What’s new in Speech Layer

- Add supervised agent session and core-tool health alerts

- Fix: keep echo-cancellation warm-up retrying after degraded fallback

- Fix: keep scroll and page phrases from replacing ordinary dictation - Fix: report scroll key presses instead of sent prompts

- Fix: failed or invalid emotive chunks now fall back to the unchanged local voice in reply order - Fix: retain source text for audio recovery and reject missing, silent, corrupt, or prematurely ending playback - Fix: propagate failed queue status instead of reporting success - Tests: reproduce middle and trailing chunk loss across the full incident reply offline

Discard the whole take after a spoken cancel

Add RC2 OS validation report

- Design: add blue scroll homepage candidate

- Copy: use hands-free eyes-free candidate messaging

- Brand: reorder the editorial wordmark and icon

- Brand: apply Speech Layer artwork across preview artifacts

- Installer: remediate the second release candidate

Update Snapcraft registration research

Record Speech Layer OS validation results

Add the scroll homepage preview and validation evidence

Add package registration research

Add supporting pages and validation evidence

Add the console homepage preview and validation evidence

Add the editorial homepage preview and validation evidence

Prepare the Speech Layer installer release candidate

Add the brutalist homepage preview and screenshots

Add the human homepage preview and validation evidence

Prevent duplicate handover and extension reload prompts

Document Speech Layer product and preview requirements

- Reuse compatible existing Node and npm before installing a fallback - Add an explicit headless profile without changing the default GUI profile - Make capmin an opt-in tool and track it in the tools ownership step - Document why Pocket TTS keeps its isolated pinned environment

Prevent unconfirmed extension reloads from stacking duplicate prompts

- Fix: Record only the ownership run identifier so installer completion and reruns finalize manifests

- Fix indicator dragging and offscreen recovery

- Exclude pi-web and its container lifecycle from new installations

Reuse existing browsers and make Chromium installation explicitly opt-in

- Add manifest-backed selective uninstall

Remove unused system package dependencies

- Add a shared compatible terminal adapter for launch and zoom - Install Ghostty only as a GUI fallback and preserve terminal choices - Add headless installer and terminal fixture coverage

- Ship the generic mate watcher without personal operations or references

- Keep Void reruns working when the legacy OS release file disappears

- Fix fresh-install Python environments for Pocket, Moonshine, and the router

- Automate LXQt Openbox shortcuts and make public checksums portable

- Seed local operations rules without overwriting user customizations

- Fix: wait for real mic capture during login healing so normal wake-model startup is not restarted and falsely reported dead

- Build a lean public installer around Moonshine, Pocket TTS, and optional Voz - Bundle unattended surfagent and optional foxagent setup with browser skills - Retry required Void packages and verify clean installs and lifecycle files - Remove retired service privileges and completed-recording fallback dependencies

- Remove retired Home Assistant references from operator and installation documentation - Stop installers and privilege templates from registering deleted services or token configuration

- Remove the retired Home Assistant and Wyoming integration while preserving phone microphone and Termux speech playback - Delete the legacy speech endpoint, service definitions, dependencies, and relocation watcher - Update operator documentation and add phone-only integration regression checks

- Fix: Hold listen-mode commands out of live pane typing and erase corrected command partials before the final handoff

- listen mode shows one expiring recording notification per session instead of repeating it on every turn - routine empty-transcription, transcribing, internal voice-routing, and debug notifications stay in logs during listen mode - actionable warnings and normal-mode desktop notifications remain unchanged

- the whisper fallback server no longer runs by default, saving CPU on modest hardware; start it manually with speechlayer whisper start when needed - speech-to-text skips the optional whisper fallback cleanly when it is not running, with one log line per state change instead of repeated errors - the end-to-end test and login health checks now verify the main speech-to-text router; the optional whisper server is reported as information only - boot entries, login heal, and service restarts no longer auto-restart the whisper fallback; installers leave it out of the default services - the optional needle fallback now stays off across reboots when it has been disabled

- log one jsonl line per played say job for latency joins - log first-sentence mint per turn with model and turn anchors - add a report script that joins mints and plays into per-model latency stats

- estimate heard characters from claim time when a barge cuts before capture lands - latch an unconsumed interruption record so later completions cannot erase it - make the full-duplex bench robust to missing fixture clips and slower wakes

Fix trailing-terminator loss in the recording probe loop

- Fix: a held terminator match now also re-arms on transcript-quiet: consecutive empty probe verdicts spanning the re-arm grace commit the cut at the remembered position, so a hot mic floor that blinds the energy grace can no longer force manual take termination - The energy veto and energy grace are unchanged; the transcript path only runs while a terminator or cancel match is already held, and the cut always lands at the remembered match position so post-match speech can never be eaten

- Replace the Mercury tag-inserter call on the say path with a deterministic regex inserter that maps plain words to whitelisted drama-3 cues at the matching sentence or word position, with at most one delivery cue and two insertions per sentence - No emotive match synthesizes verbatim with about a millisecond of overhead instead of a one to two second network call - Keep Mercury behind an inserter-mode switch, deterministic by default, for future non-say roles - Log every insertion decision to the emotive jsonl

- Fix: a lost stream feed mid-take is now logged once and the take settles finals-only from the warm whole-file decoders instead of attempting a doomed stream final, while the heartbeat keeps painted partials on screen

- Add a deterministic emotive pre-filter: the tag-inserter call now only runs when the text carries an exclamation mark or one of a short list of emotive terms, everything else synthesizes verbatim with zero added latency - Sentences that pass the filter get a biased inserter prompt that adds at least one fitting cue so the call is worth it - Log each filter decision in the emotive jsonl

- Fix: the live-partial heartbeat now runs on its own thread from take start until the final settle completes, so a slow stream or redux final on a long lagged take no longer lets the typer erase typed text mid-settle

- Fix: cache pruning no longer deletes emotive wavs still referenced by queued or playing say jobs, and only count-bounds files older than fifteen minutes - Fix: a missing playwav file is now caught before the player spawns and speaks a short loss notice instead of silently skipping the sentence - Fix: optional config reads in the say queue daemon are pipefail-safe so a missing notice config can no longer kill the daemon mid-queue

Skip the handover auto-load on extension reloads so reload stays side-effect free

- Fix: keep the live-partial heartbeat fresh while a take records so a stalled stream no longer erases typed text mid-dictation - Fix: lagged takes now settle from the warm redux decoder first (about 1 s for a short take) instead of a moonshine re-decode that timed out on long takes - Integrations: document measured thread scaling for the streaming slot and keep the 4-thread default that coexists with the probe decoder

Settle live dictation finals in place and self-heal the STT stream slot

Speak drama-3 native tag syntax directly and widen the cue vocabulary

Make the picked audition voice the built-in emotive default

Enqueue same-reply emotive chunks in submission order

Pin one default drama-3 voice; provider default rotates per request

Keep the newest 10 emotive cache utterances by default

Include the voice id in the emotive utterance cache key

Cache rendered emotive wavs; replay repeats without re-synthesis

Add opt-in emotive TTS spike behind a single toggle

Speech Layer in a browser (delta voice page) - spec only, review gates build

Backoff after failed echo estimates, then give up

Never speak notices while listen mode is active

Probe errors never count as transcript-silence

Reminders with quiet hours no longer fire during the quiet window

Reminders now record who set them, so accidental double-sets can be traced

Spoken reminders use the standard voice again instead of a robotic fallback voice

- Add a report-outstanding gate to the lane reaper: a lane holding an open intent is never reapable - Relay a harvested lane outcome to the owning orch before closing; a failed relay keeps the lane - Distinguish report-outstanding from not-started in the ground-truth probe matrix

- Fix the intent list silently dropping open intents behind the recency limit - Add a bundled ground-truth probe subcommand for lane status, repo HEAD, and open intents - Warn when outcome-shaped text is dispatched to an orch lane and would mint a false intent - Update the forward-deadline test window to the shipped default

The live dictation and fallback speech servers now get the same negative-nice CPU protection as text-to-speech, so a busy desktop no longer delays end-of-take transcription

The CPU watchdog no longer deprioritizes the speech-recognition servers while guarding spoken replies

Cancel-everything drains queued steering and follow-up messages so a voice cancel cannot be re-submitted by the next inject

Compaction guard consumes exact session_compact_failed pane-state events alongside the spinner heuristics and speaks real failures

Strip origin-tag scaffolding from provider context with append-only context edits while raw history stays untouched

Correct the wedge-recovery and ext-drift notes - only /reload loads edited extension code in pi 1.2.0, /new does not

The pi freeze guard now logs whenever its screen-based pane status disagrees with the pane's exact state file, gathering evidence for a safe future cutover

Pressing Escape in the middle of a spoken reply now cuts that reply's queued and playing audio instead of letting it read out as a finished answer

Say --skip-group accepts an explicit reply id so a deliberate cut can never hit another pane's playing audio

Voice (prototype): when a spoken reply is cut off, the pane's next turn is told how much of it the user actually heard

A new pi extension records each pane's exact agent state (working, blocked with dialog title, done, idle, error, aborted) in per-pane files for speechlayer watchers

A pane stuck on a dialog or hitting an error is now spoken aloud within seconds, including the dialog title

Phone replies are delivered the moment the pane's answer settles instead of after a polling delay, with a clear notice when a turn was cancelled

A doubled terminator (thanks said twice at the end of a take) no longer leaves a stray copy of the word in the dispatched message

Chained cancel phrases (never mind said twice, or a clipped repeat like never mind, never) now strip fully, and a take that is all cancel after the strip is discarded instead of sending the residue

Two more misheard forms respelled in the proper-nouns dictionary, one for a client product name and one for the word commit

More misheard spellings of a client product name are now corrected

The phone mic help and guide now list thanks as the only end word

A take that merely ends on the word shot no longer stops recording, thanks is the only default end word

A spoken message for a pane with no agent is refused out loud instead of being typed into its shell

A herd whose only pane has no agent now hands the message to the live agent of that name

A wake phrase left at the start of a listen-mode take is no longer mistaken for a pane name

Back-to-back listen-mode turns no longer pile up behind a slow speech engine

A busy or lagging stream engine hands the take to the fast engine and still settles the text in place

The speech server skips requests whose caller already gave up and reports its queue in health

A take with no speech is no longer decoded a second time

Speech cut by a recording hold or skip now stops the player instead of talking on

- A spoken message that starts with the word sticky is now delivered like any other message instead of being swallowed as a failed command

- Use the streamed nemotron final as the dictation text, with whole-take re-decode only as a fallback - Cut the streamed final at the terminator so trailing words never reach the prompt - Settle live partials into the sent prompt in place instead of erasing and retyping them - Erase kept partials first whenever a take routes anywhere other than a plain prompt

- Add nemotron streaming as an optional engine for the streaming STT slot - Add a stream-engine switch to the stt command, moonshine stays the default - Route live partials to the streaming slot when it runs nemotron - Keep terminator probes on the small moonshine model regardless of engine

- Home Assistant: the HA pipeline and its Wyoming servers are disabled by default and kept intact for a possible future re-enable - Status: a down Home Assistant or Wyoming service is no longer reported as an issue while the pipeline is disabled - Install: the Wyoming wake-word unit is only installed when the Home Assistant pipeline is opted in - Docs: Home Assistant and phone Assist marked disabled with re-enable steps

- STT: in-recording probes now run on a dedicated moonshine instance, measured about 5x faster than the previous probe engine on short tails - STT: dictation text now appears live in the pinned pane while you speak, then the settled final replaces it - STT: the moonshine daemon gains streaming session endpoints for live partials

- STT: phone voice notes and the audio-transcribe skill now POST the STT router so they follow stt-primary instead of whisper direct

- STT: single canonical engine list in speechlayer-state.sh, consumed by the dictate gate and the router CLI so a new engine cannot go stale in one copy

- STT: moonshine-small becomes the daily-driver primary, redux stays warm as first fallback - STT: stt moonshine-size small|medium selects the model, daemon resolves config file then env - Fix: dictate paths now honor primary=moonshine in wvd_stt_post instead of falling through to whisper direct

- STT: add opt-in moonshine-medium warm engine on :7785 behind the router, redux stays default primary - STT: stt primary moonshine selects it, falls through to redux then the classic chain - Bench basis: 2.91x realtime median, 10.8% median WER vs voz refs, 5/5 noise abstains on 31 clips

Public-facing commit messages must stay short bullets with no personal names

Operating notes for the assistant's workspaces and mailbox updated with recent rulings and lessons

The multiplexer skill reference now matches the current wait-flag spelling

Progress watchers now only watch panes that actually have assigned work, so idle utility panes no longer trigger pointless nudges, while a genuinely stalled assigned pane is still caught

The watcher test battery covers the new gating and now isolates itself from the live cleanup daemon

A spoken message interrupted by dictation can no longer vanish silently; damaged queue entries are recovered where possible and a short spoken heads-up is announced when one truly cannot be replayed

A deliberate dictation keypress now stops speech within a moment instead of letting it talk over the start of dictation

Pending phone notifications are now collected and cleared from the servers in one locked step, so a freshly landed message can no longer be erased before delivery; the log moved into the state folder

Saved attachment folders and file names no longer contain sender names or addresses, so announced paths always match what is on disk

The mail connection now re-establishes itself after long idle waits instead of hanging on the next operation

Texting a pane name from the phone now sends just that one message there instead of moving the conversation's home; the home only moves on an explicit sticky command, and unknown names are refused instead of silently becoming home

The three in-place editing helpers are now thin shortcuts to their renamed successors, which the scheduler already calls directly

Removed the old-name link left over from the voice daemon rename; everything has used the current name for a while

The session handover safety test battery moved out of the auto-loaded extensions folder into a proper tests folder, where it passes and no longer loads as a live extension

The wake-word model is now kept in one canonical place with a link from the models folder, instead of two copies that could drift apart

The prompt history viewer can now limit results to a recent time window, and the prompt wall uses it to show only the last day

The gig setlist tools now point at the renamed setlist site, on desktop and phone

The speech-tuning dictionary file now ends with a standard trailing newline

The startup entry for the listening-calibration helper now launches it under its current name

The seen-changelog marker caught up with the current assistant version

Naming a pane in a spoken message keeps the conversation there

Once the message lands, follow-up speech goes to the same pane without re-addressing, until a different pane is pinned by voice or the pin heals home

'sticky <pane name>' now pins the conversation target by voice, matching the phone shortcut

Unchanged, a typed @name still diverts one message only

A spoken command matching the control grammar with a trailing cancel phrase used to deliver the full unstripped text to the routed lane

The terminator and cancel-chain strips now run before the control interceptors, so only the trimmed text is routed

A take that is only a cancel phrase still drops silently

A quoted trailing cancel in ordinary dictation stays untouched when no terminator marker fired

Dictation now answers with a newer, much faster speech recognizer first, which matched the reference wording exactly on typical clips in testing and stays quick on long recordings

If the new recognizer is ever unavailable, dictation falls back to the previous engine and then the backup server exactly as before, proven live including during a real 65-second dictation

The previous engine order remains available as an instant one-command revert

Command reference and setup notes updated for the new speech-to-text order

An overdue task alert no longer speaks out loud by default - the assistant mentions genuine stalls in its own words instead (text alerts unchanged)

Tasks waiting on a handoff now get 12 minutes before an overdue alert, up from 10

An internal research note is no longer part of the shared documents - it stays only on the machine that wrote it

The phone-speaking guide now names the laptop's actual default voice instead of two alternates

The helper-model status note no longer describes a loading step that does not exist

Reference sheets now name the current offline command helper model instead of the retired smaller one

An overdue task alert now speaks one plain sentence instead of reading internal tracking details aloud

Workspaces whose only open work is parked waiting for the owner's go-ahead no longer keep a watcher nudging about them

The morning report now lists parked items waiting for the owner's go-ahead so nothing silently stalls

Sending work straight to a worker past its workspace's coordinator now warns and is logged for review, unless an explicit flag is passed

Routing through the coordinator stays the natural path

Typing directly in a pane and voice-addressed messages are never affected by that check

Workspace progress watchers keep reporting to the workspace's own coordinator even when a higher-level coordinator sends work into that workspace

The queue-depth test battery now declares its own orch registry fixture instead of relying on fleet names baked into code, matching the per-installation role declaration contract

The simulated reboot now force-closes the session window if it survives the polite close

The relaunch can no longer leave a duplicate window that shows the workspace but ignores the keyboard

The orchestration machinery no longer carries this installation's role names in code

Orch roles, the completion-relay target, and the morning-report target are now declared per installation in config files, so the same tooling ports to other users and workflows unchanged

Closing work with a relay now refuses loudly when no relay target is declared instead of silently assuming one, and the close itself always lands safely first

The supervisor-fold spec records the portable self-enforcing hierarchy requirement (one contact pane, limited super-orchs, project orchs, workers) and maps every role declaration point

Herdr panes with no voice-map entry now speak a fleet-default voice

A reserved '*' key in pane-voices.json ends the voice lookup chain (pane id, workspace, callsign, then '*') in the pocket impl, the voice-match module, and the say-summary extension

New or unlabeled panes now speak the fleet voice mechanically, instead of needing a per-callsign entry or falling off the map

The module gains set_fleet_default, fleet_default_entry, and effective_default_voice, plus a --fleet-default flag on the voice CLI and effective-default-aware ask and reset wording in voice commands, with tests (18 pass)

A fresh unlabeled pane in a new workspace synthesized with the fleet voice, explicit callsign and workspace entries still take precedence, and outside herdr the global config is untouched

Closing tracked work can now deliver the completion message to the orchestrator in the same action (dispatch intent relay), so a reported completion can never leave the tracker showing that work as still open

The morning oversight report now flags work that looks shipped but is still marked open

The report also flags intake items sitting unstarted for over a day

The report also flags items pointing at panes that no longer exist

Each flag comes with the exact follow-up action to take, and the report never closes anything on its own

After a reboot, every workspace with open tracked work now gets its oversight watcher back automatically

Coverage is derived from the work ledger (live lane assignments, dispatch records, and client intake queues) instead of only currently attached lanes

Workspaces whose work has no lane yet, and brand-new workspaces, are covered from day one

After a reboot the wake word now recovers on its own at login; a leftover permissions rule named the old service names, so the automatic repair could not restart the listener without a password

If the wake listener ever cannot be restarted automatically, there is now a spoken alert and a critical on-screen warning instead of silence

'speechlayer status' shows the listener in red until it recovers

The wake listener no longer races the login session at boot, a race that also stalled the boot by 50 seconds

The listener now starts at login where the audio session is guaranteed, with the boot service kept as a manual fallback

The offline command-matching engine was benchmarked against a newer candidate release on the real spoken-command workloads

The current engine answered correctly more often on every test, so it stays in place

The full benchmark evidence and harness are kept with the project, so the comparison can be re-run when a better candidate appears

Phone voice notes reach the laptop again, the speech endpoint had been dropped in an earlier rewrite so every clip since October 6 was failing and queuing on the phone

Queued voice clips now resend on their own when the laptop comes back, no new recording needed first

The uploader can try a list of fallback laptop addresses in order so one broken route no longer strands recordings

Queue-depth flags now skip orchestration workspaces entirely and count only unstarted work on worker lanes

An intent with an active child downstream or held for a decision no longer counts as queued

The orchestrator registry gains the oversight lane and can be read machine-readable

Exactly-once handover follow-up, no stacked duplicates

The generated status view shows open-intent depth per lane, lanes holding two or more are flagged

The morning report flags lanes holding two or more open intents with the queued intent ids

Batch forwards can link one child dispatch to several parents, and a mis-linked parent can be re-linked after the fact

Auto-parent linking no longer depends on pane attachments, a parent with a child in the ledger can never breach

An orch can record an untracked lane handoff on close, listed in the morning report

Breach notices always name the receiving orch, an unresolvable target alerts the oversight lane instead of nudging nobody

A forced parent id is validated before the dispatch prompt goes out

Default OFF for new pi sessions

Fix(voice-route): pinned voice sticky always wins for unaddressed free-form

Dispatches to an orch lane now start awaiting-forward with a wall-clock deadline, cleared by a child dispatch or an explicit close

A deadline breach is loud, the fleet supervisor nudges the owning orch pane, notifies the oversight lane, and speaks, exactly once per breach

Intent ids quoted in close, attach, block, or parent positions are validated against the ledger, nonexistent ids are refused

The morning report lists stale awaiting-forward dispatches

Fix the divert-drop incident class + kill the per-pane CLI storm

Compaction auto-resume: tag the bump message so it cannot read as a user GO

Rename background guardians into the speechlayer- install namespace

The phone TTS HTTP service is retired: the port-30142 server, its bookmarklet page, and every pointer are gone

Deleted libexec/speechlayer-say-server and -say-server-bg, the Kokoro-over-HTTP daemon pair absent from PATH since the 2026-10-05 namespace pass

Deleted the phone-side share dir ~/.local/share/say-server (bookmarklet.js and README.md; the bookmarklet doc was the only tracked file)

Deleted libexec/speechlayer-tts-route-watchdog, whose sole purpose was keeping the Tailscale /tts route pointed at the now-retired server; it is retired under the same ruling, not renamed

References swept across ha-integration.md (component table row, relocation breadcrumbs, the whole alternative-phone-TTS section, the Tailscale URL table row, and the IP-change checklists), tts/README.md (legacy-names lists, status bullet now a retired note, say_spoken.py hook list), AGENTS.md, the supertonic README and HANDOVER (mooted phone-bookmarklet ideas), the tts/lib/say_spoken.py header, the install.sh legacy-cleanup lists, net/ha-pi-relocate.sh, and the supertonic daemon and worker doc comments

The ops logs now record the restore-or-retire pending question as RESOLVED: retired

Five May-2026 dict .bak snapshots of HOME-ASSISTANT-TO-PI.md are deleted from the worktree; they remain in git history, since editing frozen snapshots to strip the token would falsify them

A recursive grep over the repo returns zero matches outside .git, no autostart, OpenRC, crontab, or herdr hook referenced the service, and no process or listener was running at retire time

Known leftover recorded for the ops channel: the Tailscale /tts route on this node still points at the dead port 30142, because tailscale 1.98.4 mixed legacy/svc config rejected every scoped removal form tried

Removing that route safely needs care not to disturb the sibling svc: routes, so tagging the known-dead route is deliberately left as a follow-up rather than risking the live tailnet config

The bare repo could silently drift ahead of origin when a lane forgot to push or a push failed, with backlogs of 76+ revs seen historically

'speechlayer status' gains a Repository section showing the unpushed-rev count

The count comes from git rev-list --count origin/main..HEAD in the bare repo, local refs only, so it means committed-but-not-known-pushed and works offline

The line is green at 0, warns below the threshold, and goes red at or above SPEECHLAYER_PUSH_BACKLOG_ALERT (default 10)

The count is informational only and deliberately does not feed total_issues, since the remedy is a push, not a restart

SPEECHLAYER_GIT_DIR overrides the repo path as a test seam and for nonstandard installs

The orch-supervisor reconcile loop (already running on a 45 s tick) checks the count every ORCH_SUP_BACKLOG_CHECK_S (default 600 s)

At or past the threshold the supervisor speaks the count via say --bg and appends it to the ledger at ~/.local/state/speechlayer/push-backlog.log

The alert re-fires only when the count grows and re-arms below the threshold, and the state lives in tmpfs so a reboot re-arms naturally

Visibility was chosen over auto-push on purpose, because pushing publishes the public changelog via the pre-push hook, so push timing stays a deliberate per-lane act

The operator sees the backlog in status, hears the alert aloud, and finds it in the ledger and the supervisor log

A status run no longer dies right after the first failing check - 'check || ((total_issues++))' tripped set -e when total_issues was 0, cutting the Network section and the summary line; it is now a plain assignment, matching the documented restart-path idiom

A scratch bare-repo topology with 12 then 13 unpushed revs drives the real status line and the supervisor alert end to end via --once with env seams and a stubbed say (alert at 12, silence at the same count, re-alert at 13, re-armed silence after a push)

The local repo showed 0 unpushed in status, and the supervisor was restarted onto the new code through its own --ensure contract

The launch-machinery family now owns boot and login state for whisper-server and phone-mic, not just install intent

The root cause was install.sh running 'rc-update add <svc> default || true' inside the service loop; a silently-failed add (sudo credential timeout mid-loop during a rename-transition install) left the whisper-server unit installed but absent from the default runlevel

Every boot then made no start attempt and produced zero log evidence, while desk dictation survived via the voz router and per-probe warm whisper and masked the loss (burned on two consecutive boots)

A failed runlevel add now warns loudly, and a verification pass after the service loop checks that every installed unit appears in 'rc-update show default' and reports any miss by name

The session-heal contract is extended: probe http://127.0.0.1:7777/health and repair when dead

The repair tries an owned OpenRC restart first but only waits on it when it actually ran, since sudo -n fails instantly with no cached credential at login, then falls back to a user-mode start mirroring /etc/init.d/speechlayer-whisper-server with log /tmp/whisper-server.log

Session-heal re-probes and always prints the final state, so a green 'session-heal done' while :7777 is dead is impossible

The phone-mic supervisor gets the same treatment and is re-armed at login when its conf file exists; the loop is idle-safe while the phone is unreachable

Internals.md gains a Launch-Machinery Family section naming the pattern: every component needs an owner that verifies it is up after boot or login, not just an installer that once intended it (members: this runlevel drift, the voice-daemon 15 s PA race, phone-mic coupling)

The healthy path prints 'whisper-server: healthy on :7777'; :7777 was killed twice and session-heal repaired it end-to-end in about 6 s; the phone-mic supervisor re-armed on first run; the install block was simulated with a stubbed runlevel (add attempted, miss named)

The unit was added to the default runlevel by hand (rc-update needs a real password, no NOPASSWD), so the next boot starts it owned and the unit's start_pre sweeps any user-mode orphan

Vetoed terminator and held cancel matches now re-arm instead of being dropped forever

A terminator match vetoed by the sustained-energy check, or a cancel phrase held by the quiet-gap guard, used to be dropped: later quiet probes returned no text, so the phrase never re-matched and the take ran to silence, max length, or a manual stop while absorbing room conversation (live reproduction: a vetoed trailing terminator turned into a 134 s take)

A held match is now remembered with its trim position, and every later probe verdict checks the post-match audio

Once the post-match audio stays below speech level for a grace period (WVD_TERM_REARM_GRACE_S, default 1.8 s), the cut commits at the remembered point

This restores the documented intent that the cut is held only while the user is still speaking

Speech persisting or resuming inside the grace window keeps the hold, and a later fresh match supersedes the remembered one

Held cancel phrases re-arm through the same gate and keep their fire-path semantics on commit: a content-free take discards, otherwise the cancel trims like a terminator

Genuine same-probe fires with a silent tail are untouched

Ten new cases cover the gate (opens after trailing speech then quiet, stays shut on continuous speech, holds on a resume inside the window, commits on an older resume, waits below the grace, disabled at zero, shared cancel wiring, verdict-order guard), 21/21 pass, and the say-origin-gate suite stays clean

Add a launch-coupled supervisor that keeps a live orch-watcher on every workspace with open dispatch intents

Dispatch now records the dispatching pane as the workspace's orchestrator and arms that workspace's watcher immediately

The supervisor heals dead watchers including orphaned lock holders, and keeps the lane reaper alive

Restart, session heal, and the simulated reboot path nudge the watcher supervisor, and the installer lays its login entry

The loop-guard beacon v2 now carries text_chars as its own field, the visible-text count previously summed into stream_chars

The external backstop's new sig=C live-gibberish rule uses it to tell a streaming text producer from a zero-text gibberish stream

Beacons without the value omit the key entirely, which the backstop treats as ABSTAIN (never fire), so a mixed-fleet rollout is safe

Provider-cache negative caching is fixed, so empty-string lookup failures are no longer cached or treated as answers and attribution heals on the next live lookup instead of staying permanently blind

Four new cases (text_chars=0 carried, stream total preserved, text producer count, absent-key abstain contract), 68/68 pass

Spoken one-shot replies now arm only for genuine desk-voice tells, so muting a pane stays sticky when other panes relay messages to it

The degenerate-loop guard now treats a re-loop within 30 minutes of an auto-recovery as a hard stop

The pane halts with a loud spoken and visible alert instead of silently recovering into the same loop again

The window anchors on the original recovery, so the lane self-heals once a human has looked

PI_DEGEN_WATCH_MIN retunes or disables the guard

The reload acceptance check now reads the confirmation text regardless of how the terminal wraps it, so very narrow panes verify correctly instead of being retried

The reload acceptance check now matches a single wrap-safe word with a longer window, so narrow panes and slow reloads are not falsely retried

The compaction watchdog now delivers /reload and /compact as real terminal commands typed into the editor instead of RPC text prompts, so a fleet reload actually reloads instead of arriving as a plain-text message

The extension-drift sweep now waits for live edits to settle before reloading

A reload counts only when it is visibly accepted

The sweep paces itself per pass with a failure throttle

The say queue worker does not reload itself, so speechlayer must be bounced before changes to it take effect

A prompt wiped by an auto-compaction is now re-issued verbatim afterwards instead of vanishing

A lane compacted mid-work bumps itself back to life with a continue instead of sitting idle

Post-compaction resume skips only when the recorded facts prove completion (turn-end trigger, no pending prompt, no interrupted-work deferral)

Every resume decision is logged with its reason

Heuristic auto-aborts no longer tell the handover writer to discard the aborted work

The junk claim now requires a captured repeat pattern, and heuristic aborts say the output may be legitimate and must be checked first

The external loop watchdog no longer force-stops slow-but-alive long generations

A live-stream heartbeat from the in-process guard stands the frozen check down, and the frozen clock now starts at the current generation instead of before an idle gap

A message routed to a pane by voice now speaks that pane's reply once, same as an explicit tell

Saying a client pane name in misheard forms now resolves to the right name like the other known mishearings

Say-server references now point at the surviving share folder and note the binaries are off PATH pending a restore-or-retire decision

TTS helper paths updated to the namespaced libexec layout; install writes only the thin say alias and retires legacy command names

Working-directory references updated after the repo move (old speechlayer and dict paths)

Voice config references point at the namespaced config folder so edits are not silently ignored

Retired phone audio route watcher marked as history and the manual route override path documented

Dropped references to a removed shell skill and a removed voice shortcut command

Lane status discipline merged into one fleet-wide rule (status field first, idle means unverified, stale reads are false reports)

Status reads expire same turn - never assert a lane active on a stale agent_status; re-read status plus one moved artifact before any activity claim, correct false reports plainly

Recordings no longer cut mid-sentence

Terminator phrases only fire as whole commands or trailing matches, with a quiet-gap and sustained-speech veto

The silence window is raised, and transcript probes defer the energy cutoff while speech is still being heard

Take openings are no longer eaten

The wake-word ring buffer is seeded into the capture at record start, bridging the trigger-to-capture gap (worker spawn, device open)

TTS-time chunks are blanked to keep dying speech out of the take

Cancel phrases are one mechanism now

A trailing cancel (never mind, scratch that, ignore that, forget it, scrap that, strike that, disregard that) trims like a terminator at any take length, and only a content-free take is discarded, ending the whole-take loss from a single trailing phrase

Trailing cancel chains strip to a fixpoint in the dictate script, so a second cancel spoken before the fired one can no longer leak into the dispatched prompt

The transcript-silence cutoff is vetoed while speech energy arrived within the last few seconds, so a capture dropout can no longer cut a take the moment audio resumes

Per-take audio and marker snapshots are handed to the dictate script, so overlapping record and transcribe cycles no longer race on the shared scratch file, which had stripped the wrong word from one take and dispatched a bare cancel phrase from the next

Recording echo-cancel passes raw mic when the speaker monitor is recently silent and gives up faster when no echo path exists, removing take-start attenuation

The first beep of a take now fires at recording-on instead of waiting for the first periodic beep

On normal mics it plays at the loud periodic level, one clear instant signal

Measured about 13 ms from worker spawn and about 0.4 s from wake fire while speech is playing

USB webcam mics with aggressive hardware AGC keep the soft wake-beep level, since their limiter still pins a loud take-start beep and holds capture sub-floor for seconds (reproduced live)

The loud-or-soft choice is classified per take, keyed on the live default source

WVD_BEEP_VOL_FIRST overrides the first-beep volume

Take-start beeps are logged and the beep volume knobs are documented

Keep the soft wake beep at take start (AGC protection stands) but restore the periodic mid-recording beep to its audible level via a separate WVD_BEEP_VOL_REC knob

The wake-to-capture gap is bridged with a capture-start preroll seed from the always-on ring, so opening words survive worker spin-up

A quiet-mic tail guard is added

The wake beep is softened with a lower default volume and a slow attack and release, so it stops slamming the mic's hardware AGC at take start

The stale beep-mute comment is corrected

Tick sleep guard with measured pass duration so slow signature-D passes no longer read as wake jumps

Detect stranded handover follow-up wedge (signature D, loud say alert) and auto-/reload idle panes running stale extension code (pi has no extension hot-reload)

Document /say once and the addressed-tell marker

Addressed voice tells speak their reply once, then revert to say-off

Oct 7 attribution (all loops on one upstream), petri stew experiment (null result), v4 guard + v3 backstop

Degenerate-loop doc - single-char repeat class, post-loop recovery ritual, busy-pane masking fix, incident 4

'tell <sticky>' messages dropped with the not-gone-through refusal

Replayed sentences play through again without voice barge-in cancelling the rest of the replay

Bring all user-facing docs in line with the post-rename system

Archive-first reverse flow for the mate recipe (spoken confirm, dry-run, zero-dangler teardown)

Mark namespace tier-2 remainder done (generic per-phrase wake scheme, rev ddbecec); carries mate lane's pending in-progress edits

Wake training goes generic: per-phrase wakewords/<slug> instances, speechlayer-train-wakeword / speechlayer-record-wakeword

Rename voice-daemon service unit to speechlayer-voice-daemon (tier-2 D1)

Namespace the live wake path: voice daemon, bg launcher, dictate-term (final Table C rev)

Rename remaining non-daemon service units to speechlayer-* (tier-2 D2-D4)

Namespace tier-2 bulk renames in core/ and bin/ (Table C, minus daemon + live wake path)

Reconcile orch-reaper copies and rename canonical to speechlayer-orch-reaper.sh

Terminator sustained-energy veto + drop 'over' from default terminators

TTS same-group relay: one aplay carries a whole streamed reply, ending the ~1s inter-sentence dead air on live first-say

Busy-agent hardening of the compaction flow: the write injection queues or defers, never silent-cancels

Explicit prefix only, remove bare world-question auto-claim

Write-first hardening of the compaction flow: the handover write is inline step 1, not a stage

One more misheard form of a client name is corrected (the project name)

Reverse auto-compaction to a single 100k write-then-compact point

Evict by group, never split a multi-chunk reply

Remove the presynth staging path from the say queue

'hi mate' and 'height mate' also resolve to hypemate (fast-speech transcription safety)

Say backpressure + presynth gate: long combined summaries no longer drop sentences or stall a minute

Add two-stage early-handover compaction to the pi zoomer-compaction extension

Quicksearch weather speaks both Celsius and Fahrenheit (template conversion, no extra API call); also drops the stale index entry that recorded the file at the wrong repo path in 39a643d

Namespace TTS/dispatch helpers under speechlayer- and vendor the dispatch engine

Quicksearch weather: speak temperature in both Celsius and Fahrenheit

Fix the empty harvest digest on active closes in orch-reaper

Completion_gate ran in a command-substitution subshell, so SUMMARY_TEXT never reached the close path

The gate now exports the summary through a disk side channel (SUMMARY_FILE) and the harvest reads that

Verified end-to-end on a sacrificial lane, with the closures.log row carrying the full completion line

Orch-reaper v4 turns on active auto-close (standing directive: purges built in, not one-off)

REAPER_ACTIVE=1 graduates the fleet observer to closing candidate lanes for real via herdr pane close

Every close is harvest-logged first, with the session path and a 300-char summary digest in closures.log, so outcomes survive the pane

The safe-to-close gates are unchanged: idle clock, completion summary plus rev/artifact, clean cwd, the orch, focused, and own-pane exclusions, and the standing and held marks

Any doubt still means keep

The morning report now lists what was closed plus borderline would-close cases

REAPER_ACTIVE_ENV overrides the config for supervised runs

The mate and housemate owner panes were marked standing before activation

Fix balance panes (and other focused-pane commands) acting on a workspace's first tab instead of its active tab

The OpenRC loop now cleans up the legacy openwakeword unit, guarded

After the 2bffe27 unit rename, /etc/init.d/wyoming-openwakeword is removed from all runlevels only when it still exists and carries our provenance marker (it references the speechlayer oww server script)

This keeps a stale boot entry from ever double-starting beside speechlayer-wyoming-openwakeword

The unit file itself is left in place, and the cleanup is a no-op when the unit is absent (verified absent on the only install)

Add the mate recipe: speechlayer mate new/teardown/list + voice 'make me a <name>'

The README gains a Namespace section for the TTS rollout, covering 'speechlayer say' plus the PATH alias, the ~/.config/speechlayer config home with legacy fallback, and the SPEECHLAYER_* env twins

The AGENTS.md TTS paragraph now matches

Say joins the CLI namespace as 'speechlayer say'

The TTS router stays at tts/bin/say and the CLI execs it in-process

The PATH 'say' becomes a thin alias (exec speechlayer say) installed by install.sh instead of the full binary

The remaining say-* helper names are untouched

The pocket checks now read tts-default via the namespaced config resolver

Rename whisper wrappers to speechlayer-whisper-cli / -whisper-server

SPEECHLAYER_SAY_*, SPEECHLAYER_ST_*, and SPEECHLAYER_TTS_* now override the legacy unprefixed knobs

One generic suffix-preserving mapping loop runs at the say, queue-daemon, and pocket-impl entry points

Legacy SAY_MODE, ST_VOICE, TTS_ENGINE and friends keep working, and the new prefix wins on conflict

Say-server maps the variables too

Rename OpenRC homeassistant + wyoming-* units to speechlayer- prefixed

Say-*, tts-* and kokoro-voice settings now read from ~/.config/speechlayer/ first, with the legacy ~/.config/<name> path as fallback

Fresh writes land in the namespaced location

One shared resolver idiom covers the say router, queue daemon, replay lib, duck, phone-play, say-server, engine toggles, and voice pickers

Existing values are migrated and the legacy files stay in place as inert fallback

No behavior change

Move wvd-terminator live toggle under ~/.config/speechlayer/

Fetch-deps now downloads ggml-tiny.en.bin alongside the router model

The wake daemon's dedicated terminator-probe server (:7784) has defaulted to tiny.en since the probe-model switch, but fresh installs only fetched base.en

The probe spawn then hit the model-missing branch and probes silently stayed on the shared router

Both models are now fetched with skip-if-present idempotency, --force applies to both, and the fetch is deduped when --model tiny.en is passed

Presynth generations whose client already disconnected are now skipped

Right after the priority lock grants the engine, the lowprio file-request socket is peeked for liveness, and a clean EOF or reset means the client is gone

A presynth whose client gave up while queued behind live traffic no longer burns a full generation and dies on EPIPE (about 2.5% of file generations measured)

Live-path and high-priority behavior is unchanged

Default to tiny.en, 2x faster terminator probes at equal accuracy

Run the intent sweep before every view render (status, post-dispatch, post-mutation) so the generated in-progress view is always post-sweep; engine side lives in the dispatch-engine repo

The housemate seed is broadened to the full personal layer, the house domain plus the personal-assistant remit (money, schedule, music, family, errands)

Standing personal panes stay in place and migrate into its remit lazily

The installer now scaffolds the minimal herdr shape for the workmate and housemate workspace split

It creates the two workspaces with one pre-seated owner pane each

Everything else (sub-orchestrators, watchers, workers) stays lazy until needed

The boss role is renamed to workmate, with every scripted reference swept across the ops rulebook, the watcher and reaper tooling, the voice-side respell and service maps, the say-summary defaults, the nopoll-guard fixtures, and the docs

No alias is retained

Heartbeat and arm keying now follows the workspace label (/tmp/orch-hb-workmate)

The parallel housemate home-domain pane contract is seeded

Presynth next queued job during playback, engine-aware ride

The ops rulebooks now dispatch through 'speechlayer dispatch' everywhere and the dsend references are gone

The in-progress section is now a pointer to the generated tracker view ('speechlayer dispatch status' writes ~/.local/share/dispatch-engine/in-progress.md) instead of hand-maintained bullets

The orch contract's load-bearing-list rule now cites the mechanical write/strike path

Shipping scrub - split gitignored ops/local personal layer, genericize names/clients/dates/paths in the shipped ops docs, watcher script comments only (logic untouched)

Fail loud when terminator probes error, never confuse error with silence

The dispatch in-progress list is now a generated view over the intent tracker, not hand-maintained prose

'dispatch status' renders ~/.local/share/dispatch-engine/in-progress.md, and every dispatch or close refreshes it

Intent close gains --rev, so completion evidence (summary plus rev/artifact) strikes the line with proof attached

Drop the dsend shim entirely: speechlayer dispatch is now the single dispatch surface (the engine subcommand dispatch-engine send stays for the daemon); index it in the quick commands

New 'speechlayer dispatch' is the one fleet command for handing out work, and it always opens and attaches a tracked intent (dispatch engine underneath)

Subcommands are <callsign> <task>, intent <open|list|block|unblock|close|attach|detach>, and wavefront

Bare herdr agent prompt bypasses attribution and is no longer the documented dispatch path

Serve on kimi-k3:online via OpenRouter, remove Octen entirely

Terminator probes now run on a dedicated whisper server, spawned with --tmp-dir and a status-checked warm-up

Probe windows are contiguous with byte overlap, and stacked cancels are discarded

Probes had silently returned empty because the FFmpeg conversion failed with CWD=/, so a spoken thanks, over, or shot never cut the take and recordings ran to the 60 s max

Pocket streaming shares one atempo pipeline per job at non-1.0 rates

Fix talk-over deafness during TTS in the wake recording path

Quick-question lane: make deepseek-v4.1-flash primary (current openrouter rankings leader), gemini-2.5-flash demoted to fallback after re-benchmark against current-generation fast models

New quick-question lane, a spoken 'quick question <q>' bypasses the panes

It asks a fast cloud model with thinking off (gemini-2.5-flash primary, deepseek-v4.1-flash fallback)

The short answer is spoken via say, about 5 s typical from end of speech to first audio

Say --set-speed / --clear-speed manage the persistent rate, status names the source

Pocket daemon logs mid-stream client loss as a benign abort, not 'stream fail'

TTS privacy audit report (data-flow inventory of say/queue/replay-ring capture points)

Say --speed + ~/.config/say-speed playback-rate control, pitch-preserving on all engines

Commit the live demo recorder tooling (was uncommitted scratch at speechlayer-demo/)

Quick-search answers by voice only; pane note injection off by default

Require a quiet gap before a trailing cancel phrase

Broaden leak detection to 43 rules and harden the demo

Move the secrets guard prototype fully under the speechlayer namespace

Vaultguard naming note for publish

Vaultguard env sweep admission gates

Orch-reaper v3, dry-run observer (closes nothing)

Vaultguard secrets guard-rail prototype (Option B)

Add orch-reaper, per-workspace finished-lane cleanup daemon

Structural bash parsing kills quoted-text false positives, plus unrolled-poll counter and classifier tie-breaker

Freeze on TTS-time audio instead of counting it quiet

Auto-load an on-disk handover at session start so /new can never orphan it; .loaded mtime sentinel prevents re-load loops, clear removes both

Add --stop-pane, a pane-scoped hard stop so /say off on one pane cannot drain or cut another pane's queued speech

Fix spec_age_ms log field mixing monotonic and wall clocks

Wake-command silence: live ambient tracker raises the energy threshold in loud rooms (smoothed level, slow rise, fast decay, never below calibrated base, no profile training while raised)

Pseudo-stream speculative decode + voz gain-retry (bench PASS, live-integration verified)

Fix wake-command silence submit: audio-time silence, off-thread probes, TTS-time audio dropped from command capture, unclamped adaptive threshold, short voz deadline for probes

Offline benches for pseudo-stream, gain-retry, nice

STT engine shootout on desert corpus: Moonshine, voz-int8, sherpa Zipformer2

Deeper, dated answers

Voice sticky toggle (sticky off/on/status) so free-form goes through the pane router only; spoken routing cue when the router decides

Make the quick-search sticky-pane note a toggle, default on

Make handover files per-pane: HANDOVER-<pane-key>.md under the resolved dir

Fix handover walk-up clobbering a container root's handover from worker panes

Document the voice hand-over ritual and cancel-probe toggle in the agent index

Add voice "hand over" ritual: full pi session handover in the sticky pane, zero typing

Add TTS cancel-probe: in-memory probe takes catch quiet talk-over below the echo floor

Sync the sensitive barge detent with the user-approved post-calibration sensitivity raise so a preset flip cannot revert it

Mangled barge-intent phrases are caught in the transform before pane routing

Word order and conservative command-shaped misspellings are canonicalised toward the known barge commands

The whole-utterance matcher gates the rewrite so ordinary prose stays untouched

The canonical orderings instant-cut as before

Repoint the sensitive barge preset loopback overlay onto the calibrated profile so the detent no longer restores the pre-calibration fire floor that made talk-over unreachable

New quick search intent, an explicit spoken prefix gets an Octen-backed spoken answer in about 8-10 seconds with a cited note left in the sticky pane

World questions the router abstains on get the same treatment via a pseudo-callsign

The feature is a self-contained plug-in behind a flag file, with zero added latency on other voice paths

Raise the router voz deadline cap from 45s to 120s

Dictation can no longer vanish silently

Paste delivery now verifies the clipboard and falls back to keystroke typing

The clipboard-restore race that pasted stale or empty content on slow targets is fixed with a length-scaled delay

Engine failures now fall through to the whisper shadow and announce themselves audibly, with the audio preserved

An empty-error transcription body is no longer accepted as a valid result

Run daemon recording probes on voz via the router; whisper-server no longer required

Add needle load-artifact retest, accuracy reproduces bit-for-bit at low load (0.266 = real, not a crush artifact)

Default the whisper comparison shadow to off; CPU lightness is the priority

Make voz-primary speech-to-text the standing default and record the decision

Barge calibration now forces full volume on test injections, because a stale ducked playback volume silently shrank them about 6x, so talk-over levels never reached the mic and the solver gave up

The live fire check now runs on dry runs too, so a plain calibrate run proves the daemon still barges

Wake word barge-in is a hard stop again: say is killed instantly on wake, not soft-skipped

Add per-request shadow mode switch to the voz speech-to-text router (on, after, off)

Shared sleep_guard so no scheduled job fires paid work on an expired reason

Uhm filler-span detector for dictation strip - verdict REJECT

Below-gate utterances route to a default pane, exist-or-spawn

Make voz the primary speech-to-text engine with whisper as live shadow and fallback

Schemer (desert-ant-labs ONNX extractor) vs fresh jev on frozen routing dataset

Add voz run logs referenced by the report (run 1 was foreground, its data is in results-run1.json)

Desert-ant-labs voz against the production whisper-server (base.en), a faithful CPU port of the vendor TDT pipeline

33-item corpus (librispeech, espeak commands, and real mic capture), 3 runs

Voz wins on accuracy: librispeech WER 0.048 vs 0.14-0.16, espeak 0.059 vs 0.319, real-mic transcripts identical

Voz also wins on speed (median 2.21x realtime, p50 RTF 1.46 vs 3.53 min-of-3) and adds word-level timestamps the server lacks

The verdict is adopt via a shadow trial

Add headless pi tokens-per-second shootout script

Paste the finished transcript instead of keystroke replay

Desert-ant-labs clear denoise as whisper front-end - REJECT

RLCD parallel-decision local arm vs frozen router dataset

Fix free-form capture regression, gate follow-up inheritance

Jev backend live, follow-up context in jev state

Add jev backend to pane router plus frozen-transcript shootout harness

Permanently drop auto-compaction announcements in say

Scrub inline email addresses, point credentials to logins.md

Tell slash-target routing (ws/<pane>) now resolves the pane strictly inside the named workspace instead of scanning the global inventory

The pending-create offer opens only when nothing in that workspace matches, and it offers just the pane part, not a flattened ws/<pane> name

Non-slash addressed tells are unchanged

Diarization speaker-preview sampling no longer clips from the opening crosstalk

Picks skip the first 30 s and spread across time buckets

Picks prefer single-speaker non-overlapping segments

When no clean segment exists, a tiered fallback takes the best low-overlap window

A synthetic-timeline suite covers the preview selection rules (skip zone, spread, overlap preference, fallbacks, clip length)

Follow PA default source, newest plugged-in mic wins

Commit messages must never name panes, callsigns, or clients - subjects and bodies are public via the speechlayer.com changelog, so use <pane> and generic wording instead

Document boss-pane task handoff routing in the mailbox AGENTS.md

The bounce worker is hardened for set -e plus pipefail

A grep with no match inside command-substitution assignments (Exec line parse, workspace count) could abort the detached worker before verification and the orch/boss report

New 'speechlayer kill' takes the whole herdr fleet down in order

The order is helper daemons (orch-watcher, callsign-sync, pane-healer, fanfare, keys-guard, compaction-guard), then stray pi processes with the own ancestor chain excluded, then the speechlayer window, then 'herdr server stop' last since it kills every pane PTY

The voice stack (whisper-voice-daemon, say/TTS, OpenRC services) is deliberately untouched

Verified that no cron, OpenRC, or watchdog respawns the fleet, so it stays down until the Desktop shortcut or speechlayer-session-open reopens it

New 'speechlayer bounce' is a full simulated reboot

Bounce snapshots pre-state, then a setsid+nohup fully-detached bounce-worker (stdio to /dev/null) kills the fleet

The worker re-runs the exact XDG autostart Exec lines (herdr-server, callsign-sync, fanfare, keys-guard, pane-healer, compaction-guard, session-open, %-codes expanded, Hidden/disabled skipped), so restart and reboot can never drift apart

Bounce then verifies herdr status green plus helpers plus the window, logs to /tmp/speechlayer-bounce.log, and reports the result to the orch and boss agents with retry

README and AGENTS now warn never to pkill speechlayer processes, since that half-kills the voice stack and leaves the fleet running; use 'speechlayer kill' or 'speechlayer bounce' instead

Say-pocket-impl aplay gets a deep ring buffer (--buffer-time, PK_APLAY_BUFFER_US default 500 ms), so CPU storms cannot starve playback into jitter between scheduler slices

Cpulimit is added to PKGS_CORE as the hard duty-cycle cap behind training/selfthrottle.py, and INSTALL.md documents the self-throttle stack

The llm() gguf picker now uses find -printf plus sort instead of ls -t (mtime order across both dirs)

Per-channel message origin breakdown from pi session logs

Voice-barge playback-start grace (~1.1s) so a wake word spoken as say begins cannot kill it

Fix cross-project reply leak (turn binding + resolution gate + mailbox handoff)

Training and generation scripts now self-throttle with a hard CPU duty-cycle cap

Selfthrottle.py spawns a sibling 'cpulimit -l <TRAIN_CPU_CAP|30> -p <self>' before nice and pinning

Nice 15 plus core pinning alone still let 3 pinned gen_samples.py processes hold load over 20 and jitter speech playback (live retest 2026-09-04)

SIGSTOP/SIGCONT throttling composes with nice and affinity because it is orthogonal to scheduler priority

The self-spawned cpulimit must never get -i (include-children), since cpulimit is a child of its own target and -i makes it SIGSTOP itself, parking the target in state T forever

The -i gotcha is verified and documented in selfthrottle.py and the ops manual

Nice-guard now also spawns a cpulimit at NICE_GUARD_CPU_CAP percent (default 30, 0 disables) on discovered training-class pythons that did not self-cap, belt and suspenders

Processes already carrying a cpulimit are detected by cmdline probe and skipped, so two cyclers never compound on one pid

A burner at cap 30 holds about 29-31% and TRAIN_CPU_CAP=50 holds about 47-52%, with nice 15, pinning, and thread caps all applied

Duplicate-tag flock still refuses with exit 1, per-shard locks still coexist, TRAIN_ALLOW_MULTI=1 still bypasses, and real gen_samples.py launches show the cap and cpulimit pid in the banner

The TTS CPU Protection and tts/README CPU priority sections describe the cap layer, the TRAIN_CPU_CAP and NICE_GUARD_CPU_CAP knobs, and the -i self-stop gotcha

Broken-pane session recovery procedure (boss touch-loop incident 2026-09-04)

Addressed 'tell <pane> stop talking / be quiet / shut up' now toggles /say off on that pane immediately - addressing the pane by name is the consent, so no yes/no question is asked

Addressed 'tell <pane> start talking / speak up' toggles /say on immediately

Both acknowledgements state how to reverse it ('<pane> muted, say tell <pane> start talking to unmute' / '<pane> unmuted, say tell <pane> stop talking to mute')

STT-mangled toggle phrases ('stop talk', 'stop talk start talking again') now match the toggle intent instead of being delivered to the pane as chat text

The yes/no confirmation pattern stays available for other flows - it is no longer wired into this toggle

Permanent fix for speech CPU starvation: training and generation scripts self-throttle at launch via training/selfthrottle.py

The throttle is nice 15, pinning to cores 0..nproc-3 leaving two audio cores, OMP/BLAS thread caps, and a per-shard single-instance flock, wired into gen_samples.py, train-hey-speechlayer.py, and train-kapish.py before any heavy import

Nice-guard moved into the repo as core/nice-guard.sh, with ~/.local/bin/nice-guard now a symlink and autostart unchanged

Nice-guard now also renices and pins tts312 and wakeword-train venv pythons and the speechlayer training scripts

Say-pocket-daemon self-applies nice -10 at startup via the new root helper system/linux/speechlayer-audio-rt plus a sudoers rule (sudo system/linux/install-audio-rt.sh once), with a graceful logged fallback to nice 0 without it, and fix_pocket_tts re-applies it on speechlayer restart

The nice-guard watchdog renices the top unprotected CPU hogs to +15 (training class also pinned) whenever load exceeds nproc-1 while the say queue is active

The TTS CPU Protection and tts/README CPU priority sections cover the stack

An addressed 'tell <pane> stop talking / be quiet / shut up' offer now re-opens the mic for the answer, instead of leaving the daemon deaf until the offer TTL expired

Every yes/no confirmation now times out after eight seconds of silence only and defaults to no

Any real speech resets the confirmation window

A spoken yes or no is consumed by the pending confirmation gate and is never typed into the pane as a chat message

Whisper hallucinating 'yes' or 'music playing' from a quiet room no longer confirms the mute

Noise probes never early-cut

A whole-probe gate plus a silence-anchor buffer trim keep the fiction out of the transcript

A low-confidence sidecar lets the gate refuse a shaky match

Internals documents the reusable yes/no spoken confirmation pattern so other flows (spawn-offer, pane-close) can adopt it

Per-pane 'stop talking' now confirms before muting, and the discriminant is whether the pane was addressed by name

Bare shut up, stop talking, or be quiet keeps the existing global soft cut, no question, no state change

An addressed 'tell <pane> stop talking / be quiet / shut up' barges the current say with the short offer 'Tell <pane> not to respond verbally from now on?' and waits for yes or no

Yes runs /say off on the addressed pane for a persistent mute, while no or TTL expiry changes nothing

'tell <pane> start talking / speak up' runs /say on directly with no confirm

The say-off consent reuses the spawn-offer pending state (kind=say_off on the shared file, pane_id pinned)

The yes or no is resolved against the offer and never parsed as a fresh tell

The arm timestamp is persisted, so the spoken answer lands in a separate daemon process

The legacy spawn-offer schema is unchanged for the phone bridge

Add a callsign respell to the user respell dictionary

Privacy index never seeds English function words as names (From: The client-site no longer masks every 'the' thread-wide)

Stopword-class tokens are never replaced at masking time, whatever a legacy store entry says

Load-time migration purges seeded names whose token is a stopword or NEVER word and evicts their orphaned fakes (live store: 1 entry cleaned, name:the)

Migrate CLI command rewrites the store and reports the purge count

The client-site seeds surname only, a sentence of pure function words masks nothing, legacy store with name:the migrates clean

Early-cut no longer fires on a structured tell, so a comma or other separator from a mid-sentence breath pause keeps listening instead of stopping the recording (the 'read me out' cut)

The silence and speech threshold is now learned per mic source from whisper probe verdicts (WVD_ADAPTIVE_THRESH, default on), so quiet laptop-mic speech is no longer invisible to every energy guard

The learned threshold is clamped between a small floor and the old fixed 150

The threshold persists per mic source

It feeds the silence wall, its recheck, both trailing-pause guards, and the transcript-silence energy guard

The internals env table documents the adaptive threshold knobs

Respell a misheard client product name in the proper-nouns dictionary

Respell pain to pane unconditionally (Whisper mishear in herdr context; real-word tradeoff accepted)

Extract terminator probe into named configurable strategy (WVD_TERM_MATCH_MODE, default trailing - no behavior change)

Silence auto-stop docs now match the 8 s WVD_SILENCE_S code default (was documented as 30 s in wake-words, internals, README, speechlayer)

SpeechLayer mic-route keeps pinned Shokz USB through standby instead of falling back to the laptop internal mic

Sticky USB pin written on ensure, wiped only on true USB disconnect (card gone), re-picked on USB reappear

Speech Layer-mix.sh mic_source now prefers the sticky USB source while its card is still listed

Render correct favicon.svg (blue bubble + waveform) at 180x180, transparent

Flood-fill only outside bubble, keep white shirt glyph intact

Also install speechlayer.png to hicolor when writing desktop shortcut

Install icon to hicolor + reference by name (survives DE icon-cache reloads)

Add speechlayer-session-open to symlink set (repairs bin targets after renames)

No-op idempotent re-link for pre-existing targets

Transparent PNG background (only bubble opaque)

Mark ~/Desktop shortcut as trusted (no more Unrusted application launcher prompt)

Write ~/Desktop/Speech Layer.desktop with favicon icon (no more broken pi-surf-session-open)

Favicon assets vendored under assets/favicon/ for desktop + web parity

Wake word renamed to hey_speechlayer.onnx (was hey_marvin_v0.1)

Friendly labels in notifications (no raw model names or scores)

Personal speechlayer=speechlayer alias

Os-adapters leftover identifier

Rename leftover speechlayer identifiers in live docs

Rebrand speechlayer -> speechlayer: tree move, identifiers, paths

Rename pi-surf family to speechlayer/surfagent; drop surfagent force-loading

Wharton now respells to speechlayer in all STT entry points (wharton → speechlayer)

The service-pane registry, spawn wrapper, and scaffold are live - code owns routing and never-do gates, prose owns domain behavior - and mailbox is migrated as the first citizen

Voice say-that-again now falls back to the pane text store when the audio ring is empty

The say queue daemon no longer lets a leaked SAY_TAG from its launching shell suppress all replay capture

Voice routing now asks nemotron instead of ling, and a leftover kimi pin in the environment was brought in line with it

The hey-speechlayer voice window now opens as speechlayer instead of pi-surf, and everything that looks for the window by name was updated to match

A pasted clipboard image path can no longer end up in the window title

Revert "- [x] Rename: The hey-speechlayer voice window now opens as speechlayer instead of pi-surf, and everything that looks for the window by name was updated to match"

The hey-speechlayer voice window now opens as speechlayer instead of pi-surf, and everything that looks for the window by name was updated to match

A pasted clipboard image path can no longer end up in the window title

The voice status and restart readouts now say speech layer instead of voice infrastructure

Voice barge-in no longer loops a replayed sentence, the replay plays through unless you stop it

Replay now sets a marker while a re-spoken clip is on the speaker so the barge-in detector leaves it alone

Voice commands like say that again and say off no longer get typed into a pane as chat text, they run the speech control and answer aloud

Replayed speech no longer interrupts itself in a loop when you talk over it

The spoken repeat command now fires even when a source tag is attached

Saying 'say that again' with a trailing origin tag (the '[voice]' the inject path adds, or the phone '[xmpp]' and '[email]' tags) left a stray trailing word after the brackets were stripped, which broke the whole-utterance match, so the repeat never happened and the words were typed as prose

The same fragility hit every whole-utterance voice command (new/delete/compact session, shift-tab, thinking level, clear)

The transform now strips a trailing voice, email, or xmpp tag word before matching commands

Real command words are left alone, so 'close pane', 'cycle thinking', and 'new voice' still work

'say that again [voice]' now triggers the repeat, and 'please say that again for me [voice]' still passes through as prose

Barging in during a spoken agent summary now stops the whole readout, not just the playing sentence

The energy and wake barge-in was wired to say --skip, which cut only the playing sentence and left the rest of the summary queued

It now uses say --skip-group, which also drops the still-queued sentences that share the playing summary's group

Other panes' queued speech is untouched, and an ungrouped utterance still just skips the current sentence

Hard shut-up (say --stop) is unchanged

The rewrite leg moves to inclusionai/ling-3.0-flash, the same model as the pane router, so both cloud paths share one model

The reasoning-off gate in _post_chat now covers ling too; it was nemotron-only

With reasoning effort none, ling matches nemotron on rewrite quality; without the gate, ling returns NONE

Reasoning effort stays none

The revert path is SL_REWRITE_MODEL=nvidia/nemotron-3-nano-30b-a3b

The router cloud leg swaps nemotron for inclusionai/ling-3.0-flash

Reasoning effort none and max_tokens 8 are mandatory, since thinking-on returns empty replies

The needle POST shape (query/panes) was already correct and needed no fix

The rewrite-model comment in wvd-herdr-control now notes that the router diverged

The revert path is SL_ROUTER_MODEL=nvidia/nemotron-3-nano-30b-a3b

Stale .bak copies next to the live dictate and herdr scripts are removed

The whisper-server model is now overridable via WHISPER_MODEL (default ggml-base.en.bin) instead of a hardcoded path

The WHDISPER_MODEL typo in the ops manual is fixed

Keep HTML email links so the LLM sees the actual URLs.

Local first, one cloud model, no more wrong-pane injections.

Reminders no longer talk over Speech Layer: one speech queue, and the ding waits its turn.

Stop cutting mid-sentence on "tell my browser" and trailing please.

Whisper-voice-daemon: recheck recent audio before silence wall-timeout cuts (fix mid-sentence cut-outs under CPU load); load canonical cancel phrases from speechlayer_cancel_phrases.py

When the phone and the headset both hear the same sentence, only one message reaches a chat pane

Near-duplicate repeats within 90 seconds are dropped

Short replies like yes or Resume always still go through

Needle 2, a tiny on-device command model, tidies misheard voice commands (like 'even those out' becoming 'balance panes') with no internet call

The wake-word mic now follows whichever microphone is selected in sound settings, including headset plug and unplug, instead of staying stuck on the old one

If you start talking while a reply is playing, it pauses and finishes after you stop

Replies never start over an open mic, and stop or skip still cut through right away

The public changelog page now refreshes itself on every push, so it can no longer fall behind the real history

Every queued play re-checks the current speaker so headset and laptop no longer swap mid-burst

The play log now notes which speaker was used, so a future mix-up is one search away

Raise wake-record hard cap from 40s to 60s (SL_RECORD_S)

Pi compaction-freeze guard: watchdog daemon + install wiring

Saying 'barge in' before a message now interrupts a busy pane (Esc) and submits fresh instead of queueing as a steer

It works after a callsign, as in 'tell features barge in ...', and after a workspace route

It never triggers on a mid-sentence 'barged in'

Say again now speaks on panes whose replies were never read out loud

Add 'speechlayer calibrate stop' - cancel an in-flight barge battery (SIGINT, SIGTERM after 3s); watcher untouched

Fix 'running but no state file' race + set -e mid-restart abort

Stop mid-sentence cutoffs (root-cause + hardening)

Spoken replies are kept as short audio clips, so say --replay and /say again play back exactly what you heard instead of generating it again

Keeping those clips is off by default and only starts once you turn it on, it never keeps more than five, and each pane only replays its own messages

Asking for a replay cuts whatever is playing and clears your own backlog, while other panes keep their queued messages and play right after

The talking queue, the always-ready pocket voice, and the skip-what-is-playing hotkey script now ship with the repo so a fresh install gets the whole setup

/say again replays your pane's last answers, and each workspace can have its own voice or stay muted

Wifi watchdog only nudges saved networks, never when wifi is already up, so phantom password popups stop

Voice commands now catch plural mis-hearings of a client name and fix them

Personal API keys (BYOK) now covered in README, INSTALL, speechlayer and AGENTS

Listen mode explains always-listen at boot and how talking over the agent becomes the next turn

Portability table lists the personal-keys file alongside the other per-machine settings

Add the Needle page that AGENTS.md already pointed to

Sensitive mode now pulls talk-over loopback knobs from one list

Residual floor can go up to 80k so big calibrations are not clamped away

Workspace voice map plus per-voice gain file after pane resolve

File export bakes gain so soft voices stay leveled off-play

Pocket engine through the warm daemon for phone TTS

Xmpp inject uses herdr agent prompt (atomic submit) with pane send-text plus Enter as fallback

Multi-step marker sequences paste via pane send-text since agent send is gone

Sticky default heals from the legacy default to herdr and auto-spins the my workspace home lane when it is missing

Ensure_agent_lane creates workspace, splits pane, and starts the pi agent for a callsign

Wait_idle requires a busy sighting or sustained idle so a mid-retry spinner never becomes the emailed reply

Screen scrape drops spinner glyphs, retry countdowns, error toasts, and the pi status bar

Reply comes from the session log and keeps waiting while the agent is still busy

Xmpp-outbox-drain pulls per-site commit outboxes over ssh and fans out to xmpp, ntfy, or webpush recipients

Drain restores curly quotes mangled into U+XXXX placeholders, raw JSON escapes, and common HTML entities

Xmpp-pi-bridge-ensure idempotent supervisor refreshes the D-Bus address and heals the pidfile

Xmpp-send-file sends attachments encrypted with XEP-0454 so the phone shows them inline

Per-directory project keys in keys.json with longest-prefix path match

Project key beats user default, then env, then bashrc per request

Speech Layer keys projects, emit, import-pi-sh, and --path/--cwd flags

Settings page lists project overrides and can save or remove them

Herder and listen treat project keys as personal on 401

Openrouter resolve reports project source via resolve_key_info

Brand import path in listen-intent so product name lookup does not crash

Peel doubled tell verb after respell so callsign still parses

README, AGENTS, INSTALL, speechlayer plus keys.json.example cover project keys

Pane rename comment matches agent prompt (send is gone)

Sticky only re-pins on a real focus edge so background tell keeps its target

Prefer unique agent name over duplicate pane label for sticky inject

Herdr docs use agent prompt, pane-first start, and barge-in stop order

Steering keeps open work; surfagent claim leases; agent prompt for phone inject

Install renders desktop Names and paths from product name and CLI name

Dual CLI symlink when the public name differs, keep speechlayer forever

Launchd Label prefix is data, templates stay com.speechlayer on disk

Mix sink name is MIX_SINK with speechlayer_mix default across audio helpers

Web templates plus render-brand write Speech Layer by default, speechlayer overlay ready

One runtime brand layer so Speech Layer and public speechlayer share one tree

Defaults stay Speech Layer (wake, config dir, URLs, spoken prompts) with fail-safe fallback

High-traffic surfaces read product name, wake phrase, and app name from the brand file/env

Speech Layer brand dumps the resolved values; inventory lists what still needs a wake-model choice

Per-user LLM provider keys in ~/.config/speechlayer/keys.json (600), user key beats server env key per request

Core/speechlayer_keys.py shared store + masked display + cheap key validation + auth-failure surfacing (marker + notify, never silent server billing)

Speech Layer keys status|set|clear|test|ui plus localhost :7782 settings web page (provider selector, password input, save/test/clear)

Wvd-herdr-control and wvd-listen-intent resolve OpenRouter keys via the BYOK store with strangler-safe env fallback

README BYOK section; install.sh warns with the speechlayer keys alternative

Resolve panes on non-active tabs of a workspace

Herdr 0.7.5 dropped agent send; inject path now uses agent prompt

AGENTS.md and wake-words herder-route notes match the new CLI

Stop treating bare 10/11-digit runs as phones

Drop postal code masking entirely

Speech Layer restart now revives a dead email-pi-bridge via email-pi-bridge-ensure (best-effort, cron remains primary supervisor)

Footer and logs count distinct identities, not hits

Shield and unshield phone XMPP sticky injects and replies

Shared store with email bridge and kill-switch XMPP_PRIVACY

Count shield replacements per message and log them

Tell agents that fake tokens are stand-ins to quote as-is

Footer replies with what Speech Layer shielded during LLM calls

Herd residual body verbs ask which pane, never spawn to or two

Fix client-site-two bug: body_starter includes to/too/two; herd-default routing for workspace-matched tells; block function-word callsigns.

Wake poke, CLI fast path, dead-air slimming, hold presynth

Install committed say/say-queue-daemon (wake.fifo 8ms claim, same-group ordering, recording-hold presynth, 40ms enqueue)

Hands-free auto-calibration battery + daemon self-barge detector

Spoken-prep leading-zero trim (PI-000018 -> PI-18); README: wake.fifo/same-group/presynth queue docs

Glue 'tilda/tilde slash foo' to ~/foo before flat pairs

Mask bare and keyword-anchored phone numbers with NANP validation

Mask payment cards, tax ids, and Canadian postal codes with stable fakes

Mask emails and phones to stable short fakes before prompts reach the LLM and restore them on replies

Seed names from mail headers and body anchors with separate first and last fakes

Shield injected prompts and unshield replies with a shared locked-down lookup file

Ask which pane when duplicate labels span workspaces

Silent deciders sticky then focused herd then unique agent name

Share the which-pane question and answer across voice and text

Mute or unmute the default sink with switch volume and goodnight phrases

Set Pocket voice across a whole workspace or a named pane

Queue by default, pane-scoped replay ring, and soft barge gating

Reconcile Pocket daemon pile-ups and durable HF cache on restart

Keep XMPP channel sticky separate from voice sticky and focus

Allow duplicate pane labels and keep agent names unique

Stop bare thinking words cutting mid-sentence dictation

Drop dead svn commit historical map note

Speak xmpp as x m p p

Currency, paths, URLs, emails, dates, emoji in speak-prep

Log respell diffs for training when raw ≠ fixed

Absorb trailing dots on a.m./p.m. clock forms

Fix a.m./p.m. trailing period after clock expand

Speak clock times without colon (14:30, 3pm)

Space month abbr expansions so Oct.17 reads clean

Month abbreviations speak as full names

Client-site-class fusions respelled as tell client-site

Degrees, ops, %, #N, units, e.g., cwd

Speak-prep dict (~ → roughly; digit.digit → point)

Successful tell no longer dual-dispatches into the focused pane

Mark tell committed before TTS; fire-and-forget say

Wall after commit counts handled; refuse tell-shaped fallthrough with voice retry

Free-form pi-surf prefers sticky pin over focused eyes

Evolve proper-nouns into a respell dictionary (pie/pi, user JSON)

Delete pi session runs /delete and confirms Yes

Agent inject keeps multi-Enter sleep order for confirms

Eyes/focus on also raises the herdr pi-surf window

Focus client-site cleaner lands on the cleaner pane

Tell body re-runs bare control grammar on target pane

Tell body runs cwd/nav control on target pane not chat paste

STT togel focus for tell-move-focus toggle

Home sticky channel is herdr, not the legacy default

Voice toggle for tells moving eyes focus

Fix show me bare eyes-on grammar

Voice eyes on/off for bare workspace and pane focus

Fold client-site's / client-site STT into client-site for tell routing

Sticky hold checked every tick so focus cannot keep the channel

Sticky hold reasserts herdr against focus steal

Handoff wait-scrape herdr reply to phone; re-pin sticky + hold

Focus sync skips sticky during hold so channel stays herdr

SMS herdr reply after wait; re-pin sticky

Fix bridge crash mangle on scrap path regex

STICKY machine line; instruct create to re-stick new pane

Short ensure herdr pane when missing

Confirm keyword yes/no never agent-sends the herdr pane

Default handoff to herdr pane via agent send

Keep rules/LLM rewrite path intact behind spawn-offer-clarify flip

Quoted my workspace and label-before-noun patterns

Live herd name in free text re-routes offer with held body

Never TUI dump mid-working; reject chrome junk

Keep live herd det words like my for inventory peel

Non-yes/no → rules then Needle/LLM rewrite route only

Consent stays keywords; wrong rewrite vectors never invent yes

Live-offer free-form asks speechlayer clarify path

Stop he eating hello

Forward speechlayer spawn-offer text to XMPP not echo inbound

Stop to/that hard split; long-comma English stays peel

Heal session D-Bus so Gajim remote can ack

Silent focus cutover repins sticky without phone spam

Sticky is channel not eyes address wins then manual focus

Herdr skill notes label equals agent callsign dual-write

Pane rename always dual-writes agent callsign (shim plus control)

Background callsign sync heals TUI renames upgrade-proof

Tell shell pane to launch pi types pi plus enter not prose

Move working directory force-relocates pi session and resumes

Keep change working directory as exit-pi shell-cd path

Folder nav resolves chat basenames and change-cwd phrases

Match change working directory / cwd / folder to name

Resolve short basenames under chat before zoxide

Never agent-send spawn yes/no residual or I don't know garbage

Wait for TTS and skip free-wake preroll on spawn oneshot

Peel hey speechlayer wake so spawn yes/no is not tell-to-speechlayer

Arm one-shot free-wake after spawn offer, cut on yes/no

Accept no thanks and wake-style yes/no on spawn offers

Typed Note-to-Self runs the same Speech Layer pipeline as voice notes

Peel my/the and trailing pane nouns on tell routes

Caption side-channel for current, last, queue, status.json

Queue daemon updates captions on play, skip, done, and cancel

Tell client-site pane launch pi route works despite STT mangling

Tall/tel aliases of tell and cube-old folds into client-site

Stop hyphen split and cwd-basename false pane on tell peel

Hey and yo aliases for tell with dual-use hey (filler vs route)

Sticky fallthrough on soft free-form, shared with phone target file

Unknown tell target offers spoken yes/no spawn (shared XMPP offer state)

Tell workspace pane message routes via live inventory longest match

Herdr agent inject (XMPP-style) for tell, herder route, and --inject CLI

Everyday make/create/new pane wording maps to ensure pane

Wvd_agent_inject helper; pi-surf-term prefers agent send over xdotool

Soft "speechlayer …" free-form gate with salvage before network and hard walls so blue never hangs

Ensure workspace and ensure pane create-if-missing then focus, including natural hybrid phrasing

Bash wvd_herdr_control wall plus {{SHIFTTAB}} marker wins in dictate scripts

Needle and herder-route ops, tts barge conf, phone mic and listen-path polish

Hold say playback while Speech Layer is recording so panes don't talk over the mic

Soft interrupt skips only the current utterance and keeps the rest of the queue

Wake and energy barge use skip; shut up still drains the whole queue

Track host say queue tools and say-summary extension with Speech Layer

Void guest shutdown check with default-device arecord proof; image retained

Void thin-guest L2 claim and burn-in scorecard (runit, on-target whisper, PA mix)

Rewrite DAEMON_HOME pyenv templates and ship alsa-plugins-pulseaudio on void

Dual-ship service trees with WVD default Pulse device fallback for Void asound

Force-distro/init/DE overrides and optional scrcpy on void and suse

Harden runit enable and systemd unit write for thin containers

Family dry-run matrix, container smokes, Level-3 residual scrub

Linux-family-matrix plus void and opensuse package smoke reports

Cross-host macos svc_status port heuristics and soft LAN path

Add macos-first-hour checklist with Darwin-safe probes

Gate first-hour and forced-macos status in adapter selfcheck

Point macOS install and resumption at first-hour playbook

Multi-family (debian/Mint) path, models seed step, on-target whisper wrappers

KDE/Cinnamon/dconf-cli hotkeys and never transplant cross-distro whisper bins

Ship wakeword-models seed including hey_speechlayer verifier

Mint walkthrough, portability claim calibrated, debian-family QEMU burn-in

Add install-macos first-boot helper and optional indicator launchd unit

Ship skhd and Hammerspoon hotkey examples under system/macos

Prefer TMPDIR for SL_RUNTIME_DIR on Darwin in env.sh

Make fetch-deps cmake jobs work without Linux nproc

Point README and portability at the macOS install path

Route dictate RECORD_DEVICE through audio_fallback_device for CoreAudio default

Ship rumps menu-bar indicator skeleton and wire Darwin CLI check or fix

Add dictate and indicator gates to adapter selfcheck

Update macOS install resumption and progress for residual scrub

A5 pipewire PASS on Fedora QEMU with stream-measure ratio 0.998

Pull alsa-plugins-pulseaudio so Fedora arecord pulse devices work

Skip indicator check and restart when tray helper is not installed

Session-heal polls for speechlayer mix and re-bounces daemon if arecord missing

Keep speechlayer mix ensure after pulse recover when headless has no real mic

Guest-validate PULSE_SERVER unset recover on Ubuntu QEMU restart

Record Ubuntu QEMU systemd burn-in scorecard and partial gates

Unset PULSE_SERVER before pulseaudio start after kill so restart can recover

Lower TTS energy cancel so hot speaker mon no longer zeros talk-over residual

Fire residual barge on soft speaker monitor under high mic instead of hard skip

Trial barge knobs need two chunks residual 2500 and ratio thr 3.5

Require switch model to alias so bare model names stay prose

Preflight complete herdr commands in listen mode before the LLM

Fuzzy workspace match and richer voice targets for STT near-misses

Accept cubald-style client-site mishears in proper-noun rewrite

Add standalone kapish terminator model trainer

Freeze Artix Level-3 campaign work at host-gated stop-line

List single-host burn-in tickets and regression bar for adapters

Make status fix and session-heal accept pipewire-pulse without a pulseaudio process

Refuse ha commands on Darwin and route speechlayer test capture through adapters

Document A4 user units and expand Fedora dnf package list

Extend adapter-selfcheck for CLI residual gates

Add Linux adapter selfcheck covering macos force and launchd templates

Point resumption install and progress at the selfcheck regression bar

Add launchd installer so macOS templates are a real writer not just docs sed

Scaffold Windows inject HTTP shim and WSL2 platform overrides after W0

Point macos install and progress at launchd installer and Option C door

Add stream measure script with ratio and cadence gates for A5 and W0

Record Artix Pulse golden numbers for pipewire and WSLg comparison

Spell out WSLg W0 operator procedure without claiming a pass yet

Route macos beep pid check and speaker mon through adapters

Teach speechlayer CLI Darwin-safe status restart and session-heal paths

Skip the indicator cleanly when rumps is not installed

Add macOS resumption door for real macOS hardware burn-in next

Mark Option A A2 and A3 complete and fill INSTALL systemd install pointers

Document OpenRC versus systemd sudoers as mutually exclusive

Expand systemd Level 2 slices A1 to A6 and link them from INSTALL

Route speechlayer managed service control through SL_SVC without OpenRC-only copy

Write svc-backend on systemd install and sketch Fedora packages

Draft user unit and systemctl sudoers examples off by default

Spell out systemd Level 2 burn-in path unit gaps and first boot checklist

Scaffold macOS adapters for capture inject notify svc and paths

Add raw PCM capture helper that keeps the recording loop shape

Ship untested launchd templates and macOS install TCC notes

Opt-in systemd verbs via SL_SVC without auto-detecting init

Record Option B decision readiness table and half-contract review

Campaign brief for OS backends orchestrator after Phase 4 product close

Stop soft mon from free-firing ratio barge mid long readouts without killing real talk-over

Fix tts-barge set clamps that capped spk_k below real bleed and ratio thr at three

Count only real python daemon processes so supervise and grep noise stop false multi-daemon warnings

Free-wake idle gap so amber can show between turns without killing barge or wake

Seed free-wake recordings from the always-on PCM pre-roll so first words are not clipped

Mark Phase 4 executed, platform readiness table, listen free-wake idle and pre-roll notes

Stop free-wake from rearming while TTS still plays without killing barge or wake

Blank free-wake WAV during spoken acks so switching is not reheard as a new command

Drop command-shaped listen acks and herdr switch TTS plus short-window herdr dedupe

Ship always-on listen mode with CLI, rearm, intent LLM and plan executor

Show an amber listening state on the corner indicator while mode is armed

Fold known client-site mishears on every dictate herdr and phone path before routing

Document listen-mode harness files enter exit phrases and half-contract rules

Mark the OS-adapter split finished end-to-end so the plan matches the tree

Put every desktop notification under the single app name speechlayer so nothing collides with random voice daemons

Lock TTS energy-barge knobs so loud talk-over and hey speechlayer can interrupt without clipping clean playback

Age barge grace from first audio, not process start, so synthesize lag cannot burn the window

Keep a softer wake threshold even when energy barge is off so drowned speech still reaches hey speechlayer

Drop bare cancel as a cancel phrase so random prose no longer kills a recording

Prefer okay-go and kapish spelling variants for the mid-recording instant cut

Build the wake-word mic capture command through the OS adapter so the recording loop stays the same on every platform

Record and play audio through the OS adapter so capture tools can change without rewriting the scripts

Restart managed services through the OS adapter so Linux is not hard-wired into the CLI

Reclaim dead recording locks so a crashed capture cannot block the next wake forever

Let loud speech interrupt TTS playback, with knobs you can change without restarting

Treat Whisper's clipped 'her D' as 'herd d' so herd switching still works

Harden the keystroke-marker walker so unknown markers are dropped, not typed forever

Map full 'new session' phrases to /new after slash commands settle

Route every keystroke and window-focus call through the OS adapter so typing works the same on every platform

Preserve per-site xdotool flags including flag-less Escape and --delay 8 type

Revert bare 'go to <name>'; folder-noun required again (cd stays short form)

Accept bare 'go to <name>' (≤3 tokens) when not a herd/pane command

Harden folder resolve for whisper typos (client-site ≈ client-site) and TLD-ish tokens

Drop legacy project-as-herd entirely - project is filesystem-only now

Herds-and-folders.md voice cheat sheet (switch herd / folder nav / move session / resume pi)

Rebrand herdr workspaces as 'herd' (heard/workspace aliases), freeing 'project' for folder nav

Plain folder nav inside pi now exits pi then cds; only 'move session to X' uses pi /cd relocate

Add 'resume pi' -> pi -c

Add folder-navigation intent (go to folder / cd / go up|home|back) to wvd-herdr-control, zoxide-resolved, shell cd vs pi /cd

Send desktop notifications through the OS adapter so non-Linux backends can plug in

Note that notification app-names should be unified after the port, since the current ones are generic enough to clash with other apps

Record how the Linux dispatch layer was actually built, so the design matches the code

Add the per-OS dispatch layer with Linux implementations built in, ready for scripts to adopt

Add new-pane and pause keystroke macros so spoken herdr commands can open panes and let slash commands settle before submitting

Route all runtime state files through a single configurable directory instead of hardcoding /tmp

Inventory every OS-specific call site in the voice stack, grouped by adapter

Design the OS-adapter split (audio, keystrokes, notifications, services) with a step-by-step migration plan

Link the new portability design into the existing plan so the next phase is ready to start

Note that MATE hotkeys run the dconf action field not command, so a stale action still errors even when command looks right

Add scroll-in chat examples and modernize speechlayer landing page capabilities and privacy messaging

Add charming non-technical speechlayer landing page

Restructure speechlayer landing page; feature herdr voice control and TTS reply playback

Add plain-text ASCII-art landing page explaining speechlayer

Systemd StartLimitIntervalSec/Burst moved to [Unit] section (were silently ignored in [Service])

Debian/Ubuntu pkgs list drops bogus libnotify (aborted apt txn), adds python3-venv/pip + build-essential/cmake/git for whisper.cpp build

Venv installs use --no-deps so pip-freeze closures don't pull 3GB of nvidia CUDA wheels via misaki

Recreate broken venv lacking pip (failed earlier run left python3 but no pip)

Wake-word models missing is a warning not a verify failure (user-trained artifacts, not in repo)

Validated full install.sh systemd burn-in on Ubuntu 24.04 VM (all 4 units active, whisper.cpp built, transcription working)

Level-2/3 scrub - de-hardcode the login user name, dual-ship systemd units

Phase 3b fully live - init.d copied, compat shims removed, full smoke matrix green

Root rename ~/scripts+~/.speechlayer -> ~/speechlayer with core/pi/net/training/media/lib subdirs

Accept 'panel' as spoken alias for pane

Phase 3a portability: SL_HOME parameterization

Phase 2 portability: install.sh + fetch-deps.sh

Phase 1 portability: system snapshots, requirements, models, INSTALL.md

Initial messy commit: ~/scripts + ~/.speechlayer as-is, pre-restructure