charness 3.6.1 → 3.8.0

package/stt/gigaam_sidecar.py

@@ -5,8 +5,10 @@ ONE process: it loads the model at start, binds 127.0.0.1 on an OS-chosen port a
 `POST /v1/audio/transcriptions` plus `GET /health`. The bot starts it on demand, adopts it across hot reloads,
 and it takes itself down when it has been idle (`--idle-minutes`) or when its owner process is gone.
 
-Long audio is cut at the quietest 50 ms inside the last 8 s before every 25 s boundary; the chunks are
-recognised in parallel on a pool of threads that share ONE onnxruntime session, shortest request first.
+Every voice is cut at the centre of each pause of at least 500 ms that Silero VAD finds (the model drops a whole
+phrase that follows a long pause when it decodes several phrases in one pass); no audio is ever discarded, and a
+piece longer than 25 s is cut again at its quietest 50 ms. The pieces are recognised in parallel on a pool of
+threads that share ONE onnxruntime session, strictly in arrival order (a short voice never overtakes an earlier one).
 
 It claims the bot's record before it loads the model (an exclusive create, so a second start of the same engine
 exits instead of becoming an unrecorded orphan) and completes it with its port once it listens.
@@ -21,19 +23,22 @@ Protocol and layout: `src/stt/README.md`.
 from __future__ import annotations
 
 import argparse
+import collections
+import itertools
 import contextlib
+import dataclasses
 import datetime
 import email.parser
 import email.policy
 import hmac
 import http.server
 import io
-import itertools
 import json
 import logging
 import logging.handlers
 import os
-import queue
+import select
+import socket
 import signal
 import subprocess
 import sys
@@ -44,7 +49,7 @@ import traceback
 import numpy as np
 
 # Bumped with every change of the sidecar's behaviour; the bot hashes it into the adoption check.
-SCRIPT_VERSION = "1"
+SCRIPT_VERSION = "3"
 MODEL_NAME = "gigaam-v3-e2e-rnnt"
 MODEL_QUANTIZATION = "int8"
 TOKEN_ENV_NAME = "CHARNESS_STT_SIDECAR_TOKEN"
@@ -56,12 +61,46 @@ EXIT_USAGE = 2
 EXIT_DUPLICATE = 4
 
 MAX_CHUNK_SECONDS = 25.0
+# The rate the model and the VAD work at: the upload is resampled to it once.
+SPEECH_SAMPLE_RATE = 16000
+VAD_MODEL_NAME = "silero"
+# A gap this long between two stretches of speech the VAD detects ends a piece. Measured on real speech (919 phrases,
+# pauses of 0.3-2 s): 11 phrases lost against 10 when decoding each phrase alone (39 in one pass), and it splits 56 of 356
+# continuous sentences with no loss of accuracy (4.91 % -> 4.86 % WER).
+MIN_PAUSE_MS = 500
+VAD_SPEECH_PAD_MS = 100
+# onnx-asr compares the raw gap with `min_silence_duration_ms + 2 * speech_pad_ms`: given this, a gap of
+# `MIN_PAUSE_MS` is what ends a piece.
+VAD_MIN_SILENCE_MS = MIN_PAUSE_MS - 2 * VAD_SPEECH_PAD_MS
+# The upload is resampled to 16 kHz window by window: onnxruntime keeps the largest buffer a session ever needed, and
+# a 5-minute voice resampled at once raised the peak by ~240 MB (profiled; 30 s windows: ~66 MB). The margin on each
+# side is trimmed away again; with it the joined windows are identical to a one-pass resample on every sample, except
+# that the last one may be dropped (the trims round, the model rounds up: at most 63 µs; measured at every supported
+# rate). Both are whole seconds, so their length at 16 kHz is a whole number of samples for every supported rate.
+RESAMPLE_WINDOW_SECONDS = 30
+RESAMPLE_MARGIN_SECONDS = 1
+# The install check's 1 s of silence is at Telegram's Opus rate, so it runs the resampler too, and a VAD that fails
+# shows as pieces left at this rate (the fallback keeps the file's own rate).
+CHECK_SAMPLE_RATE = 48000
 SILENCE_SEARCH_SECONDS = 8.0
 SILENCE_WINDOW_SECONDS = 0.05
 # The encoder fails on fewer than ~25 ms of audio; a piece this short holds no word anyway.
 MIN_CHUNK_SECONDS = 0.1
 # The sample rates onnx-asr resamples to 16 kHz itself.
 SUPPORTED_SAMPLE_RATES = (8000, 11025, 16000, 22050, 24000, 32000, 44100, 48000)
+# The decoders the install check wants in the `av` package (ffmpeg): AAC (M4A), MP3, Vorbis and Opus.
+FFMPEG_REQUIRED_DECODERS = ("aac", "mp3", "vorbis", "opus")
+# The upload's bytes choose ffmpeg's demuxer, and a few of them open further inputs: a text file in SDP form makes it open
+# an RTP socket and wait for 20 s. A file handed over as bytes needs no protocol, so only the two that read nothing from
+# outside are allowed.
+FFMPEG_PROTOCOL_WHITELIST = "crypto,data"
+# Ogg page header: "OggS", version, a flags byte (bit 1 = first page of a stream), granule position, serial, sequence,
+# checksum, then the number of lace values, which are followed by that many bytes of lace values.
+OGG_CAPTURE_PATTERN = b"OggS"
+OGG_PAGE_HEADER_BYTES = 27
+OGG_FLAGS_OFFSET = 5
+OGG_LACE_COUNT_OFFSET = 26
+OGG_FIRST_PAGE_FLAG = 0x02
 
 MAX_BODY_BYTES = 25 * 1024 * 1024
 MAX_HEADER_LINE_BYTES = 8192
@@ -81,10 +120,20 @@ CLAIM_ATTEMPTS = 3
 SECONDS_PER_MINUTE = 60.0
 BEARER_PREFIX = "Bearer "
 TRANSCRIPTIONS_PATH = "/v1/audio/transcriptions"
+# Once a voice is in line the sidecar answers an interim 102 naming the seconds of audio queued ahead of it, so the
+# bot's timeout can count the wait in line (voices are recognised strictly in arrival order).
+QUEUE_REPORT_STATUS = 102
+QUEUED_AUDIO_SECONDS_HEADER = "X-Charness-Queued-Audio-Seconds"
+# How often a waiting handler checks that its client is still connected, and whether the queue ahead grew.
+CLIENT_CHECK_SECONDS = 0.5
+# A waiting voice is told the queue ahead again when it has grown by more than this: a safeguard for a voice ahead whose
+# length was still unknown when this one was reported (see `SIZING_WAIT_SECONDS`).
+QUEUE_REPORT_GROWTH_SECONDS = 1.0
+# A voice takes its place in line before its length is read (reading takes a few milliseconds, more for a long file with
+# no length header), so the voices behind it wait this long at most for that length before they report their queue.
+SIZING_WAIT_SECONDS = 2.0
 HEALTH_PATH = "/health"
 RESPONSE_FORMATS = ("json", "text")
-# The pool queue's last position: a stop sentinel sorts after every real request.
-STOP_PRIORITY = sys.maxsize
 
 logger = logging.getLogger("gigaam_sidecar")
 
@@ -102,6 +151,10 @@ class RecognitionTimeout(Exception):
     """A request ran past `--max-seconds`."""
 
 
+class ClientGone(Exception):
+    """The client hung up while its voice waited (it timed out, or the bot moved on): nobody would read the text."""
+
+
 # ──────────────────────────────── audio ────────────────────────────────
 
 
@@ -132,8 +185,173 @@ def split_at_silences(
     return pieces
 
 
-def decode_audio(data: bytes) -> tuple[np.ndarray, int]:
-    """Decode an uploaded file (Telegram sends OGG/Opus) to mono float32 samples and their sample rate."""
+def split_at_pauses(audio: np.ndarray, speech_segments: list[tuple[int, int]], sample_rate: int) -> list[np.ndarray]:
+    """Cut `audio` at the centre of the gap between every two consecutive speech segments (sample offsets, in
+    order), then cut any piece longer than `MAX_CHUNK_SECONDS` with `split_at_silences`. The segments only choose
+    where to cut: the pieces joined give back `audio` exactly, so speech the detector missed is still recognised."""
+    cuts = [0]
+    for (_, previous_end), (next_start, _) in zip(speech_segments, speech_segments[1:]):
+        cut = (previous_end + next_start) // 2
+        if cuts[-1] < cut < len(audio):
+            cuts.append(cut)
+    cuts.append(len(audio))
+    pieces: list[np.ndarray] = []
+    for start, end in zip(cuts, cuts[1:]):
+        pieces.extend(split_at_silences(audio[start:end], sample_rate))
+    return pieces
+
+
+def split_without_pauses(samples: np.ndarray, sample_rate: int) -> tuple[list[np.ndarray], int]:
+    """The splitter without a VAD: only the 25 s cuts, at the file's own rate."""
+    return split_at_silences(samples, sample_rate), sample_rate
+
+
+def make_pause_splitter(resample, find_speech):
+    """The request splitter: `resample(samples, rate)` to `SPEECH_SAMPLE_RATE`, then `find_speech(audio)` → speech
+    segments, then `split_at_pauses`. Returns the pieces and their rate. A failing resample or VAD falls back to
+    `split_without_pauses`: the voice is still transcribed, only cut the old way."""
+
+    def split(samples: np.ndarray, sample_rate: int) -> tuple[list[np.ndarray], int]:
+        try:
+            audio = resample(samples, sample_rate)
+            speech_segments = find_speech(audio)
+        except Exception:
+            logger.error("pause detection failed, cutting at %.0f s only: %s", MAX_CHUNK_SECONDS, traceback.format_exc())
+            return split_without_pauses(samples, sample_rate)
+        return split_at_pauses(audio, speech_segments, SPEECH_SAMPLE_RATE), SPEECH_SAMPLE_RATE
+
+    return split
+
+
+def resample_in_windows(resample_once, samples: np.ndarray, sample_rate: int) -> np.ndarray:
+    """`resample_once(samples, rate)` → 16 kHz, applied to `RESAMPLE_WINDOW_SECONDS` windows that each read
+    `RESAMPLE_MARGIN_SECONDS` beyond both ends; the margins are cut off the output again and the windows joined."""
+    if sample_rate == SPEECH_SAMPLE_RATE:
+        return samples
+    ratio = SPEECH_SAMPLE_RATE / sample_rate
+    window = RESAMPLE_WINDOW_SECONDS * sample_rate
+    margin = RESAMPLE_MARGIN_SECONDS * sample_rate
+    parts = []
+    for start in range(0, len(samples), window):
+        end = min(start + window, len(samples))
+        read_from = max(0, start - margin)
+        resampled = resample_once(samples[read_from : min(len(samples), end + margin)], sample_rate)
+        keep_from = round((start - read_from) * ratio)
+        parts.append(resampled[keep_from : keep_from + round((end - start) * ratio)])
+    return np.concatenate(parts) if parts else samples[:0]
+
+
+def make_model_pause_splitter(model, vad):
+    """`make_pause_splitter` over the loaded model's own resampler and the Silero VAD."""
+
+    def resample_once(samples: np.ndarray, sample_rate: int) -> np.ndarray:
+        waveforms, lengths = model.resampler(samples[None], np.array([len(samples)], dtype=np.int64), sample_rate)
+        return np.ascontiguousarray(waveforms[0][: int(lengths[0])], dtype=np.float32)
+
+    def resample(samples: np.ndarray, sample_rate: int) -> np.ndarray:
+        return resample_in_windows(resample_once, samples, sample_rate)
+
+    def find_speech(audio: np.ndarray) -> list[tuple[int, int]]:
+        (segments,) = vad.segment_batch(
+            audio[None],
+            np.array([len(audio)], dtype=np.int64),
+            SPEECH_SAMPLE_RATE,
+            min_silence_duration_ms=VAD_MIN_SILENCE_MS,
+            speech_pad_ms=VAD_SPEECH_PAD_MS,
+            # Never let the VAD cut a long stretch of speech itself: `split_at_pauses` caps the pieces at a quiet spot.
+            max_speech_duration_s=len(audio) / SPEECH_SAMPLE_RATE + 1,
+        )
+        return [(int(start), int(end)) for start, end in segments]
+
+    return make_pause_splitter(resample, find_speech)
+
+
+def find_ogg_stream_starts(data: bytes) -> list[int]:
+    """The offsets where each logical stream of an Ogg file begins: more than one means chained streams (two files one
+    after the other). Only the page headers are walked (a packet that happens to hold "OggS" is not read), so the cost
+    is a few bytes per page. Streams multiplexed side by side open with consecutive first pages and count once. Empty
+    when the data does not start with an Ogg page; a damaged page ends the walk, the rest counts as the last stream."""
+    starts: list[int] = []
+    is_in_opening_pages = False
+    offset = 0
+    while offset + OGG_PAGE_HEADER_BYTES <= len(data) and data.startswith(OGG_CAPTURE_PATTERN, offset):
+        lace_end = offset + OGG_PAGE_HEADER_BYTES + data[offset + OGG_LACE_COUNT_OFFSET]
+        if lace_end > len(data):
+            break
+        is_first_page = bool(data[offset + OGG_FLAGS_OFFSET] & OGG_FIRST_PAGE_FLAG)
+        if is_first_page and not is_in_opening_pages:
+            starts.append(offset)
+        is_in_opening_pages = is_first_page
+        offset = lace_end + sum(data[offset + OGG_PAGE_HEADER_BYTES : lace_end])
+    return starts
+
+
+def split_ogg_streams(data: bytes) -> list[bytes]:
+    """The streams of a chained Ogg file as separate files (the file itself when it holds one or is not Ogg)."""
+    starts = find_ogg_stream_starts(data)
+    if len(starts) < 2:
+        return [data]
+    return [data[start:end] for start, end in zip(starts, starts[1:] + [len(data)])]
+
+
+@dataclasses.dataclass(frozen=True)
+class AudioUpload:
+    """An uploaded file and the route it takes, decided ONCE by `inspect_audio` and handed to the length read and the
+    decode: `header_seconds` is libsndfile's own length when libsndfile reads the file whole, None when ffmpeg decodes it;
+    `streams` are what ffmpeg is given (the file, or the streams of a chained Ogg apart)."""
+
+    data: bytes
+    header_seconds: float | None
+    streams: list[bytes]
+
+
+def inspect_audio(data: bytes) -> AudioUpload:
+    """Decide how an upload is read. libsndfile reads as many frames as the file's header says, which is exact for WAV,
+    FLAC and one Ogg stream. It is not for an MP3 without a Xing / Info / VBRI frame (the length is an estimate from
+    the first frame's bitrate, and the read stops there: a variable-bitrate file lost 33 s of 40) nor for chained Ogg
+    streams (only the first is read, and a chained Vorbis even reports an absurd length); and it cannot open M4A / AAC
+    at all. Those go to ffmpeg."""
+    import soundfile
+
+    streams = split_ogg_streams(data)
+    try:
+        info = soundfile.info(io.BytesIO(data))
+    except Exception:  # soundfile raises its own LibsndfileError / RuntimeError
+        return AudioUpload(data, None, streams)
+    if info.format == "MP3" or len(streams) > 1:
+        return AudioUpload(data, None, streams)
+    return AudioUpload(data, float(info.duration), streams)
+
+
+def open_ffmpeg_container(data: bytes):
+    """The uploaded bytes as an ffmpeg container that cannot reach beyond them (see `FFMPEG_PROTOCOL_WHITELIST`)."""
+    import av
+
+    return av.open(io.BytesIO(data), options={"protocol_whitelist": FFMPEG_PROTOCOL_WHITELIST})
+
+
+def read_ffmpeg_stream_seconds(data: bytes) -> float:
+    """The length of one stream from its packets' durations: exact for MP3 without a length header and for M4A, no
+    decoding (the container's own duration is an estimate there)."""
+    with open_ffmpeg_container(data) as container:
+        stream = container.streams.audio[0]
+        return sum((float(packet.duration * packet.time_base) for packet in container.demux(stream) if packet.duration), 0.0)
+
+
+def read_audio_seconds(upload: AudioUpload) -> float:
+    """The upload's length from the file (a few milliseconds, a 5-minute decode takes seconds), so the voices behind it
+    know their wait before it is decoded; 0 when it cannot be read (the decode then refuses it). What ffmpeg decodes is
+    demuxed here without decoding and once more by the decode: the early, cheap pass is the point."""
+    if upload.header_seconds is not None:
+        return upload.header_seconds
+    try:
+        return sum(read_ffmpeg_stream_seconds(stream) for stream in upload.streams)
+    except Exception:  # av raises its own FFmpegError subclasses
+        return 0.0
+
+
+def decode_with_libsndfile(data: bytes) -> tuple[np.ndarray, int]:
+    """Mono float32 samples and the sample rate of a file libsndfile reads whole (Telegram's OGG/Opus, WAV, FLAC)."""
     import soundfile
 
     try:
@@ -147,6 +365,59 @@ def decode_audio(data: bytes) -> tuple[np.ndarray, int]:
     return np.ascontiguousarray(samples, dtype=np.float32), int(sample_rate)
 
 
+def get_mono_samples(frames) -> list[np.ndarray]:
+    """The channels of resampled planar float frames averaged into one, as for libsndfile (ffmpeg's own downmix is
+    3 dB louder)."""
+    return [frame.to_ndarray().mean(axis=0, dtype=np.float32) for frame in frames]
+
+
+def decode_ffmpeg_stream(data: bytes) -> list[np.ndarray]:
+    """The first audio stream of one file as mono float32 arrays at `SPEECH_SAMPLE_RATE` (ffmpeg resamples). A resampler
+    is set up for the format, layout and rate of the frames in front of it and replaced when they change: it refuses a
+    frame that does not match its setup, and passes a frame through untouched when its first one needed no conversion."""
+    import av
+
+    pieces: list[np.ndarray] = []
+    with open_ffmpeg_container(data) as container:
+        if not container.streams.audio:
+            raise RequestError(400, "the file has no audio")
+        resampler = None
+        setup = None
+        for frame in container.decode(audio=0):
+            frame_setup = (frame.format.name, frame.layout.name, frame.sample_rate)
+            if frame_setup != setup:
+                if resampler is not None:
+                    pieces.extend(get_mono_samples(resampler.resample(None)))  # the old setup's delay, before the new part
+                resampler = av.AudioResampler(format="fltp", layout=frame.layout.name, rate=SPEECH_SAMPLE_RATE)
+                setup = frame_setup
+            pieces.extend(get_mono_samples(resampler.resample(frame)))
+        if resampler is not None:
+            pieces.extend(get_mono_samples(resampler.resample(None)))  # the resampler's delay
+    return pieces
+
+
+def decode_with_ffmpeg(streams: list[bytes]) -> tuple[np.ndarray, int]:
+    """Decode with the ffmpeg libraries of the `av` package what libsndfile does not read whole (see `inspect_audio`).
+    The streams of a chained Ogg are decoded one by one and joined, so streams that differ in codec or rate still make one
+    voice. Always mono float32 at `SPEECH_SAMPLE_RATE`."""
+    try:
+        pieces = [piece for stream in streams for piece in decode_ffmpeg_stream(stream)]
+    except RequestError:
+        raise
+    except Exception as error:  # av raises its own FFmpegError subclasses
+        raise RequestError(400, "the audio file could not be decoded") from error
+    if not pieces:
+        raise RequestError(400, "the audio file could not be decoded")
+    return np.ascontiguousarray(np.concatenate(pieces), dtype=np.float32), SPEECH_SAMPLE_RATE
+
+
+def decode_audio(upload: AudioUpload) -> tuple[np.ndarray, int]:
+    """Decode an uploaded file (Telegram sends OGG/Opus) to mono float32 samples and their sample rate."""
+    if upload.header_seconds is not None:
+        return decode_with_libsndfile(upload.data)
+    return decode_with_ffmpeg(upload.streams)
+
+
 def make_recognizer(model):
     """The pool's recognise callback over a loaded model. A piece too short to hold a word is empty text, not
     an error: the encoder cannot take it."""
@@ -163,12 +434,20 @@ def make_recognizer(model):
 
 
 class PoolRequest:
-    """One upload's chunks: collects their texts in order and tells the waiting handler when all are in."""
-
-    def __init__(self, chunk_count: int, sample_rate: int):
-        self.sample_rate = sample_rate
-        self._texts: list[str | None] = [None] * chunk_count
-        self._remaining = chunk_count
+    """One upload in the pool: its place in the arrival order, then its pieces once they are cut. Collects their
+    texts in order and tells the waiting handler when all are in."""
+
+    def __init__(self, on_finished):
+        self.sample_rate = 0
+        self._on_finished = on_finished
+        self._chunks: list[np.ndarray] | None = None
+        self._next_chunk = 0
+        # The voice's length once read from the file, then once decoded: what it counts for the requests behind it while
+        # it is still being cut. `_is_sized` is set when the first of them is known (or the request ended).
+        self._audio_seconds = 0.0
+        self._is_sized = threading.Event()
+        self._texts: list[str | None] = []
+        self._remaining = 0
         self._error: Exception | None = None
         self._lock = threading.Lock()
         self._finished = threading.Event()
@@ -176,41 +455,109 @@ class PoolRequest:
     def is_finished(self) -> bool:
         return self._finished.is_set()
 
+    def attach_chunks(self, chunks: list[np.ndarray], sample_rate: int) -> None:
+        """The pieces are cut: from now on the pool hands them out. No pieces is empty text at once."""
+        with self._lock:
+            self.sample_rate = sample_rate
+            self._texts = [None] * len(chunks)
+            self._remaining = len(chunks)
+            self._chunks = list(chunks)
+            is_empty = not chunks
+            if is_empty:
+                self._finished.set()
+        if is_empty:
+            self._on_finished()
+
+    def note_audio_seconds(self, seconds: float) -> None:
+        self._audio_seconds = seconds
+        self._is_sized.set()
+
+    def wait_until_sized(self, timeout_seconds: float) -> None:
+        """Block until the length is noted or the request ended — at most `timeout_seconds`."""
+        self._is_sized.wait(timeout_seconds)
+
+    def is_cut(self) -> bool:
+        return self._chunks is not None
+
+    def get_remaining_audio_seconds(self) -> float:
+        """Audio still to recognise: the pieces not finished (the running ones included), or the decoded length while
+        the voice is still being cut."""
+        with self._lock:
+            if self._finished.is_set():
+                return 0.0
+            if self._chunks is None:
+                return self._audio_seconds
+            samples = sum(len(chunk) for chunk, text in zip(self._chunks, self._texts) if text is None)
+            return samples / self.sample_rate if self.sample_rate else 0.0
+
+    def has_unclaimed_chunk(self) -> bool:
+        return self._chunks is not None and self._next_chunk < len(self._chunks)
+
+    def count_unclaimed_chunks(self) -> int:
+        return len(self._chunks) - self._next_chunk if self._chunks is not None else 0
+
+    def claim_next_chunk(self) -> tuple[int, np.ndarray]:
+        """The next piece for a worker (the pool calls this under its own lock, so the pieces go out in order)."""
+        index = self._next_chunk
+        self._next_chunk += 1
+        return index, self._chunks[index]
+
     def complete_chunk(self, index: int, text: str) -> None:
         with self._lock:
             if self._finished.is_set():
                 return
             self._texts[index] = text
             self._remaining -= 1
-            if self._remaining == 0:
+            is_last = self._remaining == 0
+            if is_last:
                 self._finished.set()
+        if is_last:
+            self._on_finished()
 
     def fail(self, error: Exception) -> None:
-        """Fail the whole request; the pool drops its chunks that are still queued."""
+        """Fail the whole request; the pool drops its pieces that were not handed out yet."""
         with self._lock:
-            if not self._finished.is_set():
+            is_first_end = not self._finished.is_set()
+            if is_first_end:
                 self._error = error
                 self._finished.set()
-
-    def wait(self, timeout_seconds: float) -> str:
-        """The chunks' texts joined in order with single spaces; raises the first chunk error, or
-        `RecognitionTimeout` after `timeout_seconds` (the pending chunks are then dropped)."""
-        if not self._finished.wait(timeout_seconds):
-            self.fail(RecognitionTimeout())
+            self._is_sized.set()
+        if is_first_end:
+            self._on_finished()
+
+    def wait(self, timeout_seconds: float, is_abandoned=lambda: False, on_tick=lambda: None) -> str:
+        """The chunks' texts joined in order with single spaces; raises the first chunk error, `RecognitionTimeout`
+        after `timeout_seconds`, or `ClientGone` once `is_abandoned()` says the client hung up (checked every
+        `CLIENT_CHECK_SECONDS`, when `on_tick()` also runs); in both cases the pieces not handed out yet are dropped."""
+        deadline = time.monotonic() + timeout_seconds
+        while not self._finished.wait(max(0.0, min(CLIENT_CHECK_SECONDS, deadline - time.monotonic()))):
+            on_tick()
+            if is_abandoned():
+                self.fail(ClientGone())
+            elif time.monotonic() >= deadline:
+                self.fail(RecognitionTimeout())
         if self._error is not None:
             raise self._error
         return " ".join(text.strip() for text in self._texts if text and text.strip())
 
 
+class RequestCancelled(Exception):
+    """The upload never got its pieces (it could not be decoded): its place in the order is given up."""
+
+
 class RecognitionPool:
-    """W threads over one priority queue. A request's priority is its total chunk count, so a short voice
-    overtakes the rest of a long one; equal priorities keep arrival order."""
+    """W threads over the requests in strict arrival order (FIFO). A request takes its place when it arrives
+    (`open_request`, before its audio is decoded and cut), so a voice that is quicker to cut never overtakes one that
+    came earlier; the workers hand out the pieces of the first request with pieces left, in order, before any piece of
+    the next one, and wait while a request ahead is still being cut. A request stays listed until it is finished, so
+    the audio queued ahead of a voice counts the pieces still running too."""
 
     def __init__(self, recognize, workers: int):
         self._recognize = recognize
         self._workers = workers
-        self._queue: queue.PriorityQueue = queue.PriorityQueue()
-        self._sequence = itertools.count()
+        self._condition = threading.Condition()
+        self._requests: collections.deque[PoolRequest] = collections.deque()
+        self._is_stopping = False
         self._threads: list[threading.Thread] = []
 
     def start(self) -> None:
@@ -220,24 +567,76 @@ class RecognitionPool:
             self._threads.append(thread)
 
     def stop(self) -> None:
-        for _ in self._threads:
-            self._queue.put((STOP_PRIORITY, next(self._sequence), None, 0, None))
+        """The workers finish the piece they hold and leave; pieces not handed out yet are dropped."""
+        with self._condition:
+            self._is_stopping = True
+            self._condition.notify_all()
 
     def queued_chunks(self) -> int:
-        """Chunks waiting for a worker (approximate: the queue moves while it is read)."""
-        return self._queue.qsize()
-
-    def submit(self, chunks: list[np.ndarray], sample_rate: int) -> PoolRequest:
-        request = PoolRequest(len(chunks), sample_rate)
-        for index, chunk in enumerate(chunks):
-            self._queue.put((len(chunks), next(self._sequence), request, index, chunk))
-        return request
+        """Pieces waiting for a worker."""
+        with self._condition:
+            return sum(request.count_unclaimed_chunks() for request in self._requests if not request.is_finished())
+
+    def count_cutting_requests(self) -> int:
+        """Requests in line whose audio is still being decoded and cut."""
+        with self._condition:
+            return sum(1 for request in self._requests if not request.is_finished() and not request.is_cut())
+
+    def get_audio_seconds_ahead(self, request: PoolRequest) -> float:
+        """Seconds of audio that will be recognised before `request`: everything unfinished that arrived earlier."""
+        with self._condition:
+            ahead = itertools.takewhile(lambda listed: listed is not request, self._requests)
+            return sum(listed.get_remaining_audio_seconds() for listed in ahead)
+
+    def wait_until_sized_ahead(self, request: PoolRequest, timeout_seconds: float) -> None:
+        """Wait (at most `timeout_seconds` in all) until every voice that arrived before `request` has its length
+        noted, so the queue reported to `request` counts it. A voice takes its place before its length is read."""
+        with self._condition:
+            ahead = list(itertools.takewhile(lambda listed: listed is not request, self._requests))
+        deadline = time.monotonic() + timeout_seconds
+        for listed in ahead:
+            listed.wait_until_sized(max(0.0, deadline - time.monotonic()))
+
+    def open_request(self) -> PoolRequest:
+        """Take the next place in the arrival order; `submit` or `cancel` must follow."""
+        with self._condition:
+            request = PoolRequest(self._wake_workers)
+            self._requests.append(request)
+            return request
+
+    def submit(self, request: PoolRequest, chunks: list[np.ndarray], sample_rate: int) -> None:
+        request.attach_chunks(chunks, sample_rate)
+        self._wake_workers()
+
+    def cancel(self, request: PoolRequest) -> None:
+        request.fail(RequestCancelled())
+
+    def _wake_workers(self) -> None:
+        with self._condition:
+            self._condition.notify_all()
+
+    def _take_next_chunk(self) -> tuple[PoolRequest, int, np.ndarray] | None:
+        with self._condition:
+            while not self._is_stopping:
+                while self._requests and self._requests[0].is_finished():
+                    self._requests.popleft()
+                for listed in self._requests:
+                    if listed.is_finished():
+                        continue
+                    if listed.has_unclaimed_chunk():
+                        index, samples = listed.claim_next_chunk()
+                        return listed, index, samples
+                    if not listed.is_cut():
+                        break  # still being cut: nothing behind it may go first
+                self._condition.wait()
+            return None
 
     def _work(self) -> None:
         while True:
-            _, _, request, index, samples = self._queue.get()
-            if request is None:
+            taken = self._take_next_chunk()
+            if taken is None:
                 return
+            request, index, samples = taken
             if request.is_finished():
                 continue
             try:
@@ -317,10 +716,20 @@ class SidecarContext:
     """What the handlers and the monitors share."""
 
     def __init__(
-        self, token: str, pool: RecognitionPool, workers: int, idle_seconds: float, max_seconds: float, clock=time.monotonic
+        self,
+        token: str,
+        pool: RecognitionPool,
+        split_audio,
+        workers: int,
+        idle_seconds: float,
+        max_seconds: float,
+        clock=time.monotonic,
     ):
+        """`split_audio(samples, sample_rate)` → (pieces, their sample rate): `make_model_pause_splitter`, or
+        `split_without_pauses` when the VAD could not be loaded."""
         self.token = token
         self.pool = pool
+        self.split_audio = split_audio
         self.workers = workers
         self.idle_seconds = idle_seconds
         self.max_seconds = max_seconds
@@ -394,6 +803,7 @@ class SidecarHandler(http.server.BaseHTTPRequestHandler):
                 "status": "ok",
                 "busyRequests": context.busy_requests,
                 "queuedChunks": context.pool.queued_chunks(),
+                "cuttingRequests": context.pool.count_cutting_requests(),
                 "workers": context.workers,
                 "idleMinutes": context.idle_seconds / SECONDS_PER_MINUTE,
                 "version": SCRIPT_VERSION,
@@ -417,6 +827,8 @@ class SidecarHandler(http.server.BaseHTTPRequestHandler):
             self._reply_error(error.status, error.message)
         except RecognitionTimeout:
             self._reply_error(504, "recognition took too long")
+        except ClientGone:
+            self.close_connection = True
         except Exception as error:
             logger.error("request failed: %s", traceback.format_exc())
             self._reply_error(500, f"recognition failed: {type(error).__name__}")
@@ -438,18 +850,68 @@ class SidecarHandler(http.server.BaseHTTPRequestHandler):
         response_format = fields.get("response_format", "json")
         if response_format not in RESPONSE_FORMATS:
             raise RequestError(400, f"response_format must be one of {', '.join(RESPONSE_FORMATS)}")
-        samples, sample_rate = decode_audio(file_bytes)
-        chunks = split_at_silences(samples, sample_rate)
-        request = context.pool.submit(chunks, sample_rate)
-        text = request.wait(context.max_seconds)
+        # The upload is in: its place in the arrival order is taken before the decoding and the cutting.
+        request = context.pool.open_request()
+        try:
+            upload = inspect_audio(file_bytes)
+            request.note_audio_seconds(read_audio_seconds(upload))
+            samples, sample_rate = decode_audio(upload)
+            audio_seconds = len(samples) / sample_rate
+            request.note_audio_seconds(audio_seconds)
+            chunks, chunk_sample_rate = context.split_audio(samples, sample_rate)
+            # The pieces hold what is needed: the decoded file would only take memory while the voice waits.
+            del samples, file_bytes, body, upload
+        except BaseException:
+            context.pool.cancel(request)
+            raise
+        context.pool.submit(request, chunks, chunk_sample_rate)
+        context.pool.wait_until_sized_ahead(request, SIZING_WAIT_SECONDS)
+        reported_seconds_ahead = context.pool.get_audio_seconds_ahead(request)
+
+        def report_a_longer_queue() -> None:
+            nonlocal reported_seconds_ahead
+            seconds_ahead = context.pool.get_audio_seconds_ahead(request)
+            if seconds_ahead > reported_seconds_ahead + QUEUE_REPORT_GROWTH_SECONDS:
+                self._report_queue(seconds_ahead)
+                reported_seconds_ahead = seconds_ahead
+
+        try:
+            self._report_queue(reported_seconds_ahead)
+            # A failing piece re-raises here; an OSError of the recognition itself is OUR failure and goes on to the 500.
+            text = request.wait(context.max_seconds, self._is_client_gone, report_a_longer_queue)
+        except ClientGone:
+            request.fail(ClientGone())  # a report that could not be written ends the wait too (no-op once failed)
+            logger.info("the client left while %.1fs of audio waited; dropped", audio_seconds)
+            raise
         logger.info(
-            "transcribed %.1fs of audio in %d chunk(s), %.2fs", len(samples) / sample_rate, len(chunks), time.monotonic() - started
+            "transcribed %.1fs of audio in %d chunk(s), %.2fs", audio_seconds, len(chunks), time.monotonic() - started
         )
         if response_format == "text":
             self._reply(200, text.encode("utf-8"), "text/plain; charset=utf-8")
         else:
             self._reply_json(200, {"text": text})
 
+    def _report_queue(self, seconds_ahead: float) -> None:
+        """The interim 102: the voice is in line, with this much audio before it. A report that cannot be written means
+        the client is gone (`ClientGone`)."""
+        try:
+            self._write_queue_report(seconds_ahead)
+        except OSError as error:
+            raise ClientGone() from error
+
+    def _write_queue_report(self, seconds_ahead: float) -> None:
+        self.send_response_only(QUEUE_REPORT_STATUS)
+        self.send_header(QUEUED_AUDIO_SECONDS_HEADER, f"{seconds_ahead:.1f}")
+        self.end_headers()
+
+    def _is_client_gone(self) -> bool:
+        """The client closed its end (its request is fully read, so a readable socket with nothing to read is EOF)."""
+        try:
+            readable, _, _ = select.select([self.connection], [], [], 0)
+            return bool(readable) and self.connection.recv(1, socket.MSG_PEEK) == b""
+        except OSError:
+            return True
+
     def _reply_json(self, status: int, payload: dict) -> None:
         self._reply(status, json.dumps(payload, ensure_ascii=False).encode("utf-8"), "application/json; charset=utf-8")
 
@@ -625,8 +1087,41 @@ def load_model(threads: int):
     return onnx_asr.load_model(MODEL_NAME, quantization=MODEL_QUANTIZATION, sess_options=options)
 
 
+def load_vad():
+    """Silero VAD on one thread: it runs once per request, in that request's handler thread."""
+    import onnx_asr
+    import onnxruntime
+
+    options = onnxruntime.SessionOptions()
+    options.intra_op_num_threads = 1
+    options.inter_op_num_threads = 1
+    return onnx_asr.load_vad(VAD_MODEL_NAME, sess_options=options)
+
+
+def create_audio_splitter(model, load_vad_model=load_vad):
+    """The request splitter `run_serve` uses: the pause cuts, or — when the VAD cannot be loaded — the 25 s cuts alone,
+    so the engine keeps working the old way instead of failing to start."""
+    try:
+        return make_model_pause_splitter(model, load_vad_model())
+    except Exception:
+        logger.error("the VAD could not be loaded, cutting at %.0f s only: %s", MAX_CHUNK_SECONDS, traceback.format_exc())
+        return split_without_pauses
+
+
+def check_ffmpeg_decoder(name: str) -> bool:
+    """Whether the ffmpeg inside the `av` wheel has the decoder `name`."""
+    import av
+
+    try:
+        av.Codec(name, "r")
+    except av.codec.codec.UnknownCodecError:
+        return False
+    return True
+
+
 def run_check(args: argparse.Namespace) -> int:
-    """Load the model, recognise 1 s of silence and print the versions — the installer's verify step."""
+    """Load the model and the VAD, recognise 1 s of silence through the pause splitter and print the versions —
+    the installer's verify step (it also fetches both while the network is allowed)."""
     from importlib import metadata
     import platform
 
@@ -634,11 +1129,19 @@ def run_check(args: argparse.Namespace) -> int:
         import soundfile
 
         model = load_model(args.threads)
-        silence = np.zeros(16000, dtype=np.float32)
-        text = make_recognizer(model)(silence, 16000)
+        split = make_model_pause_splitter(model, load_vad())
+        silence = np.zeros(CHECK_SAMPLE_RATE, dtype=np.float32)
+        pieces, piece_sample_rate = split(silence, CHECK_SAMPLE_RATE)
+        if piece_sample_rate != SPEECH_SAMPLE_RATE:
+            raise RuntimeError("the pause detection failed (its traceback is above, on stderr)")
+        recognize = make_recognizer(model)
+        text = " ".join(recognize(piece, piece_sample_rate) for piece in pieces).strip()
         is_opus_readable = "OPUS" in soundfile.available_subtypes("OGG")
         if not is_opus_readable:
             raise RuntimeError("libsndfile cannot read OGG/Opus")
+        missing_decoders = [name for name in FFMPEG_REQUIRED_DECODERS if not check_ffmpeg_decoder(name)]
+        if missing_decoders:
+            raise RuntimeError(f"ffmpeg (the av package) lacks the decoders {', '.join(missing_decoders)}")
         report = {
             "ok": True,
             "scriptVersion": SCRIPT_VERSION,
@@ -648,6 +1151,7 @@ def run_check(args: argparse.Namespace) -> int:
             "onnxruntime": metadata.version("onnxruntime"),
             "soundfile": metadata.version("soundfile"),
             "libsndfile": soundfile.__libsndfile_version__,
+            "av": metadata.version("av"),
             "numpy": metadata.version("numpy"),
             "silenceText": text,
         }
@@ -683,10 +1187,11 @@ def run_serve(args: argparse.Namespace, token: str) -> int:
         logger.error("model load failed: %s", traceback.format_exc())
         return EXIT_SETUP_FAILED
     logger.info("model loaded in %.2fs", time.monotonic() - loading_started)
+    split_audio = create_audio_splitter(model)
 
     pool = RecognitionPool(make_recognizer(model), args.workers)
     pool.start()
-    context = SidecarContext(token, pool, args.workers, args.idle_seconds, args.max_seconds)
+    context = SidecarContext(token, pool, split_audio, args.workers, args.idle_seconds, args.max_seconds)
     try:
         server = SidecarServer(("127.0.0.1", 0), context)
     except OSError: