Ten Minutes She Should Have Watched
Dad's request on 2026-11-04 was simple to say: when he speaks to Pippa after ten minutes of play, she should know those minutes the way a person who had been watching would. A look is one frame. Ten minutes of video is thousands of frames, and no model's context can hold them. What Pippa needs is someone who watched and took notes: a watch-along recorder that writes timed notes on a recording as it happens, so that a later question can read the notes instead of the frames.
Oriel Is the Source, Vestige Is the Watcher
The first version lived inside Oriel. It moved out (Coop 1104-10), and the split is the lesson. cwkVestige, the family's memory steward, now owns the watcher root, the fleet agent that runs it, coverage, notes and how notes become memory. Oriel supplies media and controls capture. They talk over HTTP, and neither imports the other's application. Oriel keeps no watcher package and no local note writer; it forwards note writes to Vestige after checking the watcher's token and live lease, with no local-storage fallback.
The contract Oriel serves is media-source/1:
| Route | Answer |
|---|---|
/sources/{ref} | what a source is: live or recorded, duration, how far it is ready |
/sources/{ref}/frame?t= | the original frame at full resolution, or a sized JPEG only when asked |
/sources/{ref}/speech?t0=&t1= | timed lines of what was said |
/sources/{ref}/audio?t0=&t1= | mono audio, or a status saying pending or unavailable |
/sources/{ref}/playback?t0=&t1= | which replies were played, and whether completely |
The eyes gate stays authoritative on every frame read (and the deck check on every audio read), and the contract keeps two answers apart that are easy to merge: a 404 means there is no frame at that time, while a gate refusal is not a missing frame. A watcher that cannot tell "nothing there" from "not allowed to see" will write wrong notes about both.
The Gate Follows the Pixels, Even Cached
Pippa reads the notes with the eyes action watch, inside its own budget of 9,000 tokens: the last minutes' notes in media-time order, the spans nobody saw, what is still pending, and the newest frame. That newest frame may be cached, and a cache is where gates usually leak. Here a cached frame keeps its original input's current gate: if the gate has closed, expired or the session ended, the pixels are withheld before the file is even read, while the text notes stay available with frame_unavailable naming the reason. A frame whose origin is unknown fails closed.
Watchers Are Ledger Slots, Not Pippa
The models that watch are not Pippa. Recorder harnesses have no soul and no vault identity, and which brain runs is decided by the family brain ledger's slots for Oriel, never by a brain name in code. The watcher picks its input mode from declared capabilities, not from a brain's name. When notes become memory, every run carries an explicit owner, and a run with a missing or foreign owner is never inferred as Pippa's. The distinction from track one returns here: helpers can see for her, but what they write is labelled as theirs.
A Recording Owns Its Watcher
Watching costs compute, so watchers run on the fleet's compute pool and never on the Mac Dad broadcasts from. Dad's own voice comes from the left deck card's audio. A deck card's sound is not behind the eyes gate (its picture is): what stands in front of it is the deck check, which lets audio through only from a card that holds a deck role. It is transcribed on the watcher's Mac. The lifecycle is tied to the recording with a lease:
- starting a session starts the deck-checked voice capture and assigns one pool agent a renewable session lease;
- stopping revokes the lease and stops voice capture, even a capture whose first timestamp has not appeared yet;
- each child process checks its agent's lease on a monotonic clock, so an agent crash cannot leave brains running;
- cleanup errors never skip closing the eyes gate.
Live comes first and backfill follows: a live run can produce its first notes after 15 seconds instead of waiting for a full 60-second window, while older gaps are filled behind it.
Unseen Stays Unseen
The most important property is the plainest. A stretch nobody watched is reported as unseen (in Korean, "I didn't see this stretch"), never filled in from the notes around it. Missing voice is named while the rest is transcribed. When Pippa answers a question about the last ten minutes, she can say exactly which minutes she knows and which she does not. A memory that admits its gaps can be trusted about everything else.