@gotcos/glasses-server 6.92.0 → 6.93.0

package/server/routes/transcribe-stream.ts

@@ -1,4 +1,9 @@
-import { MacParakeetUnavailableError, transcribeMacParakeet } from '../lib/mac-recording-asr.js'
+import { PHONE_CAPTURE_ID, PHONE_SOURCE_TYPE, assertPhoneProvenance, admitPhoneRecording, phoneQueryInteger, requirePhoneRecording, readPhoneRecording, validatePhoneWav, persistPhoneChunkReceipt } from '../lib/phone-recording.js'
+import { matchMacLiveVoice, macAnonymousProjection, type MacLiveVoiceState } from '../lib/mac-live-voices.js'
+import { chunkShowsVoiceLabel, macLiveVoicesMode } from '../lib/mac-voice-labels.js'
+import { macWindowDisabledFor, macWindowStateFor, macWindowWithheldReason, noteMacWindowWithheld, startMacWindowDiarize } from '../lib/mac-window-replay.js'
+import { macWindowVoicesEnabled, type MacWindowVoiceState } from '../lib/mac-window-voices.js'
+import { MacParakeetUnavailableError, transcribeMacParakeet, transcribePhoneParakeet } from '../lib/mac-recording-asr.js'
 import { getMeetingStore } from '../lib/meeting-store.js'
 import { appendAutonomousSaveLog, getStopIntentStore, savedChunkReplay, type StopIntent } from '../lib/meeting-stop-intents.js'
 import { MAC_AUDIO, MAC_CAPTURE_ID, closeMacRecording, persistMacChunkReceipt, macError, registerMacRecording, requireMacRecording, readMacRecording, validateMacWav } from '../lib/mac-recording.js'
@@ -46,7 +51,7 @@ import { emitDisplay } from '../lib/display-bus.js'
 import { errMsg } from '../lib/utils.js'
 import { transcribeLocal, applyCorrections, type WhisperWord } from '../lib/whisper-local.js'
 import { trimSilence, isSileroAvailable } from '../lib/vad-silero.js'
-import { identifySpeaker, isEmbeddingAvailable, autoEnroll, AUTO_ENROLL_CANDIDATE_SIMILARITY } from '../lib/speaker-embeddings.js'
+import { identifySpeaker, extractEmbedding, isEmbeddingAvailable, autoEnroll, AUTO_ENROLL_CANDIDATE_SIMILARITY } from '../lib/speaker-embeddings.js'
 import { nemotronLive, resolveLiveLabels, resplitSegments, type ChunkSpeakerSegment } from '../lib/nemotron-live.js'
 import { VOICEPRINT_MIN_AUDIO_SEC } from '../lib/voiceprint-floor.js'
 import {
@@ -286,6 +291,7 @@ export interface TranscriptChunk {
   elapsed: number    // ms since session start
   similarity: number // speaker identification confidence (0-1)
   /** Capture-time policy survives batch and final passes; absent means legacy Standard. */
+  sourceType?: typeof PHONE_SOURCE_TYPE
   speakerPolicy?: SpeakerMode
   words?: WhisperWord[] // word-level timestamps from DTW alignment
   asrProvider?: 'server-whisper' | 'server-parakeet' | 'iphone-whisperkit-beta'
@@ -334,6 +340,10 @@ export interface ProviderCandidateRecord {
 
 interface TranscriptSession {
   chunks: TranscriptChunk[]
+  /** Bounded anonymous acoustic anchors; active capture only, never training. */
+  macLiveVoices?: MacLiveVoiceState
+  /** 6.93.0 window-replay continuity (per-frame track ids, no audio); active capture only. */
+  macWindowVoices?: MacWindowVoiceState
   startTime: number
   title: string
   providerCandidates?: Record<string, ProviderCandidateRecord>
@@ -392,6 +402,8 @@ interface StreamChunkCompletionResponse {
   chunkIndex: number
   elapsed: number
   sessionId: string
+  sourceType?: typeof PHONE_SOURCE_TYPE
+  speakerPolicy?: 'anonymous'
   serverInstanceId: string
   asrCompleted: true
   canonical: boolean
@@ -499,6 +511,7 @@ export const __sessionsForTests = sessions
 export const __closedSessionRecordsForTests = closedSessionRecords
 
 export interface StrandedCapture {
+  sourceType?: typeof PHONE_SOURCE_TYPE
   sessionId: string
   /** Minutes since the last ACK'd chunk. */
   idleMinutes: number
@@ -542,6 +555,7 @@ export function getStrandedCaptures(now = Date.now()): StrandedCapture[] {
     const transcriptState: StrandedCapture['transcriptState'] = stale.chunks ? 'ready' : noSpeech ? 'no_speech' : 'processing'
     return [{
       sessionId: stale.sessionId,
+      ...(PHONE_CAPTURE_ID.test(stale.sessionId) ? { sourceType: PHONE_SOURCE_TYPE } : {}),
       idleMinutes: Math.round(stale.silentForMs / 60_000),
       capturedMinutes: Math.round(
         Math.max(0, lastActivityAt - (session?.startTime ?? lastActivityAt)) / 60_000,
@@ -703,6 +717,7 @@ function persistSessionRequired(sessionId: string): void {
     }
   const data = JSON.stringify({
       sessionId,
+      ...(PHONE_CAPTURE_ID.test(sessionId) ? { captureSource: requirePhoneRecording(sessionId), sourceType: PHONE_SOURCE_TYPE, speakerPolicy: 'anonymous' } : {}),
       startTime: session.startTime,
       lastActivityAt: session.lastActivityAt,
       title: session.title,
@@ -717,6 +732,8 @@ function persistSessionRequired(sessionId: string): void {
       maxChunkIndex: session.maxChunkIndex ?? -1,
       providerCandidates: session.providerCandidates ?? {},
       chunkLevels: session.chunkLevels ?? [],
+      ...(session.macLiveVoices !== undefined ? { macLiveVoices: session.macLiveVoices } : {}),
+      ...(session.macWindowVoices !== undefined ? { macWindowVoices: session.macWindowVoices } : {}),
     })
   try {
     durableAtomicWriteFileSync(filePath, data, { mode: 0o600 })
@@ -826,6 +843,12 @@ function recoverSessions(): void {
           else logStaleMoveFailure(data.sessionId, `[session-recovery] Could not move the active-session file aside for ${data.sessionId} (already ${terminal.kind}); left in place, not adopted`)
           continue
         }
+        if (String(data.sessionId).startsWith('phone_')) {
+          const phone = requirePhoneRecording(data.sessionId)
+          if (data.sourceType !== PHONE_SOURCE_TYPE || data.speakerPolicy !== 'anonymous' || data.captureSource?.version !== 1 || data.captureSource?.sessionId !== phone.sessionId || data.captureSource?.startTime !== phone.startTime || data.captureSource?.captureId !== phone.captureId || data.captureSource?.sourceType !== PHONE_SOURCE_TYPE || data.captureSource?.speakerPolicy !== 'anonymous' || data.startTime !== phone.startTime) throw Error('Missing iPhone session provenance')
+          const held = [...(data.chunksIndexed ?? []).map((e: { c: TranscriptChunk }) => e.c), ...(data.chunks ?? [])]
+          if (held.some((c: TranscriptChunk) => c && (c.speakerPolicy !== 'anonymous' || c.speaker !== 'Ext' || c.segments?.some(seg => seg.speaker !== 'Ext')))) throw Error('Invalid iPhone anonymous transcript')
+        }
         // Reconstruct the (sparse) chunk array. New format keeps original
         // indices via chunksIndexed; legacy format stored a dense `chunks`.
         const indexed: Array<{ i: number; c: TranscriptChunk }> | null =
@@ -906,6 +929,8 @@ function recoverSessions(): void {
                 ? data.providerCandidates
                 : {},
               chunkLevels: restoreChunkLevels(data.chunkLevels),
+              ...(data.macLiveVoices !== undefined && MAC_CAPTURE_ID.test(data.sessionId) ? { macLiveVoices: data.macLiveVoices } : {}),
+              ...(data.macWindowVoices !== undefined && MAC_CAPTURE_ID.test(data.sessionId) ? { macWindowVoices: data.macWindowVoices } : {}),
             }
             // Retroactively strip inline hallucinations from recovered chunks.
             // Two-pass: (1) scan all chunks to build frequency/blocklist,
@@ -1361,12 +1386,13 @@ setInterval(() => {
 
 /** Get or create a transcript session */
 export function getSession(sessionId: string): TranscriptSession {
+  const phone = sessionId.startsWith('phone_') ? requirePhoneRecording(sessionId) : null
   let session = sessions.get(sessionId)
   if (!session) {
     const now = Date.now()
     session = {
       chunks: [],
-      startTime: now,
+      startTime: phone?.startTime ?? now,
       lastActivityAt: now,
       title: '',
       providerCandidates: {},
@@ -1550,6 +1576,7 @@ export function getSessionChunkEntries(sessionId: string): IndexedTranscriptChun
         chunk: {
           text: '',
           speaker: empty.speaker || 'Ext',
+          ...(PHONE_CAPTURE_ID.test(sessionId) ? { sourceType: PHONE_SOURCE_TYPE, speakerPolicy: 'anonymous' as const } : {}),
           elapsed: empty.elapsed,
           similarity: 0,
           backend: empty.backend,
@@ -1584,8 +1611,9 @@ export function getSessionAsrCompletedIndices(sessionId: string): number[] {
 }
 
 function scheduleSessionProgressiveHq(sessionId: string): void {
-  // Progressive checkpoints are Whisper-only and may not bypass a Mac's
-  // explicit Parakeet choice, even if the separate HQ canary is enabled.
+  // Phone audio is always Parakeet, including after a global settings change.
+  // Mac retains its existing selected-engine contract.
+  if (PHONE_CAPTURE_ID.test(sessionId)) return
   if (MAC_CAPTURE_ID.test(sessionId) && readSttSettings().hq === 'parakeet-ultra') return
   // Preserve the default-off contract at the route boundary. In addition to
   // avoiding any cache work, this keeps legacy/local-first transcription
@@ -2165,6 +2193,7 @@ function canonicalChunkResponse(
     elapsed: existing.elapsed,
     sessionId,
     serverInstanceId,
+    ...(PHONE_CAPTURE_ID.test(sessionId) ? { sourceType: PHONE_SOURCE_TYPE, speakerPolicy: 'anonymous' as const } : {}),
     asrCompleted: true,
     canonical: true,
     backend: existing.backend,
@@ -2187,6 +2216,7 @@ function emptyChunkResponse(
     chunkIndex,
     sessionId,
     serverInstanceId,
+    ...(PHONE_CAPTURE_ID.test(sessionId) ? { sourceType: PHONE_SOURCE_TYPE, speakerPolicy: 'anonymous' as const } : {}),
     asrCompleted: true,
     canonical: false,
   }
@@ -2359,7 +2389,8 @@ async function processStreamChunk(opts: {
   evenHubSpeakerRole?: EvenSpeakerRoleHistogram
 }): Promise<StreamChunkCompletionResponse> {
   const { sessionId, chunkIndex, clientSpeaker, audioBuffer, candidate } = opts
-  const evenHubSpeakerRole = evenSpeakerRoleMode() === 'off' ? undefined : opts.evenHubSpeakerRole
+  const phoneCapture = sessionId.startsWith('phone_') ? requirePhoneRecording(sessionId) : null
+  const evenHubSpeakerRole = phoneCapture || evenSpeakerRoleMode() === 'off' ? undefined : opts.evenHubSpeakerRole
   if (evenHubSpeakerRole) warnEvenSpeakerRoleApplyNotImplemented()
   const tReq = performance.now()
   validateSessionId(sessionId)
@@ -2422,7 +2453,7 @@ async function processStreamChunk(opts: {
 
   // Pin identity policy at acceptance, before persistence, ASR or diarization
   // yields. A later loosening applies to the next chunk, never this audio.
-  const capturePolicy = MAC_CAPTURE_ID.test(sessionId) ? (requireMacRecording(sessionId), 'high-confidence' as const) : readSpeakerPolicy(sessionId).mode
+  const capturePolicy = phoneCapture ? 'anonymous' as const : MAC_CAPTURE_ID.test(sessionId) ? (requireMacRecording(sessionId), 'high-confidence' as const) : readSpeakerPolicy(sessionId).mode
   await persistRawSessionAudioChunk(sessionId, chunkIndex, audioBuffer)
   // Commit the received-index ledger only after the canonical raw WAV is
   // durable. A failure is typed non-2xx and a retry remains safe.
@@ -2435,7 +2466,32 @@ async function processStreamChunk(opts: {
   // the synchronous voiceprint so the process is already running while that
   // blocks. diarize() never throws; a fallback returns a reason.
   const diarizeStartedAt = performance.now()
-  const diarizePromise = nemotronLive.diarize(
+  // 6.93.0 (COS_MAC_LIVE_VOICES, window by default): a Mac chunk is diarized inside a
+  // window of the durable chunks before it, so voices keep their number across
+  // boundaries (the first chunk and a gap run a window of their own, one chunk or the
+  // contiguous run after the gap). With the switch off (COS_MAC_LIVE_VOICES=off), or no window to run (an
+  // unplannable chunk, corrupt state, earlier Voice labels), the chunk takes the plain
+  // per-chunk run with no anchors: `Ext`, as 6.92.0. A window run that times out or is
+  // refused falls back to that per-chunk run too, and two window timeouts in a row stop the
+  // window for the rest of the capture (mac-window-replay.ts).
+  const macWindowOn = MAC_CAPTURE_ID.test(sessionId) && macWindowVoicesEnabled() && !macWindowDisabledFor(sessionId)
+  const macWindowWithheld = macWindowOn ? macWindowWithheldReason(session.macWindowVoices, session.chunks) : null
+  if (macWindowWithheld) noteMacWindowWithheld(sessionId, macWindowWithheld)
+  const macWindowState = macWindowOn ? macWindowStateFor(session.macWindowVoices, session.chunks) : null
+  const macWindow = macWindowState
+    ? startMacWindowDiarize({
+        sessionId,
+        sessionDir: resolve(SESSION_AUDIO_DIR, sessionId),
+        chunkIndex,
+        audio: audioBuffer,
+        audioSha256,
+        state: macWindowState,
+        // A window timeout has a per-chunk fallback, so it must not cool Nemotron for every capture.
+        diarizeWindow: (wavPath, timeoutMs) => nemotronLive.diarize(wavPath, { timeoutMs, timeoutTripsBreaker: false }),
+        diarizeChunk: wavPath => nemotronLive.diarize(wavPath),
+      })
+    : null
+  const diarizePromise = phoneCapture ? Promise.resolve({ ok: false as const, reason: 'embedding_requested' as const }) : macWindow?.diarize ?? nemotronLive.diarize(
     resolve(SESSION_AUDIO_DIR, sessionId, `chunk_${String(chunkIndex).padStart(4, '0')}.wav`),
   )
 
@@ -2472,6 +2528,9 @@ async function processStreamChunk(opts: {
     model = candidate.model
     mode = candidate.mode
     latencyMs = candidate.latencyMs
+  } else if (phoneCapture) {
+    const result = await transcribePhoneParakeet(whisperAudio, quiet.speechSec)
+    rawText = result.text; words = result.words; backend = result.backend; asrProvider = result.asrProvider; model = result.model; latencyMs = result.latencyMs
   } else if (MAC_CAPTURE_ID.test(sessionId) && stt.hq === 'parakeet-ultra') {
     // Use the stored choice directly. effectiveStt/preview intentionally fall
     // back when unavailable, which is not an acceptable canonical Mac commit.
@@ -2526,9 +2585,13 @@ async function processStreamChunk(opts: {
     : Date.now() - session.startTime
   const trimmedText = sanitized.text
 
+  // Stage continuity alongside this chunk. Empty/losing results cannot mutate
+  // the session's anchors. Accepted canonical chunks commit both in one durable
+  // active-session write; a failed write returns non-2xx and replay retries it.
+  let nextMacLiveVoices = session.macLiveVoices === undefined ? undefined : structuredClone(session.macLiveVoices)
   // Nemotron separates the voices; the voiceprint names each one. Any fallback
   // keeps today's whole-chunk voiceprint label. Only chunks with text count.
-  const labels = trimmedText
+  const labels = trimmedText && !phoneCapture
     ? await resolveLiveLabels({
         diarize: diarizePromise,
         startedAt: diarizeStartedAt,
@@ -2538,6 +2601,17 @@ async function processStreamChunk(opts: {
         voiceprint,
         clientSpeaker,
         owner: ownerLabelOrNull(),
+        ...(macWindow ? {
+          anonymousChannel: (channel: number) => macWindow.result()?.labelOf(channel) ?? null,
+        } : MAC_CAPTURE_ID.test(sessionId) && macLiveVoicesMode() === 'anchors' ? {
+          anonymousVoice: (wav: Buffer) => {
+            // Fail closed after an upgrade/recovery lacking acoustic anchors:
+            // never reuse Voice 1 for an unrelated person from a later chunk.
+            if (!nextMacLiveVoices && session.chunks.some(chunkShowsVoiceLabel)) return null
+            nextMacLiveVoices ??= { version: 1, anchors: [] }
+            return matchMacLiveVoice(nextMacLiveVoices, extractEmbedding(wav), chunkIndex, audioSha256)
+          },
+        } : {}),
         identify: wav => {
           const policy = capturePolicy
           if (policy === 'anonymous') return { speaker: 'Ext', similarity: 0 }
@@ -2554,8 +2628,15 @@ async function processStreamChunk(opts: {
       })
     : { speaker: voiceprint.speaker, similarity: voiceprint.similarity }
   if (labels.record) nemotronLive.record({ sessionId, chunkIndex }, labels.record)
-  const { speaker, similarity } = policyLabel(labels, capturePolicy)
-  if (labels.segments) labels.segments = labels.segments.map(segment => policyLabel(segment, capturePolicy))
+  // Strict named identity is unchanged. Only this server's successful Mac
+  // Nemotron path can retain an anonymous label at similarity zero.
+  const project = <T extends { speaker: string; similarity?: number }>(value: T): T => {
+    const strict = policyLabel(value, capturePolicy)
+    return MAC_CAPTURE_ID.test(sessionId) && labels.diarizer?.engine === 'nemotron' && macLiveVoicesMode() !== 'off'
+      ? macAnonymousProjection(value, strict) : strict
+  }
+  const { speaker, similarity } = project(labels)
+  if (labels.segments) labels.segments = labels.segments.map(project)
 
   if (!trimmedText) {
     console.log(`[hallucination] Filtered (${sanitized.fallbackReason || fallbackReason || 'empty'}): chars=${rawText.length}`)
@@ -2565,7 +2646,7 @@ async function processStreamChunk(opts: {
     }
     const emptyCompletion: EmptyTranscriptCompletion = {
       text: '',
-      speaker: clientSpeaker,
+      speaker: phoneCapture ? 'Ext' : clientSpeaker,
       elapsed,
       backend,
       asrProvider,
@@ -2585,6 +2666,7 @@ async function processStreamChunk(opts: {
 
   const chunk: TranscriptChunk = {
     text: trimmedText,
+    ...(phoneCapture ? { sourceType: PHONE_SOURCE_TYPE } : {}),
     speakerPolicy: capturePolicy,
     ...(opts.audioDurationMs !== undefined ? { audioDurationMs: opts.audioDurationMs } : {}),
     speaker,
@@ -2617,6 +2699,9 @@ async function processStreamChunk(opts: {
     return canonicalChunkResponse(finalExisting, sessionId, chunkIndex)
   }
   session.chunks[chunkIndex] = chunk
+  if (nextMacLiveVoices !== undefined) session.macLiveVoices = nextMacLiveVoices
+  const macWindowNext = macWindow?.result()?.state
+  if (macWindowNext !== undefined) session.macWindowVoices = macWindowNext
   recordAsrCompleted(session, chunkIndex, sessionId)
   if (candidate && candidateRecordKey) {
     if (session.providerCandidates?.[candidateRecordKey]) {
@@ -2686,6 +2771,7 @@ function sendStreamError(res: { status: (code: number) => { json: (body: unknown
  */
 transcribeStreamRouter.post('/transcribe-stream/preview', async (req, res) => {
   try {
+    if (assertPhoneProvenance(String(req.query.sessionId ?? ''), req.query)) return void res.status(204).send()
     if (!meetingTurboPreviewEnabled() || !maintenanceAdmissionsOpen()) {
       return void res.status(204).send()
     }
@@ -2837,17 +2923,31 @@ transcribeStreamRouter.post('/mac-recording/:captureId/chunks', async (req, res)
   } catch (error) { sendStreamError(res, error) } finally { if (locked) macChunkLocks.delete(id); lease?.release() }
 })
 
+const phoneChunkLocks = new Set<string>()
 transcribeStreamRouter.post('/transcribe-stream', async (req, res) => {
+  let phoneLocked: string | undefined
   let maintenanceLease: MaintenanceWorkLease | undefined
   try {
     // Reject a wrong Mac before consuming or persisting any upload bytes.
     assertPinnedServerIdentity(req.get('X-COS-Server-Instance'), req.query.serverInstanceId)
+    // A repeated key is an array. The G2 path already refused it (its regex fails on the
+    // joined commas); say so before the phone check reads it as a string.
+    if (req.query.sessionId !== undefined && typeof req.query.sessionId !== 'string') throw makeHttpError(400, 'invalid sessionId', 'invalid_session_id')
     const sessionId = (req.query.sessionId as string) || `g2_${Date.now()}`
+    const phone = assertPhoneProvenance(sessionId, req.query)
+    if (phone) {
+      requireMacPin(req)
+      if (getMeetingStore().findBySessionId(sessionId) || isSessionDeleted(sessionId)) throw macError(410, 'session_closed', 'iPhone capture is already saved or closed')
+      if (!readPhoneRecording(sessionId) && listUnsavedCaptures().some(capture => capture.sessionId === sessionId)) throw macError(409, 'phone_capture_provenance_missing', 'Quarantined audio has no admitted iPhone provenance')
+      if (req.query.eh !== undefined || (req.query.speaker !== undefined && req.query.speaker !== 'Ext')) throw macError(400, 'phone_speaker_metadata_forbidden', 'iPhone microphone has no Even/wearer speaker metadata')
+      if (phoneChunkLocks.has(sessionId)) throw macError(409, 'phone_chunk_in_progress', 'Another chunk is processing; retry after its receipt')
+      phoneChunkLocks.add(sessionId); phoneLocked = sessionId
+    }
     if (sessionId.startsWith('mac_')) throw macError(400, 'mac_transport_required', 'Use the Mac recording transport for Mac captures')
     maintenanceLease = acquireRecordingChunkLease({
       allowDuringDrain: sessions.has(sessionId),
     })
-    const chunkIndex = parseInt((req.query.chunkIndex as string) || '0', 10)
+    const chunkIndex = phone ? phoneQueryInteger(req.query.chunkIndex, 'invalid_chunk_index', 'invalid chunkIndex') : parseInt((req.query.chunkIndex as string) || '0', 10)
     const clientSpeaker = (req.query.speaker as string) || 'Unknown'
     const clientElapsedRaw = Number(req.query.elapsed)
     const clientElapsed = Number.isFinite(clientElapsedRaw) && clientElapsedRaw >= 0
@@ -2857,12 +2957,28 @@ transcribeStreamRouter.post('/transcribe-stream', async (req, res) => {
     const startTimeOverride = Number.isFinite(startTimeRaw) && startTimeRaw > 0
       ? startTimeRaw
       : undefined
-    const audioBuffer = await readRawBody(req)
+    let phoneStartTime: number | undefined
+    if (phone) {
+      validateChunkIndex(chunkIndex)
+      const phoneElapsed = phoneQueryInteger(req.query.elapsed, 'invalid_elapsed', 'Original iPhone chunk elapsed time required')
+      if (phoneElapsed > 86400000) throw macError(400, 'invalid_elapsed', 'Original iPhone chunk elapsed time required')
+      if (req.query.startTime !== undefined) phoneStartTime = phoneQueryInteger(req.query.startTime, 'phone_start_time_required', 'Original iPhone capture start time required')
+    }
+    const audioBuffer = phone ? await readBoundedRawBody(req, MAC_AUDIO.maxChunkBytes) : await readRawBody(req)
+    let phoneDuration: number | undefined
+    if (phone) {
+      phoneDuration = validatePhoneWav(audioBuffer)
+      admitPhoneRecording(sessionId, phoneStartTime, requireMacPin(req))
+      persistPhoneChunkReceipt(sessionId, chunkIndex, sha256Hex(audioBuffer), clientElapsedRaw, phoneDuration)
+      const dir = resolve(SESSION_AUDIO_DIR, sessionId); ensurePrivateDirectory(dir)
+      durableAtomicWriteFileSync(resolve(dir, '_capture.json'), JSON.stringify(requirePhoneRecording(sessionId)), { mode: 0o600 })
+    }
     res.json(await processStreamChunk({
       sessionId,
       chunkIndex,
-      clientSpeaker,
+      clientSpeaker: phone ? 'Ext' : clientSpeaker,
       audioBuffer,
+      ...(phoneDuration !== undefined ? { audioDurationMs: phoneDuration } : {}),
       clientElapsed,
       startTimeOverride,
       evenHubSpeakerRole: parseEvenHubSpeakerRoleQuery(req.query.eh),
@@ -2870,6 +2986,7 @@ transcribeStreamRouter.post('/transcribe-stream', async (req, res) => {
   } catch (err: unknown) {
     sendStreamError(res, err)
   } finally {
+    if (phoneLocked) phoneChunkLocks.delete(phoneLocked)
     maintenanceLease?.release()
   }
 })
@@ -2877,6 +2994,8 @@ transcribeStreamRouter.post('/transcribe-stream', async (req, res) => {
 transcribeStreamRouter.post('/transcribe-stream/offline-sessions/start', async (req, res) => {
   let maintenanceLease: MaintenanceWorkLease | undefined
   try {
+    const phoneId = String((req.params as Record<string, string>).sessionId ?? req.body?.sessionId ?? req.query.sessionId ?? '')
+    if (phoneId.startsWith('phone_') || req.body?.sourceType === PHONE_SOURCE_TYPE || req.query.sourceType === PHONE_SOURCE_TYPE) throw macError(400, 'phone_indexed_transport_required', 'Use canonical indexed iPhone microphone uploads')
     if (!isIosAsrCandidateEnabled()) throw makeHttpError(403, 'iPhone ASR candidates disabled', 'iphone_asr_disabled')
     const body = req.body ?? {}
     const sessionId = String(body.sessionId ?? '')
@@ -2904,6 +3023,8 @@ transcribeStreamRouter.post('/transcribe-stream/offline-sessions/start', async (
 transcribeStreamRouter.post('/transcribe-stream/offline-sessions/:sessionId/chunks', async (req, res) => {
   let maintenanceLease: MaintenanceWorkLease | undefined
   try {
+    const phoneId = String((req.params as Record<string, string>).sessionId ?? req.body?.sessionId ?? req.query.sessionId ?? '')
+    if (phoneId.startsWith('phone_') || req.body?.sourceType === PHONE_SOURCE_TYPE || req.query.sourceType === PHONE_SOURCE_TYPE) throw macError(400, 'phone_indexed_transport_required', 'Use canonical indexed iPhone microphone uploads')
     if (!isIosAsrCandidateEnabled()) throw makeHttpError(403, 'iPhone ASR candidates disabled', 'iphone_asr_disabled')
     const sessionId = String(req.params.sessionId ?? '')
     validateSessionId(sessionId)
@@ -2951,6 +3072,8 @@ transcribeStreamRouter.post('/transcribe-stream/offline-sessions/:sessionId/chun
 transcribeStreamRouter.post('/transcribe-stream/offline-sessions/:sessionId/finalize', async (req, res) => {
   let maintenanceLease: MaintenanceWorkLease | undefined
   try {
+    const phoneId = String((req.params as Record<string, string>).sessionId ?? req.body?.sessionId ?? req.query.sessionId ?? '')
+    if (phoneId.startsWith('phone_') || req.body?.sourceType === PHONE_SOURCE_TYPE || req.query.sourceType === PHONE_SOURCE_TYPE) throw macError(400, 'phone_indexed_transport_required', 'Use canonical indexed iPhone microphone uploads')
     if (!isIosAsrCandidateEnabled()) throw makeHttpError(403, 'iPhone ASR candidates disabled', 'iphone_asr_disabled')
     const sessionId = String(req.params.sessionId ?? '')
     validateSessionId(sessionId)
@@ -2983,6 +3106,8 @@ transcribeStreamRouter.post('/transcribe-stream/offline-sessions/:sessionId/fina
 transcribeStreamRouter.post('/transcribe-stream/candidates', async (req, res) => {
   let maintenanceLease: MaintenanceWorkLease | undefined
   try {
+    const phoneId = String((req.params as Record<string, string>).sessionId ?? req.body?.sessionId ?? req.query.sessionId ?? '')
+    if (phoneId.startsWith('phone_') || req.body?.sourceType === PHONE_SOURCE_TYPE || req.query.sourceType === PHONE_SOURCE_TYPE) throw macError(400, 'phone_indexed_transport_required', 'Use canonical indexed iPhone microphone uploads')
     if (!isIosAsrCandidateEnabled()) throw makeHttpError(403, 'iPhone ASR candidates disabled', 'iphone_asr_disabled')
     const body = req.body ?? {}
     const sessionId = String(body.sessionId ?? '')

package/server/routes/voice.ts

@@ -341,7 +341,7 @@ voiceRouter.get('/voice/ext-audio', (_req, res) => {
         ageHours: parseFloat(ageHours),
         expiresIn: `${Math.max(0, 72 - parseFloat(ageHours)).toFixed(1)}h`,
         // 6.45.3 — the chunk indices a reviewer can ask to hear (`?chunk=` on
-        // the sample route). Grace, 2026-09-12: the Add-a-voice panel let her
+        // the sample route). Faith, 2026-09-12: the Add-a-voice panel let her
         // name a session but not listen to it; naming is a guess without this.
         chunkIndices: listExtAudioChunks(d.name),
       }
@@ -671,8 +671,9 @@ voiceRouter.get('/voice/profiles', (_req, res) => {
           const bySource: Record<string, number> = {}
           for (const source of p.sources ?? []) {
             // Collapse auto:<sessionId> so one poisoned session is visible
-            // without leaking a session id per row.
-            const key = source.startsWith('auto:') ? 'auto' : source
+            // without leaking a session id per row. mac-assign:<sessionId> (6.93.0)
+            // collapses the same way, as voice-directory.ts does.
+            const key = source.startsWith('auto:') ? 'auto' : source.startsWith('mac-assign:') ? 'mac-assign' : source
             bySource[key] = (bySource[key] ?? 0) + 1
           }
           return {
@@ -746,7 +747,7 @@ voiceRouter.get('/voice/directory', async (req, res) => {
  * `enrolNamedVoice`, which is right when a human names a voice and wrong here: the
  * merge has ALREADY absorbed those embeddings, so re-enrolling the same audio across
  * every affected meeting would double-count it and drag the centroid. That matters
- * concretely -- the Luke merge moved a neighbouring speaker from 0.818 to 0.842, close
+ * concretely -- the Theo merge moved a neighbouring speaker from 0.818 to 0.842, close
  * enough to the identification threshold to start producing wrong attributions.
  *
  * NEVER THROWS. A merge that succeeded in the store must not report failure because a
@@ -839,6 +840,13 @@ voiceRouter.post('/voice/merge-profiles', async (req, res) => {
     if (report.missing.length > 0 && report.merged.length === 0) {
       return res.status(404).json({ error: 'no such profile(s)', missing: report.missing, report })
     }
+    if (report.refusal) {
+      return res.status(409).json({
+        error: report.refusal.code,
+        message: report.refusal.message,
+        report,
+      })
+    }
     if (report.refused && report.merged.length === 0) {
       return res.status(409).json({
         error: 'similarity below the merge floor',