ChatVoice 0.3.0__tar.gz → 0.3.2__tar.gz

{chatvoice-0.3.0 → chatvoice-0.3.2}/.github/workflows/ci.yml

@@ -29,6 +29,11 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: "22"
+      - name: Install audio decoding prerequisite
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends ffmpeg
+          ffmpeg -version
       - run: python -m pip install --upgrade pip
       - run: python -m pip install -e ".[dev,docs,web]"
       - run: python -m pytest -q

{chatvoice-0.3.0 → chatvoice-0.3.2}/CHANGELOG.md

@@ -1,5 +1,18 @@
 # 更新日志
 
+## 0.3.2 - 2026-10-07
+
+- 默认纯识别；开始前的“启用录音+识别”是单向按钮，点击生效后立即禁用变灰，不能关闭；直接开始纯识别也锁灰。服务端持久化该选择，清空、重开或刷新不解锁，已结束会议拒绝追加音频。
+- 音频导入固定为需登录的录音+识别路线，始终私有保留原文件并支持回放；访客入口显示登录要求，不再静默降级为仅文字导入。
+- 新增录音归属 token 与开始/收尾状态，保留尾部上传幂等、清空代次、128 MiB、私有权限、取消回滚和 GPU ASR 分发；旧记录与已有混合音频保守迁移且不删除。
+
+## 0.3.1 - 2026-10-06
+
+- 将音频导入上限提高到 128 MiB，前后端和上传大小检查保持一致。
+- 大于 12 MiB 的文件通过 FFmpeg 按 30 秒、16 kHz 单声道 PCM 窗口顺序处理，复用既有 ASR dispatcher 与持久 GPU 模型，不另起模型 worker。
+- 服务端识别预算提高到 15 分钟，网页上传与识别总预算为 30 分钟；块间检查取消，失败不提交部分转写或残留会议。
+- 同步中文与英文上限/FFmpeg/等待时间说明，保留默认不归档和账号私有保留策略。
+
 ## 0.3.0 - 2026-10-06
 
 ### 新增

{chatvoice-0.3.0/src/ChatVoice.egg-info → chatvoice-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ChatVoice
-Version: 0.3.0
+Version: 0.3.2
 Summary: ChatArch voice recording, transcription, and meeting-notes toolkit.
 Author-email: ChatArch <rex@chatarch.org>
 License-Expression: MIT
@@ -60,7 +60,7 @@ ChatVoice 是 ChatArch 的录音转写与会议工作区 Python 包，包含 Spe
 要求 Python 3.10 或更高版本，建议安装到独立虚拟环境。
 
 ```bash
-python -m pip install "ChatVoice[web]==0.3.0"
+python -m pip install "ChatVoice[web]==0.3.2"
 chatvoice --version
 chatvoice --tree
 chatvoice serve app --dry-run --json
@@ -70,8 +70,8 @@ chatvoice serve app --dry-run --json
 
 ## 当前能力
 
-- **会议记录**：实时转写、暂停与继续、会议标题、标签、历史记录和复制文字。默认只做语音识别；登录后可选择保存原始录音，随会议播放或下载。
-- **录音导入**：导入不超过 12 MiB 的已有音频，经当前 ASR 通道转写后建立普通会议，继续生成标题、摘要和完善纪要。原始文件默认不保留，可明确选择保存。
+- **会议记录**：空白会议开始前用按钮二选一：“纯识别”用后即弃原始音频且无回放；登录账号可选“录音+识别”，私有保留本次会议录音并回放。首次开始即永久锁定，结束后追加音频必须新建会议。
+- **录音导入**：登录后导入不超过 128 MiB 的已有音频；导入固定属于“录音+识别”，保留原文件并支持回放。超过 12 MiB 时顺序解码为 30 秒语音块复用当前 ASR 通道。
 - **摘要与纪要**：生成摘要，手动编辑纪要，或通过对话修改并撤销。
 - **Markdown Todo**：由用户点击“转为 Todo”，在独立页面继续编辑、对话完善、复制或下载 `.md`；不会自动转换或执行任务。
 - **声音工作室**：配置系统音色与输出格式；通过独立声音复刻服务，以授权参考音频生成临时试听结果。
@@ -82,9 +82,9 @@ chatvoice serve app --dry-run --json
 
 ## 数据与安全边界
 
-账号记录保存到 `~/.chatarch/chatvoice` 下的 SQLite；访客记录仅存于当前浏览器。原始录音默认不保存；登录用户明确开启后，文件私有保存到会议名下，播放、下载和删除均校验所有权。访客不能保存服务器录音。密钥不进入浏览器。
+账号记录保存到 `~/.chatarch/chatvoice` 下的 SQLite；访客记录仅存于当前浏览器。访客仅能使用纯识别；录音+识别及文件导入要求登录，并给出可见说明而不静默降级。私有文件的播放、下载和删除均校验所有权。密钥不进入浏览器。
 
-清空或删除会议会清理关联录音；切换保存模式不删除已有文件，也不能恢复此前未保存的音频。数据库备份不包含录音文件，保留原始录音时须同时备份私有音频目录。
+清空会议不会解除模式锁；显式清空或删除仍按既有规则清理关联录音。迁移保守保留旧音频，不因模式归类删除历史数据。数据库备份不包含录音文件，使用录音+识别时须同时备份私有音频目录。
 
 自助注册关闭，由部署者创建受邀账号。ChatVoice 直接依赖 ChatLogin 0.1.2 的内建 `ChatVoiceAuth`，复用既有账号、会话和 CSRF；`/login` 使用可定制的共享 `LoginUI`。会议所有权和 Token 权限仍由 ChatVoice 控制，访客草稿等待 IndexedDB 事务提交后才跳转登录。详见[数据保留边界](https://arch.gh.wzhecnu.cn/ChatVoice/recording-storage/)。
 

{chatvoice-0.3.0 → chatvoice-0.3.2}/README.en.md

@@ -20,7 +20,7 @@ ChatVoice is the ChatArch Python package behind the Speakr recording and meeting
 Python 3.10+ is required. Use a dedicated virtual environment.
 
 ```bash
-python -m pip install "ChatVoice[web]==0.3.0"
+python -m pip install "ChatVoice[web]==0.3.2"
 chatvoice --version
 chatvoice --tree
 chatvoice serve app --dry-run --json
@@ -31,7 +31,7 @@ Installation neither starts a service nor downloads GPU models. The quick start
 ## Capabilities
 
 - Meeting recording, live transcription, pause/resume, titles, tags and history. Audio is discarded by default; account users may explicitly retain recordings for owner-protected playback and download.
-- Import an existing audio file up to 12 MiB through the configured ASR channel into a normal meeting, then generate titles, summaries and refined notes. Original-file retention is optional and defaults off.
+- A blank meeting has exactly two routes: recognition-only discards source audio with no replay; signed-in users may choose recording + recognition to retain and replay this meeting. First start locks the route permanently. Import requires login, always retains the source for replay, and supports files up to 128 MiB (over 12 MiB uses sequential 30-second ASR windows).
 - Summary generation, direct editing, conversation-based refinement and undo.
 - Explicit summary-to-Todo conversion, a separate Markdown editor and refinement conversation, copy and `.md` export. No automatic conversion or task execution.
 - Configurable system TTS and an independent one-shot voice-cloning service.
@@ -44,7 +44,7 @@ Model configuration is server-side. Independent text settings serve notes and ti
 
 Account records use SQLite below `~/.chatarch/chatvoice`. Guest records remain in the browser. Original audio is discarded by default; explicit account opt-in stores private files associated with the meeting. Playback, download and deletion check ownership. Guests cannot retain server recordings. Provider keys never reach the browser.
 
-Clearing or deleting a meeting removes its retained audio. Switching retention mode neither deletes existing files nor recovers previously discarded audio. A database backup does not include recording bytes; back up the private audio directory together with the database when retention is used.
+Clearing does not unlock a meeting route; a finished meeting needs a new meeting for more audio. Explicit clear/delete keeps existing cleanup semantics, while migration never deletes legacy audio. A database backup does not include recording bytes; back up the private audio directory together with the database when retention is used.
 
 Self-registration is disabled; operators provision invited accounts. ChatVoice uses the built-in `ChatVoiceAuth` backend from ChatLogin 0.1.2 and a customizable shared `LoginUI` at `/login`. Existing accounts, sessions and CSRF remain compatible; ChatVoice retains owner and token policy. Guest drafts must commit their IndexedDB transaction before login navigation.
 

{chatvoice-0.3.0 → chatvoice-0.3.2}/README.md

@@ -20,7 +20,7 @@ ChatVoice 是 ChatArch 的录音转写与会议工作区 Python 包，包含 Spe
 要求 Python 3.10 或更高版本，建议安装到独立虚拟环境。
 
 ```bash
-python -m pip install "ChatVoice[web]==0.3.0"
+python -m pip install "ChatVoice[web]==0.3.2"
 chatvoice --version
 chatvoice --tree
 chatvoice serve app --dry-run --json
@@ -30,8 +30,8 @@ chatvoice serve app --dry-run --json
 
 ## 当前能力
 
-- **会议记录**：实时转写、暂停与继续、会议标题、标签、历史记录和复制文字。默认只做语音识别；登录后可选择保存原始录音，随会议播放或下载。
-- **录音导入**：导入不超过 12 MiB 的已有音频，经当前 ASR 通道转写后建立普通会议，继续生成标题、摘要和完善纪要。原始文件默认不保留，可明确选择保存。
+- **会议记录**：空白会议开始前用按钮二选一：“纯识别”用后即弃原始音频且无回放；登录账号可选“录音+识别”，私有保留本次会议录音并回放。首次开始即永久锁定，结束后追加音频必须新建会议。
+- **录音导入**：登录后导入不超过 128 MiB 的已有音频；导入固定属于“录音+识别”，保留原文件并支持回放。超过 12 MiB 时顺序解码为 30 秒语音块复用当前 ASR 通道。
 - **摘要与纪要**：生成摘要，手动编辑纪要，或通过对话修改并撤销。
 - **Markdown Todo**：由用户点击“转为 Todo”，在独立页面继续编辑、对话完善、复制或下载 `.md`；不会自动转换或执行任务。
 - **声音工作室**：配置系统音色与输出格式；通过独立声音复刻服务，以授权参考音频生成临时试听结果。
@@ -42,9 +42,9 @@ chatvoice serve app --dry-run --json
 
 ## 数据与安全边界
 
-账号记录保存到 `~/.chatarch/chatvoice` 下的 SQLite；访客记录仅存于当前浏览器。原始录音默认不保存；登录用户明确开启后，文件私有保存到会议名下，播放、下载和删除均校验所有权。访客不能保存服务器录音。密钥不进入浏览器。
+账号记录保存到 `~/.chatarch/chatvoice` 下的 SQLite；访客记录仅存于当前浏览器。访客仅能使用纯识别；录音+识别及文件导入要求登录，并给出可见说明而不静默降级。私有文件的播放、下载和删除均校验所有权。密钥不进入浏览器。
 
-清空或删除会议会清理关联录音；切换保存模式不删除已有文件，也不能恢复此前未保存的音频。数据库备份不包含录音文件，保留原始录音时须同时备份私有音频目录。
+清空会议不会解除模式锁；显式清空或删除仍按既有规则清理关联录音。迁移保守保留旧音频，不因模式归类删除历史数据。数据库备份不包含录音文件，使用录音+识别时须同时备份私有音频目录。
 
 自助注册关闭，由部署者创建受邀账号。ChatVoice 直接依赖 ChatLogin 0.1.2 的内建 `ChatVoiceAuth`，复用既有账号、会话和 CSRF；`/login` 使用可定制的共享 `LoginUI`。会议所有权和 Token 权限仍由 ChatVoice 控制，访客草稿等待 IndexedDB 事务提交后才跳转登录。详见[数据保留边界](https://arch.gh.wzhecnu.cn/ChatVoice/recording-storage/)。
 

{chatvoice-0.3.0 → chatvoice-0.3.2}/docs/api-access.en.md

@@ -55,16 +55,18 @@ These endpoints require account cookies and ownership, with CSRF for writes. Rea
 
 | Method and path | Input and result |
 | --- | --- |
-| `POST /api/meetings/{id}/audio` | Multipart `file`, `upload_token`, `generation`; one completed recording pass, up to 128 MiB |
+| `POST /api/meetings/{id}/capture/start` | JSON `meeting_mode`, `capture_token`; atomically lock a blank meeting and own its capture |
+| `POST /api/meetings/{id}/capture/finish` | JSON `capture_token`; mark the matching started capture finished, idempotently |
+| `POST /api/meetings/{id}/audio` | Multipart `file`, `upload_token`, `capture_token`, `generation`; normal recording-route tail, up to 128 MiB |
 | `GET /api/meetings/{id}/audio/{audio_id}` | Private playback with controlled audio MIME and no caching |
 | `GET /api/meetings/{id}/audio/{audio_id}/download` | Attachment download of the same private file |
 | `DELETE /api/meetings/{id}/audio` | Delete all associated audio and increment recording generation |
-| `POST /api/meetings/{id}/import` | Multipart `file`, `import_token`, optional `retain_audio=false`, `channel`, `correct`; up to 12 MiB |
+| `POST /api/meetings/{id}/import` | Multipart `file`, `import_token`, optional `channel`, `correct`; always retains source, up to 128 MiB |
 | `DELETE /api/meeting-imports/{import_token}` | Cancel an owned import, also removing a just-committed meeting in a completion race |
 
-Meeting writes accept `audio_retention`, defaulting off and preserving existing choices when omitted. Detail responses include `audio_assets` and read-only `audio_generation`. Upload with the generation captured at recording start; old uploads after clearing return 409. Initial generation is zero, but clients should read the actual value.
+Meeting writes return `meeting_mode`, `mode_locked` and `capture_state`; legacy `audio_retention` still maps to the two modes, and omitted mode fields preserve the current choice. Explicit reverse mutation after lock returns 409. Details also include `audio_assets` and read-only `audio_generation`. Recognition-only has no audio asset/replay. Recording uploads validate both capture ownership and generation; stale uploads after clear return 409.
 
-Import does not overwrite an existing meeting. Success returns a normal `meeting`; repeating its completed token returns the existing result. Cancelled or failed tokens cannot silently trigger recognition again. Empty files return 400, size limits 413, invalid container/MIME 415, conflicts/cancellation 409, invalid model output 502, storage failure 503, and ASR timeout 504. Failures create no half-finished meeting. Actual decoding depends on the configured ASR. A reverse proxy must allow the application file limit plus the 64 KiB multipart allowance.
+Import requires an account, never overwrites a meeting, and returns a locked, finished recording + recognition meeting with replayable source. Even legacy `retain_audio=false` cannot downgrade it. Repeating a completed token returns the existing result; cancelled/failed tokens cannot silently recognize again. Empty files return 400, size limits 413, invalid container/MIME 415, conflicts/cancellation 409, invalid model output 502, storage failure 503, and ASR timeout 504. Failures create no half-finished meeting.
 
 ## Text processing {#text}
 

{chatvoice-0.3.0 → chatvoice-0.3.2}/docs/api-access.md

@@ -55,16 +55,18 @@ app = create_app(login_ui=LoginUI(
 
 | 方法与路径 | 请求与结果 |
 | --- | --- |
-| `POST /api/meetings/{id}/audio` | multipart：`file`、`upload_token`、`generation`；正常完成的一段录音，最大 128 MiB |
+| `POST /api/meetings/{id}/capture/start` | JSON：`meeting_mode`、`capture_token`；仅空白会议，原子锁定路线与本次采集 |
+| `POST /api/meetings/{id}/capture/finish` | JSON：`capture_token`；把匹配的已开始采集标记为完成，可幂等重试 |
+| `POST /api/meetings/{id}/audio` | multipart：`file`、`upload_token`、`capture_token`、`generation`；录音+识别的正常尾部，最大 128 MiB |
 | `GET /api/meetings/{id}/audio/{audio_id}` | 私有音频播放；受控音频 MIME 与禁止缓存 |
 | `GET /api/meetings/{id}/audio/{audio_id}/download` | 同一私有文件的附件下载 |
 | `DELETE /api/meetings/{id}/audio` | 清理会议所有音频并递增录音代次 |
-| `POST /api/meetings/{id}/import` | multipart：`file`、`import_token`，可选 `retain_audio=false`、`channel`、`correct`；最大 12 MiB |
+| `POST /api/meetings/{id}/import` | multipart：`file`、`import_token`，可选 `channel`、`correct`；固定保留原文件，最大 128 MiB |
 | `DELETE /api/meeting-imports/{import_token}` | 取消自己的导入；完成与取消交错时也清理刚建立的会议 |
 
-会议保存支持 `audio_retention`，默认关闭；省略字段不修改既有选择。详情返回 `audio_assets` 和只读的 `audio_generation`。录音上传使用采集时的代次；清空后的旧上传返回 409，不重新建立音频。初始代次是 0，客户端应读取实际值。
+会议保存返回 `meeting_mode`、`mode_locked`、`capture_state`；旧 `audio_retention` 字段继续映射两种模式，省略模式字段会保留既有选择。锁定后显式反向修改返回 409。详情还返回 `audio_assets` 和只读 `audio_generation`。纯识别无音频资产/回放；录音上传同时校验采集身份与代次，清空后的旧上传返回 409。
 
-导入不覆盖已有会议，成功返回 `meeting` 并使用正常文字/纪要流程；相同完成 token 返回既有结果。取消或失败 token 不能静默重复识别。空文件 400、超限 413、容器/MIME 错误 415、冲突/取消 409、无效模型结果 502、存储失败 503、识别超时 504；失败时不留下半成品会议。实际 ASR 解码能力由配置决定。反向代理的 body limit 需覆盖应用文件限额及 64 KiB multipart 余量。
+导入要求账号且不覆盖已有会议，固定返回已锁定、已完成的录音+识别 `meeting` 并保留可回放原文件；旧客户端提交 `retain_audio=false` 也不会降级。相同完成 token 返回既有结果。取消或失败 token 不能静默重复识别。空文件 400、超限 413、容器/MIME 错误 415、冲突/取消 409、无效模型结果 502、存储失败 503、识别超时 504；失败时不留下半成品会议。
 
 ## 文本处理 {#text}
 

{chatvoice-0.3.0 → chatvoice-0.3.2}/docs/capability-map.en.md

@@ -5,8 +5,8 @@ This map explains what ChatVoice owns. Invocation details live in the [CLI tree]
 | Capability | Entry | Dependency/boundary |
 | --- | --- | --- |
 | Recording and transcription | Web, ASR HTTP/WebSocket | Microphone permission and configured ASR; stub is only a fixture |
-| Optional meeting-audio retention | Web and meeting-audio APIs | Default off, explicit account opt-in; private playback/download, cleanup and 128 MiB limit |
-| Existing audio import | Web and meeting-import APIs | Configured ASR, 12 MiB limit; normal meetings, optional retention and cancellation/rollback |
+| Two meeting routes and lock | Web and meeting-audio APIs | Choose recognition-only or recording + recognition while blank; first start persists the lock and finished meetings reject append |
+| Existing audio import | Web and meeting-import APIs | Login required, always retained and replayable; configured ASR, 128 MiB, cancellation/rollback |
 | Summaries and refinement | Web, notes API | Independent text model; transcript is retained |
 | Markdown Todo | Web, Todo API, Python callback module | Explicit conversion/edit/refinement/undo/export; no task execution |
 | Meeting and conversation storage | Web and account APIs | Account SQLite or guest IndexedDB |

{chatvoice-0.3.0 → chatvoice-0.3.2}/docs/capability-map.md

@@ -5,8 +5,8 @@
 | 能力 | 当前入口 | 依赖与边界 |
 | --- | --- | --- |
 | 录音转写 | 网页、ASR HTTP/WebSocket | 麦克风权限与已配置 ASR；stub 仅供验证 |
-| 可选会议录音保留 | 网页、会议音频接口 | 默认关闭，账号明确开启；私有播放/下载、清理及 128 MiB 上限 |
-| 已有录音导入 | 网页、会议导入接口 | 当前 ASR 通道、12 MiB 上限；普通会议、可选保留、取消与失败回滚 |
+| 会议双路线与锁定 | 网页、会议音频接口 | 默认纯识别；单向启用录音+识别后立即锁灰，首次开始纯识别也锁；完成后不得追加 |
+| 已有录音导入 | 网页、会议导入接口 | 需登录，固定保留并可回放；当前 ASR 通道、128 MiB、取消与失败回滚 |
 | 摘要与完善 | 网页、纪要接口 | 独立文本模型；保留转写 |
 | Markdown Todo | 网页、Todo 接口、Python 回调模块 | 手动触发、可编辑/对话/撤销/导出，不执行任务 |
 | 会议与实时对话存储 | 网页、账号数据接口 | 账号 SQLite；访客 IndexedDB |

{chatvoice-0.3.0 → chatvoice-0.3.2}/docs/deployment.en.md

@@ -12,7 +12,7 @@ Choose a service shape first. ChatVoice ships a web server, not a system-service
 ## Install and inspect
 
 ```bash
-python -m pip install "ChatVoice[web]==0.3.0"
+python -m pip install "ChatVoice[web]==0.3.2"
 chatvoice paths --json
 chatvoice doctor --json
 chatvoice service plan --ensure-dirs --json

{chatvoice-0.3.0 → chatvoice-0.3.2}/docs/deployment.md

@@ -12,7 +12,7 @@
 ## 安装和预检
 
 ```bash
-python -m pip install "ChatVoice[web]==0.3.0"
+python -m pip install "ChatVoice[web]==0.3.2"
 chatvoice paths --json
 chatvoice doctor --json
 chatvoice service plan --ensure-dirs --json

{chatvoice-0.3.0 → chatvoice-0.3.2}/docs/quickstart.en.md

@@ -36,7 +36,7 @@ Python 3.10+ is required. This POSIX example uses a virtual environment under Ch
 ```bash
 python3 -m venv "$HOME/.chatarch/chatvoice/.venv"
 . "$HOME/.chatarch/chatvoice/.venv/bin/activate"
-python -m pip install "ChatVoice[web]==0.3.0"
+python -m pip install "ChatVoice[web]==0.3.2"
 chatvoice --version
 chatvoice --tree
 ```

{chatvoice-0.3.0 → chatvoice-0.3.2}/docs/quickstart.md

@@ -36,7 +36,7 @@
 ```bash
 python3 -m venv "$HOME/.chatarch/chatvoice/.venv"
 . "$HOME/.chatarch/chatvoice/.venv/bin/activate"
-python -m pip install "ChatVoice[web]==0.3.0"
+python -m pip install "ChatVoice[web]==0.3.2"
 chatvoice --version
 chatvoice --tree
 ```

chatvoice-0.3.2/docs/recording-storage.en.md

@@ -0,0 +1,50 @@
+# Data Retention Boundary
+
+Every blank meeting defaults to **recognition-only**, discarding source audio without replay. Before starting, a signed-in user may click **Enable recording + recognition** once to retain and replay this meeting; successful activation immediately greys and disables the button. It is not a reversible mode selector.
+
+| Data | Account mode | Guest mode |
+| --- | --- | --- |
+| Title, tags and transcript | Owner-isolated server SQLite | Current-browser IndexedDB |
+| Summary, note refinement, Markdown Todo and conversations | Stored with the meeting | Stored with the local meeting |
+| Original meeting recording | Recognition-only discards it; recording + recognition retains it privately | Recognition-only; no recording archive |
+| Imported original file | Always privately retained and replayable | Import is unavailable with a visible login explanation |
+| Realtime conversation text | Stored with the conversation | Browser-local record |
+| Provider credentials | Server-side only | Never sent to the browser |
+
+## Choose a recording mode
+
+| Mode | Behavior | Available to |
+| --- | --- | --- |
+| Recognition-only | Discard all source audio after processing and expose no replay | Default for accounts and guests |
+| Recording + recognition | Capture from recording start, associate it with this meeting after normal completion, and allow replay | Logged-in accounts |
+
+Enabling recording locks that choice immediately but still permits the first capture. Starting recognition-only without activation also greys the button and locks the route before text arrives. Pause/resume and normal tail finalization remain part of that capture. After finish, create a new meeting for more audio. Clear, reopen and reload do not unlock, and started meetings reject another recording or import. Recording archives remain limited to 128 MiB.
+
+The backend stores lock, start/final state and owned capture identity, rejecting later changes in either direction. Legacy records and mixed retained assets migrate conservatively as finished and are never deleted by classification.
+
+## Import existing audio
+
+Use the audio-import control in the meeting recorder. WAV, MP3, WebM, Ogg, M4A/MP4 and FLAC containers are accepted up to 128 MiB per file; actual decoding depends on the selected ASR channel. Successful import opens a normal meeting for titles, summaries and note refinement, not a separate audio library.
+
+Import always creates a locked, finished recording + recognition meeting and retains the original for replay; retention is not optional. Import requires login, while guests receive a visible explanation rather than a silent text-only downgrade. Recognition failures, empty results, cancellation and storage failures create no half-finished meeting. Cancellation prevents result commit but cannot promise immediate upstream interruption.
+
+Files over 12 MiB require FFmpeg on the main-service host. Decoding produces sequential 30-second, 16-kHz mono WAV windows through the selected ASR channel and reuses the existing persistent GPU model. Server recognition has a 15-minute budget with cancellation checks between windows. The browser has a 30-minute total upload-and-recognition budget; a long upload consumes that total. Allow 128 MiB plus multipart overhead at the reverse proxy and an ASR request wait of at least 1020 seconds. Smaller files retain the original ASR path.
+
+## Private files and deletion
+
+- Retained files live in runtime `data/meeting-audio/`, using server-generated names, `0700` directories and `0600` files.
+- Playback and download require a valid account session and meeting ownership. They are not anonymous links; read-only data tokens do not automatically grant audio-file access.
+- Clearing a meeting deletes associated audio and invalidates old uploads; deleting a meeting also cleans its audio. Cleanup failures are reported rather than counted as successful deletion.
+- Downloaded, exported, backed-up or third-party copies have independent lifecycles. Confirm authorization before retaining or using recordings.
+
+## Processing is not archiving
+
+Microphone and imported audio pass through the browser, ChatVoice and the selected ASR provider. Temporary files under `temp/asr` or `temp/audio-uploads` may be used for decoding, recognition or validation and are removed during normal cleanup. External services have their own policies. Discarding recordings does not mean audio never crosses the network or disk, nor that guest transcription works offline.
+
+Voice-studio TTS/cloning output remains temporary task preview/download audio. Cloning requires an authorized reference and creates neither a permanent voice library nor generation history. The meeting retention mode does not retain raw realtime-conversation audio.
+
+## Backups
+
+`chatvoice data dump` backs up SQLite only, not recording bytes. When retaining audio, stop the service normally and back up or restore the consistent database snapshot together with `data/meeting-audio/`. Restoring only the database cannot recover missing recordings. Code rollback must not overwrite newer records with a stale database.
+
+[Runtime and backup](runtime-layout.md) · [Access and API](api-access.md) · [Web guide](web-guide.md)

chatvoice-0.3.2/docs/recording-storage.md

@@ -0,0 +1,50 @@
+# 数据保留边界
+
+每条空白会议默认**纯识别**：原始音频用后即弃，不提供回放。账号用户可在开始前点击一次**启用录音+识别**按钮，保留并回放本次录音；按钮点击生效后立即灰掉，不能再关闭，也不是可反复选择的选项。
+
+| 数据 | 账号模式 | 访客模式 |
+| --- | --- | --- |
+| 标题、标签、转写 | 服务器 SQLite，按账号隔离 | 当前浏览器 IndexedDB |
+| 摘要、纪要完善、Markdown Todo 与对话 | 随会议保存 | 随本地会议保存 |
+| 会议原始录音 | 纯识别丢弃；录音+识别私有保留 | 仅纯识别，不建立录音档案 |
+| 导入的原始文件 | 固定私有保留并支持回放 | 不允许导入，提示登录 |
+| 实时对话文字 | 随对话记录保存 | 当前浏览器保存 |
+| 模型服务密钥 | 仅服务端配置 | 不发送到浏览器 |
+
+## 选择录音模式
+
+| 模式 | 行为 | 适用范围 |
+| --- | --- | --- |
+| 纯识别 | 处理后丢弃全部原始音频，不显示回放 | 默认；账号和访客 |
+| 录音+识别 | 从开始录音时采集浏览器编码的音频，正常结束后与本次会议关联并可回放 | 已登录账号 |
+
+点击启用后即持久锁定录音+识别，仍允许首次开始录音。未启用而直接开始纯识别，也会在文字到达前灰掉按钮并锁定路线。暂停与继续、正常尾部收尾仍属于同一次录音；结束后必须新建会议才能增加音频。清空、重开或刷新不会解锁，也不能向已开始的会议导入或挂接另一段录音。录音归档最大 128 MiB；超限或浏览器录音失败会显示具体原因。
+
+服务端保存锁定、开始/完成状态及本次采集身份，两方向的后续模式切换都会被拒绝。旧记录和已有混合音频按最保守方式归类为已完成，不因迁移删除文件。
+
+## 导入已有音频
+
+在会议录音控制区点击 **导入录音**。接受 WAV、MP3、WebM、Ogg、M4A/MP4、FLAC 容器，单个文件最大 128 MiB，实际解码能力取决于所选 ASR 通道。成功后打开普通会议，继续生成标题、摘要和完善纪要；不会建立独立的音频文件库。
+
+导入始终建立已锁定、已完成的“录音+识别”会议并保留原始文件；不是可选保存。导入要求登录，访客会看到说明且不会静默降级。识别失败、空结果、取消或存储失败不会建立半成品会议。取消阻止结果提交，不代表可以立即中断第三方或正在执行的模型计算；取消未确认时应检查会议历史，勿重复提交。
+
+超过 12 MiB 的文件需要主服务宿主安装 FFmpeg：服务顺序解码为 30 秒、16 kHz 单声道 WAV 块，每块走所选 ASR 通道，继续复用已有的持久 GPU 模型。服务端识别预算为 15 分钟，取消在块间检查；网页上传与识别合计预算为 30 分钟，长上传会占用该总预算。反向代理需允许 128 MiB 文件及 multipart 开销，并将识别请求等待设为至少 1020 秒。小文件仍使用原 ASR 路径。
+
+## 私有文件与清理
+
+- 保留文件位于运行目录的 `data/meeting-audio/`，目录权限为 `0700`、文件为 `0600`，文件名由服务端生成。
+- 播放和下载需要有效账号会话与会议所有权，不是匿名直链；只读数据 Token 不自动获得音频文件访问权。
+- 清空会议会删除关联音频并使旧上传失效；删除会议也清理音频。清理失败会报告错误，不把残留当成删除成功。
+- 已下载、导出、备份或第三方保存的副本需要分别管理。保存和使用录音前应确认使用授权。
+
+## 处理不等于归档
+
+麦克风或导入音频会经过浏览器、ChatVoice 和所选 ASR 服务。服务端可能使用 `temp/asr` 或 `temp/audio-uploads` 的临时文件解码、识别或上传校验，正常处理后清理。外部服务有自己的数据政策。“不保存录音”不代表音频不经过网络或磁盘，也不代表访客转写可离线运行。
+
+声音工作室的 TTS/复刻输出仍是当前任务的临时试听/下载结果；复刻参考需本人授权，不建立永久音色库或生成历史。实时对话的原始音频保留不属于会议保存模式。
+
+## 备份
+
+`chatvoice data dump` 只备份 SQLite，不包含原始音频文件。使用保留模式时，先正常停止服务，再把数据库一致性快照与 `data/meeting-audio/` 一起备份和恢复；只恢复数据库不能恢复丢失的录音。代码回滚不得用旧数据库覆盖新记录。
+
+[运行目录与备份](runtime-layout.md) · [权限与接口](api-access.md) · [网页使用](web-guide.md)

{chatvoice-0.3.0 → chatvoice-0.3.2}/docs/web-guide.en.md

@@ -5,7 +5,7 @@ Speakr has three top-level modes: **meeting recording, voice studio and realtime
 | Goal | Entry | Stored content |
 | --- | --- | --- |
 | Capture ideas or a meeting | Recording / transcript | Text, title and tags |
-| Import existing audio or retain a recording | Recording mode and import controls | Text by default; explicit account audio retention |
+| Import existing audio or retain a recording | New-meeting mode button and import control | Recognition-only stores text; recording-and-transcription stores playable audio |
 | Summarize and refine wording | Summary / note refinement | Summary and refinement conversation |
 | Build an action plan | Convert to Todo below the summary | Markdown Todo and its conversation |
 | Synthesize speech | Voice studio | Temporary preview/download, not generation history |
@@ -21,21 +21,21 @@ Account and guest data do not automatically migrate between modes. Sending audio
 ## Record and transcribe {#recording}
 
 1. Create a meeting and check the ASR channel in settings.
-2. Check recording mode: transcription-only is the default, while accounts can explicitly retain original audio. Start recording and grant microphone access; use HTTPS remotely.
+2. A blank meeting defaults to **recognition-only**, discarding source audio without replay. Signed-in users may click **Enable recording + recognition** once before start; activation immediately greys and disables the button and retains this meeting's audio. Starting recognition-only without activation also disables it. Guests are recognition-only. Grant microphone access over HTTPS remotely.
 3. Pause and let the current recognition window commit; resuming continues the same meeting.
-4. Finish and wait for the last recognition result. When retention is enabled, also wait for the saved-audio confirmation before reviewing playback/download and notes.
+4. Starting locks the mode permanently for this meeting. Finish and wait for the last recognition result; in recording-and-transcription, also wait for the audio-save confirmation before replay/download.
 
 Edit or refresh the title, add tags, and open saved history. Copying a transcript does not export raw audio. Clearing, creating or deleting an active meeting interrupts recording resources; confirm that you intend to discard the active state.
 
-Mode is locked during recording. Only the owner can play or download retained audio. Switching retention off does not delete earlier files; clearing or deleting the meeting does. A later recording pass creates another audio asset, whereas pause/resume stays in the same pass. Archives are limited to 128 MiB and failures/limits have visible explanations.
+The mode cannot switch after starting or finishing. Recognition-only cannot gain audio later, and a recording-and-transcription meeting cannot become recognition-only. A further recording requires a new meeting; pause/resume stays in the same capture. Clearing audio does not unlock the mode; deleting a meeting removes its associated files. Only the owner can replay/download audio. Archives are limited to 128 MiB.
 
 ## Import existing audio {#audio-import}
 
-1. Choose whether to retain the original, then use the audio-import control to select a local file.
-2. WAV, MP3, WebM, Ogg, M4A/MP4 and FLAC are accepted up to 12 MiB per file; the configured ASR channel must support decoding the selected format.
-3. The page shows upload/recognition status and a cancel control. Success opens a normal meeting for titles, summaries, note refinement and Todo.
+1. Sign in, then use **Import audio** to select a local file. Guests see a login explanation rather than an import that silently drops the audio.
+2. WAV, MP3, WebM, Ogg, M4A/MP4 and FLAC are accepted up to 128 MiB per file; the configured ASR channel must support decoding the selected format.
+3. The page shows upload/recognition status and a cancel control. Import always creates a recording-and-transcription meeting with retained, replayable original audio; continue with titles, summaries, note refinement and Todo.
 
-Original-file retention defaults off. Account opt-in enables owner-protected playback/download; guests only store browser-local text meetings. Empty, invalid, oversized, failed or cancelled imports create no new meeting. Check history instead of resubmitting if cancellation was not confirmed; model computation may still need to finish normally. See [retention and backup](recording-storage.md).
+An imported meeting is locked and cannot gain a second recording; an existing recognition-only meeting cannot be converted by import. Empty, invalid, oversized, failed or cancelled imports create no new meeting. Check history instead of resubmitting if cancellation was not confirmed; model computation may still need to finish normally. See [retention and backup](recording-storage.md).
 
 ## Summarize and refine {#summary}
 

{chatvoice-0.3.0 → chatvoice-0.3.2}/docs/web-guide.md

@@ -5,7 +5,7 @@ Speakr 的顶层入口是 **会议记录、声音工作室、实时对话**。
 | 目标 | 入口 | 保存对象 |
 | --- | --- | --- |
 | 留下语音想法或会议内容 | 会议记录 → 文字记录 | 转写文字、标题、标签 |
-| 导入已有录音或保留会议音频 | 会议录音区的模式与导入控件 | 默认只保存文字；账号可明确保留音频 |
+| 导入已有录音或保留会议音频 | 新会话的模式按钮与导入控件 | 纯识别仅保存文字；录音+识别保存音频并回放 |
 | 总结与修改表达 | 实时摘要 / 完善纪要 | 摘要正文与完善对话 |
 | 整理可执行计划 | 摘要下方“转为 Todo” | Markdown Todo 与完善对话 |
 | 让文字变成声音 | 声音工作室 | 本次试听/下载结果，不建立生成历史 |
@@ -21,21 +21,21 @@ Speakr 的顶层入口是 **会议记录、声音工作室、实时对话**。
 ## 录音与转写 {#recording}
 
 1. 新建会议，确认设置中的识别通道可用。
-2. 确认录音模式。默认只做语音识别；登录后可选择“保存原始录音”。点击录音并允许浏览器使用麦克风，远程访问使用 HTTPS。
+2. 空白会话默认 **纯识别**，音频用后即弃、不提供回放。登录后可在开始前点击一次 **启用录音+识别**：生效后按钮立即灰掉，不能关闭；保存本次原始录音并支持回放。未点而直接开始纯识别，也会灰掉按钮。访客仅能使用纯识别。远程麦克风访问使用 HTTPS。
 3. 暂停时等待当前识别片段提交；继续录音后文字仍归入本条会议。
-4. 结束后等待最后一段识别完成；开启保存时还需等到原始录音保存确认，再检查转写、摘要和录音播放/下载。
+4. 开始时模式即锁定，不能在会话中或结束后切换。结束后等待最后一段识别完成；录音+识别还需等原始录音保存确认，再检查回放/下载。
 
 可修改会议标题、手动刷新标题、添加标签，并从历史列表打开记录。复制文字只复制转写，不导出原始音频。清空、新建或删除活动会议会中断当前录音资源，应先确认内容是否需要保留。
 
-录音中的模式不可切换，已保存音频只有所属账号能播放或下载。关闭保存模式不删除此前文件；清空或删除会议才清理关联录音。正常结束后再次开始录音会保存为另一段音频，暂停/继续则保持同一段。归档上限 128 MiB，失败或超限会显示原因。
+模式随会话锁定，不能在纯识别会话事后添加录音，也不能在录音+识别会话转回纯识别。再次录音须新建会议；暂停/继续仍是同一次录音。清空录音不解锁模式，删除会议才清理关联内容。音频只有所属账号可播放或下载；归档上限 128 MiB，失败或超限会显示原因。
 
 ## 导入已有录音 {#audio-import}
 
-1. 先选择是否保存原始录音，再点击 **导入录音** 选择本地文件。
-2. 支持 WAV、MP3、WebM、Ogg、M4A/MP4、FLAC，单文件最大 12 MiB；所选 ASR 通道必须具备对应解码能力。
-3. 页面显示上传和识别状态，可点击 **取消导入**。成功后打开普通会议，继续使用标题、摘要、完善纪要和 Todo。
+1. 登录账号后点击 **导入录音** 选择本地文件；访客不能导入，页面会提示登录。
+2. 支持 WAV、MP3、WebM、Ogg、M4A/MP4、FLAC，单文件最大 128 MiB；所选 ASR 通道必须具备对应解码能力。
+3. 页面显示上传和识别状态，可点击 **取消导入**。导入始终建立“录音+识别”会议，保留原文件并支持回放；成功后继续使用标题、摘要、完善纪要和 Todo。
 
-默认不保留原始文件；账号明确开启后可播放/下载，访客只保存当前浏览器文字会议。空文件、错误、超限、取消或存储失败不留下新会议。取消未确认时检查历史，不重复提交；模型计算可能仍需正常结束。详见[保留边界与备份](recording-storage.md)。
+导入后模式已锁定，不能给已有纯识别会话补音频，也不能在导入会议再加录音。空文件、错误、超限、取消或存储失败不留下新会议。取消未确认时检查历史，不重复提交；模型计算可能仍需正常结束。详见[保留边界与备份](recording-storage.md)。
 
 ## 摘要与完善纪要 {#summary}
 

{chatvoice-0.3.0 → chatvoice-0.3.2/src/ChatVoice.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ChatVoice
-Version: 0.3.0
+Version: 0.3.2
 Summary: ChatArch voice recording, transcription, and meeting-notes toolkit.
 Author-email: ChatArch <rex@chatarch.org>
 License-Expression: MIT
@@ -60,7 +60,7 @@ ChatVoice 是 ChatArch 的录音转写与会议工作区 Python 包，包含 Spe
 要求 Python 3.10 或更高版本，建议安装到独立虚拟环境。
 
 ```bash
-python -m pip install "ChatVoice[web]==0.3.0"
+python -m pip install "ChatVoice[web]==0.3.2"
 chatvoice --version
 chatvoice --tree
 chatvoice serve app --dry-run --json
@@ -70,8 +70,8 @@ chatvoice serve app --dry-run --json
 
 ## 当前能力
 
-- **会议记录**：实时转写、暂停与继续、会议标题、标签、历史记录和复制文字。默认只做语音识别；登录后可选择保存原始录音，随会议播放或下载。
-- **录音导入**：导入不超过 12 MiB 的已有音频，经当前 ASR 通道转写后建立普通会议，继续生成标题、摘要和完善纪要。原始文件默认不保留，可明确选择保存。
+- **会议记录**：空白会议开始前用按钮二选一：“纯识别”用后即弃原始音频且无回放；登录账号可选“录音+识别”，私有保留本次会议录音并回放。首次开始即永久锁定，结束后追加音频必须新建会议。
+- **录音导入**：登录后导入不超过 128 MiB 的已有音频；导入固定属于“录音+识别”，保留原文件并支持回放。超过 12 MiB 时顺序解码为 30 秒语音块复用当前 ASR 通道。
 - **摘要与纪要**：生成摘要，手动编辑纪要，或通过对话修改并撤销。
 - **Markdown Todo**：由用户点击“转为 Todo”，在独立页面继续编辑、对话完善、复制或下载 `.md`；不会自动转换或执行任务。
 - **声音工作室**：配置系统音色与输出格式；通过独立声音复刻服务，以授权参考音频生成临时试听结果。
@@ -82,9 +82,9 @@ chatvoice serve app --dry-run --json
 
 ## 数据与安全边界
 
-账号记录保存到 `~/.chatarch/chatvoice` 下的 SQLite；访客记录仅存于当前浏览器。原始录音默认不保存；登录用户明确开启后，文件私有保存到会议名下，播放、下载和删除均校验所有权。访客不能保存服务器录音。密钥不进入浏览器。
+账号记录保存到 `~/.chatarch/chatvoice` 下的 SQLite；访客记录仅存于当前浏览器。访客仅能使用纯识别；录音+识别及文件导入要求登录，并给出可见说明而不静默降级。私有文件的播放、下载和删除均校验所有权。密钥不进入浏览器。
 
-清空或删除会议会清理关联录音；切换保存模式不删除已有文件，也不能恢复此前未保存的音频。数据库备份不包含录音文件，保留原始录音时须同时备份私有音频目录。
+清空会议不会解除模式锁；显式清空或删除仍按既有规则清理关联录音。迁移保守保留旧音频，不因模式归类删除历史数据。数据库备份不包含录音文件，使用录音+识别时须同时备份私有音频目录。
 
 自助注册关闭，由部署者创建受邀账号。ChatVoice 直接依赖 ChatLogin 0.1.2 的内建 `ChatVoiceAuth`，复用既有账号、会话和 CSRF；`/login` 使用可定制的共享 `LoginUI`。会议所有权和 Token 权限仍由 ChatVoice 控制，访客草稿等待 IndexedDB 事务提交后才跳转登录。详见[数据保留边界](https://arch.gh.wzhecnu.cn/ChatVoice/recording-storage/)。
 

{chatvoice-0.3.0 → chatvoice-0.3.2}/src/ChatVoice.egg-info/SOURCES.txt

@@ -69,6 +69,7 @@ src/ChatVoice.egg-info/top_level.txt
 src/chatvoice/__init__.py
 src/chatvoice/accounts.py
 src/chatvoice/asr.py
+src/chatvoice/asr_chunks.py
 src/chatvoice/backup.py
 src/chatvoice/cli.py
 src/chatvoice/client.py
@@ -107,6 +108,7 @@ tests/test_cli_token_data.py
 tests/test_config.py
 tests/test_docs_standard.py
 tests/test_documented_interfaces.py
+tests/test_large_audio.py
 tests/test_live_acceptance_contract.py
 tests/test_live_exchanges.py
 tests/test_login_service.py
@@ -114,9 +116,11 @@ tests/test_meeting_audio_edges.py
 tests/test_meeting_audio_import.py
 tests/test_meeting_audio_import_frontend.py
 tests/test_meeting_audio_storage.py
+tests/test_meeting_session_mode_lock.py
 tests/test_nonbrowser_flows.py
 tests/test_nonbrowser_routes.py
 tests/test_nonbrowser_runner_contract.py
+tests/test_one_way_recording_enable.py
 tests/test_public_docs_contract.py
 tests/test_realtime_provider_errors.py
 tests/test_recording_retention_frontend.py

{chatvoice-0.3.0 → chatvoice-0.3.2}/src/chatvoice/__init__.py

@@ -2,4 +2,4 @@
 
 __all__ = ["__version__"]
 
-__version__ = "0.3.0"
+__version__ = "0.3.2"