@gotcos/glasses-server 6.59.0 → 6.61.0

package/server/lib/claude-hooks-installer.ts

@@ -36,8 +36,24 @@ export interface HookSubscription {
   matcher?: string
   async: boolean
   timeout: number
+  /**
+   * 6.60.0: the command passes the block's own `timeout` to the script as its second
+   * argument. The script stops waiting 5 s before it and stamps it on the request it posts
+   * (`hookWaitS`), so the broker knows the wait of THIS invocation. The command and the
+   * timeout sit in one block, so whether or not a running Claude session re-reads its hook
+   * settings, the stamp it sends and the timeout it enforces come from the same block.
+   */
+  passTimeout?: boolean
 }
 
+/**
+ * 6.60.0: Claude Code's wait on the PermissionRequest hook: the away hold (default 600 s)
+ * plus slack. The script's curl stops at 625 and the broker answers by 620 at the latest.
+ */
+export const PERMISSION_HOOK_TIMEOUT_S = 630
+/** What every install before 6.60.0 carries for PermissionRequest, with no wait argument. */
+export const LEGACY_PERMISSION_HOOK_TIMEOUT_S = 130
+
 /**
  * Every event the reducer understands, with the timing each one needs. SessionStart,
  * UserPromptSubmit, Stop and SessionEnd are synchronous: measured 2026-09-15, an async
@@ -55,6 +71,10 @@ export interface HookSubscription {
  * because the merge keeps exactly one of ours per event and status requires it: the script
  * spools only AskUserQuestion and ExitPlanMode, which is what the old async matcher block
  * did. Changing this row makes every existing install read `drift` until Install hooks.
+ *
+ * 6.60.0: PermissionRequest waits 630 s (was 130) and passes that number to the script, for
+ * the away hold. An install that differs ONLY by still carrying the earlier block (130 s, no
+ * argument) reads `drift` with `priorWaitOnly`, and stays halt-ready (`hookHaltReady`).
  */
 export const HOOK_SUBSCRIPTIONS: readonly HookSubscription[] = [
   { event: 'SessionStart', async: false, timeout: 5 },
@@ -62,7 +82,7 @@ export const HOOK_SUBSCRIPTIONS: readonly HookSubscription[] = [
   { event: 'UserPromptSubmit', async: false, timeout: 5 },
   { event: 'Stop', async: false, timeout: 5 },
   { event: 'StopFailure', async: true, timeout: 10 },
-  { event: 'PermissionRequest', async: false, timeout: 130 },
+  { event: 'PermissionRequest', async: false, timeout: PERMISSION_HOOK_TIMEOUT_S, passTimeout: true },
   { event: 'PermissionDenied', async: true, timeout: 10 },
   { event: 'PreToolUse', async: false, timeout: 5 },
   { event: 'PostToolUse', async: true, timeout: 10 },
@@ -117,9 +137,13 @@ export function shellQuote(value: string): string {
 /**
  * The installed command carries the two paths the script needs as environment, so the
  * server and the script can never disagree about where the spool or the token is.
+ * 6.60.0: `waitS`, for a subscription with `passTimeout`, follows the event name as the
+ * script's second argument (an argument, never an environment variable: a variable could
+ * be inherited from the shell that started Claude, an argument only comes from this block).
  */
-export function hookCommand(scriptPath: string, event: string, paths: HookPaths = currentHookPaths()): string {
-  return `COS_GLASSES_HOME=${shellQuote(paths.home)} COS_HOOK_SPOOL=${shellQuote(paths.spoolDir)} ${shellQuote(scriptPath)} ${event}`
+export function hookCommand(scriptPath: string, event: string, paths: HookPaths = currentHookPaths(), waitS?: number): string {
+  const base = `COS_GLASSES_HOME=${shellQuote(paths.home)} COS_HOOK_SPOOL=${shellQuote(paths.spoolDir)} ${shellQuote(scriptPath)} ${event}`
+  return waitS === undefined ? base : `${base} ${Math.trunc(waitS)}`
 }
 
 export interface HookPaths {
@@ -133,20 +157,57 @@ export function currentHookPaths(): HookPaths {
 
 type HookBlock = { matcher?: unknown; hooks?: unknown }
 
+function hookIsOurs(h: unknown): boolean {
+  return !!h && typeof h === 'object' && typeof (h as { command?: unknown }).command === 'string'
+    && ((h as { command: string }).command.includes(HOOK_SCRIPT_MARKER) || (h as { command: string }).command.includes(HOOK_SCRIPT_NAME + ' '))
+}
+
 function blockIsOurs(block: unknown): boolean {
   if (!block || typeof block !== 'object') return false
   const hooks = (block as HookBlock).hooks
   if (!Array.isArray(hooks)) return false
-  return hooks.some(h => h && typeof h === 'object' && typeof (h as { command?: unknown }).command === 'string'
-    && ((h as { command: string }).command.includes(HOOK_SCRIPT_MARKER) || (h as { command: string }).command.includes(HOOK_SCRIPT_NAME + ' ')))
+  return hooks.some(hookIsOurs)
 }
 
 function canonicalBlock(scriptPath: string, sub: HookSubscription, paths: HookPaths): Record<string, unknown> {
-  const hook: Record<string, unknown> = { type: 'command', command: hookCommand(scriptPath, sub.event, paths), timeout: sub.timeout }
+  const command = hookCommand(scriptPath, sub.event, paths, sub.passTimeout ? sub.timeout : undefined)
+  const hook: Record<string, unknown> = { type: 'command', command, timeout: sub.timeout }
   if (sub.async) hook.async = true
   return sub.matcher ? { matcher: sub.matcher, hooks: [hook] } : { hooks: [hook] }
 }
 
+/**
+ * 6.60.0: the block an install before 6.60.0 wrote for this event, when this release changed
+ * it only by the wait: PermissionRequest at 130 s with no wait argument. Null for any other.
+ */
+function priorWaitBlock(scriptPath: string, sub: HookSubscription, paths: HookPaths): Record<string, unknown> | null {
+  if (sub.event !== 'PermissionRequest') return null
+  return canonicalBlock(scriptPath, { event: sub.event, async: sub.async, timeout: LEGACY_PERMISSION_HOOK_TIMEOUT_S }, paths)
+}
+
+/**
+ * 6.60.0: how long Claude Code waits on OUR PermissionRequest hook, read from a settings
+ * object: the smallest `timeout` among our entries (Claude runs each, so the first to give up
+ * bounds the wait). Null when none of ours is there, or one of ours has no usable number:
+ * the broker then keeps the old safe clamp (`lib/permission-broker.ts` `holdCeilingS`).
+ */
+export function permissionHookTimeoutS(settings: unknown): number | null {
+  const hooks = settings && typeof settings === 'object' ? (settings as Record<string, unknown>).hooks : null
+  const blocks = hooks && typeof hooks === 'object' ? (hooks as Record<string, unknown>).PermissionRequest : null
+  if (!Array.isArray(blocks)) return null
+  let least: number | null = null
+  for (const block of blocks) {
+    if (!blockIsOurs(block)) continue
+    for (const h of (block as HookBlock).hooks as unknown[]) {
+      if (!hookIsOurs(h)) continue
+      const timeout = (h as { timeout?: unknown }).timeout
+      if (typeof timeout !== 'number' || !Number.isFinite(timeout) || timeout <= 0) return null
+      least = least === null ? timeout : Math.min(least, timeout)
+    }
+  }
+  return least
+}
+
 export type MergeResult =
   | { ok: true; settings: Record<string, unknown>; changed: boolean }
   /** The file holds a `hooks` shape this merge would have to destroy to proceed. */
@@ -190,22 +251,29 @@ export function stripHookSettings(current: unknown): MergeResult {
   return { ok: true, settings, changed: JSON.stringify(settings) !== before }
 }
 
-/** Which of our events a settings object carries, by exact canonical command. */
-export function subscribedEvents(current: unknown, scriptPath: string, paths: HookPaths = currentHookPaths()): { subscribed: string[]; missing: string[]; drifted: string[] } {
+/**
+ * Which of our events a settings object carries, by exact canonical command. `priorWait`
+ * (6.60.0) names the drifted events whose one block of ours is exactly the block an earlier
+ * release wrote, differing only by the wait (`priorWaitBlock`).
+ */
+export function subscribedEvents(current: unknown, scriptPath: string, paths: HookPaths = currentHookPaths()): { subscribed: string[]; missing: string[]; drifted: string[]; priorWait: string[] } {
   const hooks = current && typeof current === 'object' && (current as Record<string, unknown>).hooks
   const table = hooks && typeof hooks === 'object' ? hooks as Record<string, unknown> : {}
   const subscribed: string[] = []
   const missing: string[] = []
   const drifted: string[] = []
+  const priorWait: string[] = []
   for (const sub of HOOK_SUBSCRIPTIONS) {
     const blocks = Array.isArray(table[sub.event]) ? table[sub.event] as unknown[] : []
     const ours = blocks.filter(blockIsOurs)
     if (ours.length === 0) { missing.push(sub.event); continue }
     const canonical = JSON.stringify(canonicalBlock(scriptPath, sub, paths))
-    if (ours.length === 1 && JSON.stringify(ours[0]) === canonical) subscribed.push(sub.event)
-    else drifted.push(sub.event)
+    if (ours.length === 1 && JSON.stringify(ours[0]) === canonical) { subscribed.push(sub.event); continue }
+    drifted.push(sub.event)
+    const prior = priorWaitBlock(scriptPath, sub, paths)
+    if (prior && ours.length === 1 && JSON.stringify(ours[0]) === JSON.stringify(prior)) priorWait.push(sub.event)
   }
-  return { subscribed, missing, drifted }
+  return { subscribed, missing, drifted, priorWait }
 }
 
 export type HookInstallState =
@@ -231,6 +299,16 @@ export interface HookStatus {
   subscribed: string[]
   missing: string[]
   drifted: string[]
+  /** 6.60.0: drifted events whose block is exactly an earlier release's, but for the wait. */
+  priorWait: string[]
+  /**
+   * 6.60.0: `drift`, and the ONLY difference is that the settings still carry the earlier
+   * PermissionRequest block (130 s, no wait argument): an install from before 6.60.0 that
+   * has not run Install hooks since. Questions are then held at most 120 s, as before.
+   */
+  priorWaitOnly: boolean
+  /** 6.60.0: our PermissionRequest hook's `timeout` in the settings file, or null (`permissionHookTimeoutS`). */
+  permissionHookTimeoutS: number | null
   tokenPresent: boolean
 }
 
@@ -272,16 +350,19 @@ export function hookStatus(paths: { settingsPath?: string; scriptPath?: string;
   const tokenPresent = existsSync(hookTokenPath())
   const read = readSettings(settingsPath)
   if (!read.ok) {
-    return { state: read.reason, installed: false, settingsPath, scriptPath, scriptSha, packageScriptSha, subscribed: [], missing: HOOK_SUBSCRIPTIONS.map(s => s.event), drifted: [], tokenPresent }
+    return { state: read.reason, installed: false, settingsPath, scriptPath, scriptSha, packageScriptSha, subscribed: [], missing: HOOK_SUBSCRIPTIONS.map(s => s.event), drifted: [], priorWait: [], priorWaitOnly: false, permissionHookTimeoutS: null, tokenPresent }
   }
   const events = subscribedEvents(read.settings, scriptPath, hookPaths)
+  const permissionWaitS = permissionHookTimeoutS(read.settings)
   let state: HookInstallState
   if (hooksDisabled(read.settings)) state = 'disabled_by_settings'
   else if (events.subscribed.length === 0 && events.drifted.length === 0) state = 'missing'
   else if (events.missing.length > 0 || events.drifted.length > 0) state = 'drift'
   else if (!scriptSha || (packageScriptSha && scriptSha !== packageScriptSha)) state = 'script_outdated'
   else state = 'installed'
-  return { state, installed: state === 'installed', settingsPath, scriptPath, scriptSha, packageScriptSha, ...events, tokenPresent }
+  const priorWaitOnly = state === 'drift' && events.missing.length === 0 && events.drifted.length > 0
+    && events.drifted.every(event => events.priorWait.includes(event))
+  return { state, installed: state === 'installed', settingsPath, scriptPath, scriptSha, packageScriptSha, ...events, priorWaitOnly, permissionHookTimeoutS: permissionWaitS, tokenPresent }
 }
 
 /**
@@ -295,22 +376,35 @@ export function hookStatus(paths: { settingsPath?: string; scriptPath?: string;
  *   - c0b41bf8...: the 6.53.3 script as first built, before its /qa round made every event
  *     drain stdin. Never published, but installable from a local build of that commit
  *     (7433b7f), and it carries the same halt check.
+ *   - df54677f...: the script 6.53.3 through 6.59.0 shipped. 6.60.0 changed it only for the
+ *     away hold (the PermissionRequest wait); its halt check is the same.
  * Each is pinned against its bytes in `server/lib/__fixtures__/`.
  */
 export const HALT_CAPABLE_PRIOR_SCRIPT_SHAS: readonly string[] = [
   '1158bb06297550128f01fc47caa68806a5287d6da2d05b0d1c812e8ae20764e7',
   'c0b41bf8581cfea498e1e1ac5220fe4e148bd97448d13b60a88879ee5992cc51',
+  'df54677f79908893509ee87608cfe3f4a53ced03f88f337f16a63741d6b3d547',
 ]
 
 /**
  * 6.53.3: can the hooks on this Mac stop a desk Claude run now? `installed`, or the only
  * difference is a halt-capable earlier script (above). What the cancel route's
  * `hooksReady` and `/api/health` `features.sessionCancel.deskClaude` read.
+ *
+ * 6.60.0: or `drift` with `priorWaitOnly` (the settings still carry the earlier
+ * PermissionRequest wait, every other block is current) on this package's script or a
+ * halt-capable earlier one. The wait changes how long a question is held, not the halt
+ * check, so updating the server never turns cancel from the lens off. Any other drift
+ * still is not halt-ready.
  */
-export function hookHaltReady(status: Pick<HookStatus, 'installed' | 'state' | 'scriptSha'>): boolean {
+export function hookHaltReady(status: Pick<HookStatus, 'installed' | 'state' | 'scriptSha'> & Partial<Pick<HookStatus, 'priorWaitOnly' | 'packageScriptSha'>>): boolean {
   if (status.installed === true) return true
-  return status.state === 'script_outdated' && typeof status.scriptSha === 'string'
-    && HALT_CAPABLE_PRIOR_SCRIPT_SHAS.includes(status.scriptSha)
+  const priorScript = typeof status.scriptSha === 'string' && HALT_CAPABLE_PRIOR_SCRIPT_SHAS.includes(status.scriptSha)
+  if (status.state === 'script_outdated') return priorScript
+  if (status.state === 'drift' && status.priorWaitOnly === true) {
+    return priorScript || (typeof status.scriptSha === 'string' && status.scriptSha === status.packageScriptSha)
+  }
+  return false
 }
 
 const INSTALL_COMMAND = 'npx --yes @gotcos/glasses-server@latest --hooks install'
@@ -319,8 +413,17 @@ const INSTALL_COMMAND = 'npx --yes @gotcos/glasses-server@latest --hooks install
  * 6.53.3: one plain sentence for `--hooks status` saying what the state means and what fixes
  * it. Null when installed. Carries no path: the status JSON beside it already names them.
  */
-export function hookStatusAdvice(status: Pick<HookStatus, 'installed' | 'state' | 'scriptSha' | 'packageScriptSha'>): string | null {
+export function hookStatusAdvice(status: Pick<HookStatus, 'installed' | 'state' | 'scriptSha' | 'packageScriptSha'> & Partial<Pick<HookStatus, 'priorWaitOnly'>>): string | null {
   const short = (sha: string | null): string => (sha ? sha.slice(0, 12) : 'none')
+  // 6.60.0: the one drift an update itself causes. Say what it costs and that nothing broke.
+  if (status.state === 'drift' && status.priorWaitOnly === true) {
+    return 'The Claude settings file still carries the earlier permission hook wait (130 s), so a question that starts while you are away '
+      + 'is held for the glasses for at most 2 minutes instead of 10. '
+      + `Run \`${INSTALL_COMMAND}\`, or press Install hooks in COS Control. `
+      + (hookHaltReady(status)
+        ? 'Cancel from the lens still stops desk runs meanwhile.'
+        : 'Until then a desk run cannot be cancelled from the lens.')
+  }
   switch (status.state) {
     case 'installed':
       return null

package/server/lib/client-liveness.ts

@@ -23,28 +23,116 @@
 //
 // In memory: a restart forgets it, and the next poll restores it. Until then nothing is
 // held, which is the native dialog, the safe side.
+//
+// 6.60.0 (QA round 1, the contract shared with COS Glasses 6.9.563): the away hold needs
+// more than a poll. A poll QUALIFIES only with `hold=1` (this client shows held questions;
+// 6.9.563 and later send it) AND a finite `presenceAgeMs` within [0, 24 h]: the ms since
+// the latest real wearer evidence (glasses: a ring or temple input, or a device status with
+// wearing true; phone: a foreground touch). A connected lens nobody wears sends no
+// `presenceAgeMs`, and an older client sends no `hold=1`, so neither can make the Mac hold a
+// question for 10 minutes.
+//
+// Kept apart, all in memory (a restart forgets them, which fails toward 6.59.0):
+//   - the newest counting poll of any kind (`lastQuestionsPollAt`, for /api/health);
+//   - the newest poll WITHOUT `hold=1` (`lastLegacyQuestionsPollAt`): the 6.59.0 liveness,
+//     unchanged for every older client;
+//   - the newest poll WITH `hold=1` (`lastHoldQuestionsPollAt`);
+//   - the newest qualifying presence, on BOTH clocks, each forward-only: monotonic
+//     (`performance.now()`, immune to the wall clock stepping) and wall. Its age is the
+//     larger of the two (`presenceAgeMs`): on macOS the monotonic clock does not advance
+//     while the Mac sleeps, so on its own it would read a pre-sleep presence as younger
+//     than it is; the wall clock does advance. A wall clock stepped forward reads older
+//     (no hold), never younger.
+
+/** 6.60.0: the most a client may report as `presenceAgeMs`. Anything else is no presence. */
+export const PRESENCE_AGE_MAX_MS = 86_400_000
 
 let lastPollAt: number | null = null
+let lastLegacyPollAt: number | null = null
+let lastHoldPollAt: number | null = null
+let lastPresenceMono: number | null = null
+let lastPresenceWall: number | null = null
+
+/** 6.60.0: the monotonic clock. Milliseconds since this process started; paused while the Mac sleeps. */
+export function monotonicNowMs(): number {
+  return performance.now()
+}
 
 /** A stored stamp this far ahead of a new poll means the clock stepped back. */
 const CLOCK_STEP_BACK_MS = 5_000
 
+/** Newest-wins for a poll stamp, following a clock that stepped back (see below). */
+function newerStamp(stored: number | null, at: number): number {
+  return stored === null || at > stored || stored - at > CLOCK_STEP_BACK_MS ? at : stored
+}
+
+/** 6.60.0: what a counting poll said about the client, read from its query. */
+export interface QuestionsPollFacts {
+  /** `hold=1`: this client can show held questions. */
+  hold?: boolean
+  /** ms since the latest real wearer evidence; null or absent when there is none since boot. */
+  presenceAgeMs?: number | null
+}
+
+/** 6.60.0: a `presenceAgeMs` the contract accepts: a finite whole number within [0, 24 h]. */
+export function validPresenceAgeMs(value: unknown): value is number {
+  return typeof value === 'number' && Number.isInteger(value) && value >= 0 && value <= PRESENCE_AGE_MAX_MS
+}
+
 /**
  * A counting questions poll answered at `at` (server clock). Never moves backwards for a
  * slower request answered later, but a clock that stepped back is followed: a stamp left in
  * the future would read stale to the broker, and ignoring every poll until the clock caught
- * up would leave no live client for that long.
+ * up would leave no live client for that long. 6.60.0: `poll` says whether it was a `hold=1`
+ * poll and carried qualifying presence; `mono` is the monotonic time it was answered.
  */
-export function noteQuestionsPoll(at: number): void {
+export function noteQuestionsPoll(at: number, poll: QuestionsPollFacts = {}, mono: number = monotonicNowMs()): void {
   if (!Number.isFinite(at)) return
-  if (lastPollAt === null || at > lastPollAt || lastPollAt - at > CLOCK_STEP_BACK_MS) lastPollAt = at
+  lastPollAt = newerStamp(lastPollAt, at)
+  if (poll.hold !== true) {
+    lastLegacyPollAt = newerStamp(lastLegacyPollAt, at)
+    return
+  }
+  lastHoldPollAt = newerStamp(lastHoldPollAt, at)
+  if (!validPresenceAgeMs(poll.presenceAgeMs) || !Number.isFinite(mono)) return
+  // Forward-only on each clock: a slower poll carrying older evidence never moves it back.
+  const presenceMono = mono - poll.presenceAgeMs
+  const presenceWall = at - poll.presenceAgeMs
+  if (lastPresenceMono === null || presenceMono > lastPresenceMono) lastPresenceMono = presenceMono
+  if (lastPresenceWall === null || presenceWall > lastPresenceWall) lastPresenceWall = presenceWall
+}
+
+/**
+ * 6.60.0: how long ago the newest qualifying wearer presence was, or null when no
+ * qualifying poll has arrived since this process started. The larger of the monotonic age
+ * and the wall-clock age, so a Mac that slept never makes it read younger.
+ */
+export function presenceAgeMs(mono: number = monotonicNowMs(), wall: number = Date.now()): number | null {
+  if (lastPresenceMono === null || !Number.isFinite(mono)) return null
+  const monoAge = Math.max(0, mono - lastPresenceMono)
+  const wallAge = lastPresenceWall !== null && Number.isFinite(wall) ? wall - lastPresenceWall : 0
+  return Math.max(monoAge, wallAge)
 }
 
-/** When the newest authenticated questions poll arrived, or null when none has since boot. */
+/** When the newest authenticated questions poll of any kind arrived, or null since boot (/api/health). */
 export function lastQuestionsPollAt(): number | null {
   return lastPollAt
 }
 
+/** 6.60.0: the newest poll WITHOUT `hold=1`: the 6.59.0 liveness, for every older client. */
+export function lastLegacyQuestionsPollAt(): number | null {
+  return lastLegacyPollAt
+}
+
+/** 6.60.0: the newest poll WITH `hold=1`. */
+export function lastHoldQuestionsPollAt(): number | null {
+  return lastHoldPollAt
+}
+
 export function __resetClientLivenessForTests(): void {
   lastPollAt = null
+  lastLegacyPollAt = null
+  lastHoldPollAt = null
+  lastPresenceMono = null
+  lastPresenceWall = null
 }

package/server/lib/diarizer-backend.ts

@@ -0,0 +1,163 @@
+// Which model assigns who-spoke-when.
+//
+// Voiceprints (ERes2Net) name a person. They do not separate two people inside
+// one chunk. Nemotron 3 Diarization does that, then the voiceprint names the
+// track. COS_DIARIZER selects the track model. The default is Nemotron. If its
+// CLI or its local models are missing, the server stays on the voiceprint path
+// and says so.
+//
+// OFFLINE BY CONSTRUCTION. The FluidAudio CLI downloads its models from Hugging
+// Face whenever it is run WITHOUT `--models`, and it deletes and re-downloads a
+// cache whose weights marker it does not recognise. A meeting must never wait on
+// that, so the server always passes `--models <dir>`, a local directory holding
+// the compiled bundle and the silence embedding. That code path in FluidAudio
+// (Nemotron3Models.load(directory:)) has no network call at all. When no complete
+// local directory exists the server does not run the CLI.
+
+import { execFileSync } from 'node:child_process'
+import { chmodSync, existsSync, lstatSync, mkdirSync, readlinkSync, statSync, symlinkSync, unlinkSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+
+export type DiarizerMode = 'nemotron' | 'embedding'
+
+/** Why Nemotron cannot run at all on this install. Per-chunk reasons live in nemotron-live.ts. */
+export type DiarizerStaticFallback = 'cli_missing' | 'models_missing'
+
+export interface DiarizerChoice {
+  requested: DiarizerMode
+  active: DiarizerMode
+  /** Why Nemotron was not used. Null when the request is what is running. */
+  fallback: DiarizerStaticFallback | null
+}
+
+/** The canary's preset: 32-frame chunks, about 155x realtime warm on an M3 Ultra. */
+export const NEMOTRON_VARIANT = 'fast32'
+/** The FluidAudio v0.17.4 cache keeps the compiled preset under this subdirectory. */
+export const NEMOTRON_BUNDLE = 'monolithic/v2'
+export const NEMOTRON_MODEL_DIRNAME = `Nemotron3Diarizer_${NEMOTRON_VARIANT}.mlmodelc`
+export const NEMOTRON_SILENCE_FILE = 'learnable_sil_emb.bin'
+
+const EMBEDDING_ALIASES = new Set(['embedding', 'eres2net', 'voiceprint', 'legacy'])
+
+export function requestedDiarizer(env: NodeJS.ProcessEnv = process.env): DiarizerMode {
+  const raw = (env.COS_DIARIZER ?? 'nemotron').trim().toLowerCase()
+  return EMBEDDING_ALIASES.has(raw) ? 'embedding' : 'nemotron'
+}
+
+/** First existing binary. Never returns a path that is not on disk. */
+export function nemotronCliPath(env: NodeJS.ProcessEnv = process.env, home: string = homedir()): string | null {
+  if (typeof env.COS_NEMOTRON_CLI === 'string') {
+    return env.COS_NEMOTRON_CLI.length > 0 && existsSync(env.COS_NEMOTRON_CLI) ? env.COS_NEMOTRON_CLI : null
+  }
+  const installed = join(home, '.cos-glasses', 'bin', 'fluidaudiocli')
+  if (existsSync(installed)) return installed
+  // Health reads this on every request; on an install with no CLI that was a
+  // synchronous `which` per request (QA 6.61.0 N5). Cached for a minute per PATH.
+  const key = env.PATH ?? ''
+  const now = Date.now()
+  if (whichCache && whichCache.key === key && now - whichCache.at < WHICH_CACHE_MS) {
+    return whichCache.value && existsSync(whichCache.value) ? whichCache.value : null
+  }
+  let value: string | null = null
+  try {
+    const found = execFileSync('which', ['fluidaudiocli'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 2_000 }).trim()
+    value = found && existsSync(found) ? found : null
+  } catch {
+    value = null
+  }
+  whichCache = { key, at: now, value }
+  return value
+}
+
+const WHICH_CACHE_MS = 60_000
+let whichCache: { key: string; at: number; value: string | null } | null = null
+
+/** The directory passed to `--models`. COS_NEMOTRON_MODELS overrides it. */
+export function nemotronModelsDir(env: NodeJS.ProcessEnv = process.env, home: string = homedir()): string {
+  const override = env.COS_NEMOTRON_MODELS?.trim()
+  return override ? override : join(home, '.cos-glasses', 'models', 'nemotron-3-diarization')
+}
+
+/** Where FluidAudio's own downloader leaves the models (`fluidaudiocli` run once without `--models`). */
+export function fluidAudioCacheDir(home: string = homedir()): string {
+  return join(home, 'Library', 'Application Support', 'FluidAudio', 'Models', 'nemotron-3-diarization')
+}
+
+function isFile(path: string): boolean {
+  try { return statSync(path).isFile() } catch { return false }
+}
+
+/** A compiled bundle is complete once its coremldata.bin is on disk (FluidAudio's own test). */
+export function modelsDirComplete(dir: string): boolean {
+  return isFile(join(dir, NEMOTRON_MODEL_DIRNAME, 'coremldata.bin')) && isFile(join(dir, NEMOTRON_SILENCE_FILE))
+}
+
+function cacheComplete(home: string): boolean {
+  const cache = fluidAudioCacheDir(home)
+  return isFile(join(cache, NEMOTRON_BUNDLE, NEMOTRON_MODEL_DIRNAME, 'coremldata.bin'))
+    && isFile(join(cache, NEMOTRON_SILENCE_FILE))
+}
+
+export interface NemotronModelSource {
+  dir: string
+  /** env: COS_NEMOTRON_MODELS. cos: ~/.cos-glasses/models already complete.
+   *  fluidaudio-cache: complete only after prepareNemotronModelsDir links it. */
+  source: 'env' | 'cos' | 'fluidaudio-cache'
+}
+
+/** Read-only: where the models are, or null. Never creates anything (health calls this). */
+export function nemotronModelSource(env: NodeJS.ProcessEnv = process.env, home: string = homedir()): NemotronModelSource | null {
+  const dir = nemotronModelsDir(env, home)
+  if (env.COS_NEMOTRON_MODELS?.trim()) {
+    // An explicit override is the answer, complete or not. Falling through to a
+    // different copy would run weights the operator did not choose.
+    return modelsDirComplete(dir) ? { dir, source: 'env' } : null
+  }
+  if (modelsDirComplete(dir)) return { dir, source: 'cos' }
+  if (cacheComplete(home)) return { dir, source: 'fluidaudio-cache' }
+  return null
+}
+
+/**
+ * Make `--models` point at a complete local copy, or return null.
+ *
+ * FluidAudio keeps the bundle one level below the silence embedding, while
+ * `--models` wants both in one directory, so the COS directory holds two symlinks
+ * into the FluidAudio cache. Called by the warm-up, never by a health read.
+ */
+export function prepareNemotronModelsDir(env: NodeJS.ProcessEnv = process.env, home: string = homedir()): string | null {
+  const found = nemotronModelSource(env, home)
+  if (!found) return null
+  if (found.source !== 'fluidaudio-cache') return found.dir
+  const cache = fluidAudioCacheDir(home)
+  const links: Array<[string, string]> = [
+    [join(found.dir, NEMOTRON_MODEL_DIRNAME), join(cache, NEMOTRON_BUNDLE, NEMOTRON_MODEL_DIRNAME)],
+    [join(found.dir, NEMOTRON_SILENCE_FILE), join(cache, NEMOTRON_SILENCE_FILE)],
+  ]
+  try {
+    mkdirSync(found.dir, { recursive: true, mode: 0o700 })
+    try { chmodSync(found.dir, 0o700) } catch { /* best effort */ }
+    for (const [link, target] of links) {
+      let current: string | null = null
+      try {
+        if (lstatSync(link).isSymbolicLink()) current = readlinkSync(link)
+        else continue // a real file or directory someone placed there wins
+      } catch { /* absent */ }
+      if (current === target) continue
+      if (current !== null) unlinkSync(link)
+      symlinkSync(target, link)
+    }
+  } catch {
+    return null
+  }
+  return modelsDirComplete(found.dir) ? found.dir : null
+}
+
+export function activeDiarizer(env: NodeJS.ProcessEnv = process.env, home: string = homedir()): DiarizerChoice {
+  const requested = requestedDiarizer(env)
+  if (requested === 'embedding') return { requested, active: 'embedding', fallback: null }
+  if (!nemotronCliPath(env, home)) return { requested, active: 'embedding', fallback: 'cli_missing' }
+  if (!nemotronModelSource(env, home)) return { requested, active: 'embedding', fallback: 'models_missing' }
+  return { requested, active: 'nemotron', fallback: null }
+}

package/server/lib/meeting-relabel-enrolment.ts

@@ -96,6 +96,10 @@ export interface EnrolmentReport {
   /** Candidates rejected as a different voice. `clusterSkipped === attempted`
    *  means the bucket had no dominant voice at all and nothing was written. */
   clusterSkipped: number
+  /** 6.61.0: candidates refused before clustering because the chunk is not one
+   *  voice: its own capture-time voiceprint named a third person, or Nemotron
+   *  split it into more than one turn. */
+  otherVoiceSkipped?: number
   skipped: EnrolmentSkipReason
 }
 
@@ -230,16 +234,35 @@ export function enrolNamedVoice(input: EnrolNamedVoiceInput): EnrolmentReport {
   if (read.missing) return { ...IDLE, skipped: missingReason(sidecar) }
 
   const wanted = new Set(rawIndices)
-  const candidates = read.rows.filter(r => wanted.has(r.i) && r.embedding && r.embedding.length > 0)
-  if (candidates.length === 0) return { ...IDLE, skipped: 'no_embeddings' }
+  const found = read.rows.filter(r => wanted.has(r.i) && r.embedding && r.embedding.length > 0)
+  if (found.length === 0) return { ...IDLE, skipped: 'no_embeddings' }
 
-  const attempted = candidates.length
+  // 6.61.0 (QA W3). Since Nemotron, a chunk's sidecar `speaker` is the dominant
+  // TURN's name, while the embedding row holds the WHOLE chunk's voice and the
+  // label the voiceprint gave that whole chunk. A rename of the turn's label must
+  // not teach the profile a chunk whose own voiceprint named someone else, or a
+  // chunk Nemotron heard as more than one voice: either would enrol the wrong
+  // person. `from` stays allowed (a wrong label is how a new person first shows up).
+  const chunksByIndex = new Map<number, Record<string, unknown>>()
+  for (const entry of Array.isArray(sidecar.chunkEntries) ? sidecar.chunkEntries as Array<Record<string, unknown>> : []) {
+    if (typeof entry?.chunkIndex === 'number' && entry.chunk && typeof entry.chunk === 'object') {
+      chunksByIndex.set(entry.chunkIndex, entry.chunk as Record<string, unknown>)
+    }
+  }
+  const candidates = found.filter(r => !isAnotherVoice(r.speaker, input.from, to) && !isMultiVoiceChunk(chunksByIndex.get(r.i)))
+  // Reported only when it happened, so the response is the 6.60 shape otherwise.
+  const otherVoice = found.length - candidates.length > 0 ? { otherVoiceSkipped: found.length - candidates.length } : {}
+  if (candidates.length === 0) {
+    return { enrolled: 0, attempted: found.length, created: false, clusterSkipped: 0, ...otherVoice, skipped: null }
+  }
+
+  const attempted = found.length
   const cluster = dominantCoherentCluster(candidates.map(r => r.embedding))
-  const clusterSkipped = attempted - cluster.members.length
+  const clusterSkipped = candidates.length - cluster.members.length
   // Every candidate disagreed with every other one. There is no voice here to
   // learn, only a bucket of strangers sharing one placeholder label.
   if (cluster.members.length === 0) {
-    return { enrolled: 0, attempted, created: false, clusterSkipped, skipped: null }
+    return { enrolled: 0, attempted, created: false, clusterSkipped, ...otherVoice, skipped: null }
   }
 
   // Diversity trims the coherent group to a bounded, spread-out sample. Those
@@ -261,12 +284,26 @@ export function enrolNamedVoice(input: EnrolNamedVoiceInput): EnrolmentReport {
     }
   } catch {
     return {
-      enrolled, attempted, created: !existedBefore && enrolled > 0, clusterSkipped,
+      enrolled, attempted, created: !existedBefore && enrolled > 0, clusterSkipped, ...otherVoice,
       skipped: 'store_unavailable',
     }
   }
 
   return {
-    enrolled, attempted, created: !existedBefore && enrolled > 0, clusterSkipped, skipped: null,
+    enrolled, attempted, created: !existedBefore && enrolled > 0, clusterSkipped, ...otherVoice, skipped: null,
   }
 }
+
+/** The row's own capture-time voiceprint named a real person other than the two in this rename. */
+export function isAnotherVoice(rowSpeaker: unknown, from: string, to: string): boolean {
+  if (typeof rowSpeaker !== 'string' || !rowSpeaker.trim()) return false
+  if (isPlaceholderLabel(rowSpeaker)) return false
+  return rowSpeaker !== from && rowSpeaker !== to
+}
+
+/** Nemotron heard more than one turn in this chunk, live or in the final pass. */
+export function isMultiVoiceChunk(chunk: Record<string, unknown> | undefined): boolean {
+  if (!chunk) return false
+  const turns = (value: unknown): number => Array.isArray(value) ? value.length : 0
+  return turns(chunk.segments) > 1 || turns(chunk.finalSegments) > 1
+}

package/server/lib/meeting-store.ts

@@ -379,7 +379,9 @@ export class MeetingStore {
       canonicalProvider: canonicalProvider(input.chunks),
       providers,
       providerCandidates: input.providerCandidates ?? {},
-      speakers: [...new Set(input.chunks.map(chunk => chunk.speaker).filter(speaker => speaker && speaker !== 'Ext'))],
+      // 6.61.0: a chunk can hold two named voices; its segments count too.
+      speakers: [...new Set(input.chunks.flatMap(chunk => [chunk.speaker, ...(chunk.segments ?? []).map(segment => segment.speaker)])
+        .filter(speaker => speaker && speaker !== 'Ext'))],
       chunks: input.chunks,
       chunkEntries: input.chunkEntries ?? input.chunks.map((chunk, chunkIndex) => ({ chunkIndex, chunk })),
       transferIntegrity: input.transferIntegrity ?? null,