@gotcos/glasses-server 6.21.17 → 6.21.19

package/server/lib/meeting-speaker-review.ts

@@ -26,6 +26,19 @@
 export interface ReviewChunk {
   text?: string
   speaker?: string
+  /**
+   * RAW capture index — the number in `chunk_NNNN.wav`, NOT this chunk's position
+   * in the array.
+   *
+   * These differ and the gap grows through a meeting. Measured on the 2026-08-06
+   * Ditto sidecar: 885 compacted chunks against raw indices 0..945 with 36 gaps,
+   * so array position 884 is really raw chunk 940 — a 56-chunk error, minutes of
+   * audio. `chunks` is filtered to text-bearing entries (transcribe-stream's
+   * getSessionChunks) while the WAV is written for EVERY received chunk before
+   * ASR, so the position can never address the audio. Populated from the
+   * sidecar's `chunkEntries`, which exists precisely to preserve these.
+   */
+  chunkIndex?: number
   /** MILLISECONDS from meeting start. Confirmed against the writer:
    *  meeting.ts accumulates `elapsed += row.durationMs`. Treating this as
    *  seconds reports a 32-minute meeting as 30,936 minutes. */
@@ -36,6 +49,24 @@ export interface ReviewChunk {
 /** Labels that mean "nobody was identified", not a person. */
 export const UNATTRIBUTED = new Set(['Unknown', 'Ext', '', 'Speaker 1', 'Speaker 2', 'Speaker 3'])
 
+/**
+ * Prefix for a voice a human de-attributed, numbered so distinct people stay
+ * distinct.
+ *
+ * De-attributing to a single shared `Ext` folded every corrected voice into one
+ * row: on the 2026-08-06 Ditto meeting Miles named five wrong attributions, and
+ * collapsing them would have destroyed his ability to tell those five voices
+ * apart afterwards — which is exactly what he then needs playback for. Numbering
+ * keeps them separable while asserting no identity.
+ */
+export const DEATTRIBUTED_PREFIX = 'Unidentified'
+
+/** True when a label asserts no identity — the exact set, or a numbered
+ *  de-attribution. Prefix-aware so `Unidentified 3` is treated as unnamed. */
+export function isUnattributed(label: string): boolean {
+  return UNATTRIBUTED.has(label) || new RegExp(`^${DEATTRIBUTED_PREFIX} \\d+$`).test(label)
+}
+
 /** Calibrated from the control pair above. A pair must be BOTH flip-happy and
  *  short-run to be called unreliable — either alone has honest explanations
  *  (a rapid-fire exchange is flip-happy; a brief interjection is short-run). */
@@ -44,6 +75,27 @@ export const THRASH_MEAN_RUN = 8
 /** Below the search-accept threshold a name was never asserted with confidence. */
 export const CONFIDENT_SIMILARITY = 0.65
 
+/**
+ * FLOOR FOR PRESENTING A NAME AT ALL.
+ *
+ * The identifier accepts a match at SEARCH_THRESHOLD = 0.55, so a single segment
+ * scoring 0.55 currently arrives in the panel wearing somebody's full name. On
+ * Miles's 2026-08-06 Ditto meeting that produced Richard Jenkins (1 segment,
+ * 0.60), Luke Henry (1 segment, 0.55), Dylan Jackson (2 segments, 0.58) and
+ * Navaz Sharif (3 segments, 0.58) — and he confirmed none of them were in the
+ * room. Presenting those as names is the defect; the reviewer then has to undo
+ * an assertion the system should never have made.
+ *
+ * Standing rule this enforces: speaker identity is a SUGGESTION, never an
+ * assertion. Below the floor the row is "unidentified" and the label survives
+ * only as a scored candidate.
+ *
+ * A floor cannot catch everything — a wrong match can still score well — so this
+ * removes obvious noise rather than guaranteeing correctness.
+ */
+export const ASSERT_MIN_SIMILARITY = CONFIDENT_SIMILARITY
+export const ASSERT_MIN_SEGMENTS = 3
+
 export type Reliability = 'confident' | 'weak' | 'unreliable' | 'unattributed'
 
 export interface ThrashPair {
@@ -58,6 +110,13 @@ export interface Phrase {
   /** Milliseconds from meeting start, matching the sidecar. */
   atMs: number
   similarity: number | null
+  /**
+   * Raw capture index for playback, or null when the sidecar cannot supply one
+   * (pre-`chunkEntries` captures). Null means "do not offer playback" — a
+   * guessed index plays somebody else's voice, which is worse than no button
+   * on a screen whose whole purpose is confirming identity.
+   */
+  chunkIndex: number | null
 }
 
 export interface VoiceReview {
@@ -72,22 +131,138 @@ export interface VoiceReview {
   longestRun: number
   isOwner: boolean
   reliability: Reliability
+  /**
+   * Whether `label` may be shown to a human AS A NAME.
+   *
+   * False means the UI must render the row as unidentified and offer `label`
+   * only as a scored candidate. Carried as data rather than left to each client
+   * to re-derive, so the phone, the lens and Control cannot disagree about
+   * whether a name was earned.
+   */
+  nameAsserted: boolean
+  /** Why the name is not asserted — so a UI can explain rather than just hide. */
+  assertionBlockers: string[]
   thrashesWith: ThrashPair[]
   phrases: Phrase[]
 }
 
+/** One stretch of the meeting held by a single label. */
+export interface TimelineSpan {
+  /** The label as stored. Whether it may be SHOWN as a name is still governed by
+   *  the matching voice row's `nameAsserted` — a span is not a second opinion. */
+  speaker: string
+  /** Milliseconds from meeting start. `elapsed` on a chunk is its START offset:
+   *  meeting.ts assigns `elapsed` and only then does `elapsed += durationMs`. */
+  startMs: number
+  endMs: number
+  segments: number
+}
+
+/**
+ * Collapse the chunk sequence into consecutive same-speaker spans.
+ *
+ * This exists because the ribbon needs a TIME axis. The previous ribbon drew one
+ * rectangle per voice sized by share of segments and labelled itself "who spoke,
+ * in order" — there was no ordering in it at all, so hovering could not report
+ * anything true.
+ *
+ * Non-monotonic or missing `elapsed` values are carried forward rather than
+ * trusted: a span with a negative width would render as an invisible or
+ * inverted block, which is worse than a slightly wrong boundary.
+ */
+export function speakerTimeline(chunks: ReviewChunk[], durationMs: number): TimelineSpan[] {
+  const spans: TimelineSpan[] = []
+  let cursor = 0
+  for (const c of chunks) {
+    const label = c.speaker ?? ''
+    const raw = typeof c.elapsed === 'number' && Number.isFinite(c.elapsed) ? c.elapsed : 0
+    // ONE clamp does all three jobs, because `cursor` is monotonic and never
+    // negative: it recovers a missing value, a negative value, and a value that
+    // goes backwards. Mutation showed the extra Math.max(0, raw) and the
+    // `: cursor` fallback were both unreachable behind it.
+    const startMs = Math.max(cursor, raw)
+    cursor = startMs
+    const last = spans[spans.length - 1]
+    if (last && last.speaker === label) {
+      last.segments++
+    } else {
+      spans.push({ speaker: label, startMs, endMs: startMs, segments: 1 })
+    }
+  }
+  // Each span ends where the next begins. The LAST one is the problem: `elapsed`
+  // is a start offset, and on real sidecars `durationMs` frequently equals the
+  // final chunk's start exactly (measured on 2026-08-06 Ditto: both 5,783,732),
+  // so taking the meeting end verbatim leaves the closing turn zero-width — a
+  // 1.5pt sliver for what may be a long monologue.
+  //
+  // The tail gets ONE TYPICAL CHUNK of width, derived from the median gap between
+  // this meeting's own chunk starts. That is measured from the data rather than
+  // invented, and it is the shortest defensible non-zero answer.
+  const gaps: number[] = []
+  for (let i = 1; i < spans.length; i++) {
+    const d = spans[i].startMs - spans[i - 1].startMs
+    if (d > 0) gaps.push(d)
+  }
+  gaps.sort((a, b) => a - b)
+  const typicalGap = gaps.length ? gaps[Math.floor(gaps.length / 2)] : 0
+  for (let i = 0; i < spans.length; i++) {
+    const next = spans[i + 1]
+    if (next) {
+      spans[i].endMs = Math.max(spans[i].startMs, next.startMs)
+    } else if (durationMs > spans[i].startMs) {
+      // A real meeting end, later than this span's start: use it verbatim.
+      spans[i].endMs = durationMs
+    } else {
+      // durationMs is absent, or equals the final chunk's start (the common real
+      // case). Fall back to one typical chunk so the closing turn has width.
+      spans[i].endMs = spans[i].startMs + typicalGap
+    }
+  }
+  return spans
+}
+
 export interface MeetingSpeakerReview {
   segments: number
   /** False when no chunk carries a real speaker — a recovered capture. */
   attributed: boolean
   durationMs: number
   voices: VoiceReview[]
+  /** Chronological spans, so a ribbon can be a timeline instead of a share bar. */
+  timeline: TimelineSpan[]
 }
 
 function mean(xs: number[]): number {
   return xs.length ? xs.reduce((a, b) => a + b, 0) / xs.length : 0
 }
 
+/**
+ * Attach raw capture indices to a compacted chunk array.
+ *
+ * The i-th compacted chunk is the i-th TEXT-BEARING `chunkEntries` row, whose
+ * `chunkIndex` is the raw WAV number. Verified against every 2026-07/08 sidecar
+ * that carries chunkEntries: the text-bearing count always equals the compacted
+ * count and the text lines up positionally.
+ *
+ * Returns the chunks UNCHANGED when the counts disagree or chunkEntries is
+ * absent. A partial or shifted mapping is worse than none: it would silently
+ * point playback at a neighbouring speaker, and this screen exists to confirm
+ * identity.
+ */
+export function attachRawChunkIndices(chunks: ReviewChunk[], chunkEntries: unknown): ReviewChunk[] {
+  if (!Array.isArray(chunkEntries)) return chunks
+  const textBearing = chunkEntries.filter(e => {
+    const chunk = (e as { chunk?: { text?: unknown } } | null)?.chunk
+    return typeof chunk?.text === 'string' && chunk.text.trim() !== ''
+  })
+  if (textBearing.length !== chunks.length) return chunks
+  return chunks.map((c, i) => {
+    const raw = (textBearing[i] as { chunkIndex?: unknown }).chunkIndex
+    return typeof raw === 'number' && Number.isInteger(raw) && raw >= 0
+      ? { ...c, chunkIndex: raw }
+      : c
+  })
+}
+
 /** Consecutive-run lengths for one speaker across the whole meeting. */
 export function speakerRuns(sequence: string[], speaker: string): number[] {
   const runs: number[] = []
@@ -179,6 +354,7 @@ export function selectPhrases(
       text: (c.text ?? '').trim(),
       atMs: typeof c.elapsed === 'number' ? c.elapsed : 0,
       similarity: typeof c.similarity === 'number' ? c.similarity : null,
+      chunkIndex: typeof c.chunkIndex === 'number' ? c.chunkIndex : null,
       score: phraseScore(c.text ?? ''),
     }))
     .filter(p => p.score > 0)
@@ -203,27 +379,34 @@ export function selectPhrases(
   }
   return picked
     .sort((a, b) => a.atMs - b.atMs)
-    .map(({ text, atMs, similarity }) => ({ text, atMs, similarity }))
+    .map(({ text, atMs, similarity, chunkIndex }) => ({ text, atMs, similarity, chunkIndex }))
 }
 
 /** Build the whole review for one meeting's chunks. */
 export function reviewMeetingSpeakers(
   chunks: ReviewChunk[],
-  options: { owner?: string; phrasesPerVoice?: number } = {},
+  options: { owner?: string; phrasesPerVoice?: number; durationMs?: number } = {},
 ): MeetingSpeakerReview {
   const owner = options.owner ?? 'Me'
   const limit = options.phrasesPerVoice ?? 3
   const sequence = chunks.map(c => c.speaker ?? '')
-  const durationMs = chunks.reduce((max, c) => Math.max(max, typeof c.elapsed === 'number' ? c.elapsed : 0), 0)
+  // The caller's durationMs (the sidecar's own) is the meeting's true end.
+  // Falling back to max(elapsed) uses the START of the last chunk, which makes
+  // the final timeline span zero-width — so prefer the real value and only
+  // derive when it is absent.
+  const lastStart = chunks.reduce((max, c) => Math.max(max, typeof c.elapsed === 'number' ? c.elapsed : 0), 0)
+  const durationMs = typeof options.durationMs === 'number' && options.durationMs > lastStart
+    ? options.durationMs
+    : lastStart
 
   const labels = [...new Set(sequence)].filter(s => s.length > 0)
-  const named = labels.filter(l => !UNATTRIBUTED.has(l))
+  const named = labels.filter(l => !isUnattributed(l))
 
   const voices: VoiceReview[] = labels.map(label => {
     const own = chunks.filter(c => (c.speaker ?? '') === label)
     const sims = own.map(c => c.similarity).filter((s): s is number => typeof s === 'number' && s > 0)
     const runs = speakerRuns(sequence, label)
-    const unattributed = UNATTRIBUTED.has(label)
+    const unattributed = isUnattributed(label)
 
     const thrashesWith: ThrashPair[] = []
     if (!unattributed) {
@@ -250,6 +433,32 @@ export function reviewMeetingSpeakers(
         ? 'unreliable'
         : (meanSim ?? 0) >= CONFIDENT_SIMILARITY ? 'confident' : 'weak'
 
+    // What stops this label being presented as a name. Collected as reasons
+    // rather than a bare boolean: "2 segments" and "similarity 0.58" are
+    // different problems and a reviewer deserves to see which one applies.
+    const assertionBlockers: string[] = []
+    if (unattributed) {
+      assertionBlockers.push('no name was ever assigned to this voice')
+    } else if (label === owner) {
+      // The wearer is exempt. Their identity is established by wearing the
+      // device, not by cosine — and the owner is verified at exactly this floor
+      // (VERIFY_THRESHOLD 0.65), so they sit permanently on the boundary and any
+      // thrash pair flips them. Measured across the 2026-08-06 corpus: the owner
+      // row read "Unidentified voice" in 4 of 9 meetings, including one with 285
+      // of their own segments. `thrashesWith` still renders, so a mixed row is
+      // still visible — the name is asserted, the caveat is not hidden.
+    } else {
+      if (own.length < ASSERT_MIN_SEGMENTS) {
+        assertionBlockers.push(`only ${own.length} segment${own.length === 1 ? '' : 's'} (needs ${ASSERT_MIN_SEGMENTS})`)
+      }
+      if ((meanSim ?? 0) < ASSERT_MIN_SIMILARITY) {
+        assertionBlockers.push(`similarity ${(meanSim ?? 0).toFixed(2)} below ${ASSERT_MIN_SIMILARITY}`)
+      }
+      if (thrashesWith.length > 0) {
+        assertionBlockers.push(`swaps with ${thrashesWith[0].speaker} every ${Math.round(thrashesWith[0].meanRun)} segments`)
+      }
+    }
+
     return {
       label,
       segments: own.length,
@@ -258,11 +467,19 @@ export function reviewMeetingSpeakers(
       longestRun: runs.length ? Math.max(...runs) : 0,
       isOwner: label === owner,
       reliability,
+      nameAsserted: assertionBlockers.length === 0,
+      assertionBlockers,
       thrashesWith,
       phrases: selectPhrases(chunks, label, limit, durationMs),
     }
   })
 
   voices.sort((a, b) => b.segments - a.segments)
-  return { segments: chunks.length, attributed: named.length > 0, durationMs, voices }
+  return {
+    segments: chunks.length,
+    attributed: named.length > 0,
+    durationMs,
+    voices,
+    timeline: speakerTimeline(chunks, durationMs),
+  }
 }

package/server/lib/training-audio-provenance.ts

@@ -0,0 +1,70 @@
+// Tracing a stored voice sample back to the meeting that produced it.
+//
+// WHY THIS IS NEEDED. De-attribution has to undo more than a label. When a voice
+// is falsely attributed to someone, the identifier may ALSO have auto-enrolled
+// those segments into that person's profile — so the wrong voice is now part of
+// what the system thinks they sound like, and it will keep matching. Removing the
+// label without removing the samples fixes the transcript and leaves the profile
+// poisoned. That is the mechanism behind the phantom "Erick Hernandez": three
+// mislabelled seeds compounded to eighteen samples through self-training.
+//
+// WHAT CAN AND CANNOT BE TRACED. Provenance strings differ in whether they name
+// a session:
+//
+//   auto:<sessionId>           traceable — autoEnroll stamps it
+//   correction:<sessionId>     traceable — the relabel ledger stamps it
+//   g2-training:<sessionId>    traceable ONLY from 2026-08-06 onward (see below)
+//   g2-training                NOT traceable — every sample written before that
+//   fireflies / manual / …     NOT traceable — no session concept
+//
+// `train-g2` used to stamp a bare `g2-training`, discarding which meeting each
+// sample came from even though the source WAV filename carries it
+// (`meeting_1785190805524_uzxmn4_chunk327_sim0.57.wav`). Samples written before
+// the stamp landed cannot be retracted per-meeting, and de-attribution reports
+// that count rather than implying a clean sweep.
+
+/** Session id embedded in a training-audio WAV name, or null if absent. */
+export function sessionIdFromTrainingWav(filename: string): string | null {
+  // Session ids contain underscores (`meeting_1785190805524_uzxmn4`), so the
+  // split has to be on the `_chunk` marker, not on the last underscore.
+  const at = filename.indexOf('_chunk')
+  if (at <= 0) return null
+  const id = filename.slice(0, at)
+  return /^[A-Za-z0-9:_-]{3,96}$/.test(id) ? id : null
+}
+
+/** Provenance to record for a sample trained out of `filename`. */
+export function trainingSourceFor(filename: string): string {
+  const id = sessionIdFromTrainingWav(filename)
+  return id ? `g2-training:${id}` : 'g2-training'
+}
+
+/**
+ * Did this stored sample come from `sessionId`?
+ *
+ * Exact match on the session part — a prefix test would let
+ * `auto:meeting_123_extra` match session `meeting_123` and retract a different
+ * meeting's evidence.
+ */
+export function isSampleFromSession(source: string | undefined | null, sessionId: string): boolean {
+  const s = String(source ?? '')
+  if (!sessionId) return false
+  for (const prefix of ['auto:', 'correction:', 'g2-training:']) {
+    if (s.startsWith(prefix) && s.slice(prefix.length) === sessionId) return true
+  }
+  return false
+}
+
+/**
+ * Samples that belong to this speaker but cannot be tied to any meeting.
+ *
+ * Reported so a de-attribution is honest about its reach: "retracted 4, and 9
+ * older samples cannot be traced to a meeting" is actionable, while silence
+ * implies the profile was fully cleaned.
+ */
+export function untraceableSampleCount(sources: Array<string | undefined | null>): number {
+  return sources.filter(s => {
+    const str = String(s ?? '')
+    return !str.includes(':')
+  }).length
+}

package/server/routes/health.ts

@@ -9,6 +9,7 @@ import { isSileroAvailable } from '../lib/vad-silero.js'
 import { profileProvenanceSummary, speakerModelState, speakerReadiness } from '../lib/speaker-embeddings.js'
 import { chunkEmbeddingStoreStats } from '../lib/chunk-embedding-store.js'
 import { correctionStoreStats } from '../lib/meeting-corrections.js'
+import { meetingAudioStats } from '../lib/meeting-audio-archive.js'
 import { getAvailableCliSessionId } from '../lib/claude-bridge.js'
 import {
   isWhisperLocalAvailable,
@@ -124,6 +125,7 @@ healthRouter.get('/health', async (_req, res) => {
   // `pending` is the number that matters here: an intent that never closed means
   // some meeting's files may be half-rewritten.
   const speakerCorrections = correctionStoreStats()
+  const reviewAudio = meetingAudioStats()
   // `noHumanSample` is the one to read: a profile with no human-verified sample
   // is trained entirely on labels the system chose for itself.
   const voiceProvenance = speakerId.state === 'active' ? profileProvenanceSummary() : null
@@ -246,6 +248,7 @@ healthRouter.get('/health', async (_req, res) => {
     unsaved_captures,
     chunk_embeddings: chunkEmbeddings,
     speaker_corrections: speakerCorrections,
+    review_audio: reviewAudio,
     ...(voiceProvenance ? { voice_provenance: voiceProvenance } : {}),
     capabilities: {
       transcription: {