@gotcos/glasses-server 6.91.1 → 6.93.0

package/server/lib/nemotron-live.ts

@@ -85,6 +85,14 @@ export interface LiveNamingInput {
   /** The wearer's label (`owner_speaker_label`), for the owner guard. */
   owner?: string | null
   identify: (wav: Buffer) => VoiceprintResult | null
+  /** Mac-only capture-local continuity; never an identity or a channel ID. */
+  anonymousVoice?: (wav: Buffer) => string | null
+  /**
+   * 6.93.0 window replay (mac-window-voices.ts): the confirmed `Voice N` for an
+   * activity channel, already carried across chunk boundaries, or null. When set it
+   * replaces `anonymousVoice`; a real name from `identify` still wins.
+   */
+  anonymousChannel?: (channel: number) => string | null
 }
 
 export type LiveNamingResult =
@@ -122,7 +130,7 @@ function isRealLabel(label: string): boolean {
  *  - in a split chunk the WEARER is named only at owner-verify confidence
  *    (OWNER_VERIFY_SIMILARITY). A full search can return the wearer from 0.55,
  *    and the client's label is the glasses' default wearer label, not identity
- *    evidence: on 2026-10-02 both named other people (Jeremy, Kyle) as the
+ *    evidence: on 2026-10-02 both named other people (Jasper, Corin) as the
  *    wearer. Either becomes Ext and is counted (`ownerGuard`).
  * A name is never invented.
  * The segments' texts joined with one space equal `text` exactly.
@@ -173,7 +181,7 @@ export function nameChunkSegments(input: LiveNamingInput): LiveNamingResult {
       }
       if (track.channel === dominant) { names.set(track.channel, ownerSafe(input.chunkVoiceprint)); continue }
       // The client's label is the glasses' default wearer label, not evidence of
-      // who this voice is (6.61.0 named Jeremy Sokolic as MU through it).
+      // who this voice is (6.61.0 named Jasper Quillen as MU through it).
       const dominantName = names.get(dominant)?.speaker ?? input.chunkVoiceprint.speaker
       const client = input.clientSpeaker.trim()
       if (isRealLabel(client) && client !== dominantName) ownerGuard.client_label++
@@ -181,6 +189,30 @@ export function nameChunkSegments(input: LiveNamingInput): LiveNamingResult {
     }
   }
 
+  // Live anonymous labels, one of two paths (never both, window wins):
+  //  - anonymousChannel (6.93.0 window replay): every track takes the label its
+  //    channel was already proven to hold, short turns included, because the
+  //    crosswalk (not this gate) required the clean proof;
+  //  - anonymousVoice (6.92.1 anchors, below): only a clean, sufficiently long
+  //    isolated track may establish continuity; short or mixed tracks cannot
+  //    inherit the dominant chunk's anonymous identity.
+  if (input.anonymousChannel) for (const track of ordered) {
+    // The window crosswalk already required clean overlap and two clean proof
+    // chunks for this track, so a short turn by a confirmed voice keeps its label.
+    const current = names.get(track.channel)
+    if (current && isRealLabel(current.speaker)) continue
+    const label = input.anonymousChannel(track.channel)
+    if (label && isVoiceLabel(label)) names.set(track.channel, { speaker: label, similarity: 0 })
+  } else if (input.anonymousVoice && pcm) for (const track of ordered) {
+    const current = names.get(track.channel)
+    if (current && isRealLabel(current.speaker)) continue
+    if (track.exclusiveSec < NAME_TRACK_MIN_SEC || track.exclusiveSec / track.activeSec < 0.9) continue
+    const isolated = exclusiveTrackWav(activity, track.channel, pcm)
+    if (!isolated) continue
+    const label = input.anonymousVoice(isolated)
+    if (label && isVoiceLabel(label)) names.set(track.channel, { speaker: label, similarity: 0 })
+  }
+
   const segments: ChunkSpeakerSegment[] = []
   const nameOf = (channel: number): VoiceprintResult => names.get(channel) ?? input.chunkVoiceprint
   for (const run of runsOf(labels)) {
@@ -269,6 +301,10 @@ export interface LiveLabelInput {
   /** The wearer's label, for the owner guard on split chunks. */
   owner?: string | null
   identify: (wav: Buffer) => VoiceprintResult | null
+  /** Mac-only capture-local continuity; never an identity or a channel ID. */
+  anonymousVoice?: (wav: Buffer) => string | null
+  /** 6.93.0 window replay; see LiveNamingInput. */
+  anonymousChannel?: (channel: number) => string | null
   clock?: () => number
 }
 
@@ -334,6 +370,8 @@ export async function resolveLiveLabels(input: LiveLabelInput): Promise<LiveLabe
       clientSpeaker: input.clientSpeaker,
       owner: input.owner,
       identify: input.identify,
+      anonymousVoice: input.anonymousVoice,
+      anonymousChannel: input.anonymousChannel,
     })
     if (!named.ok) return voiceprintOnly(named.reason, ms)
     const changed = named.speaker !== input.voiceprint.speaker
@@ -409,6 +447,15 @@ export interface NemotronLiveDeps {
 }
 
 export const LIVE_BUDGET_MS = 1500
+/** The audio length LIVE_BUDGET_MS was sized for: one 6 s chunk (both transports cut 6 s chunks). */
+export const LIVE_BUDGET_REFERENCE_AUDIO_SEC = 6
+/**
+ * The budget for a run over `audioSec` of audio: LIVE_BUDGET_MS per reference chunk,
+ * never less than one chunk's budget. A 30 s window is five chunks' worth, not one.
+ */
+export function liveBudgetForAudioSec(audioSec: number): number {
+  return Math.max(LIVE_BUDGET_MS, Math.ceil(LIVE_BUDGET_MS * (Number.isFinite(audioSec) ? audioSec : 0) / LIVE_BUDGET_REFERENCE_AUDIO_SEC))
+}
 export const LIVE_MAX_CONCURRENT = 2
 export const WARM_TIMEOUT_MS = 180_000
 export const WARM_RETRY_DELAYS_MS = [5_000, 30_000]
@@ -600,8 +647,13 @@ export class NemotronLiveRuntime {
     return null
   }
 
-  /** Run Nemotron on one chunk WAV within the live budget. Never throws. */
-  async diarize(wavPath: string): Promise<LiveDiarizeOutcome> {
+  /**
+   * Run Nemotron on one chunk WAV within the live budget. Never throws.
+   * `timeoutMs` replaces the per-chunk budget (a longer clip). `timeoutTripsBreaker: false`
+   * keeps a timeout of THIS run out of the shared breaker (6.93.0: a window timeout has a
+   * per-chunk fallback and must not cool Nemotron for G2 and every other capture).
+   */
+  async diarize(wavPath: string, options: { timeoutMs?: number; timeoutTripsBreaker?: boolean } = {}): Promise<LiveDiarizeOutcome> {
     const blocked = this.gate()
     if (blocked) return { ok: false, reason: blocked }
     this.inFlight++
@@ -611,7 +663,7 @@ export class NemotronLiveRuntime {
         cli: this.cli!,
         modelsDir: this.modelsDir!,
         wavPath,
-        timeoutMs: this.budget(),
+        timeoutMs: options.timeoutMs ?? this.budget(),
         computeUnits: 'ane',
         niceness: 10,
         tmpRoot: this.deps.tmpRoot?.(),
@@ -621,7 +673,7 @@ export class NemotronLiveRuntime {
       return { ok: true, run }
     } catch (error) {
       const reason: LiveFallbackReason = error instanceof NemotronRunError ? error.reason : 'error'
-      if (RUN_FAILURES.has(reason)) {
+      if (RUN_FAILURES.has(reason) && !(reason === 'timeout' && options.timeoutTripsBreaker === false)) {
         this.consecutiveFailures++
         if (this.consecutiveFailures >= BREAKER_FAILURES && this.state === 'ready') {
           // The breaker (QA 6.61.0): stop spawning. Every chunk takes the voiceprint

package/server/lib/phone-recording.ts

@@ -0,0 +1,114 @@
+/** Explicit iPhone microphone provenance. Default-off future protocol; never G2 or Mac audio. */
+import { constants, closeSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { dataPath } from './data-dir.js'
+import { durableAtomicWriteFileSync } from './atomic-fs.js'
+import { macError, validateMacWav } from './mac-recording.js'
+import { readSpeakerPolicy, writeSpeakerPolicy } from './meeting-speaker-policy.js'
+import { readSttSettings } from './stt-settings.js'
+import { parakeetInstalled } from './parakeet.js'
+
+export const PHONE_SOURCE_TYPE = 'iphone_microphone' as const
+export const PHONE_CAPTURE_ID = /^phone_(?:[0-9]{13}_)?[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/
+export interface PhoneRecording { version: 1; captureId: string; sessionId: string; sourceType: typeof PHONE_SOURCE_TYPE; speakerPolicy: 'anonymous'; startTime: number; closedAt?: number }
+export function phoneMicrophoneMeetingsCapability(serverInstanceId: string | null) {
+  let reason = 'disabled'
+  if (process.env.COS_IPHONE_MICROPHONE_MEETINGS === '1') {
+    try { reason = !serverInstanceId ? 'server_identity_unavailable' : readSttSettings().hq !== 'parakeet-ultra' ? 'parakeet_not_selected' : !parakeetInstalled().installed ? 'parakeet_not_installed' : 'ready' }
+    catch { reason = 'parakeet_unavailable' }
+  }
+  return { enabled: reason === 'ready', protocolVersion: 1 as const, sourceType: PHONE_SOURCE_TYPE, speakerPolicy: 'anonymous' as const, asrModel: 'parakeet-ultra', dictionary: 'server-profile-corrections', reason }
+}
+/** Phone IDs and the new source marker must agree, including on rejected/replayed requests. */
+export function assertPhoneProvenance(id: unknown, fields: Record<string, unknown> | undefined): boolean {
+  // A repeated query key arrives as an array; it is never a phone ID and never a 500.
+  if (typeof id !== 'string') {
+    if (fields?.sourceType === PHONE_SOURCE_TYPE) throw macError(400, 'invalid_phone_capture_id', 'Invalid iPhone capture ID')
+    return false
+  }
+  const phone = id.startsWith('phone_')
+  // Anonymous is a shared speaker policy, not evidence of a phone source.
+  if (!phone && fields?.sourceType !== PHONE_SOURCE_TYPE) return false
+  if (!PHONE_CAPTURE_ID.test(id) || fields?.sourceType !== PHONE_SOURCE_TYPE || fields?.speakerPolicy !== 'anonymous') throw macError(400, 'phone_provenance_required', 'iPhone microphone capture requires its phone ID, source type and anonymous policy')
+  return true
+}
+function pathFor(id: string): string {
+  if (!PHONE_CAPTURE_ID.test(id)) throw macError(400, 'invalid_phone_capture_id', 'Invalid iPhone capture ID')
+  return join(dataPath('phone-recordings'), id + '.json')
+}
+export function readPhoneRecording(id: string): PhoneRecording | null {
+  if (!id.startsWith('phone_')) return null
+  const path = pathFor(id)
+  try {
+    if (lstatSync(path).isSymbolicLink()) throw Error('symbolic link')
+    const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK)
+    try {
+      const stat = fstatSync(fd)
+      if (!stat.isFile() || stat.size > 4096) throw Error('invalid metadata')
+      const value = JSON.parse(readFileSync(fd, 'utf8'))
+      if (value.version !== 1 || value.captureId !== id || value.sessionId !== id || value.sourceType !== PHONE_SOURCE_TYPE || value.speakerPolicy !== 'anonymous' || !Number.isSafeInteger(value.startTime) || value.startTime <= 0 || (value.closedAt !== undefined && (!Number.isSafeInteger(value.closedAt) || value.closedAt <= 0))) throw Error('invalid metadata')
+      return value
+    } finally { closeSync(fd) }
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return null
+    throw macError(409, 'phone_capture_metadata_unreadable', 'iPhone capture provenance is unreadable; audio is retained')
+  }
+}
+export function requirePhoneRecording(id: string): PhoneRecording {
+  const value = readPhoneRecording(id)
+  if (!value) throw macError(409, 'phone_capture_provenance_missing', 'iPhone capture provenance is missing; audio is retained')
+  if (readSpeakerPolicy(id).mode !== 'anonymous' || readSpeakerPolicy(id).revision === 'unreadable') throw macError(409, 'phone_capture_policy_changed', 'iPhone microphone capture is anonymous')
+  return value
+}
+export function admitPhoneRecording(id: string, startTime: number | undefined, serverInstanceId: string): PhoneRecording {
+  const capability = phoneMicrophoneMeetingsCapability(serverInstanceId)
+  if (!capability.enabled) throw macError(503, 'phone_microphone_' + capability.reason, 'iPhone microphone recording is unavailable: ' + capability.reason)
+  const prior = readPhoneRecording(id)
+  if (prior) {
+    if (prior.closedAt) throw macError(410, 'session_closed', 'Capture is already saved')
+    if (startTime !== undefined && Number(startTime) !== prior.startTime) throw macError(409, 'phone_capture_conflict', 'Capture ID already belongs to another start time')
+    return requirePhoneRecording(id)
+  }
+  // Never retroactively turn an old/unlabelled recording into a phone capture.
+  if (existsSync(dataPath('active-sessions', id + '.json')) || existsSync(dataPath('session-audio', id)) || existsSync(dataPath('meeting-audio', id)) || existsSync(dataPath('pending-batch', id)) || existsSync(dataPath('unsaved-audio', id))) throw macError(409, 'phone_capture_provenance_missing', 'Existing audio has no admitted iPhone provenance')
+  const at = Number(startTime)
+  const epoch = /^phone_([0-9]{13})_/.exec(id)?.[1]
+  if (epoch && Number(epoch) !== at) throw macError(409, 'phone_capture_conflict', 'Capture ID does not match its original start time')
+  if (!Number.isSafeInteger(at) || at <= 0 || at > Date.now() + 300000) throw macError(400, 'phone_start_time_required', 'Original iPhone capture start time required')
+  const policy = readSpeakerPolicy(id)
+  if (policy.revision !== 'unset' && policy.mode !== 'anonymous') throw macError(409, 'phone_capture_policy_conflict', 'Capture has an incompatible speaker policy')
+  if (policy.revision === 'unset') writeSpeakerPolicy(id, 'anonymous', policy.revision)
+  const value: PhoneRecording = { version: 1, captureId: id, sessionId: id, sourceType: PHONE_SOURCE_TYPE, speakerPolicy: 'anonymous', startTime: at }
+  mkdirSync(dataPath('phone-recordings'), { recursive: true, mode: 0o700 })
+  durableAtomicWriteFileSync(pathFor(id), JSON.stringify(value), { mode: 0o600 })
+  return value
+}
+export function closePhoneRecording(id: string): void {
+  const value = requirePhoneRecording(id)
+  if (!value.closedAt) durableAtomicWriteFileSync(pathFor(id), JSON.stringify({ ...value, closedAt: Date.now() }), { mode: 0o600 })
+}
+export function validatePhoneWav(audio: Buffer): number {
+  try { return validateMacWav(audio) } catch { throw macError(400, 'invalid_phone_audio', 'Expected a bounded canonical 16-kHz mono PCM16 WAV') }
+}
+/** Phone ingress numbers are canonical decimal strings, never coerced arrays, hex, exponents or blanks. */
+const PHONE_DECIMAL = /^(?:0|[1-9][0-9]{0,15})$/
+export function phoneQueryInteger(value: unknown, reason: string, message: string): number {
+  if (typeof value !== 'string' || !PHONE_DECIMAL.test(value) || !Number.isSafeInteger(Number(value))) throw macError(400, reason, message)
+  return Number(value)
+}
+/** A receipt precedes ASR so retry after decode failure cannot overwrite accepted raw audio. */
+export function persistPhoneChunkReceipt(id: string, chunkIndex: number, audioSha256: string, elapsed: number, durationMs: number): void {
+  requirePhoneRecording(id)
+  const dir = dataPath('phone-recording-chunks', id), path = join(dir, chunkIndex + '.json')
+  const value = { chunkIndex, audioSha256, elapsed, durationMs }
+  try {
+    const stat = lstatSync(path)
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1024) throw Error('invalid receipt')
+    if (JSON.stringify(JSON.parse(readFileSync(path, 'utf8'))) !== JSON.stringify(value)) throw Error('conflict')
+    return
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw macError(409, 'phone_chunk_conflict', 'Chunk index holds different audio/timing or unreadable metadata')
+  }
+  mkdirSync(dir, { recursive: true, mode: 0o700 })
+  durableAtomicWriteFileSync(path, JSON.stringify(value), { mode: 0o600 })
+}

package/server/lib/prompt-edit.ts

@@ -1,5 +1,13 @@
 import { spawn } from 'node:child_process'
+import { existsSync, mkdirSync, readFileSync } from 'node:fs'
+import { dirname } from 'node:path'
 import { claudeKeySecretsGuardArgs } from './key-secrets-guard.js'
+import { runClaudeText } from './claude-text-runner.js'
+import { createBreaker } from './claude-circuit.js'
+import { readSwitch } from './env-switch.js'
+import { atomicWriteFileSync } from './atomic-fs.js'
+import { dataPath } from './data-dir.js'
+import { localDay } from './dictation-polish-budget.js'
 
 export const PROMPT_EDIT_DRAFT_MAX_CHARS = 24_000
 export const PROMPT_EDIT_INSTRUCTION_MAX_CHARS = 2_000
@@ -178,17 +186,90 @@ export function spawnClaudeText(prompt: string, opts: SpawnClaudeTextOptions = {
   })
 }
 
+export const PROMPT_EDIT_SYSTEM_PROMPT = 'You revise dictated prompt drafts. Output only the revised prompt text.'
+export const promptEditModel = (env: NodeJS.ProcessEnv = process.env) => env.COS_PROMPT_EDIT_MODEL || 'sonnet'
+
+/**
+ * G2's prompt edit (POST /api/prompt-edit). 6.92.0: through the isolated text runner
+ * (claude-text-runner.ts: no tools, MCP, hooks or session, a scratch directory), with the same
+ * model, effort and 45 s timeout settings as before.
+ */
 export async function applyPromptEdit(input: PromptEditInput, signal?: AbortSignal): Promise<string> {
-  return spawnClaudeText(buildPromptEditPrompt(input), {
-    model: process.env.COS_PROMPT_EDIT_MODEL || 'sonnet',
+  return runClaudeText(buildPromptEditPrompt(input), {
+    model: promptEditModel(),
     effort: process.env.COS_PROMPT_EDIT_EFFORT || 'low',
     timeoutMs: Number.parseInt(process.env.COS_PROMPT_EDIT_TIMEOUT_MS || '45000', 10),
-    systemPrompt: 'You revise dictated prompt drafts. Output only the revised prompt text.',
+    systemPrompt: PROMPT_EDIT_SYSTEM_PROMPT,
     label: 'Prompt edit',
     signal,
   })
 }
 
+// ── 6.92.0 (plan r3, A-W0b): how prompt edit stops ───────────────────
+//
+// Every `claude -p` caller answers how it stops. Prompt edit had no answer through 6.91.1:
+// - master switch: COS_PROMPT_EDIT (readSwitch; on by default, 0/false/off answers 503);
+// - daily cap: COS_PROMPT_EDIT_DAILY_CAP (default 200 a local day) in its OWN counter file, never
+//   the dictation polish counter, so editing a prompt never spends Mac dictation's budget;
+// - breaker: 3 consecutive CLI failures open it for 10 minutes; a client abort is neutral;
+// - an audit row per call that ran (caller prompt_edit, codes and sizes only).
+// Refusals are text/plain bodies of 24 characters or fewer, so G2 6.10.654 renders
+// "Edit failed.\nAPI <status>: <body>" in 40 characters or fewer.
+
+export const PROMPT_EDIT_REFUSALS = {
+  cap: { status: 429, body: 'Edit limit reached' },
+  off: { status: 503, body: 'Edit is off' },
+  paused: { status: 503, body: 'Edit paused' },
+  failed: { status: 500, body: 'Edit failed' },
+} as const
+export type PromptEditRefusal = keyof typeof PROMPT_EDIT_REFUSALS
+
+export const PROMPT_EDIT_DEFAULT_DAILY_CAP = 200
+export const PROMPT_EDIT_BREAKER_FAILURES = 3
+export const PROMPT_EDIT_BREAKER_MS = 10 * 60 * 1000
+export const PROMPT_EDIT_COUNT_FILE = '.prompt_edit_count.json'
+
+export function promptEditEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
+  return readSwitch(env.COS_PROMPT_EDIT, true)
+}
+
+export function promptEditDailyCap(env: NodeJS.ProcessEnv = process.env): number {
+  const trimmed = env.COS_PROMPT_EDIT_DAILY_CAP?.trim() ?? ''
+  if (!/^\d+$/.test(trimmed)) return PROMPT_EDIT_DEFAULT_DAILY_CAP
+  const value = Number(trimmed)
+  return value > 0 ? value : PROMPT_EDIT_DEFAULT_DAILY_CAP
+}
+
+export const promptEditBreaker = createBreaker({
+  label: 'prompt-edit', maxFailures: PROMPT_EDIT_BREAKER_FAILURES, cooldownMs: PROMPT_EDIT_BREAKER_MS,
+})
+
+const countFile = () => dataPath(PROMPT_EDIT_COUNT_FILE)
+
+export function promptEditCountToday(): number {
+  try {
+    const raw = JSON.parse(readFileSync(countFile(), 'utf8'))
+    if (raw?.date !== localDay() || !Number.isInteger(raw.count) || raw.count < 0) return 0
+    return raw.count
+  } catch { return 0 }
+}
+
+export function recordPromptEditCall(): void {
+  try {
+    const file = countFile()
+    if (!existsSync(dirname(file))) mkdirSync(dirname(file), { recursive: true })
+    atomicWriteFileSync(file, JSON.stringify({ date: localDay(), count: promptEditCountToday() + 1 }), { mode: 0o600 })
+  } catch {}
+}
+
+/** The refusal for this request, before any call, or null when the edit may run. Switch, breaker, cap. */
+export function promptEditRefusal(env: NodeJS.ProcessEnv = process.env): PromptEditRefusal | null {
+  if (!promptEditEnabled(env)) return 'off'
+  if (promptEditBreaker.isOpen()) return 'paused'
+  if (promptEditCountToday() >= promptEditDailyCap(env)) return 'cap'
+  return null
+}
+
 // ── Outbound dictation auto-clean ────────────────────────────────────
 export const AUTOCLEAN_MAX_CHARS = 8_000
 

package/server/lib/prompt-tail-guard.ts

@@ -55,7 +55,7 @@ export const TAIL_WINDOW_SEC = 10
  * no free-text tail — so it matches a sentence that IS the filler and nothing
  * that merely starts with its words. The re-validation of 2026-09-12 caught
  * `.{0,30}` tails letting "Thanks for watching the demo.", "Transcript from the
- * Silas call is in the folder." and "Subscribe me to the newsletter." through.
+ * Elliot call is in the folder." and "Subscribe me to the newsletter." through.
  * "See you later", "the end", "transcribed by" and "translated by" are
  * deliberately absent: each occurs in real dictation ("Translated by Friday."),
  * and whisper's inventions are the caption-credit shapes below. A filler this

package/server/lib/speaker-embeddings.ts

@@ -1,5 +1,5 @@
 // Speaker embedding extraction and verification using sherpa-onnx
-import { chooseEviction, tierBreakdown } from './embedding-eviction.js'
+import { chooseEviction, isMacAssign, macAssignCapFor, tierBreakdown } from './embedding-eviction.js'
 // Wraps ECAPA-TDNN model for voiceprint-based speaker classification.
 // Falls back gracefully if model is missing — amplitude classification continues.
 //
@@ -323,27 +323,8 @@ export function enrollEmbedding(name: string, embedding: Float32Array, source: s
     // dropOldestEmbedding keeps sources[] in lockstep — the old inline
     // `sources?.shift()` no-opped whenever sources was undefined or short,
     // permanently offsetting provenance from the samples it described.
-    if (profile.embeddings.length >= MAX_EMBEDDINGS_PER_SPEAKER) {
-      // Weakest PROVENANCE goes, not the oldest sample. Age is the wrong axis:
-      // four profiles at cap would lose their only human-supplied sample to
-      // FIFO while unverified attendee-metadata samples sat untouched.
-      // alignedSources is defence-in-depth here, not load-bearing: loadProfileStore
-      // already pads sources[] to match embeddings[], so a ragged array cannot
-      // reach this line (mutation-verified — swapping it for profile.sources is
-      // unobservable through this path). It is kept for any future caller that
-      // builds a profile without going through the loader, and is unit-tested
-      // directly in voice-profile-store.test.ts.
-      const choice = chooseEviction(alignedSources(profile), source, MAX_EMBEDDINGS_PER_SPEAKER)
-      const { droppedSource } = choice
-        ? dropEmbeddingAt(profile, choice.index)
-        : dropOldestEmbedding(profile)
-      console.log(
-        `[speaker] Profile full for "${name}" (${MAX_EMBEDDINGS_PER_SPEAKER}) — `
-        + `${choice ? choice.reason : 'no provenance available, dropping the oldest'} `
-        + `[dropped ${droppedSource ?? 'unknown'}, incoming ${source}]`,
-      )
-      rebuildSpeakerInManager(name, profile.embeddings)
-    }
+    const room = makeRoomForSample(name, profile, source)
+    if (!room.ok) return { success: false, dim: extractor.dim, error: room.error }
   }
 
   // Add to manager — if manager rejects (internal dedup), force via remove+readd
@@ -351,7 +332,11 @@ export function enrollEmbedding(name: string, embedding: Float32Array, source: s
   if (!added) {
     // Manager's internal dedup rejected it — force-add by rebuilding
     // Persist first so we have the complete embedding list
-    persistProfile(name, embedding, source)
+    try {
+      persistProfile(name, embedding, source)
+    } catch (err: unknown) {
+      return { success: false, dim: extractor.dim, error: `Profile store write failed: ${errMsg(err)}` }
+    }
     const updatedStore = loadProfileStore()
     const updatedProfile = updatedStore.profiles.find(p => p.name === name)
     if (updatedProfile) {
@@ -363,12 +348,99 @@ export function enrollEmbedding(name: string, embedding: Float32Array, source: s
   }
 
   // Persist to disk with provenance
-  persistProfile(name, embedding, source)
+  try {
+    persistProfile(name, embedding, source)
+  } catch (err: unknown) {
+    return { success: false, dim: extractor.dim, error: `Profile store write failed: ${errMsg(err)}` }
+  }
 
   console.log(`[speaker] Enrolled "${name}" (${extractor.dim}-dim, source: ${source})`)
   return { success: true, dim: extractor.dim }
 }
 
+/**
+ * Make room in a full profile for one incoming sample, by the provenance policy.
+ * Also enforces the per-profile cap on Mac-assigned samples (6.93.0), which can bind
+ * below the profile cap. Returns not-ok only when a Mac-assigned sample would have to
+ * displace something other than another Mac-assigned sample.
+ */
+function makeRoomForSample(name: string, profile: VoiceProfile, source: string): { ok: true } | { ok: false; error: string } {
+  const macCount = isMacAssign(source) ? alignedSources(profile).filter(s => isMacAssign(s)).length : 0
+  const macAtCap = isMacAssign(source) && macCount >= macAssignCapFor(profile.embeddings.length, macCount)
+  if (profile.embeddings.length < MAX_EMBEDDINGS_PER_SPEAKER && !macAtCap) return { ok: true }
+  // Weakest PROVENANCE goes, not the oldest sample. Age is the wrong axis:
+  // four profiles at cap would lose their only human-supplied sample to
+  // FIFO while unverified attendee-metadata samples sat untouched.
+  // alignedSources is defence-in-depth here, not load-bearing: loadProfileStore
+  // already pads sources[] to match embeddings[], so a ragged array cannot
+  // reach this line (mutation-verified — swapping it for profile.sources is
+  // unobservable through this path). It is kept for any future caller that
+  // builds a profile without going through the loader, and is unit-tested
+  // directly in voice-profile-store.test.ts.
+  const choice = chooseEviction(alignedSources(profile), source, MAX_EMBEDDINGS_PER_SPEAKER)
+  if (choice?.refuse) {
+    console.log(`[speaker] Profile "${name}" full (${profile.embeddings.length}/${MAX_EMBEDDINGS_PER_SPEAKER}): ${choice.reason} [incoming ${source}]`)
+    return { ok: false, error: 'Profile is full and holds no Mac-assigned sample to replace' }
+  }
+  const { droppedSource } = choice
+    ? dropEmbeddingAt(profile, choice.index)
+    : dropOldestEmbedding(profile)
+  console.log(
+    `[speaker] Profile full for "${name}" (${MAX_EMBEDDINGS_PER_SPEAKER}) — `
+    + `${choice ? choice.reason : 'no provenance available, dropping the oldest'} `
+    + `[dropped ${droppedSource ?? 'unknown'}, incoming ${source}]`,
+  )
+  rebuildSpeakerInManager(name, profile.embeddings)
+  return { ok: true }
+}
+
+export interface BatchEnrollItem { embedding: Float32Array; source: string }
+export interface BatchEnrollResult {
+  /** Samples that landed AND were written to disk. Zero when the write failed. */
+  enrolled: number
+  /** Samples dropped before the write (too close to an existing one, or a Mac-assigned sample with nothing it may replace). */
+  declined: number
+  /** False when the store refused or failed the single write; nothing from this batch is then in memory or on disk. */
+  persisted: boolean
+  error?: string
+}
+
+/**
+ * 6.93.0: add several samples to an EXISTING profile with ONE read-modify-write of the store.
+ * Calling `enrollEmbedding` per sample re-parsed and durably rewrote the whole store each
+ * time (about 10 MB, up to 20 times, on the event loop). Same dedup, same provenance
+ * eviction, same Mac-assigned cap. A write failure is reported, never swallowed, and the
+ * in-memory store and the speaker manager are put back to what is on disk.
+ */
+export function enrollEmbeddingsBatch(name: string, items: BatchEnrollItem[]): BatchEnrollResult {
+  if (!extractor || !manager) return { enrolled: 0, declined: items.length, persisted: false, error: 'Speaker embeddings not initialized' }
+  const store = loadProfileStore()
+  const profile = store.profiles.find(p => p.name === name)
+  if (!profile) return { enrolled: 0, declined: items.length, persisted: false, error: 'No such profile' }
+  let added = 0
+  let declined = 0
+  for (const item of items) {
+    if (profile.embeddings.some(existing => rawCosineSimilarity(item.embedding, new Float32Array(existing)) > 0.95)) { declined++; continue }
+    const room = makeRoomForSample(name, profile, item.source)
+    if (!room.ok) { declined++; continue }
+    appendEmbedding(profile, Array.from(item.embedding), item.source)
+    added++
+  }
+  if (added === 0) {
+    // Nothing was appended, but makeRoom may have rebuilt the manager; disk is still the truth.
+    return { enrolled: 0, declined, persisted: true }
+  }
+  try {
+    if (!writeProfileStore(store)) throw new Error('the store refused the write')
+  } catch (err: unknown) {
+    restoreProfileFromDisk(name)
+    return { enrolled: 0, declined: items.length, persisted: false, error: `Profile store write failed: ${errMsg(err)}` }
+  }
+  rebuildSpeakerInManager(name, profile.embeddings)
+  console.log(`[speaker] Batch-enrolled ${added} sample(s) for "${name}" (${profile.embeddings.length} total, one write)`)
+  return { enrolled: added, declined, persisted: true }
+}
+
 /** Identify speaker from WAV audio buffer.
  *  Phase 4: optionally scope search to expected attendees for fewer false positives. */
 export function identifySpeaker(
@@ -526,11 +598,17 @@ export interface MergeReport {
   samplesAfter: number
   droppedToCap: number
   refused?: { name: string; similarity: number; floor: number }[]
+  /** Set when the merge was refused because it would leave the target with no
+   *  samples at all. Nothing is written when this is present. */
+  refusal?: { code: 'merge_would_empty_profile'; message: string }
 }
 
+/** The code a merge reports when it would leave an empty profile. */
+export const MERGE_WOULD_EMPTY_PROFILE = 'merge_would_empty_profile'
+
 /**
- * Fold profiles together — two names for one person, e.g. "Luke H" and
- * "Luke Henry" at 0.843.
+ * Fold profiles together — two names for one person, e.g. "Theo M" and
+ * "Theo Marsh" at 0.843.
  *
  * Fails closed below MERGE_SIMILARITY_FLOOR unless `force`. That guard is the
  * whole safety story: a wrong merge destroys BOTH identities at once, and the
@@ -577,6 +655,21 @@ export function mergeSpeakerProfiles(
   if (refused.length > 0) report.refused = refused
   if (eligible.length === 0) return report
 
+  // A merge may never leave the target with nothing. Mac-assigned samples are
+  // trimmed to the person's other samples, so two profiles that hold only Mac
+  // samples would merge down to zero and the person would stop being recognised.
+  // Checked on a throwaway copy so a dry run and a real merge refuse identically.
+  const wouldBe = mergeProfilesInStore(
+    JSON.parse(JSON.stringify(store)) as ProfileStore, into, eligible, { cap: MAX_EMBEDDINGS_PER_SPEAKER },
+  )
+  if (wouldBe.mergedFrom.length > 0 && wouldBe.samplesAfter === 0) {
+    report.refusal = {
+      code: MERGE_WOULD_EMPTY_PROFILE,
+      message: `Merging into "${into}" would leave it with no voice samples. Nothing was changed.`,
+    }
+    return report
+  }
+
   if (options.dryRun) {
     // Report on a throwaway copy so nothing is mutated by a preview.
     const preview = JSON.parse(JSON.stringify(store)) as ProfileStore
@@ -659,6 +752,17 @@ export function extractEmbedding(wavBuffer: Buffer): Float32Array | null {
   return extractEmbeddingFromWav(wavBuffer)
 }
 
+/**
+ * Test seam: install a fake runtime (see __fixtures__/fake-speaker-runtime.ts) so the real enrolment, eviction and store-write
+ * code runs without the model. Pass null to remove it. Never called by the server.
+ */
+export function __installSpeakerRuntimeForTests(runtime: { extractor: unknown; manager: unknown } | null): void {
+  extractor = runtime ? runtime.extractor : null
+  manager = runtime ? runtime.manager : null
+  initialized = runtime !== null
+  _cachedProfileStore = null
+}
+
 /** Check if the embedding system is available */
 export function isEmbeddingAvailable(): boolean {
   return extractor !== null && manager !== null
@@ -948,7 +1052,27 @@ function invalidateProfileCache(): void {
   _cachedProfileStore = null
 }
 
-/** Persist a speaker profile to disk with provenance tracking */
+/**
+ * Put the in-memory store and the speaker manager back to what is on disk after a failed write.
+ * Without this the cache keeps samples the disk never received: `enrolled` would overstate
+ * what survives a restart, and the identifier would match on voiceprints that are not stored.
+ */
+function restoreProfileFromDisk(name: string): void {
+  invalidateProfileCache()
+  try {
+    const fresh = loadProfileStore().profiles.find(p => p.name === name)
+    if (fresh && fresh.embeddings.length > 0) rebuildSpeakerInManager(name, fresh.embeddings)
+    else if (manager?.contains(name)) manager.remove(name)
+  } catch (err: unknown) {
+    console.error(`[speaker] Could not restore "${name}" from disk after a failed write:`, errMsg(err))
+  } finally {
+    // Whatever that load saw (a store that was unreadable at that instant included) must not be pinned: the next reader reloads.
+    invalidateProfileCache()
+  }
+}
+
+/** Persist a speaker profile to disk with provenance tracking. THROWS when the store cannot be written
+ *  (6.93.0: it used to log and swallow, so `enrollEmbedding` reported success for a sample only in memory). */
 function persistProfile(name: string, embedding: Float32Array, source: string = 'manual'): void {
   try {
     const store = loadProfileStore()
@@ -960,9 +1084,11 @@ function persistProfile(name: string, embedding: Float32Array, source: string =
     }
     appendEmbedding(profile, Array.from(embedding), source)
 
-    writeProfileStore(store)
+    if (!writeProfileStore(store)) throw new Error('the store refused the write')
   } catch (err: unknown) {
     console.error('[speaker] Profile persist error:', errMsg(err))
+    restoreProfileFromDisk(name)
+    throw err instanceof Error ? err : new Error(errMsg(err))
   }
 }
 

package/server/lib/speaker-name.ts

@@ -19,7 +19,7 @@
 
 /** Longest plausible human name we will store. */
 export const MAX_SPEAKER_NAME_CHARS = 40
-/** Most words a name may have ("Maria del Carmen Ruiz" is four). */
+/** Most words a name may have ("Maria del Cora Ruiz" is four). */
 export const MAX_SPEAKER_NAME_WORDS = 4
 
 /** Words that mean "the wearer", never a third party's name. */

package/server/lib/stranded-session-actions.ts

@@ -1,3 +1,5 @@
+import { requirePhoneRecording, PHONE_SOURCE_TYPE } from './phone-recording.js'
+import { getServerInstanceId } from './server-instance-id.js'
 // What the sweeper DOES about a stranded session: draft it, then promote it.
 //
 // Two actions, deliberately asymmetric.
@@ -295,10 +297,13 @@ export async function promoteStrandedSession(
   const controller = new AbortController()
   const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? 600_000)
   try {
+    const phone = sessionId.startsWith('phone_') ? requirePhoneRecording(sessionId) : null
+    const pin = phone ? getServerInstanceId() : null
+    if (phone && !pin) return { ok: false, status: 0, reason: 'server_identity_unavailable' }
     const res = await doFetch(`http://127.0.0.1:${options.port}/api/meeting/save`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json', 'X-Cos-Token': options.token },
-      body: JSON.stringify({ sessionId, title: STRANDED_PROMOTE_TITLE }),
+      headers: { 'Content-Type': 'application/json', 'X-Cos-Token': options.token, ...(pin ? { 'X-COS-Server-Instance': pin, 'X-COS-Recording-Origin': 'stranded-sweep' } : {}) },
+      body: JSON.stringify({ sessionId, title: STRANDED_PROMOTE_TITLE, ...(phone ? { sourceType: PHONE_SOURCE_TYPE, speakerPolicy: 'anonymous' } : {}) }),
       signal: controller.signal,
     })
     let payload: Record<string, unknown> = {}