@gotcos/glasses-server 6.46.0 → 6.47.0

package/server/routes/fireflies-key.ts

@@ -0,0 +1,102 @@
+// Fireflies key endpoints.
+//
+//   POST   /api/fireflies-key/set     store the key, then check it
+//   GET    /api/fireflies-key/status  configured, source, savedAt, validatedAt, lastCheck
+//   DELETE /api/fireflies-key         remove the stored key
+//   POST   /api/fireflies-key/check   check now (this is the user-initiated one)
+//
+// The key is never in a response, and never in a log line. `status` reads the
+// remembered check rather than calling the vendor, so a settings pane that
+// polls it costs nothing.
+
+import { Router } from 'express'
+import { FirefliesKeyError, getFirefliesClient, getFirefliesKeyStore, type FirefliesKeyStore } from '../lib/fireflies-key.js'
+import { getFirefliesImporter } from '../lib/meeting-import.js'
+import type { FirefliesClient, FirefliesKeyCheck } from '../lib/fireflies-client.js'
+
+export interface FirefliesKeyRouterDeps {
+  store: () => FirefliesKeyStore
+  client: () => FirefliesClient
+  /** Told whenever the stored key changes, so a sticky invalid_key can clear. */
+  onKeyChanged?: (event: { configured: boolean }) => void
+  /** Told the result of every check, for the same reason. */
+  onKeyChecked?: (check: FirefliesKeyCheck) => void
+}
+
+export function createFirefliesKeyRouter(deps: FirefliesKeyRouterDeps): Router {
+  const router = Router()
+
+  const runCheck = async (): Promise<FirefliesKeyCheck> => {
+    const client = deps.client()
+    const check = await client.checkKey({ userInitiated: true })
+    deps.store().recordCheck(check)
+    deps.onKeyChecked?.(check)
+    return check
+  }
+
+  router.post('/fireflies-key/set', async (req, res) => {
+    try {
+      const store = deps.store()
+      const saved = store.save(req.body?.key)
+      deps.client().forgetKeyCheck()
+      deps.onKeyChanged?.({ configured: true })
+      const check = await runCheck()
+      res.json({ ok: true, savedAt: saved.savedAt, status: store.status(), check })
+    } catch (error) {
+      if (error instanceof FirefliesKeyError) {
+        return res.status(error.status).json({ error: { code: error.code, message: error.message } })
+      }
+      console.error('[fireflies-key] save failed')
+      res.status(500).json({ error: { code: 'fireflies_key_save_failed', message: 'The key could not be saved.' } })
+    }
+  })
+
+  router.get('/fireflies-key/status', (_req, res) => {
+    try {
+      const status = deps.store().status()
+      const cached = deps.client().cachedKeyCheck()
+      res.json({ ...status, ...(cached ? { lastCheck: { ...cached, cached: undefined } } : {}) })
+    } catch (error) {
+      console.error('[fireflies-key] status failed')
+      res.status(500).json({ error: { code: 'fireflies_key_unavailable', message: 'The key status could not be read.' } })
+    }
+  })
+
+  router.delete('/fireflies-key', (_req, res) => {
+    try {
+      const store = deps.store()
+      store.delete()
+      deps.client().forgetKeyCheck()
+      deps.onKeyChanged?.({ configured: store.status().configured })
+      res.json({ ok: true, status: store.status() })
+    } catch (error) {
+      if (error instanceof FirefliesKeyError) {
+        return res.status(error.status).json({ error: { code: error.code, message: error.message } })
+      }
+      console.error('[fireflies-key] delete failed')
+      res.status(500).json({ error: { code: 'fireflies_key_delete_failed', message: 'The key could not be removed.' } })
+    }
+  })
+
+  router.post('/fireflies-key/check', async (_req, res) => {
+    try {
+      res.json(await runCheck())
+    } catch (error) {
+      console.error('[fireflies-key] check failed')
+      res.status(500).json({ error: { code: 'fireflies_key_check_failed', message: 'The key could not be checked.' } })
+    }
+  })
+
+  return router
+}
+
+// A sticky invalid_key is what stops the importer from spending a budget on a
+// key the vendor already refused, so the two things that can make it wrong - a
+// new key, and a check that now succeeds - have to reach the importer from
+// here. Without this the only way out of the sticky state is a restart.
+export const firefliesKeyRouter = createFirefliesKeyRouter({
+  store: getFirefliesKeyStore,
+  client: getFirefliesClient,
+  onKeyChanged: () => getFirefliesImporter().onKeyChanged(),
+  onKeyChecked: check => getFirefliesImporter().onKeyChecked(check),
+})

package/server/routes/meeting-actions.ts

@@ -0,0 +1,82 @@
+// What the engine did, and how to undo it (6.47.0, WS4).
+//
+//   GET  /api/meeting-actions?limit=
+//   GET  /api/meeting-actions/:id              one action
+//   POST /api/meeting-actions/:id/revert       { dryRun } or { previewHash }
+//   POST /api/meeting-actions/:id/retry        a failed action, in its own direction
+//   POST /api/meeting-actions/revert-all       { dryRun } or { previewHash }
+//
+// TWO CALLS, ALWAYS. A revert asks for the preview first and gets a `previewHash` covering
+// the outputs' CURRENT bytes; sending it back is what proves the person is undoing the thing
+// they were shown. This follows the held-groups enroll gate in `voice.ts`, and for the same
+// reason: the blast radius belongs in the preview, not in an apology afterwards.
+//
+// RETRY EXISTS BECAUSE FAILURE WAS TERMINAL. An action that used its one automatic retry
+// stayed failed until the server restarted, and even a restart only re-drove WAITING rows.
+// Control's Retry button reloaded the list and nothing else. This is the route it needed.
+//
+// `revert-all` is declared BEFORE `/:id/revert`. Express matches in order, and without that
+// ordering `revert-all` is read as an action whose id is the literal string "revert-all".
+
+import { Router } from 'express'
+import { getMeetingMergeRunner, type MeetingMergeRunner } from '../lib/meeting-actions.js'
+import { actionRefusal } from './meeting-suggestions.js'
+
+export interface MeetingActionsRouterDeps {
+  runner: () => MeetingMergeRunner
+}
+
+export function createMeetingActionsRouter(deps: MeetingActionsRouterDeps): Router {
+  const router = Router()
+
+  router.get('/meeting-actions', (req, res) => {
+    try {
+      const raw = Number(req.query.limit)
+      const limit = Number.isFinite(raw) && raw > 0 ? Math.min(Math.trunc(raw), 1_000) : 100
+      res.set('Cache-Control', 'private, no-store')
+      res.json({ actions: deps.runner().listActions(limit) })
+    } catch (error) {
+      actionRefusal(error, res, 'meeting_actions_unavailable', 'The action log could not be read.')
+    }
+  })
+
+  router.get('/meeting-actions/:id', (req, res) => {
+    try {
+      res.set('Cache-Control', 'private, no-store')
+      res.json({ action: deps.runner().getAction(String(req.params.id)) })
+    } catch (error) {
+      actionRefusal(error, res, 'meeting_action_unavailable', 'That action could not be read.')
+    }
+  })
+
+  router.post('/meeting-actions/revert-all', (req, res) => {
+    deps.runner().revertAll({ dryRun: req.body?.dryRun === true, previewHash: asHash(req.body?.previewHash) })
+      .then(result => res.json(result))
+      .catch(error => actionRefusal(error, res, 'meeting_actions_revert_all_failed', 'Those merges could not be undone.'))
+  })
+
+  router.post('/meeting-actions/:id/revert', (req, res) => {
+    deps.runner().revert(String(req.params.id), {
+      dryRun: req.body?.dryRun === true,
+      previewHash: asHash(req.body?.previewHash),
+    })
+      .then(result => res.json(result))
+      .catch(error => actionRefusal(error, res, 'meeting_action_revert_failed', 'That merge could not be undone.'))
+  })
+
+  router.post('/meeting-actions/:id/retry', (req, res) => {
+    // Every refusal arrives as a rejection: `retryAction` is async, so a drain, a run in
+    // flight and a wrong state all land in the same handler as a real failure.
+    deps.runner().retryAction(String(req.params.id))
+      .then(result => res.json(result))
+      .catch(error => actionRefusal(error, res, 'meeting_action_retry_failed', 'That one could not be tried again.'))
+  })
+
+  return router
+}
+
+function asHash(value: unknown): string | undefined {
+  return typeof value === 'string' && /^[0-9a-f]{64}$/.test(value) ? value : undefined
+}
+
+export const meetingActionsRouter = createMeetingActionsRouter({ runner: getMeetingMergeRunner })

package/server/routes/meeting-engine.ts

@@ -0,0 +1,52 @@
+// The engine's own state, and the one switch a person may throw (6.47.0, WS4).
+//
+//   GET  /api/meeting-engine/status   mode, what the pipeline sees, mismatch, runs, counts
+//   POST /api/meeting-engine/mode     { mode: 'advise' | 'apply' }
+//
+// `pipelineSees` IS THE POINT OF THE STATUS ROUTE. Four processes read the mode file, and
+// the one failure a person cannot see for themselves is the server acting on `apply` while
+// the pipeline on the same Mac still believes it owns the blend. The server asks
+// `sync_meetings.py --merge-engine-status` (at most once every five minutes) and reports
+// both answers plus whether they disagree. When the pipeline cannot be asked, the field is
+// null and `mismatch` is false: "not known" is not "disagrees".
+//
+// THE MODE ROUTE REFUSES ON A MAC WITH NO PIPELINE. There is nothing to choose there: the
+// server is in imports mode and does the importing itself.
+
+import { Router } from 'express'
+import { getMeetingMergeRunner, type MeetingMergeRunner } from '../lib/meeting-actions.js'
+import type { MeetingEnginePipelineMode } from '../lib/meeting-engine-mode.js'
+import { actionRefusal } from './meeting-suggestions.js'
+
+export interface MeetingEngineRouterDeps {
+  runner: () => MeetingMergeRunner
+}
+
+export function createMeetingEngineRouter(deps: MeetingEngineRouterDeps): Router {
+  const router = Router()
+
+  router.get('/meeting-engine/status', (_req, res) => {
+    deps.runner().status()
+      .then(status => {
+        res.set('Cache-Control', 'private, no-store')
+        res.json(status)
+      })
+      .catch(error => actionRefusal(error, res, 'meeting_engine_status_unavailable', 'The engine status could not be read.'))
+  })
+
+  router.post('/meeting-engine/mode', (req, res) => {
+    try {
+      // `setMode` refuses synchronously (wrong Mac, bad value, work in flight) and only then
+      // returns a promise, so both paths have to be caught or a refusal becomes a 500.
+      deps.runner().setMode(req.body?.mode as MeetingEnginePipelineMode)
+        .then(result => res.json(result))
+        .catch(error => actionRefusal(error, res, 'meeting_engine_mode_failed', 'The mode could not be changed.'))
+    } catch (error) {
+      actionRefusal(error, res, 'meeting_engine_mode_failed', 'The mode could not be changed.')
+    }
+  })
+
+  return router
+}
+
+export const meetingEngineRouter = createMeetingEngineRouter({ runner: getMeetingMergeRunner })

package/server/routes/meeting-import.ts

@@ -0,0 +1,67 @@
+// Meeting import endpoints.
+//
+//   POST /api/meeting-import/fireflies/run       { windowDays } -> 202 { runId }
+//   GET  /api/meeting-import/fireflies/status    mode, state, counts, budget
+//   POST /api/meeting-import/fireflies/settings  { keepImporting, planCap }
+//
+// The run route answers as soon as the run is admitted. A backfill takes
+// minutes and holds a maintenance lease per page, so an HTTP request that
+// waited for it would sit far past COS Control's drain timeout; status is how a
+// surface follows it.
+//
+// Every refusal is a code a surface can render: operations_pipeline_owns_fireflies
+// (this Mac's pipeline owns Fireflies), import_in_progress, fireflies_key_missing,
+// invalid_key, invalid_window, maintenance_drain_active.
+
+import { Router } from 'express'
+import { ImportRefusedError, getFirefliesImporter, type FirefliesImporter } from '../lib/meeting-import.js'
+
+export interface MeetingImportRouterDeps {
+  importer: () => FirefliesImporter
+}
+
+export function createMeetingImportRouter(deps: MeetingImportRouterDeps): Router {
+  const router = Router()
+
+  const refusal = (error: unknown, res: import('express').Response, fallback: string): void => {
+    if (error instanceof ImportRefusedError) {
+      res.status(error.status).json({ error: { code: error.code, message: error.message } })
+      return
+    }
+    console.error(`[meeting-import] ${fallback}:`, error)
+    res.status(500).json({ error: { code: fallback, message: 'The import could not be started.' } })
+  }
+
+  router.post('/meeting-import/fireflies/run', (req, res) => {
+    try {
+      const started = deps.importer().run({ windowDays: req.body?.windowDays })
+      res.status(202).json({ accepted: true, runId: started.runId, status: deps.importer().status() })
+    } catch (error) {
+      refusal(error, res, 'meeting_import_run_failed')
+    }
+  })
+
+  router.get('/meeting-import/fireflies/status', (_req, res) => {
+    try {
+      res.json(deps.importer().status())
+    } catch (error) {
+      console.error('[meeting-import] status failed:', error)
+      res.status(500).json({ error: { code: 'meeting_import_unavailable', message: 'The import status could not be read.' } })
+    }
+  })
+
+  router.post('/meeting-import/fireflies/settings', (req, res) => {
+    try {
+      res.json(deps.importer().settings({
+        keepImporting: req.body?.keepImporting,
+        planCap: req.body?.planCap,
+      }))
+    } catch (error) {
+      refusal(error, res, 'meeting_import_settings_failed')
+    }
+  })
+
+  return router
+}
+
+export const meetingImportRouter = createMeetingImportRouter({ importer: getFirefliesImporter })

package/server/routes/meeting-suggestions.ts

@@ -0,0 +1,66 @@
+// Suggestions: what the engine wants a person to decide (6.47.0, WS4).
+//
+//   GET  /api/meeting-suggestions?state=open|confirmed|accepted|dismissed|all
+//   POST /api/meeting-suggestions/:id/accept    imports mode: make the merge
+//   POST /api/meeting-suggestions/:id/confirm   advise mode: record the answer only
+//   POST /api/meeting-suggestions/:id/dismiss   never these two meetings again
+//
+// ACCEPT AND CONFIRM ARE DIFFERENT VERBS BECAUSE THEY MEAN DIFFERENT THINGS. In imports
+// mode "yes" writes a record. In advise mode the server may not write into the operations
+// tree at all, so "yes" is remembered and acted on later, if and when a person switches to
+// apply. One verb doing both would make the advise answer look like it did something.
+//
+// Every refusal is a code a surface renders: suggestion_not_found, suggestion_stale,
+// suggestion_dismissed, advise_mode, maintenance_drain_active.
+
+import { Router, type Response } from 'express'
+import { ActionRefusedError, getMeetingMergeRunner, type MeetingMergeRunner } from '../lib/meeting-actions.js'
+
+export interface MeetingSuggestionsRouterDeps {
+  runner: () => MeetingMergeRunner
+}
+
+export function actionRefusal(error: unknown, res: Response, fallback: string, message: string): void {
+  if (error instanceof ActionRefusedError) {
+    res.status(error.status).json({ error: { code: error.code, message: error.message } })
+    return
+  }
+  console.error(`[meeting-suggestions] ${fallback}:`, error)
+  res.status(500).json({ error: { code: fallback, message } })
+}
+
+export function createMeetingSuggestionsRouter(deps: MeetingSuggestionsRouterDeps): Router {
+  const router = Router()
+
+  router.get('/meeting-suggestions', (req, res) => {
+    try {
+      const state = typeof req.query.state === 'string' ? req.query.state : undefined
+      res.set('Cache-Control', 'private, no-store')
+      res.json({ suggestions: deps.runner().listSuggestions(state) })
+    } catch (error) {
+      actionRefusal(error, res, 'meeting_suggestions_unavailable', 'The suggestions could not be read.')
+    }
+  })
+
+  router.post('/meeting-suggestions/:id/accept', (req, res) => {
+    deps.runner().acceptSuggestion(String(req.params.id))
+      .then(result => res.json(result))
+      .catch(error => actionRefusal(error, res, 'meeting_suggestion_accept_failed', 'That merge could not be made.'))
+  })
+
+  router.post('/meeting-suggestions/:id/confirm', (req, res) => {
+    deps.runner().confirmSuggestion(String(req.params.id))
+      .then(result => res.json(result))
+      .catch(error => actionRefusal(error, res, 'meeting_suggestion_confirm_failed', 'That answer could not be saved.'))
+  })
+
+  router.post('/meeting-suggestions/:id/dismiss', (req, res) => {
+    deps.runner().dismissSuggestion(String(req.params.id))
+      .then(result => res.json(result))
+      .catch(error => actionRefusal(error, res, 'meeting_suggestion_dismiss_failed', 'That answer could not be saved.'))
+  })
+
+  return router
+}
+
+export const meetingSuggestionsRouter = createMeetingSuggestionsRouter({ runner: getMeetingMergeRunner })

package/server/routes/meeting.ts

@@ -10,6 +10,7 @@ import { emitDisplay } from '../lib/display-bus.js'
 import { cleanTranscriptLines } from '../lib/hallucination-filter.js'
 import { durableAtomicWriteFileSync } from '../lib/atomic-fs.js'
 import { appendCorrection, appliedCorrections, pendingCorrections } from '../lib/meeting-corrections.js'
+import { triggerMeetingMergeRun } from '../lib/meeting-actions.js'
 import { isSampleFromSession, untraceableSampleCount } from '../lib/training-audio-provenance.js'
 import { sendAudioFile } from '../lib/send-audio.js'
 import { adaptivePlaybackAudio } from '../lib/adaptive-playback-audio.js'
@@ -116,11 +117,14 @@ import {
 } from './transcribe-stream.js'
 import { getServerInstanceId } from '../lib/server-instance-id.js'
 import {
+  type MeetingLibraryRecord,
   cosOperationsMeetingsConfigured,
   findDirectLibraryMeetingBySessionId,
   findCosOperationsMeetingBySessionId,
   resolveCosOperationsDir,
 } from '../lib/cos-operations-meetings.js'
+import { derivedSourcesFor, findDerivedRecord } from '../lib/imported-library-rows.js'
+import { assertVoiceEvidenceSource } from '../lib/voice-evidence-guard.js'
 import { domainForMeeting, resolveDomains } from '../lib/domains.js'
 import { getOwnerSpeakerLabel } from '../lib/profile.js'
 import {
@@ -329,6 +333,10 @@ function scheduleFinalizationJob(job: MeetingFinalizationJob, runtime: Finalizat
       await enrichStandaloneMeeting(current.meetingPath, jobStartedAt)
     }
     markCanonicalFinalizationState(current.sidecarPath, 'complete', false)
+    // The capture is finished and its files are durable, so the merge engine may score it.
+    // Fire-and-forget by contract: the runner queues, defers under a drain or a live
+    // capture, and never throws back at the finalization path.
+    triggerMeetingMergeRun('g2_finalized')
     runtime.finalizationJobs.remove(current.sessionId)
     finalizationRetryCounts.delete(key)
   }).catch(error => {
@@ -686,6 +694,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
         markCanonicalFinalizationState(saved.sidecarPath, finalizationJob.phase, claimPending)
       } else if (finalizationJob) {
         markCanonicalFinalizationState(saved.sidecarPath, 'complete', false)
+        triggerMeetingMergeRun('g2_finalized')
         finalizationJobs.remove(sessionId)
         finalizationJob = null
       }
@@ -714,6 +723,71 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     }
   })
 
+  // ── Record identity for the speaker surfaces (6.47.0) ─────────────────
+  //
+  // One resolver, because the speakers and content routes each carried their own
+  // copy of the same three literals and the two had already drifted apart once.
+  // `source` and `mutable` always describe the CAPTURE — the file that holds the
+  // chunks and the one a correction would rewrite — even when the caller reached
+  // it through a merged record's row. `blendedRecordId` is what says "you opened
+  // the merged row", so Control can label the panel without pretending the merge
+  // is the thing being edited.
+  function speakerRecordIdentity(
+    sessionId: string,
+    operations: { domain: string; month: string; filename: string } | null,
+    direct: MeetingLibraryRecord | null,
+    blendedRecordId?: string,
+  ): {
+    source: 'cos_operations' | 'direct_library' | 'standalone_recordings'
+    recordId: string
+    mutable: boolean
+    blendedRecordId?: string
+  } {
+    return {
+      source: operations ? 'cos_operations' : direct ? 'direct_library' : 'standalone_recordings',
+      recordId: operations
+        ? `ops:${operations.domain}:${operations.month}:${operations.filename}`
+        : direct?.recordId ?? `standalone:${sessionId}`,
+      mutable: direct == null,
+      ...(blendedRecordId ? { blendedRecordId } : {}),
+    }
+  }
+
+  /**
+   * `?recordId=blended:<h16>` on a read: the caller opened the merged row.
+   *
+   * Confirmed against the record's OWN inputs rather than trusted, so a wrong or
+   * stale id is simply ignored instead of labelling an unrelated capture as part
+   * of a merge. Any capture the merge holds is accepted, not only the earliest,
+   * because a merge of two captures has two ways in and both are legitimate.
+   */
+  function blendedRecordFor(value: unknown, sessionId: string): string | undefined {
+    if (typeof value !== 'string' || !value.startsWith('blended:')) return undefined
+    const record = findDerivedRecord(value)
+    if (!record || record.kind !== 'merge') return undefined
+    return record.g2SessionIds.includes(sessionId) ? record.recordId : undefined
+  }
+
+  /**
+   * Refuse a mutation aimed at an imported or derived record.
+   *
+   * A derived record is a FUNCTION of its inputs: the next re-derive rewrites it,
+   * so an edit here would be silently discarded. The refusal names the capture to
+   * correct instead, which is the whole point of answering 409 rather than 404.
+   */
+  function refuseDerivedMutation(recordId: unknown): { status: number; body: Record<string, unknown> } | null {
+    const refusal = assertVoiceEvidenceSource([recordId])
+    if (!refusal) return null
+    const record = typeof recordId === 'string' ? findDerivedRecord(recordId) : null
+    const sourceRecordId = record
+      ? derivedSourcesFor(record, store).find(source => source.kind === 'g2')?.recordId
+      : undefined
+    return {
+      status: refusal.status,
+      body: { ...refusal.body, mutable: false, ...(sourceRecordId ? { sourceRecordId } : {}) },
+    }
+  }
+
   // ── Speaker review (6.21.12) ──────────────────────────────────────────
   // Backs COS Control's naming panel. Read-only: it reports what a saved
   // meeting's sidecar already contains and never writes. Naming, merging, and
@@ -728,6 +802,15 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
       return
     }
+    // BEFORE the lookup. The sessionId pattern allows colons, so `blended:<h16>`
+    // and `imported:fireflies:<h16>` are shaped like sessions and would otherwise
+    // fall through to a store scan that answers 404 — the wrong answer, because
+    // the record exists and simply is not a capture.
+    const identityRefusal = assertVoiceEvidenceSource([sessionId])
+    if (identityRefusal) {
+      res.status(identityRefusal.status).json(identityRefusal.body)
+      return
+    }
     // Prefer the COS operations copy when configured. The same session exists in
     // both trees under different names — the standalone store keeps the raw
     // capture name, operations holds the titled copy — and the meetings LIST
@@ -796,11 +879,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       title,
       domain,
       filename,
-      source: operations ? 'cos_operations' : direct ? 'direct_library' : 'standalone_recordings',
-      recordId: operations
-        ? `ops:${operations.domain}:${operations.month}:${operations.filename}`
-        : direct?.recordId ?? `standalone:${sessionId}`,
-      mutable: direct == null,
+      ...speakerRecordIdentity(sessionId, operations, direct, blendedRecordFor(req.query.recordId, sessionId)),
       ...(saved ? { durationMin: saved.durationMin } : {}),
       ...review,
     })
@@ -839,6 +918,11 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
       return
     }
+    const identityRefusal = assertVoiceEvidenceSource([sessionId])
+    if (identityRefusal) {
+      res.status(identityRefusal.status).json(identityRefusal.body)
+      return
+    }
     const operations = cosOperationsMeetingsConfigured()
       ? findCosOperationsMeetingBySessionId(sessionId)
       : null
@@ -975,11 +1059,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       // no write-up yet.
       capturedChars: clip.capturedChars,
       domain: clip.domain,
-      source: operations ? 'cos_operations' : direct ? 'direct_library' : 'standalone_recordings',
-      recordId: operations
-        ? `ops:${operations.domain}:${operations.month}:${operations.filename}`
-        : direct?.recordId ?? `standalone:${sessionId}`,
-      mutable: direct == null,
+      ...speakerRecordIdentity(sessionId, operations, direct, blendedRecordFor(req.query.recordId, sessionId)),
       // So the panel can warn above the write-up, not just the clipboard.
       removedNames: clip.removed,
       coverage,
@@ -1033,6 +1113,14 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       res.status(400).json({ error: 'speaker is required', reason: 'invalid_label' })
       return
     }
+    // Enrolment writes to the voice store, so the same two gates as the other
+    // corrections: the session must be a capture, and the record aimed at must
+    // not be a derived one.
+    const evidenceRefusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(req.body?.recordId)
+    if (evidenceRefusal) {
+      res.status(evidenceRefusal.status).json(evidenceRefusal.body)
+      return
+    }
 
     const operations = cosOperationsMeetingsConfigured()
       ? findCosOperationsMeetingBySessionId(sessionId)
@@ -1091,6 +1179,14 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
       return
     }
+    // A merged G2 session is NOT refused here: it is a real capture with real
+    // audio, and relabelling it is how its profile gets better. Only an imported
+    // or derived IDENTITY is refused.
+    const evidenceRefusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(req.body?.recordId)
+    if (evidenceRefusal) {
+      res.status(evidenceRefusal.status).json(evidenceRefusal.body)
+      return
+    }
 
     const from = typeof req.body?.from === 'string' ? req.body.from : ''
     const to = typeof req.body?.to === 'string' ? req.body.to : ''
@@ -1329,6 +1425,11 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
       return
     }
+    const evidenceRefusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(req.body?.recordId)
+    if (evidenceRefusal) {
+      res.status(evidenceRefusal.status).json(evidenceRefusal.body)
+      return
+    }
     const label = typeof req.body?.label === 'string' ? req.body.label : ''
     const bad = invalidLabelReason(label)
     if (bad) {
@@ -1415,6 +1516,11 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
       return
     }
+    const evidenceRefusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(req.body?.recordId)
+    if (evidenceRefusal) {
+      res.status(evidenceRefusal.status).json(evidenceRefusal.body)
+      return
+    }
     const from = typeof req.body?.from === 'string' ? req.body.from : ''
     const bad = invalidLabelReason(from)
     if (bad) {
@@ -1992,6 +2098,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
         // Control surfaces and warns on before committing a drain.
         await enrichStandaloneMeeting(saved.filepath, Date.now())
       }
+      triggerMeetingMergeRun('orphan_recovered')
     }).catch(error => {
       // The quarantined audio is untouched on failure — retry stays possible
       // until the retention clock clears it.