@gotcos/glasses-server 6.21.17 → 6.21.18

package/server/routes/meeting.ts

@@ -9,6 +9,37 @@ import { emitDisplay } from '../lib/display-bus.js'
 import { cleanTranscriptLines } from '../lib/hallucination-filter.js'
 import { durableAtomicWriteFileSync } from '../lib/atomic-fs.js'
 import { appendCorrection, pendingCorrections } from '../lib/meeting-corrections.js'
+import { isSampleFromSession, untraceableSampleCount } from '../lib/training-audio-provenance.js'
+import {
+  listMeetingAudioChunks,
+  meetingAudioChunkPath,
+  meetingAudioRetentionDays,
+} from '../lib/meeting-audio-archive.js'
+import { readVoiceProfiles, retractEmbeddingsBySource } from '../lib/speaker-embeddings.js'
+
+/**
+ * The label a de-attributed voice takes, numbered within its meeting.
+ *
+ * NOT a shared `Ext`. De-attributing to one label folded every corrected voice
+ * into a single row — on the 2026-08-06 Ditto meeting Miles named five wrong
+ * attributions, and collapsing them would have destroyed his ability to tell
+ * those five voices apart, which is precisely what he needs playback for next.
+ *
+ * `Unidentified N` is prefix-matched by isUnattributed(), so the review panel
+ * treats the row as unnamed and autoEnroll skips it — a de-attributed stretch
+ * cannot re-poison a profile — while staying separable.
+ */
+function nextDeattributedLabel(existing: string[]): string {
+  const used = new Set(
+    existing
+      .map(s => new RegExp(`^${DEATTRIBUTED_PREFIX} (\\d+)$`).exec(s)?.[1])
+      .filter((n): n is string => Boolean(n))
+      .map(Number),
+  )
+  let n = 1
+  while (used.has(n)) n++
+  return `${DEATTRIBUTED_PREFIX} ${n}`
+}
 import {
   invalidLabelReason,
   relabelMeetingMarkdown,
@@ -76,7 +107,13 @@ import {
   findCosOperationsMeetingBySessionId,
 } from '../lib/cos-operations-meetings.js'
 import { getOwnerSpeakerLabel } from '../lib/profile.js'
-import { reviewMeetingSpeakers, type ReviewChunk } from '../lib/meeting-speaker-review.js'
+import {
+  DEATTRIBUTED_PREFIX,
+  attachRawChunkIndices,
+  isUnattributed,
+  reviewMeetingSpeakers,
+  type ReviewChunk,
+} from '../lib/meeting-speaker-review.js'
 import {
   acquireMaintenanceWork,
   maintenanceAdmissionsOpen,
@@ -676,9 +713,18 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       return
     }
 
-    const review = reviewMeetingSpeakers(chunks as ReviewChunk[], {
+    // Raw capture indices, so a phrase can address its own audio. Position in
+    // `chunks` is NOT the WAV number — see attachRawChunkIndices.
+    const sidecar = (JSON.parse(readFileSync(sidecarPath, 'utf-8')) ?? {}) as Record<string, unknown>
+    const withIndices = attachRawChunkIndices(chunks as ReviewChunk[], sidecar.chunkEntries)
+    const review = reviewMeetingSpeakers(withIndices, {
       owner: getOwnerSpeakerLabel(),
       phrasesPerVoice: Math.max(1, Math.min(6, Number(req.query.phrases) || 3)),
+      // The sidecar's own durationMs is the meeting's true end. Deriving it from
+      // max(elapsed) uses the START of the last chunk, which made the final
+      // timeline span end where it began — a 1.5pt sliver labelled "1s" for what
+      // may be a long closing monologue.
+      durationMs: typeof sidecar.durationMs === 'number' ? sidecar.durationMs : undefined,
     })
     res.set('Cache-Control', 'private, no-store')
     res.json({
@@ -863,6 +909,288 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     res.json({ ok: true, correctionId: id, ...preview })
   })
 
+
+  // ── De-attribution (6.21.18) ──────────────────────────────────────────
+  //
+  // The inverse of naming an unknown voice: this voice was NOT that person.
+  //
+  // Miles, on the 2026-08-06 Ditto meeting: none of the eleven attributed
+  // voices were actually in the room, and there was no way to say so. Naming an
+  // unknown was possible; un-naming a wrong guess was not.
+  //
+  // It undoes MORE than a label. When a voice is falsely attributed the
+  // identifier may also have auto-enrolled those segments into that person's
+  // profile, so the wrong voice is now part of what the system thinks they sound
+  // like and will keep matching. Removing only the label fixes the transcript and
+  // leaves the profile poisoned — the exact mechanism that grew the phantom
+  // "Erick Hernandez" from 3 mislabelled seeds to 18 samples.
+  router.post('/meeting/:sessionId/deattribute', (req, res) => {
+    res.set('Cache-Control', 'private, no-store')
+    const sessionId = String(req.params.sessionId ?? '')
+    if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) {
+      res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
+      return
+    }
+    const from = typeof req.body?.from === 'string' ? req.body.from : ''
+    const bad = invalidLabelReason(from)
+    if (bad) {
+      res.status(400).json({ error: `from: ${bad}`, reason: 'invalid_label' })
+      return
+    }
+    if (isUnattributed(from)) {
+      res.status(400).json({ error: `"${from}" is already unattributed`, reason: 'already_unattributed' })
+      return
+    }
+    const chunks = Array.isArray(req.body?.chunks)
+      ? (req.body.chunks as unknown[]).filter((n): n is number => Number.isInteger(n) && (n as number) >= 0)
+      : []
+    if (Array.isArray(req.body?.chunks) && chunks.length !== req.body.chunks.length) {
+      res.status(400).json({ error: 'chunks must be non-negative integers', reason: 'invalid_chunks' })
+      return
+    }
+    // Retracting the training samples is the part that improves accuracy over
+    // time, so it defaults ON. Opt out to fix a transcript without touching the
+    // profile.
+    const retractTraining = req.body?.retractTraining !== false
+
+    const operations = cosOperationsMeetingsConfigured()
+      ? findCosOperationsMeetingBySessionId(sessionId)
+      : null
+    const saved = operations ? null : store.findBySessionId(sessionId)
+    if (!operations && !saved) {
+      res.status(404).json({ error: 'No saved meeting for this session', reason: 'meeting_not_found' })
+      return
+    }
+    const sidecarPath = operations?.sidecarPath ?? saved!.sidecarPath
+    const meetingPath = operations?.meetingPath ?? saved!.filepath
+    const title = operations?.title ?? saved!.title
+
+    let sidecarRaw: string
+    try {
+      sidecarRaw = readFileSync(sidecarPath, 'utf-8')
+    } catch {
+      res.status(422).json({ error: 'Chunk sidecar is missing or unreadable', reason: 'sidecar_unreadable' })
+      return
+    }
+
+    // A NUMBERED unidentified label, unique within this meeting, so removing
+    // several wrong names does not merge those voices together.
+    let existingSpeakers: string[] = []
+    try {
+      const parsed = JSON.parse(sidecarRaw) as { speakers?: unknown; chunks?: unknown }
+      existingSpeakers = Array.isArray(parsed.speakers)
+        ? parsed.speakers.filter((x): x is string => typeof x === 'string')
+        : []
+      // Also scan the chunks: a previous de-attribution may have left a label
+      // that never made it into `speakers`.
+      if (Array.isArray(parsed.chunks)) {
+        for (const c of parsed.chunks) {
+          const sp = (c as { speaker?: unknown } | null)?.speaker
+          if (typeof sp === 'string' && !existingSpeakers.includes(sp)) existingSpeakers.push(sp)
+        }
+      }
+    } catch { /* the relabel below reports a corrupt sidecar */ }
+    const DEATTRIBUTED_LABEL = nextDeattributedLabel(existingSpeakers)
+    const plan = relabelSidecarJson(sidecarRaw, from, DEATTRIBUTED_LABEL, chunks)
+    if (!plan.ok) {
+      res.status(422).json({ error: plan.error, reason: 'deattribute_rejected' })
+      return
+    }
+
+    // What this would remove from the profile, and what it CANNOT reach.
+    // readVoiceProfiles returns a ProfileStore, not an array.
+    const profile = readVoiceProfiles().profiles.find(p => p.name === from)
+    const profileSources: Array<string | undefined> = profile
+      ? Array.from({ length: profile.embeddings.length }, (_, i) => profile.sources?.[i])
+      : []
+    const traceable = profileSources.filter(sourceString => isSampleFromSession(sourceString, sessionId)).length
+    const untraceable = untraceableSampleCount(profileSources)
+
+    let markdownPlan: ReturnType<typeof relabelMeetingMarkdown> | null = null
+    let markdownUnreadable = false
+    if (plan.value.coveredAllWithLabel) {
+      try {
+        markdownPlan = relabelMeetingMarkdown(
+          readFileSync(meetingPath, 'utf-8'), from, DEATTRIBUTED_LABEL,
+          // Remove the attendee bullet outright: renaming it would write
+          // `- Unidentified 2` into the list as though it were a person.
+          { removeAttendee: true },
+        )
+      } catch { markdownPlan = null; markdownUnreadable = true }
+    }
+    const md = markdownPlan?.ok ? markdownPlan.value : null
+
+    const surfaces = {
+      sidecar: plan.value.changed.length,
+      attendees: md?.attendees ?? 0,
+      transcript: md?.transcript ?? 0,
+    }
+    const preview = {
+      sessionId,
+      title,
+      from,
+      to: DEATTRIBUTED_LABEL,
+      // 39% of operations sidecars have no .md beside them (the document was
+      // archived). Without this the response reports sidecar changes and zero
+      // markdown changes with no hint the document was never touched.
+      markdownSkipped: !plan.value.coveredAllWithLabel
+        ? 'partial de-attribution: transcript turns cannot be mapped to chunk indices'
+        : markdownUnreadable ? 'meeting markdown unreadable' : null,
+      scope: 'meeting' as const,
+      chunks: plan.value.changed,
+      surfaces,
+      partial: !plan.value.coveredAllWithLabel,
+      speakersAfter: plan.value.speakers,
+      training: {
+        retract: retractTraining,
+        wouldRetract: retractTraining ? traceable : 0,
+        profileSamples: profileSources.length,
+        // Honest about reach: samples written before train-g2 started stamping
+        // the session cannot be tied to a meeting and survive this.
+        untraceable,
+      },
+      proseStale: md?.proseStale ?? false,
+      proseHits: md?.proseHits ?? [],
+    }
+
+    if (req.body?.dryRun === true || req.body?.confirm !== true) {
+      const notes: string[] = []
+      if (retractTraining && traceable > 0) {
+        notes.push(`${traceable} training sample(s) from this meeting will be removed from "${from}"`)
+      }
+      if (retractTraining && traceable === 0) {
+        notes.push(`no training sample from this meeting is traceable to "${from}", so the profile is unchanged`)
+      }
+      if (untraceable > 0) {
+        notes.push(`${untraceable} older sample(s) on "${from}" carry no meeting provenance and cannot be retracted`)
+      }
+      res.status(req.body?.dryRun === true ? 200 : 400).json({
+        ...(req.body?.dryRun === true ? {} : { error: 'confirmation required', reason: 'confirmation_required' }),
+        message: `Removing "${from}" from ${surfaces.sidecar} segment(s) of this meeting. ${notes.join('. ')}`.trim(),
+        ...preview,
+      })
+      return
+    }
+
+    const stalled = pendingCorrections(sessionId)
+    if (stalled.length > 0 && req.body?.force !== true) {
+      res.status(409).json({
+        error: 'a previous correction on this meeting never completed',
+        reason: 'correction_pending',
+        pending: stalled.map(r => ({ id: r.id, at: r.at, from: r.from, to: r.to })),
+      })
+      return
+    }
+
+    const id = `${sessionId}:${from}>deattributed:${Date.now().toString(36)}`
+    const at = new Date().toISOString()
+    if (!appendCorrection(sessionId, {
+      id, phase: 'intent', at, from, to: DEATTRIBUTED_LABEL, chunks: plan.value.changed, scope: 'meeting',
+    })) {
+      res.status(500).json({
+        error: 'could not record the de-attribution, so nothing was changed',
+        reason: 'ledger_unwritable',
+      })
+      return
+    }
+
+    let retracted = 0
+    try {
+      durableAtomicWriteFileSync(sidecarPath, plan.value.json, { mode: 0o600 })
+      if (md && (md.attendees > 0 || md.transcript > 0)) {
+        durableAtomicWriteFileSync(meetingPath, md.markdown, { mode: 0o600 })
+      }
+      // Profile retraction happens AFTER the transcript is corrected: if the
+      // write fails, the ledger shows an unclosed intent and the profile has not
+      // yet been touched, which is the recoverable order.
+      if (retractTraining && traceable > 0) {
+        retracted = retractEmbeddingsBySource(from, s => isSampleFromSession(s, sessionId)).removed
+      }
+    } catch (err: unknown) {
+      const message = err instanceof Error ? err.message : String(err)
+      appendCorrection(sessionId, {
+        id, phase: 'failed', at: new Date().toISOString(), from, to: DEATTRIBUTED_LABEL,
+        chunks: plan.value.changed, scope: 'meeting', error: message,
+      })
+      res.status(500).json({ error: `de-attribution failed: ${message}`, reason: 'write_failed' })
+      return
+    }
+
+    appendCorrection(sessionId, {
+      id, phase: 'applied', at: new Date().toISOString(), from, to: DEATTRIBUTED_LABEL,
+      chunks: plan.value.changed, scope: 'meeting', surfaces, proseStale: preview.proseStale,
+    })
+
+    res.json({
+      ok: true,
+      correctionId: id,
+      ...preview,
+      training: { ...preview.training, retracted },
+    })
+  })
+
+
+  // ── Review playback (6.21.18) ─────────────────────────────────────────
+  //
+  // Miles: "I can quickly play that, and I'm going to hear the voice and know
+  // immediately who the speaker is. As a final confirmation."
+  //
+  // A phrase in the panel is a weaker signal than three seconds of the actual
+  // voice. Retention is 7 days (see meeting-audio-archive), so this answers with
+  // 404 + a reason once the window has passed rather than pretending the audio
+  // was never there.
+  router.get('/meeting/:sessionId/audio/:chunkIndex', (req, res) => {
+    res.set('Cache-Control', 'private, no-store')
+    const sessionId = String(req.params.sessionId ?? '')
+    if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) {
+      res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
+      return
+    }
+    const chunkIndex = Number(req.params.chunkIndex)
+    if (!Number.isInteger(chunkIndex) || chunkIndex < 0) {
+      res.status(400).json({ error: 'Invalid chunkIndex', reason: 'invalid_chunk_index' })
+      return
+    }
+    const path = meetingAudioChunkPath(sessionId, chunkIndex)
+    if (!path) {
+      const retained = listMeetingAudioChunks(sessionId)
+      res.status(404).json({
+        error: retained.length === 0
+          ? 'No audio retained for this meeting'
+          : `Chunk ${chunkIndex} is not retained`,
+        reason: retained.length === 0 ? 'audio_not_retained' : 'chunk_not_retained',
+        // Which chunks CAN be played, so a UI can offer the nearest instead of
+        // just failing.
+        retainedChunks: retained.length,
+        firstRetained: retained[0] ?? null,
+        lastRetained: retained[retained.length - 1] ?? null,
+      })
+      return
+    }
+    res.type('audio/wav')
+    res.sendFile(path)
+  })
+
+  /** What audio a meeting still has, so the panel can show play buttons only
+   *  where they will work. */
+  router.get('/meeting/:sessionId/audio', (req, res) => {
+    res.set('Cache-Control', 'private, no-store')
+    const sessionId = String(req.params.sessionId ?? '')
+    if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) {
+      res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
+      return
+    }
+    const chunks = listMeetingAudioChunks(sessionId)
+    res.json({
+      sessionId,
+      retained: chunks.length > 0,
+      chunks,
+      // Config read, not a filesystem walk: this route used to stat every
+      // retained chunk to report one number.
+      retentionDays: meetingAudioRetentionDays(),
+    })
+  })
+
   // ── Unsaved-capture recovery (6.19.0) ─────────────────────────────────
   // Surface-only by decision (Miles, 2026-08-02): the server NEVER drives
   // recovery on its own. It lists what the quarantine holds, and one

package/server/routes/transcribe-stream.ts

@@ -42,6 +42,7 @@ import {
   appendChunkEmbedding,
   sweepExpiredChunkEmbeddings,
 } from '../lib/chunk-embedding-store.js'
+import { archiveSessionAudio, runMeetingAudioRetention } from '../lib/meeting-audio-archive.js'
 import {
   countChunkWavs,
   purgeExpiredQuarantine,
@@ -754,6 +755,22 @@ setInterval(() => {
     }
   } catch {}
 
+  // Meeting audio for review: 7-day window, then an 8 GB budget as a backstop.
+  // Order matters — sweep expiry FIRST so the cap only ever evicts audio still
+  // inside its window instead of racing the sweeper for the same files.
+  try {
+    const { swept, capped } = runMeetingAudioRetention()
+    if (swept.removed.length > 0) {
+      console.log(`[meeting-audio] Retention swept ${swept.removed.length} session(s), freed ${(swept.bytesFreed / 1e6).toFixed(1)} MB`)
+    }
+    if (capped.evicted.length > 0) {
+      console.warn(
+        `[meeting-audio] Over budget — evicted ${capped.evicted.length} oldest session(s): `
+        + `${(capped.bytesBefore / 1e9).toFixed(2)} GB -> ${(capped.bytesAfter / 1e9).toFixed(2)} GB`,
+      )
+    }
+  } catch { /* non-critical */ }
+
   // Purge training-audio WAVs past the retention window. Per file, not per
   // directory: chunks for one speaker accumulate over weeks, so an
   // all-or-nothing directory check would either keep month-old audio alive
@@ -1068,6 +1085,20 @@ export function moveSessionAudioToPending(sessionId: string): string | null {
         destDir = resolve(PENDING_BATCH_DIR, `${sessionId}_${suffix}`)
       }
     }
+    // Retain a reviewable copy BEFORE the rename. Hard links, so this costs no
+    // extra disk and the audio outlives the batch pipeline's own cleanup — which
+    // is what used to end the audio's life entirely (session-audio held 0 files
+    // on 2026-08-06, so the review panel could never play anything back).
+    try {
+      const archived = archiveSessionAudio(sessionId, srcDir)
+      if (archived.linked + archived.copied > 0) {
+        console.log(
+          `[meeting-audio] Retained ${archived.linked + archived.copied} chunk(s) for review: ${sessionId}`
+          + (archived.copied ? ` (${archived.copied} copied, link unavailable)` : '')
+          + (archived.failed ? ` — ${archived.failed} failed` : ''),
+        )
+      }
+    } catch { /* review audio is never worth failing a save for */ }
     // Rename is atomic on same filesystem
     renameSync(srcDir, destDir)
     try { chmodSync(destDir, 0o700) } catch {}

package/server/routes/voice.ts

@@ -10,6 +10,7 @@ import { trainFromFireflies, getTrainingStatus } from '../lib/speaker-trainer.js
 import { getOwnerSpeakerLabel } from '../lib/profile.js'
 import { dataPath } from '../lib/data-dir.js'
 import { purgeSpeakerCalibrationRows, relabelSpeakerCalibrationRows } from '../lib/speaker-calibration-log.js'
+import { trainingSourceFor } from '../lib/training-audio-provenance.js'
 
 // These MUST match the writer in transcribe-stream.ts, which saves under
 // dataPath(). They previously resolved relative to __dirname — i.e. inside the
@@ -192,10 +193,14 @@ voiceRouter.post('/voice/train-g2', async (req, res) => {
 
       // Extract all embeddings, select most diverse
       const embeddings: Float32Array[] = []
+      // Parallel to `embeddings`: the WAV each one came from, so the enrollment
+      // below can stamp WHICH MEETING produced the sample. Without it a later
+      // de-attribution cannot retract this meeting's contribution to the profile.
+      const embeddingFiles: string[] = []
       for (const wav of wavFiles) {
         const buffer = readFileSync(resolve(speakerPath, wav))
         const emb = extractEmbedding(buffer)
-        if (emb) embeddings.push(emb)
+        if (emb) { embeddings.push(emb); embeddingFiles.push(wav) }
       }
 
       if (embeddings.length === 0) {
@@ -220,7 +225,13 @@ voiceRouter.post('/voice/train-g2', async (req, res) => {
       // Enroll the diverse subset (enrollEmbedding handles dedup gate + FIFO cap)
       let enrolled = 0
       for (const emb of selected) {
-        const result = enrollEmbedding(speakerName, emb, 'g2-training')
+        // Reference identity, NOT a re-selection: greedyDiversitySelect returns
+        // the very same Float32Array objects, so indexOf recovers the filename
+        // without changing which samples were chosen. Swapping the selector for
+        // an index-returning one would silently alter that choice.
+        const at = embeddings.indexOf(emb)
+        const source = at >= 0 ? trainingSourceFor(embeddingFiles[at]) : 'g2-training'
+        const result = enrollEmbedding(speakerName, emb, source)
         if (result.success) enrolled++
       }
 
@@ -407,6 +418,84 @@ voiceRouter.post('/voice/enroll-ext', async (req, res) => {
   }
 })
 
+// ── Voice sample playback (6.21.18) ───────────────────────────────────────
+//
+// Miles: hearing three seconds of a voice settles an identity question that a
+// similarity score cannot. These two paths need NO retention change — the audio
+// already exists:
+//
+//   training-audio  what the system thinks a NAMED person sounds like
+//   ext-audio       an UNIDENTIFIED voice, 72-hour window
+//
+// The first is the higher-value one for the review panel: "is this really Navaz?"
+// is answered by playing Navaz's own profile sample, not by playing the segment
+// under review.
+
+/** Newest WAV in a directory — the most representative recent sample. */
+function newestWav(dirPath: string): string | null {
+  try {
+    const wavs = readdirSync(dirPath).filter(f => f.endsWith('.wav'))
+    if (wavs.length === 0) return null
+    let best = wavs[0], bestAt = 0
+    for (const w of wavs) {
+      try {
+        const at = statSync(resolve(dirPath, w)).mtimeMs
+        if (at >= bestAt) { bestAt = at; best = w }
+      } catch { /* skip unreadable */ }
+    }
+    return resolve(dirPath, best)
+  } catch {
+    return null
+  }
+}
+
+// GET /api/voice/profiles/:name/sample — hear what a stored profile sounds like.
+voiceRouter.get('/voice/profiles/:name/sample', (req, res) => {
+  res.set('Cache-Control', 'private, no-store')
+  const name = String(req.params.name ?? '')
+  const dirPath = speakerDirPath(AUDIO_SAVE_DIR, name)
+  if (!dirPath) {
+    res.status(400).json({ error: 'Invalid speaker name', reason: 'invalid_speaker' })
+    return
+  }
+  const wav = existsSync(dirPath) ? newestWav(dirPath) : null
+  if (!wav) {
+    // A profile can exist with no retained audio: it may have been built from
+    // Fireflies seeds, or its training audio may have aged out. Say which rather
+    // than implying the person is unknown.
+    res.status(404).json({
+      error: `No retained audio for "${name}"`,
+      reason: 'no_sample_audio',
+      enrolled: isEnrolled(name),
+      embeddings: getEmbeddingCount(name),
+    })
+    return
+  }
+  res.type('audio/wav')
+  res.sendFile(wav)
+})
+
+// GET /api/voice/ext-audio/:sessionId/sample — hear an unidentified voice.
+voiceRouter.get('/voice/ext-audio/:sessionId/sample', (req, res) => {
+  res.set('Cache-Control', 'private, no-store')
+  const sessionId = String(req.params.sessionId ?? '')
+  const dirPath = speakerDirPath(EXT_AUDIO_DIR, sessionId)
+  if (!dirPath) {
+    res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
+    return
+  }
+  const wav = existsSync(dirPath) ? newestWav(dirPath) : null
+  if (!wav) {
+    res.status(404).json({
+      error: 'No ext-audio retained for this session',
+      reason: 'no_ext_audio',
+    })
+    return
+  }
+  res.type('audio/wav')
+  res.sendFile(wav)
+})
+
 // GET /api/voice/profiles — enrolled people with sample counts and provenance.
 // The review surfaces need to see the store; until now the only window into it
 // was a per-name count, so a misattributed profile was invisible.