@gotcos/glasses-server 6.52.0 → 6.52.3

package/CHANGELOG.md

@@ -1,3 +1,22 @@
+## 6.52.3
+
+### A quiet ring stays with its owner; a zombie never takes it on waking
+
+2026-09-20: a hidden copy of the glasses app from the night before took the ring after the live copy went quiet, and answered a hold-to-talk 27 minutes later with a stale session. Under 6.50.4 an older boot could take a ring whose owner had been quiet for 45 s, and a locked phone is quiet for longer than that.
+
+- **An older boot takes a quiet ring back only after ten minutes** (`CLIENT_INSTANCE_RECLAIM_MS`), **and only while it has itself been claiming** (`CLIENT_INSTANCE_AWAKE_MS`, 45 s: its own previous claim must be that recent). Both copies sleep when the phone does, so a zombie that wakes beside the live copy has a gap of its own and is refused; the live copy's refresh then lands within a tick. A copy never seen before is not awake. A NEWER boot still takes at once, however quiet the owner: reopening COS remains the fix for a dead copy. The route remembers each copy's last claim time (`CLIENT_INSTANCE_MAX_SEEN` 64, least recent dropped).
+- Everything else in the referee is 6.50.4: one owner per device, the recording holds (own tagged chunks, `recording` in the claim), `check: true` never takes, no protocol change. Glasses 6.9.510 and 6.9.516 see only the longer takeover window. No new client is required; glasses 6.9.518 adds the matching client-side check.
+- **The 6.52.1 Codex fixtures now expect `turn_started_at`.** 6.52.1 stamped the prompt line with the user record's timestamp and left three `session-stream-codex` expectations on the old shape, so the suite was red. The behaviour is unchanged; the expectations were updated.
+- Tests: the reclaim edge (10 min, awake), the overnight zombie (hours-old own claim, never seen), the awake edge to the millisecond, the newer boot still taking, and over HTTP: checks past the window say owner without taking, a first claim after sleep is refused and the next tick takes. Gate: `referee-zombie-reclaims-after-45s`, `referee-asleep-zombie-reclaims`, `referee-never-seen-counts-as-awake`, `referee-last-seen-unnoted`.
+
+## 6.52.1
+
+### Session turn clock
+
+Sessions prompt events now carry additive `turn_started_at` (ISO), the timestamp on the user record that started the turn. Seed, reconnect, and live frames keep that value; transport `at` is still `Date.now()` at emit time, so a reconnect no longer resets the glasses elapsed clock. `/api/models` advertises `capabilities.runningTurnMeta.protocolVersion = 1`. A 6.52.0 client strips the unknown field and renders as before. Messages jobs already have durable `startedAt`; this is Sessions only.
+
+- Tests: a Claude user row with `timestamp` stamps the prompt draft; a row without one is byte-identical to 6.52.0; the models capability is present beside `sessionQuestions`.
+
 ## 6.52.0
 
 ### Messages trail

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.52.0",
+  "version": "6.52.3",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {

package/server/lib/client-instance-claim.ts

@@ -16,6 +16,20 @@
 export const CLIENT_INSTANCE_TICK_MS = 15_000
 /** Three missed ticks: the owner is gone. */
 export const CLIENT_INSTANCE_LIVE_MS = 3 * CLIENT_INSTANCE_TICK_MS
+/**
+ * 6.52.3: how long the owner must be quiet before an OLDER boot may take the ring back.
+ * On 2026-09-20 a hidden copy from the night before took the ring after the live copy
+ * went quiet (a locked phone throttles its timers) and answered a hold-to-talk 27 minutes
+ * later with a stale session. 45 s is a normal quiet spell for a locked phone; a dead
+ * copy stays dead, so waiting ten minutes costs nothing.
+ */
+export const CLIENT_INSTANCE_RECLAIM_MS = 10 * 60_000
+/**
+ * 6.52.3: an older boot may take the ring back only when ITS OWN previous claim is this
+ * recent. Both copies sleep when the phone does; a zombie that woke up alongside the live
+ * copy has a gap of its own, and the live copy's refresh lands within a tick.
+ */
+export const CLIENT_INSTANCE_AWAKE_MS = CLIENT_INSTANCE_LIVE_MS
 /**
  * 6.50.4: a meeting chunk inside this window means that copy is recording. Five chunk
  * intervals (~6 s each), so a stretch of silence or a slow upload does not end the hold.
@@ -126,6 +140,8 @@ export function arbitrateClientInstance(
   claim: ClientInstanceClaim,
   now: number,
   evidence: CaptureEvidence = NO_CAPTURE,
+  /** When this claimant last claimed (any verdict), or undefined: never seen. */
+  claimantLastSeenAt?: number,
 ): { owner: ClientInstanceOwner; verdict: ClientInstanceVerdict; took: boolean } {
   const fresh: ClientInstanceOwner = { ...claim, seenAt: now }
   if (!owner) return { owner: fresh, verdict: 'owner', took: true }
@@ -142,6 +158,11 @@ export function arbitrateClientInstance(
   // The ring moves on the newer copy's first claim after the meeting stops.
   if (ownerIsRecording(owner, evidence, now)) return { owner, verdict: 'yield', took: false }
   if (isNewer(claim, owner)) return { owner: fresh, verdict: 'owner', took: true }
-  if (now - owner.seenAt > CLIENT_INSTANCE_LIVE_MS) return { owner: fresh, verdict: 'owner', took: true }
+  // 6.52.3: an older boot takes a quiet ring back only after CLIENT_INSTANCE_RECLAIM_MS,
+  // and only while it has itself been claiming (awake), never on the first tick after a
+  // gap of its own. A dead newer copy is replaced when the user reopens COS (a newer boot
+  // still takes at once); this rule is for the copy that is merely quiet.
+  const claimantAwake = claimantLastSeenAt !== undefined && now - claimantLastSeenAt <= CLIENT_INSTANCE_AWAKE_MS
+  if (now - owner.seenAt > CLIENT_INSTANCE_RECLAIM_MS && claimantAwake) return { owner: fresh, verdict: 'owner', took: true }
   return { owner, verdict: 'yield', took: false }
 }

package/server/lib/session-stream-events.ts

@@ -37,7 +37,7 @@ export type SessionStreamDraft =
   // ADDITIVE TO A CLOSED SET, AND SAFE BY CONSTRUCTION: the client validates `kind`
   // against its own table and ignores anything it does not know, so a build that
   // predates this renders exactly as it did before rather than breaking.
-  | { kind: 'prompt'; text: string }
+  | { kind: 'prompt'; text: string; turn_started_at?: string }
   | { kind: 'prose'; text: string }
   // 6.49.0: `tool_outcome` rides on a status draft, never on a new kind. A shipped
   // client drops an unknown kind BEFORE seq accounting and paints a gap row for it
@@ -173,6 +173,35 @@ function asRecord(value: unknown): Record<string, unknown> | null {
     : null
 }
 
+/** ISO time the current turn actually started, from the transcript record. */
+export function recordTimestampIso(record: Record<string, unknown>): string | undefined {
+  const nested = asRecord(record.payload)
+  const item = asRecord(record.item)
+  const candidates = [record.timestamp, record.ts, nested?.timestamp, nested?.ts, item?.timestamp]
+  for (const c of candidates) {
+    if (typeof c === 'string' && c.trim()) {
+      const t = Date.parse(c)
+      if (Number.isFinite(t) && t > 0) return new Date(t).toISOString()
+    }
+    if (typeof c === 'number' && Number.isFinite(c) && c > 0) {
+      const ms = c < 1e12 ? c * 1000 : c
+      if (Number.isFinite(ms) && ms > 0) return new Date(ms).toISOString()
+    }
+  }
+  return undefined
+}
+
+function stampPromptTurnStart(drafts: SessionStreamDraft[], record: Record<string, unknown>): SessionStreamDraft[] {
+  const iso = recordTimestampIso(record)
+  if (!iso) return drafts
+  let stamped = false
+  return drafts.map((draft) => {
+    if (draft.kind !== 'prompt' || stamped) return draft
+    stamped = true
+    return { ...draft, turn_started_at: iso }
+  })
+}
+
 function countLines(value: unknown): number {
   if (typeof value !== 'string' || value.length === 0) return 0
   return value.split('\n').length
@@ -1233,9 +1262,8 @@ export function draftsFromRecord(
   const obj = asRecord(record)
   if (!obj) return []
   try {
-    if (provider === 'codex') return draftsFromCodexRecord(obj)
-    // Cursor shares Claude's content-block shape, keyed off `role` instead of `type`.
-    return draftsFromClaudeRecord(obj)
+    const drafts = provider === 'codex' ? draftsFromCodexRecord(obj) : draftsFromClaudeRecord(obj)
+    return stampPromptTurnStart(drafts, obj)
   } catch {
     // A malformed record costs one line of the trail. It must never cost the stream.
     return []

package/server/routes/client-instance.ts

@@ -27,6 +27,8 @@ import {
 
 /** Owners kept at once; the least recently seen device is dropped past this. */
 export const CLIENT_INSTANCE_MAX_DEVICES = 16
+/** Copies whose last claim time is remembered (6.52.3); the least recent is dropped past this. */
+export const CLIENT_INSTANCE_MAX_SEEN = 64
 
 export interface ClientInstanceRouterDeps {
   now?: () => number
@@ -49,6 +51,13 @@ export function createClientInstanceRouter(deps: ClientInstanceRouterDeps | (()
   const router = Router()
   const owners = new Map<string, ClientInstanceOwner>()
   const chunks = new ClientChunkLedger()
+  // 6.52.3: when each copy last claimed, so an older boot proves it was awake before it
+  // may take a quiet ring back. Bounded like the chunk ledger.
+  const lastSeen = new Map<string, number>()
+  const noteSeen = (id: string, at: number) => {
+    lastSeen.delete(id); lastSeen.set(id, at)
+    while (lastSeen.size > CLIENT_INSTANCE_MAX_SEEN) lastSeen.delete(lastSeen.keys().next().value as string)
+  }
   router.use((req, _res, next) => {
     if (isMeetingChunkPost(req.method, req.path)) chunks.note(deviceKey(req.socket?.remoteAddress ?? req.ip), parseInstanceTag(req.query?.clientInstance), now())
     next()
@@ -61,7 +70,9 @@ export function createClientInstanceRouter(deps: ClientInstanceRouterDeps | (()
     const previous = owners.get(device) ?? null
     const evidence = previous ? chunks.evidence(device, previous.id, claim.id, at) : NO_CAPTURE
     const captureLive = previous ? ownerIsRecording(previous, evidence, at) : false
-    const result = arbitrateClientInstance(previous, claim, at, evidence)
+    const claimantLastSeenAt = lastSeen.get(claim.id)
+    noteSeen(claim.id, at)
+    const result = arbitrateClientInstance(previous, claim, at, evidence, claimantLastSeenAt)
     if (req.body?.check === true) {
       const shown = previous ?? result.owner
       return void res.json({ verdict: result.verdict, owner: { id: shown.id, bootAt: shown.bootAt, version: shown.version, seenAt: shown.seenAt }, check: true, captureLive })

package/server/routes/health.ts

@@ -588,6 +588,10 @@ healthRouter.get('/models', async (req, res) => {
       // `GET /api/session-questions?client=glasses|phone` every `pollIntervalMs`; one
       // quiet for `liveWindowMs` hands every held request back to the Mac.
       sessionQuestions: sessionQuestionsCapability(),
+      // 6.52.1: Sessions prompt events carry additive `turn_started_at` (ISO), the
+      // real user-record time. Transport `at` stays the seed/live stamp. Absent on
+      // 6.52.0, the client falls back to a local pin.
+      runningTurnMeta: { protocolVersion: 1 },
       transcription: {
         ...transcription,
         live: transcriptionLive,