@gotcos/glasses-server 6.95.0 → 6.98.0

package/server/lib/mac-speaker-live-save.ts

@@ -0,0 +1,90 @@
+/** Pure bridge from qualified live evidence to the existing closed-file repair
+ * contract. No IO, inference, enrollment, or implied authorization to write.
+ * Caller must verify current audio/model/profile/ledger bytes and journal all
+ * files before applying the returned receipt. */
+import { refreshMacSpeakerLiveState, replayMacSpeakerLiveEvidence, validateMacSpeakerLiveState, hashMacSpeakerLive, type MacSpeakerLiveState } from './mac-speaker-live-memory.js'
+import { projectMacSpeakerLiveChunks, type MacSpeakerLiveSourceChunk } from './mac-speaker-live-projection.js'
+import { normalizedSpeakerCosine, type MacSpeakerProfile } from './mac-speaker-reconcile.js'
+import { hashMacSpeakerDocument, projectMacSpeakerRepair, type MacProfileMatchEvidence, type MacSpeakerRepairAssignment, type MacSpeakerRepairPlan, type MacSpeakerWordBinding } from './mac-speaker-repair-projection.js'
+type Doc = Record<string, any>
+const refuse = (why: string): never => { throw Error(`Mac live save: ${why}`) }
+const MAX_RAW = 8192
+/** Verified PCM counts include silent originals, because saved batch word
+ * clocks concatenate audio files rather than using capture elapsed time. */
+export function planMacSpeakerLiveSave(input: {
+  doc: Doc; state: MacSpeakerLiveState; profiles: readonly MacSpeakerProfile[]
+  rawAudioSampleCounts: Record<string, number>; correctionHistoryClear: boolean
+}): MacSpeakerRepairPlan {
+  const { doc, state, profiles, rawAudioSampleCounts: counts } = input
+  validateMacSpeakerLiveState(state)
+  if (!input.correctionHistoryClear || state.withheldReason || doc.sessionId !== state.captureId
+    || doc.finalizationState !== 'complete' || doc.sourceType !== 'mac_system_audio'
+    || doc.speakerRepair || (doc.correctionRevision ?? 0) !== 0 || doc.batchApplied !== true
+    || !Array.isArray(doc.chunkEntries) || !Array.isArray(doc.batchSegments)
+    || doc.chunkEntries.length > MAX_RAW || !doc.batchSegments.length) refuse('ineligible source or human history')
+  // An unkeyed integrity hash cannot authenticate caller-supplied membership.
+  // Rebuild membership from each source receipt; namespace reservation only
+  // affects presentation labels, not acoustic memory or receipt assignment.
+  const rebuilt = replayMacSpeakerLiveEvidence({ captureId: state.captureId, generation: state.generation,
+    modelSHA256: state.modelSHA256, profileSHA256: state.profileSHA256, evidence: state.evidence, profiles })
+  if (hashMacSpeakerLive(rebuilt.memory) !== hashMacSpeakerLive(state.memory)
+    || hashMacSpeakerLive(rebuilt.evidence.map(e => e.cohortId ?? null)) !== hashMacSpeakerLive(state.evidence.map(e => e.cohortId ?? null))) refuse('unverified receipt membership')
+  // Recompute the complete overlay against the frozen full profile cohort.
+  const replay = refreshMacSpeakerLiveState(state, profiles)
+  if (hashMacSpeakerLive(replay.projections) !== hashMacSpeakerLive(state.projections)) refuse('stale identity or profile claims')
+  const indexed = doc.chunkEntries.filter((e: Doc) => e.chunk?.text).map((e: Doc) => ({ i: e.chunkIndex, c: e.chunk as MacSpeakerLiveSourceChunk }))
+  const projection = projectMacSpeakerLiveChunks({ captureId: state.captureId, generation: state.generation, chunksIndexed: indexed, projections: state.projections })
+  if (projection.withheld.length || projection.appliedRawChunkIndices.length !== state.projections.length) refuse('saved originals changed or became protected')
+  const current = new Map<number, Doc>(doc.chunkEntries.map((e: Doc) => [e.chunkIndex, e.chunk]))
+  const centroids = profiles.map(p => ({ name: p.name, embedding: Array.from({ length: 192 }, (_, i) => p.embeddings.reduce((sum, v) => sum + v[i] / p.embeddings.length, 0)) }))
+  const proofs = new Map<string, MacProfileMatchEvidence>()
+  for (const span of state.projections) if (span.profileName && !proofs.has(span.identityId)) {
+    const identity = state.identities.find(i => i.identityId === span.identityId)!
+    const group = state.evidence.filter(e => e.cohortId === identity.cohortId)
+    const target = centroids.find(p => p.name === span.profileName) ?? refuse('profile missing')
+    proofs.set(span.identityId, {
+      kind: 'profile-match', profileName: span.profileName, profileSha256: state.profileSHA256,
+      modelSha256: state.modelSHA256, algorithmVersion: 'mac-native-live-v1',
+      crossWindowCosines: group.map(a => group.map(b => normalizedSpeakerCosine(a.receipt.embedding, b.receipt.embedding)!)),
+      windows: group.map(e => ({ id: e.window.id, captureStartSample: e.window.startSample, captureEndSample: e.window.endSample,
+        pcmSha256: e.receipt.pcmSHA256, similarity: normalizedSpeakerCosine(e.receipt.embedding, target.embedding)!,
+        runnerUpSimilarity: Math.max(-1, ...centroids.filter(p => p !== target).map(p => normalizedSpeakerCosine(e.receipt.embedding, p.embedding)!)),
+        rawChunks: e.window.sources.map(s => ({ rawChunkIndex: s.chunkIndex, audioSha256: s.audioSHA256, sampleCount: s.sampleCount })) })),
+    })
+  }
+  const assignments: MacSpeakerRepairAssignment[] = state.projections.flatMap(span => {
+    const original = current.get(span.rawChunkIndex) ?? refuse('missing original')
+    if (original.speaker === span.displayLabel) return []
+    return [{ rawChunkIndex: span.rawChunkIndex, from: original.speaker, to: span.displayLabel,
+      evidenceId: span.identityId, batchWords: [], ...(span.profileName ? { targetEvidence: proofs.get(span.identityId)! } : {}) }]
+  })
+  if (!assignments.length) refuse('no qualified label changes')
+  const selected = new Map(assignments.map(a => [a.rawChunkIndex, a]))
+  const withheldBatchWords: Array<MacSpeakerWordBinding & { reason: 'outside-qualified-span' }> = []
+  doc.batchSegments.forEach((segment: Doc, segmentIndex: number) => {
+    if (!Number.isSafeInteger(segment.startChunkIdx) || !Number.isSafeInteger(segment.endChunkIdx)
+      || segment.startChunkIdx < 0 || segment.endChunkIdx < segment.startChunkIdx
+      || segment.endChunkIdx - segment.startChunkIdx >= MAX_RAW || !Array.isArray(segment.speakerWords)) refuse('invalid batch geometry')
+    const ranges: Array<{ raw: number; start: number; end: number }> = []; let at = 0
+    for (let raw = segment.startChunkIdx; raw <= segment.endChunkIdx; raw++) {
+      const n = counts[String(raw)]
+      if (!Number.isSafeInteger(n) || n <= 0 || n > 480000) refuse('unverified batch PCM clock')
+      ranges.push({ raw, start: at, end: at + n / 16000 }); at += n / 16000
+    }
+    segment.speakerWords.forEach((word: Doc, wordIndex: number) => {
+      if (!Number.isFinite(word.start) || !Number.isFinite(word.end) || word.start < 0 || word.end < word.start || word.end > at) refuse('invalid batch word clock')
+      const overlapping = ranges.filter(r => word.start === word.end ? word.start >= r.start && word.start < r.end : word.start < r.end && word.end > r.start)
+      if (!overlapping.some(r => selected.has(r.raw))) return
+      const binding = { segmentIndex, wordIndex, from: word.speaker, word: word.word, start: word.start, end: word.end }
+      if (overlapping.some(r => !selected.has(r.raw))) withheldBatchWords.push({ ...binding, reason: 'outside-qualified-span' })
+      else if (new Set(overlapping.map(r => selected.get(r.raw)!.to)).size !== 1) refuse('word crosses two identities')
+      else selected.get(overlapping[0].raw)!.batchWords.push(binding)
+    })
+  })
+  const plan: MacSpeakerRepairPlan = { id: `live_${state.stateSHA256.slice(0, 24)}`, evidenceHash: state.stateSHA256,
+    expectedDocumentHash: hashMacSpeakerDocument(doc), protectedRawChunkIndices: [], rawAudioSampleCounts: counts, assignments, withheldBatchWords }
+  // Exercise all existing named-evidence and exact word/time protection gates
+  // here; callers cannot accidentally treat plan construction as qualification.
+  projectMacSpeakerRepair(doc, plan)
+  return plan
+}

package/server/lib/mac-speaker-live-store.ts

@@ -0,0 +1,71 @@
+/** Pure durable publication preparation. The caller writes this replacement and
+ * originals atomically before committing in-memory state or emitting an event. */
+import { createMacSpeakerLiveState, MAC_SPEAKER_LIVE_TERMINAL_REVISION, hashMacSpeakerLive, validateMacSpeakerLiveState, withholdMacSpeakerLiveState, type MacSpeakerLiveState } from './mac-speaker-live-memory.js'
+import { projectMacSpeakerLiveChunks, type MacSpeakerLiveSourceChunk } from './mac-speaker-live-projection.js'
+const ZERO='0'.repeat(64)
+export function macSpeakerLiveVoiceHighWater(chunks:readonly unknown[],minimum=0):number{
+ let maximum=minimum
+ const visit=(v:unknown):void=>{if(!v||typeof v!=='object')return
+  const row=v as Record<string,unknown>
+  for(const key of ['speaker','originalSpeaker'])if(typeof row[key]==='string'){
+   const match=/^Voice\s*([1-9]\d?)$/i.exec(row[key] as string);if(match)maximum=Math.max(maximum,Number(match[1]))
+  }
+  for(const key of ['segments','finalSegments','words'])if(Array.isArray(row[key]))for(const child of row[key] as unknown[])visit(child)
+ }
+ for(const c of chunks)visit(c)
+ return maximum
+}
+function reseal(state:MacSpeakerLiveState):MacSpeakerLiveState {const{stateSHA256,...body}=state;return{...body,stateSHA256:hashMacSpeakerLive(body)}}
+export function prepareMacSpeakerLivePublication(input:{captureId:string;generation:string;chunksIndexed:readonly {i:number;c:MacSpeakerLiveSourceChunk & Record<string,unknown>}[];state?:MacSpeakerLiveState;validated:boolean;revision:number;previousDigest?:string}){
+ let state=input.state,invalid=false
+ const unsafeCounter=!Number.isSafeInteger(input.revision)||input.revision<0||input.revision>=MAC_SPEAKER_LIVE_TERMINAL_REVISION-1
+ const revision=unsafeCounter?MAC_SPEAKER_LIVE_TERMINAL_REVISION-1:input.revision
+ if(state){try{validateMacSpeakerLiveState(state);if(state.captureId!==input.captureId||state.generation!==input.generation)throw Error('capture_generation_drift')}
+ catch{invalid=true;state=withholdMacSpeakerLiveState(createMacSpeakerLiveState(input.captureId,input.generation,ZERO,ZERO,99),'recovered_state_invalid')}}
+ if(unsafeCounter||state&&state.revision>=MAC_SPEAKER_LIVE_TERMINAL_REVISION-1){
+  state=withholdMacSpeakerLiveState(createMacSpeakerLiveState(input.captureId,input.generation,ZERO,ZERO,99),'revision_counter_exhausted')
+  state.revision=MAC_SPEAKER_LIVE_TERMINAL_REVISION;state=reseal(state)
+ }
+ if(state){state=structuredClone(state);if(!input.validated||invalid)state.projections=[];state=reseal(state)}
+ let overlay:ReturnType<typeof projectMacSpeakerLiveChunks>
+ try{overlay=projectMacSpeakerLiveChunks({captureId:input.captureId,generation:input.generation,chunksIndexed:input.chunksIndexed,projections:state?.projections??[]})}
+ catch(error){
+  // Projection conflicts (including a newly arrived legacy Voice collision)
+  // revoke the complete overlay. Never leave the prior durable claim visible.
+  if(!state?.projections.length)throw error
+  state.projections=[];state=reseal(state)
+  overlay=projectMacSpeakerLiveChunks({captureId:input.captureId,generation:input.generation,chunksIndexed:input.chunksIndexed,projections:[]})
+ }
+ // A valid state must never advertise proof for rows the source projector refused.
+ if(state&&overlay.withheld.length&&state.projections.length){state.projections=[];state=reseal(state);overlay=projectMacSpeakerLiveChunks({captureId:input.captureId,generation:input.generation,chunksIndexed:input.chunksIndexed,projections:[]})}
+ const changed=input.previousDigest!==overlay.effectiveOverlaySHA256
+ // A prior claim already at the terminal cursor has no representable newer
+ // withdrawal. Refuse adoption; recovery preserves it outside active claims.
+ if(input.revision===MAC_SPEAKER_LIVE_TERMINAL_REVISION&&changed&&input.previousDigest!==undefined)throw Error('live_revision_exhausted')
+ if(!state&&input.previousDigest!==undefined&&changed&&revision>0){
+  invalid=true;state=withholdMacSpeakerLiveState(createMacSpeakerLiveState(input.captureId,input.generation,ZERO,ZERO,99),'recovered_state_missing')
+ }
+ const nextRevision=Math.max(state?.revision??0,revision+(changed||invalid?1:0))
+ if(nextRevision>MAC_SPEAKER_LIVE_TERMINAL_REVISION)throw Error('live_revision_exhausted')
+ if(state){state.revision=nextRevision;state=reseal(state);validateMacSpeakerLiveState(state)}
+ return{speakerIdentityPolicy:'mac-native-v1' as const,sourceType:'mac_system_audio' as const,speakerGeneration:input.generation,speakerRevision:nextRevision,
+  speakerProjectionSHA256:overlay.effectiveOverlaySHA256,speakerProjectedChunksIndexed:overlay.speakerProjectedChunksIndexed,
+  ...(state?{macSpeakerLive:state}:{}),...(invalid?{macSpeakerLiveQuarantineSHA256:hashMacSpeakerLive(input.state??null)}:{}),invalid,
+  sourceBindingSHA256:overlay.sourceBindingSHA256}
+}
+
+/** Main-thread withdrawal path. Never validates, clones or hashes retained
+ * acoustic state. That state is private/untrusted until the worker certifies it. */
+export function macSpeakerLiveOriginalOnly(input:{captureId:string;generation:string;chunksIndexed:readonly {i:number;c:Record<string,unknown>}[];state?:MacSpeakerLiveState;revision:number;previousDigest?:string}){
+ const digest=hashMacSpeakerLive({captureId:input.captureId,generation:input.generation,changes:[]}),changed=input.previousDigest!==digest
+ if(input.revision===MAC_SPEAKER_LIVE_TERMINAL_REVISION&&changed&&input.previousDigest!==undefined)throw Error('live_revision_exhausted')
+ const unsafe=!Number.isSafeInteger(input.revision)||input.revision<0||input.revision>=MAC_SPEAKER_LIVE_TERMINAL_REVISION-1
+ const missing=!input.state&&input.previousDigest!==undefined&&changed&&input.revision>0
+ let terminal:MacSpeakerLiveState|undefined
+ if(unsafe||missing){terminal=withholdMacSpeakerLiveState(createMacSpeakerLiveState(input.captureId,input.generation,ZERO,ZERO,99),unsafe?'revision_counter_exhausted':'recovered_state_missing')
+  terminal.revision=unsafe?MAC_SPEAKER_LIVE_TERMINAL_REVISION:input.revision+1;terminal=reseal(terminal)}
+ const revision=terminal?.revision??input.revision+(changed?1:0)
+ return{speakerIdentityPolicy:'mac-native-v1' as const,sourceType:'mac_system_audio' as const,speakerGeneration:input.generation,speakerRevision:revision,speakerProjectionSHA256:digest,
+  speakerProjectedChunksIndexed:input.chunksIndexed,...(terminal?{macSpeakerLive:terminal}:{}),...(!terminal&&input.state?{macSpeakerLiveRetainedState:input.state}:{}),invalid:false,
+  sourceBindingSHA256:hashMacSpeakerLive({captureId:input.captureId,generation:input.generation,originals:input.chunksIndexed})}
+}

package/server/lib/mac-speaker-live-worker.ts

@@ -0,0 +1,58 @@
+/** Pure computation entry. No filesystem, native models, enrollment or writes. */
+import { createHash } from 'node:crypto'
+import { hasMacSpeakerProtectedRows } from './mac-speaker-protection.js'
+import { isMainThread, parentPort } from 'node:worker_threads'
+import { planMacSpeakerWindows, type VerifiedMacRawChunk, type PreparedMacSpeakerWindow, type MacWindowEmbeddingReceipt } from './mac-speaker-windows.js'
+import { createMacSpeakerLiveState, appendMacSpeakerLiveEvidence, refreshMacSpeakerLiveState, validateMacSpeakerLiveState, validateMacSpeakerLiveProfiles, withholdMacSpeakerLiveState, hashMacSpeakerLive, type MacSpeakerLiveState } from './mac-speaker-live-memory.js'
+import { prepareMacSpeakerLivePublication } from './mac-speaker-live-store.js'
+import type { MacSpeakerProfile } from './mac-speaker-reconcile.js'
+import type { SidecarEntry } from './nemotron-final.js'
+import type { MacSpeakerLiveSourceChunk } from './mac-speaker-live-projection.js'
+export interface MacSpeakerLiveComputeInput {
+  captureId:string;generation:string;sourceBindingSHA256:string;fileBindingsSHA256:string;revision:number;previousDigest?:string;voiceHighWater:number
+  state?:MacSpeakerLiveState;modelSHA256:string;profileSHA256:string;profileJSONBytes:Uint8Array
+  chunksIndexed:readonly {i:number;c:Record<string,unknown>}[];rawChunks:VerifiedMacRawChunk[];humanHistory:boolean
+}
+export interface MacSpeakerLiveComputePrepared {window?:PreparedMacSpeakerWindow;plannedWindows:number;pendingWindows:number;rejectedChunks:number;reason?:string}
+export type MacSpeakerLivePreparedPublication=ReturnType<typeof prepareMacSpeakerLivePublication>
+export interface MacSpeakerLiveComputeResult {
+  state:MacSpeakerLiveState;publication:MacSpeakerLivePreparedPublication;reason:string;plannedWindows:number;pendingWindows:number;rejectedChunks:number;completeEligibleSnapshot:boolean
+}
+export function prepareMacSpeakerLiveCompute(input:MacSpeakerLiveComputeInput){
+  if(input.profileJSONBytes.byteLength>32*1024*1024||input.chunksIndexed.length>8192||input.rawChunks.length>8192||hashMacSpeakerLive(input.chunksIndexed)!==input.sourceBindingSHA256)throw Error('compute_input_binding')
+  if(createHash('sha256').update(input.profileJSONBytes).digest('hex')!==input.profileSHA256)throw Error('compute_profile_bytes_changed')
+  const parsed=JSON.parse(Buffer.from(input.profileJSONBytes).toString()) as {profiles?:MacSpeakerProfile[]}
+  if(!Array.isArray(parsed.profiles))throw Error('profile_cohort_invalid')
+  const profiles=parsed.profiles.map(p=>({...p,profileSHA256:input.profileSHA256}));validateMacSpeakerLiveProfiles(profiles,input.profileSHA256)
+  let state=input.state
+  if(state){try{validateMacSpeakerLiveState(state);if(state.captureId!==input.captureId||state.generation!==input.generation)throw Error('capture_generation_drift')}catch{state=withholdMacSpeakerLiveState(createMacSpeakerLiveState(input.captureId,input.generation,input.modelSHA256,input.profileSHA256,99),'recovered_state_invalid')}}
+  state??=createMacSpeakerLiveState(input.captureId,input.generation,input.modelSHA256,input.profileSHA256,input.voiceHighWater)
+  if(state.modelSHA256!==input.modelSHA256||state.profileSHA256!==input.profileSHA256)state=withholdMacSpeakerLiveState(state,'model_or_profile_drift')
+  if(input.humanHistory||input.chunksIndexed.some(e=>hasMacSpeakerProtectedRows(e.c)))state=withholdMacSpeakerLiveState(state,'human_history')
+  const plan=state.withheldReason?null:planMacSpeakerWindows({sidecar:{sessionId:input.captureId,chunkEntries:input.chunksIndexed.map(e=>({chunkIndex:e.i,chunk:e.c}))as unknown as SidecarEntry[]},rawChunks:input.rawChunks,correctionHistory:'verified-clear'})
+  if(plan&&state.evidence.some(e=>!plan.windows.some(w=>w.id===e.window.id)))throw Error('retained_source_plan_drift')
+  const pending=plan?.windows.filter(w=>!state!.evidence.some(e=>e.window.id===w.id))??[]
+  const prepared:MacSpeakerLiveComputePrepared={...(pending[0]?{window:pending[0]}:{}),plannedWindows:plan?.windows.length??0,pendingWindows:pending.length,rejectedChunks:plan?.rejected.reduce((n,r)=>n+r.chunkIndexes.length,0)??0,...(state.withheldReason?{reason:state.withheldReason}:{})}
+  let finished=false
+  return{prepared,finish(receipt?:MacWindowEmbeddingReceipt):MacSpeakerLiveComputeResult{
+    if(finished)throw Error('compute_already_finished');finished=true
+    let remaining=pending.length
+    if(receipt){if(!pending[0]||receipt.windowId!==pending[0].id)throw Error('compute_unrequested_receipt')
+      state=appendMacSpeakerLiveEvidence(state!,{window:pending[0],receipt,nativeReceiptSHA256:hashMacSpeakerLive({window:pending[0],receipt})},profiles,input.voiceHighWater);remaining--
+    }else if(!pending.length)state=refreshMacSpeakerLiveState(state!,profiles)
+    const complete=!state!.withheldReason&&remaining===0
+    const publication=prepareMacSpeakerLivePublication({captureId:input.captureId,generation:input.generation,chunksIndexed:input.chunksIndexed as {i:number;c:MacSpeakerLiveSourceChunk&Record<string,unknown>}[],state,validated:complete,revision:input.revision,previousDigest:input.previousDigest})
+    state=publication.macSpeakerLive??state!
+    return{state,publication,reason:state.withheldReason??(remaining?'eligible_evidence_pending':state.projections.length?'qualified':'no_qualified_identity'),plannedWindows:prepared.plannedWindows,pendingWindows:remaining,rejectedChunks:prepared.rejectedChunks,completeEligibleSnapshot:complete}
+  }}
+}
+if(!isMainThread&&parentPort){
+  const port=parentPort;let job:string|undefined,computation:ReturnType<typeof prepareMacSpeakerLiveCompute>|undefined
+  port.on('message',(message:{id:number;job:string;op:string;input?:MacSpeakerLiveComputeInput;receipt?:MacWindowEmbeddingReceipt})=>{
+    try{
+      if(message.op==='prepare'){if(computation)throw Error('compute_duplicate_prepare');job=message.job;computation=prepareMacSpeakerLiveCompute(message.input!);port.postMessage({id:message.id,job,ok:true,value:computation.prepared})}
+      else if(message.op==='finish'){if(!computation||job!==message.job)throw Error('compute_job_binding');port.postMessage({id:message.id,job,ok:true,value:computation.finish(message.receipt)})}
+      else throw Error('compute_unknown_operation')
+    }catch(error){port.postMessage({id:message.id,job:message.job,ok:false,error:error instanceof Error?error.message:'compute_failed'})}
+  })
+}

package/server/lib/mac-speaker-live.ts

@@ -0,0 +1,175 @@
+/** Async read-only live extraction adapter. The route owns durable publication;
+ * this module never writes recordings, profiles, corrections or transcripts. */
+import { constants, lstatSync, type BigIntStats } from 'node:fs'
+import { open } from 'node:fs/promises'
+import { join } from 'node:path'
+import { createHash } from 'node:crypto'
+import { dataPath } from './data-dir.js'
+import { type VerifiedMacRawChunk, type MacWindowEmbeddingReceipt } from './mac-speaker-windows.js'
+import { extractQualifiedMacWindow } from './mac-speaker-profile-extractor.js'
+import { readPcm16Mono, pcm16ToWav } from './nemotron-segments.js'
+import { startMacSpeakerLiveCompute, type MacSpeakerLivePublicationCapability } from './mac-speaker-live-compute.js'
+import { hashMacSpeakerLive, type MacSpeakerLiveState } from './mac-speaker-live-memory.js'
+const sha=(bytes:Buffer)=>createHash('sha256').update(bytes).digest('hex')
+const yieldLoop=()=>new Promise<void>(resolve=>setImmediate(resolve))
+async function shaYielding(bytes:Buffer):Promise<string>{const hash=createHash('sha256');for(let at=0;at<bytes.length;at+=1024*1024){hash.update(bytes.subarray(at,at+1024*1024));await yieldLoop()}return hash.digest('hex')}
+export const macSpeakerLiveEnabled=(env:NodeJS.ProcessEnv=process.env):boolean=>env.COS_MAC_SPEAKER_LIVE==='1'
+export interface MacSpeakerLiveInput {
+  captureId:string;generation:string;audioDir:string;ledgerPath:string
+  chunksIndexed:readonly {i:number;c:Record<string,unknown>}[]
+  state?:MacSpeakerLiveState;voiceHighWater:number;revision?:number;previousDigest?:string
+}
+export interface MacSpeakerLiveFileBinding {path:string;exists:boolean;stamp?:string}
+export const macSpeakerLiveFileStamp=(s:BigIntStats)=>[s.dev,s.ino,s.mode,s.size,s.mtimeNs,s.ctimeNs].join(':')
+/** No awaits between this cheap final CAS and the caller's atomic publication. */
+export function assertMacSpeakerLivePublicationBindings(bindings:readonly MacSpeakerLiveFileBinding[]):void{
+ if(!Array.isArray(bindings)||!bindings.length||bindings.length>8200)throw Error('live_publication_bindings_missing')
+ for(const b of bindings){
+  if(!b||typeof b.path!=='string'||typeof b.exists!=='boolean')throw Error('live_publication_binding_invalid')
+  let stat:BigIntStats|undefined;try{stat=lstatSync(b.path,{bigint:true})}catch(error){if((error as NodeJS.ErrnoException).code!=='ENOENT')throw error}
+  if(b.exists?(!stat?.isFile()||macSpeakerLiveFileStamp(stat)!==b.stamp):stat!==undefined)throw Error('live_publication_source_changed')
+ }
+}
+export interface MacSpeakerLiveOutcome {
+  state?:MacSpeakerLiveState;reason:string;latencyMs:number;plannedWindows:number;attemptedWindows:number;pendingWindows:number
+  /** Completeness of this snapshot's canonical eligible plan, never every second of speech. */
+  completeEligibleSnapshot:boolean;rejectedChunks:number;sourceBindingSHA256:string;fileBindings:MacSpeakerLiveFileBinding[];capability?:MacSpeakerLivePublicationCapability
+}
+export interface MacSpeakerLiveDeps {
+  runtime?:()=>Promise<{modelPath:string;profilesPath:string}|null>
+  extract?:(pcm:Buffer,modelPath:string,timeoutMs:number)=>Promise<readonly number[][]|null>
+  now?:()=>number
+  /** Rechecked immediately before child launch; offline tests supply explicit admission. */
+  admit?:(captureId:string)=>boolean
+}
+// Pins are an I/O optimization only: every use reopens O_NOFOLLOW and checks
+// inode/ctime/mtime/size. Changed metadata always causes fresh bytes+hash. Final
+// CAS checks each same pin again; no elapsed-time trust or caller-provided hash.
+const pins=new Map<string,{stamp:string;hash:string;raw?:{pcmSHA256:string;sampleCount:number}}>()
+const stampOf=macSpeakerLiveFileStamp
+async function pinned(path:string,max:number,raw=false):Promise<{stamp:string;hash:string;raw?:{pcmSHA256:string;sampleCount:number}}>{
+ const f=await open(path,constants.O_RDONLY|constants.O_NOFOLLOW|constants.O_NONBLOCK)
+ try{const before=await f.stat({bigint:true});if(!before.isFile()||before.size>BigInt(max))throw Error('unsafe_or_oversized_source')
+  const stamp=stampOf(before),prior=pins.get(path)
+  if(prior?.stamp===stamp&&(!raw||prior.raw))return prior
+  const storage=Buffer.alloc(Number(before.size)+1);let offset=0
+  while(offset<storage.length){const{bytesRead}=await f.read(storage,offset,storage.length-offset,null);if(!bytesRead)break;offset+=bytesRead}
+  const bytes=storage.subarray(0,offset),after=await f.stat({bigint:true})
+  if(bytes.length!==Number(before.size)||stampOf(after)!==stamp)throw Error('source_changed_during_read')
+  const pcm=raw?pcmOf(bytes):undefined
+  const value={stamp,hash:await shaYielding(bytes),...(pcm?{raw:{pcmSHA256:sha(pcm),sampleCount:pcm.length/2}}:{})}
+  if(pins.size>=10000)pins.delete(pins.keys().next().value!);pins.set(path,value);return value
+ }finally{await f.close()}
+}
+async function readBounded(path:string,max:number):Promise<Buffer>{
+  const file=await open(path,constants.O_RDONLY|constants.O_NOFOLLOW|constants.O_NONBLOCK)
+  try{
+    const before=await file.stat({bigint:true});if(!before.isFile()||before.size>BigInt(max))throw Error('unsafe_or_oversized_source')
+    const buffer=Buffer.alloc(Number(before.size)+1);let offset=0
+    while(offset<buffer.length){const{bytesRead}=await file.read(buffer,offset,buffer.length-offset,null);if(!bytesRead)break;offset+=bytesRead}
+    const after=await file.stat({bigint:true})
+    if(offset!==Number(before.size)||stampOf(after)!==stampOf(before))throw Error('source_changed_during_read')
+    const bytes=buffer.subarray(0,offset),prior=pins.get(path)
+    if(pins.size>=10000)pins.delete(pins.keys().next().value!)
+    const hash=await shaYielding(bytes)
+    pins.set(path,{stamp:stampOf(before),hash,...(prior?.hash===hash&&prior.raw?{raw:prior.raw}:{})})
+    return bytes
+  }finally{await file.close()}
+}
+async function ledgerBytes(path:string):Promise<Buffer|null>{try{return await readBounded(path,1024*1024)}catch(error){if((error as NodeJS.ErrnoException).code==='ENOENT')return null;throw error}}
+function pcmOf(wav:Buffer):Buffer{
+  if(wav.length<44||wav.toString('ascii',0,4)!=='RIFF'||wav.readUInt32LE(4)!==wav.length-8||wav.toString('ascii',8,12)!=='WAVE'||wav.toString('ascii',12,16)!=='fmt '||wav.readUInt32LE(16)!==16||wav.readUInt16LE(20)!==1
+    ||wav.readUInt16LE(22)!==1||wav.readUInt32LE(24)!==16000||wav.readUInt16LE(34)!==16||wav.toString('ascii',36,40)!=='data'||wav.readUInt32LE(40)!==wav.length-44||(wav.length-44)%2)throw Error('invalid_raw_audio')
+  const pcm=readPcm16Mono(wav);if(!pcm||pcm.sampleRate!==16000)throw Error('invalid_raw_audio');return pcm.pcm
+}
+async function defaultRuntime(){
+ // speakerModelState()/isEmbeddingAvailable() initialize the legacy native
+ // extractor synchronously. Candidate discovery here must never call either.
+ const{speakerModelCandidates}=await import('./speaker-embeddings.js')
+ for(const modelPath of speakerModelCandidates()){
+  let file:Awaited<ReturnType<typeof open>>|undefined
+  try{file=await open(modelPath,constants.O_RDONLY|constants.O_NOFOLLOW|constants.O_NONBLOCK);const info=await file.stat()
+   if(info.isFile()&&info.size>=1000000&&info.size<=128*1024*1024)return{modelPath,profilesPath:dataPath('voice-profiles.json')}
+  }catch{/* try the next configured local candidate */}finally{await file?.close()}
+ }
+ return null
+}
+let busy=false
+/** One new disjoint window per invocation; the scheduler drains backlog without
+ * blocking transcription. No sampled12-window plan and no first-N-success claim. */
+export async function runMacSpeakerLivePass(input:MacSpeakerLiveInput,deps:MacSpeakerLiveDeps={}):Promise<MacSpeakerLiveOutcome>{
+  const now=deps.now??Date.now,start=now(),sourceBindingSHA256=hashMacSpeakerLive(input.chunksIndexed)
+  let compute:Awaited<ReturnType<typeof startMacSpeakerLiveCompute>>|undefined,capability:MacSpeakerLivePublicationCapability|undefined,fileBindings:MacSpeakerLiveFileBinding[]=[],state=input.state,plannedWindows=0,attemptedWindows=0,pendingWindows=0,rejectedChunks=0,owns=false
+  const result=(reason:string,completeEligibleSnapshot=false):MacSpeakerLiveOutcome=>({state,reason,latencyMs:now()-start,plannedWindows,attemptedWindows,pendingWindows,completeEligibleSnapshot,rejectedChunks,sourceBindingSHA256,fileBindings,capability})
+  try{
+    const admitted=()=> (deps.admit??(()=>macSpeakerLiveEnabled()))(input.captureId)
+    if(!admitted())return result('live_admission_closed')
+    if(input.chunksIndexed.length>8192)throw Error('raw_source_budget_exhausted')
+    const ledger=await ledgerBytes(input.ledgerPath)
+    const runtime=await(deps.runtime??defaultRuntime)();if(!runtime)throw Error('model_unavailable')
+    const profileBytes=await readBounded(runtime.profilesPath,32*1024*1024),profileSHA256=await shaYielding(profileBytes)
+    const initialProfileStamp=pins.get(runtime.profilesPath)!.stamp
+    const modelPin=await pinned(runtime.modelPath,128*1024*1024),modelSHA256=modelPin.hash
+    const initialLedgerStamp=ledger!==null?pins.get(input.ledgerPath)!.stamp:undefined
+    await yieldLoop()
+    const raw:VerifiedMacRawChunk[]=[],bindings=new Map<number,{hash:string;stamp:string}>()
+    for(const entry of input.chunksIndexed){
+      if(!Number.isSafeInteger(entry.i)||entry.i<0||entry.i>=10000)throw Error('invalid_raw_index')
+      // Unhashed legacy placeholders cannot become support; planner reports them.
+      if(typeof entry.c.audioSha256!=='string')continue
+      const binding=await pinned(join(input.audioDir,`chunk_${String(entry.i).padStart(4,'0')}.wav`),960044,true),audioSHA256=binding.hash
+      if(audioSHA256!==entry.c.audioSha256)throw Error('raw_audio_drift')
+      bindings.set(entry.i,{hash:audioSHA256,stamp:binding.stamp})
+      raw.push({chunkIndex:entry.i,audioSHA256,pcmSHA256:binding.raw!.pcmSHA256,sampleRate:16000,channels:1,format:'pcm_s16le',sampleCount:binding.raw!.sampleCount,verified:true})
+      await yieldLoop();if(now()-start>15000)throw Error('live_pass_deadline')
+    }
+    fileBindings=[{path:runtime.modelPath,exists:true,stamp:modelPin.stamp},{path:runtime.profilesPath,exists:true,stamp:initialProfileStamp},
+      ...[...bindings].map(([index,binding])=>({path:join(input.audioDir,`chunk_${String(index).padStart(4,'0')}.wav`),exists:true,stamp:binding.stamp}))]
+    fileBindings.push({path:input.ledgerPath,exists:ledger!==null,...(ledger!==null?{stamp:initialLedgerStamp}:{})})
+    compute=await startMacSpeakerLiveCompute({captureId:input.captureId,generation:input.generation,sourceBindingSHA256,fileBindingsSHA256:hashMacSpeakerLive(fileBindings),revision:input.revision??0,previousDigest:input.previousDigest,
+      voiceHighWater:input.voiceHighWater,state:input.state,modelSHA256,profileSHA256,profileJSONBytes:new Uint8Array(profileBytes.buffer,profileBytes.byteOffset,profileBytes.byteLength),chunksIndexed:input.chunksIndexed,rawChunks:raw,humanHistory:!!ledger?.toString().trim()},
+      {timeoutMs:Math.max(1,Math.min(5000,15000-(now()-start)))})
+    const prepared=compute.prepared;plannedWindows=prepared.plannedWindows;pendingWindows=prepared.pendingWindows;rejectedChunks=prepared.rejectedChunks
+    let receipt:MacWindowEmbeddingReceipt|undefined
+    if(prepared.window){
+      if(busy)return result('native_lane_busy')
+      busy=true;owns=true;const window=prepared.window,buffers:Buffer[]=[]
+      for(const source of window.sources){const wav=await readBounded(join(input.audioDir,`chunk_${String(source.chunkIndex).padStart(4,'0')}.wav`),960044);if(sha(wav)!==source.audioSHA256)throw Error('raw_audio_drift');buffers.push(pcmOf(wav))}
+      const pcm=Buffer.concat(buffers);attemptedWindows++
+      if(!admitted())return result('live_admission_closed')
+      const vectors=await(deps.extract??extractQualifiedMacWindow)(pcm,runtime.modelPath,Math.max(1,Math.min(8000,15000-(now()-start))))
+      if(vectors)receipt={windowId:window.id,windowBindingSHA256:window.bindingSHA256,modelSHA256,audioSHA256:sha(pcm16ToWav(pcm,16000)),pcmSHA256:sha(pcm),sampleCount:pcm.length/2,embedding:vectors[0],halfEmbeddings:[vectors[1],vectors[2]]}
+    }
+    const finished=await compute.finish(receipt)
+    state=finished.state;capability=finished.capability;pendingWindows=finished.pendingWindows
+    // Final complete source/model/profile/history CAS, before route publication.
+    if(await shaYielding(await readBounded(runtime.profilesPath,32*1024*1024))!==profileSHA256||(await pinned(runtime.modelPath,128*1024*1024)).hash!==modelSHA256
+      ||hashMacSpeakerLive(await ledgerBytes(input.ledgerPath))!==hashMacSpeakerLive(ledger))throw Error('model_profile_or_history_changed')
+    for(const[index,expected]of bindings){if((await pinned(join(input.audioDir,`chunk_${String(index).padStart(4,'0')}.wav`),960044,true)).hash!==expected.hash)throw Error('raw_audio_drift');await yieldLoop();if(now()-start>15000)throw Error('live_pass_deadline')}
+    assertMacSpeakerLivePublicationBindings(fileBindings)
+    if(!admitted())throw Error('live_admission_closed')
+    if(now()-start>15000)throw Error('live_pass_deadline')
+    return result(prepared.window&&!receipt?'extraction_unavailable':finished.reason,finished.completeEligibleSnapshot)
+  }catch(error){
+    const reason=error instanceof Error?error.message:'live_unavailable'
+    state=undefined;capability=undefined
+    return result(reason)
+  }finally{await compute?.close();if(owns)busy=false}
+}
+/** Coalescing async runner; no spin on unavailable models or failed extraction. */
+export function createMacSpeakerLiveScheduler(deps:{snapshot:(captureId:string)=>MacSpeakerLiveInput|null;commit:(captureId:string,outcome:MacSpeakerLiveOutcome)=>boolean;runtime?:MacSpeakerLiveDeps;lease?:()=>{release():void}}){
+  const pending=new Set<string>();let running=false
+  const pump=async()=>{if(running)return;running=true;try{
+    while(pending.size){const id=pending.values().next().value!;pending.delete(id);const input=deps.snapshot(id);if(!input)continue
+      let lease:{release():void}|undefined
+      try{
+        lease=deps.lease?.()
+        const outcome=await runMacSpeakerLivePass(input,deps.runtime)
+        const applied=deps.commit(id,outcome)
+        if(applied&&outcome.state&&outcome.reason==='eligible_evidence_pending')pending.add(id)
+      }catch{/* Closed maintenance admission defers work until a new capture event. */}finally{lease?.release()}
+      await yieldLoop()
+    }
+  }finally{running=false}}
+  return{schedule(captureId:string){pending.add(captureId);setImmediate(()=>{void pump().catch(()=>{})})},async drain(){await pump();while(running)await new Promise<void>(r=>setTimeout(r,5))}}
+}

package/server/lib/mac-speaker-profile-extractor.ts

@@ -17,25 +17,30 @@ process.stdin.on('end',()=>{
  if(!extractor.isReady(stream))throw Error('not ready');return Array.from(extractor.compute(stream));};
  const half=Math.floor(pcm.length/4)*2; process.stdout.write(JSON.stringify([embed(pcm),embed(pcm.subarray(0,half)),embed(pcm.subarray(half))]));
 });`
+let qualifiedExtractionBusy=false
 export async function extractQualifiedMacWindow(pcm: Buffer, modelPath: string, timeoutMs: number, deps: { spawn?: typeof spawn; modulePath?: string } = {}): Promise<readonly number[][] | null> {
-  if (pcm.length < 896000 || pcm.length > 960000 || pcm.length % 2 || timeoutMs <= 0) return null
+  if (pcm.length < 896000 || pcm.length > 960000 || pcm.length % 2 || !Number.isFinite(timeoutMs) || timeoutMs <= 0) return null
   let modulePath: string
   try { modulePath = deps.modulePath ?? require.resolve('sherpa-onnx-node') } catch { return null }
-  return new Promise(resolve => {
-    const child = (deps.spawn ?? spawn)(process.execPath, ['-e', worker, modulePath, modelPath], { stdio: ['pipe', 'pipe', 'pipe'] })
+  if(qualifiedExtractionBusy)return null
+  qualifiedExtractionBusy=true
+  const deadline=Date.now()+timeoutMs
+  try{return await new Promise<readonly number[][]|null>(resolve => {
+    let child:ReturnType<typeof spawn>
+    try{child=(deps.spawn ?? spawn)(process.execPath, ['-e', worker, modulePath, modelPath], { stdio: ['pipe', 'pipe', 'pipe'] })}catch{resolve(null);return}
     const output: Buffer[] = []; let size = 0, settled = false, aborted = false
     const finish = (result: readonly number[][] | null) => { if (settled) return; settled = true; clearTimeout(timer); resolve(result) }
     const abort = () => { aborted = true; child.kill('SIGKILL') }
     // Keep ownership until close confirms native termination. Releasing on
     // kill() alone permits a second native job while the first still exits.
-    const timer = setTimeout(abort, timeoutMs)
-    child.stdout.on('data', b => { size += b.length; if (size > 131072) abort(); else if (!aborted) output.push(Buffer.from(b)) })
+    const timer = setTimeout(abort, Math.max(0,deadline-Date.now()))
+    child.stdout!.on('data', b => { size += b.length; if (size > 131072 || Date.now()>=deadline) abort(); else if (!aborted) output.push(Buffer.from(b)) })
     // Drain diagnostics without retaining native stderr or logging private input.
-    child.stderr.on('data', () => {})
-    child.on('error', () => { aborted = true; if (!child.pid) finish(null); else child.kill('SIGKILL') }); child.stdin.on('error', () => {})
+    child.stderr!.on('data', () => {})
+    child.on('error', () => { aborted = true; if (!child.pid) finish(null); else child.kill('SIGKILL') }); child.stdin!.on('error', () => {})
     child.on('close', code => {
-      try { const rows = JSON.parse(Buffer.concat(output).toString()); finish(!aborted && code === 0 && Array.isArray(rows) && rows.length === 3 ? rows : null) } catch { finish(null) }
+      try { const rows = JSON.parse(Buffer.concat(output).toString()); finish(!aborted && Date.now()<deadline && code === 0 && Array.isArray(rows) && rows.length === 3 ? rows : null) } catch { finish(null) }
     })
-    child.stdin.end(pcm)
-  })
+    child.stdin!.end(pcm)
+  })}finally{qualifiedExtractionBusy=false}
 }