@gotcos/glasses-server 6.21.7 → 6.21.10

package/server/lib/meeting-finalization-jobs.ts

@@ -0,0 +1,235 @@
+import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, unlinkSync } from 'node:fs'
+import { basename, dirname, join, resolve, sep } from 'node:path'
+import { durableAtomicWriteFileSync } from './atomic-fs.js'
+import { dataPath } from './data-dir.js'
+
+const JOB_NAME = /^[A-Za-z0-9:_-]{3,96}\.json$/
+
+export interface MeetingFinalizationJob {
+  schemaVersion: 1
+  sessionId: string
+  meetingPath: string
+  sidecarPath: string
+  audioDir: string | null
+  streamingWordCount: number
+  phase: 'capture_pending' | 'batch_pending' | 'ops_pending'
+  claimPending: boolean
+  createdAt: string
+  updatedAt: string
+  lastError?: string
+}
+
+function contained(parent: string, child: string): boolean {
+  return child === parent || child.startsWith(`${parent}${sep}`)
+}
+
+function validJob(raw: unknown): raw is MeetingFinalizationJob {
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return false
+  const job = raw as Partial<MeetingFinalizationJob>
+  return job.schemaVersion === 1
+    && typeof job.sessionId === 'string'
+    && /^[A-Za-z0-9:_-]{3,96}$/.test(job.sessionId)
+    && typeof job.meetingPath === 'string'
+    && typeof job.sidecarPath === 'string'
+    && (job.audioDir === null || typeof job.audioDir === 'string')
+    && typeof job.streamingWordCount === 'number'
+    && Number.isFinite(job.streamingWordCount)
+    && (job.phase === 'capture_pending' || job.phase === 'batch_pending' || job.phase === 'ops_pending')
+    && (job.claimPending === undefined || typeof job.claimPending === 'boolean')
+    && typeof job.createdAt === 'string'
+    && typeof job.updatedAt === 'string'
+}
+
+/** Durable replay ledger for the post-response HQ + operations handoff.
+ * The meeting and sidecar remain the canonical data; this store contains only
+ * bounded pointers and phase state so a server restart can resume safely. */
+export class MeetingFinalizationJobStore {
+  readonly root: string
+
+  constructor(root = dataPath('meeting-finalization-jobs')) {
+    this.root = resolve(root)
+  }
+
+  private ensureRoot(): void {
+    mkdirSync(this.root, { recursive: true, mode: 0o700 })
+  }
+
+  private pathFor(sessionId: string): string {
+    if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) throw new Error('Invalid finalization sessionId')
+    const path = resolve(this.root, `${sessionId}.json`)
+    if (!contained(this.root, path)) throw new Error('Unsafe finalization job path')
+    return path
+  }
+
+  private assertSafePointers(input: Pick<MeetingFinalizationJob, 'meetingPath' | 'sidecarPath' | 'audioDir'>): void {
+    const dataRoot = dirname(this.root)
+    const recordingsRoot = resolve(dataRoot, 'recordings')
+    const pendingRoot = resolve(dataRoot, 'pending-batch')
+    if (!contained(recordingsRoot, resolve(input.meetingPath))) throw new Error('Unsafe finalization meeting path')
+    if (!contained(recordingsRoot, resolve(input.sidecarPath))) throw new Error('Unsafe finalization sidecar path')
+    if (input.audioDir && !contained(pendingRoot, resolve(input.audioDir))) {
+      throw new Error('Unsafe finalization audio path')
+    }
+  }
+
+  save(input: Omit<MeetingFinalizationJob, 'schemaVersion' | 'createdAt' | 'updatedAt'>): MeetingFinalizationJob {
+    this.assertSafePointers(input)
+    this.ensureRoot()
+    const prior = this.get(input.sessionId)
+    const now = new Date().toISOString()
+    const job: MeetingFinalizationJob = {
+      schemaVersion: 1,
+      ...input,
+      createdAt: prior?.createdAt ?? now,
+      updatedAt: now,
+    }
+    durableAtomicWriteFileSync(this.pathFor(input.sessionId), `${JSON.stringify(job, null, 2)}\n`, { mode: 0o600 })
+    return job
+  }
+
+  get(sessionId: string): MeetingFinalizationJob | null {
+    const path = this.pathFor(sessionId)
+    if (!existsSync(path)) return null
+    try {
+      const parsed = JSON.parse(readFileSync(path, 'utf8')) as unknown
+      if (!validJob(parsed)) return null
+      const normalized = { ...parsed, claimPending: parsed.claimPending === true }
+      this.assertSafePointers(normalized)
+      return normalized
+    } catch {
+      return null
+    }
+  }
+
+  list(): MeetingFinalizationJob[] {
+    if (!existsSync(this.root)) return []
+    let names: string[] = []
+    try { names = readdirSync(this.root).filter(name => JOB_NAME.test(name)) } catch { return [] }
+    return names.flatMap(name => {
+      const sessionId = basename(name, '.json')
+      const job = this.get(sessionId)
+      return job ? [job] : []
+    })
+  }
+
+  malformedCount(): number {
+    if (!existsSync(this.root)) return 0
+    try {
+      return readdirSync(this.root)
+        .filter(name => JOB_NAME.test(name))
+        .filter(name => this.get(basename(name, '.json')) === null)
+        .length
+    } catch {
+      return 0
+    }
+  }
+
+  remove(sessionId: string): void {
+    try { unlinkSync(this.pathFor(sessionId)) } catch { /* already absent */ }
+  }
+
+  /** Find a previously moved audio directory without trusting a stored path. */
+  findPendingAudioDir(sessionId: string): string | null {
+    const pendingRoot = resolve(dirname(this.root), 'pending-batch')
+    if (!existsSync(pendingRoot)) return null
+    try {
+      const candidates = readdirSync(pendingRoot)
+        .filter(name => name === sessionId || name.startsWith(`${sessionId}_`))
+        .map(name => resolve(pendingRoot, name))
+        .filter(path => contained(pendingRoot, path) && statSync(path).isDirectory())
+        .sort()
+      return candidates[0] ?? null
+    } catch {
+      return null
+    }
+  }
+
+  /** Rebuild missing replay jobs from the canonical sidecar intent marker. */
+  reconcileCanonicalSidecars(): MeetingFinalizationJob[] {
+    const recordingsRoot = resolve(dirname(this.root), 'recordings')
+    if (!existsSync(recordingsRoot)) return []
+    const rebuilt: MeetingFinalizationJob[] = []
+    let months: string[] = []
+    try { months = readdirSync(recordingsRoot).filter(name => /^\d{4}-\d{2}$/.test(name)) } catch { return [] }
+    for (const month of months) {
+      const monthDir = resolve(recordingsRoot, month)
+      let names: string[] = []
+      try { names = readdirSync(monthDir).filter(name => name.endsWith('.g2-chunks.json')) } catch { continue }
+      for (const name of names) {
+        const sidecarPath = resolve(monthDir, name)
+        try {
+          const sidecar = JSON.parse(readFileSync(sidecarPath, 'utf8')) as Record<string, unknown>
+          const sessionId = typeof sidecar.sessionId === 'string' ? sidecar.sessionId : ''
+          if (sidecar.finalizationState === 'complete' || !sidecar.finalizationState || this.get(sessionId)) continue
+          const meetingPath = sidecarPath.replace(/\.g2-chunks\.json$/, '.md')
+          if (!existsSync(meetingPath)) continue
+          const audioDir = this.findPendingAudioDir(sessionId)
+          rebuilt.push(this.save({
+            sessionId,
+            meetingPath,
+            sidecarPath,
+            audioDir,
+            streamingWordCount: Number(sidecar.streamingWordCount ?? 0),
+            phase: audioDir ? 'batch_pending' : 'capture_pending',
+            claimPending: sidecar.claimPending === true,
+          }))
+        } catch { /* malformed canonical sidecars are not executable */ }
+      }
+    }
+    return rebuilt
+  }
+}
+
+export function readFinalizationChunkEntries(job: MeetingFinalizationJob): unknown[] | null {
+  if (!existsSync(job.meetingPath) || !existsSync(job.sidecarPath)) return null
+  try {
+    const sidecar = JSON.parse(readFileSync(job.sidecarPath, 'utf8')) as Record<string, unknown>
+    if (sidecar.sessionId !== job.sessionId || !Array.isArray(sidecar.chunkEntries)) return null
+    return sidecar.chunkEntries
+  } catch {
+    return null
+  }
+}
+
+export function canonicalFinalizationIsComplete(job: MeetingFinalizationJob): boolean {
+  try {
+    const sidecar = JSON.parse(readFileSync(job.sidecarPath, 'utf8')) as Record<string, unknown>
+    return sidecar.sessionId === job.sessionId && sidecar.finalizationState === 'complete'
+  } catch {
+    return false
+  }
+}
+
+export function markCanonicalFinalizationState(
+  sidecarPath: string,
+  state: MeetingFinalizationJob['phase'] | 'complete',
+  claimPending: boolean,
+): void {
+  if (!existsSync(sidecarPath)) return
+  const parsed = JSON.parse(readFileSync(sidecarPath, 'utf8')) as Record<string, unknown>
+  parsed.finalizationState = state
+  parsed.claimPending = claimPending
+  parsed.finalizationUpdatedAt = new Date().toISOString()
+  if (state === 'complete') delete parsed.finalizationError
+  durableAtomicWriteFileSync(sidecarPath, `${JSON.stringify(parsed, null, 2)}\n`, { mode: 0o600 })
+}
+
+export function getMeetingFinalizationSnapshot(): {
+  pending: number
+  failed: number
+  oldestUpdatedAt: string | null
+  lastError: string | null
+  malformed: number
+} {
+  const jobs = new MeetingFinalizationJobStore().list()
+  const failed = jobs.filter(job => Boolean(job.lastError))
+  const oldest = jobs.map(job => job.updatedAt).sort()[0] ?? null
+  const mostRecentFailure = failed.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt))[0]
+  return {
+    pending: jobs.length,
+    failed: failed.length,
+    oldestUpdatedAt: oldest,
+    lastError: mostRecentFailure?.lastError?.slice(0, 200) ?? null,
+    malformed: new MeetingFinalizationJobStore().malformedCount(),
+  }
+}

package/server/lib/meeting-store.ts

@@ -89,6 +89,10 @@ export interface SaveMeetingInput {
   chunkEntries?: IndexedTranscriptChunk[]
   providerCandidates?: Record<string, ProviderCandidateRecord>
   transferIntegrity?: TranscriptGapReport | null
+  /** Durable intent used to reconstruct post-save work if the process exits
+   * between the canonical commit and creation of the replay job. */
+  finalizationRequired?: boolean
+  claimPending?: boolean
 }
 
 export interface SavedMeeting {
@@ -444,6 +448,11 @@ export class MeetingStore {
       transcriptionQuality: 'streaming',
       batchApplied: false,
       streamingWordCount: wordCount(transcript),
+      ...(input.finalizationRequired ? {
+        finalizationState: 'capture_pending',
+        claimPending: input.claimPending === true,
+        finalizationUpdatedAt: new Date().toISOString(),
+      } : {}),
     }
 
     // Sidecar first, markdown second: the markdown is the visible commit marker.

package/server/lib/speaker-calibration-log.ts

@@ -0,0 +1,86 @@
+// speaker-calibration.jsonl — threshold-tuning telemetry, one row per
+// identification decision. Every row carries a speaker NAME, so a person's
+// trace survives deleting their voice profile unless this file is swept too.
+//
+// The log is append-only and written from the live identification path with a
+// fire-and-forget `appendFileSync`. A rewrite therefore has a genuine (if
+// millisecond-wide) race with concurrent appends. That is acceptable HERE and
+// nowhere else in this feature: the file is explicitly non-critical tuning data,
+// already best-effort, and losing a row written during the swap costs nothing —
+// whereas leaving a deleted person's name in 21k rows is the privacy gap the
+// delete exists to close. Embedding data is never touched by this module.
+
+import { existsSync, readFileSync } from 'node:fs'
+import { durableAtomicWriteFileSync } from './atomic-fs.js'
+
+export interface CalibrationPurgeResult {
+  /** Rows whose `speaker` matched and were dropped. */
+  removed: number
+  /** Rows retained, including rows that could not be parsed. */
+  retained: number
+  /** Rows that were not valid JSON. Kept — a malformed row is not evidence that
+   *  it belongs to the person being deleted, and discarding it would be a
+   *  silent data loss dressed up as a privacy fix. */
+  unparsable: number
+}
+
+/**
+ * Filter JSONL text, dropping rows whose `speaker` field matches.
+ *
+ * Pure so the matching rule can be tested without touching the filesystem.
+ * Matching is exact on the `speaker` field only: a substring match would delete
+ * every "Miles Mallard" row when removing "Miles", and the name also appears in
+ * no other field.
+ */
+export function filterCalibrationRows(
+  raw: string,
+  speakerName: string,
+): { text: string; result: CalibrationPurgeResult } {
+  const lines = raw.split('\n')
+  const kept: string[] = []
+  const result: CalibrationPurgeResult = { removed: 0, retained: 0, unparsable: 0 }
+
+  for (const line of lines) {
+    if (line.trim() === '') continue
+    let speaker: unknown
+    try {
+      speaker = (JSON.parse(line) as { speaker?: unknown }).speaker
+    } catch {
+      result.unparsable++
+      result.retained++
+      kept.push(line)
+      continue
+    }
+    if (speaker === speakerName) {
+      result.removed++
+      continue
+    }
+    result.retained++
+    kept.push(line)
+  }
+
+  return { text: kept.length > 0 ? kept.join('\n') + '\n' : '', result }
+}
+
+/** Rewrite the log without a given speaker's rows. */
+export function purgeSpeakerCalibrationRows(
+  logPath: string,
+  speakerName: string,
+  options: { dryRun?: boolean } = {},
+): CalibrationPurgeResult {
+  if (!existsSync(logPath)) return { removed: 0, retained: 0, unparsable: 0 }
+  let raw: string
+  try {
+    raw = readFileSync(logPath, 'utf-8')
+  } catch {
+    return { removed: 0, retained: 0, unparsable: 0 }
+  }
+
+  const { text, result } = filterCalibrationRows(raw, speakerName)
+  if (result.removed === 0 || options.dryRun) return result
+
+  // Atomic: a torn rewrite of a 2 MB log would leave a half-row that every
+  // later parse trips over.
+  durableAtomicWriteFileSync(logPath, text, { mode: 0o600 })
+  return result
+}

package/server/lib/speaker-embeddings.ts

@@ -8,7 +8,20 @@
 import { resolve } from 'node:path'
 import { errMsg } from './utils.js'
 import { getOwnerSpeakerLabel } from './profile.js'
-import { readFileSync, writeFileSync, existsSync, appendFileSync, mkdirSync, statSync, openSync, readSync, closeSync } from 'node:fs'
+import { existsSync, appendFileSync, mkdirSync, statSync, openSync, readSync, closeSync } from 'node:fs'
+import {
+  appendEmbedding,
+  deleteProfileFromStore,
+  describeRepairs,
+  dropOldestEmbedding,
+  hasRepairs,
+  loadVoiceProfileStore,
+  modalDimension,
+  removeEmbeddingsBySource,
+  saveVoiceProfileStore,
+  type ProfileStore,
+  type VoiceProfile,
+} from './voice-profile-store.js'
 import { homedir } from 'node:os'
 import { spawnSync } from 'node:child_process'
 import { fileURLToPath } from 'node:url'
@@ -92,15 +105,10 @@ const autoEnrollSessions = new Map<string, Map<string, number>>()
 // Track which speakers already auto-enrolled this session
 const autoEnrolledThisSession = new Map<string, Set<string>>()
 
-interface VoiceProfile {
-  name: string
-  embeddings: number[][]  // multiple enrollments for robustness
-  sources?: string[]      // provenance: 'manual' | 'fireflies' | 'auto:sessionId'
-}
-
-interface ProfileStore {
-  profiles: VoiceProfile[]
-}
+// Shape, durability, and integrity repair all live in voice-profile-store.ts.
+// Re-exported because the review surfaces (/speakers, delete-person, coherence
+// audit) need the types and were previously blocked on them being file-private.
+export type { ProfileStore, VoiceProfile }
 
 /** Cheap structural screen for a downloaded model.
  *
@@ -293,11 +301,13 @@ export function enrollEmbedding(name: string, embedding: Float32Array, source: s
       }
     }
 
-    // FIFO cap: if at max, drop oldest before adding (always enforced)
+    // FIFO cap: if at max, drop oldest before adding (always enforced).
+    // dropOldestEmbedding keeps sources[] in lockstep — the old inline
+    // `sources?.shift()` no-opped whenever sources was undefined or short,
+    // permanently offsetting provenance from the samples it described.
     if (profile.embeddings.length >= MAX_EMBEDDINGS_PER_SPEAKER) {
       console.log(`[speaker] Profile cap reached for "${name}" (${profile.embeddings.length}/${MAX_EMBEDDINGS_PER_SPEAKER}) — dropping oldest`)
-      profile.embeddings.shift()
-      profile.sources?.shift()
+      dropOldestEmbedding(profile)
       rebuildSpeakerInManager(name, profile.embeddings)
     }
   }
@@ -448,10 +458,44 @@ export function clearSpeakerEmbeddings(name: string): boolean {
     try { manager.remove(name) } catch { /* ignore */ }
   }
 
-  // Persist
-  writeFileSync(PROFILES_PATH, JSON.stringify(store, null, 2))
-  invalidateProfileCache()
-  return true
+  // Persist. A "fresh training" clear legitimately empties one profile but must
+  // never be able to empty the whole store, so allowEmpty stays off here.
+  return writeProfileStore(store)
+}
+
+/** Remove a person entirely: profile, embeddings, and manager registration.
+ *  Returns counts so a caller can report what was actually removed. */
+export function removeSpeakerProfile(name: string): { removedProfiles: number; removedEmbeddings: number } {
+  const store = loadProfileStore()
+  const result = deleteProfileFromStore(store, name)
+  if (result.removedProfiles === 0) return result
+
+  if (manager && manager.contains(name)) {
+    try { manager.remove(name) } catch { /* the on-disk removal is the durable half */ }
+  }
+  // allowEmpty: deleting the only enrolled person is a legitimate reset, and the
+  // caller has already confirmed it explicitly.
+  writeProfileStore(store, { allowEmpty: true })
+  return result
+}
+
+/** Retract samples by provenance — e.g. every `auto:<sessionId>` embedding a
+ *  bad session wrote into the wrong profile. `clearSpeakerEmbeddings` is
+ *  all-or-nothing and would discard the legitimate training alongside it. */
+export function retractEmbeddingsBySource(
+  name: string,
+  matches: (source: string) => boolean,
+): { removed: number; remaining: number } {
+  const store = loadProfileStore()
+  const profile = store.profiles.find(p => p.name === name)
+  if (!profile) return { removed: 0, remaining: 0 }
+
+  const removed = removeEmbeddingsBySource(profile, matches)
+  if (removed === 0) return { removed: 0, remaining: profile.embeddings.length }
+
+  rebuildSpeakerInManager(name, profile.embeddings)
+  writeProfileStore(store, { allowEmpty: true })
+  return { removed, remaining: profile.embeddings.length }
 }
 
 /** Get embedding count for a speaker */
@@ -495,6 +539,28 @@ export function speakerModelState(): {
   return { state, path, searched: speakerModelCandidates() }
 }
 
+/** Map the model state onto a readiness verdict for /api/health.
+ *
+ *  The distinction this encodes is the whole point of the field, so it is a
+ *  named pure function rather than an inline ternary inside the health handler:
+ *
+ *   - 'error'       → degraded. A model IS installed and the runtime refused it,
+ *                     so diarization has silently collapsed to the amplitude
+ *                     fallback while every other status surface stays green.
+ *                     That is exactly how 78 trained profiles went unnoticed as
+ *                     missing across a managed cutover.
+ *   - 'unavailable' → NOT degraded. The ~26 MB model ships outside the npm
+ *                     tarball, so most installs have never had one and are
+ *                     working as designed. Degrading them would make the field
+ *                     meaningless on every public box and train the operator to
+ *                     ignore the one channel that matters. */
+export function speakerReadiness(
+  state: 'active' | 'unavailable' | 'error',
+): 'ready' | 'unavailable' | 'degraded' {
+  if (state === 'error') return 'degraded'
+  return state === 'active' ? 'ready' : 'unavailable'
+}
+
 /** Compute actual cosine similarity between two raw embedding vectors */
 export function rawCosineSimilarity(a: Float32Array, b: Float32Array): number {
   if (a.length !== b.length) return 0
@@ -606,14 +672,66 @@ function logCalibration(speaker: string, similarity: number, matched: boolean, e
   } catch { /* non-critical */ }
 }
 
-/** Load profile store from disk (cached in memory, invalidated on write) */
+/** Load profile store from disk (cached in memory, invalidated on write).
+ *
+ *  Previously a bare `JSON.parse(readFileSync(...))`: a truncated file threw out
+ *  of every caller, including the live enrollment path, and there was no backup
+ *  to fall back to. Corruption and integrity repairs are now both reported —
+ *  silently returning `{profiles: []}` is the one outcome that must never pass
+ *  unremarked, because the next save would commit it over the real store. */
 function loadProfileStore(): ProfileStore {
   if (_cachedProfileStore) return _cachedProfileStore
-  if (existsSync(PROFILES_PATH)) {
-    _cachedProfileStore = JSON.parse(readFileSync(PROFILES_PATH, 'utf-8'))
-    return _cachedProfileStore!
+
+  const load = loadVoiceProfileStore(PROFILES_PATH)
+
+  if (load.status === 'corrupt') {
+    if (load.recoveredFromBackup) {
+      console.error(
+        `[speaker] voice-profiles.json was corrupt (quarantined as ${load.quarantinedAs}) —`,
+        `recovered ${load.store.profiles.length} profile(s) from ${load.recoveredFromBackup}.`,
+      )
+      // Republish the recovered content so the next boot reads a clean file
+      // rather than repeating the recovery. The corrupt original is retained at
+      // the quarantine path for inspection.
+      try {
+        saveVoiceProfileStore(PROFILES_PATH, load.store)
+      } catch (err: unknown) {
+        console.error('[speaker] Failed to republish recovered profiles:', errMsg(err))
+      }
+    } else {
+      console.error(
+        `[speaker] voice-profiles.json was corrupt and NO usable backup exists.`,
+        `The unreadable file is retained at ${load.quarantinedAs}.`,
+        'Diarization is starting with zero profiles; writes will not overwrite a populated store.',
+      )
+    }
+  }
+
+  if (hasRepairs(load.repairs)) {
+    console.warn(`[speaker] Repaired voice-profiles.json on load: ${describeRepairs(load.repairs)}`)
   }
-  return { profiles: [] }
+
+  _cachedProfileStore = load.store
+  return _cachedProfileStore
+}
+
+/** Read-only view of the persisted profiles, for review/audit surfaces.
+ *  Returns a structural copy so a caller cannot mutate the shared cache. */
+export function readVoiceProfiles(): ProfileStore {
+  const store = loadProfileStore()
+  return { profiles: store.profiles.map(p => ({ ...p, embeddings: p.embeddings, sources: [...(p.sources ?? [])] })) }
+}
+
+/** Persist the shared store, reporting a refusal rather than swallowing it. */
+function writeProfileStore(store: ProfileStore, options: { allowEmpty?: boolean } = {}): boolean {
+  const result = saveVoiceProfileStore(PROFILES_PATH, store, options)
+  if (!result.written) {
+    console.error(`[speaker] Profile store write refused: ${result.refusedReason}`)
+    return false
+  }
+  if (result.backup) console.log(`[speaker] Profile store backed up to ${result.backup}`)
+  invalidateProfileCache()
+  return true
 }
 
 /** Invalidate the in-memory profile store cache (call after any write to PROFILES_PATH) */
@@ -631,12 +749,9 @@ function persistProfile(name: string, embedding: Float32Array, source: string =
       profile = { name, embeddings: [], sources: [] }
       store.profiles.push(profile)
     }
-    if (!profile.sources) profile.sources = []
-    profile.embeddings.push(Array.from(embedding))
-    profile.sources.push(source)
+    appendEmbedding(profile, Array.from(embedding), source)
 
-    writeFileSync(PROFILES_PATH, JSON.stringify(store, null, 2))
-    invalidateProfileCache()
+    writeProfileStore(store)
   } catch (err: unknown) {
     console.error('[speaker] Profile persist error:', errMsg(err))
   }
@@ -645,17 +760,24 @@ function persistProfile(name: string, embedding: Float32Array, source: string =
 /** Compute centroid (average) of multiple embeddings.
  *  The centroid captures the speaker's average voice across different acoustic
  *  conditions (meetings, mics, energy levels). More robust than any single embedding. */
-function computeCentroid(embeddings: number[][]): Float32Array {
-  const dim = embeddings[0].length
+export function computeCentroid(embeddings: number[][]): Float32Array {
+  // Dimension-safe: one wrong-length row used to read `undefined` past its end
+  // and turn EVERY component of the averaged vector into NaN, which sherpa then
+  // registers as the speaker's only representative vector. Skip mismatches
+  // instead, and take the modal dimension so a corrupt row 0 cannot define it.
+  const dim = modalDimension(embeddings)
   const centroid = new Float32Array(dim)
-  for (const emb of embeddings) {
+  if (dim === 0) return centroid
+  const usable = embeddings.filter(emb => emb.length === dim)
+  if (usable.length === 0) return centroid
+  for (const emb of usable) {
     for (let i = 0; i < dim; i++) {
       centroid[i] += emb[i]
     }
   }
   // Average
   for (let i = 0; i < dim; i++) {
-    centroid[i] /= embeddings.length
+    centroid[i] /= usable.length
   }
   // L2 normalize (important for cosine similarity)
   let norm = 0
@@ -695,8 +817,7 @@ function rebuildSpeakerInManager(name: string, embeddings: number[][]): void {
 
 /** Save full profile store to disk (used by trainer for bulk updates) */
 export function saveProfileStore(store: ProfileStore): void {
-  writeFileSync(PROFILES_PATH, JSON.stringify(store, null, 2))
-  invalidateProfileCache()
+  writeProfileStore(store)
 }
 
 /** Rebuild all profiles in manager from a store (used after bulk training) */
@@ -716,12 +837,17 @@ export function rebuildAllProfiles(store: ProfileStore): void {
   console.log(`[speaker] Rebuilt manager: ${loaded} speakers (centroid mode)`)
 }
 
-/** Load persisted profiles into manager */
+/** Load persisted profiles into manager.
+ *
+ *  Goes through loadProfileStore() rather than re-reading the file: a second
+ *  independent `JSON.parse` here meant boot and the enrollment path could
+ *  disagree about the store's contents, and it bypassed both the corrupt-file
+ *  recovery and the integrity repairs. */
 function loadProfiles(): void {
-  if (!manager || !existsSync(PROFILES_PATH)) return
+  if (!manager) return
 
   try {
-    const store: ProfileStore = JSON.parse(readFileSync(PROFILES_PATH, 'utf-8'))
+    const store = loadProfileStore()
     let loaded = 0
 
     for (const profile of store.profiles) {