@gotcos/glasses-server 6.21.9 → 6.21.10

package/CHANGELOG.md

@@ -1,3 +1,28 @@
+## 6.21.10
+
+- Make the voice profile store durable. `voice-profiles.json` is written
+  atomically with rotating hourly backups, a corrupt file is quarantined and
+  recovered from the newest usable backup, and a save can no longer replace a
+  populated store with an empty one.
+- Keep embedding provenance aligned. `sources[]` is now added, evicted, and
+  repaired in lockstep with `embeddings[]`, and centroids use the modal
+  dimension so a single wrong-length row cannot reduce a speaker's registered
+  vector to NaN.
+- Read saved speaker audio from the runtime data directory, matching where the
+  transcription pipeline writes it. `train-g2`, `saved-audio`, `ext-audio`, and
+  `enroll-ext` previously resolved a path inside the installed package and
+  reported an empty system on every managed install.
+- Require confirmation before an unscoped `train-g2` or `enroll-ext` rewrites
+  profiles and deletes source audio, cap G2 training at ten diverse samples per
+  speaker so a large backlog cannot evict an existing profile, and retain source
+  audio whenever nothing was enrolled.
+- Add `readiness.speakerId` to health. A voiceprint model that is installed but
+  rejected by the runtime now reports degraded instead of passing as working
+  diarization; an install with no model configured is unaffected.
+- Expire saved training audio after 14 days per file, add a confirm-gated
+  `POST /api/voice/delete-person` that reports per-store removal counts, and add
+  `GET /api/voice/profiles` for review surfaces.
+
 ## 6.21.9
 
 - Prevent an unclosed or abandoned recording from monopolizing progressive HQ.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.21.9",
+  "version": "6.21.10",
   "description": "COS Glasses — self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/lib/audio-retention.ts

@@ -0,0 +1,50 @@
+// Age-based retention for saved speaker audio.
+//
+// The count cap on training-audio (30 WAVs per speaker) is a storage bound, not
+// a retention policy: a speaker who is never trained keeps 30 chunks of their
+// recorded voice forever, and the only path that ever deleted them was a manual
+// /voice/train-g2 call. An unenforced retention policy is worse than none —
+// it is a promise the code does not keep.
+//
+// Split out as a pure function so the expiry rule can be tested by execution
+// without a clock, a filesystem, or a running server.
+
+export interface RetentionCandidate {
+  name: string
+  mtimeMs: number
+}
+
+export interface RetentionSplit<T extends RetentionCandidate> {
+  expired: T[]
+  retained: T[]
+}
+
+/**
+ * Partition files by age. Per-file rather than per-directory: chunks for one
+ * speaker accumulate across weeks, so an all-or-nothing directory check either
+ * keeps month-old audio alive because one chunk is fresh, or deletes today's
+ * capture because the directory is old.
+ *
+ * A file with an unreadable/zero mtime is RETAINED. Treating "I could not read
+ * the timestamp" as "this is ancient" would delete data on the strength of a
+ * failed stat.
+ */
+export function partitionExpiredAudio<T extends RetentionCandidate>(
+  files: T[],
+  nowMs: number,
+  ttlMs: number,
+): RetentionSplit<T> {
+  const expired: T[] = []
+  const retained: T[] = []
+  for (const file of files) {
+    const age = nowMs - file.mtimeMs
+    if (file.mtimeMs > 0 && Number.isFinite(file.mtimeMs) && age > ttlMs) expired.push(file)
+    else retained.push(file)
+  }
+  return { expired, retained }
+}
+
+/** Human-readable age, for the log line that reports a purge. */
+export function ageHours(mtimeMs: number, nowMs: number): number {
+  return Math.round(((nowMs - mtimeMs) / (60 * 60 * 1000)) * 10) / 10
+}

package/server/lib/speaker-calibration-log.ts

@@ -0,0 +1,86 @@
+// speaker-calibration.jsonl — threshold-tuning telemetry, one row per
+// identification decision. Every row carries a speaker NAME, so a person's
+// trace survives deleting their voice profile unless this file is swept too.
+//
+// The log is append-only and written from the live identification path with a
+// fire-and-forget `appendFileSync`. A rewrite therefore has a genuine (if
+// millisecond-wide) race with concurrent appends. That is acceptable HERE and
+// nowhere else in this feature: the file is explicitly non-critical tuning data,
+// already best-effort, and losing a row written during the swap costs nothing —
+// whereas leaving a deleted person's name in 21k rows is the privacy gap the
+// delete exists to close. Embedding data is never touched by this module.
+
+import { existsSync, readFileSync } from 'node:fs'
+import { durableAtomicWriteFileSync } from './atomic-fs.js'
+
+export interface CalibrationPurgeResult {
+  /** Rows whose `speaker` matched and were dropped. */
+  removed: number
+  /** Rows retained, including rows that could not be parsed. */
+  retained: number
+  /** Rows that were not valid JSON. Kept — a malformed row is not evidence that
+   *  it belongs to the person being deleted, and discarding it would be a
+   *  silent data loss dressed up as a privacy fix. */
+  unparsable: number
+}
+
+/**
+ * Filter JSONL text, dropping rows whose `speaker` field matches.
+ *
+ * Pure so the matching rule can be tested without touching the filesystem.
+ * Matching is exact on the `speaker` field only: a substring match would delete
+ * every "Miles Mallard" row when removing "Miles", and the name also appears in
+ * no other field.
+ */
+export function filterCalibrationRows(
+  raw: string,
+  speakerName: string,
+): { text: string; result: CalibrationPurgeResult } {
+  const lines = raw.split('\n')
+  const kept: string[] = []
+  const result: CalibrationPurgeResult = { removed: 0, retained: 0, unparsable: 0 }
+
+  for (const line of lines) {
+    if (line.trim() === '') continue
+    let speaker: unknown
+    try {
+      speaker = (JSON.parse(line) as { speaker?: unknown }).speaker
+    } catch {
+      result.unparsable++
+      result.retained++
+      kept.push(line)
+      continue
+    }
+    if (speaker === speakerName) {
+      result.removed++
+      continue
+    }
+    result.retained++
+    kept.push(line)
+  }
+
+  return { text: kept.length > 0 ? kept.join('\n') + '\n' : '', result }
+}
+
+/** Rewrite the log without a given speaker's rows. */
+export function purgeSpeakerCalibrationRows(
+  logPath: string,
+  speakerName: string,
+  options: { dryRun?: boolean } = {},
+): CalibrationPurgeResult {
+  if (!existsSync(logPath)) return { removed: 0, retained: 0, unparsable: 0 }
+  let raw: string
+  try {
+    raw = readFileSync(logPath, 'utf-8')
+  } catch {
+    return { removed: 0, retained: 0, unparsable: 0 }
+  }
+
+  const { text, result } = filterCalibrationRows(raw, speakerName)
+  if (result.removed === 0 || options.dryRun) return result
+
+  // Atomic: a torn rewrite of a 2 MB log would leave a half-row that every
+  // later parse trips over.
+  durableAtomicWriteFileSync(logPath, text, { mode: 0o600 })
+  return result
+}

package/server/lib/speaker-embeddings.ts

@@ -8,7 +8,20 @@
 import { resolve } from 'node:path'
 import { errMsg } from './utils.js'
 import { getOwnerSpeakerLabel } from './profile.js'
-import { readFileSync, writeFileSync, existsSync, appendFileSync, mkdirSync, statSync, openSync, readSync, closeSync } from 'node:fs'
+import { existsSync, appendFileSync, mkdirSync, statSync, openSync, readSync, closeSync } from 'node:fs'
+import {
+  appendEmbedding,
+  deleteProfileFromStore,
+  describeRepairs,
+  dropOldestEmbedding,
+  hasRepairs,
+  loadVoiceProfileStore,
+  modalDimension,
+  removeEmbeddingsBySource,
+  saveVoiceProfileStore,
+  type ProfileStore,
+  type VoiceProfile,
+} from './voice-profile-store.js'
 import { homedir } from 'node:os'
 import { spawnSync } from 'node:child_process'
 import { fileURLToPath } from 'node:url'
@@ -92,15 +105,10 @@ const autoEnrollSessions = new Map<string, Map<string, number>>()
 // Track which speakers already auto-enrolled this session
 const autoEnrolledThisSession = new Map<string, Set<string>>()
 
-interface VoiceProfile {
-  name: string
-  embeddings: number[][]  // multiple enrollments for robustness
-  sources?: string[]      // provenance: 'manual' | 'fireflies' | 'auto:sessionId'
-}
-
-interface ProfileStore {
-  profiles: VoiceProfile[]
-}
+// Shape, durability, and integrity repair all live in voice-profile-store.ts.
+// Re-exported because the review surfaces (/speakers, delete-person, coherence
+// audit) need the types and were previously blocked on them being file-private.
+export type { ProfileStore, VoiceProfile }
 
 /** Cheap structural screen for a downloaded model.
  *
@@ -293,11 +301,13 @@ export function enrollEmbedding(name: string, embedding: Float32Array, source: s
       }
     }
 
-    // FIFO cap: if at max, drop oldest before adding (always enforced)
+    // FIFO cap: if at max, drop oldest before adding (always enforced).
+    // dropOldestEmbedding keeps sources[] in lockstep — the old inline
+    // `sources?.shift()` no-opped whenever sources was undefined or short,
+    // permanently offsetting provenance from the samples it described.
     if (profile.embeddings.length >= MAX_EMBEDDINGS_PER_SPEAKER) {
       console.log(`[speaker] Profile cap reached for "${name}" (${profile.embeddings.length}/${MAX_EMBEDDINGS_PER_SPEAKER}) — dropping oldest`)
-      profile.embeddings.shift()
-      profile.sources?.shift()
+      dropOldestEmbedding(profile)
       rebuildSpeakerInManager(name, profile.embeddings)
     }
   }
@@ -448,10 +458,44 @@ export function clearSpeakerEmbeddings(name: string): boolean {
     try { manager.remove(name) } catch { /* ignore */ }
   }
 
-  // Persist
-  writeFileSync(PROFILES_PATH, JSON.stringify(store, null, 2))
-  invalidateProfileCache()
-  return true
+  // Persist. A "fresh training" clear legitimately empties one profile but must
+  // never be able to empty the whole store, so allowEmpty stays off here.
+  return writeProfileStore(store)
+}
+
+/** Remove a person entirely: profile, embeddings, and manager registration.
+ *  Returns counts so a caller can report what was actually removed. */
+export function removeSpeakerProfile(name: string): { removedProfiles: number; removedEmbeddings: number } {
+  const store = loadProfileStore()
+  const result = deleteProfileFromStore(store, name)
+  if (result.removedProfiles === 0) return result
+
+  if (manager && manager.contains(name)) {
+    try { manager.remove(name) } catch { /* the on-disk removal is the durable half */ }
+  }
+  // allowEmpty: deleting the only enrolled person is a legitimate reset, and the
+  // caller has already confirmed it explicitly.
+  writeProfileStore(store, { allowEmpty: true })
+  return result
+}
+
+/** Retract samples by provenance — e.g. every `auto:<sessionId>` embedding a
+ *  bad session wrote into the wrong profile. `clearSpeakerEmbeddings` is
+ *  all-or-nothing and would discard the legitimate training alongside it. */
+export function retractEmbeddingsBySource(
+  name: string,
+  matches: (source: string) => boolean,
+): { removed: number; remaining: number } {
+  const store = loadProfileStore()
+  const profile = store.profiles.find(p => p.name === name)
+  if (!profile) return { removed: 0, remaining: 0 }
+
+  const removed = removeEmbeddingsBySource(profile, matches)
+  if (removed === 0) return { removed: 0, remaining: profile.embeddings.length }
+
+  rebuildSpeakerInManager(name, profile.embeddings)
+  writeProfileStore(store, { allowEmpty: true })
+  return { removed, remaining: profile.embeddings.length }
 }
 
 /** Get embedding count for a speaker */
@@ -495,6 +539,28 @@ export function speakerModelState(): {
   return { state, path, searched: speakerModelCandidates() }
 }
 
+/** Map the model state onto a readiness verdict for /api/health.
+ *
+ *  The distinction this encodes is the whole point of the field, so it is a
+ *  named pure function rather than an inline ternary inside the health handler:
+ *
+ *   - 'error'       → degraded. A model IS installed and the runtime refused it,
+ *                     so diarization has silently collapsed to the amplitude
+ *                     fallback while every other status surface stays green.
+ *                     That is exactly how 78 trained profiles went unnoticed as
+ *                     missing across a managed cutover.
+ *   - 'unavailable' → NOT degraded. The ~26 MB model ships outside the npm
+ *                     tarball, so most installs have never had one and are
+ *                     working as designed. Degrading them would make the field
+ *                     meaningless on every public box and train the operator to
+ *                     ignore the one channel that matters. */
+export function speakerReadiness(
+  state: 'active' | 'unavailable' | 'error',
+): 'ready' | 'unavailable' | 'degraded' {
+  if (state === 'error') return 'degraded'
+  return state === 'active' ? 'ready' : 'unavailable'
+}
+
 /** Compute actual cosine similarity between two raw embedding vectors */
 export function rawCosineSimilarity(a: Float32Array, b: Float32Array): number {
   if (a.length !== b.length) return 0
@@ -606,14 +672,66 @@ function logCalibration(speaker: string, similarity: number, matched: boolean, e
   } catch { /* non-critical */ }
 }
 
-/** Load profile store from disk (cached in memory, invalidated on write) */
+/** Load profile store from disk (cached in memory, invalidated on write).
+ *
+ *  Previously a bare `JSON.parse(readFileSync(...))`: a truncated file threw out
+ *  of every caller, including the live enrollment path, and there was no backup
+ *  to fall back to. Corruption and integrity repairs are now both reported —
+ *  silently returning `{profiles: []}` is the one outcome that must never pass
+ *  unremarked, because the next save would commit it over the real store. */
 function loadProfileStore(): ProfileStore {
   if (_cachedProfileStore) return _cachedProfileStore
-  if (existsSync(PROFILES_PATH)) {
-    _cachedProfileStore = JSON.parse(readFileSync(PROFILES_PATH, 'utf-8'))
-    return _cachedProfileStore!
+
+  const load = loadVoiceProfileStore(PROFILES_PATH)
+
+  if (load.status === 'corrupt') {
+    if (load.recoveredFromBackup) {
+      console.error(
+        `[speaker] voice-profiles.json was corrupt (quarantined as ${load.quarantinedAs}) —`,
+        `recovered ${load.store.profiles.length} profile(s) from ${load.recoveredFromBackup}.`,
+      )
+      // Republish the recovered content so the next boot reads a clean file
+      // rather than repeating the recovery. The corrupt original is retained at
+      // the quarantine path for inspection.
+      try {
+        saveVoiceProfileStore(PROFILES_PATH, load.store)
+      } catch (err: unknown) {
+        console.error('[speaker] Failed to republish recovered profiles:', errMsg(err))
+      }
+    } else {
+      console.error(
+        `[speaker] voice-profiles.json was corrupt and NO usable backup exists.`,
+        `The unreadable file is retained at ${load.quarantinedAs}.`,
+        'Diarization is starting with zero profiles; writes will not overwrite a populated store.',
+      )
+    }
+  }
+
+  if (hasRepairs(load.repairs)) {
+    console.warn(`[speaker] Repaired voice-profiles.json on load: ${describeRepairs(load.repairs)}`)
   }
-  return { profiles: [] }
+
+  _cachedProfileStore = load.store
+  return _cachedProfileStore
+}
+
+/** Read-only view of the persisted profiles, for review/audit surfaces.
+ *  Returns a structural copy so a caller cannot mutate the shared cache. */
+export function readVoiceProfiles(): ProfileStore {
+  const store = loadProfileStore()
+  return { profiles: store.profiles.map(p => ({ ...p, embeddings: p.embeddings, sources: [...(p.sources ?? [])] })) }
+}
+
+/** Persist the shared store, reporting a refusal rather than swallowing it. */
+function writeProfileStore(store: ProfileStore, options: { allowEmpty?: boolean } = {}): boolean {
+  const result = saveVoiceProfileStore(PROFILES_PATH, store, options)
+  if (!result.written) {
+    console.error(`[speaker] Profile store write refused: ${result.refusedReason}`)
+    return false
+  }
+  if (result.backup) console.log(`[speaker] Profile store backed up to ${result.backup}`)
+  invalidateProfileCache()
+  return true
 }
 
 /** Invalidate the in-memory profile store cache (call after any write to PROFILES_PATH) */
@@ -631,12 +749,9 @@ function persistProfile(name: string, embedding: Float32Array, source: string =
       profile = { name, embeddings: [], sources: [] }
       store.profiles.push(profile)
     }
-    if (!profile.sources) profile.sources = []
-    profile.embeddings.push(Array.from(embedding))
-    profile.sources.push(source)
+    appendEmbedding(profile, Array.from(embedding), source)
 
-    writeFileSync(PROFILES_PATH, JSON.stringify(store, null, 2))
-    invalidateProfileCache()
+    writeProfileStore(store)
   } catch (err: unknown) {
     console.error('[speaker] Profile persist error:', errMsg(err))
   }
@@ -645,17 +760,24 @@ function persistProfile(name: string, embedding: Float32Array, source: string =
 /** Compute centroid (average) of multiple embeddings.
  *  The centroid captures the speaker's average voice across different acoustic
  *  conditions (meetings, mics, energy levels). More robust than any single embedding. */
-function computeCentroid(embeddings: number[][]): Float32Array {
-  const dim = embeddings[0].length
+export function computeCentroid(embeddings: number[][]): Float32Array {
+  // Dimension-safe: one wrong-length row used to read `undefined` past its end
+  // and turn EVERY component of the averaged vector into NaN, which sherpa then
+  // registers as the speaker's only representative vector. Skip mismatches
+  // instead, and take the modal dimension so a corrupt row 0 cannot define it.
+  const dim = modalDimension(embeddings)
   const centroid = new Float32Array(dim)
-  for (const emb of embeddings) {
+  if (dim === 0) return centroid
+  const usable = embeddings.filter(emb => emb.length === dim)
+  if (usable.length === 0) return centroid
+  for (const emb of usable) {
     for (let i = 0; i < dim; i++) {
       centroid[i] += emb[i]
     }
   }
   // Average
   for (let i = 0; i < dim; i++) {
-    centroid[i] /= embeddings.length
+    centroid[i] /= usable.length
   }
   // L2 normalize (important for cosine similarity)
   let norm = 0
@@ -695,8 +817,7 @@ function rebuildSpeakerInManager(name: string, embeddings: number[][]): void {
 
 /** Save full profile store to disk (used by trainer for bulk updates) */
 export function saveProfileStore(store: ProfileStore): void {
-  writeFileSync(PROFILES_PATH, JSON.stringify(store, null, 2))
-  invalidateProfileCache()
+  writeProfileStore(store)
 }
 
 /** Rebuild all profiles in manager from a store (used after bulk training) */
@@ -716,12 +837,17 @@ export function rebuildAllProfiles(store: ProfileStore): void {
   console.log(`[speaker] Rebuilt manager: ${loaded} speakers (centroid mode)`)
 }
 
-/** Load persisted profiles into manager */
+/** Load persisted profiles into manager.
+ *
+ *  Goes through loadProfileStore() rather than re-reading the file: a second
+ *  independent `JSON.parse` here meant boot and the enrollment path could
+ *  disagree about the store's contents, and it bypassed both the corrupt-file
+ *  recovery and the integrity repairs. */
 function loadProfiles(): void {
-  if (!manager || !existsSync(PROFILES_PATH)) return
+  if (!manager) return
 
   try {
-    const store: ProfileStore = JSON.parse(readFileSync(PROFILES_PATH, 'utf-8'))
+    const store = loadProfileStore()
     let loaded = 0
 
     for (const profile of store.profiles) {

package/server/lib/voice-profile-store.ts

@@ -0,0 +1,365 @@
+// Durability and integrity for voice-profiles.json.
+//
+// This file is the single most irreplaceable artifact the server owns: on this
+// box it holds 79 profiles / 1,317 embeddings / ~7.8 MB, accumulated over months
+// of training that cannot be re-derived once the source audio has aged out. It
+// was being written with three raw `writeFileSync` calls and read with an
+// unguarded `JSON.parse`, so one crash, disk-full, or iCloud-sync mid-write
+// would take all of it and every subsequent read would throw.
+//
+// Everything here is a pure function over an explicit path so it can be tested
+// by execution rather than by asserting on source text. speaker-embeddings.ts
+// delegates to it and keeps the sherpa-onnx manager in sync.
+
+import { existsSync, mkdirSync, readdirSync, statSync, unlinkSync } from 'node:fs'
+import { basename, dirname, join, resolve } from 'node:path'
+import { durableAtomicWriteFileSync, loadJsonOrQuarantine } from './atomic-fs.js'
+
+export interface VoiceProfile {
+  name: string
+  /** One row per enrolled sample. Parallel to `sources`, index for index. */
+  embeddings: number[][]
+  /** Provenance: 'manual' | 'fireflies' | 'g2-training' | 'auto:<sessionId>' | … */
+  sources?: string[]
+}
+
+export interface ProfileStore {
+  profiles: VoiceProfile[]
+}
+
+/** What normalization had to fix. All non-zero counts are worth logging: they
+ *  mean the file on disk had drifted from its own invariants. */
+export interface StoreRepairs {
+  /** `sources` was missing, short, or long relative to `embeddings`. */
+  sourcesRealigned: number
+  /** A null/non-string slot inside `sources` (observed in the live store). */
+  sourcesCoerced: number
+  /** Embedding rows that were not arrays of finite numbers — unusable. */
+  embeddingsDropped: number
+  /** Rows whose length differs from the profile's modal dimension. Kept on
+   *  disk, but excluded from centroids: sherpa compares by cosine, and a
+   *  short row silently produces NaN across the whole averaged vector. */
+  dimensionMismatch: number
+  /** Entries with no usable name, or duplicate names collapsed. */
+  profilesDropped: number
+}
+
+export function emptyRepairs(): StoreRepairs {
+  return {
+    sourcesRealigned: 0,
+    sourcesCoerced: 0,
+    embeddingsDropped: 0,
+    dimensionMismatch: 0,
+    profilesDropped: 0,
+  }
+}
+
+export function hasRepairs(r: StoreRepairs): boolean {
+  return r.sourcesRealigned > 0 || r.sourcesCoerced > 0 || r.embeddingsDropped > 0
+    || r.dimensionMismatch > 0 || r.profilesDropped > 0
+}
+
+export function describeRepairs(r: StoreRepairs): string {
+  const parts: string[] = []
+  if (r.profilesDropped) parts.push(`${r.profilesDropped} unusable profile(s)`)
+  if (r.embeddingsDropped) parts.push(`${r.embeddingsDropped} unusable embedding row(s)`)
+  if (r.sourcesRealigned) parts.push(`${r.sourcesRealigned} profile(s) with misaligned sources[]`)
+  if (r.sourcesCoerced) parts.push(`${r.sourcesCoerced} null/non-string source slot(s)`)
+  if (r.dimensionMismatch) parts.push(`${r.dimensionMismatch} wrong-dimension embedding(s) excluded from centroids`)
+  return parts.join(', ')
+}
+
+const UNKNOWN_SOURCE = 'unknown'
+
+function isUsableEmbedding(row: unknown): row is number[] {
+  return Array.isArray(row) && row.length > 0 && row.every(v => typeof v === 'number' && Number.isFinite(v))
+}
+
+/** The dimension the majority of a profile's rows agree on.
+ *
+ *  Not `embeddings[0].length`: if row 0 happens to be the corrupt one, every
+ *  other row becomes the "mismatch" and the profile is emptied. */
+export function modalDimension(embeddings: number[][]): number {
+  const counts = new Map<number, number>()
+  for (const row of embeddings) counts.set(row.length, (counts.get(row.length) ?? 0) + 1)
+  let best = 0, bestCount = -1
+  for (const [dim, count] of counts) {
+    // Tie-break toward the larger dimension: a truncated row is the likelier
+    // corruption than a systematically longer one.
+    if (count > bestCount || (count === bestCount && dim > best)) { best = dim; bestCount = count }
+  }
+  return best
+}
+
+/** Bring a parsed store back to its invariants, reporting every change.
+ *
+ *  Deliberately conservative: rows that are merely the wrong DIMENSION are kept
+ *  on disk and only excluded from centroid math, because they may be a
+ *  recoverable model change rather than corruption. Only rows that cannot be
+ *  numbers at all are dropped. */
+export function normalizeProfileStore(raw: unknown): { store: ProfileStore; repairs: StoreRepairs } {
+  const repairs = emptyRepairs()
+  const rawProfiles = (raw as ProfileStore | null)?.profiles
+  if (!Array.isArray(rawProfiles)) return { store: { profiles: [] }, repairs }
+
+  const byName = new Map<string, VoiceProfile>()
+  for (const candidate of rawProfiles) {
+    const name = typeof (candidate as VoiceProfile)?.name === 'string'
+      ? (candidate as VoiceProfile).name.trim()
+      : ''
+    if (!name) { repairs.profilesDropped++; continue }
+
+    const rawEmbeddings = Array.isArray((candidate as VoiceProfile).embeddings)
+      ? (candidate as VoiceProfile).embeddings as unknown[]
+      : []
+    const rawSources = Array.isArray((candidate as VoiceProfile).sources)
+      ? (candidate as VoiceProfile).sources as unknown[]
+      : null
+
+    // Walk both arrays together so dropping row i also drops source i — the
+    // exact coupling `embeddings.shift()` + `sources?.shift()` used to break.
+    const embeddings: number[][] = []
+    const sources: string[] = []
+    for (let i = 0; i < rawEmbeddings.length; i++) {
+      const row = rawEmbeddings[i]
+      if (!isUsableEmbedding(row)) { repairs.embeddingsDropped++; continue }
+      embeddings.push(row)
+      const source = rawSources?.[i]
+      if (typeof source === 'string' && source.length > 0) {
+        sources.push(source)
+      } else {
+        // Missing (sources shorter than embeddings) or a null/non-string slot.
+        if (rawSources && i < rawSources.length) repairs.sourcesCoerced++
+        sources.push(UNKNOWN_SOURCE)
+      }
+    }
+
+    const wasMisaligned = rawSources === null
+      ? embeddings.length > 0
+      : rawSources.length !== rawEmbeddings.length
+    if (wasMisaligned) repairs.sourcesRealigned++
+
+    const dim = modalDimension(embeddings)
+    for (const row of embeddings) if (row.length !== dim) repairs.dimensionMismatch++
+
+    const existing = byName.get(name)
+    if (existing) {
+      // Duplicate profile names cannot both be registered in the manager (one
+      // vector per name), so the later rows would be invisible. Merge instead.
+      repairs.profilesDropped++
+      existing.embeddings.push(...embeddings)
+      existing.sources!.push(...sources)
+      continue
+    }
+    byName.set(name, { name, embeddings, sources })
+  }
+
+  return { store: { profiles: [...byName.values()] }, repairs }
+}
+
+export type StoreLoad = {
+  store: ProfileStore
+  repairs: StoreRepairs
+  /** 'missing' is normal on a fresh install. 'corrupt' means the previous file
+   *  was quarantined and the training in it is GONE unless a backup is used. */
+  status: 'ok' | 'missing' | 'corrupt'
+  quarantinedAs?: string
+  /** Set when `status: 'corrupt'` and a backup was successfully substituted. */
+  recoveredFromBackup?: string
+}
+
+export function backupDirFor(storePath: string): string {
+  return join(dirname(storePath), `${basename(storePath, '.json')}.backups`)
+}
+
+/** Newest first. */
+export function listProfileStoreBackups(storePath: string): string[] {
+  const dir = backupDirFor(storePath)
+  if (!existsSync(dir)) return []
+  try {
+    return readdirSync(dir)
+      .filter(f => f.endsWith('.json'))
+      .map(f => resolve(dir, f))
+      .map(p => ({ p, mtime: safeMtime(p) }))
+      .sort((a, b) => b.mtime - a.mtime)
+      .map(entry => entry.p)
+  } catch { return [] }
+}
+
+function safeMtime(path: string): number {
+  try { return statSync(path).mtimeMs } catch { return 0 }
+}
+
+function safeSize(path: string): number {
+  try { return statSync(path).size } catch { return 0 }
+}
+
+export const PROFILE_STORE_BACKUP_KEEP = 5
+/** Don't copy 7.8 MB on every enroll; one snapshot per hour bounds the churn
+ *  while still guaranteeing a recent restore point. */
+export const PROFILE_STORE_BACKUP_MIN_INTERVAL_MS = 60 * 60 * 1000
+
+/**
+ * Load the store, quarantining a corrupt file and falling back to the newest
+ * usable backup rather than silently starting from zero profiles.
+ *
+ * Starting empty is the dangerous default here: the very next `saveProfileStore`
+ * would durably persist that empty store over the only remaining copy.
+ */
+export function loadVoiceProfileStore(storePath: string): StoreLoad {
+  const result = loadJsonOrQuarantine<unknown>(storePath)
+  if (result.status === 'missing') {
+    return { store: { profiles: [] }, repairs: emptyRepairs(), status: 'missing' }
+  }
+  if (result.status === 'ok') {
+    const { store, repairs } = normalizeProfileStore(result.data)
+    return { store, repairs, status: 'ok' }
+  }
+
+  for (const backup of listProfileStoreBackups(storePath)) {
+    const restored = loadJsonOrQuarantine<unknown>(backup)
+    if (restored.status !== 'ok') continue
+    const { store, repairs } = normalizeProfileStore(restored.data)
+    if (store.profiles.length === 0) continue
+    return {
+      store,
+      repairs,
+      status: 'corrupt',
+      quarantinedAs: result.quarantinedAs,
+      recoveredFromBackup: backup,
+    }
+  }
+  return {
+    store: { profiles: [] },
+    repairs: emptyRepairs(),
+    status: 'corrupt',
+    quarantinedAs: result.quarantinedAs,
+  }
+}
+
+/** Snapshot the current file before it is overwritten, then prune old copies. */
+export function backupProfileStore(
+  storePath: string,
+  options: { nowMs?: number; force?: boolean; keep?: number; minIntervalMs?: number } = {},
+): string | null {
+  if (!existsSync(storePath)) return null
+  if (safeSize(storePath) === 0) return null
+
+  const now = options.nowMs ?? Date.now()
+  const keep = options.keep ?? PROFILE_STORE_BACKUP_KEEP
+  const minInterval = options.minIntervalMs ?? PROFILE_STORE_BACKUP_MIN_INTERVAL_MS
+  const existing = listProfileStoreBackups(storePath)
+  if (!options.force && existing.length > 0 && now - safeMtime(existing[0]) < minInterval) return null
+
+  const dir = backupDirFor(storePath)
+  try {
+    mkdirSync(dir, { recursive: true, mode: 0o700 })
+    const stamp = new Date(now).toISOString().replace(/[:.]/g, '-')
+    const target = join(dir, `${basename(storePath, '.json')}.${stamp}.json`)
+    // Copy through the durable writer so a backup can never itself be torn.
+    const raw = loadJsonOrQuarantine<unknown>(storePath)
+    if (raw.status !== 'ok') return null
+    durableAtomicWriteFileSync(target, JSON.stringify(raw.data), { mode: 0o600 })
+    for (const stale of listProfileStoreBackups(storePath).slice(keep)) {
+      try { unlinkSync(stale) } catch { /* pruning is best effort */ }
+    }
+    return target
+  } catch {
+    // A failed backup must never block the write it precedes.
+    return null
+  }
+}
+
+/**
+ * Persist the store atomically, after taking a rotating backup.
+ *
+ * Refuses to write an empty store over a populated file. That is the shape of
+ * every catastrophic loss here — a failed load returning `{profiles: []}`, then
+ * a routine save committing it — and no legitimate caller needs it. Callers
+ * that really mean it (a full reset) pass `allowEmpty`.
+ */
+export function saveVoiceProfileStore(
+  storePath: string,
+  store: ProfileStore,
+  options: { allowEmpty?: boolean; nowMs?: number } = {},
+): { written: boolean; backup: string | null; refusedReason?: string } {
+  if (store.profiles.length === 0 && !options.allowEmpty) {
+    const current = loadJsonOrQuarantine<ProfileStore>(storePath)
+    if (current.status === 'ok' && (current.data?.profiles?.length ?? 0) > 0) {
+      return {
+        written: false,
+        backup: null,
+        refusedReason: `refusing to overwrite ${current.data.profiles.length} stored profile(s) with an empty store`,
+      }
+    }
+  }
+
+  const backup = backupProfileStore(storePath, { nowMs: options.nowMs })
+  mkdirSync(dirname(storePath), { recursive: true, mode: 0o700 })
+  durableAtomicWriteFileSync(storePath, JSON.stringify(store, null, 2), { mode: 0o600 })
+  return { written: true, backup }
+}
+
+/** Drop the oldest sample, keeping `embeddings` and `sources` in lockstep.
+ *
+ *  The old inline form was `embeddings.shift()` followed by `sources?.shift()`,
+ *  which silently skipped the second half whenever `sources` was undefined and
+ *  desynchronised provenance from that point on — permanently, since every
+ *  later push appended to both. */
+export function dropOldestEmbedding(profile: VoiceProfile): { droppedSource: string | null } {
+  if (profile.embeddings.length === 0) return { droppedSource: null }
+  profile.embeddings.shift()
+  if (!Array.isArray(profile.sources)) profile.sources = []
+  // Re-align first so a short sources[] cannot shift the wrong provenance off.
+  while (profile.sources.length < profile.embeddings.length + 1) profile.sources.push(UNKNOWN_SOURCE)
+  const droppedSource = profile.sources.shift() ?? null
+  profile.sources.length = profile.embeddings.length
+  return { droppedSource }
+}
+
+/** Append a sample to both arrays together. */
+export function appendEmbedding(profile: VoiceProfile, embedding: number[], source: string): void {
+  if (!Array.isArray(profile.sources)) profile.sources = []
+  while (profile.sources.length < profile.embeddings.length) profile.sources.push(UNKNOWN_SOURCE)
+  profile.embeddings.push(embedding)
+  profile.sources.push(source)
+}
+
+/** Remove every sample whose provenance matches, e.g. one poisoned session.
+ *  Returns the number removed so a retraction can be reported rather than
+ *  assumed. */
+export function removeEmbeddingsBySource(
+  profile: VoiceProfile,
+  predicate: (source: string) => boolean,
+): number {
+  if (!Array.isArray(profile.sources)) profile.sources = []
+  while (profile.sources.length < profile.embeddings.length) profile.sources.push(UNKNOWN_SOURCE)
+  const keptEmbeddings: number[][] = []
+  const keptSources: string[] = []
+  let removed = 0
+  for (let i = 0; i < profile.embeddings.length; i++) {
+    if (predicate(profile.sources[i] ?? UNKNOWN_SOURCE)) { removed++; continue }
+    keptEmbeddings.push(profile.embeddings[i])
+    keptSources.push(profile.sources[i] ?? UNKNOWN_SOURCE)
+  }
+  profile.embeddings = keptEmbeddings
+  profile.sources = keptSources
+  return removed
+}
+
+/** Delete a person's profile outright. Returns what was removed so the caller
+ *  can report a per-store count instead of a bare success. */
+export function deleteProfileFromStore(
+  store: ProfileStore,
+  name: string,
+): { removedProfiles: number; removedEmbeddings: number } {
+  let removedProfiles = 0
+  let removedEmbeddings = 0
+  store.profiles = store.profiles.filter(profile => {
+    if (profile.name !== name) return true
+    removedProfiles++
+    removedEmbeddings += profile.embeddings.length
+    return false
+  })
+  return { removedProfiles, removedEmbeddings }
+}

package/server/routes/health.ts

@@ -6,7 +6,7 @@ import { serverMetrics } from '../lib/server-metrics.js'
 import { getServerInstanceId } from '../lib/server-instance-id.js'
 import { localFirstMeetingsCapability } from '../lib/local-first-meetings-contract.js'
 import { isSileroAvailable } from '../lib/vad-silero.js'
-import { speakerModelState } from '../lib/speaker-embeddings.js'
+import { speakerModelState, speakerReadiness } from '../lib/speaker-embeddings.js'
 import { getAvailableCliSessionId } from '../lib/claude-bridge.js'
 import {
   isWhisperLocalAvailable,
@@ -113,7 +113,8 @@ healthRouter.get('/health', async (_req, res) => {
   // npm tarball), so publish its state rather than letting the amplitude
   // fallback masquerade as working diarization. Availability only — the resolved
   // path is a local filesystem detail and health is unauthenticated.
-  checks.speaker_id = speakerModelState().state
+  const speakerId = speakerModelState()
+  checks.speaker_id = speakerId.state
 
   // Health is unauthenticated. Publish only availability; the actual CLI
   // session id is a resumable runtime handle and belongs on authenticated
@@ -176,15 +177,22 @@ healthRouter.get('/health', async (_req, res) => {
       : whisper_health.startupState === 'preflight' || whisper_health.startupState === 'loading'
         ? 'starting'
         : 'degraded'
+  // A configured-but-broken voiceprint model is a fault, not a preference. The
+  // full reasoning, including why 'unavailable' must NOT degrade, lives with
+  // speakerReadiness() so it is testable rather than an inline ternary here.
+  const speakerReadinessState = speakerReadiness(speakerId.state)
   const readiness = {
     // /api/health remains a liveness endpoint and intentionally returns HTTP
     // 200 while the server can answer. This separate field prevents an HTTP-
     // green response from hiding a configured local subsystem failure.
-    status: whisperReadiness === 'degraded' ? 'degraded' : 'ready',
+    status: whisperReadiness === 'degraded' || speakerReadinessState === 'degraded' ? 'degraded' : 'ready',
     admissions: maintenance.admissionsOpen ? 'open' : 'maintenance',
     whisper: whisperReadiness,
     whisperError: whisper_health.lastError,
     localTts: tts_local.ready ? 'ready' : 'unavailable',
+    // Asserted, not merely reported: `speaker_id` above says what the state IS,
+    // this says whether that state is acceptable.
+    speakerId: speakerReadinessState,
   }
   const openai_whisper_budget = getOpenAIWhisperBudgetState()
   const codex_models = getCodexModelCatalogSnapshot()

package/server/routes/transcribe-stream.ts

@@ -37,6 +37,7 @@ import {
 } from '../lib/hallucination-filter.js'
 import { transcribeWhisperMeetingPreview } from '../lib/whisper-preview.js'
 import { dataPath } from '../lib/data-dir.js'
+import { ageHours, partitionExpiredAudio } from '../lib/audio-retention.js'
 import {
   countChunkWavs,
   purgeExpiredQuarantine,
@@ -118,6 +119,13 @@ function meetingTurboPreviewEnabled(): boolean {
 const AUDIO_SAVE_DIR = dataPath('training-audio')
 ensurePrivateDirectory(AUDIO_SAVE_DIR)
 const MAX_SAVED_CHUNKS_PER_SPEAKER = 30  // ~5 min of audio per speaker, cleaned after training
+// Age bound. The count cap above is NOT a retention policy: a speaker who never
+// gets trained keeps 30 WAVs of their voice indefinitely, and the only cleanup
+// path was a manual /voice/train-g2 call. ext-audio has had a 72h sweep since it
+// was introduced; this closes the same gap for training audio. Deliberately
+// longer than ext-audio's window because these chunks are the raw material for
+// deliberate enrollment, not opportunistic retroactive matching.
+const TRAINING_AUDIO_TTL_MS = 14 * 24 * 60 * 60 * 1000  // 14 days
 
 // Unrecognized speaker audio: save Ext chunks for retroactive enrollment
 const EXT_AUDIO_DIR = dataPath('ext-audio')
@@ -742,6 +750,44 @@ setInterval(() => {
     }
   } catch {}
 
+  // Purge training-audio WAVs past the retention window. Per file, not per
+  // directory: chunks for one speaker accumulate over weeks, so an
+  // all-or-nothing directory check would either keep month-old audio alive
+  // because one chunk is fresh, or delete today's capture because the directory
+  // is old.
+  try {
+    if (existsSync(AUDIO_SAVE_DIR)) {
+      const now = Date.now()
+      for (const dir of readdirSync(AUDIO_SAVE_DIR)) {
+        const dirPath = resolve(AUDIO_SAVE_DIR, dir)
+        try {
+          if (!statSync(dirPath).isDirectory()) continue
+          const candidates = readdirSync(dirPath)
+            .filter(f => f.endsWith('.wav'))
+            .map(name => {
+              let mtimeMs = 0
+              try { mtimeMs = statSync(resolve(dirPath, name)).mtimeMs } catch {}
+              return { name, mtimeMs }
+            })
+          const { expired, retained } = partitionExpiredAudio(candidates, now, TRAINING_AUDIO_TTL_MS)
+          for (const file of expired) {
+            try { unlinkSync(resolve(dirPath, file.name)) } catch {}
+          }
+          if (expired.length > 0) {
+            const oldest = Math.min(...expired.map(f => f.mtimeMs))
+            console.log(
+              `[training-audio] Purged ${expired.length} expired chunk(s) for ${dir}`,
+              `(oldest ${ageHours(oldest, now)}h, ${retained.length} retained)`,
+            )
+          }
+          if (retained.length === 0 && readdirSync(dirPath).length === 0) {
+            try { rmSync(dirPath, { recursive: true, force: true }) } catch {}
+          }
+        } catch {}
+      }
+    }
+  } catch {}
+
   // Purge ext-audio dirs older than 72 hours
   try {
     if (existsSync(EXT_AUDIO_DIR)) {

package/server/routes/voice.ts

@@ -4,15 +4,33 @@ import { Router } from 'express'
 import { errMsg } from '../lib/utils.js'
 import { readdirSync, readFileSync, unlinkSync, existsSync, rmdirSync, rmSync } from 'node:fs'
 import { resolve } from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { enrollSpeaker, isEnrolled, getAllSpeakerNames, identifySpeaker, extractEmbedding, enrollEmbedding, rawCosineSimilarity, getEmbeddingCount } from '../lib/speaker-embeddings.js'
+import { enrollSpeaker, isEnrolled, getAllSpeakerNames, identifySpeaker, extractEmbedding, enrollEmbedding, rawCosineSimilarity, getEmbeddingCount, removeSpeakerProfile, readVoiceProfiles } from '../lib/speaker-embeddings.js'
 import { statSync } from 'node:fs'
 import { trainFromFireflies, getTrainingStatus } from '../lib/speaker-trainer.js'
 import { getOwnerSpeakerLabel } from '../lib/profile.js'
-
-const __dirname = fileURLToPath(new URL('.', import.meta.url))
-const AUDIO_SAVE_DIR = resolve(__dirname, '..', 'data', 'training-audio')
-const EXT_AUDIO_DIR = resolve(__dirname, '..', 'data', 'ext-audio')
+import { dataPath } from '../lib/data-dir.js'
+import { purgeSpeakerCalibrationRows } from '../lib/speaker-calibration-log.js'
+
+// These MUST match the writer in transcribe-stream.ts, which saves under
+// dataPath(). They previously resolved relative to __dirname — i.e. inside the
+// installed package generation, a directory the writer never touches and that
+// every managed update replaces. Every reader below therefore reported zero
+// speakers and zero sessions while real audio accumulated in the data home.
+const AUDIO_SAVE_DIR = dataPath('training-audio')
+const EXT_AUDIO_DIR = dataPath('ext-audio')
+// Must match speaker-embeddings.ts, which appends every identification decision.
+const CALIBRATION_LOG = dataPath('speaker-calibration.jsonl')
+
+/** A speaker directory name is derived from a label by replacing spaces with
+ *  underscores. Resolve back through basename so a crafted `speaker` value
+ *  cannot escape the audio root. */
+function speakerDirPath(root: string, speakerName: string): string | null {
+  const dirName = speakerName.trim().replace(/\s+/g, '_')
+  if (!dirName || dirName.includes('/') || dirName.includes('\\') || dirName.includes('..')) return null
+  const path = resolve(root, dirName)
+  if (!path.startsWith(resolve(root) + '/')) return null
+  return path
+}
 
 export const voiceRouter = Router()
 
@@ -97,19 +115,73 @@ voiceRouter.get('/voice/training-status', async (_req, res) => {
 })
 
 // POST /api/voice/train-g2 — train from saved G2-mic audio chunks
-// These accumulate during meetings for speakers who need more embeddings
+// These accumulate during meetings for speakers who need more embeddings.
+//
+// Body: { speaker?, confirmAllSpeakers?, dryRun?, maxPerSpeaker? }
+//
+// This endpoint permanently rewrites voice profiles AND deletes the source WAVs,
+// so the unscoped form now requires an explicit confirmation. Two reasons, both
+// load-bearing:
+//
+//  1. Until the reader path above was fixed it saw an empty directory, so a
+//     no-argument call was harmless. It is not harmless any more — it now reaches
+//     every accumulated speaker directory at once.
+//  2. Enrolling N samples into a profile capped at 20 evicts the oldest sample N
+//     times. A 30-WAV directory would therefore discard EVERY pre-existing
+//     embedding for that speaker, replacing months of curated training with one
+//     meeting's audio. Diversity selection bounds the enrollment instead.
+const DEFAULT_MAX_TRAIN_PER_SPEAKER = 10
+
 voiceRouter.post('/voice/train-g2', async (req, res) => {
   try {
     const targetSpeaker = req.body?.speaker as string | undefined
+    const confirmAll = req.body?.confirmAllSpeakers === true
+    const dryRun = req.body?.dryRun === true
+    const maxPerSpeaker = Number.isFinite(req.body?.maxPerSpeaker)
+      ? Math.max(1, Math.min(20, Number(req.body.maxPerSpeaker)))
+      : DEFAULT_MAX_TRAIN_PER_SPEAKER
+
     if (!existsSync(AUDIO_SAVE_DIR)) {
       return res.json({ trained: 0, speakers: [], message: 'No saved G2 audio yet' })
     }
 
-    const speakerDirs = readdirSync(AUDIO_SAVE_DIR, { withFileTypes: true })
+    let speakerDirs = readdirSync(AUDIO_SAVE_DIR, { withFileTypes: true })
       .filter(d => d.isDirectory())
-      .filter(d => !targetSpeaker || d.name === targetSpeaker.replace(/\s+/g, '_'))
 
-    const results: Array<{ speaker: string; chunks: number; enrolled: number }> = []
+    if (targetSpeaker) {
+      const wanted = speakerDirPath(AUDIO_SAVE_DIR, targetSpeaker)
+      if (!wanted) return res.status(400).json({ error: 'invalid speaker name' })
+      speakerDirs = speakerDirs.filter(d => resolve(AUDIO_SAVE_DIR, d.name) === wanted)
+      if (speakerDirs.length === 0) {
+        return res.status(404).json({ error: `No saved G2 audio for "${targetSpeaker}"` })
+      }
+    } else if (!confirmAll && !dryRun) {
+      // Fail closed with the inventory, so the caller can see exactly what a
+      // confirmation would rewrite before granting it.
+      const pending = speakerDirs.map(d => {
+        const name = d.name.replace(/_/g, ' ')
+        let chunks = 0
+        try { chunks = readdirSync(resolve(AUDIO_SAVE_DIR, d.name)).filter(f => f.endsWith('.wav')).length } catch {}
+        return { speaker: name, chunks, currentEmbeddings: getEmbeddingCount(name) }
+      }).filter(s => s.chunks > 0)
+      return res.status(400).json({
+        error: 'confirmation required',
+        message: 'Training every speaker at once rewrites their profiles and deletes the source audio. '
+          + 'Pass { speaker } to scope it, { dryRun: true } to preview, or { confirmAllSpeakers: true } to proceed.',
+        wouldTrain: pending,
+        totalSpeakers: pending.length,
+        totalChunks: pending.reduce((sum, s) => sum + s.chunks, 0),
+      })
+    }
+
+    const results: Array<{
+      speaker: string
+      chunks: number
+      embeddingsExtracted: number
+      selected: number
+      enrolled: number
+      audioRetained?: boolean
+    }> = []
 
     for (const dir of speakerDirs) {
       const speakerName = dir.name.replace(/_/g, ' ')
@@ -127,28 +199,53 @@ voiceRouter.post('/voice/train-g2', async (req, res) => {
       }
 
       if (embeddings.length === 0) {
-        results.push({ speaker: speakerName, chunks: wavFiles.length, enrolled: 0 })
+        results.push({ speaker: speakerName, chunks: wavFiles.length, embeddingsExtracted: 0, selected: 0, enrolled: 0, audioRetained: true })
+        continue
+      }
+
+      const selected = greedyDiversitySelect(embeddings, maxPerSpeaker)
+
+      if (dryRun) {
+        results.push({
+          speaker: speakerName,
+          chunks: wavFiles.length,
+          embeddingsExtracted: embeddings.length,
+          selected: selected.length,
+          enrolled: 0,
+          audioRetained: true,
+        })
         continue
       }
 
-      // Enroll diverse embeddings (enrollEmbedding handles diversity gate + FIFO cap)
+      // Enroll the diverse subset (enrollEmbedding handles dedup gate + FIFO cap)
       let enrolled = 0
-      for (const emb of embeddings) {
+      for (const emb of selected) {
         const result = enrollEmbedding(speakerName, emb, 'g2-training')
         if (result.success) enrolled++
       }
 
-      results.push({ speaker: speakerName, chunks: wavFiles.length, enrolled })
-
-      // Clean up processed audio
-      for (const wav of wavFiles) {
-        try { unlinkSync(resolve(speakerPath, wav)) } catch {}
+      results.push({
+        speaker: speakerName,
+        chunks: wavFiles.length,
+        embeddingsExtracted: embeddings.length,
+        selected: selected.length,
+        enrolled,
+      })
+
+      // Clean up processed audio. Only when something was actually enrolled —
+      // deleting the source after enrolling nothing is pure data loss.
+      if (enrolled > 0) {
+        for (const wav of wavFiles) {
+          try { unlinkSync(resolve(speakerPath, wav)) } catch {}
+        }
+        try { rmdirSync(speakerPath) } catch {}
+      } else {
+        results[results.length - 1].audioRetained = true
       }
-      try { rmdirSync(speakerPath) } catch {}
     }
 
     const totalEnrolled = results.reduce((sum, r) => sum + r.enrolled, 0)
-    res.json({ trained: totalEnrolled, speakers: results })
+    res.json({ trained: totalEnrolled, dryRun, maxPerSpeaker, speakers: results })
   } catch (err: unknown) {
     res.status(500).json({ error: errMsg(err) })
   }
@@ -236,11 +333,31 @@ voiceRouter.post('/voice/enroll-ext', async (req, res) => {
     // Collect target directories
     const targetDirs: string[] = []
     if (sessionId) {
-      const dirPath = resolve(EXT_AUDIO_DIR, sessionId)
-      if (existsSync(dirPath)) targetDirs.push(dirPath)
+      const dirPath = speakerDirPath(EXT_AUDIO_DIR, String(sessionId))
+      if (dirPath && existsSync(dirPath)) targetDirs.push(dirPath)
       else return res.status(404).json({ error: `Session ${sessionId} not found in ext-audio` })
     } else {
       const sessionDirs = readdirSync(EXT_AUDIO_DIR, { withFileTypes: true }).filter(d => d.isDirectory())
+      // Same reasoning as train-g2: with the reader path fixed, the unscoped
+      // form now attributes EVERY unrecognized session in the retention window
+      // to one person and then recursively deletes them all. Different sessions
+      // are usually different people, so that is a profile-poisoning default.
+      if (req.body?.confirmAllSessions !== true) {
+        const inventory = sessionDirs.map(d => {
+          let chunks = 0
+          try { chunks = readdirSync(resolve(EXT_AUDIO_DIR, d.name)).filter(f => f.endsWith('.wav')).length } catch {}
+          return { sessionId: d.name, chunks }
+        }).filter(s => s.chunks > 0)
+        return res.status(400).json({
+          error: 'confirmation required',
+          message: `Enrolling every ext-audio session as "${name}" assumes one speaker across all of them, `
+            + 'and deletes the audio afterwards. Pass { sessionId } to scope it, '
+            + 'or { confirmAllSessions: true } to proceed.',
+          wouldEnrollFrom: inventory,
+          totalSessions: inventory.length,
+          totalChunks: inventory.reduce((sum, s) => sum + s.chunks, 0),
+        })
+      }
       for (const d of sessionDirs) targetDirs.push(resolve(EXT_AUDIO_DIR, d.name))
     }
 
@@ -290,6 +407,135 @@ voiceRouter.post('/voice/enroll-ext', async (req, res) => {
   }
 })
 
+// GET /api/voice/profiles — enrolled people with sample counts and provenance.
+// The review surfaces need to see the store; until now the only window into it
+// was a per-name count, so a misattributed profile was invisible.
+voiceRouter.get('/voice/profiles', (_req, res) => {
+  try {
+    const { profiles } = readVoiceProfiles()
+    const owner = getOwnerSpeakerLabel()
+    res.json({
+      owner,
+      count: profiles.length,
+      totalEmbeddings: profiles.reduce((sum, p) => sum + p.embeddings.length, 0),
+      profiles: profiles
+        .map(p => {
+          const bySource: Record<string, number> = {}
+          for (const source of p.sources ?? []) {
+            // Collapse auto:<sessionId> so one poisoned session is visible
+            // without leaking a session id per row.
+            const key = source.startsWith('auto:') ? 'auto' : source
+            bySource[key] = (bySource[key] ?? 0) + 1
+          }
+          return {
+            name: p.name,
+            embeddings: p.embeddings.length,
+            isOwner: p.name === owner,
+            sources: bySource,
+            // Provenance alignment is now an invariant; surfacing it makes a
+            // future regression visible instead of silent.
+            sourcesAligned: (p.sources?.length ?? 0) === p.embeddings.length,
+          }
+        })
+        .sort((a, b) => b.embeddings - a.embeddings),
+    })
+  } catch (err: unknown) {
+    res.status(500).json({ error: errMsg(err) })
+  }
+})
+
+// POST /api/voice/delete-person — remove one person from every store that
+// carries their name. Body: { name, confirm: true, dryRun? }
+//
+// Built before more data accumulates, and returns a per-store count so the sweep
+// is auditable rather than a bare success. Two stores are deliberately NOT swept:
+// ext-audio and session-audio are keyed by session, not by person, so there is no
+// name to match on — they age out on their own retention instead.
+voiceRouter.post('/voice/delete-person', (req, res) => {
+  try {
+    const name = req.body?.name
+    if (!name || typeof name !== 'string' || name.trim().length < 2) {
+      return res.status(400).json({ error: 'name is required (min 2 chars)' })
+    }
+    const target = name.trim()
+    const dryRun = req.body?.dryRun === true
+
+    if (req.body?.confirm !== true && !dryRun) {
+      const existing = readVoiceProfiles().profiles.find(p => p.name === target)
+      const audioDir = speakerDirPath(AUDIO_SAVE_DIR, target)
+      let wavs = 0
+      if (audioDir && existsSync(audioDir)) {
+        try { wavs = readdirSync(audioDir).filter(f => f.endsWith('.wav')).length } catch {}
+      }
+      const calibration = purgeSpeakerCalibrationRows(CALIBRATION_LOG, target, { dryRun: true })
+      return res.status(400).json({
+        error: 'confirmation required',
+        message: `Deleting "${target}" is not reversible. Pass { confirm: true } to proceed.`,
+        wouldRemove: {
+          profile: existing ? 1 : 0,
+          embeddings: existing?.embeddings.length ?? 0,
+          trainingAudioFiles: wavs,
+          calibrationRows: calibration.removed,
+        },
+      })
+    }
+
+    if (dryRun) {
+      const existing = readVoiceProfiles().profiles.find(p => p.name === target)
+      const audioDir = speakerDirPath(AUDIO_SAVE_DIR, target)
+      let wavs = 0
+      if (audioDir && existsSync(audioDir)) {
+        try { wavs = readdirSync(audioDir).filter(f => f.endsWith('.wav')).length } catch {}
+      }
+      const calibration = purgeSpeakerCalibrationRows(CALIBRATION_LOG, target, { dryRun: true })
+      return res.json({
+        name: target,
+        dryRun: true,
+        removed: {
+          profiles: existing ? 1 : 0,
+          embeddings: existing?.embeddings.length ?? 0,
+          trainingAudioFiles: wavs,
+          calibrationRows: calibration.removed,
+        },
+      })
+    }
+
+    // 1. Voice profile + sherpa manager registration.
+    const profileResult = removeSpeakerProfile(target)
+
+    // 2. Saved G2 training audio for this person.
+    let trainingAudioFiles = 0
+    const audioDir = speakerDirPath(AUDIO_SAVE_DIR, target)
+    if (audioDir && existsSync(audioDir)) {
+      try {
+        const wavs = readdirSync(audioDir).filter(f => f.endsWith('.wav'))
+        trainingAudioFiles = wavs.length
+        rmSync(audioDir, { recursive: true, force: true })
+      } catch { /* reported as 0 rather than claimed */ }
+    }
+
+    // 3. Calibration rows (the name appears in every row).
+    const calibration = purgeSpeakerCalibrationRows(CALIBRATION_LOG, target)
+
+    res.json({
+      name: target,
+      removed: {
+        profiles: profileResult.removedProfiles,
+        embeddings: profileResult.removedEmbeddings,
+        trainingAudioFiles,
+        calibrationRows: calibration.removed,
+      },
+      notAttributable: {
+        extAudio: 'keyed by session, not by person — ages out on its own retention',
+        sessionAudio: 'keyed by session, not by person — ages out on its own retention',
+      },
+      calibrationRetained: calibration.retained,
+    })
+  } catch (err: unknown) {
+    res.status(500).json({ error: errMsg(err) })
+  }
+})
+
 /** Greedy diversity selection — pick N most acoustically diverse embeddings */
 function greedyDiversitySelect(embeddings: Float32Array[], maxN: number): Float32Array[] {
   if (embeddings.length <= maxN) return embeddings