@gotcos/glasses-server 6.95.0 → 6.98.0

package/server/routes/session-find.ts

@@ -0,0 +1,73 @@
+/**
+ * POST /api/agent-sessions/find (Control 0.5.363): which of this Mac's agent sessions the person means, by meaning.
+ * Auth comes from the parent /api mount. See lib/session-find.ts for what leaves the Mac, the cost controls and the gates.
+ *
+ * Body `{ query, consentedProvider, stage }`, exactly those keys. `query` is a string; the words are redacted and cut at 200
+ * code points before use. `consentedProvider` is `"jev"`, `"subq"` or `null`: the provider the person agreed to send to.
+ * `stage` is `"first"` (the newest 254 sessions) or `"full"` (the next 254 too, unless the first already settles it).
+ *
+ * A search that cannot run answers HTTP 200 with `available: false`, a `reason` and a `message`, so Control keeps its word
+ * search and says one line about why. A malformed body is 400. A walk that fails (the session store, the keyed-sessions file) is
+ * also a 200 with `reason: failed`, so Control keeps its word search. 503 `session_find_unavailable` is left for an unexpected
+ * error outside the finder's own handling: try later.
+ * An older server answers 404, which Control reads as "no meaning search here".
+ *
+ * A closed connection stops the walk and any stage that has not started. A model request already sent is not aborted (it is
+ * billed either way). The query and the sessions never reach a log line.
+ */
+import { Router, type Response } from 'express'
+import { isAbortError } from '../lib/session-find-collect.js'
+import { SESSION_FIND_LIMITS, SessionFinder, unavailableAnswer, type SessionFindAnswer } from '../lib/session-find.js'
+
+export interface SessionFindRouteDependencies {
+  finder: Pick<SessionFinder, 'find'>
+  now: () => number
+}
+
+const BODY_KEYS = new Set(['query', 'consentedProvider', 'stage'])
+/** One log line per degrade reason per 10 minutes: Control falls back quietly, so the server says why. Fixed words only, never the query or a session. */
+export const SESSION_FIND_LOG_EVERY_MS = 10 * 60_000
+
+export function createSessionFindRouter(overrides: Partial<SessionFindRouteDependencies> = {}): Router {
+  let finder: Pick<SessionFinder, 'find'> | null = overrides.finder ?? null
+  const now = overrides.now ?? Date.now
+  const lastLogged = new Map<string, number>()
+  const logDegrade = (reason: string) => {
+    const at = now()
+    const last = lastLogged.get(reason)
+    if (last !== undefined && at - last < SESSION_FIND_LOG_EVERY_MS) return
+    lastLogged.set(reason, at)
+    console.warn(`[session-find] unavailable: ${reason}`)
+  }
+  const router = Router()
+  router.use('/agent-sessions/find', (_req, res, next) => { res.set('Cache-Control', 'private, no-store'); next() })
+
+  router.post('/agent-sessions/find', async (req, res: Response) => {
+    const body = req.body
+    const bad = () => res.status(400).json({ error: { code: 'invalid_find_request',
+      message: 'Send a query, the provider you consented to (jev, subq or null) and a stage of first or full.' } })
+    if (!body || typeof body !== 'object' || Array.isArray(body) || Object.keys(body).some(key => !BODY_KEYS.has(key))) return bad()
+    if (typeof body.query !== 'string' || body.query.length > SESSION_FIND_LIMITS.queryRawMax) return bad()
+    if (body.consentedProvider !== null && body.consentedProvider !== undefined && body.consentedProvider !== 'jev' && body.consentedProvider !== 'subq') return bad()
+    if (body.stage !== 'first' && body.stage !== 'full') return bad()
+
+    const controller = new AbortController()
+    // `close` also fires when a response has finished normally; only a connection that closed before the answer counts.
+    res.on('close', () => { if (!res.writableEnded) controller.abort() })
+    let answer: SessionFindAnswer
+    try {
+      finder ??= new SessionFinder()
+      answer = await finder.find({ query: body.query, consentedProvider: body.consentedProvider ?? null, stage: body.stage }, controller.signal)
+    } catch (error) {
+      if (isAbortError(error) || controller.signal.aborted) return
+      console.error('[session-find] search failed')
+      return res.status(503).json({ error: { code: 'session_find_unavailable', message: 'Meaning search could not read your sessions. Try again shortly.' } })
+    }
+    if (controller.signal.aborted) return
+    if (!answer.available && answer.reason) logDegrade(answer.reason)
+    return res.json(answer)
+  })
+  return router
+}
+
+export { unavailableAnswer }

package/server/routes/transcribe-stream.ts

@@ -1,3 +1,8 @@
+import { takeMacSpeakerLivePublication } from '../lib/mac-speaker-live-compute.js'
+import type { MacSpeakerLivePreparedPublication } from '../lib/mac-speaker-live-worker.js'
+import { createMacSpeakerLiveScheduler, macSpeakerLiveEnabled, assertMacSpeakerLivePublicationBindings, type MacSpeakerLiveOutcome, type MacSpeakerLiveFileBinding } from '../lib/mac-speaker-live.js'
+import { hashMacSpeakerLive, type MacSpeakerLiveState } from '../lib/mac-speaker-live-memory.js'
+import { macSpeakerLiveOriginalOnly, macSpeakerLiveVoiceHighWater } from '../lib/mac-speaker-live-store.js'
 import { PHONE_CAPTURE_ID, PHONE_SOURCE_TYPE, assertPhoneProvenance, admitPhoneRecording, phoneQueryInteger, requirePhoneRecording, readPhoneRecording, validatePhoneWav, persistPhoneChunkReceipt } from '../lib/phone-recording.js'
 import { matchMacLiveVoice, macAnonymousProjection, type MacLiveVoiceState } from '../lib/mac-live-voices.js'
 import { chunkShowsVoiceLabel, macLiveVoicesMode } from '../lib/mac-voice-labels.js'
@@ -15,7 +20,7 @@ import { readSpeakerPolicy, policyLabel, type SpeakerMode } from '../lib/meeting
 // Streams speaker-labeled transcript chunks for live meeting capture.
 
 import { Router } from 'express'
-import { createHash } from 'node:crypto'
+import { createHash, randomUUID } from 'node:crypto'
 import { chmodSync, readFileSync, writeFileSync, existsSync, lstatSync, mkdirSync, readdirSync, unlinkSync, rmSync, renameSync, statSync } from 'node:fs'
 import { writeFile } from 'node:fs/promises'
 import { resolve } from 'node:path'
@@ -86,6 +91,7 @@ import {
   type EvenSpeakerRoleHistogram,
 } from '../lib/even-hub-speaker-role.js'
 import { archiveSessionAudio, runMeetingAudioRetention } from '../lib/meeting-audio-archive.js'
+import { sweepStalePendingBatch } from '../lib/pending-batch-retention.js'
 import {
   DISCARDED_RETENTION_MS,
   countChunkWavs,
@@ -339,6 +345,18 @@ export interface ProviderCandidateRecord {
 }
 
 interface TranscriptSession {
+  /** Capture-frozen opt-in; original ASR chunks remain immutable inputs. */
+  speakerIdentityPolicy?: 'mac-native-v1'
+  speakerGeneration?: string
+  speakerRevision?: number
+  speakerProjectionSHA256?: string
+  macSpeakerLive?: MacSpeakerLiveState
+  macSpeakerLiveQuarantineSHA256?: string
+  /** Ephemeral: recovered evidence cannot publish before asynchronous revalidation. */
+  macSpeakerLiveValidated?: boolean
+  macSpeakerLiveSourceBindingSHA256?: string
+  macSpeakerLiveFileBindings?: MacSpeakerLiveFileBinding[]
+  macSpeakerLiveStatus?: {reason:string;latencyMs:number;pendingWindows:number;completeEligibleSnapshot:boolean}
   chunks: TranscriptChunk[]
   /** Bounded anonymous acoustic anchors; active capture only, never training. */
   macLiveVoices?: MacLiveVoiceState
@@ -370,6 +388,44 @@ interface TranscriptSession {
 }
 
 const sessions = new Map<string, TranscriptSession>()
+function liveIndexed(session:TranscriptSession){return session.chunks.flatMap((c,i)=>c?.text?[{i,c}]:[])}
+function liveSnapshot(captureId:string){
+ const s=sessions.get(captureId)
+ if(!maintenanceAdmissionsOpen()||!macSpeakerLiveEnabled()||!s||s.speakerIdentityPolicy!=='mac-native-v1'||!s.speakerGeneration||isSessionDeleted(captureId)||macChunkLocks.has(captureId))return null
+ return{captureId,generation:s.speakerGeneration,audioDir:resolve(SESSION_AUDIO_DIR,captureId),ledgerPath:dataPath('meeting-corrections',`${captureId}.jsonl`),
+  chunksIndexed:structuredClone(liveIndexed(s)) as unknown as {i:number;c:Record<string,unknown>}[],state:s.macSpeakerLive?structuredClone(s.macSpeakerLive):undefined,
+  voiceHighWater:macSpeakerLiveVoiceHighWater(s.chunks,Math.max(s.macWindowVoices?.voices??0,Number.isSafeInteger(s.macSpeakerLive?.voiceHighWater)?s.macSpeakerLive!.voiceHighWater:0)),revision:s.speakerRevision??0,previousDigest:s.speakerProjectionSHA256}
+}
+function commitMacSpeakerLive(captureId:string,outcome:MacSpeakerLiveOutcome):boolean{
+ const s=sessions.get(captureId)
+ if(!s||s.speakerIdentityPolicy!=='mac-native-v1'||!s.speakerGeneration||isSessionDeleted(captureId)||macChunkLocks.has(captureId)||hashMacSpeakerLive(liveIndexed(s))!==outcome.sourceBindingSHA256)return false
+ if(outcome.state&&(outcome.state.captureId!==captureId||outcome.state.generation!==s.speakerGeneration))return false
+ try{if(outcome.completeEligibleSnapshot)assertMacSpeakerLivePublicationBindings(outcome.fileBindings)}catch{
+  s.macSpeakerLiveValidated=false;s.macSpeakerLiveStatus={reason:'publication_binding_changed',latencyMs:outcome.latencyMs,pendingWindows:0,completeEligibleSnapshot:false};persistSessionBestEffort(captureId);return false
+ }
+ const certified=takeMacSpeakerLivePublication(outcome.capability,{captureId,generation:s.speakerGeneration,sourceBindingSHA256:outcome.sourceBindingSHA256,fileBindingsSHA256:hashMacSpeakerLive(outcome.fileBindings),revision:s.speakerRevision??0,
+  voiceHighWater:macSpeakerLiveVoiceHighWater(s.chunks,Math.max(s.macWindowVoices?.voices??0,Number.isSafeInteger(s.macSpeakerLive?.voiceHighWater)?s.macSpeakerLive!.voiceHighWater:0)),mode:'mac-native-v1'})
+ if(outcome.completeEligibleSnapshot&&!certified)return false
+ const previous={source:s.macSpeakerLiveSourceBindingSHA256,files:s.macSpeakerLiveFileBindings,state:s.macSpeakerLive,validated:s.macSpeakerLiveValidated,status:s.macSpeakerLiveStatus,window:s.macWindowVoices?structuredClone(s.macWindowVoices):undefined,revision:s.speakerRevision,digest:s.speakerProjectionSHA256}
+ if(certified)s.macSpeakerLive=certified.macSpeakerLive??outcome.state
+ s.macSpeakerLiveSourceBindingSHA256=outcome.sourceBindingSHA256;s.macSpeakerLiveFileBindings=outcome.fileBindings
+ s.macSpeakerLiveValidated=maintenanceAdmissionsOpen()&&macSpeakerLiveEnabled()&&!!certified&&!!outcome.state&&outcome.completeEligibleSnapshot
+ s.macSpeakerLiveStatus={reason:outcome.reason,latencyMs:outcome.latencyMs,pendingWindows:outcome.pendingWindows,completeEligibleSnapshot:outcome.completeEligibleSnapshot}
+ if(s.macWindowVoices&&s.macSpeakerLive)s.macWindowVoices.voices=Math.max(s.macWindowVoices.voices,s.macSpeakerLive.voiceHighWater)
+ try{persistSessionRequired(captureId,certified??undefined)}catch{Object.assign(s,{macSpeakerLiveSourceBindingSHA256:previous.source,macSpeakerLiveFileBindings:previous.files,macSpeakerLive:previous.state,macSpeakerLiveValidated:previous.validated,macSpeakerLiveStatus:previous.status,macWindowVoices:previous.window,speakerRevision:previous.revision,speakerProjectionSHA256:previous.digest});return false}
+ // Dedicated invalidation cursor; consumers fetch the durable full replacement.
+ emitDisplay({type:'mac_speaker_live_revision',data:{sessionId:captureId,speakerIdentityPolicy:'mac-native-v1',generation:s.speakerGeneration,speakerRevision:s.speakerRevision,speakerProjectionSHA256:s.speakerProjectionSHA256}})
+ return true
+}
+const macSpeakerLiveScheduler=createMacSpeakerLiveScheduler({snapshot:liveSnapshot,commit:commitMacSpeakerLive,lease:()=>acquireMaintenanceWork('mac_speaker_live'),runtime:{admit:captureId=>maintenanceAdmissionsOpen()&&macSpeakerLiveEnabled()&&sessions.has(captureId)&&!isSessionDeleted(captureId)&&!macChunkLocks.has(captureId)}})
+export const __macSpeakerLiveForTests={snapshot:liveSnapshot,commit:commitMacSpeakerLive,persist:(id:string)=>persistSessionRequired(id),drain:()=>macSpeakerLiveScheduler.drain()}
+/** Save consumers receive only the durable, fully validated exact-source snapshot. */
+export function getMacSpeakerLiveSaveSnapshot(captureId:string):{state:MacSpeakerLiveState;sourceBindingSHA256:string}|null{
+ const s=sessions.get(captureId);if(!macSpeakerLiveEnabled()||!s?.macSpeakerLiveValidated||!s.macSpeakerLive||s.macSpeakerLiveStatus?.completeEligibleSnapshot!==true||s.macSpeakerLiveSourceBindingSHA256!==hashMacSpeakerLive(liveIndexed(s)))return null
+ try{assertMacSpeakerLivePublicationBindings(s.macSpeakerLiveFileBindings??[])}catch{return null}
+ return{state:structuredClone(s.macSpeakerLive),sourceBindingSHA256:hashMacSpeakerLive(liveIndexed(s))}
+}
+
 const CLOSED_SESSION_TTL_MS = LOCAL_FIRST_MEETING_IDLE_RETENTION_MS
 const CLOSED_SESSIONS_FILE = dataPath('closed-transcript-sessions.json')
 
@@ -704,7 +760,7 @@ function recoverClosedSessions(): void {
 
 /** Persist a session before acknowledging any chunk. Throws on failure so a
  *  client never interprets a non-durable index as accepted. */
-function persistSessionRequired(sessionId: string): void {
+function persistSessionRequired(sessionId: string, certified?:MacSpeakerLivePreparedPublication): void {
   const session = sessions.get(sessionId)
   if (!session) throw makeHttpError(404, 'session not found', 'session_not_found')
   const filePath = resolve(CHUNK_PERSIST_DIR, `${sessionId}.json`)
@@ -715,8 +771,23 @@ function persistSessionRequired(sessionId: string): void {
       const c = session.chunks[i]
       if (c && c.text) chunksIndexed.push({ i, c })
     }
+  if(session.macSpeakerLiveValidated){
+    let reason:string|undefined
+    if(!macSpeakerLiveEnabled())reason='feature_disabled'
+    else if(session.macSpeakerLiveSourceBindingSHA256!==hashMacSpeakerLive(chunksIndexed))reason='new_source_pending'
+    else try{assertMacSpeakerLivePublicationBindings(session.macSpeakerLiveFileBindings??[])}catch{reason='resource_binding_changed'}
+    if(reason){session.macSpeakerLiveValidated=false;session.macSpeakerLiveStatus={reason,latencyMs:0,pendingWindows:0,completeEligibleSnapshot:false}}
+  }
+  const live = session.speakerIdentityPolicy === 'mac-native-v1' && session.speakerGeneration
+    ? (session.macSpeakerLiveValidated?certified:undefined)??macSpeakerLiveOriginalOnly({captureId:sessionId,generation:session.speakerGeneration,chunksIndexed:chunksIndexed as unknown as {i:number;c:Record<string,unknown>}[],state:session.macSpeakerLive,revision:session.speakerRevision??0,previousDigest:session.speakerProjectionSHA256}) : null
+  const projectionWithdrawn=!!session.macSpeakerLive?.projections.length&&!live?.macSpeakerLive?.projections.length
+  const liveStatus=live?.macSpeakerLive?.withheldReason?{reason:live.macSpeakerLive.withheldReason,latencyMs:0,pendingWindows:0,completeEligibleSnapshot:false}
+    :projectionWithdrawn&&session.macSpeakerLiveValidated?{reason:'projection_binding_changed',latencyMs:0,pendingWindows:0,completeEligibleSnapshot:false}
+    :!live?.macSpeakerLive?{reason:!macSpeakerLiveEnabled()?'feature_disabled':session.macSpeakerLiveStatus?.reason??'awaiting_qualified_evidence',latencyMs:session.macSpeakerLiveStatus?.latencyMs??0,pendingWindows:session.macSpeakerLiveStatus?.pendingWindows??0,completeEligibleSnapshot:false}
+    :session.macSpeakerLiveStatus??{reason:'awaiting_qualified_evidence',latencyMs:0,pendingWindows:0,completeEligibleSnapshot:false}
   const data = JSON.stringify({
       sessionId,
+      ...(live ? {speakerIdentityPolicy:live.speakerIdentityPolicy,sourceType:live.sourceType,speakerGeneration:live.speakerGeneration,speakerRevision:live.speakerRevision,speakerProjectionSHA256:live.speakerProjectionSHA256,speakerProjectedChunksIndexed:live.speakerProjectedChunksIndexed,...(live.macSpeakerLive?{macSpeakerLive:live.macSpeakerLive}:{}),...('macSpeakerLiveRetainedState'in live?{macSpeakerLiveRetainedState:live.macSpeakerLiveRetainedState}:{}),...(('macSpeakerLiveQuarantineSHA256'in live?live.macSpeakerLiveQuarantineSHA256:undefined)?{macSpeakerLiveQuarantineSHA256:('macSpeakerLiveQuarantineSHA256'in live?live.macSpeakerLiveQuarantineSHA256:undefined)}:{}),...(session.macSpeakerLiveQuarantineSHA256?{macSpeakerLiveQuarantineSHA256:session.macSpeakerLiveQuarantineSHA256}:{}),macSpeakerLiveStatus:liveStatus} : {}),
       ...(PHONE_CAPTURE_ID.test(sessionId) ? { captureSource: requirePhoneRecording(sessionId), sourceType: PHONE_SOURCE_TYPE, speakerPolicy: 'anonymous' } : {}),
       startTime: session.startTime,
       lastActivityAt: session.lastActivityAt,
@@ -736,7 +807,11 @@ function persistSessionRequired(sessionId: string): void {
       ...(session.macWindowVoices !== undefined ? { macWindowVoices: session.macWindowVoices } : {}),
     })
   try {
+    if(certified&&session.macSpeakerLiveValidated){try{assertMacSpeakerLivePublicationBindings(session.macSpeakerLiveFileBindings??[])}catch{session.macSpeakerLiveValidated=false;session.macSpeakerLiveStatus={reason:'resource_binding_changed',latencyMs:0,pendingWindows:0,completeEligibleSnapshot:false};return persistSessionRequired(sessionId)}}
     durableAtomicWriteFileSync(filePath, data, { mode: 0o600 })
+    if(live){session.macSpeakerLiveStatus=liveStatus;if(projectionWithdrawn)session.macSpeakerLiveValidated=false;session.macSpeakerLive=live.macSpeakerLive??('macSpeakerLiveRetainedState'in live?live.macSpeakerLiveRetainedState as MacSpeakerLiveState:undefined);session.speakerRevision=live.speakerRevision;session.speakerProjectionSHA256=live.speakerProjectionSHA256
+      if(('macSpeakerLiveQuarantineSHA256'in live?live.macSpeakerLiveQuarantineSHA256:undefined))session.macSpeakerLiveQuarantineSHA256=('macSpeakerLiveQuarantineSHA256'in live?live.macSpeakerLiveQuarantineSHA256:undefined)
+      if(live.invalid)session.macSpeakerLiveValidated=false}
   } catch (error) {
     console.error(`[transcribe-stream] Durable session write failed for ${sessionId}: ${errMsg(error)}`)
     throw makeHttpError(503, 'meeting session persistence unavailable', 'session_persistence_failed')
@@ -918,6 +993,12 @@ function recoverSessions(): void {
             for (const key of Object.keys(emptyCompletions)) insertSortedUnique(asrCompletedIndices, Number(key))
             const session: TranscriptSession = {
               chunks,
+              ...(MAC_CAPTURE_ID.test(data.sessionId)&&data.speakerIdentityPolicy==='mac-native-v1'?{
+                speakerIdentityPolicy:'mac-native-v1' as const,speakerGeneration:typeof data.speakerGeneration==='string'&&data.speakerGeneration.length>0&&data.speakerGeneration.length<=128?data.speakerGeneration:randomUUID(),
+                speakerRevision:typeof data.speakerRevision==='number'?data.speakerRevision:Number.NaN,
+                speakerProjectionSHA256:data.speakerProjectionSHA256,macSpeakerLive:data.macSpeakerLiveRetainedState??data.macSpeakerLive,macSpeakerLiveValidated:false,
+                macSpeakerLiveStatus:{reason:'recovery_revalidation_pending',latencyMs:0,pendingWindows:0,completeEligibleSnapshot:false},
+              }:{}),
               startTime: data.startTime,
               title: data.title || '',
               lastActivityAt,
@@ -957,6 +1038,20 @@ function recoverSessions(): void {
             }
             sessions.set(data.sessionId, session)
             recoveredIds.add(data.sessionId)
+            if(session.speakerIdentityPolicy==='mac-native-v1'){
+              // Clear previously exposed claims durably before asynchronous model,
+              // profile, ledger and every retained raw binding are revalidated.
+              try{persistSessionRequired(data.sessionId)}catch(error){
+                sessions.delete(data.sessionId);recoveredIds.delete(data.sessionId);rememberDeletedSession(data.sessionId)
+                // Preserve evidence outside the directory read as active claims.
+                // Do not adopt a capture whose mandatory withdrawal was not durable.
+                ensurePrivateDirectory(STALE_ACTIVE_SESSION_DIR)
+                renameSync(resolve(CHUNK_PERSIST_DIR,file),resolve(STALE_ACTIVE_SESSION_DIR,`${data.sessionId}.speaker-revalidation-${Date.now()}.json`))
+                console.error(`[session-recovery] Speaker revalidation clear failed; capture quarantined: ${data.sessionId}`)
+                continue
+              }
+              if(macSpeakerLiveEnabled())setImmediate(()=>macSpeakerLiveScheduler.schedule(data.sessionId))
+            }
             if (cleaned > 0) {
               console.log(`[session-recovery] Cleaned inline hallucinations from ${cleaned} chunks`)
               persistSessionBestEffort(data.sessionId)  // re-persist cleaned data to disk
@@ -1269,30 +1364,7 @@ setInterval(() => {
   try {
     const batchBusy = ((maintenanceLifecycle.snapshot().activeByKind as Record<string, number>)
       .meeting_batch_finalization ?? 0) > 0
-    for (const dir of readdirSync(PENDING_BATCH_DIR)) {
-      const dirPath = resolve(PENDING_BATCH_DIR, dir)
-      try {
-        const files = readdirSync(dirPath)
-        if (files.length === 0) { rmSync(dirPath, { recursive: true, force: true }); continue }
-        // Prefer the marker file mtime over first chunk mtime
-        const markerPath = resolve(dirPath, '_batch_pending.marker')
-        let ageSource: number
-        if (existsSync(markerPath)) {
-          ageSource = statSync(markerPath).mtimeMs
-        } else {
-          // Fallback for pre-v5.4.3 dirs: use directory ctime (changes on rename)
-          ageSource = statSync(dirPath).ctimeMs
-        }
-        if (Date.now() - ageSource > 12 * 60 * 60 * 1000) {
-          if (batchBusy) {
-            console.warn(`[cleanup] Retaining stale pending-batch while batch lease held: ${dir}`)
-            continue
-          }
-          rmSync(dirPath, { recursive: true, force: true })
-          console.log(`[cleanup] Purged stale pending-batch: ${dir}`)
-        }
-      } catch {}
-    }
+    sweepStalePendingBatch(PENDING_BATCH_DIR, { now: Date.now(), batchBusy })
   } catch {}
 
   // Meeting audio for review: 7-day window, then an 8 GB budget as a backstop.
@@ -1385,13 +1457,19 @@ setInterval(() => {
 }, 60_000)
 
 /** Get or create a transcript session */
-export function getSession(sessionId: string): TranscriptSession {
+export function getSession(sessionId: string, admission: {newMacRegistry?:boolean} = {}): TranscriptSession {
   const phone = sessionId.startsWith('phone_') ? requirePhoneRecording(sessionId) : null
   let session = sessions.get(sessionId)
   if (!session) {
+    // The durable registry proves this capture was already admitted. A missing
+    // or unreadable active snapshot is not permission to reset its generation,
+    // acoustic evidence or Voice namespace. Only the initial registry creator
+    // may create a new Mac session; replayed starts must recover existing state.
+    if(MAC_CAPTURE_ID.test(sessionId)&&readMacRecording(sessionId)&&!admission.newMacRegistry)throw macError(409,'mac_speaker_state_missing','Capture state is unavailable; preserve this recording and start a new capture')
     const now = Date.now()
     session = {
       chunks: [],
+      ...(MAC_CAPTURE_ID.test(sessionId)&&macSpeakerLiveEnabled()?{speakerIdentityPolicy:'mac-native-v1' as const,speakerGeneration:randomUUID(),speakerRevision:0,macSpeakerLiveValidated:false}:{}),
       startTime: phone?.startTime ?? now,
       lastActivityAt: now,
       title: '',
@@ -2478,6 +2556,7 @@ async function processStreamChunk(opts: {
   const macWindowWithheld = macWindowOn ? macWindowWithheldReason(session.macWindowVoices, session.chunks) : null
   if (macWindowWithheld) noteMacWindowWithheld(sessionId, macWindowWithheld)
   const macWindowState = macWindowOn ? macWindowStateFor(session.macWindowVoices, session.chunks) : null
+  if(macWindowState&&session.speakerIdentityPolicy==='mac-native-v1')macWindowState.voices=Math.max(macWindowState.voices,session.macSpeakerLive?.voiceHighWater??0)
   const macWindow = macWindowState
     ? startMacWindowDiarize({
         sessionId,
@@ -2510,7 +2589,8 @@ async function processStreamChunk(opts: {
   const whisperContext = recentWhisperContext(sessionId, session)
   console.log(`[perf] whisperContext: ${whisperContext.length}b | session.chunks: ${session.chunks.length}`)
 
-  const speakerPromise = Promise.resolve(identifyChunkSpeaker(audioBuffer, sessionId, chunkIndex, clientSpeaker, capturePolicy))
+  const nativeIdentity = session.speakerIdentityPolicy === 'mac-native-v1'
+  const speakerPromise = Promise.resolve(nativeIdentity ? {speaker:'Ext',similarity:0} : identifyChunkSpeaker(audioBuffer, sessionId, chunkIndex, clientSpeaker, capturePolicy))
 
   let rawText = ''
   let words: WhisperWord[] | undefined
@@ -2603,7 +2683,7 @@ async function processStreamChunk(opts: {
         owner: ownerLabelOrNull(),
         ...(macWindow ? {
           anonymousChannel: (channel: number) => macWindow.result()?.labelOf(channel) ?? null,
-        } : MAC_CAPTURE_ID.test(sessionId) && macLiveVoicesMode() === 'anchors' ? {
+        } : !nativeIdentity && MAC_CAPTURE_ID.test(sessionId) && macLiveVoicesMode() === 'anchors' ? {
           anonymousVoice: (wav: Buffer) => {
             // Fail closed after an upgrade/recovery lacking acoustic anchors:
             // never reuse Voice 1 for an unrelated person from a later chunk.
@@ -2614,7 +2694,7 @@ async function processStreamChunk(opts: {
         } : {}),
         identify: wav => {
           const policy = capturePolicy
-          if (policy === 'anonymous') return { speaker: 'Ext', similarity: 0 }
+          if (nativeIdentity || policy === 'anonymous') return { speaker: 'Ext', similarity: 0 }
           // 6.90.0: a Mac track is never checked against the wearer first (the wearer
           // is not in Mac playback) and is tagged so its calibration rows are separable.
           const mac = MAC_CAPTURE_ID.test(sessionId)
@@ -2715,6 +2795,7 @@ async function processStreamChunk(opts: {
   console.log(`[perf] persistSession: ${(performance.now() - tPersist).toFixed(1)}ms (${session.chunks.filter(c => c).length} chunks)`)
 
   scheduleSessionProgressiveHq(sessionId)
+  if(nativeIdentity)macSpeakerLiveScheduler.schedule(sessionId)
 
   emitDisplay({
     type: 'transcript_chunk',
@@ -2725,7 +2806,7 @@ async function processStreamChunk(opts: {
   // bare `void` on a rejecting promise is an unhandled rejection, which Node
   // throws on by default. All gates live inside the feed.
   // The ASR await above lets a late chunk land after Stop or save; a closed session never feeds cues.
-  if (!isSessionDeleted(sessionId)) void feedLiveCueTranscript(sessionId, trimmedText, Boolean(fallbackReason)).catch(() => {})
+  if (!isSessionDeleted(sessionId)) void feedLiveCueTranscript(sessionId, trimmedText, Boolean(fallbackReason), [speaker, ...(chunk.segments ?? []).map(segment => segment.speaker)]).catch(() => {})
 
   // 6.85.0: timing and the character count only. This line runs for every chunk, so the meeting
   // text itself never goes to the server log (transcribe-stream-log-privacy.test.ts).
@@ -2884,7 +2965,7 @@ transcribeStreamRouter.post('/mac-recording/start', (req, res) => {
     if (sessions.has(req.body.captureId) && !readMacRecording(req.body.captureId)) throw macError(409, 'mac_capture_conflict', 'Capture ID already exists')
     lease = acquireRecordingChunkLease({ allowDuringDrain: sessions.has(req.body.captureId) })
     const { recording, replayed } = registerMacRecording(req.body)
-    const session = getSession(recording.sessionId)
+    const session = getSession(recording.sessionId,{newMacRegistry:!replayed})
     if (!session.chunks.some(Boolean)) session.startTime = recording.startTime
     persistSessionRequired(recording.sessionId)
     // Arming happens only after the recording is admitted, and its answer never fails the start (armMacLiveCues returns a
@@ -2920,7 +3001,7 @@ transcribeStreamRouter.post('/mac-recording/:captureId/chunks', async (req, res)
     const prior = session.chunks[chunkIndex] ?? session.emptyCompletions?.[String(chunkIndex)]
     if (prior?.audioSha256 && prior.audioSha256 !== sha256Hex(audio)) throw macError(409, 'mac_chunk_conflict', 'Chunk index already holds different audio')
     res.json(await processStreamChunk({ sessionId: id, chunkIndex, clientSpeaker: 'Ext', audioBuffer: audio, clientElapsed: elapsed - duration, audioDurationMs: duration, startTimeOverride: recording.startTime }))
-  } catch (error) { sendStreamError(res, error) } finally { if (locked) macChunkLocks.delete(id); lease?.release() }
+  } catch (error) { sendStreamError(res, error) } finally { if (locked) {macChunkLocks.delete(id);if(sessions.get(id)?.speakerIdentityPolicy==='mac-native-v1')macSpeakerLiveScheduler.schedule(id)}; lease?.release() }
 })
 
 const phoneChunkLocks = new Set<string>()

package/server/routes/voice.ts

@@ -2,9 +2,11 @@
 
 import express, { Router } from 'express'
 import { errMsg } from '../lib/utils.js'
+import { forgetMacVoiceNamingPerson } from '../lib/mac-voice-naming-batch.js'
 import { readdirSync, readFileSync, unlinkSync, existsSync, rmdirSync, rmSync } from 'node:fs'
 import { resolve } from 'node:path'
 import { checkSpeakerName } from '../lib/speaker-name.js'
+import { bodyName, nfc, sameSpeakerName } from '../lib/speaker-name-nfc.js'
 import { enrollSpeaker, isEnrolled, getAllSpeakerNames, identifySpeaker, extractEmbedding, enrollEmbedding, getEmbeddingCount, removeSpeakerProfile, readVoiceProfiles, mergeSpeakerProfiles } from '../lib/speaker-embeddings.js'
 import { statSync } from 'node:fs'
 import { trainFromFireflies, getTrainingStatus } from '../lib/speaker-trainer.js'
@@ -51,7 +53,9 @@ voiceRouter.post('/voice/enroll', async (req, res) => {
     // Default to the configured wearer label ('Me' unless owner_speaker_label
     // is set). Hardcoding one user's initials here enrolled every other install
     // under a stranger's name.
-    const name = (req.query.name as string) || getOwnerSpeakerLabel()
+    // `?name=a&name=b` is not a name; falling through to the owner's label would enroll a stranger's voice as the owner.
+    if (req.query.name !== undefined && typeof req.query.name !== 'string') return res.status(400).json({ error: 'name must be a single value' })
+    const name = nfc(typeof req.query.name === 'string' && req.query.name ? req.query.name : getOwnerSpeakerLabel())
 
     // An old client can still send a whole spoken sentence as the name (the
     // "enroll my voice" fall-through). Refuse it here: a junk profile can
@@ -115,7 +119,8 @@ voiceRouter.post('/voice/identify', async (req, res) => {
 // POST /api/voice/train — train voiceprints from Fireflies meeting audio
 voiceRouter.post('/voice/train', async (req, res) => {
   try {
-    const { speakerNames, minSegments, minSegmentDuration, limit, maxEmbeddingsPerSpeaker, fresh } = req.body ?? {}
+    const { speakerNames: rawSpeakerNames, minSegments, minSegmentDuration, limit, maxEmbeddingsPerSpeaker, fresh } = req.body ?? {}
+    const speakerNames = Array.isArray(rawSpeakerNames) ? rawSpeakerNames.map((n: unknown) => typeof n === 'string' ? nfc(n) : n) : rawSpeakerNames
     const report = await trainFromFireflies({
       speakerNames,
       minSegments,
@@ -160,7 +165,7 @@ const DEFAULT_MAX_TRAIN_PER_SPEAKER = 10
 
 voiceRouter.post('/voice/train-g2', async (req, res) => {
   try {
-    const targetSpeaker = req.body?.speaker as string | undefined
+    const targetSpeaker = typeof req.body?.speaker === 'string' ? nfc(req.body.speaker) : undefined
     const confirmAll = req.body?.confirmAllSpeakers === true
     const dryRun = req.body?.dryRun === true
     const maxPerSpeaker = Number.isFinite(req.body?.maxPerSpeaker)
@@ -361,7 +366,8 @@ voiceRouter.get('/voice/ext-audio', (_req, res) => {
 // If sessionId provided, only enroll from that session. Otherwise, enroll from all ext sessions.
 voiceRouter.post('/voice/enroll-ext', async (req, res) => {
   try {
-    const { name, sessionId } = req.body ?? {}
+    const { name: rawName, sessionId } = req.body ?? {}
+    const name = typeof rawName === 'string' ? nfc(rawName) : rawName
     if (!name || typeof name !== 'string' || name.length < 2) {
       return res.status(400).json({ error: 'name is required (min 2 chars)' })
     }
@@ -485,7 +491,7 @@ function newestWav(dirPath: string): string | null {
 // GET /api/voice/profiles/:name/sample — hear what a stored profile sounds like.
 voiceRouter.get('/voice/profiles/:name/sample', (req, res) => {
   res.set('Cache-Control', 'private, no-store')
-  const name = String(req.params.name ?? '')
+  const name = nfc(String(req.params.name ?? ''))
   const dirPath = speakerDirPath(AUDIO_SAVE_DIR, name)
   if (!dirPath) {
     res.status(400).json({ error: 'Invalid speaker name', reason: 'invalid_speaker' })
@@ -587,7 +593,7 @@ voiceRouter.post('/voice/held-groups/enroll', async (req, res) => {
   try {
     const nameCheck = checkSpeakerName(req.body?.name, { ownerLabel: getOwnerSpeakerLabel() })
     if (!nameCheck.ok) return res.status(400).json({ success:false,error:nameCheck.message,reason:nameCheck.reason })
-    const name = resolveStoredName(String(req.body.name).trim())
+    const name = resolveStoredName(nfc(String(req.body.name).trim()))
     // Held samples are audio this Mac captured. A member pointing at an imported
     // or derived record is not held audio, so it never reaches the preview.
     //
@@ -679,7 +685,7 @@ voiceRouter.get('/voice/profiles', (_req, res) => {
           return {
             name: p.name,
             embeddings: p.embeddings.length,
-            isOwner: p.name === owner,
+            isOwner: sameSpeakerName(p.name, owner),
             sources: bySource,
             // 6.44.15: a profile whose name on disk was a spoken sentence was
             // renamed at load; the client offers a rename.
@@ -793,21 +799,23 @@ function fanOutTotals(runs: readonly SpeakerRenameFanOut[]): {
 // knows something the audio does not, and it is logged.
 voiceRouter.post('/voice/merge-profiles', async (req, res) => {
   try {
-    const into = typeof req.body?.into === 'string' ? req.body.into.trim() : ''
+    const into = bodyName(req.body?.into).trim()
     const rawFrom = req.body?.from
     const from = (Array.isArray(rawFrom) ? rawFrom : [rawFrom])
       .filter((n: unknown): n is string => typeof n === 'string' && n.trim().length > 0)
-      .map((n: string) => n.trim())
+      .map((n: string) => nfc(n.trim()))
 
     if (!into || from.length === 0) {
       return res.status(400).json({ error: 'into (string) and from (string or string[]) are required' })
     }
-    if (from.includes(into)) {
+    // The same name twice is refused, unless the store holds it twice (a profile written decomposed and its composed twin): those are two
+    // profiles and merging them is the point.
+    if (from.some(n => sameSpeakerName(n, into)) && readVoiceProfiles().profiles.filter(p => sameSpeakerName(p.name, into)).length < 2) {
       return res.status(400).json({ error: 'into and from must differ' })
     }
 
     const owner = getOwnerSpeakerLabel()
-    if (from.includes(owner)) {
+    if (from.some(n => sameSpeakerName(n, owner))) {
       // Absorbing the owner label would delete the profile the live
       // identification path checks FIRST, on every chunk.
       return res.status(400).json({
@@ -907,11 +915,11 @@ voiceRouter.post('/voice/delete-person', (req, res) => {
     if (!name || typeof name !== 'string' || name.trim().length < 2) {
       return res.status(400).json({ error: 'name is required (min 2 chars)' })
     }
-    const target = name.trim()
+    const target = nfc(name.trim())
     const dryRun = req.body?.dryRun === true
 
     if (req.body?.confirm !== true && !dryRun) {
-      const existing = readVoiceProfiles().profiles.find(p => p.name === target)
+      const existing = readVoiceProfiles().profiles.filter(p => sameSpeakerName(p.name, target))
       const audioDir = speakerDirPath(AUDIO_SAVE_DIR, target)
       let wavs = 0
       if (audioDir && existsSync(audioDir)) {
@@ -922,8 +930,8 @@ voiceRouter.post('/voice/delete-person', (req, res) => {
         error: 'confirmation required',
         message: `Deleting "${target}" is not reversible. Pass { confirm: true } to proceed.`,
         wouldRemove: {
-          profile: existing ? 1 : 0,
-          embeddings: existing?.embeddings.length ?? 0,
+          profile: existing.length,
+          embeddings: existing.reduce((n, p) => n + p.embeddings.length, 0),
           trainingAudioFiles: wavs,
           calibrationRows: calibration.removed,
         },
@@ -931,7 +939,7 @@ voiceRouter.post('/voice/delete-person', (req, res) => {
     }
 
     if (dryRun) {
-      const existing = readVoiceProfiles().profiles.find(p => p.name === target)
+      const existing = readVoiceProfiles().profiles.filter(p => sameSpeakerName(p.name, target))
       const audioDir = speakerDirPath(AUDIO_SAVE_DIR, target)
       let wavs = 0
       if (audioDir && existsSync(audioDir)) {
@@ -942,8 +950,8 @@ voiceRouter.post('/voice/delete-person', (req, res) => {
         name: target,
         dryRun: true,
         removed: {
-          profiles: existing ? 1 : 0,
-          embeddings: existing?.embeddings.length ?? 0,
+          profiles: existing.length,
+          embeddings: existing.reduce((n, p) => n + p.embeddings.length, 0),
           trainingAudioFiles: wavs,
           calibrationRows: calibration.removed,
         },
@@ -952,6 +960,8 @@ voiceRouter.post('/voice/delete-person', (req, res) => {
 
     // 1. Voice profile + sherpa manager registration.
     const profileResult = removeSpeakerProfile(target)
+    // A deleted person's voiceprints must not survive in a naming batch's Undo journal.
+    forgetMacVoiceNamingPerson(target)
 
     // 2. Saved G2 training audio for this person.
     let trainingAudioFiles = 0