feat(api,#432): set the reference voice from in-memory samples

rslife: passing a reference only as a path "forces going through filesystem IO
and creating temporary files when a segment of a wav file needs to be passed".
You have already decoded the audio and sliced out the segment you want; the API
then makes you write it back to disk to hand it over.

  crispasr_session_set_voice_samples(s, pcm, n_samples, sample_rate, ref_text)
  Session::set_voice_samples(&[f32], sample_rate, ref_text)     // Rust

WHY IT DELEGATES THROUGH THE PATH FUNCTION INSTEAD OF CALLING BACKENDS DIRECTLY,
which is the one interesting decision here. Seven backends already accept PCM
(f5_tts_set_reference, pocket_tts_set_voice, moss_tts_set_reference_wav,
miotts_set_reference, irodori_tts_set_reference, ...), so routing straight to
them is both tempting and obvious, and would avoid the write entirely.

It would also bypass crispasr_session_set_voice's consent and Art. 50(4) marking
logic, which is keyed on the reference's provenance and emits the [CONSENT]
audit line. That would make the compliance trail depend on WHICH OVERLOAD a
caller happened to reach for — a clone acquiring a different audit trail for
arriving as a buffer rather than a path. That is the same shape as the #435
phonemizer gap fixed earlier today: a second code path that quietly skips what
the first one guarantees. One behaviour, one audit trail.

So the serialisation still happens — but inside the library, once, in the system
temp directory, with cleanup on every exit path including failure. The caller's
actual problem (materialising and reaping temp files around a Vec<f32>) is
solved. The library's own IO is an implementation detail that per-backend PCM
routes can remove later WITHOUT changing this signature, which is why the
signature takes samples rather than a path.

Temp names combine a steady-clock stamp with an in-process atomic counter rather
than a PID, so concurrent calls in one process cannot collide and no
getpid()/GetCurrentProcessId() split is needed. A leftover file from a crashed
run can never be adopted as this call's reference.

Compiles clean (g++ -fsyntax-only over the full TU). Behavioural coverage comes
from CI's Rust binding tests; a local end-to-end needs a cloning-capable TTS
model, which this box does not have.

Author: crispasr integration

crispasr-sys/src/lib.rs

@@ -441,6 +441,14 @@ extern "C" {
     // #433: backend -> verb ("capability") lookup.
     pub fn crispasr_backend_caps_abi(backend: *const c_char, out_csv: *mut c_char, out_cap: c_int) -> c_int;
     pub fn crispasr_backend_caps_list_abi(out_buf: *mut c_char, out_cap: c_int) -> c_int;
+    // #432: reference voice from in-memory samples.
+    pub fn crispasr_session_set_voice_samples(
+        s: *mut CrispasrSession,
+        pcm: *const f32,
+        n_samples: c_int,
+        sample_rate: c_int,
+        ref_text_or_null: *const c_char,
+    ) -> c_int;
 
     /// Describe the exact canonical artifact bundle downloaded by `-m auto`.
     /// Returns its artifact count, 0 on miss, or a negative argument/buffer error.

crispasr/src/lib.rs

@@ -919,6 +919,53 @@ impl Session {
         Ok(())
     }
 
+    /// Set the reference voice from samples you already hold (#432).
+    ///
+    /// [`set_voice`](Self::set_voice) takes a path, which forces a temp file
+    /// whenever the reference is a *segment* of a WAV you have already decoded.
+    /// This takes the buffer directly.
+    ///
+    /// `pcm` is mono float32 at `sample_rate`. `ref_text` follows the same rule
+    /// as `set_voice`: backends that clone from raw audio need the reference
+    /// transcript.
+    ///
+    /// The library still serialises to a temp WAV internally and routes through
+    /// the same code path as `set_voice`, so consent handling and AI-Act
+    /// marking are identical for both — a clone does not get a different audit
+    /// trail for arriving as a buffer. That write is an implementation detail
+    /// and can be removed per-backend later without changing this signature.
+    pub fn set_voice_samples(
+        &self,
+        pcm: &[f32],
+        sample_rate: i32,
+        ref_text: Option<&str>,
+    ) -> Result<(), String> {
+        if pcm.is_empty() {
+            return Err("set_voice_samples: empty sample buffer".to_string());
+        }
+        if sample_rate <= 0 {
+            return Err(format!("set_voice_samples: invalid sample_rate {sample_rate}"));
+        }
+        let crt = match ref_text {
+            Some(t) => Some(CString::new(t).map_err(|e| e.to_string())?),
+            None => None,
+        };
+        let rt_ptr = crt.as_ref().map(|c| c.as_ptr()).unwrap_or(std::ptr::null());
+        let rc = unsafe {
+            crispasr_sys::crispasr_session_set_voice_samples(
+                self.handle,
+                pcm.as_ptr(),
+                pcm.len() as i32,
+                sample_rate,
+                rt_ptr,
+            )
+        };
+        if rc != 0 {
+            return Err(format!("set_voice_samples failed (rc={rc})"));
+        }
+        Ok(())
+    }
+
     /// Select a fixed/preset speaker by NAME for backends that bake names
     /// into the GGUF (orpheus). Names are e.g. `"tara"`/`"leo"` for
     /// canopylabs English; `"Anton"`/`"Sophie"` for Kartoffel_Orpheus DE.

include/crispasr_session.h

@@ -424,6 +424,17 @@ CRISPASR_SESSION_API int crispasr_session_set_codec_path(crispasr_session* s, co
 // has no voice-setting implementation.
 CRISPASR_SESSION_API int crispasr_session_set_voice(crispasr_session* s, const char* path,
                                                     const char* ref_text_or_null);
+
+// #432: same thing, from samples you already hold — no temp file of your own.
+// `pcm` is mono float32 at `sample_rate`; `ref_text_or_null` follows the same
+// rule as above (required for WAV-style cloning on backends that need it).
+//
+// The library serialises the samples to a temp WAV internally and routes them
+// through crispasr_session_set_voice, so consent handling and the Art. 50(4)
+// marking behave identically for both entry points — a clone must not acquire a
+// different audit trail by arriving as a buffer instead of a path.
+CRISPASR_SESSION_API int crispasr_session_set_voice_samples(crispasr_session* s, const float* pcm, int32_t n_samples,
+                                                            int32_t sample_rate, const char* ref_text_or_null);
 // #201: configure the TADA encoder + aligner GGUFs used for on-the-fly voice
 // cloning, i.e. crispasr_session_set_voice(s, "ref.wav", "<transcript>") on a
 // TADA session. The .wav clone path is opt-in (experimental) — enable it with

src/crispasr_c_api.cpp

@@ -29,6 +29,9 @@
 #include "core/audio_resample.h"   // Sidon S2S input-rate conversion
 
 #include <atomic>
+#include <chrono>
+#include <fstream>
+#include <filesystem>
 #include <climits> // INT_MIN (parakeet att_context_* sentinels) — issue #257
 #include <cstddef> // offsetof (diarize ABI layout static_asserts) — issue #332
 #include <cstdint>
@@ -8453,6 +8456,66 @@ static std::vector<float> indextts_resample_16k_to_24k(const float* in, int n) {
 }
 #endif
 
+// #432: set the reference voice from IN-MEMORY samples.
+//
+// rslife: passing a reference only as a path "forces going through filesystem
+// IO and creating temporary files when a segment of a wav file needs to be
+// passed" — you have the PCM in hand, and the API makes you write it out.
+//
+// WHY THIS DELEGATES THROUGH THE PATH FUNCTION RATHER THAN CALLING BACKENDS
+// DIRECTLY. Seven backends already take PCM (f5_tts_set_reference,
+// pocket_tts_set_voice, moss_tts_set_reference_wav, miotts_set_reference,
+// irodori_tts_set_reference, ...), so a direct route is tempting and would
+// avoid the write. It would also bypass crispasr_session_set_voice's consent
+// and Art. 50(4) marking logic, which is keyed on the reference's provenance
+// and emits the [CONSENT] audit line. Skipping that for the in-memory path
+// would make the compliance trail depend on WHICH OVERLOAD a caller happened
+// to use, which is precisely the kind of silent gap #435's phonemizer had.
+// One behaviour, one audit trail.
+//
+// So the write still happens — but inside the library, once, in the system temp
+// directory, and it is cleaned up on every exit path. The caller's problem
+// (materialising and reaping temp files around a Vec<f32>) is solved; the
+// library's own IO is an implementation detail that per-backend PCM routes can
+// remove later without changing this signature.
+CA_EXPORT int crispasr_session_set_voice_samples(crispasr_session* s, const float* pcm, int32_t n_samples,
+                                                 int32_t sample_rate, const char* ref_text_or_null) {
+    if (!s || !pcm || n_samples <= 0 || sample_rate <= 0)
+        return -1;
+
+    std::string wav = crispasr_make_wav_int16(pcm, (int)n_samples, (int)sample_rate);
+    if (wav.empty())
+        return -1;
+
+    std::error_code ec;
+    std::filesystem::path dir = std::filesystem::temp_directory_path(ec);
+    if (ec)
+        return -1;
+    // Distinct per call and per process: two sessions setting a voice at once
+    // must not race on one filename, and a leftover from a crashed run must not
+    // be silently adopted as this call's reference.
+    // A steady-clock stamp plus an in-process counter, rather than a PID: it is
+    // unique across concurrent calls in this process and across processes
+    // without needing a getpid()/GetCurrentProcessId() split.
+    static std::atomic<uint64_t> seq{0};
+    const auto stamp = (unsigned long long)std::chrono::steady_clock::now().time_since_epoch().count();
+    const std::filesystem::path tmp = dir / ("crispasr-voice-" + std::to_string(stamp) + "-" +
+                                             std::to_string((unsigned long long)seq.fetch_add(1)) + ".wav");
+
+    {
+        std::ofstream f(tmp, std::ios::binary);
+        if (!f)
+            return -1;
+        f.write(wav.data(), (std::streamsize)wav.size());
+        if (!f)
+            return -1;
+    }
+
+    const int rc = crispasr_session_set_voice(s, tmp.string().c_str(), ref_text_or_null);
+    std::filesystem::remove(tmp, ec); // best effort; the reference is already loaded
+    return rc;
+}
+
 CA_EXPORT int crispasr_session_set_voice(crispasr_session* s, const char* path, const char* ref_text_or_null) {
     if (!s || !path)
         return -1;