(MODEL_PATH)) {
-    console.log('[speaker] Model not found at', MODEL_PATH, '— embedding disabled, using amplitude fallback')
+  const override = process.env.COS_SPEAKER_MODEL_PATH?.trim()
+  if (override) {
+    const overridePath = resolve(override)
+    let usable = false
+    try { usable = statSync(overridePath).isFile() } catch { usable = false }
+    if (!usable) {
+      // Falling through silently would leave the operator believing an override
+      // they mistyped (or pointed at a directory) is in effect.
+      console.warn(
+        `[speaker] COS_SPEAKER_MODEL_PATH=${overridePath} is not a readable file — ignoring it`,
+        'and falling back to the remaining candidates.',
+      )
+    }
+    if (override !== overridePath) {
+      // Relative paths resolve against cwd, which under launchd is the installed
+      // package — a location the next update deletes.
+      console.warn(
+        `[speaker] COS_SPEAKER_MODEL_PATH is relative; resolved against the working directory to ${overridePath}.`,
+        'Use an absolute path so it cannot move with the process.',
+      )
+    }
+  }
+
+  const modelPath = resolveSpeakerModelPath()
+  if (!modelPath) {
+    const boltOn = resolve(homedir(), '.cos-glasses', 'models')
+    console.log(
+      '[speaker] Voiceprint model not found — embedding disabled, speaker labels come from the client.',
+      `Searched: ${speakerModelCandidates().join(', ')}.`,
+      // Name the durable directory outright. An ordinal ("the second path")
+      // shifts with the override and pointed users at the package copy, which
+      // the next update deletes.
+      `To enable diarization put ${SPEAKER_MODEL_FILENAME} in ${boltOn}/ and restart.`,
+    )
+    return false
+  }
+
+  if (!looksLikeOnnxModel(modelPath)) {
+    console.error(
+      `[speaker] ${modelPath} does not look like an ONNX model (too small, or not protobuf) —`,
+      'embedding disabled. A partial download or an HTML error page saved as .onnx does this.',
+    )
+    return false
+  }
+
+  const probe = probeModelSafely(modelPath)
+  if (!probe.ok) {
+    console.error(
+      `[speaker] ${modelPath} failed to load — embedding disabled. Reason: ${probe.reason}.`,
+      'The server is otherwise unaffected; replace the model file and restart.',
+    )
     return false
   }
 
@@ -73,7 +212,7 @@ export function initSpeakerEmbeddings(): boolean {
     sherpaOnnx = require('sherpa-onnx-node')
 
     extractor = new sherpaOnnx.SpeakerEmbeddingExtractor({
-      model: MODEL_PATH,
+      model: modelPath,
       numThreads: 2,
       provider: 'cpu',
     })
@@ -332,6 +471,30 @@ export function isEmbeddingAvailable(): boolean {
   return extractor !== null && manager !== null
 }
 
+/** Reported on /api/health so an amplitude fallback is never mistaken for real
+ *  diarization.
+ *
+ *  `state` is the RUNTIME truth (isEmbeddingAvailable), not "is a model file on
+ *  disk". Those diverge in both directions: a model deleted after a successful
+ *  load leaves diarization working from memory, and a model present alongside a
+ *  broken/ABI-mismatched sherpa-onnx never loads at all. `error` distinguishes
+ *  that second case — a model is installed but the runtime rejected it — from a
+ *  simply unconfigured install, which otherwise look identical to an operator.
+ *
+ *  Declared after the module state it reads: hoisting it above `extractor`
+ *  would make any import-time caller throw a ReferenceError on an
+ *  unauthenticated endpoint. */
+export function speakerModelState(): {
+  state: 'active' | 'unavailable' | 'error'
+  path: string | null
+  searched: string[]
+} {
+  const path = resolveSpeakerModelPath()
+  const running = isEmbeddingAvailable()
+  const state = running ? 'active' : (path && initialized ? 'error' : 'unavailable')
+  return { state, path, searched: speakerModelCandidates() }
+}
+
 /** Compute actual cosine similarity between two raw embedding vectors */
 export function rawCosineSimilarity(a: Float32Array, b: Float32Array): number {
   if (a.length !== b.length) return 0

package/server/routes/health.ts

@@ -7,6 +7,7 @@ import { serverMetrics } from '../lib/server-metrics.js'
 import { getServerInstanceId } from '../lib/server-instance-id.js'
 import { localFirstMeetingsCapability } from '../lib/local-first-meetings-contract.js'
 import { isSileroAvailable } from '../lib/vad-silero.js'
+import { speakerModelState } from '../lib/speaker-embeddings.js'
 import { getAvailableCliSessionId } from '../lib/claude-bridge.js'
 import {
   isWhisperLocalAvailable,
@@ -176,6 +177,12 @@ healthRouter.get('/health', async (_req, res) => {
 
   checks.silero_vad = isSileroAvailable() ? 'active' : 'disabled'
 
+  // Speaker diarization is opt-in (the ~26 MB voiceprint model ships outside the
+  // npm tarball), so publish its state rather than letting the amplitude
+  // fallback masquerade as working diarization. Availability only — the resolved
+  // path is a local filesystem detail and health is unauthenticated.
+  checks.speaker_id = speakerModelState().state
+
   // Health is unauthenticated. Publish only availability; the actual CLI
   // session id is a resumable runtime handle and belongs on authenticated
   // query/debug surfaces.

package/server/routes/message-ref.ts

@@ -6,7 +6,7 @@
 // fresh client continues the sequence instead of reusing numbers.
 //
 //   GET /api/message/:num     → { globalMsgNum, date, query, response }  (404 when unknown)
-//   GET /api/message-counter  → { max }
+//   GET /api/message-counter  → { max, era }
 //
 // Resolution order (per the prompt-queue/archive plan): live in-memory
 // sessions first (covers the mirror's 15-minute lag), then day archives
@@ -19,6 +19,11 @@ import { getActiveSessions } from '../lib/conversation.js'
 import { dataPath } from '../lib/data-dir.js'
 import { localDay } from '../lib/local-day.js'
 import { mergeMediaAttachmentRefs, type MediaAttachmentRef } from '../../shared/media-attachment.js'
+import {
+  LEGACY_MESSAGE_ERA,
+  currentMessageEra,
+  exchangeBelongsToEra,
+} from '../lib/message-era.js'
 
 // v6.3.0 — read archives from the SAME persistent location the archive-mirror
 // writes to (~/.cos-glasses/data/archive via dataPath), not a package-relative
@@ -40,6 +45,7 @@ interface ExchangeLike {
   content?: string
   timestamp?: number
   globalMsgNum?: number
+  messageEra?: string
   attachments?: unknown
 }
 
@@ -60,9 +66,16 @@ function pairExchange(exchanges: ExchangeLike[], i: number): { query: string; re
   }
 }
 
-function scanExchanges(exchanges: ExchangeLike[], num: number, date: string): ResolvedGlobalMessage | null {
+function scanExchanges(
+  exchanges: ExchangeLike[],
+  num: number,
+  date: string,
+  /** Pass null to match any era (post-reset short-ref fallback). */
+  era: string | null = currentMessageEra(),
+): ResolvedGlobalMessage | null {
   for (let i = 0; i < exchanges.length; i++) {
     if (exchanges[i]?.globalMsgNum !== num) continue
+    if (era != null && !exchangeBelongsToEra(exchanges[i] ?? {}, era)) continue
     const { query, response, attachments } = pairExchange(exchanges, i)
     return {
       globalMsgNum: num, date, query, response,
@@ -74,7 +87,11 @@ function scanExchanges(exchanges: ExchangeLike[], num: number, date: string): Re
 
 /** Resolve a global message number from the day archives, newest-first.
  *  Exported with an explicit dir for tests. */
-export function resolveFromArchiveDir(dir: string, num: number): ResolvedGlobalMessage | null {
+export function resolveFromArchiveDir(
+  dir: string,
+  num: number,
+  era: string | null = LEGACY_MESSAGE_ERA,
+): ResolvedGlobalMessage | null {
   let files: string[] = []
   try {
     files = readdirSync(dir).filter((f) => /^\d{4}-\d{2}-\d{2}\.json$/.test(f)).sort().reverse()
@@ -87,7 +104,12 @@ export function resolveFromArchiveDir(dir: string, num: number): ResolvedGlobalM
       const chats = Array.isArray(day?.chats) ? day.chats : []
       for (const chat of chats) {
         const exchanges = Array.isArray(chat?.exchanges) ? chat.exchanges : []
-        const hit = scanExchanges(exchanges, num, typeof day?.date === 'string' ? day.date : f.slice(0, 10))
+        const hit = scanExchanges(
+          exchanges,
+          num,
+          typeof day?.date === 'string' ? day.date : f.slice(0, 10),
+          era,
+        )
         if (hit) return hit
       }
     } catch {
@@ -143,8 +165,8 @@ export function getArchiveChatMessagesNumbered(date: string, chatIndex: number)
   return readArchiveChatNumbered(ARCHIVE_DIR, date, chatIndex)
 }
 
-/** Highest stamped number across the day archives (0 when none). */
-export function maxGlobalMsgNumInDir(dir: string): number {
+/** Highest stamped number across the day archives for one era (0 when none). */
+export function maxGlobalMsgNumInDir(dir: string, era = LEGACY_MESSAGE_ERA): number {
   let max = 0
   let files: string[] = []
   try {
@@ -157,6 +179,7 @@ export function maxGlobalMsgNumInDir(dir: string): number {
       const day = JSON.parse(readFileSync(resolve(dir, f), 'utf8'))
       for (const chat of Array.isArray(day?.chats) ? day.chats : []) {
         for (const ex of Array.isArray(chat?.exchanges) ? chat.exchanges : []) {
+          if (!exchangeBelongsToEra(ex ?? {}, era)) continue
           if (typeof ex?.globalMsgNum === 'number' && ex.globalMsgNum > max) max = ex.globalMsgNum
         }
       }
@@ -165,11 +188,14 @@ export function maxGlobalMsgNumInDir(dir: string): number {
   return max
 }
 
-function resolveFromLiveSessions(num: number): ResolvedGlobalMessage | null {
+function resolveFromLiveSessions(
+  num: number,
+  era: string | null = currentMessageEra(),
+): ResolvedGlobalMessage | null {
   const today = localDay() // local calendar day, not UTC — a live ref in the user's evening must not label tomorrow
   for (const session of getActiveSessions()) {
     const exchanges = (session as { exchanges?: ExchangeLike[] }).exchanges ?? []
-    const hit = scanExchanges(exchanges, num, today)
+    const hit = scanExchanges(exchanges, num, today, era)
     if (hit) return hit
   }
   return null
@@ -183,7 +209,13 @@ messageRefRouter.get('/message/:num', (req, res) => {
     res.status(400).json({ error: 'invalid message number' })
     return
   }
-  const hit = resolveFromLiveSessions(num) ?? resolveFromArchiveDir(ARCHIVE_DIR, num)
+  // Prefer the current era so short refs stay unambiguous after a reset.
+  // Fall back across eras so "recall message 562" still works for pre-reset
+  // stamps once numbering restarts at #1.
+  const hit = resolveFromLiveSessions(num)
+    ?? resolveFromArchiveDir(ARCHIVE_DIR, num, currentMessageEra())
+    ?? resolveFromLiveSessions(num, null)
+    ?? resolveFromArchiveDir(ARCHIVE_DIR, num, null)
   if (!hit) {
     res.status(404).json({ error: `message ${num} not found` })
     return
@@ -192,11 +224,13 @@ messageRefRouter.get('/message/:num', (req, res) => {
 })
 
 messageRefRouter.get('/message-counter', (_req, res) => {
+  const era = currentMessageEra()
   let liveMax = 0
   for (const session of getActiveSessions()) {
     for (const ex of ((session as { exchanges?: ExchangeLike[] }).exchanges ?? [])) {
+      if (!exchangeBelongsToEra(ex, era)) continue
       if (typeof ex?.globalMsgNum === 'number' && ex.globalMsgNum > liveMax) liveMax = ex.globalMsgNum
     }
   }
-  res.json({ max: Math.max(liveMax, maxGlobalMsgNumInDir(ARCHIVE_DIR)) })
+  res.json({ max: Math.max(liveMax, maxGlobalMsgNumInDir(ARCHIVE_DIR, era)), era })
 })

package/server/routes/prompt-drafts.ts

@@ -13,6 +13,7 @@ import {
   markPromptDraftError,
   getMissingChunkIndexes,
   prunePromptDrafts,
+  transcriptQualityRank,
   type PromptDraftTranscriptRecord,
 } from '../lib/prompt-draft-store.js'
 import {
@@ -22,6 +23,7 @@ import {
   OpenAIWhisperBudgetExhaustedError,
   TranscriptionUnavailableError,
 } from '../lib/transcribe-audio.js'
+import { getHighQualityTranscriptionCapability } from '../lib/whisper-local.js'
 import {
   stripInlineHallucinationsOneShot,
   stripInlineHallucinations,
@@ -191,16 +193,31 @@ async function transcribeChunk(draftId: string, chunkIndex: number, audio: Buffe
         const current = loadPromptDraftMeta(draftId)
         const warm = current?.warmTranscripts?.[String(chunkIndex)]
         const cachedFinal = current?.finalTranscripts?.[String(chunkIndex)]
-        if (!cachedFinal || cachedFinal.hash !== hash) {
-          await markPromptDraftChunkTranscript(draftId, chunkIndex, {
-            text,
-            hash,
-            requestedMode: warm?.requestedMode ?? mode,
-            actualQuality: warm?.actualQuality ?? (mode === 'hq' ? 'hq' : 'fast'),
-            backend: warm?.backend ?? 'shared-inflight',
-            degraded: warm?.degraded ?? false,
-            ...(warm?.degradationReason ? { degradationReason: warm.degradationReason } : {}),
-          }, 'final')
+        // Trust the shared job text + mode key. Warm metadata is only used when
+        // it still matches this decode — a late Fast warm must not relabel HQ.
+        const warmMatches = Boolean(
+          warm
+          && warm.hash === hash
+          && warm.requestedMode === mode
+          && warm.text === text,
+        )
+        const record: PromptDraftTranscriptRecord = {
+          text,
+          hash,
+          requestedMode: mode,
+          actualQuality: warmMatches
+            ? warm!.actualQuality
+            : (mode === 'hq' ? 'hq' : 'fast'),
+          backend: warmMatches ? warm!.backend : 'shared-inflight',
+          degraded: warmMatches ? warm!.degraded : false,
+          ...(warmMatches && warm!.degradationReason ? { degradationReason: warm!.degradationReason } : {}),
+        }
+        if (
+          !cachedFinal
+          || cachedFinal.hash !== hash
+          || transcriptQualityRank(cachedFinal.actualQuality) < transcriptQualityRank(record.actualQuality)
+        ) {
+          await markPromptDraftChunkTranscript(draftId, chunkIndex, record, 'final')
         }
       }
       return text
@@ -245,6 +262,22 @@ async function transcribeChunk(draftId: string, chunkIndex: number, audio: Buffe
   return job
 }
 
+function isReusableTranscript(
+  cached: PromptDraftTranscriptRecord | undefined,
+  hash: string,
+  mode: 'hq' | 'fast',
+): boolean {
+  if (!cached || cached.hash !== hash || cached.requestedMode !== mode) return false
+  if (cached.backend.startsWith('legacy')) return false
+  if (mode === 'fast') return cached.actualQuality === 'fast' || cached.actualQuality === 'cloud'
+  // mode === 'hq'
+  if (cached.actualQuality === 'hq' || cached.actualQuality === 'cloud') return true
+  // Degraded turbo after an HQ request: retry when large-v3 can still run.
+  // If HQ is unavailable, reuse to avoid a pointless second turbo decode.
+  if (cached.actualQuality === 'fast') return !getHighQualityTranscriptionCapability().hqAvailable
+  return false
+}
+
 async function finalizeDraft(draftId: string, mode: 'hq' | 'fast', autoClean: AutoCleanRequest, signal?: AbortSignal) {
   const meta = loadPromptDraftMeta(draftId)
   if (!meta) throw Object.assign(new Error('draft not found'), { status: 404 })
@@ -262,17 +295,11 @@ async function finalizeDraft(draftId: string, mode: 'hq' | 'fast', autoClean: Au
       }
       const current = loadPromptDraftMeta(draftId)
       const cached = current?.finalTranscripts?.[String(chunk.chunkIndex)] ?? current?.warmTranscripts?.[String(chunk.chunkIndex)]
-      // Reuse the exact requested-mode decode even when HQ truthfully degraded
-      // to turbo. Finalize's automatic policy would make the same local choice
-      // again after a successful turbo result, so a second decode adds latency
-      // without improving quality. Legacy records stay excluded because their
-      // decoder provenance was reconstructed during migration.
-      const reusable = Boolean(
-        cached
-        && cached.hash === hash
-        && cached.requestedMode === mode
-        && !cached.backend.startsWith('legacy'),
-      )
+      // Reuse only a decode that still matches the requested mode's quality bar.
+      // When Settings HQ is available, never treat a degraded turbo warm as final
+      // — that left finished chats on Fast text while REVIEW looked "HQ ready".
+      // Legacy records stay excluded (reconstructed provenance).
+      const reusable = isReusableTranscript(cached, hash, mode)
       const raw = reusable ? cached!.text : await transcribeChunk(draftId, chunk.chunkIndex, chunk.audioBuffer, mode, 'final')
       const text = sanitizeTranscript(draftId, raw, !reusable)
       if (text.trim()) {

package/server/routes/query.ts

@@ -18,6 +18,7 @@ import {
   MaintenanceLifecycleError,
   maintenanceErrorPayload,
 } from '../lib/maintenance-lifecycle.js'
+import { currentMessageEra, LEGACY_MESSAGE_ERA } from '../lib/message-era.js'
 
 const TOOL_STATUS_MESSAGES: Record<string, string> = {
   WebSearch: 'Searching web...',
@@ -38,7 +39,7 @@ queryRouter.post('/query', async (req, res) => {
     }
     throw error
   }
-  const { query, sessionId, model, effort, reference, globalMsgNum } = req.body
+  const { query, sessionId, model, effort, reference, globalMsgNum, messageEra } = req.body
   const activityToolMode = req.body.activityToolMode === 'off' || req.body.activityToolMode === 'preview'
     ? req.body.activityToolMode
     : 'status'
@@ -46,6 +47,24 @@ queryRouter.post('/query', async (req, res) => {
   // omit/unknown must not silently force Ask (6.16.3 durable-only gap).
   const cursorExecutionMode = req.body.cursorExecutionMode === 'ask' ? 'ask' as const : 'agent' as const
 
+  // Once a reset era exists, reject pre-era clients before they can stamp a
+  // five-digit number into the fresh namespace. Companion learns the era from
+  // /api/message-counter and includes it on every query.
+  const activeMessageEra = currentMessageEra()
+  if (activeMessageEra !== LEGACY_MESSAGE_ERA && messageEra !== activeMessageEra) {
+    console.warn('[query] message era mismatch', {
+      sessionId: typeof sessionId === 'string' ? sessionId : undefined,
+      sentEra: typeof messageEra === 'string' ? messageEra : '(missing)',
+      expectedEra: activeMessageEra,
+    })
+    maintenanceLease.release()
+    return res.status(409).json({
+      error: 'message_era_mismatch',
+      detail: 'Reopen or update COS Glasses to start the fresh message list.',
+      era: activeMessageEra,
+    })
+  }
+
   // Resolve durable attachment ids and legacy base64 images through one
   // validation/normalization path before opening SSE.
   let resolvedAttachments

package/server/routes/sessions.ts

@@ -2,12 +2,13 @@
 import { Router } from 'express'
 import { readFileSync } from 'fs'
 import { join } from 'path'
-import { getRecentSessions, getHistory, sessionExists, addContextBreak, endSession, getSessionRaw, getActiveSessions } from '../lib/conversation.js'
+import { getRecentSessions, getHistory, sessionExists, addContextBreak, endSession, getSessionRaw, getActiveSessions, resolveExchangePairModel } from '../lib/conversation.js'
 import { buildSessionLogEntry, writeSessionLog } from '../lib/session-log.js'
 import { getArchiveDayMessages } from '../lib/archive.js'
 import { localDay } from '../lib/local-day.js'
 import { clearCodexEngineSession } from '../lib/codex-engine-sessions.js'
 import { mergeMediaAttachmentRefs, type MediaAttachmentRef } from '../../shared/media-attachment.js'
+import { currentMessageEra, exchangeBelongsToEra } from '../lib/message-era.js'
 
 export const sessionsRouter = Router()
 
@@ -57,20 +58,24 @@ sessionsRouter.get('/sessions/:id/messages', (req, res) => {
     timestamp: number
     no?: number
     sessionId: string
+    modelPreference?: string
     attachments?: MediaAttachmentRef[]
   }> = []
+  const session = getSessionRaw(req.params.id)
   for (let i = 0; i < exchanges.length; i++) {
     const ex = exchanges[i]
     if (ex.role === 'user') {
       const next = exchanges[i + 1]
       if (next && next.role === 'assistant') {
         const attachments = mergeMediaAttachmentRefs(ex.attachments, next.attachments)
+        const modelPreference = resolveExchangePairModel(ex, next, session?.modelPreference)
         messages.push({
           query: ex.content,
           text: next.content,
           timestamp: next.timestamp,
           sessionId: req.params.id,
           ...((ex.globalMsgNum ?? next.globalMsgNum) != null ? { no: ex.globalMsgNum ?? next.globalMsgNum } : {}),
+          ...(modelPreference ? { modelPreference } : {}),
           ...(attachments.length > 0 ? { attachments } : {}),
         })
         i++ // skip the assistant exchange
@@ -241,11 +246,14 @@ sessionsRouter.get('/sessions/today/live-chats', (_req, res) => {
 // back to the archived chat's sessionId via getArchiveDayMessages.
 sessionsRouter.get('/sessions/today/all-messages', (_req, res) => {
   const todayDate = localDay()
+  const era = currentMessageEra()
 
-  const archivedMessages = getArchiveDayMessages(todayDate).map(m => ({
-    ...m,
-    source: 'archive' as const,
-  }))
+  const archivedMessages = getArchiveDayMessages(todayDate)
+    .filter(m => exchangeBelongsToEra(m, era))
+    .map(m => ({
+      ...m,
+      source: 'archive' as const,
+    }))
 
   const liveMessages: Array<{
     query: string
@@ -255,6 +263,9 @@ sessionsRouter.get('/sessions/today/all-messages', (_req, res) => {
     sessionId: string
     source: 'live'
     no?: number
+    globalMsgNum?: number
+    messageEra?: string
+    modelPreference?: string
     attachments?: MediaAttachmentRef[]
   }> = []
   const liveSessions = getActiveSessions()
@@ -264,9 +275,13 @@ sessionsRouter.get('/sessions/today/all-messages', (_req, res) => {
     for (let i = 0; i < session.exchanges.length; i++) {
       const ex = session.exchanges[i]
       if (ex.role === 'user') {
+        if (!exchangeBelongsToEra(ex, era)) continue
         const next = session.exchanges[i + 1]
         if (next && next.role === 'assistant') {
           const attachments = mergeMediaAttachmentRefs(ex.attachments, next.attachments)
+          const globalMsgNum = ex.globalMsgNum ?? next.globalMsgNum
+          const messageEra = ex.messageEra ?? next.messageEra
+          const modelPreference = resolveExchangePairModel(ex, next, session.modelPreference)
           liveMessages.push({
             query: ex.content,
             text: next.content,
@@ -274,7 +289,9 @@ sessionsRouter.get('/sessions/today/all-messages', (_req, res) => {
             chatIndex: -1,
             sessionId: session.id,
             source: 'live',
-            ...((ex.globalMsgNum ?? next.globalMsgNum) != null ? { no: ex.globalMsgNum ?? next.globalMsgNum } : {}),
+            ...(globalMsgNum != null ? { no: globalMsgNum, globalMsgNum } : {}),
+            ...(messageEra ? { messageEra } : {}),
+            ...(modelPreference ? { modelPreference } : {}),
             ...(attachments.length > 0 ? { attachments } : {}),
           })
           i++

package/server/routes/voice.ts

@@ -8,6 +8,7 @@ import { fileURLToPath } from 'node:url'
 import { enrollSpeaker, isEnrolled, getAllSpeakerNames, identifySpeaker, extractEmbedding, enrollEmbedding, rawCosineSimilarity, getEmbeddingCount } from '../lib/speaker-embeddings.js'
 import { statSync } from 'node:fs'
 import { trainFromFireflies, getTrainingStatus } from '../lib/speaker-trainer.js'
+import { getOwnerSpeakerLabel } from '../lib/profile.js'
 
 const __dirname = fileURLToPath(new URL('.', import.meta.url))
 const AUDIO_SAVE_DIR = resolve(__dirname, '..', 'data', 'training-audio')
@@ -18,7 +19,10 @@ export const voiceRouter = Router()
 // POST /api/voice/enroll — accept WAV audio, extract embedding, store as profile
 voiceRouter.post('/voice/enroll', async (req, res) => {
   try {
-    const name = (req.query.name as string) || 'MU'
+    // Default to the configured wearer label ('Me' unless owner_speaker_label
+    // is set). Hardcoding one user's initials here enrolled every other install
+    // under a stranger's name.
+    const name = (req.query.name as string) || getOwnerSpeakerLabel()
 
     // Collect raw audio body
     const buffers: Buffer[] = []
@@ -38,10 +42,12 @@ voiceRouter.post('/voice/enroll', async (req, res) => {
   }
 })
 
-// GET /api/voice/status — is MU enrolled?
+// GET /api/voice/status — is the wearer enrolled?
 voiceRouter.get('/voice/status', (_req, res) => {
+  const owner = getOwnerSpeakerLabel()
   res.json({
-    enrolled: isEnrolled('MU'),
+    owner,
+    enrolled: isEnrolled(owner),
     speakers: getAllSpeakerNames(),
   })
 })