@gotcos/glasses-server 6.18.0 → 6.18.1

package/.env.example

@@ -117,6 +117,24 @@ BIND_HOST=0.0.0.0
 # directory contains .telegram_config.json. Enable export explicitly:
 # COS_TELEGRAM_NOTIFICATIONS=1
 
+# ── POST-MEETING HQ TRANSCRIPTION DEVICE (optional) ──────────────────────
+# After a meeting saves, the server re-transcribes it with whisper-cli
+# large-v3 ("polish"). Since 6.14.1 that batch has run on CPU (-ng) so it can
+# never fight a live meeting's ASR for the GPU — going meeting-to-meeting, the
+# polish of meeting A overlaps the live capture of meeting B, and two Metal
+# workloads degrade each other. The tax is that idle polish is slow too.
+#
+# COS_BATCH_HQ_METAL=1 opts into GPU-when-idle: each segment picks Metal only
+# when nothing live is contending, and a meeting starting mid-batch preempts
+# the GPU immediately (the interrupted segment is discarded and retried on CPU
+# — a truncated transcript is never saved). Default is OFF; leave it unset
+# until you have run a meeting-to-meeting smoke on your own machine.
+# COS_BATCH_HQ_METAL=1
+#
+# COS_BATCH_HQ_FORCE_CPU=1 is the blunt rollback. It wins over everything and
+# keeps working if the default ever flips to Metal-on.
+# COS_BATCH_HQ_FORCE_CPU=1
+
 # ── LIVE CUES (optional — requires the FULL COS PIPELINE above) ──────────
 # Live meeting coaching cues on the lens: transcript window -> Composer
 # planner -> Qdrant -> LightRAG -> Composer insight -> coaching_nudge.

package/CHANGELOG.md

@@ -1,3 +1,31 @@
+## 6.18.1
+
+- **Post-meeting HQ polish can use the GPU when nothing live needs it — opt-in.**
+  6.14.1 stopped batch polish from fighting a live meeting for Metal by pinning
+  it to CPU forever, which also taxed every idle polish. The device is now
+  chosen per segment: Metal only when `COS_BATCH_HQ_METAL=1` **and** nothing
+  live is contending. **Default is unchanged (always CPU)** until a
+  meeting-to-meeting smoke passes on real hardware; `COS_BATCH_HQ_FORCE_CPU=1`
+  remains the blunt rollback and wins over everything.
+- **Live always wins the GPU, and a preempted segment is never half-saved.**
+  A meeting starting mid-batch preempts the Metal child two ways: on new
+  session creation (create only — an ordinary status read of a stale session
+  must not evict a healthy batch) and on `recording_chunk` lease acquire, which
+  covers recovery/reconnect paths that skip creation. The interrupted output is
+  **discarded unconditionally** — checked before the exit code, because SIGTERM
+  can race to a zero exit with partial stdout — and the same segment is retried
+  once on CPU, which cannot itself be preempted. A truncated transcript is
+  never written into a saved meeting; slow or failed beats silently wrong.
+- **Waiting is distinguished from wedging.** A session counts as live only if
+  it was active within 180s. A cold orphan cannot pin batch to CPU — an
+  `active-sessions` entry sat untouched for 3+ hours on 2026-07-27, and an
+  "any session in the map" rule would have disabled the GPU path permanently
+  and silently. Prompt ASR and one-shot transcription count as contending
+  (same Metal family), and a second Metal batch never starts while one is in
+  flight. A failing liveness probe fails safe to CPU.
+- Every batch segment logs `device`, `reason`, and `metalEnabled`, so "why was
+  polish slow today" is answerable after the fact.
+
 ## 6.18.0
 
 - **G2 save → operations sync restored on the managed public server.** After

package/managed-runtime-contract.json

@@ -18,7 +18,9 @@
     "COS_LIVE_CUES_MODEL",
     "COS_LIVE_CUES_GRAPH",
     "COS_LIVE_CUES_LIGHTRAG_RESERVE",
-    "COS_LIVE_CUES_AUTO"
+    "COS_LIVE_CUES_AUTO",
+    "COS_BATCH_HQ_METAL",
+    "COS_BATCH_HQ_FORCE_CPU"
   ],
   "maintenance": {
     "scope": "cross_boot",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.18.0",
+  "version": "6.18.1",
   "description": "COS Glasses — self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/lib/meeting-batch-transcribe.ts

@@ -6,6 +6,7 @@ import { existsSync, readFileSync, readdirSync, utimesSync, writeFileSync } from
 import { join, resolve } from 'node:path'
 import { enhanceAudio } from './audio-enhance.js'
 import { transcribeHighQuality, type WhisperWord } from './whisper-local.js'
+import { isMetalBatchPreempted } from './whisper-metal-gate.js'
 import type { IndexedTranscriptChunk } from '../routes/transcribe-stream.js'
 import {
   evaluateBatchQuality,
@@ -172,7 +173,26 @@ async function transcribeSegments(
       const combined = concatenateWavChunks(audioDir, segment.startChunkIdx, segment.endChunkIdx)
       const enhanced = await enhanceAudio(combined)
       const previousText = results.at(-1)?.text
-      const result = await transcribeHighQuality(enhanced, previousText?.slice(-250), { priority: 'batch' })
+      let result
+      try {
+        result = await transcribeHighQuality(enhanced, previousText?.slice(-250), { priority: 'batch' })
+      } catch (error) {
+        // A live meeting took the GPU mid-segment. The truncated Metal output
+        // was already discarded upstream (BLOCKER contract) — it is never
+        // accepted. Retry this SAME segment once on CPU, which cannot itself be
+        // preempted, so a busy day degrades to slow rather than to a silently
+        // missing stretch of transcript.
+        if (!isMetalBatchPreempted(error)) throw error
+        console.log(
+          `[meeting-batch] Segment ${segment.startChunkIdx}-${segment.endChunkIdx} preempted off Metal; `
+          + 'retrying once on CPU',
+        )
+        refreshPendingLease(audioDir)
+        result = await transcribeHighQuality(enhanced, previousText?.slice(-250), {
+          priority: 'batch',
+          forceCpu: true,
+        })
+      }
       const text = previousText ? stripOverlap(result.text, previousText) : result.text
       const words = result.words ?? []
       results.push({

package/server/lib/whisper-local.ts

@@ -14,6 +14,13 @@ import { homedir } from 'node:os'
 import crypto from 'node:crypto'
 import { getVocabulary, getOwnerName } from './profile.js'
 import { stripBrandUrls } from './hallucination-filter.js'
+import {
+  batchHqMetalEnabled,
+  chooseBatchDevice,
+  MetalBatchPreemptedError,
+  registerMetalBatchChild,
+  unregisterMetalBatchChild,
+} from './whisper-metal-gate.js'
 
 // Prompt hardening flags (transcription quality, 2026-05-29):
 //   COS_PROMPT_V2 — drop the trailing '.' on the vocab prompt and join prompt+context
@@ -697,7 +704,10 @@ export function parseWhisperCliFullJson(raw: string): { text: string; words: Whi
 export async function transcribeHighQuality(
   audioBuffer: Buffer,
   context?: string,
-  opts: { priority?: 'interactive' | 'batch' } = {},
+  /** forceCpu: the batch pipeline's one CPU retry after a Metal preempt. It
+   *  bypasses the gate entirely so the retry cannot itself be preempted into
+   *  an infinite loop. */
+  opts: { priority?: 'interactive' | 'batch'; forceCpu?: boolean } = {},
 ): Promise<HighQualityTranscriptionResult> {
   if (!cliAvailable) {
     // Fall back to server (no beam search available via HTTP API)
@@ -727,22 +737,33 @@ export async function transcribeHighQuality(
   try {
     writeFileSync(tmpWav, audioBuffer)
 
+    // Interactive HQ keeps Metal unconditionally — a short, user-blocking decode
+    // that is explicitly OUT of batch device policy. Only the long post-meeting
+    // batch is admission-controlled against live ASR.
+    const isBatch = opts.priority === 'batch'
+    const decision: { device: 'metal' | 'cpu'; reason: string; metalEnabled: boolean } = isBatch
+      ? (opts.forceCpu
+          ? { device: 'cpu', reason: 'preempt_retry', metalEnabled: batchHqMetalEnabled() }
+          : chooseBatchDevice())
+      : { device: 'metal', reason: 'interactive', metalEnabled: batchHqMetalEnabled() }
+    const useMetal = decision.device === 'metal'
+
     const text = await new Promise<string>((resolve, reject) => {
-      const isolateBatchFromLiveMetal = opts.priority === 'batch'
       // Interactive HQ: narrower beam (default 2) for latency. Meeting batch keeps 5.
       // Override: COS_HQ_BEAM_INTERACTIVE=N
       const interactiveBeamRaw = Number.parseInt(process.env.COS_HQ_BEAM_INTERACTIVE || '2', 10)
       const interactiveBeam = Number.isFinite(interactiveBeamRaw) && interactiveBeamRaw >= 1
         ? Math.min(interactiveBeamRaw, 5)
         : 2
-      const beam = isolateBatchFromLiveMetal ? 5 : interactiveBeam
+      const beam = isBatch ? 5 : interactiveBeam
       const bestOf = beam
       const args = [
         '-m', modelPath,
         '-f', tmpWav,
-        '-t', isolateBatchFromLiveMetal ? '8' : '16',
+        // CPU batch stays at 8 threads so it cannot starve live work of cores.
+        '-t', (isBatch && !useMetal) ? '8' : '16',
         '-l', 'en',
-        ...(isolateBatchFromLiveMetal ? ['-ng'] : ['-fa']),
+        ...(useMetal ? ['-fa'] : ['-ng']),
         '-bs', String(beam),
         '-bo', String(bestOf),
         '--no-timestamps',
@@ -763,6 +784,16 @@ export async function transcribeHighQuality(
       })
       ownedHqChildren.add(proc)
 
+      // BLOCKER contract: a preempted Metal child is a HARD FAIL. Its stdout
+      // and its -ojf JSON are truncated mid-decode, and writing that into a
+      // saved meeting is silent transcript corruption — strictly worse than a
+      // slow or failed batch. We record the preempt BEFORE the signal lands so
+      // the close handler can never mistake a truncated run for a clean exit.
+      let preemptedReason: string | null = null
+      if (isBatch && useMetal) {
+        registerMetalBatchChild(proc, reason => { preemptedReason = reason })
+      }
+
       let stdout = ''
       let stderr = ''
       proc.stdout.on('data', (chunk: Buffer) => { stdout += chunk.toString() })
@@ -785,8 +816,16 @@ export async function transcribeHighQuality(
 
       proc.on('close', (code) => {
         ownedHqChildren.delete(proc)
+        unregisterMetalBatchChild(proc)
         clearTimeout(timeout)
         if (forceKill) clearTimeout(forceKill)
+        // Preempt is checked FIRST and ignores the exit code: SIGTERM often
+        // yields a non-zero code, but a race could also let the child exit 0
+        // with partial output. Either way the text is discarded.
+        if (preemptedReason) {
+          reject(new MetalBatchPreemptedError(preemptedReason))
+          return
+        }
         if (timedOut) {
           reject(new Error(`whisper-cli HQ timeout (${timeoutMs / 1000}s, model=${useLargeV3 ? 'large-v3' : 'turbo'})`))
           return
@@ -800,6 +839,7 @@ export async function transcribeHighQuality(
 
       proc.on('error', (err) => {
         ownedHqChildren.delete(proc)
+        unregisterMetalBatchChild(proc)
         clearTimeout(timeout)
         if (forceKill) clearTimeout(forceKill)
         reject(new Error(`whisper-cli HQ spawn error: ${err.message}`))
@@ -831,7 +871,10 @@ export async function transcribeHighQuality(
     console.log(
       `[whisper-hq] Batch transcribed in ${elapsed}ms ` +
       `(${modelTag}${useVad ? '+vad' : ''}${captureBatchWords ? '+words' : ''}` +
-      `${words ? `, ${words.length} words` : ''}): ` +
+      `${words ? `, ${words.length} words` : ''}` +
+      // Device forensics: without these, "why is polish slow today" is
+      // unanswerable after the fact.
+      `${isBatch ? `, device=${decision.device} reason=${decision.reason} metalEnabled=${decision.metalEnabled}` : ''}): ` +
       `"${corrected.slice(0, 80)}${corrected.length > 80 ? '...' : ''}"`,
     )
     const metadata = useLargeV3

package/server/lib/whisper-metal-gate.ts

@@ -0,0 +1,207 @@
+// GPU admission control for post-meeting batch HQ transcription.
+//
+// THE PROBLEM: Miles goes meeting -> meeting. Meeting A's post-save HQ polish
+// (whisper-cli large-v3) often overlaps Meeting B's live ASR. Both want Metal.
+// 6.14.1 fixed the clash bluntly by pinning batch to CPU forever, which taxes
+// every idle polish to protect the overlap case.
+//
+// THE INVARIANT: never Metal+Metal. Live always wins admission. Batch still
+// progresses on busy days, just on CPU. Metal is used only when the operator
+// has opted in AND nothing live is contending.
+//
+// NO CIRCULAR IMPORT: transcribe-stream REGISTERS its live-activity probe here;
+// this module never imports the stream, and whisper-local imports only this.
+
+import type { ChildProcess } from 'node:child_process'
+import { maintenanceLifecycle } from './maintenance-lifecycle.js'
+
+/** Recent-activity window. A session counts as live only if it has been active
+ *  inside this window. Anything colder is treated as an ORPHAN and must NOT pin
+ *  batch to CPU — proven necessary: an active-sessions file sat untouched for
+ *  3+ hours on 2026-07-27, and an "any session in the map" rule would have
+ *  pinned batch to CPU until a server restart, silently, forever. */
+export const LIVE_ACTIVITY_WINDOW_MS = 180_000
+
+/** Maintenance kinds that own the same Metal family as batch HQ. */
+const METAL_FAMILY_WORK_KINDS = [
+  'recording_chunk',
+  'one_shot_transcription',
+  'prompt_draft_warm',
+  'prompt_draft_finalize',
+] as const
+
+export type BatchDevice = 'metal' | 'cpu'
+
+export type ContentionReason =
+  | 'session_recent'
+  | 'recording_chunk'
+  | 'one_shot_transcription'
+  | 'prompt_draft_warm'
+  | 'prompt_draft_finalize'
+  | 'metal_batch_in_flight'
+
+export type DeviceReason =
+  | 'force_cpu'
+  | 'metal_opt_out'
+  | ContentionReason
+  | 'idle'
+
+export interface BatchDeviceDecision {
+  device: BatchDevice
+  reason: DeviceReason
+  metalEnabled: boolean
+}
+
+// ── Env ──────────────────────────────────────────────────────────────────────
+
+/** Blunt rollback. Wins over everything, and keeps working after the default
+ *  eventually flips to Metal-on. */
+export function batchHqForceCpu(): boolean {
+  return process.env.COS_BATCH_HQ_FORCE_CPU === '1'
+}
+
+/** Metal batch is OPT-IN (3B). Default stays always-CPU — today's proven
+ *  behavior — until a meeting-to-meeting smoke passes. Read live, not at module
+ *  load, so tests and Control-updated env are visible. */
+export function batchHqMetalEnabled(): boolean {
+  return !batchHqForceCpu() && process.env.COS_BATCH_HQ_METAL === '1'
+}
+
+// ── Injected live-activity probe ─────────────────────────────────────────────
+
+type LiveActivityProbe = () => number | null
+
+let liveActivityProbe: LiveActivityProbe | null = null
+
+/** transcribe-stream calls this at module load. Returns the most recent
+ *  lastActivityAt across in-memory sessions, or null when there are none. */
+export function registerLiveActivityProbe(probe: LiveActivityProbe): void {
+  liveActivityProbe = probe
+}
+
+/** Test seam — clears the probe and any tracked children. */
+export function resetMetalGateForTests(): void {
+  liveActivityProbe = null
+  metalChildren.clear()
+}
+
+function recentSessionActivity(now: number): boolean {
+  if (!liveActivityProbe) return false
+  let last: number | null = null
+  try {
+    last = liveActivityProbe()
+  } catch {
+    // A probe failure must fail SAFE (assume contended): a wrong "idle" starts
+    // a Metal batch against a live meeting, which is the one thing this whole
+    // module exists to prevent. A wrong "busy" only costs batch speed.
+    return true
+  }
+  if (last == null || !Number.isFinite(last)) return false
+  return now - last < LIVE_ACTIVITY_WINDOW_MS
+}
+
+function activeMetalFamilyWork(): ContentionReason | null {
+  let byKind: Record<string, number>
+  try {
+    byKind = maintenanceLifecycle.snapshot().activeByKind as Record<string, number>
+  } catch {
+    return 'recording_chunk' // fail safe, same reasoning as above
+  }
+  for (const kind of METAL_FAMILY_WORK_KINDS) {
+    if ((byKind[kind] ?? 0) > 0) return kind
+  }
+  return null
+}
+
+/** Is something live currently entitled to Metal? */
+export function isLiveMetalContended(now: number = Date.now()): { contended: boolean; reason: ContentionReason | null } {
+  const work = activeMetalFamilyWork()
+  if (work) return { contended: true, reason: work }
+  if (recentSessionActivity(now)) return { contended: true, reason: 'session_recent' }
+  if (metalChildren.size > 0) return { contended: true, reason: 'metal_batch_in_flight' }
+  return { contended: false, reason: null }
+}
+
+/** Device for the NEXT batch segment. Re-evaluated per segment so a meeting
+ *  that starts mid-batch moves subsequent segments to CPU without a preempt. */
+export function chooseBatchDevice(now: number = Date.now()): BatchDeviceDecision {
+  if (batchHqForceCpu()) return { device: 'cpu', reason: 'force_cpu', metalEnabled: false }
+  const metalEnabled = batchHqMetalEnabled()
+  if (!metalEnabled) return { device: 'cpu', reason: 'metal_opt_out', metalEnabled: false }
+  const { contended, reason } = isLiveMetalContended(now)
+  if (contended) return { device: 'cpu', reason: reason ?? 'session_recent', metalEnabled: true }
+  return { device: 'metal', reason: 'idle', metalEnabled: true }
+}
+
+// ── Metal child registry + preempt ───────────────────────────────────────────
+
+interface MetalChildEntry {
+  proc: ChildProcess
+  /** Set by the owner so the close handler can DISCARD partial output rather
+   *  than resolving a truncated transcript into a saved meeting. */
+  markPreempted: (reason: string) => void
+  escalate?: ReturnType<typeof setTimeout>
+}
+
+const metalChildren = new Map<ChildProcess, MetalChildEntry>()
+
+/** whisper-local registers ONLY Metal-device HQ children. CPU children are
+ *  deliberately absent: they do not contend for the GPU, so preempting them
+ *  would slow batch for no benefit. */
+export function registerMetalBatchChild(proc: ChildProcess, markPreempted: (reason: string) => void): void {
+  metalChildren.set(proc, { proc, markPreempted })
+}
+
+export function unregisterMetalBatchChild(proc: ChildProcess): void {
+  const entry = metalChildren.get(proc)
+  if (entry?.escalate) clearTimeout(entry.escalate)
+  metalChildren.delete(proc)
+}
+
+export function metalBatchInFlight(): boolean {
+  return metalChildren.size > 0
+}
+
+/**
+ * Live work needs the GPU: kill every in-flight Metal batch child.
+ *
+ * Idempotent — a child already preempted is skipped, so the create-path hook
+ * and the recording_chunk backstop can both fire without double-killing.
+ * Returns how many children were preempted (0 is the overwhelmingly common
+ * case: no Metal batch running, or Metal not opted in at all).
+ */
+export function preemptMetalBatchForLive(reason: string): number {
+  if (metalChildren.size === 0) return 0
+  let preempted = 0
+  for (const entry of [...metalChildren.values()]) {
+    if (entry.escalate) continue // already preempted, escalation pending
+    preempted++
+    // Mark FIRST: the close handler must see the preempt flag before the signal
+    // lands, or it could treat a truncated run as a clean exit.
+    try { entry.markPreempted(reason) } catch { /* never block the kill */ }
+    try { entry.proc.kill('SIGTERM') } catch { /* already exited */ }
+    entry.escalate = setTimeout(() => {
+      try { entry.proc.kill('SIGKILL') } catch { /* already exited */ }
+    }, 2_000)
+    entry.escalate.unref?.()
+  }
+  if (preempted > 0) {
+    console.log(`[metal-gate] Preempted ${preempted} Metal batch child(ren) for live work (${reason})`)
+  }
+  return preempted
+}
+
+/** Distinguishable error so the batch pipeline can retry the SAME segment on
+ *  CPU instead of treating it as a generic transcription failure. */
+export class MetalBatchPreemptedError extends Error {
+  readonly preempted = true
+  constructor(readonly preemptReason: string) {
+    super(`Metal batch preempted by live work (${preemptReason})`)
+    this.name = 'MetalBatchPreemptedError'
+  }
+}
+
+export function isMetalBatchPreempted(error: unknown): error is MetalBatchPreemptedError {
+  return error instanceof MetalBatchPreemptedError
+    || (typeof error === 'object' && error !== null && (error as { preempted?: boolean }).preempted === true)
+}

package/server/routes/transcribe-stream.ts

@@ -50,6 +50,34 @@ import {
   type MaintenanceWorkLease,
 } from '../lib/maintenance-lifecycle.js'
 import { feedLiveCueTranscript } from '../lib/live-cues-engine.js'
+import { preemptMetalBatchForLive, registerLiveActivityProbe } from '../lib/whisper-metal-gate.js'
+
+/** Preempt hook 2 of 2 (1C): the recording_chunk backstop. Live audio is
+ *  arriving, so any Metal batch must yield the GPU now. This covers recovery,
+ *  reconnect, and restart adoption — paths that reach chunk upload WITHOUT
+ *  going through session creation. Idempotent with the create hook.
+ *
+ *  Every recording_chunk lease goes through here rather than calling
+ *  acquireMaintenanceWork directly, so a future call site cannot silently skip
+ *  the preempt. Preempt runs BEFORE acquire so the GPU frees even if the drain
+ *  gate rejects the lease. */
+function acquireRecordingChunkLease(options: { allowDuringDrain?: boolean }): MaintenanceWorkLease {
+  preemptMetalBatchForLive('recording_chunk')
+  return acquireMaintenanceWork('recording_chunk', options)
+}
+
+/** Live-activity probe for the Metal gate (2B). Reports the most recent
+ *  lastActivityAt across in-memory sessions; the gate applies its own
+ *  180s window so a cold orphan cannot pin batch to CPU. Registered here to
+ *  keep the dependency one-way (stream -> gate), avoiding a circular import. */
+registerLiveActivityProbe(() => {
+  let newest: number | null = null
+  for (const session of sessions.values()) {
+    const at = session.lastActivityAt
+    if (typeof at === 'number' && Number.isFinite(at) && (newest === null || at > newest)) newest = at
+  }
+  return newest
+})
 
 function ensurePrivateDirectory(path: string): void {
   if (!existsSync(path)) mkdirSync(path, { recursive: true, mode: 0o700 })
@@ -710,6 +738,10 @@ export function getSession(sessionId: string): TranscriptSession {
       emptyCompletions: {},
     }
     sessions.set(sessionId, session)
+    // Preempt hook 1 of 2 (1C). CREATE ONLY — deliberately inside the `!session`
+    // branch, never on an ordinary getSession() touch, or a status read of a
+    // stale session would falsely evict a healthy Metal batch.
+    preemptMetalBatchForLive('session_create')
   }
   if (!session.providerCandidates) session.providerCandidates = {}
   if (!session.receivedIndices) session.receivedIndices = []
@@ -1586,7 +1618,7 @@ transcribeStreamRouter.post('/transcribe-stream', async (req, res) => {
     // Reject a wrong Mac before consuming or persisting any upload bytes.
     assertPinnedServerIdentity(req.get('X-COS-Server-Instance'), req.query.serverInstanceId)
     const sessionId = (req.query.sessionId as string) || `g2_${Date.now()}`
-    maintenanceLease = acquireMaintenanceWork('recording_chunk', {
+    maintenanceLease = acquireRecordingChunkLease({
       allowDuringDrain: sessions.has(sessionId),
     })
     const chunkIndex = parseInt((req.query.chunkIndex as string) || '0', 10)
@@ -1622,7 +1654,7 @@ transcribeStreamRouter.post('/transcribe-stream/offline-sessions/start', async (
     const body = req.body ?? {}
     const sessionId = String(body.sessionId ?? '')
     validateSessionId(sessionId)
-    maintenanceLease = acquireMaintenanceWork('recording_chunk', {
+    maintenanceLease = acquireRecordingChunkLease({
       allowDuringDrain: sessions.has(sessionId),
     })
     if (isSessionDeleted(sessionId)) throw makeHttpError(410, 'session is closed', 'session_closed')
@@ -1648,7 +1680,7 @@ transcribeStreamRouter.post('/transcribe-stream/offline-sessions/:sessionId/chun
     if (!isIosAsrCandidateEnabled()) throw makeHttpError(403, 'iPhone ASR candidates disabled', 'iphone_asr_disabled')
     const sessionId = String(req.params.sessionId ?? '')
     validateSessionId(sessionId)
-    maintenanceLease = acquireMaintenanceWork('recording_chunk', {
+    maintenanceLease = acquireRecordingChunkLease({
       allowDuringDrain: sessions.has(sessionId),
     })
     if (isSessionDeleted(sessionId)) throw makeHttpError(410, 'session is closed', 'session_closed')
@@ -1694,7 +1726,7 @@ transcribeStreamRouter.post('/transcribe-stream/offline-sessions/:sessionId/fina
     if (!isIosAsrCandidateEnabled()) throw makeHttpError(403, 'iPhone ASR candidates disabled', 'iphone_asr_disabled')
     const sessionId = String(req.params.sessionId ?? '')
     validateSessionId(sessionId)
-    maintenanceLease = acquireMaintenanceWork('recording_chunk', {
+    maintenanceLease = acquireRecordingChunkLease({
       allowDuringDrain: sessions.has(sessionId),
     })
     if (isSessionDeleted(sessionId)) throw makeHttpError(410, 'session is closed', 'session_closed')
@@ -1728,7 +1760,7 @@ transcribeStreamRouter.post('/transcribe-stream/candidates', async (req, res) =>
     const sessionId = String(body.sessionId ?? '')
     const chunkIndex = Number(body.chunkIndex)
     validateSessionId(sessionId)
-    maintenanceLease = acquireMaintenanceWork('recording_chunk', {
+    maintenanceLease = acquireRecordingChunkLease({
       allowDuringDrain: sessions.has(sessionId),
     })
     validateChunkIndex(chunkIndex)