@gotcos/glasses-server 6.71.13 → 6.72.0

package/server/routes/transcribe-stream.ts

@@ -37,7 +37,6 @@ const __dirname = fileURLToPath(new URL('.', import.meta.url))
 import { emitDisplay } from '../lib/display-bus.js'
 import { errMsg } from '../lib/utils.js'
 import { transcribeLocal, applyCorrections, type WhisperWord } from '../lib/whisper-local.js'
-import { enhanceAudio } from '../lib/audio-enhance.js'
 import { trimSilence, isSileroAvailable } from '../lib/vad-silero.js'
 import { identifySpeaker, isEmbeddingAvailable, autoEnroll, AUTO_ENROLL_CANDIDATE_SIMILARITY } from '../lib/speaker-embeddings.js'
 import { nemotronLive, resolveLiveLabels, resplitSegments, type ChunkSpeakerSegment } from '../lib/nemotron-live.js'
@@ -56,7 +55,9 @@ import {
   streamSilenceDropReason,
   isVocabEchoOnly,
 } from '../lib/hallucination-filter.js'
-import { transcribeWhisperMeetingPreview } from '../lib/whisper-preview.js'
+import { transcribeMeetingPreview } from '../lib/stt-runtime.js'
+import { decideQuiet, asrFrontEnd, silenceDropsAllowed } from '../lib/stt-live.js'
+import { readSttSettings } from '../lib/stt-settings.js'
 import { dataPath } from '../lib/data-dir.js'
 import { ageHours, partitionExpiredAudio } from '../lib/audio-retention.js'
 import {
@@ -77,8 +78,16 @@ import {
   listUnsavedCaptures,
   purgeExpiredQuarantine,
   quarantineSessionAudio,
+  readCaptureDisposition,
   sweepOrphanedSessionAudio,
 } from '../lib/unsaved-audio-quarantine.js'
+import {
+  STALE_ACTIVE_SESSION_DIR_NAME,
+  moveActiveSessionFileAside,
+  purgeExpiredStaleActiveSessionFiles,
+  sweepStaleActiveSessionFiles,
+  type StaleActiveSessionMove,
+} from '../lib/stale-active-session-files.js'
 import { durableAtomicWriteFileSync } from '../lib/atomic-fs.js'
 import { saveTrainingAudioSample } from '../lib/training-audio-save.js'
 import {
@@ -92,6 +101,7 @@ import {
   acquireMaintenanceWork,
   maintenanceAdmissionsOpen,
   maintenanceLifecycle,
+  onMaintenanceAdmissionsOpen,
   type MaintenanceWorkLease,
 } from '../lib/maintenance-lifecycle.js'
 import { feedLiveCueTranscript } from '../lib/live-cues-engine.js'
@@ -139,8 +149,12 @@ function ensurePrivateDirectory(path: string): void {
 
 // Silence-hallucination drops (2026-05-29, v5.9.73). Contract in streamSilenceDropReason:
 //   brand-URL-only -> dropped ALWAYS (vocab-seeded, never real speech).
-//   any-URL-only / repeated-thank-you -> dropped only when isQuiet (rms<150), so a real
-//   softly-spoken utterance or a clearly-dictated third-party URL is never dropped.
+//   any-URL-only / repeated-thank-you / quiet vocab echo -> dropped only when the chunk
+//   is RMS-quiet (rms<150), so a real softly-spoken utterance or a clearly-dictated
+//   third-party URL is never dropped. 6.72.0 keeps these TEXT drops on the RMS test on
+//   purpose: the Silero quiet gate (under 0.5 s of speech) also fires on a chunk holding
+//   one short real name, and dropping that as a "vocab echo" would delete real speech.
+//   The Silero gate decides only the prompt and the front end.
 // Rollback: COS_WHISPER_STRIP_BRAND_URLS=0 (URL drops), COS_WHISPER_THANKYOU_FILTER=0.
 const STRIP_BRAND_URLS = process.env.COS_WHISPER_STRIP_BRAND_URLS !== '0'
 const THANKYOU_FILTER = process.env.COS_WHISPER_THANKYOU_FILTER !== '0'
@@ -542,6 +556,8 @@ export function getTranscriptionSessionLiveness(now = Date.now()): Transcription
 // Incremental chunk persistence — survive server restarts
 const CHUNK_PERSIST_DIR = dataPath('active-sessions')
 ensurePrivateDirectory(CHUNK_PERSIST_DIR)
+/** 6.71.14: where an active-session file the server no longer owns is moved, never deleted in place. */
+const STALE_ACTIVE_SESSION_DIR = dataPath(STALE_ACTIVE_SESSION_DIR_NAME)
 
 function readClosedSessions(): Record<string, ClosedTranscriptSession> {
   if (!existsSync(CLOSED_SESSIONS_FILE)) return {}
@@ -691,6 +707,71 @@ function persistSessionBestEffort(sessionId: string): void {
   try { persistSessionRequired(sessionId) } catch { /* recovery cleanup is non-admission work */ }
 }
 
+/**
+ * 6.71.14: one pass of the stale active-session sweep, against the real session
+ * map. Exported so a test drives the exact wiring the minute interval runs.
+ */
+export function sweepStaleActiveSessionFilesNow(now: number): StaleActiveSessionMove[] {
+  const moves = sweepStaleActiveSessionFiles({
+    dir: CHUNK_PERSIST_DIR,
+    targetDir: STALE_ACTIVE_SESSION_DIR,
+    isLive: id => sessions.has(id),
+    now,
+    idleRetentionMs: LOCAL_FIRST_MEETING_IDLE_RETENTION_MS,
+  })
+  for (const move of moves) {
+    if (move.target) {
+      staleMoveFailuresLogged.delete(move.sessionId)
+      console.warn(
+        `[cleanup] Moved stale active-session file aside: ${move.sessionId} `
+        + `(${move.reason}, idle ${Math.round((move.idleMs ?? 0) / 60_000)}m, not live) \u2192 ${move.target}`,
+      )
+    } else {
+      logStaleMoveFailure(move.sessionId, `[cleanup] Could not move stale active-session file aside for ${move.sessionId} (${move.reason}); it stays in active-sessions`)
+    }
+  }
+  const purged = purgeExpiredStaleActiveSessionFiles(STALE_ACTIVE_SESSION_DIR, now)
+  if (purged > 0) console.log(`[cleanup] Purged ${purged} stale active-session file(s) past retention`)
+  return moves
+}
+
+/** A failed move repeats every minute; say so once per session id, not every tick. */
+const staleMoveFailuresLogged = new Set<string>()
+function logStaleMoveFailure(sessionId: string, message: string): void {
+  if (staleMoveFailuresLogged.has(sessionId)) return
+  staleMoveFailuresLogged.add(sessionId)
+  if (staleMoveFailuresLogged.size > 500) staleMoveFailuresLogged.delete(staleMoveFailuresLogged.values().next().value as string)
+  console.error(message)
+}
+
+/**
+ * 6.71.14: is this active-session file the leftover of a capture that is already
+ * decoded (recovered or receipted no_speech), rather than a session that RESUMED
+ * under the same id after that capture was quarantined?
+ *
+ * A late chunk is accepted (the phone deletes its copy on a 410), so a session can
+ * restart under an id whose older quarantine dir is already receipted. Its file is
+ * then newer than the quarantine and its own audio sits in session-audio/<id>.
+ * Only a file that is no newer than the quarantine AND has no chunk audio of its
+ * own is the leftover; anything else is adopted as 6.71.13 would, so a meeting is
+ * never split across a restart.
+ */
+function isTerminalCaptureFile(sessionId: string, recordedLastActivityAt: unknown, filePath: string): boolean {
+  const disposition = readCaptureDisposition(sessionId)
+  if (!disposition || (disposition.kind !== 'no_speech' && disposition.kind !== 'recovered')) return false
+  const terminalAtIso = disposition.quarantinedAt ?? disposition.receiptedAt
+  const terminalAt = terminalAtIso ? Date.parse(terminalAtIso) : NaN
+  if (!Number.isFinite(terminalAt)) return false
+  let fileActivity = typeof recordedLastActivityAt === 'number' && Number.isFinite(recordedLastActivityAt)
+    ? recordedLastActivityAt
+    : NaN
+  if (!Number.isFinite(fileActivity)) {
+    try { fileActivity = statSync(filePath).mtimeMs } catch { return false }
+  }
+  if (terminalAt < fileActivity) return false
+  return countChunkWavs(resolve(SESSION_AUDIO_DIR, sessionId)) === 0
+}
+
 /** Recover sessions from disk on server restart */
 function recoverSessions(): void {
   try {
@@ -701,6 +782,27 @@ function recoverSessions(): void {
       if (!file.endsWith('.json')) continue
       try {
         const data = JSON.parse(readFileSync(resolve(CHUNK_PERSIST_DIR, file), 'utf-8'))
+        // 6.71.14: recovery can now run after boot (deferred behind a closed
+        // maintenance gate). A session already in memory owns its file; the disk
+        // copy must never overwrite it.
+        if (typeof data.sessionId === 'string' && sessions.has(data.sessionId)) continue
+        // A capture whose quarantined audio was already decoded to a terminal
+        // outcome (a saved recovery or a no_speech receipt) is done. Adopting its
+        // file would bring back a live session for it; tombstoning would delete the
+        // file. Move it aside instead. Plain `quarantined` (never decoded) is NOT
+        // done: a crash between a chunk's first WAV write and its first
+        // active-session persist quarantines the audio, and the phone's retry then
+        // starts the session again. That file is adopted exactly as before.
+        if (typeof data.sessionId === 'string' && isTerminalCaptureFile(data.sessionId, data.lastActivityAt, resolve(CHUNK_PERSIST_DIR, file))) {
+          const terminal = readCaptureDisposition(data.sessionId)!
+          const target = moveActiveSessionFileAside(
+            resolve(CHUNK_PERSIST_DIR, file), data.sessionId, STALE_ACTIVE_SESSION_DIR, 'terminal_capture', Date.now(),
+            { lastActivityAt: typeof data.lastActivityAt === 'number' ? data.lastActivityAt : null },
+          )
+          if (target) console.warn(`[session-recovery] ${data.sessionId} was already ${terminal.kind}; moved its active-session file aside: ${target}`)
+          else logStaleMoveFailure(data.sessionId, `[session-recovery] Could not move the active-session file aside for ${data.sessionId} (already ${terminal.kind}); left in place, not adopted`)
+          continue
+        }
         // Reconstruct the (sparse) chunk array. New format keeps original
         // indices via chunksIndexed; legacy format stored a dense `chunks`.
         const indexed: Array<{ i: number; c: TranscriptChunk }> | null =
@@ -859,7 +961,9 @@ function recoverSessions(): void {
     try {
       if (existsSync(SESSION_AUDIO_DIR)) {
         const actions = sweepOrphanedSessionAudio(SESSION_AUDIO_DIR, {
-          isLive: id => recoveredIds.has(id),
+          // `|| sessions.has`: deferred recovery (6.71.14) can run while sessions
+          // are live in memory; their audio is not orphaned.
+          isLive: id => recoveredIds.has(id) || sessions.has(id),
           hasFreshPreservedMarker: hasFreshPreservedAudioMarker,
           reason: 'boot_sweep_unsaved',
         })
@@ -896,9 +1000,40 @@ export function isSessionDeleted(sessionId: string): boolean {
 // A committed cross-boot maintenance operation owns durable state until the
 // trusted controller adopts the candidate. Boot recovery must not mutate or
 // promote sessions while that gate is closed.
-if (maintenanceAdmissionsOpen()) {
+//
+// 6.71.14: and once that gate opens, recovery MUST still run. Until 6.71.13 this was
+// a module-scope `if` evaluated once at import: a boot behind a closed gate (every
+// managed update) skipped it for the life of the process. Persisted sessions were
+// never adopted or tombstoned, and the closed-session tombstones were never
+// restored. On 2026-10-12 that left `active-sessions/<id>.json` for a receipted
+// capture on disk for 17 hours, reported as live by COS Control and `missing` by
+// the status route.
+let durableSessionRecoveryRan = false
+function runDurableSessionRecovery(trigger: 'boot' | 'admissions_open'): void {
+  if (durableSessionRecoveryRan) return
+  durableSessionRecoveryRan = true
   recoverClosedSessions()
   recoverSessions()
+  if (trigger === 'admissions_open') {
+    console.log(`[session-recovery] Ran deferred durable recovery after the maintenance gate opened (${sessions.size} live session(s))`)
+  }
+}
+if (maintenanceAdmissionsOpen()) {
+  runDurableSessionRecovery('boot')
+} else {
+  // Delivered on every later open; the flag above makes every delivery after the
+  // first a no-op, so disk is never re-read over a live session map.
+  onMaintenanceAdmissionsOpen(() => runDurableSessionRecovery('admissions_open'))
+}
+
+/**
+ * 6.71.14: has durable session recovery run in this process yet? Until it has, the
+ * in-memory map does not yet hold the persisted sessions, so "not in memory" is not
+ * evidence of anything. The status route answers 503 `recovery_pending` instead of
+ * `missing` while this is false.
+ */
+export function durableSessionRecoveryHasRun(): boolean {
+  return durableSessionRecoveryRan
 }
 
 /**
@@ -1011,6 +1146,10 @@ function promoteStrandedCapture(sessionId: string, lastActivityAt: number): void
 // Auto-cleanup sessions idle for the advertised retention horizon.
 setInterval(() => {
   if (!maintenanceAdmissionsOpen()) return
+  // 6.71.14: the sweeps below judge a session dead by its absence from the
+  // in-memory map. Before recovery has adopted the persisted sessions that map is
+  // empty by construction, so sweeping then would quarantine a live capture.
+  if (!durableSessionRecoveryRan) return
   // A capture whose phone went away must still become a meeting. This loop used
   // to close every idle session as 'expired', which quarantined its audio and
   // produced NO meeting — recoverable for 72h, but only by whoever thought to
@@ -1053,6 +1192,15 @@ setInterval(() => {
     // log, and nothing to reason about, because any throw in this block vanished.
     console.error(`[cleanup] Orphan-audio sweep failed: ${error instanceof Error ? error.message : error}`)
   }
+  // 6.71.14: its own try, for the same reason as auto-recovery below. An
+  // active-session file whose session is not live and has been idle past the
+  // retention horizon is moved aside; COS Control reads that directory directly
+  // and would otherwise show it as a live recording indefinitely.
+  try {
+    sweepStaleActiveSessionFilesNow(Date.now())
+  } catch (error) {
+    console.error(`[cleanup] Stale active-session sweep failed: ${error instanceof Error ? error.message : error}`)
+  }
   // DELIBERATELY ITS OWN TRY. This used to sit inside the block above, one line after
   // purgeExpiredQuarantine, so a throw anywhere in that sweep meant auto-recovery
   // silently never ran — which is exactly what happened in production on 6.23.1
@@ -2076,16 +2224,16 @@ async function processStreamChunk(opts: {
     resolve(SESSION_AUDIO_DIR, sessionId, `chunk_${String(chunkIndex).padStart(4, '0')}.wav`),
   )
 
-  const pcmData = audioBuffer.subarray(44)
-  let sumSq = 0
-  const nSamples = Math.floor(pcmData.length / 2)
-  for (let i = 0; i < nSamples; i++) {
-    const s = pcmData.readInt16LE(i * 2)
-    sumSq += s * s
-  }
-  const rms = Math.sqrt(sumSq / Math.max(1, nSamples))
-  const isQuiet = rms < 150
-  const whisperAudio = isQuiet ? audioBuffer : await enhanceAudio(audioBuffer)
+  // 6.72.0: the quiet gate and the ASR front end follow the STT settings, read
+  // per chunk so a change applies from the next chunk. Defaults: Silero speech
+  // seconds (RMS 150 fired on 1% of G2 chunks) and highpass only (the full
+  // chain lifted faint background speech over the VAD). Playback audio is
+  // separate and unchanged.
+  const stt = readSttSettings()
+  const quiet = decideQuiet(audioBuffer, stt.quietGate)
+  const rms = quiet.rms
+  const isQuiet = quiet.isQuiet
+  const whisperAudio = isQuiet ? audioBuffer : await asrFrontEnd(audioBuffer, stt.frontEnd)
   const whisperContext = recentWhisperContext(sessionId, session)
   console.log(`[perf] whisperContext: ${whisperContext.length}b | session.chunks: ${session.chunks.length}`)
 
@@ -2122,7 +2270,9 @@ async function processStreamChunk(opts: {
   // uncorrected for those sources. Idempotent for the local path.
   rawText = applyCorrections(rawText)
 
-  let sanitized = sanitizeStreamTranscript(sessionId, session, rawText, isQuiet)
+  // Text drops stay on the pre-6.72 RMS test (see the contract above).
+  const dropQuiet = silenceDropsAllowed(quiet)
+  let sanitized = sanitizeStreamTranscript(sessionId, session, rawText, dropQuiet)
   if (candidate && (!sanitized.text || sanitized.fallbackReason)) {
     fallbackReason = sanitized.fallbackReason || 'empty_candidate'
     const result = await transcribeWithServerWhisper(audioBuffer, whisperAudio, whisperContext, isQuiet)
@@ -2130,7 +2280,7 @@ async function processStreamChunk(opts: {
     words = result.words
     backend = result.backend
     asrProvider = 'server-whisper'
-    sanitized = sanitizeStreamTranscript(sessionId, session, rawText, isQuiet)
+    sanitized = sanitizeStreamTranscript(sessionId, session, rawText, dropQuiet)
   }
 
   const voiceprint = await speakerPromise
@@ -2250,7 +2400,7 @@ async function processStreamChunk(opts: {
   // throws on by default. All gates live inside the feed.
   void feedLiveCueTranscript(sessionId, trimmedText, Boolean(fallbackReason)).catch(() => {})
 
-  console.log(`[perf] TOTAL request: ${(performance.now() - tReq).toFixed(1)}ms | chunk #${chunkIndex} | ${audioBuffer.length}b | rms=${Math.round(rms)} q=${isQuiet ? 1 : 0} | ${asrProvider} | "${trimmedText.slice(0, 50)}"`)
+  console.log(`[perf] TOTAL request: ${(performance.now() - tReq).toFixed(1)}ms | chunk #${chunkIndex} | ${audioBuffer.length}b | rms=${Math.round(rms)} q=${isQuiet ? 1 : 0} gate=${quiet.gate}${quiet.speechSec === null ? '' : ` speech=${quiet.speechSec.toFixed(2)}s`} fe=${stt.frontEnd} | ${asrProvider} | "${trimmedText.slice(0, 50)}"`)
   return canonicalChunkResponse(chunk, sessionId, chunkIndex)
 }
 
@@ -2277,13 +2427,15 @@ function sendStreamError(res: { status: (code: number) => { json: (body: unknown
 }
 
 /**
- * Default-off meeting preview canary.
+ * Meeting preview (on unless COS_WHISPER_MEETING_PREVIEW=0).
  *
  * This route deliberately owns no meeting session, recovery ledger, speaker
  * attribution, or persistence. It accepts a pinned copy of the still-open
- * phrase and returns provisional Turbo text. Any contention or failure is a
- * 204 cosmetic miss; the canonical /transcribe-stream upload remains the only
- * durable and speaker-attributed result.
+ * phrase and returns provisional text from the preview engine the STT settings
+ * choose (6.72.0: Whisper Turbo, or Parakeet Ultra when selected, warm, and the
+ * client lists `parakeet-ultra` in `previewModels`; every other client gets
+ * Turbo). Any contention or failure is a 204 cosmetic miss; the canonical
+ * /transcribe-stream upload remains the only durable and speaker-attributed result.
  */
 transcribeStreamRouter.post('/transcribe-stream/preview', async (req, res) => {
   try {
@@ -2316,7 +2468,10 @@ transcribeStreamRouter.post('/transcribe-stream/preview', async (req, res) => {
 
     meetingPreviewBusy = true
     try {
-      const result = await transcribeWhisperMeetingPreview(audio)
+      // 6.72.0: the models this client accepts. Absent (every phone before 6.10.639): Turbo only.
+      const rawModels = typeof req.query.previewModels === 'string' ? req.query.previewModels.slice(0, 200) : ''
+      const accepted = rawModels.split(',').map(m => m.trim()).filter(Boolean).slice(0, 8)
+      const result = await transcribeMeetingPreview(audio, accepted)
       if (!result) return void res.status(204).send()
       const cleaned = stripInlineHallucinationsOneShot(result.text.trim()).trim()
       if (!cleaned || sharedIsFullHallucination(cleaned)) {