feat(web): voice input — record, check the recognised text, send

Microphone button in the chat composer and in free-text steps. The browser
records 16 kHz mono WAV (no server-side ffmpeg), /me/{token}/stt transcribes,
the text lands in the field for the patient to check and edit — never sent
automatically, so safety and scrub() apply on send. Hidden when the server has
voice input off or the browser lacks a microphone API. nginx: 4 MB body limit.

Refs #117

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.env.example

@@ -11,6 +11,10 @@ CHAT_AGENT=auto
 OPENROUTER_API_KEY=
 OPENROUTER_MODEL=google/gemini-2.5-flash-lite
 
+# --- Voice input (speech-to-text): auto | off | mock | openrouter. OpenRouter = synthetic data only (ADR-014).
+STT_PROVIDER=auto
+STT_MODEL=google/gemini-2.5-flash
+
 # --- Pseudonymisation key: 32+ random bytes, hex. Generate: python -c "import secrets;print(secrets.token_hex(32))"
 PSEUDO_KEY=
 

app/api/patient_web.py

@@ -17,17 +17,19 @@ issued by the server instead of handing out the pseudonymous token itself.
 
 import logging
 import secrets
+import time as monotonic_time
 from collections import defaultdict
 from datetime import date, datetime, time, timedelta
 from typing import Any, Literal
 from zoneinfo import ZoneInfo
 
-from fastapi import APIRouter, HTTPException
+from fastapi import APIRouter, HTTPException, Request
 from pydantic import BaseModel, ConfigDict, Field
 from sqlalchemy import select
 
 from app.api import fixtures
 from app.api.schemas import DemoPersona
+from app.config import get_settings
 from app.core import clock
 from app.core.instrument_catalog import Catalog, catalog
 from app.core.intake_questions import DIARY_KINDS
@@ -42,6 +44,7 @@ from app.db.identity import TOKEN_LEN
 from app.db.intake import QuestionnaireRecord
 from app.db.session import get_clinical_session, get_identity_session
 from app.integrations.emias_mock import CODE_MAX_LEN, EmiasMock
+from app.llm.stt import InvalidAudio, SttError, SttNoSpeech, get_stt, wav_seconds
 from app.services import anonymous_care
 from app.services.garden import Garden, garden_for
 
@@ -220,7 +223,56 @@ async def auth_anonymous(body: AnonymousIn | None = None) -> AuthOut:
 @router.get("/patient/capabilities")
 async def patient_capabilities() -> dict[str, bool]:
     """Expose availability without leaking clinical policy or server configuration."""
-    return {"primary_screening": intake_enabled()}
+    return {"primary_screening": intake_enabled(), "voice_input": get_stt(get_settings()) is not None}
+
+
+class SttOut(BaseModel):
+    text: str
+    provider: str
+
+
+# 16 kHz mono 16-bit PCM = 32 000 bytes/s, + header slack.
+_WAV_BYTES_PER_SECOND = 32_000
+
+
+@router.post("/me/{token}/stt", response_model=SttOut)
+async def transcribe_voice(token: str, request: Request) -> SttOut:
+    """Voice → text for the patient to check and edit (#116). Body: raw `audio/wav`, 16 kHz mono.
+
+    Only transcribes: nothing is written to the dialog and the agent is not called — the patient sends the
+    checked text as an ordinary message, where safety and `scrub()` apply. The audio is neither stored nor logged.
+    """
+    settings = get_settings()
+    stt = get_stt(settings)
+    if stt is None:
+        raise HTTPException(404, "voice input is off")
+    async with get_clinical_session() as s:
+        if await repo.get_profile(s, token) is None:
+            raise HTTPException(404, "patient not found")
+    max_bytes = (settings.stt_max_seconds + 2) * _WAV_BYTES_PER_SECOND + 4096
+    declared = request.headers.get("content-length")
+    if declared and declared.isdigit() and int(declared) > max_bytes:
+        raise HTTPException(413, "recording too long")
+    audio = await request.body()
+    if len(audio) > max_bytes:
+        raise HTTPException(413, "recording too long")
+    try:
+        seconds = wav_seconds(audio)
+    except InvalidAudio as exc:
+        raise HTTPException(415, "expected audio/wav") from exc
+    if seconds > settings.stt_max_seconds + 1:
+        raise HTTPException(413, "recording too long")
+    started = monotonic_time.monotonic()  # latency only, not domain time (that is app.core.clock)
+    try:
+        text = await stt.transcribe(audio, "wav")
+    except SttNoSpeech as exc:
+        raise HTTPException(422, "no speech recognised") from exc
+    except SttError as exc:
+        log.warning("stt failed tok=%s provider=%s: %s", token[:6], stt.name, exc)
+        raise HTTPException(503, "speech recognition unavailable") from exc
+    ms = int((monotonic_time.monotonic() - started) * 1000)
+    log.info("stt tok=%s provider=%s secs=%.1f ms=%d chars=%d", token[:6], stt.name, seconds, ms, len(text))
+    return SttOut(text=text, provider=stt.name)
 
 
 @router.post("/me/{token}/doctor/connect")

app/config.py

@@ -42,6 +42,13 @@ class Settings(BaseSettings):
     chat_agent_timeout_s: float = 25.0
     chat_agent_max_steps: int = 5
 
+    # Voice input (#116): speech-to-text for the patient's messages. `auto` = OpenRouter if a key is set, else mock.
+    # OpenRouter STT is synthetic data only (ADR-014): the audio leaves the RF and cannot be scrubbed.
+    stt_provider: Literal["auto", "off", "mock", "openrouter"] = "auto"
+    stt_model: str = "google/gemini-2.5-flash"  # needs audio input
+    stt_timeout_s: float = 30.0
+    stt_max_seconds: int = Field(default=60, ge=5, le=300)
+
     # Telegram is used only for the prototype on synthetic data; prod channel is MAX / Gosuslugi.
     tg_bot_token: str = ""
     # The RF server reaches api.telegram.org over IPv6 only; docker has IPv4 only → go through a proxy (http/socks).

app/llm/stt.py

@@ -0,0 +1,162 @@
+"""Speech-to-text for the patient's voice input (#116, slide 11: record → check the text → send).
+
+The service only transcribes: the text goes back to the patient to check and edit, and reaches the dialog as an
+ordinary text message — safety, `scrub()` and the LLM gateway apply there. Audio is never stored or logged.
+
+* `OpenRouterSTT` — an audio-capable model via OpenRouter `/chat/completions` (`input_audio`). TEMPORARY, synthetic
+  data only (ADR-014): voice is personal data that `scrub()` cannot depersonalise, and OpenRouter is a foreign
+  service (152-FZ). Real patients need an RF provider (SaluteSpeech, #121) behind the same `SpeechToText` contract.
+* `MockSTT` — offline, returns a fixed synthetic phrase (ADR-004: the demo works without network).
+"""
+
+import asyncio
+import base64
+import logging
+import struct
+from functools import lru_cache
+from pathlib import Path
+from typing import Protocol
+
+import httpx
+import yaml
+from pydantic import BaseModel
+
+from app.config import Settings
+
+log = logging.getLogger(__name__)
+
+_RETRY_STATUSES = {429, 500, 502, 503, 504}
+_ATTEMPTS = 3
+
+
+class SttTexts(BaseModel):
+    system: str
+    user: str
+    silence_marker: str
+    mock_transcript: str
+
+
+@lru_cache
+def load_texts(path: Path | None = None) -> SttTexts:
+    from app.config import get_settings
+
+    path = path or get_settings().config_dir / "texts" / "stt.yaml"
+    return SttTexts.model_validate(yaml.safe_load(path.read_text(encoding="utf-8")))
+
+
+class SttError(RuntimeError):
+    """The provider failed (network, HTTP error, bad response)."""
+
+
+class SttNoSpeech(SttError):
+    """The recording holds no recognisable speech."""
+
+
+class InvalidAudio(ValueError):
+    pass
+
+
+def wav_seconds(audio: bytes) -> float:
+    """Duration of a PCM WAV file; raises `InvalidAudio` for anything else."""
+    if len(audio) < 44 or audio[:4] != b"RIFF" or audio[8:12] != b"WAVE":
+        raise InvalidAudio("not a WAV file")
+    pos, byte_rate = 12, 0
+    while pos + 8 <= len(audio):
+        chunk_id, size = audio[pos : pos + 4], struct.unpack_from("<I", audio, pos + 4)[0]
+        if chunk_id == b"fmt " and size >= 16:
+            byte_rate = struct.unpack_from("<I", audio, pos + 16)[0]
+        elif chunk_id == b"data":
+            if not byte_rate:
+                break
+            return min(size, len(audio) - pos - 8) / byte_rate
+        pos += 8 + size + (size & 1)
+    raise InvalidAudio("malformed WAV")
+
+
+class SpeechToText(Protocol):
+    name: str
+
+    async def transcribe(self, audio: bytes, fmt: str = "wav") -> str: ...
+
+
+class MockSTT:
+    name = "mock"
+
+    async def transcribe(self, audio: bytes, fmt: str = "wav") -> str:
+        return load_texts().mock_transcript
+
+
+class OpenRouterSTT:
+    name = "openrouter"
+
+    def __init__(self, settings: Settings, client: httpx.AsyncClient | None = None) -> None:
+        self._key = settings.openrouter_api_key
+        self._model = settings.stt_model
+        self._url = settings.openrouter_base_url.rstrip("/") + "/chat/completions"
+        self._timeout = settings.stt_timeout_s
+        self._proxy = settings.openrouter_proxy_url or None
+        self._client = client
+
+    async def transcribe(self, audio: bytes, fmt: str = "wav") -> str:
+        texts = load_texts()
+        content = [
+            {"type": "text", "text": texts.user},
+            {"type": "input_audio", "input_audio": {"data": base64.b64encode(audio).decode(), "format": fmt}},
+        ]
+        body = {
+            "model": self._model,
+            "messages": [{"role": "system", "content": texts.system}, {"role": "user", "content": content}],
+            "temperature": 0,
+            "max_tokens": 800,
+            # Transcription needs no thinking: with reasoning on, gemini-2.5-flash takes ~60 s instead of ~3 s.
+            "reasoning": {"enabled": False},
+        }
+        data = await self._post(body)
+        try:
+            text = (data["choices"][0]["message"]["content"] or "").strip()
+        except (KeyError, IndexError, TypeError) as exc:
+            raise SttError("bad response") from exc
+        text = text.strip("«»\"' \n")
+        if not text or text.lower() == texts.silence_marker.lower():
+            raise SttNoSpeech("no speech")
+        return text
+
+    async def _post(self, body: dict) -> dict:
+        headers = {"Authorization": f"Bearer {self._key}", "X-Title": "PTSRaiAgent prototype (synthetic data)"}
+        for attempt in range(_ATTEMPTS):
+            try:
+                if self._client is not None:
+                    resp = await self._client.post(self._url, json=body, headers=headers, timeout=self._timeout)
+                else:
+                    async with httpx.AsyncClient(timeout=self._timeout, proxy=self._proxy) as client:
+                        resp = await client.post(self._url, json=body, headers=headers)
+            except httpx.HTTPError as exc:
+                if attempt + 1 == _ATTEMPTS:
+                    raise SttError(type(exc).__name__) from exc
+                await asyncio.sleep(0.5 * 2**attempt)
+                continue
+            if resp.status_code in _RETRY_STATUSES and attempt + 1 < _ATTEMPTS:
+                log.warning("stt openrouter http %s, retry %d", resp.status_code, attempt + 1)
+                await asyncio.sleep(0.5 * 2**attempt)
+                continue
+            if resp.status_code != 200:
+                # Provider error bodies carry no patient data — log the message to make failures diagnosable.
+                log.error("stt openrouter http %s: %s", resp.status_code, resp.text[:200])
+                raise SttError(f"http {resp.status_code}")
+            try:
+                return resp.json()
+            except ValueError as exc:
+                raise SttError("bad json") from exc
+        raise SttError("retries exhausted")
+
+
+def get_stt(settings: Settings) -> SpeechToText | None:
+    """The configured provider; `None` = voice input is off. `auto` = OpenRouter if a key is set, else mock."""
+    mode = settings.stt_provider
+    if mode == "auto":
+        mode = "openrouter" if settings.openrouter_api_key else "mock"
+    if mode == "openrouter":
+        return OpenRouterSTT(settings) if settings.openrouter_api_key else None
+    if mode == "mock":
+        return MockSTT()
+    return None

config/texts/stt.yaml

@@ -0,0 +1,17 @@
+# Распознавание голоса пациента (#116). Модель только расшифровывает речь — не отвечает и не советует.
+# Расшифровка возвращается пациенту на проверку и уходит в диалог обычным текстом (safety → scrub → LLM).
+
+# Системная инструкция модели распознавания.
+system: >-
+  Ты — система распознавания речи. Дословно расшифруй русскую речь из аудио.
+  Выведи только расшифровку: без кавычек, пояснений и ответа на сказанное.
+  Ставь знаки препинания. Если в записи совсем нет речи — выведи ровно [тишина].
+
+# Текст рядом с аудио в сообщении пользователя.
+user: "Расшифруй эту аудиозапись."
+
+# Что модель возвращает, если речи нет (сравнивается без учёта регистра).
+silence_marker: "[тишина]"
+
+# Офлайн-режим (STT_PROVIDER=mock): фиксированная фраза демо-пациента, синтетика.
+mock_transcript: "Сегодня долго не мог уснуть. Хочу обсудить это на следующей встрече."

docs/DECISIONS.md

@@ -3,6 +3,15 @@
 > Живой журнал: **что** решили и **почему**. Новые записи — сверху. Одна запись = одно решение.
 > При конфликте с [`docs/info/SPEC.md`](info/SPEC.md) действует ADR.
 
+## 2026-10-31 — ADR-014: Голосовой ввод — расшифровка отдельно от диалога; OpenRouter только на синтетике
+**Контекст:** для гранта ВШЭ и пилота «Династия» нужен голосовой ввод (слайд 11: «Записать → Проверить → Сводка»). Голос — ПДн, а `scrub()` его не обезличивает. OpenRouter — зарубежный сервис (ADR-004, guardrail 9).
+**Решение:**
+1. `POST /me/{token}/stt` **только расшифровывает**. Текст возвращается пациенту на проверку и правку, в диалог уходит обычным сообщением, поэтому safety, `scrub()` и шлюз LLM работают как с набранным текстом. Автоотправки нет.
+2. Аудио не сохраняется и не логируется. В лог пишутся только длительность, провайдер, время ответа и длина текста.
+3. Формат — WAV 16 кГц mono, его кодирует браузер: ffmpeg на сервере не нужен, одинаково работает в Chrome и iOS Safari. Лимит — `STT_MAX_SECONDS` (60 с).
+4. Провайдеры за одним протоколом `SpeechToText` (`app/llm/stt.py`): `mock` (офлайн), `openrouter` (модель с аудиовходом, `input_audio`). **OpenRouter допустим только на синтетических данных** (демо, жюри, грант). До первого реального пациента нужен РФ-провайдер, SaluteSpeech (#121).
+**Последствия:** голос в демо работает без новых зависимостей. Для пилота нужен договор с SaluteSpeech.
+
 ## 2026-10-04 — ADR-013: Правки по клиническому ревью — красные флаги, одно правило кризиса, звонок после кризиса, одна таблица номеров
 **Контекст:** ревью опросников: обязательны блок красных флагов и план безопасности со звонком после кризиса; маршрутизация должна сначала смотреть на риск и флаги, потом на шкалы; в документе два противоречащих правила кризисного экрана («любое Да» против «только высокий риск»); кризисные номера разбросаны по текстам (и чат-агент давал взрослым детский телефон доверия).
 **Решение:**

tests/test_api_patient_web.py

@@ -267,9 +267,9 @@ async def test_connect_care_does_not_reassign_or_create_patients(client: AsyncCl
 
 async def test_screening_capability_respects_release_gate(client: AsyncClient, monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setenv("INTAKE_DEMO", "0")
-    assert (await client.get("/api/v1/patient/capabilities")).json() == {"primary_screening": False}
+    assert (await client.get("/api/v1/patient/capabilities")).json()["primary_screening"] is False
     monkeypatch.setenv("INTAKE_DEMO", "1")
-    assert (await client.get("/api/v1/patient/capabilities")).json() == {"primary_screening": True}
+    assert (await client.get("/api/v1/patient/capabilities")).json()["primary_screening"] is True
 
 
 async def test_anonymous_contact_request_reaches_doctor(client: AsyncClient, monkeypatch: pytest.MonkeyPatch) -> None:

tests/test_api_stt.py

@@ -0,0 +1,71 @@
+"""Voice input endpoint (#116): transcribes only, validates the audio, never touches the dialog."""
+
+from collections.abc import AsyncIterator
+
+import pytest
+from httpx import ASGITransport, AsyncClient
+from sqlalchemy import select
+
+from app.api import patient_web
+from app.db import session
+from app.db.bootstrap import init_db
+from app.db.clinical import Message
+from app.llm.stt import MockSTT, SttError, SttNoSpeech, load_texts
+from app.main import app
+from tests.test_llm_stt import make_wav
+
+MEM = "sqlite+aiosqlite:///:memory:"
+WAV = {"Content-Type": "audio/wav"}
+
+
+@pytest.fixture
+async def client(monkeypatch: pytest.MonkeyPatch) -> AsyncIterator[AsyncClient]:
+    monkeypatch.setattr(patient_web, "get_stt", lambda _settings: MockSTT())  # never the network in tests
+    await session.configure(identity_url=MEM, clinical_url=MEM)
+    await init_db()
+    async with AsyncClient(transport=ASGITransport(app=app), base_url="http://test") as c:
+        yield c
+    await session.configure()
+
+
+async def _token(client: AsyncClient) -> str:
+    return (await client.post("/api/v1/auth/anonymous")).json()["token"]
+
+
+async def test_transcribes_without_writing_to_dialog(client: AsyncClient) -> None:
+    token = await _token(client)
+    resp = await client.post(f"/api/v1/me/{token}/stt", content=make_wav(2), headers=WAV)
+    assert resp.status_code == 200
+    assert resp.json() == {"text": load_texts().mock_transcript, "provider": "mock"}
+    async with session.get_clinical_session() as s:
+        assert (await s.execute(select(Message))).scalars().all() == []
+
+
+async def test_capability_and_off(client: AsyncClient, monkeypatch: pytest.MonkeyPatch) -> None:
+    assert (await client.get("/api/v1/patient/capabilities")).json()["voice_input"] is True
+    monkeypatch.setattr(patient_web, "get_stt", lambda _settings: None)
+    assert (await client.get("/api/v1/patient/capabilities")).json()["voice_input"] is False
+    token = await _token(client)
+    assert (await client.post(f"/api/v1/me/{token}/stt", content=make_wav(1), headers=WAV)).status_code == 404
+
+
+async def test_rejects_unknown_patient_bad_format_and_long_audio(client: AsyncClient) -> None:
+    assert (await client.post("/api/v1/me/nobody/stt", content=make_wav(1), headers=WAV)).status_code == 404
+    token = await _token(client)
+    url = f"/api/v1/me/{token}/stt"
+    assert (await client.post(url, content=b"OggS" + b"\0" * 200)).status_code == 415
+    assert (await client.post(url, content=make_wav(70), headers=WAV)).status_code == 413
+    assert (await client.post(url, content=make_wav(10, rate=48_000), headers=WAV)).status_code == 200
+
+
+@pytest.mark.parametrize(("error", "status"), [(SttNoSpeech("x"), 422), (SttError("x"), 503)])
+async def test_provider_errors(client: AsyncClient, monkeypatch: pytest.MonkeyPatch, error, status) -> None:
+    class Failing:
+        name = "failing"
+
+        async def transcribe(self, audio: bytes, fmt: str = "wav") -> str:
+            raise error
+
+    monkeypatch.setattr(patient_web, "get_stt", lambda _settings: Failing())
+    token = await _token(client)
+    assert (await client.post(f"/api/v1/me/{token}/stt", content=make_wav(1), headers=WAV)).status_code == status

tests/test_llm_stt.py

@@ -0,0 +1,107 @@
+"""Speech-to-text providers (#116): OpenRouter request shape, retries, silence, WAV parsing, provider choice."""
+
+import base64
+import io
+import json
+import wave
+
+import httpx
+import pytest
+
+from app.config import Settings
+from app.llm.stt import (
+    InvalidAudio,
+    MockSTT,
+    OpenRouterSTT,
+    SttError,
+    SttNoSpeech,
+    get_stt,
+    load_texts,
+    wav_seconds,
+)
+
+
+def make_wav(seconds: float, rate: int = 16_000) -> bytes:
+    buf = io.BytesIO()
+    with wave.open(buf, "wb") as w:
+        w.setnchannels(1)
+        w.setsampwidth(2)
+        w.setframerate(rate)
+        w.writeframes(b"\x00\x00" * int(rate * seconds))
+    return buf.getvalue()
+
+
+def _settings(**kw) -> Settings:
+    base = {"openrouter_api_key": "test", "stt_provider": "openrouter", "stt_timeout_s": 5.0}
+    return Settings(_env_file=None, **{**base, **kw})
+
+
+def _fake(responses: list[httpx.Response]) -> tuple[OpenRouterSTT, list[dict]]:
+    sent: list[dict] = []
+    replies = iter(responses)
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        sent.append(json.loads(request.content))
+        return next(replies)
+
+    stt = OpenRouterSTT(_settings(), client=httpx.AsyncClient(transport=httpx.MockTransport(handler)))
+    return stt, sent
+
+
+def _ok(text: str) -> httpx.Response:
+    return httpx.Response(200, json={"choices": [{"message": {"content": text}}]})
+
+
+def test_wav_seconds() -> None:
+    assert wav_seconds(make_wav(2.5)) == pytest.approx(2.5)
+    with pytest.raises(InvalidAudio):
+        wav_seconds(b"OggS" + b"\x00" * 100)
+    with pytest.raises(InvalidAudio):
+        wav_seconds(b"")
+
+
+async def test_openrouter_sends_audio_and_returns_transcript() -> None:
+    audio = make_wav(1)
+    stt, sent = _fake([_ok("«Сегодня плохо спал.»")])
+    assert await stt.transcribe(audio) == "Сегодня плохо спал."
+    body = sent[0]
+    assert body["model"] == "google/gemini-2.5-flash" and body["temperature"] == 0
+    assert body["reasoning"] == {"enabled": False}
+    part = body["messages"][1]["content"][1]
+    assert part["type"] == "input_audio" and part["input_audio"]["format"] == "wav"
+    assert base64.b64decode(part["input_audio"]["data"]) == audio
+
+
+async def test_silence_marker_is_no_speech() -> None:
+    stt, _ = _fake([_ok(load_texts().silence_marker.upper())])
+    with pytest.raises(SttNoSpeech):
+        await stt.transcribe(make_wav(1))
+
+
+async def test_retries_then_succeeds(monkeypatch) -> None:
+    monkeypatch.setattr("app.llm.stt.asyncio.sleep", _no_sleep)
+    stt, sent = _fake([httpx.Response(503), _ok("текст")])
+    assert await stt.transcribe(make_wav(1)) == "текст"
+    assert len(sent) == 2
+
+
+async def test_http_error_raises(monkeypatch) -> None:
+    monkeypatch.setattr("app.llm.stt.asyncio.sleep", _no_sleep)
+    stt, _ = _fake([httpx.Response(401, json={"error": {"message": "bad key"}})])
+    with pytest.raises(SttError):
+        await stt.transcribe(make_wav(1))
+
+
+async def _no_sleep(_: float) -> None:
+    return None
+
+
+async def test_mock_is_offline() -> None:
+    assert await MockSTT().transcribe(b"") == load_texts().mock_transcript
+
+
+def test_provider_choice() -> None:
+    assert isinstance(get_stt(_settings(stt_provider="auto")), OpenRouterSTT)
+    assert isinstance(get_stt(_settings(stt_provider="auto", openrouter_api_key="")), MockSTT)
+    assert get_stt(_settings(stt_provider="openrouter", openrouter_api_key="")) is None
+    assert get_stt(_settings(stt_provider="off")) is None

web/nginx.conf

@@ -14,5 +14,6 @@ server {
         proxy_http_version 1.1;
         proxy_buffering off;
         proxy_read_timeout 120s;
+        client_max_body_size 4m; # voice input: up to 60 s of 16 kHz WAV (~1.9 MB)
     }
 }

web/src/api/client.ts

@@ -46,7 +46,23 @@ export const api = {
   signInAnonymous: (focus?: Focus) => post<AuthResult>("/auth/anonymous", { focus }),
   // Presentation entry: a fresh private copy of the demo patient, straight to the chat.
   signInDemoFresh: () => post<AuthResult>("/auth/demo/fresh", {}),
-  patientCapabilities: () => request<{ primary_screening: boolean }>("/patient/capabilities"),
+  patientCapabilities: () =>
+    request<{ primary_screening: boolean; voice_input?: boolean }>("/patient/capabilities"),
+  // Voice → text for the patient to check (#117). Raw WAV body; the server only transcribes.
+  transcribe: async (token: string, wav: Blob): Promise<string> => {
+    let res: Response;
+    try {
+      res = await fetch(`${BASE}/me/${encodeURIComponent(token)}/stt`, {
+        method: "POST",
+        headers: { "Content-Type": "audio/wav" },
+        body: wav,
+      });
+    } catch {
+      throw new ApiError(0, "network");
+    }
+    if (!res.ok) throw new ApiError(res.status, res.statusText);
+    return ((await res.json()) as { text: string }).text;
+  },
   connectDoctor: (token: string) => post<{ has_doctor: boolean }>(`/me/${encodeURIComponent(token)}/doctor/connect`),
   demoPersonas: () => request<DemoPersona[]>("/patient/demo-personas"),
   crisisResources: () => request<CrisisResource[]>("/crisis/resources"),

web/src/components/Icon.tsx

@@ -32,6 +32,12 @@ const paths = {
   arrowLeft: <path d="M19 12H5m6-6l-6 6 6 6" />,
   close: <path d="M6 6l12 12M18 6L6 18" />,
   check: <path d="M5 12.5l4.5 4.5L19 7.5" />,
+  mic: (
+    <>
+      <rect x="9" y="3" width="6" height="11" rx="3" />
+      <path d="M5.5 11a6.5 6.5 0 0 0 13 0M12 17.5V21" />
+    </>
+  ),
   x: <path d="M7 7l10 10M17 7L7 17" />,
   info: (
     <>

web/src/components/VoiceInput.tsx

@@ -0,0 +1,165 @@
+import { useEffect, useRef, useState } from "react";
+
+import { ApiError, api } from "../api/client";
+import { ru } from "../content/ru";
+import { useSession } from "../session/SessionContext";
+import { MAX_SECONDS, Recorder, voiceSupported } from "../voice/recorder";
+import { Icon } from "./Icon";
+import { useToast } from "./Toast";
+
+/*
+ * Voice input next to a free-text field (#117, slide 11: «Записать → Проверить»). The recognised text is put into
+ * the field for the patient to check and edit — never sent automatically: safety and scrub() run when they send it.
+ */
+
+let capability: Promise<boolean> | null = null;
+function voiceEnabled(): Promise<boolean> {
+  capability ??= api
+    .patientCapabilities()
+    .then((c) => Boolean(c.voice_input) && voiceSupported())
+    .catch(() => false);
+  return capability;
+}
+
+const BARS = 14;
+type State = "idle" | "recording" | "transcribing";
+
+export function VoiceInput({
+  disabled,
+  onText,
+  compact,
+}: {
+  disabled?: boolean;
+  onText: (text: string) => void;
+  /** Chat composer: a round icon button; the recording panel floats above the composer. */
+  compact?: boolean;
+}) {
+  const { session } = useSession();
+  const toast = useToast();
+  const [enabled, setEnabled] = useState(false);
+  const [state, setState] = useState<State>("idle");
+  const [seconds, setSeconds] = useState(0);
+  const [levels, setLevels] = useState<number[]>(() => Array(BARS).fill(0));
+  const rec = useRef<Recorder | null>(null);
+  const timer = useRef<number>();
+
+  useEffect(() => {
+    let alive = true;
+    void voiceEnabled().then((on) => alive && setEnabled(on));
+    return () => {
+      alive = false;
+      window.clearInterval(timer.current);
+      rec.current?.cancel();
+    };
+  }, []);
+
+  if (!enabled || !session) return null;
+
+  const start = async () => {
+    const r = new Recorder();
+    try {
+      await r.start((level) => setLevels((prev) => [...prev.slice(1), level]));
+    } catch {
+      r.cancel();
+      toast(ru.voice.noMic);
+      return;
+    }
+    rec.current = r;
+    setSeconds(0);
+    setState("recording");
+    const began = Date.now();
+    timer.current = window.setInterval(() => {
+      const s = Math.floor((Date.now() - began) / 1000);
+      setSeconds(s);
+      if (s >= MAX_SECONDS) void stop();
+    }, 250);
+  };
+
+  const reset = () => {
+    window.clearInterval(timer.current);
+    rec.current = null;
+    setLevels(Array(BARS).fill(0));
+  };
+
+  const stop = async () => {
+    const wav = rec.current?.stop() ?? null;
+    reset();
+    if (!wav) {
+      setState("idle");
+      return;
+    }
+    setState("transcribing");
+    try {
+      const text = await api.transcribe(session.token, wav);
+      onText(text);
+      toast(ru.voice.check);
+    } catch (e) {
+      const status = e instanceof ApiError ? e.status : 0;
+      toast(status === 422 ? ru.voice.noSpeech : status === 413 ? ru.voice.tooLong : ru.voice.failed);
+    } finally {
+      setState("idle");
+    }
+  };
+
+  const cancel = () => {
+    rec.current?.cancel();
+    reset();
+    setState("idle");
+  };
+
+  if (state === "idle" && compact) {
+    return (
+      <button
+        type="button"
+        className="mic"
+        disabled={disabled}
+        onClick={() => void start()}
+        aria-label={ru.voice.start}
+        title={ru.voice.start}
+      >
+        <Icon name="mic" size={20} />
+      </button>
+    );
+  }
+  if (state === "idle") {
+    return (
+      <button type="button" className="voice-btn" disabled={disabled} onClick={() => void start()}>
+        <Icon name="mic" size={20} />
+        {ru.voice.start}
+      </button>
+    );
+  }
+
+  const mm = String(Math.floor(seconds / 60)).padStart(2, "0");
+  const ss = String(seconds % 60).padStart(2, "0");
+  return (
+    <div className={compact ? "voice voice--float" : "voice"} role="group" aria-label={ru.voice.recording}>
+      {state === "recording" ? (
+        <>
+          <p className="voice__hint">{ru.voice.recording}</p>
+          <div className="voice__wave" aria-hidden="true">
+            {levels.map((l, i) => (
+              <span key={i} style={{ height: `${Math.max(12, Math.round(l * 100))}%` }} />
+            ))}
+          </div>
+          <div className="voice__row">
+            <span className="voice__time" aria-live="off">
+              {mm}:{ss}
+            </span>
+            <button type="button" className="btn btn--ghost voice__cancel" onClick={cancel}>
+              {ru.voice.cancel}
+            </button>
+            <button type="button" className="btn btn--primary voice__stop" onClick={() => void stop()}>
+              {ru.voice.stop}
+            </button>
+          </div>
+          <p className="voice__privacy">{ru.voice.privacy}</p>
+        </>
+      ) : (
+        <p className="voice__hint" aria-live="polite">
+          {ru.voice.transcribing}
+        </p>
+      )}
+    </div>
+  );
+}

web/src/content/ru.ts

@@ -251,6 +251,19 @@ export const ru = {
     drinksLead: "Посчитайте, сколько порций выходит в обычный день, когда вы выпиваете.",
     noticeTitle: "Опрос приостановлен",
   },
+  voice: {
+    start: "Сказать голосом",
+    stop: "Остановить запись",
+    cancel: "Отменить",
+    recording: "Говорите — запись идёт",
+    transcribing: "Распознаём речь…",
+    check: "Проверьте распознанный текст — его можно исправить перед отправкой.",
+    privacy: "Запись не сохраняется: её видит только система распознавания, текст — специалисты вашей программы.",
+    noMic: "Нет доступа к микрофону. Разрешите его в настройках браузера или напишите текстом.",
+    noSpeech: "Не удалось разобрать речь. Попробуйте ещё раз или напишите текстом.",
+    failed: "Распознавание сейчас недоступно. Напишите, пожалуйста, текстом.",
+    tooLong: "Запись слишком длинная — до минуты за раз.",
+  },
   messages: {
     typing: "Помощник печатает",
     title: "Сообщения",

web/src/screens/Flow.tsx

@@ -5,6 +5,7 @@ import type { Catalog, DialogButton } from "../api/types";
 import { AppShell, Notice, TopBar } from "../components/AppShell";
 import { HotlineCard, telHref, useHelp } from "../components/HelpSheet";
 import { useToast } from "../components/Toast";
+import { VoiceInput } from "../components/VoiceInput";
 import { Icon, type IconName } from "../components/Icon";
 import { useCatalog } from "../content/reference";
 import { ru } from "../content/ru";
@@ -259,6 +260,7 @@ function FreeText({
         />
         <span className="textarea__count">{text.length}/500</span>
       </div>
+      <VoiceInput disabled={busy} onText={(t) => setText((prev) => (prev.trim() ? `${prev.trim()} ${t}` : t).slice(0, 500))} />
       <div className="btn-row">
         {skip ? (
           <button type="button" className="btn btn--ghost" disabled={busy} onClick={() => onSkip(skip)}>

web/src/screens/Messages.tsx

@@ -3,6 +3,7 @@ import { useNavigate } from "react-router-dom";
 
 import { AppShell, TopBar } from "../components/AppShell";
 import { Icon } from "../components/Icon";
+import { VoiceInput } from "../components/VoiceInput";
 import { ru } from "../content/ru";
 import { useDialog } from "../dialog/DialogContext";
 
@@ -112,6 +113,11 @@ export function Messages() {
             onKeyDown={onKeyDown}
             maxLength={2000}
           />
+          <VoiceInput
+            compact
+            disabled={dialog.busy}
+            onText={(text) => setDraft((prev) => (prev.trim() ? `${prev.trim()} ${text}` : text).slice(0, 2000))}
+          />
           <button type="submit" className="send" disabled={dialog.busy || !draft.trim()} aria-label={ru.common.send}>
             <Icon name="send" size={20} />
           </button>

web/src/theme/global.css

@@ -1566,6 +1566,106 @@ button.row-card:hover:not(:disabled) {
   color: var(--c-text-3);
 }
 
+/* ---------------------------------------------------------------- voice input (#117, slide 11) */
+
+.voice-btn {
+  display: inline-flex;
+  align-items: center;
+  gap: var(--s-2);
+  justify-self: start;
+  min-height: 44px;
+  padding: 0 var(--s-4);
+  border: 1.5px solid var(--c-border-strong);
+  border-radius: 999px;
+  background: var(--c-surface);
+  color: var(--c-teal-strong);
+  font-weight: 600;
+  font-size: var(--fs-14);
+}
+
+.voice-btn:hover:not(:disabled) {
+  background: var(--c-teal-soft);
+}
+
+.mic {
+  flex: none;
+  width: 44px;
+  height: 44px;
+  display: grid;
+  place-items: center;
+  border: 1.5px solid var(--c-border);
+  border-radius: 50%;
+  background: var(--c-surface);
+  color: var(--c-teal-strong);
+}
+
+.mic:hover:not(:disabled) {
+  background: var(--c-teal-soft);
+}
+
+.voice {
+  display: grid;
+  gap: var(--s-3);
+  padding: var(--s-4);
+  border: 1px solid var(--c-border);
+  border-radius: var(--r-tile);
+  background: #fbf6ee; /* warm, as on the slide */
+}
+
+.voice--float {
+  position: absolute;
+  left: 0;
+  right: 0;
+  bottom: calc(100% + var(--s-2));
+  box-shadow: 0 8px 24px rgb(33 59 56 / 12%);
+}
+
+.voice__hint {
+  margin: 0;
+  font-weight: 600;
+  color: var(--c-text);
+}
+
+.voice__wave {
+  display: flex;
+  align-items: center;
+  gap: 5px;
+  height: 44px;
+}
+
+.voice__wave span {
+  flex: 1;
+  max-width: 6px;
+  border-radius: 3px;
+  background: #b5452f;
+  transition: height 90ms linear;
+}
+
+.voice__row {
+  display: grid;
+  grid-template-columns: auto 1fr 1.4fr;
+  align-items: center;
+  gap: var(--s-2);
+}
+
+.voice__time {
+  font-variant-numeric: tabular-nums;
+  font-weight: 600;
+  color: var(--c-text-2);
+}
+
+.voice__row .btn {
+  min-height: 44px;
+  padding: 0 var(--s-3);
+  font-size: var(--fs-14);
+}
+
+.voice__privacy {
+  margin: 0;
+  font-size: var(--fs-12);
+  color: var(--c-text-3);
+}
+
 /* ---------------------------------------------------------------- emergency */
 
 .sosblock {

web/src/voice/recorder.ts

@@ -0,0 +1,121 @@
+/*
+ * Voice recording for the patient's messages (#117, slide 11): microphone → 16 kHz mono 16-bit WAV in the browser,
+ * so the server needs no ffmpeg and Chrome, Android and iOS Safari produce the same format (ADR-014).
+ * The audio lives only in memory until it is sent for transcription; nothing is stored on the device.
+ */
+
+export const TARGET_RATE = 16_000;
+export const MAX_SECONDS = 60;
+
+type WindowWithWebkit = Window & { webkitAudioContext?: typeof AudioContext };
+
+export function voiceSupported(): boolean {
+  const w = window as WindowWithWebkit;
+  return (
+    typeof navigator.mediaDevices?.getUserMedia === "function" && Boolean(window.AudioContext || w.webkitAudioContext)
+  );
+}
+
+export class Recorder {
+  private ctx: AudioContext | null = null;
+  private stream: MediaStream | null = null;
+  private node: ScriptProcessorNode | null = null;
+  private chunks: Float32Array[] = [];
+  private rate = 48_000;
+
+  /** `onLevel` gets the loudness 0..1 of each audio block (for the waveform). */
+  async start(onLevel: (level: number) => void): Promise<void> {
+    this.stream = await navigator.mediaDevices.getUserMedia({
+      audio: { channelCount: 1, echoCancellation: true, noiseSuppression: true, autoGainControl: true },
+    });
+    const Ctx = window.AudioContext || (window as WindowWithWebkit).webkitAudioContext!;
+    this.ctx = new Ctx();
+    await this.ctx.resume();
+    this.rate = this.ctx.sampleRate;
+    const source = this.ctx.createMediaStreamSource(this.stream);
+    // ScriptProcessorNode is deprecated but works everywhere (incl. older iOS Safari) without a worklet file.
+    this.node = this.ctx.createScriptProcessor(4096, 1, 1);
+    this.node.onaudioprocess = (e) => {
+      const data = new Float32Array(e.inputBuffer.getChannelData(0));
+      this.chunks.push(data);
+      let sum = 0;
+      for (let i = 0; i < data.length; i++) sum += data[i] * data[i];
+      onLevel(Math.min(1, Math.sqrt(sum / data.length) * 4));
+    };
+    source.connect(this.node);
+    this.node.connect(this.ctx.destination);
+  }
+
+  /** Stops the microphone and returns the WAV, or null if nothing was recorded. */
+  stop(): Blob | null {
+    const chunks = this.chunks;
+    const rate = this.rate;
+    this.release();
+    if (!chunks.length) return null;
+    return encodeWav(downsample(concat(chunks), rate, TARGET_RATE), TARGET_RATE);
+  }
+
+  cancel(): void {
+    this.release();
+  }
+
+  private release(): void {
+    this.node?.disconnect();
+    if (this.node) this.node.onaudioprocess = null;
+    this.stream?.getTracks().forEach((t) => t.stop());
+    void this.ctx?.close();
+    this.node = null;
+    this.stream = null;
+    this.ctx = null;
+    this.chunks = [];
+  }
+}
+
+function concat(chunks: Float32Array[]): Float32Array {
+  const out = new Float32Array(chunks.reduce((n, c) => n + c.length, 0));
+  let pos = 0;
+  for (const c of chunks) {
+    out.set(c, pos);
+    pos += c.length;
+  }
+  return out;
+}
+
+/** Averaging downsampler: good enough for speech, avoids aliasing better than dropping samples. */
+function downsample(input: Float32Array, from: number, to: number): Float32Array {
+  if (from === to) return input;
+  const ratio = from / to;
+  const out = new Float32Array(Math.floor(input.length / ratio));
+  for (let i = 0; i < out.length; i++) {
+    const start = Math.floor(i * ratio);
+    const end = Math.min(input.length, Math.floor((i + 1) * ratio));
+    let sum = 0;
+    for (let j = start; j < end; j++) sum += input[j];
+    out[i] = sum / Math.max(1, end - start);
+  }
+  return out;
+}
+
+function encodeWav(samples: Float32Array, rate: number): Blob {
+  const buf = new ArrayBuffer(44 + samples.length * 2);
+  const v = new DataView(buf);
+  const str = (o: number, s: string) => [...s].forEach((ch, i) => v.setUint8(o + i, ch.charCodeAt(0)));
+  str(0, "RIFF");
+  v.setUint32(4, 36 + samples.length * 2, true);
+  str(8, "WAVE");
+  str(12, "fmt ");
+  v.setUint32(16, 16, true);
+  v.setUint16(20, 1, true); // PCM
+  v.setUint16(22, 1, true); // mono
+  v.setUint32(24, rate, true);
+  v.setUint32(28, rate * 2, true); // byte rate
+  v.setUint16(32, 2, true); // block align
+  v.setUint16(34, 16, true);
+  str(36, "data");
+  v.setUint32(40, samples.length * 2, true);
+  for (let i = 0; i < samples.length; i++) {
+    const s = Math.max(-1, Math.min(1, samples[i]));
+    v.setInt16(44 + i * 2, s < 0 ? s * 0x8000 : s * 0x7fff, true);
+  }
+  return new Blob([buf], { type: "audio/wav" });
+}