fix(speakers): defer short live epoch labels and gate owner evidence - #23533

Short Soniox epochs produced consecutive Speaker 4–8 labels because provider/socket scopes each reserve a new conversation voice. This PR ships the bounded safe repair: live unknown voices spend no visible ordinal until five seconds of non-overlapping placed speech. Names still come from existing manual/acoustic authority. Raw identities stay distinct and available for correction.

This stacked PR depends on #23462 (fix/speaker-identity-guardrails, integrated head 072a983314bfb4e24a376b64076fe168ab416fe3) and must merge after #23462. #23404 is already merged to main as 6243071d9efeff253570749da4cece26ffcc7943. This branch merges the reconciled prerequisite and main, with no rebase or force push, and targets main as requested. It extends their shared display authorities rather than introducing another labeler.

• Flutter live transcript and episode naming use SpeakerNames' live qualification floor; qualified voices number in qualification order. Short/unplaced voices show the localized Speaker, with owner and person names preserved.
• Live legacy moment labels defer ordinals and voice-order ledger entries. Once a scoped voice qualifies, its saved ledger token preserves the ordinal on later short or unplaced moment deltas; a different conversation or scope cannot borrow it. Consecutive unnamed turns join only when their identity keys agree.
• Existing live cross-epoch owner-competition grouping requires five seconds of extracted acoustic evidence on each voice, the shared strict CROSS_EPOCH threshold, MATCH_MARGIN, complete-link agreement and different scopes. Weak/ambiguous vectors never merge competitors; short continuity accepts are provisional for cross-scope arbitration until they have five seconds of evidence. This grouping remains internal to owner arbitration; it does not rewrite transcript identities.

The prerequisite has now merged to main as 9fdfa45cea718a131e9f4186e30e5b241579c66a; the merge-after dependency is satisfied. Its deleted branch is represented by the verified final PR head above and the merged main commit.

Owner arbitration repair

A listen reconnect followed by an idle reopen can produce six seconds of owner evidence in epoch a and a two-second continuity accept in epoch b. Both voices now retain “You” while the short voice remains acoustically ungrouped. Provisional voices defer cross-scope competition until both reach five seconds; same-scope competitors and manual reservations still constrain claims. No failed voiceprint decision is promoted. All three live arbitration paths use the same scope/evidence context, including carry and owner revalidation.

The asserted reviewer probe fails twice before the fix and passes both variants after it, including actual You display labels and owner revalidation. The strict five-second grouping, margin, complete-link and unnamed-display policies are unchanged. Policy regressions cover 4.99/5 seconds, unknown/same scopes, manual reservation, invalid evidence and a same-scope competitor against a multi-epoch owner group.

Scope and remaining work

This is the authorized safe subset, not complete anonymous live linking. Anonymous voices with substantial evidence in multiple epochs can still acquire separate ordinals. Cross-listen anonymous identity needs a bounded encrypted, model/version/provenance-bound evidence handoff and reversible display aliases fenced by manual receipt generation, replica concurrency and finalization. The implementation/qualification checklist is in backend/docs/listen_pusher_pipeline.mdx, “Remaining live anonymous linking”. Unplaced audio still bypasses matching; capture placement belongs to the timeline lane. No provider-label equality or weak short-turn vectors force an owner match.

Prerequisite review follow-ups

The refreshed prerequisite fixes catalog-only ordinary-word contact scrubbing. One review finding remains in files unchanged from #23462: partially named/owner voices can be counted twice in the transcript heading. It is an inherited main follow-up; this live-epoch change leaves those files untouched. The live ledger finding is fixed here with an incremental-renderer regression.

Failure-Class: FC-generated-presentation-contract-bypass

Line-Count-Exception: app/lib/widgets/transcript.dart | 1589 -> 1590 | Pass the live qualification option into the existing shared speaker naming primitive; no new widget behavior or duplicated labeler.

Product invariants affected

• INV-UI-3: SpeakerNames remains the Flutter naming authority. Live short-voice deferral extends that primitive and is documented in app/docs/ux-contract.md; distinct wire/correction identities and named-participant counts remain intact.

Trusted manual person_name projections remain visible, while a name bound to one excerpt never labels an unbound excerpt from the same provider voice. Focused regressions cover both boundaries.

Validation

• Current repair head: 65fdab94c8b45e5df54230875c4c82a879fc4b84; merged origin/main at c28475014e0d before the fix. Both probe variants pass, with 31/31 reconnect tests and 229 additional focused policy/epoch/carry/recovery/wire/prior tests passing. No real-audio or production acceptance is claimed.
• Exact-head remote CI: green at 65fdab94c8b45e5df54230875c4c82a879fc4b84; 57 terminal checks, zero failures or pending, with repository-selected skips. All six backend shards, the backend aggregate, Dart analysis/tests, mobile eligibility, hermetic backend E2E and listen-pusher gauntlet passed without reruns. Local repository and metadata preflight passed all 47 checks; the normal pre-push gate and backend type checking passed. Pushed with SSH keepalives and verified by git ls-remote. The PR remains open and unmerged; no GCP tier used.

The following broader suite and scorecard results were recorded on the prior head; they are retained as prior validation, not claimed as final-head runs.

• Final publication source: 7d400b81792eb3480ff95a260f06693265c7b8f5; merged main 9fdfa45cea718a131e9f4186e30e5b241579c66a and fix(speakers): add typed identity, count and presentation guardrails #23462 072a983314bfb4e24a376b64076fe168ab416fe3.

• Backend: 571 tests across 24 focused files passed, including all 13 live epoch/moment cases and all 40 external-list route cases. The external-list offline speaker-name stub accepts the prerequisite rendering keyword; the real route assertions are unchanged. Ledger regressions cover short/unplaced replies, a new epoch and conversation isolation.

• Flutter: 106 tests across five focused files passed, covering naming, rendered transcripts, episode UI/provider state and previous-note navigation. The current complete Dart analysis is covered by the PR checks.

• Web: 154 files / 874 tests passed in the full suite. The web task-row regression now waits for Motion's post-render hover callback before double-clicking the snooze control. Its assertions and product behavior are unchanged; the focused two-test file passed.

• Local scripts/pr-preflight passed all 47 checks in the normal push hooks; PR metadata passed all five checks. Normal push hooks run before publication. A final main/prerequisite refresh is followed by focused backend/Flutter rechecks and frozen score replay; publication stops if the refreshed metrics differ.

• Remote CI: exact published head 7d400b81792eb3480ff95a260f06693265c7b8f5 is green: all executed checks passed, with repository-selected skips and zero failures/pending. All six backend shards, backend aggregate, Dart analysis/tests, mobile aggregate and hermetic merge gate passed. The listen-pusher gauntlet passed its single targeted rerun after a 15-second localhost HTTP read timeout in the existing concurrent REST-finalization restart scenario; no speaker assertion failed. No backend shard budget rerun was needed.

The acceptance fixture drives the real Soniox idle close/reopen adapter, epoch stamper and conversation allocator, deterministic short-turn embeddings through the live matcher, and a fresh listen matcher hydrated from serialized rows. After reconnect it swaps provider labels between owner and guest. Both enrolled and unenrolled guest cases must re-acquire evidence; an enrolled guest keeps the same name, an unenrolled guest stays separate and unnamed until qualification. Owner recognition never follows provider-number equality. These tests qualify the bounded safe repair; anonymous identity continuity across replicas remains deferred. No device or production acceptance is claimed.

Frozen local-quality scorecard

Executed the frozen #23435 scorer (e7a2144f63ed tooling) with the unchanged private corpus/word clocks, SHA-256 b2d293306c74e1423ae41c70d0432ad5eea012a60224cf6f7dc88284105309cc. Historical inference source/audio/crop/payload hashes were verified, then this branch's real Projector.assign_parts, projection builder and conversation allocator ran with filesystem store/assignment boundaries. The split diagnostic uses the frozen split validator and the candidate's production split/build/allocation code. No raw identity mapping was fitted and no display collapse was counted as diarization improvement.

Engineering gate: FAIL. All 10,541 scored words remain anonymous in this batch path: owner/enrolled accuracy is 0/4,415 (0%); wrong-name/false-owner rate is 0%. The live matcher is not exercised by this batch scorecard. This branch does not include the separate #23436 naming or #23437 batch voice-link changes that produced the supplied earlier 6/10/28/28/54 comparison, so the count differences (0/0/-1/-3/-3) are not like-for-like improvements attributable to this live repair. The batch identity producer files are byte-identical to main at evaluation.

The frozen five-speaker split case produced 27 unsplit speakers and 37/30 after the two cuts. Identity loss is 0.0/0.0 percentage points, versus the earlier approximately 3.6–3.8 points. Both split and unsplit owner accuracy are zero here: this is an all-anonymous floor, not a continuity gain, and the split gate remains FAIL. Anonymous cross-listen linking remains deferred as described above.

This was a current-projection replay with zero new model calls, zero production reads and no Firestore transaction qualification. Original inference receipts are retained; seven historical worker switches remain UNKNOWN, so full current-worker inference compatibility is INCOMPLETE. Non-English and real-device/production acoustic acceptance were not evaluated. Private persisted outputs, source hashes and aggregate reports remain outside Git.

UI-Evidence: none -- Naming policy changes only; focused naming and rendered transcript tests cover the visible labels. No layout or styling change.

Delivery

Backend/listen image deployment and a Flutter build are required for the corresponding changes. No merge, deploy, production data read, api.omi.me call, production config flip, or GCP tier used. No language-gate or firmware file touched. Rollback: revert the live-epoch feature changes while retaining the prerequisite PRs.

🤖 Generated with Claude Code