@gotcos/glasses-server 6.21.23 → 6.21.25

package/CHANGELOG.md

@@ -1,3 +1,56 @@
+## 6.21.25
+
+- `POST /meeting/:sessionId/confirm` — record that a human vouched for a label
+  the display floor demoted. The floor exists so the identifier cannot assert a
+  name it did not earn, but a person who was in the room is better evidence
+  than a cosine score, and there was no way to say so. A rename could not
+  express it: `relabelSidecarJson` rejects `from === to`. So the panel demoted
+  the row, instructed the reviewer to name it, and offered a candidate list
+  that excluded the very name they wanted.
+
+  A confirmation rewrites nothing — the sidecar already carries the label. It
+  records the vouch, and `reviewMeetingSpeakers` then reports the row as
+  asserted. Meeting-scoped like every other correction: vouching for a voice in
+  one room says nothing about a different room. Refuses with 409 if no chunk in
+  the meeting actually carries that label, so a typo cannot become a permanent
+  confirmation in an append-only ledger.
+
+  A confirmed row still shows its thrash caveat. The name is asserted; the
+  evidence that it swaps with someone else is not hidden.
+
+- Fixed a latent trap found while building it: `readCorrections` validated
+  `phase` against a hardcoded list, so adding a phase to the TYPE made every
+  such row unusable at read time — the write succeeded, the read silently
+  dropped it, and no error surfaced anywhere. Phase validation now derives from
+  a single list with a narrowing guard.
+
+## 6.21.24
+
+- A leaked recording session can no longer block every restart. The maintenance
+  drain gate counted `sessions.size`, so a session whose phone dropped
+  mid-recording without sending a close pinned that count at 1 indefinitely and
+  Install, Repair, Restart and Update Server each drained it, timed out after
+  60s, and failed — with no user-visible reason. Hit twice on 2026-08-06
+  (6.21.20 and 6.21.22); the second phantom had been silent 54 minutes and the
+  only way through was to finalize it as a real meeting, which it was not.
+
+  The gate now counts only sessions active within the last 30 minutes. A stale
+  one is reported in status as `staleTranscriptionSessions` with its session id,
+  silent duration and chunk count, so a blocked operator can see the cause —
+  and `/api/meeting/orphans` reporting 0 can no longer coexist silently with a
+  held lock, since the two read different stores.
+
+  **Nothing is reaped.** The session, its chunks and its recoverability are
+  untouched; only its claim on the restart gate expires. The 30-minute window
+  sits far above the reasons a live recording legitimately goes quiet (a
+  backgrounded phone buffering to IndexedDB, a network drop) and far below the
+  4h durable-chunk retention.
+
+  Note for anyone reading the health payload: `oldestWorkStartedAt: null` does
+  NOT indicate a leak. `recording_session` reaches the gate through
+  `extraActiveByKind`, which never contributes a timestamp, so every recording
+  session reports null — healthy or not. Only `lastActivityAt` separates them.
+
 ## 6.21.23
 
 - `GET /meeting/:sessionId/embeddings` — why each chunk was labelled the way it

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.21.23",
+  "version": "6.21.25",
   "description": "COS Glasses — self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/lib/meeting-corrections.ts

@@ -35,7 +35,31 @@ export const CORRECTIONS_DIR = 'meeting-corrections'
  * `intent` goes down before any file is touched; `applied` or `failed` closes it.
  * An unclosed intent is an incomplete correction, not a successful one.
  */
-export type CorrectionPhase = 'intent' | 'applied' | 'failed'
+export type CorrectionPhase = 'intent' | 'applied' | 'failed' | 'confirmed'
+/**
+ * A human confirming the identifier was RIGHT about a label the display floor
+ * demoted.
+ *
+ * Distinct from a rename, and it has to be: `relabelSidecarJson` rejects
+ * `from === to`, so "yes, this really is Queen Ukaoma" cannot be expressed as a
+ * correction at all. The floor exists because a 0.56 match is not evidence — but
+ * a person who was in the room IS evidence, and there was no way to record it.
+ * The panel demoted the row, told the reviewer to name it, and then offered a
+ * list that deliberately excluded the one name they wanted.
+ *
+ * A confirmation rewrites NOTHING. The sidecar already carries the label; this
+ * only records that a human vouched for it, so the review stops presenting it
+ * as unearned. Scoped to one meeting like every other correction.
+ */
+export const CONFIRMATION_PHASE = 'confirmed' as const
+
+/** Runtime counterpart of CorrectionPhase. Must stay in step with it. */
+const VALID_PHASES = new Set<string>(['intent', 'applied', 'failed', 'confirmed'])
+
+/** Narrowing guard, so the reader keeps its type safety with one phase list. */
+function isCorrectionPhase(value: unknown): value is CorrectionPhase {
+  return typeof value === 'string' && VALID_PHASES.has(value)
+}
 
 export interface CorrectionSurfaces {
   /** Chunks whose `speaker` changed in the sidecar. */
@@ -123,7 +147,11 @@ export function readCorrections(sessionId: string): CorrectionReadResult {
     try {
       const o = JSON.parse(line) as Record<string, unknown>
       if (typeof o.id !== 'string' || typeof o.from !== 'string' || typeof o.to !== 'string') { unusable++; continue }
-      if (o.phase !== 'intent' && o.phase !== 'applied' && o.phase !== 'failed') { unusable++; continue }
+      // Kept as one list so adding a phase to the TYPE cannot silently make
+      // every such row unusable at read time — which is exactly what happened
+      // when 'confirmed' was added: appendCorrection wrote it, this dropped it,
+      // and the confirmation vanished with no error anywhere.
+      if (!isCorrectionPhase(o.phase)) { unusable++; continue }
       rows.push({
         id: o.id,
         phase: o.phase,
@@ -156,6 +184,22 @@ function isSurfaces(v: unknown): v is CorrectionSurfaces {
  * and a meeting with a pending correction should be treated as possibly
  * half-written rather than clean.
  */
+/**
+ * Labels a human has confirmed for this meeting.
+ *
+ * Read by the speaker review to clear the display floor for exactly those
+ * labels. A confirmation is per-meeting and never global: vouching for a voice
+ * in one room says nothing about a different room, which is the same reasoning
+ * that makes every correction here meeting-scoped.
+ */
+export function confirmedLabels(sessionId: string): Set<string> {
+  const confirmed = new Set<string>()
+  for (const row of readCorrections(sessionId).rows) {
+    if (row.phase === 'confirmed') confirmed.add(row.to)
+  }
+  return confirmed
+}
+
 export function pendingCorrections(sessionId: string): CorrectionRow[] {
   const { rows } = readCorrections(sessionId)
   const closed = new Set(rows.filter(r => r.phase !== 'intent').map(r => r.id))

package/server/lib/meeting-speaker-review.ts

@@ -130,6 +130,8 @@ export interface VoiceReview {
   meanRun: number
   longestRun: number
   isOwner: boolean
+  /** A human confirmed this label for this meeting; the floor is waived. */
+  confirmedByHuman: boolean
   reliability: Reliability
   /**
    * Whether `label` may be shown to a human AS A NAME.
@@ -385,9 +387,21 @@ export function selectPhrases(
 /** Build the whole review for one meeting's chunks. */
 export function reviewMeetingSpeakers(
   chunks: ReviewChunk[],
-  options: { owner?: string; phrasesPerVoice?: number; durationMs?: number } = {},
+  options: {
+    owner?: string
+    phrasesPerVoice?: number
+    durationMs?: number
+    /**
+     * Labels a human vouched for in THIS meeting. The floor is a guard against
+     * the identifier over-claiming; it was never meant to overrule a person who
+     * was in the room. A confirmed label asserts its name with no rewrite —
+     * the sidecar already carries it.
+     */
+    confirmed?: Set<string>
+  } = {},
 ): MeetingSpeakerReview {
   const owner = options.owner ?? 'Me'
+  const confirmed = options.confirmed ?? new Set<string>()
   const limit = options.phrasesPerVoice ?? 3
   const sequence = chunks.map(c => c.speaker ?? '')
   // The caller's durationMs (the sidecar's own) is the meeting's true end.
@@ -439,6 +453,12 @@ export function reviewMeetingSpeakers(
     const assertionBlockers: string[] = []
     if (unattributed) {
       assertionBlockers.push('no name was ever assigned to this voice')
+    } else if (confirmed.has(label)) {
+      // A human said this is them. Blockers stay OFF the list rather than being
+      // listed-then-overridden, because a reviewer reading "similarity 0.56
+      // below 0.65" under a name they personally confirmed would reasonably
+      // conclude the confirmation had not taken. `thrashesWith` still renders,
+      // so a genuinely mixed row is still visibly mixed.
     } else if (label === owner) {
       // The wearer is exempt. Their identity is established by wearing the
       // device, not by cosine — and the owner is verified at exactly this floor
@@ -466,6 +486,8 @@ export function reviewMeetingSpeakers(
       meanRun: Math.round(mean(runs) * 100) / 100,
       longestRun: runs.length ? Math.max(...runs) : 0,
       isOwner: label === owner,
+      /** True when a human vouched for this label in this meeting. */
+      confirmedByHuman: confirmed.has(label),
       reliability,
       nameAsserted: assertionBlockers.length === 0,
       assertionBlockers,

package/server/routes/maintenance.ts

@@ -15,7 +15,7 @@ import { getQueryJobRuntimeHealth } from '../lib/query-job-runtime.js'
 import { serverMetrics } from '../lib/server-metrics.js'
 import { getServerInstanceId } from '../lib/server-instance-id.js'
 import { getWhisperHealth } from '../lib/whisper-local.js'
-import { getActiveTranscriptionSessionCount } from './transcribe-stream.js'
+import { getActiveTranscriptionSessionCount, getTranscriptionSessionLiveness } from './transcribe-stream.js'
 
 export const maintenanceRouter = Router()
 
@@ -71,15 +71,21 @@ function operationCredentials(req: Request): MaintenanceOperationCredentials {
 function statusSnapshot(credentials: MaintenanceOperationCredentials = {}) {
   const jobs = getQueryJobRuntimeHealth()
   const activeTranscriptionSessions = getActiveTranscriptionSessionCount()
+  // Only sessions still plausibly recording may hold the drain gate. A leaked
+  // session — phone dropped mid-recording, no close ever sent — otherwise pins
+  // this at 1 forever and every Install/Repair/Restart/Update drains, times out
+  // and fails with nothing to show the user. The stale ones are reported below
+  // rather than counted, and are never deleted here.
+  const sessionLiveness = getTranscriptionSessionLiveness()
   const managed = managedRuntimeCapability()
   const tracked = maintenanceLifecycle.snapshot(credentials, {
-    recording_session: activeTranscriptionSessions,
+    recording_session: sessionLiveness.live,
   })
   const untrackedDurableRuns = Math.max(0, jobs.activeRuns - (tracked.activeByKind.durable_query ?? 0))
   const lifecycle = untrackedDurableRuns > 0
     ? maintenanceLifecycle.snapshot(credentials, {
       durable_query_runtime: untrackedDurableRuns,
-      recording_session: activeTranscriptionSessions,
+      recording_session: sessionLiveness.live,
     })
     : tracked
   return {
@@ -91,6 +97,13 @@ function statusSnapshot(credentials: MaintenanceOperationCredentials = {}) {
     bootId: serverMetrics.bootId,
     activeJobs: jobs.activeRuns,
     activeTranscriptionSessions,
+    // Split out so a blocked operator can SEE why, and so "0 orphans" can never
+    // again coexist with a held lock: the orphans endpoint reads the quarantine
+    // directory, this reads the in-memory session map, and they are different
+    // stores. A stale session is surfaced here and blocks nothing.
+    liveTranscriptionSessions: sessionLiveness.live,
+    staleTranscriptionSessions: sessionLiveness.stale,
+    staleTranscriptionSessionDetail: sessionLiveness.staleSessions,
     shuttingDown: jobs.shuttingDown,
     durableStoreState: jobs.store.state,
     lifecycle,

package/server/routes/meeting.ts

@@ -13,6 +13,7 @@ import { isSampleFromSession, untraceableSampleCount } from '../lib/training-aud
 import { sendAudioFile } from '../lib/send-audio.js'
 import { chunkDiagnostics } from '../lib/chunk-embedding-diagnostics.js'
 import { errMsg } from '../lib/utils.js'
+import { confirmedLabels } from '../lib/meeting-corrections.js'
 import {
   extAudioChunkPath,
   listExtAudioChunks,
@@ -724,6 +725,10 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     const withIndices = attachRawChunkIndices(chunks as ReviewChunk[], sidecar.chunkEntries)
     const review = reviewMeetingSpeakers(withIndices, {
       owner: getOwnerSpeakerLabel(),
+      // Labels a human already vouched for in this meeting. Without this the
+      // floor re-demotes a confirmed name on every reload, and the reviewer
+      // confirms the same voice forever.
+      confirmed: confirmedLabels(sessionId),
       phrasesPerVoice: Math.max(1, Math.min(6, Number(req.query.phrases) || 3)),
       // The sidecar's own durationMs is the meeting's true end. Deriving it from
       // max(elapsed) uses the START of the last chunk, which made the final
@@ -929,6 +934,87 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
   // like and will keep matching. Removing only the label fixes the transcript and
   // leaves the profile poisoned — the exact mechanism that grew the phantom
   // "Erick Hernandez" from 3 mislabelled seeds to 18 samples.
+  /**
+   * Confirm the identifier was RIGHT about a label the display floor demoted.
+   *
+   * Rewrites nothing. The sidecar already carries the label; this records that
+   * a human vouched for it so the review stops presenting it as unearned.
+   *
+   * This exists because "yes, that really is her" was inexpressible. A rename
+   * cannot say it — `relabelSidecarJson` rejects `from === to` — so the panel
+   * demoted the row, instructed the reviewer to name it, and then offered a
+   * candidate list that excluded the very name they wanted. The floor is a
+   * guard against the IDENTIFIER over-claiming; it was never meant to overrule
+   * a person who was in the room.
+   *
+   * Meeting-scoped, like every other correction: vouching for a voice in one
+   * room says nothing about a different room.
+   */
+  router.post('/meeting/:sessionId/confirm', (req, res) => {
+    res.set('Cache-Control', 'private, no-store')
+    const sessionId = String(req.params.sessionId ?? '')
+    if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) {
+      res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
+      return
+    }
+    const label = typeof req.body?.label === 'string' ? req.body.label : ''
+    const bad = invalidLabelReason(label)
+    if (bad) {
+      res.status(400).json({ error: `label: ${bad}`, reason: 'invalid_label' })
+      return
+    }
+
+    // Same resolution as GET /speakers and the relabel route, so the panel and
+    // the confirmation act on the same copy of the meeting.
+    const operations = cosOperationsMeetingsConfigured()
+      ? findCosOperationsMeetingBySessionId(sessionId)
+      : null
+    const saved = operations ? null : store.findBySessionId(sessionId)
+    if (!operations && !saved) {
+      res.status(404).json({ error: 'No saved meeting for this session', reason: 'meeting_not_found' })
+      return
+    }
+    const sidecarPath = operations?.sidecarPath ?? saved!.sidecarPath
+
+    // Refuse to confirm a label the meeting does not actually carry. Otherwise
+    // a typo becomes a permanent confirmation for a speaker who was never here,
+    // and the ledger is append-only.
+    let carried = 0
+    try {
+      const doc = JSON.parse(readFileSync(sidecarPath, 'utf-8')) as Record<string, unknown>
+      const rows = Array.isArray(doc.chunks) ? doc.chunks : []
+      carried = rows.filter(r => r && typeof r === 'object'
+        && (r as Record<string, unknown>).speaker === label).length
+    } catch {
+      res.status(500).json({ error: 'Could not read the chunk sidecar', reason: 'sidecar_unreadable' })
+      return
+    }
+    if (carried === 0) {
+      res.status(409).json({
+        error: `No chunk in this meeting is labelled "${label}"`,
+        reason: 'label_not_present',
+      })
+      return
+    }
+
+    const ok = appendCorrection(sessionId, {
+      id: `confirm-${Date.now()}`,
+      phase: 'confirmed',
+      at: new Date().toISOString(),
+      // `from` and `to` are the same by definition — that is what makes this a
+      // confirmation rather than a rename, and why relabel could not express it.
+      from: label,
+      to: label,
+      chunks: [],
+      scope: 'meeting',
+    })
+    if (!ok) {
+      res.status(500).json({ error: 'Could not record the confirmation', reason: 'ledger_write_failed' })
+      return
+    }
+    res.json({ confirmed: true, label, segments: carried })
+  })
+
   router.post('/meeting/:sessionId/deattribute', (req, res) => {
     res.set('Cache-Control', 'private, no-store')
     const sessionId = String(req.params.sessionId ?? '')

package/server/routes/transcribe-stream.ts

@@ -342,6 +342,76 @@ export function getActiveTranscriptionSessionCount(): number {
   return sessions.size
 }
 
+/**
+ * How long a session may go silent before it stops BLOCKING a restart.
+ *
+ * Not a retention policy and not a reap: the session, its chunks and its
+ * recoverability are untouched. This decides one thing — whether it still
+ * counts toward the maintenance drain gate.
+ *
+ * Sized against the reasons a LIVE recording legitimately goes quiet: the phone
+ * backgrounded and buffering to IndexedDB, a network drop, a long pause. Those
+ * run to minutes. It sits deliberately far below
+ * LOCAL_FIRST_MEETING_IDLE_RETENTION_MS (4h), which governs how long chunks stay
+ * recoverable and is far too long to hold a restart on.
+ */
+export const RECORDING_SESSION_STALE_MS = 30 * 60 * 1000
+
+export interface TranscriptionSessionLiveness {
+  /** Sessions still plausibly recording. These block a restart. */
+  live: number
+  /** Sessions silent past the threshold. Surfaced, NOT counted, NOT deleted. */
+  stale: number
+  /** Which ones, least-silent first, so an operator can act on a name. */
+  staleSessions: Array<{ sessionId: string; silentForMs: number; chunks: number }>
+}
+
+/**
+ * Split active sessions into live and stale.
+ *
+ * WHY THIS EXISTS. The maintenance gate counts `sessions.size` and blocks every
+ * restart while it is non-zero. A session that leaks — the phone drops
+ * mid-recording and never sends a close — pins that count at 1 indefinitely, so
+ * Install, Repair, Restart and Update Server all drain, time out and fail with
+ * no user-visible reason. Observed twice on 2026-08-06 (servers 6.21.20 and
+ * 6.21.22); the second phantom had been silent 54 minutes and the only way
+ * through was to finalize it as a real meeting, which it was not.
+ *
+ * THE DISCRIMINATOR IS `lastActivityAt`, NOT `oldestWorkStartedAt`. The obvious
+ * reading — "activeTotal >= 1 with oldestWorkStartedAt null means leaked" — is
+ * WRONG and would strand healthy recordings. `recording_session` reaches the
+ * gate through `extraActiveByKind` (routes/maintenance.ts), and the snapshot's
+ * `oldestStartedAtMs` loop walks only tracked `work` entries, so an extra count
+ * never contributes a timestamp. EVERY recording session therefore reports
+ * `oldestWorkStartedAt: null`, healthy or leaked. Only the session's own
+ * `lastActivityAt` tells them apart.
+ */
+/**
+ * The live session map, for tests only.
+ *
+ * Exposed because the liveness split is pure logic over `lastActivityAt` but
+ * the map is module-private, and a test that cannot seed it can only assert the
+ * empty case. An earlier draft of the liveness test guarded on this symbol
+ * existing and silently no-opped four of its six cases — passing green while
+ * exercising nothing. Never guard a test on its own seam; make the seam real.
+ */
+export const __sessionsForTests = sessions
+
+export function getTranscriptionSessionLiveness(now = Date.now()): TranscriptionSessionLiveness {
+  let live = 0
+  const staleSessions: TranscriptionSessionLiveness['staleSessions'] = []
+  for (const [sessionId, session] of sessions) {
+    const silentForMs = now - session.lastActivityAt
+    if (silentForMs >= RECORDING_SESSION_STALE_MS) {
+      staleSessions.push({ sessionId, silentForMs, chunks: session.chunks.length })
+    } else {
+      live++
+    }
+  }
+  staleSessions.sort((a, b) => a.silentForMs - b.silentForMs)
+  return { live, stale: staleSessions.length, staleSessions }
+}
+
 // Incremental chunk persistence — survive server restarts
 const CHUNK_PERSIST_DIR = dataPath('active-sessions')
 ensurePrivateDirectory(CHUNK_PERSIST_DIR)