Church Translate, as it runs at the campuses

Live sermon translation into 100+ languages, running entirely on one Mac per
campus: audio in, voice detection, Whisper on the GPU, NLLB-200 in its own
process, and a built-in web server the congregation reads from on their
phones. No audio leaves the building.

This is the source only. What used to sit beside it — 14 GB of speech and
translation models, 8 GB of voice bundles, 6 GB of natural voices, the Electron
caches, and the app data holding the operator PIN and every service transcript
— is machine state and downloaded assets, and stays in the NAS backup where it
belongs. The vendored node, cloudflared and Windows ffmpeg binaries are out too
(533 MB, re-fetched for packaging); the browser-side runtime beside them is
kept, so a checkout still serves the congregation page.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitignore

@@ -0,0 +1,28 @@
+# Church Translate — what git keeps is the source; the weight is regenerable.
+#
+# The sibling folders of this repo (2-app-data, 3-models, 4-voices,
+# 5-natural-voices, 6-python-voice-engine, 7-extras) are machine state and
+# downloaded assets — 38 GB, and 2-app-data holds the operator PIN and every
+# service transcript. They belong in the NAS backup, never in git.
+
+.DS_Store
+*.log
+
+# installed and built
+app/node_modules/
+app/dist/
+app/logs/
+
+# shipped installers — Gitea's Releases tab is the place for these
+Releases/*.dmg
+Releases/*.blockmap
+
+# vendored executables, re-fetched for packaging (533 MB)
+# the browser-side runtime next to them (transformers.min.js, the ort wasm)
+# IS kept, so a checkout can still run the congregation page
+app/vendor/node
+app/vendor/cloudflared
+app/vendor-win/
+
+# python voice engine: rebuilt per machine by app/tools/setup-local-voices.sh
+venv/

README.md

@@ -0,0 +1,98 @@
+# Church Translate
+
+Live sermon translation into 100+ languages. One Mac app per campus. No servers,
+no deployment, no subscription.
+
+Congregants point a phone camera at a QR code, tap their language once, and read
+along — or let their phone read it aloud in their ear. No app, no account.
+
+Built because [Kaleo](https://withkaleo.com/) is $24–149/month and
+[OneAccord](https://www.oneaccord.ai/) starts at $150/month for five hours, and
+both are wrappers around cloud speech and translation APIs that an M-series Mac
+runs locally for nothing.
+
+---
+
+## How it works
+
+Everything is inside the one app. Install it on the Mac at a campus, point it at
+the pastor's microphone, and it serves the congregation page itself.
+
+```
+   ┌──────────────── one Mac, one campus ─────────────────┐
+   │                                                       │
+   │  Dante ─┐                                             │
+   │  Waves ─┼─► audio in ──► voice detection              │
+   │  M32 ───┘                     │                       │
+   │                               ▼                       │
+   │                     Whisper  (Mac GPU)                │
+   │                               │                       │
+   │                     NLLB-200  (separate process)      │
+   │                               │                       │
+   │                     built-in web server ──────────────┼──► phones on
+   │                                                       │    the WiFi
+   └───────────────────────────────────────────────────────┘
+```
+
+**No audio ever leaves the Mac,** and nothing leaves the building unless you
+choose to publish it. Only finished sentences cross the network, so a full
+auditorium costs almost nothing to serve.
+
+Two details that are not preference but necessity: translation runs in its own
+plain-Node child process, because Chromium's allocator refuses the model's
+gigabyte-sized weight blocks and kills the process; and speech recognition runs
+on the GPU while translation runs on the CPU, because neither fits in the
+other's runtime.
+
+## What it costs
+
+| | |
+| --- | --- |
+| Speech recognition | Whisper large-v3-turbo, on the Mac's GPU — **$0** |
+| Translation, 100+ languages | NLLB-200, on the Mac's CPU — **$0** |
+| Spoken audio | The listener's own phone — **$0**, at any scale |
+| Serving the page | The app itself — **$0** |
+| Dante input | Dante Virtual Soundcard, **~$50 once per campus** — or free via Waves or console USB |
+
+## Performance
+
+Measured on an M2 Max, from the end of a spoken sentence to captions on a phone.
+Partial text appears well before that, so it feels quicker than the numbers.
+
+| | |
+| --- | --- |
+| Live preview | updates every **500–800 ms** while the sentence is still being spoken |
+| Finished sentence | **~1.6 s** behind the speaker |
+| Speech recognition | 4.9× real time (accurate model) |
+| Translation | ~390 ms per language, flat over 240 consecutive runs |
+| Memory | plateaus at 10–11 GB; no drift across a long service |
+
+Two speech models run at once: a fast one drives the live preview, an accurate
+one produces the line the congregation keeps. They run on separate tracks, so
+the preview costs the finished caption almost nothing.
+
+## Getting started
+
+- **[docs/SETUP.md](docs/SETUP.md)** — installing at a campus
+- **[docs/AUDIO.md](docs/AUDIO.md)** — Dante, Waves SoundGrid, console USB
+- **[docs/COMPANION.md](docs/COMPANION.md)** — the Stream Deck button
+- **[docs/SUNDAY.md](docs/SUNDAY.md)** — print this and tape it to the desk
+- **[docs/PUBLIC-ACCESS.md](docs/PUBLIC-ACCESS.md)** — optional, for people off-site
+
+```bash
+cd app && npm install && npm start     # run from source
+cd app && npm run dist                 # build the .app
+```
+
+## Things worth knowing
+
+- **Only languages people are actually listening to get translated.** Nobody on
+  Icelandic means no CPU spent on Icelandic. Pin a language on the operator page
+  to have it ready before the first person arrives.
+- **Corrections beat retraining.** Operator page → Corrections →
+  `have a cook => Habakkuk`. Whole-word, case-insensitive, instant.
+- **A late arrival sees the last 40 lines**, so walking in halfway still makes sense.
+- **Transcripts** are written per service, original and every translation, under
+  `~/Library/Application Support/Church Translate/data/transcripts/`.
+- **Each campus is independent.** Nothing is shared, nothing syncs, and one
+  campus being down has no effect on another.

Releases/INSTALL.md

@@ -0,0 +1,106 @@
+# Church Translate — Installing at a Campus
+
+## What you need
+- An Apple Silicon Mac (M1 or newer). 16 GB+ RAM recommended.
+- The sermon audio reaching that Mac: Dante Virtual Soundcard, Waves, or any
+  input device. A mixer direct-out of the pastor's mic is ideal.
+- Wi-Fi that phones in the room can join (guest network is fine, but test the
+  QR code — some guest networks isolate clients from each other, which blocks
+  the listener page; ask IT to allow "client-to-client" for the Mac, or put
+  the Mac on the same network as the congregation).
+
+## Install
+1. Copy `Church Translate-3.0.1-arm64.dmg` to the Mac, open it, drag the app
+   to Applications.
+2. First launch on a new Mac (macOS 15+): macOS will block the app because it
+   is not notarized. Open **System Settings → Privacy & Security**, scroll
+   down, and click **Open Anyway** next to the Church Translate message, then
+   launch again. (One time only.)
+   - Alternative for a tech: `xattr -dr com.apple.quarantine "/Applications/Church Translate.app"`
+3. First run downloads the speech and translation models (~2 GB). Let it
+   finish once on good internet — after that the app works fully offline
+   except internet sharing.
+
+## The one networking rule
+The Mac must be ON a network the phones can reach — in practice: **keep the
+Mac's Wi-Fi ON and joined to the same Wi-Fi the congregation uses** (wired
+AV networks are usually isolated VLANs phones cannot route to). The Setup pane
+lists every address the Mac has and marks which network each one is; the QR
+uses the highlighted one, and Wi-Fi is preferred automatically. If phones
+"can't open the page", this is almost always why.
+
+## Set up (5 minutes)
+1. **Setup pane** → Input device: pick the Dante/Waves/interface channel the
+   sermon arrives on. Speak: the meter should go green past the notch.
+2. Adjust **Sensitivity** during a soundcheck: voice crosses the notch, room
+   noise does not. (This is remembered.)
+3. **Operator pane** → add front-page languages, pin ("Always translate") the
+   languages your campus serves, add corrections (`what it heard => what it
+   should say`) as you find them.
+4. Print the poster / share the QR — congregation phones open the local
+   address shown on the Setup pane.
+
+## Stream Deck / Companion
+Operator pane shows four URLs (Start / Stop / Toggle / Status) for Bitfocus
+Companion "Generic HTTP" buttons. Status returns `live`, `ready`, or `offline`
+as plain text.
+
+## Livestream viewers (YouTube)
+1. Setup pane → **Internet sharing** → "Share to the internet".
+2. Copy the `https://….trycloudflare.com` link into the stream description or
+   a pinned comment. **The link is new each time you start sharing** — paste a
+   fresh one each stream (only the streaming campus needs this).
+3. Operator pane → **Stream delay**: set roughly your stream's latency
+   (typically 10–30s for YouTube) so captions/voice line up with the video.
+   The room always sees live.
+- Optional permanent link: create a named Cloudflare Tunnel on a church domain
+  (one-time IT task, free) pointing at `http://<mac>:3100`, and put that URL
+  in the operator "publicUrl" setting; then the QR/poster use it too.
+
+## Free professional voices (optional, one-time setup, $0)
+The app can run studio-quality voices ON the Mac itself — no subscription, no
+usage fees, weights are Apache-licensed (owned forever). Covers Spanish,
+Portuguese, Chinese, Korean, French (+ English, German, Italian, Russian).
+One-time setup per Mac (~10 min, ~2GB download):
+
+    bash "/Applications/Church Translate.app/Contents/Resources/app/tools/setup-local-voices.sh"
+
+Then: Operator pane → Premium voices → "Local (this Mac — free)". If the local
+engine ever fails, the built-in voices take over automatically. Languages it
+doesn't cover (Vietnamese, Arabic, Haitian) stay on the built-in voices.
+fish.audio (prepaid pay-per-use, not a subscription) remains available as an
+alternative for those languages.
+
+## The two Portugueses
+"Português (Brasil)" and "Português (Portugal)" carry genuinely different
+text — one translation is produced, then each variant applies its own
+corpus-tested grammar pass (você/tu system, está falando / está a falar,
+me disse / disse-me, vocabulary). Have a native speaker of each spot-check a
+service before promoting it heavily.
+
+## During the service
+The Operator pane's health line is the one thing to watch:
+- **Green** — healthy; shows how far behind the speaker the captions are.
+- **Amber** — running behind; idle languages may be trimmed to catch up.
+- **Red** — something is wrong (not connected / badly behind). Restart the
+  app if it does not clear itself in a minute; settings and corrections are
+  safe (automatic backups, 30 kept).
+
+## Per-campus checklist (before the first Sunday)
+- [ ] Audio feed reaches the Mac and the meter goes green on speech
+- [ ] Phone on the congregation Wi-Fi can open the QR link and hear a voice
+- [ ] Languages pinned; corrections list started
+- [ ] Stream Deck buttons tested (if used)
+- [ ] A volunteer knows: green/amber/red, and "restart the app" as the fix
+
+## Updates
+Replace the app with a newer DMG the same way. Settings, corrections, models,
+and voices all survive updates (they live outside the app). Check the version
+in the DMG filename; the app's build number is in Finder → Get Info.
+
+## Known limits
+- Apple Silicon only (this build). 
+- Haitian Creole (and ~70 other languages) are captions-only — no synthesized
+  voice exists for them; the phone's own voice is used where the device has one.
+- The internet-sharing link changes on every start (that is how account-less
+  tunnels work) — use a named tunnel for a permanent link.

app/_bench-batch.mjs

@@ -0,0 +1,118 @@
+/*
+ * Does one batched decode across N target languages beat N serial calls?
+ *
+ * The premise (verified in the installed tokenizer source): NLLB's tokenizer
+ * prefixes the ENCODER input with the SOURCE language only — the target is
+ * applied purely as `forced_bos_token_id` on the decoder. So one encoder input
+ * serves every target, and the only thing that differs per row is the first
+ * decoder token.
+ */
+import { pipeline, env, LogitsProcessor, LogitsProcessorList } from '@huggingface/transformers';
+import os from 'os'; import path from 'path';
+env.allowLocalModels = false;
+env.cacheDir = path.join(os.homedir(), 'Library/Application Support/Church Translate Models');
+
+const TEXT = 'And I want you to understand that God has a plan for your life';
+const LANGS = ['spa_Latn','por_Latn','fra_Latn','zho_Hans','hat_Latn','hin_Deva','kor_Hang','vie_Latn','arb_Arab'];
+const SRC = 'eng_Latn';
+
+/* Forces a DIFFERENT language token on each row of the batch. The stock
+   ForcedBOSTokenLogitsProcessor holds a single id for the whole batch. */
+class PerRowForcedBOS extends LogitsProcessor {
+  constructor(ids, eos) { super(); this.ids = ids; this.eos = eos; }
+  _call(input_ids, logits) {
+    for (let i = 0; i < input_ids.length; ++i) {
+      const row = input_ids[i];
+      const d = logits[i].data;
+      if (row.length === 1) {
+        /* First decoder step: this row's target language. */
+        d.fill(-Infinity);
+        d[this.ids[i]] = 0;
+        continue;
+      }
+      /*
+       * transformers.js only breaks the decode loop once EVERY row is done
+       * (models.js: `if (stop.every(x => x)) break`) and nothing pads a row
+       * that already finished — so a short language keeps generating free
+       * text while a long one catches up. Pin finished rows to EOS; the
+       * trailing tokens are then stripped by skip_special_tokens.
+       */
+      if (row[row.length - 1] === this.eos) {
+        d.fill(-Infinity);
+        d[Number(this.eos)] = 0;
+      }
+    }
+    return logits;
+  }
+}
+
+const pipe = await pipeline('translation', 'Xenova/nllb-200-distilled-600M', { dtype: 'fp32' });
+const tok = pipe.tokenizer, model = pipe.model;
+
+console.log('tokenizer:', tok.constructor.name,
+  '| lang_to_token:', typeof tok.lang_to_token,
+  '| post_processor:', !!(tok.post_processor && tok.post_processor.config));
+
+/* Pin the source language into the post-processor exactly as the library does. */
+for (const item of tok.post_processor.config.single) {
+  if ('SpecialToken' in item && tok.languageRegex.test(item.SpecialToken.id)) {
+    item.SpecialToken.id = tok.lang_to_token(SRC);
+    break;
+  }
+}
+const EOS = BigInt(model.generation_config.eos_token_id ?? tok.model.convert_tokens_to_ids(['</s>'])[0]);
+console.log('eos token id:', EOS.toString());
+const bosOf = (l) => tok.model.convert_tokens_to_ids([tok.lang_to_token(l)])[0];
+
+/* Confirm the encoder input really is target-independent. */
+const a = tok(TEXT).input_ids.tolist()[0];
+console.log('encoder ids (src-prefixed):', a.slice(0, 4).join(','), '… len', a.length);
+
+async function batched(langs) {
+  const enc = tok(Array(langs.length).fill(TEXT), { padding: true, truncation: true });
+  const lp = new LogitsProcessorList();
+  lp.push(new PerRowForcedBOS(langs.map(bosOf), EOS));
+  const out = await model.generate({
+    ...enc,
+    logits_processor: lp,
+    forced_bos_token_id: null,
+    max_new_tokens: 128,
+  });
+  const rows = tok.batch_decode(out, { skip_special_tokens: true });
+  const o = {}; langs.forEach((l, i) => o[l] = rows[i].trim());
+  return o;
+}
+
+async function serial(langs) {
+  const o = {};
+  for (const l of langs) {
+    const r = await pipe(TEXT, { src_lang: SRC, tgt_lang: l });
+    o[l] = (Array.isArray(r) ? r[0] : r).translation_text.trim();
+  }
+  return o;
+}
+
+/* warm both paths */
+await serial(['spa_Latn']); await batched(['spa_Latn']);
+
+console.log('\n N |  serial  |  batched |  speedup');
+console.log('---+----------+----------+---------');
+const sample = {};
+for (const n of [1, 2, 3, 5, 9]) {
+  const langs = LANGS.slice(0, n);
+  let s = Date.now(); const so = await serial(langs); s = Date.now() - s;
+  let b = Date.now(); const bo = await batched(langs); b = Date.now() - b;
+  console.log(String(n).padStart(2) + ' | ' + (s + 'ms').padStart(8) + ' | ' + (b + 'ms').padStart(8) +
+    ' | ' + (s / b).toFixed(2) + '×');
+  if (n === 9) { sample.serial = so; sample.batched = bo; }
+}
+
+console.log('\n--- identical output? ---');
+let same = 0;
+for (const l of LANGS) {
+  const ok = sample.serial[l] === sample.batched[l];
+  if (ok) same++; else console.log('  DIFFER ' + l + '\n    serial : ' + sample.serial[l] + '\n    batched: ' + sample.batched[l]);
+}
+console.log('  ' + same + '/' + LANGS.length + ' identical');
+console.log('  spa batched: ' + sample.batched.spa_Latn);
+console.log('  zho batched: ' + sample.batched.zho_Hans);

app/_bench-mt.mjs

@@ -0,0 +1,32 @@
+import { pipeline, env } from '@huggingface/transformers';
+import os from 'os'; import path from 'path';
+env.allowLocalModels = false;
+env.cacheDir = path.join(os.homedir(), 'Library/Application Support/Church Translate Models');
+
+/* Partial-length text: a rolling 6s window is roughly this long. */
+const TEXT = 'And I want you to understand that God has a plan for your life';
+const LANGS = ['spa_Latn','por_Latn','fra_Latn','zho_Hans','hat_Latn','hin_Deva','kor_Hang','vie_Latn','arb_Arab'];
+
+for (const dtype of ['fp32','q8']) {
+  let pipe;
+  const t0 = Date.now();
+  try { pipe = await pipeline('translation','Xenova/nllb-200-distilled-600M',{ dtype }); }
+  catch (e) { console.log(dtype + ': FAILED to load — ' + String(e.message).slice(0,80)); continue; }
+  const load = Date.now() - t0;
+  /* warm */
+  await pipe(TEXT, { src_lang:'eng_Latn', tgt_lang:'spa_Latn' });
+  const times = []; const outs = {};
+  for (const l of LANGS) {
+    const s = Date.now();
+    const o = await pipe(TEXT, { src_lang:'eng_Latn', tgt_lang:l });
+    times.push(Date.now() - s);
+    outs[l] = (Array.isArray(o)?o[0]:o).translation_text.trim();
+  }
+  const mean = times.reduce((a,b)=>a+b,0)/times.length;
+  console.log('\n=== ' + dtype + ' ===  load ' + (load/1000).toFixed(1) + 's');
+  console.log('  per language: ' + times.map(t=>t+'ms').join('  '));
+  console.log('  mean ' + mean.toFixed(0) + 'ms | 1 lang ' + mean.toFixed(0) + 'ms | 2 langs ' + (mean*2).toFixed(0) + 'ms | 9 langs ' + (mean*9/1000).toFixed(1) + 's');
+  console.log('  spa: ' + outs.spa_Latn);
+  console.log('  fra: ' + outs.fra_Latn);
+  console.log('  zho: ' + outs.zho_Hans);
+}

app/_bench-opus.mjs

@@ -0,0 +1,85 @@
+/*
+ * Opus-MT bilingual vs NLLB-600M, on THIS Mac, on sermon sentences.
+ *
+ * The claim under test: a 77M bilingual model matches or beats NLLB-200-
+ * distilled-600M on high-resource pairs at ~1/8 the size. Published chrF says
+ * yes; no published CPU latency comparison exists, and quality on preaching
+ * English is not what any leaderboard measures. So: measure both here.
+ */
+import { pipeline, env } from '@huggingface/transformers';
+import os from 'os'; import path from 'path';
+env.allowLocalModels = false;
+env.cacheDir = path.join(os.homedir(), 'Library/Application Support/Church Translate Models');
+
+const SENTENCES = [
+  'And I want you to understand that God has a plan for your life',
+  'Turn with me to the book of Romans chapter eight',
+  'He was faithful even when it cost him everything',
+  'Would you stand with me as we pray',
+  'The grace of God is not something you can earn',
+  'Peter denied him three times before the rooster crowed',
+];
+const PAIRS = [
+  { code: 'spa_Latn', opus: 'Xenova/opus-mt-en-es', name: 'Spanish' },
+  { code: 'fra_Latn', opus: 'Xenova/opus-mt-en-fr', name: 'French'  },
+  { code: 'zho_Hans', opus: 'Xenova/opus-mt-en-zh', name: 'Chinese' },
+];
+
+const t = (f) => { const s = Date.now(); return f().then((r) => [Date.now() - s, r]); };
+const out = (o) => (Array.isArray(o) ? o[0] : o).translation_text.trim();
+
+console.log('loading NLLB fp32…');
+const nllb = await pipeline('translation', 'Xenova/nllb-200-distilled-600M', { dtype: 'fp32' });
+await nllb(SENTENCES[0], { src_lang: 'eng_Latn', tgt_lang: 'spa_Latn' });
+
+const results = {};
+for (const p of PAIRS) {
+  const ts = [], txt = [];
+  for (const s of SENTENCES) {
+    const [ms, o] = await t(() => nllb(s, { src_lang: 'eng_Latn', tgt_lang: p.code }));
+    ts.push(ms); txt.push(out(o));
+  }
+  results[p.name] = { nllb: { ms: ts, txt } };
+}
+
+for (const dtype of ['fp32', 'q8']) {
+  for (const p of PAIRS) {
+    let pipe;
+    const t0 = Date.now();
+    try { pipe = await pipeline('translation', p.opus, { dtype }); }
+    catch (e) { console.log(p.name + ' ' + dtype + ': LOAD FAILED — ' + String(e.message).slice(0, 90)); continue; }
+    const load = Date.now() - t0;
+    await pipe(SENTENCES[0]);
+    const ts = [], txt = [];
+    for (const s of SENTENCES) { const [ms, o] = await t(() => pipe(s)); ts.push(ms); txt.push(out(o)); }
+    results[p.name]['opus_' + dtype] = { ms: ts, txt, load };
+    await pipe.dispose?.();
+  }
+}
+
+const mean = (a) => a.reduce((x, y) => x + y, 0) / a.length;
+console.log('\n=== speed, ms per sentence (mean of ' + SENTENCES.length + ') ===');
+console.log('language  |  NLLB fp32 | Opus fp32 | Opus q8 | best speedup');
+for (const p of PAIRS) {
+  const r = results[p.name];
+  const n = mean(r.nllb.ms);
+  const f = r.opus_fp32 ? mean(r.opus_fp32.ms) : NaN;
+  const q = r.opus_q8 ? mean(r.opus_q8.ms) : NaN;
+  const best = Math.min(f || Infinity, q || Infinity);
+  console.log(p.name.padEnd(9) + ' | ' + (n.toFixed(0) + 'ms').padStart(10) + ' | ' +
+    ((f ? f.toFixed(0) : '—') + 'ms').padStart(9) + ' | ' + ((q ? q.toFixed(0) : '—') + 'ms').padStart(7) +
+    ' | ' + (n / best).toFixed(2) + 'x');
+}
+
+console.log('\n=== output, sentence by sentence ===');
+SENTENCES.forEach((s, i) => {
+  console.log('\n"' + s + '"');
+  for (const p of PAIRS) {
+    const r = results[p.name];
+    console.log('  ' + p.name);
+    console.log('    NLLB      : ' + r.nllb.txt[i]);
+    if (r.opus_fp32) console.log('    Opus fp32 : ' + r.opus_fp32.txt[i]);
+    if (r.opus_q8)   console.log('    Opus q8   : ' + r.opus_q8.txt[i] +
+      (r.opus_fp32 && r.opus_q8.txt[i] !== r.opus_fp32.txt[i] ? '   <-- differs from fp32' : ''));
+  }
+});

app/_ctxprobe.mjs

@@ -0,0 +1,98 @@
+import { pipeline, env } from '@huggingface/transformers';
+env.allowLocalModels = false;
+env.cacheDir = '/Users/Studio/Library/Application Support/Church Translate Models';
+
+// --- chrF (character n-gram F-score, beta=2), written from scratch: no npm pkg exists for node
+function ngrams(s, n) {
+  const t = s.replace(/\s+/g, '');
+  const m = new Map();
+  for (let i = 0; i + n <= t.length; i++) { const g = t.slice(i, i + n); m.set(g, (m.get(g) || 0) + 1); }
+  return m;
+}
+function chrF(hyp, ref, N = 6, beta = 2) {
+  let pS = 0, rS = 0, cnt = 0;
+  for (let n = 1; n <= N; n++) {
+    const H = ngrams(hyp, n), R = ngrams(ref, n);
+    let hs = 0, rs = 0, ov = 0;
+    for (const [g, c] of H) { hs += c; ov += Math.min(c, R.get(g) || 0); }
+    for (const [, c] of R) rs += c;
+    if (hs === 0 || rs === 0) continue;
+    pS += ov / hs; rS += ov / rs; cnt++;
+  }
+  if (!cnt) return 0;
+  const p = pS / cnt, r = rS / cnt;
+  if (p + r === 0) return 0;
+  return (1 + beta * beta) * p * r / (beta * beta * p + r);
+}
+
+const PAIRS = [
+  ["Habakkuk stood upon his watchtower and waited to see what the Lord would say.", "And the Lord answered him and told him to write the vision plainly upon tablets."],
+  ["Turn with me to Second Chronicles chapter seven verse fourteen.", "If my people who are called by my name will humble themselves and pray, I will heal their land."],
+  ["For by grace you have been saved through faith, and that not of yourselves.", "It is the gift of God, not of works, so that no one may boast."],
+  ["Melchizedek, king of Salem, brought out bread and wine.", "He was priest of God Most High, and he blessed Abram that day."],
+  ["The Lord is my shepherd; I shall not want.", "He maketh me to lie down in green pastures and leadeth me beside the still waters."],
+  ["Jesus wept at the tomb of Lazarus.", "Then he cried with a loud voice and called his friend out of the grave."],
+  ["Paul wrote to the church at Philippi from a prison cell.", "He told them to rejoice in the Lord always, and again he said rejoice."],
+  ["The elders fell down before the Lamb with harps and golden bowls of incense.", "And they sang a new song, saying, worthy art thou to take the scroll."],
+];
+const LANGS = [['spa_Latn','Spanish'],['hat_Latn','Haitian'],['arb_Arab','Arabic'],['kor_Hang','Korean'],['vie_Latn','Vietnamese']];
+
+const t0 = Date.now();
+const pipe = await pipeline('translation', 'Xenova/nllb-200-distilled-600M', { dtype: 'fp32' });
+console.log(`MODEL LOAD: ${((Date.now()-t0)/1000).toFixed(1)}s`);
+
+const tr = async (text, tgt) => {
+  const t = Date.now();
+  const r = await pipe(text, { src_lang: 'eng_Latn', tgt_lang: tgt });
+  return { text: (Array.isArray(r)?r[0]:r).translation_text.trim(), ms: Date.now()-t };
+};
+await tr(PAIRS[0][0], 'spa_Latn'); // warmup
+
+const rows = [];
+const tStart = Date.now();
+for (const [code, name] of LANGS) {
+  for (const [s1, s2] of PAIRS) {
+    const a = await tr(s1, code);
+    const b = await tr(s2, code);
+    const c = await tr(s1 + ' ' + s2, code);
+    const simA = chrF(c.text, a.text);
+    const covB = chrF(c.text, b.text);
+    const lenRatio = c.text.length / a.text.length;
+    // clean-prefix test: does a.text appear verbatim at the head of c.text?
+    const prefixExact = c.text.startsWith(a.text);
+    // fuzzy prefix: chrF of the first a.text.length chars of c vs a
+    const prefixFuzzy = chrF(c.text.slice(0, a.text.length), a.text);
+    const dropped = simA > 0.85 && lenRatio < 1.35;
+    rows.push({ name, code, s1: s1.slice(0,28), a: a.text, b: b.text, c: c.text,
+      simA:+simA.toFixed(3), covB:+covB.toFixed(3), lenRatio:+lenRatio.toFixed(2),
+      prefixExact, prefixFuzzy:+prefixFuzzy.toFixed(3), dropped,
+      msA:a.ms, msB:b.ms, msC:c.ms });
+  }
+}
+const wall = (Date.now()-tStart)/1000;
+
+console.log(`\nWALL CLOCK for ${rows.length*3} calls (${PAIRS.length} pairs x ${LANGS.length} langs x 3): ${wall.toFixed(1)}s`);
+console.log(`=> per-call avg ${(wall*1000/(rows.length*3)).toFixed(0)}ms\n`);
+
+console.log('lang        dropRate  meanCovB  prefixExact  prefixFuzzy  meanLenRatio  msA   msC   ratio');
+for (const [code,name] of LANGS) {
+  const R = rows.filter(r=>r.code===code);
+  const f=(k)=> (R.reduce((s,r)=>s+(typeof r[k]==='boolean'? (r[k]?1:0) : r[k]),0)/R.length);
+  console.log(
+    name.padEnd(12) +
+    (f('dropped')*100).toFixed(0).padStart(6)+'%  ' +
+    f('covB').toFixed(3).padStart(8) + '  ' +
+    (f('prefixExact')*100).toFixed(0).padStart(10)+'%  ' +
+    f('prefixFuzzy').toFixed(3).padStart(10) + '  ' +
+    f('lenRatio').toFixed(2).padStart(12) + '  ' +
+    f('msA').toFixed(0).padStart(4) + '  ' + f('msC').toFixed(0).padStart(4) + '  ' +
+    (f('msC')/f('msA')).toFixed(2)
+  );
+}
+console.log('\n--- samples ---');
+for (const r of rows.filter(r=>r.code==='hat_Latn'||r.code==='arb_Arab').slice(0,6)) {
+  console.log(`\n[${r.name}] ${r.s1}...  dropped=${r.dropped} covB=${r.covB} prefixExact=${r.prefixExact}`);
+  console.log('  a:', r.a); console.log('  b:', r.b); console.log('  c:', r.c);
+}
+import fs from 'fs';
+fs.writeFileSync('/private/tmp/claude-502/-Users-Studio-Documents-BandLineupDisplay/cee248f6-d861-4845-bd13-03867cf46596/scratchpad/rows.json', JSON.stringify(rows,null,1));

app/_gen-lexicon.js

@@ -0,0 +1,147 @@
+/*
+ * Regenerates bible-lexicon.js from every bible/lexicon-*.json.
+ * Run after editing any lexicon file.
+ */
+const fs = require('fs');
+const path = require('path');
+
+const files = fs.readdirSync('bible').filter((f) => /^lexicon-.*\.json$/.test(f)).sort();
+const english = {};      // lang -> { English term: local form }
+const fixes = {};        // lang -> { wrong local form: right local form }
+const refs = {};
+let total = 0;
+
+/* A variant can INHERIT its base language's table and then diverge. Portugal
+   keeps "David" where Brazil writes "Davi", so por_PT cannot simply reuse
+   por_Latn — but it should not have to restate 85 shared entries either. */
+const inheritQueue = [];
+
+for (const f of files) {
+  const j = JSON.parse(fs.readFileSync(path.join('bible', f), 'utf8'));
+  const lang = j.language;
+  if (j.inherits) { inheritQueue.push(j); refs[lang] = j.reference; continue; }
+  refs[lang] = j.reference;
+  const t = {};
+  for (const grp of ['books', 'people', 'places', 'terms']) {
+    for (const [en, loc] of Object.entries(j[grp] || {})) {
+      if (en.startsWith('_') || en === loc) continue;   // no-ops earn nothing
+      t[en] = loc;
+    }
+  }
+  english[lang] = t;
+  total += Object.keys(t).length;
+  const tf = {};
+  for (const [bad, good] of Object.entries(j._target_fixes || {})) {
+    if (bad.startsWith('_')) continue;
+    tf[bad] = good;
+  }
+  if (Object.keys(tf).length) fixes[lang] = tf;
+}
+
+/* Resolve inheritance after every base table is built. */
+for (const j of inheritQueue) {
+  const from = english[j.inherits];
+  if (!from) throw new Error(j.language + ' inherits ' + j.inherits + ', which does not exist');
+  const t = Object.assign({}, from);
+  for (const k of (j.remove || [])) delete t[k];
+  for (const [en, loc] of Object.entries(j.overrides || {})) {
+    if (en === loc) delete t[en];        // "same as English" means: do not touch it
+    else t[en] = loc;
+  }
+  english[j.language] = t;
+  total += Object.keys(t).length;
+  const fb = fixes[j.inherits];
+  if (fb) fixes[j.language] = Object.assign({}, fb, j.targetFixes || {});
+  else if (j.targetFixes) fixes[j.language] = j.targetFixes;
+}
+
+const j2 = (o) => JSON.stringify(o, null, 2).split('\n').map((l, i) => i ? '    ' + l : l).join('\n');
+
+const OUT = [
+  '/*',
+  ' * bible-lexicon.js — GENERATED from bible/lexicon-*.json by _gen-lexicon.js.',
+  ' * Do not hand-edit; edit the JSON and regenerate.',
+  ' *',
+  ' * TWO TABLES, and the difference is the whole safety argument.',
+  ' *',
+  ' * ENGLISH[] maps an ENGLISH term to the local form. It only ever fires on',
+  ' * English text that survived translation, so there is no target-language',
+  ' * homograph to collide with — the trap that makes a target-side lexicon',
+  ' * dangerous (a Spanish entry for "Marca" would turn "la marca de la bestia"',
+  ' * into "la Marcos de la bestia"). No CJK word-boundary problem either, and',
+  ' * no noun gender or grammatical case to agree with.',
+  ' *',
+  ' * FIXES[] is target-side and therefore restricted to forms MEASURED wrong',
+  ' * against a named published edition, each one checked for not being an',
+  ' * ordinary word in that language. Never add to it by intuition.',
+  ' *',
+  ' * Naming authorities: ' + Object.entries(refs).map(([k, v]) => k + ' = ' + v).join('; ') + '.',
+  ' * Verse TEXT from any copyrighted edition appears nowhere in this app; proper',
+  ' * nouns and book titles are naming conventions, not copyrightable subject',
+  ' * matter.',
+  ' */',
+  '(function (root, factory) {',
+  "  if (typeof module === 'object' && module.exports) module.exports = factory();",
+  '  else root.BibleLexicon = factory();',
+  "}(typeof self !== 'undefined' ? self : this, function () {",
+  "  'use strict';",
+  '',
+  '  const ENGLISH = ' + j2(english) + ';',
+  '',
+  '  const FIXES = ' + j2(fixes) + ';',
+  '',
+  '  /* A regional variant inherits its base language. Canonical list: NLLB_ALIAS. */',
+  "  const VARIANT_OF = { spa_ES: 'spa_Latn', spa_MX: 'spa_Latn', por_PT: 'por_Latn', zho_Hant: 'zho_Hans' };",
+  '  const base = (lang) => (ENGLISH[lang] ? lang : VARIANT_OF[lang]);',
+  '',
+  '  function forLanguage(lang) { return ENGLISH[base(lang)] || null; }',
+  '',
+  '  /*',
+  '   * WHOLE-UTTERANCE NAME LOOKUP — the deterministic guarantee.',
+  '   *',
+  '   * A bare name is the worst input this model receives. MEASURED into',
+  '   * Spanish: "Peter." came back as "\u00bfQu\u00e9 es eso?" and "Jesus." as',
+  '   * "\u00bfQu\u00e9 quieres?" — the name GONE, replaced by invented dialogue.',
+  '   * Into French, "Habakkuk." became "Habakuk est mort" (Habakkuk is dead).',
+  '   * A preacher listing names one at a time produced a run of questions with',
+  '   * no names in them at all.',
+  '   *',
+  '   * The cause is ONE CHARACTER: the terminal period. Without it the model',
+  '   * translates the term ("Peter" -> "Pedro"); with it, it reads a complete',
+  '   * conversational turn and invents a reply. preach.js strips the period for',
+  '   * short utterances, which fixes most of it — this is the guarantee for the',
+  '   * rest, because a name we know should never depend on the model at all.',
+  '   *',
+  '   * Matched on the bare word, punctuation and case stripped, and ONLY when',
+  '   * the utterance is that name and nothing else — an ordinary sentence',
+  '   * containing the name is untouched.',
+  '   */',
+  '  function wholeUtterance(text, lang) {',
+  '    const t = ENGLISH[base(lang)];',
+  '    if (!t) return null;',
+  '    const bare = String(text == null ? \'\' : text)',
+  '      .replace(/^[\\s"\\u2018\\u201c(\\[\\\']+/, \'\')',
+  '      .replace(/[\\s.!?,;:"\\u2019\\u201d)\\]\\\']+$/, \'\')',
+  '      .trim();',
+  '    if (!bare) return null;',
+  '    if (Object.prototype.hasOwnProperty.call(t, bare)) return t[bare];',
+  '    const lower = bare.toLowerCase();',
+  '    for (const k of Object.keys(t)) if (k.toLowerCase() === lower) return t[k];',
+  '    return null;',
+  '  }',
+  '',
+  '  function fixesFor(lang) { return FIXES[base(lang)] || null; }',
+  '  function languages() { return Object.keys(ENGLISH); }',
+  '',
+  '  return { forLanguage: forLanguage, fixesFor: fixesFor,',
+  '           wholeUtterance: wholeUtterance, languages: languages,',
+  '           ENGLISH: ENGLISH, FIXES: FIXES };',
+  '}));'
+].join('\n');
+
+fs.writeFileSync('bible-lexicon.js', OUT);
+console.log('wrote bible-lexicon.js — ' + files.length + ' languages, ' + total + ' English entries');
+for (const [l, t] of Object.entries(english)) {
+  console.log('   ' + l.padEnd(10) + String(Object.keys(t).length).padStart(4) + ' entries, ' +
+              Object.keys(fixes[l] || {}).length + ' target fixes  (' + refs[l] + ')');
+}

app/_lenprobe.mjs

@@ -0,0 +1,32 @@
+import { pipeline, env } from '@huggingface/transformers';
+env.allowLocalModels = false;
+env.cacheDir = '/Users/Studio/Library/Application Support/Church Translate Models';
+const pipe = await pipeline('translation','Xenova/nllb-200-distilled-600M',{dtype:'fp32'});
+const G = [
+ ["Habakkuk stood upon his watchtower.","He waited to see what the Lord would say to him.","And the Lord answered him and told him to write the vision.","Make it plain upon tablets, so that he may run who reads it."],
+ ["Turn with me to Second Chronicles chapter seven.","If my people who are called by my name will humble themselves and pray,","and seek my face and turn from their wicked ways,","then will I hear from heaven and will heal their land."],
+ ["Paul wrote to the church at Philippi from a prison cell.","He told them to rejoice in the Lord always.","And again he said unto them, rejoice.","Let your moderation be known unto all men, for the Lord is at hand."],
+];
+const L=[['hat_Latn','Haitian'],['arb_Arab','Arabic'],['kor_Hang','Korean']];
+const t=async(x,c)=>{const s=Date.now();const r=await pipe(x,{src_lang:'eng_Latn',tgt_lang:c});return{text:(Array.isArray(r)?r[0]:r).translation_text.trim(),ms:Date.now()-s}};
+await t(G[0][0],'spa_Latn');
+function ng(s,n){const q=s.replace(/\s+/g,'');const m=new Map();for(let i=0;i+n<=q.length;i++){const g=q.slice(i,i+n);m.set(g,(m.get(g)||0)+1)}return m}
+function chrF(h,r,N=6,b=2){let P=0,R=0,c=0;for(let n=1;n<=N;n++){const H=ng(h,n),F=ng(r,n);let hs=0,rs=0,ov=0;for(const[g,x]of H){hs+=x;ov+=Math.min(x,F.get(g)||0)}for(const[,x]of F)rs+=x;if(!hs||!rs)continue;P+=ov/hs;R+=ov/rs;c++}if(!c)return 0;const p=P/c,r2=R/c;return p+r2?(1+b*b)*p*r2/(b*b*p+r2):0}
+console.log('lang     nSent  lenRatio(out/sum-of-singles)  covLAST  covFIRST  ms');
+for(const[code,name]of L){
+ for(const gi in G){
+  const S=G[gi];
+  const singles=[];for(const s of S)singles.push((await t(s,code)).text);
+  for(const n of [2,3,4]){
+   const src=S.slice(0,n).join(' ');
+   const o=await t(src,code);
+   const sumLen=singles.slice(0,n).reduce((a,x)=>a+x.length,0);
+   console.log(name.padEnd(9)+String(n).padStart(4)+
+     ('   '+(o.text.length/sumLen).toFixed(2)).padStart(28)+
+     ('  '+chrF(o.text,singles[n-1]).toFixed(3)).padStart(9)+
+     ('  '+chrF(o.text,singles[0]).toFixed(3)).padStart(10)+
+     ('  '+o.ms).padStart(8));
+   if(n===4)console.log('     OUT:',o.text.slice(0,240));
+  }
+ }
+}

app/_pb.js

@@ -0,0 +1,32 @@
+const ort = require('onnxruntime-node');
+const fs = require('fs');
+const D='/private/tmp/claude-502/-Users-Studio-Documents-BandLineupDisplay/cee248f6-d861-4845-bd13-03867cf46596/scratchpad/piper/';
+const cfg = JSON.parse(fs.readFileSync(D+'lessac.json','utf8'));
+console.log('sample_rate', cfg.audio.sample_rate, 'num_symbols', cfg.num_symbols, 'phoneme_type', cfg.phoneme_type, 'lang', cfg.language && cfg.language.code);
+console.log('inference defaults', JSON.stringify(cfg.inference));
+const map = cfg.phoneme_id_map;
+// crude: use the espeak IPA of the sentence is unavailable here; approximate with the raw characters that exist in the map
+const IPA = "dʒiːzəs sɛd tuː ðɛm aɪ æm ðə bɹɛd ʌv laɪf huːɛvɚ kʌmz tuː miː";
+const ids=[map['^'][0]];
+for (const ch of IPA){ if(map[ch]){ ids.push(map[ch][0]); ids.push(map['_'][0]); } }
+ids.push(map['$'][0]);
+(async()=>{
+  const ep = process.argv[2]||'cpu';
+  const t=Date.now();
+  const sess = await ort.InferenceSession.create(D+'lessac.onnx',{executionProviders:[ep]});
+  console.log(`[${ep}] load ${Date.now()-t}ms inputs=${sess.inputNames.join(',')}`);
+  const mk=(len)=>({
+    input: new ort.Tensor('int64', BigInt64Array.from(ids.map(BigInt)), [1, ids.length]),
+    input_lengths: new ort.Tensor('int64', BigInt64Array.from([BigInt(ids.length)]), [1]),
+    scales: new ort.Tensor('float32', Float32Array.from([cfg.inference.noise_scale, len, cfg.inference.noise_w]), [3])
+  });
+  for (const ls of [1.0, 0.85, 0.7]) {
+    const feeds = mk(ls);
+    let o = await sess.run(feeds);
+    const k=sess.outputNames[0];
+    const frames=o[k].data.length;
+    let tot=0; for(let i=0;i<8;i++){const a=Date.now(); await sess.run(feeds); tot+=Date.now()-a;}
+    const avg=tot/8/1000, dur=frames/cfg.audio.sample_rate;
+    console.log(`[${ep}] length_scale=${ls}  audio ${dur.toFixed(2)}s  infer ${avg.toFixed(3)}s  RTF ${(avg/dur).toFixed(4)}  rss ${Math.round(process.memoryUsage().rss/1048576)}MB`);
+  }
+})().catch(e=>console.log(`[${process.argv[2]}] ERR`, e.message));

app/_preview-groups.html

@@ -0,0 +1,60 @@
+<!doctype html><html lang="en"><head><meta charset="utf-8">
+<title>group + channel CSS check</title><link rel="stylesheet" href="./engine.css"></head>
+<body>
+<header class="head"><div class="brand"><span class="mark"></span><span>Church&nbsp;Translate</span>
+<span class="build" id="buildTag">3.11.0 · 75</span></div></header>
+<main class="page">
+  <section class="hero" data-state="ready"><h1>Hero spans both columns</h1></section>
+  <div class="col-main">
+    <section class="group" id="g1" data-open="true">
+      <button class="group-head" type="button"><span class="chev"></span><h2>Input</h2>
+        <span class="group-sub">Dante Virtual Soundcard · ch 1</span></button>
+      <div class="group-body" id="g1b"><div class="group-inner">
+        <div class="chanbox"><div class="chanhead"><label style="margin:0">Channels</label>
+          <span class="hint" id="chanNote" style="margin:0">channel 1</span>
+          <button class="btn">Mix all</button></div>
+          <div class="chanlist" id="chanList"></div></div>
+        <p class="hint">Some content so the section has height.</p>
+      </div></div>
+    </section>
+    <section class="group" id="g2"><button class="group-head" type="button"><span class="chev"></span>
+      <h2>Languages and voices</h2><span class="group-sub">9 on · 1 pinned</span></button>
+      <div class="group-body" id="g2b"><div class="group-inner">
+        <p>Line</p><p>Line</p><p>Line</p><p>Line</p><p>Line</p><p>Line</p><p>Line</p><p>Line</p>
+      </div></div></section>
+    <section class="group" id="g3"><button class="group-head" type="button"><span class="chev"></span>
+      <h2>Settings</h2><span class="group-sub">no stream delay</span></button>
+      <div class="group-body"><div class="group-inner"><p>Line</p><p>Line</p></div></div></section>
+    <section class="card"><h2>Log</h2><div class="log"></div></section>
+  </div>
+  <aside class="col-rail"><section class="card rail-card"><h2>What the congregation opens</h2>
+    <div class="qr" style="width:11rem;height:11rem;background:#fff;margin:0 auto .625rem"></div>
+    <div class="railbtns"><button class="btn btn-primary">Copy address</button>
+    <button class="btn">Printable poster</button></div>
+    <h3 class="subhead">Operator page</h3>
+    <div class="codeblock"><code>http://10.6.3.222:3100/operator</code><button class="btn">Copy</button></div>
+    <button class="btn railwide">Open operator page</button></section></aside>
+</main>
+<script>
+for (const sec of document.querySelectorAll('.group')) {
+  sec.querySelector('.group-head').addEventListener('click', () => {
+    sec.dataset.open = sec.dataset.open === 'true' ? 'false' : 'true';
+  });
+}
+const list = document.getElementById('chanList');
+for (let i = 0; i < 16; i++) {
+  const r = document.createElement('button');
+  r.type = 'button'; r.className = 'chanrow' + (i === 0 ? ' on' : ''); r.dataset.ch = i;
+  r.innerHTML = '<b>' + (i+1) + '</b><span class="chanbar"><i class="chanbar-fill"></i></span>';
+  list.appendChild(r);
+}
+let t = 0;
+setInterval(() => { t += .3;
+  [...list.children].forEach((row, i) => {
+    const v = i === 0 ? Math.abs(Math.sin(t)) : i === 5 ? Math.abs(Math.cos(t*1.7))*.6 : Math.random()*.05;
+    const f = row.querySelector('.chanbar-fill');
+    f.style.width = (v*100).toFixed(0) + '%'; f.classList.toggle('hot', v > .35);
+  });
+}, 120);
+</script>
+</body></html>

app/_preview-langlist.html

@@ -0,0 +1,51 @@
+<!doctype html><html><head><meta charset="utf-8">
+<link rel="stylesheet" href="./engine.css">
+<style>body{padding:1.5rem;max-width:44rem;margin:0 auto}</style>
+</head><body>
+<section class="card">
+  <h2>Languages on the front page</h2>
+  <p class="hint" id="opLangCount"></p>
+  <div class="row">
+    <input id="opLangFilter" type="search" placeholder="Filter languages…" autocomplete="off">
+    <label class="oprow"><input type="checkbox" id="opLangVoiceOnly"><span>With a voice only</span></label>
+    <button class="btn" id="opLangNone">Turn all off</button>
+  </div>
+  <div id="opLangList" class="langlist"></div>
+  <label class="oprow"><input type="checkbox" id="opAllowAll" checked><span>Let listeners pick any language</span></label>
+  <p class="hint" id="opAllowAllHint">On — all 104 languages are offered. 32 of them have a voice; the rest show captions only.</p>
+</section>
+<script src="./languages.js"></script><script src="./voice-catalog.js"></script>
+<script>
+/* Same DOM the renderer builds, against the real catalogs. */
+const $=(id)=>document.getElementById(id);
+const opConfig={featured:["spa_Latn","zho_Hans","por_Latn","por_PT","fra_Latn","kor_Hang","vie_Latn","hat_Latn","arb_Arab"],allowAllLanguages:true};
+function render(){
+  const box=$('opLangList'), q=($('opLangFilter').value||'').trim().toLowerCase();
+  const voiceOnly=$('opLangVoiceOnly').checked;
+  const on=new Set(opConfig.featured), spoken=new Set(VoiceCatalog.languages());
+  const codes=Languages.codes().slice().sort((a,b)=>(Languages.get(a).name||a).localeCompare(Languages.get(b).name||b));
+  box.textContent=''; let shown=0;
+  for(const code of codes){
+    const l=Languages.get(code)||{name:code,native:code}, has=spoken.has(code);
+    if(voiceOnly&&!has) continue;
+    if(q&&(l.name+' '+l.native+' '+code).toLowerCase().indexOf(q)===-1) continue;
+    shown++;
+    const row=document.createElement('label'); row.className='langrow'+(has?'':' novoice');
+    const cb=document.createElement('input'); cb.type='checkbox'; cb.checked=on.has(code);
+    cb.addEventListener('change',()=>{cb.checked?opConfig.featured.push(code):opConfig.featured.splice(opConfig.featured.indexOf(code),1);count();});
+    row.appendChild(cb);
+    const nm=document.createElement('span'); nm.className='lname'; nm.textContent=l.name; row.appendChild(nm);
+    const nat=document.createElement('span'); nat.className='lsub'; nat.textContent=l.native===l.name?'':l.native; row.appendChild(nat);
+    const tg=document.createElement('span'); tg.className='ltag'; tg.textContent=has?'voice':'captions only'; row.appendChild(tg);
+    box.appendChild(row);
+  }
+  if(!shown){const p=document.createElement('p');p.className='hint';p.textContent='Nothing matches that.';box.appendChild(p);}
+  count();
+}
+function count(){$('opLangCount').textContent=opConfig.featured.length+' of '+Languages.codes().length+
+  ' on. These are what a listener sees first — the rest stay reachable by search.';}
+$('opLangFilter').addEventListener('input',render);
+$('opLangVoiceOnly').addEventListener('change',render);
+$('opLangNone').addEventListener('click',()=>{opConfig.featured.length=0;render();});
+render();
+</script></body></html>

app/_probe-bare.mjs

@@ -0,0 +1,25 @@
+import { pipeline, env } from '@huggingface/transformers';
+import { createRequire } from 'module';
+import os from 'os'; import path from 'path';
+const require = createRequire(import.meta.url);
+const Guard = require('./mt-guard.js');
+const B = require('./bible-lexicon.js');
+env.allowLocalModels = false;
+env.cacheDir = path.join(os.homedir(), 'Library/Application Support/Church Translate Models');
+const pipe = await pipeline('translation', 'Xenova/nllb-200-distilled-600M', { dtype: 'fp32' });
+const say = async (t, l) => {
+  const o = await pipe(t, { src_lang: 'eng_Latn', tgt_lang: l });
+  return (Array.isArray(o) ? o[0] : o).translation_text.trim();
+};
+const lex = B.forLanguage('spa_Latn');
+const BARE = ['Peter.','John.','Matthew.','Noah.','Paul.','Moses.','David.','Abraham.','Jesus.','Mary.','Habakkuk.','Genesis.','Romans.','Peter','John'];
+console.log('a BARE NAME as the whole utterance:\n');
+for (const t of BARE) {
+  const raw = await say(t, 'spa_Latn');
+  const g = Guard.clean(t, raw);
+  const bare = t.replace(/\.$/, '');
+  const want = lex[bare] || bare;
+  const kept = g.text.toLowerCase().indexOf(want.toLowerCase()) !== -1 ||
+               g.text.toLowerCase().indexOf(bare.toLowerCase()) !== -1;
+  console.log('  ' + t.padEnd(12) + 'NLLB: ' + raw.padEnd(32) + 'after guard: ' + g.text.padEnd(26) + (kept ? '' : '<-- NAME LOST'));
+}

app/_probe-book.mjs

@@ -0,0 +1,32 @@
+import { pipeline, env } from '@huggingface/transformers';
+import os from 'os'; import path from 'path';
+env.allowLocalModels=false;
+env.cacheDir=path.join(os.homedir(),'Library/Application Support/Church Translate Models');
+const pipe=await pipeline('translation','Xenova/nllb-200-distilled-600M',{dtype:'fp32'});
+
+const PHRASINGS=[
+ 'Open up to the book of John.',
+ 'Open to the book of John.',
+ 'Turn to the book of John.',
+ 'Turn with me to the book of John.',
+ 'Go to the book of John.',
+ 'Open your Bibles to the book of John.',
+ 'The book of John chapter three.',
+ 'In the book of Romans Paul writes this.',
+ 'Read the book of Genesis with me.',
+ 'This is a test of the names Jacob, Peter, John.',
+ 'Jacob, Peter and John were there.',
+ 'The names are Jacob, Peter and John.'
+];
+console.log('=== SPANISH: which phrasings get "libro" and which get "obra"? ===');
+for (const t of PHRASINGS) {
+  const o=await pipe(t,{src_lang:'eng_Latn',tgt_lang:'spa_Latn'});
+  const s=(Array.isArray(o)?o[0]:o).translation_text.trim();
+  const flag=/\bobra/i.test(s)?'  <-- OBRA (wrong)':(/\blibro/i.test(s)?'  libro OK':'');
+  console.log('  '+t+'\n     '+s+flag);
+}
+console.log('\n=== "the book of X" across the served languages ===');
+for (const lang of ['spa_Latn','por_Latn','fra_Latn','zho_Hans','kor_Hang','vie_Latn','hat_Latn','arb_Arab','hin_Deva']) {
+  const o=await pipe('Open up to the book of John.',{src_lang:'eng_Latn',tgt_lang:lang});
+  console.log('  '+lang+'  '+(Array.isArray(o)?o[0]:o).translation_text.trim());
+}

app/_probe-dot.mjs

@@ -0,0 +1,22 @@
+import { pipeline, env } from '@huggingface/transformers';
+import os from 'os'; import path from 'path';
+env.allowLocalModels = false;
+env.cacheDir = path.join(os.homedir(), 'Library/Application Support/Church Translate Models');
+const pipe = await pipeline('translation', 'Xenova/nllb-200-distilled-600M', { dtype: 'fp32' });
+const say = async (t, l) => {
+  const o = await pipe(t, { src_lang: 'eng_Latn', tgt_lang: l });
+  return (Array.isArray(o) ? o[0] : o).translation_text.trim();
+};
+const CASES = ['Peter.','John.','Matthew.','Noah.','Jesus.','Mary.','Moses.','Habakkuk.','Donald Trump.',
+               'Yes.','Okay.','Right.','Exactly.','Amen.','Watch this.','Come on.','Genesis.','Romans.',
+               'Simon Peter.','John the Baptist.'];
+const LANGS = ['spa_Latn','por_Latn','fra_Latn'];
+for (const lang of LANGS) {
+  console.log('\n=== ' + lang + ' ===');
+  console.log('  input'.padEnd(22) + 'WITH the period'.padEnd(34) + 'period STRIPPED before MT');
+  for (const t of CASES) {
+    const withDot = await say(t, lang);
+    const stripped = await say(t.replace(/[.!?]+$/, ''), lang);
+    console.log('  ' + t.padEnd(20) + withDot.slice(0, 32).padEnd(34) + stripped.slice(0, 32));
+  }
+}

app/_probe-idioms.mjs

@@ -0,0 +1,43 @@
+import { pipeline, env } from '@huggingface/transformers';
+import os from 'os'; import path from 'path';
+env.allowLocalModels=false;
+env.cacheDir=path.join(os.homedir(),'Library/Application Support/Church Translate Models');
+const pipe=await pipeline('translation','Xenova/nllb-200-distilled-600M',{dtype:'fp32'});
+const say=async(t,l='spa_Latn')=>{const o=await pipe(t,{src_lang:'eng_Latn',tgt_lang:l});return (Array.isArray(o)?o[0]:o).translation_text.trim();};
+
+/* Real preaching idioms. The question for each is not "is it good Spanish" but
+   "did the MEANING survive" — a fluent wrong answer is the dangerous case. */
+const IDIOMS=[
+ 'Open up to the book of John.',
+ 'Open up to John chapter three.',
+ 'Open up your Bibles.',
+ 'Turn with me to John chapter three.',
+ 'Look at verse four with me.',
+ 'Drop down to verse ten.',
+ 'Back up to verse one.',
+ 'Come on, somebody.',
+ 'Give God a hand of praise.',
+ 'Put a hand on your neighbor.',
+ 'Say it with me.',
+ 'Can somebody say amen.',
+ 'I want you to catch this.',
+ 'Watch this.',
+ 'Are you tracking with me.',
+ 'That will preach.',
+ 'He is a good good Father.',
+ 'God showed up.',
+ 'The enemy is defeated.',
+ 'Walk it out.',
+ 'Let that sink in.',
+ 'Write this down.',
+ 'Circle that in your Bible.',
+ 'Underline that word.',
+ 'We are going to camp out here for a minute.',
+ 'Let me unpack that for you.',
+ 'Turn the page.',
+ 'Stand to your feet.',
+ 'Bow your heads with me.'
+];
+console.log('idiom -> Spanish');
+console.log('='.repeat(70));
+for (const t of IDIOMS) console.log('  '+t+'\n     '+await say(t));

app/_probe-names.mjs

@@ -0,0 +1,41 @@
+import { pipeline, env } from '@huggingface/transformers';
+import { createRequire } from 'module';
+import os from 'os'; import path from 'path'; import fs from 'fs';
+const require = createRequire(import.meta.url);
+env.allowLocalModels=false;
+env.cacheDir=path.join(os.homedir(),'Library/Application Support/Church Translate Models');
+const pipe=await pipeline('translation','Xenova/nllb-200-distilled-600M',{dtype:'fp32'});
+
+/* The names a preacher actually says, frequency-ranked from the owner's own
+   Strong's export, plus the Gospel/epistle authors that are rare INSIDE
+   scripture but constant as book references. */
+const ranked=require('/private/tmp/claude-502/-Users-Studio-Documents-BandLineupDisplay/cee248f6-d861-4845-bd13-03867cf46596/scratchpad/proper-nouns.json')
+  .map(r=>r.english).filter(n=>/^[A-Z][a-z]+$/.test(n));
+const NAMES=[...new Set(['Matthew','Mark','Luke','John','Paul','Peter','James','Jude','Timothy','Titus',
+ 'Jesus','Moses','David','Abraham','Isaac','Jacob','Joseph','Mary','Elijah','Isaiah','Jeremiah',
+ 'Daniel','Solomon','Samuel','Saul','Noah','Adam','Eve','Joshua','Thomas','Philip','Andrew',
+ 'Stephen','Barnabas','Silas','Apollos','Lazarus','Nicodemus','Pilate','Herod','Jerusalem',
+ 'Bethlehem','Nazareth','Galilee','Egypt','Babylon','Corinth','Ephesus','Rome','Zion',
+ ...ranked.slice(0,20)])].slice(0,60);
+
+const LANGS=['por_Latn','fra_Latn','zho_Hans','zho_Hant','kor_Hang','vie_Latn','hat_Latn','arb_Arab','hin_Deva'];
+const LATIN=/[A-Za-z]/;
+const NONLATIN=new Set(['zho_Hans','zho_Hant','kor_Hang','arb_Arab','hin_Deva']);
+
+const out={};
+for (const lang of LANGS) {
+  out[lang]={};
+  for (const n of NAMES) {
+    const o=await pipe('We read about '+n+' in the Bible.',{src_lang:'eng_Latn',tgt_lang:lang});
+    out[lang][n]=(Array.isArray(o)?o[0]:o).translation_text.trim();
+  }
+  /* For a non-Latin script, surviving Latin letters mean the name was never
+     translated at all — an unambiguous, mechanically detectable failure. */
+  const survived=NONLATIN.has(lang)
+    ? NAMES.filter(n=>LATIN.test(out[lang][n]))
+    : NAMES.filter(n=>new RegExp('\\b'+n+'\\b').test(out[lang][n]));
+  console.log(lang+'  '+String(survived.length).padStart(2)+'/'+NAMES.length+' names left in ENGLISH: '+survived.slice(0,18).join(', ')+(survived.length>18?' …':''));
+  out[lang]._survived=survived;
+}
+fs.writeFileSync('/tmp/name-probe.json',JSON.stringify(out,null,1));
+console.log('\nsaved /tmp/name-probe.json');

app/_probe-nllb.mjs

@@ -0,0 +1,53 @@
+/* Measure the hallucination and what actually stops it. Runs the same model,
+   dtype and cache the app uses, in a plain node process like mt-service.js. */
+import { pipeline, env } from '@huggingface/transformers';
+import os from 'os';
+import path from 'path';
+
+env.allowLocalModels = false;
+env.cacheDir = path.join(os.homedir(), 'Library/Application Support/Church Translate Models');
+
+const t0 = Date.now();
+const pipe = await pipeline('translation', 'Xenova/nllb-200-distilled-600M', { dtype: 'fp32' });
+console.log('loaded in ' + ((Date.now() - t0) / 1000).toFixed(1) + 's\n');
+
+/* The exact lines from the operator's screenshot, plus stress cases. */
+const CASES = [
+  'Donald Trump.',
+  'Hello, hello.',
+  'His name was John.',
+  'Open up to the book, Matthew.',
+  'Today we are going to talk about Peter in the Bible.',
+  'Turn with me to John chapter 3.',
+  'Amen.',
+  'Jesus wept.',
+  'Paul wrote to the church at Corinth.',
+  'How many countries in the world?',
+  'And God said, let there be light, and there was light.'
+];
+
+const CONFIGS = [
+  { name: 'current (no params)', opts: {} },
+  { name: 'cap 2x+8',            opts: null, cap: (n) => Math.ceil(n * 2) + 8 },
+  { name: 'cap 2x+8 +nrng3',     opts: { no_repeat_ngram_size: 3 }, cap: (n) => Math.ceil(n * 2) + 8 },
+  { name: 'beams2 cap2x+8',      opts: { num_beams: 2, no_repeat_ngram_size: 3 }, cap: (n) => Math.ceil(n * 2) + 8 }
+];
+
+const tok = pipe.tokenizer;
+for (const cfg of CONFIGS) {
+  console.log('=== ' + cfg.name + ' ===');
+  let total = 0;
+  for (const text of CASES) {
+    const nIn = tok(text).input_ids.dims.at(-1);
+    const opts = Object.assign({ src_lang: 'eng_Latn', tgt_lang: 'spa_Latn' }, cfg.opts || {});
+    if (cfg.cap) opts.max_new_tokens = cfg.cap(nIn);
+    const s = Date.now();
+    const out = await pipe(text, opts);
+    const ms = Date.now() - s;
+    total += ms;
+    const got = (Array.isArray(out) ? out[0] : out).translation_text.trim();
+    const flag = (!/[?？]/.test(text) && /[?？]/.test(got)) ? '  <-- INVENTED A QUESTION' : '';
+    console.log('  ' + String(ms).padStart(5) + 'ms  in' + String(nIn).padStart(3) + '  ' + got + flag);
+  }
+  console.log('  total ' + total + 'ms\n');
+}

app/_probe-number.mjs

@@ -0,0 +1,45 @@
+import { pipeline, env } from '@huggingface/transformers';
+import os from 'os'; import path from 'path';
+env.allowLocalModels=false;
+env.cacheDir=path.join(os.homedir(),'Library/Application Support/Church Translate Models');
+const pipe=await pipeline('translation','Xenova/nllb-200-distilled-600M',{dtype:'fp32'});
+const say=async(t)=>{const o=await pipe(t,{src_lang:'eng_Latn',tgt_lang:'spa_Latn'});return (Array.isArray(o)?o[0]:o).translation_text.trim();};
+
+/* Unambiguous number markers only. Verb endings are skipped deliberately —
+   they are where the ambiguity lives, so counting them would beg the question. */
+function number(s){
+  const SING=/\b(tú|ti|tu|tus|te|contigo|usted|consigo)\b/i;
+  const PLUR_LA=/\b(ustedes|sus)\b/i;
+  const PLUR_ES=/\b(vosotros|vuestr[oa]s?|os)\b/i;
+  const vosVerb=/\w(áis|éis)\b|\b\w+[aei]d\b/;      // habláis / hablad
+  const sing=SING.test(s), la=PLUR_LA.test(s), es=PLUR_ES.test(s)||vosVerb.test(s);
+  if (es && !sing) return 'PLURAL (Peninsular)';
+  if (la && !sing) return 'PLURAL (LatAm)';
+  if (sing && !la && !es) return 'SINGULAR';
+  if (sing && (la||es)) return 'MIXED — both in one sentence';
+  return 'unmarked';
+}
+
+/* Every one of these is a preacher speaking to a room, so every one should be
+   PLURAL in Spanish. Anything singular is the model guessing wrong. */
+const TO_THE_ROOM=[
+ 'Open your Bibles.','Bow your heads with me.','Lift your hands.','Close your eyes.',
+ 'Stand to your feet.','Repeat after me.','Pray with me.','Look at verse four with me.',
+ 'Turn to the person next to you.','Give thanks to the Lord.','Come to the altar.',
+ 'Listen to me carefully.','I want you to understand this.','You are the light of the world.',
+ 'Do you believe that?','Love one another.','Do not be afraid.','Remember what He did for you.',
+ 'God has a plan for you.','You have been forgiven.','Trust in the Lord with all your heart.',
+ 'Forgive those who hurt you.','You cannot serve two masters.','Take out your notes.',
+ 'Say it with me.','Are you ready?','Let us pray together.','Turn the page with me.'
+];
+const tally={};
+console.log('every line below is addressed to a ROOM, so every one should be PLURAL\n');
+for (const t of TO_THE_ROOM) {
+  const s=await say(t); const n=number(s);
+  tally[n]=(tally[n]||0)+1;
+  const bad = n==='SINGULAR' ? '   <-- singular: wrong for a congregation' : '';
+  console.log('  '+n.padEnd(24)+s+bad);
+}
+console.log('\nTALLY of '+TO_THE_ROOM.length+' congregation-directed sentences:');
+for (const [k,v] of Object.entries(tally).sort((a,b)=>b[1]-a[1]))
+  console.log('   '+String(v).padStart(3)+'  '+k+'   ('+Math.round(v/TO_THE_ROOM.length*100)+'%)');

app/_probe-progress.mjs

@@ -0,0 +1,34 @@
+/* Everything below is already on disk. Whatever this prints is what the app
+   calls "Downloading". */
+import { pipeline, env } from '@huggingface/transformers';
+import os from 'os'; import path from 'path';
+env.allowLocalModels = false;
+env.cacheDir = path.join(os.homedir(), 'Library/Application Support/Church Translate Models');
+
+const seen = [];
+const t0 = Date.now();
+await pipeline('translation', 'Xenova/nllb-200-distilled-600M', {
+  dtype: 'fp32',
+  progress_callback: (p) => seen.push({ ms: Date.now() - t0, ...p })
+});
+
+const byStatus = {};
+for (const e of seen) byStatus[e.status] = (byStatus[e.status] || 0) + 1;
+console.log('event counts by status:', byStatus);
+console.log('total events:', seen.length, 'over', ((Date.now()-t0)/1000).toFixed(1) + 's\n');
+
+console.log('per file — did any bytes actually move?');
+const files = {};
+for (const e of seen) {
+  if (!e.file) continue;
+  const f = files[e.file] || (files[e.file] = { statuses: new Set(), maxTotal: 0, progressEvents: 0 });
+  f.statuses.add(e.status);
+  if (e.total) f.maxTotal = Math.max(f.maxTotal, e.total);
+  if (e.status === 'progress') f.progressEvents++;
+}
+for (const [name, f] of Object.entries(files)) {
+  console.log('  ' + name.padEnd(38) +
+    (f.maxTotal ? (f.maxTotal / 1048576).toFixed(1) + ' MB' : '   —   ').padStart(10) +
+    '  progress-events=' + String(f.progressEvents).padEnd(5) +
+    '  [' + Array.from(f.statuses).join(', ') + ']');
+}

app/_probe-register.mjs

@@ -0,0 +1,42 @@
+import { pipeline, env } from '@huggingface/transformers';
+import os from 'os'; import path from 'path';
+env.allowLocalModels=false;
+env.cacheDir=path.join(os.homedir(),'Library/Application Support/Church Translate Models');
+const pipe=await pipeline('translation','Xenova/nllb-200-distilled-600M',{dtype:'fp32'});
+const say=async(t)=>{const o=await pipe(t,{src_lang:'eng_Latn',tgt_lang:'spa_Latn'});return (Array.isArray(o)?o[0]:o).translation_text.trim();};
+
+/* Classify which form of address NLLB reached for. */
+function reg(s){
+  const hits=[];
+  if (/\bvosotros\b|\bvuestr[oa]s?\b|\bos\b(?!\s*[.,])/i.test(s)) hits.push('VOSOTROS');
+  if (/\bustedes\b/i.test(s)) hits.push('ustedes');
+  if (/\busted\b/i.test(s)) hits.push('usted');
+  /* vosotros verb endings */
+  if (/\w(áis|éis|ís)\b/.test(s)) hits.push('VOSOTROS-verb');
+  /* tú imperatives / 2sg endings */
+  if (/\b(mira|abre|vuelve|ven|escucha|piensa|deja|pon|ve|di|haz|sé)\b/i.test(s)) hits.push('tú');
+  /* ustedes imperative/3pl */
+  if (/\w(en|an)\b/.test(s) && /\b(abran|miren|vengan|escuchen|piensen|dejen|pongan|vayan|digan|hagan|estén|sean|levanten|inclinen)\b/i.test(s)) hits.push('ustedes-verb');
+  return hits.length?hits.join('+'):'—';
+}
+
+const LINES=[
+ 'Open your Bibles.','Open your Bibles to John chapter three.','Bow your heads with me.',
+ 'Stand to your feet.','Turn to the person next to you.','Listen to me carefully.',
+ 'I want you to understand this.','God has a plan for you.','You are the light of the world.',
+ 'You cannot serve two masters.','Do you believe that?','Are you following me?',
+ 'Lift your hands.','Close your eyes.','Repeat after me.','Come to the altar.',
+ 'Give thanks to the Lord.','Pray with me.','Look at verse four with me.',
+ 'Remember what He did for you.','You have been forgiven.','Do not be afraid.',
+ 'Love one another.','Forgive those who hurt you.','Trust in the Lord with all your heart.'
+];
+console.log('English  ->  Spanish   [register NLLB chose]');
+console.log('='.repeat(78));
+const tally={};
+for (const t of LINES) {
+  const s=await say(t); const r=reg(s);
+  for (const k of r.split('+')) tally[k]=(tally[k]||0)+1;
+  console.log('  '+t+'\n     '+s+'\n       ['+r+']');
+}
+console.log('\nTALLY across '+LINES.length+' direct-address sentences:');
+for (const [k,v] of Object.entries(tally).sort((a,b)=>b[1]-a[1])) console.log('   '+String(v).padStart(3)+'  '+k);

app/_probe-rewrites.mjs

@@ -0,0 +1,33 @@
+import { pipeline, env } from '@huggingface/transformers';
+import os from 'os'; import path from 'path';
+env.allowLocalModels=false;
+env.cacheDir=path.join(os.homedir(),'Library/Application Support/Church Translate Models');
+const pipe=await pipeline('translation','Xenova/nllb-200-distilled-600M',{dtype:'fp32'});
+const say=async(t,l)=>{const o=await pipe(t,{src_lang:'eng_Latn',tgt_lang:l});return (Array.isArray(o)?o[0]:o).translation_text.trim();};
+
+/* Each candidate must EARN its place: the rewrite has to beat the original in
+   more than one language, or it is just a different guess. */
+const PAIRS=[
+ ['Open up to the book of John.',        'Turn to the book of John.'],
+ ['Circle that in your Bible.',          'Mark that in your Bible.'],
+ ['Let that sink in.',                   'Think carefully about that.'],
+ ['Walk it out.',                        'Put it into practice.'],
+ ['That will preach.',                   'That is worth preaching.'],
+ ['Let me unpack that for you.',         'Let me explain that to you.'],
+ ['We are going to camp out here for a minute.','We are going to stay here for a minute.'],
+ ['Give God a hand of praise.',          'Applaud to praise God.'],
+ ['Put a hand on your neighbor.',        'Put a hand on the person next to you.'],
+ ['Drop down to verse ten.',             'Go to verse ten.'],
+ ['Back up to verse one.',               'Go back to verse one.'],
+ ['Are you tracking with me.',           'Are you following me.'],
+ ['I want you to catch this.',           'I want you to understand this.'],
+ ['God showed up.',                      'God was present.']
+];
+const LANGS=['spa_Latn','por_Latn','fra_Latn'];
+for (const [before,after] of PAIRS) {
+  console.log('\n' + before + '\n  -> ' + after);
+  for (const l of LANGS) {
+    const b=await say(before,l), a=await say(after,l);
+    console.log('   '+l.slice(0,3)+'  was: '+b+'\n        now: '+a+(a===b?'   (no change)':''));
+  }
+}

app/_probe-short.mjs

@@ -0,0 +1,34 @@
+import { pipeline, env } from '@huggingface/transformers';
+import { createRequire } from 'module';
+import os from 'os'; import path from 'path'; import fs from 'fs'; import vm from 'vm';
+const require = createRequire(import.meta.url);
+const Liturgy=require('./liturgy.js'), Guard=require('./mt-guard.js');
+const Preach=require('./preach.js'), B=require('./bible-lexicon.js'), Spa=require('./spa-variants.js');
+const esrc=fs.readFileSync('engine.js','utf8');
+const sb={console}; vm.createContext(sb);
+vm.runInContext(esrc.slice(esrc.indexOf('const SCRIPT_NO_SPACES'), esrc.indexOf('function applyFixes')), sb);
+env.allowLocalModels=false;
+env.cacheDir=path.join(os.homedir(),'Library/Application Support/Church Translate Models');
+const pipe=await pipeline('translation','Xenova/nllb-200-distilled-600M',{dtype:'fp32'});
+
+async function full(sentence, lang){
+  const set=Liturgy.lookup(sentence,lang); if(set) return [set,'liturgy'];
+  const named=B.wholeUtterance(sentence,lang); if(named) return [named,'name'];
+  const forMt=Preach.forTranslation(sentence);
+  const sd=Preach.stripShortPeriod(forMt);
+  const o=await pipe(sd.text,{src_lang:'eng_Latn',tgt_lang:lang});
+  let raw=(Array.isArray(o)?o[0]:o).translation_text.trim();
+  raw=Guard.clean(sd.text,raw).text;
+  raw=Preach.restorePeriod(raw,sd.hadPeriod);
+  if(lang==='spa_Latn') raw=Spa.toLatinAmerican(Spa.toChurchRegister(raw));
+  const bl=B.forLanguage(lang);
+  if(bl) raw=sb.applyTable(raw,Object.keys(bl).map(f=>({from:f,to:bl[f]})));
+  return [raw,'model'];
+}
+
+const CASES=['Hello.','What?','Amen.','Hallelujah.','Peter.','Okay.','Check.','Faith.','Hello?',
+             'No.','Jesus.','Yeah.','All right.','Right?','Holy Spirit.','Death.','Yeah?',
+             'Praise God.','Grace.','Hope.','Love.','Sin.','Heaven.','Prayer.','Worship.',
+             'Testing.','One two.','Mic check.','Good.','Wow.','Listen.','Look.','Come.','Stand.'];
+console.log('  English'.padEnd(18)+'now'.padEnd(30)+'via');
+for (const t of CASES){ const [r,how]=await full(t,'spa_Latn'); console.log('  '+t.padEnd(16)+String(r).slice(0,28).padEnd(30)+how); }

app/_proto-columns.html

@@ -0,0 +1,38 @@
+<!doctype html><html><head><meta charset="utf-8">
+<link rel="stylesheet" href="./engine.css">
+<style>body{padding:1.25rem;max-width:44rem;margin:0 auto}</style>
+</head><body>
+<section class="card">
+  <h2>Languages on the front page</h2>
+  <p class="hint" id="opLangCount"></p>
+  <div class="row">
+    <input id="opLangFilter" type="search" placeholder="Filter languages…" autocomplete="off">
+    <label class="oprow"><input type="checkbox" id="opLangVoiceOnly"><span>With a voice only</span></label>
+    <button class="btn" id="opLangNone">Turn all off</button>
+  </div>
+  <div class="langcols">
+    <div class="langcol"><div class="langcolhead">On <b id="opLangNOn">0</b></div>
+      <div id="opLangOn" class="langlist"></div></div>
+    <div class="langcol"><div class="langcolhead">Off <b id="opLangNOff">0</b></div>
+      <div id="opLangOff" class="langlist"></div></div>
+  </div>
+  <label class="oprow"><input type="checkbox" id="opAllowAll" checked><span>Let listeners pick any language</span></label>
+  <p class="hint" id="opAllowAllHint"></p>
+</section>
+<script src="./languages.js"></script><script src="./voice-catalog.js"></script>
+<script>
+/* Globals the extracted functions expect. */
+const $=(i)=>document.getElementById(i);
+let opConfig={featured:["spa_Latn","por_Latn","por_PT"],allowAllLanguages:true};
+let featuredSaveTimer=null, lastConfigSig='';
+function opSave(){ return Promise.resolve(); }
+function loadOperator(){}
+function renderOpLanguages(){ renderOpLangList(); }
+</script>
+<script>
+/* THE REAL renderOpLangList / renderOpLangCount / toggleFeatured / flyRow,
+   pasted verbatim by the build step below — no reimplementation. */
+</script>
+<script src="./_extracted.js"></script>
+<script>renderOpLangList();</script>
+</body></html>

app/_static.js

@@ -0,0 +1,18 @@
+/* Throwaway static server so the operator-page preview can be looked at in a
+   browser. Absolute root, no reliance on cwd — the launcher's working
+   directory is not readable in this sandbox. */
+const http = require('http');
+const fs = require('fs');
+const path = require('path');
+const ROOT = '/Users/Studio/Documents/church-translate/app';
+const TYPES = { '.html': 'text/html', '.js': 'text/javascript', '.css': 'text/css', '.json': 'application/json' };
+http.createServer((req, res) => {
+  const rel = decodeURIComponent(req.url.split('?')[0]).replace(/^\/+/, '') || '_preview-langlist.html';
+  const file = path.join(ROOT, rel);
+  if (!file.startsWith(ROOT)) { res.writeHead(403).end('no'); return; }
+  fs.readFile(file, (err, buf) => {
+    if (err) { res.writeHead(404).end('not found: ' + rel); return; }
+    res.writeHead(200, { 'Content-Type': TYPES[path.extname(file)] || 'application/octet-stream' });
+    res.end(buf);
+  });
+}).listen(4873, '127.0.0.1', () => console.log('preview on http://127.0.0.1:4873'));

app/_sweep-batch.mjs

@@ -0,0 +1,46 @@
+/* Does the batched path have a cliff at N=4..6? Sweep every N through the REAL
+   service, interleaved A/B so machine load hits both arms equally. */
+import { fork } from 'child_process';
+import os from 'os'; import path from 'path';
+import { fileURLToPath } from 'url';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const MODELS_DIR = path.join(os.homedir(), 'Library/Application Support/Church Translate Models');
+const LANGS = ['spa_Latn','por_Latn','fra_Latn','zho_Hans','hat_Latn','hin_Deva','kor_Hang','vie_Latn','arb_Arab'];
+const TEXT = 'And I want you to understand that God has a plan for your life';
+
+const child = fork(path.join(__dirname, 'mt-service.js'), [], { stdio: ['ignore','pipe','pipe','ipc'] });
+child.stderr.on('data', () => {});
+let seq = 0; const pending = new Map();
+child.on('message', (m) => {
+  if (m.type === 'ready') { pending.get('ready')(); return; }
+  if (m.type === 'progress' || m.type === 'note') return;
+  const w = pending.get(m.id); if (!w) return; pending.delete(m.id);
+  if (m.type === 'error') w.reject(new Error(m.message));
+  else w.resolve(m.type === 'multi' ? m.texts : m.text);
+});
+const send = (p) => new Promise((resolve, reject) => { const id = ++seq; pending.set(id, {resolve,reject}); child.send({...p, id}); });
+const ready = new Promise(r => pending.set('ready', r));
+child.send({ type:'load', model:'Xenova/nllb-200-distilled-600M', dtype:'fp32', cacheDir: MODELS_DIR });
+await ready;
+
+const one  = (t) => send({ type:'translate', text:TEXT, src:'eng_Latn', tgt:t });
+const many = (ts) => send({ type:'translateMulti', text:TEXT, src:'eng_Latn', tgts:ts });
+await one('spa_Latn'); await many(['spa_Latn','fra_Latn']);
+
+const REPS = 3;
+console.log(' N | serial(med) | batched(med) | speedup | identical');
+console.log('---+-------------+--------------+---------+----------');
+for (let n = 1; n <= 9; n++) {
+  const langs = LANGS.slice(0, n);
+  const S = [], B = []; let same = 0, tot = 0;
+  for (let r = 0; r < REPS; r++) {
+    let t = Date.now(); const so = {}; for (const l of langs) so[l] = await one(l); S.push(Date.now()-t);
+    t = Date.now(); const bo = await many(langs); B.push(Date.now()-t);
+    for (const l of langs) { tot++; if (so[l] === bo[l]) same++; }
+  }
+  const med = (a) => a.sort((x,y)=>x-y)[Math.floor(a.length/2)];
+  const s = med(S), b = med(B);
+  console.log(String(n).padStart(2) + ' | ' + (s+'ms').padStart(11) + ' | ' + (b+'ms').padStart(12) +
+    ' | ' + ((s/b).toFixed(2)+'x').padStart(7) + ' | ' + same + '/' + tot);
+}
+child.kill();

app/_test-conjugation.js

@@ -0,0 +1,40 @@
+/* Unit-test the Spanish conjugation repairs against MEASURED NLLB output — no model needed.
+   Every 'from' is a non-word (safe by construction); every real form must pass untouched. */
+const S = require('./spa-variants.js');
+let pass = 0, fail = 0;
+const t = (label, input, want) => {
+  const got = S.toChurchRegister(input);
+  const ok = got === want;
+  console.log((ok ? '  PASS  ' : '  FAIL  ') + label + (ok ? '' : '\n          got  "' + got + '"\n          want "' + want + '"'));
+  ok ? pass++ : fail++;
+};
+
+console.log('\nMEASURED NON-WORDS — must be repaired');
+t('bendecemos (transcript 2026-09-13)', 'Te bendecemos, Señor.', 'Te bendecimos, Señor.');
+t('bendicemos (transcript)', 'Bendicemos el nombre de Jesús.', 'Bendecimos el nombre de Jesús.');
+t('bendimos (transcript)', 'Bendimos su nombre.', 'Bendecimos su nombre.');
+t('bendicimos', 'Hoy bendicimos al Señor.', 'Hoy bendecimos al Señor.');
+t('bendico', 'Yo te bendico.', 'Yo te bendigo.');
+t('bendecen', 'Ellos bendecen a Dios.', 'Ellos bendicen a Dios.');
+t('bendiciré', 'Bendiciré al Señor.', 'Bendeciré al Señor.');
+t('benditaremos / bendiciremos', 'Bendiciremos tu nombre. Benditaremos tu nombre.', 'Bendeciremos tu nombre. Bendeciremos tu nombre.');
+t('bendíelo -> 1pl hortative, NOT the tú imperative', '¡Bendíelo!', '¡Bendigámoslo!');
+t('bendíalo', 'Bendíalo, pueblo.', 'Bendigámoslo, pueblo.');
+t('maldiciré', 'No maldiciré.', 'No maldeciré.');
+t('pedamos', 'Pedamos en su nombre.', 'Pidamos en su nombre.');
+t('ungas / undémonos / redémonos', 'Que ungas a tu siervo. Undémonos, Señor. Redémonos, Señor.', 'Que unjas a tu siervo. Úngenos, Señor. Redímenos, Señor.');
+t('dás', 'Tú nos dás vida.', 'Tú nos das vida.');
+t('capital preserved at sentence start', 'Bendecemos tu nombre.', 'Bendecimos tu nombre.');
+
+console.log('\nREAL FORMS — must not be touched');
+for (const real of ['Bendecimos su nombre.', 'Dios te bendiga.', 'Bendice, alma mía, al Señor.', 'Bendito sea el nombre del Señor.',
+                    'Bendiciones para todos.', 'La bendición de Dios.', 'Él nos bendijo.', 'Bendecirá a su pueblo.', 'Bendiciendo al Señor.',
+                    'Yo bendigo al Señor.', 'Ustedes bendicen a Dios.', 'Pidamos con fe.', 'Nos das vida.', 'Úngenos con tu Espíritu.']) {
+  t('untouched: ' + real, real, real);
+}
+
+console.log('\nEXISTING REGISTER PASS still runs');
+t('rezar -> orar', 'Vamos a rezar juntos.', 'Vamos a orar juntos.');
+
+console.log('\n' + pass + ' passed, ' + fail + ' failed');
+process.exit(fail ? 1 : 0);

app/_test-delay.mjs

@@ -0,0 +1,123 @@
+/*
+ * Does the stream delay hold back the INTERNET without holding back the ROOM?
+ *
+ * Starts the real server on a spare port with a throwaway DATA_DIR, connects
+ * two listeners — one plain (the room), one carrying x-forwarded-for (through
+ * the tunnel) — plus a fake engine, and times when each one is told things.
+ */
+import { spawn } from 'child_process';
+import { WebSocket } from 'ws';
+import fs from 'fs'; import os from 'os'; import path from 'path';
+import { fileURLToPath } from 'url';
+
+const DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'ct-delay-'));
+const PORT = 3199;
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+const srv = spawn(process.execPath, [path.join(__dirname, 'server', 'server.js')],
+  { env: { ...process.env, PORT: String(PORT), DATA_DIR: DIR }, stdio: ['ignore', 'pipe', 'pipe'] });
+const logs = [];
+srv.stdout.on('data', (d) => logs.push(String(d)));
+srv.stderr.on('data', (d) => logs.push('ERR ' + d));
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const B = 'http://127.0.0.1:' + PORT;
+/* Wait for OUR server, identified by the config it writes into OUR dir — a
+   stray copy left on this port by an earlier run would answer /healthz and
+   then be tested instead. */
+const CFG = path.join(DIR, 'config.json');
+for (let i = 0; i < 80; i++) {
+  if (fs.existsSync(CFG)) { try { await fetch(B + '/healthz'); break; } catch (_) {} }
+  await sleep(150);
+}
+if (!fs.existsSync(CFG)) {
+  console.error('server never started. log:\n' + logs.join(''));
+  srv.kill(); process.exit(1);
+}
+const cfg = JSON.parse(fs.readFileSync(CFG, 'utf8'));
+const KEY = cfg.controlToken, PIN = cfg.operatorPin, EKEY = cfg.engineKey;
+console.log('server up on ' + PORT + '; new PIN is ' + PIN.length + ' digits');
+
+const DELAY = 4;
+await fetch(B + '/api/control/delay-set?s=' + DELAY + '&key=' + KEY);
+console.log('stream delay set to ' + DELAY + 's\n');
+
+function listener(label, headers) {
+  const ws = new WebSocket(B.replace('http', 'ws') + '/ws?role=listener&lang=eng_Latn', { headers });
+  const got = [];
+  ws.on('message', (raw) => {
+    const m = JSON.parse(raw);
+    got.push({ t: m.t, at: Date.now(), text: m.text, delaySec: m.delaySec });
+  });
+  return { label, ws, got, ready: new Promise((r) => ws.on('open', r)) };
+}
+const room   = listener('room  ', {});
+const remote = listener('remote', { 'x-forwarded-for': '203.0.113.7' });
+await Promise.all([room.ready, remote.ready]);
+
+const eng = new WebSocket(B.replace('http', 'ws') + '/ws?role=engine&key=' + encodeURIComponent(EKEY));
+await new Promise((r) => eng.on('open', r));
+await fetch(B + '/api/control/start?key=' + KEY);
+await sleep(300);
+
+const hello = (l) => l.got.find((g) => g.t === 'hello');
+console.log('hello.delaySec  room=' + hello(room).delaySec + '  remote=' + hello(remote).delaySec);
+
+const t0 = Date.now();
+eng.send(JSON.stringify({ t: 'final', text: 'God has a plan for your life', cid: 'c1', tr: {} }));
+await sleep(DELAY * 1000 + 1200);
+
+let pass = 0, fail = 0;
+const check = (label, ok, detail) => {
+  console.log((ok ? '  ok   ' : '  FAIL ') + label + (detail ? '   ' + detail : ''));
+  ok ? pass++ : fail++;
+};
+console.log('\ncaption arrival, measured from the moment the engine sent it:');
+for (const l of [room, remote]) {
+  const c = l.got.find((g) => g.t === 'caption');
+  const dt = c ? (c.at - t0) / 1000 : null;
+  console.log('  ' + l.label + ' ' + (c ? dt.toFixed(2) + 's  "' + c.text + '"' : 'NEVER ARRIVED'));
+}
+const rc = room.got.find((g) => g.t === 'caption'), xc = remote.got.find((g) => g.t === 'caption');
+check('the room gets it immediately', rc && (rc.at - t0) < 700, rc ? ((rc.at-t0)/1000).toFixed(2) + 's' : 'missing');
+check('the internet waits the delay', xc && (xc.at - t0) >= DELAY * 1000 - 300, xc ? ((xc.at-t0)/1000).toFixed(2) + 's' : 'missing');
+check('both got the same words', rc && xc && rc.text === xc.text);
+check('hello tells the room 0', hello(room).delaySec === 0);
+check('hello tells the internet ' + DELAY, hello(remote).delaySec === DELAY);
+
+console.log('\nlate joiner backlog (scrollback in the hello frame):');
+function joiner(headers) {
+  const ws = new WebSocket(B.replace('http', 'ws') + '/ws?role=listener&lang=eng_Latn', { headers });
+  return new Promise((res) => {
+    ws.on('message', (raw) => { const m = JSON.parse(raw); if (m.t === 'hello') { ws.close(); res(m); } });
+  });
+}
+const n = (h) => (h.scrollback || []).length;
+const jr = await joiner({});
+const jx = await joiner({ 'x-forwarded-for': '203.0.113.8' });
+console.log('  a sentence spoken ' + DELAY + '+s ago:');
+console.log('    room backlog ' + n(jr) + ' · remote backlog ' + n(jx));
+check('the room sees it', n(jr) >= 1);
+check('the internet sees it too — it is past their clock', n(jx) >= 1);
+
+/* Now the case that matters: something said JUST NOW must not reach a remote
+   joiner's backlog, or the delay is defeated by refreshing the page. */
+const before = n(jx);
+eng.send(JSON.stringify({ t: 'final', text: 'a secret just spoken', cid: 'c2', tr: {} }));
+await sleep(400);
+const jr2 = await joiner({});
+const jx2 = await joiner({ 'x-forwarded-for': '203.0.113.9' });
+const txt = (h) => (h.scrollback || []).map((r) => r.text).join(' | ');
+console.log('  a sentence spoken 0.4s ago:');
+console.log('    room   backlog: ' + txt(jr2));
+console.log('    remote backlog: ' + txt(jx2));
+check('the room sees the new sentence', txt(jr2).includes('a secret just spoken'));
+check('the internet does NOT — refreshing cannot skip the delay',
+      !txt(jx2).includes('a secret just spoken'));
+check('server sized the audio window for the delay', logs.join('').includes('audio window now'));
+
+console.log('\n--- server log ---');
+console.log(logs.join('').split('\n').filter((l) => /delay|window|START/.test(l)).map((l) => '  ' + l).join('\n'));
+console.log('\n' + pass + ' passed, ' + fail + ' failed');
+srv.kill(); fs.rmSync(DIR, { recursive: true, force: true });
+process.exit(fail ? 1 : 0);

app/_test-e2e.mjs

@@ -0,0 +1,37 @@
+/* The whole chain as engine.js runs it: split -> liturgy-or-NLLB -> guard. */
+import { pipeline, env } from '@huggingface/transformers';
+import { createRequire } from 'module';
+import os from 'os'; import path from 'path'; import fs from 'fs'; import vm from 'vm';
+const require = createRequire(import.meta.url);
+const Liturgy = require('./liturgy.js');
+const Guard = require('./mt-guard.js');
+
+const src = fs.readFileSync('engine.js','utf8');
+const sb={console}; vm.createContext(sb);
+vm.runInContext(src.match(/^const ABBREV_TAIL = .*$/m)[0], sb);
+const grab=(n)=>{const i=src.indexOf('function '+n+'(');let d=0;for(let k=src.indexOf('{',i);k<src.length;k++){if(src[k]==='{')d++;else if(src[k]==='}'&&--d===0)return src.slice(i,k+1);}};
+vm.runInContext(grab('splitSentences'), sb);
+
+env.allowLocalModels=false;
+env.cacheDir=path.join(os.homedir(),'Library/Application Support/Church Translate Models');
+const pipe=await pipeline('translation','Xenova/nllb-200-distilled-600M',{dtype:'fp32'});
+
+const CASES=['God is good. Amen.','Amen.','Hallelujah.','Donald Trump.',
+             'Can I get an amen?','Jesus wept. Amen.','Dr. Luke wrote this. Amen.'];
+const LANGS=['spa_Latn','fra_Latn','deu_Latn','zho_Hans'];
+
+for (const text of CASES) {
+  console.log('\n"'+text+'"   -> '+JSON.stringify(sb.splitSentences(text)));
+  for (const lang of LANGS) {
+    const parts=[];
+    for (const s of sb.splitSentences(text)) {
+      const set=Liturgy.lookup(s,lang);
+      if (set) { parts.push(set+'  [liturgy]'); continue; }
+      const o=await pipe(s,{src_lang:'eng_Latn',tgt_lang:lang});
+      const raw=(Array.isArray(o)?o[0]:o).translation_text.trim();
+      const g=Guard.clean(s,raw);
+      parts.push(g.text + (g.trimmed?'  [guard: '+g.reason.slice(0,40)+']':''));
+    }
+    console.log('   '+lang+'  '+parts.join('  |  '));
+  }
+}

app/_test-e2e2.mjs

@@ -0,0 +1,39 @@
+/* The full chain, and specifically: does the ENGLISH the listener sees stay
+   exactly as spoken while the translation improves? */
+import { pipeline, env } from '@huggingface/transformers';
+import { createRequire } from 'module';
+import os from 'os'; import path from 'path'; import fs from 'fs'; import vm from 'vm';
+const require = createRequire(import.meta.url);
+const Liturgy=require('./liturgy.js'), Guard=require('./mt-guard.js'), Preach=require('./preach.js');
+const src=fs.readFileSync('engine.js','utf8');
+const sb={console}; vm.createContext(sb);
+vm.runInContext(src.match(/^const ABBREV_TAIL = .*$/m)[0], sb);
+const grab=(n)=>{const i=src.indexOf('function '+n+'(');let d=0;for(let k=src.indexOf('{',i);k<src.length;k++){if(src[k]==='{')d++;else if(src[k]==='}'&&--d===0)return src.slice(i,k+1);}};
+vm.runInContext(grab('splitSentences'), sb);
+
+env.allowLocalModels=false;
+env.cacheDir=path.join(os.homedir(),'Library/Application Support/Church Translate Models');
+const pipe=await pipeline('translation','Xenova/nllb-200-distilled-600M',{dtype:'fp32'});
+
+const UTTERANCES=[
+  'Open up to the book of John.',
+  'Circle that in your Bible. Amen.',
+  'Let that sink in.',
+  'Open up to the book of John. God is good. Amen.',
+  'We are going to talk about Peter in the Bible.'
+];
+for (const u of UTTERANCES) {
+  console.log('\nSPOKEN / shown in English:  "'+u+'"');
+  for (const lang of ['spa_Latn','por_Latn','fra_Latn']) {
+    const parts=[];
+    for (const s of sb.splitSentences(u)) {
+      const set=Liturgy.lookup(s,lang);
+      if (set) { parts.push(set); continue; }
+      const forMt=Preach.forTranslation(s);
+      const o=await pipe(forMt,{src_lang:'eng_Latn',tgt_lang:lang});
+      const raw=(Array.isArray(o)?o[0]:o).translation_text.trim();
+      parts.push(Guard.clean(forMt,raw).text);
+    }
+    console.log('   '+lang.slice(0,3)+'  '+parts.join(' '));
+  }
+}

app/_test-guard-real.js

@@ -0,0 +1,43 @@
+/* Run the guard over MEASURED NLLB output: 9 inputs x 10 languages.
+   The question is not "does it catch the bad one" — it is "does it leave the
+   other 89 alone". A guard that corrupts good output is worse than no guard,
+   because nobody in the building can read most of these. */
+const G = require('./mt-guard.js');
+const D = {
+spa_Latn:["Donald Trump. ¿Qué es eso?","- Sí, estoy bien.","¡Aleluya!","Se llamaba John.","Abre al libro, Matthew.","Vuelva conmigo a Juan capítulo 3.","Jesús lloró.","¡Alabado sea el Señor!","Pedro lo negó tres veces."],
+por_Latn:["Donald Trump.","- Não, não.","Aleluia!","O nome dele era John.","Abre-te ao livro, Matthew.","Virem comigo para João capítulo 3.","Jesus chorou.","Louvem o Senhor.","Pedro negou-o três vezes."],
+fra_Latn:["Donald Trump est là.","Je vous en prie.","Je vous en prie.","Il s'appelait John.","Ouvre-toi au livre, Matthew.","Tournez- vous avec moi vers Jean chapitre 3.","Jésus pleurait.","Louez le Seigneur.","Pierre le nia trois fois."],
+deu_Latn:["Donald Trump.","- Das ist doch gut.","Halleluja!","Sein Name war John.","Mach dir das Buch zu, Matthew.","Wenden Sie sich mit mir an Johannes Kapitel 3.","Jesus weinte.","Lob dem Herrn.","Petrus verleugnete ihn dreimal."],
+kor_Hang:["도널드 트럼프","아멘","할렐루야","그의 이름은 존이었다.","책에 들어봐, 매튜","요한 3 장에 나와 함께 가십시오.","예수께서는 울었습니다.","하나님께 영광을 돌리소서","베드로가 그를 세 번 부인했다."],
+zho_Hans:["唐纳德特朗普.","现在,我们要去.","哈利鲁亚!","他的名字是约翰.","开放给书,马修.","转向约翰第三章.","耶稣哭了.","赞美上帝.","彼得否认他三次."],
+rus_Cyrl:["Дональд Трамп.","- Да, да.","- Хэллюя.","Его звали Джон.","Открой глаза на книгу, Мэтью.","Повернись со мной к Иоанну, главе 3.","Иисус заплакал.","Слава Богу.","Петр трижды отрицал его."],
+arb_Arab:["دونالد ترامب","آمين","هليليا","اسمه كان جون","افتح نفسك للكتب يا (ماثيو)","انعطف معي إلى يوحنا الفصل الثالث","يسوع يبكي","-حمد الله","بـطـرس نـكره ثلاث مرات"],
+hat_Latn:["Donald Trump.","Amen.","Aleluya.","Non l te rele John.","Ouvri pou liv la, Matthew.","Fè m 'konnen Jan chapit 3.","Jezi te kriye.","Fè Bondye lwanj.","Pyè te refize l twa fwa."],
+vie_Latn:["Donald Trump.","- A-men.","Hallelujah.","Tên anh ta là John.","Mở ra sách, Matthew.","Hãy cùng tôi đọc Giăng chương 3.","Chúa Giêsu khóc.","Chúc mừng Chúa.","Phi-e-rơ đã từ chối ông ba lần."]
+};
+const SRC = ["Donald Trump.","Amen.","Hallelujah.","His name was John.","Open up to the book, Matthew.","Turn with me to John chapter 3.","Jesus wept.","Praise the Lord.","Peter denied him three times."];
+
+/* The ONLY output that should lose words. Everything else may lose a leading
+   dash and nothing more. */
+/* index 0 is "Donald Trump." (invented question); index 1 is "Amen.", a
+   one-word source whose comma-clause is invented in several languages. */
+const MAY_LOSE_WORDS = new Set(['spa_Latn|0','spa_Latn|1','por_Latn|1','zho_Hans|1','rus_Cyrl|1']);
+
+let touched = 0, dashOnly = 0, wordLoss = 0, bad = 0;
+for (const lang of Object.keys(D)) {
+  D[lang].forEach((tgt, i) => {
+    const r = G.clean(SRC[i], tgt);
+    if (r.text === tgt) return;
+    touched++;
+    const strippedDash = tgt.replace(/^\s*[-‐-―−]\s*/, '').trim();
+    if (r.text === strippedDash) { dashOnly++; console.log('  dash   ' + lang + '  "' + tgt + '" -> "' + r.text + '"'); return; }
+    wordLoss++;
+    const allowed = MAY_LOSE_WORDS.has(lang + '|' + i);
+    console.log((allowed ? '  TRIM   ' : '  !!BAD ') + lang + '  "' + tgt + '" -> "' + r.text + '"');
+    if (r.reason) console.log('           ' + r.reason);
+    if (!allowed) bad++;
+  });
+}
+console.log('\n90 measured outputs: ' + touched + ' touched, ' + dashOnly + ' dash-only, ' +
+            wordLoss + ' word-loss, ' + bad + ' UNEXPECTED');
+process.exit(bad ? 1 : 0);

app/_test-guard.js

@@ -0,0 +1,52 @@
+/* Unit-test the guard against MEASURED NLLB output — no model needed. */
+const G = require('./mt-guard.js');
+let pass = 0, fail = 0;
+const t = (label, src, tgt, wantText, wantTrim) => {
+  const r = G.clean(src, tgt);
+  const ok = r.text === wantText && (wantTrim === undefined || r.trimmed === wantTrim);
+  console.log((ok ? '  PASS  ' : '  FAIL  ') + label);
+  if (!ok) console.log('          got  "' + r.text + '" trimmed=' + r.trimmed +
+                       '\n          want "' + wantText + '"');
+  if (r.reason && ok) console.log('          ' + r.reason);
+  ok ? pass++ : fail++;
+};
+
+console.log('\nMEASURED HALLUCINATIONS — must be trimmed');
+t('invented question', 'Donald Trump.', 'Donald Trump. ¿Qué es eso?', 'Donald Trump.', true);
+t('subtitle dash', 'Hello, hello.', '- Hola, está bien.', 'Hola, está bien.', true);
+/* One English word cannot mean two clauses, so everything after the comma is
+   invented. (In production liturgy.js answers "Amen." before the guard runs;
+   this fixture exercises the rule itself.) */
+t('one-word clause trim', 'Amen.', '- Sí, estoy bien. ¿Y tú?', 'Sí.', true);
+t('two words keeps its comma', 'God is good.', 'Dios es bueno, muy bueno.', 'Dios es bueno, muy bueno.', false);
+t('CJK invented', 'Donald Trump.', '唐纳德·特朗普。那是什么？', '唐纳德·特朗普。', true);
+t('Arabic invented', 'Amen.', 'آمين. ما هذا؟', 'آمين.', true);
+
+console.log('\nMUST NOT BE TOUCHED — real output');
+t('real question kept', 'How many countries are in the world?', '¿Cuántos países hay en el mundo?',
+  '¿Cuántos países hay en el mundo?', false);
+t('unpunctuated tag question', 'Are you with me', '¿Estás conmigo?', '¿Estás conmigo?', false);
+t('THE risk case', 'Can I get an amen', '¿Puedo recibir un amén?', '¿Puedo recibir un amén?', false);
+t('semicolon scripture', 'The Lord is my shepherd; I shall not want.',
+  'El Señor es mi pastor; nada me faltará.', 'El Señor es mi pastor; nada me faltará.', false);
+t('two in two out', 'Jesus wept. He loved him.', 'Jesús lloró. Lo amaba.', 'Jesús lloró. Lo amaba.', false);
+t('abbreviation', 'Dr. Luke wrote it.', 'El Dr. Lucas lo escribió.', 'El Dr. Lucas lo escribió.', false);
+t('decimal', 'Read John 3.16 with me.', 'Lee Juan 3.16 conmigo.', 'Lee Juan 3.16 conmigo.', false);
+
+console.log('\nLONG SOURCE — clamp must NOT apply (legitimate splitting)');
+t('long splits legitimately',
+  'For God so loved the world that he gave his only begotten Son, that whoever believes in him should not perish but have everlasting life.',
+  'Porque tanto amó Dios al mundo que dio a su Hijo unigénito. Para que todo el que crea en él no se pierda. Sino que tenga vida eterna.',
+  'Porque tanto amó Dios al mundo que dio a su Hijo unigénito. Para que todo el que crea en él no se pierda. Sino que tenga vida eterna.', false);
+t('long keeps dash strip',
+  'And God said let there be light and there was light in the whole world today.',
+  '- Y dijo Dios: que haya luz.', 'Y dijo Dios: que haya luz.', true);
+
+console.log('\nEDGE CASES');
+t('empty target', 'Amen.', '', '', false);
+t('target is only a dash', 'Amen.', '-', '-', false);
+t('no source punctuation', 'Turn with me', 'Ven conmigo. ¿Qué es eso?', 'Ven conmigo.', true);
+t('CJK no spaces in target', 'Praise the Lord.', '赞美主。', '赞美主。', false);
+
+console.log('\n' + pass + ' passed, ' + fail + ' failed');
+process.exit(fail ? 1 : 0);

app/_test-lex-all.js

@@ -0,0 +1,22 @@
+const fs=require('fs'), vm=require('vm');
+const B=require('./bible-lexicon.js');
+const src=fs.readFileSync('engine.js','utf8');
+const sb={console};vm.createContext(sb);
+vm.runInContext(src.slice(src.indexOf('const SCRIPT_NO_SPACES'), src.indexOf('function applyFixes')), sb);
+const rows=require('/tmp/all-corpus.json');
+for (const lang of B.languages()) {
+  const bl=B.forLanguage(lang)||{}, fx=B.fixesFor(lang)||{};
+  const p1=Object.keys(bl).map(f=>({from:f,to:bl[f]}));
+  const p2=Object.keys(fx).map(f=>({from:f,to:fx[f]}));
+  let n=0,tot=0; const seen={};
+  for (const r of rows){
+    const t=String((r.tr&&r.tr[lang])||''); if(!t) continue; tot++;
+    let out=sb.applyTable(t,p1); if(p2.length) out=sb.applyTable(out,p2);
+    if(out===t) continue; n++;
+    const a=t.split(/\s+/),b=out.split(/\s+/),d=[];
+    for(let i=0;i<Math.max(a.length,b.length);i++) if(a[i]!==b[i]) d.push((a[i]||'')+'→'+(b[i]||''));
+    const k=d.slice(0,3).join('  ');seen[k]=(seen[k]||0)+1;
+  }
+  console.log('\n'+lang+'  '+tot+' rows, '+n+' changed'+(tot?' ('+(n/tot*100).toFixed(2)+'%)':''));
+  Object.entries(seen).sort((a,b)=>b[1]-a[1]).slice(0,10).forEach(([d,c])=>console.log('    '+String(c).padStart(3)+'x  '+d));
+}

app/_test-lex-fra.js

@@ -0,0 +1,25 @@
+const fs=require('fs'), vm=require('vm');
+const B=require('./bible-lexicon.js');
+const src=fs.readFileSync('engine.js','utf8');
+const sb={console};vm.createContext(sb);
+vm.runInContext(src.slice(src.indexOf('const SCRIPT_NO_SPACES'), src.indexOf('function applyFixes')), sb);
+const rows=require('/tmp/all-corpus.json');
+
+for (const lang of ['fra_Latn','spa_Latn']) {
+  const bl=B.forLanguage(lang), fx=B.fixesFor(lang)||{};
+  const pairs=Object.keys(bl).map(from=>({from,to:bl[from]}));
+  const fpairs=Object.keys(fx).map(from=>({from,to:fx[from]}));
+  let n=0,tot=0; const seen={};
+  for (const r of rows){
+    const t=String((r.tr&&r.tr[lang])||''); if(!t) continue; tot++;
+    let out=sb.applyTable(t,pairs);
+    if(fpairs.length) out=sb.applyTable(out,fpairs);
+    if(out===t) continue; n++;
+    const a=t.split(/\s+/),b=out.split(/\s+/),d=[];
+    for(let i=0;i<Math.max(a.length,b.length);i++) if(a[i]!==b[i]) d.push((a[i]||'')+' -> '+(b[i]||''));
+    const k=d.join('  |  '); seen[k]=(seen[k]||0)+1;
+  }
+  console.log('\n=== '+lang+' — '+tot+' real rows, '+n+' changed ('+(n/tot*100).toFixed(2)+'%) ===');
+  Object.entries(seen).sort((a,b)=>b[1]-a[1]).slice(0,28).forEach(([d,c])=>console.log('  '+String(c).padStart(3)+'x  '+d));
+  if (Object.keys(seen).length>28) console.log('  … '+(Object.keys(seen).length-28)+' more distinct changes');
+}

app/_test-lexicon.js

@@ -0,0 +1,22 @@
+/* Run the lexicon over 5,954 rows of real Spanish output and inspect EVERY
+   change. A lexicon that corrupts correct Spanish is worse than no lexicon. */
+const fs=require('fs'), vm=require('vm');
+const B=require('./bible-lexicon.js');
+const src=fs.readFileSync('engine.js','utf8');
+const sb={console};vm.createContext(sb);
+vm.runInContext(src.slice(src.indexOf('const SCRIPT_NO_SPACES'), src.indexOf('function applyFixes')), sb);
+const rows=require('/tmp/es-corpus.json');
+const bl=B.forLanguage('spa_Latn');
+const pairs=Object.keys(bl).map(from=>({from,to:bl[from]}));
+let n=0; const seen={};
+for (const r of rows){
+  const es=String((r.tr&&r.tr.spa_Latn)||''); if(!es) continue;
+  const out=sb.applyTable(es,pairs);
+  if(out===es) continue; n++;
+  const a=es.split(/\s+/),b=out.split(/\s+/),d=[];
+  for(let i=0;i<Math.max(a.length,b.length);i++) if(a[i]!==b[i]) d.push((a[i]||'')+' -> '+(b[i]||''));
+  const k=d.join('  |  '); seen[k]=(seen[k]||0)+1;
+}
+console.log('rows changed by the lexicon: '+n+'  ('+(n/rows.length*100).toFixed(2)+'%)\n');
+console.log('EVERY change:');
+Object.entries(seen).sort((a,b)=>b[1]-a[1]).forEach(([d,c])=>console.log('  '+String(c).padStart(3)+'x  '+d));

app/_test-matcher.js

@@ -0,0 +1,40 @@
+const fs=require('fs'),vm=require('vm');
+const src=fs.readFileSync('engine.js','utf8');
+const sb={console};vm.createContext(sb);
+vm.runInContext(src.slice(src.indexOf('const SCRIPT_NO_SPACES'), src.indexOf('function applyFixes')), sb);
+let pass=0,fail=0;
+const t=(label,text,pairs,want)=>{const got=sb.applyTable(text,pairs);const ok=got===want;
+  console.log((ok?'  PASS  ':'  FAIL  ')+label); if(!ok)console.log('          got  "'+got+'"\n          want "'+want+'"');
+  ok?pass++:fail++;};
+
+console.log('\nEXISTING BEHAVIOUR — must not regress');
+t('lowercase forgiving','have a back up plan',[{from:'have a back up',to:'Habakkuk'}],'Habakkuk plan');
+t('capital is exact','I finally got the job I wanted',[{from:'Job',to:'JOB-BOOK'}],'I finally got the job I wanted');
+t('capital matches capital','Turn to Job chapter 1',[{from:'Job',to:'JOB-BOOK'}],'Turn to JOB-BOOK chapter 1');
+t('term ending in period','read 1 Cor. today',[{from:'1 Cor.',to:'First Corinthians'}],'read First Corinthians today');
+t('parenthesised term','sing (Selah) now',[{from:'(Selah)',to:'SELAH'}],'sing SELAH now');
+t('longest first','first Corinthians here',[{from:'first Corinthians',to:'1 Corinthians'},{from:'Corinthians',to:'X'}],'1 Corinthians here');
+t('live CJK override','向哈巴古书第一章',[{from:'哈巴古书',to:'哈巴谷书'}],'向哈巴谷书第一章');
+t('CJK 2-char name FIRES','约翰说了',[{from:'约翰',to:'約翰'}],'約翰说了');
+t('CJK 2-char name in compound','马太福音第一章',[{from:'马太',to:'馬太'}],'馬太福音第一章');
+/* ACCEPTED COST of lowering the guard to one character: a two-character COMMON
+   noun now reaches inside a longer word again. Pinned here so it is a decision
+   on the record, not a surprise. */
+t('accepted: 2-char common noun bleeds','구원자가 왔다',[{from:'구원',to:'救い'}],'救い자가 왔다');
+/* ...and the remedy, which the table already supports: longest match wins. */
+t('remedy: longer entry wins','구원자가 왔다',
+  [{from:'구원',to:'救い'},{from:'구원자',to:'救い主'}],'救い主가 왔다');
+
+console.log('\nNEWLY FIXED — non-Latin boundaries');
+t('Cyrillic no inside-match','Маркса продали',[{from:'Марк',to:'X'}],'Маркса продали');
+t('Cyrillic real match','Марк написал',[{from:'Марк',to:'Маркос'}],'Маркос написал');
+t('Arabic no inside-match','الربا حرام',[{from:'الرب',to:'X'}],'الربا حرام');
+t('Arabic real match','الرب راعي',[{from:'الرب',to:'يهوه'}],'يهوه راعي');
+t('accented capital exact','el éxodo de los jóvenes',[{from:'Éxodo',to:'X'}],'el éxodo de los jóvenes');
+t('accented capital matches','leemos Éxodo 20',[{from:'Éxodo',to:'EXO'}],'leemos EXO 20');
+t('accented lowercase forgiving','el éxodo grande',[{from:'éxodo',to:'salida'}],'el salida grande');
+t('Devanagari boundary','यूहन्नाकी बात',[{from:'यूहन्ना',to:'X'}],'यूहन्नाकी बात');
+t('Vietnamese tone marks','Phêrô đã nói',[{from:'Phêrô',to:'Phi-e-rơ'}],'Phi-e-rơ đã nói');
+
+console.log('\n'+pass+' passed, '+fail+' failed');
+process.exit(fail?1:0);

app/_test-micfeed.mjs

@@ -0,0 +1,80 @@
+/* Drive the REAL live-audio module the way the mic feed does, and see whether
+   the stream it produces is continuous. */
+import { execFileSync } from 'child_process';
+import fs from 'fs'; import os from 'os'; import path from 'path';
+import { createRequire } from 'module';
+const require = createRequire(import.meta.url);
+const { LiveAudio } = require('./server/live-audio.js');
+
+const RATE = 16000, CHUNK = 11200;            // MIC_CHUNK
+const d = fs.mkdtempSync(path.join(os.tmpdir(), 'micfeed-'));
+
+function encode(samples, hz) {
+  const pcm = Buffer.alloc(samples * 2);
+  for (let i = 0; i < samples; i++) pcm.writeInt16LE(Math.round(9000 * Math.sin(i / hz)), i * 2);
+  const wav = Buffer.alloc(44 + pcm.length);
+  wav.write('RIFF', 0); wav.writeUInt32LE(36 + pcm.length, 4);
+  wav.write('WAVE', 8); wav.write('fmt ', 12);
+  wav.writeUInt32LE(16, 16); wav.writeUInt16LE(1, 20); wav.writeUInt16LE(1, 22);
+  wav.writeUInt32LE(RATE, 24); wav.writeUInt32LE(RATE * 2, 28);
+  wav.writeUInt16LE(2, 32); wav.writeUInt16LE(16, 34);
+  wav.write('data', 36); wav.writeUInt32LE(pcm.length, 40);
+  pcm.copy(wav, 44);
+  const w = path.join(d, 'c.wav'), a = path.join(d, 'c.aac');
+  fs.writeFileSync(w, wav);
+  if (fs.existsSync(a)) fs.unlinkSync(a);
+  execFileSync('/usr/bin/afconvert', ['-f', 'adts', '-d', 'aac@' + RATE, '-b', '48000', w, a]);
+  return fs.readFileSync(a);
+}
+
+const live = new LiveAudio((m) => console.log('  [live] ' + m));
+const st = live.ensure('eng_Latn', RATE);
+st.start();
+/* Count silence frames the pump invents because the queue ran dry. */
+const SIL = require('./server/live-audio.js').silenceFrame(RATE);
+let underrun = 0, real = 0, counting = false;
+const origClose = st.closeSegment.bind(st);
+st.closeSegment = function () {
+  if (counting) for (const f of this.building) { if (f === SIL) underrun++; else real++; }
+  return origClose();
+};
+console.log('pushing 700ms chunks every 700ms for 14s, exactly as the mic feed does…\n');
+
+const clip = encode(CHUNK, 9);
+let pushed = 0;
+const t0 = Date.now();
+let stalls = 0;
+function schedule(delay) { setTimeout(tickPush, delay); }
+function tickPush() {
+  st.pushContinuous(clip);
+  pushed++;
+  if (pushed === 2) counting = true;   // skip the startup seed
+  const backlogMs = (st.pendingFrames * 1024) / RATE * 1000;
+  const wall = Date.now() - t0;
+  const audioIn = pushed * 700;
+  console.log('  chunk ' + String(pushed).padStart(2) +
+    '  wall ' + String(wall).padStart(5) + 'ms' +
+    '  audio pushed ' + String(audioIn).padStart(5) + 'ms' +
+    '  backlog ' + backlogMs.toFixed(0).padStart(4) + 'ms' +
+    '  segments ' + st.segments.length);
+  /* Two deliberate stalls: 500ms and 900ms late, modelling a blocked event
+     loop or two chunks bunched by the socket. */
+  let nextIn = 700;
+  if (pushed === 8)  { nextIn = 1200; stalls++; }
+  if (pushed === 14) { nextIn = 1600; stalls++; }
+  if (pushed < 20) { schedule(nextIn); return; }
+  if (pushed >= 20) {
+    const held = st.segments.length * (st.framesPerSegment * 1024 / RATE);
+    console.log('\n  produced ' + st.segments.length + ' segments (' + held.toFixed(1) + 's held)');
+    console.log('  real audio frames : ' + real);
+    console.log('  SILENCE frames the pump invented on underrun : ' + underrun +
+                '  (' + (underrun * 64) + ' ms of gaps)');
+    console.log('  audio in: ' + (pushed * 0.7).toFixed(1) + 's   wall: ' + ((Date.now()-t0)/1000).toFixed(1) + 's');
+    console.log('  deliberate stalls injected: ' + stalls + ' (one 500ms late, one 900ms late)');
+    console.log('  UNDERRUNS reported by the stream: ' + (st.underruns || 0));
+    fs.rmSync(d, { recursive: true, force: true });
+    process.exit(0);
+  }
+}
+schedule(700);
+

app/_test-multi.mjs

@@ -0,0 +1,68 @@
+/* Integration test: fork the REAL mt-service.js the way main.js does and prove
+   the batched path returns the same text as the one-at-a-time path. */
+import { fork } from 'child_process';
+import os from 'os'; import path from 'path';
+import { fileURLToPath } from 'url';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const MODELS_DIR = path.join(os.homedir(), 'Library/Application Support/Church Translate Models');
+
+const LANGS = ['spa_Latn','por_Latn','fra_Latn','zho_Hans','hat_Latn','hin_Deva','kor_Hang','vie_Latn','arb_Arab'];
+const TEXTS = [
+  'And I want you to understand that God has a plan for your life',
+  'Turn with me to the book of Romans chapter eight',
+  'He was faithful even when it cost him everything, and that is the kind of faith we are called to',
+  'Amen',
+];
+
+const child = fork(path.join(__dirname, 'mt-service.js'), [], { stdio: ['ignore','pipe','pipe','ipc'] });
+child.stderr.on('data', d => process.stderr.write('[mt] ' + d));
+let seq = 0; const pending = new Map();
+child.on('message', (m) => {
+  if (m.type === 'ready') { pending.get('ready')?.(); return; }
+  if (m.type === 'note') { console.log('  note: ' + m.message); return; }
+  if (m.type === 'progress') return;
+  const w = pending.get(m.id); if (!w) return; pending.delete(m.id);
+  if (m.type === 'error') w.reject(new Error(m.message));
+  else w.resolve(m.type === 'multi' ? m.texts : m.text);
+});
+const send = (payload) => new Promise((resolve, reject) => {
+  const id = ++seq; pending.set(id, { resolve, reject });
+  child.send({ ...payload, id });
+});
+
+const ready = new Promise(r => pending.set('ready', r));
+child.send({ type: 'load', model: 'Xenova/nllb-200-distilled-600M', dtype: 'fp32', cacheDir: MODELS_DIR });
+const t0 = Date.now();
+await ready;
+console.log('model ready in ' + ((Date.now()-t0)/1000).toFixed(1) + 's\n');
+
+const one  = (text, tgt)  => send({ type:'translate', text, src:'eng_Latn', tgt });
+const many = (text, tgts) => send({ type:'translateMulti', text, src:'eng_Latn', tgts });
+
+await one(TEXTS[0], 'spa_Latn'); await many(TEXTS[0], ['spa_Latn','fra_Latn']);  // warm
+
+let mismatches = 0, checks = 0;
+console.log('text                       N |  serial  |  batched | speedup | match');
+console.log('-----------------------------+----------+----------+---------+------');
+for (const text of TEXTS) {
+  for (const n of [3, 9]) {
+    const langs = LANGS.slice(0, n);
+    let s = Date.now(); const so = {}; for (const l of langs) so[l] = await one(text, l); s = Date.now()-s;
+    let b = Date.now(); const bo = await many(text, langs); b = Date.now()-b;
+    let same = 0; for (const l of langs) { checks++; if (so[l] === bo[l]) same++; else { mismatches++; } }
+    console.log(
+      (text.slice(0,26)).padEnd(27) + String(n).padStart(2) + ' | ' +
+      (s+'ms').padStart(8) + ' | ' + (b+'ms').padStart(8) + ' | ' +
+      ((s/b).toFixed(2)+'x').padStart(7) + ' | ' + same + '/' + n);
+    if (same !== n) for (const l of langs) if (so[l] !== bo[l])
+      console.log('     ' + l + '\n       serial : ' + so[l] + '\n       batched: ' + bo[l]);
+  }
+}
+console.log('\n' + (checks - mismatches) + '/' + checks + ' identical across ' + TEXTS.length + ' texts');
+
+/* Edge cases */
+console.log('\nedge cases:');
+console.log('  one target   :', JSON.stringify(await many('God is good', ['spa_Latn'])));
+console.log('  zero targets :', JSON.stringify(await many('God is good', [])));
+console.log('  duplicate    :', JSON.stringify(await many('God is good', ['spa_Latn','spa_Latn'])));
+child.kill();

app/_test-names-e2e.mjs

@@ -0,0 +1,43 @@
+import { pipeline, env } from '@huggingface/transformers';
+import { createRequire } from 'module';
+import os from 'os'; import path from 'path'; import fs from 'fs'; import vm from 'vm';
+const require = createRequire(import.meta.url);
+const Liturgy = require('./liturgy.js'), Guard = require('./mt-guard.js');
+const Preach = require('./preach.js'), B = require('./bible-lexicon.js');
+const Spa = require('./spa-variants.js');
+
+const src = fs.readFileSync('engine.js', 'utf8');
+const sb = { console }; vm.createContext(sb);
+vm.runInContext(src.slice(src.indexOf('const SCRIPT_NO_SPACES'), src.indexOf('function applyFixes')), sb);
+
+env.allowLocalModels = false;
+env.cacheDir = path.join(os.homedir(), 'Library/Application Support/Church Translate Models');
+const pipe = await pipeline('translation', 'Xenova/nllb-200-distilled-600M', { dtype: 'fp32' });
+
+/* The pipeline exactly as engine.js now runs it. */
+async function translate(sentence, lang) {
+  const set = Liturgy.lookup(sentence, lang);
+  if (set) return set + '   [liturgy]';
+  const named = B.wholeUtterance(sentence, lang);
+  if (named) return named + '   [name lookup]';
+  const forMt = Preach.forTranslation(sentence);
+  const sd = Preach.stripShortPeriod(forMt);
+  const o = await pipe(sd.text, { src_lang: 'eng_Latn', tgt_lang: lang });
+  let raw = (Array.isArray(o) ? o[0] : o).translation_text.trim();
+  raw = Guard.clean(sd.text, raw).text;
+  raw = Preach.restorePeriod(raw, sd.hadPeriod);
+  if (lang === 'spa_Latn') raw = Spa.toLatinAmerican(Spa.toChurchRegister(raw));
+  const bl = B.forLanguage(lang);
+  if (bl) raw = sb.applyTable(raw, Object.keys(bl).map((f) => ({ from: f, to: bl[f] })));
+  const fx = B.fixesFor(lang);
+  if (fx) raw = sb.applyTable(raw, Object.keys(fx).map((f) => ({ from: f, to: fx[f] })));
+  return raw;
+}
+
+const CASES = ['Peter.','John.','Matthew.','Jesus.','Mary.','Noah.','Moses.','Habakkuk.',
+               'Simon Peter.','Donald Trump.','Amen.','Peter denied him three times.',
+               'His name was John.','Open up to the book of John.'];
+for (const lang of ['spa_Latn','fra_Latn','por_Latn','zho_Hans']) {
+  console.log('\n=== ' + lang + ' ===');
+  for (const t of CASES) console.log('  ' + t.padEnd(32) + await translate(t, lang));
+}

app/_test-oplocal.mjs

@@ -0,0 +1,61 @@
+/* The operator desk must be unreachable from the internet — page, API and
+   socket — and completely normal on the LAN. */
+import { spawn } from 'child_process';
+import { WebSocket } from 'ws';
+import fs from 'fs'; import os from 'os'; import path from 'path';
+import { fileURLToPath } from 'url';
+
+const DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'ct-oplocal-'));
+const PORT = 3198;
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const srv = spawn(process.execPath, [path.join(__dirname, 'server', 'server.js')],
+  { env: { ...process.env, PORT: String(PORT), DATA_DIR: DIR }, stdio: ['ignore', 'pipe', 'pipe'] });
+const logs = []; srv.stdout.on('data', d => logs.push(String(d))); srv.stderr.on('data', d => logs.push(String(d)));
+const sleep = ms => new Promise(r => setTimeout(r, ms));
+const B = 'http://127.0.0.1:' + PORT;
+const CFG = path.join(DIR, 'config.json');
+for (let i = 0; i < 80; i++) { if (fs.existsSync(CFG)) { try { await fetch(B + '/healthz'); break; } catch (_) {} } await sleep(150); }
+const cfg = JSON.parse(fs.readFileSync(CFG, 'utf8'));
+const PIN = cfg.operatorPin, KEY = cfg.controlToken;
+console.log('new-install PIN: ' + PIN.length + ' digits (' + PIN + ')\n');
+
+let pass = 0, fail = 0;
+const check = (l, ok, d) => { console.log((ok ? '  ok   ' : '  FAIL ') + l + (d ? '   ' + d : '')); ok ? pass++ : fail++; };
+const TUN = { 'x-forwarded-for': '203.0.113.7' };
+
+const code = async (p, h) => (await fetch(B + p, { headers: h || {} })).status;
+
+console.log('from the LAN (correct PIN):');
+check('/operator page loads',        await code('/operator') === 200);
+check('/api/config accepts the PIN', await code('/api/config?pin=' + PIN) === 200);
+
+console.log('\nfrom the internet (same correct PIN):');
+check('/operator page is 404',       await code('/operator', TUN) === 404, 'not even the login box');
+const c = await code('/api/config?pin=' + PIN, TUN);
+check('/api/config is refused',      c === 401 || c === 429, 'HTTP ' + c);
+
+console.log('\nthe listener page must still work from the internet:');
+check('/ is served',                 await code('/', TUN) === 200);
+const lm = await code('/live/eng_Latn.m3u8', TUN);
+check('/live/*.m3u8 answers',        lm === 200 || lm === 404, 'HTTP ' + lm + ' (404 = nothing playing yet)');
+
+console.log('\noperator WEBSOCKET:');
+const tryWs = (headers) => new Promise((res) => {
+  const ws = new WebSocket(B.replace('http','ws') + '/ws?role=operator&pin=' + PIN, { headers });
+  const t = setTimeout(() => { try { ws.close(); } catch (_) {} res('timeout'); }, 3000);
+  ws.on('message', () => { clearTimeout(t); ws.close(); res('accepted'); });
+  ws.on('close', (c, r) => { clearTimeout(t); res('closed: ' + String(r || c)); });
+  ws.on('error', () => {});
+});
+check('LAN socket is accepted',      await tryWs({}) === 'accepted');
+const w = await tryWs(TUN);
+check('tunnel socket is closed',     w.startsWith('closed'), w);
+
+console.log('\ncontrol API (Stream Deck) is unaffected — it uses a long random token:');
+check('control works from the LAN',  await code('/api/control/status?key=' + KEY) === 200);
+
+console.log('\n--- log ---');
+console.log(logs.join('').split('\n').filter(l => /refused|operator/.test(l)).map(l => '  ' + l).join('\n'));
+console.log('\n' + pass + ' passed, ' + fail + ' failed');
+srv.kill(); fs.rmSync(DIR, { recursive: true, force: true });
+process.exit(fail ? 1 : 0);

app/_test-pacing.js

@@ -0,0 +1,63 @@
+/* Model the cut rules with the SHIPPED constants and drive them with synthetic
+   speech patterns. The question is: how long does a segment get, per style? */
+const fs=require('fs');
+const src=fs.readFileSync('engine.js','utf8');
+const g=(n)=>Number(src.match(new RegExp('const '+n+'\\s*=\\s*Math\\.round\\((\\d+) / FRAME_MS\\)'))[1]);
+const FRAME=Number(src.match(/const FRAME\s*=\s*(\d+)/)[1]);
+const SAMPLE_RATE=Number(src.match(/const SAMPLE_RATE\s*=\s*(\d+)/)[1]);
+const FRAME_MS=(FRAME/SAMPLE_RATE)*1000;
+const F=(n)=>Math.round(g(n)/FRAME_MS);   // source stores ms; the loop counts frames
+const C={SOFT_CUT:F('SOFT_CUT'),SOFT_DIP:F('SOFT_DIP'),HARD_CUT:F('HARD_CUT'),
+         HARD_CUT_MAX:F('HARD_CUT_MAX'),EARLY_CLOSE:F('EARLY_CLOSE'),
+         EARLY_MIN_SEG:F('EARLY_MIN_SEG'),SILENCE_TO_END:F('SILENCE_TO_END')};
+console.log('FRAME_MS='+FRAME_MS+'  constants (ms): '+
+  Object.entries(C).map(([k,v])=>k+'='+Math.round(v*FRAME_MS)).join('  ')+'\n');
+
+/* pattern: fn(frameIndex) -> {speech:bool, dipish:bool, sentenceEnded:bool} */
+function run(name, pattern, maxFrames){
+  let len=0,silence=0,dip=0,cuts=[];
+  for (let i=0;i<maxFrames;i++){
+    const p=pattern(i);
+    len++;
+    if (p.speech){ silence=0; dip=0; }
+    else { silence++; dip++; }
+    if (!p.speech && p.dipish) dip++;
+    let why=null;
+    if (len>=C.HARD_CUT_MAX) why='ceiling';
+    else if (silence>=C.SILENCE_TO_END) why='silence';
+    else if (len>=C.SOFT_CUT && dip>=C.SOFT_DIP) why=(len>=C.HARD_CUT?'hard':'soft');
+    else if (p.sentenceEnded && len>=C.EARLY_MIN_SEG && silence>=C.EARLY_CLOSE) why='early';
+    else if (p.sentenceEnded && len>=C.SOFT_CUT) why='sentence';
+    if (why){ cuts.push({ms:len*FRAME_MS,why}); len=0;silence=0;dip=0; }
+  }
+  const avg=cuts.length?Math.round(cuts.reduce((a,c)=>a+c.ms,0)/cuts.length):0;
+  const worst=cuts.length?Math.max(...cuts.map(c=>c.ms)):0;
+  console.log(name);
+  console.log('   segments: '+cuts.length+'   avg '+avg+'ms   worst '+worst+'ms');
+  console.log('   reasons : '+JSON.stringify(cuts.reduce((a,c)=>(a[c.why]=(a[c.why]||0)+1,a),{})));
+  return {avg,worst};
+}
+
+const S=(ms)=>Math.round(ms/FRAME_MS);
+/* A fast preacher: continuous speech, a sentence boundary every ~4s, and no
+   pause anywhere long enough for the old rules to notice. */
+run('FAST preacher — no pauses, sentence every 4s', (i)=>({
+  speech:true, dipish:false, sentenceEnded: i%S(4000)===S(3999)
+}), S(60000));
+
+/* Same speaker but Whisper never reports a sentence end (worst case). */
+run('FAST preacher — no pauses, no punctuation at all', (i)=>({
+  speech:true, dipish:false, sentenceEnded:false
+}), S(60000));
+
+/* A normal speaker: 150ms micro-gaps between phrases every 2s. */
+run('NORMAL speaker — 150ms gap every 2s', (i)=>{
+  const inGap = (i%S(2000)) >= S(1850);
+  return { speech:!inGap, dipish:inGap, sentenceEnded:false };
+}, S(60000));
+
+/* Someone who stops properly at the end of each sentence. */
+run('DELIBERATE speaker — 600ms full stop every 5s', (i)=>{
+  const inGap = (i%S(5000)) >= S(4400);
+  return { speech:!inGap, dipish:inGap, sentenceEnded:false };
+}, S(60000));

app/_test-split.js

@@ -0,0 +1,36 @@
+const fs=require('fs'),vm=require('vm');
+const src=fs.readFileSync('engine.js','utf8');
+const grab=(n)=>{const i=src.indexOf('function '+n+'(');let d=0;for(let k=src.indexOf('{',i);k<src.length;k++){if(src[k]==='{')d++;else if(src[k]==='}'&&--d===0)return src.slice(i,k+1);}};
+const sb={console};vm.createContext(sb);
+vm.runInContext(src.match(/^const ABBREV_TAIL = .*$/m)[0], sb);
+vm.runInContext(grab('splitSentences'), sb);
+let pass=0,fail=0;
+const t=(label,input,want)=>{const got=sb.splitSentences(input);const ok=JSON.stringify(got)===JSON.stringify(want);
+  console.log((ok?'  PASS  ':'  FAIL  ')+label);
+  if(!ok)console.log('          got  '+JSON.stringify(got)+'\n          want '+JSON.stringify(want));
+  ok?pass++:fail++;};
+
+console.log('\nAMEN MUST SURVIVE');
+t('amen after a sentence','God is good. Amen.',['God is good.','Amen.']);
+t('amen alone','Amen.',['Amen.']);
+t('two short sentences','Jesus wept. Amen.',['Jesus wept.','Amen.']);
+t('hallelujah trailing','God is faithful. Hallelujah!',['God is faithful.','Hallelujah!']);
+t('three shorts','Yes. Amen. Hallelujah.',['Yes.','Amen.','Hallelujah.']);
+
+console.log('\nWHAT THE GLUE RULE WAS PROTECTING');
+t('leading abbreviation','Dr. King said God is good.',['Dr. King said God is good.']);
+t('mid abbreviation','We heard Dr. King speak today.',['We heard Dr. King speak today.']);
+t('single initial','C. S. Lewis wrote that.',['C. S. Lewis wrote that.']);
+t('decimal rejoined','It cost 3.5 million.',['It cost 3.5 million.']);
+t('verse decimal','Read John 3.16 today.',['Read John 3.16 today.']);
+t('saint','St. Paul wrote it.',['St. Paul wrote it.']);
+
+console.log('\nORDINARY TEXT UNCHANGED');
+t('one sentence','Today we are going to talk about Peter in the Bible.',
+  ['Today we are going to talk about Peter in the Bible.']);
+t('two full sentences','God is love. He gave His only Son.',['God is love.','He gave His only Son.']);
+t('question','Do you believe that? I do.',['Do you believe that?','I do.']);
+t('semicolon stays','The Lord is my shepherd; I shall not want.',
+  ['The Lord is my shepherd; I shall not want.']);
+console.log('\n'+pass+' passed, '+fail+' failed');
+process.exit(fail?1:0);

app/_test-zh.js

@@ -0,0 +1,35 @@
+/* Load and speak with every Chinese bundle the picker offers, plus a Piper
+   voice to prove the espeak path did not regress. */
+const path=require('path'), os=require('os');
+const voices=require('./voices.js');
+const sherpa=require('sherpa-onnx-node');
+const DIR=path.join(os.homedir(),'Library/Application Support/Church Translate Voices');
+const C=require('./voice-catalog.js');
+
+const TEXT='耶稣说，我就是道路、真理、生命。';
+const cases=C.forLanguage('zho_Hans').filter(v=>v.engine==='builtin')
+  .map(v=>({bundle:v.bundle,model:v.model,text:TEXT}));
+cases.push({bundle:'vits-piper-de_DE-thorsten-medium',model:'de_DE-thorsten-medium.onnx',
+            text:'Jesus sprach: Ich bin der Weg.'});
+
+let ok=0,bad=0;
+for (const c of cases) {
+  const dir=path.join(DIR,c.bundle);
+  try {
+    const cfg=voices.ttsConfig(dir,{model:c.model});
+    const which=cfg.model.vits.lexicon?'lexicon':'espeak';
+    const t=new sherpa.OfflineTts(cfg);
+    const a=t.generate({text:c.text,sid:0,speed:1.0});
+    const secs=a.samples.length/a.sampleRate;
+    /* Silence means it "worked" but produced nothing — that is still a failure. */
+    let peak=0; for(let i=0;i<a.samples.length;i++){const v=Math.abs(a.samples[i]); if(v>peak)peak=v;}
+    const dead=peak<0.01;
+    console.log((dead?'  SILENT ':'  OK     ')+c.bundle.padEnd(38)+which.padEnd(9)+
+                secs.toFixed(1)+'s  peak '+peak.toFixed(3)+'  @'+a.sampleRate);
+    dead?bad++:ok++;
+  } catch(e) {
+    console.log('  FAIL   '+c.bundle.padEnd(38)+String(e.message).split('\n')[0].slice(0,70));
+    bad++;
+  }
+}
+console.log('\n'+ok+' usable, '+bad+' not');

app/_verify-audit.js

@@ -0,0 +1,38 @@
+/* Verify the audit's claims against the REAL functions, not by reading. */
+const fs=require('fs'), vm=require('vm');
+const src=fs.readFileSync('engine.js','utf8');
+const grab=(n)=>{const i=src.indexOf('function '+n+'(');let d=0;for(let k=src.indexOf('{',i);k<src.length;k++){if(src[k]==='{')d++;else if(src[k]==='}'&&--d===0)return src.slice(i,k+1);}};
+const sb={console};vm.createContext(sb);
+vm.runInContext(src.slice(src.indexOf('const SCRIPT_NO_SPACES'), src.indexOf('function applyFixes')), sb);
+vm.runInContext(src.match(/^const ABBREV_TAIL = .*$/m)[0], sb);
+vm.runInContext(grab('splitSentences'), sb);
+
+console.log('CLAIM A1 — \\b is ASCII-only, so non-Latin terms get NO boundary guard');
+for (const t of ['Марк','Иоанн','الرب','यूहन्ना','José']) {
+  const re = sb.termMatcher(t);
+  console.log('   ' + t.padEnd(10) + ' -> /' + re.source + '/' + re.flags);
+}
+console.log('   consequence:');
+for (const [term,hay] of [['Марк','Маркса продали'],['Иоанн','Иоанном говорил'],['الرب','الربا حرام']]) {
+  const re=sb.termMatcher(term); re.lastIndex=0;
+  const hit = sb.applyTable(hay,[{from:term,to:'<<X>>'}]);
+  console.log('     "'+hay+'"  ->  "'+hit+'"');
+}
+
+console.log('\nCLAIM A2 — accented capitals fall through to case-INSENSITIVE');
+for (const t of ['Éxodo','Ámos','Exodus']) {
+  const re=sb.termMatcher(t);
+  console.log('   '+t.padEnd(8)+' flags='+re.flags+(re.flags.includes('i')?'   <-- matches lowercase too':''));
+}
+console.log('   "el éxodo de los jóvenes" -> "' + sb.applyTable('el éxodo de los jóvenes',[{from:'Éxodo',to:'Exodo-BOOK'}]) + '"');
+
+console.log('\nCLAIM A3 — 2-char CJK entries are unmatchable in running text');
+for (const [term,hay] of [['约翰','约翰说了'],['摩西','摩西带领'],['哈巴谷书','向哈巴谷书第一章']]) {
+  const out = sb.applyTable(hay,[{from:term,to:'<<X>>'}]);
+  console.log('   '+term.padEnd(6)+' in "'+hay+'"  ->  "'+out+'"'+(out===hay?'   <-- DID NOT FIRE':''));
+}
+
+console.log('\nCLAIM C1 — splitSentences glues short trailing sentences');
+for (const s of ['God is good. Amen.','It cost 3.5 million.','Dr. King said God is good.','Jesus wept. Amen.']) {
+  console.log('   "'+s+'"\n      -> '+JSON.stringify(sb.splitSentences(s)));
+}

app/app-log.js

@@ -0,0 +1,75 @@
+/*
+ * app-log.js — the persistent log this app never had.
+ *
+ * Every child (voice process, congregation server, translation model) writes
+ * to stdout, and main.js forwards that to ITS stdout — which, for an app
+ * launched from the Finder, is nowhere. So the morning a service went wrong
+ * there was a caption transcript and not one line saying what the voice
+ * process had decided to do. This module tees everything to
+ * <dataDir>/logs/app.log, rotated so it can never fill a disk.
+ *
+ * Deliberately boring: synchronous appends (a crash must not lose the line
+ * that explains it), a size cap, three generations, and every failure
+ * swallowed — logging must never be the thing that takes the service down.
+ */
+'use strict';
+const fs = require('fs');
+const path = require('path');
+
+const MAX_BYTES = 2 * 1024 * 1024;   // rotate past 2 MB
+const KEEP = 3;                      // app.log, app.log.1, app.log.2
+
+function createAppLog(dir, name) {
+  name = name || 'app.log';
+  const file = path.join(dir, name);
+  let size = 0;
+  try { fs.mkdirSync(dir, { recursive: true }); } catch (_) {}
+  try { size = fs.statSync(file).size; } catch (_) { size = 0; }
+
+  function rotate() {
+    try {
+      for (let i = KEEP - 1; i >= 1; i--) {
+        const from = file + (i === 1 ? '' : '.' + (i - 1));
+        const to = file + '.' + i;
+        try { fs.renameSync(from, to); } catch (_) {}
+      }
+    } catch (_) {}
+    size = 0;
+  }
+
+  function stamp() {
+    const d = new Date();
+    const p = (n, w) => String(n).padStart(w || 2, '0');
+    return d.getFullYear() + '-' + p(d.getMonth() + 1) + '-' + p(d.getDate()) + ' ' +
+           p(d.getHours()) + ':' + p(d.getMinutes()) + ':' + p(d.getSeconds()) + '.' + p(d.getMilliseconds(), 3);
+  }
+
+  /* Write one or more lines under a source tag. Multi-line chunks from a
+     child's stdout are split so every line carries its own stamp and tag. */
+  function write(tag, chunk) {
+    try {
+      const text = String(chunk == null ? '' : chunk);
+      if (!text.trim()) return;
+      const lines = text.replace(/\r/g, '').split('\n').filter((l) => l.length);
+      const out = lines.map((l) => stamp() + ' [' + tag + '] ' + l).join('\n') + '\n';
+      /* Bytes, not characters: accented Spanish and CJK log lines are 2-3
+         bytes a character, and a character count let a generation reach 6 MB. */
+      const bytes = Buffer.byteLength(out, 'utf8');
+      if (size + bytes > MAX_BYTES) rotate();
+      fs.appendFileSync(file, out);
+      size += bytes;
+    } catch (_) { /* never let logging take anything down */ }
+  }
+
+  /* Attach to a child process: tee stdout/stderr to the file. Returns the
+     child for chaining. The caller may still forward to its own stdout. */
+  function tee(child, tag) {
+    if (child && child.stdout) child.stdout.on('data', (d) => write(tag, d));
+    if (child && child.stderr) child.stderr.on('data', (d) => write(tag + ':err', d));
+    return child;
+  }
+
+  return { write, tee, file, rotate };
+}
+
+module.exports = { createAppLog, MAX_BYTES, KEEP };

app/bible/english-inventory.json

@@ -0,0 +1,58 @@
+{
+  "_note": "English-side inventory. The canonical spellings a preacher's transcript should contain, and the vocabulary whose TARGET-side rendering has to be checked. This file asserts nothing about other languages.",
+
+  "books": [
+    "Genesis","Exodus","Leviticus","Numbers","Deuteronomy","Joshua","Judges","Ruth",
+    "1 Samuel","2 Samuel","1 Kings","2 Kings","1 Chronicles","2 Chronicles","Ezra",
+    "Nehemiah","Esther","Job","Psalms","Proverbs","Ecclesiastes","Song of Solomon",
+    "Isaiah","Jeremiah","Lamentations","Ezekiel","Daniel","Hosea","Joel","Amos",
+    "Obadiah","Jonah","Micah","Nahum","Habakkuk","Zephaniah","Haggai","Zechariah","Malachi",
+    "Matthew","Mark","Luke","John","Acts","Romans","1 Corinthians","2 Corinthians",
+    "Galatians","Ephesians","Philippians","Colossians","1 Thessalonians","2 Thessalonians",
+    "1 Timothy","2 Timothy","Titus","Philemon","Hebrews","James","1 Peter","2 Peter",
+    "1 John","2 John","3 John","Jude","Revelation"
+  ],
+
+  "people": [
+    "Jesus","Christ","Jesus Christ","God","Holy Spirit","Lord","Father","Son of God",
+    "Adam","Eve","Noah","Abraham","Sarah","Isaac","Rebekah","Jacob","Esau","Rachel","Leah",
+    "Joseph","Moses","Aaron","Miriam","Joshua","Caleb","Gideon","Samson","Samuel","Saul",
+    "David","Solomon","Elijah","Elisha","Isaiah","Jeremiah","Ezekiel","Daniel","Jonah",
+    "Nehemiah","Ezra","Esther","Ruth","Naomi","Boaz","Job",
+    "Mary","Martha","Elizabeth","Zechariah","John the Baptist","Simon","Simon Peter","Peter",
+    "Andrew","James","John","Philip","Bartholomew","Thomas","Matthew","Thaddaeus",
+    "Judas","Judas Iscariot","Matthias","Paul","Saul of Tarsus","Barnabas","Silas",
+    "Timothy","Titus","Philemon","Stephen","Luke","Mark","Apollos","Priscilla","Aquila",
+    "Lazarus","Nicodemus","Zacchaeus","Pilate","Herod","Caesar","Cornelius","Lydia"
+  ],
+
+  "places": [
+    "Jerusalem","Bethlehem","Nazareth","Galilee","Judea","Samaria","Jericho","Bethany",
+    "Capernaum","Gethsemane","Golgotha","Calvary","Mount Sinai","Mount of Olives",
+    "Egypt","Babylon","Assyria","Damascus","Antioch","Corinth","Ephesus","Philippi",
+    "Thessalonica","Colossae","Galatia","Rome","Athens","Macedonia","Patmos",
+    "Zion","Canaan","Jordan River","Red Sea","Sea of Galilee","Eden"
+  ],
+
+  "terms": [
+    "gospel","covenant","new covenant","apostle","disciple","Pharisee","Sadducee",
+    "Gentile","Sabbath","Passover","Pentecost","Messiah","salvation","grace","mercy",
+    "repentance","redemption","atonement","righteousness","justification","sanctification",
+    "propitiation","resurrection","crucifixion","ascension","kingdom of God",
+    "kingdom of heaven","parable","prophet","prophecy","psalm","epistle","scripture",
+    "the Word","tabernacle","temple","altar","sacrifice","priest","high priest",
+    "baptism","communion","the Lord's Supper","faith","hope","love","sin","forgiveness",
+    "eternal life","heaven","hell","Satan","the devil","angel","cherubim","seraphim"
+  ],
+
+  "liturgical": {
+    "_note": "Whole-utterance constants. These are the highest-frequency short lines in preaching and the ones NLLB corrupts worst — measured: 'Amen.' becomes 'Yes, I am fine.' in Spanish. Matched only as an ENTIRE utterance, never as a substring.",
+    "keys": [
+      "amen","hallelujah","alleluia","hosanna","praise God","praise the Lord",
+      "thank you Jesus","glory to God","come on","let us pray","in Jesus name",
+      "in Jesus' name","god bless you","god is good","hello","hello hello",
+      "good morning","good evening","welcome","turn with me","open your Bibles",
+      "let me read that again","are you with me","can I get an amen"
+    ]
+  }
+}

app/bible/lexicon-arb.json

@@ -0,0 +1,107 @@
+{
+  "language": "arb_Arab",
+  "reference": "Van Dyck / فان دايك (public domain)",
+  "_verified": "Verified from the full ebible.org Van Dyck corpus, every form grepped back against it. THE DECISIVE FINDING: Van Dyck uses يسوع for Jesus 973 times and عيسى (the Quranic form) ZERO times; God is الله, 2240 times, with no competitor. Machine translation reaches for عيسى, which is why this entry exists. Diacritics mechanically stripped (U+064B-U+0652, U+0670; ٱ->ا) to match what NLLB emits; the printed form is يَسُوع.",
+  "confidence": "high — every form read from published text and grepped back against the source corpus",
+  "people": {
+    "Jesus": "يسوع",
+    "Christ": "المسيح",
+    "David": "داود",
+    "Abraham": "إبراهيم",
+    "Isaac": "إسحاق",
+    "Jacob": "يعقوب",
+    "Judah": "يهوذا",
+    "Tamar": "ثامار",
+    "Perez": "فارص",
+    "Zerah": "زارح",
+    "Hezron": "حصرون",
+    "Amminadab": "عميناداب",
+    "Nahshon": "نحشون",
+    "Salmon": "سلمون",
+    "Boaz": "بوعز",
+    "Rahab": "راحاب",
+    "Obed": "عوبيد",
+    "Ruth": "راعوث",
+    "Jesse": "يسى",
+    "Solomon": "سليمان",
+    "Uriah": "أوريا",
+    "Rehoboam": "رحبعام",
+    "Abijah": "أبيا",
+    "Asa": "آسا",
+    "Jehoshaphat": "يهوشافاط",
+    "Joram": "يورام",
+    "Uzziah": "عزيا",
+    "Jotham": "يوثام",
+    "Ahaz": "أحاز",
+    "Hezekiah": "حزقيا",
+    "Manasseh": "منسى",
+    "Amon": "آمون",
+    "Josiah": "يوشيا",
+    "Jechoniah": "يكنيا",
+    "Shealtiel": "شألتئيل",
+    "Zerubbabel": "زربابل",
+    "Abiud": "أبيهود",
+    "Eliakim": "ألياقيم",
+    "Azor": "عازور",
+    "Zadok": "صادوق",
+    "Achim": "أخيم",
+    "Eliud": "أليود",
+    "Eleazar": "أليعازر",
+    "Matthan": "متان",
+    "Joseph": "يوسف",
+    "Mary": "مريم",
+    "Simon": "سمعان",
+    "Peter": "بطرس",
+    "Andrew": "أندراوس",
+    "James": "يعقوب",
+    "Zebedee": "زبدي",
+    "John": "يوحنا",
+    "Philip": "فيلبس",
+    "Bartholomew": "برثولماوس",
+    "Thomas": "توما",
+    "Matthew": "متى",
+    "Alphaeus": "حلفى",
+    "Thaddaeus": "تداوس",
+    "Judas": "يهوذا",
+    "Moses": "موسى",
+    "Elijah": "إيليا",
+    "Ahab": "أخآب",
+    "Isaiah": "إشعياء",
+    "Jeremiah": "إرميا",
+    "Daniel": "دانيآل",
+    "Noah": "نوح",
+    "Adam": "آدم",
+    "Eve": "حواء",
+    "Joshua": "يشوع",
+    "Samuel": "صموئيل",
+    "Saul": "شاول",
+    "Paul": "بولس",
+    "Stephen": "استفانوس",
+    "Barnabas": "برنابا",
+    "Silas": "سيلا",
+    "Timothy": "تيموثاوس",
+    "Titus": "تيطس",
+    "Luke": "لوقا",
+    "Mark": "مرقس",
+    "Lazarus": "لعازر",
+    "Nicodemus": "نيقوديموس",
+    "Pilate": "بيلاطس",
+    "Herod": "هيرودس"
+  },
+  "places": {
+    "Babylon": "بابل",
+    "Jerusalem": "أورشليم",
+    "Bethlehem": "بيت لحم",
+    "Nazareth": "ناصرة",
+    "Galilee": "الجليل",
+    "Judea": "اليهودية",
+    "Egypt": "مصر",
+    "Corinth": "كورنثوس",
+    "Ephesus": "أفسس",
+    "Rome": "رومية",
+    "Zion": "صهيون",
+    "Jordan": "الأردن",
+    "Bethany": "بيت عنيا",
+    "Athens": "أثينا"
+  }
+}

app/bible/lexicon-fra.json

@@ -0,0 +1,97 @@
+{
+  "language": "fra_Latn",
+  "reference": "Louis Segond 1910 (public domain)",
+  "_verified": "Name forms read directly from Louis Segond text: Matthieu 1:1-17 (the genealogy, ~47 names in fixed order) and Matthieu 10:2-4 (the twelve apostles), fetched from BibleGateway. Nothing here is from memory.",
+  "_measured": "Checked NLLB's French output against those forms for 51 names: 48 correct, 3 wrong. The English-side entries below are INSURANCE, not corrections — NLLB is inconsistent by context (in Spanish it renders 'Turn to John' correctly but leaves 'His name was John' in English), so pinning the English form costs nothing and closes that gap.",
+  "confidence": "high",
+
+  "books": {
+    "Genesis": "Genèse", "Exodus": "Exode", "Leviticus": "Lévitique",
+    "Numbers": "Nombres", "Deuteronomy": "Deutéronome", "Joshua": "Josué",
+    "Judges": "Juges", "Ruth": "Ruth", "Samuel": "Samuel", "Kings": "Rois",
+    "Chronicles": "Chroniques", "Ezra": "Esdras", "Nehemiah": "Néhémie",
+    "Esther": "Esther", "Job": "Job", "Psalms": "Psaumes", "Psalm": "Psaume",
+    "Proverbs": "Proverbes", "Ecclesiastes": "Ecclésiaste",
+    "Song of Solomon": "Cantique des cantiques",
+    "Isaiah": "Ésaïe", "Jeremiah": "Jérémie", "Lamentations": "Lamentations",
+    "Ezekiel": "Ézéchiel", "Daniel": "Daniel", "Hosea": "Osée", "Joel": "Joël",
+    "Amos": "Amos", "Obadiah": "Abdias", "Jonah": "Jonas", "Micah": "Michée",
+    "Nahum": "Nahum", "Habakkuk": "Habacuc", "Zephaniah": "Sophonie",
+    "Haggai": "Aggée", "Zechariah": "Zacharie", "Malachi": "Malachie",
+    "Matthew": "Matthieu", "Mark": "Marc", "Luke": "Luc", "John": "Jean",
+    "Acts": "Actes", "Romans": "Romains", "Corinthians": "Corinthiens",
+    "Galatians": "Galates", "Ephesians": "Éphésiens", "Philippians": "Philippiens",
+    "Colossians": "Colossiens", "Thessalonians": "Thessaloniciens",
+    "Timothy": "Timothée", "Titus": "Tite", "Philemon": "Philémon",
+    "Hebrews": "Hébreux", "James": "Jacques", "Peter": "Pierre",
+    "Jude": "Jude", "Revelation": "Apocalypse"
+  },
+
+  "people": {
+    "Jesus": "Jésus", "Jesus Christ": "Jésus-Christ", "Christ": "Christ",
+    "Holy Spirit": "Saint-Esprit",
+    "Adam": "Adam", "Eve": "Ève", "Noah": "Noé", "Abraham": "Abraham",
+    "Sarah": "Sara", "Isaac": "Isaac", "Jacob": "Jacob", "Esau": "Ésaü",
+    "Joseph": "Joseph", "Moses": "Moïse", "Aaron": "Aaron", "Joshua": "Josué",
+    "Gideon": "Gédéon", "Samson": "Samson", "Samuel": "Samuel", "Saul": "Saül",
+    "David": "David", "Solomon": "Salomon", "Elijah": "Élie", "Elisha": "Élisée",
+    "Isaiah": "Ésaïe", "Jeremiah": "Jérémie", "Ezekiel": "Ézéchiel",
+    "Daniel": "Daniel", "Jonah": "Jonas", "Nehemiah": "Néhémie", "Ezra": "Esdras",
+    "Esther": "Esther", "Ruth": "Ruth", "Naomi": "Noémi", "Boaz": "Boaz",
+    "Mary": "Marie", "Martha": "Marthe", "Elizabeth": "Élisabeth",
+    "John the Baptist": "Jean-Baptiste", "Simon Peter": "Simon Pierre",
+    "Simon": "Simon", "Peter": "Pierre", "Andrew": "André", "John": "Jean",
+    "Philip": "Philippe", "Bartholomew": "Barthélemy", "Thomas": "Thomas",
+    "Matthew": "Matthieu", "Thaddaeus": "Thaddée",
+    "Judas Iscariot": "Judas l'Iscariot", "Matthias": "Matthias",
+    "Paul": "Paul", "Barnabas": "Barnabas", "Silas": "Silas",
+    "Timothy": "Timothée", "Titus": "Tite", "Stephen": "Étienne",
+    "Luke": "Luc", "Mark": "Marc", "Apollos": "Apollos", "Priscilla": "Priscille",
+    "Lazarus": "Lazare", "Nicodemus": "Nicodème", "Zacchaeus": "Zachée",
+    "Pilate": "Pilate", "Herod": "Hérode", "Caesar": "César",
+    "Cornelius": "Corneille", "Lydia": "Lydie", "Tamar": "Thamar",
+    "Rahab": "Rahab", "Hezekiah": "Ézéchias", "Josiah": "Josias",
+    "Manasseh": "Manassé", "Zerubbabel": "Zorobabel"
+  },
+
+  "places": {
+    "Jerusalem": "Jérusalem", "Bethlehem": "Bethléhem", "Nazareth": "Nazareth",
+    "Galilee": "Galilée", "Judea": "Judée", "Samaria": "Samarie",
+    "Jericho": "Jéricho", "Bethany": "Béthanie", "Capernaum": "Capernaüm",
+    "Gethsemane": "Gethsémané", "Golgotha": "Golgotha", "Calvary": "Calvaire",
+    "Mount Sinai": "mont Sinaï", "Mount of Olives": "mont des Oliviers",
+    "Egypt": "Égypte", "Babylon": "Babylone", "Assyria": "Assyrie",
+    "Damascus": "Damas", "Antioch": "Antioche", "Corinth": "Corinthe",
+    "Ephesus": "Éphèse", "Philippi": "Philippes", "Thessalonica": "Thessalonique",
+    "Colossae": "Colosses", "Galatia": "Galatie", "Rome": "Rome",
+    "Athens": "Athènes", "Macedonia": "Macédoine", "Patmos": "Patmos",
+    "Zion": "Sion", "Canaan": "Canaan", "Jordan River": "Jourdain",
+    "Red Sea": "mer Rouge", "Sea of Galilee": "mer de Galilée", "Eden": "Éden"
+  },
+
+  "terms": {
+    "gospel": "évangile", "covenant": "alliance", "apostle": "apôtre",
+    "disciple": "disciple", "Pharisee": "pharisien", "Sadducee": "sadducéen",
+    "Gentile": "païen", "Sabbath": "sabbat", "Passover": "Pâque",
+    "Pentecost": "Pentecôte", "Messiah": "Messie", "salvation": "salut",
+    "grace": "grâce", "mercy": "miséricorde", "repentance": "repentance",
+    "redemption": "rédemption", "atonement": "expiation",
+    "righteousness": "justice", "justification": "justification",
+    "sanctification": "sanctification", "resurrection": "résurrection",
+    "crucifixion": "crucifixion", "ascension": "ascension",
+    "kingdom of God": "royaume de Dieu", "kingdom of heaven": "royaume des cieux",
+    "parable": "parabole", "prophet": "prophète", "prophecy": "prophétie",
+    "Scripture": "Écriture", "the Word": "la Parole", "tabernacle": "tabernacle",
+    "temple": "temple", "altar": "autel", "sacrifice": "sacrifice",
+    "priest": "sacrificateur", "high priest": "souverain sacrificateur",
+    "baptism": "baptême", "the Lord's Supper": "la Cène",
+    "eternal life": "vie éternelle", "Satan": "Satan", "the devil": "le diable"
+  },
+
+  "_target_fixes": {
+    "_note": "TARGET-side corrections — the only three names NLLB got wrong in French, measured. Narrow and safe: none of these strings is an ordinary French word. 'Stéphanas' is not a variant of Étienne at all, it is a DIFFERENT biblical person (1 Cor 1:16), so leaving it would name the wrong man. 'Isaïe' is the Catholic/Jerusalem form; Segond and the Protestant tradition use Ésaïe, and this church is Protestant.",
+    "Éliya": "Élie",
+    "Stéphanas": "Étienne",
+    "Isaïe": "Ésaïe"
+  }
+}

app/bible/lexicon-hat.json

@@ -0,0 +1,105 @@
+{
+  "language": "hat_Latn",
+  "reference": "Bib La, Haitian Creole Version (HAT)",
+  "_verified": "Verified from the full ebible.org Bib La corpus. SAUL OMITTED: Haitian splits it by person, Sayil (the king) vs Sòl (of Tarsus). Note Jesse=Izayi and Isaiah=Ezayi differ by one letter — distinct English keys, so no collision here, but do not hand-edit them carelessly.",
+  "confidence": "high — every form read from published text and grepped back against the source corpus",
+  "people": {
+    "Jesus": "Jezi",
+    "Christ": "Kris",
+    "David": "David",
+    "Abraham": "Abraram",
+    "Isaac": "Izarak",
+    "Jacob": "Jakòb",
+    "Judah": "Jida",
+    "Tamar": "Tama",
+    "Perez": "Perèz",
+    "Zerah": "Zara",
+    "Hezron": "Eswòm",
+    "Amminadab": "Amenadab",
+    "Nahshon": "Naason",
+    "Salmon": "Salmon",
+    "Boaz": "Boaz",
+    "Rahab": "Raab",
+    "Obed": "Obèd",
+    "Ruth": "Rit",
+    "Solomon": "Salomon",
+    "Uriah": "Ouri",
+    "Rehoboam": "Woboram",
+    "Abijah": "Abya",
+    "Asa": "Asa",
+    "Jehoshaphat": "Jozafa",
+    "Joram": "Joram",
+    "Uzziah": "Ozyas",
+    "Jotham": "Joatam",
+    "Ahaz": "Akaz",
+    "Hezekiah": "Ezekyas",
+    "Manasseh": "Manase",
+    "Amon": "Amon",
+    "Josiah": "Jozyas",
+    "Jechoniah": "Jekonyas",
+    "Shealtiel": "Salatyèl",
+    "Zerubbabel": "Zowobabèl",
+    "Abiud": "Abiyoud",
+    "Eliakim": "Elyakim",
+    "Azor": "Azò",
+    "Zadok": "Sadòk",
+    "Achim": "Akim",
+    "Eliud": "Eliyoud",
+    "Eleazar": "Eleaza",
+    "Matthan": "Matan",
+    "Joseph": "Jozèf",
+    "Mary": "Mari",
+    "Simon": "Simon",
+    "Peter": "Pyè",
+    "Andrew": "Andre",
+    "James": "Jak",
+    "Zebedee": "Zebede",
+    "John": "Jan",
+    "Philip": "Filip",
+    "Bartholomew": "Batèlmi",
+    "Thomas": "Toma",
+    "Matthew": "Matye",
+    "Alphaeus": "Alfe",
+    "Thaddaeus": "Tade",
+    "Judas": "Jida",
+    "Moses": "Moyiz",
+    "Elijah": "Eli",
+    "Ahab": "Akab",
+    "Isaiah": "Ezayi",
+    "Jeremiah": "Jeremi",
+    "Daniel": "Danyèl",
+    "Noah": "Noe",
+    "Adam": "Adan",
+    "Eve": "Ev",
+    "Joshua": "Jozye",
+    "Samuel": "Samyèl",
+    "Paul": "Pòl",
+    "Stephen": "Etyèn",
+    "Barnabas": "Banabas",
+    "Silas": "Silas",
+    "Timothy": "Timote",
+    "Titus": "Tit",
+    "Luke": "Lik",
+    "Mark": "Mak",
+    "Lazarus": "Laza",
+    "Nicodemus": "Nikodèm",
+    "Pilate": "Pilat",
+    "Herod": "Ewòd"
+  },
+  "places": {
+    "Babylon": "Babilòn",
+    "Jerusalem": "Jerizalèm",
+    "Bethlehem": "Betleyèm",
+    "Nazareth": "Nazarèt",
+    "Galilee": "Galile",
+    "Judea": "Jide",
+    "Egypt": "Lejip",
+    "Corinth": "Korent",
+    "Ephesus": "Efèz",
+    "Rome": "Wòm",
+    "Zion": "Siyon",
+    "Jordan": "Jouden",
+    "Bethany": "Betani",
+    "Athens": "Atèn"
+  }
+}

app/bible/lexicon-hin.json

@@ -0,0 +1,99 @@
+{
+  "language": "hin_Deva",
+  "reference": "IRV Hindi 2019",
+  "_verified": "Verified from the ebible.org IRV corpus. SIX NAMES DELIBERATELY OMITTED because IRV and the older HHBD/Old Version disagree on them — Abraham (अब्राहम vs इब्राहीम), Perez, Zerah, Hezron, Manasseh, Uzziah. If this congregation reads the Old Version, IRV's forms would look wrong to them, so only the forms both editions share are pinned. Ask before adding the six.",
+  "confidence": "high — every form read from published text and grepped back against the source corpus",
+  "people": {
+    "Jesus": "यीशु",
+    "Christ": "मसीह",
+    "David": "दाऊद",
+    "Isaac": "इसहाक",
+    "Jacob": "याकूब",
+    "Judah": "यहूदा",
+    "Tamar": "तामार",
+    "Amminadab": "अम्मीनादाब",
+    "Nahshon": "नहशोन",
+    "Salmon": "सलमोन",
+    "Boaz": "बोअज",
+    "Rahab": "राहाब",
+    "Obed": "ओबेद",
+    "Ruth": "रूत",
+    "Jesse": "यिशै",
+    "Solomon": "सुलैमान",
+    "Uriah": "ऊरिय्याह",
+    "Rehoboam": "रहबाम",
+    "Abijah": "अबिय्याह",
+    "Asa": "आसा",
+    "Jehoshaphat": "यहोशाफात",
+    "Joram": "योराम",
+    "Jotham": "योताम",
+    "Ahaz": "आहाज",
+    "Hezekiah": "हिजकिय्याह",
+    "Amon": "आमोन",
+    "Josiah": "योशिय्याह",
+    "Jechoniah": "यकुन्याह",
+    "Shealtiel": "शालतीएल",
+    "Zerubbabel": "जरुब्बाबेल",
+    "Abiud": "अबीहूद",
+    "Eliakim": "एलयाकीम",
+    "Azor": "अजोर",
+    "Zadok": "सादोक",
+    "Achim": "अखीम",
+    "Eliud": "एलीहूद",
+    "Eleazar": "एलीआजर",
+    "Matthan": "मत्तान",
+    "Joseph": "यूसुफ",
+    "Mary": "मरियम",
+    "Simon": "शमौन",
+    "Peter": "पतरस",
+    "Andrew": "अन्द्रियास",
+    "James": "याकूब",
+    "Zebedee": "जब्दी",
+    "John": "यूहन्ना",
+    "Philip": "फिलिप्पुस",
+    "Bartholomew": "बरतुल्मै",
+    "Thomas": "थोमा",
+    "Matthew": "मत्ती",
+    "Alphaeus": "हलफईस",
+    "Thaddaeus": "तद्दै",
+    "Judas": "यहूदा",
+    "Moses": "मूसा",
+    "Elijah": "एलिय्याह",
+    "Ahab": "अहाब",
+    "Isaiah": "यशायाह",
+    "Jeremiah": "यिर्मयाह",
+    "Daniel": "दानिय्येल",
+    "Noah": "नूह",
+    "Adam": "आदम",
+    "Eve": "हव्वा",
+    "Joshua": "यहोशू",
+    "Samuel": "शमूएल",
+    "Saul": "शाऊल",
+    "Paul": "पौलुस",
+    "Stephen": "स्तिफनुस",
+    "Barnabas": "बरनबास",
+    "Silas": "सीलास",
+    "Timothy": "तीमुथियुस",
+    "Titus": "तीतुस",
+    "Luke": "लूका",
+    "Mark": "मरकुस",
+    "Lazarus": "लाज़र",
+    "Nicodemus": "नीकुदेमुस",
+    "Pilate": "पिलातुस",
+    "Herod": "हेरोदेस"
+  },
+  "places": {
+    "Jerusalem": "यरूशलेम",
+    "Bethlehem": "बैतलहम",
+    "Nazareth": "नासरत",
+    "Galilee": "गलील",
+    "Judea": "यहूदिया",
+    "Egypt": "मिस्र",
+    "Corinth": "कुरिन्थुस",
+    "Ephesus": "इफिसुस",
+    "Rome": "रोम",
+    "Zion": "सिय्योन",
+    "Jordan": "यरदन",
+    "Bethany": "बैतनिय्याह"
+  }
+}

app/bible/lexicon-kor.json

@@ -0,0 +1,29 @@
+{
+  "language": "kor_Hang",
+  "reference": "Korean Bible — apostle forms verified against Korean Living Bible (KLB) text",
+  "_verified": "Read directly from KLB Matthew 10:2-4 on BibleGateway. These proper-noun forms are shared with 개역개정 (the dominant Korean Protestant edition); KLB was used because it was the accessible text. Flagged as such rather than claimed as 개역개정.",
+  "_measured": "The archive holds only 6 Korean rows, so nothing could be measured. The English-side table is therefore insurance, not a correction of anything observed.",
+  "confidence": "medium — forms verified from text, but the edition is a paraphrase and no archive data exists to confirm what NLLB actually does in Korean",
+  "people": {
+    "Jesus": "예수",
+    "Christ": "그리스도",
+    "Simon": "시몬",
+    "Peter": "베드로",
+    "Andrew": "안드레",
+    "James": "야고보",
+    "John": "요한",
+    "Philip": "빌립",
+    "Bartholomew": "바돌로매",
+    "Thomas": "도마",
+    "Matthew": "마태",
+    "Thaddaeus": "다대오",
+    "Judas": "유다",
+    "Zebedee": "세베대",
+    "Alphaeus": "알패오"
+  },
+  "_target_fixes": {
+    "_note": "Predicted from the earlier probe, which showed NLLB producing the English-phonetic 매튜 rather than the Bible form 마태. NOT confirmed against archive data — there are only 6 Korean rows.",
+    "_removed_jon": "존 -> 요한 was written and then REMOVED. 존 is a SINGLE Hangul syllable, and termMatcher guards 1-character CJK terms with a lookaround precisely so they cannot match inside a word — unguarded it would corrupt 존재 (existence) and 존경 (respect). Guarded, it can never fire in running Korean, because the next character is always Hangul. So the entry would have shipped as a silent no-op. A 1-character CJK correction is not expressible with this matcher; it needs longer context (e.g. 존이 / 존은) to be both safe and effective.",
+    "매튜": "마태"
+  }
+}

app/bible/lexicon-por.json

@@ -0,0 +1,106 @@
+{
+  "language": "por_Latn",
+  "reference": "João Ferreira de Almeida Revista e Corrigida 2009 (ARC)",
+  "_verified": "Verified against BibleGateway ARC. RAM OMITTED: ARC renders Ram as 'Arão', which is the SAME spelling it uses for Aaron — the map would conflate two people. SAUL OMITTED: Portuguese splits it by person, Saul (the king) vs Saulo (of Tarsus), and one key cannot carry both. ARA is a different revision and was NOT checked.",
+  "confidence": "high — every form read from published text and grepped back against the source corpus",
+  "people": {
+    "Jesus": "Jesus",
+    "Christ": "Cristo",
+    "David": "Davi",
+    "Abraham": "Abraão",
+    "Isaac": "Isaque",
+    "Jacob": "Jacó",
+    "Judah": "Judá",
+    "Tamar": "Tamar",
+    "Perez": "Perez",
+    "Zerah": "Zerá",
+    "Hezron": "Esrom",
+    "Amminadab": "Aminadabe",
+    "Nahshon": "Naassom",
+    "Salmon": "Salmom",
+    "Boaz": "Boaz",
+    "Rahab": "Raabe",
+    "Obed": "Obede",
+    "Ruth": "Rute",
+    "Jesse": "Jessé",
+    "Solomon": "Salomão",
+    "Uriah": "Urias",
+    "Rehoboam": "Roboão",
+    "Abijah": "Abias",
+    "Asa": "Asa",
+    "Jehoshaphat": "Josafá",
+    "Joram": "Jorão",
+    "Uzziah": "Uzias",
+    "Jotham": "Jotão",
+    "Ahaz": "Acaz",
+    "Hezekiah": "Ezequias",
+    "Manasseh": "Manassés",
+    "Amon": "Amom",
+    "Josiah": "Josias",
+    "Jechoniah": "Jeconias",
+    "Shealtiel": "Salatiel",
+    "Zerubbabel": "Zorobabel",
+    "Abiud": "Abiúde",
+    "Eliakim": "Eliaquim",
+    "Azor": "Azor",
+    "Zadok": "Sadoque",
+    "Achim": "Aquim",
+    "Eliud": "Eliúde",
+    "Eleazar": "Eleazar",
+    "Matthan": "Matã",
+    "Joseph": "José",
+    "Mary": "Maria",
+    "Simon": "Simão",
+    "Peter": "Pedro",
+    "Andrew": "André",
+    "James": "Tiago",
+    "Zebedee": "Zebedeu",
+    "John": "João",
+    "Philip": "Filipe",
+    "Bartholomew": "Bartolomeu",
+    "Thomas": "Tomé",
+    "Matthew": "Mateus",
+    "Alphaeus": "Alfeu",
+    "Thaddaeus": "Tadeu",
+    "Judas": "Judas",
+    "Moses": "Moisés",
+    "Elijah": "Elias",
+    "Ahab": "Acabe",
+    "Isaiah": "Isaías",
+    "Jeremiah": "Jeremias",
+    "Daniel": "Daniel",
+    "Noah": "Noé",
+    "Adam": "Adão",
+    "Eve": "Eva",
+    "Joshua": "Josué",
+    "Samuel": "Samuel",
+    "Paul": "Paulo",
+    "Stephen": "Estêvão",
+    "Barnabas": "Barnabé",
+    "Silas": "Silas",
+    "Timothy": "Timóteo",
+    "Titus": "Tito",
+    "Luke": "Lucas",
+    "Mark": "Marcos",
+    "Lazarus": "Lázaro",
+    "Nicodemus": "Nicodemos",
+    "Pilate": "Pilatos",
+    "Herod": "Herodes"
+  },
+  "places": {
+    "Babylon": "Babilônia",
+    "Jerusalem": "Jerusalém",
+    "Bethlehem": "Belém",
+    "Nazareth": "Nazaré",
+    "Galilee": "Galileia",
+    "Judea": "Judeia",
+    "Egypt": "Egito",
+    "Corinth": "Corinto",
+    "Ephesus": "Éfeso",
+    "Rome": "Roma",
+    "Zion": "Sião",
+    "Jordan": "Jordão",
+    "Bethany": "Betânia",
+    "Athens": "Atenas"
+  }
+}

app/bible/lexicon-por_PT.json

@@ -0,0 +1,8 @@
+{
+  "language": "por_PT",
+  "inherits": "por_Latn",
+  "reference": "Almeida Revista e Corrigida, Portugal — divergences from the Brazilian table only",
+  "_verified": "Portugal keeps 'David' where Brazil writes 'Davi'. Measured: the shared table fired David->Davi 6 times on real output, which would be wrong for a Portuguese congregation. Listing it as identical to the English removes the entry rather than replacing it, so the name is simply left alone — which is already correct European Portuguese.",
+  "_gap": "This file contains ONE verified divergence. Others certainly exist (European Portuguese also differs on Egipto/Egito and Babilónia/Babilônia, though those are handled by pt-variants.js orthography). Nothing else was verified against a Portugal edition, so nothing else is claimed.",
+  "overrides": { "David": "David" }
+}

app/bible/lexicon-spa.json

@@ -0,0 +1,123 @@
+{
+  "language": "spa_Latn",
+  "reference": "Reina-Valera 1960 (RVR1960)",
+  "_copyright": "RVR1960 verse TEXT is copyright Sociedades Biblicas Unidas and is NOT included here or anywhere in this app. This file contains only proper nouns and book titles, which are naming conventions shared across Spanish Bibles and are not copyrightable subject matter. If verse text is ever used, it is for offline validation only and never ships.",
+  "_use": "Applied to NLLB's SPANISH OUTPUT, and only to rescue an English form that survived untranslated (measured: 'Se llamaba John.'). It does NOT renormalize names NLLB already localized -- that would fight the model and risk breaking inflection.",
+  "confidence": "high",
+
+  "books": {
+    "Genesis": "Génesis", "Exodus": "Éxodo", "Leviticus": "Levítico",
+    "Numbers": "Números", "Deuteronomy": "Deuteronomio", "Joshua": "Josué",
+    "Judges": "Jueces", "Ruth": "Rut", "Samuel": "Samuel", "Kings": "Reyes",
+    "Chronicles": "Crónicas", "Ezra": "Esdras", "Nehemiah": "Nehemías",
+    "Esther": "Ester", "Job": "Job", "Psalms": "Salmos", "Psalm": "Salmo",
+    "Proverbs": "Proverbios", "Ecclesiastes": "Eclesiastés",
+    "Song of Solomon": "Cantares", "Song of Songs": "Cantares",
+    "Isaiah": "Isaías", "Jeremiah": "Jeremías", "Lamentations": "Lamentaciones",
+    "Ezekiel": "Ezequiel", "Daniel": "Daniel", "Hosea": "Oseas", "Joel": "Joel",
+    "Amos": "Amós", "Obadiah": "Abdías", "Jonah": "Jonás", "Micah": "Miqueas",
+    "Nahum": "Nahúm", "Habakkuk": "Habacuc", "Zephaniah": "Sofonías",
+    "Haggai": "Hageo", "Zechariah": "Zacarías", "Malachi": "Malaquías",
+    "Matthew": "Mateo", "Mark": "Marcos", "Luke": "Lucas", "John": "Juan",
+    "Acts": "Hechos", "Romans": "Romanos", "Corinthians": "Corintios",
+    "Galatians": "Gálatas", "Ephesians": "Efesios", "Philippians": "Filipenses",
+    "Colossians": "Colosenses", "Thessalonians": "Tesalonicenses",
+    "Timothy": "Timoteo", "Titus": "Tito", "Philemon": "Filemón",
+    "Hebrews": "Hebreos", "James": "Santiago", "Peter": "Pedro",
+    "Jude": "Judas", "Revelation": "Apocalipsis"
+  },
+
+  "_books_note": "RVR1960 titles. 'Revelation' is Apocalipsis, never 'Revelación'. Song of Solomon is Cantares. Numbered books (1 Samuel, 2 Corinthians) are handled by the stem, since the numeral passes through untouched.",
+
+  "people": {
+    "Jesus": "Jesús", "Jesus Christ": "Jesucristo", "Christ": "Cristo",
+    "Holy Spirit": "Espíritu Santo", "Son of God": "Hijo de Dios",
+    "Adam": "Adán", "Eve": "Eva", "Noah": "Noé",
+    "Abraham": "Abraham", "Sarah": "Sara", "Isaac": "Isaac", "Rebekah": "Rebeca",
+    "Jacob": "Jacob", "Esau": "Esaú", "Rachel": "Raquel", "Leah": "Lea",
+    "Joseph": "José", "Moses": "Moisés", "Aaron": "Aarón", "Miriam": "María",
+    "Joshua": "Josué", "Caleb": "Caleb", "Gideon": "Gedeón", "Samson": "Sansón",
+    "Samuel": "Samuel", "Saul": "Saúl", "David": "David", "Solomon": "Salomón",
+    "Elijah": "Elías", "Elisha": "Eliseo", "Isaiah": "Isaías",
+    "Jeremiah": "Jeremías", "Ezekiel": "Ezequiel", "Daniel": "Daniel",
+    "Jonah": "Jonás", "Nehemiah": "Nehemías", "Ezra": "Esdras",
+    "Esther": "Ester", "Ruth": "Rut", "Naomi": "Noemí", "Boaz": "Booz",
+    "Mary": "María", "Martha": "Marta", "Elizabeth": "Elisabet",
+    "John the Baptist": "Juan el Bautista", "Simon Peter": "Simón Pedro",
+    "Simon": "Simón", "Peter": "Pedro", "Andrew": "Andrés",
+    "John": "Juan", "Philip": "Felipe", "Bartholomew": "Bartolomé",
+    "Thomas": "Tomás", "Matthew": "Mateo", "Thaddaeus": "Tadeo",
+    "Judas Iscariot": "Judas Iscariote", "Matthias": "Matías",
+    "Paul": "Pablo", "Barnabas": "Bernabé", "Silas": "Silas",
+    "Timothy": "Timoteo", "Titus": "Tito", "Stephen": "Esteban",
+    "Luke": "Lucas", "Mark": "Marcos", "Apollos": "Apolos",
+    "Priscilla": "Priscila", "Aquila": "Aquila", "Lazarus": "Lázaro",
+    "Nicodemus": "Nicodemo", "Zacchaeus": "Zaqueo", "Pilate": "Pilato",
+    "Herod": "Herodes", "Caesar": "César", "Cornelius": "Cornelio",
+    "Lydia": "Lidia", "Jehovah": "Jehová"
+  },
+
+  "_people_note": "RVR1960 renders Moses' sister Miriam as Maria, and Elizabeth as Elisabet (no -h). Jehovah is included because RVR1960 uses Jehova for the divine name where other Spanish versions use SENOR -- but plain 'Lord' still maps to Senor, not Jehova, since a preacher saying 'the Lord' is not invoking the tetragrammaton.",
+
+  "_james_problem": "RVR1960 splits English 'James': the EPISTLE is Santiago, but the APOSTLE (son of Zebedee) is Jacobo. One English word, two correct Spanish words, decided by context this app does not reliably have. 'James' is therefore in books{} only -- a book reference is the far more common use in preaching ('the book of James'). A bare personal 'James' is left to NLLB rather than guessed wrong.",
+
+  "places": {
+    "Jerusalem": "Jerusalén", "Bethlehem": "Belén", "Nazareth": "Nazaret",
+    "Galilee": "Galilea", "Judea": "Judea", "Samaria": "Samaria",
+    "Jericho": "Jericó", "Bethany": "Betania", "Capernaum": "Capernaum",
+    "Gethsemane": "Getsemaní", "Golgotha": "Gólgota", "Calvary": "Calvario",
+    "Mount Sinai": "monte Sinaí", "Mount of Olives": "monte de los Olivos",
+    "Egypt": "Egipto", "Babylon": "Babilonia", "Assyria": "Asiria",
+    "Damascus": "Damasco", "Antioch": "Antioquía", "Corinth": "Corinto",
+    "Ephesus": "Éfeso", "Philippi": "Filipos", "Thessalonica": "Tesalónica",
+    "Colossae": "Colosas", "Galatia": "Galacia", "Rome": "Roma",
+    "Athens": "Atenas", "Macedonia": "Macedonia", "Patmos": "Patmos",
+    "Zion": "Sion", "Canaan": "Canaán", "Jordan River": "río Jordán",
+    "Red Sea": "Mar Rojo", "Sea of Galilee": "mar de Galilea", "Eden": "Edén"
+  },
+
+  "terms": {
+    "gospel": "evangelio", "covenant": "pacto", "new covenant": "nuevo pacto",
+    "apostle": "apóstol", "disciple": "discípulo", "Pharisee": "fariseo",
+    "Sadducee": "saduceo", "Gentile": "gentil", "Sabbath": "día de reposo",
+    "Passover": "pascua", "Pentecost": "Pentecostés", "Messiah": "Mesías",
+    "salvation": "salvación", "grace": "gracia", "mercy": "misericordia",
+    "repentance": "arrepentimiento", "redemption": "redención",
+    "atonement": "expiación", "righteousness": "justicia",
+    "justification": "justificación", "sanctification": "santificación",
+    "propitiation": "propiciación", "resurrection": "resurrección",
+    "crucifixion": "crucifixión", "ascension": "ascensión",
+    "kingdom of God": "reino de Dios", "kingdom of heaven": "reino de los cielos",
+    "parable": "parábola", "prophet": "profeta", "prophecy": "profecía",
+    "epistle": "epístola", "Scripture": "Escritura", "the Word": "el Verbo",
+    "tabernacle": "tabernáculo", "temple": "templo", "altar": "altar",
+    "sacrifice": "sacrificio", "priest": "sacerdote", "high priest": "sumo sacerdote",
+    "baptism": "bautismo", "the Lord's Supper": "la Cena del Señor",
+    "eternal life": "vida eterna", "Satan": "Satanás", "the devil": "el diablo",
+    "cherubim": "querubines", "seraphim": "serafines"
+  },
+
+  "_terms_note": "RVR1960 distinctives kept deliberately: Sabbath is 'dia de reposo' (not 'sabado'), and the Word of John 1:1 is 'el Verbo' (not 'la Palabra'). Ordinary vocabulary that NLLB already translates correctly and unambiguously (faith, hope, love, sin, heaven, hell, angel) is omitted -- pinning those would add risk with no benefit.",
+
+  "liturgical": {
+    "_use": "Matched as a WHOLE UTTERANCE only, bypassing NLLB entirely. Measured: 'Amen.' currently becomes '- Si, estoy bien.' = 'Yes, I am fine.'",
+    "amen": "Amén.",
+    "hallelujah": "¡Aleluya!",
+    "alleluia": "¡Aleluya!",
+    "hosanna": "¡Hosanna!",
+    "praise god": "¡Alabado sea Dios!",
+    "praise the lord": "¡Alabado sea el Señor!",
+    "glory to god": "¡Gloria a Dios!",
+    "thank you jesus": "¡Gracias, Jesús!",
+    "god is good": "Dios es bueno.",
+    "god bless you": "Que Dios le bendiga.",
+    "let us pray": "Oremos.",
+    "in jesus name": "En el nombre de Jesús.",
+    "in jesus' name": "En el nombre de Jesús.",
+    "good morning": "Buenos días.",
+    "good evening": "Buenas noches.",
+    "welcome": "Bienvenidos.",
+    "open your bibles": "Abran sus Biblias.",
+    "turn with me": "Vayan conmigo."
+  }
+}

app/bible/lexicon-vie.json

@@ -0,0 +1,106 @@
+{
+  "language": "vie_Latn",
+  "reference": "Kinh Thánh 1925/1926 Bản Truyền Thống (VIE1925/BTT)",
+  "_verified": "Verified against bible.com VIE1925 and wordproject. JESSE OMITTED: this edition uses two different forms — Y-sai in 1 Samuel 16:1 but Gie-sê in Matthew 1:5-6 — so any single mapping is wrong in one testament. NOTE ebible.org's vie1934 is ENCODING-CORRUPT (Á appears 0 times, Aù 680) and must never be used.",
+  "confidence": "high — every form read from published text and grepped back against the source corpus",
+  "people": {
+    "Jesus": "Jêsus",
+    "Christ": "Christ",
+    "David": "Đa-vít",
+    "Abraham": "Áp-ra-ham",
+    "Isaac": "Y-sác",
+    "Jacob": "Gia-cốp",
+    "Judah": "Giu-đa",
+    "Tamar": "Tha-ma",
+    "Perez": "Pha-rê",
+    "Zerah": "Xa-ra",
+    "Hezron": "Ếch-rôm",
+    "Amminadab": "A-mi-na-đáp",
+    "Nahshon": "Na-ách-son",
+    "Salmon": "Sanh-môn",
+    "Boaz": "Bô-ô",
+    "Rahab": "Ra-háp",
+    "Obed": "Ô-bết",
+    "Ruth": "Ru-tơ",
+    "Solomon": "Sa-lô-môn",
+    "Uriah": "U-ri",
+    "Rehoboam": "Rô-bô-am",
+    "Abijah": "A-bi-gia",
+    "Asa": "A-sa",
+    "Jehoshaphat": "Giô-sa-phát",
+    "Joram": "Giô-ram",
+    "Uzziah": "Ô-xia",
+    "Jotham": "Giô-tam",
+    "Ahaz": "A-cha",
+    "Hezekiah": "Ê-xê-chia",
+    "Manasseh": "Ma-na-sê",
+    "Amon": "A-môn",
+    "Josiah": "Giô-si-a",
+    "Jechoniah": "Giê-chô-nia",
+    "Shealtiel": "Sa-la-thi-ên",
+    "Zerubbabel": "Xô-rô-ba-bên",
+    "Abiud": "A-bi-út",
+    "Eliakim": "Ê-li-a-kim",
+    "Azor": "A-xô",
+    "Zadok": "Sa-đốc",
+    "Achim": "A-chim",
+    "Eliud": "Ê-li-út",
+    "Eleazar": "Ê-lê-a-xa",
+    "Matthan": "Ma-than",
+    "Joseph": "Giô-sép",
+    "Mary": "Ma-ri",
+    "Simon": "Si-môn",
+    "Peter": "Phi-e-rơ",
+    "Andrew": "Anh-rê",
+    "James": "Gia-cơ",
+    "Zebedee": "Xê-bê-đê",
+    "John": "Giăng",
+    "Philip": "Phi-líp",
+    "Bartholomew": "Ba-tê-lê-my",
+    "Thomas": "Thô-ma",
+    "Matthew": "Ma-thi-ơ",
+    "Alphaeus": "A-phê",
+    "Thaddaeus": "Tha-đê",
+    "Judas": "Giu-đa",
+    "Moses": "Môi-se",
+    "Elijah": "Ê-li",
+    "Ahab": "A-háp",
+    "Isaiah": "Ê-sai",
+    "Jeremiah": "Giê-rê-mi",
+    "Daniel": "Đa-ni-ên",
+    "Noah": "Nô-ê",
+    "Adam": "A-đam",
+    "Eve": "Ê-va",
+    "Joshua": "Giô-suê",
+    "Samuel": "Sa-mu-ên",
+    "Saul": "Sau-lơ",
+    "Paul": "Phao-lô",
+    "Stephen": "Ê-tiên",
+    "Barnabas": "Ba-na-ba",
+    "Silas": "Si-la",
+    "Timothy": "Ti-mô-thê",
+    "Titus": "Tít",
+    "Luke": "Lu-ca",
+    "Mark": "Mác",
+    "Lazarus": "La-xa-rơ",
+    "Nicodemus": "Ni-cô-đem",
+    "Pilate": "Phi-lát",
+    "Herod": "Hê-rốt"
+  },
+  "places": {
+    "Babylon": "Ba-by-lôn",
+    "Jerusalem": "Giê-ru-sa-lem",
+    "Bethlehem": "Bết-lê-hem",
+    "Nazareth": "Na-xa-rét",
+    "Galilee": "Ga-li-lê",
+    "Judea": "Giu-đê",
+    "Egypt": "Ê-díp-tô",
+    "Corinth": "Cô-rinh-tô",
+    "Ephesus": "Ê-phê-sô",
+    "Rome": "Rô-ma",
+    "Zion": "Si-ôn",
+    "Jordan": "Giô-đanh",
+    "Bethany": "Bê-tha-ni",
+    "Athens": "A-thên"
+  }
+}

app/bible/lexicon-zho.json

@@ -0,0 +1,28 @@
+{
+  "language": "zho_Hans",
+  "reference": "和合本 Chinese Union Version, Simplified (CUVS)",
+  "_verified": "Forms read directly from CUVS text on BibleGateway: Matthew 10:2-4 (the twelve apostles) and Matthew 1:1-6 (the genealogy). Nothing from memory. BibleGateway typesets CUV with a space between every character; the spaces were stripped.",
+  "_measured": "Checked against 4,636 real Chinese rows in this church's own transcript archive. ZERO English names survive in Chinese output, so the English-side table below is pure insurance. The real defects are target-side and there are exactly two.",
+  "_god": "The archive shows NLLB already rendering God as 上帝, which matches the 上帝版 edition of the Union Version. No change made — flagging it because the CUV ships in both a 神版 and a 上帝版 and they differ on exactly this.",
+  "confidence": "high",
+
+  "people": {
+    "Jesus": "耶稣", "Jesus Christ": "耶稣基督", "Christ": "基督",
+    "Simon": "西门", "Simon Peter": "西门彼得", "Peter": "彼得",
+    "Andrew": "安得烈", "James": "雅各", "John": "约翰", "Philip": "腓力",
+    "Bartholomew": "巴多罗买", "Thomas": "多马", "Matthew": "马太",
+    "Thaddaeus": "达太", "Judas": "犹大", "Zebedee": "西庇太",
+    "Abraham": "亚伯拉罕", "David": "大卫", "Isaac": "以撒", "Jacob": "雅各",
+    "Judah": "犹大", "Tamar": "他玛", "Perez": "法勒斯", "Zerah": "谢拉",
+    "Hezron": "希斯仑", "Amminadab": "亚米拿达", "Nahshon": "拿顺",
+    "Salmon": "撒门", "Rahab": "喇合", "Boaz": "波阿斯", "Ruth": "路得",
+    "Obed": "俄备得", "Jesse": "耶西", "Uriah": "乌利亚", "Solomon": "所罗门",
+    "Moses": "摩西", "Paul": "保罗", "Joshua": "约书亚", "Noah": "挪亚"
+  },
+
+  "_target_fixes": {
+    "_note": "MEASURED wrong against the archive, and every occurrence inspected to rule out a compound-boundary false positive — 36 instances checked, all genuinely the name, each confirmed by its English source line. Noah is the serious one: NLLB used the SECULAR transliteration 诺亚 in 33 of 39 occurrences, against the Bible form 挪亚 in only 6.",
+    "诺亚": "挪亚",
+    "马修": "马太"
+  }
+}

app/bible/lexicon-zho_Hant.json

@@ -0,0 +1,22 @@
+{
+  "language": "zho_Hant",
+  "reference": "和合本 Chinese Union Version, Traditional (CUV)",
+  "_verified": "Forms read directly from CUV Traditional text on BibleGateway: Matthew 10:2-4 and Matthew 1:1-2. Traditional characters were READ, not converted from the Simplified table — a mechanical conversion would have been a guess.",
+  "confidence": "high",
+
+  "people": {
+    "Jesus": "耶穌", "Jesus Christ": "耶穌基督", "Christ": "基督",
+    "Simon": "西門", "Peter": "彼得", "Andrew": "安得烈", "James": "雅各",
+    "John": "約翰", "Philip": "腓力", "Bartholomew": "巴多羅買",
+    "Thomas": "多馬", "Matthew": "馬太", "Thaddaeus": "達太",
+    "Judas": "猶大", "Zebedee": "西庇太",
+    "Abraham": "亞伯拉罕", "David": "大衛", "Isaac": "以撒", "Jacob": "雅各",
+    "Judah": "猶大"
+  },
+
+  "_target_fixes": {
+    "_note": "Traditional counterparts of the two Simplified defects. 諾亞/馬修 are the secular-phonetic forms; 挪亞/馬太 are the Union Version's.",
+    "諾亞": "挪亞",
+    "馬修": "馬太"
+  }
+}

app/bible/test-corpus.json

@@ -0,0 +1,58 @@
+{
+  "_note": "Realistic preaching utterances for validating the guard layers. 'expect' records properties that must hold in EVERY target language, since no one here can read most of them. Anything asserting specific target text is marked needsNativeReview.",
+
+  "_carrier": "Name coverage is measured IN A CARRIER SENTENCE, not in isolation. An isolated proper noun is exactly the short-input regime where NLLB hallucinates, so testing bare terms would measure the wrong failure. Carrier: 'We read about NAME in the Bible.'",
+
+  "hallucination_cases": [
+    { "en": "Donald Trump.",                    "expect": { "noNewQuestion": true, "maxSentences": 1 }, "seen": "spa: 'Donald Trump. ¿Qué es eso?'" },
+    { "en": "Amen.",                            "expect": { "noNewQuestion": true, "maxSentences": 1 }, "seen": "spa: '- Sí, estoy bien.' (= 'Yes, I am fine.')" },
+    { "en": "Hello, hello.",                    "expect": { "noLeadingDash": true, "maxSentences": 1 }, "seen": "spa: '- Hola, está bien.'" },
+    { "en": "Hallelujah.",                      "expect": { "noNewQuestion": true, "maxSentences": 1 } },
+    { "en": "Praise the Lord.",                 "expect": { "noNewQuestion": true, "maxSentences": 1 } },
+    { "en": "Come on.",                         "expect": { "noNewQuestion": true, "maxSentences": 1 } },
+    { "en": "Yes.",                             "expect": { "noNewQuestion": true, "maxSentences": 1 } },
+    { "en": "Okay.",                            "expect": { "noNewQuestion": true, "maxSentences": 1 } }
+  ],
+
+  "must_not_be_stripped": [
+    { "en": "How many countries are in the world?",   "expect": { "keepsQuestion": true }, "why": "source has ? — the target question is real" },
+    { "en": "What does the Bible say about that?",    "expect": { "keepsQuestion": true } },
+    { "en": "Do you believe that?",                   "expect": { "keepsQuestion": true } },
+    { "en": "Who do you say that I am?",              "expect": { "keepsQuestion": true }, "why": "Matthew 16:15" },
+    { "en": "Where, O death, is your victory?",        "expect": { "keepsQuestion": true }, "why": "1 Cor 15:55" },
+    { "en": "Are you with me",                        "expect": { "note": "Whisper drops the ? on questions like this — a correct target may legitimately add one. THE RISK CASE for the invented-question rule." } },
+    { "en": "Can I get an amen",                      "expect": { "note": "same risk class" } },
+    { "en": "You know what I'm saying",               "expect": { "note": "tag question, no ? in source" } }
+  ],
+
+  "name_fidelity": [
+    { "en": "His name was John.",                            "seen": "spa: 'Se llamaba John.' — untranslated" },
+    { "en": "Open up to the book, Matthew.",                 "seen": "spa: 'Abre al libro, Matthew.' — untranslated" },
+    { "en": "Turn with me to John chapter 3.",               "seen": "spa: 'Vuelva conmigo a Juan capítulo 3.' — correct" },
+    { "en": "Today we are going to talk about Peter in the Bible.", "seen": "spa: '...de Pedro en la Biblia.' — correct" },
+    { "en": "Paul wrote to the church at Corinth." },
+    { "en": "Peter denied him three times." },
+    { "en": "James, the brother of Jesus, wrote this letter." },
+    { "en": "Mark tells us the same story." },
+    { "en": "Luke was a physician." },
+    { "en": "We are reading from Habakkuk chapter 2." }
+  ],
+
+  "homonym_traps": [
+    { "en": "I finally got the job I wanted.",         "expect": { "mustNotBecome": "Job (the book)" } },
+    { "en": "He did a mark on the paper.",             "expect": { "mustNotBecome": "Mark (the apostle)" } },
+    { "en": "She will call him tomorrow.",             "expect": { "mustNotBecome": "a proper noun" } },
+    { "en": "That was an act of kindness.",            "expect": { "mustNotBecome": "Acts" } },
+    { "en": "The romans built roads.",                 "expect": { "note": "lowercase 'romans' — people, not the epistle" } },
+    { "en": "Give me a hope and a future.",            "expect": { "mustNotBecome": "a book title" } },
+    { "en": "My son Mark is here today.",              "expect": { "note": "a real person named Mark, not the evangelist — a name lexicon must not 'fix' this" } },
+    { "en": "Amen was not his name.",                  "expect": { "note": "'Amen' inside a sentence must NOT hit the liturgical phrasebook" } }
+  ],
+
+  "long_form": [
+    { "en": "And God said, let there be light, and there was light." },
+    { "en": "For God so loved the world that he gave his only begotten Son, that whoever believes in him should not perish but have everlasting life." },
+    { "en": "The Lord is my shepherd; I shall not want." },
+    { "en": "Blessed are the poor in spirit, for theirs is the kingdom of heaven." }
+  ]
+}

app/capture-worklet.js

@@ -0,0 +1,121 @@
+/*
+ * capture-worklet.js — pulls audio off the graph in fixed frames.
+ *
+ * Runs on the audio thread, so it does the least possible work: pick the
+ * channels that carry a microphone, average them, fill a frame, hand it over.
+ * All judgement about what is speech happens on the main thread where it
+ * cannot cause a dropout.
+ */
+
+/* An empty pick means "mix everything", which is right for a two-channel
+   console feed. A specific set is right for Dante or SoundGrid, where the
+   device presents 64 channels and the voice is on one or two of them — mixing
+   those would bury the speaker under 62 silent channels and make a perfectly
+   good feed look like silence. */
+function normalize(list) {
+  if (!Array.isArray(list)) return null;
+  const out = [];
+  for (const v of list) {
+    const n = Number(v);
+    if (Number.isInteger(n) && n >= 0 && out.indexOf(n) === -1) out.push(n);
+  }
+  return out.length ? out.sort((a, b) => a - b) : null;
+}
+
+/* Per-channel levels, posted about ten times a second. They are what makes a
+   64-channel device usable at all: without them, choosing the right channel is
+   guesswork against a list of identical names, and the only feedback is
+   whether the whole app appears broken. With them you watch for the one that
+   moves when someone talks. */
+const LEVEL_MS = 100;
+
+class CaptureProcessor extends AudioWorkletProcessor {
+  constructor(options) {
+    super();
+    const opts = (options && options.processorOptions) || {};
+    this._buf = new Float32Array(opts.frameSize || 1024);
+    this._n = 0;
+    this._pick = normalize(opts.channels);
+    this._reported = -1;
+
+    this._sumSq = null;      // per-channel accumulator for the level meters
+    this._sumN = 0;
+    this._lastLevel = 0;
+
+    /* Changing channel used to mean tearing the capture graph down and
+       building it again, which is not something to do mid-service. A message
+       is, so the picker now works while translation is running. */
+    this.port.onmessage = (e) => {
+      const d = e.data;
+      if (d && d.t === 'channels') this._pick = normalize(d.channels);
+    };
+  }
+
+  process(inputs) {
+    const input = inputs[0];
+    if (!input || input.length === 0) return true;
+
+    const chans = input.length;
+    const len = input[0].length;
+
+    /* Tell the main thread how many channels actually arrived, once. */
+    if (this._reported !== chans) {
+      this._reported = chans;
+      this._sumSq = new Float32Array(chans);
+      this._sumN = 0;
+      this.port.postMessage({ channels: chans });
+    }
+
+    /*
+     * Resolve the pick ONCE per render quantum, not once per sample. A channel
+     * index that no longer exists (the device changed underneath us) falls back
+     * to mixing rather than reading past the end of the array.
+     */
+    let picks = null;
+    if (this._pick) {
+      picks = [];
+      for (let k = 0; k < this._pick.length; k++) {
+        if (this._pick[k] < chans) picks.push(this._pick[k]);
+      }
+      if (!picks.length) picks = null;
+    }
+    const np = picks ? picks.length : chans;
+
+    for (let i = 0; i < len; i++) {
+      let sum = 0;
+      if (picks) for (let k = 0; k < np; k++) sum += input[picks[k]][i];
+      else       for (let c = 0; c < chans; c++) sum += input[c][i];
+      this._buf[this._n++] = sum / np;
+
+      if (this._n === this._buf.length) {
+        this.port.postMessage(this._buf.slice(0));
+        this._n = 0;
+      }
+    }
+
+    /* Levels for EVERY channel, including the ones not selected — the whole
+       point is to find the one that is moving. */
+    if (this._sumSq && this._sumSq.length === chans) {
+      for (let c = 0; c < chans; c++) {
+        const ch = input[c];
+        let s = 0;
+        for (let i = 0; i < len; i++) s += ch[i] * ch[i];
+        this._sumSq[c] += s;
+      }
+      this._sumN += len;
+
+      const now = currentTime * 1000;
+      if (now - this._lastLevel >= LEVEL_MS && this._sumN > 0) {
+        this._lastLevel = now;
+        const rms = new Float32Array(chans);
+        for (let c = 0; c < chans; c++) rms[c] = Math.sqrt(this._sumSq[c] / this._sumN);
+        this.port.postMessage({ levels: rms });
+        this._sumSq.fill(0);
+        this._sumN = 0;
+      }
+    }
+    return true;
+  }
+}
+
+registerProcessor('capture', CaptureProcessor);

app/engine.css

@@ -0,0 +1,702 @@
+/*
+ * engine.css — the backstage app.
+ *
+ * Nobody wants to look at this during a service. It exists to answer three
+ * questions fast: is it hearing audio, is it connected to the church server,
+ * and are the words right.
+ */
+
+/*
+ * Make the `hidden` attribute actually hide things.
+ *
+ * The browser's own [hidden] rule is `display: none`, but it lives in the user-
+ * agent stylesheet, so any author rule that sets `display` — every .warn,
+ * .toast and flex row below — silently outranks it. The element stays on
+ * screen with hidden="true" and the JavaScript looks like it isn't running.
+ * That is how the operator console ended up permanently insisting the Mac
+ * engine was disconnected while it was sitting there working.
+ */
+[hidden] { display: none !important; }
+
+:root {
+  --bg: #0b0d12; --surface: #151922; --raised: #1d2331; --line: #2a3244;
+  --text: #eef1f6; --muted: #8b93a7; --accent: #6ea8fe;
+  --go: #2fbf71; --stop: #e5484d; --warn: #f5a524;
+}
+
+* { box-sizing: border-box; }
+
+body {
+  margin: 0; background: var(--bg); color: var(--text);
+  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", system-ui, sans-serif;
+  font-size: 14px;
+}
+
+h1 { font-size: 1.5rem; margin: 0 0 .375rem; font-weight: 700; }
+h2 { font-size: .9375rem; margin: 0 0 .25rem; font-weight: 650; }
+p  { margin: 0 0 .75rem; line-height: 1.5; }
+code { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: .75rem;
+       background: var(--raised); padding: .0625rem .3125rem; border-radius: 4px; }
+hr { border: 0; border-top: 1px solid var(--line); margin: 1.25rem 0; }
+
+.muted { color: var(--muted); font-size: .8125rem; }
+.hint  { color: var(--muted); font-size: .75rem; line-height: 1.5; margin: .375rem 0 0; }
+
+/* ---- header ---- */
+.head {
+  position: sticky; top: 0; z-index: 5;
+  display: flex; align-items: center; justify-content: space-between;
+  padding: .75rem 1.25rem; background: rgba(11,13,18,.92);
+  backdrop-filter: blur(10px); border-bottom: 1px solid var(--line);
+  -webkit-app-region: drag;
+}
+.brand { display: flex; align-items: center; gap: .5rem; font-size: .875rem; padding-left: 4.5rem; }
+.brand b { font-weight: 700; }
+.mark { width: .625rem; height: .625rem; border-radius: 3px; background: var(--accent); }
+.head-right { display: flex; align-items: center; gap: .4375rem; -webkit-app-region: no-drag; }
+.pip { width: .5rem; height: .5rem; border-radius: 50%; background: var(--muted); }
+.pip.ok { background: var(--go); }
+.pip.bad { background: var(--stop); }
+.pip-label { font-size: .75rem; color: var(--muted); }
+
+.build {
+  font-size: .6875rem; color: var(--muted); font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+  border: 1px solid var(--line); border-radius: 999px; padding: .0625rem .4375rem; margin-left: .125rem;
+}
+
+/* ---- page ----
+   Hero across the top, settings in a column of the same width they have always
+   had, and the congregation card parked in a rail on the right where it stays
+   put while the settings scroll under it. Narrow windows fold back to one
+   column and the rail returns to the top of the flow, where it is still the
+   first thing you need. */
+.page {
+  max-width: 72rem; margin: 0 auto; padding: 1.25rem 1.25rem 3rem;
+  display: grid; gap: 0 1rem; justify-content: center;
+  grid-template-columns: minmax(0, 44rem) minmax(17rem, 21rem);
+  align-items: start;
+}
+.page > .hero { grid-column: 1 / -1; }
+.col-main { grid-column: 1; min-width: 0; }
+.col-rail { grid-column: 2; position: sticky; top: 4rem; min-width: 0; }
+/*
+ * One column. The order is deliberate and it is NOT source order: the hero
+ * stays first — it is the button you came to press — then the congregation
+ * card, then the settings. `order: -1` on the rail alone put the QR ABOVE the
+ * hero, which is the one arrangement that is wrong.
+ */
+@media (max-width: 68rem) {
+  .page { grid-template-columns: minmax(0, 44rem); }
+  .col-main, .col-rail { grid-column: 1; }
+  .page > .hero { order: 1; }
+  .col-rail { position: static; order: 2; }
+  .col-main { order: 3; }
+}
+
+.card {
+  background: var(--surface); border: 1px solid var(--line);
+  border-radius: 14px; padding: 1.125rem; margin-bottom: .875rem;
+}
+
+/* ---- collapsible groups ---- */
+.group {
+  background: var(--surface); border: 1px solid var(--line);
+  border-radius: 14px; margin-bottom: .875rem; overflow: hidden;
+}
+.group-head {
+  display: flex; align-items: center; gap: .625rem; width: 100%;
+  appearance: none; background: transparent; border: 0; color: var(--text);
+  padding: 1rem 1.125rem; cursor: pointer; text-align: left; font: inherit;
+  transition: background .16s ease;
+}
+.group-head:hover { background: var(--raised); }
+.group-head h2 { margin: 0; }
+/* Clipped by CSS, not by slicing the string — slicing cut mid-word and left
+   things like "Dante Virtual Soundcard (Vir" with the bracket hanging open. */
+.group-sub {
+  margin-left: auto; font-size: .75rem; color: var(--muted);
+  max-width: 55%; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+}
+.chev {
+  width: .5rem; height: .5rem; flex: none;
+  border-right: 2px solid var(--muted); border-bottom: 2px solid var(--muted);
+  transform: rotate(-45deg); transition: transform .32s cubic-bezier(.2,.7,.3,1);
+}
+.group[data-open="true"] .chev { transform: rotate(45deg); }
+
+/*
+ * 0fr -> 1fr, not a pixel height: the content of these sections changes size
+ * after they open (a 105-row language list, a live meter, a QR that loads),
+ * and any measured max-height would be wrong the moment it did.
+ */
+.group-body {
+  display: grid; grid-template-rows: 0fr;
+  transition: grid-template-rows .34s cubic-bezier(.2,.7,.3,1), opacity .22s ease;
+  opacity: 0;
+}
+.group[data-open="true"] .group-body { grid-template-rows: 1fr; opacity: 1; }
+.group-body > .group-inner { overflow: hidden; min-height: 0; padding: 0 1.125rem; }
+.group[data-open="true"] > .group-body > .group-inner { padding-bottom: 1.125rem; }
+@media (prefers-reduced-motion: reduce) {
+  .group-body { transition: none; }
+  .chev { transition: none; }
+}
+
+.subhead2 { margin: 1rem 0 .25rem; font-size: .75rem; color: var(--muted); font-weight: 650; }
+
+/* ---- right rail ---- */
+.rail-card .qr { display: block; margin: 0 auto .625rem; }
+/* The rail is a third of the width the settings column has, and an operator
+   URL does not fit in it. Let it wrap rather than clip — a truncated address
+   is worse than a two-line one. */
+.rail-card .codeblock { flex-wrap: wrap; }
+.rail-card .codeblock code {
+  flex: 1 1 100%; min-width: 0; overflow-wrap: anywhere; white-space: normal;
+}
+.rail-card .codeblock .btn { margin-left: auto; }
+.railbtns { display: grid; gap: .375rem; margin-top: .625rem; }
+.railwide { width: 100%; margin-top: .375rem; }
+
+/* ---- output routing matrix ----
+   One row per language, one button per physical channel. The grid is the whole
+   point: you should be able to see at a glance that nothing is doubled up and
+   nothing is unrouted. */
+/* Sized for 64 channels as readily as for 2: the rows scroll rather than the
+   page, and the buttons shrink a step once there are more than sixteen so a
+   64-wide row still fits without becoming a horizontal scroll hunt. */
+.outmap { display: grid; gap: .375rem; margin-top: .5rem; max-height: 22rem; overflow-y: auto; }
+.outrow { display: flex; align-items: flex-start; gap: .5rem; }
+.outrow > b {
+  flex: none; width: 9.5rem; padding-top: .25rem;
+  font-size: .8125rem; font-weight: 600;
+  overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+}
+.outchans { display: flex; flex-wrap: wrap; gap: .1875rem; flex: 1; min-width: 0; }
+.outch {
+  appearance: none; cursor: pointer; font: inherit; font-size: .75rem;
+  min-width: 1.875rem; padding: .1875rem .375rem;
+  background: var(--raised); border: 1px solid var(--line); color: var(--muted);
+  border-radius: 6px; font-variant-numeric: tabular-nums;
+  transition: border-color .14s ease, background .14s ease, color .14s ease;
+}
+.outmap.many .outch { min-width: 1.5rem; padding: .125rem .1875rem; font-size: .6875rem; }
+
+/* Adjacent selected channels fuse into one pill, so a stereo pair reads as a
+   pair rather than as two numbers that happen to be lit. This is the "link"
+   made visible — the shape says they belong together. */
+.outch.on:has(+ .outch.on) { border-top-right-radius: 0; border-bottom-right-radius: 0; }
+.outch.on + .outch.on {
+  border-top-left-radius: 0; border-bottom-left-radius: 0;
+  margin-left: -.1875rem; border-left-color: rgba(110,168,254,.35);
+}
+.outmap.many .outch.on + .outch.on { margin-left: -.1875rem; }
+
+.outtag {
+  flex: none; width: 8rem; padding-top: .25rem; text-align: right;
+  font-size: .6875rem; color: var(--muted); font-variant-numeric: tabular-nums;
+}
+.outrow.none .outtag { opacity: .6; }
+
+.outtrim { flex: none; width: 5.5rem; margin: 0; accent-color: var(--accent); }
+.outtrim:disabled { opacity: .3; }
+.outdb {
+  flex: none; width: 3.25rem; padding-top: .25rem; text-align: right;
+  font-size: .6875rem; color: var(--muted); font-variant-numeric: tabular-nums;
+}
+.outch:hover { border-color: var(--muted); }
+.outch.on { border-color: var(--accent); background: rgba(110,168,254,.16); color: var(--text); }
+.outrow.none > b { color: var(--muted); font-weight: 500; }
+
+/* ---- channel picker ----
+   A grid of numbered buttons, each with its own live level. Finding the
+   speaker on a 64-channel Dante device is a matter of watching for the bar
+   that moves, so the meter is the point and the number is the label. */
+.chanbox { margin: .75rem 0; }
+.chanhead { display: flex; align-items: center; gap: .5rem; margin-bottom: .375rem; }
+.chanhead .btn { margin-left: auto; }
+.chanlist {
+  display: grid; gap: .3125rem;
+  grid-template-columns: repeat(auto-fill, minmax(4.5rem, 1fr));
+  max-height: 13rem; overflow-y: auto; padding: .125rem;
+}
+.chanrow {
+  display: flex; align-items: center; gap: .375rem;
+  appearance: none; cursor: pointer; font: inherit;
+  background: var(--raised); border: 1px solid var(--line); color: var(--muted);
+  border-radius: 7px; padding: .3125rem .4375rem;
+  transition: border-color .16s ease, background .16s ease, color .16s ease;
+}
+.chanrow:hover { border-color: var(--muted); }
+.chanrow b { font-size: .75rem; min-width: 1.25rem; text-align: right; font-variant-numeric: tabular-nums; }
+.chanrow.on { border-color: var(--accent); color: var(--text); background: rgba(110,168,254,.12); }
+.chanbar { flex: 1; height: .375rem; border-radius: 999px; background: var(--bg); overflow: hidden; }
+.chanbar-fill {
+  display: block; height: 100%; width: 0; border-radius: 999px;
+  background: var(--muted); transition: width .08s linear;
+}
+.chanbar-fill.hot { background: var(--go); }
+.chanrow.on .chanbar-fill { background: var(--accent); }
+.chanrow.on .chanbar-fill.hot { background: var(--go); }
+
+/* ---- hero ---- */
+.hero {
+  background: var(--surface); border: 1px solid var(--line);
+  border-radius: 14px; padding: 1.75rem; margin-bottom: .875rem; text-align: center;
+}
+.hero[data-state="live"]    { border-color: var(--go);   background: linear-gradient(180deg, rgba(47,191,113,.10), var(--surface)); }
+.hero[data-state="ready"]   { border-color: #2c4a7a; }
+.hero[data-state="loading"] { border-color: var(--accent); }
+.hero[data-state="error"]   { border-color: var(--stop); background: linear-gradient(180deg, rgba(229,72,77,.10), var(--surface)); }
+
+.hero-icon { width: 2.75rem; height: 2.75rem; margin: 0 auto .75rem; border-radius: 50%; background: var(--raised); position: relative; }
+.hero[data-state="live"] .hero-icon { background: var(--go); animation: pulse 2s ease-in-out infinite; }
+.hero[data-state="loading"] .hero-icon { background: var(--accent); animation: pulse 1.4s ease-in-out infinite; }
+.hero[data-state="error"] .hero-icon { background: var(--stop); }
+/* A voice falling back to built-in is amber, on the hero, in a sentence — the
+   one place whoever is standing at the Mac is actually looking. */
+.voice-warn { margin: .5rem 0 0; padding: .5rem .75rem; border-radius: 8px; font-size: .8125rem;
+              color: #fbbf24; background: rgba(251,191,36,.10); border: 1px solid rgba(251,191,36,.35); }
+@keyframes pulse { 0%,100% { transform: scale(1); opacity: 1; } 50% { transform: scale(.86); opacity: .55; } }
+
+.hero p { color: var(--muted); font-size: .875rem; max-width: 30rem; margin-left: auto; margin-right: auto; }
+
+.bar { height: .4375rem; background: var(--raised); border-radius: 999px; overflow: hidden; margin: .875rem auto .5rem; max-width: 24rem; }
+.bar-fill { height: 100%; width: 0; background: var(--accent); border-radius: 999px; transition: width .25s ease; }
+.prog-note { font-size: .75rem; color: var(--muted); font-family: ui-monospace, Menlo, monospace; }
+
+/* ---- controls ---- */
+label { display: block; font-size: .75rem; color: var(--muted); margin: .875rem 0 .375rem;
+        text-transform: uppercase; letter-spacing: .07em; font-weight: 600; }
+label:first-of-type { margin-top: 0; }
+
+input, select {
+  width: 100%; padding: .625rem .75rem;
+  background: var(--raised); color: var(--text);
+  border: 1px solid var(--line); border-radius: 9px;
+  font: inherit; font-size: .875rem; outline: none;
+}
+input:focus, select:focus { border-color: var(--accent); }
+input[type=range] { padding: 0; background: transparent; border: 0; accent-color: var(--accent); }
+
+.row { display: flex; gap: .5rem; align-items: center; margin-top: .5rem; flex-wrap: wrap; }
+.row select, .row input { flex: 1; min-width: 10rem; }
+.row .btn { flex: none; }
+
+.btn {
+  appearance: none; border: 1px solid var(--line); background: var(--raised); color: var(--text);
+  padding: .5625rem 1rem; border-radius: 9px; font: inherit; font-size: .875rem;
+  font-weight: 550; cursor: pointer;
+}
+.btn:hover { background: #262d3d; }
+.btn-primary { background: var(--accent); border-color: var(--accent); color: #08101f; font-weight: 650; }
+.btn:disabled { opacity: .5; cursor: not-allowed; }
+
+/* ---- level meter ---- */
+.meter-row { display: flex; align-items: center; gap: .75rem; margin-top: .875rem; }
+.meter {
+  position: relative; flex: 1; height: .875rem;
+  background: var(--raised); border-radius: 5px; overflow: hidden;
+}
+.meter-fill { height: 100%; width: 0; background: var(--muted); border-radius: 5px; transition: width .06s linear, background .15s ease; }
+.meter-fill.speech { background: var(--go); }
+.meter-fill.hot { background: var(--warn); }
+.meter-fill.clip { background: var(--stop); }
+.meter-thresh { position: absolute; top: 0; bottom: 0; width: 2px; background: var(--text); opacity: .65; left: 0; transition: left .2s ease; }
+.meter-label { font-family: ui-monospace, Menlo, monospace; font-size: .75rem; color: var(--muted); width: 5.5rem; text-align: right; }
+/* The gate control sits under the meter it moves, and lines its readout up
+   with the meter's own so the two numbers can be compared at a glance. */
+.threshrow { display: flex; align-items: center; gap: .75rem; margin-top: .5rem; }
+.threshrow .oprow { flex: 1 1 auto; }
+.threshrow .outtrim { flex: none; }
+
+/* ---- monitor ---- */
+.monitor {
+  background: var(--raised); border-radius: 10px; padding: .875rem;
+  height: 9rem; overflow-y: auto; font-size: .875rem; line-height: 1.55;
+  display: flex; flex-direction: column; gap: .5rem;
+}
+.mon-empty { color: var(--muted); font-size: .8125rem; margin: auto; }
+.mon-line { color: var(--text); }
+.mon-line.partial { color: var(--muted); font-style: italic; }
+.mon-line small { display: block; color: var(--muted); font-size: .6875rem; margin-top: .1875rem; }
+/* English, then what each language was actually told. The operator reads this
+   to verify the service, so the two must be visually distinct but adjacent. */
+.mon-line + .mon-line { margin-top: .625rem; }
+.mon-en { color: var(--text); }
+.mon-tr { margin: .1875rem 0 0 .875rem; font-size: .8125rem; color: var(--muted);
+          display: flex; gap: .5rem; align-items: baseline; }
+.mon-tr b { flex: none; font-size: .625rem; font-weight: 700; letter-spacing: .03em;
+            text-transform: uppercase; color: var(--accent); opacity: .85; }
+.mon-tr.dropped .mon-tr-text { color: var(--warn); font-style: italic; }
+.mon-wait { margin: .1875rem 0 0 .875rem; font-size: .75rem; color: var(--muted); opacity: .5; font-style: italic; }
+
+/* ---- details ---- */
+.details summary { cursor: pointer; list-style: none; display: flex; align-items: center; gap: .5rem; }
+.details summary::-webkit-details-marker { display: none; }
+.details summary::before { content: "▸"; color: var(--muted); font-size: .75rem; }
+.details[open] summary::before { content: "▾"; }
+.details summary h2 { margin: 0; }
+
+/* ---- log ---- */
+.log {
+  background: var(--raised); border-radius: 10px; padding: .75rem;
+  height: 8rem; overflow-y: auto;
+  font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: .6875rem; line-height: 1.6;
+  color: var(--muted); white-space: pre-wrap; word-break: break-word;
+}
+.log .err { color: var(--stop); }
+.log .ok  { color: var(--go); }
+/* The guard trimming an invented clause is not an error and not a success —
+   it is the model being caught. Amber so a run of them is visible at a glance,
+   because a spike is the only signal that the guard has started misfiring. */
+.log .warn { color: #d8a23a; }
+
+/* ---- the address the congregation uses ---- */
+.sharerow { display: flex; gap: 1.25rem; flex-wrap: wrap; align-items: flex-start; margin-top: .875rem; }
+.qr { width: 9.5rem; height: 9.5rem; background: #fff; border-radius: 10px; padding: .4375rem; flex: none; }
+.shareside { flex: 1; min-width: 15rem; }
+
+.addrlist { display: flex; flex-direction: column; gap: .375rem; margin-bottom: .875rem; }
+.addr {
+  display: flex; align-items: baseline; gap: .625rem;
+  background: var(--raised); border: 1px solid var(--line);
+  border-radius: 9px; padding: .5625rem .75rem;
+}
+.addr b {
+  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+  font-size: .9375rem; font-weight: 500; color: var(--text); word-break: break-all;
+}
+.addr span { font-size: .6875rem; color: var(--muted); text-transform: uppercase; letter-spacing: .06em; flex: none; }
+.addrlist:empty::before { content: "No network connection"; color: var(--muted); font-size: .8125rem; }
+.addr { cursor: pointer; width: 100%; text-align: left; font: inherit; transition: border-color .15s ease; }
+.addr:hover { border-color: var(--accent); }
+.addr.is-chosen { border-color: var(--accent); }
+.addr.is-chosen span { color: var(--accent); }
+
+/* ---- who is listening right now ---- */
+.listenbox {
+  display: flex; align-items: baseline; flex-wrap: wrap; gap: .5rem .75rem;
+  background: var(--raised); border: 1px solid var(--line);
+  border-radius: 10px; padding: .75rem .9375rem; margin-bottom: .875rem;
+}
+.listenbox[hidden] { display: none; }
+.listenbox > b { font-size: 1.5rem; font-weight: 700; font-variant-numeric: tabular-nums; line-height: 1; }
+.listenbox > span { font-size: .8125rem; color: var(--muted); }
+.listenbreak { display: flex; flex-wrap: wrap; gap: .375rem; width: 100%; }
+.listenbreak span {
+  font-size: .75rem; color: var(--text);
+  background: var(--line); border-radius: 999px; padding: .1875rem .5625rem;
+}
+.listenbreak b { font-variant-numeric: tabular-nums; }
+
+/* Which devices are connected — so a forgotten tab can be found. */
+.listenwho { display: flex; flex-direction: column; gap: .25rem; width: 100%; margin-top: .5rem; }
+.listenwho:empty { display: none; }
+.wholine {
+  display: flex; align-items: baseline; gap: .5rem; flex-wrap: wrap;
+  font-size: .75rem; padding: .3125rem 0;
+  border-top: 1px solid var(--line);
+}
+.wholine b { font-weight: 600; color: var(--text); }
+.wholine span { color: var(--muted); font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: .6875rem; }
+
+/* ---- Setup / Operator, in one window ---- */
+
+/* Panes cross-fade rather than jumping, so switching mode reads as the same
+   window changing rather than a new screen appearing. */
+/* Both panes are now one continuous settings page. The entrance animation is
+   kept on the first only — running it on both produced a visible two-stage
+   fade with a seam between them. */
+.mode-pane { animation: none; }
+#setupPane { animation: paneIn .26s cubic-bezier(.2,.7,.3,1) both; }
+.mode-pane[hidden] { display: none; }
+@keyframes paneIn {
+  from { opacity: 0; transform: translateY(.5rem); }
+  to   { opacity: 1; transform: none; }
+}
+@media (prefers-reduced-motion: reduce) { .mode-pane { animation: none; } }
+
+/* The hero becomes the control in operator mode. */
+.hero-go {
+  appearance: none; border: 0; cursor: pointer;
+  width: 100%; margin-top: 1.125rem; padding: 1.125rem;
+  border-radius: 12px; font: inherit; font-size: 1.375rem; font-weight: 750;
+  letter-spacing: .02em;
+  background: var(--go); color: #052e18;
+  transition: background .18s ease, transform .08s ease, opacity .18s ease;
+  animation: paneIn .26s cubic-bezier(.2,.7,.3,1) both;
+}
+.hero-go[hidden] { display: none; }
+.hero-go:active { transform: scale(.99); }
+.hero-go[data-live="true"] { background: var(--stop); color: #fff; }
+.hero-go:disabled { background: var(--raised); color: var(--muted); cursor: not-allowed; }
+
+.stats { display: grid; grid-template-columns: repeat(3,1fr); gap: .5rem; margin-top: 1rem;
+         animation: paneIn .3s cubic-bezier(.2,.7,.3,1) both; }
+.stats[hidden] { display: none; }
+.stat { background: var(--raised); border-radius: 10px; padding: .625rem; }
+.stat b { display: block; font-size: 1.25rem; font-weight: 700; font-variant-numeric: tabular-nums; }
+.stat span { font-size: .6875rem; color: var(--muted); }
+
+/* The cough button. Amber, not red — red is "stopped", and this is the opposite
+   of stopped: everything is still running, it just is not going out. */
+.hold-btn {
+  display: block; width: 100%; max-width: 22rem; margin: .5rem auto 0;
+  padding: .5rem; font-weight: 600; letter-spacing: .02em;
+}
+.hold-btn[data-held="true"] {
+  border-color: var(--warn); background: rgba(245,165,36,.18); color: var(--warn);
+}
+.holdbar {
+  margin: .625rem auto 0; max-width: 34rem; padding: .5rem .75rem; border-radius: 7px;
+  border: 1px solid var(--warn); background: rgba(245,165,36,.14);
+  font-size: .8125rem; line-height: 1.45;
+  animation: holdPulse 1.6s ease-in-out infinite;
+}
+.holdbar b { color: var(--warn); letter-spacing: .04em; }
+@keyframes holdPulse { 0%,100% { opacity: 1; } 50% { opacity: .68; } }
+@media (prefers-reduced-motion: reduce) { .holdbar { animation: none; } }
+
+.subhead { margin: 1rem 0 .375rem; font-size: .8125rem; color: var(--muted);
+           text-transform: uppercase; letter-spacing: .06em; }
+
+/* The QR is printed and handed out. When the address behind it moves, or when
+   it is pointing at a network no phone is on, that has to be impossible to
+   miss — it looks fine either way, and the failure only shows up in the room. */
+.qrwarn {
+  margin: 0 0 .625rem; padding: .5rem .6875rem; border-radius: 7px;
+  border: 1px solid var(--warn); background: rgba(245,165,36,.12);
+  color: var(--text); font-size: .8125rem; line-height: 1.45;
+}
+.qrwarn b { color: var(--warn); }
+
+.chips { display: flex; flex-wrap: wrap; gap: .375rem; margin: .625rem 0; min-height: 1.75rem; }
+.chips:empty::before { content: "None"; color: var(--muted); font-size: .8125rem; }
+.chip {
+  display: inline-flex; align-items: center; gap: .375rem;
+  background: var(--raised); border: 1px solid var(--line);
+  border-radius: 999px; padding: .25rem .4375rem .25rem .6875rem; font-size: .8125rem;
+}
+.chip button { appearance: none; border: 0; background: transparent; color: var(--muted);
+               cursor: pointer; font-size: 1rem; line-height: 1; padding: 0 .1875rem; }
+.vtag.warn { color: var(--warn); }
+
+.chip button:hover { color: var(--stop); }
+
+/* Pinning and unpinning used to be instantaneous, which on a page this long
+   reads as a chip appearing from nowhere. Same treatment as the language
+   columns: grow in, shrink out, and fly from the search result you picked. */
+@keyframes chipIn  { from { transform: scale(.86); opacity: 0; } to { transform: scale(1); opacity: 1; } }
+@keyframes chipOut { from { transform: scale(1); opacity: 1; max-width: 18rem; }
+                     to   { transform: scale(.82); opacity: 0; max-width: 0;
+                            padding-left: 0; padding-right: 0; margin-left: -.375rem; } }
+.chip.chip-in  { animation: chipIn .2s cubic-bezier(.2,.7,.3,1) both; }
+.chip.chip-out { animation: chipOut .19s ease-in both; overflow: hidden; white-space: nowrap;
+                 pointer-events: none; }
+.chip.is-landing { visibility: hidden; }
+.chipfly {
+  position: fixed; z-index: 60; pointer-events: none; margin: 0;
+  box-shadow: 0 8px 24px rgba(0,0,0,.45);
+  will-change: transform, opacity;
+}
+.chipfly button { display: none; }
+@media (prefers-reduced-motion: reduce) {
+  .chipfly { display: none; }
+  .chip.chip-in, .chip.chip-out { animation: none; }
+}
+
+.opresults { display: grid; gap: .1875rem; margin-top: .375rem; max-height: 11rem; overflow-y: auto; }
+.opresults:empty { display: none; }
+.opresults button {
+  appearance: none; text-align: left; width: 100%; font: inherit; font-size: .8125rem;
+  background: var(--raised); border: 1px solid transparent; color: var(--text);
+  border-radius: 8px; padding: .4375rem .625rem; cursor: pointer;
+}
+.opresults button:hover { border-color: var(--accent); }
+.opresults button span { color: var(--muted); margin-left: .4375rem; font-size: .75rem; }
+
+.codeblock { display: flex; align-items: center; gap: .5rem; background: var(--raised);
+             border: 1px solid var(--line); border-radius: 9px; padding: .5rem .625rem; }
+.codeblock code { flex: 1; overflow-x: auto; white-space: nowrap; font-size: .75rem; color: #cbd5e6;
+                  font-family: ui-monospace, SFMono-Regular, Menlo, monospace; }
+.codeblock + .codeblock { margin-top: .375rem; }
+.urlname { flex: 0 0 3.5rem; font-size: .75rem; font-weight: 600; color: var(--dim); }
+h2.mt { margin-top: 1.5rem; }
+textarea { width: 100%; padding: .625rem .75rem; background: var(--raised); color: var(--text);
+           border: 1px solid var(--line); border-radius: 9px; font-family: ui-monospace, Menlo, monospace;
+           font-size: .8125rem; line-height: 1.6; resize: vertical; outline: none; }
+textarea:focus { border-color: var(--accent); }
+
+/* The volunteer's traffic light: one sentence, colored by severity. */
+.op-health { margin: .375rem 0 0; font-size: .8125rem; font-weight: 600; }
+.op-health[data-level="green"] { color: #4ade80; }
+.op-health[data-level="amber"] { color: #fbbf24; }
+.op-health[data-level="red"]   { color: #f87171; }
+
+/* The voice auditioning list: one row per candidate, play and choose. */
+.voicelist { display: flex; flex-direction: column; gap: .25rem; margin-top: .5rem;
+             max-height: 19rem; overflow-y: auto; }
+.vrow { display: flex; align-items: center; gap: .5rem; padding: .375rem .5rem;
+        background: var(--raised); border: 1px solid var(--line); border-radius: 8px; }
+.vrow.is-current { border-color: var(--accent); }
+.vrow .vname { flex: 1; font-size: .8125rem; }
+.vrow .vtag { font-size: .6875rem; color: var(--dim); }
+.vrow .vmsg { font-size: .6875rem; color: #fbbf24; max-width: 14rem; }
+.vrow .vmsg.bad { color: #f87171; }
+.vrow button { flex: 0 0 auto; }
+/*
+ * "Offer this voice to listeners".
+ *
+ * Subject to exactly the two traps documented for .oprow below — `label` is
+ * styled as a small-caps field caption and bare `input` is width:100% — so it
+ * has to undo both, or the word "Offer" arrives shouting in letter-spaced caps
+ * next to a checkbox ten rems wide.
+ */
+.vrow .voffer {
+  display: flex; align-items: center; gap: .3rem;
+  flex: 0 0 auto; margin: 0;
+  text-transform: none; letter-spacing: normal; font-weight: 400;
+  font-size: .6875rem; color: var(--dim);
+  cursor: pointer; user-select: none;
+}
+.vrow .voffer input[type="checkbox"] { width: auto; min-width: 0; flex: 0 0 auto; margin: 0; }
+.vrow .voffer:has(input:checked) { color: var(--accent); }
+
+/*
+ * Checkbox rows on the operator page.
+ *
+ * These are <label> elements, and this stylesheet styles `label` as a small-caps
+ * FIELD CAPTION (uppercase, letter-spaced, muted) — correct for "API KEY", wrong
+ * for a sentence you click. It also styles bare `input` at width:100%, and
+ * `.row input` at min-width:10rem, so an unqualified checkbox rendered ten rems
+ * wide and shoved the language name off the side of the card. Both have to be
+ * undone explicitly here; verified in the browser, not assumed.
+ */
+.oprow, .langrow {
+  text-transform: none;
+  letter-spacing: normal;
+  font-weight: 400;
+  color: var(--text);
+  margin: 0;
+}
+.oprow {
+  display: flex;
+  align-items: center;
+  gap: .5rem;
+  margin: .625rem 0 .125rem;
+  font-size: .8125rem;
+  cursor: pointer;
+  user-select: none;
+  flex: 0 0 auto;
+}
+/* Beat `input, select { width: 100% }` and `.row input { flex: 1; min-width: 10rem }`. */
+.oprow input[type="checkbox"],
+.langrow input[type="checkbox"],
+.row .oprow input[type="checkbox"] {
+  width: auto;
+  min-width: 0;
+  flex: 0 0 auto;
+  padding: 0;
+  margin: 0;
+  cursor: pointer;
+}
+
+/* The language on/off list. 104 rows, so it scrolls inside its own box rather
+   than pushing the rest of the operator page down a screen and a half. */
+.langlist {
+  margin-top: .5rem;
+  max-height: 22rem;
+  overflow-y: auto;
+  overflow-x: hidden;
+  border: 1px solid var(--line);
+  border-radius: 9px;
+  background: var(--bg);
+}
+.langrow {
+  display: flex;
+  align-items: center;
+  gap: .5rem;
+  padding: .375rem .625rem;
+  font-size: .8125rem;
+  cursor: pointer;
+  border-bottom: 1px solid rgba(42, 50, 68, .5);
+  min-width: 0;
+}
+.langrow:last-child { border-bottom: 0; }
+.langrow:hover { background: var(--raised); }
+
+/* The native name is what the listener sees, so it leads. It shrinks and
+   ellipsises rather than forcing the row wider than the card. */
+.lname {
+  flex: 0 1 9rem;
+  min-width: 0;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+.lsub {
+  flex: 1 1 auto;
+  min-width: 0;
+  color: var(--muted);
+  font-size: .75rem;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+/* Whether a language can be SPOKEN is the thing being tuned — it earns a spot
+   on every row instead of a separate list to cross-reference. */
+.ltag { flex: 0 0 auto; font-size: .6875rem; color: var(--go); white-space: nowrap; }
+.langrow.novoice .ltag { color: var(--muted); }
+.langrow.novoice .lname { color: #c3cad9; }
+
+/* ── the language columns ─────────────────────────────────────────────────
+   On the left, off on the right. Both scroll independently, and both must
+   contain their scroll: with only a few languages on, the left column is not
+   scrollable at all, so a trackpad flick over it would chain to the page while
+   the identical box beside it trapped — two panes that look the same behaving
+   oppositely. */
+.langcols { display: grid; grid-template-columns: 1fr 1fr; gap: .5rem; margin-top: .5rem; }
+.langcol {
+  display: flex; flex-direction: column; min-width: 0;
+  border: 1px solid var(--line); border-radius: 9px; background: var(--bg);
+}
+.langcolhead {
+  display: flex; align-items: baseline; gap: .375rem;
+  padding: .4375rem .625rem; border-bottom: 1px solid var(--line);
+  font-size: .6875rem; text-transform: uppercase; letter-spacing: .07em;
+  color: var(--muted); font-weight: 600;
+}
+.langcolhead b { color: var(--text); font-weight: 600; }
+.langcols .langlist {
+  margin-top: 0; border: 0; border-radius: 0; background: transparent;
+  max-height: 20rem; overscroll-behavior: contain;
+}
+/* Two columns halve the row width, and the first casualties were exactly the
+   languages this church distinguishes — "Spanish (Latin Am…", "Português
+   (Portu…". The native name is what the LISTENER sees; the operator is looking
+   for the English name, so the native name yields its space here and stays
+   available on hover. */
+.langcols .lsub { display: none; }
+.langcols .lname { flex: 1 1 auto; }
+
+/* The flying row. position:fixed on <body>, so no ancestor overflow can clip it
+   — which is the whole reason it exists. Animating the real row instead meant
+   the row was clipped by its own column for the entire part of the flight that
+   crosses the gap, and the list is rebuilt every 3 seconds by the server tick,
+   which would destroy a real-node animation mid-air. A clone notices neither. */
+.langfly {
+  position: fixed; z-index: 60; pointer-events: none; margin: 0;
+  border-radius: 7px; border: 1px solid var(--accent);
+  background: var(--raised); box-shadow: 0 8px 24px rgba(0,0,0,.45);
+  will-change: transform, opacity;
+}
+.langfly .ltag, .langfly input { display: none; }
+.langrow.is-landing { visibility: hidden; }
+/* A short accent sweep on the row under the cursor, so the click is confirmed
+   even if the eye never follows the clone. */
+@keyframes rowTouched { from { background: rgba(110,168,254,.22); } to { background: transparent; } }
+.langrow.touched { animation: rowTouched .45s ease-out both; }
+@media (prefers-reduced-motion: reduce) {
+  .langfly { display: none; }
+  .langrow.touched { animation: none; }
+}

app/index.html

@@ -0,0 +1,436 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="color-scheme" content="dark">
+<!--
+  Model weights come from Hugging Face on first run. The congregation server is
+  this app's own child process on another localhost port, which is why img-src
+  admits 127.0.0.1 — that is where the QR code is rendered. Everything
+  executable stays 'self' plus what the wasm ONNX Runtime needs.
+
+  media-src carries data:/blob: because voice previews are synthesized inside
+  this app and handed straight to an <audio> element. NOTE: the policy below is
+  a plain directive list — CSP has no comment syntax, and a /* */ comment placed
+  inside it silently swallows the next directive (that is exactly how media-src
+  went missing once, and every voice preview failed with "no supported source").
+-->
+<meta http-equiv="Content-Security-Policy" content="
+  default-src 'self';
+  script-src 'self' 'wasm-unsafe-eval' blob:;
+  worker-src 'self' blob:;
+  connect-src 'self' https: ws: wss: data: blob: http://127.0.0.1:*;
+  img-src 'self' data: blob: http://127.0.0.1:*;
+  media-src 'self' data: blob: http://127.0.0.1:*;
+  style-src 'self' 'unsafe-inline';
+  font-src 'self' data:;
+">
+<title>Church Translate</title>
+<link rel="stylesheet" href="./engine.css">
+</head>
+<body>
+
+<header class="head">
+  <div class="brand">
+    <span class="mark"></span>
+    <span>Church&nbsp;Translate</span>
+    <span class="build" id="buildTag" title="Version and build number">—</span>
+  </div>
+  <div class="head-right">
+    <span id="srvDot" class="pip" title="Church server"></span>
+    <span id="srvText" class="pip-label">Not connected</span>
+  </div>
+</header>
+
+<main class="page">
+
+  <!-- Always first, always full width. Nothing above it, nothing beside it. -->
+  <section class="hero" id="hero" data-state="setup">
+    <div class="hero-icon" id="heroIcon"></div>
+    <h1 id="heroTitle">Getting ready…</h1>
+    <p id="heroBody">Checking your setup.</p>
+    <button class="hero-go" id="heroGo" hidden></button>
+    <button class="btn hold-btn" id="heroHold" hidden></button>
+    <p class="holdbar" id="holdBar" hidden>
+      <b>ON HOLD</b> — translation is running and you can see every word, but
+      nothing is reaching the congregation.</p>
+    <p class="op-health" id="opHealth" hidden></p>
+    <p class="voice-warn" id="voiceWarn" hidden></p>
+    <div class="stats" id="opStats" hidden>
+      <div class="stat"><b id="stListeners">0</b><span>listening</span></div>
+      <div class="stat"><b id="stLangs">0</b><span>languages</span></div>
+      <div class="stat"><b id="stElapsed">—</b><span>elapsed</span></div>
+    </div>
+    <div class="listenwho" id="opWho"></div>
+    <div class="bar" id="progWrap" hidden><div class="bar-fill" id="progFill"></div></div>
+    <p class="prog-note" id="progNote" hidden></p>
+    <button class="btn btn-primary" id="heroBtn" hidden></button>
+  </section>
+
+  <!-- ============================ centre column ============================ -->
+  <div class="col-main">
+
+    <!-- 1. Input ---------------------------------------------------------- -->
+    <section class="group" id="grpInput" data-open="true">
+      <button class="group-head" type="button" aria-expanded="true" aria-controls="grpInputBody">
+        <span class="chev" aria-hidden="true"></span>
+        <h2>Input</h2>
+        <span class="group-sub" id="inputSummary"></span>
+      </button>
+      <div class="group-body" id="grpInputBody">
+        <div class="group-inner">
+
+          <label for="device">Input device</label>
+          <div class="row">
+            <select id="device"></select>
+            <button class="btn" id="refreshDevices" title="Rescan inputs">Rescan</button>
+          </div>
+
+          <div class="chanbox" id="channelBox" hidden>
+            <div class="chanhead">
+              <label style="margin:0">Channels</label>
+              <span class="hint" id="chanNote" style="margin:0"></span>
+              <button class="btn" id="chanMixAll" type="button">Mix all</button>
+            </div>
+            <div class="chanlist" id="chanList"></div>
+            <p class="hint">Pick the channel the speaker is on — watch for the bar that moves.
+              Pick more than one only if two people talk on separate channels.</p>
+            <p class="qrwarn" id="chanTruth" hidden></p>
+          </div>
+
+          <div class="meter-row">
+            <div class="meter"><div class="meter-fill" id="meterFill"></div>
+              <div class="meter-thresh" id="meterThresh"></div>
+            </div>
+            <span class="meter-label" id="meterLabel">—</span>
+          </div>
+          <p class="hint" id="audioHint">Green = speech. Voice should cross the notch; room noise should not.</p>
+
+          <div class="threshrow">
+            <label class="oprow" style="margin:0">
+              <input type="checkbox" id="threshManual">
+              <span>Set the notch myself</span>
+            </label>
+            <input type="range" class="outtrim" id="threshSlider" min="-60" max="-20" step="1" disabled>
+            <span class="outdb" id="threshDb">auto</span>
+          </div>
+          <p class="hint" id="threshHint">Following the room: the notch sits above whatever the input
+            is hearing when nobody is talking. Right on a console or Dante feed. On a preamp with
+            real hiss it can settle above a quiet talker, and the mic goes dead while the bar still
+            moves — set it by hand and put the notch just above the room, under the voice.</p>
+
+          <h3 class="subhead">What it is hearing</h3>
+          <div class="monitor" id="monitor"><div class="mon-empty">Nothing yet.</div></div>
+
+        </div>
+      </div>
+    </section>
+
+    <!-- 1b. Output routing -------------------------------------------------- -->
+    <section class="group" id="grpOut">
+      <button class="group-head" type="button" aria-expanded="false" aria-controls="grpOutBody">
+        <span class="chev" aria-hidden="true"></span>
+        <h2>Output routing</h2>
+        <span class="group-sub" id="outSummary"></span>
+      </button>
+      <div class="group-body" id="grpOutBody">
+        <div class="group-inner">
+          <p class="hint">Send each language's voice to its own physical channels — English on
+            1+2, Spanish on 3, and so on — into Dante, Waves SoundGrid, a console over USB,
+            anything the Mac can play to. Phones keep working exactly as they do now; this is
+            an extra output, not a replacement.</p>
+
+          <label for="outDevice">Output device</label>
+          <div class="row">
+            <select id="outDevice"></select>
+            <button class="btn" id="outRefresh" title="Rescan outputs">Rescan</button>
+          </div>
+          <p class="hint" id="outState"></p>
+
+          <div id="outMapBox" hidden>
+            <label style="margin-top:.75rem">Channels</label>
+            <p class="hint">Click a number to send that language there. Two channels side by
+              side join into a stereo pair — the voice is mono, so both carry the same signal,
+              which is what fills a stereo pair on a console. A language with nothing selected is
+              not sent to hardware at all.</p>
+            <p class="hint">The source language carries the <b>live room microphone</b>, not a
+              translation — there is nothing to translate English into during an English service.
+              Give it channels and it feeds an assistive-listening transmitter. Keep those
+              channels off whatever feeds the app's input, or you will build a loop.</p>
+            <div id="outMap" class="outmap"></div>
+          </div>
+        </div>
+      </div>
+    </section>
+
+    <!-- 2. Languages and voices ------------------------------------------- -->
+    <section class="group" id="grpLang">
+      <button class="group-head" type="button" aria-expanded="false" aria-controls="grpLangBody">
+        <span class="chev" aria-hidden="true"></span>
+        <h2>Languages and voices</h2>
+        <span class="group-sub" id="langSummary"></span>
+      </button>
+      <div class="group-body" id="grpLangBody">
+        <div class="group-inner">
+
+          <h3 class="subhead">Languages on the front page</h3>
+          <p class="hint" id="opLangCount"></p>
+          <div class="row">
+            <input id="opLangFilter" type="search" placeholder="Filter languages…" autocomplete="off">
+            <label class="oprow"><input type="checkbox" id="opLangVoiceOnly"><span>With a voice only</span></label>
+            <button class="btn" id="opLangNone">Turn all off</button>
+          </div>
+          <div class="langcols">
+            <div class="langcol">
+              <div class="langcolhead">On <b id="opLangNOn">0</b></div>
+              <div id="opLangOn" class="langlist" role="group" aria-label="Languages on the front page"></div>
+            </div>
+            <div class="langcol">
+              <div class="langcolhead">Off <b id="opLangNOff">0</b></div>
+              <div id="opLangOff" class="langlist" role="group" aria-label="Languages not on the front page"></div>
+            </div>
+          </div>
+          <label class="oprow">
+            <input type="checkbox" id="opAllowAll">
+            <span>Let listeners pick any language</span>
+          </label>
+          <p class="hint" id="opAllowAllHint"></p>
+
+          <h3 class="subhead">Always translate</h3>
+          <p class="hint">Pinned languages are translated before anyone arrives.</p>
+          <div id="opPinned" class="chips"></div>
+          <input id="opPinSearch" type="search" placeholder="Pin a language…" autocomplete="off">
+          <div id="opPinResults" class="opresults"></div>
+
+          <hr>
+
+          <h3 class="subhead">Corrections</h3>
+          <p class="hint">One per line: <code>what it heard =&gt; what it should say</code></p>
+          <textarea id="opFixes" rows="8" spellcheck="false"></textarea>
+          <div class="row">
+            <button class="btn" id="opSaveFixes">Save corrections</button>
+            <span class="hint" id="opFixHint"></span>
+          </div>
+
+          <hr>
+
+          <h3 class="subhead">Voices</h3>
+          <p class="hint">Pick a language, press ▶ to hear a voice read scripture, then Use it.
+            Built-in voices download the first time you play them.</p>
+          <div class="row">
+            <select id="voiceLang"></select>
+            <span class="hint" id="voiceNow"></span>
+          </div>
+          <p class="hint" id="voiceCoverage"></p>
+
+          <label for="voiceInstruct" style="margin-top:.5rem">Delivery direction <span class="hint" style="display:inline">— local voices only</span></label>
+          <div class="row">
+            <input id="voiceInstruct" type="text" autocomplete="off" spellcheck="false"
+                   placeholder="e.g. whisper this softly and intimately, breathy">
+            <button class="btn" id="voiceInstructClear">Clear</button>
+          </div>
+          <p class="hint">Plain English, told to the voice before it speaks. Only the
+            <b>Local (this Mac)</b> voices listen to it — Piper built-ins have no such control and
+            will ignore it. It changes <b>delivery</b>, not volume: measured, "whisper this softly
+            and intimately" stretched the same Spanish line from 4.0s to 6.2s. Wording is not
+            predictable — "speak loudly and forcefully" came out <i>quieter</i> than plain — so try
+            a few and judge by ear. Press ▶ on a voice below to hear it with this direction.</p>
+
+          <div id="voiceList" class="voicelist"></div>
+
+          <hr>
+
+          <h3 class="subhead">Premium voices</h3>
+          <div class="row">
+            <select id="cloudProvider" style="max-width:11rem">
+              <option value="off">Off — built-in voices</option>
+              <option value="kokoro">Kokoro (this Mac — free, fast)</option>
+              <option value="local">Qwen3 (this Mac — free, expressive)</option>
+              <option value="fish">fish.audio</option>
+              <option value="google">Google Cloud TTS</option>
+            </select>
+            <span class="hint" id="cloudState"></span>
+          </div>
+          <div id="cloudFields" hidden>
+            <label for="cloudKey">API key</label>
+            <input id="cloudKey" type="password" autocomplete="off" spellcheck="false">
+            <label for="cloudVoice">Voice</label>
+            <input id="cloudVoice" type="text" autocomplete="off" spellcheck="false"
+                   placeholder="fish: default reference id · leave empty for Google">
+            <label for="cloudPerLang">Per-language voices (one per line: code = voice id)</label>
+            <textarea id="cloudPerLang" rows="4" spellcheck="false"
+              placeholder="spa_Latn = es-US-Chirp3-HD-Charon&#10;kor_Hang = ko-KR-Chirp3-HD-Charon"></textarea>
+            <div class="row">
+              <button class="btn" id="cloudSave">Save</button>
+              <button class="btn" id="cloudTest">Test</button>
+              <span class="hint" id="cloudHint"></span>
+            </div>
+          </div>
+          <p class="hint">Human-sounding voices from a paid service. Keys stay on this Mac.
+            If the service ever fails, the built-in voices take over automatically.</p>
+
+          <hr>
+
+          <h3 class="subhead">Voice dynamics</h3>
+          <label class="oprow">
+            <input type="checkbox" id="optDynamics">
+            <span>Follow the speaker's loudness</span>
+          </label>
+          <p class="hint">The translated voice gets quieter when the preacher drops to a whisper
+            and louder when he leans on a line. Applies to built-in and premium voices alike.</p>
+          <p class="hint"><b>Compressed on purpose.</b> The room spans about 40&nbsp;dB between a
+            whisper and a shout; reproduced faithfully into headphones or a hearing-aid pack the
+            whisper is inaudible and the shout is painful. This keeps the shape and holds the
+            range to about 14&nbsp;dB. Level only — the voice cannot actually whisper.</p>
+
+        </div>
+      </div>
+    </section>
+
+    <!-- 3. Settings -------------------------------------------------------- -->
+    <section class="group" id="grpSettings">
+      <button class="group-head" type="button" aria-expanded="false" aria-controls="grpSettingsBody">
+        <span class="chev" aria-hidden="true"></span>
+        <h2>Settings</h2>
+        <span class="group-sub" id="settingsSummary"></span>
+      </button>
+      <div class="group-body" id="grpSettingsBody">
+        <div class="group-inner">
+
+          <h3 class="subhead">Stream delay</h3>
+          <div class="row">
+            <input id="opDelay" type="number" min="0" max="120" step="1" style="max-width:6rem">
+            <span class="hint" style="margin:0">seconds</span>
+            <button class="btn" id="opSaveDelay">Set</button>
+            <span class="hint" id="opDelayHint"></span>
+          </div>
+          <p class="hint">For livestream viewers: hold captions and audio so they line up
+            with the stream's own delay. The room always sees live. 0 = off.</p>
+
+          <hr>
+
+          <h3 class="subhead">Bitfocus Companion</h3>
+          <div class="codeblock"><span class="urlname">Start</span><code id="opStartUrl">—</code><button class="btn" data-copy="opStartUrl">Copy</button></div>
+          <div class="codeblock"><span class="urlname">Stop</span><code id="opStopUrl">—</code><button class="btn" data-copy="opStopUrl">Copy</button></div>
+          <div class="codeblock"><span class="urlname">Toggle</span><code id="opToggleUrl">—</code><button class="btn" data-copy="opToggleUrl">Copy</button></div>
+
+          <h4 class="subhead2">Cough button</h4>
+          <p class="hint">Keeps translating and keeps you watching it — the congregation just
+            stops receiving. For a prayer request with a name in it, or anything said on a live
+            mic that was not meant to leave the room. Starting a service always clears it.</p>
+          <div class="codeblock"><span class="urlname">Hold</span><code id="opHoldUrl">—</code><button class="btn" data-copy="opHoldUrl">Copy</button></div>
+          <div class="codeblock"><span class="urlname">Resume</span><code id="opResumeUrl">—</code><button class="btn" data-copy="opResumeUrl">Copy</button></div>
+          <div class="codeblock"><span class="urlname">Hold toggle</span><code id="opHoldToggleUrl">—</code><button class="btn" data-copy="opHoldToggleUrl">Copy</button></div>
+
+          <h4 class="subhead2">Stream delay</h4>
+          <p class="hint">Nudge while watching the stream until the captions line up. Change
+            <code>by=</code> for a bigger step — one button at 1s for fine work, another at 5s.</p>
+          <div class="codeblock"><span class="urlname">+1 second</span><code id="opDelayUpUrl">—</code><button class="btn" data-copy="opDelayUpUrl">Copy</button></div>
+          <div class="codeblock"><span class="urlname">−1 second</span><code id="opDelayDownUrl">—</code><button class="btn" data-copy="opDelayDownUrl">Copy</button></div>
+          <div class="codeblock"><span class="urlname">Off</span><code id="opDelayOffUrl">—</code><button class="btn" data-copy="opDelayOffUrl">Copy</button></div>
+
+          <h4 class="subhead2">For button text and colour</h4>
+          <div class="codeblock"><span class="urlname">Status</span><code id="opStatusUrl">—</code><button class="btn" data-copy="opStatusUrl">Copy</button></div>
+          <div class="codeblock"><span class="urlname">Hold state</span><code id="opHoldStateUrl">—</code><button class="btn" data-copy="opHoldStateUrl">Copy</button></div>
+          <div class="codeblock"><span class="urlname">Delay now</span><code id="opDelayStateUrl">—</code><button class="btn" data-copy="opDelayStateUrl">Copy</button></div>
+          <p class="hint">Generic HTTP → GET. One word each: Status is <code>live</code>,
+            <code>ready</code> or <code>offline</code> (a held service still reads
+            <code>live</code> — it is live), Hold state is <code>held</code> or <code>open</code>,
+            Delay now is a number of seconds. Keep the key off the projector.</p>
+          <p class="hint">Set a Companion URL below and the server pushes
+            <code>translate_state</code>, <code>_hold</code>, <code>_delay</code> and
+            <code>_listeners</code> straight into custom variables — no polling.</p>
+
+          <hr>
+
+          <h3 class="subhead">Operator page PIN</h3>
+          <div class="row">
+            <input id="opPin" type="text" inputmode="numeric" autocomplete="off" spellcheck="false">
+            <button class="btn" id="opSavePin">Change</button>
+            <span class="hint" id="opPinHint"></span>
+          </div>
+          <p class="hint">For running the desk from a phone or tablet <b>on the church
+            network</b>. This tab never asks for it. The operator page is refused outright to
+            anything reaching the server from the internet — there is no setting to change that,
+            so the PIN only ever faces someone already in the building.</p>
+
+          <hr>
+
+          <h3 class="subhead">Advanced</h3>
+          <label for="port">Port</label>
+          <input id="port" type="number" min="1024" max="65535">
+          <p class="hint">Only if something else already uses it.</p>
+          <div class="row">
+            <button class="btn" id="savePort">Save &amp; restart server</button>
+            <span class="hint" id="portHint"></span>
+          </div>
+
+          <hr>
+
+          <h3 class="subhead">Another campus</h3>
+          <p class="hint">Carries the work: corrections, languages, pinned languages, voices,
+            output channel map and trims. Does <b>not</b> carry this Mac's PIN, control token or
+            device ids — each campus keeps its own, and premium-voice API keys stay on the machine
+            they were typed into.</p>
+          <div class="row">
+            <button class="btn" id="setExport">Save settings to a file</button>
+            <button class="btn" id="setImport">Load settings from a file</button>
+          </div>
+          <p class="hint" id="setHint"></p>
+
+          <hr>
+
+          <label style="margin-top:.75rem">Models</label>
+          <p class="hint" id="modelInfo">—</p>
+          <div class="row">
+            <button class="btn" id="revealCache">Show model folder</button>
+            <span class="hint" id="cacheSize"></span>
+          </div>
+
+        </div>
+      </div>
+    </section>
+
+    <section class="card">
+      <h2>Log</h2>
+      <div class="log" id="log"></div>
+    </section>
+
+  </div><!-- /col-main -->
+
+  <!-- ============================= right rail ============================= -->
+  <aside class="col-rail">
+    <section class="card rail-card">
+      <h2>What the congregation opens</h2>
+
+      <p class="qrwarn" id="qrWarn" hidden></p>
+
+      <img id="qr" class="qr" alt="QR code to the translation page">
+      <div id="addrList" class="addrlist"></div>
+      <div class="railbtns">
+        <button class="btn btn-primary" id="copyAddr">Copy address</button>
+        <button class="btn" id="openPoster">Printable poster</button>
+      </div>
+
+      <h3 class="subhead">Operator page</h3>
+      <p class="hint">Run the desk from a phone or tablet. Needs the PIN.</p>
+      <div class="codeblock"><code id="opPageUrl">—</code><button class="btn" data-copy="opPageUrl">Copy</button></div>
+      <button class="btn railwide" id="openOperator">Open operator page</button>
+    </section>
+  </aside>
+
+</main>
+
+<script src="./server/public/languages.js"></script>
+<script src="./pt-variants.js"></script>
+<script src="./voice-catalog.js"></script>
+<script src="./out-routing.js"></script>
+<script src="./mt-guard.js"></script>
+<script src="./liturgy.js"></script>
+<script src="./short-questions.js"></script>
+<script src="./preach.js"></script>
+<script src="./spa-variants.js"></script>
+<script src="./bible-lexicon.js"></script>
+<script type="module" src="./engine.js"></script>
+</body>
+</html>

app/kokoro-sidecar.js

@@ -0,0 +1,231 @@
+/*
+ * kokoro-sidecar.js — the natural voices, without Python.
+ *
+ * WHY THIS EXISTS. On macOS the natural voices come from `mlx_audio.server`, a
+ * Python sidecar that runs Kokoro on MLX. MLX is Apple-Silicon-only, so on
+ * Windows that process cannot exist at all — and the built-in Piper voices are
+ * a quality drop the church rejected by name.
+ *
+ * So this serves the SAME HTTP API on the SAME port using the ONNX runtime the
+ * app already ships. Everything upstream — sidecarWanted(), the warm-up, the
+ * readiness handshake, the circuit breaker, the per-language voice choices —
+ * is untouched, because from tts-service.js's point of view nothing changed.
+ *
+ * MEASURED against the live MLX sidecar, same text and voice:
+ *   duration ratio  1.0000, 1.0000, 1.0000  (identical audio length)
+ *   rms ratio       1.476 / 1.471 / 1.457   -> this build is ~3.3 dB HOTTER
+ *   phonemes        byte-identical to misaki's EspeakG2P
+ * The gain below cancels that level difference so a Windows campus and a Mac
+ * campus sound the same. Duration being exactly equal is what matters most:
+ * the HLS window pins a language's clips to one rate and length, and a
+ * different duration would change the stream's pacing.
+ *
+ * dtype MUST be fp32. fp16 returns 100% NaN on the CPU execution provider —
+ * silent audio with a flattering speed number — and q8 changes clip length.
+ */
+'use strict';
+const http = require('http');
+const fs = require('fs');
+const path = require('path');
+
+const PORT = Number(process.argv[2] || process.env.CT_KOKORO_PORT || 43111);
+const MODEL_ID = 'onnx-community/Kokoro-82M-v1.0-ONNX';
+const RATE = 24000;
+
+/* Cancels the level difference against MLX (measured 1.457-1.476, mean 1.468). */
+const MLX_MATCH_GAIN = 1 / 1.468;
+
+/* The app speaks Kokoro's single-letter codes; espeak-ng wants its own names. */
+const ESPEAK_VOICE = {
+  a: 'en-us', b: 'en-gb', e: 'es', p: 'pt-br', f: 'fr-fr',
+  i: 'it', h: 'hi', j: 'ja', z: 'cmn'
+};
+
+function log(msg) { process.stdout.write('[kokoro] ' + msg + '\n'); }
+
+/* ---------------------------------------------------------------- G2P
+ * A reimplementation of misaki.espeak.EspeakG2P — the exact preprocessing the
+ * Python side does — on top of the espeak-ng WASM build. Verified phoneme-for-
+ * phoneme identical to misaki across punctuation, «», numbers and Devanagari.
+ */
+const ZWJ = '‍';                       // espeak --ipa=3 tie character
+const PUNCT = ';:,.!?¡¿—…"«»“”()';
+const E2M = [
+  ['a^ɪ', 'I'], ['a^ʊ', 'W'], ['d^z', 'ʣ'], ['d^ʒ', 'ʤ'], ['e^ɪ', 'A'],
+  ['o^ʊ', 'O'], ['ə^ʊ', 'Q'], ['s^s', 'S'], ['t^s', 'ʦ'], ['t^ʃ', 'ʧ'], ['ɔ^ɪ', 'Y']
+];
+
+let ESpeakNg = null;
+async function espeakIPA(text, voice) {
+  if (!ESpeakNg) ESpeakNg = (await import('espeak-ng')).default;
+  const e = await ESpeakNg({ arguments: ['--phonout', 'out', '-q', '--ipa=3', '-v', voice, text] });
+  return e.FS.readFile('out', { encoding: 'utf8' });
+}
+
+async function g2p(text, espeakVoice) {
+  text = String(text).replace(/«/g, '“').replace(/»/g, '”').replace(/\(/g, '«').replace(/\)/g, '»');
+  const re = new RegExp('([' + PUNCT.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + '])');
+  let out = '';
+  for (const p of text.split(re)) {
+    if (!p) continue;
+    if (p.length === 1 && PUNCT.includes(p)) { out += p; continue; }
+    if (!p.trim()) { out += p; continue; }
+    out += p.match(/^\s*/)[0] + (await espeakIPA(p.trim(), espeakVoice)).trim() + p.match(/\s*$/)[0];
+  }
+  let ps = out.replaceAll(ZWJ, '^');
+  for (const [o, n] of E2M) ps = ps.replaceAll(o, n);
+  return ps.replaceAll('^', '').replaceAll('-', '')
+           .replace(/«/g, '(').replace(/»/g, ')').replace(/\s+/g, ' ').trim();
+}
+
+/* ------------------------------------------------------------- the model */
+let model = null, tokenizer = null, Tensor = null, loading = null;
+const styleCache = {};
+
+function voicesDir() {
+  const candidates = [
+    process.env.CT_KOKORO_VOICES,
+    path.join(__dirname, 'node_modules', 'kokoro-js', 'voices'),
+    path.join(__dirname, '..', 'node_modules', 'kokoro-js', 'voices')
+  ].filter(Boolean);
+  for (const c of candidates) { try { if (fs.existsSync(c)) return c; } catch (_) {} }
+  throw new Error('voice style vectors not found');
+}
+
+/*
+ * One 256-float style vector per voice, chosen by TOKEN COUNT — Kokoro stores
+ * 510 of them per voice and picks by length, which is how it varies delivery
+ * with sentence length. Same indexing as the reference implementation.
+ */
+function styleFor(voice, nTokens) {
+  if (!styleCache[voice]) {
+    const buf = fs.readFileSync(path.join(voicesDir(), voice + '.bin'));
+    styleCache[voice] = new Float32Array(buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.length));
+  }
+  const off = 256 * Math.min(Math.max(nTokens - 2, 0), 509);
+  return styleCache[voice].slice(off, off + 256);
+}
+
+async function ensureModel() {
+  if (model) return;
+  if (loading) return loading;
+  loading = (async () => {
+    const tf = await import('@huggingface/transformers');
+    Tensor = tf.Tensor;
+    tf.env.allowLocalModels = false;
+    if (process.env.CT_MODELS_DIR) tf.env.cacheDir = process.env.CT_MODELS_DIR;
+    const t0 = Date.now();
+    const [m, tk] = await Promise.all([
+      tf.StyleTextToSpeech2Model.from_pretrained(MODEL_ID, { dtype: 'fp32', device: 'cpu' }),
+      tf.AutoTokenizer.from_pretrained(MODEL_ID)
+    ]);
+    model = m; tokenizer = tk;
+    log('model ready in ' + ((Date.now() - t0) / 1000).toFixed(1) + 's');
+  })();
+  return loading;
+}
+
+/*
+ * ONE generation at a time.
+ *
+ * ONNX inference saturates the CPU, and the app fires several languages at
+ * once per sentence. Run concurrently they all slow down together and every
+ * one of them risks blowing its budget and falling back to a built-in voice —
+ * which is the voice-switching failure this whole engine exists to avoid. A
+ * queue makes the first clip fast and the rest predictable.
+ */
+let chain = Promise.resolve();
+function serialize(fn) {
+  const run = chain.then(fn, fn);
+  chain = run.then(() => {}, () => {});
+  return run;
+}
+
+function wavOf(float32) {
+  const n = float32.length, b = Buffer.alloc(44 + n * 2);
+  b.write('RIFF', 0); b.writeUInt32LE(36 + n * 2, 4); b.write('WAVE', 8); b.write('fmt ', 12);
+  b.writeUInt32LE(16, 16); b.writeUInt16LE(1, 20); b.writeUInt16LE(1, 22);
+  b.writeUInt32LE(RATE, 24); b.writeUInt32LE(RATE * 2, 28);
+  b.writeUInt16LE(2, 32); b.writeUInt16LE(16, 34);
+  b.write('data', 36); b.writeUInt32LE(n * 2, 40);
+  for (let i = 0; i < n; i++) {
+    let v = float32[i] * MLX_MATCH_GAIN;
+    v = v > 0.999 ? 0.999 : (v < -0.999 ? -0.999 : v);
+    b.writeInt16LE(Math.round(v * 32767), 44 + i * 2);
+  }
+  return b;
+}
+
+async function synth(voice, text, langCode, speed) {
+  await ensureModel();
+  const ev = ESPEAK_VOICE[langCode] || langCode || 'en-us';
+  const phonemes = await g2p(text, ev);
+  if (!phonemes) throw new Error('nothing to say');
+  const { input_ids } = await tokenizer(phonemes, { truncation: true });
+  const n = input_ids.dims.at(-1);
+  const out = await model({
+    input_ids,
+    style: new Tensor('float32', styleFor(voice, n), [1, 256]),
+    speed: new Tensor('float32', [Number(speed) || 1], [1])
+  });
+  return wavOf(out.waveform.data);
+}
+
+const server = http.createServer((req, res) => {
+  const url = (req.url || '').split('?')[0];
+
+  if (req.method === 'GET' && (url === '/healthz' || url === '/')) {
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: true, engine: 'kokoro-onnx', ready: !!model }));
+    return;
+  }
+  /* Same shape mlx_audio returns, so anything probing it sees what it expects. */
+  if (req.method === 'GET' && url === '/v1/models') {
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ object: 'list', data: [{ id: MODEL_ID, object: 'model', owned_by: 'system' }] }));
+    return;
+  }
+  if (req.method === 'POST' && url === '/v1/audio/speech') {
+    let body = '';
+    req.on('data', (d) => { body += d; if (body.length > 1 << 20) req.destroy(); });
+    req.on('end', () => {
+      let j;
+      try { j = JSON.parse(body); } catch (_) { res.writeHead(400).end('bad json'); return; }
+      const voice = String(j.voice || '');
+      const text = String(j.input || '');
+      const lang = String(j.lang_code || 'a');
+      if (!voice || !text) { res.writeHead(400).end('voice and input are required'); return; }
+      /*
+       * Only Kokoro lives here. A request for the Qwen3 expressive model (an
+       * operator picking a "Local" voice) is refused plainly rather than
+       * answered with the wrong voice — tts-service then falls back to the
+       * built-in voice for that language, which is the honest outcome on a
+       * platform where Qwen3/MLX cannot run.
+       */
+      if (j.model && String(j.model).indexOf('Kokoro') === -1) {
+        res.writeHead(501, { 'Content-Type': 'text/plain' });
+        res.end('this build serves Kokoro only');
+        return;
+      }
+      serialize(() => synth(voice, text, lang, j.speed))
+        .then((wav) => {
+          res.writeHead(200, { 'Content-Type': 'audio/wav', 'Content-Length': wav.length });
+          res.end(wav);
+        })
+        .catch((err) => {
+          log('synth failed (' + voice + '/' + lang + '): ' + err.message);
+          res.writeHead(500, { 'Content-Type': 'text/plain' });
+          res.end(String(err.message || err));
+        });
+    });
+    return;
+  }
+  res.writeHead(404).end('not found');
+});
+
+server.listen(PORT, '127.0.0.1', () => {
+  log('listening on 127.0.0.1:' + PORT + ' (Kokoro via ONNX, no Python)');
+  /* Load now rather than on the first sentence of the service. */
+  ensureModel().catch((e) => log('model load failed: ' + e.message));
+});
+server.on('error', (e) => { log('cannot listen on ' + PORT + ': ' + e.message); process.exit(1); });

app/liturgy.js

@@ -0,0 +1,118 @@
+/*
+ * liturgy.js — the handful of words that must never be guessed at.
+ *
+ * Measured against the shipped NLLB, the single most frequent word in a service
+ * translates as follows:
+ *
+ *   "Amen."  →  spa  "- Sí, estoy bien."     ("yes, I'm fine")
+ *               fra  "Je vous en prie."      ("you're welcome")
+ *               deu  "- Das ist doch gut."   ("well, that's good")
+ *               zho  "现在,我们要去."          ("now, we're going to go")
+ *               rus  "- Да, да."             ("yes, yes")
+ *
+ * Of ten languages tested, four were right. This is not a translation problem
+ * that better decoding fixes — one word carries no context for a context model
+ * to work from. So these bypass the model completely.
+ *
+ * SCOPE IS DELIBERATELY TINY. Only Hebrew LOANWORDS are here — amen, hallelujah,
+ * hosanna — words every tradition transliterated rather than translated, so
+ * there is one right answer and no denominational choice hiding in it.
+ * "Praise the Lord" and "Glory to God" are NOT here: they are translated
+ * phrases, and their wording differs between Protestant and Catholic editions
+ * of the same language. Guessing those would be the exact silent, confident
+ * error this file exists to prevent.
+ *
+ * Matching is WHOLE-UTTERANCE ONLY. "Amen" is a title of Christ in Revelation
+ * 3:14 and a deity in an Exodus sermon; "can I get an amen?" is a sentence.
+ * None of those may be touched, and equality matching means none of them are.
+ */
+(function (root, factory) {
+  if (typeof module === 'object' && module.exports) module.exports = factory();
+  else root.Liturgy = factory();
+}(typeof self !== 'undefined' ? self : this, function () {
+  'use strict';
+
+  /*
+   * Whisper writes these many ways: "Amen", "amen!", "A-men.", "Amen...".
+   *
+   * Hyphens are removed (A-men -> amen) but whitespace is COLLAPSED, not
+   * deleted. Deleting it turned "praise god" into "praisegod", which could
+   * never match a table key — so every multi-word entry would have been a
+   * silent no-op. Only single words are in the table today, so this was latent;
+   * fixing it now means a multi-word entry added later actually works.
+   */
+  function key(text) {
+    return String(text || '')
+      .toLowerCase()
+      .replace(/[‘’']/g, '')
+      .replace(/[-‐-―]+/g, '')        // A-men -> amen
+      .replace(/\s+/g, ' ')           // collapse, do NOT delete
+      .replace(/[.!?,;:…。！？]+$/g, '')
+      .trim();
+  }
+
+  /*
+   * Confidence is recorded per language, not assumed. HIGH = a form I can state
+   * without hedging. REVIEW = believed correct and worth a native speaker's
+   * glance before a service. A language absent from a table falls through to
+   * NLLB — no entry is better than a confident wrong one.
+   */
+  const REVIEW = { vie_Latn: 1, hin_Deva: 1, hat_Latn: 1, arb_Arab: 1, kor_Hang: 1, npi_Deva: 1 };
+
+  const AMEN = {
+    spa_Latn: 'Amén.',      por_Latn: 'Amém.',      por_PT: 'Amém.',
+    fra_Latn: 'Amen.',      deu_Latn: 'Amen.',      ita_Latn: 'Amen.',
+    nld_Latn: 'Amen.',      pol_Latn: 'Amen.',      ces_Latn: 'Amen.',
+    swe_Latn: 'Amen.',      dan_Latn: 'Amen.',      fin_Latn: 'Aamen.',
+    hun_Latn: 'Ámen.',      cat_Latn: 'Amén.',      ron_Latn: 'Amin.',
+    tur_Latn: 'Âmin.',      ell_Grek: 'Αμήν.',      rus_Cyrl: 'Аминь.',
+    ukr_Cyrl: 'Амінь.',     srp_Cyrl: 'Амин.',      swh_Latn: 'Amina.',
+    zho_Hans: '阿们。',      zho_Hant: '阿們。',      kor_Hang: '아멘.',
+    vie_Latn: 'A-men.',     hat_Latn: 'Amèn.',      arb_Arab: 'آمين.',
+    hin_Deva: 'आमीन।',      urd_Arab: 'آمین۔',      pes_Arab: 'آمین.'
+  };
+
+  const HALLELUJAH = {
+    spa_Latn: '¡Aleluya!',  por_Latn: 'Aleluia!',   por_PT: 'Aleluia!',
+    fra_Latn: 'Alléluia !', deu_Latn: 'Halleluja!', ita_Latn: 'Alleluia!',
+    nld_Latn: 'Halleluja!', pol_Latn: 'Alleluja!',  ces_Latn: 'Aleluja!',
+    swe_Latn: 'Halleluja!', dan_Latn: 'Halleluja!', fin_Latn: 'Halleluja!',
+    hun_Latn: 'Halleluja!', cat_Latn: 'Al·leluia!', ron_Latn: 'Aleluia!',
+    ell_Grek: 'Αλληλούια!', rus_Cyrl: 'Аллилуйя!',  ukr_Cyrl: 'Алілуя!',
+    srp_Cyrl: 'Алилуја!',   zho_Hans: '哈利路亚！',   zho_Hant: '哈利路亞！',
+    kor_Hang: '할렐루야!',   vie_Latn: 'Ha-lê-lu-gia!', hat_Latn: 'Alelouya!',
+    arb_Arab: 'هللويا!'
+  };
+
+  const HOSANNA = {
+    spa_Latn: '¡Hosanna!',  por_Latn: 'Hosana!',    por_PT: 'Hosana!',
+    fra_Latn: 'Hosanna !',  deu_Latn: 'Hosianna!',  ita_Latn: 'Osanna!',
+    nld_Latn: 'Hosanna!',   pol_Latn: 'Hosanna!',   rus_Cyrl: 'Осанна!',
+    ell_Grek: 'Ωσαννά!',    zho_Hans: '和散那！',    zho_Hant: '和散那！',
+    kor_Hang: '호산나!',     hat_Latn: 'Ozana!'
+  };
+
+  const PHRASES = {
+    amen: AMEN,
+    hallelujah: HALLELUJAH, halleluyah: HALLELUJAH, alleluia: HALLELUJAH,
+    hosanna: HOSANNA, hosana: HOSANNA
+  };
+
+  /* The whole utterance, or nothing. Returns null so callers fall through to
+     normal translation, which must stay the default path. */
+  /* A regional variant inherits its base language's forms. Without this a
+     Spain or Portugal listener falls through to NLLB for the single most
+     frequent utterance in the service. Canonical list: NLLB_ALIAS. */
+  const VARIANT_OF = { por_PT: 'por_Latn', spa_ES: 'spa_Latn', spa_MX: 'spa_Latn' };
+
+  function lookup(text, lang) {
+    const table = PHRASES[key(text)];
+    if (!table) return null;
+    return table[lang] || table[VARIANT_OF[lang]] || null;
+  }
+
+  function needsReview(lang) { return !!REVIEW[lang]; }
+  function phrases() { return Object.keys(PHRASES); }
+
+  return { lookup, key, needsReview, phrases, PHRASES };
+}));

app/model-worker.js

@@ -0,0 +1,88 @@
+/*
+ * model-worker.js — one model, one worker, one WASM heap.
+ *
+ * This file exists because of a hard limit: ONNX Runtime stages model weights
+ * through a 32-bit WASM heap capped at 4 GB, even when inference itself runs on
+ * the GPU. Whisper's fp16 encoder is 1.2 GB and NLLB is another 0.9 GB, and
+ * loading both into one heap fails — first as an opaque `Aborted()`, then, with
+ * smaller weights, as a load that simply never returns.
+ *
+ * A Web Worker gets its own ONNX Runtime instance and therefore its own heap.
+ * Two workers means two ceilings instead of one, so both models can run at the
+ * quality we actually want. Keeping inference off the main thread also stops
+ * the level meter from stuttering every time a sentence is decoded.
+ */
+
+import { pipeline, env } from './vendor/transformers.min.js';
+
+env.allowLocalModels = false;
+env.backends.onnx.wasm.wasmPaths = new URL('./vendor/', import.meta.url).href;
+env.backends.onnx.wasm.numThreads = 1;
+
+let pipe = null;
+let label = 'model';
+
+/* Report the adapter's features once. Whether this worker's WebGPU exposes
+   shader-f16 decides which weights we can use, and a bare "does not support
+   fp16" from deep inside ONNX is not much to debug with. */
+/*
+ * WebGPU when there is a real adapter, WASM when there is not.
+ *
+ * device:'webgpu' was hard-coded, which is safe on Apple Silicon where Metal
+ * is always there. On Windows Chromium disables WebGPU on blocklisted drivers,
+ * software adapters, old Intel iGPUs and over Remote Desktop — and with no
+ * fallback that is not "slower speech recognition", it is NO speech
+ * recognition, which is the whole app. WASM is several times slower but it
+ * runs; the choice is reported so the operator log says which one is in use.
+ */
+async function bestDevice() {
+  try {
+    if (!navigator.gpu) return 'wasm';
+    const adapter = await navigator.gpu.requestAdapter();
+    return adapter ? 'webgpu' : 'wasm';
+  } catch (_) { return 'wasm'; }
+}
+
+async function reportGpu() {
+  try {
+    if (!navigator.gpu) return 'no navigator.gpu';
+    const adapter = await navigator.gpu.requestAdapter();
+    if (!adapter) return 'no adapter';
+    return Array.from(adapter.features || []).join(',') || '(no optional features)';
+  } catch (e) {
+    return 'adapter error: ' + e.message;
+  }
+}
+
+self.onmessage = async (e) => {
+  const msg = e.data || {};
+
+  try {
+    if (msg.type === 'load') {
+      label = msg.label || msg.task;
+      self.postMessage({ type: 'gpu', label, features: await reportGpu() });
+      const device = await bestDevice();
+      pipe = await pipeline(msg.task, msg.model, {
+        device,
+        dtype: msg.dtype,
+        progress_callback: (p) => self.postMessage({ type: 'progress', label, p })
+      });
+      self.postMessage({ type: 'ready', label, device });
+      return;
+    }
+
+    if (msg.type === 'run') {
+      if (!pipe) throw new Error(label + ' is not loaded yet');
+      const out = await pipe(msg.input, msg.options || {});
+      self.postMessage({ type: 'result', id: msg.id, out });
+      return;
+    }
+  } catch (err) {
+    self.postMessage({
+      type: msg.type === 'load' ? 'loadError' : 'error',
+      id: msg.id,
+      label,
+      message: (err && err.message) || String(err)
+    });
+  }
+};

app/mt-guard.js

@@ -0,0 +1,269 @@
+/*
+ * mt-guard.js — catch what NLLB invents, before a congregation hears it.
+ *
+ * WHY THIS IS NOT A GENERATION-PARAMETER FIX. Measured against the shipped
+ * model (nllb-200-distilled-600M fp32), "Donald Trump." produces
+ * "Donald Trump. ¿Qué es eso?" under ALL of: default params, an input-derived
+ * max_new_tokens cap, no_repeat_ngram_size:3, and num_beams:2. The model
+ * genuinely believes that is the translation. Decoding cannot be tuned out of
+ * it; the output has to be checked.
+ *
+ * WHY THE OBVIOUS RULE IS WRONG. "Source has no '?', target has one, so strip
+ * the question" corrupts real output: Whisper routinely drops the question mark
+ * on a rhetorical aside, so "Are you with me" arrives unpunctuated and a
+ * correct Spanish rendering is "¿Estás conmigo?" — which that rule would
+ * delete. The reliable signal is not the question mark, it is the SENTENCE
+ * COUNT: one sentence in, two out, and the second one invented.
+ *
+ * WHY ONLY SHORT INPUTS. Hallucination is a short-input failure — the model has
+ * no context and fills the gap. Long sentences are also the ones that
+ * legitimately split in the target (many languages prefer shorter sentences
+ * than English), so clamping them would delete real scripture. The length gate
+ * keeps the clamp where the evidence is.
+ */
+(function (root, factory) {
+  if (typeof module === 'object' && module.exports) module.exports = factory();
+  else root.MtGuard = factory();
+}(typeof self !== 'undefined' ? self : this, function () {
+  'use strict';
+
+  /* Sentence-final punctuation across the scripts this app serves: Latin,
+     CJK ideographic stop, fullwidth marks, Arabic question mark, Devanagari
+     danda, Armenian, Greek, Thai has none. */
+  const TERMINATORS = '.!?。！？؟۔।॥…՜՞;';
+  const TERM_RE = new RegExp('[' + TERMINATORS.replace(/[.\-\]\\]/g, '\\$&') + ']');
+  const QUESTION_RE = /[?？؟՞]/;
+
+  /* Beyond this the input carries enough context that the model stops
+     inventing, and legitimate sentence-splitting starts. Measured failures all
+     sit far below it. */
+  /* Narrow deliberately. Every hallucination measured against this model sat
+     at one or two words; a wider gate starts reaching utterances that split
+     into two target sentences legitimately, and deleting real scripture is a
+     far worse failure than leaving one invented clause in. */
+  const SHORT_WORDS = 6;
+
+  function words(s) {
+    return String(s || '').trim().split(/\s+/).filter(Boolean).length;
+  }
+
+  /* Count sentences by terminator runs. "Mr. Smith went." must not read as two,
+     so a terminator followed by a lowercase letter does not end a sentence. */
+  function sentenceCount(s) {
+    const parts = splitSentences(s);
+    return parts.length || 1;
+  }
+
+  function splitSentences(s) {
+    const text = String(s || '').trim();
+    if (!text) return [];
+    const out = [];
+    let cur = '';
+    for (let i = 0; i < text.length; i++) {
+      const ch = text[i];
+      cur += ch;
+      if (!TERM_RE.test(ch)) continue;
+      /* Absorb a run of terminators and any closing quote/bracket. */
+      while (i + 1 < text.length && (TERM_RE.test(text[i + 1]) || /["'\)\]”’」』]/.test(text[i + 1]))) {
+        cur += text[++i];
+      }
+      const rest = text.slice(i + 1);
+      /* An abbreviation or a decimal: "Dr. Smith", "3.5" — not a boundary. */
+      if (/^\s*[a-zà-ÿ0-9]/.test(rest)) continue;
+      out.push(cur.trim());
+      cur = '';
+    }
+    if (cur.trim()) out.push(cur.trim());
+    return out;
+  }
+
+  /*
+   * NLLB was trained on a lot of subtitles and emits their dialogue dash. It is
+   * never correct here — nothing in this app is a screenplay.
+   */
+  function stripDash(s) {
+    return String(s || '').replace(/^\s*[-‐-―−]\s+/, '').trim();
+  }
+
+  /*
+   * The main entry. Returns { text, trimmed, reason } — `trimmed` is true when
+   * something was removed, so callers can log it and the operator can see how
+   * often the model is inventing.
+   */
+  /*
+   * A ONE-WORD source that comes back with a comma-clause. Measured across the
+   * archive, 13.4% of everything the preacher says is one or two words, and the
+   * model answers the short ones conversationally:
+   *
+   *   "Hello."  -> "Hola, ¿qué pasa?"     "Yeah."  -> "Sí, es cierto."
+   *   "No."     -> "No, no."              "Good."  -> "Bien, muy bien."
+   *   "Come."   -> "Ven, ven."            "Look."  -> "Mira, ¿qué?"
+   *
+   * One English word cannot mean two clauses, so the tail is invented. Keeping
+   * only the head fixes all of these and touches nothing that was already
+   * right ("La fe.", "Sin embargo.", "Por lo tanto." have no comma).
+   *
+   * Restricted to EXACTLY one word deliberately — at two words a comma can be
+   * legitimate. Handles the CJK and ideographic commas too, since this is the
+   * one output rule that needs no per-language knowledge.
+   */
+  function trimInventedClause(src, out) {
+    const words = String(src == null ? '' : src).replace(/[.!?,;:]+$/, '').split(/\s+/).filter(Boolean);
+    if (words.length !== 1) return out;
+    const m = String(out).match(/^([^,\uff0c\u3001]+)[,\uff0c\u3001]/u);
+    if (!m) return out;
+    const head = m[1].trim();
+    if (!head) return out;
+    const end = (String(src).match(/[.!?]$/) || [''])[0];
+    return /[.!?\u3002\uff01\uff1f]$/.test(head) ? head : head + end;
+  }
+
+  /*
+   * THE WHOLE OUTPUT IS AN INVENTED QUESTION.
+   *
+   * The sentence-count rule above catches an invented question APPENDED to a
+   * real translation ("Donald Trump. ¿Qué es eso?"). It cannot catch the case
+   * where the invention IS the output: one sentence in, one sentence out, and
+   * the one out is "¿Qué es eso?" for a source of "Mmm" or "them" — MEASURED
+   * in a live service, spoken aloud to the Spanish congregation three times in
+   * one morning, and produced by 34 distinct short sources in the archive.
+   *
+   * Narrow on purpose. Source: at most two words and not itself a question.
+   * Output: every sentence is a question. And the source must not be an
+   * English interrogative or a tag — "Why.", "Who.", "Right?", "You know." —
+   * because for those a Spanish question IS the correct rendering (measured:
+   * 'why.' -> '¿Por qué?', 'Isn't it.' -> '¿No es cierto?'). Whisper drops
+   * question marks routinely, so the word list, not the punctuation, is the
+   * exemption.
+   */
+  /*
+   * Widened with the auxiliaries and contractions that FRONT a real English
+   * question, because the rule below now reads every word of a short source
+   * rather than the single word it used to be limited to.
+   *
+   * MEASURED: without `could` and `you're`, widening the rule deleted
+   * 'Could it be' -> '¿Podría ser' and "You're interested in" -> '¿Te interesa?'
+   * — both correct renderings of questions Whisper handed over unpunctuated.
+   * With them the widened rule breaks NOTHING in 22,526 real short lines.
+   */
+  const INTERROGATIVE_SRC = /^(?:why|who|whom|whose|what|where|when|when'?s|how|which|isn'?t|right|okay|ok|see|really|huh|anybody|anyone|somebody|someone|guess|any|says|you|you'?re|we'?re|they'?re|there'?s|it'?s|are|am|is|was|were|do|does|did|can|could|will|would|shall|should|may|might|must|have|has|had|ready|let'?s)$/i;
+
+  function isQuestionSentence(p) {
+    const t = String(p || '').trim();
+    return /^[¿]/.test(t) || /[?？؟՞]["'\)\]”’」』]*$/.test(t);
+  }
+
+  function bareSource(src) {
+    return String(src || '').replace(/^[\s"'“‘(\[]+/u, '').replace(/[.!,;:…\-\s"'”’)\]]+$/u, '').trim();
+  }
+
+  /* Short enough that the model had no context to work from. Four, measured:
+     see the numbers below. */
+  const INVENTED_MAX_WORDS = 4;
+
+  /*
+   * UP TO FOUR words, not one.
+   *
+   * This was restricted to a single word because a two-word rule was measured
+   * blanking 'Why not.' -> '¿Por qué no?', 'Guess what.' -> '¿Adivina qué?',
+   * 'You ready.' -> '¿Están listos?'. That finding was right; the conclusion
+   * drawn from it was too narrow. What those cases have in common is not their
+   * LENGTH, it is that they contain an interrogative word — so the exemption
+   * below, not the word count, is what protects them. Testing every word of
+   * the source instead of only a lone one keeps all of them and frees the
+   * count to rise.
+   *
+   * MEASURED over this church's own archive — 349 confirmed inventions and
+   * 22,526 legitimate short translations from ten real services:
+   *
+   *     one word  (before)   198/349 caught   57%    0 legitimate lines broken
+   *     <= 4 words           254/349 caught   73%    0 legitimate lines broken
+   *
+   * The congregation was hearing 'Check, check.' as '¿Qué quieres?', 'Holy
+   * Spirit.' as '我們必須要做什麼?' and 'Hello.' as '¿Qué pasa?' — all of them
+   * two words, all of them one word past where this rule used to stop looking.
+   *
+   * A source of NO words reaches here too ('-', '...', a stray dash Whisper
+   * emits between speakers). Nothing cannot mean a question, so it is not
+   * exempted: an empty source with an all-question output is an invention by
+   * definition.
+   */
+  function inventedQuestion(src, out) {
+    if (QUESTION_RE.test(src)) return false;
+    const words = bareSource(src).split(/\s+/).filter(Boolean);
+    if (words.length > INVENTED_MAX_WORDS) return false;
+    /* ANY interrogative word, anywhere in the source — 'Guess what.' and
+       'Why not.' put it first, 'How about now' and 'And why' do not. */
+    if (words.some(function (w) { return INTERROGATIVE_SRC.test(w); })) return false;
+    const parts = splitSentences(out);
+    return parts.length > 0 && parts.every(isQuestionSentence);
+  }
+
+  /*
+   * THE PORTUGUESE TWIN. NLLB's stock invention for a fragment in Portuguese is
+   * not a question but the statement "Não." ('See.' -> 'Não.', 'Wow.' ->
+   * 'Não.', 'way.' -> 'Não.', 'You understand?' -> '- Não.' — measured in
+   * the archive), and the Spanish "No, no lo sé." family. A short source with
+   * no negation in it cannot mean "No".
+   */
+  const NEGATION_SRC = /\b(?:no|not|never|nope|nah|nay|nix|negative|nothing|none|nobody|neither|nor|don'?t|can'?t|won'?t|isn'?t|ain'?t|didn'?t|doesn'?t|wasn'?t|aren'?t|couldn'?t|wouldn'?t|shouldn'?t)\b|\b(?:uh|nuh)-?uh\b/i;
+  const NEGATION_OUT = /^[\s¿¡\-‐-―−"'“”]*(?:não|nao|no|non|nein|nee|niet|nej|nie|нет|いいえ|不|아니요|لا)[\s.!?…"'”]*$/iu;
+
+  function inventedNegation(src, out) {
+    const bare = bareSource(src);
+    const words = bare.split(/\s+/).filter(Boolean);
+    if (!words.length || words.length > 2) return false;
+    if (NEGATION_SRC.test(bare)) return false;
+    return NEGATION_OUT.test(String(out || ''));
+  }
+
+  function clean(source, target) {
+    const src = String(source == null ? '' : source).trim();
+    let out = stripDash(target);
+    if (!out) return { text: '', trimmed: false, reason: '' };
+
+    const dashed = out !== String(target || '').trim();
+
+    const oneWord = trimInventedClause(src, out);
+    if (oneWord !== out) {
+      return { text: oneWord, trimmed: true,
+               reason: 'dropped invented clause after a one-word line \u2014 "' + out + '"' };
+    }
+
+    if (inventedQuestion(src, out)) {
+      return { text: '', trimmed: true,
+               reason: 'dropped an invented question for a short line \u2014 "' + out + '"' };
+    }
+    if (inventedNegation(src, out)) {
+      return { text: '', trimmed: true,
+               reason: 'dropped an invented negation for a short line \u2014 "' + out + '"' };
+    }
+
+    if (words(src) > SHORT_WORDS) {
+      return { text: out, trimmed: dashed, reason: dashed ? 'subtitle dash' : '' };
+    }
+
+    const nSrc = sentenceCount(src);
+    const parts = splitSentences(out);
+    if (parts.length <= nSrc) {
+      return { text: out, trimmed: dashed, reason: dashed ? 'subtitle dash' : '' };
+    }
+
+    /*
+     * More sentences came out than went in, on an input too short to justify
+     * it. Keep the first nSrc — NLLB translates in order, so the real content
+     * is at the front and the invention is appended.
+     */
+    const kept = parts.slice(0, nSrc).join(' ').trim();
+    const dropped = parts.slice(nSrc).join(' ').trim();
+    if (!kept) return { text: out, trimmed: dashed, reason: '' };
+    return {
+      text: kept,
+      trimmed: true,
+      reason: 'dropped invented ' + (QUESTION_RE.test(dropped) ? 'question' : 'text') +
+              ' "' + dropped + '"'
+    };
+  }
+
+  return { clean, splitSentences, sentenceCount, stripDash, trimInventedClause, inventedQuestion, inventedNegation, SHORT_WORDS };
+}));

app/mt-service.js

@@ -0,0 +1,238 @@
+/*
+ * mt-service.js — the translation model, in a process of its own.
+ *
+ * Three runtimes were tried before this one, and the reasons matter:
+ *
+ *   • ONNX Runtime *Web* in the renderer: its weights go through a 32-bit WASM
+ *     heap capped at 4 GB. NLLB aborts at fp16 and at q4f16. The only variant
+ *     that fits is int8, which emits fluent-looking nonsense stitched together
+ *     from a dozen unrelated languages.
+ *
+ *   • onnxruntime-node inside Electron's main process: crashes outright —
+ *     EXC_BREAKPOINT in CPUAllocator::Alloc on CrBrowserMain while building the
+ *     session. A multi-gigabyte synchronous allocation on the browser thread is
+ *     not something that thread will tolerate.
+ *
+ *   • onnxruntime-node in a plain Node process: works. Correct output in every
+ *     script tested, about 0.8 s per language on this M2 Max.
+ *
+ * So translation lives here, in a forked plain-Node process (the parent runs it
+ * with ELECTRON_RUN_AS_NODE), with a normal 64-bit heap and nothing else
+ * sharing it. Electron's own utilityProcess was tried first and exits with a
+ * bare code 5 and no output. If this dies, the parent restarts it — with
+ * backoff — and the app keeps running.
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const {
+  pipeline, env, LogitsProcessor, LogitsProcessorList
+} = require('@huggingface/transformers');
+
+let pipe = null;
+
+/*
+ * ─────────────────────────── batched multi-target decode ───────────────────
+ *
+ * NLLB picks its target language with `forced_bos_token_id` — the FIRST token
+ * the decoder is made to emit. The encoder input carries only the SOURCE
+ * language tag (tokenizers.js `_build_translation_inputs` rewrites the
+ * post-processor's special token to the source, and nothing else). So one
+ * encoder input serves every target, and the only per-language difference is
+ * one token at decode step 1.
+ *
+ * That makes N languages one batched decode instead of N passes over the same
+ * 600M weights. This model is memory-bandwidth-bound — three worker processes
+ * measured SLOWER than one (3.4s vs 1.9s for five languages) — and batching is
+ * the right shape of fix for that: the weights are read once per step for the
+ * whole batch instead of once per step per language.
+ *
+ * MEASURED on this M2 Max, one sentence, fp32, versus the same work serially:
+ *
+ *     2 langs  1.59x     3 langs  1.93x     5 langs  3.06x     9 langs  3.89x
+ *
+ * with output identical to the serial path in 9 of 9 languages.
+ *
+ * Two things had to be built for it:
+ *
+ *   • PER-ROW target forcing. The stock ForcedBOSTokenLogitsProcessor holds a
+ *     single id for the whole batch, so every row would come out in the same
+ *     language.
+ *
+ *   • STICKY EOS. transformers.js only leaves the decode loop once EVERY row
+ *     is done (`if (stop.every(x => x)) break`) and nothing pads a row that
+ *     already finished — its own source says `TODO: ensure all_input_ids is
+ *     padded correctly`. Untreated, a short language keeps generating free
+ *     text while a long one catches up: Spanish finished correctly and then
+ *     drifted through Czech and Romanian for another hundred tokens. Pinning
+ *     a finished row to EOS makes the tail strippable as special tokens.
+ */
+class BatchTargets extends LogitsProcessor {
+  constructor(bosIds, eos) { super(); this.bosIds = bosIds; this.eos = eos; }
+  _call(input_ids, logits) {
+    for (let i = 0; i < input_ids.length; ++i) {
+      const row = input_ids[i];
+      const d = logits[i].data;
+      if (row.length === 1) {
+        /* Decode step 1: this row's target language, and nothing else. */
+        d.fill(-Infinity);
+        d[this.bosIds[i]] = 0;
+      } else if (row[row.length - 1] === this.eos) {
+        /* Already finished — hold it there rather than let it wander. */
+        d.fill(-Infinity);
+        d[Number(this.eos)] = 0;
+      }
+    }
+    return logits;
+  }
+}
+
+/* The batched path needs tokenizer internals. If a future version of the
+   library moves them, say so once and keep translating one at a time. */
+function batchable(tok) {
+  return !!(tok &&
+    typeof tok.lang_to_token === 'function' &&
+    tok.languageRegex instanceof RegExp &&
+    tok.post_processor && tok.post_processor.config &&
+    Array.isArray(tok.post_processor.config.single) &&
+    tok.model && typeof tok.model.convert_tokens_to_ids === 'function');
+}
+
+let warnedNoBatch = false;
+
+async function translateMulti(text, src, tgts) {
+  const tok = pipe.tokenizer, model = pipe.model;
+  if (!batchable(tok)) {
+    if (!warnedNoBatch) {
+      warnedNoBatch = true;
+      reply({ type: 'note', message: 'batched translation unavailable; using one pass per language' });
+    }
+    return null;
+  }
+
+  /* Pin the source language into the post-processor, the way the library's own
+     translation path does. */
+  for (const item of tok.post_processor.config.single) {
+    if ('SpecialToken' in item && tok.languageRegex.test(item.SpecialToken.id)) {
+      item.SpecialToken.id = tok.lang_to_token(src);
+      break;
+    }
+  }
+
+  const bosIds = tgts.map((t) => tok.model.convert_tokens_to_ids([tok.lang_to_token(t)])[0]);
+  if (bosIds.some((id) => id === undefined || id === null)) return null;
+
+  const enc = tok(new Array(tgts.length).fill(text), { padding: true, truncation: true });
+  const inLen = enc.input_ids.dims[1];
+  const eos = BigInt(model.generation_config.eos_token_id);
+
+  const lp = new LogitsProcessorList();
+  lp.push(new BatchTargets(bosIds, eos));
+
+  const out = await model.generate({
+    ...enc,
+    logits_processor: lp,
+    forced_bos_token_id: null,
+    /* A row that never emits EOS would otherwise hold the whole batch to the
+       model's 200-token ceiling. No translation of a sentence runs to four
+       times its source length. */
+    max_new_tokens: Math.min(200, inLen * 4 + 24)
+  });
+
+  const rows = tok.batch_decode(out, { skip_special_tokens: true });
+  const texts = {};
+  tgts.forEach((t, i) => { texts[t] = (rows[i] || '').trim(); });
+  return texts;
+}
+
+function reply(msg) {
+  try { if (process.send) process.send(msg); } catch (_) {}
+}
+
+process.on('message', async (msg) => {
+  msg = msg || {};
+
+  try {
+    if (msg.type === 'load') {
+      env.allowLocalModels = false;
+      if (msg.cacheDir) env.cacheDir = msg.cacheDir;
+
+      const load = () => pipeline('translation', msg.model, {
+        dtype: msg.dtype || 'fp32',
+        progress_callback: (p) => reply({ type: 'progress', p })
+      });
+
+      try {
+        pipe = await load();
+      } catch (err) {
+        /*
+         * A download interrupted partway leaves a truncated .onnx in the cache,
+         * and every launch after that dies on "Protobuf parsing failed" — the
+         * app is bricked until somebody knows to delete a folder. Throw the
+         * cached copy away and fetch it once more instead.
+         */
+        const looksCorrupt = /protobuf|parsing failed|invalid model|corrupt|unexpected end/i
+          .test((err && err.message) || '');
+        if (!looksCorrupt) throw err;
+
+        const dir = path.join(env.cacheDir, msg.model.replace(/\\/g, '/'));
+        reply({ type: 'progress', p: { status: 'initiate', file: 're-downloading damaged model files' } });
+        try { fs.rmSync(dir, { recursive: true, force: true }); } catch (_) {}
+        pipe = await load();
+      }
+
+      reply({ type: 'ready' });
+      return;
+    }
+
+    if (msg.type === 'translateMulti') {
+      if (!pipe) throw new Error('translation model is not loaded yet');
+      const text = String(msg.text || '');
+      const src = String(msg.src || 'eng_Latn');
+      const tgts = (msg.tgts || []).map(String);
+      if (!tgts.length) { reply({ type: 'multi', id: msg.id, texts: {} }); return; }
+
+      let texts = null;
+      if (tgts.length > 1) texts = await translateMulti(text, src, tgts);
+
+      /* One language, or a library that no longer exposes what batching needs:
+         the ordinary path still answers, just without the speed-up. */
+      if (!texts) {
+        texts = {};
+        for (const t of tgts) {
+          const o = await pipe(text, { src_lang: src, tgt_lang: t });
+          const g = Array.isArray(o) ? o[0] : o;
+          texts[t] = (g && g.translation_text || '').trim();
+        }
+      }
+      reply({ type: 'multi', id: msg.id, texts });
+      return;
+    }
+
+    if (msg.type === 'translate') {
+      if (!pipe) throw new Error('translation model is not loaded yet');
+      const out = await pipe(String(msg.text || ''), {
+        src_lang: String(msg.src || 'eng_Latn'),
+        tgt_lang: String(msg.tgt || 'eng_Latn')
+      });
+      const got = Array.isArray(out) ? out[0] : out;
+      reply({ type: 'result', id: msg.id, text: (got && got.translation_text || '').trim() });
+      return;
+    }
+  } catch (err) {
+    reply({
+      type: msg.type === 'load' ? 'loadError' : 'error',
+      id: msg.id,
+      message: (err && err.message) || String(err)
+    });
+  }
+});
+
+/* A crash here must be a visible, recoverable event in the parent — never a
+   silent stall that looks like a slow model. */
+process.on('uncaughtException', (e) => {
+  reply({ type: 'fatal', message: e.message });
+  process.exit(1);
+});

app/out-routing.js

@@ -0,0 +1,340 @@
+/*
+ * out-routing.js — send each language's spoken translation to its own physical
+ * output channels.
+ *
+ * English on Dante 1+2, Spanish on 3, Portuguese on 4, and so on: one Mac
+ * feeding a console or a set of assistive-listening transmitters, instead of
+ * every language sharing one stereo pair.
+ *
+ * WHY THIS IS POSSIBLE AT ALL, and why the input side is not:
+ *
+ *   MEASURED on this Mac, inside Electron (not the sandboxed preview):
+ *
+ *     OUTPUT  Dante Virtual Soundcard  destination.maxChannelCount = 8
+ *             NDI Audio                                            = 6
+ *             everything else                                      = 2
+ *
+ *     INPUT   the same Dante device, an AudioWorklet counting real channels:
+ *               no constraint / 4 / 8 / {ideal:8} / 16 / 64  ->  2 every time
+ *               channelCount: {exact: 8}   -> OverconstrainedError
+ *               channelCount: {min: 3}     -> OverconstrainedError
+ *
+ *   Those two rejections are Chromium stating outright that it cannot deliver
+ *   more than two input channels for this device, so picking "channel 16" of a
+ *   Dante input cannot be done from here at any channel count the card is set
+ *   to. OUTPUT has no such cap — the device's real count comes through — so
+ *   this module exists and its input-side twin cannot.
+ *
+ *   Nothing here assumes a number. The count is read from the hardware every
+ *   time the device is opened, so a card raised from 8x8 to 64x64 mid-week
+ *   needs a Rescan and nothing else.
+ *
+ * Device-neutral by construction. Dante, Waves SoundGrid, an Antelope box, a
+ * console over USB — they are all just Core Audio devices with a channel
+ * count, and nothing below asks which one it is.
+ */
+(function (global) {
+  'use strict';
+
+  /* Scheduling headroom. A buffer started at exactly currentTime is already
+     late by the time the render quantum runs, which clicks. */
+  const LEAD = 0.08;
+  /* If a language's queue has drifted further behind than this, stop trying to
+     honour the backlog and speak the newest sentence now. A translation that
+     is a minute late is worse than a gap. */
+  const MAX_BACKLOG = 8;
+
+  const state = {
+    ctx: null,
+    merger: null,
+    deviceId: '',
+    channels: 0,
+    map: {},            // lang -> [channel index, ...]
+    gain: {},           // lang -> dB trim, for matching a hardware input
+    gainNodes: {},      // lang -> GainNode, built lazily and reused
+    nextAt: {},         // lang -> AudioContext time its queue is free
+    onLog: function () {},
+    lastError: '',
+    played: 0,          // clips that reached the card since this graph opened
+    failed: 0,          // clips that did not, for the same period
+    lastFailError: ''
+  };
+
+  function dbToLinear(db) {
+    const n = Number(db);
+    if (!isFinite(n) || n === 0) return 1;
+    return Math.pow(10, Math.max(-40, Math.min(20, n)) / 20);
+  }
+
+  /*
+   * One gain node per language, living for as long as the graph does.
+   *
+   * A transmitter's line input wants a level the synthesizer knows nothing
+   * about, and every language is a different voice at a different loudness —
+   * so the trim is per language and it is set once, not per clip.
+   */
+  function gainFor(lang, chans) {
+    let g = state.gainNodes[lang];
+    if (!g) {
+      g = state.ctx.createGain();
+      g._wired = '';
+      state.gainNodes[lang] = g;
+    }
+    g.gain.value = dbToLinear(state.gain[lang]);
+
+    /*
+     * Rewire only when the destination actually changed.
+     *
+     * This node outlives individual clips, so a blanket disconnect/reconnect
+     * on every buffer would cut whatever is still playing through it —
+     * sentences are scheduled ahead of time and overlap the call that queues
+     * the next one.
+     */
+    const sig = chans.join(',');
+    if (g._wired !== sig) {
+      try { g.disconnect(); } catch (_) {}
+      for (const ch of chans) { try { g.connect(state.merger, 0, ch); } catch (_) {} }
+      g._wired = sig;
+    }
+    return g;
+  }
+
+  function log(msg, kind) { try { state.onLog(msg, kind); } catch (_) {} }
+
+  function active() {
+    return !!(state.ctx && state.merger && state.channels > 0);
+  }
+
+  /* Which physical channels a language plays on, or null for "not routed". */
+  function channelsFor(lang) {
+    const list = state.map && state.map[lang];
+    if (!Array.isArray(list) || !list.length) return null;
+    const out = list.map(Number).filter((n) => Number.isInteger(n) && n >= 0 && n < state.channels);
+    return out.length ? out : null;
+  }
+
+  async function teardown() {
+    const ctx = state.ctx;
+    state.ctx = null; state.merger = null; state.nextAt = {}; state.gainNodes = {};
+    if (ctx) { try { await ctx.close(); } catch (_) {} }
+  }
+
+  /*
+   * Build (or rebuild) the output graph.
+   *
+   * `channels` is what the operator asked for; the device decides what it can
+   * actually do, and asking for more than maxChannelCount throws rather than
+   * degrading — so it is clamped and the real number is reported back.
+   */
+  async function configure(opts) {
+    opts = opts || {};
+    const deviceId = String(opts.deviceId || '');
+    state.map = opts.map || {};
+    if (opts.gain) state.gain = opts.gain;
+    state.onLog = opts.onLog || state.onLog;
+    state.lastError = '';
+
+    if (!deviceId) { await teardown(); return { ok: true, channels: 0, off: true }; }
+
+    /*
+     * Rebuilding tears down running audio, so only do it when something that
+     * matters changed. A channel-map edit needs no new graph at all.
+     *
+     * `force` exists because a card reconfigured on the fly — Dante Virtual
+     * Soundcard raised from 8x8 to 64x64 — keeps the SAME device id. Without a
+     * way to say "re-read it", the app would go on offering the old count
+     * forever, and the operator would reasonably conclude it was broken.
+     */
+    if (!opts.force && state.ctx && state.deviceId === deviceId && state.channels > 0) {
+      return { ok: true, channels: state.channels };
+    }
+
+    await teardown();
+    state.deviceId = deviceId;
+
+    try {
+      const ctx = new AudioContext({ latencyHint: 'interactive' });
+      if (typeof ctx.setSinkId !== 'function') throw new Error('this build cannot choose an output device');
+      await ctx.setSinkId(deviceId);
+      /* Only after the sink is set does maxChannelCount describe the real
+         device — before that it is the default output's. */
+      /*
+       * Whatever the device says, with no ceiling of our own. 2, 8, 16, 64 —
+       * the count comes from the hardware every time it is opened, so raising
+       * a card's channel count and pressing Rescan is all it takes.
+       */
+      const max = ctx.destination.maxChannelCount || 2;
+      const want = Math.max(1, Math.min(max, Number(opts.channels) || max));
+      ctx.destination.channelCount = want;
+      ctx.destination.channelCountMode = 'explicit';
+      /* DISCRETE, emphatically. The default 'speakers' interpretation would
+         treat channels 1-8 as a surround layout and helpfully fold Spanish
+         into a rear-left downmix. Discrete means channel 3 is channel 3. */
+      ctx.destination.channelInterpretation = 'discrete';
+
+      const merger = ctx.createChannelMerger(want);
+      merger.channelCountMode = 'explicit';
+      merger.channelInterpretation = 'discrete';
+      merger.connect(ctx.destination);
+
+      if (ctx.state === 'suspended') { try { await ctx.resume(); } catch (_) {} }
+
+      state.ctx = ctx;
+      state.merger = merger;
+      state.channels = want;
+      state.nextAt = {};
+      /* Per graph, not per service: picking a different device is a fresh
+         question about whether THAT device is working. */
+      state.played = 0; state.failed = 0; state.lastFailError = '';
+      log('audio output: ' + want + ' channel' + (want === 1 ? '' : 's') +
+          (want < max ? ' (device offers ' + max + ')' : ''), 'ok');
+      return { ok: true, channels: want, max: max };
+    } catch (e) {
+      state.lastError = e.message || String(e);
+      await teardown();
+      state.channels = 0;
+      log('audio output unavailable: ' + state.lastError, 'err');
+      return { ok: false, channels: 0, error: state.lastError };
+    }
+  }
+
+  function setMap(map) { state.map = map || {}; }
+
+  function setGain(gain) {
+    state.gain = gain || {};
+    /* Live, on nodes that already exist — changing a trim while a sentence is
+       playing should move that sentence's level, not the next one's. */
+    for (const lang of Object.keys(state.gainNodes)) {
+      try { state.gainNodes[lang].gain.value = dbToLinear(state.gain[lang]); } catch (_) {}
+    }
+  }
+
+  /* Does this language go anywhere? feedMic asks before doing any work. */
+  function routed(lang) { return active() && !!channelsFor(lang); }
+
+  /*
+   * Schedule one already-decoded buffer on a language's channels.
+   *
+   * Shared by the clip path and the live room-mic path, because the only thing
+   * that differs between them is where the samples came from.
+   */
+  function schedule(lang, buf) {
+    const chans = channelsFor(lang);
+    if (!chans) return;
+    const ctx = state.ctx;
+    const now = ctx.currentTime;
+    let at = state.nextAt[lang] || 0;
+    if (at < now + LEAD) at = now + LEAD;
+    if (at - now > MAX_BACKLOG) at = now + LEAD;
+
+    const src = ctx.createBufferSource();
+    src.buffer = buf;
+    /* A MONO source on two channels is the same signal on both — dual mono,
+       which is what feeds a stereo pair on a console or a transmitter's line
+       input. Nothing here invents width the voice never had. */
+    const g = gainFor(lang, chans);
+    const splitter = buf.numberOfChannels > 1
+      ? ctx.createChannelSplitter(buf.numberOfChannels) : null;
+    if (splitter) { src.connect(splitter); splitter.connect(g); }
+    else src.connect(g);
+    src.start(at);
+    state.nextAt[lang] = at + buf.duration;
+  }
+
+  /*
+   * Raw PCM straight out, for the live room microphone.
+   *
+   * The SOURCE language never gets a synthesized clip — speakOne skips it,
+   * there is nothing to translate English into for an English service — so
+   * routing English to channels 1+2 produced silence. The audio English
+   * actually has is the room feed, and this is how it reaches the hardware.
+   *
+   * Continuous, not sentence-shaped: each chunk is scheduled immediately after
+   * the last so the feed plays as one unbroken stream rather than a queue.
+   */
+  function playPcm(lang, samples, sampleRate) {
+    if (!active() || !channelsFor(lang) || !samples || !samples.length) return;
+    try {
+      const ctx = state.ctx;
+      const buf = ctx.createBuffer(1, samples.length, sampleRate || 16000);
+      buf.copyToChannel ? buf.copyToChannel(samples, 0) : buf.getChannelData(0).set(samples);
+      schedule(lang, buf);
+    } catch (_) {}
+  }
+
+  /*
+   * Play one clip on one language's channels.
+   *
+   * Deliberately fire-and-forget and deliberately never throws: this is a
+   * parallel output path, and a failure here must cost the captions and the
+   * phone stream nothing.
+   */
+  async function play(lang, url) {
+    if (!active()) return;
+    const chans = channelsFor(lang);
+    if (!chans) return;                       // this language is not routed anywhere
+
+    try {
+      /* no-store, deliberately. Each clip is fetched exactly once, so an HTTP
+         cache buys nothing here and cost a great deal: with `force-cache` and
+         the server's `immutable`, a name reused after a restart replayed the
+         previous service's audio. The names are unique now (see tts-service's
+         seq); this makes a stale hit impossible rather than merely unlikely. */
+      const res = await fetch(url, { cache: 'no-store' });
+      if (!res.ok) { noteFail(lang, 'clip ' + res.status); return; }
+      const bytes = await res.arrayBuffer();
+      const ctx = state.ctx;
+      if (!ctx || ctx !== state.ctx) return;  // reconfigured while we were fetching
+      const buf = await ctx.decodeAudioData(bytes);
+      if (!state.ctx || ctx !== state.ctx) return;
+
+      schedule(lang, buf);
+      state.played++;
+    } catch (e) {
+      /* A clip that will not decode is one missed sentence on the hardware
+         outputs. Everything else about it already went out — but see noteFail:
+         one missed sentence is nothing, and a thousand is a dead feed. */
+      noteFail(lang, (e && e.message) || 'decode failed');
+    }
+  }
+
+  /*
+   * SAY SOMETHING WHEN THE HARDWARE FEED IS FAILING.
+   *
+   * This path is deliberately fire-and-forget: a sound card must never be able
+   * to take the captions or the phone stream down with it, so every failure
+   * above is swallowed. That was right, and it was also why a wrong clip name
+   * left every Dante and transmitter output SILENT FOR WEEKS while the app
+   * looked perfectly healthy — 404 on every clip, and not one line anywhere
+   * saying so.
+   *
+   * Swallowing the failure and reporting it are not the same thing. Nothing
+   * here throws or blocks; it counts, and it speaks up on the first failure of
+   * a run and every 20th after, so a persistent fault is loud and an occasional
+   * one is a footnote.
+   */
+  function noteFail(lang, why) {
+    state.failed++;
+    state.lastFailError = String(why || '');
+    if (state.failed === 1 || state.failed % 20 === 0) {
+      log('hardware output: ' + state.failed + ' clip' + (state.failed === 1 ? '' : 's') +
+          ' did not reach the outputs (' + lang + ': ' + state.lastFailError + ')' +
+          (state.played ? '' : ' — nothing has played on this device yet'), 'err');
+    }
+  }
+
+  function status() {
+    return {
+      on: active(),
+      deviceId: state.deviceId,
+      channels: state.channels,
+      error: state.lastError,
+      played: state.played,
+      failed: state.failed,
+      lastFailError: state.lastFailError,
+      routed: Object.keys(state.map || {}).filter((l) => channelsFor(l))
+    };
+  }
+
+  global.OutRouting = { configure, setMap, setGain, play, playPcm, routed, status, teardown };
+})(window);

app/package.json

@@ -0,0 +1,160 @@
+{
+  "name": "church-translate-engine",
+  "productName": "Church Translate",
+  "version": "3.23.2",
+  "buildNumber": 112,
+  "private": true,
+  "description": "Live sermon translation — self-contained: captures audio, transcribes, translates, and serves the congregation page itself",
+  "main": "main.js",
+  "scripts": {
+    "predist": "node tools/sync-build-version.js && node tools/check-packaged-files.js",
+    "start": "electron .",
+    "dist": "electron-builder --mac",
+    "dist:mac": "electron-builder --mac",
+    "dist:win": "electron-builder --win"
+  },
+  "devDependencies": {
+    "electron": "^33.2.0",
+    "electron-builder": "^25.1.8"
+  },
+  "dependencies": {
+    "@huggingface/transformers": "^3.8.1",
+    "espeak-ng": "^1.0.2",
+    "kokoro-js": "^1.2.1",
+    "qrcode": "^1.5.4",
+    "sherpa-onnx-node": "^1.13.6",
+    "tar-stream": "^3.2.1",
+    "unbzip2-stream": "^1.4.3",
+    "ws": "^8.18.0"
+  },
+  "build": {
+    "appId": "org.waterschurch.translate.engine",
+    "productName": "Church Translate",
+    "directories": {
+      "output": "dist"
+    },
+    "files": [
+      "main.js",
+      "preload.js",
+      "index.html",
+      "engine.css",
+      "engine.js",
+      "model-worker.js",
+      "mt-service.js",
+      "capture-worklet.js",
+      "selftest.html",
+      "selftest.js",
+      "selftest.wav",
+      "vendor/transformers.min.js",
+      "vendor/ort-wasm-simd-threaded.jsep.wasm",
+      "vendor/ort-wasm-simd-threaded.jsep.mjs",
+      "server/**/*",
+      "tts-service.js",
+      "kokoro-sidecar.js",
+      "voices.js",
+      "pt-variants.js",
+      "speech-text.js",
+      "tools/setup-local-voices.sh",
+      "voice-catalog.js",
+      "out-routing.js",
+      "mt-guard.js",
+      "liturgy.js",
+      "preach.js",
+      "spa-variants.js",
+      "bible-lexicon.js",
+      "app-log.js",
+      "sidecar-langs.js",
+      "short-questions.js",
+      "tools/verify-windows.js"
+    ],
+    "mac": {
+      "target": [
+        {
+          "target": "dir",
+          "arch": [
+            "arm64"
+          ]
+        },
+        {
+          "target": "dmg",
+          "arch": [
+            "arm64"
+          ]
+        }
+      ],
+      "category": "public.app-category.utilities",
+      "extendInfo": {
+        "NSMicrophoneUsageDescription": "Church Translate listens to the sermon audio you select so it can caption and translate it."
+      },
+      "identity": null,
+      "extraResources": [
+        {
+          "from": "vendor/node",
+          "to": "node"
+        },
+        {
+          "from": "vendor/cloudflared",
+          "to": "cloudflared"
+        }
+      ],
+      "artifactName": "${productName}-${version}-${arch}.${ext}",
+      "files": [
+        "!node_modules/**/.cache${/*}",
+        "!node_modules/onnxruntime-node/bin/napi-v3/win32${/*}",
+        "!node_modules/onnxruntime-node/bin/napi-v3/linux${/*}",
+        "!node_modules/sherpa-onnx-win-x64${/*}"
+      ]
+    },
+    "asar": false,
+    "buildVersion": "112",
+    "win": {
+      "target": [
+        {
+          "target": "nsis",
+          "arch": [
+            "x64"
+          ]
+        },
+        {
+          "target": "zip",
+          "arch": [
+            "x64"
+          ]
+        }
+      ],
+      "artifactName": "${productName} Setup ${version}.${ext}",
+      "extraResources": [
+        {
+          "from": "vendor-win/node.exe",
+          "to": "node.exe"
+        },
+        {
+          "from": "vendor-win/cloudflared.exe",
+          "to": "cloudflared.exe"
+        },
+        {
+          "from": "vendor-win/ffmpeg.exe",
+          "to": "ffmpeg.exe"
+        },
+        {
+          "from": "vendor-win/FFMPEG-LICENSE.txt",
+          "to": "FFMPEG-LICENSE.txt"
+        }
+      ],
+      "files": [
+        "!node_modules/**/.cache${/*}",
+        "!node_modules/onnxruntime-node/bin/napi-v3/darwin${/*}",
+        "!node_modules/onnxruntime-node/bin/napi-v3/linux${/*}",
+        "!node_modules/sherpa-onnx-darwin-arm64${/*}"
+      ]
+    },
+    "nsis": {
+      "oneClick": false,
+      "perMachine": false,
+      "allowToChangeInstallationDirectory": true,
+      "createDesktopShortcut": true,
+      "createStartMenuShortcut": true,
+      "deleteAppDataOnUninstall": false
+    }
+  }
+}

app/preach.js

@@ -0,0 +1,114 @@
+/*
+ * preach.js — plain English for the model, the preacher's words for the room.
+ *
+ * NLLB was trained on documents, not sermons. Handed a preaching idiom it
+ * translates the words and loses the instruction, and it does it fluently, so
+ * nobody watching a caption in a language they cannot read has any way to know.
+ * Measured against the shipped model, into Spanish, Portuguese and French:
+ *
+ *   "Circle that in your Bible."  ->  spa "En su Biblia."        VERB GONE
+ *                                     fra "Envoyez-le dans..."   (send it)
+ *                                     por "Envolva isso..."      (wrap it)
+ *   "Walk it out."                ->  fra "Je vais sortir."      (I'm leaving)
+ *   "Let that sink in."           ->  spa "Deja que se hunde."   (drowns)
+ *   "Open up to the book of John."->  spa "...la obra de Juan."   (the WORKS of John)
+ *
+ * Every entry below was measured before and after in at least three languages
+ * and kept only where the rewrite was better in more than one. "God showed up."
+ * was tested and REMOVED: "Dios apareció" was already right, so the rewrite was
+ * just a different guess. Do not add entries by intuition — measure them.
+ *
+ * CRITICAL: this rewrites ONLY what is sent to the translator. The English
+ * caption, the transcript archive and the operator's monitor all keep what was
+ * actually said. Normalising the source itself would put words in the
+ * preacher's mouth, and one source-side edit propagates to every language and
+ * the permanent record at once.
+ */
+(function (root, factory) {
+  if (typeof module === 'object' && module.exports) module.exports = factory();
+  else root.Preach = factory();
+}(typeof self !== 'undefined' ? self : this, function () {
+  'use strict';
+
+  /* Longest and most specific first — "open up to the book of" has to win over
+     the general "open up to". Applied in order, each at most once per sentence. */
+  const RULES = [
+    /* Scripture navigation. "open up to" is the one that produced "obra". */
+    [/\bopen up to the book of\b/gi, 'turn to the book of'],
+    [/\bopen up to\b/gi,            'turn to'],
+    [/\bdrop down to\b/gi,          'go to'],
+    [/\bback up to\b/gi,            'go back to'],
+    [/\bcircle (that|this|it)\b/gi, 'mark $1'],
+
+    /* Instructions that became statements, or vanished. */
+    [/\blet (that|this|it) sink in\b/gi,        'think carefully about $1'],
+    [/\bwalk (it|that) out\b/gi,                'put $1 into practice'],
+    [/\bunpack (that|this|it)\b/gi,             'explain $1'],
+    [/\bcamp out here\b/gi,                     'stay here'],
+    [/\bgive God a hand of praise\b/gi,         'applaud to praise God'],
+    [/\bput a hand on your neighbou?r\b/gi,     'put a hand on the person next to you'],
+    [/\bturn to your neighbou?r\b/gi,           'turn to the person next to you'],
+
+    /* Rhetorical checks. Wrong sense, not wrong words. */
+    [/\bare you tracking with me\b/gi,          'are you following me'],
+    [/\b(catch|get) (this|that)\b/gi,           'understand $2'],
+    [/\bthat will preach\b/gi,                  'that is worth preaching']
+  ];
+
+  /*
+   * A rewrite must not change how the sentence is capitalised — the target
+   * inherits sentence case from the source, and lowercasing the first word
+   * produced mid-sentence-looking captions.
+   */
+  function forTranslation(text) {
+    let out = String(text == null ? '' : text);
+    if (!out) return out;
+    const had = out;
+    for (const [re, to] of RULES) out = out.replace(re, to);
+    if (out === had) return had;
+    /* Restore the opening capital if a rule replaced the first word. */
+    if (/^[a-z]/.test(out) && /^[A-Z]/.test(had)) out = out.charAt(0).toUpperCase() + out.slice(1);
+    return out;
+  }
+
+  /*
+   * THE TERMINAL PERIOD ON A SHORT UTTERANCE. One character, and it is the
+   * difference between a name and invented dialogue.
+   *
+   * Measured against the shipped model:
+   *   "Peter."     -> spa "¿Qué es eso?"      | "Peter"     -> "Pedro"
+   *   "Jesus."     -> spa "¿Qué quieres?"     | "Jesus"     -> "Jesús"
+   *   "Matthew."   -> spa "¿Qué es eso?"      | "Matthew"   -> "Mateo"
+   *   "Habakkuk."  -> fra "Habakuk est mort"  | "Habakkuk"  -> "Habakuk"
+   *   "Simon Peter." -> spa "Sí, es el Simon Peter." | -> "Simón Pedro"
+   *
+   * With the period the model reads a complete conversational turn and answers
+   * it; without, it translates the term. A preacher naming people one at a time
+   * — "Peter. James. John." — got back a run of questions containing no names.
+   *
+   * Only the PERIOD is removed, and only from utterances of three words or
+   * fewer. "?" and "!" carry real meaning and are left alone, and a full
+   * sentence needs its punctuation for the model to parse it at all.
+   */
+  const SHORT_WORDS_FOR_DOT = 3;
+
+  function stripShortPeriod(text) {
+    const s = String(text == null ? '' : text);
+    const t = s.trim();
+    if (!/[^.!?]\.$/.test(t)) return { text: s, hadPeriod: false };
+    if (t.split(/\s+/).filter(Boolean).length > SHORT_WORDS_FOR_DOT) return { text: s, hadPeriod: false };
+    return { text: t.slice(0, -1), hadPeriod: true };
+  }
+
+  /* Put the period back, so the caption and the voice both get a finished line
+     (espeak takes its final intonation from terminal punctuation). */
+  function restorePeriod(out, hadPeriod) {
+    const s = String(out == null ? '' : out).trim();
+    if (!hadPeriod || !s) return s;
+    return /[.!?\u3002\uff01\uff1f\u061f]$/.test(s) ? s : s + '.';
+  }
+
+  function rules() { return RULES.length; }
+
+  return { forTranslation, stripShortPeriod, restorePeriod, rules, RULES };
+}));

app/preload.js

@@ -0,0 +1,57 @@
+/*
+ * preload.js — the only bridge between the renderer and Node.
+ * Nothing here takes a path or a command from the page; every call is a fixed
+ * verb with no free-form arguments beyond a config patch.
+ */
+'use strict';
+
+const { contextBridge, ipcRenderer } = require('electron');
+
+contextBridge.exposeInMainWorld('engineHost', {
+  getConfig:    ()      => ipcRenderer.invoke('config:get'),
+  setConfig:    (patch) => ipcRenderer.invoke('config:set', patch),
+  micStatus:    ()      => ipcRenderer.invoke('mic:status'),
+  askMic:       ()      => ipcRenderer.invoke('mic:ask'),
+  openPrivacy:  ()      => ipcRenderer.invoke('app:openPrivacy'),
+  cacheInfo:    ()      => ipcRenderer.invoke('app:cacheInfo'),
+  revealCache:  ()      => ipcRenderer.invoke('app:revealCache'),
+  copyText:     (text)  => ipcRenderer.invoke('app:copy', text),
+  setLive:      (live)  => ipcRenderer.send('engine:live', !!live),
+  logLine:      (line)  => ipcRenderer.send('log:line', String(line || '')),
+
+  /* Translation lives in the main process; these are its only two verbs. */
+  mtEnsure:     ()      => ipcRenderer.invoke('mt:ensure'),
+  settingsExport: ()    => ipcRenderer.invoke('settings:export'),
+  settingsImport: ()    => ipcRenderer.invoke('settings:import'),
+  audioDevices: ()      => ipcRenderer.invoke('audio:devices'),
+  modelsCached: (id)    => ipcRenderer.invoke('models:cached', id),
+  mtTranslate:  (req)   => ipcRenderer.invoke('mt:translate', req),
+  mtTranslateMulti: (req) => ipcRenderer.invoke('mt:translateMulti', req),
+  onMtProgress: (fn)    => ipcRenderer.on('mt:progress', (_e, p) => fn(p)),
+  onMtDown:     (fn)    => ipcRenderer.on('mt:down', (_e, info) => fn(info)),
+
+  /* The congregation server runs inside this app; these describe it. */
+  localInfo:    ()      => ipcRenderer.invoke('local:info'),
+  onServerUp:   (fn)    => ipcRenderer.on('server:up', (_e, info) => fn(info)),
+  onServerDown: (fn)    => ipcRenderer.on('server:down', () => fn()),
+
+  /* Share to the internet: a Cloudflare quick tunnel for livestream viewers. */
+  tunnelStart:   ()   => ipcRenderer.invoke('tunnel:start'),
+  tunnelStop:    ()   => ipcRenderer.invoke('tunnel:stop'),
+  tunnelStatus:  ()   => ipcRenderer.invoke('tunnel:status'),
+  onTunnel:      (fn) => ipcRenderer.on('tunnel:status', (_e, s) => fn(s)),
+
+  /* Built-in voices: this Mac speaks, and the phones play what it sends. */
+  ttsInfo:       ()      => ipcRenderer.invoke('tts:info'),
+  ttsSpeak:      (req)   => ipcRenderer.invoke('tts:speak', req),
+  ttsPreload:    (langs) => ipcRenderer.invoke('tts:preload', langs),
+  /* Audition one specific voice, and save the per-language choices. */
+  ttsAudition:   (req)   => ipcRenderer.invoke('tts:audition', req),
+  ttsSetVoices:  (c)     => ipcRenderer.invoke('tts:setVoices', c),
+  ttsSetListenerVoices: (m) => ipcRenderer.invoke('tts:setListenerVoices', m),
+  onTtsReady:    (fn)    => ipcRenderer.on('tts:ready', (_e, i) => fn(i)),
+  onTtsProgress: (fn)    => ipcRenderer.on('tts:progress', (_e, p) => fn(p)),
+  onTtsCloud:    (fn)    => ipcRenderer.on('tts:cloud', (_e, s) => fn(s)),
+  onLocalVoices: (fn)    => ipcRenderer.on('localvoices:status', (_e, s) => fn(s)),
+  localVoicesStatus: ()  => ipcRenderer.invoke('localvoices:status')
+});

app/pt-variants.js

@@ -0,0 +1,698 @@
+/*
+ * pt-variants.js — one NLLB translation, two Portugueses.
+ *
+ * Measured on this church's own 4000-sentence transcript corpus: NLLB's
+ * por_Latn output is ~8:1 European-marked, but not consistently either
+ * variant. No available translation model can steer the variant (both
+ * candidates were benchmarked and rejected — one produced the wrong variant,
+ * the other produced pan-Romance interlingua). So the split is deterministic:
+ *
+ *   raw NLLB  ─→ toEuropean()  → "Português (Portugal)"
+ *            └─→ toBrazilian() → "Português (Brasil)"
+ *
+ * Both passes were built against the real corpus with adversarial review
+ * (0 breaks), cost ~35µs/sentence, and are idempotent. The rules err on the
+ * side of leaving text alone: every transformation carries measured guards
+ * (see the 'sumo sacerdote' lookahead — a blind sumo→suco swap would have
+ * read "juice priest" in a sermon on Hebrews).
+ *
+ * Corpus-verified whitelists live inside; do not extend them by intuition —
+ * re-run the regression harnesses in the project scratchpad notes instead.
+ */
+(function (root, factory) {
+  if (typeof module === 'object' && module.exports) module.exports = factory();
+  else root.PtVariants = factory();
+}(typeof self !== 'undefined' ? self : this, function () {
+  'use strict';
+
+  const EU = (function () {
+    /*
+     * localize-pt.mjs — deterministic BR->PT (European Portuguese) post-pass.
+     * Input: NLLB por_Latn output. Output: same text nudged toward pt-PT.
+     * Design rule: every transformation must be SAFE — when unsure, leave it alone.
+     *
+     * TRAP, measured the hard way: JavaScript's \b is defined over [A-Za-z0-9_] only, so
+     * /\bônibus\b/ does NOT match "o ônibus" and /\b… (é)\b/ does not match "o fato é".
+     * Several lexicon entries were silently dead until this was caught. Every word boundary
+     * in this file therefore goes through RE(), which uses accent-aware lookarounds.
+     */
+    const LETTER = 'A-Za-zÀ-ÿ';
+    const RE = (body, flags = 'g') =>
+      new RegExp(`(?<![${LETTER}])(?:${body})(?![${LETTER}])`, flags);
+    
+    // ---------- 1. gerund -> infinitive ----------
+    // Words ending in -ndo that are NOT gerunds. Guards against "está quando", noun heads, etc.
+    const NOT_GERUND = new Set([
+      'quando', 'mundo', 'segundo', 'profundo', 'fundo', 'redondo', 'bando', 'memorando',
+      'reverendo', 'imundo', 'oriundo', 'rotundo', 'moribundo', 'estupendo', 'tremendo',
+      'horrendo', 'nefando', 'venerando', 'comando', 'bando', 'contrabando', 'blando',
+      'grando', 'furibundo', 'vagabundo', 'mando', 'brando', 'lindo', 'infindo', 'findo',
+      // 1st-person-singular present forms that merely LOOK like gerunds:
+      // entendo "I understand", pretendo, defendo, ofendo, atendo, acendo, estendo, ascendo,
+      // suspendo, respondo, escondo, confundo, difundo, ando, mando, brando…
+      'entendo', 'pretendo', 'defendo', 'ofendo', 'atendo', 'acendo', 'estendo', 'ascendo',
+      'suspendo', 'respondo', 'escondo', 'confundo', 'difundo', 'infundo', 'refundo',
+      'descendo', 'transcendo', 'contendo', 'retendo', 'obtendo', 'detendo', 'abstendo',
+    ]);
+    
+    // -uzir verbs form the gerund in -uzindo; a stray "-uzendo" is a malformed input, not a
+    // verb we can safely derive from. Leave those alone rather than emit "conduzer".
+    const BAD_STEM = /uzendo$/i;
+    
+    // Irregular / special gerund stems.
+    const GERUND_IRREG = new Map([
+      ['indo', 'ir'], ['vindo', 'vir'], ['pondo', 'pôr'],
+      ['compondo', 'compor'], ['propondo', 'propor'], ['dispondo', 'dispor'],
+      ['supondo', 'supor'], ['impondo', 'impor'], ['expondo', 'expor'], ['repondo', 'repor'],
+      ['tendo', 'ter'], ['sendo', 'ser'], ['vendo', 'ver'], ['lendo', 'ler'],
+      ['crendo', 'crer'], ['dando', 'dar'], ['rindo', 'rir'],
+      ['advindo', 'advir'], ['convindo', 'convir'], ['intervindo', 'intervir'],
+    ]);
+    
+    function gerundToInfinitive(g) {
+      const low = g.toLowerCase();
+      if (NOT_GERUND.has(low)) return null;
+      if (GERUND_IRREG.has(low)) return GERUND_IRREG.get(low);
+      if (BAD_STEM.test(low)) return null;
+      if (low.length < 6) return null;              // too short to be a safe gerund
+      if (low.endsWith('ando')) return low.slice(0, -4) + 'ar';
+      if (low.endsWith('endo')) return low.slice(0, -4) + 'er';
+      if (low.endsWith('indo')) return low.slice(0, -4) + 'ir';
+      return null;
+    }
+    
+    // ---------- 2. enclitic attachment to an infinitive ----------
+    // "atrair" + "te" -> "atrair-te" ; "atrair" + "o" -> "atraí-lo"
+    const DIRECT_3 = new Set(['o', 'a', 'os', 'as']);
+    function attachClitic(inf, pron) {
+      const p = pron.toLowerCase();
+      if (!DIRECT_3.has(p)) return `${inf}-${p}`;          // se/me/te/nos/vos/lhe/lhes attach cleanly
+      // 3rd-person direct object: drop the -r, accent the theme vowel, use l-form.
+      if (inf === 'pôr') return `pô-l${p}`;
+      if (inf.endsWith('ar')) return inf.slice(0, -2) + 'á-l' + p;
+      if (inf.endsWith('er')) return inf.slice(0, -2) + 'ê-l' + p;
+      if (inf.endsWith('ir')) return inf.slice(0, -2) + 'i-l' + p;
+      return `${inf}-${p}`;
+    }
+    
+    // ---------- 3. progressive: estar + [clitic] + GERUND  ->  estar a + INF[-clitic] ----------
+    const ESTAR = '(?:estou|estás|está|estamos|estais|estão|estava|estavas|estávamos|estavam|estive|esteve|estivemos|estiveram|estarei|estará|estaremos|estarão|estaria|estariam|estivesse|estivessem|esteja|estejam|estejamos)';
+    const CLITIC = '(?:se|me|te|nos|vos|lhe|lhes|o|a|os|as)';
+    
+    function fixProgressive(text) {
+      // with a clitic between estar and the gerund: "está se movendo" -> "está a mover-se"
+      let out = text.replace(
+        RE(`(${ESTAR})(\\s+)(${CLITIC})(\\s+)([A-Za-zÀ-ÿ]+ndo)\\b`, 'gi'),
+        (m, est, s1, pron, s2, ger) => {
+          const inf = gerundToInfinitive(ger);
+          if (!inf) return m;
+          return `${est}${s1}a ${attachClitic(inf, pron)}`;
+        });
+      // clitic ALREADY attached to the gerund: "está levando-o" -> "está a levá-lo".
+      // Must run before the plain rule, which would otherwise strand the pronoun as "a levar-o".
+      out = out.replace(
+        RE(`(${ESTAR})(\\s+)([A-Za-zÀ-ÿ]+ndo)-(${CLITIC})\\b`, 'gi'),
+        (m, est, s1, ger, pron) => {
+          const inf = gerundToInfinitive(ger);
+          if (!inf) return m;
+          return `${est}${s1}a ${attachClitic(inf, pron)}`;
+        });
+      // plain: "está falando" -> "está a falar"
+      out = out.replace(
+        RE(`(${ESTAR})(\\s+)([A-Za-zÀ-ÿ]+ndo)\\b`, 'gi'),
+        (m, est, s1, ger) => {
+          const inf = gerundToInfinitive(ger);
+          if (!inf) return m;
+          return `${est}${s1}a ${inf}`;
+        });
+      // "continua/anda/vai + gerund" is also BR-leaning; pt-PT prefers "a + inf"
+      out = out.replace(
+        RE(`(continua|continuam|continuo|continuamos|anda|andam|ando|andamos)(\\s+)([A-Za-zÀ-ÿ]+ndo)`, 'gi'),
+        (m, v, s1, ger) => { const inf = gerundToInfinitive(ger); return inf ? `${v}${s1}a ${inf}` : m; });
+      return out;
+    }
+    
+    // ---------- 4. lexical table ----------
+    // Each entry: [BR regex, PT replacement]. Case-preserving for sentence-initial capitals.
+    // Deliberately conservative: only pairs where the BR word is unambiguous in a sermon register.
+    const LEXICON = [
+      // --- transport / objects ---
+      ['trem', 'comboio'], ['trens', 'comboios'],
+      ['ônibus', 'autocarro'],
+      ['celular', 'telemóvel'], ['celulares', 'telemóveis'],
+      ['geladeira', 'frigorífico'], ['geladeiras', 'frigoríficos'],
+      ['xícara', 'chávena'], ['xícaras', 'chávenas'],
+      ['sanduíche', 'sandes'], ['sanduíches', 'sandes'],
+      ['pedágio', 'portagem'], ['ponto de ônibus', 'paragem de autocarro'],
+      ['banheiro', 'casa de banho'], ['banheiros', 'casas de banho'],
+      ['açougue', 'talho'], ['aeromoça', 'hospedeira'],
+      ['calçada', 'passeio'], ['favela', 'bairro de lata'],
+      ['grampeador', 'agrafador'], ['mouse', 'rato'],
+      ['terno', 'fato'], ['meias', 'peúgas'],
+      // --- everyday nouns ---
+      ['café da manhã', 'pequeno-almoço'],
+      ['sobrenome', 'apelido'], ['sobrenomes', 'apelidos'],
+      ['carona', 'boleia'],
+      ['sorvete', 'gelado'], ['sorvetes', 'gelados'],
+      ['bala', 'rebuçado'], ['balas', 'rebuçados'],
+      ['presunto', 'fiambre'], ['bacon', 'toucinho'],
+      ['grama', 'relva'], ['ônibus escolar', 'autocarro escolar'],
+      ['esporte', 'desporto'], ['esportes', 'desportos'],
+      ['esportivo', 'desportivo'], ['esportiva', 'desportiva'],
+      ['time', 'equipa'], ['times', 'equipas'],
+      ['equipe', 'equipa'], ['equipes', 'equipas'],
+      ['torcida', 'adeptos'], ['torcedor', 'adepto'], ['torcedores', 'adeptos'],
+      // --- tech / admin ---
+      ['tela', 'ecrã'], ['telas', 'ecrãs'],
+      ['arquivo', 'ficheiro'], ['arquivos', 'ficheiros'],
+      ['registro', 'registo'], ['registros', 'registos'],
+      ['cadastro', 'registo'],
+      ['aplicativo', 'aplicação'], ['aplicativos', 'aplicações'],
+      ['usuário', 'utilizador'], ['usuários', 'utilizadores'],
+      ['senha', 'palavra-passe'], ['senhas', 'palavras-passe'],
+      ['time de trabalho', 'equipa de trabalho'],
+      ['fone', 'auscultador'], ['fones', 'auscultadores'],
+      ['caixa de correio', 'caixa de correio'],
+      // --- people ---
+      ['garoto', 'rapaz'], ['garotos', 'rapazes'],
+      ['garota', 'rapariga'], ['garotas', 'raparigas'],
+      ['moleque', 'miúdo'], ['moleques', 'miúdos'],
+      ['criançada', 'miudagem'],
+      ['bunda', 'rabo'],
+      // REMOVED after measurement — 'cara' is a homograph: it means "face" in BOTH variants
+      // and only means "dude" as BR slang. The blind swap produced "tipo a tipo" for
+      // "cara a cara" (face to face) and "tens a tipo" for "tens a cara". Net harm.
+      // --- verbs / expressions ---
+      ['tomar café da manhã', 'tomar o pequeno-almoço'],
+      ['pegar o trem', 'apanhar o comboio'],
+      ['pegar o ônibus', 'apanhar o autocarro'],
+      // REMOVED after measurement: 'ligar para' -> 'telefonar a' is right only when the object
+      // is a person. On "get a hold of this" it produced "telefonar a isto". 0 wins, 1 loss.
+      ['bagunça', 'confusão'],
+      ['bacana', 'giro'], ['maneiro', 'giro'],
+      ['grana', 'dinheiro'],
+      ['trabalhar duro', 'trabalhar arduamente'],
+      // REMOVED after measurement:
+      //   'legal' -> 'fixe'   : 'legal' also means "lawful" in both variants. Too risky in a
+      //                         sermon ("a exigência legal"). One lucky hit, unbounded downside.
+      //   'virar' -> 'tornar-se': 'virar' is polysemous (turn / turn into / be around the corner)
+      //                         and 'tornar-se' is reflexive, so it cannot take the direct object
+      //                         'virar' takes. Produced "se tornar-se contra ele" (double
+      //                         reflexive) and "tornar-se a árvore genealógica". 3 breaks, 0 wins.
+      // --- religious register (safe, both understood, PT preference) ---
+      ['culto de domingo', 'culto de domingo'],
+      ['bispo', 'bispo'],
+    ];
+    
+    // Words that are genuinely different but too risky to swap blind, kept out on purpose:
+    //   fato (BR "suit" vs PT "fact") — homograph collision with the PT word we WANT.
+    //   fila / carro / entender / ótimo — used in both variants.
+    //   você — changing it requires re-conjugating the verb (see fixVoce).
+    
+    /* ----- gender flips -----
+     * Several pairs change grammatical gender ("a tela" f -> "o ecrã" m). Swapping the noun
+     * alone yields "na ecrã", which is ungrammatical. These entries carry the target gender so
+     * the determiner in front of them can be rewritten too. */
+    const GENDER_FLIP = new Map([
+      ['ecrã', 'm'], ['ecrãs', 'm'], ['frigorífico', 'm'], ['frigoríficos', 'm'],
+      ['sandes', 'f'], ['equipa', 'f'], ['equipas', 'f'], ['aplicação', 'f'], ['aplicações', 'f'],
+      ['casa de banho', 'f'], ['casas de banho', 'f'], ['rebuçado', 'm'], ['rebuçados', 'm'],
+      ['passeio', 'm'], ['portagem', 'f'], ['bairro de lata', 'm'], ['rabo', 'm'],
+      ['adeptos', 'm'], ['relva', 'f'], ['boleia', 'f'],
+    ]);
+    
+    // Determiners/contractions, feminine <-> masculine. Plural forms included.
+    const DET_F2M = {
+      a: 'o', as: 'os', uma: 'um', umas: 'uns', na: 'no', nas: 'nos', da: 'do', das: 'dos',
+      à: 'ao', às: 'aos', pela: 'pelo', pelas: 'pelos', esta: 'este', estas: 'estes',
+      essa: 'esse', essas: 'esses', aquela: 'aquele', aquelas: 'aqueles', minha: 'meu',
+      minhas: 'meus', tua: 'teu', tuas: 'teus', sua: 'seu', suas: 'seus', nossa: 'nosso',
+      nossas: 'nossos', vossa: 'vosso', vossas: 'vossos', toda: 'todo', todas: 'todos',
+      outra: 'outro', outras: 'outros', muita: 'muito', muitas: 'muitos', pouca: 'pouco',
+      alguma: 'algum', algumas: 'alguns', nenhuma: 'nenhum', primeira: 'primeiro',
+      mesma: 'mesmo', mesmas: 'mesmos', própria: 'próprio',
+    };
+    const DET_M2F = Object.fromEntries(Object.entries(DET_F2M).map(([f, m]) => [m, f]));
+    
+    const DET_ALT = Object.keys(DET_F2M).concat(Object.keys(DET_M2F))
+      .sort((a, b) => b.length - a.length).join('|');
+    
+    function matchCase(src, repl) {
+      if (src[0] === src[0].toUpperCase() && src[0] !== src[0].toLowerCase())
+        return repl[0].toUpperCase() + repl.slice(1);
+      return repl;
+    }
+    
+    const LEX_RE = LEXICON
+      .slice()
+      .sort((a, b) => b[0].length - a[0].length)   // longest match first
+      .map(([br, pt]) => {
+        const esc = br.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const g = GENDER_FLIP.get(pt);
+        // When the replacement flips gender, capture any determiner sitting in front of it.
+        return [RE(`(?:(${DET_ALT})\\s+)?${esc}`, 'gi'), pt, g];
+      });
+    
+    function fixLexicon(text) {
+      let out = text;
+      for (const [re, pt, gender] of LEX_RE) {
+        out = out.replace(re, (m, det) => {
+          const noun = matchCase(det ? m.slice(m.indexOf(det) + det.length).trimStart() : m, pt);
+          if (!det) return noun;
+          const map = gender === 'm' ? DET_F2M : gender === 'f' ? DET_M2F : null;
+          const fixed = map && map[det.toLowerCase()] ? matchCase(det, map[det.toLowerCase()]) : det;
+          return `${fixed} ${noun}`;
+        });
+      }
+      return out;
+    }
+    
+    // ---------- 5. the "fato" problem, handled narrowly ----------
+    // BR writes "o fato é que" / "de fato" where PT writes "facto". Only touch these fixed frames.
+    function fixFacto(text) {
+      return text
+        .replace(RE(`de fato`, 'gi'), m => matchCase(m, 'de facto'))
+        .replace(RE(`(o|O) fato (é|de|que)`, 'g'), (m, a, b) => `${a} facto ${b}`)
+        .replace(RE(`(os|Os) fatos`, 'g'), (m, a) => `${a} factos`);
+    }
+    
+    // ---------- 6. "você" — attempted narrowly, or not at all ----------
+    // A full você->tu rewrite needs verb re-conjugation across every tense: NOT attempted.
+    // What IS safe: dropping a redundant SUBJECT "você" before a 3sg verb. The remaining
+    // verb stays 3sg, which in pt-PT reads as the neutral/formal address. Grammatical, natural.
+    function fixVoce(text, { dropSubject = true } = {}) {
+      if (!dropSubject) return text;
+      let out = text;
+      // sentence-initial or post-comma "Você <verb>" -> "<verb>"  (only before estar/ir/ter/poder/dever forms
+      // and the "a + inf" progressive we just built, where 3sg is unambiguous)
+      out = out.replace(/(^|[.!?;]\s+|,\s+)([Vv]ocê)\s+(está|estava|estará|estaria|esteja|vai|ia|irá|tem|tinha|terá|pode|podia|poderá|deve|devia|deverá|precisa|precisava|quer|queria)\b/g,
+        (m, pre, v, verb) => {
+          const cap = /^[.!?;]?\s*$/.test(pre) || pre === '';
+          return pre + (cap ? verb.charAt(0).toUpperCase() + verb.slice(1) : verb);
+        });
+      // object "para você" -> "para si" (pt-PT formal).
+      // MUST use RE(): /\bpara você\b/ also fires inside "para vocês" (JS \b is ASCII-only, so
+      // the boundary after "ê" misbehaves), which produced "para sis". Plural is left alone.
+      out = out.replace(RE(`para você`, 'gi'), m => matchCase(m, 'para si'));
+      return out;
+    }
+    
+    // ---------- pipeline ----------
+    function localizeToEuropean(text, opts = {}) {
+      let t = text;
+      t = fixProgressive(t);
+      t = fixLexicon(t);
+      t = fixFacto(t);
+      if (opts.voce !== false) t = fixVoce(t);
+      return t;
+    }
+    
+    return { localizeToEuropean };
+  })();
+
+  const BR = (function () {
+    /*
+     * localize-br.mjs — deterministic EU->BR (Brazilian Portuguese) post-pass.
+     * Input: raw NLLB por_Latn output (which is ~8:1 European-marked on this corpus).
+     * Output: same text nudged toward pt-BR. Sibling of localize-pt.mjs; same design
+     * rule: every transformation must be SAFE — when unsure, leave it alone.
+     *
+     * Corrections vs the plan (PLAN-pt-and-local-voices.md item 1), all MEASURED on the
+     * 3941-sentence archive corpus:
+     *
+     *  (c) 2sg->3sg: the plan's regular rules ("present -as/-es -> -a/-e") are NOT run
+     *      as open regexes. Measured: 1469 corpus tokens end in -as/-es and ~83% are
+     *      plural nouns/determiners ("pessoas", "suas", "boas", "das", "vezes"). A
+     *      'follows tu' guard is useless the other way: only 18 tokens follow "tu",
+     *      but real 2sg verbs are pro-dropped everywhere ("sabes" x30, no "tu").
+     *      => WHITELIST of verified 2sg forms (irregulars + every regular 2sg form
+     *      actually observed in the corpus, each checked for noun homographs).
+     *      Excluded on homograph grounds: deste/destes (de+este contraction, 10x in
+     *      corpus, 0 as verb), vales (valleys), veste (3sg/noun), existe (-iste trap).
+     *      Hosts carrying an enclitic ("lembras-te", "tornas-te") are skipped: fixing
+     *      the verb while enclisis stays produces an imperative reading ("Lembra-te").
+     *
+     *  (b) enclitic->proclitic: the plan's "any non-clause-initial verb" rule was
+     *      measured against a strict attractor whitelist on all 408 corpus enclitics.
+     *      The plan rule moves 128 sentences; its only break class is imperatives
+     *      after a conjunction ("E deixe-o absorver" -> "E o deixe...", "Mas
+     *      ajuda-nos" -> "Mas nos ajuda" — imperative silently becomes declarative)
+     *      plus clitic-chain hosts ("Deixem-me dizer-vos" -> "Deixem-me vos dizer").
+     *      => shipped guard: move UNLESS the immediately-preceding token is a
+     *      conjunction/article/preposition-'a'/clitic (BLOCKERS) or any punctuation
+     *      intervenes (covers sentence/clause-initial and vocatives: "Deus,
+     *      deixe-nos..." stays). Never moves: l-forms (fazê-lo, vê-los — stem
+     *      changed; restoring the stem is only safe under estar-a where we control
+     *      both sides), n-forms after nasal hosts (louvem-no: 'no' may be 'o'; and
+     *      "matem-nos" may be 'us' or 'them' — genuinely ambiguous), gerund hosts
+     *      (BR enclisis to gerunds is natural), mesoclisis (0 in corpus, guarded).
+     *
+     *  (a) estar a + INF -> gerund: infinitive detection is shape + blocklist, not
+     *      shape alone. "está a caminho" self-filters (no -r), but feminine -r nouns
+     *      ("a par", "a colher", "a líder") would not: NOUN_R blocklist. Words of
+     *      length <=3 must be on a verb whitelist (ir/ver/dar/...). Clitic-carrying
+     *      infinitives are converted with the clitic riding the gerund: "está a
+     *      referir-se" -> "está se referindo", "está a castigá-lo" -> "está
+     *      castigando-o" (l-form stem restored — safe here because we build both
+     *      sides). Extended to continuar-family (5 corpus hits), same guards.
+     *
+     *  (d) lexicon: sumo->suco is guarded against "sumo sacerdote" (HIGH PRIEST — the
+     *      corpus's only 'sumo' is this one!). rezar->orar guarded against the
+     *      "reza a lenda / o ditado / assim" frame. rapariga->moça added (pejorative
+     *      in BR), miúdos->crianças (BR 'miúdos' = giblets) with determiner gender
+     *      flip, plus EP spellings NLLB emits (facto->fato x6, óptimo->ótimo).
+     *      'para si'/'consigo' deliberately NOT touched (EP 'you' vs BR reflexive —
+     *      polysemous, and misreading is harmless, not wrong-register).
+     *
+     *  Clitic 'te' is KEPT (plan policy: BR evangelical register mixes você+te).
+     */
+    
+    const LETTER = 'A-Za-zÀ-ÿ';
+    const RE = (body, flags = 'g') =>
+      new RegExp(`(?<![${LETTER}])(?:${body})(?![${LETTER}])`, flags);
+    
+    function matchCase(src, repl) {
+      if (src[0] === src[0].toUpperCase() && src[0] !== src[0].toLowerCase())
+        return repl[0].toUpperCase() + repl.slice(1);
+      return repl;
+    }
+    
+    // ============================ (a) estar a + INF -> gerund ============================
+    
+    // 'estar'/'estares'/'estarmos' included: "vou estar a preparar-me" (3 corpus hits
+    // were missed without the bare infinitive).
+    const ESTAR = '(?:estou|estás|está|estamos|estais|estão|estava|estavas|estávamos|estavam|estive|esteve|estivemos|estiveram|estarei|estarás|estará|estaremos|estarão|estaria|estarias|estariam|estivesse|estivesses|estivessem|estiver|estiveres|estivermos|estiverem|esteja|estejas|estejam|estejamos|estar|estares|estarmos)';
+    // continuar-family: same EU periphrasis, 5 corpus hits ("continua a andar").
+    const CONT = '(?:continuo|continuas|continua|continuamos|continuam|continuar|continuava|continuavam|continuou|continue|continuem)';
+    const AUX_A = `(?:${ESTAR}|${CONT})`;
+    
+    // -r words that are NOT infinitives (nouns/adjectives/advs). The corpus's non-verb
+    // "estar a X" cases self-filter on shape ("caminho", "morte", "fé"), but these
+    // would not. Feminine ones ("a par", "a colher") are the live risk.
+    const NOUN_R = new Set([
+      'ar', 'par', 'mar', 'lar', 'luar', 'bar', 'altar', 'açúcar', 'lugar', 'jantar',
+      'dólar', 'exemplar', 'militar', 'pilar', 'nectar', 'néctar', 'hangar', 'vulgar',
+      'mulher', 'colher', 'prazer', 'dever', 'poder', 'lazer', 'mister', 'qualquer',
+      'caráter', 'carácter', 'líder', 'éter', 'crer' /* keep? no: crer IS a verb */,
+      'mártir', 'elixir', 'nadir',
+    ]);
+    NOUN_R.delete('crer');
+    
+    // length<=3 words ending -r must be on this list to count as verbs.
+    const SHORT_VERB = new Set(['ir', 'ver', 'ler', 'dar', 'rir', 'ser', 'ter', 'vir', 'pôr']);
+    
+    const GER_IRREG = new Map([['pôr', 'pondo'], ['vir', 'vindo'], ['ir', 'indo']]);
+    
+    function infToGerund(w) {
+      const low = w.toLowerCase();
+      if (GER_IRREG.has(low)) return GER_IRREG.get(low);
+      if (NOUN_R.has(low)) return null;
+      if (low.length <= 3 && !SHORT_VERB.has(low)) return null;
+      if (/[çk]er$/.test(low)) return null;              // junk stems
+      if (low.endsWith('ar')) return low.slice(0, -2) + 'ando';
+      if (low.endsWith('er')) return low.slice(0, -2) + 'endo';
+      if (low.endsWith('ir')) return low.slice(0, -2) + 'indo';
+      if (low.endsWith('or') && /p[oô]r$/.test(low)) return low.slice(0, -2) + 'ondo'; // compor->compondo
+      return null;
+    }
+    
+    const CL_PRON = '(?:me|te|se|nos|vos|lhe|lhes)';
+    // One adverb may sit between the aux and 'a' ("Estou só a dizer-te").
+    const ADV = '(?:só|apenas|ainda|agora|sempre|mesmo|também|aqui|lá|hoje|realmente)';
+    
+    function fixEstarA(text) {
+      let out = text;
+      // 1. l-form enclitic on the infinitive: "está a castigá-lo" -> "está castigando-o".
+      //    Stem restoration is safe here because we synthesize both sides.
+      out = out.replace(
+        RE(`(${AUX_A})(\\s+(?:${ADV}\\s+)?)a\\s+([${LETTER}]+)([áêí])-l(o|a|os|as)`, 'gi'),
+        (m, aux, s1, stem, tv, cl) => {
+          const nd = tv === 'á' ? 'ando' : tv === 'ê' ? 'endo' : 'indo';
+          return `${aux}${s1}${stem}${nd}-${cl}`;
+        });
+      //    "está a pô-lo" -> "está pondo-o"
+      out = out.replace(
+        RE(`(${AUX_A})(\\s+)a\\s+p([ôo])-l(o|a|os|as)`, 'gi'),
+        (m, aux, s1, _o, cl) => `${aux}${s1}pondo-${cl}`);
+      // 1b. proclitic already between 'a' and the infinitive (NLLB emits this too):
+      //     "está a se realizar" -> "está se realizando".
+      out = out.replace(
+        RE(`(${AUX_A})(\\s+(?:${ADV}\\s+)?)a\\s+(${CL_PRON})\\s+([${LETTER}]+r)`, 'gi'),
+        (m, aux, s1, cl, inf) => {
+          const g = infToGerund(inf);
+          return g ? `${aux}${s1}${cl.toLowerCase()} ${g}` : m;
+        });
+      // 2. pronoun enclitic on the infinitive: "está a referir-se" -> "está se referindo".
+      out = out.replace(
+        RE(`(${AUX_A})(\\s+(?:${ADV}\\s+)?)a\\s+([${LETTER}]+r)-(${CL_PRON})`, 'gi'),
+        (m, aux, s1, inf, cl) => {
+          const g = infToGerund(inf);
+          return g ? `${aux}${s1}${cl.toLowerCase()} ${g}` : m;
+        });
+      // 3. plain: "está a falar" -> "está falando".
+      out = out.replace(
+        RE(`(${AUX_A})(\\s+(?:${ADV}\\s+)?)a\\s+([${LETTER}]+r)`, 'gi'),
+        (m, aux, s1, inf) => {
+          const g = infToGerund(inf);
+          return g ? `${aux}${s1}${g}` : m;
+        });
+      return out;
+    }
+    
+    // ============================ (b) enclitic -> proclitic ============================
+    
+    // Tokens whose presence right before the verb VETOES the move:
+    //  - conjunctions: enclisis after them is normal EP AND the verb is often an
+    //    imperative there ("E deixe-o...", "Mas ajuda-nos..."); moving flips the
+    //    reading to declarative.
+    //  - bare articles / the preposition-or-article 'a', 'o', 'os', 'as', 'à', 'ao':
+    //    the "prev" is then part of another phrase, not a proclisis licenser.
+    //  - clitics: prev is the tail of a preceding enclitic verb ("Deixem-me
+    //    dizer-vos" — the first verb governs; leave the chain alone).
+    const BLOCKERS = new Set([
+      'e', 'mas', 'ou', 'então', 'pois', 'porém', 'portanto', 'contudo', 'entretanto',
+      'a', 'o', 'os', 'as', 'à', 'ao', 'aos', 'às', 'um', 'uma', 'uns', 'umas',
+      'me', 'te', 'se', 'nos', 'vos', 'lhe', 'lhes',
+    ]);
+    // 'se' is genuinely both (conjunction-attractor vs clitic tail); as a clitic tail
+    // it follows a hyphen which the prev capture strips, so treat bare 'se' as an
+    // attractor EXCEPT we cannot tell — measured: corpus has no "se <verb>-<clitic>"
+    // where the 'se' was a clitic tail, so 'se' is removed from BLOCKERS below.
+    BLOCKERS.delete('se');
+    
+    const CL_ALL = '(?:me|te|se|nos|vos|lhe|lhes|lo|la|los|las|no|na|nas|o|a|os|as)';
+    
+    function fixEnclitic(text) {
+      return text.replace(
+        new RegExp(`([${LETTER}]+)(-?)([,;:]?)(\\s+)([${LETTER}]{3,})-(${CL_ALL})(-[${LETTER}]+)?(?![${LETTER}-])`, 'g'),
+        (m, prev, hyph, punct, sp, host, cl, tail) => {
+          if (tail) return m;                                   // mesoclisis — skip
+          const lcl = cl.toLowerCase(), lhost = host.toLowerCase();
+          if (/^l[oa]s?$/.test(lcl)) return m;                  // fazê-lo — stem changed, skip (NOT lhe/lhes!)
+          if (/^n/.test(lcl) && /(?:m|ão|õe|ões)$/.test(lhost)) return m; // louvem-no / matem-nos — ambiguous
+          if (lhost.endsWith('ndo')) return m;                  // gerund host — BR enclisis is fine
+          if (punct || hyph) return m;                          // clause boundary / clitic chain
+          if (BLOCKERS.has(prev.toLowerCase())) return m;
+          return `${prev}${sp}${lcl} ${host}`;
+        });
+    }
+    
+    // ============================ (c) tu-system -> você-system ============================
+    
+    // Verified 2sg forms only. Regular -s-drop is generated; irregulars are explicit.
+    const IRREG_2SG = {
+      'és': 'é', 'estás': 'está', 'tens': 'tem', 'vens': 'vem', 'vais': 'vai',
+      'dás': 'dá', 'vês': 'vê', 'pões': 'põe', 'lês': 'lê', 'crês': 'crê',
+      'queres': 'quer', 'podes': 'pode', 'sabes': 'sabe', 'dizes': 'diz',
+      'fazes': 'faz', 'trazes': 'traz', 'pedes': 'pede', 'ouves': 'ouve',
+      'queres': 'quer',
+      // preterite irregulars
+      'foste': 'foi', 'fizeste': 'fez', 'disseste': 'disse', 'viste': 'viu',
+      'tiveste': 'teve', 'vieste': 'veio', 'puseste': 'pôs', 'quiseste': 'quis',
+      'soubeste': 'soube', 'estiveste': 'esteve', 'trouxeste': 'trouxe',
+      // NOTE: 'deste'/'destes' (you gave) EXCLUDED — corpus has them 10x, all as the
+      // de+este contraction. 'vales' EXCLUDED (valleys, in corpus).
+    };
+    // Regular present/imperfect/conditional 2sg observed in the corpus (each checked
+    // against noun homographs in context) + a few universal verb-dominant forms.
+    const REG_2SG = [
+      'precisas', 'andas', 'pensas', 'lembras', 'achas', 'consegues', 'preparas',
+      'unges', 'sentes', 'gostas', 'entendes', 'reparas', 'confias', 'usas',
+      'deixas', 'ficas', 'bebes', 'pecas', 'colocas', 'procuras', 'esperas',
+      'imaginas', 'conheces', 'caminhas', 'paras', 'arriscas', 'pagas',
+      'continuas', 'percebes', 'mereces', 'ofereces', 'pertences', 'estabeleces',
+      'castigas', 'disciplinas', 'rezas', 'falas', 'amas', 'chamas', 'chegas',
+      'moras', 'trabalhas', 'levas', 'olhas', 'louvas',
+      'adoras', 'vives', 'escreves', 'aprendes', 'recebes', 'vences',
+      'perdes', 'abres', 'sentas', 'voltas', 'entras', 'ganhas',
+      // EXCLUDED noun homographs: partes (body parts, 4x in corpus), buscas
+      // (searches), guardas (guards), vias (roads), vales (valleys), contas (bills).
+      // imperfect / conditional (-as -> -a)
+      'eras', 'tinhas', 'estavas', 'devias', 'podias', 'sabias', 'farias',
+      'querias', 'ias', 'vinhas', 'davas', 'fazias', 'dizias',
+      // MEASURED EXTENSION beyond the plan (which said "do not touch subjunctive"):
+      // 2sg SUBJUNCTIVE forms convert to 3sg by the same s-drop, and every form below
+      // was verified in corpus context. Excluding them leaves the text half-converted
+      // ("você" subjects next to "se conseguires"). Present subjunctive:
+      'preocupes', 'faças', 'saibas', 'sejas', 'estejas', 'venhas', 'chames',
+      'levantes', 'deixes', 'olhes', 'percas', 'fiques', 'envelheças', 'entres',
+      'respondas', 'coloques', 'acredites', 'consigas', 'desistas', 'penses',
+      'vejas', 'digas', 'grites', 'julgues', 'demores', 'gostes', 'apareças',
+      'certifiques', 'relaxes', 'enroles', 'detestes',
+      // imperfect subjunctive (s-drop):
+      'pudesses', 'estivesses', 'fizesses', 'tivesses',
+      // EXCLUDED: 'vivas' (adjective: "línguas vivas"), 'vires' (ver-vs-vir ambiguity).
+      // regular preterite observed in corpus (+ common safe ones)
+      'percebeste', 'conheceste', 'recebeste', 'conseguiste', 'passaste',
+      'paraste', 'achaste', 'sentiste', 'acordaste', 'escolheste', 'compraste',
+      'tomaste', 'dormiste', 'criaste', 'voltaste', 'forçaste', 'encontraste',
+      'preparaste', 'apareceste', 'falaste', 'amaste', 'deixaste', 'olhaste',
+      'perdeste', 'viveste', 'ouviste', 'pediste', 'abriste', 'decidiste',
+      'entregaste', 'ganhaste', 'chegaste', 'entraste', 'levaste', 'salvaste',
+    ];
+    function reg2sgTo3sg(w) {
+      if (/aste$/.test(w)) return w.slice(0, -4) + 'ou';
+      if (/este$/.test(w)) return w.slice(0, -4) + 'eu';
+      if (/iste$/.test(w)) return w.slice(0, -4) + 'iu';
+      if (/s$/.test(w)) return w.slice(0, -1);   // present/imperfect/conditional
+      return null;
+    }
+    // Future subjunctive / personal infinitive 2sg: 3sg drops '-es', not '-s'
+    // ("se quiseres" -> "se quiser"). Explicit map, corpus-verified forms only.
+    const FUTSUBJ_2SG = {
+      quiseres: 'quiser', tiveres: 'tiver', fizeres: 'fizer', estiveres: 'estiver',
+      conseguires: 'conseguir', acabares: 'acabar', chamares: 'chamar',
+      entrares: 'entrar', morreres: 'morrer', perceberes: 'perceber',
+      desceres: 'descer', disseres: 'disser', acreditares: 'acreditar',
+      forjares: 'forjar', precisares: 'precisar', destacares: 'destacar',
+      fazeres: 'fazer', acordares: 'acordar',
+    };
+    const MAP_2SG = new Map(Object.entries(IRREG_2SG));
+    for (const w of REG_2SG) { const t = reg2sgTo3sg(w); if (t) MAP_2SG.set(w, t); }
+    for (const [w, t] of Object.entries(FUTSUBJ_2SG)) MAP_2SG.set(w, t);
+    const RE_2SG = new RegExp(
+      `(?<![${LETTER}])(${[...MAP_2SG.keys()].sort((a, b) => b.length - a.length).join('|')})(?![${LETTER}-])`, 'gi');
+    //                                                            ^ trailing '-' guard: skip "lembras-te" etc.
+    
+    function fixTuSystem(text) {
+      let out = text;
+      out = out.replace(RE_2SG, m => matchCase(m, MAP_2SG.get(m.toLowerCase()) || m));
+      out = out.replace(RE('contigo', 'gi'), m => matchCase(m, 'com você'));
+      out = out.replace(RE('convosco', 'gi'), m => matchCase(m, 'com vocês'));
+      out = out.replace(RE('tu', 'gi'), m => matchCase(m, 'você'));
+      out = out.replace(RE('ti', 'gi'), m => matchCase(m, 'você'));
+      out = out.replace(RE('teu', 'gi'), m => matchCase(m, 'seu'));
+      out = out.replace(RE('tua', 'gi'), m => matchCase(m, 'sua'));
+      out = out.replace(RE('teus', 'gi'), m => matchCase(m, 'seus'));
+      out = out.replace(RE('tuas', 'gi'), m => matchCase(m, 'suas'));
+      out = out.replace(RE('vosso', 'gi'), m => matchCase(m, 'seu'));
+      out = out.replace(RE('vossa', 'gi'), m => matchCase(m, 'sua'));
+      out = out.replace(RE('vossos', 'gi'), m => matchCase(m, 'seus'));
+      out = out.replace(RE('vossas', 'gi'), m => matchCase(m, 'suas'));
+      out = out.replace(RE('vós', 'gi'), m => matchCase(m, 'vocês'));
+      // clitic 'te' KEPT on purpose (BR evangelical register). 2pl 'vos' also kept:
+      // "eu vos peço" is normal BR liturgical speech.
+      return out;
+    }
+    
+    // ============================ (d) lexicon + spelling ============================
+    
+    // [EP form, BR form, BR gender if the swap flips the determiner]
+    const LEXICON = [
+      ['telemóvel', 'celular'], ['telemóveis', 'celulares'],
+      ['autocarro', 'ônibus'], ['autocarros', 'ônibus'],
+      ['comboio', 'trem'], ['comboios', 'trens'],
+      ['casa de banho', 'banheiro', 'm'], ['casas de banho', 'banheiros', 'm'],
+      ['ecrã', 'tela', 'f'], ['ecrãs', 'telas', 'f'],
+      ['equipa', 'equipe'], ['equipas', 'equipes'],
+      ['connosco', 'conosco'],
+      ['pequeno-almoço', 'café da manhã'], ['pequenos-almoços', 'cafés da manhã'],
+      ['registo', 'registro'], ['registos', 'registros'],
+      ['rapariga', 'moça'], ['raparigas', 'moças'],     // pejorative in BR — must swap
+      ['miúdos', 'crianças', 'f'],                       // BR 'miúdos' = giblets
+      ['peúgas', 'meias'], ['peúga', 'meia'],
+      ['desporto', 'esporte'], ['desportos', 'esportes'],
+      ['desportivo', 'esportivo'], ['desportiva', 'esportiva'],
+      ['frigorífico', 'geladeira', 'f'], ['frigoríficos', 'geladeiras', 'f'],
+      ['portagem', 'pedágio', 'm'], ['autoclismo', 'descarga', 'f'],
+      ['boleia', 'carona'], ['fiambre', 'presunto', 'm'],
+      ['relvado', 'gramado'], ['relva', 'grama'],
+      ['sumos', 'sucos'],
+      // EP spellings NLLB actually emits (facto x6, óptimo x1 in corpus):
+      ['facto', 'fato'], ['factos', 'fatos'],
+      ['óptimo', 'ótimo'], ['óptima', 'ótima'], ['óptimos', 'ótimos'], ['óptimas', 'ótimas'],
+      ['contacto', 'contato'], ['contactos', 'contatos'],
+      ['os polícias', 'os policiais'], ['dois polícias', 'dois policiais'],  // EP masc. noun
+      // DELIBERATELY EXCLUDED:
+      //   sumo (bare)      — handled below with the 'sumo sacerdote' guard.
+      //   fixe->legal      — 'fixe' is also the subjunctive of fixar.
+      //   giro->legal      — 'giro' is also a noun (spin/round).
+      //   apelido          — EP surname vs BR nickname: conversion can invert meaning.
+      //   para si/consigo  — EP 'you' vs BR reflexive; polysemous, left alone.
+      //   miúdo (singular) — also the adjective 'tiny'.
+    ];
+    const DET_F2M = {
+      a: 'o', as: 'os', uma: 'um', umas: 'uns', na: 'no', nas: 'nos', da: 'do', das: 'dos',
+      'à': 'ao', 'às': 'aos', pela: 'pelo', pelas: 'pelos', esta: 'este', estas: 'estes',
+      essa: 'esse', essas: 'esses', aquela: 'aquele', aquelas: 'aqueles', minha: 'meu',
+      minhas: 'meus', sua: 'seu', suas: 'seus', nossa: 'nosso', nossas: 'nossos',
+      toda: 'todo', todas: 'todos', outra: 'outro', outras: 'outros', muita: 'muito',
+      muitas: 'muitos', alguma: 'algum', algumas: 'alguns', nenhuma: 'nenhum',
+      mesma: 'mesmo', mesmas: 'mesmos', 'própria': 'próprio', 'próprias': 'próprios',
+    };
+    const DET_M2F = Object.fromEntries(Object.entries(DET_F2M).map(([f, m]) => [m, f]));
+    const DET_ALT = Object.keys(DET_F2M).concat(Object.keys(DET_M2F))
+      .sort((a, b) => b.length - a.length).join('|');
+    
+    const LEX_RE = LEXICON
+      .slice()
+      .sort((a, b) => b[0].length - a[0].length)
+      .map(([ep, br, g]) => {
+        const esc = ep.replace(/[.*+?^${}()|[\]\\]/g, '\\$&').replace(/ /g, '\\s+');
+        return [RE(`(?:(${DET_ALT})\\s+)?${esc}`, 'gi'), br, g || null];
+      });
+    
+    function fixLexicon(text) {
+      let out = text;
+      for (const [re, br, gender] of LEX_RE) {
+        out = out.replace(re, (m, det) => {
+          const word = matchCase(det ? m.slice(m.indexOf(det) + det.length).trimStart() : m, br);
+          if (!det) return word;
+          const map = gender === 'm' ? DET_F2M : gender === 'f' ? DET_M2F : null;
+          const fixed = map && map[det.toLowerCase()] ? matchCase(det, map[det.toLowerCase()]) : det;
+          return `${fixed} ${word}`;
+        });
+      }
+      // 'sumo' -> 'suco' ONLY when it is not the adjective 'supreme'. The corpus's one
+      // and only 'sumo' is "sumo sacerdote" (high priest) — the blind swap would have
+      // produced "suco sacerdote" (juice priest).
+      out = out.replace(
+        new RegExp(`(?<![${LETTER}])sumo(?!\\s+(?:sacerdote|sacerdotes|pontífice|bem|grau))(?![${LETTER}])`, 'gi'),
+        m => matchCase(m, 'suco'));
+      // rezar -> orar (BR evangelical register), guarded against the 'the text reads'
+      // sense ("reza a lenda", "como reza o ditado", "reza assim").
+      out = out.replace(
+        new RegExp(`(?<![${LETTER}])rez(ar|ando|o|amos|am|a|e|em|es|ei|ou|aram|ava|avam|asse|assem)(?!\\s+(?:a\\s+lenda|o\\s+ditado|assim))(?![${LETTER}])`, 'gi'),
+        (m, suf) => matchCase(m, 'or' + suf.toLowerCase()));
+      return out;
+    }
+    
+    // ============================ pipeline ============================
+    
+    function localizeToBrazilian(text) {
+      let t = text;
+      t = fixEstarA(t);      // before enclitic pass: consumes "a INF-clitic" itself
+      t = fixEnclitic(t);
+      t = fixTuSystem(t);    // after enclitic: moved clitics expose clean verb hosts
+      t = fixLexicon(t);
+      return t;
+    }
+    
+    return { localizeToBrazilian };
+  })();
+
+  return {
+    toEuropean: (t) => EU.localizeToEuropean(String(t || '')),
+    toBrazilian: (t) => BR.localizeToBrazilian(String(t || ''))
+  };
+}));

app/selftest.html

@@ -0,0 +1,23 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<title>Church Translate — self test</title>
+<meta http-equiv="Content-Security-Policy" content="
+  default-src 'self'; script-src 'self' 'wasm-unsafe-eval' blob:; worker-src 'self' blob:;
+  connect-src 'self' https: data: blob:; img-src 'self' data:; style-src 'self' 'unsafe-inline';">
+<style>
+  body { font: 14px -apple-system, system-ui, sans-serif; background:#0b0d12; color:#eef1f6; padding:2rem; }
+  pre { background:#151922; padding:1rem; border-radius:8px; white-space:pre-wrap; line-height:1.6; }
+  .ok { color:#2fbf71; } .bad { color:#e5484d; }
+</style>
+</head>
+<body>
+<h1>Self test</h1>
+<p>Runs a known sentence through both model workers and prints what comes out.</p>
+<pre id="out">starting…</pre>
+
+<script src="./server/public/languages.js"></script>
+<script type="module" src="./selftest.js"></script>
+</body>
+</html>

app/selftest.js

@@ -0,0 +1,154 @@
+/*
+ * Proves the model half of the engine works without needing any audio hardware:
+ * a known WAV goes in, a transcript and translations come out. When something
+ * is wrong on a Sunday, this separates "the AI is broken" from "the audio
+ * routing is wrong" in about a minute.
+ */
+const out = document.getElementById('out');
+const lines = [];
+function say(msg, cls) {
+  lines.push(msg);
+  out.innerHTML = lines.map((l) => l.startsWith('FAIL') ? '<span class="bad">' + l + '</span>'
+                                : l.startsWith('PASS') ? '<span class="ok">' + l + '</span>' : l).join('\n');
+  console.log('[selftest] ' + msg);
+}
+
+function makeWorker(label, task, model, dtype, fallback) {
+  return new Promise((resolve, reject) => {
+    const w = new Worker(new URL('./model-worker.js', import.meta.url), { type: 'module' });
+    w.onerror = (e) => reject(new Error(e.message || 'worker error'));
+    w.onmessage = (e) => {
+      const m = e.data;
+      if (m.type === 'gpu') { say('  gpu: ' + (m.features.includes('shader-f16') ? 'shader-f16 present' : 'no shader-f16')); return; }
+      if (m.type === 'ready') { resolve(w); return; }
+      if (m.type === 'loadError') {
+        if (fallback && /f16|fp16/i.test(m.message)) {
+          say('  ' + label + ': no fp16, retrying with integer weights');
+          w.terminate();
+          makeWorker(label, task, model, fallback, null).then(resolve, reject);
+          return;
+        }
+        reject(new Error(m.message));
+      }
+    };
+    w.postMessage({ type: 'load', label, task, model, dtype });
+  });
+}
+
+let seq = 0;
+const pending = new Map();
+function run(worker, input, options, transfer) {
+  return new Promise((resolve, reject) => {
+    const id = ++seq;
+    pending.set(id, { resolve, reject });
+    const prev = worker.onmessage;
+    worker.onmessage = (e) => {
+      const m = e.data;
+      if (m.type === 'result' || m.type === 'error') {
+        const p = pending.get(m.id);
+        if (p) { pending.delete(m.id); m.type === 'result' ? p.resolve(m.out) : p.reject(new Error(m.message)); }
+        return;
+      }
+      if (prev) prev(e);
+    };
+    worker.postMessage({ type: 'run', id, input, options }, transfer || []);
+  });
+}
+
+const ARGS = new URLSearchParams(location.search);
+
+(async () => {
+  let failures = 0;
+  try {
+    const cfg = await window.engineHost.getConfig();
+    /* ?mt=q4f16 overrides the configured weights, and ?skipAsr=1 skips the
+       speech model — loading it costs ~50s and it is not what we are testing
+       when we are iterating on translation. */
+    const mtDtype = ARGS.get('mt') || cfg.mtDtype || 'fp16';
+    const skipAsr = ARGS.get('skipAsr') === '1';
+    say('translation weights under test: ' + mtDtype + (skipAsr ? '  (speech model skipped)' : ''));
+
+    say('loading audio…');
+    const buf = await (await fetch('./selftest.wav')).arrayBuffer();
+    const ctx = new OfflineAudioContext(1, 1, 16000);
+    const decoded = await ctx.decodeAudioData(buf);
+    const audio = decoded.getChannelData(0);
+    say('  ' + decoded.duration.toFixed(1) + 's at ' + decoded.sampleRate + ' Hz');
+
+    let text = 'Good morning, church. Turn with me to Habakkuk, chapter one. ' +
+               'How long, O Lord, must I call for help, and you will not listen?';
+    if (!skipAsr) {
+    say('loading speech model…');
+    const t0 = performance.now();
+    const asr = await makeWorker('speech', 'automatic-speech-recognition', cfg.asrModel,
+      { encoder_model: 'fp16', decoder_model_merged: 'q4' },
+      { encoder_model: 'q4', decoder_model_merged: 'q4' });
+    say('  ready in ' + ((performance.now() - t0) / 1000).toFixed(1) + 's');
+
+    say('transcribing…');
+    const t1 = performance.now();
+    const res = await run(asr, audio.slice(), { language: 'en', task: 'transcribe', return_timestamps: false });
+    const elapsed = (performance.now() - t1) / 1000;
+    text = (Array.isArray(res) ? res.map((r) => r.text).join(' ') : res.text).trim();
+    say('  "' + text + '"');
+    say('  ' + elapsed.toFixed(1) + 's for ' + decoded.duration.toFixed(1) + 's of audio  ('
+        + (decoded.duration / elapsed).toFixed(1) + '× real time)');
+
+    const lower = text.toLowerCase();
+    if (lower.includes('habakkuk')) say('PASS  heard "Habakkuk"');
+    else { say('FAIL  did not hear "Habakkuk" — got: ' + text); failures++; }
+    if (lower.includes('how long')) say('PASS  heard "how long"');
+    else { say('FAIL  did not hear "how long"'); failures++; }
+    if (decoded.duration / elapsed > 1) say('PASS  faster than real time');
+    else { say('FAIL  slower than real time — will fall behind a preacher'); failures++; }
+    }
+
+    say('loading translation model…');
+    const t2 = performance.now();
+    window.engineHost.onMtProgress(() => {});
+    await window.engineHost.mtEnsure();
+    say('  ready in ' + ((performance.now() - t2) / 1000).toFixed(1) + 's');
+
+    /* Catch the failure mode that quantized NLLB produces: fluent-looking
+       output made of tokens from a dozen unrelated languages. Checking the
+       script is cheap and catches it every time — an empty-or-identical check
+       does not. */
+    const SCRIPT = {
+      spa_Latn: { want: /[a-z\u00c0-\u024f]/i, banned: /[\u4e00-\u9fff\u0600-\u06ff\uac00-\ud7af\u0400-\u04ff\u0900-\u097f]/ },
+      hat_Latn: { want: /[a-z\u00c0-\u024f]/i, banned: /[\u4e00-\u9fff\u0600-\u06ff\uac00-\ud7af\u0400-\u04ff\u0900-\u097f]/ },
+      zho_Hans: { want: /[\u4e00-\u9fff]/,     banned: /[\uac00-\ud7af\u0600-\u06ff]/ },
+      kor_Hang: { want: /[\uac00-\ud7af]/,     banned: /[\u0600-\u06ff]/ },
+      arb_Arab: { want: /[\u0600-\u06ff]/,     banned: /[\u4e00-\u9fff\uac00-\ud7af]/ }
+    };
+
+    function scriptOk(text, lang) {
+      const rule = SCRIPT[lang];
+      if (!rule) return true;
+      if (!rule.want.test(text)) return false;
+      if (rule.banned.test(text)) return false;
+      return true;
+    }
+
+    const targets = ['spa_Latn', 'zho_Hans', 'kor_Hang', 'hat_Latn', 'arb_Arab'];
+    say('translating into ' + targets.length + ' languages…');
+    const t3 = performance.now();
+    for (const tgt of targets) {
+      const one = performance.now();
+      const got = (await window.engineHost.mtTranslate({ text, src: 'eng_Latn', tgt })).trim();
+      const name = window.Languages.get(tgt).name;
+      say('  ' + name.padEnd(20) + ((performance.now() - one) / 1000).toFixed(2) + 's  ' + got.slice(0, 120));
+      if (!got || got === text) { say('FAIL  ' + name + ' came back empty or untranslated'); failures++; }
+      else if (!scriptOk(got, tgt)) { say('FAIL  ' + name + ' is not in the right script — quantized-model gibberish'); failures++; }
+      else say('PASS  ' + name + ' is real ' + name);
+    }
+    const total = (performance.now() - t3) / 1000;
+    say('  ' + total.toFixed(1) + 's for all ' + targets.length);
+    if (total < 5) say('PASS  all languages inside 5s');
+    else { say('FAIL  ' + total.toFixed(1) + 's is too slow for live use'); failures++; }
+
+  } catch (e) {
+    say('FAIL  ' + (e && e.message || e));
+    failures++;
+  }
+  say(failures ? ('SELFTEST: ' + failures + ' FAILED') : 'SELFTEST: all passed');
+})();

app/server/aac-encode.js

@@ -0,0 +1,83 @@
+'use strict';
+/*
+ * aac-encode.js — the ONE ADTS AAC encoder for the whole app.
+ *
+ * ADTS, not MP4: every frame carries its own header and length, which is what
+ * lets live-audio.js splice sentences from different clips into one continuous
+ * stream a phone can play with its screen locked. Do not "improve" this to an
+ * .m4a — its moov box describes the whole file up front and cannot be spliced.
+ *
+ * macOS uses /usr/bin/afconvert, which ships with the OS and costs the app
+ * nothing. Windows has no such tool, so it uses a bundled LGPL ffmpeg. That is
+ * the whole platform difference, and it lives here rather than at the five
+ * call sites — with one exception that callers DO have to read from here:
+ * the two encoders prepend different amounts of priming (see PRIMING_FRAMES).
+ */
+const fs = require('fs');
+const path = require('path');
+const { execFileSync } = require('child_process');
+
+const WIN = process.platform === 'win32';
+
+/*
+ * Finding ffmpeg from a FORKED CHILD. server.js and tts-service.js are plain
+ * node processes, so `process.resourcesPath` — an Electron-only property —
+ * is undefined in them. main.js puts the resolved path in the environment
+ * before forking; the other candidates are for running a child standalone.
+ */
+let ffmpegPath = null;
+function ffmpeg() {
+  if (ffmpegPath) return ffmpegPath;
+  const candidates = [
+    process.env.CT_FFMPEG,
+    path.join(process.resourcesPath || '', 'ffmpeg.exe'),
+    path.join(__dirname, '..', 'vendor-win', 'ffmpeg.exe')
+  ].filter(Boolean);
+  for (const c of candidates) {
+    try { if (fs.existsSync(c) && fs.statSync(c).isFile()) { ffmpegPath = c; return c; } } catch (_) {}
+  }
+  throw new Error('ffmpeg was not found — it is what encodes audio for phones.');
+}
+
+/*
+ * Samples of encoder priming, in 1024-sample AAC frames, that every clip
+ * carries at its front and the stream must drop.
+ *
+ * ADTS has no edit list to declare priming, so a decoder plays it as dead
+ * silence at every sentence join. MEASURED by cross-correlating the decoded
+ * clip against its source WAV at 16000 / 22050 / 24000 Hz on real speech:
+ *
+ *   afconvert   2112 samples  -> strip 2 frames  (64 samples remain; the
+ *                                debt ledger in pushContinuous eats them)
+ *   ffmpeg      1024 samples  -> strip 1 frame   (exactly one, no remainder)
+ *
+ * Getting it wrong costs real words: ffmpeg stripped at 2 keeps only 77% of
+ * the onset energy — the same damage the old comment warns about for
+ * afconvert at 3. The +64/chunk sample-debt arithmetic is IDENTICAL under both
+ * encoders (verified: 11264 samples emitted for 11200 in, either way), so it
+ * needs no platform branch. Do not change without re-measuring.
+ */
+const PRIMING_FRAMES = WIN ? 1 : 2;
+
+/*
+ * Encode a mono 16-bit WAV to ADTS AAC at a PINNED sample rate.
+ *
+ * Pinned because a language's HLS stream carries one rate for its whole life;
+ * a clip at another rate makes the stream rebuild and dumps everything queued.
+ * 48 kbps everywhere — at 32 kbps afconvert silently resamples the input.
+ * `rate` may be omitted to keep the WAV's own rate (the silence generator).
+ */
+function encodeAdts(wavPath, outPath, rate) {
+  if (WIN) {
+    const args = ['-hide_banner', '-loglevel', 'error', '-nostdin', '-y',
+                  '-i', wavPath, '-f', 'adts', '-c:a', 'aac', '-b:a', '48k', '-ac', '1'];
+    if (rate) args.push('-ar', String(rate));
+    args.push('-map_metadata', '-1', outPath);
+    execFileSync(ffmpeg(), args, { windowsHide: true });
+  } else {
+    execFileSync('/usr/bin/afconvert',
+      ['-f', 'adts', '-d', rate ? ('aac@' + rate) : 'aac', '-b', '48000', wavPath, outPath]);
+  }
+}
+
+module.exports = { encodeAdts, PRIMING_FRAMES };

app/server/live-audio.js

@@ -0,0 +1,676 @@
+/*
+ * live-audio.js — one continuous audio stream per language, as live HLS.
+ *
+ * WHY THIS EXISTS, because the obvious design is the one that fails:
+ *
+ * The natural thing is to send each sentence to the phone as its own little
+ * clip and play it. That is what this app did, and it cannot survive a locked
+ * screen. WebKit decides background behaviour from the media TYPE: an
+ * AudioContext is MediaType::WebAudio, which is restricted in the background,
+ * while an <audio> element is MediaType::Audio, which is not restricted at all.
+ * Web Audio is on the wrong side of that line by construction — no amount of
+ * keep-alive trickery moves it.
+ *
+ * Worse, iOS keeps a locked page's JavaScript and its WebSocket alive only
+ * while the page is continuously AUDIBLE. Stop making sound and a ten-second
+ * timer suspends the whole process. Ordinary pauses in a sermon are longer than
+ * ten seconds, so any per-sentence design loses its socket mid-service and
+ * cannot get it back until someone unlocks the phone.
+ *
+ * So the stream never stops. When nobody is speaking it carries encoded
+ * silence, which WebKit counts as audible (it never inspects sample values),
+ * which holds the process alive, which keeps the next sentence arriving. Idle
+ * silence costs about 1.9 kbit/s — 264 bytes per second per language.
+ *
+ * The audio also arrives over plain HTTP fetches driven by the media stack
+ * rather than over the WebSocket, so even if the socket does die while locked,
+ * the voice keeps playing and only the captions pause.
+ *
+ * A happy side effect: an audible media element puts the page in the
+ * MediaPlayback audio category instead of AmbientSound, so the ringer switch
+ * stops silencing it. Listeners with their phone on silent could not hear this
+ * app at all before.
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { encodeAdts, PRIMING_FRAMES } = require('./aac-encode.js');
+
+/* 1024 samples per AAC frame is fixed by the codec. At 22050 Hz that is
+   46.44 ms, so ~21 frames make a segment just under a second. Short segments
+   keep the live edge close; HLS players start roughly three segments back. */
+/*
+ * Segment and window sizes are TIME — each stream derives frame counts from
+ * its own sample rate. A fixed count that gives 0.7s at 22050 Hz gives 0.35s
+ * at 44100 and shrinks retention into rotate-out failures. 0.70s segments
+ * (down from 0.975) move the live edge ~0.3-0.5s closer to now.
+ */
+const SEGMENT_SEC = 0.70;
+/* ~12s of window. 8 (~7.8s) left players almost no slack: one brief stall and
+   the segment they wanted next had already rotated out, which reads as a fatal
+   error. Segments are a few hundred bytes of silence or 1-2 KB of speech, so
+   the memory cost of the extra headroom is nothing. */
+const WINDOW_SEC = 11;
+
+/*
+ * How much slack the continuous (microphone) feed carries. Paid once as delay,
+ * and it is the difference between a hiccup being absorbed and a hiccup being
+ * a hole in the middle of a word. The hardware output path does not go through
+ * here at all, so this costs the assistive-listening packs nothing.
+ */
+const CONTINUOUS_CUSHION_MS = 700;
+/* A persistently jittery feed grows its cushion rather than skipping, but not
+   past this — beyond about two seconds the delay is its own problem. */
+const CONTINUOUS_CUSHION_MAX_MS = 2100;
+
+/*
+ * Extra retention, in seconds, on top of the window.
+ *
+ * A delayed listener is served the SAME segments as the room, just starting
+ * further back — there is only one sliding window per language and nothing to
+ * send "late" to one listener over HTTP. So the window has to still contain
+ * what they are about to ask for: retention must cover the stream delay as
+ * well as the normal player slack, or their next segment has already rotated
+ * out and the page reports a fatal error.
+ *
+ * Cheap enough not to think about: audio is 48 kbps, so a 60-second reserve is
+ * about 360 KB per language — under 5 MB for a dozen languages.
+ */
+let reserveSec = 0;
+
+/*
+ * The stream plays at exactly 1x real time, so anything that queues faster than
+ * that falls behind FOREVER — the gap never closes on its own. Translated
+ * speech routinely runs longer than the original (Spanish especially), so
+ * without a cap the voice ends up minutes behind the preacher by the end of a
+ * sermon while every caption is current.
+ *
+ * When the backlog passes MAX, drop the OLDEST whole sentences until it is back
+ * under TARGET. Oldest, because in live translation the stale sentence is the
+ * worthless one — and whole sentences, because chopping mid-word is worse than
+ * skipping. The caption for anything dropped is already on screen.
+ */
+/*
+ * MEASURED against a real service (2026-09-13, 377 sentences replayed through
+ * this very module): at 6/3 the dropper threw away 73 sentences — 19.4% of the
+ * sermon — and the median dropped sentence was 3.0 s old. It was not
+ * trimming stale drift; it was firing on ordinary same-breath bursts, where
+ * one final becomes 2-4 sentences whose clips land together. The stream then
+ * drained in under 2 s and sat empty until the next clip: the "skip" and the
+ * "quiet" were two halves of one event.
+ *
+ * Two changes, both measured on the replay. Wider thresholds (9/6): 73 -> 28.
+ * Plus the rule below — only a sentence whose CAPTION is at least
+ * STALE_CAPTION_SEC old may be dropped: 73 -> 16 (4.2%), and every one of
+ * those was genuinely stale. Gating on time since push instead was tried and
+ * rejected: after any supply stall the flushed backlog is "fresh" by push
+ * time, and that variant played 94 s of stale audio.
+ */
+const MAX_BACKLOG_SEC = 9;
+const TARGET_BACKLOG_SEC = 6;
+const STALE_CAPTION_SEC = 6;
+
+/*
+ * Silence appended after each sentence. Sentences are synthesised separately
+ * and butted together with no gap at all, which is what makes a stream of them
+ * sound blocky and rushed — real speech breathes between sentences.
+ *
+ * But the pause is AUDIO, and audio is exactly what we are short of when
+ * running behind: 320ms on a 2s sentence is another 16% of drift. So the pause
+ * is a luxury spent only when the stream is keeping up. Caught up, it breathes;
+ * behind, it gets on with it. That is what a human interpreter does too.
+ */
+const SENTENCE_GAP_MS = 320;
+/* Raised with TARGET, or the breath between sentences would be squeezed to
+   nothing on 97% of sentences at the new steady state (measured). */
+const GAP_COMFORT_SEC = 1.5;    // below this backlog, take the full pause
+const GAP_SQUEEZE_SEC = 4.0;    // above this, no pause at all
+
+/* How often the pump wakes. Not once per frame — that would be 21 timers a
+   second per language for no benefit. It emits however many frames the wall
+   clock says are due. */
+const TICK_MS = 240;
+
+const SILENCE_DIR = path.join(require('os').tmpdir(), 'church-translate-silence');
+
+// ------------------------------------------------------------------ ADTS
+
+/*
+ * Split an ADTS file into whole frames. Every frame starts with a 12-bit sync
+ * word and carries its own length, so a stream is just frames concatenated —
+ * which is exactly what makes this container splice-able and MP4 not.
+ */
+function adtsFrames(buf) {
+  const out = [];
+  let off = 0;
+  while (off + 7 <= buf.length) {
+    if (buf[off] !== 0xff || (buf[off + 1] & 0xf0) !== 0xf0) break;
+    const len = ((buf[off + 3] & 0x03) << 11) | (buf[off + 4] << 3) | (buf[off + 5] >> 5);
+    if (len < 7 || off + len > buf.length) break;
+    out.push(buf.subarray(off, off + len));
+    off += len;
+  }
+  return out;
+}
+
+function adtsSampleRate(buf) {
+  const TABLE = [96000, 88200, 64000, 48000, 44100, 32000, 24000, 22050, 16000, 12000, 11025, 8000];
+  if (buf.length < 4 || buf[0] !== 0xff) return 0;
+  return TABLE[(buf[2] & 0x3c) >> 2] || 0;
+}
+
+/*
+ * One frame of encoded silence at a given rate, made once and reused forever.
+ * Encoded through server/aac-encode.js like everything else — same reasoning as the
+ * clip encoder in tts-service.js.
+ */
+const silenceCache = new Map();
+function silenceFrame(sampleRate) {
+  if (silenceCache.has(sampleRate)) return silenceCache.get(sampleRate);
+
+  fs.mkdirSync(SILENCE_DIR, { recursive: true });
+  const wav = path.join(SILENCE_DIR, 'sil-' + sampleRate + '.wav');
+  const aac = path.join(SILENCE_DIR, 'sil-' + sampleRate + '.aac');
+
+  const n = sampleRate;                       // one second is plenty to slice from
+  const b = Buffer.alloc(44 + n * 2);
+  b.write('RIFF', 0); b.writeUInt32LE(36 + n * 2, 4); b.write('WAVE', 8); b.write('fmt ', 12);
+  b.writeUInt32LE(16, 16); b.writeUInt16LE(1, 20); b.writeUInt16LE(1, 22);
+  b.writeUInt32LE(sampleRate, 24); b.writeUInt32LE(sampleRate * 2, 28);
+  b.writeUInt16LE(2, 32); b.writeUInt16LE(16, 34); b.write('data', 36); b.writeUInt32LE(n * 2, 40);
+  fs.writeFileSync(wav, b);
+  /* 48k to MATCH tts-service.js's clip encoder. At 32 kbps afconvert silently
+     RESAMPLES 44100 Hz input down to 32000, so the Chinese stream would splice
+     44.1 kHz speech against 32 kHz silence — mismatched-rate frames in one
+     stream, which players handle by glitching. */
+  encodeAdts(wav, aac);          // keeps the WAV's own rate — see aac-encode.js
+
+  const frames = adtsFrames(fs.readFileSync(aac));
+  /* Skip the first couple — the encoder's priming frames are not steady state. */
+  const frame = frames[Math.min(3, frames.length - 1)];
+  silenceCache.set(sampleRate, frame);
+  try { fs.unlinkSync(wav); } catch (_) {}
+  return frame;
+}
+
+// ---------------------------------------------------------------- streams
+
+function segmentsToKeep() {
+  return Math.max(6, Math.round((WINDOW_SEC + reserveSec) / SEGMENT_SEC));
+}
+
+class LanguageStream {
+  constructor(lang, sampleRate, onLog) {
+    this.lang = lang;
+    this.sampleRate = sampleRate;
+    this.onLog = onLog;
+    this.frameMs = (1024 / sampleRate) * 1000;
+    this.framesPerSegment = Math.max(4, Math.round(SEGMENT_SEC * sampleRate / 1024));
+    this.keepSegments = segmentsToKeep();
+
+    this.pending = [];        // [{frames, gap, id, secs, at}] — one entry per sentence; `at` is its CAPTION time
+    this.pendingFrames = 0;   // total frames queued, for the backlog check
+    this.onSentence = null;   // fires with (id, secs) as a sentence starts playing out
+    this.onDrop = null;       // fires with ([ids], secondsDropped) when the trimmer discards sentences
+    this.dropped = 0;         // sentences discarded by the trimmer, this service
+    this.droppedSec = 0;
+    this.dropTimes = [];      // when, for a "recently" view on the operator page
+    this.building = [];       // frames of the segment being filled
+    this.segments = [];       // { seq, body, frames }
+    this.nextSeq = 1;
+    this.timer = null;
+    this.lastTick = 0;
+    this.carry = 0;           // fractional frames owed from the last tick
+  }
+
+  start() {
+    if (this.timer) return;
+    /*
+     * Seed one segment of silence immediately, so /live/<lang>.m3u8 exists from
+     * the first moment a player can ask for it. Without this there is a ~1-2s
+     * window after a listener picks a language where the playlist 404s — and a
+     * 404 at exactly that moment is indistinguishable from "this device cannot
+     * play HLS", which once sent pages to the clip fallback for good.
+     */
+    if (!this.segments.length) {
+      const sil = silenceFrame(this.sampleRate);
+      for (let i = 0; i < this.framesPerSegment; i++) this.building.push(sil);
+      this.closeSegment();
+    }
+    this.lastTick = Date.now();
+    this.carry = 0;
+    this.timer = setInterval(() => this.tick(), TICK_MS);
+    if (this.timer.unref) this.timer.unref();
+  }
+
+  stop() {
+    if (this.timer) clearInterval(this.timer);
+    this.timer = null;
+    this.continuous = false;      // re-prime the cushion on the next service
+    this.underruns = 0;
+    this.reprimes = 0;
+    this.pending.length = 0;
+    this.pendingFrames = 0;
+    this.building.length = 0;
+    /* Drop the window too. Keeping it would serve a playlist that never
+       advances, and a player reaching the end of a frozen live playlist stalls
+       rather than failing — which is much harder to notice than a 404. */
+    this.segments.length = 0;
+  }
+
+  /* Queue a sentence. Frames go out at the stream's own pace, so a long
+     sentence simply occupies the next few seconds of the stream. */
+  /*
+   * Continuous feed (the live microphone): no sentence gap, no read-along
+   * announce, and an exact-sample debt ledger. Each 0.7s chunk arrives with
+   * 2112 samples of encoder priming; stripping two whole AAC frames removes
+   * 2048 of them, and the remaining +64 per chunk would stretch an hour of
+   * feed by ~20 seconds — the backlog trimmer would then "fix" that with
+   * audible chunk drops. When the debt reaches a full frame, one extra
+   * (mostly-priming) frame is stripped and the ledger settles.
+   */
+  pushContinuous(buf) {
+    const rate = adtsSampleRate(buf);
+    if (rate && rate !== this.sampleRate) {
+      this.sampleRate = rate;
+      this.frameMs = (1024 / rate) * 1000;
+      this.framesPerSegment = Math.max(4, Math.round(SEGMENT_SEC * rate / 1024));
+      this.pending.length = 0;
+      this.pendingFrames = 0;
+      this.building.length = 0;
+    }
+    /*
+     * A JITTER CUSHION, primed once.
+     *
+     * The mic feed produces exactly real time — 0.7s of audio every 0.7s — so
+     * supply equals demand with nothing spare, and the steady-state backlog
+     * measured only ~800ms. tick() inserts SILENCE whenever the queue runs dry,
+     * so any hiccup longer than that cushion — a busy event loop, a WebSocket
+     * that bunched two chunks, a GC pause — punches an audible hole straight
+     * through the middle of a word. On a sentence-shaped TTS stream a hole
+     * lands in a pause and nobody notices; on a continuous feed it is a skip.
+     *
+     * MEASURED with a metronome-perfect feed and no network: 0 underruns, 800ms
+     * backlog. That is healthy but thin, and the real path has neither of those
+     * luxuries.
+     *
+     * Priming silence costs that much added delay ONCE, at the start, and buys
+     * the same amount of jitter tolerance for the whole service.
+     */
+    if (!this.continuous) {
+      this.continuous = true;
+      this.underruns = 0;
+      this.cushionMs = CONTINUOUS_CUSHION_MS;
+      this.reprimes = 0;
+    }
+
+    /*
+     * SELF-HEALING, and this is the part that matters.
+     *
+     * A cushion primed once is spent once: the first hiccup big enough to
+     * empty the queue eats it, and every hiccup after that is an audible hole
+     * because the buffer never comes back. MEASURED — two stalls (500ms and
+     * 900ms late) took the backlog from 1472ms to 704ms permanently, and the
+     * stream reported 15 underrun frames.
+     *
+     * So top up whenever the queue is found EMPTY at push time. Empty means
+     * silence has already gone out — the audio is lost either way — and adding
+     * the cushion back is the difference between losing it once and losing it
+     * every time. Never top up a queue that still holds audio; that would
+     * insert silence into the middle of a word to fix a problem that has not
+     * happened.
+     *
+     * A feed that keeps stalling earns a bigger cushion, up to a ceiling: more
+     * delay is a fair price for not being punched full of holes, but it cannot
+     * grow without limit.
+     */
+    if (this.pendingFrames === 0) {
+      if (this.reprimes > 0) {
+        this.cushionMs = Math.min(CONTINUOUS_CUSHION_MAX_MS, this.cushionMs + 350);
+      }
+      const sil0 = silenceFrame(this.sampleRate);
+      const cushion = Math.round(this.cushionMs / this.frameMs);
+      const pad = [];
+      for (let i = 0; i < cushion; i++) pad.push(sil0);
+      this.pending.push({ frames: pad, gap: 0, id: null, secs: 0 });
+      this.pendingFrames += pad.length;
+      this.reprimes++;
+      this.onLog('live mic feed for ' + this.lang + ': ' +
+                 (this.reprimes === 1 ? 'primed ' : 'refilled ') +
+                 Math.round(cushion * this.frameMs) + 'ms of jitter cushion' +
+                 (this.reprimes > 1 ? ' (refill #' + this.reprimes + ')' : ''));
+    }
+
+    /* Encoder priming, from aac-encode.js — 2 frames under afconvert, 1 under
+       ffmpeg. The +64 remainder below is the same under both (measured). */
+    let strip = PRIMING_FRAMES;
+    this.sampleDebt = (this.sampleDebt || 0) + 64;
+    if (this.sampleDebt >= 1024) { strip += 1; this.sampleDebt -= 1024; }
+
+    let frames = adtsFrames(buf);
+    if (frames.length > strip + 2) frames = frames.slice(strip);
+    if (!frames.length) return;
+
+    this.pending.push({ frames, gap: 0, id: null, secs: (frames.length * 1024) / this.sampleRate });
+    this.pendingFrames += frames.length;
+    /* No trimBacklog here: a live feed produces exactly real time by
+       construction (the debt ledger guarantees it), so the backlog stays a
+       constant one-chunk bubble. */
+  }
+
+  push(buf, terminal, id, captionAt) {
+    const rate = adtsSampleRate(buf);
+    if (rate && rate !== this.sampleRate) {
+      /* A voice was swapped underneath us. Splicing mismatched rates produces
+         chipmunk audio, so rebuild the stream instead. */
+      this.onLog('live audio for ' + this.lang + ' switching ' + this.sampleRate + ' -> ' + rate);
+      this.sampleRate = rate;
+      this.frameMs = (1024 / rate) * 1000;
+      this.framesPerSegment = Math.max(4, Math.round(SEGMENT_SEC * rate / 1024));
+      this.pending.length = 0;
+      this.pendingFrames = 0;
+      this.building.length = 0;
+    }
+
+    /*
+     * The encoder prepends priming to every clip — afconvert 2112 samples,
+     * ffmpeg 1024 (both measured; see aac-encode.js) — and ADTS
+     * has no edit list to declare it, so the decoder plays it as dead silence
+     * at every sentence boundary — 96-142 ms per join. Dropping the first two
+     * frames removes 2048 of those samples; frame 2 keeps frame 1 as its MDCT
+     * overlap partner, so the speech onset survives (measured error confined to
+     * the first 1024 samples, RMS 10-21 LSB). Dropping THREE destroys the onset
+     * (-5 dBFS error, 12-38% energy loss). Do not raise this number.
+     */
+    let frames = adtsFrames(buf);
+    if (frames.length > PRIMING_FRAMES + 2) frames = frames.slice(PRIMING_FRAMES);
+    if (!frames.length) return;
+
+    /* The gap rides with the sentence so that dropping one drops its pause too. */
+    /*
+     * A full stop earns a full breath; a fragment the VAD cut mid-thought gets
+     * only a beat, because a sentence-final pause after half a sentence is
+     * exactly the halting rhythm listeners hear as "blocky".
+     */
+    const ended = terminal === '.' || terminal === '!' || terminal === '?' ||
+                  terminal === '\u3002' || terminal === undefined;
+    const gapMs = this.gapMsForBacklog() * (ended ? 1 : 0.4);
+    const gap = Math.round(gapMs / this.frameMs);
+    const sil = silenceFrame(this.sampleRate);
+    const secs = (frames.length * 1024) / this.sampleRate;   // speech only, sans gap
+    for (let i = 0; i < gap; i++) frames.push(sil);
+
+    /* `at` is when the sentence was SAID (the caption's timestamp), not when
+       its audio arrived — the difference is the whole dropper fix above. */
+    this.pending.push({ frames, gap, id, secs, at: Number(captionAt) || Date.now() });
+    this.pendingFrames += frames.length;
+    this.trimBacklog();
+  }
+
+  backlogSeconds() { return (this.pendingFrames * 1024) / this.sampleRate; }
+
+  gapMsForBacklog() {
+    const b = this.backlogSeconds();
+    if (b <= GAP_COMFORT_SEC) return SENTENCE_GAP_MS;
+    if (b >= GAP_SQUEEZE_SEC) return 0;
+    /* Taper rather than switch, so the rhythm does not lurch at a threshold. */
+    const t = (b - GAP_COMFORT_SEC) / (GAP_SQUEEZE_SEC - GAP_COMFORT_SEC);
+    return Math.round(SENTENCE_GAP_MS * (1 - t));
+  }
+
+  trimBacklog() {
+    if (this.backlogSeconds() <= MAX_BACKLOG_SEC) return;
+
+    /*
+     * Shorten the breathing room before losing anyone's words. A clipped pause
+     * costs a little naturalness; a dropped sentence costs the sentence. Only
+     * once every pause is gone is dropping the right answer.
+     */
+    for (let i = 0; i < this.pending.length && this.backlogSeconds() > TARGET_BACKLOG_SEC; i++) {
+      const p = this.pending[i];
+      const trim = Math.min(p.gap, p.frames.length - 1);
+      if (trim <= 0) continue;
+      p.frames.length -= trim;
+      this.pendingFrames -= trim;
+      p.gap -= trim;
+    }
+    if (this.backlogSeconds() <= MAX_BACKLOG_SEC) return;
+
+    let dropped = 0;
+    let droppedSec = 0;
+    const ids = [];
+    while (this.pending.length > 1 && this.backlogSeconds() > TARGET_BACKLOG_SEC) {
+      /* Never cut the sentence that is coming out of the speaker mid-word —
+         if the head has started playing, the oldest DROPPABLE one is next. */
+      const at = this.pending[0].announced ? 1 : 0;
+      if (at >= this.pending.length) break;
+      /* Only a sentence the preacher said STALE_CAPTION_SEC ago is stale enough
+         to lose. If the oldest droppable one is fresher than that, everything
+         behind it is fresher still — stop, and let the hurry work it down. */
+      if (Date.now() - (this.pending[at].at || 0) < STALE_CAPTION_SEC * 1000) break;
+      const gone = this.pending.splice(at, 1)[0];
+      this.pendingFrames -= gone.frames.length;
+      droppedSec += (gone.frames.length * 1024) / this.sampleRate;
+      if (gone.id != null) ids.push(gone.id);
+      dropped++;
+    }
+    if (dropped) {
+      this.dropped += dropped;
+      this.droppedSec += droppedSec;
+      this.dropTimes.push(Date.now());
+      if (this.dropTimes.length > 200) this.dropTimes.splice(0, this.dropTimes.length - 200);
+      if (this.onDrop) { try { this.onDrop(ids, droppedSec); } catch (_) {} }
+    }
+    if (dropped) {
+      this.onLog('live audio ' + this.lang + ': dropped ' + dropped +
+                 ' stale sentence(s) to catch up (backlog now ' +
+                 this.backlogSeconds().toFixed(1) + 's)');
+    }
+  }
+
+  tick() {
+    const now = Date.now();
+    const elapsed = now - this.lastTick;
+    this.lastTick = now;
+
+    /* Frames due since the last wake, carrying the fraction forward so the
+       stream does not drift slow. */
+    const exact = elapsed / this.frameMs + this.carry;
+    let due = Math.floor(exact);
+    this.carry = exact - due;
+
+    /* After a long stall (a laptop sleeping) do not dump a minute of silence
+       into the buffer — just resume at the live edge. */
+    if (due > this.framesPerSegment * 2) due = this.framesPerSegment * 2;
+
+    const sil = silenceFrame(this.sampleRate);
+    for (let i = 0; i < due; i++) {
+      let frame = sil;
+      while (this.pending.length && !this.pending[0].frames.length) this.pending.shift();
+      if (!this.pending.length && this.continuous) {
+        /*
+         * The queue ran dry on a feed that is supposed to be unbroken. This is
+         * the skip, and it used to happen silently — the stream simply played
+         * a little silence and nobody could tell it from the room being quiet.
+         * Counted and reported, because "it skips sometimes" is not something
+         * anyone can act on.
+         */
+        this.underruns = (this.underruns || 0) + 1;
+        if (this.underruns === 1 || this.underruns % 25 === 0) {
+          this.onLog('live mic feed for ' + this.lang + ': ' + this.underruns +
+                     ' underrun frame(s) — audio arriving slower than real time');
+        }
+      }
+      if (this.pending.length) {
+        const head = this.pending[0];
+        /* The first frame of a sentence leaving the queue is the moment it
+           starts existing as sound — which is what the read-along highlight on
+           the phones needs to know. */
+        if (!head.announced) {
+          head.announced = true;
+          if (this.onSentence && head.id != null) {
+            try { this.onSentence(head.id, head.secs); } catch (_) {}
+          }
+        }
+        frame = head.frames.shift();
+        this.pendingFrames--;
+      }
+      this.building.push(frame);
+      if (this.building.length >= this.framesPerSegment) this.closeSegment();
+    }
+  }
+
+  closeSegment() {
+    const body = Buffer.concat(this.building);
+    this.segments.push({ seq: this.nextSeq++, body, frames: this.building.length });
+    this.building = [];
+    while (this.segments.length > this.keepSegments) this.segments.shift();
+  }
+
+  segmentDuration() { return (this.framesPerSegment * 1024) / this.sampleRate; }
+
+  /*
+   * `backSec` is how far behind the live edge this listener should start. 0 for
+   * the room; the stream delay for someone who came through the tunnel. Same
+   * playlist, same segments, different starting position — which is the only
+   * way to delay one listener of a shared HLS window and not the others.
+   */
+  playlist(backSec) {
+    if (!this.segments.length) return null;
+    const dur = this.segmentDuration();
+    /* Never ask for a position older than the window actually holds, or the
+       player seeks to something that has rotated out and stalls. */
+    const held = Math.max(0, (this.segments.length - 1) * dur);
+    const back = Math.min(Math.max(0, Number(backSec) || 0) + 1.2, held);
+    const lines = [
+      '#EXTM3U',
+      '#EXT-X-VERSION:3',
+      '#EXT-X-TARGETDURATION:' + Math.ceil(dur),
+      '#EXT-X-MEDIA-SEQUENCE:' + this.segments[0].seq,
+      /* Without this a player starts three segments back and stays there for
+         the whole service. Measured: 4.92 s of lag becomes 1.61 s. */
+      '#EXT-X-START:TIME-OFFSET=-' + back.toFixed(2) + ',PRECISE=YES'
+    ];
+    for (const s of this.segments) {
+      lines.push('#EXTINF:' + dur.toFixed(3) + ',');
+      /* Relative to the PLAYLIST's directory, which is /live/ — so the language
+         has to be in the path or the player asks for /live/17.aac and gets a
+         404. The playlist itself is /live/<lang>.m3u8, not /live/<lang>/. */
+      lines.push(this.lang + '/' + s.seq + '.aac');
+    }
+    return lines.join('\n') + '\n';
+  }
+
+  segment(seq) {
+    const s = this.segments.find((x) => x.seq === seq);
+    return s ? s.body : null;
+  }
+}
+
+// ----------------------------------------------------------------- facade
+
+class LiveAudio {
+  constructor(onLog) {
+    this.streams = new Map();
+    this.onLog = onLog || (() => {});
+  }
+
+  /* Default rate is a starting guess; the first real clip corrects it. */
+  ensure(lang, sampleRate) {
+    let s = this.streams.get(lang);
+    if (!s) {
+      s = new LanguageStream(lang, sampleRate || 22050, this.onLog);
+      s.onSentence = (id, secs) => {
+        if (this.onSentenceStart) { try { this.onSentenceStart(lang, id, secs); } catch (_) {} }
+      };
+      s.onDrop = (ids, secs) => {
+        if (this.onDropped) { try { this.onDropped(lang, ids, secs); } catch (_) {} }
+      };
+      this.streams.set(lang, s);
+      this.onLog('live audio stream open for ' + lang);
+    }
+    s.start();
+    return s;
+  }
+
+  push(lang, buf, sampleRate, terminal, id, captionAt) {
+    const s = this.ensure(lang, sampleRate || adtsSampleRate(buf));
+    s.push(buf, terminal, id, captionAt);
+  }
+
+  /*
+   * What the trimmer has thrown away, per language — the number that was
+   * invisible for a whole service. `recent` is drop EVENTS in the last minute,
+   * which is what an operator can act on; totals are for the log.
+   */
+  stats() {
+    const out = {};
+    const cut = Date.now() - 60000;
+    for (const [lang, s] of this.streams) {
+      if (!s.dropped && !s.underruns) continue;
+      out[lang] = {
+        dropped: s.dropped,
+        droppedSec: +s.droppedSec.toFixed(1),
+        recent: s.dropTimes.filter((t) => t > cut).length,
+        underruns: s.continuous ? (s.underruns || 0) : undefined
+      };
+    }
+    return out;
+  }
+
+  /* Per-language backlog in seconds — how far the voice is behind the text.
+     The engine slows or quickens synthesis from this, like an interpreter. */
+  backlog() {
+    const out = {};
+    for (const [lang, s] of this.streams) {
+      if (s.timer) out[lang] = +s.backlogSeconds().toFixed(2);
+    }
+    return out;
+  }
+
+  /*
+   * Called whenever the set of languages anyone is listening to changes.
+   * OPENS a stream for every active language rather than only restarting ones
+   * that already exist — the stream has to be audible before the first sentence,
+   * not after it, or the phone is suspended before that sentence can arrive.
+   */
+  retain(langs, rateFor) {
+    const keep = new Set(langs);
+    for (const lang of keep) this.ensure(lang, rateFor ? rateFor(lang) : 22050);
+    for (const [lang, s] of this.streams) {
+      if (keep.has(lang)) continue;
+      if (s.timer) { s.stop(); this.onLog('live audio stream idle for ' + lang); }
+    }
+  }
+
+  stopAll() { for (const [, s] of this.streams) s.stop(); }
+
+  playlist(lang, backSec) {
+    const s = this.streams.get(lang);
+    return s ? s.playlist(backSec) : null;
+  }
+
+  /*
+   * Keep enough history to serve a listener who is `sec` behind the live edge.
+   * Called whenever the stream delay changes, and applied to streams that
+   * already exist as well as new ones.
+   */
+  reserve(sec) {
+    const n = Math.max(0, Math.min(300, Math.round(Number(sec) || 0)));
+    if (n === reserveSec) return;
+    reserveSec = n;
+    const keep = segmentsToKeep();
+    for (const st of this.streams.values()) {
+      st.keepSegments = keep;
+      /* Shrinking takes effect on the next rotate; growing must not drop
+         anything that is already held. */
+      while (st.segments.length > keep) st.segments.shift();
+    }
+    this.onLog('audio window now ' + ((WINDOW_SEC + n)).toFixed(0) + 's (delay reserve ' + n + 's)');
+  }
+  segment(lang, seq) { const s = this.streams.get(lang); return s ? s.segment(seq) : null; }
+}
+
+module.exports = { LiveAudio, adtsFrames, adtsSampleRate, silenceFrame };

app/server/public/app.webmanifest

@@ -0,0 +1,13 @@
+{
+  "name": "Live Translation",
+  "short_name": "Translate",
+  "description": "Live sermon translation in your language",
+  "start_url": "/",
+  "display": "standalone",
+  "orientation": "portrait",
+  "background_color": "#0b0d12",
+  "theme_color": "#0b0d12",
+  "icons": [
+    { "src": "/icon.svg", "sizes": "any", "type": "image/svg+xml", "purpose": "any maskable" }
+  ]
+}

app/server/public/icon.svg

@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">
+  <rect width="512" height="512" rx="112" fill="#0b0d12"/>
+  <g fill="none" stroke="#6ea8fe" stroke-width="26" stroke-linecap="round" stroke-linejoin="round">
+    <path d="M104 168h150M179 136v32M214 168c0 62-45 112-100 130"/>
+    <path d="M150 232c14 30 40 54 74 66"/>
+    <path d="M266 400l68-168 68 168M292 344h84"/>
+  </g>
+</svg>

app/server/public/index.html

@@ -0,0 +1,89 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover, maximum-scale=5">
+<meta name="theme-color" content="#0b0d12">
+<meta name="apple-mobile-web-app-capable" content="yes">
+<meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
+<meta name="color-scheme" content="dark">
+<title>Live Translation</title>
+<link rel="manifest" href="/app.webmanifest">
+<link rel="stylesheet" href="/listen.css">
+</head>
+<body>
+
+<!-- ───────────────────────── language picker ───────────────────────── -->
+<section id="picker" class="screen is-active">
+  <div class="picker-inner">
+    <header class="picker-head">
+      <div class="church" id="churchName">Live Translation</div>
+      <h1 id="chooseTitle">Choose your language</h1>
+      <!-- Cycles through the same question in other languages, so anyone can
+           tell what this page is for without reading English. -->
+      <div class="rotator" id="rotator" aria-hidden="true"></div>
+    </header>
+
+    <div class="featured" id="featured"></div>
+
+    <div class="search-wrap">
+      <div class="search-box">
+        <input id="search" type="search" inputmode="search" autocomplete="off" enterkeyhint="search"
+               autocorrect="off" spellcheck="false" placeholder="Search all languages">
+        <button id="searchClear" class="search-clear" type="button" aria-label="Clear search" hidden>
+          <svg viewBox="0 0 24 24" aria-hidden="true"><path d="M6 6l12 12M18 6L6 18"/></svg>
+        </button>
+      </div>
+      <div class="results" id="results" role="listbox"></div>
+    </div>
+  </div>
+</section>
+
+<!-- ───────────────────────── caption reader ────────────────────────── -->
+<section id="reader" class="screen">
+  <header class="bar">
+    <button id="btnBack" class="bar-btn" aria-label="Change language">
+      <svg viewBox="0 0 24 24" aria-hidden="true"><path d="M15 5l-7 7 7 7"/></svg>
+    </button>
+    <div class="bar-lang">
+      <span id="barLangName">—</span>
+      <span id="liveDot" class="dot" title="Live"></span>
+    </div>
+    <div class="bar-actions">
+      <button id="btnSpeak" class="bar-btn" aria-label="Speak aloud" aria-pressed="false">
+        <svg viewBox="0 0 24 24" aria-hidden="true" class="ic-off"><path d="M11 5L6 9H2v6h4l5 4V5z"/><path d="M22 9l-6 6M16 9l6 6"/></svg>
+        <svg viewBox="0 0 24 24" aria-hidden="true" class="ic-on"><path d="M11 5L6 9H2v6h4l5 4V5z"/><path d="M15.5 8.5a5 5 0 010 7M18.5 5.5a9 9 0 010 13"/></svg>
+      </button>
+      <button id="btnOriginal" class="bar-btn bar-btn-text bar-btn-src" aria-label="Show original" aria-pressed="false">EN</button>
+      <button id="btnSize" class="bar-btn bar-btn-text" aria-label="Text size">Aa</button>
+    </div>
+  </header>
+
+  <div id="voiceBar" class="voicebar" hidden>
+    <label for="voicePick">Voice</label>
+    <select id="voicePick"></select>
+  </div>
+  <p id="voiceHint" class="voicehint" hidden></p>
+
+  <main id="stream" class="stream" tabindex="0">
+    <div id="waiting" class="waiting">
+      <div class="pulse"><span></span><span></span><span></span></div>
+      <p id="waitingText">The message hasn't started yet</p>
+    </div>
+    <div id="lines" class="lines"></div>
+    <div id="partial" class="line line-partial" hidden></div>
+  </main>
+
+  <button id="jumpLive" class="jump" hidden>
+    <svg viewBox="0 0 24 24" aria-hidden="true"><path d="M6 9l6 6 6-6"/></svg>
+    <span id="jumpLabel">Live</span>
+  </button>
+
+  <div id="toast" class="toast" hidden></div>
+</section>
+
+<script src="/languages.js"></script>
+<script src="/ui-strings.js"></script>
+<script src="/listen.js"></script>
+</body>
+</html>

app/server/public/languages.js

@@ -0,0 +1,186 @@
+/*
+ * languages.js — the language catalog, shared by the NAS server, the listener
+ * page, and the Mac engine.
+ *
+ * `code` is a FLORES-200 code, which is what NLLB-200 expects. `tts` is the
+ * BCP-47 tag we hand to the phone's speechSynthesis; it is a best effort, and a
+ * phone that has no matching voice simply shows captions without speaking.
+ *
+ * `native` is what the listener actually sees in the picker. Never show someone
+ * the English name of their own language when you can help it.
+ */
+(function (root, factory) {
+  if (typeof module === 'object' && module.exports) module.exports = factory();
+  else root.Languages = factory();
+}(typeof self !== 'undefined' ? self : this, function () {
+
+  // [ FLORES code, English name, native name, BCP-47 for TTS, rtl ]
+  var RAW = [
+    ['eng_Latn', 'English',              'English',            'en-US'],
+    ['spa_Latn', 'Spanish (Latin America)', 'Español (América Latina)', 'es-MX'],
+    ['zho_Hans', 'Chinese (Simplified)', '简体中文',            'zh-CN'],
+    ['zho_Hant', 'Chinese (Traditional)','繁體中文',            'zh-TW'],
+    ['yue_Hant', 'Cantonese',            '廣東話',              'zh-HK'],
+    ['fra_Latn', 'French',               'Français',           'fr-FR'],
+    /* One NLLB Portuguese, two voices: the Brazilian and European variants
+       share their translation (por_PT is aliased to por_Latn at the MT
+       boundary in engine.js) and differ in the voice that reads it. */
+    ['por_Latn', 'Portuguese (Brazil)',   'Português (Brasil)',   'pt-BR'],
+    ['por_PT',   'Portuguese (Portugal)', 'Português (Portugal)', 'pt-PT'],
+    /* Same NLLB Spanish, read in a Castilian voice. There is no grammatical
+       transform between them: converting ustedes->vosotros needs to know
+       whether "you" was one person or a room, and neither the English nor
+       the Spanish carries that — see spa-variants.js for the measurements. */
+    ['spa_ES',   'Spanish (Spain)', 'Español (España)', 'es-ES'],
+    /* Mexico shares Latin America's grammar exactly (RAE: vosotros "carecen
+       de uso en América", and Mexico is tuteo-exclusive), so the text is
+       identical — this exists so a Mexican listener sees their own country
+       named, and so the operator can give it its own voice. */
+    ['spa_MX',   'Spanish (Mexico)', 'Español (México)', 'es-MX'],
+    ['kor_Hang', 'Korean',               '한국어',              'ko-KR'],
+    ['vie_Latn', 'Vietnamese',           'Tiếng Việt',         'vi-VN'],
+    ['hat_Latn', 'Haitian Creole',       'Kreyòl Ayisyen',     'ht-HT'],
+    ['arb_Arab', 'Arabic',               'العربية',             'ar-SA', true],
+    ['rus_Cyrl', 'Russian',              'Русский',            'ru-RU'],
+    ['ukr_Cyrl', 'Ukrainian',            'Українська',         'uk-UA'],
+    ['ron_Latn', 'Romanian',             'Română',             'ro-RO'],
+    ['pol_Latn', 'Polish',               'Polski',             'pl-PL'],
+    ['deu_Latn', 'German',               'Deutsch',            'de-DE'],
+    ['ita_Latn', 'Italian',              'Italiano',           'it-IT'],
+    ['nld_Latn', 'Dutch',                'Nederlands',         'nl-NL'],
+    ['tgl_Latn', 'Tagalog',              'Tagalog',            'fil-PH'],
+    ['ceb_Latn', 'Cebuano',              'Cebuano',            'fil-PH'],
+    ['ind_Latn', 'Indonesian',           'Bahasa Indonesia',   'id-ID'],
+    ['zsm_Latn', 'Malay',                'Bahasa Melayu',      'ms-MY'],
+    ['tha_Thai', 'Thai',                 'ไทย',                'th-TH'],
+    ['khm_Khmr', 'Khmer',                'ភាសាខ្មែរ',            'km-KH'],
+    ['lao_Laoo', 'Lao',                  'ລາວ',                'lo-LA'],
+    ['mya_Mymr', 'Burmese',              'မြန်မာ',              'my-MM'],
+    ['shn_Mymr', 'Shan',                 ' လိၵ်ႈတႆး',            'shn'],
+    ['kac_Latn', 'Kachin (Jingpho)',     'Jinghpaw',           'kac'],
+    ['npi_Deva', 'Nepali',               'नेपाली',              'ne-NP'],
+    ['hin_Deva', 'Hindi',                'हिन्दी',               'hi-IN'],
+    ['urd_Arab', 'Urdu',                 'اردو',                'ur-PK', true],
+    ['ben_Beng', 'Bengali',              'বাংলা',               'bn-BD'],
+    ['pan_Guru', 'Punjabi',              'ਪੰਜਾਬੀ',              'pa-IN'],
+    ['guj_Gujr', 'Gujarati',             'ગુજરાતી',             'gu-IN'],
+    ['tam_Taml', 'Tamil',                'தமிழ்',               'ta-IN'],
+    ['tel_Telu', 'Telugu',               'తెలుగు',              'te-IN'],
+    ['mal_Mlym', 'Malayalam',            'മലയാളം',              'ml-IN'],
+    ['kan_Knda', 'Kannada',              'ಕನ್ನಡ',               'kn-IN'],
+    ['mar_Deva', 'Marathi',              'मराठी',               'mr-IN'],
+    ['sin_Sinh', 'Sinhala',              'සිංහල',               'si-LK'],
+    ['pes_Arab', 'Persian (Farsi)',      'فارسی',               'fa-IR', true],
+    ['prs_Arab', 'Dari',                 'دری',                 'fa-AF', true],
+    ['pbt_Arab', 'Pashto',               'پښتو',                'ps-AF', true],
+    ['ckb_Arab', 'Kurdish (Sorani)',     'کوردی',               'ckb',   true],
+    ['kmr_Latn', 'Kurdish (Kurmanji)',   'Kurmancî',           'ku'],
+    ['heb_Hebr', 'Hebrew',               'עברית',               'he-IL', true],
+    ['tur_Latn', 'Turkish',              'Türkçe',             'tr-TR'],
+    ['amh_Ethi', 'Amharic',              'አማርኛ',               'am-ET'],
+    ['tir_Ethi', 'Tigrinya',             'ትግርኛ',               'ti-ET'],
+    ['som_Latn', 'Somali',               'Soomaali',           'so-SO'],
+    ['swh_Latn', 'Swahili',              'Kiswahili',          'sw-KE'],
+    ['yor_Latn', 'Yoruba',               'Yorùbá',             'yo-NG'],
+    ['ibo_Latn', 'Igbo',                 'Igbo',               'ig-NG'],
+    ['hau_Latn', 'Hausa',                'Hausa',              'ha-NG'],
+    ['lin_Latn', 'Lingala',              'Lingála',            'ln'],
+    ['kin_Latn', 'Kinyarwanda',          'Ikinyarwanda',       'rw-RW'],
+    ['run_Latn', 'Kirundi',              'Ikirundi',           'rn'],
+    ['lug_Latn', 'Luganda',              'Luganda',            'lg'],
+    ['nya_Latn', 'Chichewa',             'Chichewa',           'ny'],
+    ['sna_Latn', 'Shona',                'chiShona',           'sn'],
+    ['zul_Latn', 'Zulu',                 'isiZulu',            'zu-ZA'],
+    ['xho_Latn', 'Xhosa',                'isiXhosa',           'xh-ZA'],
+    ['afr_Latn', 'Afrikaans',            'Afrikaans',          'af-ZA'],
+    ['jpn_Jpan', 'Japanese',             '日本語',              'ja-JP'],
+    ['ell_Grek', 'Greek',                'Ελληνικά',           'el-GR'],
+    ['hun_Latn', 'Hungarian',            'Magyar',             'hu-HU'],
+    ['ces_Latn', 'Czech',                'Čeština',            'cs-CZ'],
+    ['slk_Latn', 'Slovak',               'Slovenčina',         'sk-SK'],
+    ['bul_Cyrl', 'Bulgarian',            'Български',          'bg-BG'],
+    ['srp_Cyrl', 'Serbian',              'Српски',             'sr-RS'],
+    ['hrv_Latn', 'Croatian',             'Hrvatski',           'hr-HR'],
+    ['bos_Latn', 'Bosnian',              'Bosanski',           'bs-BA'],
+    ['slv_Latn', 'Slovenian',            'Slovenščina',        'sl-SI'],
+    ['als_Latn', 'Albanian',             'Shqip',              'sq-AL'],
+    ['lit_Latn', 'Lithuanian',           'Lietuvių',           'lt-LT'],
+    ['lvs_Latn', 'Latvian',              'Latviešu',           'lv-LV'],
+    ['est_Latn', 'Estonian',             'Eesti',              'et-EE'],
+    ['fin_Latn', 'Finnish',              'Suomi',              'fi-FI'],
+    ['swe_Latn', 'Swedish',              'Svenska',            'sv-SE'],
+    ['nob_Latn', 'Norwegian',            'Norsk',              'nb-NO'],
+    ['dan_Latn', 'Danish',               'Dansk',              'da-DK'],
+    ['isl_Latn', 'Icelandic',            'Íslenska',           'is-IS'],
+    ['kat_Geor', 'Georgian',             'ქართული',            'ka-GE'],
+    ['hye_Armn', 'Armenian',             'Հայերեն',            'hy-AM'],
+    ['azj_Latn', 'Azerbaijani',          'Azərbaycan',         'az-AZ'],
+    ['uzn_Latn', 'Uzbek',                'Oʻzbek',             'uz-UZ'],
+    ['kaz_Cyrl', 'Kazakh',               'Қазақша',            'kk-KZ'],
+    ['kir_Cyrl', 'Kyrgyz',               'Кыргызча',           'ky-KG'],
+    ['tgk_Cyrl', 'Tajik',                'Тоҷикӣ',             'tg-TJ'],
+    ['khk_Cyrl', 'Mongolian',            'Монгол',             'mn-MN'],
+    ['bod_Tibt', 'Tibetan',              'བོད་སྐད་',              'bo'],
+    ['gle_Latn', 'Irish',                'Gaeilge',            'ga-IE'],
+    ['cym_Latn', 'Welsh',                'Cymraeg',            'cy-GB'],
+    ['eus_Latn', 'Basque',               'Euskara',            'eu-ES'],
+    ['cat_Latn', 'Catalan',              'Català',             'ca-ES'],
+    ['glg_Latn', 'Galician',             'Galego',             'gl-ES'],
+    ['quy_Latn', 'Quechua',              'Runasimi',           'qu'],
+    ['ayr_Latn', 'Aymara',               'Aymar aru',          'ay'],
+    ['grn_Latn', 'Guarani',              "Avañe'ẽ",            'gn'],
+    ['mri_Latn', 'Maori',                'Te Reo Māori',       'mi-NZ'],
+    ['smo_Latn', 'Samoan',               'Gagana Samoa',       'sm'],
+    ['fij_Latn', 'Fijian',               'Na Vosa Vakaviti',   'fj'],
+    ['tpi_Latn', 'Tok Pisin',            'Tok Pisin',          'tpi']
+  ];
+
+  var LANGS = RAW.map(function (r) {
+    return { code: r[0], name: r[1], native: r[2], tts: r[3], rtl: !!r[4] };
+  });
+
+  var BY_CODE = {};
+  LANGS.forEach(function (l) { BY_CODE[l.code] = l; });
+
+  // A sane opening set for a US church. The operator can change this at any time.
+  var DEFAULT_FEATURED = [
+    'spa_Latn', 'zho_Hans', 'por_Latn', 'fra_Latn',
+    'kor_Hang', 'vie_Latn', 'hat_Latn', 'arb_Arab'
+  ];
+
+  function get(code) { return BY_CODE[code] || null; }
+
+  function label(code) {
+    var l = BY_CODE[code];
+    if (!l) return code;
+    return l.native === l.name ? l.native : l.native + ' · ' + l.name;
+  }
+
+  /* Case- and accent-insensitive search across both names and the code, so
+     "espanol", "Español", "spanish" and "spa" all find Spanish. */
+  function normalize(s) {
+    return String(s || '')
+      .toLowerCase()
+      .normalize('NFD')
+      .replace(/[̀-ͯ]/g, '');
+  }
+
+  function search(query) {
+    var q = normalize(query).trim();
+    if (!q) return LANGS.slice();
+    return LANGS.filter(function (l) {
+      return normalize(l.name).indexOf(q) !== -1 ||
+             normalize(l.native).indexOf(q) !== -1 ||
+             normalize(l.code).indexOf(q) !== -1;
+    });
+  }
+
+  return {
+    LANGS: LANGS,
+    DEFAULT_FEATURED: DEFAULT_FEATURED,
+    get: get,
+    label: label,
+    search: search,
+    codes: function () { return LANGS.map(function (l) { return l.code; }); }
+  };
+}));

app/server/public/listen.css

@@ -0,0 +1,448 @@
+/*
+ * listen.css — the congregant's screen.
+ *
+ * Two rules drive every choice here: it is dark because a bright phone in a
+ * dim auditorium is rude to the row behind you, and the type is large because
+ * people are reading it at arm's length in low light while listening.
+ */
+
+/*
+ * Make the `hidden` attribute actually hide things.
+ *
+ * The browser's own [hidden] rule is `display: none`, but it lives in the user-
+ * agent stylesheet, so any author rule that sets `display` — every .warn,
+ * .toast and flex row below — silently outranks it. The element stays on
+ * screen with hidden="true" and the JavaScript looks like it isn't running.
+ * That is how the operator console ended up permanently insisting the Mac
+ * engine was disconnected while it was sitting there working.
+ */
+[hidden] { display: none !important; }
+
+:root {
+  --bg:      #0b0d12;
+  --surface: #151922;
+  --raised:  #1d2331;
+  --line:    #2a3244;
+  --text:    #eef1f6;
+  --muted:   #8b93a7;
+  --accent:  #6ea8fe;
+  --live:    #34d399;
+  --radius:  16px;
+
+  --cap-size: 1.5rem;   /* nudged by the Aa button */
+  --cap-lead: 1.55;
+}
+
+* { box-sizing: border-box; }
+
+html, body {
+  margin: 0;
+  height: 100%;
+  background: var(--bg);
+  color: var(--text);
+  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", system-ui, "Helvetica Neue", Arial, sans-serif;
+  -webkit-text-size-adjust: 100%;
+  overscroll-behavior: none;
+}
+
+body { overflow: hidden; }
+
+.screen {
+  position: fixed;
+  left: 0;
+  right: 0;
+  /*
+   * Pinned to the VISUAL viewport, not the layout viewport.
+   *
+   * `position: fixed` is measured against the layout viewport, and on iOS those
+   * two come apart: collapsing the URL bar pans the visual viewport downward
+   * while the layout viewport stays put, so a bar fixed at layout-top ends up
+   * above what the user can actually see. `100dvh` fixed the HEIGHT half of
+   * that and this is the POSITION half — the same bug wearing a different hat,
+   * which is why it came back after being fixed once.
+   *
+   * The page itself never scrolls (body is overflow:hidden), so the existing
+   * self-heal — which watches window.scrollY and scrollingElement — sees zero
+   * on both and correctly does nothing. Nothing was scrolling. The viewport was
+   * moving underneath.
+   *
+   * listen.js keeps these two custom properties in step with visualViewport.
+   * The fallbacks are what a browser without visualViewport gets, which is the
+   * behaviour this had before.
+   */
+  top: var(--vv-top, 0px);
+  height: var(--vv-h, 100dvh);
+  display: none;
+}
+.screen.is-active { display: flex; flex-direction: column; }
+
+/* ───────────────────────────── picker ───────────────────────────── */
+
+#picker { overflow-y: auto; -webkit-overflow-scrolling: touch; }
+
+.picker-inner {
+  width: 100%;
+  max-width: 40rem;
+  margin: 0 auto;
+  padding: max(2.5rem, env(safe-area-inset-top)) 1.25rem calc(2rem + env(safe-area-inset-bottom));
+}
+
+.picker-head { text-align: center; margin-bottom: 1.75rem; }
+
+.church {
+  font-size: .8125rem;
+  letter-spacing: .12em;
+  text-transform: uppercase;
+  color: var(--muted);
+  margin-bottom: .75rem;
+}
+
+.picker-head h1 {
+  font-size: clamp(1.5rem, 6vw, 2rem);
+  line-height: 1.2;
+  margin: 0 0 .5rem;
+  font-weight: 650;
+}
+
+/* The same question, cycling through other languages. */
+.rotator {
+  min-height: 1.5rem;
+  color: var(--muted);
+  font-size: 1rem;
+  transition: opacity .4s ease;
+}
+.rotator.fade { opacity: 0; }
+
+.featured {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(9.5rem, 1fr));
+  gap: .75rem;
+  margin-bottom: 1.75rem;
+}
+
+.lang-btn {
+  appearance: none;
+  border: 1px solid var(--line);
+  background: var(--surface);
+  color: var(--text);
+  border-radius: var(--radius);
+  padding: 1.0625rem .875rem;
+  min-height: 4.25rem;
+  font: inherit;
+  text-align: center;
+  cursor: pointer;
+  display: flex;
+  flex-direction: column;
+  justify-content: center;
+  gap: .1875rem;
+  transition: background .15s ease, border-color .15s ease, transform .1s ease;
+}
+.lang-btn:hover { background: var(--raised); border-color: #3a445c; }
+.lang-btn:active { transform: scale(.975); }
+.lang-btn:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
+
+.lang-native { font-size: 1.1875rem; font-weight: 600; line-height: 1.25; }
+.lang-en     { font-size: .8125rem; color: var(--muted); }
+
+.search-wrap { position: relative; }
+
+#search {
+  width: 100%;
+  padding: .9375rem 1rem;
+  font-size: 1rem;
+  color: var(--text);
+  background: var(--surface);
+  border: 1px solid var(--line);
+  border-radius: var(--radius);
+  outline: none;
+}
+#search:focus { border-color: var(--accent); }
+#search::placeholder { color: var(--muted); }
+
+.results { margin-top: .75rem; display: grid; gap: .375rem; }
+.results:empty { display: none; }
+
+.result {
+  appearance: none;
+  width: 100%;
+  text-align: start;
+  border: 1px solid transparent;
+  background: var(--surface);
+  color: var(--text);
+  border-radius: 12px;
+  padding: .8125rem 1rem;
+  font: inherit;
+  cursor: pointer;
+  display: flex;
+  justify-content: space-between;
+  align-items: baseline;
+  gap: 1rem;
+}
+.result:hover { background: var(--raised); }
+.result:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
+.result b { font-weight: 600; font-size: 1.0625rem; }
+.result span { color: var(--muted); font-size: .8125rem; flex: none; }
+
+.no-results { color: var(--muted); text-align: center; padding: 1rem; font-size: .9375rem; }
+
+/* ───────────────────────────── reader ───────────────────────────── */
+
+.bar {
+  flex: none;
+  /* Pinned. The language name and the speaker button are the only controls a
+     listener has; losing them off the top of a long sermon is not acceptable. */
+  position: sticky;
+  top: 0;
+  z-index: 6;
+  display: flex;
+  align-items: center;
+  gap: .5rem;
+  padding: max(.5rem, env(safe-area-inset-top)) .625rem .5rem;
+  background: rgba(11, 13, 18, .92);
+  backdrop-filter: blur(12px);
+  border-bottom: 1px solid var(--line);
+}
+
+.bar-lang {
+  flex: 1;
+  min-width: 0;
+  display: flex;
+  align-items: center;
+  gap: .5rem;
+  font-size: 1rem;
+  font-weight: 600;
+}
+#barLangName { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+
+.dot {
+  flex: none;
+  width: .5rem;
+  height: .5rem;
+  border-radius: 50%;
+  background: var(--muted);
+  transition: background .3s ease;
+}
+.dot.is-live { background: var(--live); animation: breathe 2.4s ease-in-out infinite; }
+@keyframes breathe { 0%, 100% { opacity: 1; } 50% { opacity: .35; } }
+
+.bar-actions { display: flex; gap: .25rem; }
+
+.bar-btn {
+  appearance: none;
+  border: 0;
+  background: transparent;
+  color: var(--text);
+  width: 2.75rem;
+  height: 2.75rem;
+  border-radius: 12px;
+  display: grid;
+  place-items: center;
+  cursor: pointer;
+  padding: 0;
+}
+.bar-btn:hover { background: var(--raised); }
+.bar-btn:focus-visible { outline: 2px solid var(--accent); outline-offset: -2px; }
+.bar-btn svg {
+  width: 1.375rem; height: 1.375rem;
+  fill: none; stroke: currentColor; stroke-width: 2;
+  stroke-linecap: round; stroke-linejoin: round;
+}
+.bar-btn-text { font-size: 1rem; font-weight: 600; letter-spacing: .01em; }
+
+/* Speaker icon swaps between muted and sounding. */
+#btnSpeak .ic-on { display: none; }
+#btnSpeak[aria-pressed="true"] { color: var(--accent); }
+#btnSpeak[aria-pressed="true"] .ic-on  { display: block; }
+#btnSpeak[aria-pressed="true"] .ic-off { display: none; }
+
+.stream {
+  flex: 1;
+  overflow-y: auto;
+  -webkit-overflow-scrolling: touch;
+  overscroll-behavior: contain;
+  padding: 1.25rem 1.125rem calc(4rem + env(safe-area-inset-bottom));
+  /* Deliberately NOT scroll-behavior: smooth. That makes every programmatic
+     scroll an animation, so a page catching up on 40 lines restarts a long
+     animation on each new sentence and never reaches the bottom. listen.js
+     picks smooth-or-instant per scroll instead. */
+}
+
+.lines { display: flex; flex-direction: column; gap: .875rem; }
+
+.line {
+  font-size: var(--cap-size);
+  line-height: var(--cap-lead);
+  letter-spacing: .003em;
+  animation: rise .28s ease-out both;
+}
+@media (prefers-reduced-motion: reduce) { .line { animation: none; } }
+@keyframes rise { from { opacity: 0; transform: translateY(.5rem); } to { opacity: 1; transform: none; } }
+
+/*
+ * The reading eye follows the VOICE, not recency. Every line reads at full
+ * weight — the newest is not special, because the newest is precisely what the
+ * voice has NOT said yet — and the one the voice is speaking right now carries
+ * the highlight, so a listener can read along and always knows where in the
+ * text the audio is.
+ */
+.line.is-old { color: #b7bfd2; }
+.line.is-speaking {
+  color: var(--text);
+  background: rgba(96, 165, 250, .10);
+  box-shadow: inset 3px 0 0 0 #60a5fa;
+  border-radius: .375rem;
+  padding: .125rem .5rem .125rem .625rem;
+  margin-left: -.625rem;
+  transition: background .25s ease, box-shadow .25s ease;
+}
+@media (prefers-reduced-motion: reduce) { .line.is-speaking { transition: none; } }
+
+.line-partial { color: var(--muted); font-style: italic; margin-top: .875rem; }
+
+.line-original {
+  display: block;
+  margin-top: .3125rem;
+  font-size: .8em;
+  color: var(--muted);
+  font-style: italic;
+}
+
+/* When translation for a language isn't flowing yet. */
+.line.is-untranslated { opacity: .72; }
+
+.waiting {
+  height: 100%;
+  min-height: 55vh;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  gap: 1.25rem;
+  color: var(--muted);
+  text-align: center;
+}
+.waiting p { margin: 0; font-size: 1.0625rem; max-width: 20rem; }
+.waiting[hidden] { display: none; }
+
+.pulse { display: flex; gap: .4375rem; }
+.pulse span {
+  width: .5rem; height: .5rem; border-radius: 50%;
+  background: var(--muted);
+  animation: bounce 1.4s ease-in-out infinite;
+}
+.pulse span:nth-child(2) { animation-delay: .18s; }
+.pulse span:nth-child(3) { animation-delay: .36s; }
+@keyframes bounce { 0%, 60%, 100% { transform: translateY(0); opacity: .4; } 30% { transform: translateY(-.4375rem); opacity: 1; } }
+
+.jump {
+  position: fixed;
+  left: 50%;
+  transform: translateX(-50%);
+  bottom: calc(1.25rem + env(safe-area-inset-bottom));
+  display: flex;
+  align-items: center;
+  gap: .375rem;
+  padding: .625rem 1.125rem;
+  border: 0;
+  border-radius: 999px;
+  background: var(--accent);
+  color: #08101f;
+  font: inherit;
+  font-weight: 650;
+  font-size: .9375rem;
+  cursor: pointer;
+  box-shadow: 0 .5rem 1.5rem rgba(0, 0, 0, .5);
+}
+.jump[hidden] { display: none; }
+.jump svg { width: 1.125rem; height: 1.125rem; fill: none; stroke: currentColor; stroke-width: 2.5; stroke-linecap: round; stroke-linejoin: round; }
+
+.toast {
+  position: fixed;
+  left: 50%;
+  transform: translateX(-50%);
+  bottom: calc(4.5rem + env(safe-area-inset-bottom));
+  background: var(--raised);
+  border: 1px solid var(--line);
+  color: var(--text);
+  padding: .625rem 1rem;
+  border-radius: 999px;
+  font-size: .875rem;
+  max-width: calc(100vw - 2.5rem);
+  text-align: center;
+  z-index: 10;
+}
+.toast[hidden] { display: none; }
+
+/* Text-size steps, driven by the Aa button. */
+body.size-2 { --cap-size: 1.875rem; }
+body.size-3 { --cap-size: 2.375rem; --cap-lead: 1.45; }
+
+/* Right-to-left scripts. */
+#reader[dir="rtl"] .stream,
+#reader[dir="rtl"] .lines { text-align: right; }
+
+/* The "EN" button: tap it to see the preacher's own words under each line. */
+.bar-btn-src { font-size: .8125rem; letter-spacing: .04em; color: var(--muted); }
+.bar-btn-src[aria-pressed="true"] { color: var(--accent); background: var(--raised); }
+
+/* ---- voice picker: only appears when speech is on and there is a choice ---- */
+.voicebar {
+  flex: none;
+  position: sticky;
+  top: 0;
+  z-index: 5;
+  display: flex;
+  align-items: center;
+  gap: .625rem;
+  padding: .5rem 1.125rem .5625rem;
+  border-bottom: 1px solid var(--line);
+  background: var(--surface);
+}
+.voicebar label {
+  font-size: .6875rem;
+  letter-spacing: .08em;
+  text-transform: uppercase;
+  color: var(--muted);
+  flex: none;
+}
+.voicebar select {
+  flex: 1;
+  min-width: 0;
+  appearance: none;
+  background: var(--raised);
+  color: var(--text);
+  border: 1px solid var(--line);
+  border-radius: 9px;
+  padding: .4375rem .75rem;
+  font: inherit;
+  font-size: .875rem;
+}
+.voicebar select:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
+
+/* Voices come from the device, not from us. When it has few or poor ones, say
+   where better ones live rather than letting people conclude we sound bad. */
+.voicehint {
+  flex: none;
+  margin: 0;
+  padding: .5rem 1.125rem .625rem;
+  font-size: .78125rem;
+  line-height: 1.45;
+  color: var(--muted);
+  background: var(--surface);
+  border-bottom: 1px solid var(--line);
+}
+.voicehint[hidden] { display: none; }
+.voicehint b { color: var(--text); font-weight: 600; }
+
+/* iOS renders no native clear control for type=search — this is it. Centered
+   on the input (not .search-wrap, which grows when results render). */
+.search-box { position: relative; }
+#search { padding-inline-end: 3.25rem; font-size: max(1rem, 16px); }
+.search-clear {
+  position: absolute; top: 50%; right: .5rem; transform: translateY(-50%);
+  width: 2.25rem; height: 2.25rem; border: 0; border-radius: 50%;
+  background: rgba(148,163,184,.18); color: #cbd5e6; cursor: pointer;
+  display: flex; align-items: center; justify-content: center;
+}
+.search-clear svg { width: .875rem; height: .875rem; stroke: currentColor; stroke-width: 2.5; fill: none; }
+.search-clear:active { background: rgba(148,163,184,.32); }

app/server/public/operator.css

@@ -0,0 +1,201 @@
+/*
+ * operator.css — the sound desk view.
+ *
+ * The START button is deliberately enormous. On a Sunday it is pressed once,
+ * often by a volunteer, sometimes in the dark, sometimes on a tablet, usually
+ * while three other things are going wrong.
+ */
+
+/*
+ * Make the `hidden` attribute actually hide things.
+ *
+ * The browser's own [hidden] rule is `display: none`, but it lives in the user-
+ * agent stylesheet, so any author rule that sets `display` — every .warn,
+ * .toast and flex row below — silently outranks it. The element stays on
+ * screen with hidden="true" and the JavaScript looks like it isn't running.
+ * That is how the operator console ended up permanently insisting the Mac
+ * engine was disconnected while it was sitting there working.
+ */
+[hidden] { display: none !important; }
+
+:root {
+  --bg: #0b0d12; --surface: #151922; --raised: #1d2331; --line: #2a3244;
+  --text: #eef1f6; --muted: #8b93a7; --accent: #6ea8fe;
+  --go: #2fbf71; --stop: #e5484d; --warn: #f5a524;
+}
+
+* { box-sizing: border-box; }
+
+body {
+  margin: 0;
+  background: var(--bg);
+  color: var(--text);
+  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", system-ui, sans-serif;
+  -webkit-text-size-adjust: 100%;
+}
+
+h1 { font-size: 1.5rem; margin: 0; font-weight: 650; }
+h2 { font-size: 1.0625rem; margin: 0 0 .375rem; font-weight: 650; }
+h2.mt { margin-top: 1.75rem; }
+p  { margin: 0 0 .875rem; line-height: 1.5; }
+code { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: .8125rem; }
+
+.muted { color: var(--muted); font-size: .875rem; }
+.tiny  { font-size: .8125rem; }
+.err   { color: var(--stop); font-size: .875rem; }
+.eyebrow { font-size: .75rem; letter-spacing: .12em; text-transform: uppercase; color: var(--muted); margin-bottom: .25rem; }
+
+/* ---- PIN gate ---- */
+.gate { display: none; min-height: 100dvh; place-items: center; padding: 1.25rem; }
+.gate.is-active { display: grid; }
+#console { display: none; }
+#console.is-active { display: block; }
+
+.gate-card {
+  width: 100%; max-width: 21rem;
+  background: var(--surface); border: 1px solid var(--line);
+  border-radius: 18px; padding: 1.75rem;
+  display: flex; flex-direction: column; gap: .75rem;
+}
+
+/* ---- shell ---- */
+.wrap { max-width: 46rem; margin: 0 auto; padding: 1.5rem 1.125rem 5rem; }
+.top { display: flex; align-items: flex-start; justify-content: space-between; gap: 1rem; margin-bottom: 1.25rem; }
+.ghost { color: var(--accent); text-decoration: none; font-size: .875rem; white-space: nowrap; }
+.ghost:hover { text-decoration: underline; }
+
+.card {
+  background: var(--surface); border: 1px solid var(--line);
+  border-radius: 18px; padding: 1.375rem; margin-bottom: 1rem;
+}
+.card.control { padding-bottom: 1rem; }
+
+/* ---- the button ---- */
+.big {
+  width: 100%; min-height: 8.5rem;
+  border: 0; border-radius: 16px; cursor: pointer;
+  display: flex; flex-direction: column; align-items: center; justify-content: center; gap: .375rem;
+  background: var(--go); color: #052e18;
+  font: inherit; transition: background .18s ease, transform .08s ease;
+}
+.big:active { transform: scale(.99); }
+.big:focus-visible { outline: 3px solid var(--accent); outline-offset: 3px; }
+.big[data-live="true"] { background: var(--stop); color: #fff; }
+.big[disabled] { background: var(--raised); color: var(--muted); cursor: not-allowed; }
+.big-label { font-size: 1.625rem; font-weight: 750; letter-spacing: .02em; }
+.big-sub { font-size: .9375rem; opacity: .85; }
+
+.stats { display: grid; grid-template-columns: repeat(3, 1fr); gap: .5rem; margin-top: 1rem; }
+.stat { background: var(--raised); border-radius: 12px; padding: .75rem; text-align: center; }
+.stat b { display: block; font-size: 1.375rem; font-weight: 700; }
+.stat span { font-size: .75rem; color: var(--muted); }
+
+.warn {
+  margin-top: 1rem; padding: .875rem 1rem;
+  background: rgba(245, 165, 36, .12);
+  border: 1px solid rgba(245, 165, 36, .4);
+  border-radius: 12px; font-size: .875rem; line-height: 1.5;
+  display: flex; flex-direction: column; gap: .25rem;
+}
+.warn strong { color: var(--warn); }
+
+.enginebar {
+  margin-top: .75rem; font-size: .8125rem; color: var(--muted);
+  display: flex; flex-wrap: wrap; gap: .875rem;
+}
+
+/* ---- inputs ---- */
+input, textarea, select {
+  width: 100%; padding: .75rem .875rem;
+  background: var(--raised); color: var(--text);
+  border: 1px solid var(--line); border-radius: 10px;
+  font: inherit; font-size: .9375rem; outline: none;
+}
+input:focus, textarea:focus { border-color: var(--accent); }
+textarea { resize: vertical; font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: .8125rem; line-height: 1.6; }
+label { display: block; font-size: .875rem; color: var(--muted); margin-bottom: .5rem; }
+label input { margin-top: .375rem; }
+
+.btn {
+  appearance: none; border: 1px solid var(--line);
+  background: var(--raised); color: var(--text);
+  padding: .6875rem 1.125rem; border-radius: 10px;
+  font: inherit; font-size: .9375rem; font-weight: 550;
+  cursor: pointer; text-decoration: none; display: inline-block; text-align: center;
+}
+.btn:hover { background: #262d3d; }
+.btn-primary { background: var(--accent); border-color: var(--accent); color: #08101f; font-weight: 650; }
+.row { display: flex; gap: .5rem; align-items: center; flex-wrap: wrap; margin-top: .75rem; }
+.row .btn { flex: none; }
+.row input { flex: 1; min-width: 10rem; }
+
+/* ---- language chips ---- */
+.chips { display: flex; flex-wrap: wrap; gap: .4375rem; margin-bottom: .75rem; min-height: 2rem; }
+.chip {
+  display: inline-flex; align-items: center; gap: .4375rem;
+  background: var(--raised); border: 1px solid var(--line);
+  border-radius: 999px; padding: .375rem .5rem .375rem .8125rem;
+  font-size: .875rem;
+}
+.chip button {
+  appearance: none; border: 0; background: transparent; color: var(--muted);
+  cursor: pointer; font-size: 1.125rem; line-height: 1; padding: 0 .25rem;
+}
+.chip button:hover { color: var(--stop); }
+.chips:empty::before { content: "None yet"; color: var(--muted); font-size: .875rem; }
+
+.results { display: grid; gap: .25rem; margin-top: .5rem; max-height: 15rem; overflow-y: auto; }
+.results:empty { display: none; }
+.results button {
+  appearance: none; text-align: left; width: 100%;
+  background: var(--raised); border: 1px solid transparent; color: var(--text);
+  border-radius: 8px; padding: .5625rem .75rem; font: inherit; font-size: .875rem; cursor: pointer;
+}
+.results button:hover { border-color: var(--accent); }
+.results button span { color: var(--muted); margin-left: .5rem; font-size: .8125rem; }
+
+/* ---- qr + code ---- */
+.qrrow { display: flex; gap: 1.25rem; flex-wrap: wrap; align-items: flex-start; }
+.qr { width: 10rem; height: 10rem; background: #fff; border-radius: 12px; padding: .5rem; flex: none; }
+.qrside { flex: 1; min-width: 14rem; }
+
+.codeblock {
+  display: flex; align-items: center; gap: .5rem;
+  background: var(--raised); border: 1px solid var(--line);
+  border-radius: 10px; padding: .625rem .75rem; margin-bottom: .5rem;
+}
+.codeblock code { flex: 1; overflow-x: auto; white-space: nowrap; color: #cbd5e6; }
+.copy {
+  appearance: none; border: 0; background: var(--line); color: var(--text);
+  border-radius: 7px; padding: .3125rem .625rem; font: inherit; font-size: .75rem; cursor: pointer; flex: none;
+}
+.copy:hover { background: var(--accent); color: #08101f; }
+
+.toast {
+  position: fixed; left: 50%; transform: translateX(-50%);
+  bottom: 1.5rem; background: var(--raised); border: 1px solid var(--line);
+  padding: .6875rem 1.125rem; border-radius: 999px; font-size: .875rem; z-index: 20;
+}
+.toast[hidden] { display: none; }
+
+@media (max-width: 30rem) {
+  .big-label { font-size: 1.375rem; }
+  .qr { width: 100%; height: auto; max-width: 15rem; margin: 0 auto; }
+}
+
+/* ---- who is listening, by language ---- */
+.wholist { display: flex; flex-wrap: wrap; gap: .4375rem; margin-top: .75rem; }
+.wholist[hidden] { display: none; }
+.who {
+  display: inline-flex; align-items: baseline; gap: .4375rem;
+  background: var(--raised); border: 1px solid var(--line);
+  border-radius: 999px; padding: .3125rem .75rem;
+  font-size: .8125rem;
+}
+.who b { font-variant-numeric: tabular-nums; font-weight: 700; font-size: .9375rem; }
+.who span { color: var(--muted); }
+
+.op-health { margin: .5rem 0 0; font-size: .8125rem; font-weight: 600; text-align: center; }
+.op-health[data-level="green"] { color: #4ade80; }
+.op-health[data-level="amber"] { color: #fbbf24; }
+.op-health[data-level="red"]   { color: #f87171; }

app/server/public/operator.html

@@ -0,0 +1,129 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
+<meta name="theme-color" content="#0b0d12">
+<meta name="color-scheme" content="dark">
+<title>Translation — Operator</title>
+<link rel="stylesheet" href="/operator.css">
+</head>
+<body>
+
+<!-- PIN gate ------------------------------------------------------------- -->
+<section id="gate" class="gate is-active">
+  <form id="gateForm" class="gate-card">
+    <h1>Operator</h1>
+    <p class="muted">Enter the PIN for this church's translation system.</p>
+    <input id="pin" type="password" inputmode="numeric" autocomplete="current-password"
+           placeholder="PIN" aria-label="Operator PIN" required>
+    <button type="submit" class="btn btn-primary">Unlock</button>
+    <p id="gateErr" class="err" hidden></p>
+    <p class="muted tiny">The PIN is in <code>data/OPERATOR-PIN.txt</code> on the NAS.</p>
+  </form>
+</section>
+
+<!-- Console -------------------------------------------------------------- -->
+<main id="console" class="wrap">
+
+  <header class="top">
+    <div>
+      <div class="eyebrow">Live Translation</div>
+      <h1 id="svcName">—</h1>
+    </div>
+    <a class="ghost" href="/" target="_blank" rel="noopener">Listener view ↗</a>
+  </header>
+
+  <!-- The one control that matters on a Sunday morning. -->
+  <section class="card control">
+    <button id="bigBtn" class="big" data-live="false">
+      <span class="big-label">START TRANSLATING</span>
+      <span class="big-sub" id="bigSub">Ready</span>
+    </button>
+    <p class="op-health" id="opHealth" hidden></p>
+    <div class="stats">
+      <div class="stat"><b id="stListeners">0</b><span>listening</span></div>
+      <div class="stat"><b id="stLangs">0</b><span>languages</span></div>
+      <div class="stat"><b id="stElapsed">—</b><span>elapsed</span></div>
+    </div>
+
+    <!-- Who is actually reading, and in what. The total alone does not tell you
+         whether a language is worth keeping. -->
+    <div id="whoList" class="wholist" hidden></div>
+
+    <div id="engineWarn" class="warn" hidden>
+      <strong>The Mac engine is not connected.</strong>
+      <span>Open <em>Church Translate Engine</em> on the backstage Mac Studio. Nothing will translate until it is running.</span>
+    </div>
+    <div id="engineInfo" class="enginebar" hidden></div>
+  </section>
+
+  <!-- Languages ---------------------------------------------------------- -->
+  <section class="card">
+    <h2>Languages on the front page</h2>
+    <p class="muted">These show as big buttons before anyone searches. Everything else
+      is still reachable through search — all <b id="totalLangs">0</b> of them.</p>
+    <div id="featuredList" class="chips"></div>
+    <input id="langSearch" type="search" placeholder="Add a language…" autocomplete="off">
+    <div id="langResults" class="results"></div>
+
+    <h2 class="mt">Always translate</h2>
+    <p class="muted">Normally a language is only translated while someone is actually
+      listening to it. Pin one here to have it ready before the first person arrives.</p>
+    <div id="pinnedList" class="chips"></div>
+  </section>
+
+  <!-- Glossary ----------------------------------------------------------- -->
+  <section class="card">
+    <h2>Corrections</h2>
+    <p class="muted">One per line, in the form
+      <code>what it heard =&gt; what it should say</code>. This is how “have a cook”
+      becomes “Habakkuk” and your pastor’s name stops being a different word every
+      week. Matching ignores capitals and only hits whole words.</p>
+    <textarea id="bias" rows="7" spellcheck="false"></textarea>
+    <button id="saveGlossary" class="btn">Save corrections</button>
+  </section>
+
+  <!-- Setup -------------------------------------------------------------- -->
+  <section class="card">
+    <h2>The QR code</h2>
+    <div class="qrrow">
+      <img id="qr" class="qr" alt="QR code to the listener page">
+      <div class="qrside">
+        <label>Public address
+          <input id="publicUrl" type="url" placeholder="https://translate.yourchurch.org" spellcheck="false">
+        </label>
+        <p class="muted tiny">Leave blank to use whatever address this page was opened at.
+          Set it once the Cloudflare tunnel is up so the QR code always points at the public name.</p>
+        <div class="row">
+          <button id="savePublic" class="btn">Save</button>
+          <a id="posterLink" class="btn" href="/poster" target="_blank" rel="noopener">Printable poster ↗</a>
+        </div>
+      </div>
+    </div>
+  </section>
+
+  <section class="card">
+    <h2>Stream Deck / Companion</h2>
+    <p class="muted">Add a <b>Generic HTTP</b> action in Companion. Method GET, and one of:</p>
+    <div class="codeblock"><code id="urlToggle">—</code><button class="copy" data-copy="urlToggle">Copy</button></div>
+    <div class="codeblock"><code id="urlStart">—</code><button class="copy" data-copy="urlStart">Copy</button></div>
+    <div class="codeblock"><code id="urlStop">—</code><button class="copy" data-copy="urlStop">Copy</button></div>
+    <p class="muted tiny">Keep this key off the projector — anyone with it can start and stop translation.</p>
+  </section>
+
+  <section class="card">
+    <h2>Change the PIN</h2>
+    <div class="row">
+      <input id="newPin" type="password" placeholder="New PIN (4+ characters)" autocomplete="new-password">
+      <button id="savePin" class="btn">Update PIN</button>
+    </div>
+  </section>
+
+  <div id="toast" class="toast" hidden></div>
+</main>
+
+<script src="/languages.js"></script>
+<script src="/operator.js"></script>
+</body>
+</html>

app/server/public/operator.js

@@ -0,0 +1,333 @@
+/*
+ * operator.js — the sound desk console.
+ *
+ * Everything here is secondary to one thing: the big button has to be right,
+ * and it has to tell the truth about whether the system is actually working.
+ * A green "START" on a Sunday when the Mac engine is closed would be worse
+ * than no button at all, so the button disables itself when there is no engine.
+ */
+
+(function () {
+  'use strict';
+
+  var $ = function (id) { return document.getElementById(id); };
+  var PIN_KEY = 'ct.pin';
+
+  var app = { pin: null, cfg: null, status: null, ws: null, base: location.origin, elapsedTimer: null };
+
+  var toastTimer = null;
+  function toast(msg) {
+    var t = $('toast');
+    t.textContent = msg;
+    t.hidden = false;
+    clearTimeout(toastTimer);
+    toastTimer = setTimeout(function () { t.hidden = true; }, 2600);
+  }
+
+  function api(path, opts) {
+    opts = opts || {};
+    opts.headers = Object.assign({ 'X-Operator-Pin': app.pin }, opts.headers || {});
+    if (opts.body) opts.headers['Content-Type'] = 'application/json';
+    return fetch(path, opts).then(function (r) {
+      return r.json().then(function (j) {
+        if (!r.ok) throw new Error(j.error || ('HTTP ' + r.status));
+        return j;
+      });
+    });
+  }
+
+  function save(patch, okMsg) {
+    return api('/api/config', { method: 'POST', body: JSON.stringify(patch) })
+      .then(function (j) { app.cfg = j.config; toast(okMsg || 'Saved'); return j; })
+      .catch(function (e) { toast('Could not save: ' + e.message); throw e; });
+  }
+
+  // ───────────────────────────────────────────── gate
+
+  $('gateForm').addEventListener('submit', function (e) {
+    e.preventDefault();
+    var pin = $('pin').value.trim();
+    if (!pin) return;
+    app.pin = pin;
+    api('/api/config')
+      .then(function (j) {
+        try { sessionStorage.setItem(PIN_KEY, pin); } catch (_) {}
+        $('gateErr').hidden = true;
+        enterConsole(j);
+      })
+      .catch(function () {
+        app.pin = null;
+        $('gateErr').textContent = 'That PIN was not accepted.';
+        $('gateErr').hidden = false;
+        $('pin').value = '';
+        $('pin').focus();
+      });
+  });
+
+  function enterConsole(j) {
+    app.cfg = j.config;
+    app.status = j.status;
+    app.base = (j.config.publicUrl || j.publicBase || location.origin).replace(/\/+$/, '');
+    $('gate').classList.remove('is-active');
+    $('console').classList.add('is-active');
+    $('totalLangs').textContent = Languages.LANGS.length;
+    renderConfig();
+    renderStatus(j.status);
+    connect();
+  }
+
+  // ───────────────────────────────────────────── status + big button
+
+  function fmtElapsed(since) {
+    if (!since) return '—';
+    var s = Math.max(0, Math.floor((Date.now() - since) / 1000));
+    var m = Math.floor(s / 60);
+    return m + ':' + String(s % 60).padStart(2, '0');
+  }
+
+  /* One chip per language actually being read, busiest first. */
+  function renderWho(rows) {
+    var box = $('whoList');
+    box.textContent = '';
+    if (!rows.length) { box.hidden = true; return; }
+    box.hidden = false;
+
+    rows.forEach(function (row) {
+      var l = Languages.get(row.code);
+      var el = document.createElement('span');
+      el.className = 'who';
+      var n = document.createElement('b');
+      n.textContent = row.count;
+      var name = document.createElement('span');
+      name.textContent = l ? l.native : row.code;
+      el.appendChild(n);
+      el.appendChild(name);
+      box.appendChild(el);
+    });
+  }
+
+  function renderStatus(st) {
+    if (!st) return;
+    app.status = st;
+    $('svcName').textContent = st.serviceName || 'Live Translation';
+
+    /* The traffic light — computed on the server so every surface agrees. */
+    var hl = $('opHealth');
+    if (hl) {
+      hl.hidden = !st.health;
+      if (st.health) {
+        hl.setAttribute('data-level', st.health.level);
+        hl.textContent = st.health.detail;
+      }
+    }
+
+    var live = !!st.live;
+    var ready = !!st.engineConnected;
+    var btn = $('bigBtn');
+
+    btn.dataset.live = live ? 'true' : 'false';
+    btn.disabled = !ready && !live;
+    btn.querySelector('.big-label').textContent = live ? 'STOP TRANSLATING' : 'START TRANSLATING';
+    var stale = !!st.engineStale;
+
+    $('bigSub').textContent = stale
+      ? 'The Mac engine has stopped responding'
+      : live ? 'On air — the congregation is reading'
+      : (ready ? 'Engine ready' : 'Waiting for the Mac engine');
+
+    /* Connected-but-silent is the dangerous state: the socket is up, so
+       everything looks healthy, but nothing is being transcribed. */
+    $('engineWarn').hidden = ready && !stale;
+    if (stale) {
+      $('engineWarn').querySelector('strong').textContent = 'The Mac engine is connected but silent.';
+      $('engineWarn').querySelector('span').textContent =
+        'It has not reported for over 10 seconds. Quit and reopen Church Translate Engine on the Mac Studio.';
+    } else if (!ready) {
+      $('engineWarn').querySelector('strong').textContent = 'The Mac engine is not connected.';
+      $('engineWarn').querySelector('span').textContent =
+        'Open Church Translate Engine on the backstage Mac Studio. Nothing will translate until it is running.';
+    }
+
+    $('stListeners').textContent = st.listeners || 0;
+    $('stLangs').textContent = (st.activeLanguages || []).length;
+    $('stElapsed').textContent = fmtElapsed(st.startedAt);
+
+    renderWho(st.listenersByLanguage || []);
+
+    clearInterval(app.elapsedTimer);
+    if (live && st.startedAt) {
+      app.elapsedTimer = setInterval(function () {
+        $('stElapsed').textContent = fmtElapsed(st.startedAt);
+      }, 1000);
+    }
+
+    var es = st.engineStatus || {};
+    var bits = [];
+    if (es.device) bits.push('🎙 ' + es.device);
+    if (es.model) bits.push('🧠 ' + es.model);
+    if (typeof es.peakDb === 'number' && es.peakDb > -99) {
+      /* Peak over the last few seconds — an instantaneous sample lands between
+         syllables and reads as silence on a working feed. */
+      bits.push('📶 ' + es.peakDb + ' dB peak' + (es.peakDb < -40 ? ' (low)' : ''));
+    } else if (typeof es.rms === 'number') {
+      bits.push('📶 ' + (es.rms > 0.002 ? 'audio present' : 'silent'));
+    }
+    if (typeof es.lagMs === 'number') bits.push('⏱ ' + Math.round(es.lagMs) + ' ms behind');
+    $('engineInfo').textContent = bits.join('   ');
+    $('engineInfo').hidden = bits.length === 0;
+  }
+
+  $('bigBtn').addEventListener('click', function () {
+    if (!app.ws || app.ws.readyState !== 1) { toast('Not connected to the server.'); return; }
+    app.ws.send(JSON.stringify({ t: 'toggle' }));
+  });
+
+  function connect() {
+    var proto = location.protocol === 'https:' ? 'wss:' : 'ws:';
+    var ws = new WebSocket(proto + '//' + location.host + '/ws?role=operator&pin=' + encodeURIComponent(app.pin));
+    app.ws = ws;
+    ws.onmessage = function (ev) {
+      var m;
+      try { m = JSON.parse(ev.data); } catch (_) { return; }
+      if (m.t === 'status') renderStatus(m.status);
+    };
+    ws.onclose = function () {
+      if (app.ws !== ws) return;
+      app.ws = null;
+      setTimeout(connect, 2000);
+    };
+  }
+
+  // ───────────────────────────────────────────── languages
+
+  function chip(code, onRemove) {
+    var l = Languages.get(code) || { native: code, name: code };
+    var el = document.createElement('span');
+    el.className = 'chip';
+    el.textContent = l.native === l.name ? l.native : l.native + ' · ' + l.name;
+    var x = document.createElement('button');
+    x.type = 'button';
+    x.setAttribute('aria-label', 'Remove ' + l.name);
+    x.textContent = '×';
+    x.addEventListener('click', function () { onRemove(code); });
+    el.appendChild(x);
+    return el;
+  }
+
+  function renderConfig() {
+    var cfg = app.cfg;
+
+    var f = $('featuredList');
+    f.textContent = '';
+    (cfg.featured || []).forEach(function (code) {
+      f.appendChild(chip(code, function (c) {
+        save({ featured: cfg.featured.filter(function (x) { return x !== c; }) })
+          .then(renderConfig);
+      }));
+    });
+
+    var p = $('pinnedList');
+    p.textContent = '';
+    (cfg.pinned || []).forEach(function (code) {
+      p.appendChild(chip(code, function (c) {
+        save({ pinned: cfg.pinned.filter(function (x) { return x !== c; }) })
+          .then(renderConfig);
+      }));
+    });
+
+    $('bias').value = ((cfg.glossary && cfg.glossary.fixes) || []).join('\n');
+    $('publicUrl').value = cfg.publicUrl || '';
+
+    var base = (cfg.publicUrl || app.base).replace(/\/+$/, '');
+    $('qr').src = '/qr.svg?url=' + encodeURIComponent(base + '/');
+    $('posterLink').href = '/poster?pin=' + encodeURIComponent(app.pin);
+
+    var key = encodeURIComponent(cfg.controlToken);
+    $('urlToggle').textContent = base + '/api/control/toggle?key=' + key;
+    $('urlStart').textContent  = base + '/api/control/start?key='  + key;
+    $('urlStop').textContent   = base + '/api/control/stop?key='   + key;
+  }
+
+  var searchTimer = null;
+  $('langSearch').addEventListener('input', function (e) {
+    var q = e.target.value;
+    clearTimeout(searchTimer);
+    searchTimer = setTimeout(function () { renderLangResults(q); }, 90);
+  });
+
+  function renderLangResults(q) {
+    var box = $('langResults');
+    box.textContent = '';
+    if (!q.trim()) return;
+    Languages.search(q).slice(0, 25).forEach(function (l) {
+      var b = document.createElement('button');
+      b.type = 'button';
+      b.textContent = l.native;
+      var s = document.createElement('span');
+      s.textContent = l.name;
+      b.appendChild(s);
+      b.addEventListener('click', function () {
+        var featured = (app.cfg.featured || []).slice();
+        if (featured.indexOf(l.code) === -1) featured.push(l.code);
+        save({ featured: featured }, l.name + ' added').then(function () {
+          $('langSearch').value = '';
+          box.textContent = '';
+          renderConfig();
+        });
+      });
+      box.appendChild(b);
+    });
+  }
+
+  // ───────────────────────────────────────────── the rest
+
+  $('saveGlossary').addEventListener('click', function () {
+    var lines = $('bias').value.split('\n').map(function (s) { return s.trim(); }).filter(Boolean);
+    /* Warn rather than silently drop: a line without "=>" is not a correction
+       and would otherwise look saved while doing nothing. */
+    var bad = lines.filter(function (l) { return l.indexOf('=>') === -1; });
+    var good = lines.filter(function (l) { return l.indexOf('=>') !== -1; });
+    var glossary = Object.assign({}, app.cfg.glossary, { fixes: good });
+    save({ glossary: glossary }, bad.length
+      ? (good.length + ' saved · ' + bad.length + ' line(s) ignored, they need "=>"')
+      : (good.length + ' corrections saved'));
+  });
+
+  $('savePublic').addEventListener('click', function () {
+    save({ publicUrl: $('publicUrl').value.trim() }, 'Address saved').then(renderConfig);
+  });
+
+  $('savePin').addEventListener('click', function () {
+    var pin = $('newPin').value.trim();
+    if (pin.length < 4) { toast('Use at least 4 characters.'); return; }
+    save({ operatorPin: pin }, 'PIN updated').then(function () {
+      app.pin = pin;
+      try { sessionStorage.setItem(PIN_KEY, pin); } catch (_) {}
+      $('newPin').value = '';
+      renderConfig();
+    });
+  });
+
+  document.addEventListener('click', function (e) {
+    var btn = e.target.closest('.copy');
+    if (!btn) return;
+    var text = $(btn.dataset.copy).textContent;
+    navigator.clipboard.writeText(text)
+      .then(function () { toast('Copied'); })
+      .catch(function () { toast('Copy failed — select it by hand'); });
+  });
+
+  // Resume a session on reload without retyping the PIN.
+  var saved = null;
+  try { saved = sessionStorage.getItem(PIN_KEY); } catch (_) {}
+  if (saved) {
+    app.pin = saved;
+    api('/api/config').then(enterConsole).catch(function () {
+      app.pin = null;
+      try { sessionStorage.removeItem(PIN_KEY); } catch (_) {}
+      $('pin').focus();
+    });
+  } else {
+    $('pin').focus();
+  }
+})();

app/server/public/poster.html

@@ -0,0 +1,94 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Translation — Poster</title>
+<style>
+  :root { --ink: #10131a; --muted: #5b6478; }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0; background: #f4f5f8; color: var(--ink);
+    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", system-ui, sans-serif;
+    display: grid; place-items: center; min-height: 100vh; padding: 1.5rem;
+  }
+  .sheet {
+    width: 100%; max-width: 46rem; aspect-ratio: 8.5 / 11;
+    background: #fff; border-radius: 12px; box-shadow: 0 1.5rem 3rem rgba(0,0,0,.12);
+    padding: 3.5rem 3rem; display: flex; flex-direction: column; align-items: center;
+    text-align: center; gap: 1.25rem;
+  }
+  .church { font-size: .875rem; letter-spacing: .18em; text-transform: uppercase; color: var(--muted); }
+  h1 { font-size: 2.75rem; line-height: 1.1; margin: 0; font-weight: 750; letter-spacing: -.01em; }
+  .sub { font-size: 1.25rem; color: var(--muted); margin: 0; }
+  .qr { width: 17rem; height: 17rem; margin: .5rem 0; }
+  .url { font-size: 1.125rem; font-weight: 600; letter-spacing: .01em; word-break: break-all; }
+  .langs {
+    display: flex; flex-wrap: wrap; justify-content: center; gap: .5rem .875rem;
+    font-size: 1.0625rem; color: var(--ink); margin-top: auto; padding-top: 1.25rem;
+    border-top: 1px solid #e3e6ec; width: 100%;
+  }
+  .langs span { white-space: nowrap; }
+  .foot { font-size: .8125rem; color: var(--muted); }
+  .bar { max-width: 46rem; width: 100%; display: flex; gap: .5rem; justify-content: flex-end; margin-bottom: .75rem; }
+  .bar button {
+    border: 1px solid #d3d8e2; background: #fff; color: var(--ink);
+    padding: .5rem 1rem; border-radius: 8px; font: inherit; font-size: .875rem; cursor: pointer;
+  }
+  @media print {
+    body { background: #fff; padding: 0; display: block; }
+    .bar { display: none; }
+    .sheet { box-shadow: none; border-radius: 0; max-width: none; width: 100%; aspect-ratio: auto; min-height: 100vh; }
+  }
+</style>
+</head>
+<body>
+<div class="bar"><button onclick="window.print()">Print</button></div>
+<div class="sheet">
+  <div class="church" id="church">—</div>
+  <h1 id="head">Listen in your language</h1>
+  <p class="sub" id="sub">Scan with your phone camera</p>
+  <img class="qr" id="qr" alt="QR code">
+  <div class="url" id="url">—</div>
+  <div class="langs" id="langs"></div>
+  <div class="foot">Free · No app to download · Works on any phone</div>
+</div>
+
+<script src="/languages.js"></script>
+<script>
+(function () {
+  var params = new URLSearchParams(location.search);
+  var pin = params.get('pin');
+
+  /* "Listen in your language" written in the languages most likely to be in the
+     room — a poster nobody can read is just decoration. */
+  var INVITES = ['Escucha en tu idioma', '用您的语言收听', 'Écoutez dans votre langue',
+                 'Ouça no seu idioma', '당신의 언어로 들으세요', 'Nghe bằng ngôn ngữ của bạn',
+                 'Koute nan lang ou', 'استمع بلغتك', 'Слухайте своєю мовою', 'Sikiliza kwa lugha yako'];
+
+  function render(cfg, base) {
+    document.getElementById('church').textContent = cfg.serviceName || '';
+    document.getElementById('url').textContent = base.replace(/^https?:\/\//, '');
+    document.getElementById('qr').src = '/qr.svg?url=' + encodeURIComponent(base + '/');
+    var box = document.getElementById('langs');
+    box.textContent = '';
+    INVITES.forEach(function (t) {
+      var s = document.createElement('span');
+      s.textContent = t;
+      box.appendChild(s);
+    });
+  }
+
+  var url = pin ? '/api/config' : '/api/languages';
+  var opts = pin ? { headers: { 'X-Operator-Pin': pin } } : {};
+  fetch(url, opts).then(function (r) { return r.json(); }).then(function (j) {
+    var cfg = j.config || j;
+    var base = (cfg.publicUrl || j.publicBase || location.origin).replace(/\/+$/, '');
+    render(cfg, base);
+  }).catch(function () {
+    render({ serviceName: '' }, location.origin);
+  });
+})();
+</script>
+</body>
+</html>

app/server/public/ui-strings.js

@@ -0,0 +1,68 @@
+/*
+ * ui-strings.js — the handful of words on the listener page itself.
+ *
+ * Someone who needs a Spanish sermon should not have to read an English button
+ * to get it. These are hand-written for the languages a US church sees most;
+ * anything else falls back to English, and the picker still shows every
+ * language in its own script.
+ *
+ * Order: choose, waiting, speak, stop, reconnecting, change, original, live
+ */
+(function (root, factory) {
+  if (typeof module === 'object' && module.exports) module.exports = factory();
+  else root.UIStrings = factory();
+}(typeof self !== 'undefined' ? self : this, function () {
+
+  var KEYS = ['choose', 'waiting', 'speak', 'stop', 'reconnecting', 'change', 'original', 'live'];
+
+  var TABLE = {
+    eng_Latn: ['Choose your language', "The message hasn't started yet", 'Speak aloud', 'Stop', 'Reconnecting…', 'Change language', 'Show original', 'Live'],
+    spa_Latn: ['Elige tu idioma', 'El mensaje aún no ha comenzado', 'Leer en voz alta', 'Detener', 'Reconectando…', 'Cambiar idioma', 'Ver original', 'En vivo'],
+    zho_Hans: ['选择您的语言', '信息尚未开始', '朗读', '停止', '正在重新连接…', '更换语言', '显示原文', '直播中'],
+    zho_Hant: ['選擇您的語言', '信息尚未開始', '朗讀', '停止', '正在重新連線…', '更換語言', '顯示原文', '直播中'],
+    yue_Hant: ['揀你嘅語言', '信息仲未開始', '朗讀', '停止', '重新連線緊…', '轉語言', '顯示原文', '直播中'],
+    fra_Latn: ['Choisissez votre langue', "Le message n'a pas encore commencé", 'Lire à voix haute', 'Arrêter', 'Reconnexion…', 'Changer de langue', "Voir l'original", 'En direct'],
+    por_Latn: ['Escolha o seu idioma', 'A mensagem ainda não começou', 'Ler em voz alta', 'Parar', 'Reconectando…', 'Mudar idioma', 'Ver original', 'Ao vivo'],
+    por_PT:   ['Escolha o seu idioma', 'A mensagem ainda não começou', 'Ler em voz alta', 'Parar', 'A restabelecer ligação…', 'Mudar idioma', 'Ver original', 'Em direto'],
+    kor_Hang: ['언어를 선택하세요', '메시지가 아직 시작되지 않았습니다', '소리내어 읽기', '중지', '다시 연결 중…', '언어 변경', '원문 보기', '실시간'],
+    vie_Latn: ['Chọn ngôn ngữ của bạn', 'Bài giảng chưa bắt đầu', 'Đọc to', 'Dừng', 'Đang kết nối lại…', 'Đổi ngôn ngữ', 'Xem bản gốc', 'Trực tiếp'],
+    hat_Latn: ['Chwazi lang ou', 'Mesaj la poko kòmanse', 'Li awotvwa', 'Sispann', 'N ap rekonekte…', 'Chanje lang', 'Montre orijinal la', 'An dirèk'],
+    arb_Arab: ['اختر لغتك', 'لم تبدأ الرسالة بعد', 'القراءة بصوت عالٍ', 'إيقاف', 'جارٍ إعادة الاتصال…', 'تغيير اللغة', 'عرض النص الأصلي', 'مباشر'],
+    rus_Cyrl: ['Выберите язык', 'Проповедь ещё не началась', 'Читать вслух', 'Стоп', 'Переподключение…', 'Сменить язык', 'Показать оригинал', 'В эфире'],
+    ukr_Cyrl: ['Оберіть мову', 'Проповідь ще не почалася', 'Читати вголос', 'Стоп', 'Перепідключення…', 'Змінити мову', 'Показати оригінал', 'Наживо'],
+    deu_Latn: ['Wähle deine Sprache', 'Die Predigt hat noch nicht begonnen', 'Vorlesen', 'Stopp', 'Neu verbinden…', 'Sprache ändern', 'Original anzeigen', 'Live'],
+    ita_Latn: ['Scegli la tua lingua', 'Il messaggio non è ancora iniziato', 'Leggi ad alta voce', 'Ferma', 'Riconnessione…', 'Cambia lingua', 'Mostra originale', 'In diretta'],
+    tgl_Latn: ['Piliin ang iyong wika', 'Hindi pa nagsisimula ang mensahe', 'Basahin nang malakas', 'Itigil', 'Kumokonekta muli…', 'Palitan ang wika', 'Ipakita ang orihinal', 'Live'],
+    swh_Latn: ['Chagua lugha yako', 'Ujumbe bado haujaanza', 'Soma kwa sauti', 'Simamisha', 'Inaunganisha tena…', 'Badilisha lugha', 'Onyesha asili', 'Moja kwa moja'],
+    amh_Ethi: ['ቋንቋዎን ይምረጡ', 'መልእክቱ ገና አልጀመረም', 'ጮክ ብሎ ማንበብ', 'አቁም', 'እንደገና በመገናኘት ላይ…', 'ቋንቋ ቀይር', 'ዋናውን አሳይ', 'በቀጥታ'],
+    pes_Arab: ['زبان خود را انتخاب کنید', 'پیام هنوز شروع نشده است', 'خواندن با صدای بلند', 'توقف', 'در حال اتصال مجدد…', 'تغییر زبان', 'نمایش متن اصلی', 'زنده'],
+    hin_Deva: ['अपनी भाषा चुनें', 'संदेश अभी शुरू नहीं हुआ है', 'ज़ोर से पढ़ें', 'रोकें', 'पुनः कनेक्ट हो रहा है…', 'भाषा बदलें', 'मूल दिखाएँ', 'लाइव'],
+    jpn_Jpan: ['言語を選択してください', 'メッセージはまだ始まっていません', '読み上げる', '停止', '再接続中…', '言語を変更', '原文を表示', 'ライブ'],
+    pol_Latn: ['Wybierz swój język', 'Kazanie jeszcze się nie zaczęło', 'Czytaj na głos', 'Zatrzymaj', 'Ponowne łączenie…', 'Zmień język', 'Pokaż oryginał', 'Na żywo'],
+    ron_Latn: ['Alege limba ta', 'Mesajul nu a început încă', 'Citește cu voce tare', 'Oprește', 'Reconectare…', 'Schimbă limba', 'Arată originalul', 'În direct'],
+    som_Latn: ['Dooro luqaddaada', 'Farriintu weli ma bilaaban', 'Kor u akhri', 'Jooji', 'Dib u xidhiidhinaya…', 'Beddel luqadda', 'Tus qoraalka asalka ah', 'Toos'],
+    npi_Deva: ['आफ्नो भाषा छान्नुहोस्', 'सन्देश अझै सुरु भएको छैन', 'ठूलो स्वरमा पढ्नुहोस्', 'रोक्नुहोस्', 'पुन: जडान हुँदै…', 'भाषा परिवर्तन गर्नुहोस्', 'मूल देखाउनुहोस्', 'प्रत्यक्ष'],
+    mya_Mymr: ['သင့်ဘာသာစကားကို ရွေးပါ', 'တရားဒေသနာ မစသေးပါ', 'အသံထွက်ဖတ်ပါ', 'ရပ်ပါ', 'ပြန်လည်ချိတ်ဆက်နေသည်…', 'ဘာသာစကားပြောင်းပါ', 'မူရင်းပြပါ', 'တိုက်ရိုက်']
+  };
+
+  function pack(arr) {
+    var o = {};
+    KEYS.forEach(function (k, i) { o[k] = arr[i]; });
+    return o;
+  }
+
+  var STRINGS = {};
+  Object.keys(TABLE).forEach(function (code) { STRINGS[code] = pack(TABLE[code]); });
+
+  function forLang(code) {
+    /* Fall back to English rather than showing a key name. A missing string is
+       a cosmetic problem; a blank button is a broken page. */
+    /* A regional variant reads its base language's strings; showing a Spanish
+       speaker an English page because the code says spa_ES rather than
+       spa_Latn is exactly what languages.js says never to do. */
+    var VARIANT_OF = { por_PT: 'por_Latn', spa_ES: 'spa_Latn', spa_MX: 'spa_Latn' };
+    return Object.assign({}, STRINGS.eng_Latn, STRINGS[code] || STRINGS[VARIANT_OF[code]] || {});
+  }
+
+  return { KEYS: KEYS, STRINGS: STRINGS, forLang: forLang, has: function (c) { return !!STRINGS[c]; } };
+}));

app/short-questions.js

@@ -0,0 +1,69 @@
+/*
+ * short-questions.js — one-word questions that must never be guessed at.
+ *
+ * MEASURED: "What?" is the single most frequent invented line left after every
+ * other guard — the shipped NLLB renders it "¿Qué es eso?" (15 archive rows),
+ * "Yeah?" -> "¿Qué es eso?" (6), "Hello?" -> "¿Qué pasa?" (6), "How?" -> "¿Cómo
+ * es que lo hizo?" (3). The preacher says "What?" about three times a service.
+ * Because the SOURCE is itself a question, the hallucination guard rightly
+ * refuses to blank the output (a Spanish question is the correct shape) — so
+ * these bypass the model altogether, the way liturgy.js does for "Amen".
+ *
+ * Whole-utterance match only, one word, terminal '?' or '.' or nothing. The
+ * table holds only words whose one-word rendering is not a matter of register
+ * or denomination. Languages not listed fall through to the model unchanged.
+ */
+(function (root, factory) {
+  if (typeof module === 'object' && module.exports) module.exports = factory();
+  else root.ShortQuestions = factory();
+}(typeof self !== 'undefined' ? self : this, function () {
+  'use strict';
+
+  /* word -> { lang: rendering } — the base language stands for its variants. */
+  const TABLE = {
+    what:   { spa_Latn: '¿Qué?',        por_Latn: 'O quê?',      fra_Latn: 'Quoi ?',           deu_Latn: 'Was?',       ita_Latn: 'Cosa?' },
+    why:    { spa_Latn: '¿Por qué?',    por_Latn: 'Por quê?',    fra_Latn: 'Pourquoi ?',       deu_Latn: 'Warum?',     ita_Latn: 'Perché?' },
+    who:    { spa_Latn: '¿Quién?',      por_Latn: 'Quem?',       fra_Latn: 'Qui ?',            deu_Latn: 'Wer?',       ita_Latn: 'Chi?' },
+    how:    { spa_Latn: '¿Cómo?',       por_Latn: 'Como?',       fra_Latn: 'Comment ?',        deu_Latn: 'Wie?',       ita_Latn: 'Come?' },
+    where:  { spa_Latn: '¿Dónde?',      por_Latn: 'Onde?',       fra_Latn: 'Où ?',             deu_Latn: 'Wo?',        ita_Latn: 'Dove?' },
+    when:   { spa_Latn: '¿Cuándo?',     por_Latn: 'Quando?',     fra_Latn: 'Quand ?',          deu_Latn: 'Wann?',      ita_Latn: 'Quando?' },
+    which:  { spa_Latn: '¿Cuál?',       por_Latn: 'Qual?',       fra_Latn: 'Lequel ?',         deu_Latn: 'Welche?',    ita_Latn: 'Quale?' },
+    yeah:   { spa_Latn: '¿Sí?',         por_Latn: 'Sim?',        fra_Latn: 'Oui ?',            deu_Latn: 'Ja?',        ita_Latn: 'Sì?' },
+    yes:    { spa_Latn: '¿Sí?',         por_Latn: 'Sim?',        fra_Latn: 'Oui ?',            deu_Latn: 'Ja?',        ita_Latn: 'Sì?' },
+    hello:  { spa_Latn: '¿Hola?',       por_Latn: 'Olá?',        fra_Latn: 'Allô ?',           deu_Latn: 'Hallo?',     ita_Latn: 'Pronto?' },
+    right:  { spa_Latn: '¿Verdad?',     por_Latn: 'Certo?',      fra_Latn: "N'est-ce pas ?",   deu_Latn: 'Oder?',      ita_Latn: 'Vero?' },
+    really: { spa_Latn: '¿En serio?',   por_Latn: 'Sério?',      fra_Latn: 'Vraiment ?',       deu_Latn: 'Wirklich?',  ita_Latn: 'Davvero?' },
+    okay:   { spa_Latn: '¿Está bien?',  por_Latn: 'Está bem?',   fra_Latn: "D'accord ?",       deu_Latn: 'Okay?',      ita_Latn: 'Va bene?' },
+    ok:     { spa_Latn: '¿Está bien?',  por_Latn: 'Está bem?',   fra_Latn: "D'accord ?",       deu_Latn: 'Okay?',      ita_Latn: 'Va bene?' },
+    ready:  { spa_Latn: '¿Listos?',     por_Latn: 'Prontos?',    fra_Latn: 'Prêts ?',          deu_Latn: 'Bereit?',    ita_Latn: 'Pronti?' },
+    huh:    { spa_Latn: '¿Eh?',         por_Latn: 'Hã?',         fra_Latn: 'Hein ?',           deu_Latn: 'Hä?',        ita_Latn: 'Eh?' }
+  };
+
+  const VARIANT_OF = { spa_ES: 'spa_Latn', spa_MX: 'spa_Latn', por_PT: 'por_Latn' };
+
+  /* "What?", "what.", "WHAT", '"What?"' — one word, optionally punctuated. */
+  function key(text) {
+    const t = String(text || '').trim().replace(/^[\s"'“‘(\[]+/u, '').replace(/[\s"'”’)\]]+$/u, '');
+    const m = t.match(/^([A-Za-z]+)[?.!…]*$/);
+    return m ? m[1].toLowerCase() : null;
+  }
+
+  /*
+   * Only a source that IS a question (ends in '?') or is a bare interrogative
+   * word: "What." is Whisper dropping the mark; "What" alone is the same. A
+   * bare "yes"/"okay"/"right"/"ready" with a period is an ANSWER, not a
+   * question, and must reach the model as one — so those need the '?'.
+   */
+  const NEEDS_MARK = new Set(['yeah', 'yes', 'hello', 'right', 'really', 'okay', 'ok', 'ready', 'huh']);
+
+  function lookup(text, lang) {
+    const k = key(text);
+    if (!k || !TABLE[k]) return null;
+    const asked = /\?[?!.…]*\s*["'”’)\]]*$/.test(String(text || '').trim());
+    if (!asked && NEEDS_MARK.has(k)) return null;
+    const row = TABLE[k];
+    return row[lang] || row[VARIANT_OF[lang]] || null;
+  }
+
+  return { lookup, TABLE };
+}));

app/sidecar-langs.js

@@ -0,0 +1,34 @@
+/*
+ * sidecar-langs.js — the ONE table of what the mlx-audio sidecar calls a language.
+ *
+ * Two models, two conventions: Kokoro wants a single letter ('e', 'p'), Qwen3
+ * wants a full word ('spanish'). Both tts-service.js (which speaks) and main.js
+ * (which now WARMS the exact voices in use at launch) need the same answer, and
+ * a copy in each drifted once already — which is how the warmup came to load a
+ * 1.7 GB model nobody had chosen while the 82 MB one every pinned language
+ * actually used sat cold until the first sentence of the service.
+ */
+(function (root, factory) {
+  if (typeof module === 'object' && module.exports) module.exports = factory();
+  else root.SidecarLangs = factory();
+}(typeof self !== 'undefined' ? self : this, function () {
+  'use strict';
+
+  const KOKORO_MODEL = 'prince-canuma/Kokoro-82M';
+  const QWEN_MODEL = 'mlx-community/Qwen3-TTS-12Hz-1.7B-CustomVoice-8bit';
+
+  const KOKORO_LANG = {
+    eng_Latn: 'a', spa_Latn: 'e', spa_ES: 'e', spa_MX: 'e',
+    por_Latn: 'p', por_PT: 'p', fra_Latn: 'f', ita_Latn: 'i',
+    hin_Deva: 'h', jpn_Jpan: 'j', zho_Hans: 'z'
+  };
+
+  const LOCAL_LANG = {
+    spa_Latn: 'spanish', por_Latn: 'portuguese', zho_Hans: 'chinese',
+    kor_Hang: 'korean', fra_Latn: 'french', eng_Latn: 'english',
+    deu_Latn: 'german', ita_Latn: 'italian', rus_Cyrl: 'russian',
+    por_PT: 'portuguese', spa_ES: 'spanish', spa_MX: 'spanish'
+  };
+
+  return { KOKORO_MODEL, QWEN_MODEL, KOKORO_LANG, LOCAL_LANG };
+}));

app/spa-variants.js

@@ -0,0 +1,300 @@
+/*
+ * spa-variants.js — one Spanish translation, two Spanish congregations.
+ *
+ * WHY ONLY ONE DIRECTION IS IMPLEMENTED, AND IT IS NOT THE ONE ASKED FOR.
+ *
+ * Converting Latin American Spanish INTO Peninsular (ustedes -> vosotros) was
+ * specified, built on paper, and then measured against this church's own
+ * archive of 5,954 English->Spanish pairs. It has to be abandoned, because the
+ * information it needs is not in the input:
+ *
+ *   - Spanish 3rd-person-plural is IDENTICAL for "ustedes" (you all) and
+ *     "ellos" (they). English resolves person but not NUMBER, and in 98.9% of
+ *     the sentences a gate would fire on, whether "you" was one person or a
+ *     room is simply undetermined.
+ *   - Spanish uses 3PL as its impersonal/passive, so the very condition that
+ *     triggers a conversion is what creates the false positives. Measured, real:
+ *       "You're not accepted on the basis of your religious works."
+ *          NLLB: "No te aceptan por tus obras religiosas."
+ *          after: "no te aceptáis"  =  "you don't accept yourself"
+ *     That inverts grace into works-salvation, fluently, in a synthesized voice,
+ *     for listeners who cannot detect it.
+ *   - "su" means his/her/its/their/your-formal. Of the sentences carrying it,
+ *     25.2% provably could NOT mean "your" — the English has no "your" at all.
+ *     "Él te recibirá como su hijo" ("as HIS son") would become "as YOUR son".
+ *   - Provable wins 68, provable losses 46, on 22.6% of rows. Every uncounted
+ *     loss class pushes that under 1:1.
+ *
+ * THE INVERSE DIRECTION IS SAFE, and that asymmetry is the whole design.
+ * vosotros, vuestro, os, -áis, -éis and the -ad/-ed/-id imperative can ONLY be
+ * second-person-plural. There is nothing to disambiguate. So Peninsular forms
+ * can be normalised OUT of Latin American output with no risk at all — and NLLB
+ * does leak them: 27 rows in the archive, including "lavará vuestros pecados"
+ * and "Hacéis esto".
+ *
+ * Result: Spain gets the same words in a Castilian voice (the thing a Spaniard
+ * notices first), and Latin America gets Spanish that is consistently Latin
+ * American instead of occasionally Peninsular.
+ */
+(function (root, factory) {
+  if (typeof module === 'object' && module.exports) module.exports = factory();
+  else root.SpaVariants = factory();
+}(typeof self !== 'undefined' ? self : this, function () {
+  'use strict';
+
+  /* Accent-aware boundaries. JS \b is [A-Za-z0-9_], so /\bvosotros\b/ is fine
+     but /\bhabláis\b/ breaks at the á — the trap pt-variants.js documents. */
+  const W = '\\p{L}\\p{N}\\p{M}';
+  const RE = (body, flags) => new RegExp('(?<![' + W + '])(?:' + body + ')(?![' + W + '])', flags || 'giu');
+
+  /*
+   * Verb forms are ENUMERATED, never derived from suffixes. A suffix rule is
+   * unusable here: "-ís" would eat país and anís, and "-ad"/"-ed" would eat
+   * usted, verdad, ciudad, bondad, pared, red and sed. pt-variants.js reached
+   * the same conclusion and shipped a whitelist for the same reason.
+   * Each entry is 2nd-person-plural -> 3rd-person-plural (the ustedes form).
+   *
+   * THREE FORMS ARE DELIBERATELY ABSENT. Matching is case-insensitive, so any
+   * short form that is also an ordinary word is a landmine:
+   *   "sed"  (ser, "be ye")  is the noun THIRST — measured 5 times in this
+   *          church's archive, every one of them the noun, in a sermon about a
+   *          man dying of thirst in the desert. It turned "morir de sed" into
+   *          "morir de sean". Caught only by running the real corpus.
+   *   "id"   (ir, "go ye")   collides with the English "ID".
+   *   "dad"  (dar, "give ye") collides with the English "dad".
+   * All three are vanishingly rare in NLLB output and common as other words.
+   * Do not add them back.
+   */
+  const VERBS = {
+    /* ser / estar / haber / ir */
+    'sois': 'son', 'erais': 'eran', 'fuisteis': 'fueron', 'seréis': 'serán', 'seáis': 'sean',
+    'estáis': 'están', 'estabais': 'estaban', 'estuvisteis': 'estuvieron', 'estaréis': 'estarán', 'estéis': 'estén',
+    'habéis': 'han', 'habíais': 'habían', 'hubisteis': 'hubieron', 'habréis': 'habrán', 'hayáis': 'hayan',
+    'vais': 'van', 'ibais': 'iban', 'fuisteis2': 'fueron', 'iréis': 'irán', 'vayáis': 'vayan',
+    /* high-frequency irregulars */
+    'tenéis': 'tienen', 'teníais': 'tenían', 'tuvisteis': 'tuvieron', 'tendréis': 'tendrán', 'tengáis': 'tengan', 'tened': 'tengan',
+    'hacéis': 'hacen', 'hacíais': 'hacían', 'hicisteis': 'hicieron', 'haréis': 'harán', 'hagáis': 'hagan', 'haced': 'hagan',
+    'podéis': 'pueden', 'podíais': 'podían', 'pudisteis': 'pudieron', 'podréis': 'podrán', 'podáis': 'puedan',
+    'queréis': 'quieren', 'queríais': 'querían', 'quisisteis': 'quisieron', 'querréis': 'querrán', 'queráis': 'quieran',
+    'decís': 'dicen', 'decíais': 'decían', 'dijisteis': 'dijeron', 'diréis': 'dirán', 'digáis': 'digan', 'decid': 'digan',
+    'venís': 'vienen', 'veníais': 'venían', 'vinisteis': 'vinieron', 'vendréis': 'vendrán', 'vengáis': 'vengan', 'venid': 'vengan',
+    'sabéis': 'saben', 'sabíais': 'sabían', 'supisteis': 'supieron', 'sabréis': 'sabrán', 'sepáis': 'sepan',
+    'dais': 'dan', 'dabais': 'daban', 'disteis': 'dieron', 'daréis': 'darán', 'deis': 'den',
+    'veis': 'ven', 'veíais': 'veían', 'visteis': 'vieron', 'veréis': 'verán', 'veáis': 'vean', 'ved': 'vean',
+    'ponéis': 'ponen', 'pusisteis': 'pusieron', 'pondréis': 'pondrán', 'pongáis': 'pongan', 'poned': 'pongan',
+    'salís': 'salen', 'salisteis': 'salieron', 'saldréis': 'saldrán', 'salgáis': 'salgan', 'salid': 'salgan',
+    'oís': 'oyen', 'oísteis': 'oyeron', 'oiréis': 'oirán', 'oigáis': 'oigan', 'oíd': 'oigan',
+    /* regular verbs a preacher actually uses */
+    'habláis': 'hablan', 'hablabais': 'hablaban', 'hablasteis': 'hablaron', 'hablaréis': 'hablarán', 'habléis': 'hablen', 'hablad': 'hablen',
+    'miráis': 'miran', 'mirasteis': 'miraron', 'miréis': 'miren', 'mirad': 'miren',
+    'escucháis': 'escuchan', 'escuchasteis': 'escucharon', 'escuchéis': 'escuchen', 'escuchad': 'escuchen',
+    'oráis': 'oran', 'orasteis': 'oraron', 'oréis': 'oren', 'orad': 'oren',
+    'rezáis': 'oran', 'rezasteis': 'oraron', 'recéis': 'oren', 'rezad': 'oren',
+    'creéis': 'creen', 'creíais': 'creían', 'creísteis': 'creyeron', 'creáis': 'crean', 'creed': 'crean',
+    'vivís': 'viven', 'vivíais': 'vivían', 'vivisteis': 'vivieron', 'viváis': 'vivan', 'vivid': 'vivan',
+    'abrís': 'abren', 'abristeis': 'abrieron', 'abráis': 'abran', 'abrid': 'abran',
+    'recibís': 'reciben', 'recibisteis': 'recibieron', 'recibáis': 'reciban', 'recibid': 'reciban',
+    'entendéis': 'entienden', 'entendisteis': 'entendieron', 'entendáis': 'entiendan',
+    'buscáis': 'buscan', 'buscasteis': 'buscaron', 'busquéis': 'busquen', 'buscad': 'busquen',
+    'amáis': 'aman', 'amasteis': 'amaron', 'améis': 'amen', 'amad': 'amen',
+    'sentís': 'sienten', 'sentisteis': 'sintieron', 'sintáis': 'sientan',
+    'pedís': 'piden', 'pedisteis': 'pidieron', 'pidáis': 'pidan', 'pedid': 'pidan',
+    'volvéis': 'vuelven', 'volvisteis': 'volvieron', 'volváis': 'vuelvan', 'volved': 'vuelvan',
+    'llegáis': 'llegan', 'llegasteis': 'llegaron', 'lleguéis': 'lleguen',
+    'levantáis': 'levantan', 'levantad': 'levanten', 'levantaos': 'levántense',
+    'sentaos': 'siéntense', 'arrepentíos': 'arrepiéntanse', 'acercaos': 'acérquense',
+    /* Reflexive imperatives change the stem and move the accent, so they are
+       named rather than derived. These are the ones that actually occur in
+       Peninsular scripture. */
+    'despojaos': 'despójense', 'renovaos': 'renuévense', 'vestíos': 'vístanse',
+    'airaos': 'aírense', 'alegraos': 'alégrense', 'regocijaos': 'regocíjense',
+    'humillaos': 'humíllense', 'apartaos': 'apártense', 'acordaos': 'acuérdense',
+    'guardaos': 'guárdense', 'someteos': 'sométanse', 'revestíos': 'revístanse',
+    'volveos': 'vuélvanse', 'allegaos': 'acérquense', 'mirad': 'miren'
+  };
+  delete VERBS['fuisteis2'];
+
+  /*
+   * Pronouns and possessives. This direction needs NO noun gender, which is
+   * precisely what made the reverse direction impossible: "su" is invariant,
+   * while "vuestro" must agree with the possessed noun in gender AND number.
+   */
+  const GRAMMAR = [
+    [RE('vosotros|vosotras'), 'ustedes'],
+    [RE('vuestros|vuestras'), 'sus'],
+    [RE('vuestro|vuestra'), 'su'],
+    /* The 2pl clitic. Anchored, because "os" is two letters and sits inside
+       hundreds of words. */
+    [RE('os'), 'les']
+  ];
+
+  /*
+   * Lexical Peninsular leakage, all observed in the archive. Deliberately tiny:
+   * an unobserved entry is a guess, and a guess here is a silent error.
+   */
+  const LEXICON = [
+    [RE('coches'), 'carros'], [RE('coche'), 'carro'],
+    [RE('gafas'), 'lentes'],
+    [RE('ordenadores'), 'computadoras'], [RE('ordenador'), 'computadora'],
+    [RE('móviles'), 'celulares'],
+    [RE('zumo'), 'jugo'], [RE('patatas'), 'papas'], [RE('patata'), 'papa'],
+    [RE('piso'), 'departamento'], [RE('chavales'), 'muchachos'], [RE('chaval'), 'muchacho']
+  ];
+
+  /*
+   * "vale" is a homograph and the archive contains both senses:
+   *   interjection  "Vale, pensemos..."      -> Peninsular, convert
+   *   the verb      "No vale la pena."       -> universal, MUST NOT convert
+   * Only the sentence-initial interjection followed by a comma is touched.
+   */
+  const VALE = /(^|[.!?¡¿]\s*)Vale,/g;
+
+  /*
+   * Regular paradigm, as ORDERED SUFFIX rules, applied after the explicit table
+   * so irregulars (estáis->están, sois->son) always win.
+   *
+   * These endings are safe where a bare "-ís" or "-ad" is not: -áis, -éis,
+   * -abais, -íais, -asteis, -isteis, -réis and -ríais occur in Spanish ONLY as
+   * second-person-plural verb inflections. There is no noun or adjective with
+   * any of them, so no homograph can be caught.
+   *
+   * ORDER MATTERS. The future is -réis and maps to -rán, not to -ren: without
+   * the -réis rule first, "hablaréis" would become "hablaren" rather than
+   * "hablarán". Longest and most specific first, throughout.
+   */
+  const SUFFIX = [
+    [/(\w{2,})ríais\b/giu, '$1rían'],      // conditional: hablaríais -> hablarían
+    [/(\w{2,})réis\b/giu,  '$1rán'],       // future:      hablaréis  -> hablarán
+    [/(\w{2,})abais\b/giu, '$1aban'],      // imperfect -ar
+    [/(\w{2,})íais\b/giu,  '$1ían'],       // imperfect -er/-ir
+    [/(\w{2,})asteis\b/giu,'$1aron'],      // preterite -ar
+    [/(\w{2,})isteis\b/giu,'$1ieron'],     // preterite -er/-ir
+    [/(\w{2,})áis\b/giu,   '$1an'],        // present -ar / subjunctive -er,-ir
+    [/(\w{2,})éis\b/giu,   '$1en']         // present -er / subjunctive -ar
+  ];
+
+  /*
+   * DENOMINATIONAL REGISTER, and it applies to every Spanish variant — this is
+   * not a regional question.
+   *
+   * RAE separates the two verbs: `orar` is "dirigirse mentalmente o de palabra
+   * a una divinidad" — extempore prayer, the evangelical default. `rezar` is
+   * from Latin recitare, "recitar la misa, una oracion", i.e. saying a SET
+   * prayer, and is Catholic-coded. NLLB picks between them at random: measured
+   * across this church's archive, 15 rows chose rezar and 14 chose orar, for
+   * the same English word "pray". So a Protestant congregation hears
+   * "Rezo para que..." — which reads as reciting a liturgical formula.
+   *
+   * Straight lexical substitution, no ambiguity in the verb forms. ONE guard:
+   * "rezo" is also a NOUN (a recited prayer), and mapping the noun would say
+   * "oro" = GOLD. Every occurrence in the archive is the verb, but the
+   * determiner lookbehind makes the noun unreachable regardless.
+   */
+  const PRAY = [
+    [RE('rezar'), 'orar'], [RE('rezando'), 'orando'], [RE('rezado'), 'orado'],
+    [RE('rezamos'), 'oramos'], [RE('rezaban'), 'oraban'], [RE('rezaba'), 'oraba'],
+    [RE('rezaron'), 'oraron'], [RE('rezan'), 'oran'], [RE('rezas'), 'oras'],
+    [RE('recemos'), 'oremos'], [RE('recen'), 'oren'], [RE('reces'), 'ores'],
+    [RE('rece'), 'ore'], [RE('reza'), 'ora'],
+    /* the noun guard */
+    [/(?<![\p{L}\p{N}\p{M}])(?<!\b(?:el|un|los|unos|mi|su|tu|este|ese|aquel)\s)rezo(?![\p{L}\p{N}\p{M}])/giu, 'oro']
+  ];
+
+  /*
+   * "coger" is routine in Spain and vulgar across Mexico and much of Latin
+   * America — RAE marks it "vulg. ... Realizar el acto sexual" for Mexico
+   * among others. Zero occurrences in the archive so far, but the cost of the
+   * guard is nothing and the cost of the failure is a sermon.
+   */
+  const SAFE = [
+    [RE('coger'), 'tomar'], [RE('cogiendo'), 'tomando'], [RE('cogemos'), 'tomamos'],
+    [RE('cogen'), 'toman'], [RE('coges'), 'tomas'], [RE('cojan'), 'tomen'],
+    [RE('coja'), 'tome'], [RE('chaqueta'), 'chamarra'], [RE('chaquetas'), 'chamarras']
+  ];
+
+  /*
+   * CONJUGATION REPAIRS — non-words only.
+   *
+   * MEASURED on the shipped NLLB (fp32, greedy — the library exposes no beam
+   * search): "We bless…" came back as a bendecir form in 47 of 49 worship
+   * sentences and 15 of those were NOT SPANISH WORDS — bendecemos, bendicemos,
+   * bendimos for the correct bendecimos (bendecir conjugates like decir:
+   * bendigo, bendices, bendice, bendecimos, bendecís, bendicen). The
+   * tokenizer explains it: the right form needs three pieces (▁bende·c·imos)
+   * while each wrong one is a likelier two-piece path, and greedy decoding
+   * commits to the likelier piece. Forced-decode scoring showed the model
+   * genuinely prefers the non-word, so no decoding setting fixes this.
+   *
+   * Every 'from' here is a string that is not a word in any Spanish. That is
+   * what makes the table safe by construction: a non-word can never be the
+   * preacher's meaning, so replacing it cannot corrupt a correct line. A
+   * sweep of the church's 16,132 archived Spanish fields changed 28 and every
+   * one of the 13 distinct changes was non-word -> correct form, with zero
+   * collateral. Real-but-wrong forms ("Bendijo" for "I bless") are NOT here:
+   * they are words, and a table cannot know the person the speaker meant.
+   *
+   *   bendíalo/bendíelo -> bendigámoslo (1pl hortative "let us bless him"),
+   *   deliberately not the fluent-but-wrong tú imperative bendícelo.
+   *   bendicié -> bendice is kept: "Bendice tu nombre" is grammatical praise
+   *   where the non-word was noise; flagged advisory in review.
+   */
+  const CONJ = [
+    [RE('bendecemos|bendicemos|bendimos|bendicimos'), 'bendecimos'],
+    [RE('bendico'), 'bendigo'],
+    [RE('bendecen'), 'bendicen'],
+    [RE('bendicié'), 'bendice'],
+    [RE('bendíalo|bendíelo'), 'bendigámoslo'],
+    [RE('bendiciré'), 'bendeciré'],
+    [RE('benditaremos|bendiciremos'), 'bendeciremos'],
+    [RE('maldiciré'), 'maldeciré'],
+    [RE('pedamos'), 'pidamos'],
+    [RE('ungas'), 'unjas'],
+    [RE('undémonos'), 'úngenos'],
+    [RE('redémonos'), 'redímenos'],
+    [RE('dás'), 'das']
+  ];
+
+  /* Applied to EVERY Spanish variant, before any regional pass. */
+  function toChurchRegister(text) {
+    let s = String(text == null ? '' : text);
+    if (!s) return s;
+    for (const [re, to] of PRAY.concat(SAFE, CONJ)) s = s.replace(re, (m) =>
+      /^[\p{Lu}]/u.test(m) ? to.charAt(0).toUpperCase() + to.slice(1) : to);
+    return s;
+  }
+
+  function toLatinAmerican(text) {
+    let s = String(text == null ? '' : text);
+    if (!s) return s;
+
+    /* Verbs first, longest form first, so "estabais" is not shadowed by a
+       shorter overlapping entry. */
+    const forms = Object.keys(VERBS).sort((a, b) => b.length - a.length);
+    for (const f of forms) s = s.replace(RE(f), (m) => {
+      const to = VERBS[f];
+      /* Preserve the capital: sentence-initial imperatives are common. */
+      return /^[\p{Lu}]/u.test(m) ? to.charAt(0).toUpperCase() + to.slice(1) : to;
+    });
+
+    /* Then the regular paradigm, for verbs the table does not name. */
+    for (const [re, to] of SUFFIX) s = s.replace(re, to);
+
+    for (const [re, to] of GRAMMAR) s = s.replace(re, (m) =>
+      /^[\p{Lu}]/u.test(m) ? to.charAt(0).toUpperCase() + to.slice(1) : to);
+
+    for (const [re, to] of LEXICON) s = s.replace(re, (m) =>
+      /^[\p{Lu}]/u.test(m) ? to.charAt(0).toUpperCase() + to.slice(1) : to);
+
+    s = s.replace(VALE, '$1Bueno,');
+    return s;
+  }
+
+  /*
+   * Spain keeps NLLB's words untouched and is distinguished by its VOICE.
+   * Deliberately a no-op rather than an absent function, so the call site reads
+   * symmetrically and the reason lives here rather than in a comment there.
+   */
+  function toPeninsular(text) { return String(text == null ? '' : text); }
+
+  return { toLatinAmerican, toPeninsular, toChurchRegister, VERBS, LEXICON, PRAY, CONJ };
+}));

app/speech-text.js

@@ -0,0 +1,143 @@
+/*
+ * speech-text.js — what the voice is given, as opposed to what the screen shows.
+ *
+ * Everything here exists because espeak-ng speaks characters it cannot
+ * pronounce rather than ignoring them. A single pair of markdown asterisks does
+ * not render as emphasis; it renders as the word "asterisco", twice, in the
+ * middle of a sentence. Measured: an asterisk pair nearly doubles clip length.
+ *
+ * This runs in the TTS child, deliberately, so the caption on the listener's
+ * phone keeps the original text. Someone READING "1 Corintios 13:4-7" wants
+ * exactly those characters; someone HEARING it wants "Primera de Corintios
+ * trece, del cuatro al siete". Normalising in the renderer would corrupt both.
+ *
+ * Two layers, and the split matters:
+ *   - UNIVERSAL: symbols and URLs, which are noise in every language.
+ *   - PER-LANGUAGE: scripture, ordinals and currency, which are grammar. A rule
+ *     that is right in Spanish is wrong in German and meaningless in Korean, so
+ *     these hang off the FLORES code and a language with no table gets only the
+ *     universal layer. Adding a language means adding a table, never widening a
+ *     regex.
+ */
+
+'use strict';
+
+/* Characters espeak names aloud that carry no meaning in speech. Kept as a
+   character class rather than a word list because the failure is per-glyph.
+   DELETED, not replaced with a space: Chinese and Korean are written without
+   spaces, so spacing "**神**是爱" would split 神 off 是爱, and would tear a Korean
+   particle off its noun. Deleting is correct in both script families —
+   "**Dios**" and "**神**" both come back whole. */
+const NOISE = /[*_#^~|\\`{}=+©®™]/g;
+
+/* Angle-bracket tags go before the noise class: stripping < and > alone would
+   leave the tag name behind, so "<br>" would be spoken as the word "br". */
+const TAGS = /<[^>]{1,80}>/g;
+const ANGLES = /[<>]/g;
+
+/* Spoken as "barra" / "arroba" and never meaningful mid-sentence. */
+const SLASHES = /[/]+/g;
+
+/* A URL read aloud is many seconds of spelled-out punctuation. The caption
+   still shows it, which is the only place a URL is usable anyway. */
+const URLS = /\b(?:https?:\/\/|www\.)\S+/gi;
+const EMAILS = /\b[^\s@]+@[^\s@]+\.[a-z]{2,}\b/gi;
+
+/* Any letter or digit in any script. If nothing survives normalisation there is
+   nothing to say, and asking the engine to say nothing produces an audible
+   artifact rather than silence. */
+const HAS_CONTENT = /[\p{L}\p{N}]/u;
+
+/* Scripts without case, where the all-caps rule below is meaningless. */
+const UNCASED = /[\p{Script=Han}\p{Script=Hangul}\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Arabic}\p{Script=Hebrew}\p{Script=Thai}\p{Script=Devanagari}\p{Script=Georgian}\p{Script=Greek}]/u;
+
+// ---------------------------------------------------------------- per-language
+
+/*
+ * Spanish first because it is this church's second language and the one the
+ * congregation reported on. Each table is written against what a Spanish
+ * speaker expects to hear read from a pulpit, not against a dictionary.
+ */
+const ES_BOOKS = 'Corintios|Timoteo|Pedro|Juan|Reyes|Samuel|Crónicas|Tesalonicenses|Macabeos';
+const ES_ORDINAL = { 1: 'Primera', 2: 'Segunda', 3: 'Tercera' };
+
+const LANGUAGES = {
+  spa_Latn: {
+    rules: [
+      /* "1 Corintios" is written as a numeral and spoken as an ordinal. Read as
+         a cardinal it becomes "uno Corintios", which is not Spanish. */
+      [new RegExp('\\b([123])\\s+(' + ES_BOOKS + ')\\b', 'g'),
+       (_m, n, book) => ES_ORDINAL[n] + ' de ' + book],
+
+      /* A verse range: the hyphen is otherwise deleted outright, leaving two
+         loose numbers with nothing to say they were a range. */
+      [/(\d+)\s*[-–—]\s*(\d+)/g, '$1 al $2'],
+
+      [/\b(\d+)\s*(?:er|ro)\b/gi, (_m, n) => n === '1' ? 'primer' : n + 'º'],
+      [/\b1\s*[ªº]/gi, 'primera'], [/\b2\s*[ºo]\b/gi, 'segundo'], [/\b2\s*[ªa]\b/gi, 'segunda'],
+      [/\b3\s*[ºo]\b/gi, 'tercero'], [/\b3\s*[ªa]\b/gi, 'tercera'],
+
+      [/\bvv\./gi, 'versículos'], [/\bv\./gi, 'versículo'],
+      [/\bcaps\./gi, 'capítulos'], [/\bcap\./gi, 'capítulo'],
+
+      /* Spanish puts the unit after the amount; the symbol is written before it. */
+      [/\$\s*(\d[\d.,]*)/g, '$1 dólares'],
+      [/€\s*(\d[\d.,]*)/g, '$1 euros'],
+      [/&/g, ' y ']
+    ]
+  },
+
+  eng_Latn: {
+    rules: [
+      [/\b([123])\s+(Corinthians|Timothy|Peter|John|Kings|Samuel|Chronicles|Thessalonians|Maccabees)\b/g,
+       (_m, n, book) => ({ 1: 'First', 2: 'Second', 3: 'Third' })[n] + ' ' + book],
+      [/(\d+)\s*[-–—]\s*(\d+)/g, '$1 through $2'],
+      [/\bvv\./gi, 'verses'], [/\bv\./gi, 'verse'],
+      [/\bch\./gi, 'chapter'], [/\bchap\./gi, 'chapter'],
+      [/\$\s*(\d[\d.,]*)/g, '$1 dollars'],
+      [/&/g, ' and ']
+    ]
+  }
+};
+
+// ---------------------------------------------------------------- the pass
+
+/*
+ * Returns the string to synthesise, or '' when there is nothing worth saying.
+ * '' is a real answer and the caller must treat it as "produce no clip" — an
+ * empty string handed to the engine emits a short burst of noise, not silence.
+ */
+function normalizeForSpeech(text, lang) {
+  let s = String(text == null ? '' : text);
+
+  s = s.replace(URLS, ' ').replace(EMAILS, ' ');
+
+  /* A regional variant reads with its base language's rules. Without this a
+     new code silently gets NO table and the numbered-book rule stops firing,
+     so "1 Corintios" is spoken as "uno Corintios" — the exact failure this
+     file exists to prevent. Canonical list: NLLB_ALIAS in engine.js. */
+  const VARIANT_OF = { por_PT: 'por_Latn', spa_ES: 'spa_Latn', spa_MX: 'spa_Latn' };
+  const table = LANGUAGES[lang] || LANGUAGES[VARIANT_OF[lang]];
+  if (table) for (const [re, to] of table.rules) s = s.replace(re, to);
+
+  s = s.replace(TAGS, ' ').replace(NOISE, '').replace(ANGLES, '').replace(SLASHES, ' ');
+
+  /* Shouting is phonemised differently from the same words in lower case, and
+     short all-caps words get spelled out letter by letter. Only for scripts
+     that have case at all. */
+  if (!UNCASED.test(s)) {
+    s = s.replace(/(?:\b[\p{Lu}\p{N}]{2,}\b[\s,.;:!?]*){2,}/gu, (run) => run.toLowerCase());
+  }
+
+  s = s.replace(/\s+/g, ' ').trim();
+
+  /* espeak takes final lengthening and sentence-final intonation from the
+     terminal punctuation, and ASR chunks cut by the VAD often arrive without
+     any — measured cost: 142 ms of final lengthening, gone, in 10/10 trials.
+     A period is the one addition that is always safe. */
+  if (/[\p{L}\p{N}]$/u.test(s)) s += '.';
+
+  return HAS_CONTENT.test(s) ? s : '';
+}
+
+module.exports = { normalizeForSpeech, LANGUAGES };

app/tools/check-packaged-files.js

@@ -0,0 +1,93 @@
+/*
+ * check-packaged-files.js — refuse to build an app that is missing a module.
+ *
+ * package.json's build.files is an explicit ALLOW-LIST. Adding a new module and
+ * forgetting to list it produces a DMG that installs cleanly, launches cleanly,
+ * and then throws at the first require() — which is exactly what shipped once:
+ * three new files were left out, `require('./sidecar-langs.js')` threw inside
+ * the voice process, and the natural voices silently never started. Nothing in
+ * the build said a word.
+ *
+ * So the build now reads what the code actually loads — every local require()
+ * in the main/child processes and every <script src="./…"> in the pages — and
+ * fails if any of it would not be packaged.
+ */
+'use strict';
+const fs = require('fs');
+const path = require('path');
+
+const APP = path.join(__dirname, '..');
+const pkg = JSON.parse(fs.readFileSync(path.join(APP, 'package.json'), 'utf8'));
+const patterns = (pkg.build && pkg.build.files) || [];
+
+/* Does the allow-list cover this path? Only the two glob shapes this file
+   actually uses — "server/**\/*" and plain paths. */
+/* electron-builder always includes these, whatever the allow-list says. */
+const ALWAYS = new Set(['package.json']);
+
+/* The allow-list in package.json is forward-slash; path.join() gives
+   backslashes when this runs on Windows, so every server/** module would read
+   as un-packaged and refuse the build. Compare in one notation. */
+const toPosix = (p) => String(p).split(path.sep).join('/');
+
+function covered(rel) {
+  rel = toPosix(rel);
+  if (ALWAYS.has(rel)) return true;
+  return patterns.some((p) => {
+    if (p === rel) return true;
+    const star = p.indexOf('**');
+    if (star !== -1) return rel.startsWith(p.slice(0, star));
+    return false;
+  });
+}
+
+/* Entry points whose dependency graph must be packaged. */
+const ROOTS = ['main.js', 'preload.js', 'engine.js', 'tts-service.js', 'mt-service.js',
+               'model-worker.js', 'server/server.js', 'kokoro-sidecar.js'];
+const HTML = ['index.html', 'server/public/index.html'];
+
+const seen = new Set();
+const missing = [];
+
+function scanJs(rel) {
+  if (seen.has(rel)) return;
+  seen.add(rel);
+  const abs = path.join(APP, rel);
+  let src;
+  try { src = fs.readFileSync(abs, 'utf8'); } catch (_) { return; }
+  const dir = toPosix(path.dirname(rel));
+  const re = /require\(\s*['"](\.[^'"]+)['"]\s*\)/g;
+  let m;
+  while ((m = re.exec(src))) {
+    let dep = toPosix(path.normalize(path.join(dir, m[1])));
+    if (!/\.[a-z]+$/.test(dep)) dep += '.js';
+    if (dep.startsWith('..')) continue;                 // outside the app dir
+    if (!fs.existsSync(path.join(APP, dep))) continue;  // optional/native, let node fail loudly
+    if (!covered(dep)) missing.push(dep + '  (required by ' + rel + ')');
+    scanJs(dep);
+  }
+}
+
+for (const r of ROOTS) scanJs(r);
+
+for (const page of HTML) {
+  let src;
+  try { src = fs.readFileSync(path.join(APP, page), 'utf8'); } catch (_) { continue; }
+  const dir = toPosix(path.dirname(page));
+  const re = /<script\s+src=["'](\.\/[^"']+)["']/g;
+  let m;
+  while ((m = re.exec(src))) {
+    const dep = toPosix(path.normalize(path.join(dir, m[1])));
+    if (!fs.existsSync(path.join(APP, dep))) continue;
+    if (!covered(dep)) missing.push(dep + '  (script in ' + page + ')');
+    if (dep.endsWith('.js')) scanJs(dep);
+  }
+}
+
+if (missing.length) {
+  console.error('\nBUILD REFUSED — these files are loaded at runtime but are NOT in package.json build.files:\n');
+  for (const f of Array.from(new Set(missing))) console.error('  ' + f);
+  console.error('\nAdd them to build.files, or the installed app will throw on first use.\n');
+  process.exit(1);
+}
+console.log('[check] all ' + seen.size + ' runtime modules are packaged');

app/tools/install-latest.sh

@@ -0,0 +1,90 @@
+#!/bin/bash
+#
+# install-latest.sh — quit, replace, relaunch. One step, repeatable.
+#
+# Doing this by hand meant three builds in a row were staged and never
+# installed, so the app under test was two versions behind what the log said
+# was fixed. That is worse than no build at all.
+#
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+REL="$ROOT/Releases"
+DIST="$ROOT/app/dist"
+APPS="/Applications"
+NAME="Church Translate.app"
+
+# Both places, newest first. `npm run dist` writes to app/dist and only a
+# release copy lands in Releases/ — looking in one of them installed a build
+# that was two versions behind the one just compiled, and said "3.8.0 -> 3.8.0"
+# while doing it. That is the exact failure this script was written to stop.
+DMG="$(ls -t "$REL"/*.dmg "$DIST"/*.dmg 2>/dev/null | head -1)"
+[ -n "$DMG" ] || { echo "No .dmg in $REL or $DIST"; exit 1; }
+echo "installing: $(basename "$DMG")"
+
+# Stale volumes from earlier installs keep the old version's name around and
+# make it genuinely hard to tell what is mounted.
+for v in /Volumes/*Church\ Translate*; do
+  [ -d "$v" ] && { echo "  ejecting stale $v"; hdiutil detach "$v" -quiet -force || true; }
+done
+
+# NEVER install over a live service. main.js deliberately blocks its own window
+# close with a confirmation dialog while translation is live, so that nobody
+# takes the captions down mid-sermon — and this script's force-terminate would
+# walk straight through that protection. Ask the server instead.
+if pgrep -f "$NAME/Contents/MacOS" >/dev/null; then
+  CFG="$HOME/Library/Application Support/Church Translate/data/config.json"
+  KEY="$(/usr/bin/python3 -c "import json,sys;print(json.load(open(sys.argv[1])).get('controlToken',''))" "$CFG" 2>/dev/null || true)"
+  if [ -n "$KEY" ]; then
+    ST="$(curl -s --max-time 4 "http://127.0.0.1:3100/api/status.txt?key=$KEY" 2>/dev/null || true)"
+    if [ "$ST" = "live" ]; then
+      echo "REFUSING TO INSTALL: translation is LIVE right now."
+      echo "Stop the service first — installing would cut the captions for everyone listening."
+      exit 2
+    fi
+    [ -n "$ST" ] && echo "  service is '$ST' (not live) — safe to replace"
+  fi
+  echo "  quitting the running app"
+  osascript -e 'tell application "Church Translate" to quit' 2>/dev/null || true
+  for _ in $(seq 1 50); do   # 25s: it shuts three model children down first
+    pgrep -f "$NAME/Contents/MacOS" >/dev/null || break
+    sleep 0.5
+  done
+  # The forked children (server, mt, tts) exit with the parent; if the parent
+  # is wedged, take it down rather than installing under a live process.
+  pgrep -f "$NAME/Contents/MacOS" >/dev/null && {
+    echo "  did not quit in 25s — terminating"
+    pkill -f "$NAME/Contents/MacOS" || true
+    sleep 2
+  }
+fi
+
+MNT="$(mktemp -d /tmp/ct-mnt.XXXXXX)"
+hdiutil attach "$DMG" -nobrowse -quiet -mountpoint "$MNT"
+trap 'hdiutil detach "$MNT" -quiet -force >/dev/null 2>&1 || true; rmdir "$MNT" 2>/dev/null || true' EXIT
+
+# Prove the replacement exists BEFORE removing what works.
+[ -d "$MNT/$NAME" ] || { echo "no $NAME inside the dmg"; exit 1; }
+NEW="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "$MNT/$NAME/Contents/Info.plist")"
+NEWB="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleVersion' "$MNT/$NAME/Contents/Info.plist" 2>/dev/null || echo '?')"
+OLD="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "$APPS/$NAME/Contents/Info.plist" 2>/dev/null || echo 'none')"
+OLDB="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleVersion' "$APPS/$NAME/Contents/Info.plist" 2>/dev/null || echo '0')"
+echo "  $OLD (build $OLDB)  ->  $NEW (build $NEWB)"
+
+# Installing the same build over itself looks identical to a successful
+# install and is how a fix gets reported as shipped when it is not on disk.
+if [ "$OLD" = "$NEW" ] && [ "$OLDB" = "$NEWB" ]; then
+  echo "  NOTE: that is the build already installed — nothing changed."
+  echo "        Did you forget to bump version/buildNumber, or to run npm run dist?"
+fi
+
+rm -rf "$APPS/$NAME"
+ditto "$MNT/$NAME" "$APPS/$NAME"
+
+# The build is deliberately unsigned, so a fresh copy off a disk image carries
+# a quarantine flag and Gatekeeper refuses to open it without a right-click.
+# This is the user's own locally built app being installed at their request.
+xattr -dr com.apple.quarantine "$APPS/$NAME" 2>/dev/null || true
+
+open -a "$APPS/$NAME"
+echo "  launched"

app/tools/setup-local-voices.sh

@@ -0,0 +1,70 @@
+#!/bin/bash
+# One-time, per-Mac installer for the free local voices
+# (Kokoro and Qwen3-TTS, both via mlx-audio).
+# Bought once for $0: Apache-2.0 weights, runs entirely on this Mac.
+# The venv CANNOT be copied between machines — run this on each Mac.
+set -euo pipefail
+
+DIR="$HOME/Library/Application Support/Church Translate Local Voices"
+VENV="$DIR/venv"
+PORT="${1:-43111}"
+
+echo "== Church Translate — local voices installer =="
+# macOS ships Python 3.9, which mlx-audio cannot use — so FIND a 3.10+ python
+# rather than assuming the one on PATH. Checked in order: uv-managed (this Mac
+# has them), Homebrew, versioned names on PATH, then plain python3.
+PY=""
+pick_py() {
+  for c in "$@"; do
+    [ -x "$c" ] || continue
+    "$c" -c 'import sys; sys.exit(0 if sys.version_info >= (3,10) else 1)' 2>/dev/null && { PY="$c"; return 0; }
+  done
+  return 1
+}
+pick_py $(ls -d "$HOME/.local/share/uv/python/"*/bin/python3 2>/dev/null | sort -r) \
+        /opt/homebrew/bin/python3.13 /opt/homebrew/bin/python3.12 /opt/homebrew/bin/python3.11 \
+        /opt/homebrew/bin/python3 /usr/local/bin/python3 \
+        "$(command -v python3.13 || true)" "$(command -v python3.12 || true)" \
+        "$(command -v python3.11 || true)" "$(command -v python3 || true)" || {
+  echo "No Python 3.10+ found. Install one, then re-run:"
+  echo "    brew install python@3.12       # or: xcode-select --install"
+  exit 1
+}
+echo "using python: $PY ($("$PY" --version 2>&1))"
+
+mkdir -p "$DIR"
+[ -d "$VENV" ] || "$PY" -m venv "$VENV"
+"$VENV/bin/pip" install --upgrade pip >/dev/null
+
+# The exact dependency set, learned from consecutive boot failures:
+# mlx_audio.server needs uvicorn/fastapi/python-multipart; webrtcvad still
+# imports pkg_resources, which setuptools>=81 removed.
+"$VENV/bin/pip" install 'setuptools<81' mlx-audio uvicorn fastapi python-multipart webrtcvad
+
+# Kokoro's text processing. mlx-audio ships the model code but not these, and
+# without them synthesis fails at the last step with an ImportError for
+# 'misaki' — after the 330MB model has already downloaded. espeakng-loader
+# carries its own libespeak-ng, so no Homebrew and nothing system-wide.
+"$VENV/bin/pip" install misaki phonemizer-fork espeakng-loader
+
+echo "== prefetching the model (one-time download, ~2GB) =="
+"$VENV/bin/python3" - <<'PY'
+from huggingface_hub import snapshot_download
+snapshot_download('mlx-community/Qwen3-TTS-12Hz-1.7B-CustomVoice-8bit')
+print('model cached')
+PY
+
+echo "== self-test: boot the server and synthesize one sentence =="
+"$VENV/bin/python3" -m mlx_audio.server --host 127.0.0.1 --port "$PORT" &
+SRV=$!
+trap 'kill $SRV 2>/dev/null' EXIT
+for i in $(seq 1 30); do curl -s -o /dev/null "http://127.0.0.1:$PORT/v1/models" && break; sleep 1; done
+OUT="$DIR/selftest.wav"
+curl -s -X POST "http://127.0.0.1:$PORT/v1/audio/speech" \
+  -H 'Content-Type: application/json' \
+  -d '{"model":"mlx-community/Qwen3-TTS-12Hz-1.7B-CustomVoice-8bit","voice":"aiden","input":"The Lord bless you and keep you.","lang_code":"english","response_format":"wav","max_tokens":300,"temperature":0.2}' \
+  -o "$OUT"
+head -c 4 "$OUT" | grep -q RIFF && echo "SELF-TEST OK — $OUT ($(stat -f%z "$OUT") bytes)" || { echo "SELF-TEST FAILED"; exit 1; }
+kill $SRV 2>/dev/null; trap - EXIT
+echo
+echo "Done. In Church Translate: Operator pane → Premium voices → 'Local (this Mac — free)'."

app/tools/sync-build-version.js

@@ -0,0 +1,43 @@
+/*
+ * sync-build-version.js — make `buildNumber` mean something.
+ *
+ * package.json carried TWO build numbers: a top-level `buildNumber` that was
+ * dutifully bumped every release and read by absolutely nothing, and
+ * `build.buildVersion` — the one electron-builder writes to CFBundleVersion —
+ * hardcoded at "51" since 3.4.0. So the installed app reported build 51 while
+ * the release was build 55, and the DMG filename was the only honest clue
+ * anywhere. Runs as `predist`, so bumping buildNumber alone is now enough.
+ */
+'use strict';
+const fs = require('fs');
+const path = require('path');
+
+const p = path.join(__dirname, '..', 'package.json');
+const raw = fs.readFileSync(p, 'utf8');
+const pkg = JSON.parse(raw);
+
+const want = String(pkg.buildNumber || '').trim();
+if (!want) {
+  console.error('package.json has no buildNumber — refusing to build a build with no number');
+  process.exit(1);
+}
+if (!/^\d+$/.test(want)) {
+  console.error('buildNumber must be digits, got "' + want + '"');
+  process.exit(1);
+}
+
+const have = String((pkg.build && pkg.build.buildVersion) || '');
+if (have === want) {
+  console.log('build number ' + want + ' (CFBundleVersion already matches)');
+  process.exit(0);
+}
+
+/* Rewrite the one value textually rather than re-serialising the whole file, so
+   this never reformats a config the operator's settings depend on. */
+const re = /("buildVersion"\s*:\s*")([^"]*)(")/;
+if (!re.test(raw)) {
+  console.error('could not find build.buildVersion in package.json');
+  process.exit(1);
+}
+fs.writeFileSync(p, raw.replace(re, '$1' + want + '$3'));
+console.log('CFBundleVersion ' + (have || '(unset)') + ' -> ' + want);