instar 1.3.1621 → 1.3.1623

package/dist/core/AppConversationService.d.ts

@@ -68,9 +68,18 @@ export interface AppConversationServiceDeps {
      * `TranscriptionUnavailableError` when no provider is configured. Absent ⇒ every voice note
      * without a phone transcript reads "transcription unavailable".
      */
-    transcribeVoice?: (filePath: string, mediaType: string) => Promise<string>;
+    transcribeVoice?: (filePath: string, mediaType: string, timeoutMs?: number) => Promise<string>;
     /** How long one dispatch waits for a server transcript (default 60 s, the spec's fixed deadline). */
     transcribeDeadlineMs?: number;
+    /** At most this many provider calls run at once in this process (default 3). */
+    transcribeConcurrency?: number;
+    /**
+     * The ceiling on one transcription, queueing included (default 10 minutes): a call still queued
+     * at the ceiling ends "timed out waiting"; a running call gets only what is left of it.
+     */
+    transcribeCeilingMs?: number;
+    /** The provider name stored on a transcript event (e.g. `groq`); absent ⇒ `server`. */
+    voiceProviderName?: () => string | undefined;
 }
 /** §4.5.1: server transcription has a 60-second limit. */
 export declare const VOICE_TRANSCRIBE_DEADLINE_MS = 60000;
@@ -79,7 +88,47 @@ export declare const VOICE_TRANSCRIBE_DEADLINE_MS = 60000;
  * server transcript on one line, or an honest note when there is none.
  */
 export declare function voiceLineWithTranscript(filePath: string, transcript: string): string;
+/** A transcript on one line for a session: control characters removed; a long one says it was cut. */
+export declare function transcriptOneLine(transcript: string): string;
 export declare function voiceLineUnavailable(filePath: string, reason: string): string;
+/**
+ * The line for a voice note whose server transcript was not ready by the deadline (§4.5.1). An app
+ * conversation gets the transcript later as one follow-up line; a Telegram or Slack conversation
+ * continued from the app keeps it with the message only (no follow-up path reaches those sessions).
+ */
+export declare function voiceLinePending(filePath: string, followUp: boolean): string;
+/** The follow-up line a late server transcript produces (§4.5.1), once per attachment. */
+export declare function lateTranscriptLine(filePath: string, outcome: VoiceOutcome, caption: string): string;
+/** What one server transcription produced. A failure carries a plain reason, never silence. */
+export type VoiceOutcome = {
+    ok: true;
+    text: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * How long the provider itself may take (§4.5.1): past the 60 s dispatch deadline the transcript
+ * is still wanted, as a late transcript. Bounded: one call per attachment, aborted at this limit.
+ */
+export declare const VOICE_TRANSCRIBE_PROVIDER_TIMEOUT_MS: number;
+/**
+ * A server transcript gets the phone transcript's treatment before it is stored or delivered
+ * (§4.3, §4.5.1): `scanInbound` first (so a dictated pending pairing code declines that pairing),
+ * then exact-token removal. Text past the store's limit is cut with a note, never refused.
+ */
+export declare function scrubServerTranscript(text: string, scan?: ((t: string) => void) | null): {
+    text: string;
+    kinds: string[];
+};
+/** At most this many server transcriptions call the provider at once, per process (§4.5.1). */
+export declare const VOICE_TRANSCRIBE_CONCURRENCY = 3;
+/**
+ * A stored transcript as it may be handed to a session or a device: the exact-token removal runs
+ * again on READ, so a transcript a peer stored without scrubbing (an older or misbehaving build)
+ * can never carry a pairing invite or a desktop code anywhere (second-pass review, finding 2).
+ */
+export declare function transcriptForDelivery(text: string): string;
 export declare class AppConversationService {
     readonly deps: AppConversationServiceDeps;
     readonly store: AppConversationStore;
@@ -100,6 +149,12 @@ export declare class AppConversationService {
     /** Conditions whose notice is raised: the latch that makes it one notice per episode. */
     private readonly raisedNotices;
     private readonly now;
+    /** Server transcriptions running in this process, by attachment (one per attachment, §4.5.1). */
+    private readonly transcriptions;
+    /** Provider slots in use, and the calls queued for one (a bounded, per-process limit). */
+    private transcribeActive;
+    private readonly transcribeWaiters;
+    private inboundScan;
     /** Increment 3 fills this in (push without Telegram); increment 1 records the hook only. */
     pushHook: ((conversationKey: string, messageId: string) => void) | null;
     constructor(deps: AppConversationServiceDeps);
@@ -134,11 +189,41 @@ export declare class AppConversationService {
      * `[file now available: <path>]` line when the blob lands.
      */
     sessionLinesFor(conversationKey: string, messageId: string, attachments: ReadonlyArray<AppAttachment>, caption: string, waitMs?: number): Promise<string[]>;
+    /** Wired where the pairing service is: declines a pending pairing whose code a transcript dictates. */
+    setInboundScan(fn: ((text: string) => void) | null): void;
+    /** The session line for a voice note the phone did not transcribe (§4.5.1). Never rejects. */
+    private voiceLine;
     /**
-     * Transcribe one voice note with the shared Telegram transcriber, bounded by the 60 s deadline.
-     * Never rejects: no provider, a failure or the deadline all become an honest line with the path.
+     * The server transcript of one voice attachment, waiting at most the 60 s dispatch deadline.
+     * `pending` means it is still running: when it settles, a late transcript event is stored and
+     * one follow-up line is delivered (app conversations). Never rejects.
      */
-    private voiceLine;
+    private voiceResult;
+    /**
+     * One server transcription per attachment on this machine, ever (§4.5.1, bounded): a stored
+     * transcript (made here or replicated from a peer) is reused; one already running is joined; a
+     * recorded failure is reported with its reason and never retried; a run a restart interrupted
+     * reads as a failure. Only an attachment with no row starts the provider.
+     */
+    private transcription;
+    /**
+     * One provider call under the per-process limit (§4.5.1, second-pass finding 1). Queue time counts
+     * toward the ceiling: still queued at the ceiling ⇒ `TranscriptionQueueTimeout`; a running call
+     * gets the remaining time (passed to the provider as its own timeout) and is abandoned at the
+     * ceiling. The slot is held until the provider call itself settles, so at most N ever run.
+     */
+    private limitedTranscribe;
+    /** A provider slot, waiting at most `waitMs`; false when the wait ran out. */
+    private acquireTranscribeSlot;
+    /** Hand the slot to the next queued call, or free it. */
+    private releaseTranscribeSlot;
+    /** Scrub, then store the transcript as its own unsigned event (§4.5.1). The session gets it either way. */
+    private storeTranscript;
+    /** A late transcript (or its failure): one follow-up line, or a note for the next delivery. */
+    private deliverLate;
+    /** The transcript reached the session already: no later line may repeat it (second-pass finding 3). */
+    private markTranscriptDelivered;
+    private transcriptDelivered;
     /** A blob landed: each waiting row gets its session copy and one follow-up line. */
     resolvePending(sha: string): Promise<void>;
     /**

package/dist/core/AppConversationService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AppConversationService.d.ts","sourceRoot":"","sources":["../../src/core/AppConversationService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,KAAK,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAEhF,OAAO,EAAmB,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACnF,OAAO,EAAuC,KAAK,gBAAgB,EAAE,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,KAAK,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACrK,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,aAAa,EAA2B,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAmE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEzH,OAAO,EAAE,kBAAkB,EAA+C,MAAM,yBAAyB,CAAC;AAG1G,eAAO,MAAM,uBAAuB,QAAa,CAAC;AAIlD,2EAA2E;AAC3E,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,MAAM,CAAC;IACxB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,KAAK,CAAC,EAAE,oBAAoB,CAAC;IAC7B,UAAU,EAAE,MAAM,OAAO,CAAC;IAC1B,SAAS,EAAE,MAAM,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,kBAAkB,GAAG,IAAI,CAAC;IAC1C,2EAA2E;IAC3E,WAAW,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/C,YAAY,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7C,6FAA6F;IAC7F,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1C,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IAC9B,SAAS,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,SAAS,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACzC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAC9C,oEAAoE;IACpE,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACvF,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3E,qGAAqG;IACrG,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,0DAA0D;AAC1D,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAGpF;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE7E;AAKD,qBAAa,sBAAsB;IAuBrB,QAAQ,CAAC,IAAI,EAAE,0BAA0B;IAtBrD,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,OAAO,CAAC,SAAS,CAAwB;IACzC,OAAO,CAAC,KAAK,CAA+C;IAC5D,OAAO,CAAC,UAAU,CAA+C;IACjE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,kGAAkG;IAClG,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IACxC;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAA2D;IAC3E,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAqB;IAEvD,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;IACnD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,4FAA4F;IAC5F,QAAQ,EAAE,CAAC,CAAC,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAQ;IAE/E,YAAqB,IAAI,EAAE,0BAA0B,EAwBpD;IAED,KAAK,CAAC,UAAU,SAAQ,GAAG,IAAI,CAW9B;IAED,IAAI,IAAI,IAAI,CAMX;IAED,8EAA8E;IACxE,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAOhC;IAED,0FAA0F;IAC1F,OAAO,CAAC,cAAc;IAOtB;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAmC1B;;;OAGG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAepI;IAED,OAAO,CAAC,MAAM;IAId,SAAS,IAAI,MAAM,CAAkC;IAIrD,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,CAAwB;IAEhG;;;;;OAKG;IACG,eAAe,CAAC,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAqB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAqB5K;IAED;;;OAGG;YACW,SAAS;IAsBvB,oFAAoF;IAC9E,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiB/C;IAED;;;OAGG;IACH,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,EAAE,MAAM,IAAI,CAAA;KAAE,CAO5E;IAED,0FAA0F;IAC1F,OAAO,CAAC,aAAa;IAIrB;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE,gBAAgB,GAAG,aAAa,CAS9C;IAED;;;;OAIG;IACH,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAKjG;IAED,kFAAkF;IAClF,gBAAgB,IAAI,IAAI,CAMvB;IAED;;;OAGG;IACH,gBAAgB,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,MAAM,CAgB/D;IAED,wHAAwH;IACxH,iBAAiB,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAUpC;IAED,6FAA6F;IAC7F,SAAS,IAAI,IAAI,CAehB;IAED,qFAAqF;IACrF,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEhC;IAED,OAAO,IAAI,OAAO,CAAmC;IAErD,4DAA4D;IAC5D,gBAAgB,CAAC,GAAG,EAAE,MAAM,kEAI3B;IAED,wEAAwE;IACxE,UAAU,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGjD;IAED,aAAa,CAAC,eAAe,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAOnF;IAED,KAAK,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAItC;IAED,kFAAkF;IAClF,oBAAoB,CAAC,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAErE;IAED,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAMzI;IAED;;;;;;OAMG;IACH,eAAe,IAAI,IAAI,CAiCtB;IAED,kGAAkG;IAClG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAe1I;IAED,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAG7F;IAED,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,CAK9E;CACF"}
+{"version":3,"file":"AppConversationService.d.ts","sourceRoot":"","sources":["../../src/core/AppConversationService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAsC,KAAK,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAEpH,OAAO,EAAmB,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACnF,OAAO,EAAuC,KAAK,gBAAgB,EAAE,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,KAAK,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACrK,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,aAAa,EAA2B,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAmE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEzH,OAAO,EAAE,kBAAkB,EAA+C,MAAM,yBAAyB,CAAC;AAG1G,eAAO,MAAM,uBAAuB,QAAa,CAAC;AAIlD,2EAA2E;AAC3E,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,MAAM,CAAC;IACxB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,KAAK,CAAC,EAAE,oBAAoB,CAAC;IAC7B,UAAU,EAAE,MAAM,OAAO,CAAC;IAC1B,SAAS,EAAE,MAAM,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,kBAAkB,GAAG,IAAI,CAAC;IAC1C,2EAA2E;IAC3E,WAAW,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/C,YAAY,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7C,6FAA6F;IAC7F,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1C,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IAC9B,SAAS,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,SAAS,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACzC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAC9C,oEAAoE;IACpE,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACvF,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/F,qGAAqG;IACrG,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,gFAAgF;IAChF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uFAAuF;IACvF,iBAAiB,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;CAC9C;AAED,0DAA0D;AAC1D,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAEpF;AAED,sGAAsG;AACtG,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAM5D;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,MAAM,CAI5E;AAED,0FAA0F;AAC1F,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAKnG;AAED,+FAA+F;AAC/F,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtF;;;GAGG;AACH,eAAO,MAAM,oCAAoC,QAAc,CAAC;AAIhE;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAM1H;AAID,+FAA+F;AAC/F,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAO9C;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1D;AAKD,qBAAa,sBAAsB;IA6BrB,QAAQ,CAAC,IAAI,EAAE,0BAA0B;IA5BrD,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,OAAO,CAAC,SAAS,CAAwB;IACzC,OAAO,CAAC,KAAK,CAA+C;IAC5D,OAAO,CAAC,UAAU,CAA+C;IACjE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,kGAAkG;IAClG,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IACxC;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAA2D;IAC3E,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAqB;IAEvD,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;IACnD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,iGAAiG;IACjG,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAyC;IACxE,0FAA0F;IAC1F,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAyB;IAC3D,OAAO,CAAC,WAAW,CAAyC;IAC5D,4FAA4F;IAC5F,QAAQ,EAAE,CAAC,CAAC,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAQ;IAE/E,YAAqB,IAAI,EAAE,0BAA0B,EAwBpD;IAED,KAAK,CAAC,UAAU,SAAQ,GAAG,IAAI,CAW9B;IAED,IAAI,IAAI,IAAI,CAMX;IAED,8EAA8E;IACxE,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAOhC;IAED,0FAA0F;IAC1F,OAAO,CAAC,cAAc;IAOtB;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAmC1B;;;OAGG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAepI;IAED,OAAO,CAAC,MAAM;IAId,SAAS,IAAI,MAAM,CAAkC;IAIrD,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,CAAwB;IAEhG;;;;;OAKG;IACG,eAAe,CAAC,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAqB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAqB5K;IAED,uGAAuG;IACvG,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAA2B;IAEpF,8FAA8F;YAChF,SAAS;IAMvB;;;;OAIG;YACW,WAAW;IAsBzB;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IA2CrB;;;;;OAKG;YACW,iBAAiB;IAY/B,8EAA8E;IAC9E,OAAO,CAAC,qBAAqB;IAe7B,yDAAyD;IACzD,OAAO,CAAC,qBAAqB;IAM7B,2GAA2G;IAC3G,OAAO,CAAC,eAAe;IAcvB,+FAA+F;IAC/F,OAAO,CAAC,WAAW;IAmBnB,uGAAuG;IACvG,OAAO,CAAC,uBAAuB;IAO/B,OAAO,CAAC,mBAAmB;IAK3B,oFAAoF;IAC9E,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgC/C;IAED;;;OAGG;IACH,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,EAAE,MAAM,IAAI,CAAA;KAAE,CAsB5E;IAED,0FAA0F;IAC1F,OAAO,CAAC,aAAa;IAWrB;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE,gBAAgB,GAAG,aAAa,CAS9C;IAED;;;;OAIG;IACH,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAKjG;IAED,kFAAkF;IAClF,gBAAgB,IAAI,IAAI,CAMvB;IAED;;;OAGG;IACH,gBAAgB,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,MAAM,CAgB/D;IAED,wHAAwH;IACxH,iBAAiB,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAUpC;IAED,6FAA6F;IAC7F,SAAS,IAAI,IAAI,CAehB;IAED,qFAAqF;IACrF,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEhC;IAED,OAAO,IAAI,OAAO,CAAmC;IAErD,4DAA4D;IAC5D,gBAAgB,CAAC,GAAG,EAAE,MAAM,kEAI3B;IAED,wEAAwE;IACxE,UAAU,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGjD;IAED,aAAa,CAAC,eAAe,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAOnF;IAED,KAAK,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAItC;IAED,kFAAkF;IAClF,oBAAoB,CAAC,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAErE;IAED,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAMzI;IAED;;;;;;OAMG;IACH,eAAe,IAAI,IAAI,CAiCtB;IAED,kGAAkG;IAClG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAe1I;IAED,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAG7F;IAED,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,CAK9E;CACF"}

package/dist/core/AppConversationService.js

@@ -1,6 +1,6 @@
 import { SessionChannelRegistry } from '../messaging/shared/SessionChannelRegistry.js';
-import { AppConversationStore } from './AppConversationStore.js';
-import { derivedEventId, isAppConversationKey } from './appConversationText.js';
+import { AppConversationStore, MAX_STORED_TEXT, transcriptEventId } from './AppConversationStore.js';
+import { derivedEventId, isAppConversationKey, removeAuthorityTokens } from './appConversationText.js';
 import { appInjectionTag } from './appInboundDispatch.js';
 import { ledgerViewKey, verifyRecordedOrigin } from './AppRecordSignatures.js';
 import { AppMediaStore, DEFAULT_MAX_STORE_BYTES } from './AppMediaStore.js';
@@ -23,12 +23,78 @@ export const VOICE_TRANSCRIBE_DEADLINE_MS = 60_000;
  * server transcript on one line, or an honest note when there is none.
  */
 export function voiceLineWithTranscript(filePath, transcript) {
+    return `[voice:${filePath}] ${transcriptOneLine(transcript)}`;
+}
+/** A transcript on one line for a session: control characters removed; a long one says it was cut. */
+export function transcriptOneLine(transcript) {
     const oneLine = transcript.replace(/[\x00-\x1f\x7f]+/g, ' ').replace(/\s+/g, ' ').trim();
-    return `[voice:${filePath}] ${oneLine ? Array.from(oneLine).slice(0, MAX_TRANSCRIPT_CHARS).join('') : '(no speech recognized)'}`;
+    if (!oneLine)
+        return '(no speech recognized)';
+    const chars = Array.from(oneLine);
+    if (chars.length <= MAX_TRANSCRIPT_CHARS)
+        return oneLine;
+    return `${chars.slice(0, MAX_TRANSCRIPT_CHARS).join('')} (transcript cut here; the full transcript is saved with the message)`;
 }
 export function voiceLineUnavailable(filePath, reason) {
     return `[voice:${filePath}] (transcription unavailable: ${reason}; the audio file is at that path)`;
 }
+/**
+ * The line for a voice note whose server transcript was not ready by the deadline (§4.5.1). An app
+ * conversation gets the transcript later as one follow-up line; a Telegram or Slack conversation
+ * continued from the app keeps it with the message only (no follow-up path reaches those sessions).
+ */
+export function voiceLinePending(filePath, followUp) {
+    return followUp
+        ? `[voice:${filePath}] (transcript not ready after 60 s; it follows in a separate line, and the audio file is at that path)`
+        : `[voice:${filePath}] (transcript not ready after 60 s; it is saved with the message if it finishes, and the audio file is at that path)`;
+}
+/** The follow-up line a late server transcript produces (§4.5.1), once per attachment. */
+export function lateTranscriptLine(filePath, outcome, caption) {
+    const forMsg = caption ? ` (for the message "${caption}")` : '';
+    return outcome.ok
+        ? `[voice transcript ready: ${filePath}]${forMsg} ${transcriptOneLine(transcriptForDelivery(outcome.text))}`
+        : `[voice transcript unavailable: ${filePath}]${forMsg} (transcription unavailable: ${outcome.reason}; the audio file is at that path)`;
+}
+/**
+ * How long the provider itself may take (§4.5.1): past the 60 s dispatch deadline the transcript
+ * is still wanted, as a late transcript. Bounded: one call per attachment, aborted at this limit.
+ */
+export const VOICE_TRANSCRIBE_PROVIDER_TIMEOUT_MS = 10 * 60_000;
+const CUT_NOTE = ' … (transcript cut here; the audio file has the rest)';
+/**
+ * A server transcript gets the phone transcript's treatment before it is stored or delivered
+ * (§4.3, §4.5.1): `scanInbound` first (so a dictated pending pairing code declines that pairing),
+ * then exact-token removal. Text past the store's limit is cut with a note, never refused.
+ */
+export function scrubServerTranscript(text, scan) {
+    try {
+        scan?.(text);
+    }
+    catch { /* @silent-fallback-ok — the scan only declines leaked pairings; token removal still runs */ }
+    const removed = removeAuthorityTokens(text);
+    let out = removed.text;
+    if (out.length > MAX_STORED_TEXT)
+        out = out.slice(0, MAX_STORED_TEXT - CUT_NOTE.length).replace(/[\uD800-\uDBFF]$/, '') + CUT_NOTE;
+    return { text: out, kinds: removed.kinds };
+}
+/** At most this many server transcriptions call the provider at once, per process (§4.5.1). */
+export const VOICE_TRANSCRIBE_CONCURRENCY = 3;
+/** A transcription still queued for a provider slot when its ceiling passed. */
+class TranscriptionQueueTimeout extends Error {
+    constructor() { super('timed out waiting for a transcription slot'); }
+}
+/** A provider call still running when the ceiling (queue time included) passed. */
+class TranscriptionCeilingTimeout extends Error {
+    constructor() { super('the transcription provider ran past the ceiling'); }
+}
+/**
+ * A stored transcript as it may be handed to a session or a device: the exact-token removal runs
+ * again on READ, so a transcript a peer stored without scrubbing (an older or misbehaving build)
+ * can never carry a pairing invite or a desktop code anywhere (second-pass review, finding 2).
+ */
+export function transcriptForDelivery(text) {
+    return removeAuthorityTokens(text).text;
+}
 const MEDIA_SWEEP_MS = 60 * 60_000;
 const MEDIA_REFUSAL_SWEEP_GAP_MS = 5 * 60_000;
 export class AppConversationService {
@@ -52,6 +118,12 @@ export class AppConversationService {
     /** Conditions whose notice is raised: the latch that makes it one notice per episode. */
     raisedNotices = new Set();
     now;
+    /** Server transcriptions running in this process, by attachment (one per attachment, §4.5.1). */
+    transcriptions = new Map();
+    /** Provider slots in use, and the calls queued for one (a bounded, per-process limit). */
+    transcribeActive = 0;
+    transcribeWaiters = [];
+    inboundScan = null;
     /** Increment 3 fills this in (push without Telegram); increment 1 records the hook only. */
     pushHook = null;
     constructor(deps) {
@@ -227,7 +299,7 @@ export class AppConversationService {
                 return null;
             });
             if (copy) {
-                lines.push(a.kind === 'voice' && !a.transcript ? this.voiceLine(copy, a.mediaType) : sessionLine(a, copy));
+                lines.push(a.kind === 'voice' && !a.transcript ? this.voiceLine(conversationKey, messageId, a, copy, caption) : sessionLine(a, copy));
                 continue;
             }
             // Held here but the copy failed: not a copying problem (reported above).
@@ -247,36 +319,207 @@ export class AppConversationService {
         }
         return Promise.all(lines);
     }
+    /** Wired where the pairing service is: declines a pending pairing whose code a transcript dictates. */
+    setInboundScan(fn) { this.inboundScan = fn; }
+    /** The session line for a voice note the phone did not transcribe (§4.5.1). Never rejects. */
+    async voiceLine(conversationKey, messageId, a, copy, caption) {
+        const r = await this.voiceResult(conversationKey, messageId, a, copy, caption);
+        if (r === 'pending')
+            return voiceLinePending(copy, isAppConversationKey(conversationKey));
+        return r.ok ? voiceLineWithTranscript(copy, r.text) : voiceLineUnavailable(copy, r.reason);
+    }
     /**
-     * Transcribe one voice note with the shared Telegram transcriber, bounded by the 60 s deadline.
-     * Never rejects: no provider, a failure or the deadline all become an honest line with the path.
+     * The server transcript of one voice attachment, waiting at most the 60 s dispatch deadline.
+     * `pending` means it is still running: when it settles, a late transcript event is stored and
+     * one follow-up line is delivered (app conversations). Never rejects.
      */
-    async voiceLine(copy, mediaType) {
-        const transcribe = this.deps.transcribeVoice;
-        if (!transcribe)
-            return voiceLineUnavailable(copy, 'no voice transcription on this machine');
+    async voiceResult(conversationKey, messageId, a, copy, caption) {
+        const t = this.transcription(conversationKey, messageId, a, copy);
+        if (!('entry' in t))
+            return t.now;
+        const entry = t.entry;
         const deadlineMs = this.deps.transcribeDeadlineMs ?? VOICE_TRANSCRIBE_DEADLINE_MS;
         let timer = null;
         const deadline = new Promise((resolve) => { timer = setTimeout(() => resolve('deadline'), deadlineMs); });
         try {
-            const out = await Promise.race([transcribe(copy, mediaType), deadline]);
-            if (out === 'deadline') {
-                this.report('voice transcription', new Error(`no transcript within ${Math.round(deadlineMs / 1000)} s`));
-                return voiceLineUnavailable(copy, 'transcription took too long');
+            const out = await Promise.race([entry.done, deadline]);
+            if (out !== 'deadline')
+                return out;
+            entry.late = true;
+            this.report('voice transcription', new Error(`no transcript within ${Math.round(deadlineMs / 1000)} s; it is kept as a late transcript when it finishes`));
+            if (!entry.lateArmed) {
+                entry.lateArmed = true;
+                void entry.done.then((o) => this.deliverLate(conversationKey, a, copy, captionSnippet(caption), o));
             }
-            return voiceLineWithTranscript(copy, out);
+            return 'pending';
         }
-        catch (err) {
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
+    /**
+     * One server transcription per attachment on this machine, ever (§4.5.1, bounded): a stored
+     * transcript (made here or replicated from a peer) is reused; one already running is joined; a
+     * recorded failure is reported with its reason and never retried; a run a restart interrupted
+     * reads as a failure. Only an attachment with no row starts the provider.
+     */
+    transcription(conversationKey, messageId, a, copy) {
+        const stored = this.store.transcriptFor(a.attachmentId);
+        if (stored)
+            return { now: { ok: true, text: transcriptForDelivery(stored.text) } };
+        const live = this.transcriptions.get(a.attachmentId);
+        if (live)
+            return { entry: live };
+        const transcribe = this.deps.transcribeVoice;
+        if (!transcribe)
+            return { now: { ok: false, reason: 'no voice transcription on this machine' } };
+        const db = this.media.indexDb;
+        const prior = db.prepare('SELECT state, reason FROM voice_transcriptions WHERE attachmentId = ?').get(a.attachmentId);
+        if (prior) {
+            if (prior.state === 'running') {
+                const reason = 'the server restarted before the transcript finished';
+                db.prepare(`UPDATE voice_transcriptions SET state = 'failed', reason = ?, finishedAt = ? WHERE attachmentId = ?`).run(reason, this.now(), a.attachmentId);
+                return { now: { ok: false, reason } };
+            }
+            return { now: { ok: false, reason: prior.reason ?? 'the transcription service failed' } };
+        }
+        const claimed = db.prepare(`INSERT OR IGNORE INTO voice_transcriptions (attachmentId, state, reason, startedAt, finishedAt) VALUES (?, 'running', NULL, ?, NULL)`).run(a.attachmentId, this.now());
+        if (claimed.changes !== 1)
+            return { now: { ok: false, reason: 'the transcription service failed' } };
+        const entry = { late: false, lateArmed: false, done: Promise.resolve({ ok: false, reason: 'not started' }) };
+        entry.done = this.limitedTranscribe(transcribe, copy, a.mediaType)
+            .then((raw) => this.storeTranscript(conversationKey, messageId, a, raw, entry.late), (err) => {
             if (err instanceof TranscriptionUnavailableError)
-                return voiceLineUnavailable(copy, 'no transcription provider is configured');
+                return { ok: false, reason: 'no transcription provider is configured' };
             this.report('voice transcription', err);
-            return voiceLineUnavailable(copy, 'the transcription service failed');
+            if (err instanceof TranscriptionQueueTimeout)
+                return { ok: false, reason: 'timed out waiting' };
+            if (err instanceof TranscriptionCeilingTimeout)
+                return { ok: false, reason: 'the transcription service timed out' };
+            return { ok: false, reason: 'the transcription service failed' };
+        })
+            .then((o) => {
+            try {
+                db.prepare('UPDATE voice_transcriptions SET state = ?, reason = ?, finishedAt = ? WHERE attachmentId = ?')
+                    .run(o.ok ? 'done' : 'failed', o.ok ? null : o.reason, this.now(), a.attachmentId);
+            }
+            catch (err) {
+                this.report('voice transcription record', err);
+            } // @silent-fallback-ok — reported; a restart reads the row as interrupted, never retries
+            this.transcriptions.delete(a.attachmentId);
+            return o;
+        });
+        this.transcriptions.set(a.attachmentId, entry);
+        return { entry };
+    }
+    /**
+     * One provider call under the per-process limit (§4.5.1, second-pass finding 1). Queue time counts
+     * toward the ceiling: still queued at the ceiling ⇒ `TranscriptionQueueTimeout`; a running call
+     * gets the remaining time (passed to the provider as its own timeout) and is abandoned at the
+     * ceiling. The slot is held until the provider call itself settles, so at most N ever run.
+     */
+    async limitedTranscribe(transcribe, copy, mediaType) {
+        const ceilingMs = this.deps.transcribeCeilingMs ?? VOICE_TRANSCRIBE_PROVIDER_TIMEOUT_MS;
+        const startedAt = Date.now();
+        if (!(await this.acquireTranscribeSlot(ceilingMs)))
+            throw new TranscriptionQueueTimeout();
+        const remaining = Math.max(1, ceilingMs - (Date.now() - startedAt));
+        const run = Promise.resolve().then(() => transcribe(copy, mediaType, remaining));
+        void run.then(() => this.releaseTranscribeSlot(), () => this.releaseTranscribeSlot());
+        let timer = null;
+        const ceiling = new Promise((_r, reject) => { timer = setTimeout(() => reject(new TranscriptionCeilingTimeout()), remaining); });
+        try {
+            return await Promise.race([run, ceiling]);
         }
         finally {
             if (timer)
                 clearTimeout(timer);
         }
     }
+    /** A provider slot, waiting at most `waitMs`; false when the wait ran out. */
+    acquireTranscribeSlot(waitMs) {
+        const limit = Math.max(1, this.deps.transcribeConcurrency ?? VOICE_TRANSCRIBE_CONCURRENCY);
+        if (this.transcribeActive < limit) {
+            this.transcribeActive++;
+            return Promise.resolve(true);
+        }
+        return new Promise((resolve) => {
+            const waiter = () => { clearTimeout(timer); resolve(true); };
+            const timer = setTimeout(() => {
+                const i = this.transcribeWaiters.indexOf(waiter);
+                if (i >= 0)
+                    this.transcribeWaiters.splice(i, 1);
+                resolve(false);
+            }, waitMs);
+            timer.unref?.();
+            this.transcribeWaiters.push(waiter);
+        });
+    }
+    /** Hand the slot to the next queued call, or free it. */
+    releaseTranscribeSlot() {
+        const next = this.transcribeWaiters.shift();
+        if (next) {
+            next();
+            return;
+        } // the slot passes on; the active count is unchanged
+        this.transcribeActive = Math.max(0, this.transcribeActive - 1);
+    }
+    /** Scrub, then store the transcript as its own unsigned event (§4.5.1). The session gets it either way. */
+    storeTranscript(conversationKey, messageId, a, raw, late) {
+        const scrubbed = scrubServerTranscript(raw, this.inboundScan);
+        const machineId = this.deps.machineId();
+        const provider = (this.deps.voiceProviderName?.() ?? 'server').toLowerCase();
+        try {
+            this.store.append({
+                eventId: transcriptEventId(a.attachmentId, machineId), kind: 'transcript', conversationKey, messageId,
+                attachmentId: a.attachmentId, text: scrubbed.text, provider: /^[a-z0-9][a-z0-9._-]{0,31}$/.test(provider) ? provider : 'server',
+                at: new Date(this.now()).toISOString(), machineId, ...(late ? { late: true } : {}),
+            });
+        }
+        catch (err) {
+            this.report('voice transcript store', err);
+        } // @silent-fallback-ok — reported; the session still receives the transcript
+        return { ok: true, text: scrubbed.text };
+    }
+    /** A late transcript (or its failure): one follow-up line, or a note for the next delivery. */
+    deliverLate(conversationKey, a, copy, caption, outcome) {
+        try {
+            if (!isAppConversationKey(conversationKey))
+                return; // kept with the message; no follow-up path reaches platform sessions
+            const line = lateTranscriptLine(copy, outcome, caption);
+            const alias = this.deps.registry.appAliasFor(conversationKey);
+            const title = this.store.getConversation(conversationKey)?.title ?? 'Untitled';
+            const sent = alias !== null && this.ownsAlias(alias)
+                && this.followUp?.(alias, `${appInjectionTag(alias, title, this.ownerName(), 'none')} ${line}`) === true;
+            // A "now available" row still waiting for a delivery will carry the stored transcript itself
+            // (pendingContext), so a separate note would say it twice (second-pass finding 3).
+            const carried = !!this.media.indexDb.prepare(`SELECT 1 FROM pending_deliveries WHERE attachmentId = ? AND state = 'ready'`).get(a.attachmentId);
+            if (sent && outcome.ok)
+                this.markTranscriptDelivered(a.attachmentId);
+            if (!sent && !(outcome.ok && carried)) {
+                this.media.indexDb.prepare('INSERT OR IGNORE INTO transcript_notes (attachmentId, conversationKey, line, createdAt) VALUES (?, ?, ?, ?)')
+                    .run(a.attachmentId, conversationKey, line, this.now());
+            }
+        }
+        catch (err) {
+            this.report('late transcript', err);
+        }
+    }
+    /** The transcript reached the session already: no later line may repeat it (second-pass finding 3). */
+    markTranscriptDelivered(attachmentId) {
+        try {
+            this.media.indexDb.prepare(`INSERT INTO voice_transcriptions (attachmentId, state, reason, startedAt, finishedAt, delivered) VALUES (?, 'done', NULL, ?, ?, 1) ON CONFLICT(attachmentId) DO UPDATE SET delivered = 1`)
+                .run(attachmentId, this.now(), this.now());
+        }
+        catch (err) {
+            this.report('transcript delivered mark', err);
+        } // @silent-fallback-ok — reported; at worst the transcript is repeated once
+    }
+    transcriptDelivered(attachmentId) {
+        const r = this.media.indexDb.prepare('SELECT delivered FROM voice_transcriptions WHERE attachmentId = ?').get(attachmentId);
+        return r?.delivered === 1;
+    }
     /** A blob landed: each waiting row gets its session copy and one follow-up line. */
     async resolvePending(sha) {
         const rows = this.media.indexDb.prepare(`SELECT * FROM pending_deliveries WHERE sha256 = ? AND state = 'waiting'`).all(sha);
@@ -290,12 +533,28 @@ export class AppConversationService {
                 const claimed = this.media.indexDb.prepare(`UPDATE pending_deliveries SET state = 'ready', path = ? WHERE attachmentId = ? AND state = 'waiting'`).run(copy, r.attachmentId);
                 if (claimed.changes !== 1)
                     continue;
+                // A voice note the phone did not transcribe is transcribed now that it is here (§4.5.1):
+                // the transcript (or an honest reason) rides on the same line; past 60 s it follows later.
+                let tail = '';
+                let carriesTranscript = false;
+                if (a && a.kind === 'voice' && !a.transcript) {
+                    const v = await this.voiceResult(r.conversationKey, r.messageId, a, copy, r.caption);
+                    carriesTranscript = v !== 'pending' && v.ok;
+                    tail = v === 'pending' ? ' (transcript not ready after 60 s; it follows in a separate line)'
+                        : v.ok ? ` ${transcriptOneLine(transcriptForDelivery(v.text))}` : ` (transcription unavailable: ${v.reason})`;
+                }
                 const alias = this.deps.registry.appAliasFor(r.conversationKey);
                 const title = this.store.getConversation(r.conversationKey)?.title ?? 'Untitled';
                 const sent = alias !== null && this.ownsAlias(alias)
-                    && this.followUp?.(alias, `${appInjectionTag(alias, title, this.ownerName(), 'none')} ${availableLine(copy, r.caption)}`) === true;
-                if (sent)
+                    && this.followUp?.(alias, `${appInjectionTag(alias, title, this.ownerName(), 'none')} ${availableLine(copy, r.caption)}${tail}`) === true;
+                if (sent) {
                     this.media.indexDb.prepare('DELETE FROM pending_deliveries WHERE attachmentId = ?').run(r.attachmentId);
+                    // The transcript rode on this line: a note for it would repeat it (second-pass finding 3).
+                    if (carriesTranscript)
+                        this.markTranscriptDelivered(r.attachmentId);
+                    if (carriesTranscript)
+                        this.media.indexDb.prepare('DELETE FROM transcript_notes WHERE attachmentId = ?').run(r.attachmentId);
+                }
             }
             catch (err) {
                 this.report('pending resolve', err);
@@ -308,11 +567,31 @@ export class AppConversationService {
      */
     pendingContext(conversationKey) {
         const rows = this.media.indexDb.prepare(`SELECT * FROM pending_deliveries WHERE conversationKey = ? AND state IN ('ready','expired') ORDER BY createdAt`).all(conversationKey);
-        const lines = rows.map((r) => (r.state === 'ready' && r.path ? availableLine(r.path, r.caption) : `(a file from ${new Date(r.createdAt).toISOString().slice(0, 10)}, ${r.displayName}, could not be copied to this machine)`));
+        const carried = new Set();
+        const lines = rows.map((r) => {
+            if (!(r.state === 'ready' && r.path))
+                return `(a file from ${new Date(r.createdAt).toISOString().slice(0, 10)}, ${r.displayName}, could not be copied to this machine)`;
+            // A voice note's stored server transcript rides on its line (§4.5.1), scrubbed on read.
+            const stored = this.store.transcriptFor(r.attachmentId);
+            const t = stored && !this.transcriptDelivered(r.attachmentId) ? stored : null;
+            if (stored)
+                carried.add(r.attachmentId);
+            return `${availableLine(r.path, r.caption)}${t ? ` ${transcriptOneLine(transcriptForDelivery(t.text))}` : ''}`;
+        });
+        // Late transcripts that found no live session (§4.5.1), oldest first — except one whose
+        // transcript the "now available" line above already carries (said once, never twice).
+        const notes = this.media.indexDb.prepare('SELECT attachmentId, line FROM transcript_notes WHERE conversationKey = ? ORDER BY createdAt').all(conversationKey);
+        for (const n of notes)
+            if (!carried.has(n.attachmentId))
+                lines.push(transcriptForDelivery(n.line));
         return {
             lines,
-            ack: () => { for (const r of rows)
-                this.media.indexDb.prepare('DELETE FROM pending_deliveries WHERE attachmentId = ? AND state = ?').run(r.attachmentId, r.state); },
+            ack: () => {
+                for (const r of rows)
+                    this.media.indexDb.prepare('DELETE FROM pending_deliveries WHERE attachmentId = ? AND state = ?').run(r.attachmentId, r.state);
+                for (const n of notes)
+                    this.media.indexDb.prepare('DELETE FROM transcript_notes WHERE attachmentId = ?').run(n.attachmentId);
+            },
         };
     }
     /** Waiting rows older than 7 days become a line in the session's next context (§4.12). */
@@ -323,6 +602,16 @@ export class AppConversationService {
         catch (err) {
             this.report('pending expiry', err);
         }
+        // Bounded bookkeeping (§4.5.1): late-transcript notes no delivery picked up within 7 days (the
+        // transcript itself stays in the store and in history), and finished attempt rows after 30
+        // days (by then no dispatch re-reads them; a stored transcript is found in the store first).
+        try {
+            this.media.indexDb.prepare('DELETE FROM transcript_notes WHERE createdAt <= ?').run(this.now() - PENDING_DELIVERY_TTL_MS);
+            this.media.indexDb.prepare(`DELETE FROM voice_transcriptions WHERE state IN ('done','failed') AND COALESCE(finishedAt, startedAt) <= ?`).run(this.now() - 30 * 24 * 60 * 60_000);
+        }
+        catch (err) {
+            this.report('transcript bookkeeping', err);
+        }
     }
     /**
      * The §4.6 verdict for a stored message, against THIS machine's ledger and key history.