@gotcos/glasses-server 6.36.17 → 6.36.20

package/CHANGELOG.md

@@ -1,3 +1,72 @@
+## 6.36.20
+
+Follow-up to 6.36.19, which was never published. QA found three things in it.
+
+**The reset CLI mutated production archives just by importing.**
+`message-era-reset.ts` imported `endSession`/`getActiveSessions` from
+`conversation.js` and used neither -- but that module's scope runs
+`loadFromDisk()` and a boot `runDailyArchiveMirror()`. In the one-shot CLI that
+is a second process concurrently loading and rewriting the archives the live
+server owns, and `appendToArchive` appends rather than upserts, so it can
+duplicate prior-day chats. The import is gone, and a test now asserts it stays
+gone. The previous canary injected an `archiveAndRelease` and asserted it was
+never called, which only ever caught a regression routed through the callback --
+the code it replaced called `endSession()` directly as its default. `sessions`
+and `archiveAndRelease` are deleted from the input type rather than left as a
+silent no-op for a future caller.
+
+**A corrupt `message-era.json` was indistinguishable from a reset.**
+`currentMessageEraState` fell back to `legacy` on missing OR invalid content.
+Reverting to `legacy` after a real era existed is the worst available answer: it
+re-reads every era-stamped exchange as a PREVIOUS era, hiding it from
+`/all-messages`, while promoting unstamped ones to current -- and to a client it
+looks exactly like a reset nobody asked for. Missing still means `legacy`, which
+is correct for a first upgrade whose exchanges carry no stamp at all. Corrupt
+now rotates explicitly, says so on stderr, and degrades to `legacy` without
+caching only if the replacement cannot be persisted.
+
+**The header described a code path that had been removed.** It still said
+rotation stops "if an archive write fails". There is no archive write. It now
+also records what 6.36.19 quietly changed: this path does NOT archive, and the
+daily mirror skips today by design, so a same-day copy exists only after an
+explicit session end or `POST /api/archive/now`.
+
+The 409 copy on both query paths no longer tells the wearer to reopen for a
+"fresh message list" -- as of app 6.8.423 the cards stay.
+
+Requires app 6.8.423. Suite 2985 / 211 files, tsc 0. The conversation-import
+canary is mutation-verified: reintroducing the import fails it.
+
+## 6.36.19
+- **Resetting the spoken message count no longer ends the conversation.**
+  `resetLiveMessageEra` used to `endSession` every live session before rotating
+  the era, so "reset the message count" also emptied CHAT and killed the thread
+  the wearer was in the middle of. It now rotates the era and nothing else.
+- Numbers stay unique because they were never bare ints: a number is
+  `{messageEra, globalMsgNum}`. The era rotates, the current-era ceiling
+  restarts at 0, and leftover cards keep their old era and their old number.
+  Lookup already prefers the current era (`message-ref.ts:231-234`) and the
+  counter is already era-scoped (`message-ref.ts:242-251`), so "message N" stays
+  unambiguous without a second ID scheme.
+- `archived` stays in the response and is now always `0`. Callers read the field,
+  so it is kept — but copy that reports it must stop claiming sessions were
+  archived. The `archive_failed` 503 path is **gone**, not relocated: there is no
+  archive step left to fail.
+- Tests inverted to match. A supplied `archiveAndRelease` is now asserted
+  *never to be called*, and a refusing one can no longer block the rotation.
+  Mutation-verified: reintroducing the release loop fails the suite.
+
+**Ship gate:** do not POST `/api/message-era/reset` from any surface until app
+6.8.422 is also live. Server-first plus the old companion still wipes local
+messages, and `/sessions/today/all-messages` is era-filtered so recover cannot
+bring the leftover cards back.
+
+## 6.36.18
+- **Meetings list now carries voice-assignment tags.** Each row includes
+  `voiceReview` from the sidecar head (`speakers[]`) plus whether a human
+  correction landed in the ledger. Control paints NEW / N to name / REVIEWED
+  without opening each meeting. Still a 4 KB head read — not a chunk parse.
+
 ## 6.36.17
 - **Naming a new person from a wrong existing label now creates their voice profile.**
   Enrolment after `POST /relabel` only fired when `from` was a placeholder (`Ext`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.36.17",
+  "version": "6.36.20",
   "description": "COS Glasses — self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/lib/cos-operations-meetings.ts

@@ -18,6 +18,7 @@ import { basename, dirname, join, resolve } from 'node:path'
 import { discoveredDomains, domainAbbreviation as deriveAbbr, isSafeDomainName as safeName } from './domains.js'
 import type { MeetingDetail, MeetingMeta } from './meeting-store.js'
 import { MEETING_SOURCE_MAX_BYTES, meetingDayCountsFromNames, meetingListLimit } from './meeting-store.js'
+import { meetingVoiceReview, parseSidecarListHead } from './meeting-voice-review.js'
 
 /**
  * The four domains of ONE user's COS. Retained as the documented example layout
@@ -151,30 +152,35 @@ const SIDECAR_HEAD_BYTES = 4096
  * them whole would make listing cost scale with total transcript size — and this
  * lister already reads every markdown file it finds.
  */
-export function sidecarSessionId(monthDir: string, meetingFilename: string): string | undefined {
+export function sidecarListHints(monthDir: string, meetingFilename: string): {
+  sessionId?: string
+  speakers: string[]
+} {
   const sidecarName = meetingFilename.replace(/\.md$/, '.g2-chunks.json')
-  if (sidecarName === meetingFilename) return undefined
+  if (sidecarName === meetingFilename) return { speakers: [] }
   const path = join(monthDir, sidecarName)
   let fd: number | null = null
   try {
     const linkStat = lstatSync(path)
-    if (linkStat.isSymbolicLink() || !linkStat.isFile() || linkStat.size === 0) return undefined
+    if (linkStat.isSymbolicLink() || !linkStat.isFile() || linkStat.size === 0) return { speakers: [] }
     const real = realpathSync(path)
-    if (dirname(real) !== realpathSync(monthDir)) return undefined
+    if (dirname(real) !== realpathSync(monthDir)) return { speakers: [] }
     const stat = statSync(real)
     fd = openSync(path, 'r')
     const buffer = Buffer.alloc(Math.min(SIDECAR_HEAD_BYTES, stat.size))
     const read = readSync(fd, buffer, 0, buffer.length, 0)
-    const match = buffer.subarray(0, read).toString('utf8')
-      .match(/"sessionId"\s*:\s*"([A-Za-z0-9:_-]{3,96})"/)
-    return match ? match[1] : undefined
+    return parseSidecarListHead(buffer.subarray(0, read).toString('utf8'))
   } catch {
-    return undefined
+    return { speakers: [] }
   } finally {
     if (fd !== null) { try { closeSync(fd) } catch { /* already closed */ } }
   }
 }
 
+export function sidecarSessionId(monthDir: string, meetingFilename: string): string | undefined {
+  return sidecarListHints(monthDir, meetingFilename).sessionId
+}
+
 function envPath(name: string): string | null {
   const raw = process.env[name]?.trim()
   if (!raw) return null
@@ -563,8 +569,11 @@ export function listCosOperationsMeetings(options: {
               meta.recordId = `ops:${domain}:${month}:${file}`
               meta.mutable = true
               meta.canonicalRecord = `operations/${domain}/meetings/${month}/${file}`
-              const sessionId = sidecarSessionId(monthDir, file)
-              if (sessionId) meta.sessionId = sessionId
+              const hints = sidecarListHints(monthDir, file)
+              if (hints.sessionId) meta.sessionId = hints.sessionId
+              if (hints.speakers.length > 0) {
+                meta.voiceReview = meetingVoiceReview(hints.speakers, hints.sessionId)
+              }
               if (options.day && meta.date !== options.day) continue
               allMeetings.push(meta)
             } catch { /* skip unreadable files */ }

package/server/lib/meeting-store.ts

@@ -94,6 +94,13 @@ export interface MeetingMeta {
   mutable?: boolean
   /** Present only when the server can state a truthful local record. */
   canonicalRecord?: string
+  /** Additive. Unique sidecar speakers + whether a human correction landed. */
+  voiceReview?: {
+    voices: number
+    unattributedVoices: number
+    namedVoices: number
+    humanTouched: boolean
+  }
 }
 
 export interface MeetingActionItem {

package/server/lib/meeting-voice-review.ts

@@ -0,0 +1,53 @@
+// Cheap voice-assignment stats for the meetings LIST.
+//
+// The Speakers panel's "Meetings to review" row cannot open every sidecar just
+// to paint a tag. The unique `speakers` array sits at the top of the sidecar,
+// so a 4 KB head read already used for `sessionId` is enough. Segment counts
+// stay on the per-meeting review route.
+
+import { isUnattributed } from './meeting-speaker-review.js'
+import { readCorrections } from './meeting-corrections.js'
+
+export interface MeetingVoiceReview {
+  voices: number
+  unattributedVoices: number
+  namedVoices: number
+  humanTouched: boolean
+}
+
+export function parseSidecarListHead(head: string): {
+  sessionId?: string
+  speakers: string[]
+} {
+  const sessionId = head.match(/"sessionId"\s*:\s*"([A-Za-z0-9:_-]{3,96})"/)?.[1]
+  const block = head.match(/"speakers"\s*:\s*\[([^\]]*)\]/)
+  const speakers = block
+    ? [...block[1].matchAll(/"((?:\\.|[^"\\])*)"/g)].map(match => match[1].replace(/\\"/g, '"'))
+    : []
+  return { sessionId, speakers }
+}
+
+export function meetingVoiceReview(
+  speakers: string[],
+  sessionId?: string,
+): MeetingVoiceReview {
+  const labels = [...new Set(speakers.map(name => name.trim()).filter(Boolean))]
+  const unattributedVoices = labels.filter(isUnattributed).length
+  return {
+    voices: labels.length,
+    unattributedVoices,
+    namedVoices: Math.max(0, labels.length - unattributedVoices),
+    humanTouched: sessionWasHumanTouched(sessionId),
+  }
+}
+
+export function sessionWasHumanTouched(sessionId?: string): boolean {
+  if (!sessionId) return false
+  try {
+    return readCorrections(sessionId).rows.some(
+      row => row.phase === 'applied' || row.phase === 'confirmed',
+    )
+  } catch {
+    return false
+  }
+}

package/server/lib/message-era-reset.ts

@@ -1,15 +1,23 @@
-// Archive live sessions, then start short-numbering at #1.
-// History is retained in day archives; only the current era's ceiling resets.
-// Disk mtime on message-era.json is enough — the live server re-reads it.
-// Do not rotate the era if a query is in flight or an archive write fails.
-
-import { endSession, getActiveSessions } from './conversation.js'
+// Rotate the short-number namespace. Live sessions are NOT ended and nothing
+// is archived here: the companion keeps every card, so the reset is a numbering
+// change rather than a history change.
+//
+// Do not rotate the era if a query is in flight.
+//
+// NOTE: this file deliberately imports nothing from ./conversation.js. Importing
+// it runs its module scope -- loadFromDisk() and a boot runDailyArchiveMirror()
+// -- which in the one-shot CLI means a second process concurrently loading and
+// rewriting the same archives the live server owns. appendToArchive appends
+// rather than upserts, so that duplicates prior-day chats.
+//
+// Today's exchanges are NOT archived by this path. The daily mirror skips
+// today by design (conversation.ts: `sessionDay >= todayLocal`), so a same-day
+// copy exists only after an explicit session end or POST /api/archive/now.
 import {
   createMessageEra,
   currentMessageEraState,
   type MessageEraState,
 } from './message-era.js'
-import type { SessionToArchive } from './archive.js'
 
 export class MessageEraResetError extends Error {
   readonly code: string
@@ -37,8 +45,6 @@ export interface MessageEraResetInput {
   now?: number
   activeRuns?: number
   shuttingDown?: boolean
-  sessions?: SessionToArchive[]
-  archiveAndRelease?: (session: SessionToArchive) => Promise<boolean>
 }
 
 async function resolveJobHealth(input: MessageEraResetInput): Promise<{ activeRuns: number; shuttingDown: boolean }> {
@@ -79,26 +85,29 @@ export async function resetLiveMessageEra(input: MessageEraResetInput): Promise<
   }
 
   const previous = currentMessageEraState()
-  const sessions = input.sessions ?? getActiveSessions()
-  const archiveAndRelease = input.archiveAndRelease ?? (async (session: SessionToArchive) => {
-    const result = await endSession(session.id)
-    if (!result) return true
-    if (result.exchangeCount > 0 && !result.logged) return false
-    return true
-  })
 
-  let archived = 0
-  for (const session of sessions) {
-    const released = await archiveAndRelease(session)
-    if (!released) {
-      throw new MessageEraResetError(
-        'archive_failed',
-        'Archive failed; message count was not reset.',
-        503,
-      )
-    }
-    archived++
-  }
+  // 6.36.19 — rotate the era, do NOT end the thread.
+  //
+  // This used to endSession() every live session before rotating, which is what
+  // made "reset the message count" also empty CHAT and kill the conversation the
+  // wearer was in the middle of. Miles wants the opposite shape: the next message
+  // is #1, the old cards keep their numbers, and the thread survives.
+  //
+  // Numbers stay unique because they are {messageEra, globalMsgNum}, not a bare
+  // int: the era rotates, the current-era ceiling restarts at 0, and leftover
+  // cards keep their old era. Lookup already prefers the current era
+  // (message-ref.ts:231-234) and the counter is already era-scoped
+  // (message-ref.ts:242-251), so nothing downstream needs to change to keep
+  // "message N" unambiguous.
+  //
+  // `archived` stays in the result and is now always 0. Control and the app read
+  // it, so removing the field would break them; the copy that reports it has to
+  // stop claiming sessions were archived.
+  //
+  // Deliberately no archive step here. There is nothing to release, so there is
+  // no 503 archive_failed path any more — that failure mode is gone rather than
+  // relocated. The day-archive mirror already retains history.
+  const archived = 0
 
   const next: MessageEraState = createMessageEra(input.now ?? Date.now())
   return {

package/server/lib/message-era.ts

@@ -55,9 +55,38 @@ export function currentMessageEraState(): MessageEraState {
     cachedMtimeMs = mtimeMs
     return cached
   }
-  cached = { v: 1, era: LEGACY_MESSAGE_ERA, startedAt: 0 }
-  cachedMtimeMs = mtimeMs
-  return cached
+  // Missing is not corrupt. A legacy install upgrading for the first time has
+  // no file AND no era stamps on its exchanges, and only LEGACY_MESSAGE_ERA
+  // classifies an unstamped exchange as current. Rotating here would file every
+  // one of them under a previous era and empty the chat on upgrade.
+  if (loaded.status === 'missing') {
+    cached = { v: 1, era: LEGACY_MESSAGE_ERA, startedAt: 0 }
+    cachedMtimeMs = mtimeMs
+    return cached
+  }
+
+  // Corrupt, or present-but-invalid: the file existed, so a real era almost
+  // certainly did too, and its value is now unrecoverable. Reverting to legacy
+  // would be the worst available answer -- it re-reads every era-stamped
+  // exchange as a PREVIOUS era (hiding it from /all-messages) while promoting
+  // unstamped ones to current, and it is indistinguishable from a reset nobody
+  // asked for. Rotate explicitly and say so, so the state is self-consistent
+  // and the event is diagnosable.
+  console.error(
+    `[message-era] ${MESSAGE_ERA_FILE} was unreadable (status=${loaded.status}); `
+    + 'rotating to a fresh era. Older messages stay in day archives and remain '
+    + 'reachable by session, but not by short number.',
+  )
+  try {
+    return createMessageEra()
+  } catch (err) {
+    // Read-only or full data dir: degrade to legacy rather than crash the
+    // server, but never cache it -- the next call retries the rotation.
+    console.error('[message-era] could not persist the replacement era:', err)
+    cached = null
+    cachedMtimeMs = Number.NaN
+    return { v: 1, era: LEGACY_MESSAGE_ERA, startedAt: 0 }
+  }
 }
 
 export function currentMessageEra(): string {

package/server/lib/query-job-runtime.ts

@@ -82,7 +82,7 @@ export async function preparePublicDurableQueryAdmission(raw: unknown): Promise<
     throw new QueryJobAdmissionPreparationError(
       409,
       'message_era_mismatch',
-      'Reopen or update COS Glasses to start the fresh message list.',
+      'Reopen or update COS Glasses. Your cards stay; the next message is #1.',
     )
   }
   try {

package/server/routes/query.ts

@@ -60,7 +60,7 @@ queryRouter.post('/query', async (req, res) => {
     maintenanceLease.release()
     return res.status(409).json({
       error: 'message_era_mismatch',
-      detail: 'Reopen or update COS Glasses to start the fresh message list.',
+      detail: 'Reopen or update COS Glasses. Your cards stay; the next message is #1.',
       era: activeMessageEra,
     })
   }

package/server/scripts/reset-message-era.ts

@@ -1,6 +1,7 @@
 #!/usr/bin/env tsx
-// Archives live sessions, then creates a fresh short-number namespace.
-// History stays in day archives. Disk mtime is enough — no server restart.
+// Creates a fresh short-number namespace. Live sessions are NOT ended and
+// nothing is archived -- the companion keeps every card. Disk mtime is enough
+// — no server restart.
 //
 //   npx tsx server/scripts/reset-message-era.ts --confirm
 
@@ -22,7 +23,7 @@ console.log(JSON.stringify({
   restartRequired: false,
   verify: 'GET /api/message-counter should return { max: 0, era: "<era above>" }',
   nextSteps: [
-    'Phone: tap RESET # or reopen the companion so the live list clears',
+    'Phone: reopen the companion — cards stay, the next message is #1',
     'Send a test message — expect #1',
   ],
 }, null, 2))