@gotcos/glasses-server 6.21.17 → 6.21.18

package/CHANGELOG.md

@@ -1,3 +1,79 @@
+## 6.21.18
+
+Everything a human needs to correct who spoke, and to hear the voice before
+deciding. Four changes that landed together after Miles reviewed the 2026-08-06
+Ditto meeting and found eleven attributed voices, most of them wrong.
+
+- A NAME MUST BE EARNED. `identifySpeaker` accepts a match at 0.55, so one
+  segment could arrive in the review panel wearing somebody's full name — Richard
+  Jenkins on 1 segment at 0.60, Luke Henry on 1 at 0.55. Voices now carry
+  `nameAsserted` plus `assertionBlockers`; below the floor a client must render
+  "unidentified" and offer the label only as a scored candidate. Floors:
+  similarity >= 0.65 AND >= 3 segments AND not thrashing. The owner gets no
+  exemption.
+- `timeline` ON THE REVIEW. Consecutive same-speaker spans with start/end, so a
+  ribbon can be an actual timeline. The previous one drew a rectangle per voice
+  sized by share of segments while labelled "who spoke, in order", so a voice
+  that spoke twice appeared once and hover could report nothing true.
+- POST /meeting/:id/deattribute — "this voice was NOT that person". Un-attributes
+  it for ONE meeting and retracts the training samples that meeting contributed
+  to that person's profile, so a false attribution stops reinforcing itself. It
+  reports what it cannot reach: `train-g2` used to stamp a bare `g2-training`,
+  discarding which meeting each sample came from, and now stamps
+  `g2-training:<sessionId>`. Samples written before this are relabellable but not
+  retractable.
+- MEETING AUDIO KEPT 7 DAYS, 8 GB budget (Miles's call: review should survive to
+  a weekend). Chunk WAVs previously died with the batch pipeline —
+  `session-audio` held 0 files. Hard-linked at the single choke point before the
+  rename, so it costs no extra disk and outlives the pipeline's cleanup. Sized on
+  measurement: 3.1 h/day mean and 6.9 h peak make a week ~2.5 GB uncompressed, so
+  the audio stays usable for re-transcription too. Retention sweeps expiry first,
+  then evicts oldest whole sessions; a session whose age cannot be read is kept.
+- Playback: `GET /voice/profiles/:name/sample` (needs no retention change — the
+  training audio already existed, and playing a stored profile is what answers
+  "is this really them"), `GET /voice/ext-audio/:id/sample`, and
+  `GET /meeting/:id/audio/:chunk` which distinguishes "the window passed" from
+  "that chunk is missing" and reports which chunks are playable.
+- `/api/health` gains `review_audio`. `voice_provenance` from 6.21.17 already
+  reports `noHumanSample`; on the live store that is 67 of 77 profiles.
+
+FIXES FOUND BY QA BEFORE PUBLISH (nothing above ever shipped):
+
+- PLAYBACK PLAYS THE RIGHT AUDIO. `Phrase` now carries the RAW capture index,
+  resolved from the sidecar's `chunkEntries`. The compacted `chunks` array and
+  the `chunk_NNNN.wav` numbering are different sequences: on the 2026-08-06 Ditto
+  sidecar, 885 compacted chunks against raw indices 0..945 with 36 gaps, so array
+  position 884 is raw chunk 940. Playing by position would have played a
+  different speaker minutes earlier — on the one screen whose job is confirming
+  who spoke. When the counts disagree no index is emitted at all, because a
+  shifted index is worse than no button.
+- THE OWNER IS EXEMPT FROM THE NAME FLOOR. The wearer is verified at exactly the
+  floor (VERIFY_THRESHOLD 0.65), so they sat permanently on the boundary and any
+  thrash pair flipped them: measured across the 2026-08-06 corpus, the owner row
+  read "Unidentified voice" in 4 of 9 meetings, once with 285 of their own
+  segments. `thrashesWith` still renders, so a mixed row is still visible.
+- DE-ATTRIBUTION NUMBERS ITS LABELS. `Unidentified 1`, `Unidentified 2`, … rather
+  than one shared `Ext`. Miles found five wrong attributions in one meeting;
+  collapsing them into a single row would have destroyed his ability to tell
+  those voices apart, which is exactly what playback is for next.
+- DE-ATTRIBUTION DELETES THE ATTENDEE BULLET instead of renaming it. Renaming
+  wrote an unidentified label into the attendee list as though it were a person,
+  and every downstream reader takes that bullet at face value while the pipeline
+  that BUILDS attendees deliberately excludes such labels.
+- The timeline's LAST SPAN had zero width. `durationMs` frequently equals the
+  final chunk's start exactly (both 5,783,732 on the Ditto sidecar), so the
+  closing turn rendered as a sliver. The tail now takes one typical chunk of
+  width from the meeting's own median gap — measured 7,034 ms where it was 0.
+- De-attribute reports `markdownSkipped`, which relabel already did and it
+  silently dropped. 39% of operations sidecars have no `.md` beside them, so the
+  response claimed segment changes with no hint the document was untouched.
+- `/api/health` no longer statSyncs every retained chunk on every poll. COS
+  Control polls every 12s and a 7-day window is 2,000-3,000 files; stats are now
+  cached for 30s and invalidated when retention actually removes something. The
+  `/audio` listing reads the retention window as config rather than walking disk.
+
+Requires COS Control 0.5.0+ to use the scoped correction and playback surfaces.
+
 ## 6.21.17
 
 - Voice profiles now give up their WEAKEST sample, not their oldest. Eviction is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.21.17",
+  "version": "6.21.18",
   "description": "COS Glasses — self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/lib/meeting-audio-archive.ts

@@ -0,0 +1,314 @@
+// Meeting audio kept long enough for a human to review who was speaking.
+//
+// WHY IT DID NOT EXIST. Chunk WAVs lived in `session-audio` only until a meeting
+// was saved, then moved to `pending-batch` for HQ re-transcription and deleted
+// when that finished. Measured 2026-08-06: `session-audio` held 0 files. So the
+// review panel could show a phrase but never let anyone HEAR it, and its own
+// copy said "naming this needs its audio, which is no longer held."
+//
+// Miles's decision: keep a week, so review can happen on a weekend rather than
+// only within hours of the meeting, and stay under 8 GB.
+//
+// SIZING IS MEASURED, NOT GUESSED. Real recording volume over the 14 days to
+// 2026-08-06 was 3.1 h/day mean, 6.9 h peak. A 7-day window is ~22 hours, which
+// at 16 kHz mono 16-bit (32 KB/s) is ~2.5 GB — comfortably inside 8 GB. So the
+// audio is kept UNCOMPRESSED and stays usable for re-transcription, not just
+// playback. The cap is a runaway backstop: it would take a sustained 10 h/day
+// week to reach it.
+//
+// HARD LINKS, NOT COPIES. Archiving happens at the moment audio moves to
+// `pending-batch`, and links the same inodes rather than duplicating them. A
+// copy would double disk for the whole batch window — 260 MB for a two-hour
+// meeting — and introduce an ordering hazard against the batch purge. With links
+// the pipeline can delete its directory whenever it likes and the bytes survive.
+
+import {
+  copyFileSync, existsSync, linkSync, mkdirSync, readdirSync, rmSync, statSync,
+} from 'node:fs'
+import { join, resolve } from 'node:path'
+import { dataPath } from './data-dir.js'
+
+export const MEETING_AUDIO_DIR = 'meeting-audio'
+
+/** One week, per Miles: review should survive until a weekend. */
+export function meetingAudioTtlMs(): number {
+  const raw = Number(process.env.COS_MEETING_AUDIO_RETENTION_DAYS)
+  const days = Number.isFinite(raw) && raw > 0 ? raw : 7
+  return days * 24 * 60 * 60 * 1000
+}
+
+/** Total budget for retained meeting audio. Miles: stay under 8 GB. */
+export function meetingAudioMaxBytes(): number {
+  const raw = Number(process.env.COS_MEETING_AUDIO_MAX_BYTES)
+  return Number.isFinite(raw) && raw > 0 ? raw : 8 * 1024 * 1024 * 1024
+}
+
+/** Master switch. Default ON — with it off, review has no audio at all. */
+export function meetingAudioEnabled(): boolean {
+  return process.env.COS_MEETING_AUDIO !== '0'
+}
+
+function sessionDir(sessionId: string): string | null {
+  if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) return null
+  const root = dataPath(MEETING_AUDIO_DIR)
+  const path = join(root, sessionId.replace(/:/g, '_'))
+  return resolve(path).startsWith(resolve(root) + '/') ? path : null
+}
+
+/** Chunk WAVs as written by the capture path (`chunk_0000.wav`). */
+function isChunkWav(name: string): boolean {
+  return /^chunk_\d+\.wav$/.test(name)
+}
+
+export interface ArchiveResult {
+  linked: number
+  /** Files that had to be copied because the link failed (e.g. cross-device). */
+  copied: number
+  failed: number
+  bytes: number
+}
+
+/**
+ * Bring one session's chunk WAVs into the archive.
+ *
+ * Never throws: this runs on the save path, and losing review audio must never
+ * cost a meeting. Individual failures are counted rather than aborting the rest,
+ * because a partially-archived meeting is still partially reviewable.
+ */
+export function archiveSessionAudio(sessionId: string, sourceDir: string): ArchiveResult {
+  const out: ArchiveResult = { linked: 0, copied: 0, failed: 0, bytes: 0 }
+  if (!meetingAudioEnabled()) return out
+  const dest = sessionDir(sessionId)
+  if (!dest || !existsSync(sourceDir)) return out
+  let names: string[]
+  try {
+    names = readdirSync(sourceDir).filter(isChunkWav)
+  } catch {
+    return out
+  }
+  if (names.length === 0) return out
+  try {
+    mkdirSync(dest, { recursive: true, mode: 0o700 })
+  } catch {
+    return out
+  }
+  for (const name of names) {
+    const from = resolve(sourceDir, name)
+    const to = resolve(dest, name)
+    if (existsSync(to)) continue
+    try {
+      linkSync(from, to)
+      out.linked++
+    } catch {
+      // A link can fail across filesystems or if the source vanished mid-sweep.
+      // Copy rather than skip: the point is that the audio survives.
+      try { copyFileSync(from, to); out.copied++ } catch { out.failed++; continue }
+    }
+    try { out.bytes += statSync(to).size } catch { /* counted as linked regardless */ }
+  }
+  return out
+}
+
+/** Bytes and age for one archived session. */
+function sessionSize(dir: string): { bytes: number; mtimeMs: number; files: number } {
+  let bytes = 0, mtimeMs = 0, files = 0
+  try {
+    for (const name of readdirSync(dir).filter(isChunkWav)) {
+      try {
+        const st = statSync(join(dir, name))
+        bytes += st.size
+        files++
+        mtimeMs = Math.max(mtimeMs, st.mtimeMs)
+      } catch { /* skip unreadable */ }
+    }
+  } catch { /* unreadable dir reports zero */ }
+  return { bytes, mtimeMs, files }
+}
+
+export interface SweepResult {
+  removed: string[]
+  retained: string[]
+  bytesFreed: number
+}
+
+/**
+ * Drop sessions past the retention window.
+ *
+ * A session whose age cannot be read is RETAINED — treating an unreadable stat
+ * as ancient would delete the audio a pending review depends on.
+ */
+export function sweepMeetingAudio(nowMs: number, ttlMs = meetingAudioTtlMs()): SweepResult {
+  const root = dataPath(MEETING_AUDIO_DIR)
+  const out: SweepResult = { removed: [], retained: [], bytesFreed: 0 }
+  if (!existsSync(root)) return out
+  let names: string[]
+  try { names = readdirSync(root) } catch { return out }
+  for (const name of names) {
+    const dir = join(root, name)
+    const { bytes, mtimeMs } = sessionSize(dir)
+    if (mtimeMs <= 0) { out.retained.push(name); continue }
+    if (nowMs - mtimeMs > ttlMs) {
+      try { rmSync(dir, { recursive: true, force: true }); out.removed.push(name); out.bytesFreed += bytes }
+      catch { out.retained.push(name) }
+    } else {
+      out.retained.push(name)
+    }
+  }
+  return out
+}
+
+export interface CapResult {
+  evicted: string[]
+  bytesBefore: number
+  bytesAfter: number
+}
+
+/**
+ * Evict OLDEST SESSIONS FIRST until the archive fits its budget.
+ *
+ * Whole sessions, not individual chunks: half a meeting's audio is a confusing
+ * artefact, and predictable eviction beats squeezing in a few more megabytes.
+ *
+ * Note on accounting: while `pending-batch` still holds the same inodes, these
+ * hard-linked files are counted at full size in BOTH places, so the total reads
+ * high during the batch window. That is deliberately conservative — it can sweep
+ * slightly early, never late.
+ */
+export function enforceMeetingAudioCap(maxBytes = meetingAudioMaxBytes()): CapResult {
+  const root = dataPath(MEETING_AUDIO_DIR)
+  const out: CapResult = { evicted: [], bytesBefore: 0, bytesAfter: 0 }
+  if (!existsSync(root)) return out
+  let names: string[]
+  try { names = readdirSync(root) } catch { return out }
+
+  const entries = names.map(name => ({ name, ...sessionSize(join(root, name)) }))
+  out.bytesBefore = entries.reduce((n, e) => n + e.bytes, 0)
+  out.bytesAfter = out.bytesBefore
+  if (out.bytesAfter <= maxBytes) return out
+
+  // Oldest first. A session with an unreadable mtime sorts LAST so it is evicted
+  // only as a final resort, matching the sweeper's bias toward keeping evidence.
+  entries.sort((a, b) => (a.mtimeMs || Number.MAX_SAFE_INTEGER) - (b.mtimeMs || Number.MAX_SAFE_INTEGER))
+  for (const e of entries) {
+    if (out.bytesAfter <= maxBytes) break
+    try {
+      rmSync(join(root, e.name), { recursive: true, force: true })
+      out.evicted.push(e.name)
+      out.bytesAfter -= e.bytes
+    } catch { /* leave it counted; the next pass will try again */ }
+  }
+  return out
+}
+
+/** Absolute path to one chunk's WAV, or null when it is not retained. */
+export function meetingAudioChunkPath(sessionId: string, chunkIndex: number): string | null {
+  const dir = sessionDir(sessionId)
+  if (!dir) return null
+  // No integer guard: `chunkIndex` is a number, so the interpolation can never
+  // contain a path separator, and a nonsense value simply names a file that does
+  // not exist. Mutation confirmed an explicit check here is unreachable behind
+  // the existence test below.
+  const path = resolve(dir, `chunk_${String(chunkIndex).padStart(4, '0')}.wav`)
+  if (!resolve(path).startsWith(resolve(dir) + '/')) return null
+  return existsSync(path) ? path : null
+}
+
+/** Chunk indices retained for a session, ascending. */
+export function listMeetingAudioChunks(sessionId: string): number[] {
+  const dir = sessionDir(sessionId)
+  if (!dir || !existsSync(dir)) return []
+  try {
+    return readdirSync(dir)
+      .filter(isChunkWav)
+      .map(n => Number(n.slice('chunk_'.length, -'.wav'.length)))
+      .filter(n => Number.isInteger(n))
+      .sort((a, b) => a - b)
+  } catch {
+    return []
+  }
+}
+
+/**
+ * Cached stats for /api/health.
+ *
+ * The uncached walk statSyncs EVERY retained chunk: a 7-day window at the
+ * measured rate is roughly 2,000-3,000 files, and COS Control polls health every
+ * 12 seconds — thousands of synchronous stats on the same event loop that ingests
+ * live audio. The sibling chunkEmbeddingStoreStats is one stat per session for
+ * the same reason. A 30s cache keeps the number useful without the cost.
+ */
+let statsCache: { at: number; value: ReturnType<typeof computeMeetingAudioStats> } | null = null
+const STATS_TTL_MS = 30_000
+
+export function meetingAudioStats(): ReturnType<typeof computeMeetingAudioStats> {
+  const now = Date.now()
+  if (statsCache && now - statsCache.at < STATS_TTL_MS) return statsCache.value
+  const value = computeMeetingAudioStats()
+  statsCache = { at: now, value }
+  return value
+}
+
+/** Invalidate after a sweep or eviction so health does not report stale usage. */
+export function invalidateMeetingAudioStats(): void {
+  statsCache = null
+}
+
+/** Counts for /api/health, so retention can be seen rather than assumed. */
+function computeMeetingAudioStats(): {
+  enabled: boolean
+  sessions: number
+  bytes: number
+  maxBytes: number
+  retentionDays: number
+  oldestAgeHours: number | null
+} {
+  const root = dataPath(MEETING_AUDIO_DIR)
+  const retentionDays = Math.round((meetingAudioTtlMs() / (24 * 60 * 60 * 1000)) * 10) / 10
+  const base = {
+    enabled: meetingAudioEnabled(),
+    maxBytes: meetingAudioMaxBytes(),
+    retentionDays,
+  }
+  if (!existsSync(root)) return { ...base, sessions: 0, bytes: 0, oldestAgeHours: null }
+  let sessions = 0, bytes = 0, oldest = Number.POSITIVE_INFINITY
+  try {
+    for (const name of readdirSync(root)) {
+      const { bytes: b, mtimeMs, files } = sessionSize(join(root, name))
+      if (files === 0) continue
+      sessions++
+      bytes += b
+      if (mtimeMs > 0) oldest = Math.min(oldest, mtimeMs)
+    }
+  } catch { /* report what we have */ }
+  return {
+    ...base,
+    sessions,
+    bytes,
+    oldestAgeHours: Number.isFinite(oldest) ? Math.round(((Date.now() - oldest) / 3_600_000) * 10) / 10 : null,
+  }
+}
+
+/**
+ * One retention pass: expire first, then enforce the budget.
+ *
+ * ORDER IS LOAD-BEARING and that is why this is a named function rather than two
+ * calls inline in an interval. Enforcing the cap first would let it EVICT audio
+ * that the sweeper was about to expire anyway — counting those bytes against the
+ * budget and so evicting extra sessions that were still inside their window. Run
+ * the other way round, the cap only ever sees audio a human could still want.
+ */
+/** Retention window in days — a pure config read, no filesystem. */
+export function meetingAudioRetentionDays(): number {
+  return Math.round((meetingAudioTtlMs() / (24 * 60 * 60 * 1000)) * 10) / 10
+}
+
+export function runMeetingAudioRetention(nowMs = Date.now()): {
+  swept: SweepResult
+  capped: CapResult
+} {
+  const swept = sweepMeetingAudio(nowMs)
+  const capped = enforceMeetingAudioCap()
+  // Usage just changed; do not let health report the pre-sweep figure.
+  if (swept.removed.length > 0 || capped.evicted.length > 0) invalidateMeetingAudioStats()
+  return { swept, capped }
+}

package/server/lib/meeting-relabel.ts

@@ -185,7 +185,12 @@ function sectionRange(md: string, heading: string): { start: number; end: number
  * by label, not by index, and the markdown's turn segmentation does not match
  * the sidecar's. See the file header.
  */
-export function relabelMeetingMarkdown(md: string, from: string, to: string): RelabelOutcome<MarkdownRelabelResult> {
+export function relabelMeetingMarkdown(
+  md: string,
+  from: string,
+  to: string,
+  options: { removeAttendee?: boolean } = {},
+): RelabelOutcome<MarkdownRelabelResult> {
   if (from === to) return { ok: false, error: 'from and to are the same label' }
   for (const [which, label] of [['from', from], ['to', to]] as const) {
     const bad = invalidLabelReason(label)
@@ -204,7 +209,14 @@ export function relabelMeetingMarkdown(md: string, from: string, to: string): Re
     // run past its own line. Without the end anchor, `- Luke H` matches the
     // PREFIX of `- Luke Henry` and deleting it leaves the fragment `enry`.
     const line = (label: string) => `^-[ \t]+${escapeRegExp(label)}[ \t]*$`
-    const alreadyListed = new RegExp(line(to), 'm').test(body)
+    // A de-attribution must DELETE the attendee bullet, never rename it. Renaming
+    // writes `- Unidentified 2` into the attendee list as though it were a
+    // person, and the COS pipeline that BUILDS attendees deliberately excludes
+    // unidentified labels (sync_meetings.py filters them) while every reader —
+    // parseAttendees, extractAttendees, the Python prep generators — takes the
+    // bullet at face value. So a rename here injects a phantom attendee that
+    // downstream treats as real.
+    const alreadyListed = options.removeAttendee || new RegExp(line(to), 'm').test(body)
     let rewritten: string
     if (alreadyListed) {
       // Both names present: drop the old bullet instead of creating a duplicate