Architecture

Two honest channels beat one clever guess.

The wearer tag answers “when did I speak?” The reader’s room microphone answers “what happened in the room?” The product aligns them, preserves provenance, and lets the user control retention.

Wearer contact waveform and room microphone waveform align to identify wearer speech and preserve other speakers. — Mechanical identity is a side channel: contact energy is strong only when the wearer’s tissue vibrates.

System boundary

Element	Contains	Must not contain
Choker/tag	Textile band, breakaway/mute, contact pad, passive sensor, resonator/antenna, enclosure	Battery, persistent storage, firmware, cloud credential, invisible software mute
Reader puck	RF source and receiver, room microphones, visible indicator, compute, local storage, secure element, USB/network interface	Undocumented capture path, shared factory password, mandatory cloud dependency
Host app	Session control, consent UX, transcript, export, delete, optional model endpoint	Capture-state ambiguity, undeletable raw audio, silent training reuse

Product state machine

State	RF	Room mic	Storage	User-visible truth
Muted	Reader idle; tag mechanically open/detuned	Off	None	Mute flag visible on choker; puck dark
Armed	Reader self-test only	Off	Health metrics only	Ready indication distinct from recording
Capturing	Approved illumination active	On	Encrypted session	Unmistakable indicator driven from capture path
Processing	Off unless session continues	Off	Local working set	Processing—not recording—shown separately
Exported/deleted	Off	Off	Per policy	Receipt identifies destination or deletion scope

First requirements

These are architecture requirements; numeric product targets remain provisional until P0–P2 establish distributions.

R-001: A wearer can remove the choker with one hand and without software.
R-002: Mechanical mute causes a measurable loss of recoverable wearer audio under worst-case approved illumination.
R-003: Capture indication is coupled to the actual room ADC and RF receive pipeline.
R-004: Loss of network does not prevent local capture, export, or deletion.
R-005: Raw room, raw contact, restored contact, transcript, and summary remain separately attributable in provenance metadata.
R-006: The product never claims the passive tag is cryptographically private.
R-007: Regional RF configuration is hardware/firmware constrained and cannot be casually enabled in an unapproved market.
R-008: A session records explicit notice/consent state as metadata without pretending that UI alone satisfies every jurisdiction.

Canonical data contract

Session {
  session_id, started_at, ended_at, device_id,
  jurisdiction_profile, notice_confirmed,
  streams: [
    {kind: "room_raw", clock, calibration_id, hash},
    {kind: "contact_demod", clock, rf_profile, calibration_id, hash},
    {kind: "contact_restored", parent_hash, model_id, hash}
  ],
  segments: [{start, end, label, confidence, evidence}],
  exports: [{time, format, destination_class}],
  deletion: {requested_at, completed_at, scope}
}

The evidence field should distinguish contact coherence, acoustic diarization, and user correction. Never collapse all three into a mysterious confidence score.

Failure behavior

Weak wearer channel

Preserve room audio, mark wearer attribution uncertain, ask for repositioning after the session—not during a high-stakes meeting.

Reader loses tag

Record the gap explicitly. Do not hallucinate the wearer channel from the room channel.

Network unavailable

Continue local encrypted capture if the user requested it. Queue optional remote processing.

Mute disagreement

If physical-state sensing and RF measurement disagree, fail closed: stop capture and surface a hardware fault.