@gotcos/glasses-server 6.21.7 → 6.21.10

package/server/lib/voice-profile-store.ts

@@ -0,0 +1,365 @@
+// Durability and integrity for voice-profiles.json.
+//
+// This file is the single most irreplaceable artifact the server owns: on this
+// box it holds 79 profiles / 1,317 embeddings / ~7.8 MB, accumulated over months
+// of training that cannot be re-derived once the source audio has aged out. It
+// was being written with three raw `writeFileSync` calls and read with an
+// unguarded `JSON.parse`, so one crash, disk-full, or iCloud-sync mid-write
+// would take all of it and every subsequent read would throw.
+//
+// Everything here is a pure function over an explicit path so it can be tested
+// by execution rather than by asserting on source text. speaker-embeddings.ts
+// delegates to it and keeps the sherpa-onnx manager in sync.
+
+import { existsSync, mkdirSync, readdirSync, statSync, unlinkSync } from 'node:fs'
+import { basename, dirname, join, resolve } from 'node:path'
+import { durableAtomicWriteFileSync, loadJsonOrQuarantine } from './atomic-fs.js'
+
+export interface VoiceProfile {
+  name: string
+  /** One row per enrolled sample. Parallel to `sources`, index for index. */
+  embeddings: number[][]
+  /** Provenance: 'manual' | 'fireflies' | 'g2-training' | 'auto:<sessionId>' | … */
+  sources?: string[]
+}
+
+export interface ProfileStore {
+  profiles: VoiceProfile[]
+}
+
+/** What normalization had to fix. All non-zero counts are worth logging: they
+ *  mean the file on disk had drifted from its own invariants. */
+export interface StoreRepairs {
+  /** `sources` was missing, short, or long relative to `embeddings`. */
+  sourcesRealigned: number
+  /** A null/non-string slot inside `sources` (observed in the live store). */
+  sourcesCoerced: number
+  /** Embedding rows that were not arrays of finite numbers — unusable. */
+  embeddingsDropped: number
+  /** Rows whose length differs from the profile's modal dimension. Kept on
+   *  disk, but excluded from centroids: sherpa compares by cosine, and a
+   *  short row silently produces NaN across the whole averaged vector. */
+  dimensionMismatch: number
+  /** Entries with no usable name, or duplicate names collapsed. */
+  profilesDropped: number
+}
+
+export function emptyRepairs(): StoreRepairs {
+  return {
+    sourcesRealigned: 0,
+    sourcesCoerced: 0,
+    embeddingsDropped: 0,
+    dimensionMismatch: 0,
+    profilesDropped: 0,
+  }
+}
+
+export function hasRepairs(r: StoreRepairs): boolean {
+  return r.sourcesRealigned > 0 || r.sourcesCoerced > 0 || r.embeddingsDropped > 0
+    || r.dimensionMismatch > 0 || r.profilesDropped > 0
+}
+
+export function describeRepairs(r: StoreRepairs): string {
+  const parts: string[] = []
+  if (r.profilesDropped) parts.push(`${r.profilesDropped} unusable profile(s)`)
+  if (r.embeddingsDropped) parts.push(`${r.embeddingsDropped} unusable embedding row(s)`)
+  if (r.sourcesRealigned) parts.push(`${r.sourcesRealigned} profile(s) with misaligned sources[]`)
+  if (r.sourcesCoerced) parts.push(`${r.sourcesCoerced} null/non-string source slot(s)`)
+  if (r.dimensionMismatch) parts.push(`${r.dimensionMismatch} wrong-dimension embedding(s) excluded from centroids`)
+  return parts.join(', ')
+}
+
+const UNKNOWN_SOURCE = 'unknown'
+
+function isUsableEmbedding(row: unknown): row is number[] {
+  return Array.isArray(row) && row.length > 0 && row.every(v => typeof v === 'number' && Number.isFinite(v))
+}
+
+/** The dimension the majority of a profile's rows agree on.
+ *
+ *  Not `embeddings[0].length`: if row 0 happens to be the corrupt one, every
+ *  other row becomes the "mismatch" and the profile is emptied. */
+export function modalDimension(embeddings: number[][]): number {
+  const counts = new Map<number, number>()
+  for (const row of embeddings) counts.set(row.length, (counts.get(row.length) ?? 0) + 1)
+  let best = 0, bestCount = -1
+  for (const [dim, count] of counts) {
+    // Tie-break toward the larger dimension: a truncated row is the likelier
+    // corruption than a systematically longer one.
+    if (count > bestCount || (count === bestCount && dim > best)) { best = dim; bestCount = count }
+  }
+  return best
+}
+
+/** Bring a parsed store back to its invariants, reporting every change.
+ *
+ *  Deliberately conservative: rows that are merely the wrong DIMENSION are kept
+ *  on disk and only excluded from centroid math, because they may be a
+ *  recoverable model change rather than corruption. Only rows that cannot be
+ *  numbers at all are dropped. */
+export function normalizeProfileStore(raw: unknown): { store: ProfileStore; repairs: StoreRepairs } {
+  const repairs = emptyRepairs()
+  const rawProfiles = (raw as ProfileStore | null)?.profiles
+  if (!Array.isArray(rawProfiles)) return { store: { profiles: [] }, repairs }
+
+  const byName = new Map<string, VoiceProfile>()
+  for (const candidate of rawProfiles) {
+    const name = typeof (candidate as VoiceProfile)?.name === 'string'
+      ? (candidate as VoiceProfile).name.trim()
+      : ''
+    if (!name) { repairs.profilesDropped++; continue }
+
+    const rawEmbeddings = Array.isArray((candidate as VoiceProfile).embeddings)
+      ? (candidate as VoiceProfile).embeddings as unknown[]
+      : []
+    const rawSources = Array.isArray((candidate as VoiceProfile).sources)
+      ? (candidate as VoiceProfile).sources as unknown[]
+      : null
+
+    // Walk both arrays together so dropping row i also drops source i — the
+    // exact coupling `embeddings.shift()` + `sources?.shift()` used to break.
+    const embeddings: number[][] = []
+    const sources: string[] = []
+    for (let i = 0; i < rawEmbeddings.length; i++) {
+      const row = rawEmbeddings[i]
+      if (!isUsableEmbedding(row)) { repairs.embeddingsDropped++; continue }
+      embeddings.push(row)
+      const source = rawSources?.[i]
+      if (typeof source === 'string' && source.length > 0) {
+        sources.push(source)
+      } else {
+        // Missing (sources shorter than embeddings) or a null/non-string slot.
+        if (rawSources && i < rawSources.length) repairs.sourcesCoerced++
+        sources.push(UNKNOWN_SOURCE)
+      }
+    }
+
+    const wasMisaligned = rawSources === null
+      ? embeddings.length > 0
+      : rawSources.length !== rawEmbeddings.length
+    if (wasMisaligned) repairs.sourcesRealigned++
+
+    const dim = modalDimension(embeddings)
+    for (const row of embeddings) if (row.length !== dim) repairs.dimensionMismatch++
+
+    const existing = byName.get(name)
+    if (existing) {
+      // Duplicate profile names cannot both be registered in the manager (one
+      // vector per name), so the later rows would be invisible. Merge instead.
+      repairs.profilesDropped++
+      existing.embeddings.push(...embeddings)
+      existing.sources!.push(...sources)
+      continue
+    }
+    byName.set(name, { name, embeddings, sources })
+  }
+
+  return { store: { profiles: [...byName.values()] }, repairs }
+}
+
+export type StoreLoad = {
+  store: ProfileStore
+  repairs: StoreRepairs
+  /** 'missing' is normal on a fresh install. 'corrupt' means the previous file
+   *  was quarantined and the training in it is GONE unless a backup is used. */
+  status: 'ok' | 'missing' | 'corrupt'
+  quarantinedAs?: string
+  /** Set when `status: 'corrupt'` and a backup was successfully substituted. */
+  recoveredFromBackup?: string
+}
+
+export function backupDirFor(storePath: string): string {
+  return join(dirname(storePath), `${basename(storePath, '.json')}.backups`)
+}
+
+/** Newest first. */
+export function listProfileStoreBackups(storePath: string): string[] {
+  const dir = backupDirFor(storePath)
+  if (!existsSync(dir)) return []
+  try {
+    return readdirSync(dir)
+      .filter(f => f.endsWith('.json'))
+      .map(f => resolve(dir, f))
+      .map(p => ({ p, mtime: safeMtime(p) }))
+      .sort((a, b) => b.mtime - a.mtime)
+      .map(entry => entry.p)
+  } catch { return [] }
+}
+
+function safeMtime(path: string): number {
+  try { return statSync(path).mtimeMs } catch { return 0 }
+}
+
+function safeSize(path: string): number {
+  try { return statSync(path).size } catch { return 0 }
+}
+
+export const PROFILE_STORE_BACKUP_KEEP = 5
+/** Don't copy 7.8 MB on every enroll; one snapshot per hour bounds the churn
+ *  while still guaranteeing a recent restore point. */
+export const PROFILE_STORE_BACKUP_MIN_INTERVAL_MS = 60 * 60 * 1000
+
+/**
+ * Load the store, quarantining a corrupt file and falling back to the newest
+ * usable backup rather than silently starting from zero profiles.
+ *
+ * Starting empty is the dangerous default here: the very next `saveProfileStore`
+ * would durably persist that empty store over the only remaining copy.
+ */
+export function loadVoiceProfileStore(storePath: string): StoreLoad {
+  const result = loadJsonOrQuarantine<unknown>(storePath)
+  if (result.status === 'missing') {
+    return { store: { profiles: [] }, repairs: emptyRepairs(), status: 'missing' }
+  }
+  if (result.status === 'ok') {
+    const { store, repairs } = normalizeProfileStore(result.data)
+    return { store, repairs, status: 'ok' }
+  }
+
+  for (const backup of listProfileStoreBackups(storePath)) {
+    const restored = loadJsonOrQuarantine<unknown>(backup)
+    if (restored.status !== 'ok') continue
+    const { store, repairs } = normalizeProfileStore(restored.data)
+    if (store.profiles.length === 0) continue
+    return {
+      store,
+      repairs,
+      status: 'corrupt',
+      quarantinedAs: result.quarantinedAs,
+      recoveredFromBackup: backup,
+    }
+  }
+  return {
+    store: { profiles: [] },
+    repairs: emptyRepairs(),
+    status: 'corrupt',
+    quarantinedAs: result.quarantinedAs,
+  }
+}
+
+/** Snapshot the current file before it is overwritten, then prune old copies. */
+export function backupProfileStore(
+  storePath: string,
+  options: { nowMs?: number; force?: boolean; keep?: number; minIntervalMs?: number } = {},
+): string | null {
+  if (!existsSync(storePath)) return null
+  if (safeSize(storePath) === 0) return null
+
+  const now = options.nowMs ?? Date.now()
+  const keep = options.keep ?? PROFILE_STORE_BACKUP_KEEP
+  const minInterval = options.minIntervalMs ?? PROFILE_STORE_BACKUP_MIN_INTERVAL_MS
+  const existing = listProfileStoreBackups(storePath)
+  if (!options.force && existing.length > 0 && now - safeMtime(existing[0]) < minInterval) return null
+
+  const dir = backupDirFor(storePath)
+  try {
+    mkdirSync(dir, { recursive: true, mode: 0o700 })
+    const stamp = new Date(now).toISOString().replace(/[:.]/g, '-')
+    const target = join(dir, `${basename(storePath, '.json')}.${stamp}.json`)
+    // Copy through the durable writer so a backup can never itself be torn.
+    const raw = loadJsonOrQuarantine<unknown>(storePath)
+    if (raw.status !== 'ok') return null
+    durableAtomicWriteFileSync(target, JSON.stringify(raw.data), { mode: 0o600 })
+    for (const stale of listProfileStoreBackups(storePath).slice(keep)) {
+      try { unlinkSync(stale) } catch { /* pruning is best effort */ }
+    }
+    return target
+  } catch {
+    // A failed backup must never block the write it precedes.
+    return null
+  }
+}
+
+/**
+ * Persist the store atomically, after taking a rotating backup.
+ *
+ * Refuses to write an empty store over a populated file. That is the shape of
+ * every catastrophic loss here — a failed load returning `{profiles: []}`, then
+ * a routine save committing it — and no legitimate caller needs it. Callers
+ * that really mean it (a full reset) pass `allowEmpty`.
+ */
+export function saveVoiceProfileStore(
+  storePath: string,
+  store: ProfileStore,
+  options: { allowEmpty?: boolean; nowMs?: number } = {},
+): { written: boolean; backup: string | null; refusedReason?: string } {
+  if (store.profiles.length === 0 && !options.allowEmpty) {
+    const current = loadJsonOrQuarantine<ProfileStore>(storePath)
+    if (current.status === 'ok' && (current.data?.profiles?.length ?? 0) > 0) {
+      return {
+        written: false,
+        backup: null,
+        refusedReason: `refusing to overwrite ${current.data.profiles.length} stored profile(s) with an empty store`,
+      }
+    }
+  }
+
+  const backup = backupProfileStore(storePath, { nowMs: options.nowMs })
+  mkdirSync(dirname(storePath), { recursive: true, mode: 0o700 })
+  durableAtomicWriteFileSync(storePath, JSON.stringify(store, null, 2), { mode: 0o600 })
+  return { written: true, backup }
+}
+
+/** Drop the oldest sample, keeping `embeddings` and `sources` in lockstep.
+ *
+ *  The old inline form was `embeddings.shift()` followed by `sources?.shift()`,
+ *  which silently skipped the second half whenever `sources` was undefined and
+ *  desynchronised provenance from that point on — permanently, since every
+ *  later push appended to both. */
+export function dropOldestEmbedding(profile: VoiceProfile): { droppedSource: string | null } {
+  if (profile.embeddings.length === 0) return { droppedSource: null }
+  profile.embeddings.shift()
+  if (!Array.isArray(profile.sources)) profile.sources = []
+  // Re-align first so a short sources[] cannot shift the wrong provenance off.
+  while (profile.sources.length < profile.embeddings.length + 1) profile.sources.push(UNKNOWN_SOURCE)
+  const droppedSource = profile.sources.shift() ?? null
+  profile.sources.length = profile.embeddings.length
+  return { droppedSource }
+}
+
+/** Append a sample to both arrays together. */
+export function appendEmbedding(profile: VoiceProfile, embedding: number[], source: string): void {
+  if (!Array.isArray(profile.sources)) profile.sources = []
+  while (profile.sources.length < profile.embeddings.length) profile.sources.push(UNKNOWN_SOURCE)
+  profile.embeddings.push(embedding)
+  profile.sources.push(source)
+}
+
+/** Remove every sample whose provenance matches, e.g. one poisoned session.
+ *  Returns the number removed so a retraction can be reported rather than
+ *  assumed. */
+export function removeEmbeddingsBySource(
+  profile: VoiceProfile,
+  predicate: (source: string) => boolean,
+): number {
+  if (!Array.isArray(profile.sources)) profile.sources = []
+  while (profile.sources.length < profile.embeddings.length) profile.sources.push(UNKNOWN_SOURCE)
+  const keptEmbeddings: number[][] = []
+  const keptSources: string[] = []
+  let removed = 0
+  for (let i = 0; i < profile.embeddings.length; i++) {
+    if (predicate(profile.sources[i] ?? UNKNOWN_SOURCE)) { removed++; continue }
+    keptEmbeddings.push(profile.embeddings[i])
+    keptSources.push(profile.sources[i] ?? UNKNOWN_SOURCE)
+  }
+  profile.embeddings = keptEmbeddings
+  profile.sources = keptSources
+  return removed
+}
+
+/** Delete a person's profile outright. Returns what was removed so the caller
+ *  can report a per-store count instead of a bare success. */
+export function deleteProfileFromStore(
+  store: ProfileStore,
+  name: string,
+): { removedProfiles: number; removedEmbeddings: number } {
+  let removedProfiles = 0
+  let removedEmbeddings = 0
+  store.profiles = store.profiles.filter(profile => {
+    if (profile.name !== name) return true
+    removedProfiles++
+    removedEmbeddings += profile.embeddings.length
+    return false
+  })
+  return { removedProfiles, removedEmbeddings }
+}

package/server/lib/whisper-local.ts

@@ -8,7 +8,7 @@
 
 import { spawn, execFile } from 'node:child_process'
 import type { ChildProcess } from 'node:child_process'
-import { writeFileSync, unlinkSync, existsSync, readFileSync } from 'node:fs'
+import { writeFileSync, unlinkSync, existsSync, readFileSync, statSync } from 'node:fs'
 import { basename, join } from 'node:path'
 import { homedir } from 'node:os'
 import crypto from 'node:crypto'
@@ -74,6 +74,37 @@ export interface HighQualityTranscriptionResult {
   degradationReason?: HighQualityUnavailableReason
 }
 
+let highQualityCheckpointFingerprint: string | null = null
+
+/** Stable, path-free cache identity for progressive meeting HQ checkpoints.
+ * Model/configuration is immutable for the lifetime of one server process, so
+ * cache this instead of stat'ing multi-GB model files on every health poll. */
+export function getHighQualityCheckpointFingerprint(): string {
+  if (highQualityCheckpointFingerprint) return highQualityCheckpointFingerprint
+  const identity = (path: string): Record<string, number | boolean> => {
+    try {
+      const stat = statSync(path)
+      return { present: true, size: stat.size, mtimeMs: Math.floor(stat.mtimeMs) }
+    } catch {
+      return { present: false, size: 0, mtimeMs: 0 }
+    }
+  }
+  highQualityCheckpointFingerprint = crypto.createHash('sha256').update(JSON.stringify({
+    schema: 2,
+    serverVersion: process.env.COS_SERVER_VERSION?.trim() || 'development',
+    whisperCli: identity(WHISPER_CLI),
+    model: identity(resolveBatchModel()),
+    vad: identity(VAD_MODEL_PATH),
+    beam: 5,
+    bestOf: 5,
+    vadEnabled: hqCliVadEnabled('batch'),
+    enhancement: 'audio-enhance-v1',
+    prompt: buildWhisperPrompt(),
+    corrections: getWhisperCorrections(),
+  })).digest('hex')
+  return highQualityCheckpointFingerprint
+}
+
 export function classifyHighQualityTranscriptionCapability(input: {
   enabled: boolean
   cliPresent: boolean
@@ -806,7 +837,14 @@ export async function transcribeHighQuality(
   /** forceCpu: the batch pipeline's one CPU retry after a Metal preempt. It
    *  bypasses the gate entirely so the retry cannot itself be preempted into
    *  an infinite loop. */
-  opts: { priority?: 'interactive' | 'batch'; forceCpu?: boolean } = {},
+  opts: {
+    priority?: 'interactive' | 'batch'
+    forceCpu?: boolean
+    forceCpuReason?: string
+    threads?: number
+    backgroundCpu?: boolean
+    signal?: AbortSignal
+  } = {},
 ): Promise<HighQualityTranscriptionResult> {
   if (!cliAvailable) {
     // Fall back to server (no beam search available via HTTP API)
@@ -844,7 +882,7 @@ export async function transcribeHighQuality(
     const useVad = hqCliVadEnabled(opts.priority)
     const decision: { device: 'metal' | 'cpu'; reason: string; metalEnabled: boolean } = isBatch
       ? (opts.forceCpu
-          ? { device: 'cpu', reason: 'preempt_retry', metalEnabled: batchHqMetalEnabled() }
+          ? { device: 'cpu', reason: opts.forceCpuReason || 'preempt_retry', metalEnabled: batchHqMetalEnabled() }
           : chooseBatchDevice())
       : { device: 'metal', reason: 'interactive', metalEnabled: batchHqMetalEnabled() }
     const useMetal = decision.device === 'metal'
@@ -858,11 +896,14 @@ export async function transcribeHighQuality(
         : 2
       const beam = isBatch ? 5 : interactiveBeam
       const bestOf = beam
+      const requestedThreads = Number.isFinite(opts.threads)
+        ? Math.max(1, Math.min(16, Math.floor(opts.threads!)))
+        : 8
       const args = [
         '-m', modelPath,
         '-f', tmpWav,
         // CPU batch stays at 8 threads so it cannot starve live work of cores.
-        '-t', (isBatch && !useMetal) ? '8' : '16',
+        '-t', (isBatch && !useMetal) ? String(requestedThreads) : '16',
         '-l', 'en',
         ...(useMetal ? ['-fa'] : ['-ng']),
         '-bs', String(beam),
@@ -879,9 +920,18 @@ export async function transcribeHighQuality(
         // omits this — VAD was measured dropping real leading speech on compose.
         args.push('--vad', '--vad-model', VAD_MODEL_PATH)
       }
-      const proc = spawn(WHISPER_CLI, args, {
+      const useBackgroundTaskPolicy = Boolean(
+        isBatch && !useMetal && opts.backgroundCpu
+        && process.platform === 'darwin'
+        && existsSync('/usr/sbin/taskpolicy'),
+      )
+      const proc = spawn(
+        useBackgroundTaskPolicy ? '/usr/sbin/taskpolicy' : WHISPER_CLI,
+        useBackgroundTaskPolicy ? ['-b', WHISPER_CLI, ...args] : args,
+        {
         stdio: ['ignore', 'pipe', 'pipe'],
-      })
+        },
+      )
       ownedHqChildren.add(proc)
 
       // BLOCKER contract: a preempted Metal child is a HARD FAIL. Its stdout
@@ -896,6 +946,17 @@ export async function transcribeHighQuality(
 
       let stdout = ''
       let stderr = ''
+      let aborted = false
+      let abortForceKill: ReturnType<typeof setTimeout> | null = null
+      const onAbort = (): void => {
+        aborted = true
+        try { proc.kill('SIGTERM') } catch { /* already exited */ }
+        abortForceKill = setTimeout(() => {
+          try { proc.kill('SIGKILL') } catch { /* already exited */ }
+        }, 2_000)
+      }
+      if (opts.signal?.aborted) onAbort()
+      else opts.signal?.addEventListener('abort', onAbort, { once: true })
       proc.stdout.on('data', (chunk: Buffer) => { stdout += chunk.toString() })
       proc.stderr.on('data', (chunk: Buffer) => { stderr += chunk.toString() })
 
@@ -915,9 +976,11 @@ export async function transcribeHighQuality(
       }, timeoutMs)
 
       proc.on('close', (code) => {
+        opts.signal?.removeEventListener('abort', onAbort)
         ownedHqChildren.delete(proc)
         unregisterMetalBatchChild(proc)
         clearTimeout(timeout)
+        if (abortForceKill) clearTimeout(abortForceKill)
         if (forceKill) clearTimeout(forceKill)
         // Preempt is checked FIRST and ignores the exit code: SIGTERM often
         // yields a non-zero code, but a race could also let the child exit 0
@@ -926,6 +989,12 @@ export async function transcribeHighQuality(
           reject(new MetalBatchPreemptedError(preemptedReason))
           return
         }
+        if (aborted) {
+          const error = new Error('Progressive HQ checkpoint aborted')
+          error.name = 'AbortError'
+          reject(error)
+          return
+        }
         if (timedOut) {
           reject(new Error(`whisper-cli HQ timeout (${timeoutMs / 1000}s, model=${useLargeV3 ? 'large-v3' : 'turbo'})`))
           return
@@ -938,9 +1007,11 @@ export async function transcribeHighQuality(
       })
 
       proc.on('error', (err) => {
+        opts.signal?.removeEventListener('abort', onAbort)
         ownedHqChildren.delete(proc)
         unregisterMetalBatchChild(proc)
         clearTimeout(timeout)
+        if (abortForceKill) clearTimeout(abortForceKill)
         if (forceKill) clearTimeout(forceKill)
         reject(new Error(`whisper-cli HQ spawn error: ${err.message}`))
       })

package/server/routes/health.ts

@@ -6,7 +6,7 @@ import { serverMetrics } from '../lib/server-metrics.js'
 import { getServerInstanceId } from '../lib/server-instance-id.js'
 import { localFirstMeetingsCapability } from '../lib/local-first-meetings-contract.js'
 import { isSileroAvailable } from '../lib/vad-silero.js'
-import { speakerModelState } from '../lib/speaker-embeddings.js'
+import { speakerModelState, speakerReadiness } from '../lib/speaker-embeddings.js'
 import { getAvailableCliSessionId } from '../lib/claude-bridge.js'
 import {
   isWhisperLocalAvailable,
@@ -40,6 +40,9 @@ import { listUnsavedCaptures } from '../lib/unsaved-audio-quarantine.js'
 import { getWhisperPreviewCapability } from '../lib/whisper-preview.js'
 import { getTranscriptionProfileStatus } from '../lib/profile.js'
 import { getHealthStaticProbes } from '../lib/health-static-probes.js'
+import { getEarlyMeetingSyncSnapshot } from '../lib/g2-ops-handoff.js'
+import { getProgressiveHqSnapshot } from '../lib/meeting-batch-transcribe.js'
+import { getMeetingFinalizationSnapshot } from '../lib/meeting-finalization-jobs.js'
 
 export const healthRouter = Router()
 
@@ -110,7 +113,8 @@ healthRouter.get('/health', async (_req, res) => {
   // npm tarball), so publish its state rather than letting the amplitude
   // fallback masquerade as working diarization. Availability only — the resolved
   // path is a local filesystem detail and health is unauthenticated.
-  checks.speaker_id = speakerModelState().state
+  const speakerId = speakerModelState()
+  checks.speaker_id = speakerId.state
 
   // Health is unauthenticated. Publish only availability; the actual CLI
   // session id is a resumable runtime handle and belongs on authenticated
@@ -173,15 +177,22 @@ healthRouter.get('/health', async (_req, res) => {
       : whisper_health.startupState === 'preflight' || whisper_health.startupState === 'loading'
         ? 'starting'
         : 'degraded'
+  // A configured-but-broken voiceprint model is a fault, not a preference. The
+  // full reasoning, including why 'unavailable' must NOT degrade, lives with
+  // speakerReadiness() so it is testable rather than an inline ternary here.
+  const speakerReadinessState = speakerReadiness(speakerId.state)
   const readiness = {
     // /api/health remains a liveness endpoint and intentionally returns HTTP
     // 200 while the server can answer. This separate field prevents an HTTP-
     // green response from hiding a configured local subsystem failure.
-    status: whisperReadiness === 'degraded' ? 'degraded' : 'ready',
+    status: whisperReadiness === 'degraded' || speakerReadinessState === 'degraded' ? 'degraded' : 'ready',
     admissions: maintenance.admissionsOpen ? 'open' : 'maintenance',
     whisper: whisperReadiness,
     whisperError: whisper_health.lastError,
     localTts: tts_local.ready ? 'ready' : 'unavailable',
+    // Asserted, not merely reported: `speaker_id` above says what the state IS,
+    // this says whether that state is acceptable.
+    speakerId: speakerReadinessState,
   }
   const openai_whisper_budget = getOpenAIWhisperBudgetState()
   const codex_models = getCodexModelCatalogSnapshot()
@@ -190,6 +201,7 @@ healthRouter.get('/health', async (_req, res) => {
   const cursorSnapshot = getCursorModelCatalogSnapshot()
   const { agentBinary: _cursorAgentBinary, ...cursor_models } = cursorSnapshot
   const meeting_sync = getMeetingSyncSnapshot()
+  const progressiveHq = getProgressiveHqSnapshot()
   // Quarantined unsaved captures (6.19.0). Compact on this unauthenticated
   // surface — same exposure level as meeting_sync's meetingIds. Full detail
   // plus the recover action live on the authenticated /api/meeting/orphans.
@@ -235,6 +247,11 @@ healthRouter.get('/health', async (_req, res) => {
       },
       cliDebug: CLI_DEBUG_CAPABILITY,
       liveCues,
+      meetingLifecycle: {
+        earlySyncClaim: getEarlyMeetingSyncSnapshot(),
+        progressiveHq,
+        finalization: getMeetingFinalizationSnapshot(),
+      },
       ...(localFirstMeetings ? { localFirstMeetings } : {}),
     },
     // /api/health is intentionally unauthenticated for setup diagnostics.
@@ -261,6 +278,7 @@ healthRouter.get('/models', async (req, res) => {
   const transcriptionHq = getHighQualityTranscriptionCapability()
   const transcriptionLive = getWhisperPreviewCapability()
   const transcriptionProfile = getTranscriptionProfileStatus()
+  const progressiveHq = getProgressiveHqSnapshot()
   const cursorOptions = cursorCatalog.options.filter(option => !!option.id)
   res.json({
     ...catalog,
@@ -282,6 +300,11 @@ healthRouter.get('/models', async (req, res) => {
         hq: transcriptionHq,
         profile: transcriptionProfile,
       },
+      meetingLifecycle: {
+        earlySyncClaim: getEarlyMeetingSyncSnapshot(),
+        progressiveHq,
+        finalization: getMeetingFinalizationSnapshot(),
+      },
       cliDebug: CLI_DEBUG_CAPABILITY,
       recovery: managedRuntimeCapability(),
       // Same helper as /api/health — the companion's 15s liveness poll reads