ratatoskr/docs/contracts/donut_voiced_interview.contract.md

---
contract_version: "2.1"
module: "ratatoskr.web.tts_kb"
purpose: >
  A voiced, corpus-grounded Tier-3 interview character in the ratatoskr web
  console. Two capabilities plus one character: (a) auto-TTS via the
  chatterbox-fast gateway, spoken on SSE `done` (migrated off Zonos 2026-08-07;
  no affect modulation — chatterbox Turbo has no emotion knob); (b) a
  consumer-side KB-retrieval + `memory_context` pinning
  BRIDGE that grounds the character's recall in the ingested corpus while she
  stays in-voice; (c) Princess Donut (Dungeon Crawler Carl) as the first
  instance. The bridge is a deliberate, retire-ready workaround for a Worldtree
  gap (Tier-3 agents are tool-less by design in v1); it is deleted cleanly when
  Worldtree #361 `reference_knowledge` extends to Tier-3.
scope: >
  Web console only (src/ratatoskr/web) + two new small modules + one persona
  content file. The Bifrost provider planes and the ratatoskr.wt SDK-adapter
  core are UNTOUCHED. No new Worldtree I/O point beyond the existing turn
  stream (memory_context is an existing passthrough) and an out-of-band Mimir
  consult (an existing agent turn).
touches:
  - src/ratatoskr/web/server.py          # /api/tts route + the retrieval-pinning seam on the turn path
  - src/ratatoskr/web/static/index.html   # speak-on-done playback, 🔊 toggle, <audio> sink; turn POST carries agent_id
  - src/ratatoskr/web/entrypoint.py       # RATATOSKR_TTS_URL override (the tts swap seam)
  - src/ratatoskr/tts.py                  # chatterbox-fast gateway client (was Zonos + PAD->dial; migrated 2026-08-07)
  - src/ratatoskr/kb_bridge.py            # NEW, RETIRE-READY — consumer-side retrieval + memory_context pinning
  - src/ratatoskr/wt.py                   # stream_turn gains a memory_context passthrough (seam-review: the contract's original touch list undercounted this by one file; the param defaults None so the bridge's RETIREMENT stays inert — deleting kb_bridge.py + the one call-site leaves wt.stream_turn's SDK-parity param harmless)
  - docs/characters/donut.md              # NEW — Princess Donut persona (content; the tier3 define source)
depends_on:
  - "chatterbox-fast gateway: POST http://10.100.79.3:8197/tts (infra-ops; WG-internal, no auth; bespoke non-OpenAI schema {text,voice,format,stream}; streaming placeholder-header wav @ 24000 Hz; no per-synth cap; NO affect controls; verified 2026-08-07 against image local/chatterbox-fast:v1)"
  - "Worldtree turn stream: memory_context[] passthrough (SDK stream_turn already forwards it verbatim)"
  - "Worldtree agents.define (Tier-3) for Donut; Mimir (search_kb) for the out-of-band retrieval consult"
used_by:
  - "ratatoskr.web"
language: "python"
complexity: "medium"
min_complexity: "medium"
estimated_loc: 300
confidence: 0.8
---

# Contract: Donut voiced interview (auto-TTS + KB-recall bridge)

> **⚠ TTS MIGRATED OFF ZONOS → chatterbox-fast 2026-08-07 (operator-directed).**
> Slice 2's synthesis backend moved from the Zonos gateway (:8890
> `/v1/audio/speech`) to chatterbox-fast (:8197 `/tts`). Three architecture deltas,
> all infra-ops-verified against image `local/chatterbox-fast:v1`:
> - **Affect dropped (DEC-7 RETIRED).** chatterbox serves the Chatterbox TURBO
>   checkpoint, which has NO valence/arousal/emotion knob (exaggeration is exposed
>   but inert on Turbo). The whole PAD→emotion-dial path — `PadState`,
>   `EmotionDials`, `pad_to_dials`, and the browser `p`/`a` body fields — is
>   deleted. Voice is now flat (high-quality but unmodulated). Operator's call: if
>   live affect ever becomes load-bearing again, Zonos (:8890) remains the only
>   fleet TTS with real emotion steering.
> - **Client-side chunking dropped (DEC-10 RETIRED).** chatterbox has no per-synth
>   token/duration cap (Zonos capped at 6144 tok / 71.2s) and chunks arbitrary-length
>   text internally, so `chunk_text` + `tts_stream_long` + `_pcm_after_header` are
>   deleted; a single `tts_stream` call voices a whole turn. The mid-stream degrade
>   policy (`yielded_any`) folds INTO `tts_stream`.
> - **Sample rate 44100 → 24000 Hz.** The browser Web Audio decode MUST use 24000
>   or the voice plays ~1.8× too fast.
> `/api/tts` stays POST; the streaming placeholder-header WAV shape (DEC-2/DEC-3) and
> the browser Web-Audio PCM decode path (DEC-2) are UNCHANGED except the sample rate.
> The `tts.py` client remains the single swap seam (DEC-1). DEC-7/9/10 below are
> retained as historical record of the Zonos build.

> **⚠ SLICE 3 (KB-recall bridge) RETIRED 2026-08-02.** The `kb_bridge.py` module +
> its single `web/server.py` call-site were deleted per INV-KB-1 when Worldtree #383
> shipped native Tier-3 `reference_knowledge` (v1.0.0b167, live on :8081 + demo).
> Donut now searches the fiction wing (DCC corpus) natively, in-turn, with evidence
> packets (note_id + path provenance, confidence bucket) and a server-side grounding
> rule — strictly better than the consumer-side memory_context pinning it replaced
> (no separate consult round-trip, not gated by our out-of-band prompt). Retirement
> live-verified: Donut called `reference_knowledge` and grounded in DCC in-voice
> before deletion. `wt.stream_turn`'s `memory_context` param was KEPT (inert SDK
> parity). The DEC-6 / INV-KB-* / FN pin_kb_context sections below are retained as
> historical record of what was built and why it retired. **Slices 1 (persona) + 2
> (auto-TTS) remain LIVE.**

Migration-style contract: three separable slices (persona / TTS / KB-bridge),
each independently shippable. Slice order is chosen for fastest visible result.

## Decisions (DEC)

- **DEC-1 — direct :8197 coupling (amended 2026-08-07).** Proxy straight to the
  chatterbox-fast gateway. Original Zonos rationale was the emotion dials (which
  `ext-tts` dropped); that rationale is retired with affect (DEC-7). The coupling
  STANDS regardless: chatterbox-fast is a bespoke, non-OpenAI `/tts` schema
  (`{text,voice,format,stream}`, verified with infra-ops), NOT reachable through the
  OpenAI-shaped `ext-tts` LiteLLM alias — so `tts.py` remains the single swap seam,
  now translating that bespoke schema. (Considered routing via the generic alias
  once affect was dropped; the non-OpenAI wire ruled it out.)
- **DEC-2 — STREAMING, play-as-it-arrives (amended 2026-08-02, operator-directed).**
  The gateway ALREADY streams: `POST /v1/audio/speech` relays a chunked int16 WAV
  (transfer-encoding: chunked, placeholder 0xFFFFFFFF RIFF/data sizes) as it synthesizes
  — TTFB ~0.44s vs ~7s total (infra-ops verified). So ratatoskr PROXIES THE CHUNKS
  STRAIGHT THROUGH (`tts_stream`, `GET /api/tts`) and the browser plays a progressive
  `<audio src>`; NEVER buffer, NEVER rewrite the placeholder header (a rewrite needs the
  whole clip and defeats streaming — the bug the original buffered `tts_synthesize` +
  `_finalize_wav_header` hit). The placeholder-size WAV is DESIGNED for `<audio src>`
  progressive playback (validated in Chromium: plays, currentTime advances, no MSE
  needed). Supersedes the original "full-synth latency accepted / no streaming."
  (Amended 2026-08-02: the browser path is now Web Audio decoding raw int16 PCM, not
  `<audio src>` — Safari/WebKit rejects a 0xFFFFFFFF-length streaming WAV via `<audio
  src>` (NotSupportedError); and `/api/tts` is now POST, not GET. See DEC-10.)
- **DEC-3 — wav streaming (amended 2026-08-07).** `format:"wav"`, `stream:true` →
  a streaming int16 RIFF/WAVE with placeholder (0xFFFFFFFF) RIFF/data sizes, one
  header, then s16le PCM to EOF — the shape the browser's one-header-strip decoder
  expects. chatterbox also offers `format:"pcm"` (headerless raw s16le, leaner);
  kept on `wav` so the streaming shape stays byte-identical to the Zonos path and the
  endpoint's RIFF-sniff (non-WAV-200 → 503) and the browser header-strip both stand
  unchanged. (pcm is a deferred lean-up — it would drop the header-strip + the
  RIFF-sniff, net a few lines.)
- **DEC-4 — server-side proxy.** Browser → `/api/tts` (nh3-dev) → gateway. The
  irv-ml1 host/URL never reaches the client (INV-TTS-1). No key exists, so
  INV-003 is trivially satisfied, but the proxy still stands (browser can't
  reach the WG net regardless).
- **DEC-5 — serialize one synth per turn.** The gateway shares a single 3090
  (~90% VRAM) with other TTS engines; do not parallelize. A new turn cancels any
  in-flight synth + playback.
- **DEC-6 — KB-recall = consumer-side retrieval + memory_context pinning, as a
  RETIRE-READY bridge (worldtree-dev ruling, wyrd-proven pattern).** Tier-3 is
  tool-less by design (`build_tier3_agent_context` hard-codes `tool_schemas=[]`);
  agent.call:mimir is rejected (recursion). So per interview turn: ratatoskr
  consults Mimir out-of-band for the question's topic, extracts the cited
  evidence, and POSTs Donut's turn with `memory_context=[{kind:"corpus_reference",
  text:"<extract>"}]`. She answers in-voice, framing it as her own memory. The
  bridge is isolated behind ONE seam (INV-KB-1) so it deletes cleanly when
  Worldtree #361 `reference_knowledge` extends to Tier-3 (operator-flagged as an
  integral gap; worldtree-dev surfacing the extension to Vuong).
  - **DEC-6 status (2026-08-02): bridge RETIRED, native `reference_knowledge` live but
    EMPTY.** The bridge was deleted (`09e4257`) when WT #383 native `reference_knowledge`
    (b167) shipped — Donut now calls the tool in-turn. But the tool returns zero hits for
    every query. Root-caused 2026-08-02: Mimir's `search_library` DOES find the DCC corpus
    (main wing, score ~0.03), so the store is NOT empty and this is NOT a ratatoskr gap —
    WT's native `reference_knowledge` isn't surfacing content Mimir retrieves fine (likely
    a wing-scope mismatch — tool scoped to the failed `fiction` wing — or a confidence
    threshold rejecting the weak ~0.03 hits). Escalated to worldtree-dev. Until fixed,
    Donut recalls from her own character knowledge (degrades in-voice per the persona).
- **DEC-7 — affect-driven emotion. RETIRED 2026-08-07 (chatterbox migration).**
  chatterbox Turbo has no valence/arousal/emotion control (infra-ops-verified:
  exaggeration is exposed but inert; cfg_weight/min_p not exposed; only generic
  sampling knobs move output, and those change timbre/variance not emotion). There
  is no coupling point for a live-PAD driver, so the entire path is deleted —
  `PadState`, `EmotionDials`, `pad_to_dials`, the `/api/tts` `p`/`a` body fields, and
  the browser's `pad` argument. Voice is now flat. Retained below as historical
  record of the Zonos build. (Original: map live PAD from the `affect_update` SSE →
  Zonos `emotion_valence`/`emotion_arousal`, reframing the feature as voice
  OBSERVABILITY. The observability framing dies with the knob.)
- **DEC-8 — voice: custom "donut" is REGISTERED (amended 2026-08-07 for chatterbox).**
  chatterbox voices are `*.wav` reference clips in `/refs` (GET /voices lists the
  stems). infra-ops registered `/refs/donut.wav` (the same reference clip behind the
  Zonos Donut voice) at operator direction, so `_TTS_VOICE_MAP` maps
  `ratatoskr:donut → "donut"` directly. NOTE the case: chatterbox wants lowercase
  `"donut"` (Zonos used `"Donut"`). Non-interview agents fall to the chatterbox
  default `"glados_25s"` (was Zonos `"Cora"`, which does not exist on chatterbox).
- **DEC-9 — hold English (amended 2026-08-07; the "nothing to drift" call was WRONG).**
  The Zonos `language:"en-us"` pin is dropped — chatterbox has no `language` field. BUT the
  initial "English-only, nothing to drift" rationale was FALSIFIED by an operator report the
  same day: the Turbo checkpoint drifts into German partway through a long turn. infra-ops's
  authoritative root-cause (source-read, thread 01KZEDMJ…): **Turbo has latent multilingual
  capacity that leaks**, and the drift is **length-driven** — the gateway's adaptive scheduler
  ratchets chunk size upward with NO cap, so a long turn collapses into essentially ONE long
  generation after the first 2-3 sentences, and the sampler wanders off English on that single
  long decode (generation state DOES reset per chunk — cross-chunk carry is not the mechanism;
  it's the unbounded per-chunk length). Two-layer response:
  - **Sampling curbs (shipped, no redeploy) — REDUCE drift probability, do NOT guarantee it.**
    `gateway_body` tightens below the gateway defaults: `_TTS_TOP_K = 80` (from 1000 — the
    highest-leverage knob; the huge default admits off-language tokens), `_TTS_TOP_P = 0.85`
    (from 0.95), `_TTS_TEMPERATURE = 0.5` (from 0.8). Escalation if still drifting: temp
    0.3-0.4, rep_penalty 1.2→1.3.
  - **Length-bounding (the ROBUST fix) — GUARANTEES English by keeping each generation short.**
    Two paths, operator's call: (a) return to short CLIENT-side chunking (~1-2 sentences per
    /tts call, each a fresh re-anchored generation; partially reverses DEC-10; works today, no
    redeploy; loses the gateway's seamless internal streaming); (b) infra-ops adds a SERVER-side
    max-chunk cap to the scheduler (keeps seamless streaming AND holds English; needs a
    chatterbox-fast redeploy + operator greenlight on the card-shared fleet service — then the
    consumer reverts to sending full text).
  The persona's dialogue-only rewrite in `docs/characters/donut.md` still stands (removes the
  asterisk-RP-voiced-verbatim vector regardless of engine). (Original Zonos DEC-9 below.)

- **DEC-9a — OOM on long single generations → empty 200 (infra-ops 2026-08-07).** chatterbox-fast
  shares the RTX 3090 with Zonos2 (~1 GB headroom). A long single generation can OOM the card;
  the gateway then returns HTTP **200 with a 0-byte body** (not a 5xx). `tts_endpoint` treats an
  empty 200 body as a synthesis failure → 503 (INV-TTS-4 visible skip), never a silent empty
  audio/wav stream. Length-bounding (DEC-9 above) fixes the OOM too — small chunks don't OOM.
- **DEC-10 — long-form chunk-and-concatenate. RETIRED 2026-08-07 (chatterbox
  migration).** chatterbox-fast has NO per-synth token/duration cap (Zonos capped at
  6144 tok / 71.2s) and chunks arbitrary-length text INTERNALLY via its adaptive
  scheduler, streaming seamlessly — so client-side chunk-and-concatenate is deleted:
  `chunk_text`, `tts_stream_long`, `_pcm_after_header`, and the `_TTS_CHUNK_CHAR_BUDGET`
  constants are gone; a single `tts_stream` call voices a whole turn. `/api/tts` STAYS
  POST (DEC-10a) — a long turn still rides the body, not a length-capped URL — and the
  8000-char outer cap stays as a shared-GPU hold ceiling (no longer a chunk-count
  bound). The `yielded_any` mid-stream degrade that lived in `tts_stream_long` folds
  into `tts_stream`. Retained below as historical record of the Zonos build. (Original:)
  The Zonos model hard-caps ONE synthesis at
  `max_tokens=6144` = 71.2s of audio (6144 / 86.3 Hz codec frame rate; the gateway 400s
  above 6144 — an architectural sequence limit, unraisable). So a turn longer than ~71s
  truncated mid-stream. Fix: split the text client-side and concatenate the PCM
  (`chunk_text` + `tts_stream_long`). Chunking is paragraph-first + greedy (operator call:
  fewer, fuller chunks for prosody), targeting ~75% of the cap per chunk (~747 chars @
  ~14 c/s); the 25% headroom covers char→audio-seconds variance (the cap is on TOKENS —
  6144 = 71.2s ALWAYS, a codec-frame constant regardless of delivery, infra-ops — while the
  budget is in CHARS, a proxy that stretches under slow/expressive delivery) so no chunk clips;
  oversized paragraphs fall back to sentence packing, oversized sentences to clause/word
  sub-splitting. Concatenation emits chunk 1's WAV verbatim then chunks 2..N header-
  stripped → ONE continuous int16-PCM stream (never bury a RIFF header mid-stream —
  infra-ops). Identical voice+dials+language per chunk for uniform delivery. `/api/tts`
  becomes POST (DEC-10a) so the full text rides the body, not a length-capped URL; the
  outer text cap rises 2000→8000 (a shared-3090 hold bound, not a URL bound).

## Invariants

- **INV-TTS-1 [hard]** — the TTS gateway host/URL (chatterbox-fast :8197) never
  reaches the browser; all synthesis goes through `/api/tts`.
- **INV-TTS-2 [hard]** — TTS is opt-in: a 🔊 toggle (default OFF), persisted to
  localStorage (mirrors the theme/cot-toggle pattern). No speech without it.
- **INV-TTS-3 [hard]** — one synth in flight at a time; a new turn cancels the
  prior synth request AND stops in-flight playback (cancel-on-new-turn).
- **INV-TTS-4 [hard]** — TTS failure is non-blocking: a gateway error, non-wav
  body, or playback failure skips audio; the turn/transcript is unaffected. Logging is
  scoped to GENUINE failure: a committed-200 mid-stream/later-chunk degrade writes a
  `tts_degrade` stderr line (server) or a `no WAV header` ticker (browser); a browser-side
  ABORT/cancel (INV-TTS-3 new-turn) is deliberately SILENT — cancellation is not a failure.
- **INV-KB-1 [hard]** — the KB bridge is import-isolated behind a single seam:
  `server.py`'s turn path calls exactly one function `pin_kb_context(question,
  agent_id) -> list[memory_context] | []`. Retiring the bridge = delete
  `kb_bridge.py` + that one call-site; no other file changes. `kb_bridge` imports
  nothing from the TTS or SDK-adapter core.
- **INV-KB-2 [hard]** — the retrieval channel is never persisted: `memory_context`
  is per-turn, `kind="corpus_reference"` (a free label), and rides the turn POST
  body only.
- **INV-KB-3 [hard]** — KB-retrieval failure is non-blocking: a failed/empty
  Mimir consult pins nothing (`[]`) and Donut answers without the extract; never
  block or fail her turn on retrieval.
- **INV-KB-4** — the bridge is scoped to characters that opt in (a per-agent
  allowlist / config), not applied to every turn — only interview characters
  that need corpus recall pay the retrieval round-trip.

## FN blocks

### FN tts_stream  (the sole synthesis primitive — DEC-2 streaming; amended 2026-08-07)
```
tts_stream(text, *, voice, client: httpx.AsyncClient, url=CHATTERBOX_TTS_URL) -> AsyncIterator[bytes]
  # Open the gateway's CHUNKED stream (client.stream("POST", url, json=gateway_body(text, voice))) and
  # YIELD wav chunks as they synthesize. Pass through verbatim — never buffer, never rewrite the placeholder
  # header. chatterbox chunks arbitrary-length text INTERNALLY (no per-synth cap, DEC-10 RETIRED), so this
  # SINGLE call voices a whole turn — no client-side chunk-and-concatenate wrapper.
  # gateway_body(text, voice) = {text, voice, format:"wav", stream:true, temperature:_TTS_TEMPERATURE}.
  #   temperature < gateway-default 0.8 holds English across a long turn (DEC-9). NO dials, NO language (RETIRED).
  precondition: text non-empty. Voice membership in GET /voices is GATEWAY-enforced, not client-asserted.
  postcondition: yields the gateway's chunked int16 streaming WAV bytes unmodified (0xFFFFFFFF placeholder
                 sizes intact), one leading header then s16le PCM @ 24000 Hz to EOF.
  error (the yielded_any pivot, folded in from the retired tts_stream_long):
    - a non-200 OPEN or a connect/transport failure BEFORE the first byte -> TtsUnavailable (so the endpoint
      peek can still return 503; nothing committed yet).
    - a transport drop AFTER >= 1 byte has streamed (the 200 is committed) -> DEGRADE: write a `tts_degrade`
      stderr line, END the generator, keep what played. NEVER raise into the committed StreamingResponse.
  invariant: format is ALWAYS "wav" (DEC-3); never mp3/opus/pcm from this seam.
```

### FN chunk_text  (DEC-10 long-form splitting; pure) — RETIRED 2026-08-07 (chatterbox chunks internally; deleted). Historical:
```
chunk_text(text, budget=_TTS_CHUNK_CHAR_BUDGET) -> list[str]
  # Split into synthesis chunks each <= budget chars. Paragraph-first (seams on blank lines), greedy pack.
  steps:
    - strip; empty/whitespace -> [].
    - whole paragraphs (each <= budget) greedily pack together, joined "\n\n".
    - a paragraph > budget flushes the pending run, then sentence-packs (split (?<=[.!?])\s+, join " ");
      a sentence > budget sub-splits on clause (, ; :) then space, hard-cut mid-word only as last resort.
  postcondition: every chunk non-empty and <= budget; word order preserved; no split mid-word unless the
                 input has no boundary at all. budget = 71.2s * 0.75 * 14 c/s ≈ 747 (75% of cap for prosody).
```

### FN tts_stream_long  (DEC-10 orchestrator) — RETIRED 2026-08-07 (no per-synth cap; deleted, its yielded_any degrade folded into tts_stream). Historical:
```
tts_stream_long(text, *, voice, dials, client, url=ZONOS_TTS_URL, budget=_TTS_CHUNK_CHAR_BUDGET) -> AsyncIterator[bytes]
  # chunk_text(text) then synth each chunk with tts_stream (identical voice+dials+language). Emit chunk 1
  # VERBATIM (WAV header + PCM); chunks 2..N via _pcm_after_header (strip up to+incl the `data` id+size) so
  # the browser decodes ONE continuous int16-PCM stream after a single leading header (infra-ops: one header).
  error: the pivot is `yielded_any`, NOT the chunk index. A failure BEFORE the first byte (an OPEN failure)
         propagates as TtsUnavailable -> endpoint peek -> 503 (nothing committed yet). A failure AFTER bytes
         have streamed — a MID-STREAM drop on chunk 0 OR a later chunk, past the committed 200 — degrades:
         drop the tail, keep what played, write a `tts_degrade` stderr line, RETURN (never raise into the
         committed StreamingResponse). httpx wraps aiter_bytes in `except RequestError`, so a mid-stream
         drop arrives as TtsUnavailable, not a clean generator end — the yielded_any gate is what keeps a
         chunk-0 mid-stream drop from raising into the 200.
```

### FN pad_to_dials — RETIRED 2026-08-07 (DEC-7 affect dropped; PadState/EmotionDials/pad_to_dials all deleted). Historical:
```
pad_to_dials(pad: PadState | None) -> EmotionDials
  # Map live PAD -> Zonos emotion dials (DEC-7).
  steps:
    - none/malformed pad -> neutral dials (emotion_enabled=False) [degrade-not-crash].
    - emotion_valence = clamp(pad.pleasure, -1, 1); emotion_arousal = clamp(pad.arousal, -1, 1).
    - emotion_enabled = True; emotion_strength from a fixed default (tunable).
  invariant: total over any PAD the DECLARED surface produces (a PadState with float axes /
             None / out-of-range / NaN / inf / a non-PadState object) -> valid dials, never raises.
             (A PadState carrying NON-float axes is a type violation no call site constructs — the
             endpoint coerces via PadState.from_obj; not defended inside pad_to_dials.)
```

### FN tts_endpoint  (server.py, POST /api/tts — DEC-10a; amended 2026-08-07)
```
POST /api/tts  {text, agent_id?}  -> audio/wav (chunked StreamingResponse)
  # POST (not GET) so an arbitrarily long turn rides the body, not a length-capped URL. The gateway chunks
  # arbitrary-length text internally (DEC-10 RETIRED — no client concat); a single tts_stream call proxies it.
  # text capped 8000 chars, word-boundary truncated (a shared-GPU hold bound; the transcript still shows the
  # full text). text/agent_id are untrusted open-world body fields — each degrades, never 500s (INV-TTS-4).
  # (The `p`/`a` PAD body fields are GONE — DEC-7 affect retired.)
  steps:
    - bad JSON / non-str text -> 400. Scrub lone surrogates from text (else httpx's utf-8 encode of the gateway
      body 500s); if the scrubbed text is blank after strip -> 400. word-boundary truncate to 8000 (with a
      mid-word HARD-CUT fallback when the last space sits at index <= limit//2).
    - resolve voice: per-character map -> "donut", default "glados_25s"; a NON-str agent_id (unhashable) -> default.
    - acquire the serialize lock (DEC-5, one stream at a time on the shared GPU); open tts_stream and PEEK the
      first byte: a bad gateway OPEN -> 503; an EMPTY 200 body (no bytes — an OOM synth, DEC-9a) -> 503; and a
      200 whose first bytes are NOT a RIFF header -> 503 too (a mislabeled non-WAV body would decode as
      garbage) — all BEFORE committing a 200 (INV-TTS-4). Any OTHER escape during the peek (CancelledError,
      httpx.InvalidURL) releases the lock+client, then propagates.
    - return StreamingResponse piping tts_stream; the generator's finally releases the lock + closes the client
      (incl. the browser-abort path: a new turn's fetch() drops the POST) and, on a committed mid-stream drop,
      tts_stream degrades internally (ends the generator, no raise). httpx.Timeout is connect=10 / read=120 /
      write=10 / pool=10 (read=120 per infra-ops: a long synth can render slowly).
```

### FN pin_kb_context  (kb_bridge.py — RETIRE-READY, INV-KB-1)
```
pin_kb_context(question: str, agent_id: str | None, *, client) -> list[dict]   # memory_context items, or []
  # The bridge. Consumer-side retrieval + pinning (DEC-6).
  steps:
    - gate on the interview-character allowlist (INV-KB-4); not listed / blank question -> [].
    - out-of-band Mimir consult (a throwaway session + one turn), HARD-bounded by a timeout.
    - extract the answer text (prefer DoneEvent.response; fall back to text deltas), bounded length.
    - return [{"kind":"corpus_reference","text":<extract>}].
  error/empty/timeout: any failure or no hits -> [] (INV-KB-3; never raises to the turn path).
                       CancelledError (browser disconnect) is NOT caught — it propagates.
  no-hit sentinel (heid-code-review F7): the consult prompt asks Mimir to emit exactly NO_CORPUS_MATCH
                       when the search finds nothing relevant; pin_kb_context drops any extract containing
                       it -> [], so a non-empty "no results found" answer is never pinned as the character's
                       own memory. The token is artificial (no genuine passage contains it).
  session hygiene (heid-bug-hunt): the throwaway Mimir consult session is deleted (SDK sessions.delete) on
                       success/error/timeout via a caller-owned holder, so consults don't accumulate upstream.
  CONSULT PROMPT (foot-gun mitigation, tuned live 2026-08-02): force "search_library EXACTLY ONCE,
    no read_note" — converges Mimir in ~3-15s. The softer "do one search" phrasing let Mimir loop
    read_note<->search past a 25s ceiling on conversational (non-keyword) questions (live-observed).
  KNOWN LIMIT (surfaced by the live smoke, NOT a bridge defect): the bridge's GROUNDING VALUE is gated
    by Mimir's retrieval quality on the target corpus. DCC's fiction-wing index is currently weak
    (scores ~0.02, failed backfill — a standing worldtree-dev item), so hits are noisy/partial; the
    model's own DCC training knowledge already grounds Donut well, so the bridge is opportunistic here.
    Its real payoff is a corpus the model does NOT know AND that indexes cleanly.
  RETIREMENT: when Worldtree #361 reference_knowledge reaches Tier-3, delete this module + the single
              server.py call-site (wt.stream_turn's memory_context param stays, inert); Donut then
              searches in-voice natively.
```

### FN client: speakOnDone  (index.html — Web Audio STREAMING, DEC-2; amended 2026-08-07)
```
on SSE `done`:
  if !ttsEnabled(): return                                  # INV-TTS-2
  cancelTts()                                               # INV-TTS-3: abort fetch + stop scheduled nodes
  POST /api/tts {text (sliced to the 8000 cap), agent_id?} -> reader   # DEC-10a: POST body. NO p/a (DEC-7 retired).
  loop: read chunk -> skip ONE WAV header up to the data chunk (bounded 64KiB) -> int16 LE PCM -> Float32 ->
        AudioBuffer(sampleRate=24000) -> BufferSource.start(playAt) GAPLESSLY -> playAt += buf.duration
        # SR = 24000 (chatterbox; was 44100 for Zonos — MUST match or the voice plays ~1.8x too fast). TTFA ~0.5s.
  first scheduled node -> "▶ voiced". HARD failure (non-OK HTTP, or 64KiB with no WAV header) -> ticker + skip;
        ABORT/cancel (INV-TTS-3 new-turn) + bare network error -> SILENT skip (INV-TTS-4, cancel is not a failure)

WHY Web Audio, not <audio src>: Safari/WebKit REFUSES a streaming 0xFFFFFFFF-length WAV via <audio src>
(NotSupportedError — it can't compute duration/seek), which was the operator's live failure. Decoding the raw
int16 PCM ourselves and scheduling it into an AudioContext sidesteps every WAV-container quirk and works in all
engines. Validated in Chromium: 43 nodes scheduled, 5.1s decoded, no error.

AUTOPLAY UNLOCK: an AudioContext starts "suspended"; Safari + Chrome require resume() to originate from a user
gesture (then it stays running). _unlockTtsAudio() resumes it on the FIRST interaction anywhere (document
pointerdown/keydown) + toggle-on + each submit, so it's running before the ~15s-delayed speak-on-done. Validated:
ctx is "running" 6.5s after the gesture (past the transient-activation window). Page served no-store so a stale
cache can't hide these updates.
```

## Slice plan

1. **Persona** — author `docs/characters/donut.md` (corpus-grounded, interview frame,
   markdown-RP register) + `tier3 define` Princess Donut. Visible: she's in the picker,
   chattable (answers from training until slice 3). No code.
2. **Auto-TTS** — `tts.py` (gateway client + pad_to_dials) + `/api/tts` proxy + the
   index.html 🔊 toggle + speak-on-done playback + serialize/cancel. Visible: she's voiced,
   affect-modulated. TDD (respx-mock the gateway; live smoke on the console).
3. **KB-bridge** — `kb_bridge.py` + the one server.py seam. Visible: she recalls the DCC
   corpus in-voice. TDD. RETIRE-READY per INV-KB-1.

Out of scope: true audio streaming (DEC-2), custom voice registration (DEC-8, infra-ops
follow-up), extending the bridge to non-interview agents.