@gotcos/glasses-server 6.94.0 → 6.94.2

package/server/lib/mac-speaker-repair-render.ts

@@ -0,0 +1,105 @@
+// Pure exact-token rendering shared by offline repair and saved Mac finalization.
+type Doc = Record<string, any>
+function refuse(message: string): never { throw new Error(`Mac speaker repair: ${message}`) }
+export interface BoundWord { word: string; before: string; after: string }
+export function boundWords(before: Doc, after: Doc): BoundWord[] {
+  if (before.batchApplied !== true || !Array.isArray(before.batchSegments) || !before.batchSegments.length) refuse('v1 requires complete canonical batch speaker words')
+  return before.batchSegments.flatMap((segment: Doc, si: number) => {
+    if (!Array.isArray(segment.speakerWords) || segment.speakerWords.length !== after.batchSegments[si]?.speakerWords?.length) refuse('incomplete batch speaker words')
+    return segment.speakerWords.flatMap((row: Doc, wi: number) => {
+      const next = after.batchSegments[si].speakerWords[wi]
+      if (typeof row.word !== 'string' || typeof row.speaker !== 'string' || typeof next.speaker !== 'string') refuse('invalid canonical word binding')
+      return row.word.match(/\S+/gu)?.map((word: string) => ({ word, before: row.speaker, after: next.speaker })) ?? []
+    })
+  })
+}
+/** Exact ordered tokens + exact old labels, no nearest/anchor/substring guessing.
+ * Spoken token bytes and original separators remain; only prefixes are replaced
+ * or inserted when an existing turn must split at a proven word boundary.
+ */
+export function renderBoundSpeakerLabels(transcript: string, words: BoundWord[], preserveUnlabelled = false): string {
+  let pointer = 0
+  const result = transcript.split('\n').map(line => {
+    const match = /^(\[([^\]\r\n]+)\]:[ \t]*)(.*)$/.exec(line)
+    if (!match) { if (line.trim() && !preserveUnlabelled) refuse('unbound nonempty transcript line'); return line }
+    const tokens = [...match[3].matchAll(/\S+/gu)]
+    if (!tokens.length) return line
+    let out = '', previous: string | null = null, consumed = 0
+    for (const token of tokens) {
+      const bound = words[pointer++]
+      if (!bound || bound.word !== token[0] || bound.before !== match[2]) refuse('transcript words/labels do not exactly match canonical evidence')
+      const offset = token.index!
+      out += match[3].slice(consumed, offset)
+      if (previous === null) out = match[1].replace(`[${match[2]}]`, `[${bound.after}]`) + out
+      else if (previous !== bound.after) out += `\n[${bound.after}]: `
+      out += token[0]; consumed = offset + token[0].length; previous = bound.after
+    }
+    return out + match[3].slice(consumed)
+  }).join('\n')
+  if (pointer !== words.length) refuse('transcript has missing canonical words')
+  return result
+}
+/** Omitted/cleaned unaffected lines may stay. Every changed canonical token
+ * must still be covered by exactly one full-line, exact-token + old-label join. */
+export function renderSparseBoundSpeakerLabels(transcript: string, words: BoundWord[]): string {
+  const covered = new Set<number>()
+  let lastEnd = 0
+  const out = transcript.split('\n').map(line => {
+    const match = /^(\[([^\]\r\n]+)\]:[ \t]*)(.*)$/.exec(line)
+    if (!match) return line
+    const tokens = match[3].match(/\S+/gu) ?? []
+    if (!tokens.length) return line
+    const candidates: number[] = []
+    for (let start = 0; start <= words.length - tokens.length; start++) {
+      if (tokens.every((token, offset) => words[start + offset].word === token && words[start + offset].before === match[2])) candidates.push(start)
+    }
+    const affects = (start: number) => words.slice(start, start + tokens.length).some(word => word.before !== word.after)
+    if (candidates.length !== 1) {
+      if (candidates.some(affects)) refuse('changed markdown line has ambiguous canonical binding')
+      return line
+    }
+    const start = candidates[0], end = start + tokens.length
+    if (start < lastEnd) refuse('markdown canonical line order disagrees')
+    lastEnd = end
+    for (let index = start; index < end; index++) covered.add(index)
+    return affects(start) ? renderBoundSpeakerLabels(line, words.slice(start, end)) : line
+  }).join('\n')
+  if (words.some((word, index) => word.before !== word.after && !covered.has(index))) refuse('changed canonical words lack unique complete markdown binding')
+  return out
+}
+/** The operations importer writes this literal marker after a character-limited
+ * canonical preview. Only an exact ordered prefix may waive omitted tail words. */
+export function renderTruncatedBoundSpeakerLabels(body: string, words: BoundWord[]): string {
+  const marker = '... [Transcript truncated for length]'
+  const position = body.indexOf(marker)
+  if (position < 0 || body.indexOf(marker, position + marker.length) >= 0) refuse('one explicit transcript truncation marker required')
+  const shown = body.slice(0, position), suffix = body.slice(position)
+  if (/^\[[^\]\r\n]+\]:/m.test(suffix)) refuse('spoken lines follow transcript truncation marker')
+  const tokens: Array<{word: string; label: string}> = []
+  for (const line of shown.split('\n')) {
+    const match = /^\[([^\]\r\n]+)\]:[ \t]*(.*)$/.exec(line)
+    if (match) for (const word of match[2].match(/\S+/gu) ?? []) tokens.push({word, label:match[1]})
+  }
+  if (!tokens.length || tokens.length >= words.length) refuse('truncation marker does not describe a canonical prefix')
+  const visible = tokens.map((token, index) => {
+    const bound = words[index]
+    const partial = index === tokens.length - 1 && bound.word.startsWith(token.word)
+    if (bound.before !== token.label || (bound.word !== token.word && !partial)) refuse('truncated preview is not an exact canonical prefix')
+    return {...bound, word:token.word}
+  })
+  return renderBoundSpeakerLabels(shown, visible, true) + suffix
+}
+export function renderMarkdown(markdown: string, words: BoundWord[]): string {
+  const headings = [...markdown.matchAll(/^## Transcript[^\n]*\n/gm)]
+  if (headings.length !== 1) refuse('exactly one Transcript section required')
+  const start = headings[0].index! + headings[0][0].length
+  const next = /^## /m.exec(markdown.slice(start)), end = next ? start + next.index : markdown.length
+  const body = markdown.slice(start, end)
+  let rendered: string
+  if (body.includes('... [Transcript truncated for length]')) rendered = renderTruncatedBoundSpeakerLabels(body, words)
+  else {
+    try { rendered = renderBoundSpeakerLabels(body, words, true) }
+    catch { rendered = renderSparseBoundSpeakerLabels(body, words) }
+  }
+  return markdown.slice(0, start) + rendered + markdown.slice(end)
+}

package/server/lib/mac-speaker-windows.ts

@@ -0,0 +1,239 @@
+// Pure preparation/qualification only. The caller verifies WAVs, runs extraction,
+// authenticates these receipts and applies reviewed exact-span candidates.
+import { createHash } from 'node:crypto'
+import { isVoiceLabel } from './mac-voice-labels.js'
+import { hasMacSpeakerProtectedRows } from './mac-speaker-protection.js'
+import {
+  createMacSpeakerMemory, matchMacSpeakerProfile, normalizedSpeakerCosine, normalizedSpeakerEmbedding,
+  reconcileMacSpeakerObservation, type MacSpeakerObservation, type MacSpeakerProfile,
+} from './mac-speaker-reconcile.js'
+import type { SidecarEntry } from './nemotron-final.js'
+const SR = 16_000
+const SHA = /^[a-f0-9]{64}$/
+const uint = (n: unknown): n is number => Number.isSafeInteger(n) && Number(n) >= 0
+const samplePosition = (value: number): number => Number.isFinite(value) && Math.abs(value - Math.round(value)) <= 1e-6 ? Math.round(value) : Number.NaN
+const hash = (v: unknown): string => createHash('sha256').update(JSON.stringify(v)).digest('hex')
+export const MAC_SPEAKER_WINDOW_VERSION = 'exact-window-v1'
+export interface VerifiedMacRawChunk {
+  chunkIndex: number
+  audioSHA256: string
+  pcmSHA256: string
+  sampleRate: 16000
+  channels: 1
+  format: 'pcm_s16le'
+  sampleCount: number
+  verified: true
+}
+export interface MacWindowSource extends VerifiedMacRawChunk {
+  startSample: number
+  endSample: number
+  /** Automatic segment span coverage, not independent VAD/purity ground truth. */
+  speechSamples: number
+  textSHA256: string
+  segmentsSHA256: string
+}
+export interface PreparedMacSpeakerWindow {
+  id: string
+  captureId: string
+  originalVoiceHint: string
+  startSample: number
+  endSample: number
+  sampleCount: number
+  speechSamples: number
+  sources: MacWindowSource[]
+  bindingSHA256: string
+}
+export interface MacSpeakerWindowPlan {
+  version: typeof MAC_SPEAKER_WINDOW_VERSION
+  captureId: string
+  /** These families are candidate scheduling hints, never speaker identities. */
+  families: { originalVoiceHint: string; windowIds: string[] }[]
+  windows: PreparedMacSpeakerWindow[]
+  rejected: { chunkIndexes: number[]; reason: string }[]
+  thresholds: { windowSamples: number; minimumWindowSamples: number; minimumSpeechSamples: number }
+}
+export interface MacSpeakerWindowInput {
+  sidecar: { sessionId: string; correctionRevision?: number; chunkEntries?: SidecarEntry[] }
+  rawChunks: VerifiedMacRawChunk[]
+  /** Includes ledger-only legacy corrections; unavailable must fail closed. */
+  correctionHistory: 'verified-clear' | 'human-corrected' | 'unavailable'
+  correctedChunkIndexes?: readonly number[]
+  minimumSpeechSamples?: number
+}
+function sourceOf(entry: SidecarEntry, raw: VerifiedMacRawChunk | undefined): { source?: MacWindowSource; hint?: string; reason?: string } {
+  const c = entry?.chunk
+  if (!c || !raw || !uint(entry.chunkIndex) || raw.chunkIndex !== entry.chunkIndex || raw.verified !== true
+    || raw.sampleRate !== SR || raw.channels !== 1 || raw.format !== 'pcm_s16le' || !uint(raw.sampleCount) || !raw.sampleCount || raw.sampleCount > 480_000
+    || !SHA.test(raw.audioSHA256) || !SHA.test(raw.pcmSHA256) || c.audioSha256 !== raw.audioSHA256) return { reason: 'unverified_raw_binding' }
+  if (c.speakerPolicy !== 'high-confidence' || !isVoiceLabel(c.speaker) || typeof c.text !== 'string' || !c.text.trim()) return { reason: 'not_automatic_homogeneous' }
+  if (hasMacSpeakerProtectedRows(c)) return { reason: 'human_corrected' }
+  const segments = c.segments
+  if (!Array.isArray(segments) || !segments.length || segments.length > 1024 || segments.some(s => s?.speaker !== c.speaker)
+    || segments.map(s => s.text).join(' ').trim().split(/\s+/).join(' ') !== c.text.trim().split(/\s+/).join(' ')) return { reason: 'not_automatic_homogeneous' }
+  const startSample = samplePosition(Number(c.elapsed) * SR / 1000)
+  if (!uint(startSample) || !Number.isSafeInteger(startSample + raw.sampleCount)) return { reason: 'bad_clock' }
+  let end = 0, speechSamples = 0
+  for (const s of segments) {
+    const a = samplePosition(Number(s.startSec) * SR), b = samplePosition(Number(s.endSec) * SR)
+    if (!uint(a) || !uint(b) || a < end || b <= a || b > raw.sampleCount || (s as unknown as Record<string, unknown>).overlap === true || (s as unknown as Record<string, unknown>).mixedSpeakers === true) return { reason: 'mixed_or_invalid_segments' }
+    speechSamples += b - a; end = b
+  }
+  return { source: { ...structuredClone(raw), startSample, endSample: startSample + raw.sampleCount, speechSamples,
+    textSHA256: hash(c.text), segmentsSHA256: hash(segments) }, hint: c.speaker }
+}
+/** Non-overlapping original chunks only. No cross-label concatenation, gap
+ * filling, arbitrary crops, inferred names or automatic enrollment. */
+export function planMacSpeakerWindows(input: MacSpeakerWindowInput): MacSpeakerWindowPlan {
+  const captureId = input.sidecar.sessionId
+  const minimumSpeechSamples = input.minimumSpeechSamples ?? 320_000
+  const plan: MacSpeakerWindowPlan = { version: MAC_SPEAKER_WINDOW_VERSION, captureId, families: [], windows: [], rejected: [], thresholds: { windowSamples: 480_000, minimumWindowSamples: 448_000, minimumSpeechSamples } }
+  if (typeof captureId !== 'string' || !captureId || captureId.length > 200 || !uint(minimumSpeechSamples) || minimumSpeechSamples < 32_000 || minimumSpeechSamples > 480_000) throw new Error('mac_window_input')
+  const entries = input.sidecar.chunkEntries
+  if (!Array.isArray(entries) || entries.length > 65536 || !Array.isArray(input.rawChunks) || input.rawChunks.length > 65536) throw new Error('mac_window_bound')
+  const refuse = (indexes: number[], reason: string) => { plan.rejected.push({ chunkIndexes: indexes, reason }) }
+  if (input.correctionHistory !== 'verified-clear' || !uint(input.sidecar.correctionRevision ?? 0) || Number(input.sidecar.correctionRevision ?? 0) > 0) {
+    refuse(entries.map(e => e.chunkIndex), 'human_history_not_clear'); return plan
+  }
+  const raw = new Map<number, VerifiedMacRawChunk>()
+  const duplicates = new Set<number>()
+  for (const r of input.rawChunks) { if (raw.has(r.chunkIndex)) duplicates.add(r.chunkIndex); raw.set(r.chunkIndex, r) }
+  const entryCounts = new Map<number, number>()
+  for (const e of entries) entryCounts.set(e.chunkIndex, (entryCounts.get(e.chunkIndex) ?? 0) + 1)
+  for (const [index, count] of entryCounts) if (count > 1) duplicates.add(index)
+  const seenChunks = new Set<number>(), seenAudio = new Set<string>(), seenPCM = new Set<string>()
+  const corrected = new Set(input.correctedChunkIndexes ?? [])
+  let pending: MacWindowSource[] = [], hint = ''
+  let lastSource: MacWindowSource | undefined
+  const flush = (reason: string) => { if (pending.length) refuse(pending.map(s => s.chunkIndex), reason); pending = []; hint = '' }
+  const finish = () => {
+    const first = pending[0], last = pending.at(-1)!
+    const sampleCount = pending.reduce((n, s) => n + s.sampleCount, 0)
+    const speechSamples = pending.reduce((n, s) => n + s.speechSamples, 0)
+    if (speechSamples < minimumSpeechSamples) { flush('insufficient_speech'); return }
+    const body = { captureId, originalVoiceHint: hint, startSample: first.startSample, endSample: last.endSample, sampleCount, speechSamples, sources: pending }
+    const bindingSHA256 = hash(body)
+    plan.windows.push({ ...structuredClone(body), id: `window_${bindingSHA256}`, bindingSHA256 })
+    pending = []; hint = ''
+  }
+  const close = (reason: string) => {
+    if (pending.reduce((n, s) => n + s.sampleCount, 0) >= plan.thresholds.minimumWindowSamples) finish()
+    else flush(reason)
+  }
+  for (const entry of entries) {
+    const index = entry?.chunkIndex
+    if (seenChunks.has(index) || duplicates.has(index)) { close('duplicate_raw_index'); refuse([index], 'duplicate_raw_index'); continue }
+    seenChunks.add(index)
+    const candidate = sourceOf(entry, raw.get(index))
+    if (corrected.has(index) || candidate.reason) { close('interrupted_window'); refuse([index], corrected.has(index) ? 'human_corrected' : candidate.reason!); continue }
+    const source = candidate.source!
+    if (seenAudio.has(source.audioSHA256) || seenPCM.has(source.pcmSHA256)) { close('duplicate_audio'); refuse([index], 'duplicate_audio'); continue }
+    seenAudio.add(source.audioSHA256); seenPCM.add(source.pcmSHA256)
+    if (lastSource && source.startSample < lastSource.endSample) { close('clock_overlap'); refuse([index], 'clock_overlap'); continue }
+    lastSource = source
+    if (pending.length && (source.startSample !== pending.at(-1)!.endSample || index !== pending.at(-1)!.chunkIndex + 1)) close('clock_or_raw_gap')
+    if (pending.length && candidate.hint !== hint) close('hint_changed')
+    if (pending.reduce((n, s) => n + s.sampleCount, 0) + source.sampleCount > 480_000) close('partial_window')
+    if (pending.length >= 240) close('source_count_bound')
+    hint = candidate.hint!; pending.push(source)
+    if (pending.reduce((n, s) => n + s.sampleCount, 0) === 480_000) finish()
+  }
+  close('partial_window')
+  const families = new Map<string, string[]>()
+  for (const w of plan.windows) { const ids = families.get(w.originalVoiceHint) ?? []; ids.push(w.id); families.set(w.originalVoiceHint, ids) }
+  plan.families = [...families].map(([originalVoiceHint, windowIds]) => ({ originalVoiceHint, windowIds }))
+  return plan
+}
+export interface MacWindowEmbeddingReceipt {
+  windowId: string
+  windowBindingSHA256: string
+  modelSHA256: string
+  /** Verified bytes of the exact prepared concatenation, not a crop. */
+  audioSHA256: string
+  pcmSHA256: string
+  sampleCount: number
+  embedding: readonly number[]
+  /** Sensitivity evidence only, never two additional independent observations. */
+  halfEmbeddings?: readonly [readonly number[], readonly number[]]
+}
+export interface QualifiedMacWindowCandidate {
+  windowId: string
+  startSample: number
+  endSample: number
+  originalVoiceHint: string
+  status: 'qualified' | 'preserve'
+  reason: string
+  /** Opaque cohort identity. Never a global rename of originalVoiceHint. */
+  acousticIdentity?: string
+  profileName?: string
+  evidence: string[]
+  provenance: { algorithm: typeof MAC_SPEAKER_WINDOW_VERSION; modelSHA256: string; profileSHA256?: string; anonymousCosine: .90; anonymousMargin: .06; identityCosine: .88; identityMargin: .05 }
+}
+function preparedWindowValid(w: PreparedMacSpeakerWindow, plan: MacSpeakerWindowPlan): boolean {
+  if (!w || w.captureId !== plan.captureId || !isVoiceLabel(w.originalVoiceHint) || !uint(w.startSample) || !uint(w.endSample)
+    || !uint(w.sampleCount) || w.sampleCount < 448_000 || w.sampleCount > 480_000 || w.endSample - w.startSample !== w.sampleCount || !uint(w.speechSamples)
+    || w.speechSamples < plan.thresholds.minimumSpeechSamples || w.speechSamples > w.sampleCount || !Array.isArray(w.sources) || !w.sources.length || w.sources.length > 240) return false
+  let samples = 0, speech = 0
+  for (let i = 0; i < w.sources.length; i++) {
+    const s = w.sources[i], previous = w.sources[i - 1]
+    if (!s || s.verified !== true || s.sampleRate !== SR || s.channels !== 1 || s.format !== 'pcm_s16le' || !uint(s.chunkIndex)
+      || !uint(s.startSample) || !uint(s.endSample) || !uint(s.sampleCount) || s.sampleCount <= 0 || s.endSample - s.startSample !== s.sampleCount
+      || !uint(s.speechSamples) || s.speechSamples > s.sampleCount || !SHA.test(s.audioSHA256) || !SHA.test(s.pcmSHA256) || !SHA.test(s.textSHA256) || !SHA.test(s.segmentsSHA256)
+      || (previous && (s.chunkIndex !== previous.chunkIndex + 1 || s.startSample !== previous.endSample))) return false
+    samples += s.sampleCount; speech += s.speechSamples
+  }
+  return samples === w.sampleCount && speech === w.speechSamples && w.sources[0].startSample === w.startSample && w.sources.at(-1)!.endSample === w.endSample
+}
+
+/** Cohorts require independent whole windows. Old Voice labels supply no votes.
+ * A qualified candidate is a proposal for this exact span, never permission to
+ * rename every occurrence of its hint. Frozen profiles are only read. */
+export function qualifyMacSpeakerWindows(plan: MacSpeakerWindowPlan, receipts: readonly MacWindowEmbeddingReceipt[], profiles: readonly MacSpeakerProfile[], modelSHA256: string, dimensions = 192): QualifiedMacWindowCandidate[] {
+  if (plan.version !== MAC_SPEAKER_WINDOW_VERSION || plan.thresholds.windowSamples !== 480_000 || plan.thresholds.minimumWindowSamples !== 448_000 || !uint(plan.thresholds.minimumSpeechSamples) || plan.thresholds.minimumSpeechSamples < 32_000 || plan.thresholds.minimumSpeechSamples > 480_000 || !SHA.test(modelSHA256) || !uint(dimensions) || !dimensions || dimensions > 4096 || plan.windows.length > 8192 || receipts.length > 8192) throw new Error('mac_window_qualification_input')
+  let memory = createMacSpeakerMemory(plan.captureId, modelSHA256, { dimensions, maxIdentities: 128, maxOriginals: 8192 })
+  const byId = new Map<string, MacWindowEmbeddingReceipt>(), duplicate = new Set<string>()
+  for (const r of receipts) { if (byId.has(r.windowId)) duplicate.add(r.windowId); byId.set(r.windowId, r) }
+  const candidates: QualifiedMacWindowCandidate[] = []
+  const cohorts = new Map<number, { index: number; observation: MacSpeakerObservation }[]>()
+  const seenSources = new Set<number>(), seenRawPCM = new Set<string>(), seenRawAudio = new Set<string>()
+  for (let i = 0; i < plan.windows.length; i++) {
+    const w = plan.windows[i], r = byId.get(w.id)
+    const provenance: QualifiedMacWindowCandidate['provenance'] = { algorithm: MAC_SPEAKER_WINDOW_VERSION, modelSHA256, anonymousCosine: .90 as const, anonymousMargin: .06 as const, identityCosine: .88 as const, identityMargin: .05 as const }
+    const candidate: QualifiedMacWindowCandidate = { windowId: w.id, startSample: w.startSample, endSample: w.endSample, originalVoiceHint: w.originalVoiceHint, status: 'preserve', reason: 'missing_embedding', evidence: [], provenance }
+    candidates.push(candidate)
+    const { id: _id, bindingSHA256, ...body } = w
+    if (!r) continue
+    if (!preparedWindowValid(w, plan) || duplicate.has(w.id) || r.modelSHA256 !== modelSHA256 || r.windowBindingSHA256 !== bindingSHA256 || hash(body) !== bindingSHA256 || w.id !== `window_${bindingSHA256}`
+      || w.captureId !== plan.captureId || !uint(w.sampleCount) || w.sampleCount < 448_000 || w.sampleCount > 480_000 || w.endSample - w.startSample !== w.sampleCount || r.sampleCount !== w.sampleCount
+      || !SHA.test(r.audioSHA256) || !SHA.test(r.pcmSHA256) || !normalizedSpeakerEmbedding(r.embedding, dimensions)
+      || w.sources.some(s => seenSources.has(s.chunkIndex) || seenRawPCM.has(s.pcmSHA256) || seenRawAudio.has(s.audioSHA256))) { candidate.reason = 'receipt_or_lineage_conflict'; continue }
+    for (const source of w.sources) { seenSources.add(source.chunkIndex); seenRawPCM.add(source.pcmSHA256); seenRawAudio.add(source.audioSHA256) }
+    if (r.halfEmbeddings && (r.halfEmbeddings.length !== 2 || r.halfEmbeddings.some(v => !normalizedSpeakerEmbedding(v, dimensions))
+      || normalizedSpeakerCosine(r.halfEmbeddings[0], r.halfEmbeddings[1])! < .90
+      || r.halfEmbeddings.some(v => normalizedSpeakerCosine(v, r.embedding)! < .90))) { candidate.reason = 'incoherent_halves'; continue }
+    const observation: MacSpeakerObservation = { captureId: plan.captureId, modelSHA256,
+      original: { chunkIndex: i, audioSHA256: r.audioSHA256, pcmSHA256: r.pcmSHA256, startSample: w.startSample, sampleCount: w.sampleCount },
+      startSample: w.startSample, endSample: w.endSample, exclusiveSamples: w.speechSamples, purity: 1, overlapSamples: 0, mixedSpeakers: false, embedding: r.embedding }
+    const next = reconcileMacSpeakerObservation(memory, observation)
+    memory = next.state; candidate.reason = next.decision.reason; candidate.evidence = next.decision.evidence
+    if (next.decision.identityId !== undefined) {
+      const group = cohorts.get(next.decision.identityId) ?? []; group.push({ index: i, observation }); cohorts.set(next.decision.identityId, group)
+    }
+  }
+  for (const [identity, group] of cohorts) {
+    if (memory.identities[identity - 1]?.voice === null || group.length < 2) continue
+    if (group.some(a => group.some(b => normalizedSpeakerCosine(a.observation.embedding, b.observation.embedding)! < .90))) {
+      for (const item of group) candidates[item.index].reason = 'inconsistent_complete_link'
+      continue
+    }
+    const acousticIdentity = `acoustic_${hash(group.map(g => plan.windows[g.index].bindingSHA256).sort())}`
+    const proposal = matchMacSpeakerProfile(memory, group.map(g => g.observation), profiles)
+    const evidence = group.map(g => plan.windows[g.index].bindingSHA256)
+    for (const item of group) {
+      const c = candidates[item.index]
+      c.status = 'qualified'; c.reason = proposal.reason === 'matched_profile' ? 'qualified_profile' : 'qualified_anonymous'
+      c.acousticIdentity = acousticIdentity; c.evidence = evidence
+      if (proposal.reason === 'matched_profile') { c.profileName = proposal.label!; c.provenance.profileSHA256 = proposal.provenance.profileSHA256 }
+    }
+  }
+  return candidates
+}

package/server/lib/meeting-scribe-content.ts

@@ -276,6 +276,9 @@ export interface AttendeeLine {
    */
   isOwner: boolean
   confirmedByHuman: boolean
+  /** Qualified exact-span machine evidence; raw capture scores stay unchanged. */
+  machineQualified?: boolean
+  machineQualifiedSegments?: number
 }
 
 /**
@@ -406,8 +409,12 @@ export function renderProvenance(
   const clauses: string[] = []
   const owner = named.filter(v => v.isOwner).map(q)
   const human = named.filter(v => !v.isOwner && v.confirmedByHuman).map(q)
-  const matched = named.filter(v => !v.isOwner && !v.confirmedByHuman).map(q)
+  const machine = named.filter(v => !v.isOwner && !v.confirmedByHuman && v.machineQualified).map(q)
+  const combined = named.filter(v => !v.isOwner && !v.confirmedByHuman && !v.machineQualified && (v.machineQualifiedSegments ?? 0) > 0).map(q)
+  const matched = named.filter(v => !v.isOwner && !v.confirmedByHuman && !v.machineQualified && !(v.machineQualifiedSegments ?? 0)).map(q)
   if (owner.length) clauses.push(`${owner.join(', ')} by wearing the device`)
+  if (machine.length) clauses.push(`${machine.join(', ')} by qualified independent long-window profile evidence (not human confirmation)`)
+  if (combined.length) clauses.push(`${combined.join(', ')} by capture matches plus qualified independent long-window profile evidence (not human confirmation)`)
   if (matched.length) clauses.push(`${matched.join(', ')} by voice match`)
   if (human.length) clauses.push(`${human.join(', ')} because a human named that voice`)
   const lines: string[] = [

package/server/lib/meeting-speaker-review.ts

@@ -22,6 +22,7 @@
 //
 // Everything here is pure over a chunk array so it can be tested by execution.
 
+import type { QualifiedMachinePosition } from './mac-speaker-machine-evidence.js'
 import { isVoiceLabel } from './mac-voice-labels.js'
 
 /** One transcript chunk as stored in the `.g2-chunks.json` sidecar. */
@@ -152,6 +153,10 @@ export interface VoiceReview {
   isOwner: boolean
   /** A human confirmed this label for this meeting; the floor is waived. */
   confirmedByHuman: boolean
+  /** Independent long-window profile evidence, never a human confirmation. */
+  machineQualified: boolean
+  machineQualifiedSegments: number
+  assertionSource: 'owner' | 'human' | 'qualified-profile' | 'capture-and-qualified-profile' | 'capture-match' | null
   reliability: Reliability
   /**
    * Whether `label` may be shown to a human AS A NAME.
@@ -588,6 +593,9 @@ export function reviewMeetingSpeakers(
      */
     confirmed?: Set<string>
     confirmedChunks?: Map<number, string>
+    /** Reader-validated exact compacted positions from current bound raw audio. */
+    machineEvidenceStatus?: 'absent' | 'qualified' | 'invalid'
+    machineQualifiedPositions?: ReadonlyMap<number, QualifiedMachinePosition>
     /**
      * The sidecar's `batchSegments`, when the HQ pass has run. Their word
      * timings give real voiced time; without them speaking time falls back to
@@ -646,6 +654,24 @@ export function reviewMeetingSpeakers(
   const voices: VoiceReview[] = labels.map(label => {
     const own = chunks.filter(c => (c.speaker ?? '') === label)
     const sims = own.map(c => c.similarity).filter((s): s is number => typeof s === 'number' && s > 0)
+    const machineQualifiedSegments = chunks.reduce((n, c, i) => {
+      const proof = options.machineQualifiedPositions?.get(i)
+      return n + Number(c.speaker === label && !!proof && proof.label === label
+        && (c.chunkIndex === undefined || c.chunkIndex === proof.rawChunkIndex)
+        && proof.independentWindows >= 2 && proof.minimumSimilarity >= .88 && proof.minimumMargin >= .05)
+    }, 0)
+    const machineQualified = own.length > 0 && machineQualifiedSegments === own.length
+    // Repaired records require support for every occurrence. A legacy mean
+    // from one positive row cannot vouch for repaired zero-score positions.
+    const scopedMachineRecord = (options.machineEvidenceStatus !== undefined && options.machineEvidenceStatus !== 'absent') || (options.machineQualifiedPositions?.size ?? 0) > 0
+    const unsupportedScopedSegments = scopedMachineRecord ? chunks.reduce((n, c, i) => {
+      if (c.speaker !== label) return n
+      const proof = options.machineQualifiedPositions?.get(i)
+      const machine = proof?.label === label && (c.chunkIndex === undefined || c.chunkIndex === proof.rawChunkIndex) && proof.independentWindows >= 2 && proof.minimumSimilarity >= .88 && proof.minimumMargin >= .05
+      const human = confirmed.has(label) || options.confirmedChunks?.get(i) === label
+      const capture = typeof c.similarity === 'number' && Number.isFinite(c.similarity) && c.similarity >= ASSERT_MIN_SIMILARITY
+      return n + Number(!machine && !human && !capture)
+    }, 0) : 0
     const runs = speakerRuns(sequence, label)
     const unattributed = isUnattributed(label)
     const confirmedSegments = unattributed ? 0 : confirmed.has(label) ? own.length
@@ -674,7 +700,7 @@ export function reviewMeetingSpeakers(
       ? 'unattributed'
       : thrashesWith.length > 0
         ? 'unreliable'
-        : (meanSim ?? 0) >= CONFIDENT_SIMILARITY ? 'confident' : 'weak'
+        : machineQualified || (meanSim ?? 0) >= CONFIDENT_SIMILARITY ? 'confident' : 'weak'
 
     // What stops this label being presented as a name. Collected as reasons
     // rather than a bare boolean: "2 segments" and "similarity 0.58" are
@@ -688,6 +714,11 @@ export function reviewMeetingSpeakers(
       // below 0.65" under a name they personally confirmed would reasonably
       // conclude the confirmation had not taken. `thrashesWith` still renders,
       // so a genuinely mixed row is still visibly mixed.
+    } else if (unsupportedScopedSegments) {
+      // System-audio repairs do not identify the wearer by device ownership.
+      // This gate also precedes the legacy owner exemption.
+      assertionBlockers.push(`${unsupportedScopedSegments} segment${unsupportedScopedSegments === 1 ? '' : 's'} lack current scoped speaker evidence`)
+      if (thrashesWith.length > 0) assertionBlockers.push(`swaps with ${thrashesWith[0].speaker} every ${Math.round(thrashesWith[0].meanRun)} segments`)
     } else if (label === owner) {
       // The wearer is exempt. Their identity is established by wearing the
       // device, not by cosine — and the owner is verified at exactly this floor
@@ -696,6 +727,10 @@ export function reviewMeetingSpeakers(
       // row read "Unidentified voice" in 4 of 9 meetings, including one with 285
       // of their own segments. `thrashesWith` still renders, so a mixed row is
       // still visible — the name is asserted, the caveat is not hidden.
+    } else if (machineQualified) {
+      // Exact positions passed the independent .88/margin/long-window gate.
+      // Keep raw similarities unchanged and retain the mixed-row warning.
+      if (thrashesWith.length > 0) assertionBlockers.push(`swaps with ${thrashesWith[0].speaker} every ${Math.round(thrashesWith[0].meanRun)} segments`)
     } else {
       if (own.length < ASSERT_MIN_SEGMENTS) {
         assertionBlockers.push(`only ${own.length} segment${own.length === 1 ? '' : 's'} (needs ${ASSERT_MIN_SEGMENTS})`)
@@ -719,6 +754,9 @@ export function reviewMeetingSpeakers(
       isOwner: label === owner,
       /** True when a human vouched for this label in this meeting. */
       confirmedByHuman: confirmed.has(label),
+      machineQualified: !unattributed && machineQualified,
+      machineQualifiedSegments: unattributed ? 0 : machineQualifiedSegments,
+      assertionSource: assertionBlockers.length ? null : confirmed.has(label) ? 'human' : label === owner ? 'owner' : machineQualified ? 'qualified-profile' : machineQualifiedSegments > 0 ? 'capture-and-qualified-profile' : 'capture-match',
       reliability,
       nameAsserted: assertionBlockers.length === 0,
       assertionBlockers,

package/server/lib/nemotron-final.ts

@@ -40,6 +40,7 @@ import {
   nemotronCliPath,
   prepareNemotronModelsDir,
 } from './diarizer-backend.js'
+import { readCorrections } from './meeting-corrections.js'
 import { CONFIDENT_SIMILARITY, isUnattributed } from './meeting-speaker-review.js'
 import { getOwnerSpeakerLabel } from './profile.js'
 import { OWNER_VERIFY_SIMILARITY } from './voiceprint-floor.js'
@@ -370,6 +371,24 @@ function liveSpeakerAt(chunk: SidecarChunk, t: number, owner?: string | null): s
   return best && typeof best.speaker === 'string' ? guardOwnerName(best.speaker, best.similarity, chunk, owner) : null
 }
 
+/** Existing strict Mac names are local immutable claims, never a name source
+ * for a global anonymous channel. Exact token/word labels win over chunk names.
+ * An unplaced named segment withholds anonymous refinement for the whole chunk. */
+function protectedMacName(chunk: SidecarChunk, t: number, exact?: string): { name: string | null; hold: boolean } {
+  if (chunk.speakerPolicy !== 'high-confidence') return { name: null, hold: false }
+  if (typeof exact === 'string' && isName(exact)) return { name: exact, hold: true }
+  const named = (chunk.segments ?? []).filter(s => isName(s.speaker))
+  for (const segment of named) {
+    if (!Number.isFinite(segment.startSec) || !Number.isFinite(segment.endSec)
+      || Number(segment.startSec) < 0 || Number(segment.endSec) <= Number(segment.startSec)) return { name: null, hold: true }
+    if (t >= Number(segment.startSec) && t < Number(segment.endSec)) return { name: segment.speaker, hold: true }
+  }
+  // A segment-less legacy chunk has only its head claim. Explicit anonymous
+  // turns, however, must never inherit a real name from the majority/head label.
+  if (isName(chunk.speaker) && !chunk.segments?.length) return { name: chunk.speaker, hold: true }
+  return { name: null, hold: false }
+}
+
 export interface RelabelStats {
   total: number
   /** Words whose label changed. */
@@ -418,13 +437,15 @@ export function relabelBatchSegments(
       const end = batchWordToTimeline(segment, Number(word.end), timeline)
       // Existing live anonymous turns are established capture evidence. A
       // meeting-wide channel may refine unknown speech, never overwrite them.
-      const live = start ? liveSpeakerAt(start.window.chunk, start.inChunk, owner) : null
-      let name: string | null = isVoiceLabel(live) ? live : null
-      if (name === null && start) {
+      const liveCandidate = start ? liveSpeakerAt(start.window.chunk, start.inChunk, owner) : null
+      const protectedName = start ? protectedMacName(start.window.chunk, start.inChunk, word.speaker) : { name: null, hold: false }
+      const live = start?.window.chunk.speakerPolicy === 'high-confidence' && isName(liveCandidate) ? protectedName.name : liveCandidate
+      let name: string | null = protectedName.name ?? (isVoiceLabel(live) ? live : null)
+      if (name === null && !protectedName.hold && start) {
         const channel = channelForSpan(a, start.at, Math.max(start.at, end?.window === start.window ? end.at : start.at + 0.01))
         if (channel !== null && map.has(channel)) { name = map.get(channel)!; stats.viaChannel++ }
       }
-      if (isVoiceLabel(live)) stats.kept++
+      if (isVoiceLabel(live) || protectedName.name !== null) stats.kept++
       if (name === null) {
         stats.kept++
         name = live
@@ -479,20 +500,34 @@ export function relabelStreamingChunks(
     if (typeof chunk.text !== 'string' || !chunk.text.trim()) continue
     const tokens = splitTokens(chunk.text)
     const times = streamingTokenTimes(chunk, tokens, window, a)
-    const base = guardOwnerName(typeof chunk.originalSpeaker === 'string' ? chunk.originalSpeaker : chunk.speaker, chunk.similarity, chunk, owner)
+    const originalBase = guardOwnerName(typeof chunk.originalSpeaker === 'string' ? chunk.originalSpeaker : chunk.speaker, chunk.similarity, chunk, owner)
+    const base = chunk.speakerPolicy === 'high-confidence' && chunk.segments?.length && isName(originalBase) ? 'Ext' : originalBase
     const labels: string[] = []
     const liveTokens = (chunk.segments ?? []).flatMap(segment => splitTokens(String(segment.text ?? '')).map(token => ({ token, speaker: segment.speaker })))
     const exactLive = liveTokens.length === tokens.length && liveTokens.every((part, i) => part.token === tokens[i]) ? liveTokens : null
+    // Without token alignment or a clock, preserve the original named chunk
+    // rather than spreading a nearby named turn across its unmatched text.
+    if (chunk.speakerPolicy === 'high-confidence' && chunk.segments?.some(s => isName(s.speaker)) && !exactLive && !times) continue
     let carry: string | null = null
     for (let i = 0; i < tokens.length; i++) {
       const established = exactLive?.[i].speaker
-      if (!isWordToken(tokens[i]) || !times) { labels.push(isVoiceLabel(established) ? established! : carry ?? liveSpeakerAt(chunk, 0, owner) ?? base); continue }
+      if (!isWordToken(tokens[i]) || !times) {
+        const protectedName = !times && established === undefined && chunk.segments?.length ? { name: null, hold: true } : protectedMacName(chunk, times?.[i]?.start ?? 0, established)
+        const local = liveSpeakerAt(chunk, times?.[i]?.start ?? 0, owner)
+        const safeLocal = chunk.speakerPolicy === 'high-confidence' && isName(local) ? protectedName.name : local
+        labels.push(protectedName.name ?? (chunk.speakerPolicy === 'high-confidence' && established !== undefined ? established : isVoiceLabel(established) ? established! : carry ?? safeLocal ?? base))
+        continue
+      }
       stats.total++
       const span = times[i]
       const channel = channelForSpan(a, window.start + span.start, window.start + Math.max(span.end, span.start + 0.01))
       let name: string
-      const live = isVoiceLabel(established) ? established! : liveSpeakerAt(chunk, span.start, owner)
-      if (isVoiceLabel(live)) { name = live!; stats.kept++ }
+      const liveCandidate = isVoiceLabel(established) ? established! : liveSpeakerAt(chunk, span.start, owner)
+      const protectedName = protectedMacName(chunk, span.start, established)
+      const live = chunk.speakerPolicy === 'high-confidence' && isName(liveCandidate) ? protectedName.name : liveCandidate
+      if (protectedName.name !== null) { name = protectedName.name; stats.kept++ }
+      else if (protectedName.hold) { name = live ?? base; stats.kept++ }
+      else if (isVoiceLabel(live)) { name = live!; stats.kept++ }
       else if (channel !== null && map.has(channel)) { name = map.get(channel)!; stats.viaChannel++ }
       else { name = live ?? base; stats.kept++ }
       labels.push(name)
@@ -787,6 +822,14 @@ function distinctSpeakers(transcript: string): number {
   return names.size
 }
 
+/** Legacy corrections may have a ledger without a sidecar revision. Unknown
+ * or incomplete recorded history is held, never treated as automatic evidence. */
+function hasHumanCorrectionHistory(sidecar: Record<string, unknown>): boolean {
+  if (typeof sidecar.sessionId !== 'string') return false
+  const corrections = readCorrections(sidecar.sessionId)
+  return corrections.rows.length > 0 || corrections.unusable > 0
+}
+
 async function finalPassNow(options: FinalPassOptions): Promise<FinalPassOutcome> {
   const started = (options.now ?? Date.now)()
   const env = options.env ?? process.env
@@ -801,6 +844,7 @@ async function finalPassNow(options: FinalPassOptions): Promise<FinalPassOutcome
   const sidecar = JSON.parse(sidecarText) as Record<string, any>
   const owner = options.owner !== undefined ? options.owner : ownerLabelOrNull()
   if (Number(sidecar.correctionRevision ?? 0) > 0) return { status: 'skipped', reason: 'human_corrected' }
+  if (hasHumanCorrectionHistory(sidecar)) return { status: 'skipped', reason: 'human_corrected' }
   const markdown = readFileSync(options.meetingPath, 'utf8')
   const transcript = readTranscriptSection(markdown)
   if (transcript === null) return { status: 'skipped', reason: 'no_transcript' }
@@ -1025,6 +1069,9 @@ function commitFinalPass(
     return { status: 'skipped', reason: 'changed_during_pass', detail: sidecarNow !== sidecarText ? 'sidecar changed' : 'markdown changed' }
   }
 
+  // A legacy confirmation can land only in its ledger while native work runs.
+  if (hasHumanCorrectionHistory(nextSidecar)) return { status: 'skipped', reason: 'changed_during_pass', detail: 'correction history changed' }
+
   // Sidecar first, markdown second, as the store does: the markdown is the
   // visible commit. If the markdown write fails, put the sidecar back, and say
   // so loudly if even that fails (the two files then disagree).
@@ -1056,8 +1103,8 @@ function commitFinalPass(
 // ── 6.90.0: unnamed, meeting-stable voices for Mac recordings ───────────────────
 //
 // The named pass above maps a channel to a name from chunks the voiceprint was
-// sure of. A Mac recording has no such chunks (every one is `Ext` at the 0.88
-// floor) and must never borrow a name, so it skips that pass (`speaker_policy`).
+// sure of. Strict Mac recordings never borrow names across a global channel;
+// rare existing names are preserved locally while other words stay anonymous.
 // This pass keeps the channels and drops the names: each channel that holds the
 // floor in enough chunks becomes `Voice 1`, `Voice 2`, ... in order of first
 // speech. No profile is read or written anywhere below; `owner` is never passed,
@@ -1070,9 +1117,9 @@ export const VOICE_MIN_SUPPORT = FINAL_MIN_SUPPORT
 
 /**
  * Unnamed mode applies to a Mac recording, with the switch on, when every chunk
- * that carries words is the Mac strict policy and none already carries a real
- * name (a 0.88 match is rare, and a pass must never overwrite one with a
- * placeholder).
+ * that carries words is the Mac strict policy. Rare existing names are protected
+ * per span by the relabellers; one match must not disable anonymous refinement
+ * for the remainder of an otherwise strict recording.
  */
 export function unnamedVoicesEligible(
   sidecar: Record<string, unknown>,
@@ -1090,7 +1137,7 @@ export function unnamedVoicesEligible(
   // strict; anything else (anonymous, a malformed marker) still refuses.
   const silentOk = entries.filter(entry => !hasText(entry.chunk))
     .every(entry => entry.chunk?.speakerPolicy === undefined || entry.chunk.speakerPolicy === 'high-confidence')
-  return silentOk && spoken.every(chunk => chunk.speakerPolicy === 'high-confidence' && !isName(chunk.speaker))
+  return silentOk && spoken.every(chunk => chunk.speakerPolicy === 'high-confidence')
 }
 
 export interface VoiceChannels {
@@ -1360,6 +1407,9 @@ async function unnamedVoicePass(input: UnnamedInput): Promise<FinalPassOutcome>
     for (const chunk of [entry.chunk, chunks[i]]) {
       const original = typeof chunk.originalSpeaker === 'string' ? chunk.originalSpeaker : chunk.speaker
       if (final) chunk.finalSegments = final.segments
+      // A pre-existing strict name is immutable even when a legacy chunk's
+      // segments disagree. The anonymous pass never asserts a different name.
+      if (chunk.speakerPolicy === 'high-confidence' && isName(chunk.speaker)) continue
       chunk.speaker = label
       if (label !== original) chunk.originalSpeaker = original
       else delete chunk.originalSpeaker