@gotcos/glasses-server 6.17.0 → 6.18.1

package/server/lib/whisper-metal-gate.ts

@@ -0,0 +1,207 @@
+// GPU admission control for post-meeting batch HQ transcription.
+//
+// THE PROBLEM: Miles goes meeting -> meeting. Meeting A's post-save HQ polish
+// (whisper-cli large-v3) often overlaps Meeting B's live ASR. Both want Metal.
+// 6.14.1 fixed the clash bluntly by pinning batch to CPU forever, which taxes
+// every idle polish to protect the overlap case.
+//
+// THE INVARIANT: never Metal+Metal. Live always wins admission. Batch still
+// progresses on busy days, just on CPU. Metal is used only when the operator
+// has opted in AND nothing live is contending.
+//
+// NO CIRCULAR IMPORT: transcribe-stream REGISTERS its live-activity probe here;
+// this module never imports the stream, and whisper-local imports only this.
+
+import type { ChildProcess } from 'node:child_process'
+import { maintenanceLifecycle } from './maintenance-lifecycle.js'
+
+/** Recent-activity window. A session counts as live only if it has been active
+ *  inside this window. Anything colder is treated as an ORPHAN and must NOT pin
+ *  batch to CPU — proven necessary: an active-sessions file sat untouched for
+ *  3+ hours on 2026-07-27, and an "any session in the map" rule would have
+ *  pinned batch to CPU until a server restart, silently, forever. */
+export const LIVE_ACTIVITY_WINDOW_MS = 180_000
+
+/** Maintenance kinds that own the same Metal family as batch HQ. */
+const METAL_FAMILY_WORK_KINDS = [
+  'recording_chunk',
+  'one_shot_transcription',
+  'prompt_draft_warm',
+  'prompt_draft_finalize',
+] as const
+
+export type BatchDevice = 'metal' | 'cpu'
+
+export type ContentionReason =
+  | 'session_recent'
+  | 'recording_chunk'
+  | 'one_shot_transcription'
+  | 'prompt_draft_warm'
+  | 'prompt_draft_finalize'
+  | 'metal_batch_in_flight'
+
+export type DeviceReason =
+  | 'force_cpu'
+  | 'metal_opt_out'
+  | ContentionReason
+  | 'idle'
+
+export interface BatchDeviceDecision {
+  device: BatchDevice
+  reason: DeviceReason
+  metalEnabled: boolean
+}
+
+// ── Env ──────────────────────────────────────────────────────────────────────
+
+/** Blunt rollback. Wins over everything, and keeps working after the default
+ *  eventually flips to Metal-on. */
+export function batchHqForceCpu(): boolean {
+  return process.env.COS_BATCH_HQ_FORCE_CPU === '1'
+}
+
+/** Metal batch is OPT-IN (3B). Default stays always-CPU — today's proven
+ *  behavior — until a meeting-to-meeting smoke passes. Read live, not at module
+ *  load, so tests and Control-updated env are visible. */
+export function batchHqMetalEnabled(): boolean {
+  return !batchHqForceCpu() && process.env.COS_BATCH_HQ_METAL === '1'
+}
+
+// ── Injected live-activity probe ─────────────────────────────────────────────
+
+type LiveActivityProbe = () => number | null
+
+let liveActivityProbe: LiveActivityProbe | null = null
+
+/** transcribe-stream calls this at module load. Returns the most recent
+ *  lastActivityAt across in-memory sessions, or null when there are none. */
+export function registerLiveActivityProbe(probe: LiveActivityProbe): void {
+  liveActivityProbe = probe
+}
+
+/** Test seam — clears the probe and any tracked children. */
+export function resetMetalGateForTests(): void {
+  liveActivityProbe = null
+  metalChildren.clear()
+}
+
+function recentSessionActivity(now: number): boolean {
+  if (!liveActivityProbe) return false
+  let last: number | null = null
+  try {
+    last = liveActivityProbe()
+  } catch {
+    // A probe failure must fail SAFE (assume contended): a wrong "idle" starts
+    // a Metal batch against a live meeting, which is the one thing this whole
+    // module exists to prevent. A wrong "busy" only costs batch speed.
+    return true
+  }
+  if (last == null || !Number.isFinite(last)) return false
+  return now - last < LIVE_ACTIVITY_WINDOW_MS
+}
+
+function activeMetalFamilyWork(): ContentionReason | null {
+  let byKind: Record<string, number>
+  try {
+    byKind = maintenanceLifecycle.snapshot().activeByKind as Record<string, number>
+  } catch {
+    return 'recording_chunk' // fail safe, same reasoning as above
+  }
+  for (const kind of METAL_FAMILY_WORK_KINDS) {
+    if ((byKind[kind] ?? 0) > 0) return kind
+  }
+  return null
+}
+
+/** Is something live currently entitled to Metal? */
+export function isLiveMetalContended(now: number = Date.now()): { contended: boolean; reason: ContentionReason | null } {
+  const work = activeMetalFamilyWork()
+  if (work) return { contended: true, reason: work }
+  if (recentSessionActivity(now)) return { contended: true, reason: 'session_recent' }
+  if (metalChildren.size > 0) return { contended: true, reason: 'metal_batch_in_flight' }
+  return { contended: false, reason: null }
+}
+
+/** Device for the NEXT batch segment. Re-evaluated per segment so a meeting
+ *  that starts mid-batch moves subsequent segments to CPU without a preempt. */
+export function chooseBatchDevice(now: number = Date.now()): BatchDeviceDecision {
+  if (batchHqForceCpu()) return { device: 'cpu', reason: 'force_cpu', metalEnabled: false }
+  const metalEnabled = batchHqMetalEnabled()
+  if (!metalEnabled) return { device: 'cpu', reason: 'metal_opt_out', metalEnabled: false }
+  const { contended, reason } = isLiveMetalContended(now)
+  if (contended) return { device: 'cpu', reason: reason ?? 'session_recent', metalEnabled: true }
+  return { device: 'metal', reason: 'idle', metalEnabled: true }
+}
+
+// ── Metal child registry + preempt ───────────────────────────────────────────
+
+interface MetalChildEntry {
+  proc: ChildProcess
+  /** Set by the owner so the close handler can DISCARD partial output rather
+   *  than resolving a truncated transcript into a saved meeting. */
+  markPreempted: (reason: string) => void
+  escalate?: ReturnType<typeof setTimeout>
+}
+
+const metalChildren = new Map<ChildProcess, MetalChildEntry>()
+
+/** whisper-local registers ONLY Metal-device HQ children. CPU children are
+ *  deliberately absent: they do not contend for the GPU, so preempting them
+ *  would slow batch for no benefit. */
+export function registerMetalBatchChild(proc: ChildProcess, markPreempted: (reason: string) => void): void {
+  metalChildren.set(proc, { proc, markPreempted })
+}
+
+export function unregisterMetalBatchChild(proc: ChildProcess): void {
+  const entry = metalChildren.get(proc)
+  if (entry?.escalate) clearTimeout(entry.escalate)
+  metalChildren.delete(proc)
+}
+
+export function metalBatchInFlight(): boolean {
+  return metalChildren.size > 0
+}
+
+/**
+ * Live work needs the GPU: kill every in-flight Metal batch child.
+ *
+ * Idempotent — a child already preempted is skipped, so the create-path hook
+ * and the recording_chunk backstop can both fire without double-killing.
+ * Returns how many children were preempted (0 is the overwhelmingly common
+ * case: no Metal batch running, or Metal not opted in at all).
+ */
+export function preemptMetalBatchForLive(reason: string): number {
+  if (metalChildren.size === 0) return 0
+  let preempted = 0
+  for (const entry of [...metalChildren.values()]) {
+    if (entry.escalate) continue // already preempted, escalation pending
+    preempted++
+    // Mark FIRST: the close handler must see the preempt flag before the signal
+    // lands, or it could treat a truncated run as a clean exit.
+    try { entry.markPreempted(reason) } catch { /* never block the kill */ }
+    try { entry.proc.kill('SIGTERM') } catch { /* already exited */ }
+    entry.escalate = setTimeout(() => {
+      try { entry.proc.kill('SIGKILL') } catch { /* already exited */ }
+    }, 2_000)
+    entry.escalate.unref?.()
+  }
+  if (preempted > 0) {
+    console.log(`[metal-gate] Preempted ${preempted} Metal batch child(ren) for live work (${reason})`)
+  }
+  return preempted
+}
+
+/** Distinguishable error so the batch pipeline can retry the SAME segment on
+ *  CPU instead of treating it as a generic transcription failure. */
+export class MetalBatchPreemptedError extends Error {
+  readonly preempted = true
+  constructor(readonly preemptReason: string) {
+    super(`Metal batch preempted by live work (${preemptReason})`)
+    this.name = 'MetalBatchPreemptedError'
+  }
+}
+
+export function isMetalBatchPreempted(error: unknown): error is MetalBatchPreemptedError {
+  return error instanceof MetalBatchPreemptedError
+    || (typeof error === 'object' && error !== null && (error as { preempted?: boolean }).preempted === true)
+}

package/server/routes/health.ts

@@ -36,6 +36,7 @@ import { managedRuntimeCapability, managedServerVersion } from '../lib/managed-r
 import { getServerGenerationId } from '../lib/managed-runtime.js'
 import { maintenanceLifecycle } from '../lib/maintenance-lifecycle.js'
 import { getLocalTtsHealth, refreshLocalTtsHealth } from '../lib/tts-local.js'
+import { liveCuesCapability } from '../lib/live-cues-capability.js'
 
 export const healthRouter = Router()
 
@@ -203,6 +204,9 @@ healthRouter.get('/health', async (_req, res) => {
   const recovery = managedRuntimeCapability()
   const maintenance = maintenanceLifecycle.snapshot()
   const tts_local = getLocalTtsHealth()
+  // Computed once per request; the same value feeds features.liveCues and
+  // capabilities.liveCues so the two surfaces can never disagree.
+  const liveCues = liveCuesCapability()
   const features = {
     claude: claudeAvailable,
     codex: codexAvailable,
@@ -219,6 +223,7 @@ healthRouter.get('/health', async (_req, res) => {
     durableQueryJobsProtocol: durableJobs.protocolVersion,
     localFirstMeetings: localFirstMeetings !== null,
     transcriptionPolicy: transcription.mode,
+    liveCues: liveCues.available,
   }
   const voice = {
     available: keyStatus.hasKey || tts_local.ready,
@@ -277,6 +282,7 @@ healthRouter.get('/health', async (_req, res) => {
         carriedAcrossBoot: maintenance.operation?.carriedAcrossBoot ?? false,
       },
       cliDebug: CLI_DEBUG_CAPABILITY,
+      liveCues,
       ...(localFirstMeetings ? { localFirstMeetings } : {}),
     },
     // /api/health is intentionally unauthenticated for setup diagnostics.
@@ -319,6 +325,10 @@ healthRouter.get('/models', async (req, res) => {
       transcription: { ...transcription, hq: transcriptionHq },
       cliDebug: CLI_DEBUG_CAPABILITY,
       recovery: managedRuntimeCapability(),
+      // Same helper as /api/health — the companion's 15s liveness poll reads
+      // THIS surface, so a value present only on /api/health leaves the
+      // live-cues indicator blind.
+      liveCues: liveCuesCapability(),
       ...(localFirstMeetings ? { localFirstMeetings } : {}),
     },
   })

package/server/routes/live-cues.ts

@@ -0,0 +1,58 @@
+// Live Cues routes. Authenticated by the global /api X-Cos-Token middleware
+// (index.ts:148) like every other /api route — no route-local auth needed.
+//
+// POST /live-cues/start { sessionId }  -> { armed, sessionId, pipelinesUsed }
+// POST /live-cues/stop  { sessionId }  -> { nudgesGenerated, nudges }
+// GET  /live-cues/status               -> engine snapshot + capability
+
+import { Router } from 'express'
+import { errMsg } from '../lib/utils.js'
+import {
+  armLiveCues,
+  disarmLiveCues,
+  getLiveCuesStatus,
+  LiveCuesArmError,
+} from '../lib/live-cues-engine.js'
+import { liveCuesCapability } from '../lib/live-cues-capability.js'
+
+export const liveCuesRouter = Router()
+
+liveCuesRouter.post('/live-cues/start', async (req, res) => {
+  const sessionId = typeof (req.body as { sessionId?: unknown })?.sessionId === 'string'
+    ? String((req.body as { sessionId: string }).sessionId).trim()
+    : ''
+  // A start with no sessionId is refused, never silently armed on a global
+  // counter — the per-meeting cap is only real when it is session-scoped.
+  if (!sessionId || !/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) {
+    return res.status(400).json({ error: 'sessionId required', reason: 'missing_session_id' })
+  }
+  try {
+    const result = await armLiveCues(sessionId)
+    return res.json(result)
+  } catch (error) {
+    if (error instanceof LiveCuesArmError) {
+      return res.status(error.status).json({ error: error.message, reason: error.code })
+    }
+    return res.status(500).json({ error: errMsg(error) })
+  }
+})
+
+liveCuesRouter.post('/live-cues/stop', (req, res) => {
+  const sessionId = typeof (req.body as { sessionId?: unknown })?.sessionId === 'string'
+    ? String((req.body as { sessionId: string }).sessionId).trim()
+    : ''
+  if (!sessionId) {
+    return res.status(400).json({ error: 'sessionId required', reason: 'missing_session_id' })
+  }
+  // Shape matches the existing client stop handler: it reads nudgesGenerated
+  // for its log line and hydrates meetingNudgeHistory from nudges when SSE
+  // missed events (the 200-event replay buffer is flooded by transcript_chunk).
+  return res.json(disarmLiveCues(sessionId))
+})
+
+liveCuesRouter.get('/live-cues/status', (_req, res) => {
+  res.json({
+    capability: liveCuesCapability(),
+    sessions: getLiveCuesStatus(),
+  })
+})

package/server/routes/meeting.ts

@@ -41,6 +41,13 @@ import {
 } from './transcribe-stream.js'
 import { getServerInstanceId } from '../lib/server-instance-id.js'
 import { acquireMaintenanceWork, type MaintenanceWorkLease } from '../lib/maintenance-lifecycle.js'
+import { handoffMeetingToOperations } from '../lib/g2-ops-handoff.js'
+
+function cosOpsPipelineConfigured(): boolean {
+  // Read env live (not the module-load COS_SCRIPTS_DIR const) so unit tests that
+  // clear ops env stay standalone, and Control-updated env is visible.
+  return Boolean(process.env.COS_SCRIPTS_DIR?.trim())
+}
 
 interface MeetingSessionSource {
   getTranscript(sessionId: string): string | null
@@ -313,24 +320,48 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
           allowDuringDrain: true,
           phase: 'queued',
         })
-        const task = Promise.resolve().then(() => {
+        const task = Promise.resolve().then(async () => {
           batchLease.setPhase('active')
-          return finalizeBatch({
-            audioDir: pendingAudioDir,
-            entries: chunkEntries.map(entry => ({ ...entry, chunk: { ...entry.chunk } })),
-            streamingWordCount: countWords(transcript),
-            meetingPath: saved.filepath,
-            sidecarPath: saved.sidecarPath,
-            runBatch,
-          })
+          try {
+            await finalizeBatch({
+              audioDir: pendingAudioDir,
+              entries: chunkEntries.map(entry => ({ ...entry, chunk: { ...entry.chunk } })),
+              streamingWordCount: countWords(transcript),
+              meetingPath: saved.filepath,
+              sidecarPath: saved.sidecarPath,
+              runBatch,
+            })
+          } catch (error) {
+            // Raw audio deliberately remains for bounded cleanup / retry.
+            console.error(
+              `[meeting/save] Batch finalization failed for ${sessionId}: `
+              + `${error instanceof Error ? error.message : String(error)}`,
+            )
+          }
+          // Always hand off the durable local scribe (streaming or batch) into
+          // operations/ when COS pipeline is configured — this is what was
+          // missing on managed public server and left today's G2 files unsynced.
+          if (cosOpsPipelineConfigured()) {
+            await handoffMeetingToOperations(saved.filepath)
+          }
         }).catch(error => {
-          // Raw audio deliberately remains for the existing two-hour cleanup.
           console.error(
-            `[meeting/save] Batch finalization failed for ${sessionId}: `
+            `[meeting/save] G2 ops handoff failed for ${sessionId}: `
             + `${error instanceof Error ? error.message : String(error)}`,
           )
         }).finally(() => batchLease.release())
         scheduleBackground(task)
+      } else if (cosOpsPipelineConfigured()) {
+        // No HQ batch (no audio / incomplete writes) — still hand off the
+        // streaming scribe into operations when COS pipeline is configured.
+        scheduleBackground(
+          handoffMeetingToOperations(saved.filepath).catch(error => {
+            console.error(
+              `[meeting/save] G2 ops handoff failed for ${sessionId}: `
+              + `${error instanceof Error ? error.message : String(error)}`,
+            )
+          }),
+        )
       }
     } catch (error) {
       if (error instanceof MeetingStoreError) {
@@ -399,7 +430,7 @@ async function finalizeBatch(options: {
   if (canDeletePendingBatchAudio(transcriptApplied, metadataPersisted)) {
     rmSync(options.audioDir, { recursive: true, force: true })
   } else {
-    console.warn('[meeting/save] Pending raw audio retained for bounded two-hour cleanup')
+    console.warn('[meeting/save] Pending raw audio retained for bounded cleanup')
   }
 }
 

package/server/routes/transcribe-stream.ts

@@ -46,8 +46,38 @@ import { getServerInstanceId } from '../lib/server-instance-id.js'
 import {
   acquireMaintenanceWork,
   maintenanceAdmissionsOpen,
+  maintenanceLifecycle,
   type MaintenanceWorkLease,
 } from '../lib/maintenance-lifecycle.js'
+import { feedLiveCueTranscript } from '../lib/live-cues-engine.js'
+import { preemptMetalBatchForLive, registerLiveActivityProbe } from '../lib/whisper-metal-gate.js'
+
+/** Preempt hook 2 of 2 (1C): the recording_chunk backstop. Live audio is
+ *  arriving, so any Metal batch must yield the GPU now. This covers recovery,
+ *  reconnect, and restart adoption — paths that reach chunk upload WITHOUT
+ *  going through session creation. Idempotent with the create hook.
+ *
+ *  Every recording_chunk lease goes through here rather than calling
+ *  acquireMaintenanceWork directly, so a future call site cannot silently skip
+ *  the preempt. Preempt runs BEFORE acquire so the GPU frees even if the drain
+ *  gate rejects the lease. */
+function acquireRecordingChunkLease(options: { allowDuringDrain?: boolean }): MaintenanceWorkLease {
+  preemptMetalBatchForLive('recording_chunk')
+  return acquireMaintenanceWork('recording_chunk', options)
+}
+
+/** Live-activity probe for the Metal gate (2B). Reports the most recent
+ *  lastActivityAt across in-memory sessions; the gate applies its own
+ *  180s window so a cold orphan cannot pin batch to CPU. Registered here to
+ *  keep the dependency one-way (stream -> gate), avoiding a circular import. */
+registerLiveActivityProbe(() => {
+  let newest: number | null = null
+  for (const session of sessions.values()) {
+    const at = session.lastActivityAt
+    if (typeof at === 'number' && Number.isFinite(at) && (newest === null || at > newest)) newest = at
+  }
+  return newest
+})
 
 function ensurePrivateDirectory(path: string): void {
   if (!existsSync(path)) mkdirSync(path, { recursive: true, mode: 0o700 })
@@ -636,11 +666,15 @@ setInterval(() => {
       }
     }
   } catch {}
-  // Purge stale pending-batch dirs older than 2 hours after move (batch should complete in minutes).
+  // Purge stale pending-batch dirs. HQ large-v3 on long meetings + Control
+  // restart can exceed 2h (2026-07-27: two sessions purged before batch).
+  // Use 12h, and never purge while a meeting_batch_finalization lease is held.
   // Age measured by _batch_pending.marker mtime (set by moveSessionAudioToPending), NOT the first
   // chunk's mtime — chunk files keep their original write-time across the atomic rename, so for
   // meetings > 1 hour, chunk mtimes would always look stale. Fallback: dir mtime for older marker-less dirs.
   try {
+    const batchBusy = ((maintenanceLifecycle.snapshot().activeByKind as Record<string, number>)
+      .meeting_batch_finalization ?? 0) > 0
     for (const dir of readdirSync(PENDING_BATCH_DIR)) {
       const dirPath = resolve(PENDING_BATCH_DIR, dir)
       try {
@@ -655,7 +689,11 @@ setInterval(() => {
           // Fallback for pre-v5.4.3 dirs: use directory ctime (changes on rename)
           ageSource = statSync(dirPath).ctimeMs
         }
-        if (Date.now() - ageSource > 2 * 60 * 60 * 1000) {
+        if (Date.now() - ageSource > 12 * 60 * 60 * 1000) {
+          if (batchBusy) {
+            console.warn(`[cleanup] Retaining stale pending-batch while batch lease held: ${dir}`)
+            continue
+          }
           rmSync(dirPath, { recursive: true, force: true })
           console.log(`[cleanup] Purged stale pending-batch: ${dir}`)
         }
@@ -700,6 +738,10 @@ export function getSession(sessionId: string): TranscriptSession {
       emptyCompletions: {},
     }
     sessions.set(sessionId, session)
+    // Preempt hook 1 of 2 (1C). CREATE ONLY — deliberately inside the `!session`
+    // branch, never on an ordinary getSession() touch, or a status read of a
+    // stale session would falsely evict a healthy Metal batch.
+    preemptMetalBatchForLive('session_create')
   }
   if (!session.providerCandidates) session.providerCandidates = {}
   if (!session.receivedIndices) session.receivedIndices = []
@@ -1538,6 +1580,11 @@ async function processStreamChunk(opts: {
   console.log(`[perf] persistSession: ${(performance.now() - tPersist).toFixed(1)}ms (${session.chunks.filter(c => c).length} chunks)`)
 
   emitDisplay({ type: 'transcript_chunk', data: { text: trimmedText, speaker, chunkIndex, elapsed, sessionId } })
+  // Live Cues feed — fire-and-forget, NEVER awaited: transcription must not
+  // block on a cue, and no LLM runs on this path. .catch() is required — a
+  // bare `void` on a rejecting promise is an unhandled rejection, which Node
+  // throws on by default. All gates live inside the feed.
+  void feedLiveCueTranscript(sessionId, trimmedText, Boolean(fallbackReason)).catch(() => {})
 
   console.log(`[perf] TOTAL request: ${(performance.now() - tReq).toFixed(1)}ms | chunk #${chunkIndex} | ${audioBuffer.length}b | rms=${Math.round(rms)} q=${isQuiet ? 1 : 0} | ${asrProvider} | "${trimmedText.slice(0, 50)}"`)
   return canonicalChunkResponse(chunk, sessionId, chunkIndex)
@@ -1571,7 +1618,7 @@ transcribeStreamRouter.post('/transcribe-stream', async (req, res) => {
     // Reject a wrong Mac before consuming or persisting any upload bytes.
     assertPinnedServerIdentity(req.get('X-COS-Server-Instance'), req.query.serverInstanceId)
     const sessionId = (req.query.sessionId as string) || `g2_${Date.now()}`
-    maintenanceLease = acquireMaintenanceWork('recording_chunk', {
+    maintenanceLease = acquireRecordingChunkLease({
       allowDuringDrain: sessions.has(sessionId),
     })
     const chunkIndex = parseInt((req.query.chunkIndex as string) || '0', 10)
@@ -1607,7 +1654,7 @@ transcribeStreamRouter.post('/transcribe-stream/offline-sessions/start', async (
     const body = req.body ?? {}
     const sessionId = String(body.sessionId ?? '')
     validateSessionId(sessionId)
-    maintenanceLease = acquireMaintenanceWork('recording_chunk', {
+    maintenanceLease = acquireRecordingChunkLease({
       allowDuringDrain: sessions.has(sessionId),
     })
     if (isSessionDeleted(sessionId)) throw makeHttpError(410, 'session is closed', 'session_closed')
@@ -1633,7 +1680,7 @@ transcribeStreamRouter.post('/transcribe-stream/offline-sessions/:sessionId/chun
     if (!isIosAsrCandidateEnabled()) throw makeHttpError(403, 'iPhone ASR candidates disabled', 'iphone_asr_disabled')
     const sessionId = String(req.params.sessionId ?? '')
     validateSessionId(sessionId)
-    maintenanceLease = acquireMaintenanceWork('recording_chunk', {
+    maintenanceLease = acquireRecordingChunkLease({
       allowDuringDrain: sessions.has(sessionId),
     })
     if (isSessionDeleted(sessionId)) throw makeHttpError(410, 'session is closed', 'session_closed')
@@ -1679,7 +1726,7 @@ transcribeStreamRouter.post('/transcribe-stream/offline-sessions/:sessionId/fina
     if (!isIosAsrCandidateEnabled()) throw makeHttpError(403, 'iPhone ASR candidates disabled', 'iphone_asr_disabled')
     const sessionId = String(req.params.sessionId ?? '')
     validateSessionId(sessionId)
-    maintenanceLease = acquireMaintenanceWork('recording_chunk', {
+    maintenanceLease = acquireRecordingChunkLease({
       allowDuringDrain: sessions.has(sessionId),
     })
     if (isSessionDeleted(sessionId)) throw makeHttpError(410, 'session is closed', 'session_closed')
@@ -1713,7 +1760,7 @@ transcribeStreamRouter.post('/transcribe-stream/candidates', async (req, res) =>
     const sessionId = String(body.sessionId ?? '')
     const chunkIndex = Number(body.chunkIndex)
     validateSessionId(sessionId)
-    maintenanceLease = acquireMaintenanceWork('recording_chunk', {
+    maintenanceLease = acquireRecordingChunkLease({
       allowDuringDrain: sessions.has(sessionId),
     })
     validateChunkIndex(chunkIndex)