@gotcos/glasses-server 6.21.13 → 6.21.17

package/server/lib/meeting-corrections.ts

@@ -0,0 +1,218 @@
+// The record of every speaker correction a human has made, per meeting.
+//
+// WHY A LEDGER AND NOT JUST A REWRITE. A relabel mutates files in place: the
+// chunk sidecar, the attendee list, the transcript turn labels. If that is all
+// that happens, three things become impossible:
+//
+//   1. UNDO. Once "Luke H" has become "Luke Henry" in the sidecar, nothing
+//      remembers it was ever anything else. A mistaken correction is permanent.
+//   2. CRASH RECOVERY. A rewrite touches several files. Die between them and the
+//      meeting is half-corrected with no trace of what was intended.
+//   3. TRAINING. Piece 3 turns a correction into an enrollment. It needs to know
+//      WHICH chunks a human vouched for, and to be able to retract that vouching
+//      later if the correction is undone.
+//
+// So the ledger is written FIRST, as intent, and the rewrite follows. A row with
+// an intent and no outcome is a correction that did not finish — visible rather
+// than silent.
+//
+// WHAT IS DELIBERATELY NOT CORRECTED. The meeting markdown's Summary, Topics,
+// Decisions and Action Items are LLM prose that refers to people by BARE FIRST
+// NAME ("Jeremy pushed back", "Chris raised Beamer sentiment"). Verified on a
+// real scribe: 6 of 12 speakers appear that way. This org has two Kyles, two
+// Jacobuses and two Chrises, so a find/replace on a first name in narrative text
+// would silently rewrite a sentence about a different person. Prose is left
+// alone and flagged stale instead — `proseStale` on the applied row.
+
+import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, statSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { dataPath } from './data-dir.js'
+
+export const CORRECTIONS_DIR = 'meeting-corrections'
+
+/**
+ * A correction is recorded in two phases sharing one id.
+ * `intent` goes down before any file is touched; `applied` or `failed` closes it.
+ * An unclosed intent is an incomplete correction, not a successful one.
+ */
+export type CorrectionPhase = 'intent' | 'applied' | 'failed'
+
+export interface CorrectionSurfaces {
+  /** Chunks whose `speaker` changed in the sidecar. */
+  sidecar: number
+  /** Lines changed in the markdown attendee list. */
+  attendees: number
+  /** `[Name]:` turn labels changed in the markdown transcript. */
+  transcript: number
+}
+
+export interface CorrectionRow {
+  id: string
+  phase: CorrectionPhase
+  /** ISO timestamp, supplied by the caller so this module stays deterministic. */
+  at: string
+  from: string
+  to: string
+  /**
+   * The exact chunk indices this correction covers. Explicit rather than derived,
+   * because piece 3 enrolls precisely these and must be able to retract
+   * precisely these. An empty array means "every chunk carrying `from`", which
+   * is resolved at apply time and written back onto the applied row.
+   */
+  chunks: number[]
+  /**
+   * 'meeting' is the only scope. Corrections are per-meeting BY DESIGN: the
+   * identifier mishearing one voice in one room does not mean every past chunk
+   * was wrong, and rewriting history on a single correction is how a small
+   * mistake becomes an unrecoverable one.
+   */
+  scope: 'meeting'
+  surfaces?: CorrectionSurfaces
+  /** True when narrative prose still carries the old label. See the header. */
+  proseStale?: boolean
+  /** Why an attempt failed, on a `failed` row. */
+  error?: string
+}
+
+function sessionFile(sessionId: string): string | null {
+  if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) return null
+  const dir = dataPath(CORRECTIONS_DIR)
+  const path = join(dir, `${sessionId.replace(/:/g, '_')}.jsonl`)
+  return resolve(path).startsWith(resolve(dir) + '/') ? path : null
+}
+
+/**
+ * Append one row. Returns false rather than throwing on a bad session id or an
+ * unwritable directory — but note the caller's contract: if the INTENT row
+ * cannot be written, the rewrite must not proceed. An unrecorded mutation is
+ * exactly what this file exists to prevent.
+ */
+export function appendCorrection(sessionId: string, row: CorrectionRow): boolean {
+  const path = sessionFile(sessionId)
+  if (!path) return false
+  try {
+    mkdirSync(dataPath(CORRECTIONS_DIR), { recursive: true, mode: 0o700 })
+    appendFileSync(path, JSON.stringify(row) + '\n', { mode: 0o600 })
+    return true
+  } catch {
+    return false
+  }
+}
+
+export interface CorrectionReadResult {
+  rows: CorrectionRow[]
+  /** Lines that could not be parsed. Surfaced, because a correction history read
+   *  partially is a correction history that lies about what a human decided. */
+  unusable: number
+  missing: boolean
+}
+
+export function readCorrections(sessionId: string): CorrectionReadResult {
+  const path = sessionFile(sessionId)
+  if (!path || !existsSync(path)) return { rows: [], unusable: 0, missing: true }
+  let raw: string
+  try {
+    raw = readFileSync(path, 'utf-8')
+  } catch {
+    return { rows: [], unusable: 0, missing: true }
+  }
+  const rows: CorrectionRow[] = []
+  let unusable = 0
+  for (const line of raw.split('\n')) {
+    if (line.trim() === '') continue
+    try {
+      const o = JSON.parse(line) as Record<string, unknown>
+      if (typeof o.id !== 'string' || typeof o.from !== 'string' || typeof o.to !== 'string') { unusable++; continue }
+      if (o.phase !== 'intent' && o.phase !== 'applied' && o.phase !== 'failed') { unusable++; continue }
+      rows.push({
+        id: o.id,
+        phase: o.phase,
+        at: typeof o.at === 'string' ? o.at : '',
+        from: o.from,
+        to: o.to,
+        chunks: Array.isArray(o.chunks) ? o.chunks.filter((n): n is number => typeof n === 'number') : [],
+        scope: 'meeting',
+        surfaces: isSurfaces(o.surfaces) ? o.surfaces : undefined,
+        proseStale: typeof o.proseStale === 'boolean' ? o.proseStale : undefined,
+        error: typeof o.error === 'string' ? o.error : undefined,
+      })
+    } catch {
+      unusable++
+    }
+  }
+  return { rows, unusable, missing: false }
+}
+
+function isSurfaces(v: unknown): v is CorrectionSurfaces {
+  if (!v || typeof v !== 'object') return false
+  const o = v as Record<string, unknown>
+  return typeof o.sidecar === 'number' && typeof o.attendees === 'number' && typeof o.transcript === 'number'
+}
+
+/**
+ * Corrections that recorded an intent and never closed it.
+ *
+ * This is the crash signal. A process that died mid-rewrite leaves exactly this,
+ * and a meeting with a pending correction should be treated as possibly
+ * half-written rather than clean.
+ */
+export function pendingCorrections(sessionId: string): CorrectionRow[] {
+  const { rows } = readCorrections(sessionId)
+  const closed = new Set(rows.filter(r => r.phase !== 'intent').map(r => r.id))
+  return rows.filter(r => r.phase === 'intent' && !closed.has(r.id))
+}
+
+/** Only the corrections that actually landed — the ones piece 3 may train on. */
+export function appliedCorrections(sessionId: string): CorrectionRow[] {
+  return readCorrections(sessionId).rows.filter(r => r.phase === 'applied')
+}
+
+/**
+ * Follow a chain of applied corrections to the label a voice now carries.
+ *
+ * Chains happen: a voice labelled 'Ext' is corrected to 'Luke H', then later to
+ * 'Luke Henry'. Asking "what is Ext now?" must answer 'Luke Henry', not stop at
+ * the first hop. Cycles are possible if a human corrects A→B then B→A, so the
+ * walk is bounded by the number of corrections and returns the last label
+ * reached rather than looping.
+ */
+export function currentLabelFor(sessionId: string, originalLabel: string): string {
+  const applied = appliedCorrections(sessionId)
+  let label = originalLabel
+  const seen = new Set<string>([label])
+  for (let hop = 0; hop < applied.length; hop++) {
+    // Latest applied correction FROM the current label wins: a later human
+    // decision supersedes an earlier one.
+    const next = [...applied].reverse().find(r => r.from === label)
+    if (!next || seen.has(next.to)) break
+    label = next.to
+    seen.add(label)
+  }
+  return label
+}
+
+/** Counts for /api/health — pending is the number that matters. */
+export function correctionStoreStats(): {
+  sessions: number
+  applied: number
+  pending: number
+  failed: number
+} {
+  const dir = dataPath(CORRECTIONS_DIR)
+  if (!existsSync(dir)) return { sessions: 0, applied: 0, pending: 0, failed: 0 }
+  let sessions = 0, applied = 0, pending = 0, failed = 0
+  try {
+    for (const name of readdirSync(dir).filter(n => n.endsWith('.jsonl'))) {
+      try {
+        statSync(join(dir, name))
+        sessions++
+        const id = name.replace(/\.jsonl$/, '')
+        const { rows } = readCorrections(id)
+        applied += rows.filter(r => r.phase === 'applied').length
+        failed += rows.filter(r => r.phase === 'failed').length
+        pending += pendingCorrections(id).length
+      } catch { /* skip unreadable */ }
+    }
+  } catch { /* report what we have */ }
+  return { sessions, applied, pending, failed }
+}

package/server/lib/meeting-relabel.ts

@@ -0,0 +1,267 @@
+// Rewriting a speaker label inside one meeting's files.
+//
+// Pure over strings: every function takes file content and returns file content,
+// so each rule below is testable by execution rather than by reading it.
+//
+// THE CONSTRAINT THAT SHAPES THIS FILE. The markdown transcript is NOT an
+// index-parallel rendering of the chunk sidecar. Measured on a real meeting
+// (2026-08-06 Health Score V2): 135 sidecar chunks collapse to 46 speaker runs,
+// while the markdown carries 70 turns — and they disagree on who spoke, with the
+// markdown's 4th turn attributed to Joe Karbowski where the sidecar's 4th run
+// says Richard Jenkins. The transcript was rendered from a different
+// segmentation pass. So:
+//
+//   * There is NO mapping from a chunk index to a transcript turn.
+//   * A relabel of EVERY chunk carrying a label can still be applied to the
+//     markdown, because "all X becomes Y" needs no index alignment.
+//   * A relabel of a SUBSET of chunks cannot touch the markdown transcript at
+//     all. Rewriting by label would relabel turns the human never selected.
+//
+// `coveredAllWithLabel` on the sidecar result is how the caller knows which case
+// it is. It is returned as DATA rather than left as a rule to remember.
+//
+// AND WHAT IS NEVER REWRITTEN: the Summary / Topics / Decisions / Action Items
+// prose. It refers to people by bare first name — 6 of 12 speakers did so on the
+// meeting above — and this org has two Kyles, two Jacobuses and two Chrises, so
+// a first-name substitution in narrative text would rewrite sentences about
+// somebody else. Reported as `proseStale` instead.
+
+/** A label that would corrupt the file formats it gets written into. */
+export function invalidLabelReason(label: string): string | null {
+  if (label.trim() === '') return 'label is empty'
+  if (label !== label.trim()) return 'label has leading or trailing whitespace'
+  if (label.length > 120) return 'label is longer than 120 characters'
+  // `[Name]:` delimits transcript turns and `- Name` delimits attendees; a
+  // label containing these would make the file unparseable by its own readers.
+  if (/[\[\]\n\r]/.test(label)) return 'label contains a bracket or newline'
+  return null
+}
+
+function escapeRegExp(s: string): string {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}
+
+export interface SidecarRelabelResult {
+  /** Serialized in the same shape the pipeline writes: 2-space indent, trailing newline. */
+  json: string
+  /** Chunk indices whose speaker actually changed. */
+  changed: number[]
+  /**
+   * True when no chunk still carries `from` after this relabel. ONLY then may the
+   * caller rewrite the markdown transcript by label. See the file header.
+   */
+  coveredAllWithLabel: boolean
+  /** The top-level `speakers` array after the relabel. */
+  speakers: string[]
+  /** Chunks still carrying `from` — non-zero for a deliberate partial relabel. */
+  remainingWithFrom: number
+}
+
+export type RelabelOutcome<T> = { ok: true; value: T } | { ok: false; error: string }
+
+/**
+ * Relabel chunks in a `.g2-chunks.json` sidecar.
+ *
+ * `chunks` empty means every chunk carrying `from`. An explicit list restricts
+ * the change to those indices — the partial case, which exists because the
+ * identifier can mishear one stretch of a meeting without being wrong about the
+ * rest.
+ */
+export function relabelSidecarJson(
+  raw: string,
+  from: string,
+  to: string,
+  chunks: number[] = [],
+): RelabelOutcome<SidecarRelabelResult> {
+  if (from === to) return { ok: false, error: 'from and to are the same label' }
+  for (const [which, label] of [['from', from], ['to', to]] as const) {
+    const bad = invalidLabelReason(label)
+    if (bad) return { ok: false, error: `${which}: ${bad}` }
+  }
+
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(raw)
+  } catch {
+    return { ok: false, error: 'sidecar is not valid JSON' }
+  }
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    return { ok: false, error: 'sidecar is not an object' }
+  }
+  const doc = parsed as Record<string, unknown>
+  const rows = doc.chunks
+  if (!Array.isArray(rows)) return { ok: false, error: 'sidecar has no chunks array' }
+
+  const restrict = chunks.length > 0 ? new Set(chunks) : null
+  // A caller naming indices that do not carry `from` is confused about what it
+  // is correcting; failing loudly beats silently relabelling nothing.
+  if (restrict) {
+    const mismatched = chunks.filter(i => {
+      const row = rows[i]
+      return !row || typeof row !== 'object' || (row as Record<string, unknown>).speaker !== from
+    })
+    if (mismatched.length > 0) {
+      return { ok: false, error: `chunks do not carry "${from}": ${mismatched.slice(0, 8).join(', ')}` }
+    }
+  }
+
+  const changed: number[] = []
+  let remainingWithFrom = 0
+  rows.forEach((row, i) => {
+    // The `typeof` half guards the cast below rather than any behaviour — a
+    // truthy non-object can never satisfy `.speaker === from`, so it is
+    // deliberately not claimed as tested.
+    if (!row || typeof row !== 'object') return
+    const r = row as Record<string, unknown>
+    if (r.speaker !== from) return
+    if (restrict && !restrict.has(i)) { remainingWithFrom++; return }
+    r.speaker = to
+    changed.push(i)
+  })
+
+  if (changed.length === 0) return { ok: false, error: `no chunk carries "${from}"` }
+
+  // Keep the top-level speaker list truthful: it is what the review panel and
+  // the attendee renderer read, so a stale entry shows a person who is no longer
+  // attributed anything.
+  const existing = Array.isArray(doc.speakers) ? doc.speakers.filter((s): s is string => typeof s === 'string') : []
+  const speakers = [...existing]
+  if (!speakers.includes(to)) {
+    // Replace in place when `from` is being fully retired, so the list keeps its
+    // original ordering rather than moving the person to the end.
+    const at = speakers.indexOf(from)
+    if (at >= 0 && remainingWithFrom === 0) speakers[at] = to
+    else speakers.push(to)
+  } else if (remainingWithFrom === 0) {
+    // `to` already listed and `from` fully retired — merging a split identity.
+    // Drop the old entry rather than leaving a name nothing is attributed to.
+    const at = speakers.indexOf(from)
+    if (at >= 0) speakers.splice(at, 1)
+  }
+  doc.speakers = speakers
+
+  return {
+    ok: true,
+    value: {
+      json: `${JSON.stringify(doc, null, 2)}\n`,
+      changed,
+      coveredAllWithLabel: remainingWithFrom === 0,
+      speakers,
+      remainingWithFrom,
+    },
+  }
+}
+
+export interface MarkdownRelabelResult {
+  markdown: string
+  /** Attendee bullet lines changed or removed. */
+  attendees: number
+  /** `[Name]:` turn labels rewritten. */
+  transcript: number
+  /**
+   * True when the old label still appears in narrative prose, which is left
+   * untouched on purpose. The caller records this so a human can be told the
+   * summary predates their correction.
+   */
+  proseStale: boolean
+  /** The prose forms found, for an honest message rather than a bare boolean. */
+  proseHits: string[]
+}
+
+/** Byte range of a `## Heading` section, or null when absent. */
+function sectionRange(md: string, heading: string): { start: number; end: number } | null {
+  const re = new RegExp(`^##\\s+${escapeRegExp(heading)}\\s*$`, 'm')
+  const m = re.exec(md)
+  if (!m) return null
+  const start = m.index + m[0].length
+  const next = /^##\s+/m.exec(md.slice(start))
+  return { start, end: next ? start + next.index : md.length }
+}
+
+/**
+ * Rewrite the structured label positions in a meeting markdown file.
+ *
+ * ONLY sound when every chunk carrying `from` is being relabelled — this works
+ * by label, not by index, and the markdown's turn segmentation does not match
+ * the sidecar's. See the file header.
+ */
+export function relabelMeetingMarkdown(md: string, from: string, to: string): RelabelOutcome<MarkdownRelabelResult> {
+  if (from === to) return { ok: false, error: 'from and to are the same label' }
+  for (const [which, label] of [['from', from], ['to', to]] as const) {
+    const bad = invalidLabelReason(label)
+    if (bad) return { ok: false, error: `${which}: ${bad}` }
+  }
+
+  let out = md
+  let attendees = 0
+  let transcript = 0
+
+  // --- Attendees: exact bullet lines only, inside the Attendees section only.
+  const att = sectionRange(out, 'Attendees')
+  if (att) {
+    const body = out.slice(att.start, att.end)
+    // Anchored at BOTH ends, and `[ \t]` rather than `\s` so a pattern can never
+    // run past its own line. Without the end anchor, `- Luke H` matches the
+    // PREFIX of `- Luke Henry` and deleting it leaves the fragment `enry`.
+    const line = (label: string) => `^-[ \t]+${escapeRegExp(label)}[ \t]*$`
+    const alreadyListed = new RegExp(line(to), 'm').test(body)
+    let rewritten: string
+    if (alreadyListed) {
+      // Both names present: drop the old bullet instead of creating a duplicate
+      // attendee. This is the normal case when merging a split identity.
+      rewritten = body.replace(new RegExp(`${line(from)}\\n?`, 'gm'), () => { attendees++; return '' })
+    } else {
+      rewritten = body.replace(new RegExp(line(from), 'gm'), () => { attendees++; return `- ${to}` })
+    }
+    out = out.slice(0, att.start) + rewritten + out.slice(att.end)
+  }
+
+  // --- Transcript: `[Name]:` at line start only. A name appearing inside spoken
+  //     text is a quote, not a label, and must not be touched.
+  const tr = sectionRange(out, 'Transcript')
+  if (tr) {
+    const body = out.slice(tr.start, tr.end)
+    const rewritten = body.replace(
+      new RegExp(`^\\[${escapeRegExp(from)}\\]:`, 'gm'),
+      () => { transcript++; return `[${to}]:` },
+    )
+    out = out.slice(0, tr.start) + rewritten + out.slice(tr.end)
+  }
+
+  // --- Prose: detect, never rewrite.
+  const proseHits = detectProseReferences(out, from)
+
+  return {
+    ok: true,
+    value: { markdown: out, attendees, transcript, proseStale: proseHits.length > 0, proseHits },
+  }
+}
+
+/**
+ * Forms of `label` still present in narrative prose.
+ *
+ * Searches everything except the attendee list and the transcript — the
+ * transcript's body is spoken words, and a name said aloud is a quote rather
+ * than a stale attribution.
+ */
+export function detectProseReferences(md: string, label: string): string[] {
+  const ranges = [sectionRange(md, 'Attendees'), sectionRange(md, 'Transcript')].filter(
+    (r): r is { start: number; end: number } => r !== null,
+  )
+  let prose = ''
+  let cursor = 0
+  for (const r of ranges.sort((a, b) => a.start - b.start)) {
+    prose += md.slice(cursor, r.start)
+    cursor = Math.max(cursor, r.end)
+  }
+  prose += md.slice(cursor)
+
+  const hits: string[] = []
+  const full = new RegExp(`\\b${escapeRegExp(label)}\\b`)
+  if (full.test(prose)) hits.push(label)
+  const first = label.split(/\s+/)[0]
+  // Only a multi-word label has a distinct bare-first-name form. 'MU' or 'Ext'
+  // would otherwise be reported twice for the same match.
+  if (first && first !== label && new RegExp(`\\b${escapeRegExp(first)}\\b`).test(prose)) hits.push(first)
+  return hits
+}

package/server/lib/speaker-embeddings.ts

@@ -1,4 +1,5 @@
 // Speaker embedding extraction and verification using sherpa-onnx
+import { chooseEviction, tierBreakdown } from './embedding-eviction.js'
 // Wraps ECAPA-TDNN model for voiceprint-based speaker classification.
 // Falls back gracefully if model is missing — amplitude classification continues.
 //
@@ -15,6 +16,8 @@ import {
   mergeProfilesInStore,
   profileSimilarity,
   describeRepairs,
+  alignedSources,
+  dropEmbeddingAt,
   dropOldestEmbedding,
   hasRepairs,
   loadVoiceProfileStore,
@@ -87,7 +90,11 @@ const VERIFY_THRESHOLD = 0.65
 const SEARCH_THRESHOLD = 0.55
 const AUTO_ENROLL_THRESHOLD = 0.88    // High bar — must be very confident before auto-enrolling
 const AUTO_ENROLL_CONSENSUS = 2       // Must match N times in same session before enrolling
-const MAX_EMBEDDINGS_PER_SPEAKER = 20 // FIFO cap — oldest drops when full
+// Raised 20 -> 40 on 2026-08-06. Measured, not guessed: search latency is 1 us
+// at 20, 40 AND 80 samples per speaker (77 speakers, sherpa SpeakerEmbeddingManager),
+// so the old cap defended nothing — while 61 of 77 profiles sat AT it, meaning
+// every correction cost a sample. 20 extra slots per speaker is ~1.2 MB.
+const MAX_EMBEDDINGS_PER_SPEAKER = 40
 const SAMPLE_RATE = 16000
 
 // Module-level state — sherpa-onnx-node is CJS with no TS types (SDK v0.0.7 interop)
@@ -308,8 +315,24 @@ export function enrollEmbedding(name: string, embedding: Float32Array, source: s
     // `sources?.shift()` no-opped whenever sources was undefined or short,
     // permanently offsetting provenance from the samples it described.
     if (profile.embeddings.length >= MAX_EMBEDDINGS_PER_SPEAKER) {
-      console.log(`[speaker] Profile cap reached for "${name}" (${profile.embeddings.length}/${MAX_EMBEDDINGS_PER_SPEAKER}) — dropping oldest`)
-      dropOldestEmbedding(profile)
+      // Weakest PROVENANCE goes, not the oldest sample. Age is the wrong axis:
+      // four profiles at cap would lose their only human-supplied sample to
+      // FIFO while unverified attendee-metadata samples sat untouched.
+      // alignedSources is defence-in-depth here, not load-bearing: loadProfileStore
+      // already pads sources[] to match embeddings[], so a ragged array cannot
+      // reach this line (mutation-verified — swapping it for profile.sources is
+      // unobservable through this path). It is kept for any future caller that
+      // builds a profile without going through the loader, and is unit-tested
+      // directly in voice-profile-store.test.ts.
+      const choice = chooseEviction(alignedSources(profile), source, MAX_EMBEDDINGS_PER_SPEAKER)
+      const { droppedSource } = choice
+        ? dropEmbeddingAt(profile, choice.index)
+        : dropOldestEmbedding(profile)
+      console.log(
+        `[speaker] Profile full for "${name}" (${MAX_EMBEDDINGS_PER_SPEAKER}) — `
+        + `${choice ? choice.reason : 'no provenance available, dropping the oldest'} `
+        + `[dropped ${droppedSource ?? 'unknown'}, incoming ${source}]`,
+      )
       rebuildSpeakerInManager(name, profile.embeddings)
     }
   }
@@ -342,7 +365,7 @@ export function enrollEmbedding(name: string, embedding: Float32Array, source: s
 export function identifySpeaker(
   wavBuffer: Buffer,
   expectedSpeakers?: string[],
-): { speaker: string; similarity: number } | null {
+): { speaker: string; similarity: number; embedding?: Float32Array } | null {
   if (!extractor || !manager) return null
 
   try {
@@ -356,7 +379,7 @@ export function identifySpeaker(
       if (isOwner) {
         const similarity = computeCosineSimilarity(embedding, owner)
         logCalibration(owner, similarity, true)
-        return { speaker: owner, similarity }
+        return { speaker: owner, similarity, embedding }
       }
     }
 
@@ -369,7 +392,7 @@ export function identifySpeaker(
         if (matches) {
           const similarity = computeCosineSimilarity(embedding, name)
           logCalibration(name, similarity, true)
-          return { speaker: name, similarity }
+          return { speaker: name, similarity, embedding }
         }
       }
     }
@@ -379,12 +402,14 @@ export function identifySpeaker(
     if (found && found.length > 0) {
       const similarity = computeCosineSimilarity(embedding, found)
       logCalibration(found, similarity, true)
-      return { speaker: found, similarity }
+      return { speaker: found, similarity, embedding }
     }
 
-    // No match — external speaker
+    // No match — external speaker. The embedding still goes back: an
+    // unidentified voice's vector is the most valuable thing to retain, because
+    // naming it later is exactly the correction that has no other evidence.
     logCalibration('Ext', 0, false)
-    return { speaker: 'Ext', similarity: 0 }
+    return { speaker: 'Ext', similarity: 0, embedding }
   } catch (err: unknown) {
     console.error('[speaker] Identification error:', errMsg(err))
     return null
@@ -665,6 +690,35 @@ export function speakerReadiness(
   return state === 'active' ? 'ready' : 'unavailable'
 }
 
+/**
+ * Provenance composition across every stored profile, plus the profiles with no
+ * human-verified sample at all.
+ *
+ * Surfaced because the number that mattered here was invisible: the owner's own
+ * profile — the one driving owner detection — was 10 attendee-metadata samples,
+ * 9 identifier-labelled ones and 1 unlabelled, with nothing a human had ever
+ * confirmed. Nothing in any status output said so.
+ */
+export function profileProvenanceSummary(): {
+  profiles: number
+  atCap: number
+  cap: number
+  tiers: Record<string, number>
+  noHumanSample: string[]
+} {
+  const store = loadProfileStore()
+  const tiers: Record<string, number> = {}
+  const noHumanSample: string[] = []
+  let atCap = 0
+  for (const p of store.profiles) {
+    const breakdown = tierBreakdown(alignedSources(p))
+    for (const [k, v] of Object.entries(breakdown)) tiers[k] = (tiers[k] ?? 0) + v
+    if (p.embeddings.length >= MAX_EMBEDDINGS_PER_SPEAKER) atCap++
+    if (breakdown.human === 0) noHumanSample.push(p.name)
+  }
+  return { profiles: store.profiles.length, atCap, cap: MAX_EMBEDDINGS_PER_SPEAKER, tiers, noHumanSample }
+}
+
 /** Compute actual cosine similarity between two raw embedding vectors */
 export function rawCosineSimilarity(a: Float32Array, b: Float32Array): number {
   if (a.length !== b.length) return 0

package/server/lib/voice-profile-store.ts

@@ -69,7 +69,10 @@ export function describeRepairs(r: StoreRepairs): string {
   return parts.join(', ')
 }
 
-const UNKNOWN_SOURCE = 'unknown'
+/** Placeholder provenance for a sample whose source was never recorded.
+ *  Exported so callers and tests reference the same value the store writes;
+ *  3 samples in the live store carry it. */
+export const UNKNOWN_SOURCE = 'unknown'
 
 function isUsableEmbedding(row: unknown): row is number[] {
   return Array.isArray(row) && row.length > 0 && row.every(v => typeof v === 'number' && Number.isFinite(v))
@@ -317,6 +320,38 @@ export function dropOldestEmbedding(profile: VoiceProfile): { droppedSource: str
   return { droppedSource }
 }
 
+/**
+ * Drop the sample at `index`, keeping sources[] in lockstep.
+ *
+ * Alignment happens BEFORE the splice: a sources[] shorter than embeddings[]
+ * would otherwise make index N refer to two different samples in the two
+ * arrays, permanently offsetting provenance from the samples it describes —
+ * the same class of bug as the old inline `sources?.shift()`.
+ */
+export function dropEmbeddingAt(profile: VoiceProfile, index: number): { droppedSource: string | null } {
+  if (!Number.isInteger(index) || index < 0 || index >= profile.embeddings.length) {
+    return { droppedSource: null }
+  }
+  if (!Array.isArray(profile.sources)) profile.sources = []
+  while (profile.sources.length < profile.embeddings.length) profile.sources.push(UNKNOWN_SOURCE)
+  profile.embeddings.splice(index, 1)
+  const droppedSource = profile.sources.splice(index, 1)[0] ?? null
+  profile.sources.length = profile.embeddings.length
+  return { droppedSource }
+}
+
+/**
+ * Provenance of each stored sample, index-aligned with embeddings[].
+ *
+ * Holes and a short array both read as undefined, which the eviction policy
+ * classifies as `unknown` — the weakest tier. That is the safe direction: a
+ * sample whose provenance was lost must never inherit the protection given to
+ * one a human supplied.
+ */
+export function alignedSources(profile: VoiceProfile): Array<string | undefined> {
+  return Array.from({ length: profile.embeddings.length }, (_, i) => profile.sources?.[i])
+}
+
 /** Append a sample to both arrays together. */
 export function appendEmbedding(profile: VoiceProfile, embedding: number[], source: string): void {
   if (!Array.isArray(profile.sources)) profile.sources = []