@remnic/core 9.4.2 → 9.6.0

package/src/wearables/config.ts

@@ -16,6 +16,7 @@ import type {
   WearableCleanupSettings,
   WearableCorrectionRule,
   WearableMemoryMode,
+  WearableFusionConfig,
   WearableSourceSettings,
   WearablesConfig,
 } from "./types.js";
@@ -47,6 +48,11 @@ const MAX_AUTO_SYNC_WINDOW_DAYS = 90;
 const DEFAULT_SOURCE_TRUST = 0.8;
 const DEFAULT_AUTO_APPROVE_TRUST = 0.7;
 const DEFAULT_REVIEW_TRUST = 0.45;
+// Cross-source fusion (#1810) — disabled by default; enabling is the
+// only behavior change fusion introduces.
+const DEFAULT_FUSION_ENABLED = false;
+const DEFAULT_FUSION_PROXIMITY_GAP_MS = 300_000;
+const DEFAULT_FUSION_WINDOW_TOLERANCE_MS = 30_000;
 
 // Sources whose provider emits per-utterance text but unreliable
 // speaker labels (Bee falls back to a generic "unknown" label when
@@ -91,6 +97,14 @@ export function defaultWearableSourceSettings(
   };
 }
 
+export function defaultWearableFusionConfig(): WearableFusionConfig {
+  return {
+    enabled: DEFAULT_FUSION_ENABLED,
+    proximityGapMs: DEFAULT_FUSION_PROXIMITY_GAP_MS,
+    windowToleranceMs: DEFAULT_FUSION_WINDOW_TOLERANCE_MS,
+  };
+}
+
 export function defaultWearablesConfig(): WearablesConfig {
   return {
     enabled: false,
@@ -104,6 +118,7 @@ export function defaultWearablesConfig(): WearablesConfig {
     autoSyncDeepDays: DEFAULT_AUTO_SYNC_DEEP_DAYS,
     corrections: [],
     sources: {},
+    fusion: defaultWearableFusionConfig(),
   };
 }
 
@@ -331,6 +346,42 @@ function parseSourceSettings(
  * Parse the `wearables` config block. `undefined` yields the disabled
  * default config; any present-but-malformed value throws.
  */
+function parseFusionSettings(
+  value: unknown,
+  keyPath: string,
+): WearableFusionConfig {
+  if (value === undefined) return defaultWearableFusionConfig();
+  const raw = requireObject(value, keyPath);
+  const defaults = defaultWearableFusionConfig();
+  const parsePositiveInt = (
+    value: unknown,
+    name: string,
+    fallback: number,
+  ): number => {
+    if (value === undefined) return fallback;
+    const coerced = coerceNumber(value);
+    if (coerced === undefined || !Number.isInteger(coerced) || coerced <= 0) {
+      throw new Error(
+        `${keyPath}.${name} must be a positive integer (got ${JSON.stringify(value)})`,
+      );
+    }
+    return coerced;
+  };
+  return {
+    enabled: parseBool(raw.enabled, `${keyPath}.enabled`, defaults.enabled),
+    proximityGapMs: parsePositiveInt(
+      raw.proximityGapMs,
+      "proximityGapMs",
+      defaults.proximityGapMs,
+    ),
+    windowToleranceMs: parsePositiveInt(
+      raw.windowToleranceMs,
+      "windowToleranceMs",
+      defaults.windowToleranceMs,
+    ),
+  };
+}
+
 export function parseWearablesConfig(value: unknown): WearablesConfig {
   if (value === undefined) return defaultWearablesConfig();
   const raw = requireObject(value, "wearables");
@@ -455,6 +506,7 @@ export function parseWearablesConfig(value: unknown): WearablesConfig {
     autoSyncIntervalMinutes,
     autoSyncDays,
     autoSyncDeepDays,
+    fusion: parseFusionSettings(raw.fusion, "wearables.fusion"),
     corrections: parseCorrectionRules(raw.corrections, "wearables.corrections"),
     sources,
   };

package/src/wearables/day-store.test.ts

@@ -2,12 +2,16 @@ import assert from "node:assert/strict";
 import { test } from "node:test";
 
 import {
+  bodyIsEscaped,
   composeDayTranscriptBody,
   composeDayTranscriptMeta,
+  decodeTranscriptBody,
   hashTranscriptBody,
   isValidTranscriptDate,
   parseDayTranscript,
+  parseTranscriptSegmentLine,
   serializeDayTranscript,
+  TRANSCRIPT_FORMAT_VERSION,
 } from "./day-store.js";
 import { emptySpeakerRegistry } from "./speakers.js";
 import type { WearableConversation } from "./types.js";
@@ -141,3 +145,245 @@ test("invalid timezone falls back to UTC clock rendering instead of crashing", (
   );
   assert.match(body, /## \d{2}:\d{2}–\d{2}:\d{2} · Morning coffee/);
 });
+
+
+test("decodeTranscriptBody decodes segment text but leaves headings/locations untouched (#1849)", () => {
+  // Hand-written stored body: segment text carries the escaped forms
+  // (backslash-n for a newline) exactly as composeDayTranscriptBody
+  // serializes them, while the title/location are NOT escaped on write.
+  const body =
+    "# bee transcript — 2026-06-10\n" +
+    "\n" +
+    "## 09:00–09:10 · C:\\roadmap (conversation c1)\n" +
+    "\n" +
+    "*Location: D:\\data*\n" +
+    "\n" +
+    '**Me (you)** [09:00]: Line one.\\nLine two.\n';
+  const decoded = decodeTranscriptBody(body, true);
+  // Segment text IS decoded: backslash-n -> real newline.
+  assert.ok(decoded.includes("Line one.\nLine two."), "segment newline decoded");
+  assert.ok(!decoded.includes("Line one.\\nLine two."), "no escaped-newline leak in segment");
+  // Title and location are NOT escaped on write, so a literal backslash
+  // there must pass through verbatim (only segment text is decoded).
+  assert.ok(decoded.includes("· C:\\roadmap (conversation c1)"), "title backslash untouched");
+  assert.ok(decoded.includes("*Location: D:\\data*"), "location backslash untouched");
+});
+
+test("decodeTranscriptBody recovers original segment text from a composed body (#1849)", () => {
+  const original = "First line.\nSecond line with a backslash \\ here.";
+  const conversations: WearableConversation[] = [
+    {
+      id: "c1",
+      source: "bee",
+      startIso: "2026-06-10T09:00:00Z",
+      segments: [{ speakerKey: "user", isWearer: true, text: original }],
+    },
+  ];
+  const body = composeDayTranscriptBody("bee", "2026-06-10", "UTC", conversations, REGISTRY);
+  // The stored body carries the ESCAPED form, not the original...
+  assert.ok(!body.includes(original), "stored body is escaped, not the raw original");
+  assert.ok(body.includes("First line.\\nSecond line"), "stored body has the escaped newline");
+  // ...and decoding recovers the original utterance verbatim.
+  assert.ok(
+    decodeTranscriptBody(body, true).includes(original),
+    "decoded body recovers the original segment text",
+  );
+});
+
+
+test("speaker label with markdown delimiters round-trips through compose → parse and decodeTranscriptBody (#1849)", () => {
+  // A speaker label containing `**`, `[`, `]` — the exact characters that
+  // delimit a segment line. Without safe serialization the label breaks
+  // parseTranscriptSegmentLine parsing; with escape/unescape it round-trips
+  // losslessly through composition, parsing, and display decoding.
+  const registry = emptySpeakerRegistry();
+  registry.selfName = "Me";
+  registry.speakers["bee:SPEAKER_01"] = {
+    name: "A**B",
+    updatedAt: "2026-06-10T00:00:00Z",
+  };
+  const conversations: WearableConversation[] = [
+    {
+      id: "c1",
+      source: "bee",
+      startIso: "2026-06-10T09:00:00Z",
+      segments: [
+        { speakerKey: "user", isWearer: true, text: "Hi there.", startIso: "2026-06-10T09:00:00Z" },
+        { speakerKey: "SPEAKER_01", text: "Delimited label.", startIso: "2026-06-10T09:01:00Z" },
+      ],
+    },
+  ];
+  const body = composeDayTranscriptBody("bee", "2026-06-10", "UTC", conversations, registry);
+  // The raw stored body escapes the delimiters so the parser never sees
+  // a forged `**` or `[` boundary inside the label.
+  assert.ok(
+    body.includes("**A\\*\\*B**"),
+    "label delimiters are escaped in the stored body: " + body,
+  );
+  // Display decoding recovers the ORIGINAL label for view/search surfaces.
+  const decoded = decodeTranscriptBody(body, true);
+  assert.ok(
+    decoded.includes("**A**B** [09:01]: Delimited label."),
+    "decoded body shows the original unescaped label: " + decoded,
+  );
+  // parseDayTranscript preserves the body bytes verbatim.
+  const serialized = serializeDayTranscript(
+    composeDayTranscriptMeta("bee", "2026-06-10", "UTC", conversations, registry, body, "2026-06-11T01:00:00.000Z"),
+    body,
+  );
+  const parsed = parseDayTranscript(serialized);
+  assert.ok(parsed);
+  assert.equal(parsed!.body, body, "body survives serialization round-trip");
+});
+
+test("legacy raw label without escape sequences parses and decodes verbatim (#1849)", () => {
+  // A hand-written stored body whose label was NEVER escaped (a pre-
+  // escaper transcript). decodeTranscriptBody and the segment-line parser
+  // must treat it as a no-op: no backslash sequences => unchanged label.
+  const body =
+    "# bee transcript — 2026-06-10\n" +
+    "\n" +
+    "## 09:00–09:10 (conversation c1)\n" +
+    "\n" +
+    "**Me (you)** [09:00]: Hello world.\n" +
+    "**Guest** [09:01]: Good morning.\n";
+  const decoded = decodeTranscriptBody(body);
+  assert.equal(decoded, body, "legacy body with no escapes decodes verbatim");
+});
+
+test("legacy body with literal backslash-n/backslash-r is never decoded (#1849)", () => {
+  // A pre-escaper transcript whose segment text contains the LITERAL
+  // two-character sequences \n and \r (not escape sequences). The
+  // format-aware decoder MUST leave them byte-for-byte unchanged so the
+  // original content is never corrupted.
+  const legacyBody =
+    "# bee transcript — 2026-06-10\n" +
+    "\n" +
+    "## 09:00–09:10 (conversation c1)\n" +
+    "\n" +
+    "**Guest** [09:00]: A literal backslash-n \\n and backslash-r \\r here.\n";
+  // Default (escaped=false): legacy body is a no-op.
+  assert.equal(
+    decodeTranscriptBody(legacyBody),
+    legacyBody,
+    "legacy body must not be decoded without an explicit format marker",
+  );
+  // Even when explicitly told the body IS escaped, the literal sequences
+  // \n / \r WOULD be decoded — but only NEW-format bodies (meta carries
+  // formatVersion >= 2) are ever passed escaped=true by the service.
+  // Here we verify the SAFETY of the default: callers that forget the
+  // flag never corrupt legacy content.
+  assert.equal(
+    decodeTranscriptBody(legacyBody, false),
+    legacyBody,
+    "escaped=false leaves legacy literal escapes unchanged",
+  );
+});
+
+test("new-format body with formatVersion marker decodes correctly (#1849)", () => {
+  const conversations: WearableConversation[] = [
+    {
+      id: "c1",
+      source: "bee",
+      startIso: "2026-06-10T09:00:00Z",
+      segments: [{ speakerKey: "user", isWearer: true, text: "Line one.\nLine two." }],
+    },
+  ];
+  const body = composeDayTranscriptBody("bee", "2026-06-10", "UTC", conversations, REGISTRY);
+  const meta = composeDayTranscriptMeta(
+    "bee", "2026-06-10", "UTC", conversations, REGISTRY, body, "2026-06-11T01:00:00.000Z",
+  );
+  // The meta carries the format version marker.
+  assert.equal(meta.formatVersion, TRANSCRIPT_FORMAT_VERSION);
+  assert.ok(bodyIsEscaped(meta), "new-format meta is recognized as escaped");
+  // bodyIsEscaped returns false for legacy (no marker) and null.
+  assert.equal(bodyIsEscaped(null), false);
+  assert.equal(bodyIsEscaped(undefined), false);
+  assert.equal(bodyIsEscaped({}), false);
+  assert.equal(bodyIsEscaped({ formatVersion: 1 }), false);
+  // Decoding with the escaped flag recovers the original newline.
+  const decoded = decodeTranscriptBody(body, bodyIsEscaped(meta));
+  assert.ok(decoded.includes("Line one.\nLine two."), "new-format body decodes the newline");
+});
+
+test("composeDayTranscriptMeta stamps formatVersion and serialize/parse round-trips it (#1849)", () => {
+  const body = composeDayTranscriptBody(
+    "limitless", "2026-06-10", "UTC", CONVERSATIONS, REGISTRY,
+  );
+  const meta = composeDayTranscriptMeta(
+    "limitless", "2026-06-10", "UTC", CONVERSATIONS, REGISTRY, body, "2026-06-11T01:00:00.000Z",
+  );
+  assert.equal(meta.formatVersion, TRANSCRIPT_FORMAT_VERSION);
+  const serialized = serializeDayTranscript(meta, body);
+  assert.ok(serialized.includes("formatVersion: 2"), "serialized file carries the marker");
+  const parsed = parseDayTranscript(serialized);
+  assert.ok(parsed);
+  assert.equal(parsed!.meta.formatVersion, TRANSCRIPT_FORMAT_VERSION);
+  // A legacy file (hand-written, no formatVersion line) parses with
+  // formatVersion undefined so bodyIsEscaped returns false.
+  const legacyFile =
+    "---\nkind: wearable-transcript\nsource: \"bee\"\ndate: \"2026-06-10\"\n" +
+    "timezone: \"UTC\"\nconversationCount: 1\nsegmentCount: 1\n" +
+    "speakers: []\ndurationMinutes: 0\ncontentHash: \"x\"\nsyncedAt: \"y\"\n" +
+    "---\n\n# bee transcript — 2026-06-10\n";
+  const legacyParsed = parseDayTranscript(legacyFile);
+  assert.ok(legacyParsed);
+  assert.equal(legacyParsed!.meta.formatVersion, undefined);
+  assert.equal(bodyIsEscaped(legacyParsed!.meta), false);
+});
+
+test("parseTranscriptSegmentLine extracts label, clock, and text (#1849)", () => {
+  const m = parseTranscriptSegmentLine("**Pat** [09:30]: Hello world.");
+  assert.deepEqual(m, { label: "Pat", clock: "09:30", text: "Hello world." });
+});
+
+test("parseTranscriptSegmentLine handles single-char label and empty text", () => {
+  const m = parseTranscriptSegmentLine("**X** [00:00]: ");
+  assert.deepEqual(m, { label: "X", clock: "00:00", text: "" });
+});
+
+test("parseTranscriptSegmentLine preserves backslash escape sequences in label/text", () => {
+  // Escaped labels/text from the escape-aware serializer carry literal
+  // backslash sequences that must survive the linear parser unchanged.
+  const m = parseTranscriptSegmentLine("**Pat \\*Smith\\*** [09:00]: Hello \\n world.");
+  assert.ok(m);
+  assert.equal(m!.label, "Pat \\*Smith\\*");
+  assert.equal(m!.clock, "09:00");
+  assert.equal(m!.text, "Hello \\n world.");
+});
+
+test("parseTranscriptSegmentLine returns null for non-segment lines", () => {
+  assert.equal(parseTranscriptSegmentLine(""), null);
+  assert.equal(parseTranscriptSegmentLine("not a segment"), null);
+  assert.equal(parseTranscriptSegmentLine("**no close"), null);
+  assert.equal(parseTranscriptSegmentLine("**label** no bracket"), null);
+  assert.equal(parseTranscriptSegmentLine("**label** [clock] no colon-space"), null);
+  assert.equal(parseTranscriptSegmentLine("**label** [clock]:no space"), null);
+  assert.equal(parseTranscriptSegmentLine("**label** []: text"), null);
+});
+
+test("parseTranscriptSegmentLine is linear-safe on adversarial repeated delimiters (#1849)", () => {
+  // A line with many '*' chars must not cause polynomial backtracking.
+  // The linear scan finds the first '**' followed by \s[ — or returns
+  // null — without exploring exponential alternatives.
+  const longLabel = "a".repeat(10_000);
+  const adversarial = `**${longLabel}** [09:00]: text`;
+  const m = parseTranscriptSegmentLine(adversarial);
+  assert.ok(m, "long label with valid delimiters must parse");
+  assert.equal(m!.label, longLabel);
+  assert.equal(m!.clock, "09:00");
+  assert.equal(m!.text, "text");
+
+  // All stars, no closing \s[ — must return null quickly.
+  const noClose = "**" + "*".repeat(10_000);
+  assert.equal(parseTranscriptSegmentLine(noClose), null);
+
+  // All stars followed by valid suffix — the first '**' positions are
+  // all stars (not followed by \s), so the scan walks the entire run
+  // in O(n) and finds the '** ' before '['.
+  const allStars = "**" + "*".repeat(10_000) + "** [09:00]: text";
+  const m2 = parseTranscriptSegmentLine(allStars);
+  assert.ok(m2, "star-prefixed line with valid delimiters must parse");
+  assert.equal(m2!.clock, "09:00");
+  assert.equal(m2!.text, "text");
+});

package/src/wearables/day-store.ts

@@ -34,6 +34,127 @@ export const WEARABLES_DIR_NAME = "wearables";
 
 const DATE_PATTERN = /^\d{4}-\d{2}-\d{2}$/;
 
+/**
+ * Day-transcript body serialization format version. Folded into
+ * `hashTranscriptBody` so a version bump invalidates files written by an
+ * older serializer and forces an idempotent rewrite. Decoders gate on this:
+ * only bodies whose parsed meta carries >= this version have escape
+ * sequences decoded; legacy bodies (absent / older) are left byte-for-byte
+ * unchanged so a literal two-character `\n`/`\r` in a pre-escaper
+ * transcript is never altered (issue #1849).
+ */
+export const TRANSCRIPT_FORMAT_VERSION = 2;
+
+/**
+ * Result of parsing a rendered transcript segment line.
+ */
+export interface TranscriptSegmentMatch {
+  /** Speaker label text between the `**` delimiters. */
+  label: string;
+  /** Clock text between the `[` `]` delimiters. */
+  clock: string;
+  /** Segment text after the colon. */
+  text: string;
+}
+
+/**
+ * Test a single character code point against the JavaScript regex `\s`
+ * whitespace class without invoking a regex. Used by the linear segment
+ * line parser so no quantified pattern is ever evaluated on untrusted
+ * transcript content (CodeQL polynomial-redos, issue #1849).
+ */
+function isRegexWhitespace(code: number): boolean {
+  return (
+    (code >= 0x09 && code <= 0x0d) ||
+    code === 0x20 ||
+    code === 0xa0 ||
+    code === 0x1680 ||
+    (code >= 0x2000 && code <= 0x200a) ||
+    code === 0x2028 ||
+    code === 0x2029 ||
+    code === 0x202f ||
+    code === 0x205f ||
+    code === 0x3000 ||
+    code === 0xfeff
+  );
+}
+
+/**
+ * Parse a rendered transcript segment line (`**label** [clock]: text`)
+ * into its three components using a linear, bounded scan — a CodeQL-safe
+ * replacement for the polynomial-risk regex that previously matched this
+ * format. Returns null when the line is not a segment line.
+ *
+ * The scan finds the FIRST occurrence of each structural delimiter
+ * (`**` after the label, `]` after the clock) exactly as the original
+ * non-greedy regex did, and verifies the fixed separator characters
+ * (`\s`, `[`, `:`, `\s`) by single-character code-point comparison.
+ * No quantified regex is evaluated on the line (#1849).
+ *
+ * Escaped labels (formatVersion >= 2) never contain an unescaped `**`,
+ * `[`, or `]`, and rendered clocks are always `HH:MM` / `--:--`, so the
+ * first delimiter is always the correct one for every well-formed
+ * transcript. Legacy unescaped labels are used verbatim by the caller
+ * and parsed identically here.
+ */
+export function parseTranscriptSegmentLine(
+  line: string,
+): TranscriptSegmentMatch | null {
+  // Must start with '**'.
+  if (!line.startsWith("**")) return null;
+
+  // Find the closing '**' of the label: the first '**' at index >= 3
+  // (label is at least 1 char) that is immediately followed by \s and
+  // then '['. This mirrors the non-greedy regex: the engine tries the
+  // shortest label first and extends only when the subsequent fixed
+  // delimiters do not line up. An escaped label ending with '\*' is
+  // correctly handled because the spurious '**' (escape-star + close-
+  // star) is not followed by \s and the scan continues.
+  let labelEnd = -1;
+  for (let i = 3; i < line.length; i++) {
+    if (
+      line.charCodeAt(i) !== 0x2a /* '*' */ ||
+      i + 3 >= line.length ||
+      line.charCodeAt(i + 1) !== 0x2a /* '*' */ ||
+      !isRegexWhitespace(line.charCodeAt(i + 2)) ||
+      line.charCodeAt(i + 3) !== 0x5b /* '[' */
+    ) {
+      continue;
+    }
+    labelEnd = i;
+    break;
+  }
+  if (labelEnd === -1) return null;
+
+  const label = line.slice(2, labelEnd);
+  // Clock content starts after the closing '**', the \s, and the '['.
+  const clockStart = labelEnd + 4;
+
+  // Find the closing ']' of the clock: the first ']' at index >=
+  // clockStart + 1 (clock is at least 1 char) that is immediately
+  // followed by ':' and \s — matching the non-greedy regex.
+  let clockEnd = -1;
+  for (let i = clockStart + 1; i < line.length; i++) {
+    if (
+      line.charCodeAt(i) !== 0x5d /* ']' */ ||
+      i + 2 >= line.length ||
+      line.charCodeAt(i + 1) !== 0x3a /* ':' */ ||
+      !isRegexWhitespace(line.charCodeAt(i + 2))
+    ) {
+      continue;
+    }
+    clockEnd = i;
+    break;
+  }
+  if (clockEnd === -1) return null;
+
+  return {
+    label,
+    clock: line.slice(clockStart, clockEnd),
+    text: line.slice(clockEnd + 3),
+  };
+}
+
 export function isValidTranscriptDate(date: string): boolean {
   if (!DATE_PATTERN.test(date)) return false;
   const parsed = new Date(`${date}T00:00:00Z`);
@@ -41,7 +162,14 @@ export function isValidTranscriptDate(date: string): boolean {
 }
 
 export function hashTranscriptBody(body: string): string {
-  return createHash("sha256").update(body, "utf-8").digest("hex");
+  // The version prefix makes the hash an idempotency key for the body AS
+  // SERIALIZED under the current format: when the escape encoding changes
+  // (version bump) every existing file's stored hash no longer matches and
+  // the pipeline rewrites it with the new marker — no separate migration
+  // pass needed (issue #1849).
+  return createHash("sha256")
+    .update(`v${TRANSCRIPT_FORMAT_VERSION}\n${body}`, "utf-8")
+    .digest("hex");
 }
 
 function formatClockTime(iso: string | undefined, timezone: string): string {
@@ -69,6 +197,135 @@ function conversationDurationMinutes(conversation: WearableConversation): number
   return (end - start) / 60_000;
 }
 
+/**
+ * Escape segment text for the line-based markdown format so that embedded
+ * newlines, carriage returns, and backslashes survive the serialize →
+ * reconstruct round-trip losslessly.  Reversed by `unescapeSegmentText`
+ * (this module — the single decode primitive shared with the fusion
+ * reconstruct path and every view/search/index surface).
+ *
+ * Without this, a segment whose text contains a newline is split across
+ * multiple physical lines; the reconstruct path treats each line
+ * independently and the continuation is silently dropped (or worse, a
+ * continuation line that looks like a heading/clock is mis-parsed).
+ */
+export function escapeSegmentText(text: string): string {
+  return text
+    .replace(/\\/g, "\\\\")
+    .replace(/\n/g, "\\n")
+    .replace(/\r/g, "\\r");
+}
+
+/**
+ * Reverse `escapeSegmentText`. Unknown escape sequences (a lone
+ * backslash followed by a character the escaper never emits) are passed
+ * through literally so legacy transcripts that never went through the
+ * escaper still round-trip their original text. This is the SINGLE
+ * decode primitive: the fusion reconstruct path and every user-facing
+ * view/search/index surface call it so escaped storage never leaks to
+ * display (#1849).
+ */
+export function unescapeSegmentText(text: string): string {
+  return text.replace(/\\(.)/g, (_match, ch: string) => {
+    if (ch === "n") return "\n";
+    if (ch === "r") return "\r";
+    if (ch === "\\") return "\\";
+    return "\\" + ch;
+  });
+}
+
+/**
+ * Escape a speaker label for the line-based markdown format so that
+ * markdown-delimiter characters in an arbitrary user/provider label
+ * (`**`, `[`, `]`), the escape character (`\`), and embedded newlines/
+ * carriage returns cannot break `parseTranscriptSegmentLine` parsing.
+ * Without this, a label containing `**` (or `** [clock]:`) can make the
+ * non-greedy delimiter match land on the wrong `**` and mis-parse the
+ * clock/text — or fail to parse the line at all. Reversed by
+ * `unescapeSpeakerLabel` (this module). Legacy transcripts whose labels
+ * were never escaped still parse: `unescapeSpeakerLabel` is a no-op on
+ * any label without a backslash escape sequence (#1849).
+ */
+export function escapeSpeakerLabel(label: string): string {
+  return label
+    .replace(/\\/g, "\\\\")
+    .replace(/\*/g, "\\*")
+    .replace(/\[/g, "\\[")
+    .replace(/\]/g, "\\]")
+    .replace(/\n/g, "\\n")
+    .replace(/\r/g, "\\r");
+}
+
+/**
+ * Reverse `escapeSpeakerLabel`. Unknown escape sequences (a backslash
+ * followed by a character the escaper never emits) are passed through
+ * literally so legacy transcripts with raw labels still round-trip
+ * their original text, mirroring `unescapeSegmentText` for segment text.
+ */
+export function unescapeSpeakerLabel(label: string): string {
+  return label.replace(/\\(.)/g, (_match, ch: string) => {
+    if (ch === "\\") return "\\";
+    if (ch === "*") return "*";
+    if (ch === "[") return "[";
+    if (ch === "]") return "]";
+    if (ch === "n") return "\n";
+    if (ch === "r") return "\r";
+    return "\\" + ch;
+  });
+}
+
+/**
+ * Whether a parsed day-transcript's body was written by the escape-aware
+ * serializer (meta carries `formatVersion` >= `TRANSCRIPT_FORMAT_VERSION`).
+ * Legacy bodies (no marker, or an older version) must NOT be decoded: their
+ * literal two-character `\n`, `\r`, and lone backslashes are original
+ * content, not escape sequences (issue #1849).
+ */
+export function bodyIsEscaped(
+  meta: { formatVersion?: number } | null | undefined,
+): boolean {
+  return (
+    meta !== null &&
+    meta !== undefined &&
+    typeof meta.formatVersion === "number" &&
+    meta.formatVersion >= TRANSCRIPT_FORMAT_VERSION
+  );
+}
+
+/**
+ * Decode the escaped segment text AND speaker label of a stored
+ * transcript body into the ORIGINAL forms for user-facing
+ * view/search/index surfaces. Only segment lines are touched: the text
+ * is decoded via `unescapeSegmentText` and the label via
+ * `unescapeSpeakerLabel`; headings, locations, and the H1 header are
+ * NOT escaped on write and pass through unchanged, so a title or
+ * location containing a literal backslash is never altered. The fusion
+ * reconstruct path does NOT use this — it decodes each segment once
+ * during parse — so callers feeding bodies back into reconstruct must
+ * pass the RAW stored body, not a decoded one, to avoid double-decoding.
+ *
+ * FORMAT-AWARE (issue #1849): when `escaped` is falsy (the default) the
+ * body is returned byte-for-byte unchanged. Only bodies written by the
+ * escape-aware serializer (`escaped = true`, derived from
+ * `bodyIsEscaped(meta)`) are decoded, so a legacy transcript's literal
+ * two-character `\n`/`\r` or lone backslash is never altered. Callers
+ * that have the parsed meta should pass `bodyIsEscaped(meta)`.
+ */
+export function decodeTranscriptBody(body: string, escaped = false): string {
+  if (!escaped) return body;
+  const lines = body.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const match = parseTranscriptSegmentLine(lines[i]);
+    if (match === null) continue;
+    const { label, clock, text: rawText } = match;
+    const decodedText = unescapeSegmentText(rawText);
+    const decodedLabel = unescapeSpeakerLabel(label);
+    if (decodedText === rawText && decodedLabel === label) continue;
+    lines[i] = `**${decodedLabel}** [${clock}]: ${decodedText}`;
+  }
+  return lines.join("\n");
+}
+
 /** Compose the markdown body (no frontmatter) for one source/day. */
 export function composeDayTranscriptBody(
   sourceId: string,
@@ -101,7 +358,9 @@ export function composeDayTranscriptBody(
     for (const segment of conversation.segments) {
       const { label } = resolveSpeaker(sourceId, segment, registry);
       const at = formatClockTime(segment.startIso, timezone);
-      lines.push(`**${label}** [${at}]: ${segment.text}`);
+      lines.push(
+        `**${escapeSpeakerLabel(label)}** [${at}]: ${escapeSegmentText(segment.text)}`,
+      );
     }
     lines.push("");
   }
@@ -132,6 +391,7 @@ export function composeDayTranscriptMeta(
     durationMinutes,
     contentHash: hashTranscriptBody(body),
     syncedAt,
+    formatVersion: TRANSCRIPT_FORMAT_VERSION,
   };
 }
 
@@ -142,6 +402,9 @@ export function serializeDayTranscript(
 ): string {
   const lines: string[] = ["---"];
   lines.push(`kind: ${meta.kind}`);
+  if (typeof meta.formatVersion === "number") {
+    lines.push(`formatVersion: ${meta.formatVersion}`);
+  }
   lines.push(`source: ${JSON.stringify(meta.source)}`);
   lines.push(`date: ${JSON.stringify(meta.date)}`);
   lines.push(`timezone: ${JSON.stringify(meta.timezone)}`);
@@ -204,9 +467,15 @@ export function parseDayTranscript(raw: string): WearableDayTranscript | null {
 
   const meta: WearableDayTranscriptMeta = {
     kind: "wearable-transcript",
+    ...(scalars.has("formatVersion")
+      ? { formatVersion: parseNonNegativeInt(scalars.get("formatVersion")) }
+      : {}),
     source,
     date,
-    timezone: scalars.get("timezone") ?? "UTC",
+    // Preserve a missing timezone field as "" rather than coercing to a
+    // default: the fusion identity guard must see "no resolvable tz id"
+    // and skip, never silently match a known zone.
+    timezone: scalars.get("timezone") ?? "",
     conversationCount: parseNonNegativeInt(scalars.get("conversationCount")),
     segmentCount: parseNonNegativeInt(scalars.get("segmentCount")),
     speakers,