@gotcos/glasses-server 6.21.14 → 6.21.18

package/server/routes/meeting.ts

@@ -7,6 +7,44 @@ import { resolve } from 'node:path'
 import { Router } from 'express'
 import { emitDisplay } from '../lib/display-bus.js'
 import { cleanTranscriptLines } from '../lib/hallucination-filter.js'
+import { durableAtomicWriteFileSync } from '../lib/atomic-fs.js'
+import { appendCorrection, pendingCorrections } from '../lib/meeting-corrections.js'
+import { isSampleFromSession, untraceableSampleCount } from '../lib/training-audio-provenance.js'
+import {
+  listMeetingAudioChunks,
+  meetingAudioChunkPath,
+  meetingAudioRetentionDays,
+} from '../lib/meeting-audio-archive.js'
+import { readVoiceProfiles, retractEmbeddingsBySource } from '../lib/speaker-embeddings.js'
+
+/**
+ * The label a de-attributed voice takes, numbered within its meeting.
+ *
+ * NOT a shared `Ext`. De-attributing to one label folded every corrected voice
+ * into a single row — on the 2026-08-06 Ditto meeting Miles named five wrong
+ * attributions, and collapsing them would have destroyed his ability to tell
+ * those five voices apart, which is precisely what he needs playback for next.
+ *
+ * `Unidentified N` is prefix-matched by isUnattributed(), so the review panel
+ * treats the row as unnamed and autoEnroll skips it — a de-attributed stretch
+ * cannot re-poison a profile — while staying separable.
+ */
+function nextDeattributedLabel(existing: string[]): string {
+  const used = new Set(
+    existing
+      .map(s => new RegExp(`^${DEATTRIBUTED_PREFIX} (\\d+)$`).exec(s)?.[1])
+      .filter((n): n is string => Boolean(n))
+      .map(Number),
+  )
+  let n = 1
+  while (used.has(n)) n++
+  return `${DEATTRIBUTED_PREFIX} ${n}`
+}
+import {
+  invalidLabelReason,
+  relabelMeetingMarkdown,
+  relabelSidecarJson,
+} from '../lib/meeting-relabel.js'
 import {
   getMeetingStore,
   MeetingStore,
@@ -69,7 +107,13 @@ import {
   findCosOperationsMeetingBySessionId,
 } from '../lib/cos-operations-meetings.js'
 import { getOwnerSpeakerLabel } from '../lib/profile.js'
-import { reviewMeetingSpeakers, type ReviewChunk } from '../lib/meeting-speaker-review.js'
+import {
+  DEATTRIBUTED_PREFIX,
+  attachRawChunkIndices,
+  isUnattributed,
+  reviewMeetingSpeakers,
+  type ReviewChunk,
+} from '../lib/meeting-speaker-review.js'
 import {
   acquireMaintenanceWork,
   maintenanceAdmissionsOpen,
@@ -669,9 +713,18 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       return
     }
 
-    const review = reviewMeetingSpeakers(chunks as ReviewChunk[], {
+    // Raw capture indices, so a phrase can address its own audio. Position in
+    // `chunks` is NOT the WAV number — see attachRawChunkIndices.
+    const sidecar = (JSON.parse(readFileSync(sidecarPath, 'utf-8')) ?? {}) as Record<string, unknown>
+    const withIndices = attachRawChunkIndices(chunks as ReviewChunk[], sidecar.chunkEntries)
+    const review = reviewMeetingSpeakers(withIndices, {
       owner: getOwnerSpeakerLabel(),
       phrasesPerVoice: Math.max(1, Math.min(6, Number(req.query.phrases) || 3)),
+      // The sidecar's own durationMs is the meeting's true end. Deriving it from
+      // max(elapsed) uses the START of the last chunk, which made the final
+      // timeline span end where it began — a 1.5pt sliver labelled "1s" for what
+      // may be a long closing monologue.
+      durationMs: typeof sidecar.durationMs === 'number' ? sidecar.durationMs : undefined,
     })
     res.set('Cache-Control', 'private, no-store')
     res.json({
@@ -685,6 +738,459 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     })
   })
 
+
+  // ── Per-meeting speaker relabel (6.21.16) ─────────────────────────────
+  //
+  // Corrects who a voice was in ONE meeting. Deliberately not a global merge:
+  // Miles, on the design — "changing it doesn't mean that all previous chunks
+  // should also be moved. It should be meeting by meeting, with the goal of
+  // hardening or refining the voice profiles." The identifier mishearing a voice
+  // in one room is not evidence that every past attribution was wrong.
+  //
+  // ORDER IS THE WHOLE DESIGN. The ledger intent is written BEFORE any file is
+  // touched, and a failed intent write aborts without mutating anything. A
+  // process that dies mid-rewrite therefore leaves a visible pending correction
+  // rather than a silently half-relabelled meeting.
+  router.post('/meeting/:sessionId/relabel', (req, res) => {
+    res.set('Cache-Control', 'private, no-store')
+    const sessionId = String(req.params.sessionId ?? '')
+    if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) {
+      res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
+      return
+    }
+
+    const from = typeof req.body?.from === 'string' ? req.body.from : ''
+    const to = typeof req.body?.to === 'string' ? req.body.to : ''
+    const chunks = Array.isArray(req.body?.chunks)
+      ? (req.body.chunks as unknown[]).filter((n): n is number => Number.isInteger(n) && (n as number) >= 0)
+      : []
+    if (Array.isArray(req.body?.chunks) && chunks.length !== req.body.chunks.length) {
+      res.status(400).json({ error: 'chunks must be non-negative integers', reason: 'invalid_chunks' })
+      return
+    }
+    for (const [which, label] of [['from', from], ['to', to]] as const) {
+      const bad = invalidLabelReason(label)
+      if (bad) {
+        res.status(400).json({ error: `${which}: ${bad}`, reason: 'invalid_label' })
+        return
+      }
+    }
+    if (from === to) {
+      res.status(400).json({ error: 'from and to are the same label', reason: 'noop_relabel' })
+      return
+    }
+
+    // Same resolution as GET /speakers — operations tree first when configured,
+    // so the panel and the correction act on the same copy of the meeting.
+    const operations = cosOperationsMeetingsConfigured()
+      ? findCosOperationsMeetingBySessionId(sessionId)
+      : null
+    const saved = operations ? null : store.findBySessionId(sessionId)
+    if (!operations && !saved) {
+      res.status(404).json({ error: 'No saved meeting for this session', reason: 'meeting_not_found' })
+      return
+    }
+    const sidecarPath = operations?.sidecarPath ?? saved!.sidecarPath
+    const meetingPath = operations?.meetingPath ?? saved!.filepath
+    const title = operations?.title ?? saved!.title
+
+    let sidecarRaw: string
+    try {
+      sidecarRaw = readFileSync(sidecarPath, 'utf-8')
+    } catch {
+      res.status(422).json({ error: 'Chunk sidecar is missing or unreadable', reason: 'sidecar_unreadable' })
+      return
+    }
+
+    const plan = relabelSidecarJson(sidecarRaw, from, to, chunks)
+    if (!plan.ok) {
+      res.status(422).json({ error: plan.error, reason: 'relabel_rejected' })
+      return
+    }
+
+    // The markdown may only be rewritten when EVERY chunk carrying `from` is
+    // covered. Its turn segmentation does not match the sidecar's, so a partial
+    // relabel has no way to know which turns the selected chunks became.
+    let markdownRaw: string | null = null
+    let markdownPlan: ReturnType<typeof relabelMeetingMarkdown> | null = null
+    if (plan.value.coveredAllWithLabel) {
+      try {
+        markdownRaw = readFileSync(meetingPath, 'utf-8')
+        markdownPlan = relabelMeetingMarkdown(markdownRaw, from, to)
+      } catch {
+        markdownRaw = null   // sidecar-only correction; reported in the response
+      }
+    }
+    const md = markdownPlan?.ok ? markdownPlan.value : null
+
+    const surfaces = {
+      sidecar: plan.value.changed.length,
+      attendees: md?.attendees ?? 0,
+      transcript: md?.transcript ?? 0,
+    }
+    const preview = {
+      sessionId,
+      title,
+      from,
+      to,
+      scope: 'meeting' as const,
+      chunks: plan.value.changed,
+      surfaces,
+      partial: !plan.value.coveredAllWithLabel,
+      remainingWithFrom: plan.value.remainingWithFrom,
+      speakersAfter: plan.value.speakers,
+      proseStale: md?.proseStale ?? false,
+      proseHits: md?.proseHits ?? [],
+      markdownSkipped: !plan.value.coveredAllWithLabel
+        ? 'partial relabel: transcript turns cannot be mapped to chunk indices'
+        : markdownRaw === null ? 'meeting markdown unreadable' : null,
+    }
+
+    if (req.body?.dryRun === true || req.body?.confirm !== true) {
+      res.status(req.body?.dryRun === true ? 200 : 400).json({
+        ...(req.body?.dryRun === true ? {} : { error: 'confirmation required', reason: 'confirmation_required' }),
+        message: `Relabelling ${surfaces.sidecar} chunk(s) from "${from}" to "${to}" in this meeting`
+          + (preview.proseStale
+            ? '. The summary and decisions still name the old speaker and are NOT rewritten — '
+              + `prose refers to people by first name (${preview.proseHits.join(', ')}), `
+              + 'so substituting it could rewrite a sentence about someone else.'
+            : '.'),
+        ...preview,
+      })
+      return
+    }
+
+    // A prior correction that never closed means this meeting's files may already
+    // be half-written. Refuse rather than layering a second rewrite on top.
+    const stalled = pendingCorrections(sessionId)
+    if (stalled.length > 0 && req.body?.force !== true) {
+      res.status(409).json({
+        error: 'a previous correction on this meeting never completed',
+        reason: 'correction_pending',
+        pending: stalled.map(r => ({ id: r.id, at: r.at, from: r.from, to: r.to })),
+        message: 'Its files may be partly rewritten. Re-check the meeting, then pass { force: true } to proceed.',
+      })
+      return
+    }
+
+    const id = `${sessionId}:${from}>${to}:${Date.now().toString(36)}`
+    const at = new Date().toISOString()
+    // Intent first. If this cannot be written, nothing is mutated — an
+    // unrecorded rewrite is the exact failure the ledger exists to prevent.
+    if (!appendCorrection(sessionId, { id, phase: 'intent', at, from, to, chunks: plan.value.changed, scope: 'meeting' })) {
+      res.status(500).json({
+        error: 'could not record the correction, so nothing was changed',
+        reason: 'ledger_unwritable',
+      })
+      return
+    }
+
+    try {
+      durableAtomicWriteFileSync(sidecarPath, plan.value.json, { mode: 0o600 })
+      if (md && (md.attendees > 0 || md.transcript > 0)) {
+        durableAtomicWriteFileSync(meetingPath, md.markdown, { mode: 0o600 })
+      }
+    } catch (err: unknown) {
+      const message = err instanceof Error ? err.message : String(err)
+      appendCorrection(sessionId, {
+        id, phase: 'failed', at: new Date().toISOString(), from, to,
+        chunks: plan.value.changed, scope: 'meeting', error: message,
+      })
+      res.status(500).json({ error: `relabel failed: ${message}`, reason: 'write_failed' })
+      return
+    }
+
+    appendCorrection(sessionId, {
+      id, phase: 'applied', at: new Date().toISOString(), from, to,
+      chunks: plan.value.changed, scope: 'meeting', surfaces,
+      proseStale: preview.proseStale,
+    })
+
+    res.json({ ok: true, correctionId: id, ...preview })
+  })
+
+
+  // ── De-attribution (6.21.18) ──────────────────────────────────────────
+  //
+  // The inverse of naming an unknown voice: this voice was NOT that person.
+  //
+  // Miles, on the 2026-08-06 Ditto meeting: none of the eleven attributed
+  // voices were actually in the room, and there was no way to say so. Naming an
+  // unknown was possible; un-naming a wrong guess was not.
+  //
+  // It undoes MORE than a label. When a voice is falsely attributed the
+  // identifier may also have auto-enrolled those segments into that person's
+  // profile, so the wrong voice is now part of what the system thinks they sound
+  // like and will keep matching. Removing only the label fixes the transcript and
+  // leaves the profile poisoned — the exact mechanism that grew the phantom
+  // "Erick Hernandez" from 3 mislabelled seeds to 18 samples.
+  router.post('/meeting/:sessionId/deattribute', (req, res) => {
+    res.set('Cache-Control', 'private, no-store')
+    const sessionId = String(req.params.sessionId ?? '')
+    if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) {
+      res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
+      return
+    }
+    const from = typeof req.body?.from === 'string' ? req.body.from : ''
+    const bad = invalidLabelReason(from)
+    if (bad) {
+      res.status(400).json({ error: `from: ${bad}`, reason: 'invalid_label' })
+      return
+    }
+    if (isUnattributed(from)) {
+      res.status(400).json({ error: `"${from}" is already unattributed`, reason: 'already_unattributed' })
+      return
+    }
+    const chunks = Array.isArray(req.body?.chunks)
+      ? (req.body.chunks as unknown[]).filter((n): n is number => Number.isInteger(n) && (n as number) >= 0)
+      : []
+    if (Array.isArray(req.body?.chunks) && chunks.length !== req.body.chunks.length) {
+      res.status(400).json({ error: 'chunks must be non-negative integers', reason: 'invalid_chunks' })
+      return
+    }
+    // Retracting the training samples is the part that improves accuracy over
+    // time, so it defaults ON. Opt out to fix a transcript without touching the
+    // profile.
+    const retractTraining = req.body?.retractTraining !== false
+
+    const operations = cosOperationsMeetingsConfigured()
+      ? findCosOperationsMeetingBySessionId(sessionId)
+      : null
+    const saved = operations ? null : store.findBySessionId(sessionId)
+    if (!operations && !saved) {
+      res.status(404).json({ error: 'No saved meeting for this session', reason: 'meeting_not_found' })
+      return
+    }
+    const sidecarPath = operations?.sidecarPath ?? saved!.sidecarPath
+    const meetingPath = operations?.meetingPath ?? saved!.filepath
+    const title = operations?.title ?? saved!.title
+
+    let sidecarRaw: string
+    try {
+      sidecarRaw = readFileSync(sidecarPath, 'utf-8')
+    } catch {
+      res.status(422).json({ error: 'Chunk sidecar is missing or unreadable', reason: 'sidecar_unreadable' })
+      return
+    }
+
+    // A NUMBERED unidentified label, unique within this meeting, so removing
+    // several wrong names does not merge those voices together.
+    let existingSpeakers: string[] = []
+    try {
+      const parsed = JSON.parse(sidecarRaw) as { speakers?: unknown; chunks?: unknown }
+      existingSpeakers = Array.isArray(parsed.speakers)
+        ? parsed.speakers.filter((x): x is string => typeof x === 'string')
+        : []
+      // Also scan the chunks: a previous de-attribution may have left a label
+      // that never made it into `speakers`.
+      if (Array.isArray(parsed.chunks)) {
+        for (const c of parsed.chunks) {
+          const sp = (c as { speaker?: unknown } | null)?.speaker
+          if (typeof sp === 'string' && !existingSpeakers.includes(sp)) existingSpeakers.push(sp)
+        }
+      }
+    } catch { /* the relabel below reports a corrupt sidecar */ }
+    const DEATTRIBUTED_LABEL = nextDeattributedLabel(existingSpeakers)
+    const plan = relabelSidecarJson(sidecarRaw, from, DEATTRIBUTED_LABEL, chunks)
+    if (!plan.ok) {
+      res.status(422).json({ error: plan.error, reason: 'deattribute_rejected' })
+      return
+    }
+
+    // What this would remove from the profile, and what it CANNOT reach.
+    // readVoiceProfiles returns a ProfileStore, not an array.
+    const profile = readVoiceProfiles().profiles.find(p => p.name === from)
+    const profileSources: Array<string | undefined> = profile
+      ? Array.from({ length: profile.embeddings.length }, (_, i) => profile.sources?.[i])
+      : []
+    const traceable = profileSources.filter(sourceString => isSampleFromSession(sourceString, sessionId)).length
+    const untraceable = untraceableSampleCount(profileSources)
+
+    let markdownPlan: ReturnType<typeof relabelMeetingMarkdown> | null = null
+    let markdownUnreadable = false
+    if (plan.value.coveredAllWithLabel) {
+      try {
+        markdownPlan = relabelMeetingMarkdown(
+          readFileSync(meetingPath, 'utf-8'), from, DEATTRIBUTED_LABEL,
+          // Remove the attendee bullet outright: renaming it would write
+          // `- Unidentified 2` into the list as though it were a person.
+          { removeAttendee: true },
+        )
+      } catch { markdownPlan = null; markdownUnreadable = true }
+    }
+    const md = markdownPlan?.ok ? markdownPlan.value : null
+
+    const surfaces = {
+      sidecar: plan.value.changed.length,
+      attendees: md?.attendees ?? 0,
+      transcript: md?.transcript ?? 0,
+    }
+    const preview = {
+      sessionId,
+      title,
+      from,
+      to: DEATTRIBUTED_LABEL,
+      // 39% of operations sidecars have no .md beside them (the document was
+      // archived). Without this the response reports sidecar changes and zero
+      // markdown changes with no hint the document was never touched.
+      markdownSkipped: !plan.value.coveredAllWithLabel
+        ? 'partial de-attribution: transcript turns cannot be mapped to chunk indices'
+        : markdownUnreadable ? 'meeting markdown unreadable' : null,
+      scope: 'meeting' as const,
+      chunks: plan.value.changed,
+      surfaces,
+      partial: !plan.value.coveredAllWithLabel,
+      speakersAfter: plan.value.speakers,
+      training: {
+        retract: retractTraining,
+        wouldRetract: retractTraining ? traceable : 0,
+        profileSamples: profileSources.length,
+        // Honest about reach: samples written before train-g2 started stamping
+        // the session cannot be tied to a meeting and survive this.
+        untraceable,
+      },
+      proseStale: md?.proseStale ?? false,
+      proseHits: md?.proseHits ?? [],
+    }
+
+    if (req.body?.dryRun === true || req.body?.confirm !== true) {
+      const notes: string[] = []
+      if (retractTraining && traceable > 0) {
+        notes.push(`${traceable} training sample(s) from this meeting will be removed from "${from}"`)
+      }
+      if (retractTraining && traceable === 0) {
+        notes.push(`no training sample from this meeting is traceable to "${from}", so the profile is unchanged`)
+      }
+      if (untraceable > 0) {
+        notes.push(`${untraceable} older sample(s) on "${from}" carry no meeting provenance and cannot be retracted`)
+      }
+      res.status(req.body?.dryRun === true ? 200 : 400).json({
+        ...(req.body?.dryRun === true ? {} : { error: 'confirmation required', reason: 'confirmation_required' }),
+        message: `Removing "${from}" from ${surfaces.sidecar} segment(s) of this meeting. ${notes.join('. ')}`.trim(),
+        ...preview,
+      })
+      return
+    }
+
+    const stalled = pendingCorrections(sessionId)
+    if (stalled.length > 0 && req.body?.force !== true) {
+      res.status(409).json({
+        error: 'a previous correction on this meeting never completed',
+        reason: 'correction_pending',
+        pending: stalled.map(r => ({ id: r.id, at: r.at, from: r.from, to: r.to })),
+      })
+      return
+    }
+
+    const id = `${sessionId}:${from}>deattributed:${Date.now().toString(36)}`
+    const at = new Date().toISOString()
+    if (!appendCorrection(sessionId, {
+      id, phase: 'intent', at, from, to: DEATTRIBUTED_LABEL, chunks: plan.value.changed, scope: 'meeting',
+    })) {
+      res.status(500).json({
+        error: 'could not record the de-attribution, so nothing was changed',
+        reason: 'ledger_unwritable',
+      })
+      return
+    }
+
+    let retracted = 0
+    try {
+      durableAtomicWriteFileSync(sidecarPath, plan.value.json, { mode: 0o600 })
+      if (md && (md.attendees > 0 || md.transcript > 0)) {
+        durableAtomicWriteFileSync(meetingPath, md.markdown, { mode: 0o600 })
+      }
+      // Profile retraction happens AFTER the transcript is corrected: if the
+      // write fails, the ledger shows an unclosed intent and the profile has not
+      // yet been touched, which is the recoverable order.
+      if (retractTraining && traceable > 0) {
+        retracted = retractEmbeddingsBySource(from, s => isSampleFromSession(s, sessionId)).removed
+      }
+    } catch (err: unknown) {
+      const message = err instanceof Error ? err.message : String(err)
+      appendCorrection(sessionId, {
+        id, phase: 'failed', at: new Date().toISOString(), from, to: DEATTRIBUTED_LABEL,
+        chunks: plan.value.changed, scope: 'meeting', error: message,
+      })
+      res.status(500).json({ error: `de-attribution failed: ${message}`, reason: 'write_failed' })
+      return
+    }
+
+    appendCorrection(sessionId, {
+      id, phase: 'applied', at: new Date().toISOString(), from, to: DEATTRIBUTED_LABEL,
+      chunks: plan.value.changed, scope: 'meeting', surfaces, proseStale: preview.proseStale,
+    })
+
+    res.json({
+      ok: true,
+      correctionId: id,
+      ...preview,
+      training: { ...preview.training, retracted },
+    })
+  })
+
+
+  // ── Review playback (6.21.18) ─────────────────────────────────────────
+  //
+  // Miles: "I can quickly play that, and I'm going to hear the voice and know
+  // immediately who the speaker is. As a final confirmation."
+  //
+  // A phrase in the panel is a weaker signal than three seconds of the actual
+  // voice. Retention is 7 days (see meeting-audio-archive), so this answers with
+  // 404 + a reason once the window has passed rather than pretending the audio
+  // was never there.
+  router.get('/meeting/:sessionId/audio/:chunkIndex', (req, res) => {
+    res.set('Cache-Control', 'private, no-store')
+    const sessionId = String(req.params.sessionId ?? '')
+    if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) {
+      res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
+      return
+    }
+    const chunkIndex = Number(req.params.chunkIndex)
+    if (!Number.isInteger(chunkIndex) || chunkIndex < 0) {
+      res.status(400).json({ error: 'Invalid chunkIndex', reason: 'invalid_chunk_index' })
+      return
+    }
+    const path = meetingAudioChunkPath(sessionId, chunkIndex)
+    if (!path) {
+      const retained = listMeetingAudioChunks(sessionId)
+      res.status(404).json({
+        error: retained.length === 0
+          ? 'No audio retained for this meeting'
+          : `Chunk ${chunkIndex} is not retained`,
+        reason: retained.length === 0 ? 'audio_not_retained' : 'chunk_not_retained',
+        // Which chunks CAN be played, so a UI can offer the nearest instead of
+        // just failing.
+        retainedChunks: retained.length,
+        firstRetained: retained[0] ?? null,
+        lastRetained: retained[retained.length - 1] ?? null,
+      })
+      return
+    }
+    res.type('audio/wav')
+    res.sendFile(path)
+  })
+
+  /** What audio a meeting still has, so the panel can show play buttons only
+   *  where they will work. */
+  router.get('/meeting/:sessionId/audio', (req, res) => {
+    res.set('Cache-Control', 'private, no-store')
+    const sessionId = String(req.params.sessionId ?? '')
+    if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) {
+      res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
+      return
+    }
+    const chunks = listMeetingAudioChunks(sessionId)
+    res.json({
+      sessionId,
+      retained: chunks.length > 0,
+      chunks,
+      // Config read, not a filesystem walk: this route used to stat every
+      // retained chunk to report one number.
+      retentionDays: meetingAudioRetentionDays(),
+    })
+  })
+
   // ── Unsaved-capture recovery (6.19.0) ─────────────────────────────────
   // Surface-only by decision (Miles, 2026-08-02): the server NEVER drives
   // recovery on its own. It lists what the quarantine holds, and one

package/server/routes/transcribe-stream.ts

@@ -38,6 +38,11 @@ import {
 import { transcribeWhisperMeetingPreview } from '../lib/whisper-preview.js'
 import { dataPath } from '../lib/data-dir.js'
 import { ageHours, partitionExpiredAudio } from '../lib/audio-retention.js'
+import {
+  appendChunkEmbedding,
+  sweepExpiredChunkEmbeddings,
+} from '../lib/chunk-embedding-store.js'
+import { archiveSessionAudio, runMeetingAudioRetention } from '../lib/meeting-audio-archive.js'
 import {
   countChunkWavs,
   purgeExpiredQuarantine,
@@ -750,6 +755,22 @@ setInterval(() => {
     }
   } catch {}
 
+  // Meeting audio for review: 7-day window, then an 8 GB budget as a backstop.
+  // Order matters — sweep expiry FIRST so the cap only ever evicts audio still
+  // inside its window instead of racing the sweeper for the same files.
+  try {
+    const { swept, capped } = runMeetingAudioRetention()
+    if (swept.removed.length > 0) {
+      console.log(`[meeting-audio] Retention swept ${swept.removed.length} session(s), freed ${(swept.bytesFreed / 1e6).toFixed(1)} MB`)
+    }
+    if (capped.evicted.length > 0) {
+      console.warn(
+        `[meeting-audio] Over budget — evicted ${capped.evicted.length} oldest session(s): `
+        + `${(capped.bytesBefore / 1e9).toFixed(2)} GB -> ${(capped.bytesAfter / 1e9).toFixed(2)} GB`,
+      )
+    }
+  } catch { /* non-critical */ }
+
   // Purge training-audio WAVs past the retention window. Per file, not per
   // directory: chunks for one speaker accumulate over weeks, so an
   // all-or-nothing directory check would either keep month-old audio alive
@@ -788,6 +809,16 @@ setInterval(() => {
     }
   } catch {}
 
+  // Sweep expired chunk embeddings. Same shape as the audio sweeps, but a
+  // separate window: these are non-invertible timbre vectors, not speech, and
+  // the correction loop needs them to survive a weekend.
+  try {
+    const swept = sweepExpiredChunkEmbeddings(Date.now())
+    if (swept.removed.length > 0) {
+      console.log(`[chunk-embeddings] Purged ${swept.removed.length} expired session file(s), ${swept.retained.length} retained`)
+    }
+  } catch {}
+
   // Purge ext-audio dirs older than 72 hours
   try {
     if (existsSync(EXT_AUDIO_DIR)) {
@@ -1054,6 +1085,20 @@ export function moveSessionAudioToPending(sessionId: string): string | null {
         destDir = resolve(PENDING_BATCH_DIR, `${sessionId}_${suffix}`)
       }
     }
+    // Retain a reviewable copy BEFORE the rename. Hard links, so this costs no
+    // extra disk and the audio outlives the batch pipeline's own cleanup — which
+    // is what used to end the audio's life entirely (session-audio held 0 files
+    // on 2026-08-06, so the review panel could never play anything back).
+    try {
+      const archived = archiveSessionAudio(sessionId, srcDir)
+      if (archived.linked + archived.copied > 0) {
+        console.log(
+          `[meeting-audio] Retained ${archived.linked + archived.copied} chunk(s) for review: ${sessionId}`
+          + (archived.copied ? ` (${archived.copied} copied, link unavailable)` : '')
+          + (archived.failed ? ` — ${archived.failed} failed` : ''),
+        )
+      }
+    } catch { /* review audio is never worth failing a save for */ }
     // Rename is atomic on same filesystem
     renameSync(srcDir, destDir)
     try { chmodSync(destDir, 0o700) } catch {}
@@ -1498,6 +1543,20 @@ function identifyChunkSpeaker(audioBuffer: Buffer, sessionId: string, chunkIndex
   console.log(`[perf] identifySpeaker: ${(performance.now() - tEmb).toFixed(1)}ms`)
   if (!embeddingResult) return { speaker: clientSpeaker, similarity: 0 }
 
+  // Bank the embedding before anything else can return. This is the only moment
+  // it exists: identifySpeaker computes it per chunk and nothing else keeps it,
+  // so a correction made later has no acoustic evidence without this write.
+  // Deliberately includes 'Ext' — an unidentified voice is the case with no
+  // other way to be trained.
+  if (embeddingResult.embedding) {
+    appendChunkEmbedding(sessionId, {
+      i: chunkIndex,
+      speaker: embeddingResult.speaker,
+      similarity: embeddingResult.similarity,
+      embedding: embeddingResult.embedding,
+    })
+  }
+
   let speaker = embeddingResult.speaker
   if (speaker !== clientSpeaker) {
     console.log(`[speaker] Embedding: ${speaker} vs Amplitude: ${clientSpeaker} (sim: ${embeddingResult.similarity.toFixed(2)})`)