gemini-3.1-flash-live-preview through a Durable Object in the
existing tuturuuu-meet Worker. It does not require a self-hosted process.
The Worker holds the Gemini API key; browsers receive short-lived,
purpose-bound session tokens and connect through /live-connect.
Audience and permissions
A personal session captures only its owner’s microphone and plays replies only on that device. Starting it mutes the meeting microphone. If the user unmutes the meeting, personal capture and reply playback pause. Pausing also clears queued speech; incoming private audio is blocked while the room microphone is on. Use headphones: speaker audio can otherwise be picked up by an open physical microphone. Only a room admin can invite the room assistant. One room assistant can be active at a time. Its initiating device captures the meeting audio available to that device, limited to microphone tracks of participants who explicitly enable Talk to Mira. Screen-share audio is excluded. Audio unavailable to that device cannot be transcribed or understood. Participants see the assistant’s presence and may need to enable playback once because of browser autoplay restrictions. Room output is published through server-authenticated events. Browser tokens cannot impersonate Mira’s audio. The model can inspect current public meeting context, recall earlier session turns, and organize its context. Personal memory is not included in room mode. Personal sessions can use the selected workspace through the same permission-checked tools as text chat. The workspace picker validates the authenticated account against the current workspace actor; the per-device participant ID remains reserved for room transport and chat attribution. Hidden workspaces, guests, foreign actors and stale actor leases remain unavailable. The actual nested Live dialog regression uses distinct account and device IDs (live-workspace-identity.test.tsx). Every workspace read or change requires an inline private
approval before execution. Membership, current permissions, and arguments are
validated again at execution time. Room sessions never receive these tools.
A room admin can stop the shared assistant even when another admin invited it.
The room presence expires automatically if its initiating session disappears.
Mira in the meeting
Room chat is the default, including solo meetings. Mention @mira, @ttr, or @tuturuuu to request a text answer. While room Live is active, its initiating device also forwards new mentions to Live for a spoken answer. Mira Live posts its completed spoken answers in room chat using the room’s existing retention setting. Private turns never enter room chat automatically. Mira has its own tile, AI badge, speaking animation, pin control, and participant list entry. Talk to Mira / Mute to Mira controls only whether your microphone enters the Live mix; it does not mute you for other people. Listen to Mira / Deafen Mira independently controls local assistant playback. Listening starts automatically; microphones start excluded for every new Live session. Browser autoplay restrictions may require one click on Listen to Mira. Explicitly deafening Mira stays respected when playback reconnects. Participant badges expose both directions and distinguish an allowed input with a muted meeting microphone from an input excluded from Mira. The initiating browser must remain connected and receiving participants’ audio. During recovery, new chat mentions are queued in that browser; replayed room history does not retrigger Live. Acoustic spill from another opted-in person’s microphone cannot be separated from their voice, so use headphones where needed. Deploy the realtime protocol changes and Meet Worker together. Older clients without explicit microphone preferences are excluded from the new input mix. Older initiating clients must refresh before starting room Live; the Worker rejects microphone input from legacy sessions without the opt-in audio policy. Restart any room Live session created before this release to use voice input.Explicit approvals
A personal assistant may propose remembering a fact or sharing an exact reply with the room. The owner sees the proposed text, can edit it, and can approve or deny it. Workspace requests show their exact arguments. Approval claims each operation once before execution; an uncertain result is not automatically retried. Pending proposals expire after five minutes. No timeout implies approval. Interrupted actions are marked failed and are never silently replayed. Approved public replies use a fresh speech session containing only the approved text. The private session’s audio, memory, context, and resumption handle are never forwarded to the room. If speech delivery fails after the text was posted, the text remains in room chat; inspect the result before approving a retry.Memory and context
Memory is disabled by default. Owners can enable it and inspect, edit, or delete saved entries in meeting settings. Database policies restrict reads to the owner. Memory changes first stop the owner’s active personal sessions so cached private context cannot continue speaking after a deletion. A durable pending command blocks new personal sessions until an interrupted mutation has recovered. Context compression and session resumption support long conversations within available quota. They do not create a literally infinite model context window. The active journal keeps bounded recent turns and rolling checkpoints; a private Durable Object archive supports searching earlier turns in that session. Model summaries can omit details. Ending the session clears its journal, private review text, resumption handle, and archive in bounded batches; approved user memories and billing receipts remain separate. The client retries interrupted connections, including temporary token-refresh failures. Provider GoAway events use resumable sessions; bounded checkpoints are the fallback when a handle is no longer valid. Choose a voice before starting. Microphone and speaker changes in meeting settings also apply to the active personal assistant. Pausing or interrupting speech clears queued playback on the receiving devices. Audio is not archived, and audio never received by the service cannot be reconstructed after an outage.Usage and costs
Live reservations and settlement use the platform’s existing AI credit ledger and charge the initiating user’s personal workspace. Usage is accumulated from provider events by modality. Reservations use nine-minute holds and renew after eight minutes or before exhaustion; failed settlements remain durable and retry after the session ends. Final provider usage is collected during shutdown. Interrupted turns without a final usage receipt remain marked incomplete even if subsequent turns succeed. Room admins can see aggregated Live provider costs in meeting settings. The count represents billing periods, including renewed reservations and separate approved speech requests, rather than unique people. Updates are sequence-checked so retries do not count the same period twice. Personal transcripts and memories are not included in the cost response. Prices come from the existing model catalog and Google’s Gemini pricing. The published paid rates verified on 2026-09-10 are $0.75 per million text input tokens, $3 audio input, $1 image/video input, $4.50 text output, and $12 audio output. Google Search is $14 per thousand queries after shared allowances. Project-wide free allowances and Cloudflare Live Worker duration, storage, and requests are not fully allocated to individual meetings. Missing usage stays marked incomplete; these estimates do not replace provider invoices.Active-session alarm scope
A successful active Live tick schedules the next alarm for twenty seconds later. The tick first settles pending public billing and expires reviews, then maintains registry discoverability, sends the room heartbeat or personal context command, and performs primary quota settlement and usage reporting when billing exists. Renewal can add settlement, usage and reservation work; reconnect and queued tool responses add separate provider operations. Count those calls and persisted keys separately from the alarm itself. Pause suppresses provider input; it does not skip this alarm’s registry, room or billing work. The registry lease renews after successful registration. Its 23-hour failure boundary limits tolerated registry outages, not the lifetime of an otherwise healthy session. A future recurring-work bound must preserve active consent, quota coverage and privacy discoverability, with explicit expiry and an authenticated durable stop checked before dispatch and rescheduling. These are source-path findings, not measured billed-operation or hosted shutdown evidence; duplicate/restart, slow downstream, no-progress and Stop-race probes remain required before certifying a cost envelope.Ended-session compensation and retry safety
Ending Live stops capture and provider output, but unresolved server obligations can still require work. The session retains registry removal, room release, quota settlement, usage reporting and private-context erasure independently.cleanupEndedLiveSession handles registry/room compensation while
finalizeSessionBilling handles billing and context. The session alarm can invoke
both after ended is persisted. A completed flag for one obligation does not
prove completion of the others.
The current registry/room helper arms a future alarm before I/O and persists
completion flags afterward. It does not reserve a finite attempt count or job
expiry before the registry call. Repeated registry failure can therefore keep
scheduling work; a successful external operation followed by a failed progress
write can replay after reconstruction. Persisted session termination alone is
not an independent stop fence for this background work. The nominal one-minute
retry interval is not a hard operation or spending cap: billing retries, duplicate
invocations and restarts must be counted separately.
Active-session registry renewal has a separate privacy lease. It starts at the
12-hour boundary, and retryable failure is tolerated until 23 hours since the last
recorded renewal; at that boundary the helper throws after attempting registration.
These age checks do not reserve attempts: repeated reconstructed calls before the
boundary still each perform a registry RPC. Successful renewal suppresses later
calls only when its timestamp survives persistence. Invalid or future recorded timestamps
now fail closed before registration, as described in the clock-integrity contract
below. This clock fence does not reserve finite retry attempts.
If Stop arrives during registration, the helper attempts compensating removal;
removal failure must remain recoverable without authorizing an unlimited retry job.
Context erasure separately lists at most 128 archived turns per wake and deletes
those keys in a batch; each deleted key remains part of the storage envelope.
A full batch schedules a confirmation wake to discover any remaining turns.
Deletion failure retains the archive and schedules another attempt. Session
finalization persists state from both public-billing settlement and its final
step when the persisted completion receipt is absent, incomplete or inconsistent
with current obligations. Context erasure alone does not establish completion.
The completed-receipt guard described in the runbook performs one session-key
read and skips finalization writes only when durable and current completion agree
for the same session and owner, with no pending usage or public billing. It
rechecks obligations after the read. An in-memory flag alone cannot establish that
a prior progress write succeeded; registry and room compensation remain separate.
Public-billing settlement currently iterates the entire saved billing map in one
invocation. A record needing quota settlement, share completion and usage reporting
can perform three downstream requests and two session-state writes, followed by
one write for the map. Successful quota settlement is persisted before usage
reporting, so a usage failure can retry reporting without re-settling quota.
However, each failed record requests retry scheduling separately, and a failed
final map write can replay reporting after reconstruction. Count those scheduler
calls separately from delivered wakes: repeated scheduling can overwrite one alarm.
A bounded replacement needs a durable cursor and per-record progress; truncating
the map or dropping acknowledged-but-unpersisted obligations loses recovery state.
This is an operating limitation, not permission to discard unresolved work.
Approved memories, private-context deletion obligations, quota reservations and
billing receipts must remain distinguishable and durable. Do not mark cleanup
complete, delete recovery state or settle unknown usage as zero to stop retries.
Before changing this path, require a joint compensation contract:
- Reserve attempts and a finite job deadline durably before downstream work. Persist each obligation’s idempotent progress and stop automatic scheduling on terminal completion or exhaustion while retaining unresolved obligations.
- Bound downstream calls, response consumption and storage keys/rows per wake. Include registry/room cleanup and independently scheduled billing/context work in the operation envelope; an outer alarm cap alone is insufficient.
- Provide authenticated recovery for pending obligations and a durable stop fence checked before dispatch and rescheduling. Concurrent Stop, privacy revocation, queued callbacks and billing retries must not replenish or bypass the budget.
- Test duplicate alarms, reconstruction, clock boundaries, no progress, repeated downstream failure, reservation-write failure and successful downstream work followed by failed persistence. Count actual downstream calls and written keys, and exercise the corresponding real Worker/SQLite storage boundaries.
packages/meet-core/src/features/live-assistant/session-cleanup.test.ts verifies
that registry failure does not prevent independent room cleanup and that confirmed
completion stops later helper work. It does not establish finite retries,
reschedule-race safety, billing bounds or hosted alarm behavior. Keep those gates
explicit until their implementation and evidence exist. Billing alerts and
per-invocation CPU limits do not establish a total-spend cap.
Registry lease clock integrity
Active Live sessions require nonnegative safe-integer start and renewal timestamps. A renewal must lie between session start and the current server clock. Corrupt, nonfinite or future timestamps fail before a registry request; the session tick uses its existingsession_unavailable stop path to end capture and retain billing,
room-release and privacy cleanup obligations. A server clock rollback can therefore
end an active session instead of silently extending privacy discoverability.
This applies to personal and room Live sessions. Valid leases retain the twelve-hour
renewal and twenty-three-hour retryable-failure boundaries. Ended sessions still
attempt registry removal even when their lease timestamps are invalid. These checks
do not introduce finite compensation attempts, authenticated background Stop or a
spending cap. Count those independent obligations separately.
Regression coverage: registry-heartbeat.test.ts exercises invalid timestamps,
reconstruction without registration I/O, exact lease boundaries, duplicate renewal
and ended-session removal. session-cleanup.test.ts checks independent compensation.
These helper tests use controlled namespaces; real SQLite persistence, hosted
privacy revocation and the complete stop/reschedule path remain release gates.
Deployment and verification
Apply the additivemeet_private_ai_memory migration through the repository’s
normal migration pipeline. The Worker needs its existing Supabase configuration,
MEET_REALTIME_TOKEN_SECRET, and GOOGLE_GENERATIVE_AI_API_KEY; no key is sent
to another Worker or to the browser. Wrangler’s meet-live-v1 migration creates
the SQLite Durable Object binding MEET_LIVE.
Build the Cloudflare artifact, not only the Next application. The custom wrapper
re-exports OpenNext’s cache Durable Objects and delegates every unrelated route.
Verify the final uploaded bundle against the Workers size limit.
Before release, verify two devices can distinguish private and room audio,
room guests cannot mint an assistant stream, memory changes cancel personal
sessions, explicit share approvals publish only the previewed content, and quota
settlement remains accurate after reconnects. Use synthetic conversation content
and isolated test rooms. Do not end an employee’s active meeting during checks.
Voice recovery and review outcomes
Microphone capture uses the browser’s 16 kHz resampler and flushes its final partial frame when stopped. A disconnected personal microphone pauses Live input; select a working microphone in settings before resuming. Starting personal voice mutes the meeting microphone; a failed startup restores its previous enabled state. Room playback requires the listener to enable audio, with at most three seconds of recent audio buffered while the browser awaits that gesture. Approved tool outcomes are saved before provider delivery. After a reconnect they are supplied as completed results, never automatically executed again. A workspace operation with no completion acknowledgement after two minutes becomes an unknown outcome for the requester to inspect and discard; discarding never retries the action. Permission checks and approval are required for every private workspace operation. Task metadata tools without a matching permission gate are not exposed. Deployment checks requireGOOGLE_GENERATIVE_AI_API_KEY on the Meet Worker.
Missing provider token allocation or search grounding usage remains marked as
incomplete cost coverage instead of being counted as free.
Server requests carrying room tokens or database credentials use redirect: 'manual'
and reject non-success statuses. Cloudflare’s workerd runtime does not implement
redirect: 'error'; using it throws before the request reaches the upstream and
can fail the Live WebSocket upgrade. Do not replace this with follow, which
could forward credentials to a redirect target. Verify the deployed upgrade in
addition to the Next.js start-session route and provider-only tests.