# Names heard on a call

A name heard on a call is guarded on the way into a record and on the way back out of one. `identity.PROTECTED_MARKERS`, with `name_rejected`, `clean_name` and `scrub_names`, sits on the summariser's output, lead capture, the person upsert and what gets remembered — and on every place one is read aloud again. A form of address is never treated as one.

- **Status:** Available
- **Audience:** both
- **Channels:** phone
- **In the app:** #/calls
- **Last verified:** 2026-09-10
- **Canonical:** https://connectbyjbrh.com/docs/phone/names-on-calls/

## Why this needs guarding at all

Speech recognition produces a string, and a language model asked "who was this?" will always answer something. Between them they will confidently hand you *Sir*, *Madam*, *Bhai*, a company, a job title, "the caller", or the transcriber's best guess at a word it did not catch. Written into a person record, each of those is permanent, visible to staff, and eventually said back to a real human being.

So the guard is not a tidy-up step at the end. It sits on every door, because there are several ways a string can reach a record and only one of them is the obvious one.

## Every door, in and out

| Door | Direction | What is checked |
|---|---|---|
| Summariser output | In | The model's account of the call, which is where an invented one usually appears |
| Lead capture | In | What becomes a new lead's identity |
| Person upsert | In | The write onto the person record itself |
| `connect_memory.remember` | In | Anything durable being kept about the person |
| Every read-back | Out | What is said aloud or written back to the caller |

The outbound direction is the one people forget. A value that slipped in before the guards existed is still in the data, and reading it aloud — "Am I speaking to Sir?" — is the moment it becomes the caller's problem rather than the database's. Checking on the way out means old data cannot embarrass a new call.

`fact_rejected` covers the neighbouring case: a fact *keyed* by a person's name is refused when that key is a suffix, a pronoun or "the caller". Otherwise a workspace slowly accumulates knowledge filed under nobody.

## A form of address is not an identity

This is the single rule to remember, and it is worth being precise about what it excludes. *Sir*, *Madam*, *Ji*, *Andi*, *Bhai* and their equivalents are markers of respect that attach to whoever is being spoken to. They are protected markers: recognised, and specifically not promoted into an identity.

The same words matter enormously in [how the voice speaks](/docs/phone/regional-speech/) — using them correctly is much of what makes a line sound local. Being useful in speech and being useless as an identifier are not in tension; they are two different jobs for the same word.

> **Careful** An empty field is a correct answer. If nobody said who they were, the record says nobody said. That is recoverable on the next call; a wrong value is not, because nothing downstream knows it is wrong.

## Values that are read back, and how

Identities are not the only thing spoken on a call that has to be right. A phone number, an email address or a reference code heard in the caller's own words gets a note recording exactly what was heard (`entity_heard`), and the next two lines are checked for a confirmation (`entity_readback {confirmed}`).

That is read-back **by value**: the point is not that a confirmation happened but that the specific digits were repeated and agreed. The same discipline sits behind [promises made on a call](/docs/phone/promise-integrity/), where a time nobody actually said aloud cannot be recorded as booked.

## What is verified today

The guards described here were reconciled on 2026-09-10 against `backend/app/voice_region.plan` at `f5ea518`, and none of them moved. The neighbouring change is worth knowing about, because it uses the same words for the opposite purpose: the respectful forms a place uses — *garu* after a name in Telugu, *ji* in Hindi, *-nga* endings in Tamil — are carried per region in `REGIONS` and asked for by name in the brief. A word can be required in speech and refused as an identity at the same time. The rule that a form of address never becomes one, and the practice of guarding the read path as well as the write path, exist because the alternative was seen in production data.

## Questions

### Connect called somebody by the wrong name. Where did it come from?

Most often from data written before the guards, since the outbound check will refuse a protected marker but cannot know that an ordinary-looking string was a mis-transcription. Correct the person record; the correction is what the next call's brief is built from.

### Will Connect ask for a name if it does not have one?

The behaviour text for the line decides what is asked, and asking is a reasonable thing to configure. What is not configurable is accepting a poor answer: whatever is heard still passes the same guards before it reaches a record.

### Does the summariser ever invent one?

It can try — that is precisely why its output is one of the guarded doors. The other protection is upstream: a call with fewer than two caller lines and fewer than five caller words is never sent to the summariser, because ten one-turn rows once carried an invented afternoon at a sales desk.

## Related

- [Identifying the caller](https://connectbyjbrh.com/docs/phone/caller-identity/)
- [Call summaries](https://connectbyjbrh.com/docs/phone/call-summary/)
- [Facts learned on a call](https://connectbyjbrh.com/docs/phone/call-facts/)
- [Promises made on a call](https://connectbyjbrh.com/docs/phone/promise-integrity/)
- [Relationship memory versus chat history](https://connectbyjbrh.com/research/relationship-memory/)

## What this page is based on

- Reconciled 2026-09-10 against `f5ea518` — `backend/app/voice_region.plan`, read from the code rather than its docstring
- Connect phone source pack — `docs-source/sources/PHONE.md` §10, names and follow-up integrity
- Connect phone source pack — `docs-source/sources/PHONE.md` §7, read-backs by value
- Connect capability registry — `docs-source/facts.py` (`cross_channel_identity`, `call_summary`)