@gotcos/glasses-server 6.58.0 → 6.58.1

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## 6.58.1
+
+### A copy that lost its audio no longer holds the ring
+
+- 2026-09-29, 07:36 to 07:51, glasses 6.9.558 on 6.57.1, the HC standup while driving: a hidden copy of COS (`mumnr7cf`) lost its audio at 07:38:19 (`meeting.audio.silent`, the bridge probe alive, the glasses connected) and went on claiming `recording: true`. Its timers were throttled: 24 log rows in 14 minutes, gaps of 30 s to 208 s. A new copy started the meeting at 07:38:48 and another at 07:45:10; each was told to yield within a second, which stopped its recording. Only the copy opened at 07:50:46 took the ring. About 12.5 minutes (07:38:19 to 07:51:02) never reached the Mac.
+- The cause: an owner's own `recording` word held the ring for as long as it kept claiming (QA round 3's allowance for uploads that lag after an outage), and nothing checked the word against its chunks.
+- **A copy that says it is not recording is believed over its own chunks.** Before, any chunk of its own in the last 30 s held the ring, including chunks committed before its audio stopped and still uploading or replayed. This applies to a claimant taking the ring, and to an owner holding it while that owner keeps claiming (45 s): a copy's start announcement is one claim with a 1.5 s deadline while its chunks get 30 s, so an older `false` can outlive a start the Mac never heard, and then the chunks speak for it. Glasses 6.9.560 says so within seconds of losing its audio. Only a claim that carries the `recording` field counts (glasses 6.9.510+); older copies keep the 6.50.4 rule.
+- **A copy's word alone holds for 150 s (`CLIENT_INSTANCE_WORD_HOLD_MS`) after its newest proof:** its own newest chunk, the start of its recording claims, or a grace after a gap. The worst gap between two chunks from a copy that is recording is one failed upload (the 30 s timeout) plus the longest backoff (60 s); the hold allows one more backoff on top, and is derived from those two constants. After a gap of more than two ticks (`CLIENT_INSTANCE_GRACE_GAP_MS`, an outage or a sleep) a copy still recording gets one fresh hold for its uploads to catch up, and another only after a chunk of its own has arrived since: the 9/29 zombie's gappy claims would otherwise have renewed it forever. The same test applies to a copy taking the ring and to one holding it.
+- **What each copy has said is kept per copy**, across changes of owner. Without that, a copy that lost the ring and took it back started a fresh clock, and a silent copy and an idle newer one traded the ring every few minutes for a whole meeting. Now the ring moves once. Glasses 6.9.560 then stands aside quietly, keeping its meeting until its audio returns or another copy records.
+- **Known limit for builds before 6.9.560:** once the ring has moved, the silent copy keeps its meeting and, told to yield by an owner that is not recording, keeps answering the ring (6.9.510's rule) alongside the new owner until that owner starts recording, when it is told to yield and saves. The Mac could end that sooner only by telling it the new owner records when it does not.
+- For the builds already out (the Even Hub 6.9.538 included), the hold is bounded, not removed: a copy opened while the silent copy's last chunks are under 30 s old, or its word under 150 s (plus one grace), is still told to yield. From then on the next copy to start the meeting keeps it.
+- Unchanged: a newer copy still waits while the owner's own chunks arrive, a duplicate recording still ends on the claimant, untagged chunks still hold only for an owner that claims, and the 6.52.3 reclaim rules.
+- Tests: the 9/29 timeline over HTTP (the new copy keeps the ring, and the zombie is then told to yield with `captureLive: true`); an older build that never stops saying `recording`, held for exactly the hold after its last chunk; a silent 6.9.538 copy and an idle newer one for 20 minutes (the ring moves once); a real recorder uploading on the worst cadence keeps the ring; a claimant that says `false` never takes on its chunks; a copy with nothing to show cannot take the ring back by saying `recording`; the hold's derivation; the one grace per chunk. Two HTTP fixtures that claimed to be 6.9.509 now omit `recording` as 6.9.509 did. Two review rounds (round 1 FIX FIRST: a claimant's own chunks and a fresh clock on every take-back let the ring alternate, and the 90 s hold had no margin over the uploader; round 2 FIX FIRST: believing an owner's old `false` forever let a second copy record alongside one whose start the Mac missed; all fixed, with a test for each).
+
 ## 6.58.0
 
 ### Work: did the session finish the task?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.58.0",
+  "version": "6.58.1",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {

package/server/lib/client-instance-claim.ts

@@ -35,6 +35,28 @@ export const CLIENT_INSTANCE_AWAKE_MS = CLIENT_INSTANCE_LIVE_MS
  * intervals (~6 s each), so a stretch of silence or a slow upload does not end the hold.
  */
 export const CLIENT_INSTANCE_CAPTURE_LIVE_MS = 30_000
+/** The glasses uploader's longest wait between chunk attempts (cos-glasses-app local-first-meeting-uploader.ts, maxBackoffMs). */
+export const GLASSES_UPLOAD_MAX_BACKOFF_MS = 60_000
+/** The glasses chunk upload's request timeout (cos-glasses-app api-client.ts). A failed attempt can take this long. */
+export const GLASSES_UPLOAD_TIMEOUT_MS = 30_000
+/**
+ * 6.58.1: how long a copy's own `recording` word holds without proof. On 2026-09-29 (glasses
+ * 6.9.558) a hidden copy lost its audio at 07:38:19 and kept claiming `recording: true` for 12
+ * minutes; two newer copies started the meeting and were each told to stop within a second, and
+ * 12.5 minutes were never captured. The word exists for upload lag (QA round 3), which is bounded:
+ * the worst gap between two chunk arrivals from a copy that is recording is one failed attempt
+ * (the timeout) plus the longest backoff, 90 s. This allows one more backoff on top (QA, 6.58.1:
+ * exactly 90 s left no margin for a weak link, an ASR stall on the Mac or throttled timers).
+ */
+export const CLIENT_INSTANCE_WORD_HOLD_MS = GLASSES_UPLOAD_TIMEOUT_MS + 2 * GLASSES_UPLOAD_MAX_BACKOFF_MS
+/**
+ * 6.58.1: a gap between an owner's claims longer than two ticks is an outage or a sleep. When the
+ * owner comes back still saying `recording`, its word gets one fresh CLIENT_INSTANCE_WORD_HOLD_MS
+ * for its chunks to catch up, but only if a chunk of its own arrived since the last such grace:
+ * the 2026-09-29 zombie's timers were throttled (gaps of 30 s to 208 s between rows), so a grace
+ * on every gap would have held the ring for it indefinitely.
+ */
+export const CLIENT_INSTANCE_GRACE_GAP_MS = 2 * CLIENT_INSTANCE_TICK_MS
 /** App copies whose newest chunk is remembered; the least recent is dropped past this. */
 export const CLIENT_INSTANCE_MAX_TAGGED = 64
 /** A boot time this far past the server clock is a phone clock set wrong, not a newer copy. */
@@ -45,15 +67,41 @@ export interface ClientInstanceClaim {
   bootAt: number
   version: string
   /**
-   * The copy says it is recording (glasses 6.9.509+; false when absent). Chunk arrival
+   * The copy says it is recording (glasses 6.9.510+; false when absent). Chunk arrival
    * alone lags: after an outage the uploader backs off up to 60 s, and only a visible page
    * or a display reconnect resets it, which a hidden recording copy never gets (QA round 3).
    */
   recording: boolean
+  /**
+   * 6.58.1: the claim carried a `recording` field at all (glasses 6.9.510+). Only then is a
+   * `recording: false` a statement; from older copies it is merely absent.
+   */
+  recordingReported?: boolean
+}
+
+/**
+ * 6.58.1: what one copy has said about recording, kept per copy (not per owner) so it survives
+ * the ring moving between copies. Before this was per copy, a copy that lost the ring and took
+ * it back started a fresh clock each time, and a silent 6.9.538 copy and an idle newer one
+ * traded the ring every few minutes for a whole meeting, both answering the ring (QA, 6.58.1).
+ */
+export interface CopyWord {
+  recording: boolean
+  recordingReported: boolean
+  /** When this copy's current run of `recording: true` claims began. */
+  recordingSince?: number
+  /** When this copy last got a grace after a gap in its claims (see CLIENT_INSTANCE_GRACE_GAP_MS). */
+  graceAt?: number
+  /** When this copy last claimed, under any verdict. */
+  seenAt: number
 }
 
 export interface ClientInstanceOwner extends ClientInstanceClaim {
   seenAt: number
+  /** 6.58.1: the owner's CopyWord.recordingSince. */
+  recordingSince?: number
+  /** 6.58.1: the owner's CopyWord.graceAt. */
+  graceAt?: number
 }
 
 export type ClientInstanceVerdict = 'owner' | 'yield'
@@ -75,6 +123,10 @@ export interface CaptureEvidence {
   owner: boolean
   claimant: boolean
   untagged: boolean
+  /** 6.58.1: when the owner's own newest tagged chunk arrived, however long ago; absent: never (or forgotten). */
+  ownerChunkAt?: number
+  /** 6.58.1: the same for the claimant. */
+  claimantChunkAt?: number
 }
 
 export const NO_CAPTURE: CaptureEvidence = { owner: false, claimant: false, untagged: false }
@@ -97,10 +149,14 @@ export class ClientChunkLedger {
 
   evidence(device: string, ownerId: string, claimId: string, now: number): CaptureEvidence {
     const live = (at: number | undefined) => at !== undefined && now - at < CLIENT_INSTANCE_CAPTURE_LIVE_MS
+    const ownerChunkAt = this.tagged.get(ownerId)
+    const claimantChunkAt = this.tagged.get(claimId)
     return {
-      owner: live(this.tagged.get(ownerId)),
-      claimant: live(this.tagged.get(claimId)),
+      owner: live(ownerChunkAt),
+      claimant: live(claimantChunkAt),
       untagged: live(this.untagged.get(device)),
+      ...(ownerChunkAt !== undefined ? { ownerChunkAt } : {}),
+      ...(claimantChunkAt !== undefined ? { claimantChunkAt } : {}),
     }
   }
 }
@@ -111,10 +167,68 @@ export class ClientChunkLedger {
  * own last claim saying `recording`, and untagged chunks from the device (which could be
  * anyone's), count only while it is still claiming: a dead owner must never be pinned by
  * a stale flag or by the chunks of the copy that replaced it (QA round 2).
+ *
+ * 6.58.1, two limits from the 2026-09-29 zombie (see CLIENT_INSTANCE_WORD_HOLD_MS):
+ * - An owner still claiming that SAYS it is not recording is believed over its trailing chunks.
+ *   Glasses 6.9.560 says so within seconds of its audio stopping; the chunks it had already
+ *   committed can keep arriving and would hold the ring for a copy with nothing left to record.
+ *   Only while it claims (CLIENT_INSTANCE_LIVE_MS): a copy's start announcement is one claim with
+ *   a 1.5 s deadline while its chunks get 30 s, so a `false` from before a meeting can outlive a
+ *   start the Mac never heard, and its chunks must then speak for it (QA round 2: believing the
+ *   old `false` let a second copy record alongside). Only a claim that carries the field counts.
+ * - Its word alone holds for CLIENT_INSTANCE_WORD_HOLD_MS after its newest proof (wordBacked).
  */
 export function ownerIsRecording(owner: ClientInstanceOwner, evidence: CaptureEvidence, now: number): boolean {
-  if (evidence.owner) return true
-  return (owner.recording || evidence.untagged) && now - owner.seenAt <= CLIENT_INSTANCE_LIVE_MS
+  const claiming = now - owner.seenAt <= CLIENT_INSTANCE_LIVE_MS
+  if (evidence.owner && !(claiming && saysNotRecording(owner))) return true
+  if (!claiming) return false
+  if (evidence.untagged) return true
+  return wordBacked(owner, evidence.ownerChunkAt, now)
+}
+
+/** 6.58.1: the claim carried `recording: false` explicitly (glasses 6.9.510+). */
+export function saysNotRecording(claim: Pick<ClientInstanceClaim, 'recording' | 'recordingReported'>): boolean {
+  return claim.recordingReported === true && !claim.recording
+}
+
+/**
+ * 6.58.1: a copy's own `recording: true` still counts: its newest proof (its own newest chunk,
+ * the start of its run of recording claims, or its one grace after a gap) is no older than
+ * CLIENT_INSTANCE_WORD_HOLD_MS. The same rule for an owner holding the ring and a claimant
+ * taking it, so a copy with nothing to show cannot take the ring back by saying so (QA, 6.58.1).
+ */
+export function wordBacked(word: Pick<CopyWord, 'recording' | 'recordingSince' | 'graceAt'>, chunkAt: number | undefined, now: number): boolean {
+  if (!word.recording) return false
+  const provenAt = Math.max(chunkAt ?? 0, word.recordingSince ?? 0, word.graceAt ?? 0)
+  return now - provenAt <= CLIENT_INSTANCE_WORD_HOLD_MS
+}
+
+/**
+ * 6.58.1: a copy's word after its claim at `now`. `recordingSince` starts when its claims start
+ * saying `recording` and clears when they stop. A claim that comes back after a gap longer than
+ * CLIENT_INSTANCE_GRACE_GAP_MS, still recording, gets a grace for its uploads to catch up, once
+ * per chunk of its own: the first grace is free, and another needs a chunk newer than the last.
+ * `chunkAt` is this copy's own newest chunk.
+ */
+export function nextCopyWord(prev: CopyWord | undefined, claim: ClientInstanceClaim, now: number, chunkAt?: number): CopyWord {
+  const recordingReported = claim.recordingReported === true
+  if (!claim.recording) return { recording: false, recordingReported, seenAt: now }
+  if (!prev || !prev.recording || prev.recordingSince === undefined) return { recording: true, recordingReported, recordingSince: now, seenAt: now }
+  const cameBack = now - prev.seenAt > CLIENT_INSTANCE_GRACE_GAP_MS
+  const chunkSinceGrace = prev.graceAt === undefined || (chunkAt ?? 0) > prev.graceAt
+  const graceAt = cameBack && chunkSinceGrace ? now : prev.graceAt
+  return { recording: true, recordingReported, recordingSince: prev.recordingSince, ...(graceAt !== undefined ? { graceAt } : {}), seenAt: now }
+}
+
+/** The owner's word, as a CopyWord. */
+function wordOf(owner: ClientInstanceOwner): CopyWord {
+  return {
+    recording: owner.recording,
+    recordingReported: owner.recordingReported === true,
+    ...(owner.recordingSince !== undefined ? { recordingSince: owner.recordingSince } : {}),
+    ...(owner.graceAt !== undefined ? { graceAt: owner.graceAt } : {}),
+    seenAt: owner.seenAt,
+  }
 }
 
 /** A body the route may act on, or null. Never throws. */
@@ -127,7 +241,7 @@ export function parseClientInstanceClaim(body: unknown, now = Date.now()): Clien
   // as long as the clock stayed wrong (QA, 6.50.3).
   if (o.bootAt > now + CLIENT_INSTANCE_MAX_FUTURE_BOOT_MS) return null
   const version = typeof o.version === 'string' ? o.version.slice(0, 32) : ''
-  return { id: o.id, bootAt: o.bootAt, version, recording: o.recording === true }
+  return { id: o.id, bootAt: o.bootAt, version, recording: o.recording === true, recordingReported: typeof o.recording === 'boolean' }
 }
 
 function isNewer(a: ClientInstanceClaim, b: ClientInstanceClaim): boolean {
@@ -142,27 +256,44 @@ export function arbitrateClientInstance(
   evidence: CaptureEvidence = NO_CAPTURE,
   /** When this claimant last claimed (any verdict), or undefined: never seen. */
   claimantLastSeenAt?: number,
-): { owner: ClientInstanceOwner; verdict: ClientInstanceVerdict; took: boolean } {
-  const fresh: ClientInstanceOwner = { ...claim, seenAt: now }
-  if (!owner) return { owner: fresh, verdict: 'owner', took: true }
-  if (owner.id === claim.id) return { owner: { ...owner, seenAt: now, recording: claim.recording }, verdict: 'owner', took: false }
+  /**
+   * 6.58.1: this claimant's word before this claim (the route keeps one per copy). Undefined:
+   * the owner's own word when the claimant is the owner, otherwise a copy never heard from.
+   */
+  claimantWord?: CopyWord,
+): { owner: ClientInstanceOwner; verdict: ClientInstanceVerdict; took: boolean; word: CopyWord } {
+  const isOwner = owner !== null && owner.id === claim.id
+  const chunkAt = isOwner ? evidence.ownerChunkAt : evidence.claimantChunkAt
+  const word = nextCopyWord(claimantWord ?? (isOwner ? wordOf(owner) : undefined), claim, now, chunkAt)
+  const fresh: ClientInstanceOwner = {
+    ...claim,
+    seenAt: now,
+    ...(word.recordingSince !== undefined ? { recordingSince: word.recordingSince } : {}),
+    ...(word.graceAt !== undefined ? { graceAt: word.graceAt } : {}),
+  }
+  const decide = (o: ClientInstanceOwner, verdict: ClientInstanceVerdict, took: boolean) => ({ owner: o, verdict, took, word })
+  if (!owner) return decide(fresh, 'owner', true)
+  if (isOwner) return decide(fresh, 'owner', false)
   // 6.50.4: the yielding copy stops its recording (that is how a duplicate ends), so the
   // ring must never move in a way that stops the only recording.
   // (1) The claimant is recording and the owner is not: the claimant is the meeting.
   // Reopened offline, the Mac still names the dead copy from before; when signal returns,
   // the new copy's chunks land first and its claim must not be told to stop (QA round 2).
   // Its chunks or its own word: after an outage the uploads lag the claims (QA round 3).
-  if ((evidence.claimant || claim.recording) && !ownerIsRecording(owner, evidence, now)) return { owner: fresh, verdict: 'owner', took: true }
+  // 6.58.1: the claimant's chunks count unless it says it is not recording, and its word only
+  // while it is backed (wordBacked), the same tests the owner meets.
+  const claimantRecords = (evidence.claimant && !saysNotRecording(claim)) || wordBacked(word, chunkAt, now)
+  if (claimantRecords && !ownerIsRecording(owner, evidence, now)) return decide(fresh, 'owner', true)
   // (2) The owner is recording: a newer copy waits, however quiet the owner's claims.
   // Reopening COS on a blank phone page mid-meeting ended the meeting on 6.50.3 (QA).
   // The ring moves on the newer copy's first claim after the meeting stops.
-  if (ownerIsRecording(owner, evidence, now)) return { owner, verdict: 'yield', took: false }
-  if (isNewer(claim, owner)) return { owner: fresh, verdict: 'owner', took: true }
+  if (ownerIsRecording(owner, evidence, now)) return decide(owner, 'yield', false)
+  if (isNewer(claim, owner)) return decide(fresh, 'owner', true)
   // 6.52.3: an older boot takes a quiet ring back only after CLIENT_INSTANCE_RECLAIM_MS,
   // and only while it has itself been claiming (awake), never on the first tick after a
   // gap of its own. A dead newer copy is replaced when the user reopens COS (a newer boot
   // still takes at once); this rule is for the copy that is merely quiet.
   const claimantAwake = claimantLastSeenAt !== undefined && now - claimantLastSeenAt <= CLIENT_INSTANCE_AWAKE_MS
-  if (now - owner.seenAt > CLIENT_INSTANCE_RECLAIM_MS && claimantAwake) return { owner: fresh, verdict: 'owner', took: true }
-  return { owner, verdict: 'yield', took: false }
+  if (now - owner.seenAt > CLIENT_INSTANCE_RECLAIM_MS && claimantAwake) return decide(fresh, 'owner', true)
+  return decide(owner, 'yield', false)
 }

package/server/routes/client-instance.ts

@@ -21,8 +21,8 @@ import {
   parseClientInstanceClaim,
   parseInstanceTag,
   ClientChunkLedger,
-  NO_CAPTURE,
   type ClientInstanceOwner,
+  type CopyWord,
 } from '../lib/client-instance-claim.js'
 
 /** Owners kept at once; the least recently seen device is dropped past this. */
@@ -58,6 +58,13 @@ export function createClientInstanceRouter(deps: ClientInstanceRouterDeps | (()
     lastSeen.delete(id); lastSeen.set(id, at)
     while (lastSeen.size > CLIENT_INSTANCE_MAX_SEEN) lastSeen.delete(lastSeen.keys().next().value as string)
   }
+  // 6.58.1: what each copy has said about recording, kept across changes of owner (CopyWord).
+  // Bounded like lastSeen; a check updates it too (the copy still said it).
+  const words = new Map<string, CopyWord>()
+  const noteWord = (id: string, word: CopyWord) => {
+    words.delete(id); words.set(id, word)
+    while (words.size > CLIENT_INSTANCE_MAX_SEEN) words.delete(words.keys().next().value as string)
+  }
   router.use((req, _res, next) => {
     if (isMeetingChunkPost(req.method, req.path)) chunks.note(deviceKey(req.socket?.remoteAddress ?? req.ip), parseInstanceTag(req.query?.clientInstance), now())
     next()
@@ -68,11 +75,13 @@ export function createClientInstanceRouter(deps: ClientInstanceRouterDeps | (()
     if (!claim) return void res.status(400).json({ error: 'invalid_claim' })
     const device = deviceKey(req.socket?.remoteAddress ?? req.ip)
     const previous = owners.get(device) ?? null
-    const evidence = previous ? chunks.evidence(device, previous.id, claim.id, at) : NO_CAPTURE
+    // 6.58.1: evidence even with no owner, so a first claim still knows its own newest chunk.
+    const evidence = chunks.evidence(device, previous?.id ?? '', claim.id, at)
     const captureLive = previous ? ownerIsRecording(previous, evidence, at) : false
     const claimantLastSeenAt = lastSeen.get(claim.id)
     noteSeen(claim.id, at)
-    const result = arbitrateClientInstance(previous, claim, at, evidence, claimantLastSeenAt)
+    const result = arbitrateClientInstance(previous, claim, at, evidence, claimantLastSeenAt, words.get(claim.id))
+    noteWord(claim.id, result.word)
     if (req.body?.check === true) {
       const shown = previous ?? result.owner
       return void res.json({ verdict: result.verdict, owner: { id: shown.id, bootAt: shown.bootAt, version: shown.version, seenAt: shown.seenAt }, check: true, captureLive })