feat(voice): ask before leaving work behind, and stop cutting off the sign-off

Three things the device found, all in the same corner of teardown.

**A machine switch discarded outstanding work, silently.**
`applyMachineSwitch` builds a fresh VoiceSession, so the FSM goes with the
old one: the queue, the in-flight turn and any pending approval. A task
Sai had promised out loud disappeared with nothing said — the hazard
VOICE_FSM §7 records for a dropped call, reachable by an ordinary voice
command. `close()` only discards the stream, so the work kept running on
the machine being left and its result reached nobody.

So the switch now asks first, and so does the hang-up, through one shared
LeavingWorkPolicy — they lose the same work in the same way, and the ask
should not read differently depending on which one you said. It names
what is outstanding, says it keeps running where it started, and points
at the Sai app for the result. It never stops anything: aborting work
nobody asked to cancel would be its own failure.

One-shot, like applyInterrupt's scope question — someone who says "switch
to my laptop" twice means it. Running and queued are named separately,
the same rule interruptScopeQuestion follows, because reading them as one
list describes a queued task as underway. From the picker there is no
question to ask, so it switches and then says what was left behind.

**The idle sign-off was cut mid-sentence.** Teardown waited a flat 1.8s;
"It's been quiet for a bit, so I'll hang up to save battery. Tap to start
again." runs about four. It now waits for the line to start, for the play
queue to drain, and for a short tail — capped at 12s, because a teardown
that hangs on a sign-off that never came leaves the mic open and has not
actually ended anything.

Both endCall-with-reason paths get it; the goodbye window is left alone
on purpose, since its 1.8s doubles as the barge-in cancel window that
check 10d is written against.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: jamie-simular

docs/ON_DEVICE_CHECK.md

@@ -273,6 +273,14 @@ Mid-call, with more than one machine on the account:
   your ear is `RESELECT_NUDGE`'s failure in a new place. Switching from the **phone picker** instead
   must be silent — a button press carries no tool response, so the correction goes in as a nudge, and
   Sai narrating what you just pressed is the failure.
+- **Switch with a task still running** and Sai must **ask first** — naming the task, saying it keeps
+  going on the machine you are leaving and that this call will not hear the result, and offering to
+  stop it. Answer either way and the switch then goes through; the question is one-shot, like
+  `interrupt`'s scope question. This is `LeavingWorkPolicy`, shared with the hang-up in check 10a, and
+  it exists because `applyMachineSwitch` builds a fresh `VoiceSession`: before it, a switch silently
+  discarded the queue, the running turn and any pending approval — work Sai had promised out loud. From
+  the **picker** there is no question to ask (a tap is not a conversation), so it switches and then says
+  what was left behind.
 - **Switch onto a hibernated machine** and it should wake, announced: "Switched to ⟨label⟩", then
   `MACHINE_WAKING` verbatim, then `MACHINE_AWAKE` on its own a minute or so later — all before you ask
   for anything. Both switch paths go through `applyMachineSwitch`, so the picker behaves the same.

meta-android-app/app/src/main/java/com/meta/wearable/dat/externalsampleapps/cameraaccess/saispike/AudioIo.kt

@@ -281,6 +281,21 @@ class AudioIo(
   }
 
   /** Barge-in: drop everything queued for playback so the model goes quiet immediately. */
+  /**
+   * Is there model audio still waiting to be written to the track?
+   *
+   * For the teardown paths, which have to let a spoken sign-off finish before cutting the audio. They
+   * used to wait a flat 1.8 s, which is less than the lines they were waiting for: the idle-timeout
+   * reason ("It's been quiet for a bit, so I'll hang up to save battery. Tap to start again.") ran
+   * past it and was cut mid-sentence on device.
+   *
+   * Only the QUEUE — what the track itself still holds is a fraction of a second and is covered by the
+   * caller's tail wait. Exact accounting there would mean polling `getPlaybackHeadPosition` against a
+   * moving write cursor, which is a lot of arithmetic to shave 200 ms off a hang-up.
+   */
+  val playbackPending: Boolean
+    get() = playQueue.isNotEmpty()
+
   fun flushPlayback() {
     playQueue.clear() // drop everything not yet written, not just what the track already holds
     track?.let {

meta-android-app/app/src/main/java/com/meta/wearable/dat/externalsampleapps/cameraaccess/saispike/CallService.kt

@@ -117,6 +117,15 @@ class CallService : Service() {
 
   /** The in-flight "is it awake yet" watcher, if any. A machine switch supersedes the previous one. */
   private var wakeWatch: Job? = null
+
+  /**
+   * The user has been asked once about work they are leaving behind — see [LeavingWorkPolicy].
+   *
+   * Shared by the hang-up and the machine switch on purpose: they are the same question about the same
+   * work, and asking it twice in a row ("shall I stop that first?" … "shall I stop that first?") is
+   * the trap the one-shot exists to avoid. Reset per call, like [hangupGuardUsed].
+   */
+  @Volatile private var leavingWorkAsked = false
   // Nudges withheld while muted (they'd be spoken into the void and lost). Replayed on unmute.
   private val heldNudges = HeldNudgeQueue(MAX_HELD_NUDGES)
   // Keepalive throttle: the last time we told the server a human is still present (see maybeKeepalive).
@@ -234,6 +243,7 @@ class CallService : Service() {
     lastUserText = ""
     lastSaiText = ""
     hangupGuardUsed = false
+    leavingWorkAsked = false
     lastStepFailureNudgeAt = 0L
     callActive = true
     audioPaused = false
@@ -750,6 +760,17 @@ class CallService : Service() {
             "last sai: \"${excerpt(lastSaiText)}\"" +
             (if (spokeThisTurn) " | Sai spoke in this turn" else " | Sai said nothing in this turn"),
     )
+    // Work first, farewell second. HangupPolicy answers "did they mean me?"; this answers "do they
+    // know what they are leaving?" — and an unanswered task outlives the call either way, so the
+    // question has to come before the goodbye rather than after it.
+    val leaving = leavingWork(Leaving.CALL)
+    if (leaving is LeavingWorkAction.Ask) {
+      leavingWorkAsked = true
+      log("⏻ endCall held — work outstanding; asking before leaving it behind")
+      live?.injectNudge("endcall-work-outstanding", leaving.nudge)
+      status("live — talk (a hang-up was held back)")
+      return
+    }
     when (val action =
         HangupPolicy.decide(
             spokeThisTurn = spokeThisTurn,
@@ -847,7 +868,7 @@ class CallService : Service() {
     }
     notifyReason(reason)
     scope.launch {
-      if (canSpeak) delay(1_800) // let the spoken reason land before cutting audio
+      if (canSpeak) awaitSignOff()
       stopAll()
       status(reason) // stopAll resets status to "Idle" — keep the reason visible on the ended call
     }
@@ -1001,7 +1022,7 @@ class CallService : Service() {
       )
     }
     scope.launch {
-      if (canSpeak) delay(1_800) // let the spoken sign-off land before cutting audio
+      if (canSpeak) awaitSignOff() // the line runs past any fixed delay worth picking
       stopAll()
       status(line) // keep the reason visible after the call ends
     }
@@ -1016,6 +1037,16 @@ class CallService : Service() {
   private fun switchMachine(name: String): String {
     val decision = MachineSwitcher.resolve(name, machines, currentMachineId)
     if (decision is MachineSwitch.SwitchTo) {
+      // Asked BEFORE the switch, because the switch is what destroys the answer: applyMachineSwitch
+      // builds a fresh VoiceSession, so the queue, the in-flight turn and any pending approval go with
+      // the old one. Returned as the TOOL REPLY rather than spoken, so the model asks in its own words
+      // and the switch simply has not happened yet.
+      val leaving = leavingWork(Leaving.MACHINE)
+      if (leaving is LeavingWorkAction.Ask) {
+        leavingWorkAsked = true
+        log("↺ switchMachine held — work outstanding; asking before leaving it behind")
+        return leaving.nudge
+      }
       applyMachineSwitch(decision.machine, notifyModel = false) // the reply carries the context update
     }
     return when (decision) {
@@ -1034,7 +1065,16 @@ class CallService : Service() {
       return
     }
     if (match.machineId == currentMachineId) return
+    // A button press is not a question, so this does not hold — the user did the thing deliberately and
+    // a modal-by-voice over a tap would be worse than the loss. But it must not be SILENT: the same
+    // work is being left behind, so say what it was.
+    val leftBehind = leavingWork(Leaving.MACHINE)
     applyMachineSwitch(match, notifyModel = true)
+    if (leftBehind is LeavingWorkAction.Ask) {
+      leavingWorkAsked = true
+      log("↺ picker switch left work behind — telling the user rather than asking")
+      live?.injectNudge("left-work-behind", leftBehind.nudge)
+    }
   }
 
   /**
@@ -1152,6 +1192,61 @@ class CallService : Service() {
         }
   }
 
+  /**
+   * Is there outstanding work, and has the user been told? See [LeavingWorkPolicy].
+   *
+   * Reads the FSM rather than tracking a parallel copy: the queue and the in-flight turn already live
+   * there, and a second count is a second thing to get wrong.
+   */
+  private fun leavingWork(leaving: Leaving): LeavingWorkAction {
+    val state = concierge?.state() ?: return LeavingWorkAction.Proceed
+    return LeavingWorkPolicy.decide(
+        state = state,
+        leaving = leaving,
+        alreadyAsked = leavingWorkAsked,
+        muted = saiMuted,
+    )
+  }
+
+  /**
+   * Wait for a spoken sign-off to actually finish before tearing the audio down.
+   *
+   * Replaces a flat 1.8 s, which was shorter than the lines it was waiting for — the idle-timeout
+   * reason runs about four seconds and was cut mid-sentence on device. Waits for the line to START
+   * (the model has to generate it first), then for the play queue to drain, then a short tail for what
+   * the AudioTrack still holds.
+   *
+   * Every wait is bounded. A teardown that hangs because a sign-off never came is worse than one that
+   * clips a word: the mic stays open and the guard that fired has not actually ended anything.
+   */
+  private suspend fun awaitSignOff() {
+    val io = audioIo ?: return
+    // 1. Wait for it to begin. If nothing is ever queued the model produced no audio at all — muted,
+    // dropped socket, a refusal — and there is nothing to wait out.
+    val startBy = SystemClock.elapsedRealtime() + SIGNOFF_START_MS
+    while (!io.playbackPending && SystemClock.elapsedRealtime() < startBy) delay(50)
+    if (!io.playbackPending) {
+      log("sign-off: nothing was spoken — ending now")
+      return
+    }
+    // 2. Wait for it to finish, capped. `playbackPending` goes false between chunks as well as at the
+    // end, so require it to stay quiet for a beat rather than trusting one observation.
+    val endBy = SystemClock.elapsedRealtime() + SIGNOFF_MAX_MS
+    var quietSince = 0L
+    while (SystemClock.elapsedRealtime() < endBy) {
+      delay(50)
+      if (io.playbackPending) {
+        quietSince = 0L
+        continue
+      }
+      if (quietSince == 0L) quietSince = SystemClock.elapsedRealtime()
+      if (SystemClock.elapsedRealtime() - quietSince >= SIGNOFF_QUIET_MS) break
+    }
+    if (SystemClock.elapsedRealtime() >= endBy) log("sign-off: capped at ${SIGNOFF_MAX_MS / 1000}s")
+    // 3. The track's own buffer, which `playbackPending` cannot see.
+    delay(SIGNOFF_TAIL_MS)
+  }
+
   /**
    * Act on a [WakePolicy] decision: speak the line verbatim, or log why not.
    *
@@ -1547,6 +1642,14 @@ class CallService : Service() {
     private const val WAKE_WATCH_MS = 3 * 60_000L
     /** Poll interval while waiting for a wake. Cheap (`GET /machines`), and nothing pushes this. */
     private const val WAKE_POLL_MS = 10_000L
+    /** How long to wait for a sign-off to start before concluding none is coming. */
+    private const val SIGNOFF_START_MS = 2_500L
+    /** Hard cap on waiting for a sign-off to finish. The mic is still open until it expires. */
+    private const val SIGNOFF_MAX_MS = 12_000L
+    /** How long the play queue must stay empty to count as finished rather than between chunks. */
+    private const val SIGNOFF_QUIET_MS = 350L
+    /** For what the AudioTrack still holds after the queue drains. */
+    private const val SIGNOFF_TAIL_MS = 400L
     private const val NOTIF_ID = 42
     private const val REASON_NOTIF_ID = 43
     /** Default "ask before delivering an update" threshold; overridable via StartParams (app setting). */

meta-android-app/app/src/main/java/com/meta/wearable/dat/externalsampleapps/cameraaccess/saispike/LeavingWorkPolicy.kt

@@ -0,0 +1,111 @@
+/*
+ * sai-fi — voice concierge (leaving work behind).
+ */
+
+// Two ways to walk away from work in progress — hanging up, and changing machines — and one rule for
+// both: ask first, and say where the results will be instead.
+//
+// A pure decision, so it can be tested without a device. The reason it is shared rather than written
+// twice: the two paths lose work in exactly the same way, and the one that had no ask at all lost it
+// silently. `applyMachineSwitch` builds a fresh VoiceSession, so the FSM — queue, in-flight turn,
+// pending approval — is replaced wholesale. Work the user was PROMISED OUT LOUD disappears with
+// nothing said, which is the hazard docs/VOICE_FSM.md §7 records for a dropped call, reachable by an
+// ordinary voice command.
+//
+// Note what this does NOT do: it never stops anything. A task left running keeps running on the
+// machine it started on, and the honest thing is to say so and point at the app, not to abort work
+// nobody asked to cancel.
+
+package com.meta.wearable.dat.externalsampleapps.cameraaccess.saispike
+
+import com.meta.wearable.dat.externalsampleapps.cameraaccess.saispike.fsm.ConciergeState
+import com.meta.wearable.dat.externalsampleapps.cameraaccess.saispike.fsm.hasOutstandingWork
+import com.meta.wearable.dat.externalsampleapps.cameraaccess.saispike.fsm.readBackList
+
+/** Where the user is going, which is all that differs between the two questions. */
+enum class Leaving {
+  /** The call is ending. Results have nowhere to arrive. */
+  CALL,
+  /** The machine is changing. The old machine keeps working; this call stops hearing about it. */
+  MACHINE,
+}
+
+/** What [LeavingWorkPolicy.decide] concluded. */
+sealed interface LeavingWorkAction {
+  /** Do not go yet. [nudge] is model-facing: it carries the facts and asks for a decision. */
+  data class Ask(val nudge: String) : LeavingWorkAction
+
+  /** Nothing outstanding, or the user has already been asked. Go. */
+  data object Proceed : LeavingWorkAction
+}
+
+object LeavingWorkPolicy {
+
+  /**
+   * Ask before leaving work behind — once.
+   *
+   * One-shot for the same reason `applyInterrupt`'s scope question is: a user who says "hang up" or
+   * "switch to my laptop" twice means it, and a question that cannot be got past is a trap. The caller
+   * owns the flag so the two paths do not consume each other's ask.
+   *
+   * @param muted nothing asked can be heard, so there is no question to put — the caller decides what
+   *   to do with that, because the right answer differs: a hang-up should proceed silently, and a
+   *   switch should proceed and be reported on unmute.
+   */
+  fun decide(
+      state: ConciergeState,
+      leaving: Leaving,
+      alreadyAsked: Boolean,
+      muted: Boolean,
+  ): LeavingWorkAction {
+    if (alreadyAsked || muted) return LeavingWorkAction.Proceed
+    if (!state.hasOutstandingWork()) return LeavingWorkAction.Proceed
+    return LeavingWorkAction.Ask(nudge(state, leaving))
+  }
+
+  /**
+   * The facts, and what to do with them. Model-facing, like `HangupPolicy.UNCONFIRMED_NUDGE` — the
+   * content varies with what is outstanding, so the phrasing is the model's and only the facts are
+   * ours.
+   *
+   * Running and queued are named SEPARATELY, the same rule `interruptScopeQuestion` follows: one is
+   * work in progress the user may not want to lose, the other has not happened at all, and reading
+   * them as one list describes a queued task as underway.
+   */
+  private fun nudge(state: ConciergeState, leaving: Leaving): String {
+    val clauses = mutableListOf<String>()
+    if (state.inFlight.isNotEmpty()) {
+      clauses += "still working on ${readBackList(state.inFlight)}"
+    }
+    if (state.queue.isNotEmpty()) {
+      clauses += "${readBackList(state.queue.map { it.text })} hasn't started yet"
+    }
+    if (state.pendingApprovalId != null) {
+      clauses += "there's a request waiting on their answer"
+    }
+
+    val going =
+        when (leaving) {
+          Leaving.CALL -> "hanging up"
+          Leaving.MACHINE -> "moving to another machine"
+        }
+    // The part that makes the answer actionable, and the part that was missing: a task left running is
+    // not lost, it is just somewhere else. Without this the choice reads as "abandon it or stay", and
+    // the user picks staying for work they could simply have read later.
+    val whereItGoes =
+        when (leaving) {
+          Leaving.CALL ->
+              "Anything left running keeps going on their machine — they just won't hear the result " +
+                  "here, and can pick it up in the Sai app."
+          Leaving.MACHINE ->
+              "Anything left running keeps going on the machine they're leaving — this call won't " +
+                  "hear the result once you move, and they can pick it up in the Sai app."
+        }
+
+    return "[system] NOTHING has happened yet — you have not $going, and you must not until they " +
+        "answer. They are ${clauses.joinToString(", and ")}. $whereItGoes " +
+        "Tell them what's outstanding in ONE short line, and ask whether to stop it first or leave " +
+        "it running. Then do what they say: to stop it, call interrupt; to leave it, ask again and " +
+        "it will go through. Do not describe any of it as finished."
+  }
+}