@gotcos/glasses-server 6.92.0 → 6.93.0

package/server/scripts/mac-voice-assignment-6930-mutation-gate.mjs

@@ -0,0 +1,225 @@
+#!/usr/bin/env node
+// 6.93.0 mutation gate: assigning a Mac recording `Voice N` to an existing voice profile (lib/mac-voice-assignment.ts and
+// its hook in the relabel route of routes/meeting.ts). Engine copied unchanged from mac-window-voices-6930-mutation-gate.mjs;
+// mutations run only in a disposable copy of the checkout.
+//
+// What it proves, in order:
+//   0. The target suites are GREEN unmutated. A gate over a red suite reads every mutant as killed and proves nothing.
+//   1. Each target string appears EXACTLY ONCE in its file, so the mutation is unambiguous.
+//   2. The mutated file differs from the original, so the edit landed.
+//   3. A NAMED test fails ("FAIL  server/x.test.ts > name"); a build error or a harness failure is not a kill.
+//   4. The file is restored byte for byte (compared) before the next mutant.
+// Usage: node server/scripts/mac-voice-assignment-6930-mutation-gate.mjs [--list] [name…]
+import { mkdtempSync, cpSync, readFileSync, writeFileSync, symlinkSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { resolve, join, dirname, basename } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { spawnSync } from 'node:child_process'
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), '../..')
+const LIB_T = ['server/lib/mac-voice-assignment.test.ts']
+const ROUTE_T = ['server/routes/meeting-mac-assign-route.test.ts']
+const G2_T = ['server/routes/meeting-relabel-route.test.ts']
+const EV_T = ['server/lib/embedding-eviction.test.ts', 'server/lib/embedding-eviction-integration.test.ts']
+const SE_T = ['server/lib/speaker-embeddings-enroll.test.ts']
+const TP_T = ['server/lib/training-audio-provenance.test.ts']
+const MERGE_T = ['server/lib/voice-profile-merge.test.ts']
+const VS_T = ['server/routes/voice-safety.test.ts']
+const ALL = [...LIB_T, ...ROUTE_T, ...G2_T, ...EV_T, ...SE_T, ...TP_T, ...MERGE_T, ...VS_T]
+const A = 'server/lib/mac-voice-assignment.ts', M = 'server/routes/meeting.ts'
+const VP = 'server/lib/voice-profile-store.ts', VR = 'server/routes/voice.ts'
+const EV = 'server/lib/embedding-eviction.ts', SE = 'server/lib/speaker-embeddings.ts', TP = 'server/lib/training-audio-provenance.ts'
+const m = (name, file, edits, tests) => ({ name, file, edits: typeof edits[0] === 'string' ? [edits] : edits, tests })
+
+const mutations = [
+  // ── Library guards: each refusal stands on its own, not only behind the route's ──
+  m('guard-not-mac', A, ["  if (!isMacCaptureSidecar(sidecar, sessionId)) return none('not_mac_capture')\n", ''], [...LIB_T, ...ROUTE_T]),
+  m('guard-voice-label', A, ["  if (!isVoiceLabel(from)) return none('not_a_voice_label')\n", ''], [...LIB_T, ...ROUTE_T]),
+  m('guard-placeholder-target', A, ["  if (isPlaceholderLabel(to)) return none('unknown_profile')\n", ''], [...LIB_T, ...ROUTE_T]),
+  m('guard-unknown-profile', A, ["  if (!profile) return none('unknown_profile')\n", ''], [...LIB_T, ...ROUTE_T]),
+  m('profile-name-case-insensitive', A, ['.find(p => p.name === to) } catch', '.find(p => p.name.toLowerCase() === to.toLowerCase()) } catch'], [...LIB_T, ...ROUTE_T]),
+  m('guard-embeddings-switch', A, ["  if (!chunkEmbeddingsEnabled()) return none('disabled')\n", ''], LIB_T),
+  m('guard-model-present', A, ["  if (!isEmbeddingAvailable()) return none('store_unavailable')\n", ''], [...LIB_T, ...ROUTE_T]),
+  m('guard-index-mapping', A, ["  if (!rawIndices) return none('no_index_mapping')\n", ''], LIB_T),
+  // ── B3: the wearer profile is never a target ──
+  m('guard-owner', A, ["  if (input.ownerLabel && sameName(to, input.ownerLabel)) return none('owner_profile')\n", ''], [...LIB_T, ...ROUTE_T]),
+  m('owner-match-case-sensitive', A, ["a.normalize('NFKC').trim().toLowerCase() === b.normalize('NFKC').trim().toLowerCase()", "a === b"], [...LIB_T, ...ROUTE_T]),
+  m('route-owner-label-not-passed', M, ['sidecar: parsedForAssign, ownerLabel })', 'sidecar: parsedForAssign })'], ROUTE_T),
+  m('route-owner-not-409', M, ["      if (macAssign.report.skipped === 'owner_profile') {", '      if (false) {'], ROUTE_T),
+  m('guard-no-stored-voice', A, ["  if (!stored) return none('no_stored_voice')\n", ''], LIB_T),
+  // ── B2: capacity (a Mac-assigned sample can only use free slots or replace its own kind) ──
+  m('guard-profile-full', A, ["  if (capacity <= 0) return none('profile_full')\n", ''], ROUTE_T),
+  m('capacity-ignores-replaceable', A, ['Math.max(0, MAX_EMBEDDINGS_PER_SPEAKER - profile.embeddings.length) + macCount)', 'Math.max(0, MAX_EMBEDDINGS_PER_SPEAKER - profile.embeddings.length))'], ROUTE_T),
+  m('selection-not-trimmed-to-room', A, ['Math.min(MAX_ENROL_PER_CORRECTION, capacity)).slice(0, capacity)', 'Math.min(MAX_ENROL_PER_CORRECTION, capacity))'], ROUTE_T),
+  m('selection-ignores-mac-cap', A, ['Math.min(MAX_ENROL_PER_CORRECTION, capacity)).slice(0, capacity)', 'MAX_ENROL_PER_CORRECTION)'], ROUTE_T),
+  // ── Which audio ──
+  m('mixed-chunk-used-whole', A, ['if (turns.length === 0 || turns.every(t => t.speaker === from)) {', 'if (true) {'], ROUTE_T),
+  m('other-voices-turns-sliced', A, ['const usable = turns.filter(t => t.speaker === from\n', 'const usable = turns.filter(t => true\n'], ROUTE_T),
+  m('slice-min-ignored', A, ['>= MAC_ASSIGN_MIN_SLICE_SEC)', '>= 0)'], ROUTE_T),
+  m('slice-min-off-by-one', A, ['export const MAC_ASSIGN_MIN_SLICE_SEC = 3.0', 'export const MAC_ASSIGN_MIN_SLICE_SEC = 2.0'], ROUTE_T),
+  m('slice-inset-removed', A, ['export const MAC_ASSIGN_SLICE_INSET_SEC = 0.15', 'export const MAC_ASSIGN_SLICE_INSET_SEC = 0'], ROUTE_T),
+  m('slice-start-inset-removed', A, ['slice: { startSec: (t.startSec as number) + MAC_ASSIGN_SLICE_INSET_SEC,', 'slice: { startSec: (t.startSec as number),'], ROUTE_T),
+  m('slice-end-inset-removed', A, ['endSec: (t.endSec as number) - MAC_ASSIGN_SLICE_INSET_SEC }', 'endSec: (t.endSec as number) }'], ROUTE_T),
+  m('final-segments-ignored', A, ['const list = Array.isArray(final) && final.length > 0 ? final : Array.isArray(live) ? live : []', 'const list = Array.isArray(live) ? live : []'], ROUTE_T),
+  m('short-chunk-not-skipped', A, ['    if (sec < VOICEPRINT_MIN_AUDIO_SEC) { report.shortSkipped += 1; continue }\n', ''], ROUTE_T),
+  m('unit-cap-ignored', A, ['const picked = spread(units, MAC_ASSIGN_MAX_UNITS)', 'const picked = units'], ROUTE_T),
+  m('spread-takes-the-first', A, ['out.push(items[Math.floor((k * items.length) / max)])', 'out.push(items[k])'], ROUTE_T),
+  m('missing-audio-not-counted', A, ['    if (!path) { report.missingAudio += 1; continue }\n', '    if (!path) continue\n'], [...LIB_T, ...ROUTE_T]),
+  m('audio-gone-reads-as-unusable', A, ["report.skipped = units.length === 0 ? 'no_usable_audio' : 'audio_not_retained'", "report.skipped = 'no_usable_audio'"], [...LIB_T, ...ROUTE_T]),
+  m('wrong-sample-rate-accepted', A, ['    if (!pcm || pcm.sampleRate !== SAMPLE_RATE) continue\n', '    if (!pcm) continue\n'], ROUTE_T),
+  // ── The same gates a glasses rename uses ──
+  m('coherence-gate-skipped', A, ['greedyDiversitySelect(cluster.members.map(m => embeddings[m]), Math.min(', 'greedyDiversitySelect(embeddings, Math.min('], ROUTE_T),
+  m('coherence-skips-not-reported', A, ['report.clusterSkipped = embeddings.length - cluster.members.length', 'report.clusterSkipped = 0'], ROUTE_T),
+  m('no-cluster-still-enrols', A, ["  if (cluster.members.length === 0) { report.skipped = 'no_usable_audio'; return { report, selected: [], stats } }\n", ''], ROUTE_T),
+  m('diversity-cap-ignored', A, ['Math.min(MAX_ENROL_PER_CORRECTION, capacity)).slice(0, capacity)', 'Infinity).slice(0, capacity)'], ROUTE_T),
+  // ── B1: similarity, counts and the three gates ──
+  m('below-floor-never-flagged', A, ['report.belowFloor = report.similarity < MERGE_SIMILARITY_FLOOR', 'report.belowFloor = false'], ROUTE_T),
+  m('below-floor-wrong-way', A, ['report.belowFloor = report.similarity < MERGE_SIMILARITY_FLOOR', 'report.belowFloor = report.similarity > MERGE_SIMILARITY_FLOOR'], ROUTE_T),
+  m('similarity-not-reported', A, ['report.similarity = Math.round(rawCosineSimilarity(voice, stored) * 1000) / 1000', 'report.similarity = null'], ROUTE_T),
+  m('floor-not-the-merge-floor', A, ['belowFloor: false, floor: MERGE_SIMILARITY_FLOOR,', 'belowFloor: false, floor: 0.5,'], ROUTE_T),
+  m('gate-below-floor-dropped', A, ["  if (report.belowFloor) report.gates.push('below_floor')\n", ''], [...LIB_T, ...ROUTE_T]),
+  m('gate-mixed-dropped', A, ["  if (report.groupSize < embeddings.length * MAC_ASSIGN_MIXED_FRACTION) report.gates.push('mixed_voice')\n", ''], [...LIB_T, ...ROUTE_T]),
+  m('gate-mixed-edge-inclusive', A, ['report.groupSize < embeddings.length * MAC_ASSIGN_MIXED_FRACTION', 'report.groupSize <= embeddings.length * MAC_ASSIGN_MIXED_FRACTION'], LIB_T),
+  m('gate-mixed-fraction-half', A, ['export const MAC_ASSIGN_MIXED_FRACTION = 2 / 3', 'export const MAC_ASSIGN_MIXED_FRACTION = 1 / 2'], [...LIB_T, ...ROUTE_T]),
+  m('gate-too-little-dropped', A, ["  if (report.groupSize < MAC_ASSIGN_MIN_UNITS && report.groupSec < MAC_ASSIGN_MIN_SINGLE_SEC) report.gates.push('too_little_audio')\n", ''], [...LIB_T, ...ROUTE_T]),
+  m('gate-too-little-or', A, ['report.groupSize < MAC_ASSIGN_MIN_UNITS && report.groupSec < MAC_ASSIGN_MIN_SINGLE_SEC', 'report.groupSize < MAC_ASSIGN_MIN_UNITS || report.groupSec < MAC_ASSIGN_MIN_SINGLE_SEC'], [...LIB_T, ...ROUTE_T]),
+  m('gate-single-seconds-lowered', A, ['export const MAC_ASSIGN_MIN_SINGLE_SEC = 6', 'export const MAC_ASSIGN_MIN_SINGLE_SEC = 5'], LIB_T),
+  m('gate-min-units-one', A, ['export const MAC_ASSIGN_MIN_UNITS = 2', 'export const MAC_ASSIGN_MIN_UNITS = 1'], [...LIB_T, ...ROUTE_T]),
+  m('group-size-not-reported', A, ['  report.groupSize = cluster.members.length\n', ''], [...LIB_T, ...ROUTE_T]),
+  m('group-seconds-wrong', A, ['report.groupSec = Math.round(cluster.members.reduce((sum, m) => sum + secs[m], 0) * 10) / 10', 'report.groupSec = Math.round(secs.reduce((sum, v) => sum + v, 0) * 10) / 10'], LIB_T),
+  // ── The route: gates refuse unless forced; force is not wider than that ──
+  m('route-gates-never-refuse', M, ['    if (macAssign && macAssign.report.gates.length > 0 && req.body?.force !== true) {', '    if (false) {'], ROUTE_T),
+  m('route-force-ignored', M, ['    if (macAssign && macAssign.report.gates.length > 0 && req.body?.force !== true) {', '    if (macAssign && macAssign.report.gates.length > 0) {'], ROUTE_T),
+  m('route-gate-reason-not-first', M, ['      const gate = macAssign.report.gates[0]\n', '      const gate = macAssign.report.gates[macAssign.report.gates.length - 1]\n'], ROUTE_T),
+  m('route-force-skips-pending-correction', M, ['    if (stalled.length > 0 && (req.body?.force !== true || macAssign)) {', '    if (stalled.length > 0 && req.body?.force !== true) {'], ROUTE_T),
+  // ── B4: capture, interleave, deadline, yield, vector reuse ──
+  m('route-capture-pre-check-dropped', M, ['      if (captureActive()) {\n        res.status(409).json({ error: \'A meeting is being recorded right now.', '      if (false) {\n        res.status(409).json({ error: \'A meeting is being recorded right now.'], ROUTE_T),
+  m('route-capture-post-check-dropped', M, ['    if (macAssign && captureActive()) {', '    if (false) {'], ROUTE_T),
+  m('route-capture-ignored-by-default-probe', M, ['(() => getTranscriptionSessionLiveness().live > 0)', '(() => false)'], ROUTE_T),
+  m('route-in-flight-not-guarded', M, ['      if (macAssignInFlight.has(sessionId)) {', '      if (false) {'], ROUTE_T),
+  m('route-in-flight-never-released', M, ['      } finally {\n        macAssignInFlight.delete(sessionId)\n      }', '      } finally {\n      }'], ROUTE_T),
+  m('route-meeting-bytes-not-rechecked', M, ['      if (sidecarAfter !== sidecarRaw || revisionAfter) {', '      if (revisionAfter) {'], ROUTE_T),
+  m('route-revision-not-rechecked', M, ['      if (sidecarAfter !== sidecarRaw || revisionAfter) {', '      if (sidecarAfter !== sidecarRaw) {'], ROUTE_T),
+  m('plan-does-not-yield', A, ['    await yieldToLoop()\n', ''], [...LIB_T, ...ROUTE_T]),
+  m('plan-deadline-ignored', A, ['    if (now() >= deadline) {', '    if (false) {'], LIB_T),
+  m('plan-deadline-not-a-refusal', A, ["      report.skipped = 'deadline'\n", ''], LIB_T),
+  m('env-deadline-unbounded', A, ['raw >= 1000 && raw <= 25_000', 'raw >= 0'], LIB_T),
+  m('vectors-not-reused', A, ['    const hit = cacheGet(key)\n', '    const hit = undefined as ReturnType<typeof cacheGet>\n'], [...LIB_T, ...ROUTE_T]),
+  m('vector-key-ignores-file', A, ['|${info.size}|${Math.round(info.mtimeMs)}|${info.ino}|${Math.round(info.ctimeMs)}`', '`'], LIB_T),
+  m('vector-key-ignores-mtime', A, ['|${Math.round(info.mtimeMs)}|${info.ino}', '|${info.ino}'], LIB_T),
+  m('vector-key-ignores-inode', A, ['|${info.ino}|${Math.round(info.ctimeMs)}`', '|${Math.round(info.ctimeMs)}`'], LIB_T),
+  m('vector-key-ignores-ctime', A, ['|${info.ino}|${Math.round(info.ctimeMs)}`', '|${info.ino}`'], LIB_T),
+  m('vector-key-ignores-slice', A, ["${unit.slice ? `${unit.slice.startSec.toFixed(3)}-${unit.slice.endSec.toFixed(3)}` : 'whole'}", "whole"], LIB_T),
+  m('apply-writes-per-sample', A, ['const result = enrollEmbeddingsBatch(plan.report.person, plan.selected.map(embedding => ({ embedding, source })))', 'const result = plan.selected.map(embedding => enrollEmbeddingsBatch(plan.report.person, [{ embedding, source }])).reduce((a, r) => ({ enrolled: a.enrolled + r.enrolled, declined: a.declined + r.declined, persisted: a.persisted && r.persisted }), { enrolled: 0, declined: 0, persisted: true })'], LIB_T),
+  // ── Commit ──
+  m('commit-ignores-refusal', A, ["  if (plan.report.skipped !== null || plan.selected.length === 0) return { ...plan.report, enrolled: 0 }\n", ''], LIB_T),
+  m('commit-source-tag', A, ['const source = `${MAC_ASSIGN_SOURCE}:${sessionId}`', 'const source = `correction:${sessionId}`'], [...LIB_T, ...ROUTE_T]),
+  m('commit-source-tag-unstamped', A, ['const source = `${MAC_ASSIGN_SOURCE}:${sessionId}`', 'const source = MAC_ASSIGN_SOURCE'], [...LIB_T, ...ROUTE_T]),
+  m('commit-store-failure-swallowed', A, ["    if (!result.persisted) return { ...plan.report, enrolled: 0, skipped: 'store_unavailable' }\n", ''], [...LIB_T, ...ROUTE_T]),
+  m('commit-counts-everything', A, ['    return { ...plan.report, enrolled: result.enrolled }', '    return { ...plan.report, enrolled: plan.selected.length }'], ROUTE_T),
+  m('plan-creates-profile-flag', A, ['person, enrolled: 0, attempted: 0, created: false,', 'person, enrolled: 0, attempted: 0, created: true as unknown as false,'], ROUTE_T),
+  // ── The relabel route ──
+  m('route-flag-always-on', M, ['    if (req.body?.assignVoiceProfile === true) {', '    if (true) {'], [...ROUTE_T, ...G2_T]),
+  m('route-flag-ignored', M, ['    if (req.body?.assignVoiceProfile === true) {', '    if (false) {'], ROUTE_T),
+  m('route-mac-only', M, ['      if (!isMacCaptureSidecar(parsedForAssign, sessionId)) {\n', '      if (false) {\n'], ROUTE_T),
+  m('route-voice-label-only', M, ['      if (!isVoiceLabel(from)) {\n        res.status(400).json({ error: \'Only an unnamed Voice N', '      if (false) {\n        res.status(400).json({ error: \'Only an unnamed Voice N'], ROUTE_T),
+  m('route-unknown-profile-404', M, ["      if (macAssign.report.skipped === 'unknown_profile') {", '      if (false) {'], ROUTE_T),
+  m('route-nothing-to-enrol-refusal', M, ['    if (macAssign && macAssign.report.skipped !== null) {', '    if (false) {'], ROUTE_T),
+  m('route-preview-hides-enrolment', M, ['        ...(macAssign ? { enrolment: macAssign.report } : {}),\n', ''], ROUTE_T),
+  m('route-preview-message', M, ['              ? `, and adding up to ${macAssign.report.enrolled} voice sample(s) to ${to}\'s profile`', '              ? ``'], ROUTE_T),
+  m('route-preview-hides-refusal-reason', M, ['              : `. Assigning is not possible: ${macAssignSkipText(macAssign.report.skipped)}. You can still rename the speaker in the transcript without adding any voice samples`', '              : \'\''], ROUTE_T),
+  m('route-apply-uses-glasses-path', M, ['    const enrolment = macAssign\n      ? commitMacVoiceAssignment(sessionId, macAssign)\n      : enrolNamedVoice(', '    const enrolment = false\n      ? commitMacVoiceAssignment(sessionId, macAssign!)\n      : enrolNamedVoice('], ROUTE_T),
+  m('route-plan-uses-renamed-sidecar', M, ['macAssign = await planMacVoiceAssignment({ sessionId, from, to, changed: plan.value.changed, sidecar: parsedForAssign, ownerLabel })', 'macAssign = await planMacVoiceAssignment({ sessionId, from, to, changed: [], sidecar: parsedForAssign, ownerLabel })'], ROUTE_T),
+  // ── B2 policy (embedding-eviction.ts) ──
+  m('mac-assign-not-assisted', EV, ["    case MAC_ASSIGN_SOURCE:\n", ''], [...EV_T, ...SE_T, ...ROUTE_T]),
+  m('mac-assign-vouches', EV, ["return head === 'manual' || head === 'fireflies' || head === 'g2-enrollment'", "return head === 'manual' || head === 'fireflies' || head === 'g2-enrollment' || head === 'mac-assign'"], EV_T),
+  m('mac-assign-is-a-correction', EV, ["return String(source ?? '').trim().toLowerCase().startsWith('correction')", "return String(source ?? '').trim().toLowerCase().startsWith('correction') || isMacAssign(source)"], EV_T),
+  m('mac-assign-evicts-others', EV, ["    if (macIdx.length > 0) {\n      return {\n        index: macIdx[0],", "    if (false) {\n      return {\n        index: macIdx[0],"], [...EV_T, ...SE_T, ...ROUTE_T]),
+  m('mac-assign-refusal-evicts-index-zero', EV, ["return { index: -1, tier: 'assisted', reason: 'profile is full and holds no Mac-assigned sample to replace, refusing the Mac-assigned sample', refuse: true }", "return { index: 0, tier: 'assisted', reason: 'profile is full and holds no Mac-assigned sample to replace, refusing the Mac-assigned sample' }"], [...EV_T, ...SE_T, ...ROUTE_T]),
+  m('mac-assign-outlives-auto', EV, ["  if (macIdx.length > 0) {\n    return {\n      index: macIdx[0],\n      tier: 'assisted',\n      reason: `dropping the oldest Mac-assigned sample", "  if (false) {\n    return {\n      index: macIdx[0],\n      tier: 'assisted',\n      reason: `dropping the oldest Mac-assigned sample"], [...EV_T, ...SE_T]),
+  m('mac-assign-evicted-only-within-assisted', EV, [[
+    "  if (macIdx.length > 0) {\n    return {\n      index: macIdx[0],\n      tier: 'assisted',\n      reason: `dropping the oldest Mac-assigned sample (${String(sources[macIdx[0]])}) before any other kind, it is the weakest evidence`,\n    }\n  }\n", ''],
+    ["    const idx = sources.findIndex(s => provenanceTier(s) === tier)", "    const idx = tier === 'assisted' && macIdx.length > 0 ? macIdx[0] : sources.findIndex(s => provenanceTier(s) === tier)"]], [...EV_T, ...SE_T]),
+  // ── 6.93.0 polish: the cap is min(10, the profile's other samples), at plan time, at write time and in a merge ──
+  m('cap-is-flat-ten', EV, ['return Math.min(MAC_ASSIGN_PROFILE_CAP, Math.max(0, sampleCount - macCount))', 'return MAC_ASSIGN_PROFILE_CAP'], [...EV_T, ...SE_T, ...LIB_T, ...ROUTE_T, ...MERGE_T]),
+  m('cap-counts-mac-as-other', EV, ['return Math.min(MAC_ASSIGN_PROFILE_CAP, Math.max(0, sampleCount - macCount))', 'return Math.min(MAC_ASSIGN_PROFILE_CAP, sampleCount)'], [...EV_T, ...SE_T, ...LIB_T, ...ROUTE_T, ...MERGE_T]),
+  m('plan-capacity-flat-ten', A, ['Math.min(macAssignCapFor(profile.embeddings.length, macCount), Math.max(0,', 'Math.min(10, Math.max(0,'], ROUTE_T),
+  m('store-guard-flat-ten', SE, ['macCount >= macAssignCapFor(profile.embeddings.length, macCount)', 'macCount >= 10'], [...SE_T, ...LIB_T]),
+  m('store-guard-not-for-mac-incoming', SE, ['const macAtCap = isMacAssign(source) && macCount >= macAssignCapFor(profile.embeddings.length, macCount)', 'const macAtCap = false'], [...SE_T, ...LIB_T]),
+  m('merge-mac-not-trimmed', VP, ['const trimmed = new Set(macKept.slice(0, Math.max(0, macKept.length - macAllowed)))', 'const trimmed = new Set<number>()'], MERGE_T),
+  m('merge-trims-newest-mac', VP, ['const trimmed = new Set(macKept.slice(0, Math.max(0, macKept.length - macAllowed)))', 'const trimmed = new Set(macKept.slice(macAllowed))'], MERGE_T),
+  m('merge-mac-cap-flat-ten', VP, ['macAssignCapFor(kept.length, macKept.length)', 'Math.min(10, kept.length)'], MERGE_T),
+  m('merge-mac-ranked-as-assisted', VP, ['isMacAssign(sources[i]) ? -1 : EVICTION_ORDER', 'false ? -1 : EVICTION_ORDER'], MERGE_T),
+  m('profiles-listing-mac-assign-uncollapsed', VR, [": source.startsWith('mac-assign:') ? 'mac-assign' : source", ': source'], VS_T),
+  m('route-finalizing-post-check-dropped', M, ['      const finalizingAfter = finalizingRefusal(sessionId)\n', '      const finalizingAfter = null as ReturnType<typeof finalizingRefusal>\n'], ROUTE_T),
+  m('deattribute-retracts-nothing', M, ['retracted = retractEmbeddingsBySource(from, s => isSampleFromSession(s, sessionId)).removed', 'retracted = 0'], ROUTE_T),
+  m('deattribute-retracts-every-sample', M, ['retracted = retractEmbeddingsBySource(from, s => isSampleFromSession(s, sessionId)).removed', 'retracted = retractEmbeddingsBySource(from, () => true).removed'], ROUTE_T),
+  m('mac-assign-cap-changed', EV, ['export const MAC_ASSIGN_PROFILE_CAP = 10', 'export const MAC_ASSIGN_PROFILE_CAP = 20'], [...EV_T, ...SE_T, ...ROUTE_T]),
+  m('mac-assign-not-retractable', TP, ["['auto:', 'correction:', 'g2-training:', 'ext-group:', 'mac-assign:']", "['auto:', 'correction:', 'g2-training:', 'ext-group:']"], [...TP_T, ...ROUTE_T]),
+  // ── 6.93.0 final: a merge never leaves an empty profile; a correction at quota runs before the Mac step ──
+  m('merge-allows-empty-profile', SE, ["if (wouldBe.mergedFrom.length > 0 && wouldBe.samplesAfter === 0) {", 'if (false) {'], MERGE_T),
+  m('merge-empty-refusal-not-409', VR, ['    if (report.refusal) {\n', '    if (false) {\n'], VS_T),
+  m('correction-quota-after-mac-step', EV, ['if (isCorrection(incomingSource) && correctionIdx.length >= correctionQuota(cap)) {', 'if (isCorrection(incomingSource) && correctionIdx.length >= correctionQuota(cap) && macIdx.length === 0) {'], [...EV_T, ...SE_T]),
+  // ── B2/B4/W8: the real store code ──
+  m('batch-writes-per-sample', SE, ['    appendEmbedding(profile, Array.from(item.embedding), item.source)\n    added++\n', '    appendEmbedding(profile, Array.from(item.embedding), item.source)\n    added++\n    writeProfileStore(store)\n'], SE_T),
+  m('batch-dedup-dropped', SE, ['    if (profile.embeddings.some(existing => rawCosineSimilarity(item.embedding, new Float32Array(existing)) > 0.95)) { declined++; continue }\n', ''], SE_T),
+  m('batch-room-not-made', SE, ['    const room = makeRoomForSample(name, profile, item.source)\n    if (!room.ok) { declined++; continue }\n', ''], SE_T),
+  m('batch-write-failure-swallowed', SE, ["    if (!writeProfileStore(store)) throw new Error('the store refused the write')\n  } catch (err: unknown) {\n    restoreProfileFromDisk(name)\n    return { enrolled: 0, declined: items.length", "    writeProfileStore(store)\n  } catch (err: unknown) {\n    restoreProfileFromDisk(name)\n    return { enrolled: 0, declined: items.length"], SE_T),
+  m('batch-failure-memory-kept', SE, ["  } catch (err: unknown) {\n    restoreProfileFromDisk(name)\n    return { enrolled: 0, declined: items.length", "  } catch (err: unknown) {\n    return { enrolled: 0, declined: items.length"], SE_T),
+  m('batch-failure-counts-enrolled', SE, ["return { enrolled: 0, declined: items.length, persisted: false, error: `Profile store write failed: ${errMsg(err)}` }\n  }\n  rebuildSpeakerInManager", "return { enrolled: added, declined: items.length, persisted: false, error: `Profile store write failed: ${errMsg(err)}` }\n  }\n  rebuildSpeakerInManager"], SE_T),
+  m('mac-cap-not-enforced', SE, ['if (profile.embeddings.length < MAX_EMBEDDINGS_PER_SPEAKER && !macAtCap) return { ok: true }', 'if (profile.embeddings.length < MAX_EMBEDDINGS_PER_SPEAKER) return { ok: true }'], SE_T),
+  m('refusal-falls-back-to-oldest', SE, ["  if (choice?.refuse) {\n", "  if (false) {\n"], SE_T),
+  m('persist-swallows-write-error', SE, ["    restoreProfileFromDisk(name)\n    throw err instanceof Error ? err : new Error(errMsg(err))\n", "    restoreProfileFromDisk(name)\n"], SE_T),
+  m('persist-ignores-refused-write', SE, ["    if (!writeProfileStore(store)) throw new Error('the store refused the write')\n  } catch (err: unknown) {\n    console.error('[speaker] Profile persist error:', errMsg(err))", "    writeProfileStore(store)\n  } catch (err: unknown) {\n    console.error('[speaker] Profile persist error:', errMsg(err))"], SE_T),
+  m('persist-failure-memory-kept', SE, ["    console.error('[speaker] Profile persist error:', errMsg(err))\n    restoreProfileFromDisk(name)\n", "    console.error('[speaker] Profile persist error:', errMsg(err))\n"], SE_T),
+  m('enroll-reports-success-after-failed-write', SE, ["    try {\n      persistProfile(name, embedding, source)\n    } catch (err: unknown) {\n      return { success: false, dim: extractor.dim, error: `Profile store write failed: ${errMsg(err)}` }\n    }\n    const updatedStore", "    try {\n      persistProfile(name, embedding, source)\n    } catch (err: unknown) {\n    }\n    const updatedStore"], SE_T),
+  m('enroll-reports-success-after-failed-write-new', SE, ["  // Persist to disk with provenance\n  try {\n    persistProfile(name, embedding, source)\n  } catch (err: unknown) {\n    return { success: false, dim: extractor.dim, error: `Profile store write failed: ${errMsg(err)}` }\n  }", "  // Persist to disk with provenance\n  try {\n    persistProfile(name, embedding, source)\n  } catch (err: unknown) {\n  }"], SE_T),
+  m('restore-leaves-phantom-speaker', SE, ["    else if (manager?.contains(name)) manager.remove(name)\n", ''], SE_T),
+]
+
+const args = process.argv.slice(2)
+if (args.includes('--list')) { for (const { name } of mutations) console.log(name); process.exit(0) }
+const selected = args.length ? mutations.filter(({ name }) => args.includes(name)) : mutations
+if (args.length && selected.length !== args.length) throw new Error('Unknown mutation name in: ' + args.join(' '))
+if (new Set(mutations.map(x => x.name)).size !== mutations.length) throw new Error('Duplicate mutation name')
+
+// Record exactly which code this run proved (QA R-N1): the commit, and whether the tree matched it.
+const rev = spawnSync('git', ['-C', root, 'rev-parse', 'HEAD'], { encoding: 'utf8' }).stdout.trim()
+const modified = spawnSync('git', ['-C', root, 'status', '--porcelain', '--untracked-files=no'], { encoding: 'utf8' }).stdout.split('\n').filter(Boolean).length
+console.log(`commit ${rev || 'unknown'} (${modified ? `${modified} modified files: NOT the committed code` : 'clean tree'})`)
+const scratch = mkdtempSync(join(tmpdir(), "mac-voice-assignment-6930-mutations-"))
+try {
+  const skip = new Set(['data', 'models', 'certs', 'node_modules'])
+  cpSync(join(root, 'server'), join(scratch, 'server'), { recursive: true, filter: src => !(skip.has(basename(src)) && dirname(src) === join(root, 'server')) })
+  for (const dir of ['shared', 'work-task-runtime', 'bin', 'docs', 'memory-runtime']) cpSync(join(root, dir), join(scratch, dir), { recursive: true })
+  for (const file of ['vitest.config.ts', 'package.json', 'managed-runtime-contract.json']) cpSync(join(root, file), join(scratch, file))
+  symlinkSync(join(root, 'node_modules'), join(scratch, 'node_modules'), 'dir')
+  const run = tests => spawnSync(process.execPath, [join(root, 'node_modules/vitest/vitest.mjs'), 'run', '--maxWorkers=1', ...tests], {
+    cwd: scratch, env: { PATH: process.env.PATH, HOME: scratch, TMPDIR: process.env.TMPDIR, COS_DATA_DIR: join(scratch, 'data'), COS_PROFILE_PATH: join(scratch, 'data', 'profile.json') },
+    encoding: 'utf8', timeout: 300000,
+  })
+  const baseline = run(ALL)
+  if (baseline.status !== 0) throw new Error('Baseline failed; a gate over a red suite proves nothing:\n' + baseline.stdout + '\n' + baseline.stderr)
+  const totals = /Tests\s+(\d+) passed/.exec(baseline.stdout)
+  console.log(`baseline PASS (${totals ? totals[1] : '?'} tests in ${ALL.length} files)`)
+  let killed = 0
+  for (const { name, file, edits, tests } of selected) {
+    const target = join(scratch, file), original = readFileSync(target, 'utf8')
+    let mutated = original
+    for (const [find, replacement] of edits) {
+      if (mutated.split(find).length !== 2) throw new Error(`Mutation ${name} does not match exactly once in ${file}: ${find.slice(0, 80)}`)
+      mutated = mutated.replace(find, () => replacement)
+    }
+    if (mutated === original) throw new Error(`Mutation ${name} did not change ${file}`)
+    writeFileSync(target, mutated)
+    let result
+    try { result = run(tests) } finally { writeFileSync(target, original) }
+    if (readFileSync(target, 'utf8') !== original) throw new Error(`Restore failed for ${file} after ${name}`)
+    const output = result.stdout + '\n' + result.stderr
+    const killers = [...new Set([...output.matchAll(/FAIL\s+(server\/\S+\.test\.ts > [^\n]+)/g)].map(x => x[1].trim()))]
+    if (result.status === 0 || result.error || !killers.length) { console.log(`${name} SURVIVED or harness failed\n${output.slice(-3000)}`); process.exitCode = 1; continue }
+    killed += 1
+    console.log(`${name} KILLED by ${killers.slice(0, 2).join(' | ')}${killers.length > 2 ? ` (+${killers.length - 2} more)` : ''}`)
+  }
+  console.log(`${killed} of ${selected.length} Mac voice assignment 6.93.0 mutations killed`)
+} finally { rmSync(scratch, { recursive: true, force: true }) }

package/server/scripts/mac-window-voices-6930-mutation-gate.mjs

@@ -0,0 +1,193 @@
+#!/usr/bin/env node
+// 6.93.0 mutation gate: live Mac window replay (lib/mac-window-voices.ts, lib/mac-window-replay.ts), its hook in
+// lib/nemotron-live.ts and the Mac chunk route. Engine copied unchanged from mac-voices-6900-mutation-gate.mjs;
+// mutations run only in a disposable copy of the checkout.
+//
+// What it proves, in order:
+//   0. The target suites are GREEN unmutated. A gate over a red suite reads every mutant as killed and proves nothing.
+//   1. Each target string appears EXACTLY ONCE in its file, so the mutation is unambiguous.
+//   2. The mutated file differs from the original, so the edit landed.
+//   3. A NAMED test fails ("FAIL  server/x.test.ts > name"); a build error or a harness failure is not a kill.
+//   4. The file is restored byte for byte (compared) before the next mutant.
+// Usage: node server/scripts/mac-window-voices-6930-mutation-gate.mjs [--list] [name…]
+import { mkdtempSync, cpSync, readFileSync, writeFileSync, symlinkSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { resolve, join, dirname, basename } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { spawnSync } from 'node:child_process'
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), '../..')
+const UNIT_T = ['server/lib/mac-window-voices.test.ts']
+const REPLAY_T = ['server/lib/mac-window-replay.test.ts']
+const LABELS_T = ['server/lib/mac-voice-labels.test.ts']
+const LIVE_T = ['server/lib/nemotron-live.test.ts']
+const FINAL_T = ['server/lib/nemotron-final-mac-voices.test.ts']
+const MAC_T = ['server/routes/mac-recording.test.ts']
+const ALL = [...UNIT_T, ...REPLAY_T, ...LABELS_T, ...LIVE_T, ...FINAL_T, ...MAC_T]
+const W = 'server/lib/mac-window-voices.ts', RP = 'server/lib/mac-window-replay.ts', L = 'server/lib/nemotron-live.ts', TS = 'server/routes/transcribe-stream.ts'
+const VL = 'server/lib/mac-voice-labels.ts', NF = 'server/lib/nemotron-final.ts'
+const m = (name, file, edits, tests) => ({ name, file, edits: typeof edits[0] === 'string' ? [edits] : edits, tests })
+
+const mutations = [
+  // ── Switch (QA B1: with every switch off a Mac recording is 6.92.0) ──
+  // Default ON (Miles 2026-10-26): unset is the window; only an explicit off (0, false, no) or COS_MAC_VOICE_LABELS off is 6.92.0.
+  m('live-default-off', VL, ["  }\n  return 'window'\n}", "  }\n  return 'off'\n}"], [...LABELS_T, ...UNIT_T, ...REPLAY_T, ...MAC_T]),
+  m('live-default-anchors', VL, ["  }\n  return 'window'\n}", "  }\n  return 'anchors'\n}"], [...LABELS_T, ...UNIT_T, ...MAC_T]),
+  m('anchors-unselectable', VL, ["  if (raw === 'anchors') return 'anchors'\n", ''], [...LABELS_T, ...UNIT_T]),
+  m('explicit-off-ignored', VL, ["  if (OFF_WORDS.includes(raw)) return 'off'\n", ''], [...LABELS_T, ...UNIT_T, ...MAC_T]),
+  // Every spelling of off is its own guard (6.93.0 added none, disable, disabled, never).
+  ...['0', 'false', 'off', 'no', 'none', 'disable', 'disabled', 'never'].map(word => {
+    const list = ['0', 'false', 'off', 'no', 'none', 'disable', 'disabled', 'never']
+    const quote = items => '[' + items.map(x => `'${x}'`).join(', ') + ']'
+    return m(`off-word-${word}-dropped`, VL, [`export const OFF_WORDS: readonly string[] = ${quote(list)}`, `export const OFF_WORDS: readonly string[] = ${quote(list.filter(x => x !== word))}`], LABELS_T)
+  }),
+  // ── W9: an unrecognised value is window and says so once ──
+  m('unrecognised-not-warned', VL, ['    warn(`[mac-voices] mac_live_voices_unrecognised', '    void(`[mac-voices] mac_live_voices_unrecognised'], LABELS_T),
+  m('unrecognised-warned-every-time', VL, ["raw !== 'window' && !warnedUnrecognised.has(raw)) {", "raw !== 'window') {"], LABELS_T),
+  m('window-value-warned', VL, ["if (raw !== '' && raw !== 'window' && !warnedUnrecognised", "if (raw !== '' && !warnedUnrecognised"], LABELS_T),
+  m('empty-value-warned', VL, ["if (raw !== '' && raw !== 'window' && !warnedUnrecognised", "if (raw !== 'window' && !warnedUnrecognised"], LABELS_T),
+  m('anchors-value-warned', VL, ["  if (raw === 'anchors') return 'anchors'\n  if (raw !==", "  if (raw !=="], LABELS_T),
+  m('explicit-off-case-sensitive', VL, ["const raw = String(env.COS_MAC_LIVE_VOICES ?? '').trim().toLowerCase()", "const raw = String(env.COS_MAC_LIVE_VOICES ?? '').trim()"], LABELS_T),
+  m('voice-labels-off-not-master', VL, ["  if (!macVoiceLabelsEnabled(env)) return 'off'\n  const raw", '  const raw'], [...LABELS_T, ...UNIT_T, ...MAC_T]),
+  m('voice-shape-unchecked', VL, ['return Array.isArray(segments) && segments.some(', 'return segments.some('], LABELS_T),
+  m('anchors-run-when-off', TS, ["macLiveVoicesMode() === 'anchors' ? {", "macLiveVoicesMode() !== 'window' ? {"], MAC_T),
+  m('anchors-run-in-window-mode', TS, ["macLiveVoicesMode() === 'anchors' ? {", "macLiveVoicesMode() !== 'off' ? {"], MAC_T),
+  m('projection-when-off', TS, ["labels.diarizer?.engine === 'nemotron' && macLiveVoicesMode() !== 'off'", "labels.diarizer?.engine === 'nemotron'"], MAC_T),
+  m('g2-takes-window', TS, ['const macWindowOn = MAC_CAPTURE_ID.test(sessionId) && macWindowVoicesEnabled()', 'const macWindowOn = macWindowVoicesEnabled()'], MAC_T),
+  m('final-restricts-without-live-voices', NF, ['const liveMap = liveNumbers.length ? mapChannelsToLiveVoices(timeline.windows, activity) : null', 'const liveMap = mapChannelsToLiveVoices(timeline.windows, activity)'], [...FINAL_T, ...MAC_T]),
+  m('final-leaves-unproven-ext', NF, ['channels = found.channels.filter(channel => !liveMap || liveMap.has(channel) || unproven.includes(channel))', 'channels = found.channels.filter(channel => !liveMap || liveMap.has(channel))'], FINAL_T),
+  m('final-numbers-contradicted-channel', NF, ['return channels.filter(channel => !claims.has(channel))', 'return channels'], FINAL_T),
+  m('final-number-collides-with-live', NF, ['let next = Math.max(...liveNumbers)', 'let next = 0'], FINAL_T),
+  // ── Carry across the boundary ──
+  m('carry-min-ignored', W, ['if (c.count < MAC_WINDOW_CARRY_MIN_FRAMES || ', 'if ('], UNIT_T),
+  m('carry-agreement-ignored', W, [' || c.count / exclusiveInOverlap.get(c.slot)! < MAC_WINDOW_CARRY_AGREEMENT) continue', ') continue'], UNIT_T),
+  m('carry-not-one-to-one', W, ['if (slotTrack.has(c.slot) || usedTracks.has(c.track)) continue', 'if (slotTrack.has(c.slot)) continue'], UNIT_T),
+  // The denominator counts untracked exclusive frames too (they are why a slot of mixed history is not carried).
+  m('untracked-not-in-denominator', W, [
+    ['      exclusiveInOverlap.set(slot, (exclusiveInOverlap.get(slot) ?? 0) + 1)\n      const track = codes[i]\n      if (track < 0) continue\n', '      const track = codes[i]\n      if (track < 0) continue\n      exclusiveInOverlap.set(slot, (exclusiveInOverlap.get(slot) ?? 0) + 1)\n'],
+  ], UNIT_T),
+  // ── The current chunk must agree (QA W1) ──
+  m('agreement-skipped', W, ['if (chunkAgreesWithSlot(window, start, length, slot, input.chunkAlone)) continue', 'if (true) continue'], UNIT_T),
+  m('agreement-without-a-view', W, ['if (!alone || alone.probs.length !== alone.frames * NEMOTRON_CHANNELS) return false', 'if (!alone) return true\n  if (alone.probs.length !== alone.frames * NEMOTRON_CHANNELS) return false'], UNIT_T),
+  m('agreement-coverage-ignored', W, ['if (covered === 0 || covered < own * MAC_WINDOW_AGREE_COVERAGE) return false', 'if (covered === 0) return false'], UNIT_T),
+  m('agreement-purity-ignored', W, ['return Math.max(...perChannel.values()) / covered >= MAC_WINDOW_AGREE_PURITY', 'return true'], UNIT_T),
+  m('withheld-slot-still-coded-tracked', W, ['slotTrack.delete(slot)\n    withheld++', 'withheld++'], UNIT_T),
+  m('silent-carried-slot-counted-as-disagreement', W, ['    if ((exclusiveNew.get(slot) ?? 0) === 0) { slotTrack.delete(slot); continue }\n', ''], UNIT_T),
+  // ── Repeated window timeouts stop the window for the capture (QA R3) ──
+  m('disable-threshold-off-by-one', RP, ['timeouts >= MAC_WINDOW_BACKOFF_TIMEOUTS && !windowDisabled.has(sessionId)', 'timeouts > MAC_WINDOW_BACKOFF_TIMEOUTS && !windowDisabled.has(sessionId)'], [...REPLAY_T, ...MAC_T]),
+  m('backoff-window-of-one', RP, ['.slice(-MAC_WINDOW_BACKOFF_OF_LAST)', '.slice(-1)'], REPLAY_T),
+  m('backoff-window-unbounded', RP, ['.slice(-MAC_WINDOW_BACKOFF_OF_LAST)', '.slice(-1000)'], REPLAY_T),
+  m('backoff-counts-non-timeout', RP, ['const timeouts = recent.filter(Boolean).length', 'const timeouts = recent.length'], REPLAY_T),
+  m('timeout-not-counted', RP, ['    noteWindowRun(input.sessionId, !outcome.ok && outcome.reason === \'timeout\', log)\n', ''], [...REPLAY_T, ...MAC_T]),
+  m('disable-logged-every-time', RP, ['timeouts >= MAC_WINDOW_BACKOFF_TIMEOUTS && !windowDisabled.has(sessionId)', 'timeouts >= MAC_WINDOW_BACKOFF_TIMEOUTS'], REPLAY_T),
+  m('route-ignores-disabled-window', TS, [' && !macWindowDisabledFor(sessionId)\n', '\n'], MAC_T),
+  // ── A re-run over the pass's own output reads the live label, not its own (QA R-N2) ──
+  m('rerun-reads-speaker', NF, ["return typeof chunk?.originalSpeaker === 'string' ? chunk.originalSpeaker : chunk?.speaker", 'return chunk?.speaker'], FINAL_T),
+  m('rerun-numbers-read-speaker', NF, ['entries.flatMap(entry => [liveLabelOf(entry.chunk), ', 'entries.flatMap(entry => [entry.chunk?.speaker, '], FINAL_T),
+  m('agreement-view-dropped', RP, ['crossed = cross(outcome.run, solo.ok ? solo.run : null, plan)', 'crossed = cross(outcome.run, null, plan)'], [...REPLAY_T, ...MAC_T]),
+  m('agreement-run-unconditional', RP, ['if (crossed.stats.carried > 0) {', 'if (true) {'], REPLAY_T),
+  m('agreement-run-failure-allowed', RP, ['crossed = cross(outcome.run, solo.ok ? solo.run : null, plan)', 'crossed = cross(outcome.run, solo.ok ? solo.run : soloOf(outcome.run, plan), plan)\n      function soloOf(run, p) { const before = p.chunks.slice(0, -1).reduce((n, c) => n + c.samples, 0); const f0 = Math.floor(before / 160); const n = run.frames - f0; return { frames: n, probs: run.probs.slice(f0 * 8, (f0 + n) * 8) } }'], REPLAY_T),
+  // ── New tracks, eviction, cap ──
+  m('new-track-despite-overlap', W, ['if (slotTrack.has(slot) || votes.has(slot) || n < MAC_WINDOW_NEW_TRACK_FRAMES) continue', 'if (slotTrack.has(slot) || n < MAC_WINDOW_NEW_TRACK_FRAMES) continue'], UNIT_T),
+  m('new-track-any-length', W, ['if (slotTrack.has(slot) || votes.has(slot) || n < MAC_WINDOW_NEW_TRACK_FRAMES) continue', 'if (slotTrack.has(slot) || votes.has(slot)) continue'], UNIT_T),
+  m('track-cap-ignored', W, ['    if (id >= MAC_WINDOW_MAX_TRACKS) { capped++; continue }\n', ''], UNIT_T),
+  m('no-eviction', W, ['state.tracks = state.tracks.filter(t => referenced.has(t.id))', 'state.tracks = state.tracks'], UNIT_T),
+  m('eviction-drops-referenced', W, ['state.tracks = state.tracks.filter(t => referenced.has(t.id))', 'state.tracks = state.tracks.filter(t => t.voice !== null)'], UNIT_T),
+  m('max-voice-ignored', W, ['      if (state.voices >= MAX_VOICE) { t.proofs.pop(); continue }\n', ''], UNIT_T),
+  // ── Proof and numbering ──
+  m('one-proof-confirms', W, ['    if (t.proofs.length >= MAC_WINDOW_PROOFS) {', '    if (t.proofs.length >= 1) {'], [...UNIT_T, ...MAC_T]),
+  m('duplicate-audio-proof', W, ['if (t.proofs.some(p => p.chunk === current.chunk || p.audioSha256 === audioSha256)) continue', 'if (t.proofs.some(p => p.chunk === current.chunk)) continue'], UNIT_T),
+  m('proof-purity-ignored', W, ['if (ex < MAC_WINDOW_PROOF_FRAMES || purity < MAC_WINDOW_PROOF_PURITY || t.voice !== null) continue', 'if (ex < MAC_WINDOW_PROOF_FRAMES || t.voice !== null) continue'], UNIT_T),
+  m('proof-any-length', W, ['if (ex < MAC_WINDOW_PROOF_FRAMES || purity < MAC_WINDOW_PROOF_PURITY || t.voice !== null) continue', 'if (purity < MAC_WINDOW_PROOF_PURITY || t.voice !== null) continue'], UNIT_T),
+  // ── Untrusted input ──
+  m('geometry-unchecked', W, ['  if (window.frames !== macWindowFrameCount(sample)) return null\n', ''], UNIT_T),
+  m('geometry-tail-fft-wrong', W, ['export const MAC_WINDOW_FFT_SAMPLES = 512', 'export const MAC_WINDOW_FFT_SAMPLES = 500'], UNIT_T),
+  m('geometry-tail-window-wrong', W, ['export const MAC_WINDOW_FRAME_SAMPLES = 400', 'export const MAC_WINDOW_FRAME_SAMPLES = 399'], UNIT_T),
+  m('geometry-hop-wrong', W, ['Math.round(MAC_AUDIO.sampleRate * NEMOTRON_FRAME_SEC)', 'Math.round(MAC_AUDIO.sampleRate * NEMOTRON_FRAME_SEC) + 1'], UNIT_T),
+  m('window-ceiling-wrong', W, ['MAC_AUDIO.sampleRate * (MAC_AUDIO.maxChunkMs / 1000)', 'MAC_AUDIO.sampleRate * (MAC_AUDIO.maxChunkMs / 1000) - 1'], UNIT_T),
+  m('values-unchecked', W, ['  for (const v of window.probs) if (!Number.isFinite(v) || v < 0 || v > 1) return null\n', ''], UNIT_T),
+  m('invalid-state-accepted', W, ['if (!validMacWindowVoices(input.state) || !SHA.test(audioSha256)', 'if (!SHA.test(audioSha256)'], UNIT_T),
+  m('voice-above-highwater', W, ['if (!isIndex(t.voice) || t.voice < 1 || t.voice > s.voices || voices.has(t.voice)', 'if (!isIndex(t.voice) || t.voice < 1 || voices.has(t.voice)'], UNIT_T),
+  m('duplicate-voice-accepted', W, ['|| t.voice > s.voices || voices.has(t.voice) ||', '|| t.voice > s.voices ||'], UNIT_T),
+  m('unproven-number-accepted', W, ['    } else if (t.proofs.length >= MAC_WINDOW_PROOFS) return false\n', '    }\n'], UNIT_T),
+  m('recent-order-unchecked', W, ['if (!r || !isIndex(r.chunk) || r.chunk <= last) return false', 'if (!r || !isIndex(r.chunk)) return false'], UNIT_T),
+  m('frame-codes-unchecked', W, ['codes.some(c => c < UNTRACKED || (c >= 0 && !ids.has(c)))', 'codes.some(c => c < UNTRACKED)'], UNIT_T),
+  m('frame-length-cap-ignored', W, ['frames.length > 64_000 || ', ''], UNIT_T),
+  // ── Plan and bounds ──
+  m('plan-bridges-gap', W, ['if (!isIndex(n) || n === 0 || total + n > MAC_WINDOW_MAX_SAMPLES) break', 'if (!isIndex(n) || n === 0 || total + n > MAC_WINDOW_MAX_SAMPLES) continue'], UNIT_T),
+  m('plan-sample-cap-ignored', W, ['if (!isIndex(n) || n === 0 || total + n > MAC_WINDOW_MAX_SAMPLES) break', 'if (!isIndex(n) || n === 0) break'], UNIT_T),
+  m('recent-unbounded', W, ['    .slice(-(MAC_WINDOW_MAX_CHUNKS - 1))\n', ''], [...UNIT_T, ...MAC_T]),
+  // ── Timeouts and fallback (QA W4) ──
+  m('window-budget-per-chunk', RP, ['const timeoutMs = liveBudgetForAudioSec(windowSec)', 'const timeoutMs = 1500'], [...REPLAY_T, ...MAC_T]),
+  m('timeout-no-fallback', RP, ["return outcome.reason === 'timeout' ? fallback('timeout', outcome.ms) : outcome", 'return outcome'], [...REPLAY_T, ...MAC_T]),
+  m('other-failures-fall-back', RP, ["return outcome.reason === 'timeout' ? fallback('timeout', outcome.ms) : outcome", "return fallback('timeout', outcome.ms)"], REPLAY_T),
+  m('geometry-no-fallback', RP, ["let crossed = cross(outcome.run, null, plan)\n    if (!crossed) return fallback('geometry', undefined)", "let crossed = cross(outcome.run, null, plan)\n    if (!crossed) return { ok: false, reason: 'bad_output' } as LiveDiarizeOutcome"], REPLAY_T),
+  m('window-timeout-trips-breaker', L, ["if (RUN_FAILURES.has(reason) && !(reason === 'timeout' && options.timeoutTripsBreaker === false)) {", 'if (RUN_FAILURES.has(reason)) {'], LIVE_T),
+  m('window-exempt-from-all-failures', L, ["if (RUN_FAILURES.has(reason) && !(reason === 'timeout' && options.timeoutTripsBreaker === false)) {", 'if (RUN_FAILURES.has(reason) && options.timeoutTripsBreaker !== false) {'], LIVE_T),
+  m('timeout-option-ignored', L, ['timeoutMs: options.timeoutMs ?? this.budget(),', 'timeoutMs: this.budget(),'], LIVE_T),
+  m('budget-not-scaled', L, ['Math.max(LIVE_BUDGET_MS, Math.ceil(LIVE_BUDGET_MS * (Number.isFinite(audioSec) ? audioSec : 0) / LIVE_BUDGET_REFERENCE_AUDIO_SEC))', 'LIVE_BUDGET_MS'], LIVE_T),
+  m('window-tripping-diarize-call', TS, ['diarizeWindow: (wavPath, timeoutMs) => nemotronLive.diarize(wavPath, { timeoutMs, timeoutTripsBreaker: false }),', 'diarizeWindow: (wavPath, timeoutMs) => nemotronLive.diarize(wavPath, { timeoutMs }),'], MAC_T),
+  // ── Telemetry (QA W8) ──
+  m('withheld-state-not-noted', TS, ['  if (macWindowWithheld) noteMacWindowWithheld(sessionId, macWindowWithheld)\n', ''], MAC_T),
+  m('withheld-noted-every-chunk', RP, ['  if (seenWithheld.has(key)) return\n', ''], REPLAY_T),
+  m('window-line-not-logged', RP, ['    log(`[mac-window] chunk #${input.chunkIndex} window ${plan.chunks.length} chunks', '    void (`[mac-window] chunk #${input.chunkIndex} window ${plan.chunks.length} chunks'], REPLAY_T),
+  // ── I/O half and route ──
+  m('restart-after-voice-labels', RP, ["  return chunks.some(chunkShowsVoiceLabel) ? 'earlier_voice_labels' : null\n", '  return null\n'], [...REPLAY_T, ...MAC_T]),
+  m('corrupt-state-accepted', RP, ["return validMacWindowVoices(saved) ? null : 'corrupt_state'", 'return null'], [...REPLAY_T, ...MAC_T]),
+  m('corrupt-state-restarted', RP, [
+    ['  if (macWindowWithheldReason(saved, chunks)) return null\n', "  if (macWindowWithheldReason(saved, chunks) === 'earlier_voice_labels') return null\n"],
+    ['return saved === undefined ? emptyMacWindowVoices() : saved as MacWindowVoiceState', 'return saved === undefined || !validMacWindowVoices(saved) ? emptyMacWindowVoices() : saved as MacWindowVoiceState'],
+  ], [...REPLAY_T, ...MAC_T]),
+  m('window-wav-kept', RP, ['  let cleaned = false\n  const cleanup = () => {\n    if (cleaned) return\n    cleaned = true\n', '  let cleaned = false\n  const cleanup = () => {\n    if (cleaned || true) return\n    cleaned = true\n'], [...REPLAY_T, ...MAC_T]),
+  m('channel-label-dropped', L, ['    if (label && isVoiceLabel(label)) names.set(track.channel, { speaker: label, similarity: 0 })\n  } else if (input.anonymousVoice', '  } else if (input.anonymousVoice'], MAC_T),
+  m('voice-overwrites-name', L, ['    if (current && isRealLabel(current.speaker)) continue\n    const label = input.anonymousChannel(track.channel)', '    const label = input.anonymousChannel(track.channel)'], MAC_T),
+  m('window-state-not-committed', TS, ['  if (macWindowNext !== undefined) session.macWindowVoices = macWindowNext\n', ''], MAC_T),
+  m('window-state-not-persisted', TS, ['      ...(session.macWindowVoices !== undefined ? { macWindowVoices: session.macWindowVoices } : {}),\n', ''], MAC_T),
+]
+
+const args = process.argv.slice(2)
+if (args.includes('--list')) { for (const { name } of mutations) console.log(name); process.exit(0) }
+const selected = args.length ? mutations.filter(({ name }) => args.includes(name)) : mutations
+if (args.length && selected.length !== args.length) throw new Error('Unknown mutation name in: ' + args.join(' '))
+if (new Set(mutations.map(x => x.name)).size !== mutations.length) throw new Error('Duplicate mutation name')
+
+// Record exactly which code this run proved (QA R-N1): the commit, and whether the tree matched it.
+const rev = spawnSync('git', ['-C', root, 'rev-parse', 'HEAD'], { encoding: 'utf8' }).stdout.trim()
+const modified = spawnSync('git', ['-C', root, 'status', '--porcelain', '--untracked-files=no'], { encoding: 'utf8' }).stdout.split('\n').filter(Boolean).length
+console.log(`commit ${rev || 'unknown'} (${modified ? `${modified} modified files: NOT the committed code` : 'clean tree'})`)
+const scratch = mkdtempSync(join(tmpdir(), 'mac-window-voices-6930-mutations-'))
+try {
+  const skip = new Set(['data', 'models', 'certs', 'node_modules'])
+  cpSync(join(root, 'server'), join(scratch, 'server'), { recursive: true, filter: src => !(skip.has(basename(src)) && dirname(src) === join(root, 'server')) })
+  for (const dir of ['shared', 'work-task-runtime', 'bin', 'docs', 'memory-runtime']) cpSync(join(root, dir), join(scratch, dir), { recursive: true })
+  for (const file of ['vitest.config.ts', 'package.json', 'managed-runtime-contract.json']) cpSync(join(root, file), join(scratch, file))
+  symlinkSync(join(root, 'node_modules'), join(scratch, 'node_modules'), 'dir')
+  const run = tests => spawnSync(process.execPath, [join(root, 'node_modules/vitest/vitest.mjs'), 'run', '--maxWorkers=1', ...tests], {
+    cwd: scratch, env: { PATH: process.env.PATH, HOME: scratch, TMPDIR: process.env.TMPDIR, COS_DATA_DIR: join(scratch, 'data'), COS_PROFILE_PATH: join(scratch, 'data', 'profile.json') },
+    encoding: 'utf8', timeout: 300000,
+  })
+  const baseline = run(ALL)
+  if (baseline.status !== 0) throw new Error('Baseline failed; a gate over a red suite proves nothing:\n' + baseline.stdout + '\n' + baseline.stderr)
+  const totals = /Tests\s+(\d+) passed/.exec(baseline.stdout)
+  console.log(`baseline PASS (${totals ? totals[1] : '?'} tests in ${ALL.length} files)`)
+  let killed = 0
+  for (const { name, file, edits, tests } of selected) {
+    const target = join(scratch, file), original = readFileSync(target, 'utf8')
+    let mutated = original
+    for (const [find, replacement] of edits) {
+      if (mutated.split(find).length !== 2) throw new Error(`Mutation ${name} does not match exactly once in ${file}: ${find.slice(0, 80)}`)
+      mutated = mutated.replace(find, () => replacement)
+    }
+    if (mutated === original) throw new Error(`Mutation ${name} did not change ${file}`)
+    writeFileSync(target, mutated)
+    let result
+    try { result = run(tests) } finally { writeFileSync(target, original) }
+    if (readFileSync(target, 'utf8') !== original) throw new Error(`Restore failed for ${file} after ${name}`)
+    const output = result.stdout + '\n' + result.stderr
+    const killers = [...new Set([...output.matchAll(/FAIL\s+(server\/\S+\.test\.ts > [^\n]+)/g)].map(x => x[1].trim()))]
+    if (result.status === 0 || result.error || !killers.length) { console.log(`${name} SURVIVED or harness failed\n${output.slice(-3000)}`); process.exitCode = 1; continue }
+    killed += 1
+    console.log(`${name} KILLED by ${killers.slice(0, 2).join(' | ')}${killers.length > 2 ? ` (+${killers.length - 2} more)` : ''}`)
+  }
+  console.log(`${killed} of ${selected.length} Mac window replay 6.93.0 mutations killed`)
+} finally { rmSync(scratch, { recursive: true, force: true }) }