diff --git a/app/src-tauri/src/lib.rs b/app/src-tauri/src/lib.rs
index e532a4a6c6..3c22734adf 100644
--- a/app/src-tauri/src/lib.rs
+++ b/app/src-tauri/src/lib.rs
@@ -3174,6 +3174,10 @@ pub fn run() {
                             request_id: request_id.clone(),
                             meet_url: meet_url.clone(),
                             display_name: "OpenHuman Dev".to_string(),
+                            // Dev-auto launch has no real user identity — the
+                            // wake gate will fail-closed (no wakes fire) which
+                            // is the safe posture for an automated harness.
+                            owner_display_name: String::new(),
                         };
                         match meet_call::meet_call_open_window(app_handle.clone(), state, args)
                             .await
diff --git a/app/src-tauri/src/meet_audio/audio_bridge.js b/app/src-tauri/src/meet_audio/audio_bridge.js
index 9d9cfdedd9..618463a8f2 100644
--- a/app/src-tauri/src/meet_audio/audio_bridge.js
+++ b/app/src-tauri/src/meet_audio/audio_bridge.js
@@ -45,9 +45,13 @@
 
   function ensureContext() {
     if (ctx) {
-      console.log(
-        "[openhuman-audio-bridge] reuse AudioContext state=" + ctx.state
-      );
+      // Resume if suspended (CEF suspends until user gesture; the
+      // meet_scanner's synthetic clicks count as gestures on some
+      // builds but not all).
+      if (ctx.state === "suspended") {
+        ctx.resume().catch(function () {});
+        console.log("[openhuman-audio-bridge] resumed suspended AudioContext");
+      }
       return ctx;
     }
     var requestedRate = SAMPLE_RATE;
@@ -97,6 +101,29 @@
     return out;
   }
 
+  // Track every scheduled AudioBufferSource so __openhumanFlushAudio
+  // can stop them on barge-in (user re-asks during a long bot reply).
+  // Without this list, only the queue tail past `nextStartTime` would
+  // be cancellable; anything already start()-ed plays to completion.
+  var activeSources = [];
+
+  // Stop in-flight playback and reset the schedule cursor. Called by
+  // the Rust shell when the brain cancels outbound (new wake fires
+  // mid-reply). Returns the number of sources that were stopped, so
+  // the shell can log how much speech got cut.
+  window.__openhumanFlushAudio = function () {
+    var stopped = 0;
+    while (activeSources.length) {
+      var s = activeSources.pop();
+      try { s.stop(); stopped++; } catch (_) {}
+      try { s.disconnect(); } catch (_) {}
+    }
+    if (ctx) {
+      nextStartTime = ctx.currentTime;
+    }
+    return stopped;
+  };
+
   // Public push API. Returns the duration in seconds the chunk added
   // to the queue, mostly for diagnostics; the shell ignores it.
   window.__openhumanFeedPcm = function (b64) {
@@ -110,6 +137,13 @@
       var src = ctx.createBufferSource();
       src.buffer = buffer;
       src.connect(dest);
+      // Also pipe to the page's default audio output so the bot's
+      // TTS is audible on the host machine. This does NOT cause echo
+      // because Meet attributes the bot's own speech to "You" (which
+      // is filtered in core's note_caption) and the media-element
+      // mute below silences Meet's INCOMING call audio (other
+      // participants' voices bouncing back through speakers).
+      src.connect(ctx.destination);
       // Schedule strictly after the previous chunk so successive
       // 100 ms feeds line up gaplessly. If the queue has emptied
       // (caller fell behind), restart at currentTime so we don't try
@@ -118,6 +152,11 @@
         nextStartTime = ctx.currentTime;
       }
       src.start(nextStartTime);
+      activeSources.push(src);
+      src.onended = function () {
+        var idx = activeSources.indexOf(src);
+        if (idx !== -1) activeSources.splice(idx, 1);
+      };
       nextStartTime += buffer.duration;
       // High-frequency log gated by a counter so we don't drown the
       // console at 10 Hz; emit ~1 in 50 frames (~5 s cadence at the
@@ -231,5 +270,161 @@
         });
     };
   }
-  console.log("[openhuman-audio-bridge] install complete");
+  // Mute all inbound call audio on this page. The bot's CEF window is
+  // a headless participant — it reads captions for input and uses the
+  // virtual mic for output. Any audio that plays through the local
+  // speakers gets picked up by the user's mic (they're on the same
+  // machine) and causes an echo loop. We:
+  //
+  //   1. Mute all existing <audio> and <video> elements.
+  //   2. Observe the DOM for new media elements and mute those too.
+  //   3. Monkey-patch HTMLMediaElement.prototype.play to auto-mute
+  //      before playing, catching dynamically created elements that
+  //      aren't in the DOM yet.
+  //
+  // This does NOT affect the bridge's outbound TTS path — that goes
+  // through the Web Audio graph's MediaStreamDestination (virtual mic),
+  // not through any <audio>/<video> element.
+  function muteMediaElement(el) {
+    try {
+      el.muted = true;
+      el.volume = 0;
+    } catch (_) {}
+  }
+
+  function muteAllMedia() {
+    var els = document.querySelectorAll("audio, video");
+    for (var i = 0; i < els.length; i++) {
+      muteMediaElement(els[i]);
+    }
+  }
+
+  // Initial sweep (may be empty at document-start; the observer
+  // and play-patch handle late arrivals).
+  muteAllMedia();
+
+  // Observe DOM for dynamically added media elements.
+  try {
+    var mediaObserver = new MutationObserver(function (mutations) {
+      for (var i = 0; i < mutations.length; i++) {
+        var added = mutations[i].addedNodes;
+        for (var j = 0; j < added.length; j++) {
+          var node = added[j];
+          if (node.nodeType !== 1) continue;
+          if (node.tagName === "AUDIO" || node.tagName === "VIDEO") {
+            muteMediaElement(node);
+          }
+          // Also check children (e.g. a div containing a <video>).
+          if (node.querySelectorAll) {
+            var inner = node.querySelectorAll("audio, video");
+            for (var k = 0; k < inner.length; k++) {
+              muteMediaElement(inner[k]);
+            }
+          }
+        }
+      }
+    });
+    mediaObserver.observe(document.documentElement || document.body || document, {
+      childList: true,
+      subtree: true,
+    });
+  } catch (e) {
+    console.warn("[openhuman-audio-bridge] media mute observer failed:", e);
+  }
+
+  // Monkey-patch play() to ensure mute sticks even for elements created
+  // outside the DOM (Meet sometimes uses detached <audio> for WebRTC).
+  try {
+    var origPlay = HTMLMediaElement.prototype.play;
+    HTMLMediaElement.prototype.play = function () {
+      muteMediaElement(this);
+      return origPlay.apply(this, arguments);
+    };
+  } catch (e) {
+    console.warn("[openhuman-audio-bridge] play() patch failed:", e);
+  }
+
+  // WebRTC-level muting: Meet routes incoming participant audio via
+  // RTCPeerConnection.ontrack, NOT through <audio> elements. The DOM
+  // patches above miss this entirely. We intercept at two layers:
+  //
+  //   1. RTCPeerConnection.prototype.addTrack — no-op (we don't need
+  //      to touch outbound, only inbound).
+  //   2. Incoming remote audio tracks — disable them so the browser
+  //      never sends their samples to the speaker.
+  //   3. AudioContext.createMediaStreamSource — return a silent
+  //      (disconnected) source so any Web Audio routing of remote
+  //      streams produces no output.
+  //
+  // Our bridge's TTS path is unaffected because it uses
+  // AudioBufferSource → dest (MediaStreamDestination) + ctx.destination,
+  // never an RTCPeerConnection or createMediaStreamSource.
+  try {
+    var origRTCPeerConnection = window.RTCPeerConnection;
+    if (origRTCPeerConnection) {
+      // Intercept the ontrack setter to disable incoming audio tracks.
+      var origAddEventListener = origRTCPeerConnection.prototype.addEventListener;
+      origRTCPeerConnection.prototype.addEventListener = function (type, listener, options) {
+        if (type === "track") {
+          var wrappedListener = function (event) {
+            if (event.track && event.track.kind === "audio") {
+              event.track.enabled = false;
+              console.log("[openhuman-audio-bridge] disabled incoming WebRTC audio track");
+            }
+            return listener.call(this, event);
+          };
+          return origAddEventListener.call(this, type, wrappedListener, options);
+        }
+        return origAddEventListener.call(this, type, listener, options);
+      };
+
+      // Also intercept the ontrack property setter.
+      var ontrackDesc = Object.getOwnPropertyDescriptor(origRTCPeerConnection.prototype, "ontrack");
+      if (ontrackDesc && ontrackDesc.set) {
+        var origOntrackSet = ontrackDesc.set;
+        Object.defineProperty(origRTCPeerConnection.prototype, "ontrack", {
+          get: ontrackDesc.get,
+          set: function (handler) {
+            var wrapped = function (event) {
+              if (event.track && event.track.kind === "audio") {
+                event.track.enabled = false;
+                console.log("[openhuman-audio-bridge] disabled incoming WebRTC audio track (ontrack)");
+              }
+              return handler.call(this, event);
+            };
+            origOntrackSet.call(this, wrapped);
+          },
+          configurable: true,
+        });
+      }
+    }
+  } catch (e) {
+    console.warn("[openhuman-audio-bridge] RTCPeerConnection patch failed:", e);
+  }
+
+  // Intercept AudioContext.createMediaStreamSource so remote streams
+  // routed through Web Audio produce silence instead of speaker output.
+  try {
+    var origCreateMSS = AudioContext.prototype.createMediaStreamSource;
+    AudioContext.prototype.createMediaStreamSource = function (stream) {
+      var node = origCreateMSS.call(this, stream);
+      // Check if this is a remote stream (not our bridge's dest stream).
+      // Our bridge uses dest.stream which has a known track; anything
+      // else is remote audio we want to silence.
+      if (dest && stream === dest.stream) {
+        return node; // our bridge — pass through
+      }
+      // Remote stream — create a gain node set to 0 and interpose it
+      // so nothing reaches the destination.
+      var silencer = this.createGain();
+      silencer.gain.value = 0;
+      node.connect(silencer);
+      console.log("[openhuman-audio-bridge] silenced createMediaStreamSource (remote stream)");
+      return silencer;
+    };
+  } catch (e) {
+    console.warn("[openhuman-audio-bridge] createMediaStreamSource patch failed:", e);
+  }
+
+  console.log("[openhuman-audio-bridge] install complete (local audio + WebRTC muted)");
 })();
diff --git a/app/src-tauri/src/meet_audio/caption_listener.rs b/app/src-tauri/src/meet_audio/caption_listener.rs
index 637c4ee7bc..89d0660676 100644
--- a/app/src-tauri/src/meet_audio/caption_listener.rs
+++ b/app/src-tauri/src/meet_audio/caption_listener.rs
@@ -32,6 +32,10 @@ const POLL_INTERVAL: Duration = Duration::from_millis(500);
 /// away (call ended) or the renderer crashed.
 const MAX_CONSECUTIVE_ERRORS: u32 = 30;
 
+/// How often (in ticks) to log a diagnostic heartbeat when drains are
+/// empty. 60 ticks × 500 ms = every 30 s.
+const DIAG_HEARTBEAT_TICKS: u64 = 60;
+
 /// RAII handle. Drop to stop the listener task.
 pub struct CaptionListener {
     pub request_id: String,
@@ -58,6 +62,11 @@ pub fn start(request_id: String, cdp: CdpConn, session_id: String) -> CaptionLis
         tick.tick().await;
         let mut cdp = cdp;
         let mut errors: u32 = 0;
+        let mut tick_count: u64 = 0;
+        let mut total_captions: u64 = 0;
+
+        log::info!("[meet-audio] caption listener started request_id={request_id_for_task}");
+
         loop {
             tokio::select! {
                 _ = &mut shutdown_rx => {
@@ -67,8 +76,12 @@ pub fn start(request_id: String, cdp: CdpConn, session_id: String) -> CaptionLis
                     break;
                 }
                 _ = tick.tick() => {
+                    tick_count += 1;
                     match drain_and_forward(&request_id_for_task, &mut cdp, &session_id).await {
-                        Ok(_) => errors = 0,
+                        Ok(count) => {
+                            errors = 0;
+                            total_captions += count;
+                        },
                         Err(err) => {
                             errors += 1;
                             log::debug!(
@@ -82,6 +95,17 @@ pub fn start(request_id: String, cdp: CdpConn, session_id: String) -> CaptionLis
                             }
                         }
                     }
+
+                    // Periodic diagnostic heartbeat so silent caption
+                    // listeners are visible in the logs.
+                    if tick_count % DIAG_HEARTBEAT_TICKS == 0 {
+                        let bridge_info = probe_bridge_info(&mut cdp, &session_id).await;
+                        log::info!(
+                            "[meet-audio] caption listener heartbeat request_id={request_id_for_task} \
+                             ticks={tick_count} total_captions={total_captions} \
+                             consec_errors={errors} bridge={bridge_info}"
+                        );
+                    }
                 }
             }
         }
@@ -93,19 +117,18 @@ pub fn start(request_id: String, cdp: CdpConn, session_id: String) -> CaptionLis
     }
 }
 
+/// Returns the number of captions forwarded to core.
 async fn drain_and_forward(
     request_id: &str,
     cdp: &mut CdpConn,
     session_id: &str,
-) -> Result<(), String> {
+) -> Result<u64, String> {
     let captions = inject::drain_captions(cdp, session_id).await?;
     if captions.is_empty() {
-        return Ok(());
+        return Ok(0);
     }
-    log::info!(
-        "[meet-audio] captions drained count={} request_id={request_id}",
-        captions.len()
-    );
+    let count = captions.len() as u64;
+    log::info!("[meet-audio] captions drained count={count} request_id={request_id}",);
     for (speaker, text, ts_ms) in captions {
         // Propagate the failure so MAX_CONSECUTIVE_ERRORS can trip if
         // core's session/RPC path is broken — without this the
@@ -123,5 +146,31 @@ async fn drain_and_forward(
         .await
         .map_err(|err| format!("push_caption (request_id={request_id}): {err}"))?;
     }
-    Ok(())
+    Ok(count)
+}
+
+/// Query the page-side captions bridge for diagnostic info. Never
+/// fails — returns a human-readable string for the heartbeat log.
+async fn probe_bridge_info(cdp: &mut CdpConn, session_id: &str) -> String {
+    let res = cdp
+        .call(
+            "Runtime.evaluate",
+            serde_json::json!({
+                "expression": "(typeof window.__openhumanCaptionsBridgeInfo === 'function') \
+                               ? JSON.stringify(window.__openhumanCaptionsBridgeInfo()) \
+                               : '{\"installed\":false}'",
+                "returnByValue": true,
+            }),
+            Some(session_id),
+        )
+        .await;
+    match res {
+        Ok(v) => v
+            .get("result")
+            .and_then(|r| r.get("value"))
+            .and_then(|v| v.as_str())
+            .unwrap_or("{\"error\":\"no value\"}")
+            .to_string(),
+        Err(err) => format!("{{\"error\":\"{err}\"}}"),
+    }
 }
diff --git a/app/src-tauri/src/meet_audio/captions_bridge.js b/app/src-tauri/src/meet_audio/captions_bridge.js
index cf79bd45e3..4ddb8e7c6c 100644
--- a/app/src-tauri/src/meet_audio/captions_bridge.js
+++ b/app/src-tauri/src/meet_audio/captions_bridge.js
@@ -38,22 +38,34 @@
   window.__openhumanCaptionsBridgeInstalled = true;
 
   var queue = [];
-  // Per-speaker last-text fingerprint so a caption that grows in place
-  // (Meet appends text mid-utterance) doesn't get queued multiple
-  // times. We emit the *latest* text for each speaker only when it
-  // changes; downstream wake-word logic dedupes on its own buffer.
+  // Set of ALL caption texts we've already queued, keyed by
+  // "speaker\t<normalized_text>". Meet keeps multiple caption rows
+  // visible per speaker (a running transcript), and a single-slot
+  // lastBySpeaker would flip-flop between rows on successive polls,
+  // re-emitting old rows as "new". A seen-set prevents any text
+  // (or prefix-growth of that text) from being emitted twice.
+  var seenTexts = {};
+  // Per-speaker last-text for delta extraction: when a caption row
+  // grows in place ("Hey openhuman" → "Hey openhuman what time"),
+  // we only emit the new tail, not the full text containing the
+  // already-processed wake phrase.
   var lastBySpeaker = {};
 
   function findCaptionsRegion() {
     // Meet's captions region carries a stable accessibility label
-    // even as class names churn between rollouts. Try the canonical
-    // English first, then fall back to a fuzzy match for localized
-    // builds ("Subtitles", "Sous-titres", etc.) that still embed
-    // "captions" / "caption" in the aria-label.
+    // even as class names churn between rollouts. Try several
+    // strategies — Meet keeps changing the exact DOM shape.
     return (
+      // Canonical English aria-label
       document.querySelector('[aria-label="Captions"]') ||
-      document.querySelector('div[role="region"][aria-label*="aption"]') ||
+      // Fuzzy match for localized builds
       document.querySelector('div[role="region"][aria-label*="aption" i]') ||
+      // Meet 2024+: the captions container sometimes uses role="log"
+      // with an aria-label containing "caption" or "subtitle"
+      document.querySelector('[role="log"][aria-label*="aption" i]') ||
+      document.querySelector('[role="log"][aria-label*="ubtitle" i]') ||
+      // Last resort: any element whose aria-label contains "caption"
+      document.querySelector('[aria-label*="aption" i][aria-live]') ||
       null
     );
   }
@@ -65,16 +77,25 @@
     // Each caption line is typically a flex row with the speaker name
     // at the top and the live transcript below. We don't depend on
     // exact class names; instead we walk direct children and treat
-    // each as one caption "row".
+    // each as one caption "row". Meet sometimes nests rows inside an
+    // intermediate wrapper div, so also look one level deeper.
     var rows = region.querySelectorAll(
-      ':scope > div, :scope > section, :scope > [role="listitem"]'
+      ':scope > div, :scope > section, :scope > [role="listitem"], ' +
+      ':scope > div > div, :scope > [role="list"] > [role="listitem"]'
     );
     if (!rows.length) {
       // Fall back to a single-block region: one big innerText blob.
       var blob = (region.innerText || "").trim();
-      if (blob && blob !== lastBySpeaker.__blob__) {
-        queue.push({ speaker: "", text: blob, ts: Date.now() });
+      var prevBlob = lastBySpeaker.__blob__ || "";
+      if (blob && blob !== prevBlob) {
+        var blobDelta = blob;
+        if (prevBlob && blob.indexOf(prevBlob) === 0) {
+          blobDelta = blob.slice(prevBlob.length).trim();
+        }
         lastBySpeaker.__blob__ = blob;
+        if (blobDelta) {
+          queue.push({ speaker: "", text: blobDelta, ts: Date.now() });
+        }
       }
       return;
     }
@@ -108,9 +129,21 @@
       if (!bestText) return;
 
       var key = speakerGuess || "_unknown";
-      if (lastBySpeaker[key] === bestText) return;
+      // Fingerprint: lowercase so "Hey Openhuman" and "hey openhuman"
+      // don't slip through as distinct entries.
+      var fp = key + "\t" + bestText.toLowerCase();
+      if (seenTexts[fp]) return;
+      seenTexts[fp] = true;
+      // Delta extraction: if this row is a prefix-growth of the last
+      // text we saw for this speaker, only emit the new tail.
+      var prev = lastBySpeaker[key] || "";
       lastBySpeaker[key] = bestText;
-      queue.push({ speaker: speakerGuess, text: bestText, ts: Date.now() });
+      var textToEmit = bestText;
+      if (prev && bestText.indexOf(prev) === 0) {
+        textToEmit = bestText.slice(prev.length).trim();
+      }
+      if (!textToEmit) return;
+      queue.push({ speaker: speakerGuess, text: textToEmit, ts: Date.now() });
     });
   }
 
@@ -138,32 +171,104 @@
     return true;
   }
 
-  // Auto-enable captions: walk every button on the page and click any
-  // that has an aria-label starting with "Turn on captions". Caps the
-  // attempts so we don't fight a user who deliberately disables CC.
-  var ENABLE_ATTEMPT_BUDGET = 30; // ~30 * 2s = 60s
+  // Auto-enable captions. Strategy:
+  //
+  //   1. Try clicking a button whose aria-label matches known patterns
+  //      (covers older Meet builds + localized labels).
+  //   2. If no button found after a few tries, fall back to dispatching
+  //      the keyboard shortcut "c" which toggles captions in Meet
+  //      regardless of UI changes.
+  //   3. Once the captions region appears, stop trying.
+  //
+  // Caps attempts so a user who deliberately disables CC isn't fought
+  // over forever.
+  var ENABLE_ATTEMPT_BUDGET = 60; // ~60 * 2s = 120s — covers slow admit
   var enableAttempts = 0;
+  // After this many failed button-click attempts, switch to keyboard shortcut.
+  var KEYBOARD_FALLBACK_AFTER = 8;
+  var captionsEnabledConfirmed = false;
+
   function tryEnableCaptions() {
-    if (enableAttempts >= ENABLE_ATTEMPT_BUDGET) return;
+    if (captionsEnabledConfirmed || enableAttempts >= ENABLE_ATTEMPT_BUDGET) return;
     enableAttempts++;
-    var buttons = document.querySelectorAll("button[aria-label]");
-    for (var i = 0; i < buttons.length; i++) {
-      var lbl = (buttons[i].getAttribute("aria-label") || "").toLowerCase();
-      // Match "Turn on captions" but NOT "Turn off captions".
-      if (lbl.indexOf("turn on captions") === 0 || /^turn on captions/.test(lbl)) {
-        try {
-          buttons[i].click();
-          enableAttempts = ENABLE_ATTEMPT_BUDGET; // success — stop trying.
+
+    // If the captions region already exists, we're done.
+    if (findCaptionsRegion()) {
+      captionsEnabledConfirmed = true;
+      enableAttempts = ENABLE_ATTEMPT_BUDGET;
+      return true;
+    }
+
+    // Strategy 1: button click (works on older Meet builds)
+    if (enableAttempts <= KEYBOARD_FALLBACK_AFTER) {
+      var buttons = document.querySelectorAll("button[aria-label]");
+      var ON_PATTERNS = [
+        "turn on captions",
+        "turn on live captions",
+        "turn on subtitles",
+        "turn on closed captions",
+        "captions on",
+        "captions (c)",
+        "show captions",
+        "enable captions",
+      ];
+      var OFF_PATTERNS = [
+        "turn off captions",
+        "turn off live captions",
+        "turn off subtitles",
+        "captions off",
+        "disable captions",
+        "hide captions",
+        "hide subtitles",
+      ];
+      for (var i = 0; i < buttons.length; i++) {
+        var lbl = (buttons[i].getAttribute("aria-label") || "").toLowerCase();
+        if (OFF_PATTERNS.some(function (p) { return lbl.indexOf(p) >= 0; })) continue;
+        var pressed = buttons[i].getAttribute("aria-pressed");
+        if (pressed === "true") {
+          captionsEnabledConfirmed = true;
+          enableAttempts = ENABLE_ATTEMPT_BUDGET;
           return true;
+        }
+        if (ON_PATTERNS.some(function (p) { return lbl.indexOf(p) >= 0; })) {
+          try { buttons[i].click(); captionsEnabledConfirmed = true; enableAttempts = ENABLE_ATTEMPT_BUDGET; return true; } catch (_) {}
+        }
+        // Bare label fallback
+        if ((lbl === "captions" || lbl === "subtitles" || lbl === "cc") && pressed !== "true") {
+          try { buttons[i].click(); captionsEnabledConfirmed = true; enableAttempts = ENABLE_ATTEMPT_BUDGET; return true; } catch (_) {}
+        }
+      }
+    }
+
+    // Strategy 2: keyboard shortcut "c" — Meet toggles captions on
+    // key press regardless of button labels. We also try "j" (some
+    // locales bind subtitles to "j"). We must check the region isn't
+    // already visible first to avoid toggling OFF. Only fire the
+    // shortcut every other attempt to give the DOM time to react.
+    if (enableAttempts > KEYBOARD_FALLBACK_AFTER && enableAttempts % 2 === 0) {
+      if (!findCaptionsRegion()) {
+        try {
+          // Dispatch a real "c" keypress to the document body so Meet
+          // picks it up as its keyboard shortcut.
+          var keyOpts = { key: "c", code: "KeyC", keyCode: 67, which: 67, bubbles: true };
+          document.body.dispatchEvent(new KeyboardEvent("keydown", keyOpts));
+          document.body.dispatchEvent(new KeyboardEvent("keyup", keyOpts));
         } catch (_) {}
       }
     }
+
     return false;
   }
 
   setInterval(function () {
     attachObserver();
     pollOnce();
+    trimSeenTexts();
+    // Quick check: confirm captions region appeared after a shortcut press
+    if (!captionsEnabledConfirmed && findCaptionsRegion()) {
+      captionsEnabledConfirmed = true;
+      enableAttempts = ENABLE_ATTEMPT_BUDGET;
+    }
   }, 250);
   setInterval(tryEnableCaptions, 2000);
 
@@ -174,13 +279,49 @@
     return out;
   };
 
+  // Cap the seen-set so a multi-hour call doesn't leak memory.
+  // 500 entries ≈ a very active 30-minute meeting; beyond that,
+  // ancient captions have scrolled off Meet's visible region anyway.
+  var MAX_SEEN = 500;
+  function trimSeenTexts() {
+    var keys = Object.keys(seenTexts);
+    if (keys.length > MAX_SEEN) {
+      // Drop the oldest half (insertion-order is preserved in V8).
+      var toDrop = keys.slice(0, Math.floor(keys.length / 2));
+      for (var i = 0; i < toDrop.length; i++) {
+        delete seenTexts[toDrop[i]];
+      }
+    }
+  }
+
   window.__openhumanCaptionsBridgeInfo = function () {
+    var region = findCaptionsRegion();
+    // Scan for caption-related buttons to help diagnose enable failures.
+    var captionButtons = [];
+    try {
+      var buttons = document.querySelectorAll("button[aria-label]");
+      for (var i = 0; i < buttons.length; i++) {
+        var lbl = (buttons[i].getAttribute("aria-label") || "").toLowerCase();
+        if (lbl.indexOf("caption") >= 0 || lbl.indexOf("subtitle") >= 0 || lbl === "cc") {
+          captionButtons.push({
+            label: lbl,
+            pressed: buttons[i].getAttribute("aria-pressed"),
+          });
+        }
+      }
+    } catch (_) {}
     return {
       installed: true,
-      region_found: !!findCaptionsRegion(),
+      region_found: !!region,
+      region_tag: region ? region.tagName : null,
+      region_aria: region ? region.getAttribute("aria-label") : null,
+      region_children: region ? region.children.length : 0,
       queue_depth: queue.length,
       tracked_speakers: Object.keys(lastBySpeaker).length,
+      seen_texts: Object.keys(seenTexts).length,
       enable_attempts: enableAttempts,
+      enable_budget: ENABLE_ATTEMPT_BUDGET,
+      caption_buttons: captionButtons,
     };
   };
 })();
diff --git a/app/src-tauri/src/meet_audio/inject.rs b/app/src-tauri/src/meet_audio/inject.rs
index 312f5297b1..1891c4dcd6 100644
--- a/app/src-tauri/src/meet_audio/inject.rs
+++ b/app/src-tauri/src/meet_audio/inject.rs
@@ -274,3 +274,31 @@ pub async fn feed_pcm_chunk(cdp: &mut CdpConn, session: &str, pcm_b64: &str) ->
     }
     Ok(())
 }
+
+/// Stop any in-flight audio playback inside the page bridge and reset
+/// its schedule cursor. Called when the brain cancels outbound (user
+/// re-asks during a long reply) so the previous reply's tail doesn't
+/// keep playing while the new turn is dispatched. Returns the count
+/// of sources that were stopped, useful for diagnostic logging.
+pub async fn flush_audio_bridge(cdp: &mut CdpConn, session: &str) -> Result<i64, String> {
+    let res = cdp
+        .call(
+            "Runtime.evaluate",
+            json!({
+                "expression": "(typeof window.__openhumanFlushAudio === 'function') ? window.__openhumanFlushAudio() : -1",
+                "returnByValue": true,
+            }),
+            Some(session),
+        )
+        .await
+        .map_err(|e| format!("Runtime.evaluate flush: {e}"))?;
+    if let Some(exception) = res.get("exceptionDetails") {
+        return Err(format!("page exception: {exception}"));
+    }
+    let stopped = res
+        .get("result")
+        .and_then(|r| r.get("value"))
+        .and_then(|v| v.as_i64())
+        .unwrap_or(0);
+    Ok(stopped)
+}
diff --git a/app/src-tauri/src/meet_audio/mod.rs b/app/src-tauri/src/meet_audio/mod.rs
index 789dcce401..d89314159d 100644
--- a/app/src-tauri/src/meet_audio/mod.rs
+++ b/app/src-tauri/src/meet_audio/mod.rs
@@ -87,10 +87,15 @@ pub async fn start<R: Runtime>(
     app: AppHandle<R>,
     request_id: String,
     meet_url: String,
+    owner_display_name: String,
+    bot_display_name: String,
 ) -> Result<(), String> {
     log::info!(
-        "[meet-audio] start request_id={request_id} url_prefix={}",
-        truncate_for_log(&meet_url, 64)
+        "[meet-audio] start request_id={request_id} url_prefix={} \
+         owner_chars={} bot_chars={}",
+        truncate_for_log(&meet_url, 64),
+        owner_display_name.chars().count(),
+        bot_display_name.chars().count()
     );
 
     if let Some(state) = app.try_state::<MeetAudioState>() {
@@ -104,12 +109,22 @@ pub async fn start<R: Runtime>(
     }
 
     // Tell core to open its session first so the very first PCM push
-    // doesn't race the start RPC.
+    // doesn't race the start RPC. Hand the call owner + bot display
+    // names through with the request so the core wake-word gate
+    // (privacy lock: only the owner can trigger tool calls) is
+    // active before the first caption can arrive.
     rpc_call(
         "openhuman.meet_agent_start_session",
         serde_json::json!({
             "request_id": request_id,
             "sample_rate_hz": 16_000,
+            "owner_display_name": owner_display_name,
+            "bot_display_name": bot_display_name,
+            // Persisted into the recent-calls JSONL by stop_session
+            // so the Skills "Meeting Bots" card can show "joined
+            // <code>" in the history list. The URL the shell built
+            // the CEF window with is the canonical value.
+            "meet_url": meet_url,
         }),
     )
     .await?;
@@ -170,7 +185,7 @@ pub async fn start<R: Runtime>(
                     caption_listener_disabled(request_id.clone())
                 }
             };
-            let speak = speak_pump::start(request_id.clone(), cdp, session);
+            let speak = speak_pump::start(app.clone(), request_id.clone(), cdp, session);
             (speak, captions)
         }
         Err(err) => {
diff --git a/app/src-tauri/src/meet_audio/speak_pump.rs b/app/src-tauri/src/meet_audio/speak_pump.rs
index 1fab93f869..4b83a15ce1 100644
--- a/app/src-tauri/src/meet_audio/speak_pump.rs
+++ b/app/src-tauri/src/meet_audio/speak_pump.rs
@@ -7,9 +7,10 @@
 //! the call so each tick is a single `Runtime.evaluate` round-trip
 //! rather than fresh attach + detach.
 
-use std::time::Duration;
+use std::time::{Duration, Instant};
 
 use base64::{engine::general_purpose::STANDARD as B64, Engine as _};
+use tauri::{AppHandle, Emitter, Runtime};
 use tokio::sync::oneshot;
 use tokio::time::interval;
 
@@ -29,6 +30,21 @@ const POLL_INTERVAL: Duration = Duration::from_millis(100);
 /// either way.
 const MAX_CONSECUTIVE_FEED_ERRORS: u32 = 30;
 
+/// How long the speaking-state event keeps reporting `speaking=true`
+/// after the last non-empty PCM tick. Brain enqueues outbound in
+/// chunks of ~50–200 ms and there's a gap of one or two pump ticks
+/// (100 ms each) between chunks while the next batch is being
+/// synthesised. Without a hangover, the mascot's mouth would flicker
+/// shut every gap. 400 ms covers the typical inter-chunk silence
+/// without bridging across legitimate end-of-utterance pauses.
+const SPEAKING_HANGOVER: Duration = Duration::from_millis(400);
+
+/// Tauri event channel for "the bot is/isn't speaking right now".
+/// Consumed by `MascotFrameProducer` (frontend) to flip the mascot
+/// SVG between idle and a mouth-open / talking pose so the Meet
+/// participant sees a visual cue that matches the audio they hear.
+const SPEAKING_STATE_EVENT: &str = "meet-video:speaking-state";
+
 /// RAII handle. Drop to stop the pump task. The shutdown channel
 /// causes the spawned loop to exit on the next select tick.
 pub struct SpeakPump {
@@ -45,8 +61,15 @@ impl Drop for SpeakPump {
 /// Spawn the speak pump for a session that already has the audio
 /// bridge installed. `cdp` and `session_id` come from
 /// [`inject::install_audio_bridge`] and are owned by the pump task
-/// from this point on.
-pub fn start(request_id: String, cdp: CdpConn, session_id: String) -> SpeakPump {
+/// from this point on. `app` is held so the pump can fire
+/// `meet-video:speaking-state` events when the bot starts / stops
+/// producing PCM (drives the in-Meet mascot's mouth animation).
+pub fn start<R: Runtime>(
+    app: AppHandle<R>,
+    request_id: String,
+    cdp: CdpConn,
+    session_id: String,
+) -> SpeakPump {
     let (shutdown_tx, mut shutdown_rx) = oneshot::channel::<()>();
     let request_id_for_task = request_id.clone();
     tauri::async_runtime::spawn(async move {
@@ -56,17 +79,30 @@ pub fn start(request_id: String, cdp: CdpConn, session_id: String) -> SpeakPump
         tick.tick().await;
         let mut cdp = cdp;
         let mut feed_errors: u32 = 0;
+        // Edge-detect state for the speaking-state event. We emit on
+        // every flip and never on every tick — the frontend renderer
+        // would otherwise see a flood of redundant state updates and
+        // burn worker time on no-op rerenders.
+        let mut speaking_state = SpeakingTracker::new();
         loop {
             tokio::select! {
                 _ = &mut shutdown_rx => {
                     log::info!(
                         "[meet-audio] speak pump shutdown request_id={request_id_for_task}"
                     );
+                    // Make sure the mascot stops talking when the
+                    // session ends — without this the last "speaking"
+                    // edge would leave the mouth open for the next
+                    // call's first frame.
+                    speaking_state.force_off(&app, &request_id_for_task);
                     break;
                 }
                 _ = tick.tick() => {
-                    match poll_and_feed(&request_id_for_task, &mut cdp, &session_id).await {
-                        Ok(_) => feed_errors = 0,
+                    let had_pcm = match poll_and_feed(&request_id_for_task, &mut cdp, &session_id).await {
+                        Ok(had) => {
+                            feed_errors = 0;
+                            had
+                        }
                         Err(err) => {
                             feed_errors += 1;
                             log::debug!(
@@ -76,10 +112,17 @@ pub fn start(request_id: String, cdp: CdpConn, session_id: String) -> SpeakPump
                                 log::warn!(
                                     "[meet-audio] speak pump giving up after {feed_errors} consecutive errors request_id={request_id_for_task}"
                                 );
+                                speaking_state.force_off(&app, &request_id_for_task);
                                 break;
                             }
+                            // A failed tick is *not* evidence the bot
+                            // stopped speaking — leave the hangover to
+                            // expire naturally so transient CDP errors
+                            // don't flicker the mascot's mouth shut.
+                            false
                         }
-                    }
+                    };
+                    speaking_state.tick(had_pcm, &app, &request_id_for_task);
                 }
             }
         }
@@ -91,6 +134,86 @@ pub fn start(request_id: String, cdp: CdpConn, session_id: String) -> SpeakPump
     }
 }
 
+/// Edge-detector + hangover for the speaking-state event stream.
+/// State machine has two reachable values (`speaking` / `idle`) and
+/// flips between them only when the underlying signal sustains long
+/// enough to clear the hangover, so the frontend never sees a flap
+/// during the natural gap between two PCM chunks.
+struct SpeakingTracker {
+    /// Currently-reported state. Defaults to `false` so the mascot
+    /// boots into the idle pose; the first `speaking=true` tick is a
+    /// real edge.
+    reported: bool,
+    /// Wall-clock the hangover expires. Set to `now + SPEAKING_HANGOVER`
+    /// every tick that carries PCM; the state flips back to `false`
+    /// only once `now > hangover_until` AND a tick with no PCM lands.
+    hangover_until: Option<Instant>,
+}
+
+impl SpeakingTracker {
+    fn new() -> Self {
+        Self {
+            reported: false,
+            hangover_until: None,
+        }
+    }
+
+    /// Drive the state machine from a single pump tick. `had_pcm`
+    /// is whether `poll_and_feed` saw a non-empty `pcm_base64` for
+    /// this tick. Emits the Tauri event only when the reported
+    /// state actually flips.
+    fn tick<R: Runtime>(&mut self, had_pcm: bool, app: &AppHandle<R>, request_id: &str) {
+        if had_pcm {
+            // Extend the hangover. If we were idle, flip up to
+            // speaking — the user hears audio starting now.
+            self.hangover_until = Some(Instant::now() + SPEAKING_HANGOVER);
+            self.set_reported(true, app, request_id);
+            return;
+        }
+        // No PCM this tick. If the hangover hasn't expired, stay in
+        // whatever state we were already in (typically `speaking=true`
+        // during the gap between two consecutive chunks).
+        if let Some(until) = self.hangover_until {
+            if Instant::now() < until {
+                return;
+            }
+            // Hangover elapsed; clear so we don't re-evaluate on
+            // every future idle tick.
+            self.hangover_until = None;
+        }
+        // Hangover expired or never armed → bot is genuinely idle.
+        self.set_reported(false, app, request_id);
+    }
+
+    /// Force the reported state to `false` and emit an event if that's
+    /// a flip. Used on shutdown / fatal error paths so the mascot
+    /// can't get stuck mid-talk.
+    fn force_off<R: Runtime>(&mut self, app: &AppHandle<R>, request_id: &str) {
+        self.hangover_until = None;
+        self.set_reported(false, app, request_id);
+    }
+
+    fn set_reported<R: Runtime>(&mut self, next: bool, app: &AppHandle<R>, request_id: &str) {
+        if self.reported == next {
+            return;
+        }
+        self.reported = next;
+        let payload = serde_json::json!({
+            "requestId": request_id,
+            "speaking": next,
+        });
+        if let Err(err) = app.emit(SPEAKING_STATE_EVENT, payload) {
+            // Best-effort: a missing renderer (closed window mid-tick)
+            // is the common case and not worth raising the log level.
+            log::debug!(
+                "[meet-audio] speaking-state emit failed request_id={request_id} speaking={next} err={err}"
+            );
+        } else {
+            log::debug!("[meet-audio] speaking-state -> {next} request_id={request_id}");
+        }
+    }
+}
+
 /// No-op pump used when bridge install failed at session start. Keeps
 /// the rest of the session lifecycle uniform — `MeetAudioSession` can
 /// still hold a `SpeakPump` regardless of speak-path readiness.
@@ -101,11 +224,14 @@ pub fn start_disabled(request_id: String) -> SpeakPump {
     }
 }
 
+/// Run a single pump tick. Returns `true` when the tick actually
+/// carried synthesized PCM (used by the caller to drive the
+/// speaking-state edge detector).
 async fn poll_and_feed(
     request_id: &str,
     cdp: &mut CdpConn,
     session_id: &str,
-) -> Result<(), String> {
+) -> Result<bool, String> {
     let v = super::rpc_call(
         "openhuman.meet_agent_poll_speech",
         serde_json::json!({ "request_id": request_id }),
@@ -119,6 +245,27 @@ async fn poll_and_feed(
         .get("utterance_done")
         .and_then(|x| x.as_bool())
         .unwrap_or(false);
+    let flush_pending = v
+        .get("flush_pending")
+        .and_then(|x| x.as_bool())
+        .unwrap_or(false);
+
+    // Barge-in: brain set flush_pending when it cancelled the previous
+    // outbound. Stop in-flight playback inside the JS bridge BEFORE we
+    // feed the next chunk so the user hears the new reply instead of
+    // the tail of the old one. Best-effort — if the page is gone the
+    // flush errors and we drop through to the feed, which will fail
+    // the same way and trigger the same recovery path.
+    if flush_pending {
+        match inject::flush_audio_bridge(cdp, session_id).await {
+            Ok(stopped) => log::info!(
+                "[meet-audio] barge-in flush request_id={request_id} sources_stopped={stopped}"
+            ),
+            Err(e) => {
+                log::warn!("[meet-audio] barge-in flush failed request_id={request_id} err={e}")
+            }
+        }
+    }
 
     if !pcm_b64.is_empty() {
         // Validate decode locally before pushing — saves a round-trip
@@ -131,8 +278,10 @@ async fn poll_and_feed(
             bytes.len()
         );
         inject::feed_pcm_chunk(cdp, session_id, pcm_b64).await?;
-    } else if utterance_done {
+        return Ok(true);
+    }
+    if utterance_done {
         log::info!("[meet-audio] speak pump utterance complete request_id={request_id}");
     }
-    Ok(())
+    Ok(false)
 }
diff --git a/app/src-tauri/src/meet_call/mod.rs b/app/src-tauri/src/meet_call/mod.rs
index b075405b2c..01b72f5ea4 100644
--- a/app/src-tauri/src/meet_call/mod.rs
+++ b/app/src-tauri/src/meet_call/mod.rs
@@ -81,7 +81,18 @@ impl Default for MeetCallState {
 pub struct OpenWindowArgs {
     pub request_id: String,
     pub meet_url: String,
+    /// Bot's Meet participant tile name — what the bot types into
+    /// Meet's "Your name" input. Also passed to the core wake gate
+    /// so the bot's own captioned TTS is filtered out as self-echo.
     pub display_name: String,
+    /// Call owner's Meet participant name — the human who launched
+    /// the bot. The core wake-word gate (privacy lock: only the
+    /// owner can trigger tool calls) compares speaker captions
+    /// against this value. Defaulted to empty so callers staged
+    /// during the rollout window keep parsing; an empty owner
+    /// fails closed in core (no wakes fire).
+    #[serde(default)]
+    pub owner_display_name: String,
 }
 
 /// Open a dedicated top-level CEF webview window pointed at the Meet URL.
@@ -113,6 +124,25 @@ pub async fn meet_call_open_window<R: Runtime>(
         return Ok(label);
     }
 
+    // Only one meet-call window can be live at a time — concurrent bot
+    // sessions race the CEF audio handler registration (`listen_capture`)
+    // and confuse the user with multiple "Meet — OpenHuman" windows in
+    // their Dock. Close any stragglers from a prior Join before opening
+    // a fresh one. The CloseRequested handler will tear down their
+    // scanner + audio session via the per-window event listeners below.
+    let stale_labels: Vec<String> = app
+        .webview_windows()
+        .keys()
+        .filter(|l| l.starts_with("meet-call-"))
+        .cloned()
+        .collect();
+    for stale in stale_labels {
+        if let Some(window) = app.get_webview_window(&stale) {
+            log::info!("[meet-call] closing stale window label={stale} before new join");
+            let _ = window.close();
+        }
+    }
+
     let data_dir = data_directory_for(&app, &request_id)?;
     if let Err(err) = std::fs::create_dir_all(&data_dir) {
         log::warn!(
@@ -162,6 +192,29 @@ pub async fn meet_call_open_window<R: Runtime>(
         .build()
         .map_err(|e| format!("[meet-call] WebviewWindowBuilder.build failed: {e}"))?;
 
+    // Push the window off-screen post-build. macOS Cocoa clamps NSWindow
+    // frame origins to the union of all attached monitors' bounds, so
+    // (-30000, -30000) lands at (0, 0) on a single-display setup or on
+    // a secondary monitor's edge on multi-display setups. Not perfect,
+    // but the post-join hide() in `meet_scanner::run` is the primary
+    // hiding mechanism — this just keeps the brief pre-join window
+    // out of the user's main display where possible.
+    //
+    // We can't hide() here: a window built hidden never gives its
+    // renderer a backing surface, and `meet_scanner` drives the join
+    // via CDP `Input.dispatchMouseEvent` which requires laid-out DOM.
+    // Hide post-join instead.
+    if let Err(err) = window.set_position(tauri::PhysicalPosition::new(-30000i32, -30000i32)) {
+        log::warn!("[meet-call] post-build set_position failed: {err}");
+    }
+    if let Ok(pos) = window.outer_position() {
+        log::info!(
+            "[meet-call] post-build outer_position={{x:{},y:{}}} (target=-30000,-30000)",
+            pos.x,
+            pos.y
+        );
+    }
+
     state
         .inner
         .lock()
@@ -195,10 +248,17 @@ pub async fn meet_call_open_window<R: Runtime>(
         let app_for_audio = app.clone();
         let request_id_for_audio = request_id.clone();
         let url_for_audio = parsed.to_string();
+        let bot_for_audio = args.display_name.clone();
+        let owner_for_audio = args.owner_display_name.clone();
         tauri::async_runtime::spawn(async move {
-            if let Err(err) =
-                crate::meet_audio::start(app_for_audio, request_id_for_audio.clone(), url_for_audio)
-                    .await
+            if let Err(err) = crate::meet_audio::start(
+                app_for_audio,
+                request_id_for_audio.clone(),
+                url_for_audio,
+                owner_for_audio,
+                bot_for_audio,
+            )
+            .await
             {
                 log::warn!(
                     "[meet-call] meet_audio start failed request_id={request_id_for_audio} err={err}"
@@ -364,7 +424,7 @@ pub async fn meet_call_close_window<R: Runtime>(
     Ok(false)
 }
 
-fn window_label_for(request_id: &str) -> String {
+pub fn window_label_for(request_id: &str) -> String {
     format!("meet-call-{request_id}")
 }
 
diff --git a/app/src-tauri/src/meet_scanner/mod.rs b/app/src-tauri/src/meet_scanner/mod.rs
index 67e56f57f2..9764be8aa7 100644
--- a/app/src-tauri/src/meet_scanner/mod.rs
+++ b/app/src-tauri/src/meet_scanner/mod.rs
@@ -35,7 +35,7 @@
 use std::time::Duration;
 
 use serde_json::{json, Value};
-use tauri::{AppHandle, Runtime};
+use tauri::{AppHandle, Manager, Runtime};
 
 use crate::cdp::{self, CdpConn};
 
@@ -70,7 +70,7 @@ const POLL_INTERVAL: Duration = Duration::from_millis(500);
 /// the scanner uses it as a target-URL prefix so two concurrent calls
 /// each attach to their own CEF target instead of cross-controlling.
 pub fn spawn<R: Runtime>(
-    _app: AppHandle<R>,
+    app: AppHandle<R>,
     request_id: String,
     meet_url: String,
     display_name: String,
@@ -79,7 +79,21 @@ pub fn spawn<R: Runtime>(
     // JoinHandle whose abort_handle() we can return to the caller.
     let handle = tokio::spawn(async move {
         match run(&request_id, &meet_url, &display_name).await {
-            Ok(()) => log::info!("[meet-scanner] join sequence completed request_id={request_id}"),
+            Ok(()) => {
+                log::info!("[meet-scanner] join sequence completed request_id={request_id}");
+                // Diagnostic build: keep the window VISIBLE post-join so
+                // we can verify whether the previous `window.hide()` was
+                // suspending the renderer enough to break the audio +
+                // caption bridges. Smoke shows audio_context_state stuck
+                // at "not-created" and no push_caption RPCs ever fire
+                // after hide() — both consistent with the renderer
+                // pausing its event loop when orderOut: lands. If the
+                // pipeline works with the window visible we'll restore
+                // hide() via a different mechanism (e.g. drag off-screen
+                // via Tauri set_position rather than orderOut:).
+                let _ = app;
+                let _ = request_id;
+            }
             Err(err) => {
                 log::warn!("[meet-scanner] join sequence aborted request_id={request_id} err={err}")
             }
@@ -99,6 +113,53 @@ async fn run(request_id: &str, meet_url: &str, display_name: &str) -> Result<(),
     let _ = cdp.call("Page.enable", json!({}), Some(&session)).await;
     let _ = cdp.call("Runtime.enable", json!({}), Some(&session)).await;
 
+    // Phase 0 — strip any leaked Google session cookies/cache before
+    // we touch the page. The vendored tauri-cef runtime does not yet
+    // honour our per-request_id `data_directory` as a fresh CEF
+    // RequestContext — webviews end up sharing the parent process's
+    // cookie + cache store. Without this clear, Meet recognises the
+    // signed-in Google account on the user's main openhuman session
+    // ("nikhil@tinyhumans.ai" / "Verify it's you" screen) and the bot
+    // never reaches the anonymous "Your name" pre-join input we drive
+    // in Phase 2.
+    //
+    // `Network.clearBrowserCookies` + `Network.clearBrowserCache` are
+    // CDP-wide for the attached browser instance, so they wipe the
+    // session for THIS Meet target without touching the user's main
+    // openhuman webviews (those run in separate browser instances).
+    // Best-effort: if Network domain isn't enabled or CDP returns an
+    // error, we log and continue — the bot may still land on the
+    // verify screen but won't get worse than the pre-clear state.
+    let _ = cdp.call("Network.enable", json!({}), Some(&session)).await;
+    if let Err(err) = cdp
+        .call("Network.clearBrowserCookies", json!({}), Some(&session))
+        .await
+    {
+        log::warn!("[meet-scanner] clearBrowserCookies failed: {err}");
+    } else {
+        log::info!("[meet-scanner] cleared browser cookies for fresh anonymous session");
+    }
+    if let Err(err) = cdp
+        .call("Network.clearBrowserCache", json!({}), Some(&session))
+        .await
+    {
+        log::info!("[meet-scanner] clearBrowserCache skipped: {err}");
+    }
+    // Reload the page once so Meet re-fetches from scratch without the
+    // user's Google session cookies. Without the reload, Meet's React
+    // state still holds the post-auth view; we'd be clicking buttons
+    // on a stale page.
+    if let Err(err) = cdp
+        .call("Page.reload", json!({"ignoreCache": true}), Some(&session))
+        .await
+    {
+        log::warn!("[meet-scanner] post-cookie-clear reload failed: {err}");
+    }
+    // Give the reloaded page a moment to settle before scanner phases
+    // start poking the DOM. 1.5s is comfortably above Meet's typical
+    // first-paint on CEF + leaves headroom for slow CI runners.
+    tokio::time::sleep(Duration::from_millis(1500)).await;
+
     // Phase 1 — dismiss the device-check screen.
     //
     // Meet's exact copy varies by region/A-B test; we try the canonical
@@ -122,6 +183,108 @@ async fn run(request_id: &str, meet_url: &str, display_name: &str) -> Result<(),
     // Phase 2 — type the display name.
     type_into_named_input(&mut cdp, &session, "Your name", display_name).await?;
 
+    // Phase 2.5 — ensure camera + mic are ON before Ask-to-join.
+    //
+    // Meet pre-join shows the toggle button with aria-label that
+    // describes the *action it performs*: "Turn on camera" when the
+    // camera is currently OFF, "Turn off camera" when currently ON.
+    // We want both ON, so we MUST only match the "Turn on …" variants.
+    // Matching "Turn off …" would booby-trap us: it would click an
+    // already-on toggle, turning it OFF — which is the bug we just
+    // tripped on (mic ended up muted because "Turn off microphone"
+    // matched and the click flipped it off).
+    //
+    // If no "Turn on …" match is found, the device is already on (or
+    // the page hasn't rendered the toggle yet) — log + skip silently.
+    // On miss, dump the current aria-labels so we can verify state and
+    // extend the matcher with newly observed Meet variants.
+    if let Err(err) = click_by_aria_label(
+        &mut cdp,
+        &session,
+        &["turn on camera", "turn camera on", "camera is off"],
+        Duration::from_secs(8),
+    )
+    .await
+    {
+        log::info!(
+            "[meet-scanner] camera toggle ON not clicked (already on or label drift): {err}"
+        );
+        dump_aria_labels(&mut cdp, &session, "camera|video").await;
+    }
+    if let Err(err) = click_by_aria_label(
+        &mut cdp,
+        &session,
+        &[
+            "turn on microphone",
+            "turn microphone on",
+            "turn on mic",
+            "turn mic on",
+            "microphone is off",
+            "mic is off",
+        ],
+        Duration::from_secs(8),
+    )
+    .await
+    {
+        log::info!("[meet-scanner] mic toggle ON not clicked (already on or label drift): {err}");
+        dump_aria_labels(&mut cdp, &session, "mic|microphone|audio").await;
+    }
+
+    // Phase 2.6 — force a fresh getUserMedia call by cycling mic off-on
+    // BEFORE Ask-to-join.
+    //
+    // Why before, not after: if Ask-to-join times out (Meet UI variant
+    // drift or already-joined-elsewhere) the scanner returns Err and
+    // any later phases never run. Cycling here means the gUM intercept
+    // gets its chance regardless of what happens at the join button —
+    // and pre-join is also when Meet's React happily re-acquires media
+    // on toggle, so this is the more reliable site anyway.
+    //
+    // Meet caches the camera + mic MediaStreams from initial page load
+    // (before meet_audio::inject reloaded with our bridges). Our gUM
+    // intercept in audio_bridge.js only fires on NEW gUM calls, so the
+    // cached streams keep flowing — the bot's mic stays the real OS
+    // microphone, the bot's camera stays the static fake-camera Y4M
+    // frame, and our speak_pump pushes synthesized PCM into a
+    // MediaStreamDestination that's never attached to any outbound
+    // track. Host hears the user (echo loop) instead of the bot.
+    //
+    // Click "Turn off microphone" → ~700 ms pause for React to settle →
+    // click whatever aria-label appears in its place ("Turn on
+    // microphone" or a variant). The second click triggers Meet to
+    // re-request via getUserMedia, which our bridge then intercepts.
+    if let Err(err) = click_by_aria_label(
+        &mut cdp,
+        &session,
+        &["turn off microphone", "turn microphone off", "turn off mic"],
+        Duration::from_secs(4),
+    )
+    .await
+    {
+        log::info!("[meet-scanner] mic off-cycle skipped: {err}");
+    } else {
+        log::info!("[meet-scanner] mic cycled off; pausing 700ms before re-arm");
+        tokio::time::sleep(Duration::from_millis(700)).await;
+        if let Err(err) = click_by_aria_label(
+            &mut cdp,
+            &session,
+            &[
+                "turn on microphone",
+                "turn microphone on",
+                "turn on mic",
+                "turn mic on",
+            ],
+            Duration::from_secs(6),
+        )
+        .await
+        {
+            log::warn!("[meet-scanner] mic on-cycle missed (left muted!): {err}");
+            dump_aria_labels(&mut cdp, &session, "mic|microphone").await;
+        } else {
+            log::info!("[meet-scanner] mic re-armed (gUM intercept should now fire)");
+        }
+    }
+
     // Phase 3 — request to join.
     wait_and_click_text(
         &mut cdp,
@@ -131,9 +294,218 @@ async fn run(request_id: &str, meet_url: &str, display_name: &str) -> Result<(),
     )
     .await?;
 
+    // Phase 4 — once the bot is admitted, force-enable captions.
+    //
+    // captions_bridge.js already polls every 2 s for a button whose
+    // aria-label STARTS with "turn on captions" (`indexOf(...) === 0`).
+    // That's brittle: Meet ships "Turn on captions (c)" in some regions
+    // (the parenthesised shortcut breaks the `=== 0` prefix-match), and
+    // the polling cap (30 attempts * 2 s = 60 s) can expire before a
+    // slow host admits the bot. Belt-and-suspenders: from the scanner
+    // side, wait for admission (the "Leave call" affordance) then click
+    // the captions toggle ourselves via the looser substring matcher.
+    //
+    // Best-effort: if any step times out, log + continue. The brain
+    // will simply not see captions for this session, which is no worse
+    // than the pre-fix state.
+    if let Err(err) = wait_for_admission(&mut cdp, &session).await {
+        log::info!("[meet-scanner] admission wait skipped: {err}");
+    } else {
+        log::info!("[meet-scanner] bot admitted into meeting");
+        if let Err(err) = click_by_aria_label(
+            &mut cdp,
+            &session,
+            &[
+                "turn on captions",
+                "turn on live captions",
+                "turn on subtitles",
+                "turn on closed captions",
+                "captions on",
+                "captions (c)",
+                "show captions",
+                "enable captions",
+            ],
+            Duration::from_secs(8),
+        )
+        .await
+        {
+            log::info!("[meet-scanner] captions toggle ON not clicked: {err}");
+            dump_aria_labels(&mut cdp, &session, "caption|subtitle").await;
+            // Fallback: dispatch the "c" keyboard shortcut that toggles
+            // captions in Meet regardless of button label changes.
+            log::info!("[meet-scanner] trying keyboard shortcut 'c' to enable captions");
+            if let Err(key_err) = dispatch_caption_shortcut(&mut cdp, &session).await {
+                log::info!("[meet-scanner] caption shortcut dispatch failed: {key_err}");
+            }
+        }
+    }
+
     Ok(())
 }
 
+/// Wait until the meeting page renders the in-call control bar — the
+/// signal that the host has admitted the bot from the waiting room.
+/// The "Leave call" / "End call" button is the simplest stable anchor;
+/// the captions and "more options" buttons exist in pre-join too.
+async fn wait_for_admission(cdp: &mut CdpConn, session: &str) -> Result<(), String> {
+    const ADMISSION_BUDGET: Duration = Duration::from_secs(120);
+    let expression = r#"
+        (() => {
+          const all = document.querySelectorAll('button[aria-label]');
+          for (const el of all) {
+            const a = (el.getAttribute('aria-label') || '').toLowerCase();
+            if (a.includes('leave call') || a.includes('end call')) {
+              const rect = el.getBoundingClientRect();
+              if (rect.width > 0 && rect.height > 0) return true;
+            }
+          }
+          return false;
+        })()
+    "#;
+    let deadline = tokio::time::Instant::now() + ADMISSION_BUDGET;
+    while tokio::time::Instant::now() < deadline {
+        let res = cdp
+            .call(
+                "Runtime.evaluate",
+                json!({ "expression": expression, "returnByValue": true }),
+                Some(session),
+            )
+            .await?;
+        let admitted = res
+            .get("result")
+            .and_then(|r| r.get("value"))
+            .and_then(|v| v.as_bool())
+            .unwrap_or(false);
+        if admitted {
+            return Ok(());
+        }
+        tokio::time::sleep(Duration::from_secs(1)).await;
+    }
+    Err(format!(
+        "timeout ({}s) waiting for Leave-call affordance",
+        ADMISSION_BUDGET.as_secs()
+    ))
+}
+
+/// Dump the page's aria-labels that match a JS regex pattern so we can
+/// inspect what Meet actually exposes after a failed
+/// [`click_by_aria_label`]. Best-effort, swallows all CDP errors.
+async fn dump_aria_labels(cdp: &mut CdpConn, session: &str, pattern: &str) {
+    let pattern_js = serde_json::to_string(pattern).unwrap_or_else(|_| "\"camera\"".to_string());
+    let expression = format!(
+        r#"
+        (() => {{
+          const re = new RegExp({pattern_js}, "i");
+          const nodes = document.querySelectorAll('[aria-label]');
+          const hits = [];
+          for (const el of nodes) {{
+            const aria = el.getAttribute('aria-label') || '';
+            if (!re.test(aria)) continue;
+            const tag = el.tagName.toLowerCase();
+            const role = el.getAttribute('role') || '';
+            const dataTip = el.getAttribute('data-tooltip') || '';
+            const rect = el.getBoundingClientRect();
+            const visible = rect.width > 0 && rect.height > 0;
+            hits.push({{ aria, tag, role, dataTip, visible }});
+            if (hits.length >= 24) break;
+          }}
+          return hits;
+        }})()
+        "#
+    );
+    let res = match cdp
+        .call(
+            "Runtime.evaluate",
+            json!({ "expression": expression, "returnByValue": true }),
+            Some(session),
+        )
+        .await
+    {
+        Ok(v) => v,
+        Err(err) => {
+            log::info!("[meet-scanner] aria-label dump failed: {err}");
+            return;
+        }
+    };
+    if let Some(arr) = res.get("result").and_then(|r| r.get("value")) {
+        log::info!(
+            "[meet-scanner] aria-label dump pattern={} hits={}",
+            pattern,
+            arr
+        );
+    }
+}
+
+/// Click a button whose `aria-label` matches one of `labels`
+/// (case-insensitive substring). Meet's camera + mic toggles have no
+/// visible text — they're icon buttons with `aria-label="Turn on
+/// camera"` etc. The existing `wait_and_click_text` matches innerText
+/// only, so we need a sibling matcher anchored on aria-label.
+async fn click_by_aria_label(
+    cdp: &mut CdpConn,
+    session: &str,
+    labels: &[&str],
+    budget: Duration,
+) -> Result<(), String> {
+    let labels_js = serde_json::to_string(labels).map_err(|e| format!("labels json: {e}"))?;
+    let expression = format!(
+        r#"
+        (() => {{
+          const labels = {labels_js};
+          const want = labels.map(l => l.toLowerCase());
+          const candidates = document.querySelectorAll(
+            'button, [role="button"], [aria-label]'
+          );
+          for (const el of candidates) {{
+            if (el.disabled || el.getAttribute('aria-disabled') === 'true') continue;
+            const aria = (el.getAttribute('aria-label') || '').toLowerCase();
+            if (!aria) continue;
+            if (!want.some(w => aria.includes(w))) continue;
+            const rect = el.getBoundingClientRect();
+            if (rect.width === 0 || rect.height === 0) continue;
+            el.scrollIntoView({{ block: 'center', inline: 'center' }});
+            el.click();
+            return aria;
+          }}
+          return null;
+        }})()
+        "#
+    );
+
+    let deadline = tokio::time::Instant::now() + budget;
+    let mut last_value = Value::Null;
+    while tokio::time::Instant::now() < deadline {
+        let res = cdp
+            .call(
+                "Runtime.evaluate",
+                json!({
+                    "expression": expression,
+                    "returnByValue": true,
+                    "awaitPromise": false,
+                }),
+                Some(session),
+            )
+            .await?;
+        let value = res
+            .get("result")
+            .and_then(|r| r.get("value"))
+            .cloned()
+            .unwrap_or(Value::Null);
+        if value.is_string() {
+            log::info!(
+                "[meet-scanner] clicked aria-label matching {labels:?} aria={}",
+                value.as_str().unwrap_or("")
+            );
+            return Ok(());
+        }
+        last_value = value;
+        tokio::time::sleep(POLL_INTERVAL).await;
+    }
+    Err(format!(
+        "timeout waiting for aria-label matching {labels:?} (last={last_value})"
+    ))
+}
+
 /// Poll CEF's target list until a page whose URL starts with `meet_url`
 /// shows up, then attach a CDP session to it. Filtering by the full
 /// per-call URL prefix (rather than just the host) keeps two concurrent
@@ -222,6 +594,53 @@ async fn wait_and_click_text(
     ))
 }
 
+/// Dispatch the "c" keyboard shortcut via CDP `Input.dispatchKeyEvent`
+/// to toggle captions in Google Meet. This bypasses button-label
+/// matching entirely and works regardless of Meet's UI changes.
+async fn dispatch_caption_shortcut(cdp: &mut CdpConn, session: &str) -> Result<(), String> {
+    for event_type in ["keyDown", "keyUp"] {
+        cdp.call(
+            "Input.dispatchKeyEvent",
+            json!({
+                "type": event_type,
+                "key": "c",
+                "code": "KeyC",
+                "windowsVirtualKeyCode": 67,
+                "nativeVirtualKeyCode": 67,
+            }),
+            Some(session),
+        )
+        .await
+        .map_err(|e| format!("Input.dispatchKeyEvent({event_type}): {e}"))?;
+    }
+    // Give Meet a moment to react, then check if captions region appeared.
+    tokio::time::sleep(Duration::from_secs(2)).await;
+    let check = cdp
+        .call(
+            "Runtime.evaluate",
+            json!({
+                "expression": "!!document.querySelector('[aria-label*=\"aption\" i], [role=\"log\"][aria-label]')",
+                "returnByValue": true,
+            }),
+            Some(session),
+        )
+        .await
+        .map_err(|e| format!("caption region check: {e}"))?;
+    let found = check
+        .get("result")
+        .and_then(|r| r.get("value"))
+        .and_then(|v| v.as_bool())
+        .unwrap_or(false);
+    if found {
+        log::info!("[meet-scanner] captions enabled via keyboard shortcut 'c'");
+    } else {
+        log::info!(
+            "[meet-scanner] caption region not found after 'c' shortcut — may need manual enable"
+        );
+    }
+    Ok(())
+}
+
 /// Focus an `<input>` whose `aria-label` or `placeholder` contains
 /// `hint`, then dispatch the supplied text via `Input.insertText` so
 /// Meet's React-controlled input picks it up as a real keystroke.
diff --git a/app/src/components/intelligence/IntelligenceCallsTab.tsx b/app/src/components/intelligence/IntelligenceCallsTab.tsx
index 1c63bdf77f..8783c4e764 100644
--- a/app/src/components/intelligence/IntelligenceCallsTab.tsx
+++ b/app/src/components/intelligence/IntelligenceCallsTab.tsx
@@ -64,7 +64,13 @@ export default function IntelligenceCallsTab({ onToast }: Props) {
     setError(null);
     setSubmitting(true);
     try {
-      const result = await joinMeetCall({ meetUrl, displayName });
+      // ownerDisplayName left empty here because this tab's UI is hidden
+      // behind a "Coming Soon" gate (see render branch below) — the call
+      // is dead-code-reachable only. When the tab is revived it must
+      // collect an owner-name input the same way `MeetingBotsCard` does
+      // (privacy lock for the in-call wake gate). Empty fails closed in
+      // core, so we're safe in the meantime.
+      const result = await joinMeetCall({ meetUrl, displayName, ownerDisplayName: '' });
       setActiveCalls(prev => [
         ...prev.filter(call => call.requestId !== result.requestId),
         { requestId: result.requestId, meetUrl: result.meetUrl, displayName: result.displayName },
diff --git a/app/src/components/skills/MeetingBotsCard.tsx b/app/src/components/skills/MeetingBotsCard.tsx
index f8fd50e480..6b94488b21 100644
--- a/app/src/components/skills/MeetingBotsCard.tsx
+++ b/app/src/components/skills/MeetingBotsCard.tsx
@@ -1,20 +1,20 @@
 // Meeting bots entry point on the Skills "Integrations" section.
 //
-// Surfaces as a compact, fun banner: clicking opens a modal that wraps
-// the backend mascot bot (PR tinyhumansai/backend#773). Joining a
-// Google Meet kicks off the Camoufox-driven mascot in the backend,
-// which streams the mascot's WebRTC video into the call as an
-// anonymous guest. Zoom and Teams are shown as "coming soon" — the
-// backend already routes them but returns 400 "not yet supported".
+// Surfaces as a compact, fun banner: clicking opens a modal that opens
+// a dedicated CEF webview pointed at the Meet URL. The bot's outbound
+// camera is the mascot canvas (`meet_video::camera_bridge`) and its
+// outbound audio is the synthesized speech pump (`meet_audio`). Zoom
+// and Teams are shown as "coming soon" — only Google Meet has the CEF
+// bridge pipeline today.
 
-import { useEffect, useState } from 'react';
+import { useCallback, useEffect, useState } from 'react';
 
 import { useT } from '../../lib/i18n/I18nContext';
 import {
-  joinMeetingViaMascotBot,
-  SERVER_OVERLOADED_MESSAGE,
-  type MascotJoinMeetingError,
+  joinMeetCall,
+  listMeetCalls,
   type MascotMeetPlatform,
+  type MeetCallRecord,
 } from '../../services/meetCallService';
 
 type Toast = { type: 'success' | 'error' | 'info'; title: string; message?: string };
@@ -50,10 +50,6 @@ const PLATFORMS: PlatformDef[] = [
   },
 ];
 
-function isMascotJoinMeetingError(err: unknown): err is MascotJoinMeetingError {
-  return !!err && typeof err === 'object' && 'isCapacityGated' in err && 'message' in err;
-}
-
 export default function MeetingBotsCard({ onToast }: Props) {
   const [open, setOpen] = useState(false);
 
@@ -124,14 +120,45 @@ interface ModalProps {
   onToast?: (toast: Toast) => void;
 }
 
-function MeetingBotsModal({ onClose, onToast }: ModalProps) {
+export function MeetingBotsModal({ onClose, onToast }: ModalProps) {
   const { t } = useT();
   const [platform, setPlatform] = useState<MascotMeetPlatform>('gmeet');
   const [meetUrl, setMeetUrl] = useState('');
   const [displayName, setDisplayName] = useState('OpenHuman');
+  // Privacy lock: the bot will only react to the wake word when this
+  // exact name is the speaker in Meet's captions. Anyone else who
+  // says "hey openhuman …" is silently ignored — preventing a
+  // remote participant from issuing tool calls in the owner's
+  // name. Empty fails closed; the submit handler will surface an
+  // explicit error before opening the CEF window.
+  const [ownerDisplayName, setOwnerDisplayName] = useState('');
   const [submitting, setSubmitting] = useState(false);
-  const [capacityGated, setCapacityGated] = useState(false);
   const [error, setError] = useState<string | null>(null);
+  // Recent-calls history loaded from core when the modal opens.
+  // `null` means "not yet fetched"; `[]` means "fetched, no rows".
+  // Separating the two lets the UI render a "Loading…" hint on
+  // first open without flashing a misleading empty state.
+  const [recentCalls, setRecentCalls] = useState<MeetCallRecord[] | null>(null);
+  const [recentError, setRecentError] = useState<string | null>(null);
+
+  const refreshRecentCalls = useCallback(async () => {
+    setRecentError(null);
+    try {
+      const rows = await listMeetCalls(20);
+      setRecentCalls(rows);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : 'Failed to load recent calls.';
+      console.warn('[meeting-bots] listMeetCalls failed:', err);
+      setRecentError(message);
+      setRecentCalls([]);
+    }
+  }, []);
+
+  useEffect(() => {
+    // Fire-and-forget on mount; the modal is short-lived (closes on
+    // submit or Cancel) so a slow RPC here can't pile up.
+    void refreshRecentCalls();
+  }, [refreshRecentCalls]);
 
   const selected = PLATFORMS.find(p => p.platform === platform) ?? PLATFORMS[0];
   const selectedLabel = t(selected.labelKey);
@@ -149,14 +176,24 @@ function MeetingBotsModal({ onClose, onToast }: ModalProps) {
   const handleSubmit = async (event: React.FormEvent<HTMLFormElement>) => {
     event.preventDefault();
     setError(null);
-    setCapacityGated(false);
     if (isComingSoon) {
       setError(t('skills.meetingBots.platformComingSoon').replace('{label}', selectedLabel));
       return;
     }
     setSubmitting(true);
     try {
-      await joinMeetingViaMascotBot({ platform, meetUrl, displayName });
+      // Flow A: local CEF webview with mascot canvas + synthesized audio.
+      // joinMeetCall opens an off-screen CEF window per request_id,
+      // installs the audio/video bridges via CDP, then meet_scanner
+      // drives the join automatically. Returns once the window has
+      // been created — meet_audio + meet_scanner take it from there.
+      //
+      // ownerDisplayName is the privacy lock: the wake-word gate in
+      // the core only accepts captions whose speaker matches this
+      // value (case-insensitive, "(host)" / "(you)" suffix stripped).
+      // Anyone else in the room saying the wake phrase is dropped
+      // without dispatching a tool turn.
+      await joinMeetCall({ meetUrl, displayName, ownerDisplayName });
       onToast?.({
         type: 'success',
         title: t('skills.meetingBots.joiningTitle'),
@@ -165,20 +202,9 @@ function MeetingBotsModal({ onClose, onToast }: ModalProps) {
       setMeetUrl('');
       onClose();
     } catch (err) {
-      if (isMascotJoinMeetingError(err)) {
-        setCapacityGated(err.isCapacityGated);
-        const message = err.isCapacityGated ? SERVER_OVERLOADED_MESSAGE : err.message;
-        setError(message);
-        onToast?.({
-          type: 'error',
-          title: err.isCapacityGated ? t('skills.meetingBots.busyTitle') : t('skills.meetingBots.couldNotStartTitle'),
-          message,
-        });
-      } else {
-        const message = err instanceof Error ? err.message : t('skills.meetingBots.failedToStart');
-        setError(message);
-        onToast?.({ type: 'error', title: t('skills.meetingBots.couldNotStartTitle'), message });
-      }
+      const message = err instanceof Error ? err.message : t('skills.meetingBots.failedToStart');
+      setError(message);
+      onToast?.({ type: 'error', title: t('skills.meetingBots.couldNotStartTitle'), message });
     } finally {
       setSubmitting(false);
     }
@@ -272,14 +298,33 @@ function MeetingBotsModal({ onClose, onToast }: ModalProps) {
               />
             </label>
 
+            <label className="block">
+              <span className="text-[10px] font-medium uppercase tracking-wide text-stone-500 dark:text-neutral-400">
+                Your name in the call
+              </span>
+              <input
+                type="text"
+                value={ownerDisplayName}
+                onChange={e => setOwnerDisplayName(e.target.value)}
+                maxLength={64}
+                placeholder="As shown in Google Meet (e.g. Nikhil Bajaj)"
+                disabled={isComingSoon || submitting}
+                aria-describedby="meeting-bots-owner-hint"
+                required
+                className="mt-1 w-full rounded-xl border border-stone-200 dark:border-neutral-800 bg-white dark:bg-neutral-900 px-3 py-2 text-sm text-stone-900 dark:text-neutral-100 focus:border-primary-500 focus:outline-none focus:ring-2 focus:ring-primary-100 disabled:cursor-not-allowed disabled:bg-stone-50 dark:disabled:bg-neutral-800/60"
+              />
+              <p
+                id="meeting-bots-owner-hint"
+                className="mt-1 text-[10px] leading-relaxed text-stone-500 dark:text-neutral-400">
+                Privacy lock. OpenHuman will only respond to the wake word when this exact name
+                is speaking — anyone else in the call cannot trigger tool calls in your name.
+              </p>
+            </label>
+
             {error && (
               <div
                 role="alert"
-                className={`rounded-xl border px-3 py-2 text-xs ${
-                  capacityGated
-                    ? 'border-amber-200 dark:border-amber-500/30 bg-amber-50 dark:bg-amber-500/10 text-amber-800 dark:text-amber-300'
-                    : 'border-coral-200 dark:border-coral-500/30 bg-coral-50 dark:bg-coral-500/10 text-coral-700 dark:text-coral-300'
-                }`}>
+                className="rounded-xl border border-coral-200 dark:border-coral-500/30 bg-coral-50 dark:bg-coral-500/10 px-3 py-2 text-xs text-coral-700 dark:text-coral-300">
                 {error}
               </div>
             )}
@@ -293,7 +338,9 @@ function MeetingBotsModal({ onClose, onToast }: ModalProps) {
               </button>
               <button
                 type="submit"
-                disabled={submitting || isComingSoon || !meetUrl.trim()}
+                disabled={
+                  submitting || isComingSoon || !meetUrl.trim() || !ownerDisplayName.trim()
+                }
                 className="rounded-xl bg-primary-500 px-4 py-2 text-sm font-semibold text-white hover:bg-primary-600 disabled:cursor-not-allowed disabled:bg-stone-200 dark:disabled:bg-neutral-700 disabled:text-stone-400 dark:disabled:text-neutral-500">
                 {isComingSoon
                   ? t('skills.meetingBots.comingSoon').replace('{label}', selectedLabel)
@@ -303,8 +350,125 @@ function MeetingBotsModal({ onClose, onToast }: ModalProps) {
               </button>
             </div>
           </form>
+
+          <RecentCallsSection rows={recentCalls} error={recentError} />
         </div>
       </div>
     </div>
   );
 }
+
+/**
+ * Recent calls list rendered below the join form inside the same
+ * modal — same surface where the user launches a call, so they see
+ * their history without navigating away. Three states:
+ *   - `rows === null`     → still loading (small spinner-y hint).
+ *   - `rows === []`       → no calls yet (gentle empty state).
+ *   - `rows.length > 0`   → render a compact list, newest first.
+ *
+ * `error` is shown inline above the list when the fetch failed but
+ * doesn't block the form — the join path is independent.
+ */
+function RecentCallsSection({
+  rows,
+  error,
+}: {
+  rows: MeetCallRecord[] | null;
+  error: string | null;
+}) {
+  return (
+    <section
+      aria-label="Recent meeting calls"
+      className="mt-4 border-t border-stone-200 dark:border-neutral-800 pt-4">
+      <div className="flex items-baseline justify-between">
+        <h3 className="text-[11px] font-semibold uppercase tracking-wide text-stone-500 dark:text-neutral-400">
+          Recent calls
+          {rows && rows.length > 0 && (
+            <span className="ml-1 text-stone-400 dark:text-neutral-500 normal-case font-normal">
+              ({rows.length})
+            </span>
+          )}
+        </h3>
+      </div>
+
+      {error && (
+        // Plain status text rather than role="alert" — the join form
+        // already owns the alert role for the modal's primary error
+        // surface. A failure to fetch history is informational, not
+        // actionable, and shouldn't collide with the form's a11y
+        // announcement.
+        <p className="mt-2 text-[11px] text-coral-600 dark:text-coral-400">{error}</p>
+      )}
+
+      {rows === null ? (
+        <p className="mt-2 text-[11px] text-stone-400 dark:text-neutral-500">Loading…</p>
+      ) : rows.length === 0 ? (
+        <p className="mt-2 text-[11px] text-stone-400 dark:text-neutral-500">
+          No previous calls yet — your meeting history will appear here.
+        </p>
+      ) : (
+        <ul className="mt-2 max-h-48 space-y-1 overflow-y-auto pr-1">
+          {rows.map(call => (
+            <RecentCallRow key={call.request_id} call={call} />
+          ))}
+        </ul>
+      )}
+    </section>
+  );
+}
+
+function RecentCallRow({ call }: { call: MeetCallRecord }) {
+  // Show the trailing meeting code (`abc-defg-hij`) rather than the
+  // full URL — the URL prefix is always `https://meet.google.com/`
+  // and would just waste row width.
+  const meetingCode = (() => {
+    try {
+      const parsed = new URL(call.meet_url);
+      const tail = parsed.pathname.replace(/^\/+/, '');
+      return tail || call.meet_url;
+    } catch {
+      return call.meet_url || '(unknown URL)';
+    }
+  })();
+  const duration = Math.max(0, Math.round(call.spoken_seconds + call.listened_seconds));
+  return (
+    <li className="rounded-lg px-2 py-1.5 text-[11px] text-stone-700 dark:text-neutral-300 hover:bg-stone-50 dark:hover:bg-neutral-800/40">
+      <div className="flex items-center justify-between gap-2">
+        <span className="truncate font-mono text-stone-800 dark:text-neutral-200">{meetingCode}</span>
+        <span className="shrink-0 text-stone-400 dark:text-neutral-500">
+          {formatRelativeTime(call.started_at_ms)}
+        </span>
+      </div>
+      <div className="mt-0.5 flex items-center gap-3 text-[10px] text-stone-500 dark:text-neutral-400">
+        <span>{call.turn_count} turn{call.turn_count === 1 ? '' : 's'}</span>
+        <span>{duration}s on call</span>
+      </div>
+    </li>
+  );
+}
+
+/**
+ * Compact "12 min ago" / "yesterday" / "May 14" style stamp. Browser
+ * `Intl.RelativeTimeFormat` would be nicer but pulls a much larger
+ * locale data path; the targets here are short labels in a single
+ * surface, not a full i18n investment.
+ */
+function formatRelativeTime(ms: number): string {
+  if (!ms) return '—';
+  const diff = Date.now() - ms;
+  if (diff < 0) return 'just now';
+  const seconds = Math.floor(diff / 1000);
+  if (seconds < 60) return 'just now';
+  const minutes = Math.floor(seconds / 60);
+  if (minutes < 60) return `${minutes}m ago`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24) return `${hours}h ago`;
+  const days = Math.floor(hours / 24);
+  if (days === 1) return 'yesterday';
+  if (days < 7) return `${days}d ago`;
+  try {
+    return new Date(ms).toLocaleDateString(undefined, { month: 'short', day: 'numeric' });
+  } catch {
+    return '—';
+  }
+}
diff --git a/app/src/components/skills/__tests__/MeetingBotsCard.test.tsx b/app/src/components/skills/__tests__/MeetingBotsCard.test.tsx
index 1d99f8d739..1c7c3c0b4f 100644
--- a/app/src/components/skills/__tests__/MeetingBotsCard.test.tsx
+++ b/app/src/components/skills/__tests__/MeetingBotsCard.test.tsx
@@ -11,7 +11,11 @@ vi.mock('../../../services/meetCallService', async () => {
   );
   return {
     ...actual,
-    joinMeetingViaMascotBot: (...args: unknown[]) => joinMock(...args),
+    // Flow A: the modal submit calls joinMeetCall (CEF webview), not the
+    // Flow B backend joinMeetingViaMascotBot. Switched in the
+    // mascot-meet-flowA revival commits — kept the mock variable name
+    // `joinMock` to keep the diff focused on the call site swap.
+    joinMeetCall: (...args: unknown[]) => joinMock(...args),
   };
 });
 
@@ -45,8 +49,8 @@ describe('MeetingBotsCard', () => {
     expect(screen.queryByRole('dialog')).not.toBeInTheDocument();
   });
 
-  it('submits to joinMeetingViaMascotBot and fires a success toast', async () => {
-    joinMock.mockResolvedValueOnce({ success: true });
+  it('submits to joinMeetCall and fires a success toast', async () => {
+    joinMock.mockResolvedValueOnce({ requestId: 'req-1' });
     const onToast = vi.fn();
     render(<MeetingBotsCard onToast={onToast} />);
 
@@ -54,14 +58,25 @@ describe('MeetingBotsCard', () => {
     fireEvent.change(screen.getByLabelText(/meeting link/i), {
       target: { value: 'https://meet.google.com/abc-defg-hij' },
     });
+    // Owner display name is now required — the wake-word gate refuses
+    // every caption when this is empty (privacy lock), so the submit
+    // button stays disabled and the test would hang on form submit
+    // without typing a value here.
+    fireEvent.change(screen.getByLabelText(/your name in the call/i), {
+      target: { value: 'Alice' },
+    });
     const form = screen.getByRole('dialog').querySelector('form')!;
     fireEvent.submit(form);
 
+    // Flow A's joinMeetCall takes { meetUrl, displayName, ownerDisplayName }.
+    // Assert on the owner name (the new privacy-lock contract) and meetUrl;
+    // the bot displayName is a UI-supplied default and not contract-load-
+    // bearing for this assertion.
     await vi.waitFor(() => {
       expect(joinMock).toHaveBeenCalledWith(
         expect.objectContaining({
-          platform: 'gmeet',
           meetUrl: 'https://meet.google.com/abc-defg-hij',
+          ownerDisplayName: 'Alice',
         })
       );
     });
@@ -76,11 +91,11 @@ describe('MeetingBotsCard', () => {
     });
   });
 
-  it('surfaces a capacity-gated error inline + as an amber toast', async () => {
-    joinMock.mockRejectedValueOnce({
-      isCapacityGated: true,
-      message: 'busy',
-    });
+  // Flow A's joinMeetCall has no capacity-gated concept — any throw maps
+  // to the single "could not start" toast + inline alert with the error
+  // message. Two error cases collapsed into one in the Flow A model.
+  it('surfaces a join error inline + as an error toast', async () => {
+    joinMock.mockRejectedValueOnce(new Error('Bad URL'));
     const onToast = vi.fn();
     render(<MeetingBotsCard onToast={onToast} />);
 
@@ -88,25 +103,8 @@ describe('MeetingBotsCard', () => {
     fireEvent.change(screen.getByLabelText(/meeting link/i), {
       target: { value: 'https://meet.google.com/x' },
     });
-    fireEvent.submit(screen.getByRole('dialog').querySelector('form')!);
-
-    await vi.waitFor(() => {
-      expect(onToast).toHaveBeenCalledWith(
-        expect.objectContaining({ type: 'error', title: expect.stringMatching(/busy/i) })
-      );
-    });
-    // Modal stays open so the user can retry; inline alert visible.
-    expect(screen.getByRole('alert')).toBeInTheDocument();
-  });
-
-  it('surfaces a non-capacity error', async () => {
-    joinMock.mockRejectedValueOnce({ isCapacityGated: false, message: 'Bad URL' });
-    const onToast = vi.fn();
-    render(<MeetingBotsCard onToast={onToast} />);
-
-    fireEvent.click(screen.getByTestId('meeting-bots-banner'));
-    fireEvent.change(screen.getByLabelText(/meeting link/i), {
-      target: { value: 'https://meet.google.com/x' },
+    fireEvent.change(screen.getByLabelText(/your name in the call/i), {
+      target: { value: 'Alice' },
     });
     fireEvent.submit(screen.getByRole('dialog').querySelector('form')!);
 
diff --git a/app/src/features/human/HumanPage.tsx b/app/src/features/human/HumanPage.tsx
index 960a9886ed..e7271f24fa 100644
--- a/app/src/features/human/HumanPage.tsx
+++ b/app/src/features/human/HumanPage.tsx
@@ -1,5 +1,6 @@
 import { useEffect, useMemo, useState } from 'react';
 
+import { MeetingBotsModal } from '../../components/skills/MeetingBotsCard';
 import { useT } from '../../lib/i18n/I18nContext';
 import Conversations from '../../pages/Conversations';
 import { useAppSelector } from '../../store/hooks';
@@ -20,6 +21,7 @@ const HumanPage = () => {
     const raw = window.localStorage.getItem(SPEAK_REPLIES_KEY);
     return raw === null ? true : raw === '1';
   });
+  const [joinMeetingOpen, setJoinMeetingOpen] = useState(false);
 
   useEffect(() => {
     window.localStorage.setItem(SPEAK_REPLIES_KEY, speakReplies ? '1' : '0');
@@ -70,6 +72,21 @@ const HumanPage = () => {
         {t('voice.pushToTalk')}
       </label>
 
+      {/* "Send OpenHuman to a meeting" — opens the Flow A modal which spawns
+          an off-screen CEF webview pointed at the Meet URL with the mascot
+          canvas as the outbound camera and synthesized speech as the
+          outbound mic. The user's OS mic is never wired to the meeting. */}
+      <button
+        type="button"
+        onClick={() => setJoinMeetingOpen(true)}
+        data-testid="human-join-meeting-pill"
+        className="absolute top-4 left-44 z-10 inline-flex items-center gap-1.5 px-3 py-1.5 rounded-full bg-primary-500 text-white text-xs font-medium shadow-soft hover:bg-primary-600 focus:outline-none focus-visible:ring-2 focus-visible:ring-primary-300">
+        <span aria-hidden="true">📞</span>
+        {t('skills.meetingBots.modalTitle')}
+      </button>
+
+      {joinMeetingOpen && <MeetingBotsModal onClose={() => setJoinMeetingOpen(false)} />}
+
       {/* Chat sidebar — vertically centered above the BottomTabBar (~80px). */}
       <div className="absolute right-4 top-0 bottom-20 z-10 flex items-center">
         <aside className="w-[420px] h-[min(720px,calc(100vh-160px))] rounded-2xl border border-stone-300 dark:border-neutral-700 bg-white dark:bg-neutral-900 shadow-soft flex flex-col overflow-hidden">
diff --git a/app/src/features/meet/MascotFrameProducer.tsx b/app/src/features/meet/MascotFrameProducer.tsx
index a66d033c45..ee11a360d7 100644
--- a/app/src/features/meet/MascotFrameProducer.tsx
+++ b/app/src/features/meet/MascotFrameProducer.tsx
@@ -60,6 +60,11 @@ const ProducerSession: FC<{ session: BusSession }> = ({ session }) => {
   const wsReadyRef = useRef(false);
   const stoppedRef = useRef(false);
   const inflightRef = useRef(false);
+  // True while the bot is actively producing PCM into the Meet call.
+  // Drives the mascot's `face` prop so the mouth visibly animates.
+  // Source of truth is the Rust speak_pump (edge-detected with ~400ms
+  // hangover). Same `requestId` guards against stale events.
+  const [isSpeaking, setIsSpeaking] = useState(false);
 
   const captureFrame = useCallback(async () => {
     if (stoppedRef.current || !wsReadyRef.current || inflightRef.current) return;
@@ -163,8 +168,26 @@ const ProducerSession: FC<{ session: BusSession }> = ({ session }) => {
     };
     worker.postMessage({ cmd: 'start', intervalMs });
 
+    // Subscribe to speaking-state events from the Rust speak_pump so
+    // the mascot's mouth animates while the bot is producing TTS audio.
+    let unlistenSpeaking: UnlistenFn | undefined;
+    let speakingListenerCancelled = false;
+    listen<{ requestId: string; speaking: boolean }>('meet-video:speaking-state', event => {
+      const p = event.payload;
+      if (p && p.requestId === session.requestId) {
+        setIsSpeaking(p.speaking);
+      }
+    })
+      .then(stop => {
+        if (speakingListenerCancelled) stop();
+        else unlistenSpeaking = stop;
+      })
+      .catch(err => console.debug('[meet-video-producer] speaking-state listen failed', err));
+
     return () => {
       stoppedRef.current = true;
+      speakingListenerCancelled = true;
+      if (unlistenSpeaking) unlistenSpeaking();
       try {
         worker.postMessage({ cmd: 'stop' });
         worker.terminate();
@@ -186,7 +209,7 @@ const ProducerSession: FC<{ session: BusSession }> = ({ session }) => {
       wsRef.current = null;
       wsReadyRef.current = false;
     };
-  }, [session.port, captureFrame]);
+  }, [session.port, session.requestId, captureFrame]);
 
   return (
     <div
@@ -194,14 +217,19 @@ const ProducerSession: FC<{ session: BusSession }> = ({ session }) => {
       aria-hidden="true"
       style={{
         position: 'fixed',
-        left: '-99999px',
+        // Keep at a real screen position (not -99999px) so the WebGL
+        // canvas backing RiveMascot actually renders. Browsers skip
+        // painting GPU contexts that are fully off-viewport. opacity:0
+        // makes it invisible to the user while keeping the render alive.
+        left: 0,
         top: 0,
         width: FRAME_H,
         height: FRAME_H,
         pointerEvents: 'none',
         opacity: 0,
+        zIndex: -1,
       }}>
-      <RiveMascot face="idle" size={FRAME_H} />
+      <RiveMascot face={isSpeaking ? 'speaking' : 'idle'} size={FRAME_H} />
     </div>
   );
 };
diff --git a/app/src/lib/i18n/en.ts b/app/src/lib/i18n/en.ts
index 2af7398ddb..2bdfce0c15 100644
--- a/app/src/lib/i18n/en.ts
+++ b/app/src/lib/i18n/en.ts
@@ -3328,7 +3328,7 @@ const en: TranslationMap = {
     'OpenHuman joins calls silently and handles notes and follow-ups automatically.',
   'skills.meetingBots.bannerTitle': 'Send OpenHuman to your next meeting',
   'skills.meetingBots.busyTitle': 'OpenHuman is busy',
-  'skills.meetingBots.comingSoon': '{label} coming soon',
+  'skills.meetingBots.comingSoon': 'coming soon',
   'skills.meetingBots.couldNotStartTitle': 'Could not start OpenHuman',
   'skills.meetingBots.displayName': 'Display name',
   'skills.meetingBots.failedToStart': 'Failed to start OpenHuman.',
@@ -3347,7 +3347,7 @@ const en: TranslationMap = {
   'skills.meetingBots.platforms.gmeet': 'Google Meet',
   'skills.meetingBots.platforms.teams': 'Microsoft Teams',
   'skills.meetingBots.platforms.zoom': 'Zoom',
-  'skills.meetingBots.sendTo': 'Send to {label}',
+  'skills.meetingBots.sendTo': 'Send to',
   'skills.meetingBots.soonSuffix': 'soon',
   'skills.meetingBots.starting': 'Starting…',
   'skills.resource.preview.closeAriaLabel': 'Close preview',
diff --git a/app/src/services/__tests__/meetCallService.test.ts b/app/src/services/__tests__/meetCallService.test.ts
index b92c5be924..febf4ae6c2 100644
--- a/app/src/services/__tests__/meetCallService.test.ts
+++ b/app/src/services/__tests__/meetCallService.test.ts
@@ -41,23 +41,29 @@ describe('joinMeetCall', () => {
     const result = await joinMeetCall({
       meetUrl: 'https://meet.google.com/abc-defg-hij',
       displayName: 'Agent Alice',
+      ownerDisplayName: 'Owner Bob',
     });
 
     expect(callCoreRpc).toHaveBeenCalledWith({
       method: 'openhuman.meet_join_call',
       params: { meet_url: 'https://meet.google.com/abc-defg-hij', display_name: 'Agent Alice' },
     });
+    // owner_display_name is forwarded to the shell (not to the core's
+    // meet_join_call, which is stateless validation only) — assert on
+    // the shell args, not the core RPC params.
     expect(invoke).toHaveBeenCalledWith('meet_call_open_window', {
       args: {
         request_id: 'req-1',
         meet_url: 'https://meet.google.com/abc-defg-hij',
         display_name: 'Agent Alice',
+        owner_display_name: 'Owner Bob',
       },
     });
     expect(result).toEqual({
       requestId: 'req-1',
       meetUrl: 'https://meet.google.com/abc-defg-hij',
       displayName: 'Agent Alice',
+      ownerDisplayName: 'Owner Bob',
       windowLabel: 'meet-call-req-1',
     });
   });
@@ -65,7 +71,11 @@ describe('joinMeetCall', () => {
   it('throws if core rejects the request', async () => {
     vi.mocked(callCoreRpc).mockResolvedValueOnce({ ok: false } as never);
     await expect(
-      joinMeetCall({ meetUrl: 'https://meet.google.com/abc-defg-hij', displayName: 'Agent Alice' })
+      joinMeetCall({
+        meetUrl: 'https://meet.google.com/abc-defg-hij',
+        displayName: 'Agent Alice',
+        ownerDisplayName: 'Owner Bob',
+      })
     ).rejects.toThrow(/Core rejected/);
     expect(invoke).not.toHaveBeenCalled();
   });
@@ -80,10 +90,30 @@ describe('joinMeetCall', () => {
     } as never);
 
     await expect(
-      joinMeetCall({ meetUrl: 'https://meet.google.com/abc-defg-hij', displayName: 'Agent Alice' })
+      joinMeetCall({
+        meetUrl: 'https://meet.google.com/abc-defg-hij',
+        displayName: 'Agent Alice',
+        ownerDisplayName: 'Owner Bob',
+      })
     ).rejects.toThrow(/desktop app/);
     expect(invoke).not.toHaveBeenCalled();
   });
+
+  it('rejects an empty owner_display_name as a privacy-lock guard', async () => {
+    // Privacy lock: empty owner would fail closed at the core wake
+    // gate (no captions ever wake the bot). Surface the requirement
+    // up front so the user doesn't sit through a join only to find
+    // the bot silent — see feat/mascot-meet-flowA Plan C.
+    await expect(
+      joinMeetCall({
+        meetUrl: 'https://meet.google.com/abc-defg-hij',
+        displayName: 'Agent Alice',
+        ownerDisplayName: '   ',
+      })
+    ).rejects.toThrow(/your own name/i);
+    expect(callCoreRpc).not.toHaveBeenCalled();
+    expect(invoke).not.toHaveBeenCalled();
+  });
 });
 
 describe('closeMeetCall', () => {
diff --git a/app/src/services/meetCallService.ts b/app/src/services/meetCallService.ts
index 6ca0248c25..aa29eb3cef 100644
--- a/app/src/services/meetCallService.ts
+++ b/app/src/services/meetCallService.ts
@@ -15,12 +15,25 @@ import { isTauri } from '../utils/tauriCommands/common';
 import { apiClient } from './apiClient';
 import { callCoreRpc } from './coreRpcClient';
 
-export type MeetJoinCallInput = { meetUrl: string; displayName: string };
+export type MeetJoinCallInput = {
+  meetUrl: string;
+  /** Bot's display name in Meet's "Your name" prompt. */
+  displayName: string;
+  /**
+   * The launching user's display name as it will appear in the Meet
+   * call. This is the *only* speaker the in-call wake-word gate will
+   * accept — captions from any other participant are dropped before
+   * tools can be dispatched. Empty / missing fails closed in core
+   * (no wakes fire) which is the safe default during the rollout.
+   */
+  ownerDisplayName?: string;
+};
 
 export type MeetJoinCallResult = {
   requestId: string;
   meetUrl: string;
   displayName: string;
+  ownerDisplayName: string;
   windowLabel: string;
 };
 
@@ -29,9 +42,19 @@ type CoreJoinResponse = { ok: boolean; request_id: string; meet_url: string; dis
 export async function joinMeetCall(input: MeetJoinCallInput): Promise<MeetJoinCallResult> {
   const meetUrl = input.meetUrl.trim();
   const displayName = input.displayName.trim();
+  const ownerDisplayName = (input.ownerDisplayName ?? '').trim();
 
   if (!meetUrl) throw new Error('Please paste a Google Meet link.');
   if (!displayName) throw new Error('Please enter a display name.');
+  // Owner name is the privacy lock — captions from anyone else are
+  // refused by the core wake gate. Surfacing the requirement up front
+  // keeps the user from sitting through the join only to find the bot
+  // ignores them; matches the message the inline alert would show.
+  if (!ownerDisplayName) {
+    throw new Error(
+      'Please enter your own name as it will appear in the Meet so OpenHuman knows who to listen to.'
+    );
+  }
   // Refuse early outside the desktop shell so the browser dev surface
   // (`pnpm dev`) doesn't mint a stray request_id on the core for a join
   // attempt that has no chance of opening a CEF window.
@@ -57,6 +80,12 @@ export async function joinMeetCall(input: MeetJoinCallInput): Promise<MeetJoinCa
         request_id: rpcResult.request_id,
         meet_url: rpcResult.meet_url,
         display_name: rpcResult.display_name,
+        // Owner name doesn't round-trip through meet_join_call (the
+        // RPC is platform-agnostic validation only) — pass it
+        // directly to the shell so the meet_audio start path can
+        // hand it to the wake-word gate. See feat/mascot-meet-flowA
+        // Plan C — owner-only privacy lock.
+        owner_display_name: ownerDisplayName,
       },
     });
   } catch (err) {
@@ -73,6 +102,7 @@ export async function joinMeetCall(input: MeetJoinCallInput): Promise<MeetJoinCa
     requestId: rpcResult.request_id,
     meetUrl: rpcResult.meet_url,
     displayName: rpcResult.display_name,
+    ownerDisplayName,
     windowLabel,
   };
 }
@@ -82,6 +112,48 @@ export async function closeMeetCall(requestId: string): Promise<boolean> {
   return invoke<boolean>('meet_call_close_window', { requestId });
 }
 
+/**
+ * One completed Meet call as persisted by the core in the JSONL
+ * recent-calls log (written by `handle_stop_session`). Same shape
+ * as `MeetCallRecord` in `src/openhuman/meet_agent/store.rs` —
+ * snake_case fields because the core surfaces them verbatim.
+ */
+export interface MeetCallRecord {
+  request_id: string;
+  meet_url: string;
+  bot_display_name: string;
+  owner_display_name: string;
+  started_at_ms: number;
+  ended_at_ms: number;
+  listened_seconds: number;
+  spoken_seconds: number;
+  turn_count: number;
+}
+
+interface CoreListCallsResponse {
+  ok: boolean;
+  calls: MeetCallRecord[];
+  count: number;
+}
+
+/**
+ * Fetch the most recent completed Meet calls (newest first). Used
+ * by the Skills "Meeting Bots" modal to render a history list
+ * underneath the join form. Returns an empty array on a fresh
+ * install (no recorded calls yet) — the core treats a missing
+ * JSONL file as "no rows" rather than an error.
+ */
+export async function listMeetCalls(limit = 20): Promise<MeetCallRecord[]> {
+  const result = await callCoreRpc<CoreListCallsResponse>({
+    method: 'openhuman.meet_agent_list_calls',
+    params: { limit },
+  });
+  if (!result?.ok) {
+    throw new Error('Core rejected the meet_agent_list_calls request.');
+  }
+  return result.calls ?? [];
+}
+
 /**
  * Backend-driven meet bot join (PR tinyhumansai/backend#773).
  *
diff --git a/src/openhuman/meet_agent/brain.rs b/src/openhuman/meet_agent/brain.rs
index 497874c40b..8be8fdbd29 100644
--- a/src/openhuman/meet_agent/brain.rs
+++ b/src/openhuman/meet_agent/brain.rs
@@ -32,25 +32,82 @@
 
 use base64::{engine::general_purpose::STANDARD as B64, Engine as _};
 use serde_json::{json, Value};
+use std::collections::HashMap;
+use std::sync::{Arc, OnceLock};
+use std::time::Duration;
+use tokio::sync::Mutex as TokioMutex;
 
 use super::session::registry;
 use super::types::{SessionEvent, SessionEventKind};
 use super::wav;
 
+use crate::openhuman::agent::harness::session::Agent;
+
+/// Process-wide cache of orchestrator Agents keyed by `request_id`.
+/// Each meet session reuses the same Agent across all its turns so
+/// the harness's in-memory `Agent.history` accumulates and the
+/// orchestrator can recall prior dialogue ("did I tell you to
+/// remember Friday?", "what did Alice say earlier?"). Without the
+/// cache each turn builds a fresh Agent, loses the prior turn's
+/// memory, and pays the 5-10s build cost every time.
+///
+/// Locked with `tokio::sync::Mutex` because we hold the inner
+/// `Arc<TokioMutex<Agent>>` lock across `run_single().await` —
+/// std::sync::Mutex cannot be held across await without breaking
+/// Send + leaking the lock on cancel.
+static AGENT_CACHE: OnceLock<TokioMutex<HashMap<String, Arc<TokioMutex<Agent>>>>> = OnceLock::new();
+
+fn agent_cache() -> &'static TokioMutex<HashMap<String, Arc<TokioMutex<Agent>>>> {
+    AGENT_CACHE.get_or_init(|| TokioMutex::new(HashMap::new()))
+}
+
+/// Drop the cached orchestrator for a meet session. Called from
+/// `handle_stop_session` so a finished call doesn't leak the Agent
+/// (each one carries memory tree + tool registry handles).
+pub async fn forget_session_agent(request_id: &str) {
+    let mut guard = agent_cache().lock().await;
+    if guard.remove(request_id).is_some() {
+        log::info!("[meet-agent] dropped cached orchestrator for request_id={request_id}");
+    }
+}
+
+/// Wall-clock ceiling on one agentic turn. Slack / Gmail fetches via
+/// Composio + per-message filtering + iteration-2 synthesis can hit
+/// 60-80s in the slow path. 90s gives the long integrations a chance
+/// to land. The turn_in_progress gate blocks new wakes during the
+/// wait, so the user cannot spawn parallel queries by re-asking.
+const AGENTIC_TURN_TIMEOUT_SECS: u64 = 90;
+
+/// Spoken filler played immediately after wake-word fires, before the
+/// (possibly slow) orchestrator+tool path runs. Bridges the 30-60s
+/// silence on slow integration paths. Kept short (~1s synth) so it
+/// doesn't intrude on fast greetings / time questions.
+const PREROLL_ACK_PHRASE: &str = "On it.";
+
 /// How many of the most recent `Heard` / `Spoke` events we feed back
 /// into the LLM as rolling conversation context. 12 ≈ a few minutes of
 /// captioned dialogue — enough for the model to follow a thread without
 /// blowing the prompt budget.
 const CONTEXT_EVENT_WINDOW: usize = 12;
-/// Spoken-reply ceiling. Each token is roughly ¾ of a word, so 220
-/// tokens ≈ 30 seconds of speech — long enough for a real answer, short
-/// enough that the model can't hijack the meeting.
-const REPLY_MAX_TOKENS: u32 = 220;
+/// Spoken-reply ceiling. Each token is roughly ¾ of a word, so 80
+/// tokens ≈ ~60 spoken words ≈ ~12 seconds. The system prompt asks for
+/// one short sentence, but reasoning-style backends ignore soft length
+/// hints and emit 800+ char monologues. Hard token cap keeps the bot
+/// interruptible regardless of model behaviour.
+const REPLY_MAX_TOKENS: u32 = 80;
 /// ElevenLabs model. `eleven_turbo_v2_5` strikes the best
 /// quality/latency balance; the older default the backend would pick
 /// (`eleven_monolingual_v1`) sounds noticeably flatter.
 const TTS_MODEL_ID: &str = "eleven_turbo_v2_5";
 
+/// Hard ceiling on reply characters fed to TTS. The LLM is asked to be
+/// concise but reasoning models still emit 800+ char paragraphs. Cap
+/// drops everything past the first sentence boundary at-or-before
+/// this index, falling back to a raw char cut when no boundary fits.
+/// ~25s of speech at average prosody — keeps the bot interruptible
+/// and prevents the "60s monologue / can't talk over it" loop.
+const MAX_TTS_CHARS: usize = 400;
+
 /// Minimum samples below which we skip the brain turn entirely.
 /// 250 ms @ 16 kHz — under this, VAD almost certainly fired on a
 /// transient (cough, click) rather than real speech.
@@ -61,6 +118,334 @@ const MIN_TURN_SAMPLES: usize = 4_000;
 /// the ops boundary check rejects anything else outright.
 const SAMPLE_RATE_HZ: u32 = super::ops::REQUIRED_SAMPLE_RATE;
 
+/// Classify a non-owner caption that tripped the wake word. The
+/// gate has already decided the speaker isn't authorised; this
+/// picks between a friendly hi-back (greeting / pleasantry) and
+/// a polite refusal (real task ask). Matching is conservative:
+/// when the post-wake tail is empty OR only contains greeting
+/// words, treat it as a greeting. Anything else is assumed to be
+/// a task ask.
+fn classify_unauthorized_intent(caption_text: &str) -> UnauthorizedIntent {
+    // Lift the bit of text that comes after the matched wake
+    // phrase so we don't get fooled by the wake itself ("hey
+    // openhuman" obviously contains "hey").
+    let lower = caption_text.to_ascii_lowercase();
+    let wake_phrases = [
+        "hey open human",
+        "hi open human",
+        "hello open human",
+        "hey openhuman",
+        "hi openhuman",
+        "hello openhuman",
+        "open human",
+        "openhuman",
+    ];
+    let tail = wake_phrases
+        .iter()
+        .filter_map(|p| lower.find(p).map(|i| &lower[i + p.len()..]))
+        .next()
+        .unwrap_or(&lower);
+    // Strip punctuation / common filler so "hi there!" reduces to
+    // ["hi", "there"]. Keeping the word list cheap and English-only
+    // for v1; the locale-aware story lands with multilingual TTS.
+    let words: Vec<&str> = tail
+        .split(|c: char| !c.is_ascii_alphanumeric())
+        .filter(|w| !w.is_empty())
+        .collect();
+    if words.is_empty() {
+        return UnauthorizedIntent::Greeting;
+    }
+    const GREETING_WORDS: &[&str] = &[
+        "hi",
+        "hello",
+        "hey",
+        "yo",
+        "sup",
+        "howdy",
+        "greetings",
+        "hola",
+        "good",
+        "morning",
+        "afternoon",
+        "evening",
+        "night",
+        "there",
+        "everyone",
+        "all",
+        "folks",
+        "team",
+        "guys",
+        "yall",
+    ];
+    if words.iter().all(|w| GREETING_WORDS.contains(w)) {
+        UnauthorizedIntent::Greeting
+    } else {
+        UnauthorizedIntent::TaskAsk
+    }
+}
+
+/// Output of `classify_unauthorized_intent`. Drives whether the
+/// non-owner turn speaks a canned hi-back or routes the prompt
+/// through a toolless LLM (general-knowledge + safe deflection).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum UnauthorizedIntent {
+    /// Just a greeting — bot says hi back without offering tools.
+    Greeting,
+    /// Substantive question. Route to a toolless LLM with a strict
+    /// system prompt — answer general knowledge / casual chat,
+    /// refuse anything that would require the owner's personal
+    /// tools or data, and point the owner at the magic word
+    /// ("allow") if access is needed.
+    TaskAsk,
+}
+
+/// System prompt for the non-owner branch. The LLM has no tool
+/// surface attached and is told to refuse any request that would
+/// need the owner's personal data. Kept short and explicit so the
+/// model doesn't ad-lib a different boundary.
+fn non_owner_system_prompt(owner: &str) -> String {
+    let owner_label = if owner.trim().is_empty() {
+        "the meeting host"
+    } else {
+        owner.trim()
+    };
+    format!(
+        "\
+You are openhuman, an AI participant in a live Google Meet call. The speaker is NOT the call \
+owner — the owner is {owner_label}.\n\
+\n\
+WHAT YOU MAY DO:\n\
+- Answer general knowledge questions (history, science, math, definitions, weather concepts).\n\
+- Casual conversation, jokes, small talk, greetings.\n\
+- Explain what you are and what you can do at a high level.\n\
+\n\
+WHAT YOU MUST REFUSE (no exceptions):\n\
+- Anything that would require {owner_label}'s personal data: their Slack, Gmail, Calendar, \
+contacts, memory notes, files, schedule, integrations, or chat history.\n\
+- Sending messages, scheduling, reminding, creating, modifying or deleting any data on their \
+behalf.\n\
+- Revealing what {owner_label} has previously told you or stored with you.\n\
+\n\
+WHEN REFUSING: respond with exactly one short sentence pointing at the magic word, e.g. \
+\"That needs {owner_label}'s permission — {owner_label}, say 'allow' if you'd like me to help.\"\n\
+\n\
+OUTPUT FORMAT (strict):\n\
+- ONE short spoken sentence, max 25 words.\n\
+- Plain English. No markdown, bullets, code fences, or URLs.\n\
+- No meta-narration (\"I should…\", \"Let me…\", \"As an AI…\"). Just answer.\n\
+- Respond in ENGLISH ONLY regardless of the speaker's language — TTS is English-only.\n\
+"
+    )
+}
+
+/// Route a non-owner caption through the toolless chat-v1 LLM.
+/// Returns the spoken text — the caller TTS's it and enqueues.
+async fn llm_general_no_tools(prompt: &str, owner: &str) -> Result<String, String> {
+    let system_prompt = non_owner_system_prompt(owner);
+    // No rolling history for the non-owner path — each ask is a
+    // fresh conversation. Sharing history between owner turns and
+    // non-owner turns risks leaking the owner's tool-call results
+    // into a stranger-facing reply.
+    llm_meeting_basic(prompt, &[], &system_prompt).await
+}
+
+/// Friendly hi-back canned line when a non-owner just greets the
+/// bot. Kept short and warm; doesn't mention the owner / privacy
+/// gate at all — that's noise on a "hello".
+fn friendly_greeting_message(asker: &str) -> String {
+    let asker = asker.trim();
+    if asker.is_empty() {
+        "Hi there! Nice to meet you.".to_string()
+    } else {
+        format!("Hi {asker}! Nice to meet you.")
+    }
+}
+
+/// Spoken refusal when a non-owner trips the wake word. Built per
+/// call from the configured owner display name so the audible
+/// response names the actual person who has the keys, and tells
+/// the owner the magic word ("allow") to grant access. Kept short
+/// so it doesn't drown the conversation.
+fn soft_deny_message(asker: &str, owner: &str) -> String {
+    let asker = asker.trim();
+    let owner = owner.trim();
+    match (asker.is_empty(), owner.is_empty()) {
+        (true, true) => "Sorry, I only respond to my owner.".to_string(),
+        (true, false) => format!(
+            "Sorry, only {owner} can ask me things in this call. {owner}, say 'allow' if you'd like me to answer."
+        ),
+        (false, true) => format!("Sorry {asker}, I only respond to my owner."),
+        (false, false) => format!(
+            "Sorry {asker}, only {owner} can ask me things here. {owner}, say 'allow' to let them in."
+        ),
+    }
+}
+
+/// Recognise an "open the gate" intent from the owner's first words
+/// after the wake phrase. Conservative: only fires when the prompt
+/// begins with one of the canonical permit verbs so an unrelated
+/// owner query that happens to contain "allow" or "yes" deeper in
+/// the sentence isn't hijacked.
+///
+/// Returns `true` when the owner is explicitly granting access to
+/// the most-recently-refused asker. The caller still gates on
+/// session-level state (`take_pending_unauthorized`) — without a
+/// pending request the intent is meaningless and the prompt should
+/// just run as a normal LLM turn.
+fn looks_like_grant_intent(prompt: &str) -> bool {
+    let p = prompt.trim().to_ascii_lowercase();
+    if p.is_empty() {
+        return false;
+    }
+    // Whole-prompt matches first so short approvals ("allow", "yes")
+    // don't collide with longer prompts that happen to start with
+    // the same word.
+    matches!(
+        p.as_str(),
+        "allow" | "yes" | "ok" | "okay" | "go ahead" | "let them in" | "let them ask" | "permit"
+    ) || p.starts_with("allow ")
+        || p.starts_with("let them")
+        || p.starts_with("let him")
+        || p.starts_with("let her")
+        || p.starts_with("go ahead")
+        || p.starts_with("yes go ahead")
+        || p.starts_with("yes let")
+        || p.starts_with("permit ")
+        || p.starts_with("you can answer")
+        || p.starts_with("you can tell")
+}
+
+/// Owner-grant path: the owner said "allow them" / "go ahead" /
+/// "let them in" after a non-owner's wake refusal. Add the
+/// previously-refused speaker to the per-call allowlist (so their
+/// next wake fires through to the orchestrator), and speak a
+/// short confirmation so they know they're in.
+pub async fn run_grant_turn(request_id: &str, grantee: &str) -> Result<bool, String> {
+    let grantee = grantee.trim();
+    let message = if grantee.is_empty() {
+        "Okay, you can ask me now.".to_string()
+    } else {
+        format!("Okay, {grantee} can ask me now.")
+    };
+    log::info!("[meet-agent] grant request_id={request_id} grantee=\"{grantee}\"");
+    // Apply the grant on the session BEFORE speaking — if TTS races
+    // and the grantee re-asks during synthesis, we want their next
+    // wake to fire through. Also cancel any prior outbound so the
+    // confirmation doesn't queue behind a half-drained refusal.
+    let _ = registry().with_session(request_id, |s| {
+        s.allow_speaker(grantee);
+        s.cancel_outbound();
+    });
+    let samples = match tts(&message).await {
+        Ok(samples) => samples,
+        Err(err) => {
+            log::warn!("[meet-agent] grant TTS failed request_id={request_id} err={err}");
+            stub_tts(&message).await
+        }
+    };
+    registry().with_session(request_id, |s| {
+        s.record_event(
+            SessionEventKind::Note,
+            format!("owner granted wake access to {grantee}"),
+        );
+        s.record_event(SessionEventKind::Spoke, message.clone());
+        if !samples.is_empty() {
+            s.enqueue_outbound_pcm(&samples, true);
+        }
+        // Clear the wake_active + turn_in_progress flags so the
+        // next caption (likely the grantee's actual question) can
+        // fire a new turn. Without this, the wake state from the
+        // owner's "allow them" prompt would coalesce the grantee's
+        // first real caption into a continuation of this grant turn.
+        s.wake_active = false;
+        s.turn_in_progress = false;
+        s.mark_turn_done();
+    })?;
+    Ok(true)
+}
+
+/// Soft-deny path: kick a canned-line TTS reply when the wake word
+/// fires from a non-owner. Branches on intent: a bare greeting gets
+/// a friendly hi-back; a substantive task ask gets the refusal that
+/// tells the owner how to grant access. Does NOT touch the
+/// orchestrator agent (no tool calls, no memory writes) — it's a
+/// single canned line, so the failure modes are limited to TTS errors.
+///
+/// `caption_text` is the full caption from `note_caption` so we can
+/// classify intent here; the session has already recorded the
+/// pending grant request and dispatch timestamp.
+pub async fn run_soft_deny_turn(
+    request_id: &str,
+    asker: &str,
+    caption_text: &str,
+) -> Result<bool, String> {
+    let owner = registry()
+        .with_session(request_id, |s| s.owner_display_name().to_string())
+        .unwrap_or_default();
+    let intent = classify_unauthorized_intent(caption_text);
+    // Greeting → canned hi (no network round-trip needed).
+    // TaskAsk  → toolless LLM. The LLM has no tools attached, has
+    //            an explicit "refuse personal-data asks" system
+    //            prompt, and is asked to point the owner at the
+    //            magic word when refusing. So a Q like "what's
+    //            the capital of France" lands as a normal answer
+    //            ("Paris"), while "read Nikhil's Slack" lands as
+    //            the refusal. The LLM picks; we don't classify.
+    let message = match intent {
+        UnauthorizedIntent::Greeting => friendly_greeting_message(asker),
+        UnauthorizedIntent::TaskAsk => match llm_general_no_tools(caption_text, &owner).await {
+            Ok(reply) if !reply.trim().is_empty() => reply,
+            Ok(_) => {
+                // Empty reply = LLM declined silently. Fall back to
+                // the explicit canned refusal so the speaker hears
+                // *something* and knows the bot didn't crash.
+                log::info!(
+                    "[meet-agent] non-owner LLM returned empty — using canned refusal request_id={request_id}"
+                );
+                soft_deny_message(asker, &owner)
+            }
+            Err(err) => {
+                log::warn!("[meet-agent] non-owner LLM failed request_id={request_id} err={err}");
+                soft_deny_message(asker, &owner)
+            }
+        },
+    };
+    log::info!(
+        "[meet-agent] soft-deny request_id={request_id} asker=\"{asker}\" owner=\"{owner}\" intent={intent:?}"
+    );
+    // Cancel any prior outbound so the refusal doesn't queue behind a
+    // half-drained reply from a previous turn.
+    let _ = registry().with_session(request_id, |s| s.cancel_outbound());
+    let samples = match tts(&message).await {
+        Ok(samples) => samples,
+        Err(err) => {
+            log::warn!("[meet-agent] soft-deny TTS failed request_id={request_id} err={err}");
+            stub_tts(&message).await
+        }
+    };
+    registry().with_session(request_id, |s| {
+        let kind = match intent {
+            UnauthorizedIntent::Greeting => "greeting",
+            UnauthorizedIntent::TaskAsk => "refusal",
+        };
+        s.record_event(
+            SessionEventKind::Note,
+            format!("soft-deny ({kind}): {asker} unauthorised wake"),
+        );
+        s.record_event(SessionEventKind::Spoke, message.clone());
+        if !samples.is_empty() {
+            s.enqueue_outbound_pcm(&samples, true);
+        }
+        // NB: do NOT call `mark_turn_done` here — that's the
+        // owner-min-turn-gap stamp, and we want the owner to be
+        // able to wake (e.g. say "allow them") within seconds of a
+        // refusal. The session's own `UNAUTHORIZED_COOLDOWN_MS` is
+        // what guards against a soft-deny loop from the same
+        // non-owner speaker.
+    })?;
+    Ok(true)
+}
+
 /// Caption-driven turn. Drains the session's pending wake-word prompt
 /// (assembled by `session::note_caption`) and runs LLM → TTS → enqueue
 /// outbound. Skips STT entirely — the captions are already text.
@@ -77,36 +462,129 @@ pub async fn run_caption_turn(request_id: &str) -> Result<bool, String> {
     // a chance to assemble before we drain the prompt.
     tokio::time::sleep(std::time::Duration::from_millis(CAPTION_TURN_DELAY_MS)).await;
 
-    let (prompt, history) = match registry().with_session(request_id, |s| {
+    // When wake fires from a bare "hey openhuman" with no tail, the
+    // session returns None from take_pending_prompt — there's nothing
+    // to feed the LLM. Previously we silently bailed (`return Ok(false)`)
+    // which made the bot look broken to the user. Treat empty-tail wake
+    // as a "say hi back" greeting cue: synthesize a short ack so the
+    // user gets audible proof that the caption→wake→speak loop is
+    // wired up end-to-end.
+    //
+    // Also: drop any queued outbound PCM from the previous turn.
+    // Reasoning-model replies can run 60+ seconds; if the user re-fires
+    // the wake mid-reply we need to stop the old speech rather than
+    // play the entire backlog before the new reply starts. This makes
+    // the bot interruptible from the user's side.
+    let (prompt, history, was_bare_wake) = match registry().with_session(request_id, |s| {
+        // Mark turn as in-flight so note_caption refuses to fire new
+        // wakes until run_caption_turn returns. Without this, the
+        // user's continuing speech (or growing-caption re-fires)
+        // spawns 20 parallel agentic turns for one question and none
+        // of them complete inside the timeout.
+        s.turn_in_progress = true;
+        s.cancel_outbound();
         let prompt = s.take_pending_prompt();
         let history = recent_dialog_history(s.events(), CONTEXT_EVENT_WINDOW);
         (prompt, history)
     })? {
-        (Some(p), h) => (p, h),
-        (None, _) => return Ok(false),
+        (Some(p), h) => (p, h, false),
+        (None, h) => {
+            log::info!(
+                "[meet-agent] caption turn bare-wake (no tail) request_id={request_id} — replying with greeting ack"
+            );
+            ("hello".to_string(), h, true)
+        }
     };
     log::info!(
-        "[meet-agent] caption turn start request_id={request_id} prompt_chars={} history_msgs={}",
+        "[meet-agent] caption turn start request_id={request_id} prompt_chars={} history_msgs={} bare_wake={}",
         prompt.chars().count(),
         history.len(),
+        was_bare_wake,
     );
 
-    // Real LLM call. The model gets the rolling caption history plus
-    // the user's direct address and decides whether to respond, what
-    // to say, and how concise to be. It can also return an empty
-    // string when it concludes the message wasn't actually directed
-    // at it (false-positive wake word, side conversation).
-    let reply_text = match llm_meeting(&prompt, &history).await {
+    // Grant-intent fast path. When the owner says "hey openhuman,
+    // allow them" / "let them in" / "go ahead" after a non-owner
+    // wake refusal, treat the turn as a single-shot session-level
+    // grant rather than handing the prompt to the orchestrator.
+    // The pending grantee was captured by `note_caption` at refusal
+    // time and lives on the session for `PENDING_GRANT_WINDOW_MS`.
+    if !was_bare_wake && looks_like_grant_intent(&prompt) {
+        let pending = registry()
+            .with_session(request_id, |s| s.take_pending_unauthorized())
+            .ok()
+            .flatten();
+        if let Some(grantee) = pending {
+            return run_grant_turn(request_id, &grantee).await;
+        }
+        // No pending request to grant — fall through to the normal
+        // LLM path. The model can interpret "allow" however it
+        // wants from there; without a pending grantee we have no
+        // session-level meaning to attach to it.
+        log::info!(
+            "[meet-agent] grant-intent prompt detected but no pending request — falling through request_id={request_id}"
+        );
+    }
+
+    // Pre-roll filler. The orchestrator + integration tools take
+    // 30–60s on slow paths (Slack / Gmail / Calendar). Without an
+    // immediate acoustic cue, the user assumes the bot is broken and
+    // re-asks (which the turn_in_progress gate now blocks but still
+    // burns the call atmosphere). Speak a 2-word ack right away and
+    // enqueue with done=false so the real reply appends cleanly when
+    // it lands.
+    //
+    // Skip pre-roll on short prompts: greetings ("hi"), checks ("can
+    // you hear me", "are you there"), time questions ("what's the
+    // time"), and other trivial asks the agent answers in 2-5s
+    // without tools — those don't need the ack, and "On it. Yes, I
+    // can hear you" sounds redundant. The 50-char threshold is a
+    // rough proxy; real second-brain questions ("am I free Friday
+    // afternoon for a 30 min slot") are almost always longer.
+    const PREROLL_SKIP_PROMPT_CHARS: usize = 50;
+    if !was_bare_wake && prompt.chars().count() > PREROLL_SKIP_PROMPT_CHARS {
+        if let Ok(ack_pcm) = tts(PREROLL_ACK_PHRASE).await {
+            let _ = registry().with_session(request_id, |s| {
+                s.enqueue_outbound_pcm(&ack_pcm, false);
+            });
+            log::info!(
+                "[meet-agent] pre-roll ack queued request_id={request_id} samples={}",
+                ack_pcm.len()
+            );
+        } else {
+            log::debug!(
+                "[meet-agent] pre-roll ack synth failed request_id={request_id} — skipping pre-roll"
+            );
+        }
+    }
+
+    // Route the turn through the FULL orchestrator agent first — it
+    // owns the user's connected integrations, memory tree, MCP
+    // clients and skills, so it can actually answer "is my Friday
+    // free", "what did Alice say about the deploy", etc. Falls back
+    // to the bare chat-completions path on orchestrator build /
+    // timeout / RPC error so a config-degraded environment still
+    // produces audible output instead of dead air.
+    let reply_text = match llm_meeting_agentic(&prompt, request_id).await {
         Ok(text) => text,
-        Err(err) => {
-            log::warn!("[meet-agent] caption-turn LLM failed request_id={request_id} err={err}");
+        Err(agentic_err) => {
+            // Do NOT fall back to basic LLM. The basic path has no
+            // tool access, so on a calendar/slack/gmail question it
+            // confidently hallucinates "I don't have access" — which
+            // is the WRONG answer and worse than silence. Speak a
+            // short canned "let me get back to you" ack so the user
+            // knows the question was heard but the bot couldn't
+            // resolve it in time, then drop the prompt. The user
+            // can re-ask (turn_in_progress gate clears as we exit).
+            log::warn!(
+                "[meet-agent] agentic turn failed — speaking polite ack instead of toolless fallback request_id={request_id} err={agentic_err}"
+            );
             let _ = registry().with_session(request_id, |s| {
                 s.record_event(
                     SessionEventKind::Note,
-                    format!("LLM failure (using ack): {err}"),
+                    format!("agentic path failed; speaking ack: {agentic_err}"),
                 );
             });
-            pick_ack_phrase(&prompt).to_string()
+            "Let me get back to you on that.".to_string()
         }
     };
 
@@ -144,12 +622,22 @@ pub async fn run_caption_turn(request_id: &str) -> Result<bool, String> {
             );
         }
         s.turn_count += 1;
+        // Clear the in-flight gate so the next wake can fire. Done
+        // inside the same with_session so it lands in one critical
+        // section with the reply enqueue, even if the caller drops
+        // the future after this point.
+        s.turn_in_progress = false;
+        // Stamp turn-done time so note_caption's min-turn-gap
+        // backstop can suppress wakes that fire within 15s of this
+        // turn's completion (caption residue / repeat questions).
+        s.mark_turn_done();
     })?;
 
     log::info!(
-        "[meet-agent] caption turn done request_id={request_id} reply_chars={} synth_samples={}",
+        "[meet-agent] caption turn done request_id={request_id} reply_chars={} synth_samples={} reply_preview={:?}",
         reply_text.chars().count(),
-        synthesized.len()
+        synthesized.len(),
+        reply_text.chars().take(120).collect::<String>(),
     );
     Ok(true)
 }
@@ -178,11 +666,7 @@ fn pick_ack_phrase(prompt: &str) -> &'static str {
 /// turn actually ran, `Ok(false)` when the inbound buffer was below the
 /// floor.
 pub async fn run_turn(request_id: &str) -> Result<bool, String> {
-    let (drained, history) = registry().with_session(request_id, |s| {
-        let drained = s.drain_inbound();
-        let history = recent_dialog_history(s.events(), CONTEXT_EVENT_WINDOW);
-        (drained, history)
-    })?;
+    let drained = registry().with_session(request_id, |s| s.drain_inbound())?;
     if drained.len() < MIN_TURN_SAMPLES {
         log::debug!(
             "[meet-agent] skipping turn request_id={request_id} samples={}",
@@ -221,18 +705,20 @@ pub async fn run_turn(request_id: &str) -> Result<bool, String> {
         heard.chars().count()
     );
 
-    // ─── LLM ────────────────────────────────────────────────────────
-    let reply_text = match llm_meeting(&heard, &history).await {
+    // ─── LLM (agentic only; no basic-LLM fallback to avoid toolless hallucinations) ─
+    let reply_text = match llm_meeting_agentic(&heard, request_id).await {
         Ok(text) => text,
-        Err(err) => {
-            log::warn!("[meet-agent] LLM failed request_id={request_id} err={err}");
+        Err(agentic_err) => {
+            log::warn!(
+                "[meet-agent] STT-path agentic failed — speaking polite ack request_id={request_id} err={agentic_err}"
+            );
             let _ = registry().with_session(request_id, |s| {
                 s.record_event(
                     SessionEventKind::Note,
-                    format!("LLM failure (using stub): {err}"),
+                    format!("agentic path failed; speaking ack: {agentic_err}"),
                 );
             });
-            stub_llm(&heard).await
+            "Let me get back to you on that.".to_string()
         }
     };
 
@@ -302,38 +788,220 @@ async fn stt(samples: &[i16]) -> Result<String, String> {
 /// at it (intent classification — emit empty string when not), and
 /// (b) responding conversationally and concisely when it is.
 const MEETING_SYSTEM_PROMPT: &str = "\
-You are OpenHuman, an AI assistant joining a live Google Meet call as a participant. \
-The meeting transcript is provided as prior turns where `user` lines are captions \
-spoken by humans on the call (sometimes prefixed with their name) and `assistant` \
-lines are things you previously said out loud. The latest `user` message is the \
-utterance you are deciding how to respond to.\n\
+You are OpenHuman, joining a live Google Meet call by voice. Every word you \
+produce will be spoken aloud over the call. The transcript shows `user` lines \
+(humans on the call, sometimes prefixed with a name) and `assistant` lines \
+(things you previously said out loud).\n\
 \n\
-Decide first: was this latest utterance actually directed at you? Strong signals: \
-the speaker addresses you by name (\"OpenHuman\", \"hey openhuman\"), asks a direct \
-question, or asks you to do something (note this, summarise, look up, remember, \
-remind, draft). Weak signals (do NOT respond): chit-chat between humans, \
-side conversation, your name appearing inside a longer thought aimed at someone \
-else, ambient transcription noise.\n\
+STRICT OUTPUT RULES — these are non-negotiable. The output is fed DIRECTLY \
+into TTS and spoken aloud verbatim. Any meta-text becomes audible bot \
+gibberish on a live call.\n\
+1. Output ONE sentence. Maximum 25 spoken words.\n\
+2. Plain spoken English. No markdown. No bullets. No code. No emoji.\n\
+3. NO chain-of-thought. NO reasoning. NO planning. NO <think> blocks. NO \
+preamble. NEVER write phrases like \"We need to…\", \"I should…\", \"Let me…\", \
+\"The user said…\", \"This is a greeting…\", \"So I should respond with…\", \
+\"My response is…\". Output ONLY the final answer that the user should hear.\n\
+4. Never repeat what the user said. Never narrate what you are about to do.\n\
+5. If the latest user line is not directly addressed to you, output the empty \
+string. Do not respond to side conversations or ambient speech.\n\
+6. Examples — good vs bad:\n\
+   User: \"hello\" → GOOD: \"Hey there.\"  BAD: \"The user said hello, so I should respond with a greeting.\"\n\
+   User: \"what's the time\" → GOOD: \"I don't have a clock right now.\"  BAD: \"We need to generate a single sentence. The user is asking the time.\"\n\
 \n\
-If it is NOT directed at you, output exactly the empty string. Stay silent. \
+Address-detection: respond when the user names you (\"OpenHuman\", \"hey \
+openhuman\"), asks a direct question of you, or gives a direct command \
+(remember, summarise, look up). Otherwise stay silent.\n\
 \n\
-If it IS directed at you:\n\
-  • Reply in 1–2 spoken sentences. Conversational, warm, direct. No filler.\n\
-  • Pronounce naturally — write the way a person speaks, not the way they type. \
-No markdown, no bullet lists, no code blocks, no emoji.\n\
-  • For dictation / note requests (\"remember…\", \"action item…\", \"follow up on…\"), \
-the note is already captured in the transcript log, so just acknowledge briefly \
-(\"Got it.\", \"Adding that.\") — don't read the note back.\n\
-  • For questions, answer directly with what you know; if you don't know, say so \
-in one sentence rather than guessing.\n\
-  • Never repeat verbatim what was said. Never describe what you're about to do — \
-just do it.\n\
+For unanswerable questions: say so in one sentence (\"I don't know that off \
+the top of my head\") instead of guessing or stalling.\n\
+For dictation / note requests: a 2-3 word ack (\"Got it.\", \"Noted.\"). Don't \
+read the note back.\n\
 ";
 
+/// Voice-frontend system-prompt directive prepended to the user
+/// utterance before it reaches the orchestrator. The orchestrator
+/// already has its own persona, tool catalogue, memory loader and
+/// connected integrations; this addendum just tells it the answer is
+/// going to be spoken aloud verbatim so it should reply in one short
+/// spoken sentence with no markdown / no chain-of-thought / no
+/// preamble. Wrapped in a delimiter so the orchestrator can't confuse
+/// the directive with the user's actual utterance.
+const MEET_VOICE_DIRECTIVE: &str = "\
+MEETING VOICE MODE — this conversation is happening live over voice in a Google Meet call.\n\
+\n\
+LANGUAGE: Respond in ENGLISH ONLY. Do not switch languages even if a user's name, prior memory, or transcript hint suggests another locale. The TTS engine is English-only; non-English output produces garbled audio.\n\
+\n\
+TOOL USE (encouraged):\n\
+- USE TOOLS whenever a tool can give a real answer. Calendar, email, slack, memory, integrations — \
+call them. Tool calls are invisible to the user and DO NOT count toward your reply word budget.\n\
+- If you need data from a tool to answer accurately, CALL THE TOOL. Do not guess from prior training. \
+Do not claim something is not connected before attempting to call its tool — the tool surface above \
+shows what is actually available right now.\n\
+- delegate_to_integrations_agent is your gateway to all connected provider integrations (calendar, \
+gmail, slack, etc.). Use it when the user asks about their schedule, mail, messages, or any other \
+integration-backed data.\n\
+\n\
+FINAL SPOKEN REPLY (strict — this is the only part the user hears):\n\
+- After tool work is done, output ONE short spoken sentence, max 25 words.\n\
+- Plain spoken English only. No markdown. No bullets. No code. No URLs.\n\
+- No meta-narration. Do not say \"Let me check…\", \"I will look…\", \"The user is asking…\", \
+\"We need to…\", \"I should…\". Just give the answer.\n\
+- If the user is not directly addressing you (chit-chat between humans, side conversation, your \
+name appearing inside a longer thought aimed at someone else), output an empty string and stay silent.\n\
+- For dictation / note requests (\"remember…\", \"action item…\", \"follow up on…\"), a 2-3 word \
+ack is enough (\"Got it.\", \"Noted.\").\n\
+- For genuinely unanswerable questions, say so in one short sentence rather than guessing.";
+
+/// First 12 chars of `request_id`, for log scoping. UUID prefixes are
+/// unique enough at one-meet-at-a-time to keep transcripts apart.
+fn short_id(id: &str) -> String {
+    id.chars().take(12).collect()
+}
+
+/// Route the meeting utterance through the FULL orchestrator agent —
+/// same path the chat UI and the webview meet handoff use. The
+/// orchestrator inherits the user's connected integrations, memory
+/// tree, MCP clients, skills, and the project-wide tool registry, so
+/// "is my Friday evening free", "did anyone in #eng ping me about
+/// the deploy", "remind me to mail Alice tomorrow" all answer with
+/// real data — not a guess from the model's training prior.
+///
+/// We rebuild the Agent per turn (cheap relative to the LLM call
+/// itself, since the registry is initialised once at startup) and
+/// wrap `run_single` in a 20s timeout so a slow tool iteration
+/// doesn't leave the meeting participant in silence indefinitely.
+///
+/// Errors propagate to the caller, which falls back to the bare
+/// chat-completions path (`llm_meeting_basic`) so a config /
+/// registry / token issue degrades to a polite reply instead of
+/// dead air.
+async fn llm_meeting_agentic(prompt: &str, request_id: &str) -> Result<String, String> {
+    // Get-or-build the per-meet cached Agent. First wake of a meet
+    // builds the orchestrator once (memory tree + MCP + tools — 5-10s
+    // cold); subsequent wakes reuse the same instance, so its
+    // in-memory history accumulates and the orchestrator can recall
+    // earlier dialogue without disk-resume corruption tripping the
+    // tool_calls / tool_message API constraint.
+    let agent_lock = get_or_build_agent_for_meet(request_id).await?;
+
+    // Lock for the duration of the turn. The lock is per-meet, so
+    // two distinct meet sessions can run agents in parallel; within
+    // one meet, turn_in_progress already prevents reentrancy. Held
+    // across run_single().await — that's why we use tokio::sync::Mutex.
+    let mut agent = agent_lock.lock().await;
+
+    // Per-turn refresh of the time-context block. The voice directive
+    // is baked into the system prompt at build time; the clock has
+    // to update each turn or the bot will tell the user it's still
+    // 2am ten minutes later. Prepend the time block to the user
+    // utterance instead of touching the system prompt suffix (which
+    // we can't change without rebuilding the Agent).
+    let now_local = chrono::Local::now();
+    let time_block = format!(
+        "[RIGHT-NOW CONTEXT — current local time: {} ({}), tz {}. \
+         Use this directly for any time/date question; do not call a tool.]",
+        now_local.format("%Y-%m-%d %H:%M:%S"),
+        now_local.format("%A"),
+        now_local.format("%:z"),
+    );
+    let user_message = format!("{time_block}\n\n{prompt}");
+
+    // Per-turn unique definition_name for the transcript file. The
+    // Agent's in-memory history persists across turns (cache); only
+    // the on-disk transcript filename rolls per turn so a kill
+    // mid-tool-call doesn't poison the next process's resume path.
+    let now_ms = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.as_millis())
+        .unwrap_or(0);
+    agent.set_agent_definition_name(format!(
+        "orchestrator_meet_{}_{now_ms}",
+        short_id(request_id)
+    ));
+
+    log::info!(
+        "[meet-agent] agentic turn dispatch request_id={request_id} prompt_chars={} cached_history_msgs={}",
+        prompt.chars().count(),
+        agent.history().len(),
+    );
+
+    let fut = agent.run_single(&user_message);
+    let reply = match tokio::time::timeout(Duration::from_secs(AGENTIC_TURN_TIMEOUT_SECS), fut)
+        .await
+    {
+        Ok(Ok(text)) => text,
+        Ok(Err(e)) => {
+            return Err(format!("[meet-agent] orchestrator run_single failed: {e}"));
+        }
+        Err(_elapsed) => {
+            log::warn!(
+                "[meet-agent] agentic turn timed out request_id={request_id} after {}s — speaking polite ack",
+                AGENTIC_TURN_TIMEOUT_SECS
+            );
+            return Err(format!(
+                "agentic timeout after {AGENTIC_TURN_TIMEOUT_SECS}s"
+            ));
+        }
+    };
+
+    Ok(strip_for_speech(&reply))
+}
+
+/// Get the cached orchestrator for this meet, or build it on first
+/// call. Returns an `Arc<TokioMutex<Agent>>` so the caller can lock
+/// across the run_single().await.
+async fn get_or_build_agent_for_meet(request_id: &str) -> Result<Arc<TokioMutex<Agent>>, String> {
+    {
+        let cache = agent_cache().lock().await;
+        if let Some(existing) = cache.get(request_id) {
+            return Ok(existing.clone());
+        }
+    }
+
+    // Cold build. Use the with_profile builder — same canonical path
+    // the web channel (chat UI) uses at channels/providers/web.rs:1570,
+    // which is what wires the user's connected integrations + delegation
+    // tools. profile_prompt_suffix carries the meet voice directive.
+    let config = crate::openhuman::config::ops::load_config_with_timeout().await?;
+    let mut agent = Agent::from_config_for_agent_with_profile(
+        &config,
+        "orchestrator",
+        None,
+        Some(MEET_VOICE_DIRECTIVE.to_string()),
+    )
+    .map_err(|e| format!("[meet-agent] orchestrator build failed: {e}"))?;
+
+    // Per-meet event context so the harness scopes its observability
+    // events to this request_id instead of colliding with the chat UI.
+    agent.set_event_context(format!("meet_{request_id}"), "meet_agent");
+    agent.set_agent_definition_name(format!("orchestrator_meet_{}", short_id(request_id)));
+
+    log::info!("[meet-agent] orchestrator built + cached for request_id={request_id}");
+
+    let arc = Arc::new(TokioMutex::new(agent));
+    agent_cache()
+        .lock()
+        .await
+        .insert(request_id.to_string(), arc.clone());
+    Ok(arc)
+}
+
 /// Build a chat-completions request from rolling meeting history plus
 /// the current user prompt, post it through the backend, and return
 /// the assistant's reply (trimmed, possibly empty).
-async fn llm_meeting(prompt: &str, history: &[ConversationTurn]) -> Result<String, String> {
+///
+/// Used as a fallback when the orchestrator path
+/// (`llm_meeting_agentic`) cannot be built — missing config,
+/// registry not initialised, no session token. The orchestrator path
+/// gives memory/tool/integration access; this bare path only gets
+/// the rolling caption history. Acceptable degradation so the bot
+/// doesn't go silent in a config-degraded environment.
+async fn llm_meeting_basic(
+    prompt: &str,
+    history: &[ConversationTurn],
+    system_prompt: &str,
+) -> Result<String, String> {
     use crate::api::config::effective_backend_api_url;
     use crate::api::jwt::get_session_token;
     use crate::api::BackendOAuthClient;
@@ -349,14 +1017,20 @@ async fn llm_meeting(prompt: &str, history: &[ConversationTurn]) -> Result<Strin
     let client = BackendOAuthClient::new(&api_url).map_err(|e| e.to_string())?;
 
     let mut messages: Vec<Value> = Vec::with_capacity(history.len() + 2);
-    messages.push(json!({ "role": "system", "content": MEETING_SYSTEM_PROMPT }));
+    messages.push(json!({ "role": "system", "content": system_prompt }));
     for turn in history {
         messages.push(json!({ "role": turn.role, "content": turn.content }));
     }
     messages.push(json!({ "role": "user", "content": prompt }));
 
     let body = json!({
-        "model": "agentic-v1",
+        // chat-v1 = conversational non-reasoning model. agentic-v1 /
+        // reasoning-v1 leak their chain-of-thought as plain text
+        // ("We need to generate a single sentence…") into the response
+        // body when streamed without the structured thinking_delta
+        // channel — which TTS then reads aloud. chat-v1 produces a
+        // direct user-facing answer, which is what we want over voice.
+        "model": "chat-v1",
         "temperature": 0.5,
         "max_tokens": REPLY_MAX_TOKENS,
         "messages": messages,
@@ -382,6 +1056,40 @@ async fn llm_meeting(prompt: &str, history: &[ConversationTurn]) -> Result<Strin
 /// code, leading bullets). Keep punctuation that affects prosody
 /// (commas, periods, question marks) intact.
 fn strip_for_speech(text: &str) -> String {
+    // Strip reasoning-model <think>...</think> blocks before we strip
+    // markdown. DeepSeek / GMI / qwen-style reasoning models emit
+    // their internal chain-of-thought wrapped in <think>...</think>
+    // tags ahead of the user-facing reply. Without this, TTS reads
+    // the entire monologue aloud — which on a 60s+ reasoning trace
+    // produces a minute of bot speech the user never asked for.
+    // Multiple non-overlapping blocks are stripped in sequence; an
+    // unclosed <think> at the end (truncated output) drops everything
+    // from the tag onwards.
+    let mut cleaned = String::with_capacity(text.len());
+    let mut rest = text;
+    loop {
+        match rest.find("<think>") {
+            Some(open) => {
+                cleaned.push_str(&rest[..open]);
+                let after = &rest[open + "<think>".len()..];
+                match after.find("</think>") {
+                    Some(close) => {
+                        rest = &after[close + "</think>".len()..];
+                    }
+                    None => {
+                        // Unclosed tag → drop the rest as reasoning.
+                        break;
+                    }
+                }
+            }
+            None => {
+                cleaned.push_str(rest);
+                break;
+            }
+        }
+    }
+    let text = cleaned.trim();
+
     let mut out = String::with_capacity(text.len());
     let mut in_code = false;
     for line in text.lines() {
@@ -407,7 +1115,96 @@ fn strip_for_speech(text: &str) -> String {
         }
         out.push_str(&cleaned);
     }
-    out.trim().to_string()
+    let trimmed = out.trim().to_string();
+    let de_reasoned = strip_untagged_reasoning(&trimmed);
+    cap_for_speech(&de_reasoned, MAX_TTS_CHARS)
+}
+
+/// Strip reasoning-style preamble that reasoning models leak as plain
+/// text (no `<think>` tags) — phrases like "We need to generate…",
+/// "I should respond with…", "The user said…", "Let me think…".
+/// Heuristic: drop sentences whose lowercased trim matches a known
+/// reasoning opener; if everything is reasoning, return only the last
+/// sentence (final conclusion). If no signal, return input untouched.
+fn strip_untagged_reasoning(text: &str) -> String {
+    if text.is_empty() {
+        return text.to_string();
+    }
+    const REASONING_OPENERS: &[&str] = &[
+        "we need to",
+        "we should",
+        "i need to",
+        "i should",
+        "i will",
+        "let me ",
+        "first,",
+        "the user said",
+        "the user is",
+        "the user asked",
+        "the user wants",
+        "this is a",
+        "this seems",
+        "so i should",
+        "so the response",
+        "so my response",
+        "okay, so",
+        "alright,",
+        "given that",
+        "since the user",
+        "the assistant",
+        "the response should",
+        "my response",
+        "to respond",
+        "responding with",
+    ];
+    let sentences: Vec<&str> = text
+        .split_inclusive(|c: char| matches!(c, '.' | '!' | '?'))
+        .map(str::trim)
+        .filter(|s| !s.is_empty())
+        .collect();
+    if sentences.is_empty() {
+        return text.to_string();
+    }
+    let kept: Vec<&str> = sentences
+        .iter()
+        .filter(|s| {
+            let lc = s.to_lowercase();
+            !REASONING_OPENERS
+                .iter()
+                .any(|opener| lc.starts_with(opener))
+        })
+        .copied()
+        .collect();
+    if kept.is_empty() {
+        // Everything was reasoning — return the last sentence as the
+        // probable conclusion, lower-cased openers stripped.
+        return sentences.last().map(|s| s.to_string()).unwrap_or_default();
+    }
+    kept.join(" ")
+}
+
+/// Truncate `text` to at most `max_chars` characters, preferring to
+/// cut at the last sentence terminator (`.`, `!`, `?`) inside the
+/// budget so the TTS doesn't trail off mid-clause. Falls back to a
+/// hard char cut + ellipsis when no terminator fits.
+fn cap_for_speech(text: &str, max_chars: usize) -> String {
+    let total = text.chars().count();
+    if total <= max_chars {
+        return text.to_string();
+    }
+    let prefix: String = text.chars().take(max_chars).collect();
+    if let Some(idx) = prefix.rfind(['.', '!', '?']) {
+        let end = idx
+            + prefix[idx..]
+                .chars()
+                .next()
+                .map(char::len_utf8)
+                .unwrap_or(1);
+        return prefix[..end].trim_end().to_string();
+    }
+    let mut out = prefix.trim_end().to_string();
+    out.push('…');
+    out
 }
 
 /// One rolling-history entry handed to the LLM.
@@ -652,4 +1449,120 @@ mod tests {
         assert_eq!(strip_for_speech(""), "");
         assert_eq!(strip_for_speech("   \n  "), "");
     }
+
+    #[test]
+    fn soft_deny_message_names_both_owner_and_asker() {
+        let line = soft_deny_message("Bob", "Alice");
+        assert!(line.contains("Bob"), "must address the asker: {line}");
+        assert!(line.contains("Alice"), "must name the owner: {line}");
+        assert!(
+            line.to_lowercase().contains("allow"),
+            "must hint the magic word: {line}"
+        );
+    }
+
+    #[test]
+    fn soft_deny_message_handles_missing_names_gracefully() {
+        // No asker, no owner — should still be a polite English sentence,
+        // not a templated stub with empty placeholders.
+        let line = soft_deny_message("", "");
+        assert!(!line.is_empty());
+        assert!(
+            !line.contains("{"),
+            "must not leak format placeholders: {line}"
+        );
+    }
+
+    #[test]
+    fn looks_like_grant_intent_accepts_canonical_phrases() {
+        // Whole-prompt approvals.
+        for phrase in ["allow", "yes", "ok", "okay", "go ahead", "permit"] {
+            assert!(
+                looks_like_grant_intent(phrase),
+                "must accept bare approval phrase: {phrase}"
+            );
+        }
+        // Common longer forms.
+        for phrase in [
+            "allow them",
+            "allow Bob to ask",
+            "let them in",
+            "let them ask",
+            "let her ask",
+            "go ahead and answer them",
+            "yes go ahead",
+            "permit Bob",
+            "you can tell Bob",
+        ] {
+            assert!(looks_like_grant_intent(phrase), "should accept: {phrase}");
+        }
+    }
+
+    #[test]
+    fn classify_unauthorized_intent_treats_bare_wake_as_greeting() {
+        // Empty tail after the wake phrase — the non-owner just
+        // said "hey openhuman" with nothing else. Friendly hi-back
+        // is the right call, not a refusal.
+        assert_eq!(
+            classify_unauthorized_intent("hey openhuman"),
+            UnauthorizedIntent::Greeting
+        );
+        assert_eq!(
+            classify_unauthorized_intent("Hi openhuman."),
+            UnauthorizedIntent::Greeting
+        );
+    }
+
+    #[test]
+    fn classify_unauthorized_intent_treats_filler_as_greeting() {
+        // Common pleasantries that contain greeting words only.
+        for text in [
+            "hello openhuman there",
+            "hi openhuman everyone",
+            "hey openhuman hi",
+            "hey openhuman good morning",
+        ] {
+            assert_eq!(
+                classify_unauthorized_intent(text),
+                UnauthorizedIntent::Greeting,
+                "should be greeting: {text}"
+            );
+        }
+    }
+
+    #[test]
+    fn classify_unauthorized_intent_flags_task_asks() {
+        // Substantive task asks — refuse + tell owner how to grant.
+        for text in [
+            "hey openhuman read my slack",
+            "hi openhuman what's on alice's calendar",
+            "openhuman send the report",
+            "hello openhuman remember the launch",
+        ] {
+            assert_eq!(
+                classify_unauthorized_intent(text),
+                UnauthorizedIntent::TaskAsk,
+                "should be task: {text}"
+            );
+        }
+    }
+
+    #[test]
+    fn looks_like_grant_intent_rejects_unrelated_prompts() {
+        // Words that happen to contain "allow" / "yes" mid-prompt
+        // shouldn't hijack a normal question — the matcher only
+        // honors prompts that BEGIN with a permit verb.
+        for phrase in [
+            "what's on my calendar today",
+            "did i allow that meeting earlier",
+            "yesterday's notes please",
+            "remind me to ok the budget",
+            "permittivity of free space",
+        ] {
+            assert!(
+                !looks_like_grant_intent(phrase),
+                "must not match unrelated prompt: {phrase}"
+            );
+        }
+    }
 }
diff --git a/src/openhuman/meet_agent/mod.rs b/src/openhuman/meet_agent/mod.rs
index 8cf60bdae0..4207171bf5 100644
--- a/src/openhuman/meet_agent/mod.rs
+++ b/src/openhuman/meet_agent/mod.rs
@@ -39,6 +39,7 @@ pub mod ops;
 pub mod rpc;
 pub mod schemas;
 pub mod session;
+pub mod store;
 pub mod types;
 pub mod wav;
 
diff --git a/src/openhuman/meet_agent/rpc.rs b/src/openhuman/meet_agent/rpc.rs
index 9c604db25e..25442f652e 100644
--- a/src/openhuman/meet_agent/rpc.rs
+++ b/src/openhuman/meet_agent/rpc.rs
@@ -18,12 +18,18 @@ use crate::rpc::RpcOutcome;
 
 use super::brain;
 use super::ops::VadEvent;
-use super::session::registry;
+use super::session::{registry, CaptionOutcome};
+use super::store::{self, MeetCallRecord};
 use super::types::{
-    PollSpeechRequest, PushCaptionRequest, PushListenPcmRequest, StartSessionRequest,
-    StopSessionRequest,
+    ListCallsRequest, ListCallsResponse, PollSpeechRequest, PushCaptionRequest,
+    PushListenPcmRequest, StartSessionRequest, StopSessionRequest,
 };
 
+/// Default `limit` for `handle_list_calls` when the caller omits one.
+/// Comfortably above the ~20 rows the UI shows initially while still
+/// keeping the response payload small.
+const LIST_CALLS_DEFAULT_LIMIT: usize = 50;
+
 const LOG_PREFIX: &str = "[meet-agent-rpc]";
 
 pub async fn handle_start_session(params: Map<String, Value>) -> Result<Value, String> {
@@ -31,10 +37,25 @@ pub async fn handle_start_session(params: Map<String, Value>) -> Result<Value, S
         .map_err(|e| format!("{LOG_PREFIX} invalid start_session params: {e}"))?;
 
     registry().start(&req.request_id, req.sample_rate_hz)?;
+    // Install the call-owner identity before any captions can arrive.
+    // The session is created with empty identities — which deliberately
+    // fails closed in note_caption — so racing a push_caption against
+    // this with_session call would simply drop the early caption rather
+    // than leak it. Done as a second step (vs threading through
+    // `start`) so the registry's start signature stays unchanged and
+    // existing callers (legacy shell variants, smoke tests) don't have
+    // to be updated in lockstep.
+    registry().with_session(&req.request_id, |s| {
+        s.set_identities(&req.owner_display_name, &req.bot_display_name);
+        s.set_meet_url(&req.meet_url);
+    })?;
     log::info!(
-        "{LOG_PREFIX} start_session request_id={} sample_rate_hz={}",
+        "{LOG_PREFIX} start_session request_id={} sample_rate_hz={} \
+         owner_chars={} bot_chars={}",
         req.request_id,
-        req.sample_rate_hz
+        req.sample_rate_hz,
+        req.owner_display_name.chars().count(),
+        req.bot_display_name.chars().count()
     );
 
     RpcOutcome::new(
@@ -83,28 +104,69 @@ pub async fn handle_push_caption(params: Map<String, Value>) -> Result<Value, St
     let req: PushCaptionRequest = serde_json::from_value(Value::Object(params))
         .map_err(|e| format!("{LOG_PREFIX} invalid push_caption params: {e}"))?;
 
-    let wake_fired = registry().with_session(&req.request_id, |s| {
+    // Diagnostic: log the caption text + match outcome so we can tell
+    // from the dev:app stdout exactly what the wake-word matcher saw.
+    // Truncate to 120 chars to avoid blowing up the log line. This is
+    // safe to leave on for now — captions are already broadcast to all
+    // participants in the meeting; nothing here that isn't on the wire.
+    let preview: String = req.text.chars().take(120).collect();
+    let outcome = registry().with_session(&req.request_id, |s| {
         s.note_caption(&req.speaker, &req.text, req.ts_ms)
     })?;
+    log::info!(
+        "{LOG_PREFIX} push_caption request_id={} speaker={} text=\"{}\" outcome={:?}",
+        req.request_id,
+        req.speaker,
+        preview,
+        outcome,
+    );
 
-    if wake_fired {
-        log::info!(
-            "{LOG_PREFIX} wake word fired request_id={} speaker={}",
-            req.request_id,
-            req.speaker
-        );
-        let request_id = req.request_id.clone();
-        tokio::spawn(async move {
-            if let Err(err) = brain::run_caption_turn(&request_id).await {
-                log::warn!("{LOG_PREFIX} caption-turn failed request_id={request_id} err={err}");
-            }
-        });
+    // Branch on the gate's verdict:
+    //   - WakeFired         → kick the normal LLM+TTS turn
+    //   - UnauthorizedWake  → kick a soft-deny canned TTS turn so the
+    //                          non-owner gets an audible "sorry, only
+    //                          <owner> can ask" and the owner is told
+    //                          how to grant them access
+    //   - Ignored           → no audible response
+    let turn_started = matches!(outcome, CaptionOutcome::WakeFired);
+    match outcome {
+        CaptionOutcome::WakeFired => {
+            log::info!(
+                "{LOG_PREFIX} wake word fired request_id={} speaker={}",
+                req.request_id,
+                req.speaker
+            );
+            let request_id = req.request_id.clone();
+            tokio::spawn(async move {
+                if let Err(err) = brain::run_caption_turn(&request_id).await {
+                    log::warn!(
+                        "{LOG_PREFIX} caption-turn failed request_id={request_id} err={err}"
+                    );
+                }
+            });
+        }
+        CaptionOutcome::UnauthorizedWake { speaker, text } => {
+            log::info!(
+                "{LOG_PREFIX} unauthorized wake — soft-deny turn request_id={} speaker={}",
+                req.request_id,
+                speaker
+            );
+            let request_id = req.request_id.clone();
+            tokio::spawn(async move {
+                if let Err(err) = brain::run_soft_deny_turn(&request_id, &speaker, &text).await {
+                    log::warn!(
+                        "{LOG_PREFIX} soft-deny turn failed request_id={request_id} err={err}"
+                    );
+                }
+            });
+        }
+        CaptionOutcome::Ignored => {}
     }
 
     RpcOutcome::new(
         json!({
             "ok": true,
-            "turn_started": wake_fired,
+            "turn_started": turn_started,
         }),
         vec![],
     )
@@ -115,14 +177,19 @@ pub async fn handle_poll_speech(params: Map<String, Value>) -> Result<Value, Str
     let req: PollSpeechRequest = serde_json::from_value(Value::Object(params))
         .map_err(|e| format!("{LOG_PREFIX} invalid poll_speech params: {e}"))?;
 
-    let (pcm_base64, utterance_done) =
-        registry().with_session(&req.request_id, |s| s.poll_outbound())?;
+    let (pcm_base64, utterance_done, flush_pending) =
+        registry().with_session(&req.request_id, |s| {
+            let (b64, done) = s.poll_outbound();
+            let flush = s.take_flush_pending();
+            (b64, done, flush)
+        })?;
 
     RpcOutcome::new(
         json!({
             "ok": true,
             "pcm_base64": pcm_base64,
             "utterance_done": utterance_done,
+            "flush_pending": flush_pending,
         }),
         vec![],
     )
@@ -134,6 +201,11 @@ pub async fn handle_stop_session(params: Map<String, Value>) -> Result<Value, St
         .map_err(|e| format!("{LOG_PREFIX} invalid stop_session params: {e}"))?;
 
     let session = registry().stop(&req.request_id)?;
+    // Drop the cached orchestrator Agent for this meet so we don't
+    // leak its memory tree + tool registry handles after the call
+    // ends. The next start_session with the same request_id (rare
+    // but possible) will cold-build a fresh Agent.
+    super::brain::forget_session_agent(&req.request_id).await;
     log::info!(
         "{LOG_PREFIX} stop_session request_id={} listened={:.2}s spoken={:.2}s turns={}",
         session.request_id,
@@ -142,6 +214,32 @@ pub async fn handle_stop_session(params: Map<String, Value>) -> Result<Value, St
         session.turn_count
     );
 
+    // Persist a recent-calls record. Best-effort: a failed write
+    // never blocks the stop_session response — the call is already
+    // over by definition and the UI doesn't depend on the record
+    // existing to function. We log loudly enough that a broken
+    // persistence path is visible in dev:app stdout.
+    let record = MeetCallRecord {
+        request_id: session.request_id.clone(),
+        meet_url: session.meet_url().to_string(),
+        bot_display_name: session.bot_display_name().to_string(),
+        owner_display_name: session.owner_display_name().to_string(),
+        started_at_ms: session.started_at_ms(),
+        ended_at_ms: std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .map(|d| d.as_millis() as u64)
+            .unwrap_or(0),
+        listened_seconds: session.listened_seconds(),
+        spoken_seconds: session.spoken_seconds(),
+        turn_count: session.turn_count,
+    };
+    if let Err(err) = store::append_record(&record).await {
+        log::warn!(
+            "{LOG_PREFIX} append_record failed request_id={} err={err}",
+            session.request_id
+        );
+    }
+
     RpcOutcome::new(
         json!({
             "ok": true,
@@ -155,6 +253,26 @@ pub async fn handle_stop_session(params: Map<String, Value>) -> Result<Value, St
     .into_cli_compatible_json()
 }
 
+/// Return the most recent completed calls (newest first). Reads
+/// the per-user JSONL log written by `handle_stop_session`. Missing
+/// file → empty list (first run after install). Caller may pass an
+/// optional `limit`; we apply `LIST_CALLS_DEFAULT_LIMIT` when absent
+/// and `store::MAX_RECENT_CALLS` as the hard ceiling.
+pub async fn handle_list_calls(params: Map<String, Value>) -> Result<Value, String> {
+    let req: ListCallsRequest = serde_json::from_value(Value::Object(params))
+        .map_err(|e| format!("{LOG_PREFIX} invalid list_calls params: {e}"))?;
+    let limit = req.limit.unwrap_or(LIST_CALLS_DEFAULT_LIMIT);
+    let calls = store::read_recent(limit).await?;
+    let response = ListCallsResponse {
+        ok: true,
+        count: calls.len(),
+        calls,
+    };
+    let value = serde_json::to_value(&response)
+        .map_err(|e| format!("{LOG_PREFIX} serialize list_calls response: {e}"))?;
+    RpcOutcome::new(value, vec![]).into_cli_compatible_json()
+}
+
 /// Decode a base64 string of PCM16LE bytes into samples. Empty input is
 /// a "heartbeat" push (no audio this tick) and yields an empty Vec.
 fn decode_pcm16le_b64(b64: &str) -> Result<Vec<i16>, String> {
@@ -237,13 +355,25 @@ mod tests {
         }
         assert_eq!(last, json!(true), "expected a turn_started=true reply");
 
-        // Give the spawned turn a moment to enqueue audio.
-        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
-
-        let mut poll = Map::new();
-        poll.insert("request_id".into(), json!("rpc-push"));
-        let out = handle_poll_speech(poll).await.unwrap();
-        let pcm = out.get("pcm_base64").and_then(|v| v.as_str()).unwrap_or("");
+        // Wait up to 30s for the spawned brain turn to enqueue audio.
+        // The agentic path builds an orchestrator Agent on first wake
+        // (memory tree load + MCP init), which can take several seconds
+        // even in a minimal test environment. Failing the agentic path
+        // (no backend token) still falls through to a canned-ack TTS
+        // stub, so the queue eventually fills regardless. Poll every
+        // 100ms so the test exits the moment audio lands.
+        let mut pcm = String::new();
+        for _ in 0..300 {
+            let mut poll = Map::new();
+            poll.insert("request_id".into(), json!("rpc-push"));
+            let out = handle_poll_speech(poll).await.unwrap();
+            let chunk = out.get("pcm_base64").and_then(|v| v.as_str()).unwrap_or("");
+            if !chunk.is_empty() {
+                pcm = chunk.to_string();
+                break;
+            }
+            tokio::time::sleep(std::time::Duration::from_millis(100)).await;
+        }
         assert!(!pcm.is_empty(), "expected synthesized audio after turn");
 
         let mut stop = Map::new();
diff --git a/src/openhuman/meet_agent/schemas.rs b/src/openhuman/meet_agent/schemas.rs
index 1c1795a090..1f143c223b 100644
--- a/src/openhuman/meet_agent/schemas.rs
+++ b/src/openhuman/meet_agent/schemas.rs
@@ -40,6 +40,11 @@ const DEFS: &[Def] = &[
         schema: schema_stop_session,
         handler: handle_stop_session,
     },
+    Def {
+        function: "list_calls",
+        schema: schema_list_calls,
+        handler: handle_list_calls,
+    },
 ];
 
 pub fn all_controller_schemas() -> Vec<ControllerSchema> {
@@ -82,6 +87,28 @@ fn schema_start_session() -> ControllerSchema {
                 comment: "Sample rate of inbound/outbound PCM. Default 16000.",
                 required: false,
             },
+            FieldSchema {
+                name: "owner_display_name",
+                ty: TypeSchema::String,
+                comment: "Display name of the call owner (the user who launched the bot). \
+                     Used by the wake-word gate as the only speaker authorised to trigger \
+                     tool calls. Empty fails closed.",
+                required: false,
+            },
+            FieldSchema {
+                name: "bot_display_name",
+                ty: TypeSchema::String,
+                comment: "Display name the bot uses as its Meet participant tile. Used to drop \
+                     the bot's own captions (self-echo filter).",
+                required: false,
+            },
+            FieldSchema {
+                name: "meet_url",
+                ty: TypeSchema::String,
+                comment: "Normalised Meet URL the call joined. Persisted into the recent-calls \
+                     log on stop_session.",
+                required: false,
+            },
         ],
         outputs: vec![
             FieldSchema {
@@ -275,6 +302,42 @@ fn schema_stop_session() -> ControllerSchema {
     }
 }
 
+fn schema_list_calls() -> ControllerSchema {
+    ControllerSchema {
+        namespace: "meet_agent",
+        function: "list_calls",
+        description:
+            "Return the most recent completed Meet calls (newest first). Reads the JSONL log written \
+                      on each stop_session. Used by the Skills Meeting Bots card to show a recent-calls list.",
+        inputs: vec![FieldSchema {
+            name: "limit",
+            ty: TypeSchema::F64,
+            comment: "Max rows to return. Defaults to 50; hard-capped server-side.",
+            required: false,
+        }],
+        outputs: vec![
+            FieldSchema {
+                name: "ok",
+                ty: TypeSchema::Bool,
+                comment: "True when the read succeeded (even if no rows exist yet).",
+                required: true,
+            },
+            FieldSchema {
+                name: "calls",
+                ty: TypeSchema::String,
+                comment: "Array of MeetCallRecord objects, newest first.",
+                required: true,
+            },
+            FieldSchema {
+                name: "count",
+                ty: TypeSchema::F64,
+                comment: "Number of rows in `calls`.",
+                required: true,
+            },
+        ],
+    }
+}
+
 fn schema_unknown() -> ControllerSchema {
     ControllerSchema {
         namespace: "meet_agent",
@@ -310,6 +373,9 @@ fn handle_poll_speech(p: Map<String, Value>) -> ControllerFuture {
 fn handle_stop_session(p: Map<String, Value>) -> ControllerFuture {
     Box::pin(async move { super::rpc::handle_stop_session(p).await })
 }
+fn handle_list_calls(p: Map<String, Value>) -> ControllerFuture {
+    Box::pin(async move { super::rpc::handle_list_calls(p).await })
+}
 
 #[cfg(test)]
 mod tests {
@@ -333,7 +399,8 @@ mod tests {
                 "push_listen_pcm",
                 "push_caption",
                 "poll_speech",
-                "stop_session"
+                "stop_session",
+                "list_calls",
             ]
         );
     }
diff --git a/src/openhuman/meet_agent/session.rs b/src/openhuman/meet_agent/session.rs
index 6e60c649e0..526dbc46ac 100644
--- a/src/openhuman/meet_agent/session.rs
+++ b/src/openhuman/meet_agent/session.rs
@@ -10,7 +10,7 @@
 //! live in a process-wide `OnceLock<Mutex<HashMap<...>>>`. The locking
 //! pattern matches `meet_call::MeetCallState` on the shell side.
 
-use std::collections::HashMap;
+use std::collections::{HashMap, HashSet};
 use std::sync::{Mutex, OnceLock};
 use std::time::{Instant, SystemTime, UNIX_EPOCH};
 
@@ -19,6 +19,48 @@ use base64::{engine::general_purpose::STANDARD as B64, Engine as _};
 use super::ops::{self, Vad, VadEvent};
 use super::types::{SessionEvent, SessionEventKind};
 
+/// What `note_caption` decided to do with a caption. Replaces the
+/// prior boolean return so the RPC layer can branch between the
+/// "fire a normal LLM turn", "speak a polite refusal", and "do
+/// nothing" paths without re-doing the gate logic out-of-band.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum CaptionOutcome {
+    /// Caption was dropped: not a wake, dedupped, cooled down, or
+    /// during a turn-in-flight. No audible response.
+    Ignored,
+    /// Wake fired and the caller should kick `brain::run_caption_turn`.
+    WakeFired,
+    /// Wake phrase was detected from someone who is not the call
+    /// owner (or on a session that hasn't had identities configured).
+    /// The caller should speak a polite refusal — or a friendly hi
+    /// when the tail is a greeting — via `brain::run_soft_deny_turn`
+    /// rather than silently dropping. Carries the full caption text
+    /// so the brain layer can classify intent (greeting vs task)
+    /// and pick the appropriate canned reply.
+    UnauthorizedWake { speaker: String, text: String },
+}
+
+/// How long after a denied wake the owner has to say "allow" before
+/// the grant request expires. 2 minutes is enough for a back-and-forth
+/// exchange ("hey openhuman" — refusal — owner: "go ahead, let them
+/// ask") without leaving the gate softened indefinitely.
+const PENDING_GRANT_WINDOW_MS: u64 = 120_000;
+
+/// Minimum gap between consecutive non-owner dispatches. Meet's STT
+/// re-transcribes the same utterance with slight wording jitter
+/// ("Openhuman. I open." → "Openhuman. High openhum." →
+/// "Openhuman. High Openhuman.") so per-text dedup misses the
+/// duplicates. Without a session-wide rate limit each variant
+/// would fire a fresh LLM + TTS round-trip.
+///
+/// Set at 20s (vs the prior 60s) so a non-owner can actually
+/// engage in back-and-forth conversation — the toolless LLM
+/// answers general questions now, so a 1-minute gate would feel
+/// like the bot has gone deaf between asks. 20s is long enough
+/// to cover Meet's STT replay window while letting real new
+/// utterances through. 2026-05-25 smoke matrix.
+const UNAUTHORIZED_COOLDOWN_MS: u64 = 20_000;
+
 /// Cap on the inbound buffer so a runaway shell push (e.g. shell never
 /// stops, brain never drains) can't grow memory unboundedly. 30s @ 16kHz
 /// mono = 960 KB per session — generous for any reasonable utterance.
@@ -72,6 +114,85 @@ pub struct MeetAgentSession {
     /// text — a single character growth re-queues the line). Without
     /// this gate the brain spam-fires on every caption growth.
     wake_cooldown_until_ts_ms: u64,
+    /// Per-speaker last caption text. Drops verbatim repeats from the
+    /// page-side observer. A single-slot Option<String> was broken
+    /// because Meet's CC region renders two simultaneous rows (the
+    /// user's caption AND the bot's TTS being captioned as
+    /// speaker="You"). Polling walks both rows every 250ms; with a
+    /// single-slot signature the value flips A → B → A → B every
+    /// tick and dedup never matches. Per-speaker keying fixes it.
+    last_caption_by_speaker: std::collections::HashMap<String, String>,
+    /// True between brain-turn dispatch (run_caption_turn entry) and
+    /// final-reply enqueue. While set, note_caption refuses to fire a
+    /// fresh wake — without this gate, the model takes 5–15s to run
+    /// tools but Meet keeps emitting new captions every 250ms, each
+    /// firing a new turn that cancels the prior one. Tool calls never
+    /// resolve. The gate is wider than `is_speaking()` (which only
+    /// covers TTS playback) because the LLM + tool phase is the part
+    /// the user can interrupt only by deliberately re-saying the wake
+    /// word, which they shouldn't have to.
+    pub turn_in_progress: bool,
+    /// Set true by `cancel_outbound`; cleared by the next
+    /// `poll_outbound`. Tells the shell side that the previous reply
+    /// was interrupted and the JS audio bridge should flush any
+    /// in-flight playback BEFORE feeding the next chunk. Without this
+    /// distinct signal, a normal end-of-utterance would also flush,
+    /// cutting the final 100ms of the last legitimate reply.
+    flush_pending: bool,
+    /// Wall-clock ms at the moment the previous brain turn finished.
+    /// Used by note_caption to enforce a minimum gap between turns —
+    /// even if the page-side caption cooldown expires (or Meet emits
+    /// a fresh utterance just past it), the bot still refuses to
+    /// fire a new wake within MIN_TURN_GAP_MS. Backstop against the
+    /// "user asks once, bot answers 5 times" pattern when caption
+    /// residue keeps re-matching the wake phrase.
+    last_turn_done_at_ms: u64,
+    /// Display name of the call owner — the user who launched the
+    /// bot. Only captions from this speaker may trip the wake word.
+    /// Empty until [`set_identities`] is called; while empty the
+    /// gate fails closed (no wakes fire) so a misconfigured launch
+    /// can never leak the user's tool surface to a remote
+    /// participant. Normalisation (lowercase / parenthetical
+    /// suffix strip) happens at compare time inside note_caption.
+    owner_display_name: String,
+    /// Display name the bot uses as its Meet participant tile.
+    /// Used to drop the bot's own captions (Meet renders the bot's
+    /// TTS in the same captions region as remote speakers; without
+    /// an explicit bot-self filter the bot would re-wake on its
+    /// own voice). Empty until set; while empty the bot-self filter
+    /// is inert.
+    bot_display_name: String,
+    /// Normalised Meet URL the call joined. Snapshotted at start
+    /// so the recent-calls log captures which meeting this was
+    /// without forcing the frontend to keep an in-memory map.
+    meet_url: String,
+    /// Wall-clock ms when `start_session` ran. The session also
+    /// keeps `started_at: Instant` for monotonic elapsed-seconds
+    /// math, but the JSONL persistence layer needs an absolute
+    /// timestamp that can be sorted across process restarts.
+    started_at_ms: u64,
+    /// Wall-clock ms of the most recent soft-deny dispatch. Used
+    /// to enforce `UNAUTHORIZED_COOLDOWN_MS` so a non-owner whose
+    /// caption Meet re-transcribes with text variations doesn't
+    /// trigger a fresh soft-deny TTS on every variant. 0 = no
+    /// soft-deny has dispatched yet this call.
+    last_unauthorized_dispatch_at_ms: u64,
+    /// Normalised name of the most recent non-owner speaker that
+    /// tripped the wake word. Recorded so the owner can grant them
+    /// access by saying "allow" / "let them" / "go ahead" within
+    /// `PENDING_GRANT_WINDOW_MS` of the refusal. Cleared once a
+    /// grant lands or the window elapses.
+    pending_unauthorized_speaker: Option<String>,
+    /// Wall-clock ms when `pending_unauthorized_speaker` was set.
+    /// The owner has `PENDING_GRANT_WINDOW_MS` from this point to
+    /// approve the asker.
+    pending_unauthorized_at_ms: u64,
+    /// Speakers (normalised display names) the owner has explicitly
+    /// allowed to wake the bot during this call. Wake gate accepts
+    /// captions whose speaker matches the owner OR appears here.
+    /// Resets on `stop_session` (the registry drops the whole
+    /// session). Empty by default — grants are opt-in per call.
+    allowlist: HashSet<String>,
 }
 
 impl MeetAgentSession {
@@ -92,7 +213,123 @@ impl MeetAgentSession {
             wake_active: false,
             last_caption_ts_ms: 0,
             wake_cooldown_until_ts_ms: 0,
+            last_caption_by_speaker: std::collections::HashMap::new(),
+            turn_in_progress: false,
+            flush_pending: false,
+            last_turn_done_at_ms: 0,
+            last_unauthorized_dispatch_at_ms: 0,
+            owner_display_name: String::new(),
+            bot_display_name: String::new(),
+            meet_url: String::new(),
+            started_at_ms: SystemTime::now()
+                .duration_since(UNIX_EPOCH)
+                .map(|d| d.as_millis() as u64)
+                .unwrap_or(0),
+            pending_unauthorized_speaker: None,
+            pending_unauthorized_at_ms: 0,
+            allowlist: HashSet::new(),
+        }
+    }
+
+    /// Add a speaker to the per-call allowlist. The wake gate
+    /// thereafter accepts captions from this speaker just like it
+    /// would from the owner — single source of truth so the
+    /// granted user can ask follow-up questions without saying
+    /// "allow" each time. Stored using the normalised name so
+    /// Meet's punctuation/case jitter doesn't reset the grant.
+    pub fn allow_speaker(&mut self, speaker_display_name: &str) {
+        let norm = normalise_participant_name(speaker_display_name);
+        if !norm.is_empty() {
+            self.allowlist.insert(norm);
+        }
+    }
+
+    /// Consume the pending unauthorized speaker if still inside the
+    /// grant window. Returns the display name (in its normalised
+    /// form) so the brain layer can both grant them access and name
+    /// them in the spoken confirmation ("Okay, <name> can ask me").
+    /// Returns `None` when no pending grant exists or the window
+    /// has already elapsed.
+    pub fn take_pending_unauthorized(&mut self) -> Option<String> {
+        let now_ms = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .map(|d| d.as_millis() as u64)
+            .unwrap_or(0);
+        let candidate = self.pending_unauthorized_speaker.take()?;
+        if now_ms.saturating_sub(self.pending_unauthorized_at_ms) > PENDING_GRANT_WINDOW_MS {
+            // Stale grant — drop without surfacing. The owner would
+            // need to re-trigger the refusal flow to re-arm.
+            self.pending_unauthorized_at_ms = 0;
+            return None;
         }
+        self.pending_unauthorized_at_ms = 0;
+        Some(candidate)
+    }
+
+    /// Record the Meet URL the call joined. Stored alongside the
+    /// session so `stop_session` can write it into the JSONL
+    /// recent-calls log. Empty string acceptable (older shells that
+    /// don't yet forward the URL will simply log calls with an
+    /// empty `meet_url` field — the UI degrades gracefully).
+    pub fn set_meet_url(&mut self, meet_url: &str) {
+        self.meet_url = meet_url.trim().to_string();
+    }
+
+    /// Read accessors used when persisting the call record on
+    /// `stop_session`. Kept at the session boundary so the store
+    /// module doesn't have to reach into private fields.
+    pub fn meet_url(&self) -> &str {
+        &self.meet_url
+    }
+    pub fn bot_display_name(&self) -> &str {
+        &self.bot_display_name
+    }
+    pub fn started_at_ms(&self) -> u64 {
+        self.started_at_ms
+    }
+
+    /// Set the call-owner display name (the human who launched the
+    /// bot) and the bot's own Meet participant name. The note_caption
+    /// gate uses both: captions are accepted only when the speaker
+    /// matches the owner, and the bot-self filter drops captions
+    /// authored by the bot's own TTS feed.
+    ///
+    /// Either argument may be empty. Empty owner_display_name
+    /// fails-closed (the gate refuses every wake) so a misconfigured
+    /// launch can never expose the user's tool surface to a remote
+    /// participant. Empty bot_display_name simply disables the
+    /// bot-self filter — the dedup / cooldown layers still keep the
+    /// loop in check, but it's a less-defended posture.
+    pub fn set_identities(&mut self, owner_display_name: &str, bot_display_name: &str) {
+        self.owner_display_name = owner_display_name.trim().to_string();
+        self.bot_display_name = bot_display_name.trim().to_string();
+    }
+
+    /// Read accessor used by audit logging. Empty when set_identities
+    /// has not been called for this session.
+    pub fn owner_display_name(&self) -> &str {
+        &self.owner_display_name
+    }
+
+    /// Stamp the current wall-clock time as "turn just finished". The
+    /// brain calls this from the final with_session block of
+    /// run_caption_turn (alongside clearing turn_in_progress) so the
+    /// min-turn-gap backstop in note_caption can see it.
+    pub fn mark_turn_done(&mut self) {
+        self.last_turn_done_at_ms = std::time::SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .map(|d| d.as_millis() as u64)
+            .unwrap_or(0);
+    }
+
+    /// True when the brain has TTS audio queued for playback. The
+    /// note_caption gate uses this to refuse wake matches while the
+    /// bot is actively speaking — otherwise Meet captions the bot's
+    /// own voice (or the user keeps talking through the reply) and
+    /// fires a fresh turn before the current one finishes, producing
+    /// an unbreakable speak-listen-speak loop.
+    pub fn is_speaking(&self) -> bool {
+        !self.outbound.is_empty()
     }
 
     /// Caption-driven listen path. Returns `true` when this caption
@@ -104,22 +341,169 @@ impl MeetAgentSession {
     /// the match in the same caption is treated as the start of the
     /// prompt; subsequent captions append until `take_pending_prompt`
     /// drains.
-    pub fn note_caption(&mut self, speaker: &str, text: &str, ts_ms: u64) -> bool {
+    pub fn note_caption(&mut self, speaker: &str, text: &str, ts_ms: u64) -> CaptionOutcome {
         if text.trim().is_empty() {
-            return false;
+            return CaptionOutcome::Ignored;
+        }
+        // Drop noise captions from Meet's local-user / UI affordances.
+        // `speaker=="You"` is Meet's label for the local participant
+        // (the bot itself when its outbound is the user-facing tile),
+        // plus a catch-all for placeholder / demo / accessibility
+        // strings that some Meet variants surface inside the caption
+        // region. Without this filter the bot's own TTS would loop
+        // back as a "user spoke" prompt and re-fire the wake word,
+        // eating the prompt budget and producing endless speech.
+        let speaker_lower = speaker.trim().to_lowercase();
+        if speaker_lower == "you" || speaker_lower.is_empty() {
+            return CaptionOutcome::Ignored;
+        }
+        // Privacy gate — owner-only wake.
+        //
+        // Today the brain runs the user's full orchestrator agent with
+        // their tool surface (calendar, Slack, Gmail, … 119 Composio
+        // integrations) and the user's memory tree. A meeting is a
+        // public room. Without an identity gate, *any* participant who
+        // says the wake phrase (or whose audio Meet transcribes near
+        // one) can issue tool calls in the user's name and have the
+        // results spoken aloud to the whole room — a hard privacy
+        // leak. So before any wake / dedup / cooldown work happens we
+        // require: speaker == owner_display_name. Anyone else (and
+        // the bot itself) is dropped without recording an event.
+        //
+        // Normalisation is intentionally light (lowercase + trim +
+        // parenthetical suffix strip) so Meet's "(host)" / "(you)"
+        // decorations don't break the match. Anything fancier
+        // (NFKC, diacritic folding) waits for a real-name smoke
+        // report — start tight, expand only on evidence.
+        let speaker_norm = normalise_participant_name(speaker);
+        let owner_norm = normalise_participant_name(&self.owner_display_name);
+        let bot_norm = normalise_participant_name(&self.bot_display_name);
+        log::info!(
+            "[meet-agent] note_caption gate request_id={} speaker_raw=\"{}\" \
+             speaker_norm=\"{}\" owner_norm=\"{}\" bot_norm=\"{}\"",
+            self.request_id,
+            speaker,
+            speaker_norm,
+            owner_norm,
+            bot_norm
+        );
+        // Bot-self filter first: a bot caption that happens to match
+        // its own display name must never re-wake. Run before the
+        // owner check so a (very contrived) bot_display_name ==
+        // owner_display_name still doesn't let the bot wake itself.
+        if !bot_norm.is_empty() && speaker_norm == bot_norm {
+            log::debug!(
+                "[meet-agent] caption dropped: bot self-caption request_id={}",
+                self.request_id
+            );
+            return CaptionOutcome::Ignored;
+        }
+        // Fail-closed when no owner has been configured. A live
+        // session without a known owner is by definition unsafe —
+        // any participant could wake. Log once per such caption so
+        // operators can spot the misconfiguration in the dev log.
+        if owner_norm.is_empty() {
+            log::warn!(
+                "[meet-agent] wake refused: no owner_display_name configured \
+                 request_id={} speaker={}",
+                self.request_id,
+                speaker
+            );
+            return CaptionOutcome::Ignored;
+        }
+        // Treat owner + previously-granted allowlist members as
+        // authorised speakers for wake purposes. The allowlist is
+        // populated when the owner says "allow them" / "go ahead"
+        // / "let them ask" after a non-owner wake refusal — see
+        // `brain::run_caption_turn`'s grant-intent branch.
+        //
+        // The actual authorised/unauthorised branch happens AFTER
+        // all the rate-limit gates (dedup, turn-in-progress, min-
+        // turn-gap, cooldown) below, so the same caption repeating
+        // every 250 ms — which Meet does aggressively while a
+        // participant is still visible in the CC region — cannot
+        // spam the refusal path either. Without that ordering the
+        // soft-deny TTS triggers a fresh refusal on every Meet
+        // re-emit of the identical caption text. Smoke-tested as
+        // the "sorry sorry sorry" loop on 2026-05-25.
+        let speaker_is_authorised =
+            speaker_norm == owner_norm || self.allowlist.contains(&speaker_norm);
+        // Per-speaker dedup. Meet's CC region re-renders the same line
+        // every 250 ms poll tick and emits BOTH speaker rows on each
+        // walk (the user AND the bot TTS as speaker="You"). A single-
+        // slot last-signature would flip A → B → A → B every tick and
+        // never dedup. Keyed by speaker_lower so the user's repeating
+        // utterance is dropped after the first hit regardless of bot
+        // captions interleaving.
+        //
+        // Normalised match (lowercase + drop non-alphanumeric + collapse
+        // whitespace) so Meet's punctuation/case jitter between emits
+        // ("Hey, openhuman" → "hey openhuman.") doesn't slip through
+        // the dedup. Without normalisation each capitalisation flip
+        // fires another wake.
+        let key = speaker_lower.clone();
+        let normalised = normalise_for_dedup(text);
+        if let Some(prev) = self.last_caption_by_speaker.get(&key) {
+            if prev == &normalised {
+                return CaptionOutcome::Ignored;
+            }
+        }
+        self.last_caption_by_speaker.insert(key, normalised);
+        // Gate: while a brain turn is in flight (LLM + tools running),
+        // refuse to fire a fresh wake. The prior gate also blocked on
+        // is_speaking() (outbound queued), but that prevented barge-in
+        // — the user couldn't interrupt a wrong-direction reply by
+        // re-asking. is_speaking() removed; barge-in now works via
+        // cancel_outbound → flush_pending → JS bridge flush. The LLM
+        // phase still blocks because spawning a parallel agentic turn
+        // would waste tool calls on the same question.
+        if self.turn_in_progress {
+            self.record_event(
+                SessionEventKind::Heard,
+                format!("{speaker}: {text} (suppressed: turn_in_progress)"),
+            );
+            return CaptionOutcome::Ignored;
         }
         self.last_caption_ts_ms = ts_ms;
-        // Already collecting after a previous wake word: just append
-        // the new caption. No second fire — the brain is already
-        // scheduled and will drain the prompt in ~1.5 s. Without this
-        // gate, a slowly-growing caption fires the wake word on
-        // every dedupe-then-grow cycle.
-        if self.wake_active {
+        // Already collecting after a previous (authorised) wake word:
+        // append the continuation. No second fire — the brain is
+        // already scheduled and will drain the prompt in ~1.5 s.
+        // Without this gate, a slowly-growing caption fires the wake
+        // word on every dedupe-then-grow cycle.
+        //
+        // Restricted to authorised speakers so a non-owner can't
+        // smuggle text into the in-flight owner prompt (e.g. owner
+        // says "hey openhuman, what's on my calendar"; non-owner
+        // mid-prompt: "and read alice's slack").
+        if self.wake_active && speaker_is_authorised {
             if !self.pending_prompt.is_empty() {
                 self.pending_prompt.push(' ');
             }
             self.pending_prompt.push_str(text.trim());
-            return false;
+            return CaptionOutcome::Ignored;
+        }
+        // Min-turn-gap backstop. Even if the page-side caption
+        // cooldown window expires, refuse to start a new turn
+        // within MIN_TURN_GAP_MS of the prior turn's completion.
+        // Without this the bot replied to the same user question 4-5
+        // times when Meet's caption observer kept re-emitting the line
+        // with subtle text variation that slipped past the dedup.
+        const MIN_TURN_GAP_MS: u64 = 60_000;
+        let now_wall_ms = std::time::SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .map(|d| d.as_millis() as u64)
+            .unwrap_or(0);
+        if self.last_turn_done_at_ms != 0
+            && now_wall_ms.saturating_sub(self.last_turn_done_at_ms) < MIN_TURN_GAP_MS
+        {
+            self.record_event(
+                SessionEventKind::Heard,
+                format!(
+                    "{speaker}: {text} (suppressed: <{}ms since last turn)",
+                    MIN_TURN_GAP_MS
+                ),
+            );
+            return CaptionOutcome::Ignored;
         }
         // In cooldown after a recent turn — Meet keeps the same
         // utterance visible for several seconds, so without this
@@ -135,7 +519,7 @@ impl MeetAgentSession {
                     format!("{speaker}: {text}")
                 },
             );
-            return false;
+            return CaptionOutcome::Ignored;
         }
         // Normalize before matching: Meet's STT punctuates the wake
         // phrase ("hey, openhuman"), capitalizes mid-sentence, and
@@ -147,15 +531,80 @@ impl MeetAgentSession {
         // and the transcript log; the user's punctuation isn't load-
         // bearing for note-taking.
         let normalized = normalize_for_wake(text);
-        let wake_idx = normalized
-            .find("hey openhuman")
-            .or_else(|| normalized.find("hey open human"));
-        if let Some(idx) = wake_idx {
-            let after = if normalized[idx..].starts_with("hey openhuman") {
-                idx + "hey openhuman".len()
-            } else {
-                idx + "hey open human".len()
-            };
+        // Accept any of the canonical wake phrases. Meet's STT mangles
+        // the brand ("Hi Openhuman", "Open Human", dropped prefix) so
+        // we match a small set rather than a single rigid prefix.
+        // Ordered longest-first so the tail offset is calculated against
+        // the actual matched phrase.
+        const WAKE_PHRASES: &[&str] = &[
+            "hey open human",
+            "hi open human",
+            "hello open human",
+            "hey openhuman",
+            "hi openhuman",
+            "hello openhuman",
+            "open human",
+            "openhuman",
+        ];
+        let mut wake_hit: Option<(usize, &'static str)> = None;
+        for phrase in WAKE_PHRASES {
+            if let Some(idx) = normalized.find(phrase) {
+                wake_hit = Some((idx, phrase));
+                break;
+            }
+        }
+        if let Some((idx, phrase)) = wake_hit {
+            // Wake phrase detected — branch on whether the speaker is
+            // allowed to actually drive the bot. Non-owner + not
+            // allowlisted → polite refusal turn; owner + allowlist →
+            // normal LLM turn.
+            if !speaker_is_authorised {
+                let preview: String = text.chars().take(40).collect();
+                let now_ms = SystemTime::now()
+                    .duration_since(UNIX_EPOCH)
+                    .map(|d| d.as_millis() as u64)
+                    .unwrap_or(0);
+                // Session-wide soft-deny cooldown. Meet's STT
+                // re-transcribes the same utterance with wording
+                // jitter, slipping past the per-text dedup. Cap the
+                // refusal TTS to one dispatch per minute so the loop
+                // can't compound itself (and so rate-limits from the
+                // TTS backend don't fire either).
+                if self.last_unauthorized_dispatch_at_ms != 0
+                    && now_ms.saturating_sub(self.last_unauthorized_dispatch_at_ms)
+                        < UNAUTHORIZED_COOLDOWN_MS
+                {
+                    log::debug!(
+                        "[meet-agent] unauthorized_wake suppressed (cooldown) \
+                         request_id={} speaker=\"{}\" preview=\"{}\"",
+                        self.request_id,
+                        speaker,
+                        preview
+                    );
+                    return CaptionOutcome::Ignored;
+                }
+                log::info!(
+                    "[meet-agent] unauthorized_wake_attempt request_id={} \
+                     speaker=\"{}\" owner=\"{}\" preview=\"{}\"",
+                    self.request_id,
+                    speaker,
+                    self.owner_display_name,
+                    preview
+                );
+                self.last_unauthorized_dispatch_at_ms = now_ms;
+                // Record the pending grant request. The owner has
+                // PENDING_GRANT_WINDOW_MS to approve them via the
+                // "allow" / "let them" / "go ahead" pattern; after
+                // that the slot expires and the unauthorised speaker
+                // has to re-trigger the refusal to re-arm.
+                self.pending_unauthorized_speaker = Some(speaker.trim().to_string());
+                self.pending_unauthorized_at_ms = now_ms;
+                return CaptionOutcome::UnauthorizedWake {
+                    speaker: speaker.trim().to_string(),
+                    text: text.to_string(),
+                };
+            }
+            let after = idx + phrase.len();
             let tail = normalized.get(after..).unwrap_or("").trim().to_string();
             self.pending_prompt = tail;
             self.wake_active = true;
@@ -163,7 +612,7 @@ impl MeetAgentSession {
                 SessionEventKind::Note,
                 format!("wake word from speaker={speaker}"),
             );
-            return true;
+            return CaptionOutcome::WakeFired;
         }
         // Outside a wake context, just record the line for the
         // transcript log. Useful for debugging "why didn't the agent
@@ -177,7 +626,7 @@ impl MeetAgentSession {
                 format!("{speaker}: {text}")
             },
         );
-        false
+        CaptionOutcome::Ignored
     }
 
     /// Drain the assembled wake-word prompt and clear the active
@@ -193,10 +642,16 @@ impl MeetAgentSession {
             return None;
         }
         self.wake_active = false;
-        // 8s grace beyond the most recent caption's page timestamp.
-        // `last_caption_ts_ms` is whatever Date.now() was page-side
-        // when the line landed — same clock as future caption pushes.
-        const COOLDOWN_MS: u64 = 8_000;
+        // 30s grace beyond the most recent caption's page timestamp.
+        // The previous 8s window was too short: Meet's caption region
+        // re-renders the just-finished utterance for 5-8s, the bot's
+        // reply takes another 5-15s to synthesize + speak, then any
+        // natural user follow-up ("wait, did you say X?") within the
+        // same 30s window is treated as continuation rather than a
+        // fresh wake. Under-prompted users especially repeat the wake
+        // phrase 2-3 times before realising the bot already heard them
+        // — without this, each repeat fires another tool call.
+        const COOLDOWN_MS: u64 = 60_000;
         self.wake_cooldown_until_ts_ms = self.last_caption_ts_ms.saturating_add(COOLDOWN_MS);
         let prompt = std::mem::take(&mut self.pending_prompt);
         let trimmed = prompt.trim().to_string();
@@ -242,6 +697,33 @@ impl MeetAgentSession {
         }
     }
 
+    /// Drop everything queued for playback. The brain calls this at
+    /// the start of a new caption turn so the bot stops mid-sentence
+    /// instead of letting the previous reply play to completion while
+    /// the user is already speaking again. Marks the outbound channel
+    /// as 'done' so the speak_pump signals end-of-utterance on its
+    /// next poll and the page bridge can reset its audio-bridge state
+    /// cleanly.
+    pub fn cancel_outbound(&mut self) {
+        // Mark flush BEFORE the early-empty check — even if the Rust
+        // queue happens to be empty right now, the JS bridge may have
+        // already pulled the prior reply's tail and be playing it
+        // standalone. The flush signal must still fire.
+        self.flush_pending = true;
+        if !self.outbound.is_empty() {
+            self.outbound.clear();
+        }
+        self.outbound_done = true;
+    }
+
+    /// Take + clear the pending-flush flag. Called by the shell on
+    /// every poll_outbound; when true, the shell will issue a JS
+    /// bridge flush BEFORE feeding the next PCM chunk so the prior
+    /// reply's in-flight playback stops cleanly.
+    pub fn take_flush_pending(&mut self) -> bool {
+        std::mem::take(&mut self.flush_pending)
+    }
+
     /// Drain everything currently queued for the shell. Returns
     /// `(pcm_base64, utterance_done)`.
     pub fn poll_outbound(&mut self) -> (String, bool) {
@@ -287,6 +769,61 @@ impl MeetAgentSession {
     }
 }
 
+/// Canonicalise a Meet participant display name for the owner-gate
+/// comparison. Strips a single trailing parenthetical decorator
+/// (Meet appends `" (host)"`, `" (you)"`, `" (presenter)"` to some
+/// captions and labels), lowercases ASCII, and collapses internal
+/// whitespace. NFKC folding is *not* applied — start tight and
+/// expand on real-world miss reports rather than guessing at the
+/// shape of names we haven't seen yet. Returns empty when the input
+/// is empty / whitespace-only so the caller can fail-closed.
+fn normalise_participant_name(raw: &str) -> String {
+    let trimmed = raw.trim();
+    if trimmed.is_empty() {
+        return String::new();
+    }
+    // Strip a single trailing parenthetical (e.g. "Alice (host)").
+    // We only strip when the parenthetical is at the end and the
+    // preceding chunk is non-empty — guards against pathological
+    // inputs like "()" or "(host)" alone.
+    let stripped: &str = if let Some(open_idx) = trimmed.rfind(" (") {
+        if trimmed.ends_with(')') && open_idx > 0 {
+            &trimmed[..open_idx]
+        } else {
+            trimmed
+        }
+    } else {
+        trimmed
+    };
+    // Lowercase + collapse internal whitespace.
+    let mut out = String::with_capacity(stripped.len());
+    let mut prev_space = true;
+    for c in stripped.chars() {
+        if c.is_whitespace() {
+            if !prev_space {
+                out.push(' ');
+                prev_space = true;
+            }
+        } else {
+            for lc in c.to_lowercase() {
+                out.push(lc);
+            }
+            prev_space = false;
+        }
+    }
+    out.trim_end().to_string()
+}
+
+/// Lowercase + drop non-alphanumeric + collapse whitespace. Used by
+/// the per-speaker dedup so Meet's punctuation/case jitter between
+/// caption emits doesn't bypass the dedup. Same shape as
+/// `normalize_for_wake` but exposed under a distinct name to keep
+/// the two intents (wake-word match vs. dedup key) separate at the
+/// call site.
+fn normalise_for_dedup(text: &str) -> String {
+    normalize_for_wake(text)
+}
+
 /// Lowercase + drop punctuation + collapse whitespace, so the wake
 /// phrase matches regardless of how Meet's STT punctuated or cased
 /// it ("Hey, OpenHuman", "hey open-human", etc).
@@ -426,32 +963,47 @@ mod tests {
         .unwrap();
     }
 
+    /// Build a session pre-configured for the wake-word tests: Alice
+    /// is the call owner, "OpenHuman" is the bot's Meet tile. Every
+    /// wake-path test goes through this helper so the owner gate
+    /// (the privacy hard-lock around tool calls) is consistently
+    /// in scope.
+    fn session_with_owner_alice() -> MeetAgentSession {
+        let mut s = MeetAgentSession::new("p".into(), 16_000);
+        s.set_identities("Alice", "OpenHuman");
+        s
+    }
+
     #[test]
     fn note_caption_handles_punctuated_wake() {
-        let mut s = MeetAgentSession::new("p".into(), 16_000);
+        let mut s = session_with_owner_alice();
         // Meet often inserts a comma after "hey".
-        let fired = s.note_caption("Alice", "Hey, OpenHuman remember the launch", 1);
-        assert!(fired, "punctuated wake phrase should still fire");
+        let outcome = s.note_caption("Alice", "Hey, OpenHuman remember the launch", 1);
+        assert_eq!(outcome, CaptionOutcome::WakeFired);
         let prompt = s.take_pending_prompt().expect("prompt drained");
         assert_eq!(prompt, "remember the launch");
     }
 
     #[test]
     fn note_caption_handles_split_brand() {
-        let mut s = MeetAgentSession::new("p".into(), 16_000);
-        let fired = s.note_caption("Alice", "hey open-human, send the report", 1);
-        assert!(fired);
+        let mut s = session_with_owner_alice();
+        let outcome = s.note_caption("Alice", "hey open-human, send the report", 1);
+        assert_eq!(outcome, CaptionOutcome::WakeFired);
         let prompt = s.take_pending_prompt().expect("prompt drained");
         assert_eq!(prompt, "send the report");
     }
 
     #[test]
     fn note_caption_does_not_double_fire_on_growing_caption() {
-        let mut s = MeetAgentSession::new("p".into(), 16_000);
+        let mut s = session_with_owner_alice();
         let first = s.note_caption("Alice", "hey openhuman take notes", 1);
-        assert!(first);
+        assert_eq!(first, CaptionOutcome::WakeFired);
         let second = s.note_caption("Alice", "hey openhuman take notes about the launch", 2);
-        assert!(!second, "second caption while wake_active must not refire");
+        assert_eq!(
+            second,
+            CaptionOutcome::Ignored,
+            "second caption while wake_active must not refire"
+        );
         let prompt = s.take_pending_prompt().expect("prompt drained");
         // First wake stripped "hey openhuman"; the continuation
         // appended the WHOLE growing caption (still containing "hey
@@ -475,4 +1027,178 @@ mod tests {
         })
         .unwrap();
     }
+
+    // -- Owner-only wake gate (privacy lock) --------------------------
+
+    #[test]
+    fn note_caption_rejects_non_owner_speaker() {
+        let mut s = session_with_owner_alice();
+        // Bob is in the room but not the owner; even with a perfect
+        // wake phrase the gate must refuse with a soft-deny outcome
+        // (so the bot can speak a polite refusal) rather than
+        // silently ignoring.
+        let outcome = s.note_caption("Bob", "hey openhuman read alice's slack DMs", 1);
+        assert_eq!(
+            outcome,
+            CaptionOutcome::UnauthorizedWake {
+                speaker: "Bob".into(),
+                text: "hey openhuman read alice's slack DMs".into(),
+            },
+            "non-owner wake must produce an UnauthorizedWake outcome"
+        );
+        // Soft-deny path doesn't drain the wake prompt — the brain
+        // only synthesises a canned refusal line.
+        assert!(s.take_pending_prompt().is_none());
+    }
+
+    #[test]
+    fn note_caption_non_owner_without_wake_phrase_is_ignored() {
+        // Random chatter from a non-owner shouldn't trigger the
+        // refusal — only an actual attempt to wake the bot does.
+        let mut s = session_with_owner_alice();
+        let outcome = s.note_caption("Bob", "hey did you watch the game last night", 1);
+        assert_eq!(outcome, CaptionOutcome::Ignored);
+    }
+
+    #[test]
+    fn note_caption_rejects_bot_self_caption() {
+        let mut s = session_with_owner_alice();
+        // Meet often re-captions the bot's own TTS in the same region.
+        // The bot must never wake on its own voice — regardless of
+        // the text content, including text that happens to repeat the
+        // wake phrase. Bot-self caption is `Ignored` (no audible
+        // response at all) rather than `UnauthorizedWake` — surfacing
+        // a soft-deny here would create an infinite loop where the
+        // refusal triggers its own bot-self caption.
+        let outcome = s.note_caption("OpenHuman", "hey openhuman would you like to know more", 1);
+        assert_eq!(outcome, CaptionOutcome::Ignored);
+    }
+
+    #[test]
+    fn note_caption_fails_closed_when_owner_unconfigured() {
+        // No set_identities call → owner empty → no wake regardless of
+        // speaker. Mirrors the misconfigured-launch posture: better
+        // silent failure than an open mic for the user's tool surface.
+        let mut s = MeetAgentSession::new("p".into(), 16_000);
+        let outcome = s.note_caption("Alice", "hey openhuman do the thing", 1);
+        assert_eq!(outcome, CaptionOutcome::Ignored);
+    }
+
+    #[test]
+    fn note_caption_owner_with_host_suffix_matches() {
+        // Meet decorates some captions with "(host)" / "(you)". The
+        // normaliser strips a single trailing parenthetical so the
+        // gate still recognises Alice when Meet renders her as
+        // "Alice (host)".
+        let mut s = session_with_owner_alice();
+        let outcome = s.note_caption("Alice (host)", "hey openhuman take a note", 1);
+        assert_eq!(outcome, CaptionOutcome::WakeFired);
+    }
+
+    #[test]
+    fn note_caption_owner_case_insensitive() {
+        // Meet sometimes title-cases display names that the user
+        // entered in lowercase, or vice versa. The comparison must
+        // be case-insensitive.
+        let mut s = session_with_owner_alice();
+        let outcome = s.note_caption("ALICE", "hey openhuman summarise", 1);
+        assert_eq!(outcome, CaptionOutcome::WakeFired);
+    }
+
+    #[test]
+    fn allowlist_grants_subsequent_wakes() {
+        // After the owner grants Bob via `allow_speaker`, Bob's
+        // next wake-phrase caption should fire just like the
+        // owner's — no soft-deny, no Ignored.
+        let mut s = session_with_owner_alice();
+        // First attempt without a grant is soft-deny:
+        let denied = s.note_caption("Bob", "hey openhuman read slack", 1);
+        assert!(matches!(denied, CaptionOutcome::UnauthorizedWake { .. }));
+        // Owner grants Bob:
+        s.allow_speaker("Bob");
+        // Bob now wakes successfully. Use a different text so the
+        // per-speaker dedup doesn't reject it.
+        let granted = s.note_caption("Bob", "hey openhuman what's the weather", 2);
+        assert_eq!(granted, CaptionOutcome::WakeFired);
+    }
+
+    #[test]
+    fn note_caption_unauthorized_wake_cooldown_blocks_text_variants() {
+        // Meet's STT re-transcribes the same utterance with text
+        // jitter ("Openhuman. I open." → "Openhuman. High openhum.")
+        // — the per-text dedup doesn't catch these because the
+        // strings differ. The session-wide soft-deny cooldown must
+        // gate subsequent variants from the same speaker so only
+        // one refusal TTS dispatches per minute regardless of
+        // STT churn.
+        let mut s = session_with_owner_alice();
+        let first = s.note_caption("Bob", "Openhuman. I open.", 1);
+        assert!(matches!(first, CaptionOutcome::UnauthorizedWake { .. }));
+        // Different text but same speaker → still cooled down.
+        let second = s.note_caption("Bob", "Openhuman. High openhum.", 2);
+        assert_eq!(second, CaptionOutcome::Ignored);
+        let third = s.note_caption("Bob", "Openhuman. High Openhuman.", 3);
+        assert_eq!(third, CaptionOutcome::Ignored);
+        // Different speaker also gated — soft-deny TTS slot is
+        // session-wide, not per-speaker.
+        let charlie = s.note_caption("Charlie", "openhuman hello", 4);
+        assert_eq!(charlie, CaptionOutcome::Ignored);
+    }
+
+    #[test]
+    fn note_caption_unauthorized_wake_does_not_loop_on_identical_caption() {
+        // Regression: Meet's caption observer re-emits the same row
+        // every 250 ms while it's still visible. The first emission
+        // produces an UnauthorizedWake; subsequent identical
+        // emissions must be deduped to `Ignored` so the soft-deny
+        // TTS doesn't fire on every tick ("sorry, sorry, sorry…"
+        // loop seen in dev:app on 2026-05-25).
+        let mut s = session_with_owner_alice();
+        let first = s.note_caption("Bob", "hey openhuman read my dms", 1);
+        assert!(matches!(first, CaptionOutcome::UnauthorizedWake { .. }));
+        // Same text from same speaker — must dedup to Ignored.
+        let second = s.note_caption("Bob", "hey openhuman read my dms", 2);
+        assert_eq!(second, CaptionOutcome::Ignored);
+        // Punctuation/case jitter on the same utterance still dedups
+        // because the normaliser strips it before compare.
+        let third = s.note_caption("Bob", "Hey, openhuman read my DMs.", 3);
+        assert_eq!(third, CaptionOutcome::Ignored);
+    }
+
+    #[test]
+    fn take_pending_unauthorized_returns_within_window() {
+        // The soft-deny path records the speaker so the owner can
+        // grant them shortly after. Inside the window we get the
+        // name back; we'd need to fast-forward time to test the
+        // expiry path, so just assert the in-window happy path here.
+        let mut s = session_with_owner_alice();
+        let _ = s.note_caption("Bob", "hey openhuman list my emails", 1);
+        let pending = s.take_pending_unauthorized();
+        assert_eq!(pending.as_deref(), Some("Bob"));
+        // Consumed — second take returns None.
+        assert!(s.take_pending_unauthorized().is_none());
+    }
+
+    #[test]
+    fn normalise_participant_name_strips_trailing_paren() {
+        assert_eq!(normalise_participant_name("Alice (host)"), "alice");
+        assert_eq!(normalise_participant_name("Bob (you)"), "bob");
+        // No paren — left as-is (modulo lowercase / trim).
+        assert_eq!(normalise_participant_name("  Charlie  "), "charlie");
+        // Internal whitespace collapsed.
+        assert_eq!(normalise_participant_name("First  Last"), "first last");
+        // Pathological standalone paren — preserved so the gate can
+        // still treat it as a name distinct from the owner.
+        assert_eq!(normalise_participant_name("(host)"), "(host)");
+        // Empty stays empty so callers can fail-closed.
+        assert_eq!(normalise_participant_name(""), "");
+        assert_eq!(normalise_participant_name("   "), "");
+    }
+
+    #[test]
+    fn set_identities_trims_whitespace() {
+        let mut s = MeetAgentSession::new("p".into(), 16_000);
+        s.set_identities("  Alice  ", "\tOpenHuman\n");
+        assert_eq!(s.owner_display_name(), "Alice");
+    }
 }
diff --git a/src/openhuman/meet_agent/store.rs b/src/openhuman/meet_agent/store.rs
new file mode 100644
index 0000000000..40b2a1ee09
--- /dev/null
+++ b/src/openhuman/meet_agent/store.rs
@@ -0,0 +1,250 @@
+//! Persistence for completed meet-agent calls.
+//!
+//! Append-only JSONL file under the workspace data dir. Each line is
+//! one `MeetCallRecord` written when `handle_stop_session` closes a
+//! call. The list endpoint reads the tail of the file in reverse so
+//! the most recent calls come first — same shape the UI expects.
+//!
+//! ## Why JSONL (not sqlite)
+//!
+//! Meet call records are write-rarely, read-rarely, low-cardinality
+//! data. A single user closes a few calls per day at most. JSONL is
+//! cheap to append (no locking machinery beyond OpenOptions::append),
+//! trivial to inspect with `tail`, and survives partial writes — a
+//! malformed final line just gets skipped on parse. A sqlite table
+//! would add a migration, a connection pool, and a `cargo` build
+//! dependency for no real benefit at this volume.
+//!
+//! ## Bounding
+//!
+//! `read_recent` caps the in-memory result at `MAX_RECENT_CALLS` so
+//! a long-lived install with thousands of calls doesn't allocate an
+//! unbounded Vec. The file itself is never truncated here; a future
+//! housekeeping job can prune.
+
+use std::path::{Path, PathBuf};
+
+use serde::{Deserialize, Serialize};
+use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
+
+use crate::openhuman::config::Config;
+
+/// One closed Meet call. Persisted as a JSONL line.
+///
+/// Fields use `snake_case` because the RPC layer surfaces them
+/// directly (we don't rename when serializing to the frontend), and
+/// the JSONL file becomes self-describing for anyone running `tail`
+/// on it.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct MeetCallRecord {
+    /// UUID minted by `openhuman.meet_join_call`. Matches the session
+    /// key. Stable per call so the UI can dedup if a record is
+    /// re-emitted on a rare crash-and-retry path.
+    pub request_id: String,
+    /// Normalised Meet URL the call joined. Stored so the recent-calls
+    /// list can show *which* meeting this was without forcing the
+    /// frontend to keep an in-memory map.
+    pub meet_url: String,
+    /// Bot tile name as typed into Meet's "Your name" input. Useful
+    /// when the user runs multiple bot personas.
+    pub bot_display_name: String,
+    /// Call owner display name (the user who launched the bot).
+    /// Snapshotted at start so a later rename in the user profile
+    /// doesn't mutate history.
+    pub owner_display_name: String,
+    /// Wall-clock ms at start_session.
+    pub started_at_ms: u64,
+    /// Wall-clock ms at stop_session.
+    pub ended_at_ms: u64,
+    /// Total seconds of inbound (Meet → agent) audio processed.
+    pub listened_seconds: f32,
+    /// Total seconds of outbound (agent → Meet) audio synthesized.
+    pub spoken_seconds: f32,
+    /// Completed agent turns during the call.
+    pub turn_count: u32,
+}
+
+/// Hard cap on the rows returned from `read_recent`. The UI shows ~20
+/// rows initially with a "Load more" affordance reserved for later;
+/// keeping the API ceiling at 200 means a misconfigured client can't
+/// trigger an OOM-shaped read.
+pub const MAX_RECENT_CALLS: usize = 200;
+
+/// Resolve the workspace-relative path of the meet-calls JSONL file.
+/// Mirrors `threads/ops::workspace_dir` — single source of truth for
+/// "where does openhuman keep its per-user data". Created on demand
+/// at append time; missing file at read time is treated as "no
+/// recorded calls yet" (returns an empty Vec rather than an error).
+pub async fn meet_calls_jsonl_path() -> Result<PathBuf, String> {
+    let workspace = Config::load_or_init()
+        .await
+        .map(|c| c.workspace_dir)
+        .map_err(|e| format!("load config: {e}"))?;
+    Ok(workspace.join("meet_agent").join("calls.jsonl"))
+}
+
+/// Append a single record to the JSONL store. Creates parent
+/// directories if missing. Each call writes one line + newline so
+/// the file remains parsable even when a future writer crashes
+/// mid-line (the partial line is skipped on read).
+pub async fn append_record(record: &MeetCallRecord) -> Result<(), String> {
+    let path = meet_calls_jsonl_path().await?;
+    append_record_to(&path, record).await
+}
+
+async fn append_record_to(path: &Path, record: &MeetCallRecord) -> Result<(), String> {
+    if let Some(parent) = path.parent() {
+        tokio::fs::create_dir_all(parent)
+            .await
+            .map_err(|e| format!("mkdir {}: {e}", parent.display()))?;
+    }
+    let mut line = serde_json::to_string(record).map_err(|e| format!("serialize: {e}"))?;
+    line.push('\n');
+    let mut file = tokio::fs::OpenOptions::new()
+        .create(true)
+        .append(true)
+        .open(path)
+        .await
+        .map_err(|e| format!("open {}: {e}", path.display()))?;
+    file.write_all(line.as_bytes())
+        .await
+        .map_err(|e| format!("write {}: {e}", path.display()))?;
+    Ok(())
+}
+
+/// Return the `limit` most recent records (newest first). Missing
+/// file → empty Vec. Malformed lines are dropped silently with a
+/// debug log so one bad row doesn't poison the whole list. The cap
+/// is enforced *after* parsing so future fields don't break older
+/// records — readers are tolerant of unknown trailing fields via
+/// serde's default behavior.
+pub async fn read_recent(limit: usize) -> Result<Vec<MeetCallRecord>, String> {
+    let path = meet_calls_jsonl_path().await?;
+    read_recent_from(&path, limit).await
+}
+
+async fn read_recent_from(path: &Path, limit: usize) -> Result<Vec<MeetCallRecord>, String> {
+    let limit = limit.min(MAX_RECENT_CALLS);
+    if limit == 0 {
+        return Ok(Vec::new());
+    }
+    let file = match tokio::fs::File::open(path).await {
+        Ok(f) => f,
+        Err(err) if err.kind() == std::io::ErrorKind::NotFound => return Ok(Vec::new()),
+        Err(err) => return Err(format!("open {}: {err}", path.display())),
+    };
+    let reader = BufReader::new(file);
+    let mut lines = reader.lines();
+    let mut all: Vec<MeetCallRecord> = Vec::new();
+    while let Some(line) = lines
+        .next_line()
+        .await
+        .map_err(|e| format!("read {}: {e}", path.display()))?
+    {
+        if line.trim().is_empty() {
+            continue;
+        }
+        match serde_json::from_str::<MeetCallRecord>(&line) {
+            Ok(rec) => all.push(rec),
+            Err(err) => {
+                log::debug!("[meet-agent-store] skip malformed line err={err}");
+            }
+        }
+    }
+    // Newest first. Compare on started_at_ms for stability against
+    // future out-of-order writes (e.g. a future async flush race).
+    all.sort_by(|a, b| b.started_at_ms.cmp(&a.started_at_ms));
+    all.truncate(limit);
+    Ok(all)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::TempDir;
+
+    fn sample(idx: u64) -> MeetCallRecord {
+        MeetCallRecord {
+            request_id: format!("req-{idx}"),
+            meet_url: "https://meet.google.com/abc-defg-hij".into(),
+            bot_display_name: "OpenHuman".into(),
+            owner_display_name: "Alice".into(),
+            started_at_ms: 1_000_000 + idx * 60_000,
+            ended_at_ms: 1_000_000 + idx * 60_000 + 30_000,
+            listened_seconds: 12.5,
+            spoken_seconds: 4.2,
+            turn_count: 3,
+        }
+    }
+
+    #[tokio::test]
+    async fn append_then_read_round_trip() {
+        let tmp = TempDir::new().unwrap();
+        let path = tmp.path().join("nested").join("calls.jsonl");
+        let a = sample(1);
+        let b = sample(2);
+        append_record_to(&path, &a).await.unwrap();
+        append_record_to(&path, &b).await.unwrap();
+        let recent = read_recent_from(&path, 10).await.unwrap();
+        assert_eq!(recent.len(), 2);
+        // Newest first → req-2 comes before req-1.
+        assert_eq!(recent[0].request_id, "req-2");
+        assert_eq!(recent[1].request_id, "req-1");
+    }
+
+    #[tokio::test]
+    async fn read_recent_caps_limit() {
+        let tmp = TempDir::new().unwrap();
+        let path = tmp.path().join("calls.jsonl");
+        for i in 0..5 {
+            append_record_to(&path, &sample(i)).await.unwrap();
+        }
+        let recent = read_recent_from(&path, 3).await.unwrap();
+        assert_eq!(recent.len(), 3);
+        // Top 3 are the most recent (idx 4, 3, 2).
+        assert_eq!(recent[0].request_id, "req-4");
+        assert_eq!(recent[2].request_id, "req-2");
+    }
+
+    #[tokio::test]
+    async fn read_recent_missing_file_returns_empty() {
+        let tmp = TempDir::new().unwrap();
+        let path = tmp.path().join("does-not-exist.jsonl");
+        let recent = read_recent_from(&path, 10).await.unwrap();
+        assert!(recent.is_empty());
+    }
+
+    #[tokio::test]
+    async fn malformed_line_is_skipped() {
+        let tmp = TempDir::new().unwrap();
+        let path = tmp.path().join("calls.jsonl");
+        // Hand-write a file with one good record + one bad line.
+        let good = serde_json::to_string(&sample(1)).unwrap();
+        tokio::fs::write(&path, format!("{good}\nnot-json\n"))
+            .await
+            .unwrap();
+        let recent = read_recent_from(&path, 10).await.unwrap();
+        assert_eq!(recent.len(), 1);
+        assert_eq!(recent[0].request_id, "req-1");
+    }
+
+    #[tokio::test]
+    async fn zero_limit_returns_empty() {
+        let tmp = TempDir::new().unwrap();
+        let path = tmp.path().join("calls.jsonl");
+        append_record_to(&path, &sample(1)).await.unwrap();
+        let recent = read_recent_from(&path, 0).await.unwrap();
+        assert!(recent.is_empty());
+    }
+
+    #[tokio::test]
+    async fn limit_above_cap_is_clamped() {
+        // Passing usize::MAX must not allocate Vec::with_capacity(usize::MAX).
+        // The clamp lives inside read_recent_from before any allocation.
+        let tmp = TempDir::new().unwrap();
+        let path = tmp.path().join("calls.jsonl");
+        append_record_to(&path, &sample(1)).await.unwrap();
+        let recent = read_recent_from(&path, usize::MAX).await.unwrap();
+        assert_eq!(recent.len(), 1);
+    }
+}
diff --git a/src/openhuman/meet_agent/types.rs b/src/openhuman/meet_agent/types.rs
index 636fbd6825..35b4bb6b75 100644
--- a/src/openhuman/meet_agent/types.rs
+++ b/src/openhuman/meet_agent/types.rs
@@ -21,6 +21,30 @@ pub struct StartSessionRequest {
     /// sending. Validated on entry.
     #[serde(default = "default_sample_rate")]
     pub sample_rate_hz: u32,
+    /// Display name of the call owner — the human who launched the
+    /// bot. Used by the wake-word gate in [`crate::openhuman::meet_agent::session`]
+    /// as the *only* speaker allowed to issue tool calls. Captions
+    /// from any other participant are dropped without recording an
+    /// event. Empty string fails closed (no wake fires) so a
+    /// misconfigured shell can never expose the user's tool surface.
+    /// Defaulted so older shells / smoke tests that don't yet set
+    /// the field still parse the payload.
+    #[serde(default)]
+    pub owner_display_name: String,
+    /// Display name the bot uses as its Meet participant tile.
+    /// Captions whose `speaker` matches this name are treated as the
+    /// bot's own TTS echoing back and dropped — without an explicit
+    /// filter the bot would re-wake on its own voice. Empty disables
+    /// the filter; dedup + cooldown still apply but it's a weaker
+    /// posture.
+    #[serde(default)]
+    pub bot_display_name: String,
+    /// Normalised Meet URL the call joined. Persisted into the
+    /// recent-calls log so the UI can show "Joined `…/abc-defg-hij`
+    /// — 12 min ago". Defaulted so older shells that haven't been
+    /// updated to forward the URL still parse the payload.
+    #[serde(default)]
+    pub meet_url: String,
 }
 
 fn default_sample_rate() -> u32 {
@@ -111,6 +135,31 @@ pub struct PushCaptionResponse {
     pub turn_started: bool,
 }
 
+/// Inputs to `openhuman.meet_agent_list_calls`.
+///
+/// Returns the most recently completed Meet calls (newest first) so
+/// the Skills "Meeting Bots" card can render a history list inside
+/// the same modal the user used to launch the call. Capped server-
+/// side at `store::MAX_RECENT_CALLS` so a misconfigured client
+/// can't request an unbounded read.
+#[derive(Debug, Clone, Deserialize)]
+pub struct ListCallsRequest {
+    /// Maximum rows to return. Defaults to 50 if absent. Hard cap
+    /// applied server-side regardless of what the caller asks for.
+    #[serde(default)]
+    pub limit: Option<usize>,
+}
+
+/// Outputs from `openhuman.meet_agent_list_calls`.
+#[derive(Debug, Clone, Serialize)]
+pub struct ListCallsResponse {
+    pub ok: bool,
+    pub calls: Vec<super::store::MeetCallRecord>,
+    /// Number of rows in `calls`. Convenient for the UI when
+    /// rendering a header like "Recent calls (12)".
+    pub count: usize,
+}
+
 /// Inputs to `openhuman.meet_agent_stop_session`.
 #[derive(Debug, Clone, Deserialize)]
 pub struct StopSessionRequest {