fix(speakers): defer short live epoch labels and gate owner evidence

.github/checks-manifest.yaml

@@ -4,6 +4,16 @@
 # Checks that consume PR metadata declare `requires_pr_body: true`; post-merge
 # push runs exclude only that category because no authoritative PR body is available.
 checks:
+  - id: speaker-identity-interpolation-ratchet
+    command: ["python3", ".github/scripts/check_speaker_label_interpolation.py", "--changed-files", "{changed_files}", "--base", "{base}"]
+    triggers: ["backend/**/*.py", "app/lib/**/*.dart", ".github/scripts/*speaker_label_interpolation.py", ".github/checks-manifest.yaml"]
+    lanes: ["local", "ci"]
+    reason: "#23379 and Speaker 379 live notes: raw diarization interpolation must not re-enter display or prompts"
+  - id: speaker-label-interpolation-tests
+    command: ["python3", ".github/scripts/test_check_speaker_label_interpolation.py"]
+    triggers: [".github/scripts/*speaker_label_interpolation.py", ".github/checks-manifest.yaml"]
+    lanes: ["local", "ci"]
+    reason: "Fingerprint ratchet rejects f-strings, format, percent and Dart raw speaker interpolation without trading away old leaks"
   - id: nightly-main-contract-tests
     command: ["python3", "scripts/ci/test_nightly_main.py"]
     triggers: [".github/workflows/**", "scripts/ci/nightly_main_report.py", "scripts/ci/test_nightly_main*.py", ".github/checks-manifest.yaml"]
@@ -1868,7 +1878,7 @@ checks:
     command: ["python3", ".github/scripts/check_speaker_label_interpolation.py"]
     triggers: ["backend/**/*.py", ".github/scripts/check_speaker_label_interpolation.py", ".github/checks-manifest.yaml"]
     lanes: ["local", "ci"]
-    reason: "#23381: an interpolated 'Speaker {speaker_id}' prompt label is a raw per-conversation diarization counter that summarizers copy verbatim into user-visible notes; unnamed voices must be labeled through utils.speaker_display.SpeakerLabeler dense labels"
+    reason: "#23381: an interpolated 'Speaker {speaker_id}' prompt label is a raw per-conversation diarization counter that summarizers copy verbatim into user-visible notes; unnamed voices must use the identity-aware utils.speakers.display authority"
   - id: speaker-label-interpolation-selftest
     command: ["python3", ".github/scripts/check_speaker_label_interpolation.py", "--self-test"]
     triggers: [".github/scripts/check_speaker_label_interpolation.py", ".github/checks-manifest.yaml"]

.github/scripts/check_speaker_label_interpolation.py

@@ -1,27 +1,155 @@
 #!/usr/bin/env python3
-"""Reject interpolated ``Speaker {speaker_id}`` display labels in backend source.
-
-A ``speaker_id`` is a per-conversation diarization counter, not a person. When a
-formatter interpolates it into a ``Speaker N`` label, summarizer models copy the
-label verbatim into user-visible notes (#23381). Unnamed voices must be labeled
-through ``backend/utils/speaker_display.SpeakerLabeler`` (dense "Speaker A/B/..."
-per rendered transcript), which is the only allowlisted builder of ``Speaker ``
-labels.
-
-The check is AST-based and zero-tolerance outside that allowlist: f-strings,
-``str.format`` templates, ``%`` templates, and concatenation all count when a
-constant chunk ends with the word ``Speaker`` right before a dynamic value. Log
-messages that merely mention a speaker ("Speaker assignment failed: ...") do not
-match, and the provider-internal ``SPEAKER_00`` namespace is a different string.
+"""Ratchet raw speaker interpolation after #23379 and the Speaker 379 live-notes incident.
+
+Existing storage/routing expressions are compared by AST fingerprint, not a count:
+removing one old expression never buys permission to introduce a different leak.
+Display text must use utils.speakers.display / SpeakerNames. Wire fields remain IDs.
 """
 
 from __future__ import annotations
 
 import argparse
 import ast
+from collections import Counter
+from pathlib import Path
 import re
+import subprocess
 import sys
-from pathlib import Path
+
+AUTHORITY = {
+    'backend/utils/speaker_display.py',
+    'backend/utils/speakers/display.py',
+    'app/lib/ui/format/speaker_names.dart',
+    'app/lib/ui/format/diarization_label.dart',
+}
+RAW = re.compile(r'(?i)(?:\b(?:raw_)?speaker_?id\b|\bdiarization_?label\b|raw_for_transport|rawForTransport)')
+
+
+def findings(path: str, source: str) -> list[tuple[str, int]]:
+    if path in AUTHORITY or '/tests/' in path or '/test/' in path:
+        return []
+    if path.startswith('backend/') and path.endswith('.py'):
+        tree = ast.parse(source)
+        hits = []
+        tainted = set()
+
+        def is_raw(expression):
+            return bool(RAW.search(ast.unparse(expression))) or any(
+                isinstance(part, ast.Name)
+                and part.id in tainted
+                or isinstance(part, ast.Attribute)
+                and part.attr in ('speaker', 'speaker_id', 'speakerId')
+                for part in ast.walk(expression)
+            )
+
+        # Local aliases do not turn storage identity into safe display text.
+        for _ in range(3):
+            for assignment in ast.walk(tree):
+                if (
+                    isinstance(assignment, (ast.Assign, ast.AnnAssign))
+                    and assignment.value is not None
+                    and is_raw(assignment.value)
+                ):
+                    targets = assignment.targets if isinstance(assignment, ast.Assign) else [assignment.target]
+                    for target in targets:
+                        tainted.update(part.id for part in ast.walk(target) if isinstance(part, ast.Name))
+        for node in ast.walk(tree):
+            if (isinstance(node, ast.ImportFrom) and node.module == 'utils.speaker_display') or (
+                isinstance(node, ast.Import) and any(alias.name == 'utils.speaker_display' for alias in node.names)
+            ):
+                hits.append((ast.dump(node, include_attributes=False), node.lineno))
+            expressions = []
+            speaker_template = False
+            if isinstance(node, ast.JoinedStr):
+                expressions = [v.value for v in node.values if isinstance(v, ast.FormattedValue)]
+                speaker_template = any(
+                    isinstance(left, ast.Constant)
+                    and isinstance(left.value, str)
+                    and re.search(r'(?<![_A-Za-z])Speaker[ \t]*$', left.value)
+                    and isinstance(right, ast.FormattedValue)
+                    for left, right in zip(node.values, node.values[1:])
+                )
+            elif isinstance(node, ast.Call) and isinstance(node.func, ast.Attribute) and node.func.attr == 'format':
+                expressions = list(node.args) + [kw.value for kw in node.keywords]
+                speaker_template = (
+                    isinstance(node.func.value, ast.Constant)
+                    and isinstance(node.func.value.value, str)
+                    and bool(re.search(r'(?<![_A-Za-z])Speaker[ \t]*\{', node.func.value.value))
+                )
+            elif (
+                isinstance(node, ast.BinOp)
+                and isinstance(node.op, ast.Mod)
+                and isinstance(node.left, ast.Constant)
+                and isinstance(node.left.value, str)
+            ):
+                expressions = [node.right]
+                speaker_template = bool(re.search(r'(?<![_A-Za-z])Speaker[ \t]*%', node.left.value))
+            elif isinstance(node, ast.BinOp) and isinstance(node.op, ast.Add):
+                for literal, dynamic in ((node.left, node.right), (node.right, node.left)):
+                    if (
+                        isinstance(literal, ast.Constant)
+                        and isinstance(literal.value, str)
+                        and re.search(r'(?<![_A-Za-z])Speaker[ \t]*$', literal.value)
+                    ):
+                        expressions = [dynamic]
+                        speaker_template = True
+            if not expressions:
+                continue
+            rendered = ast.unparse(node)
+            # Generic aliases are caught when the template itself says Speaker/SPEAKER.
+            raw = any(is_raw(expr) for expr in expressions)
+            template = (
+                node.func.value if isinstance(node, ast.Call) else node.left if isinstance(node, ast.BinOp) else None
+            )
+            if isinstance(template, ast.Constant) and isinstance(template.value, str):
+                raw = raw or bool(re.search(r'(?:\{|%\()(?:raw_)?speaker_?id\b', template.value, re.I))
+            alias = re.search(r'[Ss][Pp][Ee][Aa][Kk][Ee][Rr][ _]', rendered) and any(
+                re.search(r'\b(?:sid|speaker|speaker_key|speaker_idx)\b', ast.unparse(expr)) for expr in expressions
+            )
+            if raw or alias or speaker_template:
+                hits.append((ast.dump(node, include_attributes=False), node.lineno))
+        return hits
+    if path.startswith('app/lib/') and path.endswith('.dart') and '/gen/' not in path and '/l10n/' not in path:
+        return [
+            (match.group(), source.count('\n', 0, match.start()) + 1)
+            for match in re.finditer(
+                r'''(?:['"][^'"\n]*\$(?:\{[^}\n]*(?:speakerId|rawForTransport)[^}\n]*\}|speakerId\b)[^'"\n]*['"])''',
+                source,
+            )
+        ]
+    return []
+
+
+def regressions(path: str, before: str, after: str) -> list[int]:
+    old = Counter(fingerprint for fingerprint, _ in findings(path, before))
+    lines = []
+    for fingerprint, line in findings(path, after):
+        if old[fingerprint]:
+            old[fingerprint] -= 1
+        else:
+            lines.append(line)
+    return lines
+
+
+def _main_ratchet(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--changed-files', required=True)
+    parser.add_argument('--base', required=True)
+    args = parser.parse_args(argv)
+    failures = []
+    for path in Path(args.changed_files).read_text().splitlines():
+        file = Path(path)
+        if not file.is_file() or not (path.endswith('.py') or path.endswith('.dart')):
+            continue
+        result = subprocess.run(['git', 'show', f'{args.base}:{path}'], text=True, capture_output=True)
+        failures.extend(
+            f'{path}:{line}: raw speaker interpolation; use display_participants / SpeakerNames'
+            for line in regressions(path, result.stdout if result.returncode == 0 else '', file.read_text())
+        )
+    print('\n'.join(failures) if failures else 'OK: no new raw speaker interpolation')
+    return int(bool(failures))
+
+
 
 REPOSITORY_ROOT = Path(__file__).resolve().parents[2]
 SCAN_ROOT = Path('backend')
@@ -147,7 +275,7 @@ def _self_test() -> int:
     return 0
 
 
-def main(argv: list[str] | None = None) -> int:
+def _main_fullscan(argv: list[str] | None = None) -> int:
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument('--root', type=Path, default=REPOSITORY_ROOT)
     parser.add_argument('--scan-root', type=Path, default=SCAN_ROOT)
@@ -158,12 +286,20 @@ def main(argv: list[str] | None = None) -> int:
     violations = collect_violations(args.root.resolve(), args.scan_root)
     if not violations:
         return 0
-    print('FAIL: "Speaker" labels must not interpolate a raw id; use utils.speaker_display.SpeakerLabeler:', file=sys.stderr)
+    print('FAIL: "Speaker" labels must not interpolate a raw id; use utils.speakers.display.display_participants:', file=sys.stderr)
     for path, errors in sorted(violations.items()):
         for error in errors:
             print(f'  {path}:{error}', file=sys.stderr)
     return 1
 
 
+
+def main(argv: list[str] | None = None) -> int:
+    arguments = sys.argv[1:] if argv is None else argv
+    if '--changed-files' in arguments or '--base' in arguments:
+        return _main_ratchet(arguments)
+    return _main_fullscan(arguments)
+
+
 if __name__ == '__main__':
     raise SystemExit(main())

.github/scripts/test_check_speaker_label_interpolation.py

@@ -0,0 +1,46 @@
+import unittest
+
+from check_speaker_label_interpolation import regressions
+
+
+class SpeakerPresentationRatchetTest(unittest.TestCase):
+    def test_python_interpolations(self):
+        for source in [
+            'x = f"Speaker {segment.speaker_id}"',
+            'x = f"{speaker_id}: hello"',
+            'x = "Speaker {}".format(segment["speaker_id"])',
+            'x = "Speaker %s" % raw_speaker_id',
+            'x = f"Speaker {speaker}"',
+            'x = "Speaker " + value',
+            'x = f"Speaker {display_key}"',
+            'sid = segment.speaker_id\nx = f"Who: {sid}"',
+            'x = f"{segment.speaker}"',
+            'x = "Speaker {speaker_id}".format(**segment)',
+            'x = "Speaker %(speaker_id)s" % segment',
+        ]:
+            with self.subTest(source=source):
+                self.assertTrue(regressions('backend/utils/review.py', '', source))
+
+    def test_baseline_is_fingerprinted(self):
+        old = 'x = f"Speaker {speaker_id}"'
+        self.assertFalse(regressions('backend/utils/review.py', old, old))
+        self.assertFalse(regressions('backend/utils/review.py', old, 'x = names.label(row)'))
+        self.assertTrue(regressions('backend/utils/review.py', old, 'x = f"Who: {speaker_id}"'))
+
+    def test_authority_and_tests(self):
+        for path in ['backend/utils/speakers/display.py', 'backend/tests/unit/test_display.py']:
+            self.assertFalse(regressions(path, '', 'x = f"{speaker_id}"'))
+
+    def test_dart(self):
+        self.assertTrue(
+            regressions('backend/utils/new_renderer.py', '', 'from utils.speaker_display import SpeakerLabeler')
+        )
+        self.assertFalse(
+            regressions('backend/utils/new_renderer.py', '', 'from utils.speakers.display import display_participants')
+        )
+        self.assertTrue(regressions('app/lib/widgets/transcript.dart', '', 'Text("Speaker ${segment.speakerId}")'))
+        self.assertFalse(regressions('app/lib/widgets/transcript.dart', '', 'Text(names.forSegment(segment))'))
+
+
+if __name__ == '__main__':
+    unittest.main()

app/AGENTS.md

@@ -1,7 +1,8 @@
-# App (Flutter) — Operational Playbook
+# App (Flutter)
 
-Inherits [`../AGENTS.md`](../AGENTS.md); adds app-specific operational guidance.
-UI rules: [docs/ux-contract.md](docs/ux-contract.md).
+UI: [contract](docs/ux-contract.md).
+
+Speakers: `SpeakerNames`/`DiarizationLabel` (`lib/ui/format/`); `EpisodePresentation.participants` counts names.
 
 ## Build Bootstrap
 

app/changelog/unreleased/live-speaker-epochs.json

@@ -0,0 +1 @@
+{"change":"Short unidentified live turns stay unnamed across reconnects instead of creating a new numbered speaker for each socket."}

app/changelog/unreleased/speaker-identity-guardrails.json

@@ -0,0 +1 @@
+{"change":"Speaker labels stay consistent across transcripts and review questions, and excess unidentified voices are grouped as Others."}

app/docs/ux-contract.md

@@ -217,11 +217,13 @@ participant lists, the speaker filter and every copied, shared or exported trans
 - Everyone else is **Speaker N**, N dense per conversation (1, 2, 3… in order of first
   appearance, skipping the owner and Omi). Never a raw id, never a gap. Naming a person does not
   renumber the others. `TranscriptSegment.getDisplaySpeakerId` returns the same N.
+- Live capture passes `deferShortVoices: true`: unnamed voices remain plain **Speaker** until five seconds of non-overlapping placed speech. Unplaced text cannot qualify. Number at qualification time so a short earlier voice cannot renumber an established voice; owner and known-person names still use their existing authority. This display floor does not identify or merge voices.
 - When the server could not resolve speakers across the conversation (`speaker_resolution.status`
   is `unavailable`), raw ids from different recordings are not comparable, so an unnamed voice is
   the plain **Speaker** (`l10n.unnamedSpeakerLabel`), never "Speaker ?" and never a number, and the
   transcript heading omits its speaker count. A saved transcript names each speaker once per turn
   (consecutive lines from the same voice), so a change of voice is still visible.
+- When diarization splits into more than eight unnamed voices, group tiny-evidence voices as **Others** and omit exact counts in conversation headers and the transcript heading. `DiarizationLabel` keeps storage ids out of display text.
 - On-device overflow transcripts (`stt_provider=on_device:<engine>`) have one **unlabeled** voice: omit speaker names and the speaker count. Local engines never imply diarization or identity.
 - The speaker filter is "Filter by speaker" (`l10n.filterBySpeaker`), never the loudspeaker string
   `phoneSpeaker`.

app/lib/l10n/app_ar.arb

@@ -4423,5 +4423,6 @@
     "recapInTheBackground": "في الخلفية",
     "retentionOfferAccept": "ابقَ بخصم {percent}%",
     "retentionOfferBody": "ابقَ وادفع {price} شهريًا لمدة {months} أشهر قادمة.",
-    "retentionOfferApplied": "تم. خصم {percent}% لمدة {months} أشهر قادمة."
+    "retentionOfferApplied": "تم. خصم {percent}% لمدة {months} أشهر قادمة.",
+    "othersSpeakerLabel": "آخرون"
 }

app/lib/l10n/app_be.arb

@@ -11849,5 +11849,6 @@
     "recapInTheBackground": "У фоне",
     "retentionOfferAccept": "Застацца са зніжкай {percent}%",
     "retentionOfferBody": "Застаньцеся і плаціце {price} у месяц на працягу {months} месяцаў.",
-    "retentionOfferApplied": "Гатова. Зніжка {percent}% на {months} месяцы."
+    "retentionOfferApplied": "Гатова. Зніжка {percent}% на {months} месяцы.",
+    "othersSpeakerLabel": "Іншыя"
 }

app/lib/l10n/app_bg.arb

@@ -4423,5 +4423,6 @@
     "recapInTheBackground": "На заден план",
     "retentionOfferAccept": "Остани с {percent}% отстъпка",
     "retentionOfferBody": "Остани и плащай {price} на месец за следващите {months} месеца.",
-    "retentionOfferApplied": "Готово. {percent}% отстъпка за следващите {months} месеца."
+    "retentionOfferApplied": "Готово. {percent}% отстъпка за следващите {months} месеца.",
+    "othersSpeakerLabel": "Други"
 }

app/lib/l10n/app_bn.arb

@@ -11849,5 +11849,6 @@
     "recapInTheBackground": "পটভূমিতে",
     "retentionOfferAccept": "{percent}% ছাড়ে থাকুন",
     "retentionOfferBody": "থাকুন এবং মাসে {price} দিন, পরের {months} মাস।",
-    "retentionOfferApplied": "হয়ে গেছে। {percent}% ছাড়, পরের {months} মাস।"
+    "retentionOfferApplied": "হয়ে গেছে। {percent}% ছাড়, পরের {months} মাস।",
+    "othersSpeakerLabel": "অন্যরা"
 }

app/lib/l10n/app_bs.arb

@@ -11849,5 +11849,6 @@
     "recapInTheBackground": "U pozadini",
     "retentionOfferAccept": "Ostani uz {percent}% popusta",
     "retentionOfferBody": "Ostani i plaćaj {price} mjesečno sljedećih {months} mjeseca.",
-    "retentionOfferApplied": "Gotovo. {percent}% popusta sljedećih {months} mjeseca."
+    "retentionOfferApplied": "Gotovo. {percent}% popusta sljedećih {months} mjeseca.",
+    "othersSpeakerLabel": "Ostali"
 }

app/lib/l10n/app_ca.arb

@@ -4423,5 +4423,6 @@
     "recapInTheBackground": "En segon pla",
     "retentionOfferAccept": "Queda't amb un {percent}% de descompte",
     "retentionOfferBody": "Queda't i paga {price} al mes durant els propers {months} mesos.",
-    "retentionOfferApplied": "Fet. {percent}% de descompte els propers {months} mesos."
+    "retentionOfferApplied": "Fet. {percent}% de descompte els propers {months} mesos.",
+    "othersSpeakerLabel": "Altres"
 }

app/lib/l10n/app_cs.arb

@@ -4423,5 +4423,6 @@
     "recapInTheBackground": "Na pozadí",
     "retentionOfferAccept": "Zůstat se slevou {percent} %",
     "retentionOfferBody": "Zůstaňte a plaťte {price} měsíčně po dobu dalších {months} měsíců.",
-    "retentionOfferApplied": "Hotovo. Sleva {percent} % na dalších {months} měsíců."
+    "retentionOfferApplied": "Hotovo. Sleva {percent} % na dalších {months} měsíců.",
+    "othersSpeakerLabel": "Ostatní"
 }

app/lib/l10n/app_da.arb

@@ -4465,5 +4465,6 @@
     "recapInTheBackground": "I baggrunden",
     "retentionOfferAccept": "Bliv for {percent}% rabat",
     "retentionOfferBody": "Bliv og betal {price} om måneden de næste {months} måneder.",
-    "retentionOfferApplied": "Færdig. {percent}% rabat de næste {months} måneder."
+    "retentionOfferApplied": "Færdig. {percent}% rabat de næste {months} måneder.",
+    "othersSpeakerLabel": "Andre"
 }