Ambient ASR garbage — background audio (TV/podcast) feeds Whisper as fake user input #105

Context

Found during the #44 LED bench sweep on 2026-05-23, looking at xiaozhi-server logs.

A continuous stream of Whisper ASR transcriptions are being treated as user messages and forwarded to the LLM, even though no human was speaking to Dotty. Source was background audio (TV / podcast playing in the room).

Evidence

xiaozhi-server log fragment, single ~12 minute window:

```
20:27:07 大模型收到用户消息: {"content": "When somebody focuses on an external enemy, immigrants, other races, trans people..."}
20:28:24 大模型收到用户消息: {"content": "which I think are really old fashioned social democrats still are not yet practical..."}
20:28:27 大模型收到用户消息: {"content": "Let's do whatever it is."}
20:28:32 大模型收到用户消息: {"content": "possible. But, uh, uh, there is..."}
20:29:01 大模型收到用户消息: {"content": "I intended to call Trump a very specific kind of party..."}
20:29:13 大模型收到用户消息: {"content": "I like to cut the action in another way. You know Trump likes to attack the left..."}
20:29:32 大模型收到用户消息: {"content": "Sorry but if there ever was a historicist relativist, it's Trump..."}
20:31:03 大模型收到用户消息: {"content": "So in 2016, you said that a top victory might be for the best in America..."}
20:38:00 ASR result: "one of the ways of how to talk a lot and pretending to change things without really changing society…" (4-paragraph political monologue)
```

Each of these triggered an LLM chat turn — pumping background podcast content into Dotty's conversation history.

Why this is bad

1. TTS race: every spurious chat turn overwrites `conn.sentence_id`, which (per say bypass races chat turns under continuous ASR — sentence_id arbitration #104) silently drops server-pushed greetings (`face_greeter` say bypass, ProactiveGreeter, etc.).
2. Persona drift: the LLM's "Speaking with Brett" turn history gets polluted with disconnected paragraphs about fascism / political theory / podcast snippets, which can degrade later genuine responses.
3. Persona PII leakage risk: if the LLM context includes any household member's personal info, Dotty might respond to a podcast's tangential content with personalised greetings or memory writes (e.g. `remember` tool calls on bogus user input).
4. Kid-safety surface: ambient audio is unfiltered by the kid-mode content rules (those apply to LLM output, not ASR input).
5. Battery + cost: continuous WS turns + LLM calls + (when VLM_API_KEY is set) photo captures cost real money and shorten battery life.

Suspected mechanisms

• VAD threshold too low / too sensitive — VAD is firing on any voice-band audio above the noise floor. SileroVAD's threshold should probably be tuned up, OR
• No directional gating — the firmware emits `sound_event` with energy + direction; xiaozhi-server could refuse to start ASR on sounds that look like distant/diffuse audio (low single-direction confidence, low peak energy) vs. close-talk speech.
• No wake-word gating on turn continuation — once a turn opens, subsequent ASR turns auto-fire without re-requiring a wake. Brief silence after a podcast pause looks like turn boundary.
• No speaker recognition / voiceprint gate — `声纹识别URL未配置，声纹识别将被禁用` (voiceprint URL not configured) — speakers other than household members aren't filtered out.

Possible mitigations (cheapest first)

1. Bump SileroVAD threshold (config-only). Test if fewer ambient triggers happen with a higher threshold; measure false-negative rate on real human speech.
2. Energy floor on ASR — require ASR audio's RMS energy to exceed a threshold before forwarding to LLM. Background TV is loud-but-distant; close-talk speech has higher concentrated energy.
3. Wake-word required between turns — after each LLM turn, require a fresh wake-word before allowing the next ASR turn. Loses conversational flow but reliably scopes Dotty to direct address.
4. Wire up voiceprint provider — only forward ASR to LLM when the speaker matches a household voice_print_id.

Severity

P1 — actively burning cloud LLM tokens + producing garbage in conversation context whenever anyone has a TV / podcast / radio on near Dotty. Also blocks #104 from being user-visible: even if we fix the say race, Dotty's TTS will still get drowned out by ambient-triggered chat turns.

Related

• say bypass races chat turns under continuous ASR — sentence_id arbitration #104 (say bypass races chat turns) — same root cause symptom-amplified
• CLAUDE.md notes that `声纹识别URL未配置` ships as a warning at startup but is treated as non-blocking