@gotcos/glasses-server 6.95.0 → 6.98.0

package/server/routes/meeting.ts

@@ -1,8 +1,15 @@
 import { runQualifiedMacProfilePass } from '../lib/mac-speaker-profile-finalizer.js'
 import { readMacSpeakerMachineEvidence } from '../lib/mac-speaker-machine-evidence.js'
+import { isEffectiveMacSpeakerCallView, readMacSpeakerCallView } from '../lib/mac-speaker-call-view.js'
+import { commitMacCallHumanAnnotation, isMacCallHumanName, macCallHumanPaths, macCallHumanScopes, previewMacCallHumanAnnotation, readMacCallHumanFile, recoverMacCallHumanAnnotation, type MacCallHumanFiles, type MacCallHumanScope } from '../lib/mac-speaker-call-human.js'
+import type { MacSpeakerCallPacket, MacSpeakerCallView } from '../lib/mac-speaker-call-view.js'
+import { buildMacIntervalHumanScopes, commitMacIntervalHumanAnnotation, inspectMacIntervalHumanJournal, macIntervalHumanPaths, previewMacIntervalHumanAnnotation, recoverMacIntervalHumanAnnotation, undoMacIntervalHumanAnnotation, type MacIntervalHumanScope } from '../lib/mac-speaker-call-interval-human.js'
+import { commitOriginalViewTransaction, inspectOriginalViewTransaction, originalViewPaths, previewOriginalViewTransaction, recoverOriginalViewTransaction } from '../lib/mac-speaker-call-original-view.js'
+import { checkSpeakerName } from '../lib/speaker-name.js'
 import { dataPath } from '../lib/data-dir.js'
 import { PHONE_CAPTURE_ID, PHONE_SOURCE_TYPE, assertPhoneProvenance, readPhoneRecording, requirePhoneRecording, closePhoneRecording } from '../lib/phone-recording.js'
 import { MAC_CAPTURE_ID, readMacRecording, requireMacRecording, macChunkReceipt, closeMacRecording } from '../lib/mac-recording.js'
+import { bodyName, nfc, sameRecordId, sameSpeakerName } from '../lib/speaker-name-nfc.js'
 import { readSpeakerPolicy, writeSpeakerPolicy, isSpeakerMode } from '../lib/meeting-speaker-policy.js'
 // POST /api/meeting/save — finalize an existing transcribe-stream session into
 // the standalone public meeting store. The live transcript and chunk metadata
@@ -12,7 +19,7 @@ import { existsSync, readdirSync, readFileSync, rmSync, statSync, unlinkSync } f
 import { isWorthRecovering } from '../lib/quarantine-auto-recover.js'
 import { basename, resolve } from 'node:path'
 import { createHash } from 'node:crypto'
-import { Router } from 'express'
+import { Router, type RequestHandler } from 'express'
 import { emitDisplay } from '../lib/display-bus.js'
 import { createStopRequestStore, isStopRequestRefusal, STOP_REQUEST_CLAIM_WINDOW_MS, type StopRequest, type StopRequestStore } from '../lib/meeting-stop-requests.js'
 import { appendAutonomousSaveLog, getStopIntentStore, type StopIntent, type StopIntentStore } from '../lib/meeting-stop-intents.js'
@@ -47,6 +54,9 @@ import {
 import { readVoiceProfiles, retractEmbeddingsBySource } from '../lib/speaker-embeddings.js'
 import { enrolNamedVoice } from '../lib/meeting-relabel-enrolment.js'
 import { commitMacVoiceAssignment, planMacVoiceAssignment, type MacAssignGate, type MacAssignPlan, type MacAssignSkip } from '../lib/mac-voice-assignment.js'
+import { readVoiceDisplay, voiceDisplayScopes } from '../lib/mac-voice-display.js'
+import { registerMacVoiceNamingBatchRoutes } from '../lib/mac-voice-naming-batch.js'
+import { getVoiceSuggestionRunner, voiceSidecarEntries, voiceSuggestionPauseLease, voiceSuggestionRecordingLease, type VoiceSuggestionBlock, type VoiceSuggestionRunner } from '../lib/mac-voice-suggestions.js'
 import { isMacCaptureSidecar, isVoiceLabel } from '../lib/mac-voice-labels.js'
 
 function requireMacRecordingForSave(sessionId: string, expectedChunkCount: unknown): void {
@@ -194,16 +204,20 @@ import {
 } from '../lib/g2-ops-handoff.js'
 import {
   canonicalFinalizationIsComplete,
+  finalizationStop,
   MeetingFinalizationJobStore,
   markCanonicalFinalizationState,
   readFinalizationChunkEntries,
+  stoppedFinalizationRetryDue,
   type MeetingFinalizationJob,
 } from '../lib/meeting-finalization-jobs.js'
 import { enrichStandaloneMeeting } from '../lib/meeting-summary-persistence.js'
 import { bootResumeGate, type BootResumeGate } from '../lib/boot-resume.js'
+import { managedServerVersion } from '../lib/managed-runtime.js'
 import { recordFinalPassSkip, runNemotronFinalPass, type FinalPassOptions, type FinalPassOutcome } from '../lib/nemotron-final.js'
 import { runTranscriptCleanup, type CleanupOutcome } from '../lib/transcript-cleanup.js'
 import { notifySpeakerShadowFinalized } from '../lib/speaker-shadow.js'
+import { macSpeakerCallCachedRefreshAvailability, notifyMacSpeakerCallFinalized, notifyMacSpeakerCallLedgerChanged } from '../lib/mac-speaker-call-producer.js'
 import { sweepTranscriptCleanupData } from '../lib/transcript-cleanup-screen.js'
 import type { TranscriptCleanupRouteDeps } from './transcript-cleanup.js'
 
@@ -228,13 +242,31 @@ function cosOpsPipelineConfigured(): boolean {
  * A failure is logged and never fails the capture's own finalization, because a retry would
  * re-run the standalone summary; mac_library_backfill.py files it later, idempotently.
  */
-async function fileFinishedMacRecording(sessionId: string, meetingPath: string, label: string): Promise<void> {
+export async function fileFinishedMacRecording(sessionId: string, meetingPath: string, label: string, deps: {
+  configured?: () => boolean
+  file?: typeof fileMacRecordingInLibrary
+  notify?: typeof notifyMacSpeakerCallFinalized
+  shadowNotify?: typeof notifySpeakerShadowFinalized
+  operationsRoot?: () => string | null
+} = {}): Promise<void> {
   // Callers pass Mac captures only (finalization and orphan recovery both check MAC_CAPTURE_ID).
-  if (!cosOpsPipelineConfigured()) return
+  if (!MAC_CAPTURE_ID.test(sessionId)) return
+  const notify = deps.notify ?? notifyMacSpeakerCallFinalized
   try {
-    const filing = await fileMacRecordingInLibrary(meetingPath)
+    if (!(deps.configured ?? cosOpsPipelineConfigured)()) return
+    const filing = await (deps.file ?? fileMacRecordingInLibrary)(meetingPath)
     if (filing.outcome === 'filed') {
       console.log(`[${label}] Mac recording ${sessionId} filed into the library (${filing.status}): ${filing.path}`)
+      // The exact-file importer returns its chosen destination. Never guess a
+      // second copy from a title or apply one copy's packet to another BASE.
+      const root = (deps.operationsRoot ?? resolveCosOperationsDir)()
+      const filedPath = resolve(filing.path), sidecarPath = filedPath.replace(/\.md$/, '.g2-chunks.json')
+      if (root && filedPath.startsWith(`${root}/`) && filedPath.endsWith('.md')) {
+        const source = JSON.parse(readMacCallHumanFile(sidecarPath, 32 * 1024 * 1024)!.text)
+        if (source.sessionId === sessionId && source.sourceType === 'mac_system_audio') {
+          await notify({ sessionId, sidecarPath })
+        }
+      }
     } else {
       console.log(`[${label}] Mac recording ${sessionId} stays standalone: ${filing.reason}`)
     }
@@ -243,6 +275,15 @@ async function fileFinishedMacRecording(sessionId: string, meetingPath: string,
       `[${label}] Mac recording ${sessionId} was not filed into the library: `
       + `${error instanceof Error ? error.message : String(error)}`,
     )
+  } finally {
+    // The canonical standalone recording remains a registered target when
+    // filing is unavailable or fails. Notifications never make saving fail.
+    try { await notify({ sessionId, sidecarPath: meetingPath.replace(/\.md$/, '.g2-chunks.json') }) }
+    catch { console.warn(`[${label}] Closed-call speaker reconciliation deferred for ${sessionId}`) }
+    // Register the publishing consumer before the log-only consumer can start
+    // shared inference. An already-running log-only execution cannot acquire
+    // pre-native source provenance retroactively.
+    (deps.shadowNotify ?? notifySpeakerShadowFinalized)({ sessionId, sidecarPath: meetingPath.replace(/\.md$/, '.g2-chunks.json') })
   }
 }
 
@@ -262,7 +303,7 @@ function markdownUnreadableReason(operations: { mergedScribeConflict?: string[]
 }
 
 function requestedRecordMatches(requested: unknown, expected: string): boolean {
-  return requested == null || requested === '' || requested === expected
+  return requested == null || requested === '' || sameRecordId(requested, expected)
 }
 
 interface MeetingSessionSource {
@@ -317,6 +358,8 @@ export interface MeetingRouteDependencies {
   stopRequests?: StopRequestStore
   /** 6.77.0: the post-save transcript cleanup (lib/transcript-cleanup.ts). */
   transcriptCleanup?: TranscriptCleanupRunner
+  /** 6.96.3: on-click voice suggestions (lib/mac-voice-suggestions.ts). Tests inject a runner with a fake extractor. */
+  voiceSuggestions?: VoiceSuggestionRunner
   /** 6.81.0: the phone's Stop, durable (lib/meeting-stop-intents.ts). */
   stopIntents?: StopIntentStore
   /** 6.81.0: the server's own save of a stopped meeting. Tests inject the clock, timer and gate. */
@@ -331,6 +374,8 @@ export interface MeetingRouteDependencies {
 
 const activeFinalizationJobs = new Set<string>()
 const finalizationRetryCounts = new Map<string, number>()
+/** Retries after a job's first failure in one process, 60 s and 120 s apart. */
+const FINALIZATION_RETRY_LIMIT = 2
 
 interface FinalizationRuntime {
   finalizationJobs: MeetingFinalizationJobStore
@@ -383,13 +428,17 @@ export function scheduleFinalizationJob(job: MeetingFinalizationJob, runtime: Fi
     allowDuringDrain: true,
     phase: 'queued',
   })
+  // 6.97.0: an attempt is starting, so a job that had stopped is work in progress again.
+  try { runtime.finalizationJobs.clearStopped(job.sessionId) } catch { /* the lease above still holds the drain */ }
   const jobStartedAt = Date.now()
   const task = Promise.resolve().then(async () => {
     lease.setPhase('active')
     let current = runtime.finalizationJobs.get(job.sessionId) ?? job
     if (canonicalFinalizationIsComplete(current)) {
+      if (MAC_CAPTURE_ID.test(current.sessionId)) await notifyMacSpeakerCallFinalized({ sessionId: current.sessionId, sidecarPath: current.sidecarPath, freezeOnly: true })
       runtime.finalizationJobs.remove(current.sessionId)
       bootResumeGate().forget('meeting_finalization', current.sessionId)
+      if (MAC_CAPTURE_ID.test(current.sessionId)) runtime.scheduleBackground(fileFinishedMacRecording(current.sessionId, current.meetingPath, 'meeting/resume'))
       return
     }
     if (current.phase === 'capture_pending') {
@@ -492,9 +541,9 @@ export function scheduleFinalizationJob(job: MeetingFinalizationJob, runtime: Fi
       await enrichStandaloneMeeting(current.meetingPath, jobStartedAt)
     }
     markCanonicalFinalizationState(current.sidecarPath, 'complete', false)
-    // 6.95.0: speaker merge shadow mode (off unless COS_SPEAKER_SHADOW=1). Log only and
-    // fire-and-forget: it queues, defers under live work, and never throws back here.
-    if (MAC_CAPTURE_ID.test(current.sessionId)) notifySpeakerShadowFinalized({ sessionId: current.sessionId, sidecarPath: current.sidecarPath })
+    // Capture the pre-correction source while the finalization guard still
+    // refuses human edits. A deferred producer keeps its own durable work item.
+    if (MAC_CAPTURE_ID.test(current.sessionId)) await notifyMacSpeakerCallFinalized({ sessionId: current.sessionId, sidecarPath: current.sidecarPath, freezeOnly: true })
     // The capture is finished and its files are durable, so the merge engine may score it.
     // Fire-and-forget by contract: the runner queues, defers under a drain or a live
     // capture, and never throws back at the finalization path.
@@ -512,6 +561,9 @@ export function scheduleFinalizationJob(job: MeetingFinalizationJob, runtime: Fi
     }
   }).catch(error => {
     const current = runtime.finalizationJobs.get(job.sessionId) ?? job
+    const retryCount = finalizationRetryCounts.get(key) ?? 0
+    // 6.97.0: nothing will try this again in this process, so it stops counting as work.
+    const outOfRetries = retryCount >= FINALIZATION_RETRY_LIMIT
     try {
       runtime.finalizationJobs.save({
         sessionId: current.sessionId,
@@ -522,14 +574,14 @@ export function scheduleFinalizationJob(job: MeetingFinalizationJob, runtime: Fi
         phase: current.phase,
         claimPending: current.claimPending,
         lastError: error instanceof Error ? error.message : String(error),
+        ...(outOfRetries ? { stopped: { at: new Date().toISOString(), reason: 'retries_exhausted' as const, version: managedServerVersion() } } : {}),
       })
     } catch { /* keep the original durable job if error annotation fails */ }
     console.error(
       `[meeting/save] Durable finalization retained for retry (${job.sessionId}): `
       + `${error instanceof Error ? error.message : String(error)}`,
     )
-    const retryCount = finalizationRetryCounts.get(key) ?? 0
-    if (retryCount < 2) {
+    if (!outOfRetries) {
       finalizationRetryCounts.set(key, retryCount + 1)
       const retryRetained = () => {
         if (!maintenanceAdmissionsOpen()) {
@@ -558,6 +610,8 @@ export function resumeMeetingFinalizationJobs(options: {
   gate?: BootResumeGate
   finalizationJobs?: MeetingFinalizationJobStore
   schedule?: (job: MeetingFinalizationJob) => void
+  now?: number
+  version?: string | null
 } = {}): void {
   const finalizationJobs = options.finalizationJobs ?? new MeetingFinalizationJobStore()
   finalizationJobs.reconcileCanonicalSidecars()
@@ -567,11 +621,25 @@ export function resumeMeetingFinalizationJobs(options: {
     runBatch: runMeetingBatchPipeline,
     scheduleBackground: task => { void task },
   }))
+  const now = options.now ?? Date.now()
+  const version = options.version === undefined ? managedServerVersion() : options.version
   for (const job of finalizationJobs.list()) {
     if (options.sessionId !== undefined && job.sessionId !== options.sessionId) continue
+    // 6.97.0: a job that gave up does not take the lock back on every start. It is tried again on
+    // another server version, which may have the fix, or 6 hours after it stopped. A person's Retry
+    // (`sessionId`) always runs.
+    const stop = finalizationStop(job)
+    if (stop && options.sessionId === undefined && !stoppedFinalizationRetryDue(stop, now, version)) continue
     // 6.78.0: counted (durably) BEFORE it runs, so a job that kills the process is parked
     // after RESTART_LIMIT crashed boots. A parked job is skipped and stays in its store.
-    if (!gate.admit('meeting_finalization', job.sessionId, job.phase)) continue
+    if (!gate.admit('meeting_finalization', job.sessionId, job.phase)) {
+      // 6.97.0: parked means nothing is trying it, so it must not hold Restart or Update either.
+      try { if (stop?.reason !== 'crash_parked') finalizationJobs.markStopped(job, 'crash_parked', version) } catch { /* stays as it was */ }
+      continue
+    }
+    // 6.97.0: a job that already failed gets one attempt per start, with no timers: its lock lasts as
+    // long as that attempt runs. This also covers a job that failed before 6.97.0 wrote stops down.
+    if (stop || job.lastError) finalizationRetryCounts.set(`${finalizationJobs.root}:${job.sessionId}`, FINALIZATION_RETRY_LIMIT)
     schedule(job)
   }
 }
@@ -734,6 +802,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
   const finalDiarize = deps.finalDiarize ?? runNemotronFinalPass
   const qualifiedProfilePass = deps.qualifiedProfilePass ?? runQualifiedMacProfilePass
   const transcriptCleanup = deps.transcriptCleanup
+  const voiceSuggestions = deps.voiceSuggestions ?? getVoiceSuggestionRunner()
   const router = Router()
   const captureActive = deps.captureActive ?? (() => getTranscriptionSessionLiveness().live > 0)
   const savingSessions = new Set<string>()
@@ -1578,18 +1647,285 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
   // Keyed on sessionId so it can reuse the store's traversal-hardened readers
   function reviewRevision(meetingPath: string, sidecarPath: string): string {
     const hash = createHash('sha256')
+    let sidecarJSON: string | null = null
     for (const path of [meetingPath, sidecarPath]) {
       let text: string | null = null
       try { text = readFileSync(path, 'utf-8') } catch { /* missing content is part of the revision */ }
       hash.update(JSON.stringify(text))
+      if (path === sidecarPath) sidecarJSON = text
+    }
+    // Existing clients already round-trip this opaque 64-character revision.
+    // A packet/ledger change that withdraws a view must invalidate its preview,
+    // even when the immutable base files have not changed at all.
+    if (sidecarJSON) {
+      try {
+        const view = readMacSpeakerCallView(sidecarPath, sidecarJSON, meetingPath)
+        if (isEffectiveMacSpeakerCallView(view)) hash.update(JSON.stringify({ packetSHA256: view.metadata.packetSHA256, generation: view.metadata.generation, revision: view.metadata.revision, mode: view.metadata.mode, humanAnnotation: view.metadata.humanAnnotation, intervalHumanAnnotation: view.metadata.intervalHumanAnnotation, intervalHumanRecoveryRequired: view.metadata.intervalHumanRecoveryRequired }))
+      } catch { /* Preserve existing unreadable-base handling in each caller. */ }
+    }
+    // Include sidecar-only decisions and recovery states even after an automatic
+    // packet is withdrawn or becomes unreadable. Old preview revisions fail CAS.
+    if (MAC_CAPTURE_ID.test(String((() => { try { return JSON.parse(sidecarJSON ?? '{}').sessionId } catch { return '' } })()))) {
+      const id = JSON.parse(sidecarJSON!).sessionId
+      const files = { sidecarPath, meetingPath }, paths = macIntervalHumanPaths(files, id), legacy = macCallHumanPaths(files, id)
+      for (const [path, limit] of [[paths.packet, 16 * 1024 * 1024], [sidecarPath.replace(/\.g2-chunks\.json$/, '.speaker-call-state.json'), 16 * 1024 * 1024], [paths.legacyAnnotation, 16 * 1024 * 1024], [paths.annotation, 16 * 1024 * 1024], [paths.journal, 40 * 1024 * 1024], [originalViewPaths(files, id).journal, 1024 * 1024], [legacy.journal, 64 * 1024 * 1024], [paths.ledger, 8 * 1024 * 1024]] as const) {
+        try { hash.update(JSON.stringify(readMacCallHumanFile(path, limit, true)?.hash ?? null)) }
+        catch { hash.update(JSON.stringify({ unreadable: path })) }
+      }
     }
     return hash.digest('hex')
   }
 
+  function callViewMutationRefusal(sessionId: string): { status: number; body: Record<string, unknown> } | null {
+    const operations = cosOperationsMeetingsConfigured() ? findCosOperationsMeetingBySessionId(sessionId) : null
+    const direct = operations ? null : findDirectLibraryMeetingBySessionId(sessionId)
+    const saved = operations || direct ? null : store.findBySessionId(sessionId)
+    if (!operations && !direct && !saved) return null
+    const sidecarPath = operations?.sidecarPath ?? direct?.sidecarPath ?? saved!.sidecarPath
+    try {
+      if (MAC_CAPTURE_ID.test(sessionId)) {
+        const files = { sidecarPath, meetingPath: operations?.meetingPath ?? direct?.meetingPath ?? saved!.filepath }
+        const originalTransaction = inspectOriginalViewTransaction(files, sessionId)
+        if (originalTransaction.status === 'prepared' || originalTransaction.status === 'recovery-invalid') return { status: 409, body: { reason: 'human_annotation_recovery_required', error: 'Finish the interrupted return to the original view before another correction.', mutable: false } }
+        let pending = true
+        try { const journal = readMacCallHumanFile(macCallHumanPaths({ sidecarPath, meetingPath: operations?.meetingPath ?? direct?.meetingPath ?? saved!.filepath }, sessionId).journal, 64 * 1024 * 1024, true); pending = journal !== null && JSON.parse(journal.text).phase !== 'complete' } catch { /* A malformed owned journal must not permit a competing mutation. */ }
+        const intervalJournal = inspectMacIntervalHumanJournal({ sidecarPath, meetingPath: operations?.meetingPath ?? direct?.meetingPath ?? saved!.filepath }, sessionId)
+        pending = pending || intervalJournal.status === 'prepared' || intervalJournal.status === 'recovery-invalid'
+        if (pending) return { status: 409, body: { reason: 'human_annotation_recovery_required', error: 'Finish the interrupted scoped annotation before another correction.', mutable: false } }
+      }
+      const view = readMacSpeakerCallView(sidecarPath, readFileSync(sidecarPath, 'utf8'), operations?.meetingPath ?? direct?.meetingPath ?? saved!.filepath)
+      if (view.metadata.humanAnnotationInvalid) return { status: 409, body: { reason: 'human_annotation_invalid', error: 'The saved human annotation cannot be verified; restore or recover it before another correction.', mutable: false } }
+      if (isEffectiveMacSpeakerCallView(view)) return { status: 409, body: { reason: 'derived_call_view_requires_scoped_action', error: 'This consolidated view is read-only. Naming and voice enrollment require an exact reviewed source selection; nothing was changed.', mutable: false } }
+    } catch { /* The existing route reports an unreadable base independently. */ }
+    return null
+  }
+
   function selectedReadMatches(requested: unknown, sessionId: string, actual: string): boolean {
     return requestedRecordMatches(requested, actual) || blendedRecordFor(requested, sessionId) !== undefined
   }
 
+  function callGroupScopes(files: MacCallHumanFiles, baseJSON: string, view: MacSpeakerCallView): MacCallHumanScope[] {
+    // A sample/word interval is not a whole raw-chunk naming selector. Keep
+    // this policy read-only until the consumer can review exact ranges.
+    if (intervalPolicyPresent(view)) return []
+    const captureId = JSON.parse(baseJSON).sessionId, paths = macCallHumanPaths(files, captureId)
+    const packet = readMacCallHumanFile(paths.packet, 16 * 1024 * 1024, true)
+    let parsedPacket: MacSpeakerCallPacket | null = null
+    try { parsedPacket = packet ? JSON.parse(packet.text) as MacSpeakerCallPacket : null } catch { /* Human-authored scopes are independent of a corrupt automatic packet. */ }
+    return macCallHumanScopes({ baseJSON, view, packet: parsedPacket,
+      markdown: readMacCallHumanFile(files.meetingPath, 16 * 1024 * 1024)!.text,
+      ledgerJSONL: readMacCallHumanFile(paths.ledger, 8 * 1024 * 1024, true)?.text ?? '',
+      annotationJSON: readMacCallHumanFile(paths.annotation, 16 * 1024 * 1024, true)?.text ?? null })
+  }
+  const publicCallScope = (scope: MacCallHumanScope) => ({ identityId: scope.identityId, displayLabel: scope.displayLabel, reviewBasis: scope.reviewBasis, scopeSHA256: scope.scopeSHA256, members: scope.members, fieldCount: scope.fields.length })
+  function intervalPolicyPresent(view: MacSpeakerCallView): boolean {
+    return view.metadata.status === 'applied' && view.metadata.mode === 'source-bound-intervals' || !!view.metadata.intervalHumanAnnotation || !!view.metadata.intervalHumanAnnotationInvalid || !!view.metadata.intervalHumanRecoveryRequired
+  }
+  function callGroupSource(sessionId: string) {
+    const operations = cosOperationsMeetingsConfigured() ? findCosOperationsMeetingBySessionId(sessionId) : null
+    if (operations?.mergedScribeConflict?.length) throw Error('meeting source conflict')
+    const direct = operations ? null : findDirectLibraryMeetingBySessionId(sessionId)
+    if (direct) throw Error('direct library is read-only')
+    const saved = operations ? null : store.findBySessionId(sessionId)
+    if (!operations && !saved) throw Error('meeting not found')
+    return { files: { sidecarPath: operations?.sidecarPath ?? saved!.sidecarPath, meetingPath: operations?.meetingPath ?? saved!.filepath },
+      recordId: operations ? `ops:${operations.domain}:${operations.month}:${operations.filename}` : `standalone:${sessionId}` }
+  }
+
+  // Exact reviewed source membership is a separate action from legacy from-label
+  // relabels. No caller-provided patch paths, global expansion or enrollment.
+  router.get('/meeting/:sessionId/speaker-groups', (req, res) => {
+    res.set('Cache-Control', 'private, no-store')
+    const sessionId = String(req.params.sessionId ?? '')
+    if (!MAC_CAPTURE_ID.test(sessionId)) { res.status(400).json({ reason: 'not_mac_capture' }); return }
+    try {
+      const source = callGroupSource(sessionId)
+      if (!requestedRecordMatches(req.query.recordId, source.recordId)) { res.status(409).json({ reason: 'record_source_mismatch' }); return }
+      const base = readMacCallHumanFile(source.files.sidecarPath, 32 * 1024 * 1024)!.text, view = readMacSpeakerCallView(source.files.sidecarPath, base, source.files.meetingPath)
+      res.json({ sessionId, recordId: source.recordId, sourceRevision: reviewRevision(source.files.meetingPath, source.files.sidecarPath), groupScopes: callGroupScopes(source.files, base, view).map(publicCallScope), humanAnnotation: view.metadata.humanAnnotation ?? null, enrollmentAllowed: false })
+    } catch (error) { res.status(409).json({ reason: 'group_review_unavailable', error: String(error) }) }
+  })
+  router.post('/meeting/:sessionId/speaker-groups/recover', (req, res) => {
+    const sessionId = String(req.params.sessionId ?? '')
+    if (!MAC_CAPTURE_ID.test(sessionId)) { res.status(400).json({ reason: 'not_mac_capture' }); return }
+    const refusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(req.body?.recordId) ?? finalizingRefusal(sessionId)
+    if (refusal) { res.status(refusal.status).json(refusal.body); return }
+    try {
+      const source = callGroupSource(sessionId)
+      if (req.body?.recordId !== source.recordId) { res.status(409).json({ reason: 'record_source_mismatch' }); return }
+      const view = readMacSpeakerCallView(source.files.sidecarPath, readMacCallHumanFile(source.files.sidecarPath, 32 * 1024 * 1024)!.text, source.files.meetingPath)
+      if (intervalPolicyPresent(view)) { res.status(409).json({ reason: 'interval_scoped_action_required' }); return }
+      recoverMacCallHumanAnnotation(source.files, sessionId)
+      notifyMacSpeakerCallLedgerChanged(sessionId)
+      res.json({ ok: true, sourceRevision: reviewRevision(source.files.meetingPath, source.files.sidecarPath) })
+    } catch (error) { res.status(409).json({ reason: 'group_recovery_refused', error: String(error) }) }
+  })
+  router.post('/meeting/:sessionId/speaker-groups/:identityId/relabel', async (req, res) => {
+    res.set('Cache-Control', 'private, no-store')
+    const sessionId = String(req.params.sessionId ?? ''), identityId = String(req.params.identityId ?? ''), body = req.body
+    if (body && typeof body === 'object' && typeof body.to === 'string') body.to = nfc(body.to)
+    if (!MAC_CAPTURE_ID.test(sessionId) || !body || Object.keys(body).some(k => !['recordId', 'expectedRevision', 'scopeSHA256', 'rawChunkIndices', 'to', 'dryRun', 'confirm'].includes(k)) || !isMacCallHumanName(body.to) || !Array.isArray(body.rawChunkIndices) || !body.rawChunkIndices.length || body.rawChunkIndices.length > 6000 || body.rawChunkIndices.some((i: unknown) => !Number.isSafeInteger(i) || Number(i) < 0) || new Set(body.rawChunkIndices).size !== body.rawChunkIndices.length || typeof body.expectedRevision !== 'string' || !/^[a-f0-9]{64}$/.test(body.expectedRevision)) { res.status(400).json({ reason: 'invalid_group_selection' }); return }
+    const refusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(body.recordId) ?? sourceRevisionRefusal(sessionId, body) ?? finalizingRefusal(sessionId)
+    if (refusal) { res.status(refusal.status).json(refusal.body); return }
+    try {
+      const source = callGroupSource(sessionId)
+      if (body.recordId !== source.recordId) { res.status(409).json({ reason: 'record_source_mismatch' }); return }
+      const base = readMacCallHumanFile(source.files.sidecarPath, 32 * 1024 * 1024)!.text, view = readMacSpeakerCallView(source.files.sidecarPath, base, source.files.meetingPath)
+      if (intervalPolicyPresent(view)) { res.status(409).json({ reason: 'interval_scoped_action_required' }); return }
+      const scope = callGroupScopes(source.files, base, view).find(s => s.identityId === identityId && s.scopeSHA256 === body.scopeSHA256)
+      if (!scope) { res.status(409).json({ reason: 'group_scope_changed', error: 'Reopen the group before naming it' }); return }
+      const selected = new Set<number>(body.rawChunkIndices), members = scope.members.filter(m => selected.has(m.rawChunkIndex))
+      if (members.length !== selected.size) { res.status(409).json({ reason: 'group_scope_changed' }); return }
+      const selection = previewMacCallHumanAnnotation(base, readMacCallHumanFile(source.files.meetingPath, 16 * 1024 * 1024)!.text, view, scope, body.rawChunkIndices, body.to)
+      const preview = { identityId, scopeSHA256: scope.scopeSHA256, ...selection, to: body.to, enrollmentAllowed: false, sourceRevision: body.expectedRevision }
+      if (body.dryRun === true || body.confirm !== true) { res.status(body.dryRun === true ? 200 : 400).json({ ...(body.dryRun === true ? {} : { reason: 'confirmation_required' }), preview }); return }
+      // A correction withdraws a packet bound to its prior ledger. Require the
+      // verified retained native export before the FIRST automatic-group edit
+      // so the remaining groups can refresh without rerunning audio inference.
+      // Revising an existing human decision remains independent of the model.
+      if (scope.reviewBasis !== 'human-authored') {
+        const refresh = await macSpeakerCallCachedRefreshAvailability(sessionId, source.files.sidecarPath)
+        // producer_disabled is a setting, not a wait: nothing is coming to finish it, so it must not ask for a retry.
+        // It stays refused because naming now would withdraw the packet and strand every other group in this view.
+        if (!refresh.available) { res.status(409).json({ reason: 'group_refresh_unavailable', ...(refresh.reason === 'producer_disabled'
+          ? { error: 'Naming these groups is not available while speaker reconciliation is off. Your selection was not changed.', retryable: false }
+          : { error: 'Speaker reconciliation is not ready. Your selection was not changed; reopen this group after it finishes.', retryable: true }) }); return }
+        // The cached receipt check awaits child IO. A finalization/resume job
+        // may start in that interval before it changes any source bytes.
+        const afterAdmission = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(body.recordId) ?? sourceRevisionRefusal(sessionId, body) ?? finalizingRefusal(sessionId)
+        if (afterAdmission) { res.status(afterAdmission.status).json(afterAdmission.body); return }
+      }
+      const correction = commitMacCallHumanAnnotation({ files: source.files, captureId: sessionId, scope, selectedRawChunkIndices: body.rawChunkIndices, to: body.to })
+      notifyMacSpeakerCallLedgerChanged(sessionId)
+      res.json({ ok: true, confirmed: true, correction, enrollmentAllowed: false, anonymousRefreshRequired: true, sourceRevision: reviewRevision(source.files.meetingPath, source.files.sidecarPath) })
+    } catch (error) { res.status(409).json({ reason: 'group_correction_refused', error: String(error) }) }
+  })
+
+  // Interval naming cannot reuse raw-chunk selectors. These actions write only
+  // a separate source-bound human sidecar; they never invoke the acoustic producer,
+  // enroll profiles, or rewrite BASE/Markdown/the shared corrections ledger.
+  function intervalGroupScopes(files: MacCallHumanFiles, baseJSON: string, view: MacSpeakerCallView): MacIntervalHumanScope[] {
+    if (view.metadata.humanAnnotationInvalid || view.metadata.intervalHumanRecoveryRequired) throw Error('human annotation requires recovery')
+    const id = JSON.parse(baseJSON).sessionId, paths = macIntervalHumanPaths(files, id)
+    const packetFile = readMacCallHumanFile(paths.packet, 16 * 1024 * 1024, true)
+    let packet: MacSpeakerCallPacket | null = null
+    try { packet = packetFile ? JSON.parse(packetFile.text) : null } catch { /* withdrawn automatic projection */ }
+    return buildMacIntervalHumanScopes({ baseJSON, view, packet,
+      markdown: readMacCallHumanFile(files.meetingPath, 16 * 1024 * 1024)!.text,
+      ledgerJSONL: readMacCallHumanFile(paths.ledger, 8 * 1024 * 1024, true)?.text ?? '',
+      legacyAnnotationJSON: readMacCallHumanFile(paths.legacyAnnotation, 16 * 1024 * 1024, true)?.text ?? null,
+      annotationJSON: readMacCallHumanFile(paths.annotation, 16 * 1024 * 1024, true)?.text ?? null })
+  }
+  const publicIntervalScope = (scope: MacIntervalHumanScope) => ({ kind: scope.kind, reviewBasis: 'exact-hq-words', identityId: scope.identityId, displayLabel: scope.displayLabel, scopeSHA256: scope.scopeSHA256, members: scope.members, fieldCount: scope.fieldCount, ...(scope.selectionRuns ? { selectionRuns: scope.selectionRuns } : {}) })
+  const publicIntervalAnnotation = (view: MacSpeakerCallView) => view.metadata.intervalHumanAnnotation ? {
+    revision: view.metadata.intervalHumanAnnotation.revision, annotationSHA256: view.metadata.intervalHumanAnnotation.annotationSHA256,
+    activeActions: view.metadata.intervalHumanAnnotation.activeActions,
+  } : null
+  function intervalReviewFields(files: MacCallHumanFiles, base: string, view: MacSpeakerCallView) {
+    // Omit entirely for legacy/G2 readers; even an empty new array is a new-policy
+    // signal to Control and must not make every old meeting read-only.
+    const intervalPolicy = intervalPolicyPresent(view)
+    const captureId = JSON.parse(base).sessionId
+    if (!MAC_CAPTURE_ID.test(captureId) || !intervalPolicy && view.metadata.status === 'applied') return {}
+    let originalAvailable = false
+    if (!view.metadata.humanAnnotationInvalid && !view.metadata.intervalHumanRecoveryRequired && !view.metadata.intervalHumanAnnotation?.activeActions.length) {
+      try { originalAvailable = previewOriginalViewTransaction(files, captureId).artifacts.length > 0 } catch { /* Refusal is an explicit unavailable capability. */ }
+    }
+    // An unreadable/withdrawn packet or a state-only remnant still blocks legacy
+    // mutation. Offer its verified archival exit without treating that remnant
+    // as a valid acoustic scope. Unaffected legacy views keep their old tools.
+    if (!intervalPolicy && !originalAvailable) return {}
+    let scopes: MacIntervalHumanScope[] = []
+    if (intervalPolicy) try { scopes = intervalGroupScopes(files, base, view) } catch { /* read-only recovery UI */ }
+    return { intervalGroupScopes: scopes.map(publicIntervalScope), intervalHumanAnnotation: publicIntervalAnnotation(view), intervalHumanRecoveryRequired: view.metadata.intervalHumanRecoveryRequired === true, intervalOriginalViewAvailable: originalAvailable }
+  }
+  function exactIntervalConfirmedWords(base: Record<string, any>, view: MacSpeakerCallView) {
+    if (!view.metadata.intervalHumanAnnotation) return undefined
+    return view.metadata.intervalHumanAnnotation.confirmedWords.map(proof => {
+      const original = base.batchSegments?.[proof.batchIndex]?.speakerWords?.[proof.wordIndex], effective = view.doc.batchSegments?.[proof.batchIndex]?.speakerWords?.[proof.wordIndex]
+      if (!original || createHash('sha256').update(JSON.stringify(original)).digest('hex') !== proof.wordSHA256 || effective?.speaker !== proof.label) throw Error('Exact human word source changed')
+      return { batchIndex: proof.batchIndex, wordIndex: proof.wordIndex, label: proof.label }
+    })
+  }
+  const validSHA = (value: unknown): value is string => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value)
+  const intervalBodyKeys = (body: any, keys: string[]) => body && typeof body === 'object' && !Array.isArray(body) && Object.keys(body).length === keys.length && Object.keys(body).every(k => keys.includes(k))
+  router.get('/meeting/:sessionId/speaker-interval-groups', (req, res) => {
+    res.set('Cache-Control', 'private, no-store')
+    const sessionId = String(req.params.sessionId ?? '')
+    if (!MAC_CAPTURE_ID.test(sessionId)) { res.status(400).json({ reason: 'not_mac_capture' }); return }
+    const refusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(req.query.recordId)
+    if (refusal) { res.status(refusal.status).json(refusal.body); return }
+    try {
+      const source = callGroupSource(sessionId)
+      if (req.query.recordId !== source.recordId) { res.status(409).json({ reason: 'record_source_mismatch' }); return }
+      const base = readMacCallHumanFile(source.files.sidecarPath, 32 * 1024 * 1024)!.text, view = readMacSpeakerCallView(source.files.sidecarPath, base, source.files.meetingPath)
+      res.json({ sessionId, recordId: source.recordId, sourceRevision: reviewRevision(source.files.meetingPath, source.files.sidecarPath), ...intervalReviewFields(source.files, base, view), enrollmentAllowed: false })
+    } catch (error) { res.status(409).json({ reason: 'interval_group_review_unavailable', error: String(error) }) }
+  })
+  router.post('/meeting/:sessionId/speaker-interval-groups/recover', (req, res) => {
+    const sessionId = String(req.params.sessionId ?? ''), body = req.body
+    if (!MAC_CAPTURE_ID.test(sessionId) || !intervalBodyKeys(body, ['recordId', 'confirm']) || body.confirm !== true) { res.status(400).json({ reason: 'confirmation_required' }); return }
+    const refusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(body.recordId) ?? finalizingRefusal(sessionId)
+    if (refusal) { res.status(refusal.status).json(refusal.body); return }
+    try {
+      const source = callGroupSource(sessionId)
+      if (body.recordId !== source.recordId) { res.status(409).json({ reason: 'record_source_mismatch' }); return }
+      const original = inspectOriginalViewTransaction(source.files, sessionId)
+      if (original.status === 'prepared' || original.status === 'recovery-invalid') recoverOriginalViewTransaction(source.files, sessionId)
+      else recoverMacIntervalHumanAnnotation(source.files, sessionId)
+      res.json({ ok: true, confirmed: true, enrollmentAllowed: false, sourceRevision: reviewRevision(source.files.meetingPath, source.files.sidecarPath) })
+    } catch (error) { res.status(409).json({ reason: 'interval_group_recovery_refused', error: String(error) }) }
+  })
+  router.post('/meeting/:sessionId/speaker-interval-groups/original', (req, res) => {
+    const sessionId = String(req.params.sessionId ?? ''), body = req.body
+    if (!MAC_CAPTURE_ID.test(sessionId) || !intervalBodyKeys(body, ['recordId', 'expectedRevision', 'confirm']) || body.confirm !== true || !validSHA(body.expectedRevision)) { res.status(400).json({ reason: 'invalid_original_view_confirmation' }); return }
+    const refusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(body.recordId) ?? sourceRevisionRefusal(sessionId, body) ?? finalizingRefusal(sessionId)
+    if (refusal) { res.status(refusal.status).json(refusal.body); return }
+    try {
+      const source = callGroupSource(sessionId)
+      if (body.recordId !== source.recordId) { res.status(409).json({ reason: 'record_source_mismatch' }); return }
+      const preview = previewOriginalViewTransaction(source.files, sessionId)
+      if (!preview.artifacts.length) throw Error('No active interval view to archive')
+      commitOriginalViewTransaction({ files: source.files, captureId: sessionId, expectedScopeSHA256: preview.scopeSHA256 })
+      res.json({ ok: true, confirmed: true, enrollmentAllowed: false, sourceRevision: reviewRevision(source.files.meetingPath, source.files.sidecarPath) })
+    } catch (error) { res.status(409).json({ reason: 'interval_original_view_refused', error: String(error) }) }
+  })
+  router.post('/meeting/:sessionId/speaker-interval-groups/undo', (req, res) => {
+    const sessionId = String(req.params.sessionId ?? ''), body = req.body
+    if (!MAC_CAPTURE_ID.test(sessionId) || !intervalBodyKeys(body, ['recordId', 'expectedRevision', 'actionId', 'annotationRevision', 'annotationSHA256', 'confirm']) || body.confirm !== true || !validSHA(body.expectedRevision) || !validSHA(body.annotationSHA256) || !Number.isSafeInteger(body.annotationRevision) || body.annotationRevision < 1 || typeof body.actionId !== 'string' || !/^mac-speaker-call-interval-human-v1:[a-f0-9-]{36}$/.test(body.actionId)) { res.status(400).json({ reason: 'invalid_interval_undo' }); return }
+    const refusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(body.recordId) ?? sourceRevisionRefusal(sessionId, body) ?? finalizingRefusal(sessionId)
+    if (refusal) { res.status(refusal.status).json(refusal.body); return }
+    try {
+      const source = callGroupSource(sessionId)
+      if (body.recordId !== source.recordId) { res.status(409).json({ reason: 'record_source_mismatch' }); return }
+      const view = readMacSpeakerCallView(source.files.sidecarPath, readMacCallHumanFile(source.files.sidecarPath, 32 * 1024 * 1024)!.text, source.files.meetingPath)
+      if (view.metadata.humanAnnotationInvalid || view.metadata.intervalHumanRecoveryRequired) throw Error('human annotation recovery required')
+      const correction = undoMacIntervalHumanAnnotation({ files: source.files, captureId: sessionId, actionId: body.actionId, revision: body.annotationRevision, annotationSHA256: body.annotationSHA256 })
+      res.json({ ok: true, confirmed: true, correction, enrollmentAllowed: false, sourceRevision: reviewRevision(source.files.meetingPath, source.files.sidecarPath) })
+    } catch (error) { res.status(409).json({ reason: 'interval_group_undo_refused', error: String(error) }) }
+  })
+  router.post('/meeting/:sessionId/speaker-interval-groups/:identityId/relabel', (req, res) => {
+    res.set('Cache-Control', 'private, no-store')
+    const sessionId = String(req.params.sessionId ?? ''), identityId = String(req.params.identityId ?? ''), body = req.body
+    if (body && typeof body === 'object' && typeof body.to === 'string') body.to = nfc(body.to)
+    const previewOnly = body?.dryRun === true && body?.confirm === undefined, confirmed = body?.confirm === true && body?.dryRun === undefined
+    const keys = ['recordId', 'expectedRevision', 'scopeSHA256', 'memberIds', 'to', previewOnly ? 'dryRun' : 'confirm']
+    if (!MAC_CAPTURE_ID.test(sessionId) || !/^[A-Za-z0-9:_-]{1,128}$/.test(identityId) || !intervalBodyKeys(body, keys) || !previewOnly && !confirmed || !validSHA(body.expectedRevision) || !validSHA(body.scopeSHA256) || !isMacCallHumanName(body.to) || !Array.isArray(body.memberIds) || !body.memberIds.length || body.memberIds.length > 20000 || !body.memberIds.every(validSHA) || new Set(body.memberIds).size !== body.memberIds.length) { res.status(400).json({ reason: 'invalid_interval_selection' }); return }
+    const refusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(body.recordId) ?? sourceRevisionRefusal(sessionId, body) ?? finalizingRefusal(sessionId)
+    if (refusal) { res.status(refusal.status).json(refusal.body); return }
+    try {
+      const source = callGroupSource(sessionId)
+      if (body.recordId !== source.recordId) { res.status(409).json({ reason: 'record_source_mismatch' }); return }
+      const base = readMacCallHumanFile(source.files.sidecarPath, 32 * 1024 * 1024)!.text, view = readMacSpeakerCallView(source.files.sidecarPath, base, source.files.meetingPath)
+      const scope = intervalGroupScopes(source.files, base, view).find(s => s.identityId === identityId && s.scopeSHA256 === body.scopeSHA256)
+      if (!scope) { res.status(409).json({ reason: 'interval_scope_changed' }); return }
+      const selection = previewMacIntervalHumanAnnotation(scope, body.memberIds, body.to)
+      if (previewOnly) { res.json({ preview: { identityId, scopeSHA256: scope.scopeSHA256, ...selection, to: body.to, enrollmentAllowed: false, sourceRevision: body.expectedRevision } }); return }
+      const correction = commitMacIntervalHumanAnnotation({ files: source.files, captureId: sessionId, scope, memberIds: body.memberIds, to: body.to })
+      res.json({ ok: true, confirmed: true, correction, enrollmentAllowed: false, sourceRevision: reviewRevision(source.files.meetingPath, source.files.sidecarPath) })
+    } catch (error) { res.status(409).json({ reason: 'interval_group_correction_refused', error: String(error) }) }
+  })
+
   function sourceRevisionRefusal(sessionId: string, body: any): { status: number; body: Record<string, unknown> } | null {
     const ops = cosOperationsMeetingsConfigured() ? findCosOperationsMeetingBySessionId(sessionId) : null
     if (ops?.mergedScribeConflict?.length) return { status: 409, body: { reason: 'record_source_mismatch', error: markdownUnreadableReason(ops) } }
@@ -1634,7 +1970,44 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     } catch (error) { res.status(409).json({ error: String(error) }); }
   })
 
-  router.get('/meeting/:sessionId/speakers', (req, res) => {
+  /** The speaker review of a saved meeting, as GET /speakers answers it. Voice suggestions scope to these same rows. */
+  function speakerReviewFor(input: { sessionId: string; sidecarPath: string; meetingPath: string; baseJSON: string; sidecar: Record<string, unknown>; chunks: unknown; phrasesPerVoice: number }) {
+    const { sessionId, sidecarPath, meetingPath, baseJSON, sidecar, chunks, phrasesPerVoice } = input
+    // Raw capture indices, so a phrase can address its own audio. Position in
+    // `chunks` is NOT the WAV number — see attachRawChunkIndices.
+    const callView = readMacSpeakerCallView(sidecarPath, baseJSON, meetingPath)
+    const withIndices = attachRawChunkIndices(callView.doc.chunks ?? chunks as ReviewChunk[], sidecar.chunkEntries)
+    const machineEvidence = readMacSpeakerMachineEvidence(sidecar)
+    const review = reviewMeetingSpeakers(withIndices, {
+      callViewAnonymousLabels: callView.metadata.groups.map(g => g.label),
+      effectiveWordView: callView.metadata.effectiveWordView,
+      exactConfirmedWords: exactIntervalConfirmedWords(sidecar, callView),
+      owner: getOwnerSpeakerLabel(),
+      // Labels a human already vouched for in this meeting. Without this the
+      // floor re-demotes a confirmed name on every reload, and the reviewer
+      // confirms the same voice forever.
+      confirmed: confirmedLabels(sessionId),
+      confirmedChunks: confirmedChunks(sessionId),
+      machineQualifiedPositions: machineEvidence.positions,
+      machineEvidenceStatus: machineEvidence.status,
+      phrasesPerVoice,
+      // The sidecar's own durationMs is the meeting's true end. Deriving it from
+      // max(elapsed) uses the START of the last chunk, which made the final
+      // timeline span end where it began — a 1.5pt sliver labelled "1s" for what
+      // may be a long closing monologue.
+      durationMs: typeof sidecar.durationMs === 'number' ? sidecar.durationMs : undefined,
+      // Word-level speaker timings from the HQ batch pass, present on 82 of 92
+      // measured sidecars. These give REAL voiced time per speaker; without them
+      // speaking time falls back to capped chunk deltas, which still carry the
+      // sub-ceiling pauses. `speakingTimeSource` on the response says which ran.
+      batchSegments: Array.isArray(callView.doc.batchSegments)
+        ? (callView.doc.batchSegments as SpeakerWordSegment[])
+        : undefined,
+    })
+    return { callView, review }
+  }
+
+  router.get('/meeting/:sessionId/speakers', async (req, res) => {
     const sessionId = String(req.params.sessionId ?? '')
     if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) {
       res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
@@ -1675,8 +2048,10 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
 
     let chunks: unknown
     let sidecar: Record<string, unknown>
+    let baseJSON: string
     try {
-      sidecar = JSON.parse(readFileSync(sidecarPath, 'utf-8')) as Record<string, unknown>
+      baseJSON = readFileSync(sidecarPath, 'utf-8')
+      sidecar = JSON.parse(baseJSON) as Record<string, unknown>
       chunks = Array.isArray(sidecar) ? sidecar : sidecar.chunks
     } catch {
       // Defensive: both lookups above already read this sidecar to match the
@@ -1692,35 +2067,20 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       return
     }
 
-    // Raw capture indices, so a phrase can address its own audio. Position in
-    // `chunks` is NOT the WAV number — see attachRawChunkIndices.
-    const withIndices = attachRawChunkIndices(chunks as ReviewChunk[], sidecar.chunkEntries)
-    const machineEvidence = readMacSpeakerMachineEvidence(sidecar)
-    const review = reviewMeetingSpeakers(withIndices, {
-      owner: getOwnerSpeakerLabel(),
-      // Labels a human already vouched for in this meeting. Without this the
-      // floor re-demotes a confirmed name on every reload, and the reviewer
-      // confirms the same voice forever.
-      confirmed: confirmedLabels(sessionId),
-      confirmedChunks: confirmedChunks(sessionId),
-      machineQualifiedPositions: machineEvidence.positions,
-      machineEvidenceStatus: machineEvidence.status,
+    const meetingPath = operations?.meetingPath ?? direct?.meetingPath ?? saved!.filepath
+    const { callView, review } = speakerReviewFor({
+      sessionId,
+      sidecarPath,
+      meetingPath,
+      baseJSON: baseJSON!,
+      sidecar,
+      chunks,
       phrasesPerVoice: Math.max(1, Math.min(6, Number(req.query.phrases) || 3)),
-      // The sidecar's own durationMs is the meeting's true end. Deriving it from
-      // max(elapsed) uses the START of the last chunk, which made the final
-      // timeline span end where it began — a 1.5pt sliver labelled "1s" for what
-      // may be a long closing monologue.
-      durationMs: typeof sidecar.durationMs === 'number' ? sidecar.durationMs : undefined,
-      // Word-level speaker timings from the HQ batch pass, present on 82 of 92
-      // measured sidecars. These give REAL voiced time per speaker; without them
-      // speaking time falls back to capped chunk deltas, which still carry the
-      // sub-ceiling pauses. `speakingTimeSource` on the response says which ran.
-      batchSegments: Array.isArray(sidecar.batchSegments)
-        ? (sidecar.batchSegments as SpeakerWordSegment[])
-        : undefined,
     })
-    res.set('Cache-Control', 'private, no-store')
-    res.json({
+    // The rows and the revision that vouches for them are read in one synchronous stretch, BEFORE the await below. A
+    // POST /relabel landing during the await then makes this revision old too, and `expectedRevision` refuses the stale
+    // view. Hashing after the await would pair old rows with a new revision, and that check would pass.
+    const body = {
       sessionId,
       title,
       domain,
@@ -1728,13 +2088,95 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       ...identity,
       speakerPolicy: readSpeakerPolicy(sessionId),
       reviewIdentityVersion: 1,
-      sourceRevision: reviewRevision(operations?.meetingPath ?? direct?.meetingPath ?? saved!.filepath, sidecarPath),
+      sourceRevision: reviewRevision(meetingPath, sidecarPath),
       ...(operations?.mergedScribeConflict?.length ? { mutable: false, identityConflict: operations.mergedScribeConflict } : {}),
       ...(saved ? { durationMin: saved.durationMin } : {}),
       ...review,
-    })
+      ...(isEffectiveMacSpeakerCallView(callView) || callView.metadata.humanAnnotationInvalid ? { mutable: false, mutationBlockedReason: callView.metadata.humanAnnotationInvalid ? 'human_annotation_invalid' : 'derived_call_view_requires_scoped_action' } : {}),
+      speakerCallView: callView.metadata,
+      ...intervalReviewFields({ sidecarPath, meetingPath }, baseJSON, callView),
+      ...(() => { try { return { groupScopes: callGroupScopes({ sidecarPath, meetingPath }, baseJSON, callView).map(publicCallScope) } } catch { return { groupScopes: [] } } })(),
+    }
+    // 6.96.3: display grouping from this Mac's speaker shadow log, read at request time. No shadow record, no field.
+    // Mac captures only: anything else never yields here. A view that already groups the words stands on its own.
+    const voiceDisplay = MAC_CAPTURE_ID.test(sessionId) && !isEffectiveMacSpeakerCallView(callView) ? await readVoiceDisplay(sessionId, review.voices.map(v => v.label)) : null
+    res.set('Cache-Control', 'private, no-store')
+    res.json(voiceDisplay ? { ...body, voiceDisplay } : body)
   })
 
+  // ── Voice suggestions (6.96.3, lib/mac-voice-suggestions.ts) ───────────────────
+  // POST is the ONLY thing that starts a job. Both answer one JSON state; only a malformed id is a 4xx.
+  // `refused` comes from POST and is not remembered, so GET reads idle, running, done or failed.
+  // Read-only: nothing here or in the job writes a profile, label, sidecar or vector file.
+  function voiceSuggestionSource(sessionId: string): { refused: string } | { sidecarPath: string; meetingPath: string } {
+    if (assertVoiceEvidenceSource([sessionId]) || !MAC_CAPTURE_ID.test(sessionId)) return { refused: 'not_saved_mac_capture' }
+    const operations = cosOperationsMeetingsConfigured() ? findCosOperationsMeetingBySessionId(sessionId) : null
+    const direct = operations ? null : findDirectLibraryMeetingBySessionId(sessionId)
+    const saved = operations || direct ? null : store.findBySessionId(sessionId)
+    if (!operations && !direct && !saved) return { refused: 'not_saved_mac_capture' }
+    return { sidecarPath: operations?.sidecarPath ?? direct?.sidecarPath ?? saved!.sidecarPath, meetingPath: operations?.meetingPath ?? direct?.meetingPath ?? saved!.filepath }
+  }
+
+  // 6.96.3: name the high-confidence suggestions in one step, and undo that step (lib/mac-voice-naming-batch.ts).
+  registerMacVoiceNamingBatchRoutes(router, { store, captureActive, reviewRevision, callViewMutationRefusal, finalizingRefusal })
+
+  const readVoiceSuggestions: RequestHandler = (req, res) => {
+    const sessionId = String(req.params.sessionId ?? '')
+    if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) { res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' }); return }
+    res.set('Cache-Control', 'private, no-store')
+    // A job in flight answers from memory: Control polls this, and the revision hashes the whole meeting.
+    const running = voiceSuggestions.running(sessionId)
+    if (running) { res.json(running); return }
+    const source = voiceSuggestionSource(sessionId)
+    res.json(voiceSuggestions.read(sessionId, 'refused' in source ? '' : reviewRevision(source.meetingPath, source.sidecarPath)))
+  }
+
+  const startVoiceSuggestions: RequestHandler = (req, res) => {
+    const sessionId = String(req.params.sessionId ?? '')
+    if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) { res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' }); return }
+    res.set('Cache-Control', 'private, no-store')
+    const source = voiceSuggestionSource(sessionId)
+    if ('refused' in source) { res.json(voiceSuggestions.refusal(source.refused, '')); return }
+    const { sidecarPath, meetingPath } = source
+    let baseJSON: string
+    let sidecar: Record<string, unknown>
+    try {
+      baseJSON = readFileSync(sidecarPath, 'utf-8')
+      sidecar = JSON.parse(baseJSON) as Record<string, unknown>
+      if (!Array.isArray(sidecar.chunks)) throw new Error('no chunk array')
+    } catch {
+      res.json(voiceSuggestions.refusal('sidecar_unreadable', ''))
+      return
+    }
+    const sourceRevision = reviewRevision(meetingPath, sidecarPath)
+    // Its labels are not the labels on the audio's turns, so no unit could be chosen honestly.
+    const view = readMacSpeakerCallView(sidecarPath, baseJSON, meetingPath)
+    if (isEffectiveMacSpeakerCallView(view) || view.metadata.humanAnnotationInvalid) { res.json(voiceSuggestions.refusal('derived_call_view', sourceRevision)); return }
+    const entries = voiceSidecarEntries(sidecar)
+    if (!entries) { res.json(voiceSuggestions.refusal('no_index_mapping', sourceRevision)); return }
+    const block = (): VoiceSuggestionBlock | null => {
+      if (captureActive() || voiceSuggestionRecordingLease()) return 'recording_active'
+      if (!maintenanceAdmissionsOpen()) return 'maintenance'
+      if (finalizingRefusal(sessionId)) return 'meeting_finalizing'
+      return null
+    }
+    res.json(voiceSuggestions.start({
+      sessionId,
+      sourceRevision,
+      entries,
+      block,
+      pause: () => voiceSuggestionPauseLease(),
+      loadScopes: async () => {
+        const { review } = speakerReviewFor({ sessionId, sidecarPath, meetingPath, baseJSON, sidecar, chunks: sidecar.chunks, phrasesPerVoice: 1 })
+        const labels = review.voices.map(v => v.label)
+        return voiceDisplayScopes(await readVoiceDisplay(sessionId, labels), labels)
+      },
+    }))
+  }
+
+  router.get('/meeting/:sessionId/voice-suggestions', readVoiceSuggestions)
+  router.post('/meeting/:sessionId/voice-suggestions', startVoiceSuggestions)
+
 
   // ── Per-meeting speaker relabel (6.21.16) ─────────────────────────────
   //
@@ -1792,8 +2234,10 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     const mdPath = operations?.meetingPath ?? direct?.meetingPath ?? sidecarPath.replace(/\.g2-chunks\.json$/, '.md')
 
     let sidecar: Record<string, unknown>
+    let baseJSON: string
     try {
-      sidecar = (JSON.parse(readFileSync(sidecarPath, 'utf-8')) ?? {}) as Record<string, unknown>
+      baseJSON = readFileSync(sidecarPath, 'utf-8')
+      sidecar = (JSON.parse(baseJSON) ?? {}) as Record<string, unknown>
     } catch {
       res.status(422).json({ error: 'Chunk sidecar is missing or unreadable', reason: 'sidecar_unreadable' })
       return
@@ -1807,10 +2251,14 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       res.status(422).json({ error: 'Chunk sidecar holds no chunk array', reason: 'sidecar_empty' })
       return
     }
-    const chunks = rawChunks as ReviewChunk[]
+    const callView = readMacSpeakerCallView(sidecarPath, baseJSON!, mdPath)
+    const chunks = (callView.doc.chunks ?? rawChunks) as ReviewChunk[]
 
     const machineEvidence = readMacSpeakerMachineEvidence(sidecar)
     const review = reviewMeetingSpeakers(attachRawChunkIndices(chunks, sidecar.chunkEntries), {
+      callViewAnonymousLabels: callView.metadata.groups.map(g => g.label),
+      effectiveWordView: callView.metadata.effectiveWordView,
+      exactConfirmedWords: exactIntervalConfirmedWords(sidecar, callView),
       owner: getOwnerSpeakerLabel(),
       confirmed: confirmedLabels(sessionId),
       confirmedChunks: confirmedChunks(sessionId),
@@ -1820,8 +2268,8 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       // discarded 48 transcript excerpts on a 16-voice meeting.
       phrasesPerVoice: 1,
       durationMs: typeof sidecar.durationMs === 'number' ? sidecar.durationMs : undefined,
-      batchSegments: Array.isArray(sidecar.batchSegments)
-        ? (sidecar.batchSegments as SpeakerWordSegment[])
+      batchSegments: Array.isArray(callView.doc.batchSegments)
+        ? (callView.doc.batchSegments as SpeakerWordSegment[])
         : undefined,
     })
 
@@ -1841,12 +2289,13 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       confirmedByHuman: v.confirmedByHuman,
       machineQualified: v.machineQualified,
       machineQualifiedSegments: v.machineQualifiedSegments,
+      ...(v.kind ? { kind: v.kind, displayName: v.displayName, identityId: v.identityId } : {}),
     }))
 
     // A missing .md is not fatal — the review and the sidecar still describe the
     // meeting, and a reviewer would rather have who-spoke than a 404.
     let markdown = ''
-    try { markdown = readFileSync(mdPath, 'utf-8') } catch { markdown = '' }
+    try { markdown = callView.markdown ?? readFileSync(mdPath, 'utf-8') } catch { markdown = '' }
     const scribe = parseScribe(markdown)
 
     const date = meetingDate(sidecar.startTime)
@@ -1905,6 +2354,8 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       date,
       durationMin,
       scribeAvailable: markdown.length > 0,
+      speakerCallView: callView.metadata,
+      ...(review.effectiveSpeakerSummary ? { effectiveSpeakerSummary: review.effectiveSpeakerSummary } : {}),
       attendees,
       speakingTimeSource: review.speakingTimeSource,
       voicedMs: review.voicedMs,
@@ -1920,6 +2371,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       capturedChars: clip.capturedChars,
       domain: clip.domain,
       ...identity,
+      ...(isEffectiveMacSpeakerCallView(callView) || callView.metadata.humanAnnotationInvalid ? { mutable: false, mutationBlockedReason: callView.metadata.humanAnnotationInvalid ? 'human_annotation_invalid' : 'derived_call_view_requires_scoped_action' } : {}),
       reviewIdentityVersion: 1,
       sourceRevision: reviewRevision(operations?.meetingPath ?? direct?.meetingPath ?? saved!.filepath, sidecarPath),
       ...(operations?.mergedScribeConflict?.length ? { mutable: false, identityConflict: operations.mergedScribeConflict } : {}),
@@ -1971,7 +2423,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
       return
     }
-    const speaker = typeof req.body?.speaker === 'string' ? req.body.speaker.trim() : ''
+    const speaker = bodyName(req.body?.speaker).trim()
     if (!speaker) {
       res.status(400).json({ error: 'speaker is required', reason: 'invalid_label' })
       return
@@ -1979,7 +2431,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     // Enrolment writes to the voice store, so the same two gates as the other
     // corrections: the session must be a capture, and the record aimed at must
     // not be a derived one.
-    const evidenceRefusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(req.body?.recordId) ?? sourceRevisionRefusal(sessionId, req.body)
+    const evidenceRefusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(req.body?.recordId) ?? callViewMutationRefusal(sessionId) ?? sourceRevisionRefusal(sessionId, req.body)
     if (evidenceRefusal) {
       res.status(evidenceRefusal.status).json(evidenceRefusal.body)
       return
@@ -2004,7 +2456,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     }
 
     // Only rows that ACTUALLY landed, and only those that named this speaker.
-    const rows = appliedCorrections(sessionId).filter(r => r.to === speaker && r.chunks.length > 0)
+    const rows = appliedCorrections(sessionId).filter(r => sameSpeakerName(r.to, speaker) && r.chunks.length > 0)
     if (rows.length === 0) {
       res.status(404).json({ error: `No applied correction named "${speaker}" in this meeting`, reason: 'no_correction' })
       return
@@ -2045,14 +2497,14 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     // A merged G2 session is NOT refused here: it is a real capture with real
     // audio, and relabelling it is how its profile gets better. Only an imported
     // or derived IDENTITY is refused.
-    const evidenceRefusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(req.body?.recordId) ?? sourceRevisionRefusal(sessionId, req.body) ?? finalizingRefusal(sessionId)
+    const evidenceRefusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(req.body?.recordId) ?? callViewMutationRefusal(sessionId) ?? sourceRevisionRefusal(sessionId, req.body) ?? finalizingRefusal(sessionId)
     if (evidenceRefusal) {
       res.status(evidenceRefusal.status).json(evidenceRefusal.body)
       return
     }
 
-    const from = typeof req.body?.from === 'string' ? req.body.from : ''
-    const to = typeof req.body?.to === 'string' ? req.body.to : ''
+    const from = bodyName(req.body?.from)
+    const to = bodyName(req.body?.to)
     const chunks = Array.isArray(req.body?.chunks)
       ? (req.body.chunks as unknown[]).filter((n): n is number => Number.isInteger(n) && (n as number) >= 0)
       : []
@@ -2163,7 +2615,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       // Other requests ran while the plan yielded. Nothing may have moved: the meeting's bytes, the caller's revision, or a new capture.
       let sidecarAfter: string | null = null
       try { sidecarAfter = readFileSync(sidecarPath, 'utf-8') } catch { sidecarAfter = null }
-      const revisionAfter = sourceRevisionRefusal(sessionId, req.body)
+      const revisionAfter = callViewMutationRefusal(sessionId) ?? sourceRevisionRefusal(sessionId, req.body)
       if (sidecarAfter !== sidecarRaw || revisionAfter) {
         res.status(409).json({ error: 'The meeting changed while the voice was being read. Reopen it and try again; nothing was changed', reason: 'meeting_changed', retryable: true })
         return
@@ -2296,6 +2748,8 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       return
     }
 
+    const viewBeforeWrite = callViewMutationRefusal(sessionId)
+    if (viewBeforeWrite) { res.status(viewBeforeWrite.status).json(viewBeforeWrite.body); return }
     const id = `${sessionId}:${from}>${to}:${Date.now().toString(36)}`
     const at = new Date().toISOString()
     // Intent first. If this cannot be written, nothing is mutated — an
@@ -2400,12 +2854,12 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
       return
     }
-    const evidenceRefusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(req.body?.recordId) ?? sourceRevisionRefusal(sessionId, req.body)
+    const evidenceRefusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(req.body?.recordId) ?? callViewMutationRefusal(sessionId) ?? sourceRevisionRefusal(sessionId, req.body)
     if (evidenceRefusal) {
       res.status(evidenceRefusal.status).json(evidenceRefusal.body)
       return
     }
-    const label = typeof req.body?.label === 'string' ? req.body.label : ''
+    const label = bodyName(req.body?.label)
     const bad = invalidLabelReason(label)
     if (bad) {
       res.status(400).json({ error: `label: ${bad}`, reason: 'invalid_label' })
@@ -2453,7 +2907,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       const doc = JSON.parse(readFileSync(sidecarPath, 'utf-8')) as Record<string, unknown>
       const rows = Array.isArray(doc.chunks) ? doc.chunks : []
       carried = rows.filter(r => r && typeof r === 'object'
-        && (r as Record<string, unknown>).speaker === label).length
+        && sameSpeakerName((r as Record<string, unknown>).speaker, label)).length
     } catch {
       res.status(500).json({ error: 'Could not read the chunk sidecar', reason: 'sidecar_unreadable' })
       return
@@ -2491,12 +2945,12 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
       return
     }
-    const evidenceRefusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(req.body?.recordId) ?? sourceRevisionRefusal(sessionId, req.body) ?? finalizingRefusal(sessionId)
+    const evidenceRefusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(req.body?.recordId) ?? callViewMutationRefusal(sessionId) ?? sourceRevisionRefusal(sessionId, req.body) ?? finalizingRefusal(sessionId)
     if (evidenceRefusal) {
       res.status(evidenceRefusal.status).json(evidenceRefusal.body)
       return
     }
-    const from = typeof req.body?.from === 'string' ? req.body.from : ''
+    const from = bodyName(req.body?.from)
     const bad = invalidLabelReason(from)
     if (bad) {
       res.status(400).json({ error: `from: ${bad}`, reason: 'invalid_label' })
@@ -2572,7 +3026,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       if (Array.isArray(parsed.chunks)) {
         for (const c of parsed.chunks) {
           const sp = (c as { speaker?: unknown } | null)?.speaker
-          if (typeof sp === 'string' && !existingSpeakers.includes(sp)) existingSpeakers.push(sp)
+          if (typeof sp === 'string' && !existingSpeakers.some(x => sameSpeakerName(x, sp))) existingSpeakers.push(sp)
         }
       }
     } catch { /* the relabel below reports a corrupt sidecar */ }
@@ -2585,7 +3039,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
 
     // What this would remove from the profile, and what it CANNOT reach.
     // readVoiceProfiles returns a ProfileStore, not an array.
-    const profile = readVoiceProfiles().profiles.find(p => p.name === from)
+    const profile = readVoiceProfiles().profiles.find(p => sameSpeakerName(p.name, from))
     const profileSources: Array<string | undefined> = profile
       ? Array.from({ length: profile.embeddings.length }, (_, i) => profile.sources?.[i])
       : []