@gotcos/glasses-server 6.61.0 → 6.61.2

package/CHANGELOG.md

@@ -1,3 +1,31 @@
+## 6.61.2
+
+### Renaming a voice works on merged meetings whose recording was filed in a different folder
+
+- **What was broken.** When COS merges a glasses recording into a call's write-up, the two are often filed under different areas: the recording under personal, the call under quilt. The server looked for the merged write-up only beside the recording, so it missed it. On 2026-10-02 that was 65 of the 199 merged meetings on Miles's Mac, among them Chris <> Miles Sync on 9/10 (8 voices). Opening Speakers on one showed the raw recording name, and renaming or removing a voice there either failed with "Meeting source changed; reopen the meeting" (when the request carried the record the meetings list shows) or renamed the voice in the recording only and left the meeting's attendees and transcript saying the old name (what COS Control 0.5.254 does; it reported "meeting markdown unreadable"). Naming held voices on these meetings followed the recording's own pointer instead: for 63 it left the meeting's transcript as it was and only marked it as having newer labels, and for 2 (the 9/10 meeting among them) the pointer named a file that had moved, so it failed.
+- **What works now.** The server looks in every area's folder for the recording's month, and also the next or previous month when the recording is dated the first or last day of a month (none of the 199 needed that; a call that starts just before midnight can). It picks the meeting that says it holds the recording with `<!-- g2-session: <id> -->`. Speakers shows that meeting's title and area, renaming, removing or confirming a voice updates that meeting, naming held voices edits it the way it already did for merges filed beside their recording, and the record matches the meetings list row. Merged meetings beside their recording work as before.
+- **Only an exact marker counts.** A title, a file name or an id that differs by one character never matches. iCloud conflict copies (`Name 2.md`) and duplicate folders (`2026-09 2`) are never read as meetings.
+- **Two meetings claiming one recording: neither is chosen.** The recording keeps its own record, the server logs `merged_scribe_ambiguous` with both paths, a rename says so in `markdownSkipped`, and naming held voices refuses until one is fixed. None of the 199 is in that state.
+- **Speed.** The meetings list does not use this lookup and is unchanged. On a copy of Miles's 2,640 meetings, median of 9 runs, two runs each: the default list 313 and 317 ms on 6.61.1, 312 and 315 ms on 6.61.2; one month 84 and 83 ms, then 84 and 84 ms. Opening Speakers on a merged meeting reads that month's write-ups across every area once after a start or a change (49 to 51 ms the first time, against 35 ms on 6.61.1) and afterwards only checks their timestamps: 28 to 29 ms, the same as 6.61.1.
+- **Checked on copies of the real meetings.** All 65 cross-folder meetings resolve to the meeting the list shows (0 of 65 on 6.61.1), all 134 same-folder ones still do, and the 59 recordings the marker pass left for review resolve exactly as on 6.61.1 (30 to their own write-up, 29 to the recording alone, none to a merged meeting). A rename on a copy of the 9/10 meeting: 6.61.1 refused it with the list's record and changed only the recording with the Speakers record; 6.61.2 applied it to the meeting.
+- **For clients.** No response field was added or removed. For a cross-folder merged meeting, `/api/meeting/:id/speakers` and `/content` now carry the merged meeting's `recordId`, `title`, `filename` and `domain`, the values its list row already had; every other meeting answers as before. COS Glasses 6.9.563 to 6.9.570 and COS Control 0.5.254 need no update.
+- **Comments only.** The code comments and README now say glasses presence is a ring, temple or lens gesture, or a phone touch while COS is in front, and never the worn status (COS Glasses 6.9.570). No behaviour change; `presenceAgeMs` is unchanged.
+- Tests: a route suite over HTTP in the pipeline layout (the list row, the Speakers record, title and area, a rename sent with either record, a removal, a confirmation, the copy text, a same-folder merge, and two claims refused), the lookup itself (every area, an area name this repo never uses, the capture's own write-up still winning, no claim, near-miss ids, a title that is not a claim, two claims in one folder or two, iCloud copies of a write-up, of a recording and of a month folder, the first and last day of a month and a year boundary, a mid-month recording not searching further, the cache seeing a new, edited, emptied or deleted write-up and a deleted month folder, a warm lookup reading nothing, a write-up changed between the scan and the read, an unreadable folder or file in another area, a FIFO never opened, suggestion sides and merged-record sources), and held naming (a cross-folder merge, two claims refused). On 6.61.1 the route suite fails 7 of 9 and the two held naming tests fail.
+- `node server/scripts/merged-scribe-mutation-gate.mjs` (repository only, not in the package) runs from a green baseline (85 tests in 3 files), matches each target exactly once, and each mutant must fail the test named for it: 41 of 41 killed. The 6.61.0 and 6.61.1 gate (`nemotron-mutation-gate.mjs`, including the finalizing refusal and the re-read before the final pass writes) rerun on this build: baseline 169 tests in 11 files, 104 of 104 killed. Full suite 5,761 passed, 2 skipped (378 files); typecheck clean; `npm audit --omit=dev` 0 vulnerabilities.
+
+## 6.61.1
+
+### Fixes 6.61.0 labelling other people as the wearer: a split track is named only by a confident voiceprint, never by the glasses' default label
+
+- Miles, 2026-10-02 10:19, in a live meeting on 6.61.0: "MU is being assigned to loudest speaker vs my actual voice signature ... I saw Jeremy Sokolic voice showing up as MU." In that session (`meeting_1790953219564_yhwyxs`, read from a copy), 40 turns read MU. 25 were genuine (voiceprint at 0.65 or more, Even Hub `self`). 11 had similarity 0 in two-track chunks where Even Hub heard mostly someone else ("Okay.", "I can send a message. Yeah.", "to have as we play into calendar."): a short second track took the client's label, and the client's label is the glasses' default wearer label (`MU`), not evidence of who spoke. 2 more ("Of course. All right." at 0.612, and 0.625) were a track's own voiceprint check returning the wearer from the full search, which accepts any profile from 0.55, below the 0.65 at which the voiceprint verifies the wearer.
+- **The client's label never names a track.** In a split chunk, a short track that is not the dominant one is `Ext`. The client's label is still what 6.60.0 used it for: a whole chunk no voiceprint could run on (under 2 s, or no voiceprint model). A one-track chunk is labelled exactly as 6.60.0 labelled the chunk.
+- **The wearer needs owner-verify confidence in a split chunk.** A track named the wearer (`owner_speaker_label`) by its own voiceprint check, or a short dominant track that would take the whole chunk's voiceprint, keeps the wearer's name only at `OWNER_VERIFY_SIMILARITY` (0.65, now one constant shared with the voiceprint's owner verify); between 0.55 and 0.65 it is `Ext`. Any other name keeps the search threshold, as before. The two 0.665 and 0.716 turns where Even Hub heard mostly someone else are above the floor and stay, as reviewed.
+- **The final pass applies the same rule.** Its channel map was already built only from chunks at 0.65 or more. Its per-chunk fallback (the live turn a word sat in, else the chunk's label) now treats a wearer name in a split chunk below 0.65 as `Ext`, so a 6.61.0 turn like these is never carried into a final transcript.
+- **Logged and counted.** Every chunk where a would-be wearer name was refused logs one line, `[diarizer] owner-guard chunk #N refused=K client_label=X weak_owner=Y`; the chunk's `diarizer.ownerGuard` lists the reasons, and `readiness.diarizer.ownerGuard` counts them since start.
+- **Replayed on the field session (read-only copies of its 195 Nemotron chunks and their audio, the real CLI and the real voiceprint):** all 28 genuine wearer turns (0.65 or more, Even Hub `self`) stay MU; 0 of the 11 similarity-0 MU turns and 0 of the 2 weak ones (0.612, 0.625) are MU any more; the 2 borderline turns stay MU; the guard refused 13 client labels and 2 weak wearer matches; no chunk fell back.
+- Tests: the field chunks rebuilt from their records ("Okay." with Even Hub self 19/121, "I can send a message. Yeah." at self 3/125 with Kyle keeping his own track, "Of course. All right." at 0.612), the wearer staying the wearer in a one-track chunk (0.703) and a split one (0.716), a weak wearer match refused on both paths (the whole-chunk voiceprint a short dominant turn takes, and a track's own check), the client label never naming a track, the owner-guard log line and count, the route passing `owner_speaker_label`, and the final pass refusing a 6.61.0 similarity-0 MU turn while keeping a confident one. The mutation gate adds a case for each guard and retargets the three 6.61.0 cases the guard replaced: baseline 169 tests in 11 files, 104 of 104 killed. Full suite 5,723 passed, 2 skipped.
+- No Install hooks and no COS Control change.
+
 ## 6.61.0
 
 ### Nemotron is the default diarizer, for real: it splits two-voice chunks on the HUD during the call and in the final transcript, and the voiceprint names each voice

package/README.md

@@ -265,21 +265,22 @@ or the away hold's.
 
 **The away hold (6.60.0).** A request that starts while you are away (the desk idle 90 s,
 the same threshold as above) is held for up to 10 minutes, but only when the glasses or the
-phone that show held questions report that you wore or touched them in the last 30 minutes.
+phone that show held questions report that you touched them in the last 30 minutes.
 The client contract (COS Glasses 6.9.563 and later):
 
 - Poll `GET /api/session-questions?client=glasses|phone&hold=1&presenceAgeMs=<int>`.
   `hold=1` says this client shows held questions. `presenceAgeMs` is the milliseconds since
-  the latest real wearer evidence (glasses: a ring or temple input, or a device status with
-  wearing true; phone: a foreground touch), a whole number from 0 to 86,400,000, and is left
-  out when there is none since the app started.
+  the latest real wearer evidence (glasses: a ring, temple or lens gesture; phone: a touch
+  while COS is in front), a whole number from 0 to 86,400,000, and is left out when there is
+  none since the app started. The worn status never counts (COS Glasses 6.9.570 and later):
+  wear detection can be turned off, and then it always reads not worn.
 - Only a poll with `hold=1` AND a valid `presenceAgeMs` counts toward the hold. The server
   keeps the newest such presence in memory, on the monotonic clock and the wall clock, and
   reads its age as the larger of the two (so a Mac that slept never makes it look newer).
   Recent means within `COS_PERMISSION_BROKER_AWAY_RECENT_CLIENT_S` (default 1800, clamped to 0
   through 86400; under 30 it means the 30 s live window). After a server restart nothing is
   recent until such a poll.
-- A `hold=1` poll without presence (a connected lens nobody wears) makes no client live and
+- A `hold=1` poll without presence (a connected lens nobody touches) makes no client live and
   holds nothing. A poll without `hold=1` (COS Glasses 6.9.562 and earlier, every older phone
   build) keeps the 6.59.0 meaning exactly: live for 30 s, a 110 s hold, and never the away
   hold.
@@ -597,8 +598,9 @@ is split into turns instead of carrying one label.
   `segments: [{ speaker, text, startSec, endSec, similarity }]` in time order;
   their texts joined with one space equal `text`. A track with at least 2 s of
   its own audio is named by the voiceprint on that audio; a shorter one takes the
-  chunk's voiceprint when it is the dominant voice, otherwise the client's label
-  (when that is a real name different from the dominant one) or `Ext`. The
+  chunk's voiceprint when it is the dominant voice, otherwise it is `Ext`. The
+  glasses' default wearer label never names a track, and in a split chunk the
+  wearer is named only at owner-verify confidence (0.65; since 6.61.1). The
   segments are stored on the chunk, so the saved meeting keeps them.
 - **The final transcript.** When a meeting is saved, one Nemotron pass over the
   whole meeting maps each channel to a name from the chunks the voiceprint was

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.61.0",
+  "version": "6.61.2",
   "description": "COS Glasses: self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {
@@ -47,6 +47,7 @@
     "!server/scripts/work-progress-mutation-gate.mjs",
     "!server/scripts/away-hold-mutation-gate.mjs",
     "!server/scripts/nemotron-mutation-gate.mjs",
+    "!server/scripts/merged-scribe-mutation-gate.mjs",
     "!server/scripts/nemotron-replay.ts",
     "!server/scripts/mutation-gate.mjs",
     "!server/lib/meeting-engine/__fixtures__/**",

package/server/lib/client-liveness.ts

@@ -27,10 +27,11 @@
 // 6.60.0 (QA round 1, the contract shared with COS Glasses 6.9.563): the away hold needs
 // more than a poll. A poll QUALIFIES only with `hold=1` (this client shows held questions;
 // 6.9.563 and later send it) AND a finite `presenceAgeMs` within [0, 24 h]: the ms since
-// the latest real wearer evidence (glasses: a ring or temple input, or a device status with
-// wearing true; phone: a foreground touch). A connected lens nobody wears sends no
-// `presenceAgeMs`, and an older client sends no `hold=1`, so neither can make the Mac hold a
-// question for 10 minutes.
+// the latest real wearer evidence (glasses: a ring, temple or lens gesture; phone: a touch
+// while COS is in front). The worn status never counts: Glasses 6.9.570 dropped it because
+// wear detection can be turned off, and then it always reads not worn. A connected lens
+// nobody touches sends no `presenceAgeMs`, and an older client sends no `hold=1`, so neither
+// can make the Mac hold a question for 10 minutes.
 //
 // Kept apart, all in memory (a restart forgets them, which fails toward 6.59.0):
 //   - the newest counting poll of any kind (`lastQuestionsPollAt`, for /api/health);

package/server/lib/cos-operations-meetings.ts

@@ -478,6 +478,12 @@ function withMeetingListInsights(meta: CosOperationsMeetingMeta, content: string
  * but the readable meeting is now the merged scribe, so this returns the orphan's
  * sidecar path with the merged scribe's path, filename and title. Without that,
  * naming a voice on a merged meeting opened a file that no longer existed.
+ *
+ * ...AND ITS DOMAIN AND MONTH (6.61.2). The merged scribe may sit in another
+ * domain folder than the sidecar, and `domain`, `month` and `filename` are what
+ * every caller builds the `ops:` recordId from, so all three describe the merged
+ * scribe: the same recordId the meetings list shows for that row. `sidecarPath`
+ * stays the capture's, wherever it is.
  */
 export function findCosOperationsMeetingBySessionId(sessionId: string): {
   sidecarPath: string
@@ -486,22 +492,31 @@ export function findCosOperationsMeetingBySessionId(sessionId: string): {
   domain: string
   month: string
   title: string
+  /**
+   * 6.61.2. Set only when MORE THAN ONE meeting declares this session through
+   * `<!-- g2-session -->`: their operations-relative paths. The record then
+   * describes the capture alone, exactly as an unresolved merge does, because
+   * picking one of them would write a correction into a meeting chosen by
+   * directory order.
+   */
+  mergedScribeConflict?: string[]
 } | null {
   const operationsDir = resolveCosOperationsDir()
   if (!operationsDir) return null
 
-  for (const domain of discoverMeetingDomains(operationsDir)) {
+  const domains = discoverMeetingDomains(operationsDir)
+  for (const domain of domains) {
     const meetingsBase = join(operationsDir, domain, 'meetings')
     let months: string[]
     try {
-      months = readdirSync(meetingsBase).filter(d => /^\d{4}-\d{2}$/.test(d)).sort().reverse()
+      months = readdirSync(meetingsBase).filter(d => MONTH_PATTERN.test(d)).sort().reverse()
     } catch { continue }
 
     for (const month of months) {
       const monthDir = join(meetingsBase, month)
       let sidecars: string[]
       try {
-        sidecars = readdirSync(monthDir).filter(f => f.endsWith('.g2-chunks.json') && !/ \d+(\.[A-Za-z0-9-]+)*\.json$/.test(f)).sort().reverse()
+        sidecars = readdirSync(monthDir).filter(f => f.endsWith('.g2-chunks.json') && !ICLOUD_CONFLICT_COPY.test(f)).sort().reverse()
       } catch { continue }
 
       for (const sidecarName of sidecars) {
@@ -510,17 +525,26 @@ export function findCosOperationsMeetingBySessionId(sessionId: string): {
         const sidecarPath = join(monthDir, sidecarName)
         let meetingPath = join(monthDir, meetingFilename)
         let resolvedFilename = meetingFilename
+        let resolvedDomain = domain
+        let resolvedMonth = month
+        let mergedScribeConflict: string[] | undefined
         let content: string | null = null
         try {
           content = readFileSync(meetingPath, 'utf-8')
         } catch {
-          // The capture's own scribe is gone. Only now is it worth reading the
-          // month's other scribes to find the one that declares this session.
-          const merged = findMergedScribeForSession(monthDir, sessionId)
-          if (merged) {
+          // The capture's own scribe is gone. Only now is it worth looking for
+          // the merged scribe that declares this session, in EVERY domain: the
+          // pipeline re-files a merge by its Fireflies call, so a capture filed
+          // under personal is routinely merged into a scribe under quilt.
+          const merged = resolveMergedScribe(operationsDir, domains, month, sidecarName, sessionId)
+          if (merged.status === 'resolved') {
+            resolvedDomain = merged.domain
+            resolvedMonth = merged.month
             resolvedFilename = merged.filename
-            meetingPath = join(monthDir, merged.filename)
+            meetingPath = merged.path
             content = merged.content
+          } else if (merged.status === 'ambiguous') {
+            mergedScribeConflict = merged.claimants
           }
         }
         let title = resolvedFilename.replace(/\.md$/, '')
@@ -530,9 +554,10 @@ export function findCosOperationsMeetingBySessionId(sessionId: string): {
           sidecarPath,
           meetingPath,
           filename: resolvedFilename,
-          domain,
-          month,
+          domain: resolvedDomain,
+          month: resolvedMonth,
           title,
+          ...(mergedScribeConflict ? { mergedScribeConflict } : {}),
         }
       }
     }
@@ -540,30 +565,188 @@ export function findCosOperationsMeetingBySessionId(sessionId: string): {
   return null
 }
 
+// ── Merged-scribe resolution across domains (6.61.2) ────────────────────────
+//
+// 6.47.0 looked for the merged scribe only in the sidecar's own folder. On
+// 2026-10-02, 65 of the 199 merged scribes on the author's Mac sat in a
+// different DOMAIN folder from their capture (38 personal -> quilt, 11 personal
+// -> hermit_crabs, 9 personal -> sprocket_rocket, 7 between hermit_crabs,
+// sprocket_rocket and quilt), so those sessions resolved to the retired
+// standalone filename: the speaker review named a record the meetings list does
+// not show, and every correction either 409'd on `record_source_mismatch` or
+// renamed the voice in the sidecar alone.
+//
+// IDENTITY IS THE MARKER. A scribe holds a session only if it carries
+// `<!-- g2-session: <exact id> -->`. No filename, title or date is ever a match,
+// and two scribes declaring one session resolve to neither.
+
+/**
+ * iCloud conflict copies ("Chris_Miles_Sync 2.md", "x 2.g2-chunks.json").
+ * Never canonical, and a copy of a merged scribe carries the same markers as the
+ * original, so counting it would turn every conflict copy into a duplicate claim.
+ */
+const ICLOUD_CONFLICT_COPY = / \d+(\.[A-Za-z0-9-]+)*\.(md|json)$/
+
+function shiftMonth(month: string, by: number): string {
+  const [year, monthNumber] = month.split('-').map(Number)
+  const index = year * 12 + (monthNumber - 1) + by
+  return `${String(Math.floor(index / 12)).padStart(4, '0')}-${String((index % 12) + 1).padStart(2, '0')}`
+}
+
 /**
- * The scribe in this month that declares `sessionId` through `<!-- g2-session -->`.
+ * The month folders a merged scribe for this capture can sit in.
  *
- * Only ever called when a capture's own scribe is missing, so the full-content
- * read it costs lands on a path that was about to answer with a dead file.
+ * The capture's own month, always. Measured on 2026-10-02: all 199 merged
+ * scribes carry the capture's own date (0 of 199 a day off) and the nearest any
+ * capture came to a month edge was 7.5 hours. So a merge can land in another
+ * month only when the capture sits on a month's first or last day (a call that
+ * began before midnight and a capture that began after it, or the reverse), and
+ * those two days also search the neighbouring month. A sidecar whose name does
+ * not carry a date inside its own month searches both neighbours, because
+ * nothing says which way it leans. Never a `2026-09 2` folder: every name here
+ * is built, not listed.
  */
-function findMergedScribeForSession(
-  monthDir: string,
-  sessionId: string,
-): { filename: string; content: string } | null {
-  let names: string[]
+export function mergedScribeMonthsFor(sidecarMonth: string, sidecarFilename: string): string[] {
+  if (!MONTH_PATTERN.test(sidecarMonth)) return []
+  const date = /^(\d{4}-\d{2})-(\d{2})/.exec(sidecarFilename)
+  if (!date || date[1] !== sidecarMonth) {
+    return [sidecarMonth, shiftMonth(sidecarMonth, -1), shiftMonth(sidecarMonth, 1)]
+  }
+  const day = Number(date[2])
+  const [year, monthNumber] = sidecarMonth.split('-').map(Number)
+  const lastDay = new Date(Date.UTC(year, monthNumber, 0)).getUTCDate()
+  const months = [sidecarMonth]
+  if (day === 1) months.push(shiftMonth(sidecarMonth, -1))
+  if (day === lastDay) months.push(shiftMonth(sidecarMonth, 1))
+  return months
+}
+
+// The cost guard. A cold lookup reads every scribe in the months above across
+// every domain (about 300 files and 11 MB for a busy month on the author's Mac);
+// a warm one stats them and reads nothing. A month's listing is reused while the
+// folder's own stamp is unchanged, and a scribe's markers while ITS stamp is,
+// so an in-place edit that leaves the folder's mtime alone is still seen.
+interface ScribeClaimEntry { stamp: string; sessions: readonly string[] }
+interface MonthListingEntry { stamp: string; names: string[] }
+const scribeClaimCache = new Map<string, ScribeClaimEntry>()
+const monthListingCache = new Map<string, MonthListingEntry>()
+let scribeClaimReads = 0
+
+function statStamp(stat: { ino: number; size: number; mtimeMs: number; ctimeMs: number }): string {
+  return `${stat.ino}:${stat.size}:${stat.mtimeMs}:${stat.ctimeMs}`
+}
+
+/** Every canonical scribe in one month folder that declares at least one session. */
+function scribeClaimsIn(monthDir: string): Array<{ filename: string; sessions: readonly string[] }> {
+  let dirStamp: string
   try {
-    names = readdirSync(monthDir).filter(name => name.endsWith('.md')).sort().reverse()
+    dirStamp = statStamp(statSync(monthDir))
   } catch {
-    return null
+    for (const name of monthListingCache.get(monthDir)?.names ?? []) scribeClaimCache.delete(join(monthDir, name))
+    monthListingCache.delete(monthDir)
+    return []
   }
-  for (const filename of names.slice(0, MAX_LIST_CANDIDATES)) {
-    let content: string
+  let listing = monthListingCache.get(monthDir)
+  if (!listing || listing.stamp !== dirStamp) {
+    let names: string[]
     try {
-      content = readFileSync(join(monthDir, filename), 'utf-8')
+      names = readdirSync(monthDir)
+        .filter(name => name.endsWith('.md') && !ICLOUD_CONFLICT_COPY.test(name))
+        .sort()
+        .slice(0, MAX_LIST_CANDIDATES)
+    } catch {
+      return []
+    }
+    const kept = new Set(names)
+    for (const old of listing?.names ?? []) if (!kept.has(old)) scribeClaimCache.delete(join(monthDir, old))
+    listing = { stamp: dirStamp, names }
+    monthListingCache.set(monthDir, listing)
+  }
+  const claims: Array<{ filename: string; sessions: readonly string[] }> = []
+  for (const filename of listing.names) {
+    const path = join(monthDir, filename)
+    let stat: ReturnType<typeof statSync>
+    try {
+      stat = statSync(path)
     } catch { continue }
-    if (mergedScribeSessions(content).includes(sessionId)) return { filename, content }
+    // A FIFO or a folder named *.md is never read: a FIFO would block the server.
+    if (!stat.isFile()) continue
+    const stamp = statStamp(stat)
+    let entry = scribeClaimCache.get(path)
+    if (!entry || entry.stamp !== stamp) {
+      let content: string
+      try {
+        content = readFileSync(path, 'utf-8')
+      } catch { continue }
+      scribeClaimReads++
+      entry = { stamp, sessions: mergedScribeSessions(content) }
+      scribeClaimCache.set(path, entry)
+    }
+    if (entry.sessions.length > 0) claims.push({ filename, sessions: entry.sessions })
   }
-  return null
+  return claims
+}
+
+/** How much work the marker cache has done. Diagnostics and the cost tests read it. */
+export function mergedScribeCacheStats(): { reads: number; scribes: number; months: number } {
+  return { reads: scribeClaimReads, scribes: scribeClaimCache.size, months: monthListingCache.size }
+}
+
+/** Drop the marker cache. Tests use it to measure a cold lookup. */
+export function resetMergedScribeCache(): void {
+  scribeClaimCache.clear()
+  monthListingCache.clear()
+  scribeClaimReads = 0
+}
+
+export type MergedScribeResolution =
+  | { status: 'resolved'; domain: string; month: string; filename: string; path: string; content: string }
+  | { status: 'none' }
+  | { status: 'ambiguous'; claimants: string[] }
+
+/**
+ * The ONE scribe, in any domain, that declares `sessionId` through
+ * `<!-- g2-session -->`. Two or more is `ambiguous` and resolves to none of them.
+ *
+ * `read` is the final read of the chosen scribe. Injectable so a test can stand
+ * in for a scribe rewritten between the scan and this read.
+ */
+export function resolveMergedScribe(
+  operationsDir: string,
+  domains: readonly string[],
+  sidecarMonth: string,
+  sidecarFilename: string,
+  sessionId: string,
+  read: (path: string) => string = path => readFileSync(path, 'utf-8'),
+): MergedScribeResolution {
+  const months = mergedScribeMonthsFor(sidecarMonth, sidecarFilename)
+  const found: Array<{ domain: string; month: string; filename: string }> = []
+  for (const domain of domains) {
+    for (const month of months) {
+      for (const claim of scribeClaimsIn(join(operationsDir, domain, 'meetings', month))) {
+        if (claim.sessions.includes(sessionId)) found.push({ domain, month, filename: claim.filename })
+      }
+    }
+  }
+  if (found.length === 0) return { status: 'none' }
+  if (found.length > 1) {
+    const claimants = found.map(f => `${f.domain}/meetings/${f.month}/${f.filename}`)
+    // Once per lookup, and lookups happen on a person's action (opening the
+    // speaker panel, a correction), never in a loop.
+    console.warn(`[meetings] merged_scribe_ambiguous: ${claimants.length} meetings declare session ${sessionId} (${claimants.join(', ')}); using the capture alone until one is fixed`)
+    return { status: 'ambiguous', claimants }
+  }
+  const only = found[0]
+  const path = join(operationsDir, only.domain, 'meetings', only.month, only.filename)
+  let content: string
+  try {
+    content = read(path)
+  } catch {
+    return { status: 'none' }
+  }
+  // The cache is a hint; the file just read is the identity.
+  if (!mergedScribeSessions(content).includes(sessionId)) return { status: 'none' }
+  return { status: 'resolved', ...only, path, content }
 }
 
 export type MeetingLibraryRecord = NonNullable<ReturnType<typeof findCosOperationsMeetingBySessionId>> & {

package/server/lib/held-naming-batches.ts

@@ -188,6 +188,9 @@ function resolveCopies(sessionId:string):ResolvedCopy[] {
   if (operations) {
     const found = findCosOperationsMeetingBySessionId(sessionId)
     if (!found) throw new Error('Operations meeting copy is missing; retry after sync')
+    // 6.61.2: two meetings declare this session. Fail closed rather than let the
+    // sidecar's own blended_into pointer below pick one of them.
+    if (found.mergedScribeConflict) throw new Error(`${found.mergedScribeConflict.length} meetings declare this session; fix the duplicate before naming`)
     paths.push({copy:'operations',sidecarPath:found.sidecarPath,meetingPath:found.meetingPath})
   } else if (process.env.COS_OPERATIONS_DIR?.trim() || process.env.COS_SCRIPTS_DIR?.trim()) {
     // An explicitly configured but unavailable iCloud root is not standalone.

package/server/lib/nemotron-final.ts

@@ -41,6 +41,8 @@ import {
   prepareNemotronModelsDir,
 } from './diarizer-backend.js'
 import { CONFIDENT_SIMILARITY, isUnattributed } from './meeting-speaker-review.js'
+import { getOwnerSpeakerLabel } from './profile.js'
+import { OWNER_VERIFY_SIMILARITY } from './voiceprint-floor.js'
 import {
   NEMOTRON_TMP_PREFIX,
   NemotronRunError,
@@ -265,6 +267,10 @@ export function crowdIdentities(windows: TimelineWindow[]): number {
   return [...counts.values()].filter(count => count >= FINAL_MIN_SUPPORT).length
 }
 
+function ownerLabelOrNull(): string | null {
+  try { return getOwnerSpeakerLabel() } catch { return null }
+}
+
 function isName(label: unknown): label is string {
   return typeof label === 'string' && !isUnattributed(label.trim())
 }
@@ -332,7 +338,21 @@ export function mapChannelsToNames(windows: TimelineWindow[], a: Activity, optio
 }
 
 /** The live segment that held chunk-relative time t, else null. */
-function liveSpeakerAt(chunk: SidecarChunk, t: number): string | null {
+/**
+ * 6.61.1 owner guard for per-chunk names. 6.61.0 named split tracks as the wearer
+ * from the glasses' default label (similarity 0) or a weak search match
+ * (0.55 to 0.65). In a chunk with more than one live turn, the wearer's name
+ * counts only at owner-verify confidence; otherwise it is Ext. A one-turn chunk
+ * keeps its label exactly as 6.60.0 gave it.
+ */
+export function guardOwnerName(name: string, similarity: unknown, chunk: SidecarChunk, owner: string | null | undefined): string {
+  if (!owner || name !== owner) return name
+  const split = Array.isArray(chunk.segments) && chunk.segments.length > 1
+  if (!split) return name
+  return Number(similarity) >= OWNER_VERIFY_SIMILARITY ? name : 'Ext'
+}
+
+function liveSpeakerAt(chunk: SidecarChunk, t: number, owner?: string | null): string | null {
   const segments = chunk.segments
   if (!Array.isArray(segments) || segments.length === 0) return null
   let best: ChunkSpeakerSegment | null = null
@@ -344,7 +364,7 @@ function liveSpeakerAt(chunk: SidecarChunk, t: number): string | null {
     const d = t < s ? s - t : t > e ? t - e : 0
     if (d < distance) { distance = d; best = segment }
   }
-  return best && typeof best.speaker === 'string' ? best.speaker : null
+  return best && typeof best.speaker === 'string' ? guardOwnerName(best.speaker, best.similarity, chunk, owner) : null
 }
 
 export interface RelabelStats {
@@ -383,6 +403,7 @@ export function relabelBatchSegments(
   timeline: MeetingTimeline,
   a: Activity,
   map: Map<number, string>,
+  owner?: string | null,
 ): { segments: SidecarBatchSegment[]; stats: RelabelStats } {
   const stats: RelabelStats = { total: 0, relabeled: 0, viaChannel: 0, kept: 0 }
   const out = segments.map(segment => ({
@@ -399,7 +420,8 @@ export function relabelBatchSegments(
       }
       if (name === null) {
         stats.kept++
-        name = (start && liveSpeakerAt(start.window.chunk, start.inChunk)) ?? original
+        name = (start && liveSpeakerAt(start.window.chunk, start.inChunk, owner))
+          ?? (start ? guardOwnerName(original, start.window.chunk.similarity, start.window.chunk, owner) : original)
       }
       if (name !== word.speaker) stats.relabeled++
       const next: SpeakerWord = { ...word, speaker: name }
@@ -441,6 +463,7 @@ export function relabelStreamingChunks(
   timeline: MeetingTimeline,
   a: Activity,
   map: Map<number, string>,
+  owner?: string | null,
 ): { finals: Map<number, { speaker: string; segments: ChunkSpeakerSegment[] }>; stats: RelabelStats } {
   const stats: RelabelStats = { total: 0, relabeled: 0, viaChannel: 0, kept: 0 }
   const finals = new Map<number, { speaker: string; segments: ChunkSpeakerSegment[] }>()
@@ -449,17 +472,17 @@ export function relabelStreamingChunks(
     if (typeof chunk.text !== 'string' || !chunk.text.trim()) continue
     const tokens = splitTokens(chunk.text)
     const times = streamingTokenTimes(chunk, tokens, window, a)
-    const base = typeof chunk.originalSpeaker === 'string' ? chunk.originalSpeaker : chunk.speaker
+    const base = guardOwnerName(typeof chunk.originalSpeaker === 'string' ? chunk.originalSpeaker : chunk.speaker, chunk.similarity, chunk, owner)
     const labels: string[] = []
     let carry: string | null = null
     for (let i = 0; i < tokens.length; i++) {
-      if (!isWordToken(tokens[i]) || !times) { labels.push(carry ?? liveSpeakerAt(chunk, 0) ?? base); continue }
+      if (!isWordToken(tokens[i]) || !times) { labels.push(carry ?? liveSpeakerAt(chunk, 0, owner) ?? base); continue }
       stats.total++
       const span = times[i]
       const channel = channelForSpan(a, window.start + span.start, window.start + Math.max(span.end, span.start + 0.01))
       let name: string
       if (channel !== null && map.has(channel)) { name = map.get(channel)!; stats.viaChannel++ }
-      else { name = liveSpeakerAt(chunk, span.start) ?? base; stats.kept++ }
+      else { name = liveSpeakerAt(chunk, span.start, owner) ?? base; stats.kept++ }
       labels.push(name)
       carry = name
     }
@@ -646,6 +669,8 @@ export interface FinalPassOptions {
   tmpRoot?: string
   log?: (line: string) => void
   now?: () => number
+  /** The wearer's label, for the 6.61.1 owner guard (default: the profile's). */
+  owner?: string | null
   /** Seam: how files are written (durable atomic by default). */
   write?: (path: string, data: string) => void
   /** Seam: the batch relabeller (word-aligned in place by default). */
@@ -758,6 +783,7 @@ async function finalPassNow(options: FinalPassOptions): Promise<FinalPassOutcome
 
   const sidecarText = readFileSync(options.sidecarPath, 'utf8')
   const sidecar = JSON.parse(sidecarText) as Record<string, any>
+  const owner = options.owner !== undefined ? options.owner : ownerLabelOrNull()
   if (Number(sidecar.correctionRevision ?? 0) > 0) return { status: 'skipped', reason: 'human_corrected' }
   const markdown = readFileSync(options.meetingPath, 'utf8')
   const transcript = readTranscriptSection(markdown)
@@ -833,7 +859,7 @@ async function finalPassNow(options: FinalPassOptions): Promise<FinalPassOutcome
     mode = 'batch'
     const segments = (Array.isArray(sidecar.batchSegments) ? sidecar.batchSegments : []) as SidecarBatchSegment[]
     if (!segments.length) return { status: 'skipped', reason: 'no_speaker_words' }
-    const relabeled = relabelBatchSegments(segments, timeline, activity, mapping.map)
+    const relabeled = relabelBatchSegments(segments, timeline, activity, mapping.map, owner)
     stats = relabeled.stats
     // finalizeBatch wrote labelled turns only when every segment had speaker words.
     const selected = selectBatchTranscriptForPersistence(
@@ -850,7 +876,7 @@ async function finalPassNow(options: FinalPassOptions): Promise<FinalPassOutcome
     if (typeof sidecar.batchTranscript === 'string') nextSidecar.batchTranscript = next
   } else {
     mode = 'streaming'
-    const relabeled = relabelStreamingChunks(timeline, activity, mapping.map)
+    const relabeled = relabelStreamingChunks(timeline, activity, mapping.map, owner)
     stats = relabeled.stats
     const textEntries = entries.filter(entry => typeof entry.chunk?.text === 'string' && entry.chunk.text.trim())
     next = relabelStreamingTranscript(transcript, textEntries.map(entry => ({ chunkIndex: entry.chunkIndex, text: entry.chunk.text })), relabeled.finals)

package/server/lib/nemotron-live.ts

@@ -55,6 +55,7 @@ import {
   type TokenTime,
 } from './nemotron-segments.js'
 import type { WhisperWord } from './whisper-local.js'
+import { OWNER_VERIFY_SIMILARITY } from './voiceprint-floor.js'
 
 /** The chunk response contract shared with COS Glasses 6.9.567. Keep this shape. */
 export interface ChunkSpeakerSegment {
@@ -78,8 +79,10 @@ export interface LiveNamingInput {
   audio: Buffer
   /** Today's whole-chunk voiceprint result. */
   chunkVoiceprint: VoiceprintResult
-  /** The client's own label (amplitude / Even Hub), e.g. the owner or Ext. */
+  /** The client's own label (amplitude / Even Hub), e.g. the owner or Ext. Never names a split track. */
   clientSpeaker: string
+  /** The wearer's label (`owner_speaker_label`), for the owner guard. */
+  owner?: string | null
   identify: (wav: Buffer) => VoiceprintResult | null
 }
 
@@ -92,6 +95,8 @@ export type LiveNamingResult =
       tracks: number
       timing: 'words' | 'estimated'
       identified: number
+      /** Would-be wearer names refused in this chunk, by reason. */
+      ownerGuard: { client_label: number; weak_owner: number }
     }
   | { ok: false; reason: 'no_text' | 'no_speech' }
 
@@ -105,14 +110,19 @@ function isRealLabel(label: string): boolean {
 /**
  * Split one chunk's text into named segments. Pure apart from `identify`.
  *
- * Naming rules (2026-10-02 brief):
- *  - one track: it is the whole chunk, so it takes the chunk's voiceprint result;
+ * Naming rules (2026-10-02 brief, 6.61.1 owner guard):
+ *  - one track: it is the whole chunk, so it takes the chunk's voiceprint result,
+ *    exactly as 6.60.0 labelled the chunk (including the client's label when no
+ *    voiceprint could run);
  *  - two or more: each track with at least NAME_TRACK_MIN_SEC of its own audio is
- *    named by the voiceprint on that audio;
- *  - a shorter track takes the chunk's voiceprint when it is the dominant track,
- *    otherwise the client's label when that is a real name different from the
- *    dominant one, otherwise Ext. A name is never invented and the voiceprint's
- *    own thresholds decide every name it gives.
+ *    named by the voiceprint on that audio; a shorter dominant track takes the
+ *    chunk's voiceprint; any other short track is Ext;
+ *  - in a split chunk the WEARER is named only at owner-verify confidence
+ *    (OWNER_VERIFY_SIMILARITY). A full search can return the wearer from 0.55,
+ *    and the client's label is the glasses' default wearer label, not identity
+ *    evidence: on 2026-10-02 both named other people (Jeremy, Kyle) as the
+ *    wearer. Either becomes Ext and is counted (`ownerGuard`).
+ * A name is never invented.
  * The segments' texts joined with one space equal `text` exactly.
  */
 export function nameChunkSegments(input: LiveNamingInput): LiveNamingResult {
@@ -139,6 +149,7 @@ export function nameChunkSegments(input: LiveNamingInput): LiveNamingResult {
   const used = new Set(labels)
 
   const names = new Map<number, VoiceprintResult>()
+  const ownerGuard = { client_label: 0, weak_owner: 0 }
   let identified = 0
   const pcm = readPcm16Mono(input.audio)
   const ordered = tracks.filter(track => used.has(track.channel))
@@ -146,16 +157,25 @@ export function nameChunkSegments(input: LiveNamingInput): LiveNamingResult {
   if (ordered.length === 1) {
     names.set(ordered[0].channel, input.chunkVoiceprint)
   } else {
+    const owner = input.owner?.trim() || null
+    const ownerSafe = (named: VoiceprintResult): VoiceprintResult => {
+      if (!owner || named.speaker !== owner || named.similarity >= OWNER_VERIFY_SIMILARITY) return named
+      ownerGuard[named.similarity > 0 ? 'weak_owner' : 'client_label']++
+      return { speaker: 'Ext', similarity: 0 }
+    }
     for (const track of ordered) {
       if (track.exclusiveSec >= NAME_TRACK_MIN_SEC && pcm) {
         const wav = exclusiveTrackWav(activity, track.channel, pcm)
         const named = wav ? input.identify(wav) : null
-        if (named) { names.set(track.channel, named); identified++; continue }
+        if (named) { names.set(track.channel, ownerSafe(named)); identified++; continue }
       }
-      if (track.channel === dominant) { names.set(track.channel, input.chunkVoiceprint); continue }
+      if (track.channel === dominant) { names.set(track.channel, ownerSafe(input.chunkVoiceprint)); continue }
+      // The client's label is the glasses' default wearer label, not evidence of
+      // who this voice is (6.61.0 named Jeremy Sokolic as MU through it).
       const dominantName = names.get(dominant)?.speaker ?? input.chunkVoiceprint.speaker
       const client = input.clientSpeaker.trim()
-      names.set(track.channel, { speaker: isRealLabel(client) && client !== dominantName ? client : 'Ext', similarity: 0 })
+      if (isRealLabel(client) && client !== dominantName) ownerGuard.client_label++
+      names.set(track.channel, { speaker: 'Ext', similarity: 0 })
     }
   }
 
@@ -196,7 +216,7 @@ export function nameChunkSegments(input: LiveNamingInput): LiveNamingResult {
   let best = -1
   for (const [name, sec] of voiced) if (sec > best) { best = sec; speaker = name }
   const similarity = [...names.values()].find(named => named.speaker === speaker)?.similarity ?? 0
-  return { ok: true, speaker, similarity: round(similarity, 3), segments, tracks: tracks.length, timing, identified }
+  return { ok: true, speaker, similarity: round(similarity, 3), segments, tracks: tracks.length, timing, identified, ownerGuard }
 }
 
 /**
@@ -244,6 +264,8 @@ export interface LiveLabelInput {
   audio: Buffer
   voiceprint: VoiceprintResult
   clientSpeaker: string
+  /** The wearer's label, for the owner guard on split chunks. */
+  owner?: string | null
   identify: (wav: Buffer) => VoiceprintResult | null
   clock?: () => number
 }
@@ -260,10 +282,12 @@ export interface LiveLabels {
     tracks?: number
     timing?: 'words' | 'estimated'
     ms?: number
+    /** 6.61.1: would-be wearer names refused in this chunk (client_label, weak_owner). */
+    ownerGuard?: string[]
   }
   /** What NemotronLiveRuntime.record should log; absent when the voiceprint was chosen by config. */
   record?:
-    | { outcome: 'nemotron'; ms: number; segments: number; tracks: number; timing: string; identified: number }
+    | { outcome: 'nemotron'; ms: number; segments: number; tracks: number; timing: string; identified: number; ownerGuard?: { client_label: number; weak_owner: number } }
     | { outcome: 'voiceprint'; reason: string; ms: number | null; detail?: string }
 }
 
@@ -306,10 +330,15 @@ export async function resolveLiveLabels(input: LiveLabelInput): Promise<LiveLabe
       audio: input.audio,
       chunkVoiceprint: input.voiceprint,
       clientSpeaker: input.clientSpeaker,
+      owner: input.owner,
       identify: input.identify,
     })
     if (!named.ok) return voiceprintOnly(named.reason, ms)
     const changed = named.speaker !== input.voiceprint.speaker
+    const guarded = [
+      ...Array(named.ownerGuard.client_label).fill('client_label'),
+      ...Array(named.ownerGuard.weak_owner).fill('weak_owner'),
+    ] as string[]
     return {
       speaker: named.speaker,
       similarity: named.similarity,
@@ -320,8 +349,12 @@ export async function resolveLiveLabels(input: LiveLabelInput): Promise<LiveLabe
         timing: named.timing,
         ms,
         ...(changed ? { voiceprintSpeaker: input.voiceprint.speaker, voiceprintSimilarity: input.voiceprint.similarity } : {}),
+        ...(guarded.length ? { ownerGuard: guarded } : {}),
+      },
+      record: {
+        outcome: 'nemotron', ms, segments: named.segments.length, tracks: named.tracks, timing: named.timing, identified: named.identified,
+        ...(guarded.length ? { ownerGuard: named.ownerGuard } : {}),
       },
-      record: { outcome: 'nemotron', ms, segments: named.segments.length, tracks: named.tracks, timing: named.timing, identified: named.identified },
     }
   } catch (error) {
     return voiceprintOnly('error', ms, error instanceof Error ? error.message : String(error))
@@ -414,6 +447,8 @@ export interface LiveSnapshot {
   /** Whether the CLI binary is the v0.17.4 build the offline guarantee was verified on. */
   cliKnown: boolean | null
   chunks: { nemotron: number; voiceprint: number; reasons: Record<string, number> }
+  /** 6.61.1: would-be wearer names refused on split chunks since start. */
+  ownerGuard: { client_label: number; weak_owner: number }
   last: { at: string; outcome: 'nemotron' | 'voiceprint'; reason: string | null; ms: number | null } | null
 }
 
@@ -440,6 +475,7 @@ export class NemotronLiveRuntime {
   private modelsDir: string | null = null
   private identity: { path: string; sha256: string; known: boolean } | null = null
   private counts = { nemotron: 0, voiceprint: 0, reasons: {} as Record<string, number> }
+  private ownerGuard = { client_label: 0, weak_owner: 0 }
   private recent: Array<{ outcome: 'nemotron' | 'voiceprint'; reason: string | null }> = []
   private last: LiveSnapshot['last'] = null
   private lastStateLog: string | null = null
@@ -605,7 +641,7 @@ export class NemotronLiveRuntime {
 
   /** Record one chunk's outcome. Run failures are logged per chunk; state reasons once per change. */
   record(chunk: { sessionId: string; chunkIndex: number }, outcome:
-    | { outcome: 'nemotron'; ms: number; segments: number; tracks: number; timing: string; identified: number }
+    | { outcome: 'nemotron'; ms: number; segments: number; tracks: number; timing: string; identified: number; ownerGuard?: { client_label: number; weak_owner: number } }
     | { outcome: 'voiceprint'; reason: string; ms: number | null; detail?: string },
   ): void {
     const at = new Date(this.now()).toISOString()
@@ -615,6 +651,12 @@ export class NemotronLiveRuntime {
       this.pushRecent('nemotron', null)
       this.lastStateLog = null
       this.log(`[diarizer] chunk #${chunk.chunkIndex} nemotron ${outcome.ms} ms tracks=${outcome.tracks} segments=${outcome.segments} timing=${outcome.timing} named=${outcome.identified}`)
+      const guard = outcome.ownerGuard
+      if (guard && guard.client_label + guard.weak_owner > 0) {
+        this.ownerGuard.client_label += guard.client_label
+        this.ownerGuard.weak_owner += guard.weak_owner
+        this.log(`[diarizer] owner-guard chunk #${chunk.chunkIndex} refused=${guard.client_label + guard.weak_owner} client_label=${guard.client_label} weak_owner=${guard.weak_owner}`)
+      }
       return
     }
     this.counts.voiceprint++
@@ -676,6 +718,7 @@ export class NemotronLiveRuntime {
       warm: { state: this.state, ms: this.warmMs, loadSec: this.warmLoadSec, error: this.warmError },
       cliKnown: this.identity ? this.identity.known : null,
       chunks: { nemotron: this.counts.nemotron, voiceprint: this.counts.voiceprint, reasons: { ...this.counts.reasons } },
+      ownerGuard: { ...this.ownerGuard },
       last: this.last,
     }
   }

package/server/lib/permission-broker.ts

@@ -16,7 +16,7 @@
 // exactly as if no hook existed. Every path here that is not an answer ends in `{}`.
 //
 // ---------------------------------------------------------------------------
-// WHAT GETS PARKED (Miles's Q3 and Q4, 2026-09-19): away AND wearing
+// WHAT GETS PARKED (Miles's Q3 and Q4, 2026-09-19): away AND recently present
 // ---------------------------------------------------------------------------
 // The hook has no matcher, so every permission request at an idle desk reaches the route.
 // Everything outside the gate answers `{}` at once (target: under 100 ms). A request is
@@ -67,10 +67,12 @@
 //     2026-09-30 19:54: "Hold only if the glasses or phone were connected in the last 30
 //     min. A Claude Remote Control session with no glasses gets its question right away,
 //     as before."). The contract shared with COS Glasses 6.9.563 (lib/client-liveness): a
-//     poll `?client=glasses|phone&hold=1&presenceAgeMs=<int>`, the ms since a ring or temple
-//     input, a device status with wearing true, or a phone foreground touch. Recent means
-//     within `COS_PERMISSION_BROKER_AWAY_RECENT_CLIENT_S` (default 1800; below 30 s, the 30 s
-//     live window). A connected lens nobody wears sends no presence; an older client sends
+//     poll `?client=glasses|phone&hold=1&presenceAgeMs=<int>`, the ms since a ring, temple or
+//     lens gesture, or a phone touch while COS is in front. The worn status is never presence
+//     (Glasses 6.9.570, Miles 2026-10-02: wear detection can be turned off, and then it always
+//     reads not worn). Recent means within `COS_PERMISSION_BROKER_AWAY_RECENT_CLIENT_S`
+//     (default 1800; below 30 s, the 30 s live window). A connected lens nobody touches sends
+//     no presence; an older client sends
 //     no `hold=1` and keeps the 6.59.0 liveness, never the away hold. In memory: after a
 //     restart nothing is recent until such a poll.
 // Held that way, a request stays answerable while no client is polling, so a lens or phone
@@ -1057,7 +1059,7 @@ export class PermissionBroker {
    *   - `recent`: within the window, so the away hold may apply;
    *   - `holdLive`: a `hold=1` client polled within the live window AND its presence is
    *     recent, so it counts as a live client the way an older client's poll does. A
-   *     connected lens nobody wears never counts (QA round 1, Skeptic W1).
+   *     connected lens nobody touches never counts (QA round 1, Skeptic W1).
    */
   private presence(now: number): { ageMs: number | null; recent: boolean; holdLive: boolean; windowMs: number } {
     let ageMs: number | null = null

package/server/lib/speaker-embeddings.ts

@@ -42,6 +42,7 @@ const require = createRequire(import.meta.url)
 const __dirname = fileURLToPath(new URL('.', import.meta.url))
 
 import { DATA_DIR } from './data-dir.js'
+import { OWNER_VERIFY_SIMILARITY } from './voiceprint-floor.js'
 
 export const SPEAKER_MODEL_FILENAME = '3dspeaker_speech_eres2net_sv_en_voxceleb_16k.onnx'
 
@@ -86,7 +87,7 @@ const PROFILES_PATH = resolve(DATA_DIR, 'voice-profiles.json')
 const CALIBRATION_LOG = resolve(DATA_DIR, 'speaker-calibration.jsonl')
 
 // Thresholds
-const VERIFY_THRESHOLD = 0.65
+const VERIFY_THRESHOLD = OWNER_VERIFY_SIMILARITY
 const SEARCH_THRESHOLD = 0.55
 /** The bar `autoEnroll` enrols at. From 6.45.4 also the bar at which a held
  *  group is offered as a person with one click ("high"): the identifier would

package/server/lib/voiceprint-floor.ts

@@ -1,4 +1,12 @@
-// The least audio the voiceprint names a voice from. One source for the
-// whole-chunk check in transcribe-stream and the per-track check in Nemotron
-// naming, so the two can never drift apart.
+// Voiceprint floors shared by every path that names a voice, so they can never
+// drift apart.
+
+/** The least audio the voiceprint names a voice from: the whole-chunk check in
+ *  transcribe-stream and the per-track check in Nemotron naming. */
 export const VOICEPRINT_MIN_AUDIO_SEC = 2.0
+
+/** The similarity at which the voiceprint verifies the WEARER (speaker-embeddings'
+ *  owner verify). A full search accepts any profile from 0.55, so a voice can come
+ *  back as the wearer between 0.55 and 0.65 without ever passing owner verify;
+ *  6.61.1 refuses that for a split track (it named other people as the wearer). */
+export const OWNER_VERIFY_SIMILARITY = 0.65

package/server/routes/meeting.ts

@@ -171,6 +171,21 @@ function cosOpsPipelineConfigured(): boolean {
   return Boolean(process.env.COS_SCRIPTS_DIR?.trim())
 }
 
+/**
+ * Why a correction left the meeting's markdown alone when it could not read it.
+ *
+ * 6.61.2: when two meetings declare the same session the lookup chooses neither
+ * and the record falls back to the capture, whose own scribe the merge retired.
+ * "Unreadable" would send the reader looking for a missing file; the real
+ * answer is the duplicate claim, so the response names it.
+ */
+function markdownUnreadableReason(operations: { mergedScribeConflict?: string[] } | null): string {
+  const conflict = operations?.mergedScribeConflict
+  return conflict && conflict.length > 1
+    ? `no merged meeting chosen: ${conflict.length} meetings declare this session (${conflict.join(', ')})`
+    : 'meeting markdown unreadable'
+}
+
 function requestedRecordMatches(requested: unknown, expected: string): boolean {
   return requested == null || requested === '' || requested === expected
 }
@@ -1331,7 +1346,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       proseHits: md?.proseHits ?? [],
       markdownSkipped: !plan.value.coveredAllWithLabel
         ? 'partial relabel: transcript turns cannot be mapped to chunk indices'
-        : markdownRaw === null ? 'meeting markdown unreadable' : null,
+        : markdownRaw === null ? markdownUnreadableReason(operations) : null,
     }
 
     if (req.body?.dryRun === true || req.body?.confirm !== true) {
@@ -1684,7 +1699,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       // markdown changes with no hint the document was never touched.
       markdownSkipped: !plan.value.coveredAllWithLabel
         ? 'partial de-attribution: transcript turns cannot be mapped to chunk indices'
-        : markdownUnreadable ? 'meeting markdown unreadable' : null,
+        : markdownUnreadable ? markdownUnreadableReason(operations) : null,
       scope: 'meeting' as const,
       chunks: plan.value.changed,
       surfaces,

package/server/routes/transcribe-stream.ts

@@ -9,7 +9,7 @@ import { chmodSync, readFileSync, writeFileSync, existsSync, lstatSync, mkdirSyn
 import { writeFile } from 'node:fs/promises'
 import { resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
-import { getVocabulary, getOwnerName } from '../lib/profile.js'
+import { getVocabulary, getOwnerName, getOwnerSpeakerLabel } from '../lib/profile.js'
 import { getOpenAIKey } from '../lib/openai-key.js'
 import { getTranscriptionPolicySnapshot, isOpenAIWhisperFallbackReady } from '../lib/transcription-policy.js'
 import { STRANDED_STALE_MS } from '../lib/stranded-sessions.js'
@@ -1908,6 +1908,11 @@ async function transcribeWithServerWhisper(audioBuffer: Buffer, whisperAudio: Bu
   }
 }
 
+/** The wearer's label for the 6.61.1 owner guard; null when the profile cannot say. */
+function ownerLabelOrNull(): string | null {
+  try { return getOwnerSpeakerLabel() } catch { return null }
+}
+
 function identifyChunkSpeaker(audioBuffer: Buffer, sessionId: string, chunkIndex: number, clientSpeaker: string): { speaker: string; similarity: number } {
   const expectedSpeakers = undefined
   const audioDurationSec = Math.max(0, (audioBuffer.length - 44)) / 32000
@@ -2155,6 +2160,7 @@ async function processStreamChunk(opts: {
         audio: audioBuffer,
         voiceprint,
         clientSpeaker,
+        owner: ownerLabelOrNull(),
         identify: wav => {
           const named = identifySpeaker(wav, undefined, { event: 'nemotron-track' })
           return named ? { speaker: named.speaker, similarity: named.similarity } : null