@gotcos/glasses-server 6.92.0 → 6.93.0

package/server/routes/meeting.ts

@@ -1,3 +1,5 @@
+import { dataPath } from '../lib/data-dir.js'
+import { PHONE_CAPTURE_ID, PHONE_SOURCE_TYPE, assertPhoneProvenance, readPhoneRecording, requirePhoneRecording, closePhoneRecording } from '../lib/phone-recording.js'
 import { MAC_CAPTURE_ID, readMacRecording, requireMacRecording, macChunkReceipt, closeMacRecording } from '../lib/mac-recording.js'
 import { readSpeakerPolicy, writeSpeakerPolicy, isSpeakerMode } from '../lib/meeting-speaker-policy.js'
 // POST /api/meeting/save — finalize an existing transcribe-stream session into
@@ -42,6 +44,8 @@ import {
 } from '../lib/meeting-audio-archive.js'
 import { readVoiceProfiles, retractEmbeddingsBySource } from '../lib/speaker-embeddings.js'
 import { enrolNamedVoice } from '../lib/meeting-relabel-enrolment.js'
+import { commitMacVoiceAssignment, planMacVoiceAssignment, type MacAssignGate, type MacAssignPlan, type MacAssignSkip } from '../lib/mac-voice-assignment.js'
+import { isMacCaptureSidecar, isVoiceLabel } from '../lib/mac-voice-labels.js'
 
 function requireMacRecordingForSave(sessionId: string, expectedChunkCount: unknown): void {
   try {
@@ -264,6 +268,8 @@ function defaultSessionLedger(sessionId: string): SessionLedger {
 
 export interface MeetingRouteDependencies {
   store?: MeetingStore
+  /** 6.93.0: is any meeting capture (glasses, Mac or iPhone) live right now? Assigning a Mac voice to a profile is refused while one is. */
+  captureActive?: () => boolean
   sessions?: MeetingSessionSource
   runBatch?: (
     audioDir: string,
@@ -439,7 +445,7 @@ function scheduleFinalizationJob(job: MeetingFinalizationJob, runtime: Finalizat
     // summary describes, the cleaned text. Off unless Miles turns it on.
     await runCleanupStage(runtime.transcriptCleanup, { sessionId: current.sessionId, meetingPath: current.meetingPath, sidecarPath: current.sidecarPath }, runtime.sessions)
 
-    if (cosOpsPipelineConfigured() && !MAC_CAPTURE_ID.test(current.sessionId)) {
+    if (cosOpsPipelineConfigured() && !MAC_CAPTURE_ID.test(current.sessionId) && !PHONE_CAPTURE_ID.test(current.sessionId)) {
       await handoffMeetingToOperations(current.meetingPath)
     } else {
       // Standalone: no sync_meetings.py to produce summary/topics/decisions.
@@ -452,7 +458,7 @@ function scheduleFinalizationJob(job: MeetingFinalizationJob, runtime: Finalizat
     // The capture is finished and its files are durable, so the merge engine may score it.
     // Fire-and-forget by contract: the runner queues, defers under a drain or a live
     // capture, and never throws back at the finalization path.
-    if (!MAC_CAPTURE_ID.test(current.sessionId)) triggerMeetingMergeRun('g2_finalized')
+    if (!MAC_CAPTURE_ID.test(current.sessionId) && !PHONE_CAPTURE_ID.test(current.sessionId)) triggerMeetingMergeRun('g2_finalized')
     runtime.finalizationJobs.remove(current.sessionId)
     // 6.78.0: finished, so its crash-loop count (lib/boot-resume.ts) is done.
     bootResumeGate().forget('meeting_finalization', current.sessionId)
@@ -559,7 +565,7 @@ function publicSaveResponse(saved: SavedMeeting, replayed = false): Record<strin
     : 100
   return {
     receiptVersion: 1,
-    ...(saved.sourceType === 'mac_system_audio' ? { sourceType: saved.sourceType, sessionId: saved.captureId, captureId: saved.captureId } : {}),
+    ...(saved.sourceType ? { sourceType: saved.sourceType, sessionId: saved.captureId, captureId: saved.captureId, ...(saved.sourceType === PHONE_SOURCE_TYPE ? { speakerPolicy: 'anonymous' } : {}) } : {}),
     serverInstanceId: getServerInstanceId(),
     saved: true,
     // Keep the build199 string field without leaking an absolute host path.
@@ -646,6 +652,31 @@ function suppliedServerPin(
   return header || secondary || null
 }
 
+const MAC_ASSIGN_SKIP_TEXT: Record<string, string> = {
+  not_mac_capture: 'this is not a Mac recording',
+  not_a_voice_label: 'only an unnamed Voice N can be assigned',
+  unknown_profile: 'that name is not an enrolled voice profile',
+  disabled: 'voice samples are switched off on this server (COS_CHUNK_EMBEDDINGS)',
+  store_unavailable: 'the speaker model is not loaded on this Mac, or the voice profile store could not be written',
+  no_index_mapping: 'this recording has no chunk index map to find its audio',
+  audio_not_retained: 'the recording audio is no longer retained (it is kept for 7 days)',
+  no_usable_audio: 'no usable audio from this voice, or the audio does not sound like one person',
+  owner_profile: 'that is the wearer profile, and a Mac recording has no wearer microphone',
+  no_stored_voice: 'that profile has no stored voice to compare against',
+  profile_full: 'that profile is full and holds no Mac-assigned sample to replace',
+  deadline: 'reading the audio took longer than the time limit; ask again to continue where it stopped',
+}
+const macAssignSkipText = (skipped: MacAssignSkip): string => (skipped && MAC_ASSIGN_SKIP_TEXT[skipped]) || String(skipped)
+
+const MAC_ASSIGN_GATE_TEXT: Record<MacAssignGate, string> = {
+  below_floor: 'this voice sounds unlike that profile (under the 0.55 floor a voice merge also refuses at)',
+  mixed_voice: 'this Voice N holds more than one voice, so the dominant one may not be the person you picked',
+  too_little_audio: 'there is too little clean audio from this voice to trust one short sample',
+}
+
+/** Meetings with an assignment plan running now. One at a time per meeting, so two requests cannot interleave their reads and writes. */
+const macAssignInFlight = new Set<string>()
+
 export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router {
   const store = deps.store ?? getMeetingStore()
   const sessions = deps.sessions ?? defaultSessionSource
@@ -656,6 +687,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
   const finalDiarize = deps.finalDiarize ?? runNemotronFinalPass
   const transcriptCleanup = deps.transcriptCleanup
   const router = Router()
+  const captureActive = deps.captureActive ?? (() => getTranscriptionSessionLiveness().live > 0)
   const savingSessions = new Set<string>()
   const stopRequests = deps.stopRequests ?? createStopRequestStore()
   setNamingSessionLiveness(id => sessions.getStartTime(id) !== null || savingSessions.has(id) || activeFinalizationJobs.has(id))
@@ -740,6 +772,14 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
   let recoveryPendingLogged = false
   router.get('/meeting/sessions/:sessionId/status', (req, res) => {
     const sessionId = String(req.params.sessionId ?? '')
+    let phoneProvenanceState: 'admitted' | 'not_admitted' | undefined
+    if (sessionId.startsWith('phone_')) {
+      try {
+        if (readPhoneRecording(sessionId)) { requirePhoneRecording(sessionId); phoneProvenanceState = 'admitted' }
+        else if (existsSync(dataPath('session-audio', sessionId)) || existsSync(dataPath('meeting-audio', sessionId)) || existsSync(dataPath('pending-batch', sessionId)) || existsSync(dataPath('active-sessions', sessionId + '.json')) || findQuarantineDir(sessionId)) requirePhoneRecording(sessionId)
+        else { assertPhoneProvenance(sessionId, req.query); phoneProvenanceState = 'not_admitted' }
+      } catch (error) { const e = error as Error & { status?: number; reason?: string }; res.status(e.status ?? 409).json({ error: e.message, reason: e.reason }); return }
+    }
     if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) {
       res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
       return
@@ -755,6 +795,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       return
     }
     const saved = store.findBySessionId(sessionId)
+    if (phoneProvenanceState === 'admitted' && readPhoneRecording(sessionId)?.closedAt && !saved) { res.status(409).json({ error: 'Saved iPhone metadata is incomplete; audio is retained', reason: 'phone_saved_metadata_unreadable' }); return }
     // 6.71.14: before durable recovery has run (a boot behind a closed or stuck
     // maintenance gate), a persisted meeting is not in memory YET, and answering
     // `missing` would tell the phone the Mac lost it. Every phone status caller
@@ -786,6 +827,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     res.set('Cache-Control', 'private, no-store')
     res.json({
       sessionId,
+      ...(phoneProvenanceState ? { sourceType: PHONE_SOURCE_TYPE, speakerPolicy: 'anonymous', provenanceState: phoneProvenanceState } : {}),
       state,
       serverInstanceId,
       receivedRanges: live.receivedRanges,
@@ -902,6 +944,10 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
       return null
     }
+    if (sessionId.startsWith('phone_')) {
+      res.status(400).json({ error: 'Stop this recording on iPhone', reason: 'phone_capture_stop_on_iphone' })
+      return null
+    }
     if (MAC_CAPTURE_ID.test(sessionId)) {
       // A Mac recording stops from Control itself; it has no glasses to ask.
       res.status(400).json({ error: 'A Mac recording stops from Record on Mac', reason: 'mac_capture' })
@@ -995,6 +1041,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
   // off screen still tells the Mac. It never closes the session and never refuses a chunk:
   // the server saves on its own only once it holds every chunk 0..finalChunkIndex.
   router.post('/meeting/sessions/:sessionId/stop', (req, res) => {
+    try { assertPhoneProvenance(String(req.params.sessionId ?? ''), req.body) } catch (error) { const e = error as Error & { status?: number; reason?: string }; res.status(e.status ?? 400).json({ error: e.message, reason: e.reason }); return }
     const sessionId = String(req.params.sessionId ?? '')
     if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) {
       res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
@@ -1109,6 +1156,9 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     try {
       // A response can be lost after both durable files were committed. Find
       // the sidecar by session ID so client retry/restart is idempotent.
+      if (sessionId.startsWith('phone_')) {
+        try { requirePhoneRecording(sessionId) } catch (error) { const failure = error as Error & { status?: number; reason?: string }; throw new MeetingStoreError(failure.message, failure.status ?? 409, failure.reason ?? 'phone_capture_provenance_missing') }
+      }
       const alreadySaved = store.findBySessionId(sessionId)
       if (alreadySaved) {
         finalizationJobs.reconcileCanonicalSidecars()
@@ -1126,6 +1176,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
         respond(200, publicSaveResponse(alreadySaved, true), true)
         return alreadySaved
       }
+      if (PHONE_CAPTURE_ID.test(sessionId) && requirePhoneRecording(sessionId).closedAt) throw new MeetingStoreError('Saved iPhone source metadata is incomplete; audio is retained', 409, 'phone_saved_metadata_unreadable')
       if (MAC_CAPTURE_ID.test(sessionId)) {
         requireMacRecordingForSave(sessionId, body?.expectedChunkCount)
       }
@@ -1176,17 +1227,18 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
         ?? chunks.map((chunk, chunkIndex) => ({ chunkIndex, chunk }))
       const startTime = sessions.getStartTime(sessionId) ?? Date.now()
       const macRecording = readMacRecording(sessionId)
+      const phoneRecording = readPhoneRecording(sessionId)
       const durationFromTimeline = macRecording
         ? macChunkReceipt(sessionId, Number(body?.expectedChunkCount) - 1)?.endElapsed ?? 0
         : chunks.reduce(
-        (maximum, chunk) => Math.max(maximum, chunk?.elapsed ?? 0),
+        (maximum, chunk) => Math.max(maximum, (chunk?.elapsed ?? 0) + (PHONE_CAPTURE_ID.test(sessionId) ? chunk?.audioDurationMs ?? 0 : 0)),
         0,
       )
       const durationMs = durationFromTimeline > 0
         ? durationFromTimeline
         : Math.max(0, Date.now() - startTime)
       const integrity = withPhoneFinalIndex(sessions.getIntegrity(sessionId), phoneFinal)
-      const needsOperations = cosOpsPipelineConfigured() && !macRecording
+      const needsOperations = cosOpsPipelineConfigured() && !macRecording && !phoneRecording
       // Standalone saves need a finalization pass too, for summary enrichment.
       // Before 6.37 a standalone save with no audio nulled the job below and
       // never reached the ops_pending slot, so enrichment could never run.
@@ -1301,7 +1353,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
         markCanonicalFinalizationState(saved.sidecarPath, finalizationJob.phase, claimPending)
       } else if (finalizationJob) {
         markCanonicalFinalizationState(saved.sidecarPath, 'complete', false)
-        if (!readMacRecording(sessionId)) triggerMeetingMergeRun('g2_finalized')
+        if (!readMacRecording(sessionId) && !PHONE_CAPTURE_ID.test(sessionId)) triggerMeetingMergeRun('g2_finalized')
         finalizationJobs.remove(sessionId)
         bootResumeGate().forget('meeting_finalization', sessionId)
         finalizationJob = null
@@ -1361,13 +1413,14 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
         res.status(400).json({ error: 'Invalid domain', reason: 'invalid_domain' })
         return
       }
+      try { assertPhoneProvenance(sessionId, body) } catch (error) { const e = error as Error & { status?: number; reason?: string }; respond(e.status ?? 400, { error: e.message, reason: e.reason }); return }
       const serverInstanceId = getServerInstanceId()
       if (!serverInstanceId) {
         res.status(503).json({ error: 'Server identity unavailable', reason: 'server_identity_unavailable' })
         return
       }
       const pin = suppliedServerPin(req, body?.serverInstanceId)
-      if (MAC_CAPTURE_ID.test(sessionId) && !pin) {
+      if ((MAC_CAPTURE_ID.test(sessionId) || PHONE_CAPTURE_ID.test(sessionId)) && !pin) {
         res.status(400).json({ error: 'Server identity pin required', reason: 'server_identity_pin_required' })
         return
       }
@@ -1376,7 +1429,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
         return
       }
       // Only the phone pins its saves (the local-first contract); the stranded sweep does not.
-      await performSave(sessionId, body, respond, pin ? 'phone' : 'client')
+      await performSave(sessionId, body, respond, pin && req.get('X-COS-Recording-Origin') !== 'stranded-sweep' ? 'phone' : 'client')
     } catch (error) {
       console.error('[meeting/save] Finalization failed:', error)
       respond(500, { error: 'Meeting save failed', reason: 'meeting_save_error' })
@@ -1829,7 +1882,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
    * Replay a recorded correction's enrolment — the retroactive path.
    *
    * WHY. Enrolment fires inside `POST /relabel`, so a voice named BEFORE that shipped
-   * has a correct transcript and no profile. Kirstyn Blum is the live case: named
+   * has a correct transcript and no profile. Wren Hale is the live case: named
    * across two meetings (60 and 109 chunks), 182 mentions in the sidecars, absent from
    * a 77-profile store. Re-running the rename cannot help — she is already a real
    * name there, so the placeholder guard correctly declines.
@@ -1847,7 +1900,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
    * refusal when unmappable, voice coherence, the diversity cap and the
    * `correction:<sessionId>` tag all apply identically. A named `from` is still
    * enrolled when `to` is a real person — that is how a wrong existing match
-   * becomes a new profile (Nick Gurney → Milo LeBaron). Placeholder targets
+   * becomes a new profile (Cole Garner → Leo Ashby). Placeholder targets
    * stay idle.
    *
    * FAILS CLOSED. Without `confirm: true` it reports what it would enrol and writes
@@ -1924,7 +1977,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     })
   })
 
-  router.post('/meeting/:sessionId/relabel', (req, res) => {
+  router.post('/meeting/:sessionId/relabel', async (req, res) => {
     res.set('Cache-Control', 'private, no-store')
     const sessionId = String(req.params.sessionId ?? '')
     if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) {
@@ -2010,6 +2063,63 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       return
     }
 
+    // 6.93.0: a Mac recording voice assigned to an EXISTING voice profile. Opt-in per
+    // request (`assignVoiceProfile: true`); without it a Mac rename stays text only.
+    // Planned BEFORE anything is written: the preview shows exactly what would be added,
+    // and a confirm that would add nothing is refused with the rename unapplied.
+    // 6.93.0: refusals first (owner, a live capture), then an async plan that yields to the
+    // event loop, then a re-check that nothing moved while it ran.
+    let macAssign: MacAssignPlan | null = null
+    if (req.body?.assignVoiceProfile === true) {
+      let parsedForAssign: Record<string, unknown> = {}
+      try {
+        const doc = JSON.parse(sidecarRaw) as unknown
+        if (doc && typeof doc === 'object' && !Array.isArray(doc)) parsedForAssign = doc as Record<string, unknown>
+      } catch { /* relabelSidecarJson already parsed it */ }
+      if (!isMacCaptureSidecar(parsedForAssign, sessionId)) {
+        res.status(400).json({ error: 'assignVoiceProfile applies to Mac recordings only; a glasses rename already trains the profile', reason: 'not_mac_capture' })
+        return
+      }
+      if (!isVoiceLabel(from)) {
+        res.status(400).json({ error: 'Only an unnamed Voice N can be assigned to a voice profile', reason: 'not_a_voice_label' })
+        return
+      }
+      // The wearer's own profile is refused inside the plan (`owner_profile`): a Mac recording has no wearer microphone, and a wrong
+      // sample there would poison owner detection. The route only has to pass the label and map the answer.
+      const ownerLabel = getOwnerSpeakerLabel()
+      // Embedding and the profile write share this server with a live recording. Never while one runs.
+      if (captureActive()) {
+        res.status(409).json({ error: 'A meeting is being recorded right now. Assign the voice after it ends, so the recording is never held up', reason: 'capture_active', retryable: true })
+        return
+      }
+      if (macAssignInFlight.has(sessionId)) {
+        res.status(409).json({ error: 'Another voice assignment for this meeting is still running', reason: 'assign_in_progress', retryable: true })
+        return
+      }
+      macAssignInFlight.add(sessionId)
+      try {
+        macAssign = await planMacVoiceAssignment({ sessionId, from, to, changed: plan.value.changed, sidecar: parsedForAssign, ownerLabel })
+      } finally {
+        macAssignInFlight.delete(sessionId)
+      }
+      // Other requests ran while the plan yielded. Nothing may have moved: the meeting's bytes, the caller's revision, or a new capture.
+      let sidecarAfter: string | null = null
+      try { sidecarAfter = readFileSync(sidecarPath, 'utf-8') } catch { sidecarAfter = null }
+      const revisionAfter = sourceRevisionRefusal(sessionId, req.body)
+      if (sidecarAfter !== sidecarRaw || revisionAfter) {
+        res.status(409).json({ error: 'The meeting changed while the voice was being read. Reopen it and try again; nothing was changed', reason: 'meeting_changed', retryable: true })
+        return
+      }
+      if (macAssign.report.skipped === 'owner_profile') {
+        res.status(409).json({ error: 'That is the wearer profile. A Mac recording cannot add voice samples to it, so nothing was changed', reason: 'owner_profile' })
+        return
+      }
+      if (macAssign.report.skipped === 'unknown_profile') {
+        res.status(404).json({ error: `"${to}" is not an enrolled voice profile, so nothing was changed`, reason: 'unknown_profile', enrolment: macAssign.report })
+        return
+      }
+    }
+
     // The markdown may only be rewritten when EVERY chunk carrying `from` is
     // covered. Its turn segmentation does not match the sidecar's, so a partial
     // relabel has no way to know which turns the selected chunks became.
@@ -2051,7 +2161,16 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     if (req.body?.dryRun === true || req.body?.confirm !== true) {
       res.status(req.body?.dryRun === true ? 200 : 400).json({
         ...(req.body?.dryRun === true ? {} : { error: 'confirmation required', reason: 'confirmation_required' }),
+        ...(macAssign ? { enrolment: macAssign.report } : {}),
         message: `Relabelling ${surfaces.sidecar} chunk(s) from "${from}" to "${to}" in this meeting`
+          + (macAssign
+            ? macAssign.report.skipped === null
+              ? `, and adding up to ${macAssign.report.enrolled} voice sample(s) to ${to}'s profile`
+                + (macAssign.report.gates.length > 0
+                  ? `. The server will refuse that unless you confirm adding it anyway: ${macAssign.report.gates.map(g => MAC_ASSIGN_GATE_TEXT[g]).join('; ')}`
+                  : '')
+              : `. Assigning is not possible: ${macAssignSkipText(macAssign.report.skipped)}. You can still rename the speaker in the transcript without adding any voice samples`
+            : '')
           + (preview.proseStale
             ? '. The summary and decisions still name the old speaker and are NOT rewritten — '
               + `prose refers to people by first name (${preview.proseHits.join(', ')}), `
@@ -2062,15 +2181,59 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       return
     }
 
+    // Assigning to a profile with nothing to add is refused whole: the person asked for
+    // samples, so a rename that silently adds none is not what they confirmed.
+    if (macAssign && macAssign.report.skipped !== null) {
+      res.status(422).json({
+        error: `Nothing was changed. Assigning is not possible: ${macAssignSkipText(macAssign.report.skipped)}`,
+        reason: 'nothing_to_enrol',
+        enrolment: macAssign.report,
+      })
+      return
+    }
+
+    // 6.93.0: a wrong voice is never written into a real person's profile on a warning alone. Below the floor,
+    // a mixed group or too little audio is a 409 unless the caller sends `force: true` (COS Control's separate
+    // "Add anyway"). The plan was just recomputed against the profile as it is now, so a change since the preview counts.
+    if (macAssign && macAssign.report.gates.length > 0 && req.body?.force !== true) {
+      const gate = macAssign.report.gates[0]
+      res.status(409).json({
+        error: `Nothing was changed. ${MAC_ASSIGN_GATE_TEXT[gate].replace(/^./, c => c.toUpperCase())}. Add it anyway only if you are sure`,
+        reason: gate,
+        gates: macAssign.report.gates,
+        enrolment: macAssign.report,
+      })
+      return
+    }
+
+    // A capture that started while the plan ran must not meet the profile write.
+    if (macAssign && captureActive()) {
+      res.status(409).json({ error: 'A meeting started recording while the voice was being read. Assign the voice after it ends; nothing was changed', reason: 'capture_active', retryable: true })
+      return
+    }
+
+    // The plan awaited, so a finalization pass may have started for this meeting since the check at the top of the route.
+    // A job record exists from save to completion, which makes that unlikely today; this keeps it from depending on it.
+    if (macAssign) {
+      const finalizingAfter = finalizingRefusal(sessionId)
+      if (finalizingAfter) {
+        res.status(finalizingAfter.status).json(finalizingAfter.body)
+        return
+      }
+    }
+
     // A prior correction that never closed means this meeting's files may already
     // be half-written. Refuse rather than layering a second rewrite on top.
+    // `force` on an assignment means "add this voice anyway" (above). It must not also skip this guard.
     const stalled = pendingCorrections(sessionId)
-    if (stalled.length > 0 && req.body?.force !== true) {
+    if (stalled.length > 0 && (req.body?.force !== true || macAssign)) {
       res.status(409).json({
         error: 'a previous correction on this meeting never completed',
         reason: 'correction_pending',
         pending: stalled.map(r => ({ id: r.id, at: r.at, from: r.from, to: r.to })),
-        message: 'Its files may be partly rewritten. Re-check the meeting, then pass { force: true } to proceed.',
+        message: macAssign
+          ? 'Its files may be partly rewritten. Re-check the meeting, or do a text-only rename with { force: true } first.'
+          : 'Its files may be partly rewritten. Re-check the meeting, then pass { force: true } to proceed.',
       })
       return
     }
@@ -2125,7 +2288,9 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       if (doc && typeof doc === 'object' && !Array.isArray(doc)) parsedSidecar = doc as Record<string, unknown>
     } catch { /* enrolment refuses on an unusable sidecar; the rename already landed */ }
 
-    const enrolment = enrolNamedVoice({ sessionId, from, to, changed: plan.value.changed, sidecar: parsedSidecar })
+    const enrolment = macAssign
+      ? commitMacVoiceAssignment(sessionId, macAssign)
+      : enrolNamedVoice({ sessionId, from, to, changed: plan.value.changed, sidecar: parsedSidecar })
     res.json({
       ok: true,
       correctionId: id,
@@ -2153,7 +2318,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
   // profile, so the wrong voice is now part of what the system thinks they sound
   // like and will keep matching. Removing only the label fixes the transcript and
   // leaves the profile poisoned — the exact mechanism that grew the phantom
-  // "Erick Hernandez" from 3 mislabelled seeds to 18 samples.
+  // "Evan Hartwell" from 3 mislabelled seeds to 18 samples.
   /**
    * Confirm the identifier was RIGHT about a label the display floor demoted.
    *
@@ -2685,6 +2850,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       return
     }
     const body = (req.body ?? {}) as Record<string, unknown>
+    if (sessionId.startsWith('phone_')) { try { requirePhoneRecording(sessionId) } catch (error) { const e = error as Error & { status?: number; reason?: string }; res.status(e.status ?? 409).json({ error: e.message, reason: e.reason }); return } }
     if (body.title !== undefined && typeof body.title !== 'string') {
       res.status(400).json({ error: 'Invalid title', reason: 'invalid_title' })
       return
@@ -2719,7 +2885,9 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     }
     const capture = synthesizeEntriesFromChunkWavs(quarantineDir)
     const macCapture = readMacRecording(sessionId)
+    const phoneCapture = readPhoneRecording(sessionId)
     const entries = capture.entries.map(entry => {
+      if (phoneCapture) return { ...entry, chunk: { ...entry.chunk, speaker: 'Ext', speakerPolicy: 'anonymous' as const, sourceType: PHONE_SOURCE_TYPE } }
       if (!macCapture) return entry
       const receipt = macChunkReceipt(sessionId, entry.chunkIndex)
       return { ...entry, chunk: { ...entry.chunk, speaker: 'Ext', speakerPolicy: 'high-confidence' as const,
@@ -2797,6 +2965,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
         // retention window, so a capture wrongly judged silent is not lost.
         markRecoveredNoSpeech(quarantineDir, entries.length)
         if (macCapture) closeMacRecording(sessionId)
+        if (phoneCapture) closePhoneRecording(sessionId)
         console.log(
           `[meeting/orphans] ${sessionId} held no speech `
           + `(${entries.length} chunks, ${Math.round((Date.now() - startedAt) / 1000)}s) `
@@ -2806,7 +2975,8 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       }
       const recoveredChunks = results.map(item => ({
         text: item.text,
-        speaker: macCapture ? 'Ext' : 'Unknown',
+        speaker: macCapture || phoneCapture ? 'Ext' : 'Unknown',
+        ...(phoneCapture ? { speakerPolicy: 'anonymous' as const, sourceType: PHONE_SOURCE_TYPE } : {}),
         ...(macCapture ? { speakerPolicy: 'high-confidence' as const } : {}),
         elapsed: item.segment.startElapsed,
         similarity: 0,
@@ -2822,7 +2992,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
           resolveCosOperationsDir(),
         ),
         transcript,
-        startTime: macCapture?.startTime ?? capture.startTime,
+        startTime: macCapture?.startTime ?? phoneCapture?.startTime ?? capture.startTime,
         durationMs: macCapture ? Math.max(...entries.map(e => e.chunk.elapsed + (e.chunk.audioDurationMs ?? 0))) : capture.durationMs,
         chunks: recoveredChunks,
         chunkEntries: recoveredChunks.map((chunk, position) => ({
@@ -2851,7 +3021,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
         })
       } catch { /* display is best-effort */ }
       await runCleanupStage(transcriptCleanup, { sessionId, meetingPath: saved.filepath, sidecarPath: saved.sidecarPath }, sessions)
-      if (cosOpsPipelineConfigured() && !macCapture) {
+      if (cosOpsPipelineConfigured() && !macCapture && !phoneCapture) {
         await handoffMeetingToOperations(saved.filepath)
       } else {
         // Orphan recovery is its own path and never reaches
@@ -2862,7 +3032,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
         // Control surfaces and warns on before committing a drain.
         await enrichStandaloneMeeting(saved.filepath, Date.now())
       }
-      if (!macCapture) triggerMeetingMergeRun('orphan_recovered')
+      if (!macCapture && !phoneCapture) triggerMeetingMergeRun('orphan_recovered')
     }).catch(error => {
       // The quarantined audio is untouched on failure — retry stays possible
       // until the retention clock clears it.

package/server/routes/meetings.ts

@@ -1,3 +1,4 @@
+import { PHONE_CAPTURE_ID } from '../lib/phone-recording.js'
 // Meeting archive: COS operations tree when configured, else standalone recordings.
 
 import { Router } from 'express'
@@ -73,13 +74,16 @@ export function withMeetingContext<T extends MeetingMeta>(meeting: T, source: Me
   return { ...meeting, ...readOnlyContext() }
 }
 
-/** A Mac capture's session id, as routes/meeting.ts keys the pipeline skip. */
+/** Exact Mac identity; iPhone captures never satisfy this predicate. */
 export function isMacCaptureId(sessionId: string | undefined): boolean {
   return typeof sessionId === 'string' && MAC_CAPTURE_ID.test(sessionId)
 }
+function isStandaloneCaptureId(sessionId: string | undefined): boolean {
+  return typeof sessionId === 'string' && (MAC_CAPTURE_ID.test(sessionId) || PHONE_CAPTURE_ID.test(sessionId))
+}
 
 /**
- * Operations rows plus the store's Mac recordings (6.73.14), newest first by date and time, capped at `limit`. Only Mac
+ * Operations rows plus the store's Mac recordings (6.73.14), newest first by date and time, capped at `limit`. Only Mac and admitted phone
  * rows are added: a G2 store row is the pipeline's to file, and its operations copy is the row. A Mac row is left out
  * when an operations row holds its session, or when `held` does (the sessions merged scribes declare), the same rule
  * the day count applies (imported-library-rows macStoreDayCounts). Operations rows are never deduplicated against each
@@ -90,7 +94,7 @@ export function withMacStoreRows(operations: MeetingMeta[], storeRows: MeetingMe
   const mac = storeRows
     // Keyed on the sidecar's session, as the save route keys the pipeline skip (MAC_CAPTURE_ID). The row's sourceType
     // comes from the markdown's Capture source line instead, which an edited or older record can lack.
-    .filter(row => isMacCaptureId(row.sessionId) && !sessions.has(row.sessionId) && !held.has(row.sessionId!))
+    .filter(row => isStandaloneCaptureId(row.sessionId) && (!PHONE_CAPTURE_ID.test(row.sessionId!) || row.sourceType === 'iphone_microphone') && !sessions.has(row.sessionId) && !held.has(row.sessionId!))
     .map(withStandaloneIdentity)
   if (mac.length === 0) return operations
   return [...operations, ...mac]
@@ -342,7 +346,7 @@ export function createMeetingsRouter(
           // 6.73.14 (Miles 2026-10-15): routes/meeting.ts never hands a Mac recording to the pipeline (MAC_CAPTURE_ID),
           // so on a pipeline Mac it lives only in this store and never appeared in Meetings; Control's hand-off read
           // "Saved meeting not found yet" forever. The store's Mac rows join the operations rows here.
-          const meetings = withMacStoreRows(operationsMeetings, store.list({ ...listOptions, sessionMatch: isMacCaptureId }), limit, declaredSessions)
+          const meetings = withMacStoreRows(operationsMeetings, store.list({ ...listOptions, sessionMatch: isStandaloneCaptureId }), limit, declaredSessions)
           // ONLY WHEN THE LIST SAW THE WHOLE MONTH. The row list is capped, and a capped
           // list knows about fewer merged scribes than the month holds, so handing its
           // sessions to an UNCAPPED day count would subtract too little and put the dot
@@ -356,7 +360,7 @@ export function createMeetingsRouter(
               const operationsMonths = listCosOperationsMeetingMonths(domain)
               const known = new Set(operationsMonths)
               const macOnly = store.listMonths().filter(month => !known.has(month)
-                && store.list({ month, domain, limit: 1, sessionMatch: isMacCaptureId }).length > 0)
+                && store.list({ month, domain, limit: 1, sessionMatch: isStandaloneCaptureId }).length > 0)
               return macOnly.length ? uniqueSortedMonths([operationsMonths, macOnly]) : operationsMonths
             })(),
             // The rows above already read every scribe in this month and told us which