@gotcos/glasses-server 6.27.11 → 6.27.13

package/CHANGELOG.md

@@ -1,5 +1,69 @@
 ## Unreleased
 
+## 6.27.13
+- **`POST /api/meeting/:sessionId/backfill-enrolment`** — train a profile from a voice
+  that was named BEFORE enrolment shipped. Those meetings have a correct transcript and
+  no profile, and re-running the rename cannot help: the voice is already a real name
+  there, so the placeholder guard correctly declines. The live case is Kirstyn Blum —
+  60 and 109 chunks across two meetings, 182 sidecar mentions, absent from a 77-profile
+  store.
+- The correction LEDGER already holds what enrolment needs: the original `from`, the
+  `to`, and the exact chunk indices written at apply time. This replays those rows
+  through the SAME `enrolNamedVoice` — raw-index mapping, refusal when unmappable,
+  coherence, the diversity cap and the `correction:<sessionId>` tag all apply
+  identically. No second implementation to drift.
+- **Named-source corrections are excluded, by the existing rule rather than a new one.**
+  `Ext -> Kirstyn` is training data; `Allison Wheeler -> Kirstyn` is a mis-attribution
+  fix, and training on it would put Allison's voice into Kirstyn's profile. Both rows
+  are reported; only the placeholder one attempts anything. Mutation-verified: dropping
+  the placeholder guard fails that test.
+- **Runs in-process, which is the point.** The voice store is owned by the running
+  server and rewritten wholesale, so an external process that enrols directly has its
+  work silently clobbered. Not hypothetical — an attempt on 2026-08-13 validated
+  cleanly, selected 20 samples, and left the store untouched at its Aug 7 mtime.
+- **Fails closed.** Without `confirm: true` it reports what it would enrol and writes
+  nothing. The preview runs every gate — a preview that skipped them would be a guess
+  about what the real call does — so `enrolNamedVoice` gained a `dryRun` flag. The
+  projection can land HIGHER than reality, because only `enrollEmbedding` can judge
+  near-duplicates against the live profile; that is documented on the flag.
+
+## 6.27.12
+- **Naming an unidentified voice creates a real speaker profile — correctly this time.**
+  Re-enables what 6.27.10 shipped broken and 6.27.11 disabled.
+- **The index join is fixed.** 6.27.10 fed COMPACTED sidecar positions to a store keyed
+  on RAW capture indices; on a live session that enrolled 73 of 103 rows belonging to
+  other people, 22 of them the owner. Enrolment now runs through
+  `attachRawChunkIndices` and **refuses outright** when the mapping is not established —
+  detected by reference identity, which is how that function signals "cannot map" —
+  reporting `skipped: 'no_index_mapping'`. There is no fallback to positions anywhere.
+- **`Ext` is a bucket, not a person, so coherence is checked.** Only the dominant
+  MUTUALLY coherent cluster is enrolled and `clusterSkipped` reports the rest. Mutual
+  rather than medoid-star on purpose: a seed sitting between two voices merges them
+  otherwise. The floor is aliased from the exported `MERGE_SIMILARITY_FLOOR` so it
+  cannot drift from the identifier's own accept threshold.
+- **Samples are stamped `correction:<sessionId>`.** A bare tag matched none of the three
+  prefixes `isSampleFromSession` accepts, so "Not in this meeting" — the app's only undo
+  — would have retracted nothing, the samples would have counted as untraceable, and
+  they would have landed in the weakest eviction tier with no correction quota.
+- **Bounded.** `greedyDiversitySelect` caps at 20 before enrolling. Unbounded, ~41ms per
+  cycle against a 7.9 MB store x 109 chunks blocked the event loop past the helper's 30s
+  timeout, showing "Server stopped" for a correction that applied.
+- **Reports honestly.** `enrolment: { enrolled, attempted, created, clusterSkipped,
+  skipped }`. A zero is now legible instead of indistinguishable from success.
+  `created: false` when appending to an existing profile, so nothing claims a profile
+  was made when samples were added. `enrolledEmbeddings` retained for existing clients.
+- **Tests, 28 -> 42, plus 14 on the selection lib.** The chunk-embedding mock is GONE:
+  fixtures write real JSONL through the real encoder and the route reads it through the
+  real decoder and index filter. That double mock is why 6.27.10 shipped — the join was
+  never exercised, and a gapless 3-chunk fixture pinned the bug as the contract.
+- Nine mutations, all landed in-target and confirmed present before each run. M1
+  (bypass the mapping) fails four tests including "enrols the RAW-index embeddings,
+  never the sidecar positions". M2 initially SURVIVED — the branch was unreached — so
+  the test was fixed rather than the code.
+- Known: `skipDedupCheck` stays at its default `false`, so near-duplicate samples are
+  rejected and `enrolled` can fall below the 20 selected. Conservative and honestly
+  reported; `/api/voice/enroll-ext` passes `true`.
+
 ## 6.27.11
 - **SAFETY REVERT: the 6.27.10 relabel enrolment is disabled.** It joined two
   different index spaces. `plan.value.changed` are positions in the COMPACTED sidecar

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.27.11",
+  "version": "6.27.13",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/lib/meeting-relabel-enrolment.ts

@@ -0,0 +1,263 @@
+// Turning "that unidentified voice was Kirstyn Blum" into a real voice profile.
+//
+// WHY THIS EXISTS. Relabelling was TEXT ONLY: it rewrote `speaker` strings in the
+// meeting sidecar and never touched the voice store. Naming a voice over 109
+// segments labelled that one meeting and taught the system nothing — she never
+// appeared in /api/voice/profiles, the review panel still offered her as `new
+// name` inside the SAME meeting, no later meeting could match her, and there was
+// no profile to accumulate further chunks against. Verified live 2026-08-13:
+// `Kirstyn Blum` appears 70x in one sidecar and 112x in another while
+// voice-profiles.json held 77 profiles and no Kirstyn.
+//
+// ─────────────────────────────────────────────────────────────────────────────
+// WHY THIS IS ITS OWN MODULE AND WHY IT IS THIS PARANOID
+//
+// 6.27.10 shipped this inline in the route and was reverted the same night.
+// It joined TWO DIFFERENT INDEX SPACES:
+//
+//   plan.value.changed      positions in the COMPACTED sidecar array
+//                           (meeting-relabel.ts, iterating rows already filtered
+//                           to those carrying text)
+//   chunk-embedding store   keyed on the RAW CAPTURE INDEX
+//                           (transcribe-stream.ts writes `i: chunkIndex`)
+//
+// `getSessionChunks` is `session.chunks.filter(c => c && c.text)` while an
+// embedding is written for every chunk with 2s+ of audio, BEFORE ASR is known.
+// The two diverge at the first text-less chunk and the gap grows from there.
+// 73 of 74 live sessions with embeddings have gaps, so divergence was the NORMAL
+// case, not an edge case.
+//
+// Consequence, measured on `meeting_1786628481833_eagkaz`: naming one voice
+// enrolled 73 of 103 rows belonging to OTHER PEOPLE — 22 chunks of MU (the device
+// owner), 16 Vikas, 10 Vishnu, 8 Niranjan, 7 Anil, 6 Chris, 3 Manoj, 1 Navaz, and
+// only 30 that were actually the named voice. It reported SUCCESS, because rows do
+// come back from the store; they were simply the wrong rows.
+//
+// This writes to a SHARED, LONG-LIVED store that drives speaker attribution across
+// every future meeting. A wrong write is permanent and silent. So every step below
+// fails CLOSED: no mapping means no enrolment, never a fall back to positions.
+
+import {
+  chunkEmbeddingTtlMs,
+  chunkEmbeddingsEnabled,
+  readChunkEmbeddings,
+} from './chunk-embedding-store.js'
+import {
+  enrollEmbedding,
+  isEmbeddingAvailable,
+  readVoiceProfiles,
+} from './speaker-embeddings.js'
+import { attachRawChunkIndices, type ReviewChunk } from './meeting-speaker-review.js'
+import {
+  MAX_ENROL_PER_CORRECTION,
+  dominantCoherentCluster,
+  greedyDiversitySelect,
+} from './voice-enrolment-selection.js'
+
+/** Labels the diariser invents when it does not know who is speaking. Naming one
+ *  of these is a FIRST TRAINING RUN for a new person, not a correction. */
+const PLACEHOLDER_LABEL = /^(ext|unknown|unidentified(\s+\d+)?|speaker\s*\d+)$/i
+
+export const isPlaceholderLabel = (label: string): boolean => PLACEHOLDER_LABEL.test(label.trim())
+
+/**
+ * Why nothing was enrolled, when the answer is not "it worked".
+ *
+ * Reported rather than inferred, because there are four ways this silently
+ * enrols zero and they are indistinguishable from the outside:
+ *   1. the ~26 MB 3dspeaker model is absent (it is .npmignore'd, and a managed
+ *      cutover has stranded it before)     -> store_unavailable
+ *   2. COS_CHUNK_EMBEDDINGS=0              -> disabled
+ *   3. the 14-day embedding TTL has passed -> expired
+ *   4. the meeting predates the store      -> no_embeddings
+ *
+ * `null` means nothing BLOCKED enrolment. It does not mean samples were written —
+ * read `enrolled` for that, and `clusterSkipped` for the coherence verdict.
+ */
+export type EnrolmentSkipReason =
+  | null
+  | 'no_index_mapping'
+  | 'no_embeddings'
+  | 'disabled'
+  | 'expired'
+  | 'store_unavailable'
+
+export interface EnrolmentReport {
+  /** Samples the voice store actually accepted. */
+  enrolled: number
+  /** Candidate embeddings found for the relabelled chunks, before any gating.
+   *  Zero here means this correction was never an enrolment (a real name being
+   *  corrected to another real name), not that enrolment failed. */
+  attempted: number
+  /** True ONLY when a profile did not exist for this name and now does. An
+   *  existing name is APPENDED to, and must never be reported as created. */
+  created: boolean
+  /** Candidates rejected as a different voice. `clusterSkipped === attempted`
+   *  means the bucket had no dominant voice at all and nothing was written. */
+  clusterSkipped: number
+  skipped: EnrolmentSkipReason
+}
+
+const IDLE: EnrolmentReport = {
+  enrolled: 0, attempted: 0, created: false, clusterSkipped: 0, skipped: null,
+}
+
+/**
+ * Compacted sidecar positions -> RAW capture indices, or null.
+ *
+ * `attachRawChunkIndices` signals "I cannot map this" by returning the SAME ARRAY
+ * it was given — when `chunkEntries` is absent, or when the text-bearing count
+ * disagrees with the compacted count. That unchanged case is exactly the
+ * poisoning case, so it is detected by REFERENCE IDENTITY and refused. There is
+ * deliberately no fall back to positions: a shifted mapping is worse than none,
+ * because it looks like it worked.
+ *
+ * A single unmappable position refuses the WHOLE set, for the same reason a
+ * partial mapping is refused: enrolling the subset that happened to map still
+ * writes whoever the unmapped ones turned out to be, and there is no way to tell
+ * from the result which happened.
+ */
+export function resolveRawChunkIndices(
+  sidecar: Record<string, unknown>,
+  positions: number[],
+): number[] | null {
+  const chunks = sidecar.chunks
+  if (!Array.isArray(chunks)) return null
+  const withRaw = attachRawChunkIndices(chunks as ReviewChunk[], sidecar.chunkEntries)
+  if (withRaw === chunks) return null
+
+  const raw: number[] = []
+  for (const position of positions) {
+    const index = withRaw[position]?.chunkIndex
+    if (typeof index !== 'number' || !Number.isInteger(index) || index < 0) return null
+    raw.push(index)
+  }
+  return raw
+}
+
+/**
+ * A missing embedding file is either aged out or never written, and the two are
+ * worth telling apart: 'expired' means the correction arrived too late and the
+ * loop would have worked, 'no_embeddings' means this meeting could never train
+ * anything. The store cannot distinguish them — the file is simply gone — so the
+ * meeting's own start time against the live TTL is the evidence.
+ */
+function missingReason(sidecar: Record<string, unknown>): EnrolmentSkipReason {
+  const startTime = sidecar.startTime
+  if (typeof startTime !== 'number' || !Number.isFinite(startTime) || startTime <= 0) return 'no_embeddings'
+  return Date.now() - startTime > chunkEmbeddingTtlMs() ? 'expired' : 'no_embeddings'
+}
+
+/** Does a profile already exist under this name? Read from the PERSISTED store
+ *  rather than `isEnrolled`, which asks the sherpa manager and therefore answers
+ *  "no" for every name on an install with no model — which would report every
+ *  append as a creation. */
+function profileExists(name: string): boolean {
+  try {
+    return readVoiceProfiles().profiles.some(p => p.name === name)
+  } catch {
+    // Unknowable is not "new". Claiming creation is the lie that matters here.
+    return true
+  }
+}
+
+export interface EnrolNamedVoiceInput {
+  sessionId: string
+  from: string
+  to: string
+  /** `plan.value.changed` — COMPACTED sidecar positions. Never raw indices. */
+  changed: number[]
+  /** The parsed sidecar, for `chunks` + `chunkEntries` + `startTime`. */
+  sidecar: Record<string, unknown>
+  /** Run every gate but write nothing. `enrolled` then counts what WOULD be enrolled;
+   *  the real call can land LOWER, because `enrollEmbedding`'s dedup gate rejects
+   *  near-duplicates and only it can judge that against the live profile. A preview
+   *  that skipped the gates would be a guess about what the real call does. */
+  dryRun?: boolean
+}
+
+/**
+ * Enrol the voice a human just named.
+ *
+ * SCOPED to placeholder -> real name. Correcting one real name to another is left
+ * alone deliberately: moving a voice between existing people is `merge-profiles`,
+ * which is explicit and confirmation-gated, and a sweep of this store put two
+ * DISTINCT people at 0.85 similarity, so doing it implicitly would poison both.
+ *
+ * An EXISTING name is appended to without a prompt, and reports `created: false`.
+ *
+ * Samples are stamped `correction:<sessionId>`, not a bare source string. The
+ * prefix is load-bearing in four places: `isSampleFromSession` accepts only
+ * `auto:` / `correction:` / `g2-training:`, so a bare tag makes the app's only
+ * undo ("Not in this meeting") retract NOTHING; `untraceableSampleCount` counts
+ * it as untraceable; `provenanceTier` falls to 'unknown', ranking a human-typed
+ * name BELOW Fireflies attendee metadata for eviction; and `isCorrection()` is a
+ * `startsWith('correction')` test, so the correction quota never protects it.
+ *
+ * NEVER THROWS. Enrolment is a bonus on top of a rename that is already durable
+ * on disk; a voice store that refuses must not undo what the user asked for.
+ */
+export function enrolNamedVoice(input: EnrolNamedVoiceInput): EnrolmentReport {
+  const { sessionId, from, to, changed, sidecar } = input
+
+  // Not an enrolment at all. `attempted: 0` with `skipped: null` is how the
+  // caller tells this apart from an enrolment that found no candidates.
+  if (!isPlaceholderLabel(from) || isPlaceholderLabel(to) || changed.length === 0) return IDLE
+
+  if (!chunkEmbeddingsEnabled()) return { ...IDLE, skipped: 'disabled' }
+  // No extractor/manager means every enrollEmbedding would return success:false.
+  // Naming that beats looping twenty times and reporting a bare zero.
+  if (!isEmbeddingAvailable()) return { ...IDLE, skipped: 'store_unavailable' }
+
+  const rawIndices = resolveRawChunkIndices(sidecar, changed)
+  if (!rawIndices) return { ...IDLE, skipped: 'no_index_mapping' }
+
+  let read: ReturnType<typeof readChunkEmbeddings>
+  try {
+    read = readChunkEmbeddings(sessionId)
+  } catch {
+    return { ...IDLE, skipped: 'store_unavailable' }
+  }
+  if (read.missing) return { ...IDLE, skipped: missingReason(sidecar) }
+
+  const wanted = new Set(rawIndices)
+  const candidates = read.rows.filter(r => wanted.has(r.i) && r.embedding && r.embedding.length > 0)
+  if (candidates.length === 0) return { ...IDLE, skipped: 'no_embeddings' }
+
+  const attempted = candidates.length
+  const cluster = dominantCoherentCluster(candidates.map(r => r.embedding))
+  const clusterSkipped = attempted - cluster.members.length
+  // Every candidate disagreed with every other one. There is no voice here to
+  // learn, only a bucket of strangers sharing one placeholder label.
+  if (cluster.members.length === 0) {
+    return { enrolled: 0, attempted, created: false, clusterSkipped, skipped: null }
+  }
+
+  // Diversity trims the coherent group to a bounded, spread-out sample. Those
+  // trimmed are NOT counted in clusterSkipped — they were the right voice, just
+  // redundant, and reporting them as rejected would read as a coherence problem.
+  const coherent = cluster.members.map(m => candidates[m].embedding)
+  const selected = greedyDiversitySelect(coherent, MAX_ENROL_PER_CORRECTION)
+
+  const existedBefore = profileExists(to)
+  const source = `correction:${sessionId}`
+  let enrolled = 0
+  try {
+    if (input.dryRun) {
+      // Projection, not a promise — see the dryRun docblock. Every gate above has
+      // already run, so this is what the real call will attempt.
+      enrolled = selected.length
+    } else for (const embedding of selected) {
+      if (enrollEmbedding(to, embedding, source).success) enrolled += 1
+    }
+  } catch {
+    return {
+      enrolled, attempted, created: !existedBefore && enrolled > 0, clusterSkipped,
+      skipped: 'store_unavailable',
+    }
+  }
+
+  return {
+    enrolled, attempted, created: !existedBefore && enrolled > 0, clusterSkipped, skipped: null,
+  }
+}

package/server/lib/voice-enrolment-selection.ts

@@ -0,0 +1,202 @@
+// WHICH embeddings from a meeting may become training data for one person.
+//
+// Two independent filters, both pure over Float32Array[] so they are testable by
+// execution rather than by reading them:
+//
+//   dominantCoherentCluster  — does this bag of chunks sound like ONE person?
+//   greedyDiversitySelect    — of the ones that do, which 20 span the most range?
+//
+// THE PROBLEM THE FIRST ONE SOLVES. `Ext` is not a person. `identifySpeaker`
+// returns 'Ext' for every voice that falls below its accept threshold, so a
+// meeting with five unrecognised people produces ONE 'Ext' label covering all
+// five. voice-directory.ts says it outright: "Ext/Unidentified clusters are
+// meeting-local, not people."
+//
+// Measured on session `meeting_1786628481833_eagkaz` (2026-08-13): 115 'Ext'
+// embeddings, 1,770 pairwise cosines, MEDIAN 0.170, and 98% of them below 0.55 —
+// the identifier's own accept threshold. Enrolling that bucket wholesale under a
+// name a human typed writes several strangers into one profile, permanently and
+// silently, and the profile then matches all of them forever.
+//
+// So the rule is: enrol the DOMINANT COHERENT GROUP and report what was left
+// behind, rather than enrolling everything and reporting success.
+
+import { MERGE_SIMILARITY_FLOOR, rawCosineSimilarity } from './speaker-embeddings.js'
+
+/**
+ * Two chunks are the same voice only above this cosine.
+ *
+ * Aliased from the already-exported `MERGE_SIMILARITY_FLOOR` rather than written
+ * as a literal, because that constant IS `SEARCH_THRESHOLD` (speaker-embeddings.ts)
+ * — the threshold `identifySpeaker` itself uses to accept a match. Deriving it
+ * means the gate cannot drift away from the identifier it is second-guessing; a
+ * hardcoded 0.55 here would silently disagree the day that value is tuned.
+ */
+export const VOICE_COHERENCE_FLOOR = MERGE_SIMILARITY_FLOOR
+
+/** How many samples one correction may add to a profile. */
+export const MAX_ENROL_PER_CORRECTION = 20
+
+export interface CoherentCluster {
+  /** Indices into the input array, ascending. EMPTY when nothing coheres. */
+  members: number[]
+  /** Index the cluster formed around, or -1 when there is no cluster. */
+  seed: number
+}
+
+/**
+ * The largest group of embeddings that plausibly share one voice.
+ *
+ * MUTUALLY COHERENT, not merely star-shaped, and not connected components.
+ * The distinction is the whole safety property:
+ *
+ *   components  A~B and B~C admits C alongside A even when A and C are nothing
+ *               alike. Two people merge through anyone who sounds like both.
+ *   star        every member within `floor` of one seed. Better, but a seed
+ *               sitting between two voices still admits both — measured: with
+ *               a=[1,0], b=[1,1], c=[0,1], b agrees with a AND c while a and c
+ *               are orthogonal, so the star around b is the whole crowd.
+ *   mutual      every PAIR within `floor`. Cannot admit two voices at once.
+ *
+ * Built as a seed star and then refined: repeatedly drop the member with the
+ * most internal disagreements (ties to the one with the lowest mean similarity,
+ * then the highest index) until every pair clears the floor. Greedy rather than
+ * a true maximum clique, which is NP-hard — greedy errs toward a SMALLER group,
+ * and under-enrolling is the safe direction when the alternative is writing a
+ * stranger into someone's profile permanently.
+ *
+ * A LONE candidate is returned as its own cluster: one chunk cannot contradict
+ * itself, and refusing it would mean a short correction never trains anything.
+ * But a bag of MANY mutually dissimilar embeddings returns EMPTY — the seed with
+ * the most agreement still has none, so picking one of them would be choosing an
+ * arbitrary stranger out of a crowd, which is precisely the failure this exists
+ * to stop. The caller reports that as `clusterSkipped === attempted`.
+ *
+ * Ties on seed choice break by mean similarity to the agreeing set, then by
+ * lowest index, so the result is deterministic for a given input.
+ */
+export function dominantCoherentCluster(
+  embeddings: Float32Array[],
+  floor: number = VOICE_COHERENCE_FLOOR,
+): CoherentCluster {
+  const n = embeddings.length
+  if (n === 0) return { members: [], seed: -1 }
+  if (n === 1) return { members: [0], seed: 0 }
+
+  // Full pairwise matrix once: the refinement below reads it repeatedly, and
+  // recomputing a 192-dim cosine inside that loop is the difference between
+  // microseconds and seconds on a long meeting.
+  const sim: number[][] = Array.from({ length: n }, () => new Array<number>(n).fill(0))
+  for (let i = 0; i < n; i++) {
+    sim[i][i] = 1
+    for (let j = i + 1; j < n; j++) {
+      const s = rawCosineSimilarity(embeddings[i], embeddings[j])
+      sim[i][j] = s
+      sim[j][i] = s
+    }
+  }
+
+  let bestSeed = -1
+  let bestAgree: number[] = []
+  let bestMean = -Infinity
+  for (let i = 0; i < n; i++) {
+    const agree: number[] = []
+    let sum = 0
+    for (let j = 0; j < n; j++) {
+      if (i !== j && sim[i][j] >= floor) { agree.push(j); sum += sim[i][j] }
+    }
+    const meanSim = agree.length > 0 ? sum / agree.length : -Infinity
+    if (agree.length > bestAgree.length || (agree.length === bestAgree.length && meanSim > bestMean)) {
+      bestSeed = i
+      bestAgree = agree
+      bestMean = meanSim
+    }
+  }
+
+  // Nothing agreed with anything. There is no dominant voice here, only a crowd.
+  if (bestSeed === -1 || bestAgree.length === 0) return { members: [], seed: -1 }
+
+  let members = [bestSeed, ...bestAgree].sort((a, b) => a - b)
+  for (;;) {
+    let worst = -1, worstConflicts = 0, worstMean = Infinity
+    for (const m of members) {
+      let conflicts = 0, sum = 0
+      for (const other of members) {
+        if (m === other) continue
+        if (sim[m][other] < floor) conflicts++
+        sum += sim[m][other]
+      }
+      const meanSim = members.length > 1 ? sum / (members.length - 1) : 1
+      if (conflicts > worstConflicts || (conflicts === worstConflicts && conflicts > 0 && meanSim <= worstMean)) {
+        worst = m; worstConflicts = conflicts; worstMean = meanSim
+      }
+    }
+    if (worstConflicts === 0) break
+    members = members.filter(m => m !== worst)
+    // The seed itself can be the outlier — a voice sitting between two others is
+    // exactly the member that has to go for the rest to be mutually coherent.
+    if (members.length <= 1) break
+  }
+
+  // A refinement that ate everything but one member left no evidence of a shared
+  // voice, only the last survivor of a crowd. Same verdict as no cluster at all.
+  if (members.length < 2) return { members: [], seed: -1 }
+
+  // The seed may have been pruned; report the member that best represents what
+  // survived, so `seed` always names a row that is actually in the cluster.
+  let seed = members[0], seedMean = -Infinity
+  for (const m of members) {
+    let sum = 0
+    for (const other of members) if (m !== other) sum += sim[m][other]
+    const meanSim = sum / (members.length - 1)
+    if (meanSim > seedMean) { seed = m; seedMean = meanSim }
+  }
+  return { members, seed }
+}
+
+/**
+ * Pick the N most acoustically diverse embeddings — greedy max-min-distance.
+ *
+ * Moved here VERBATIM from routes/voice.ts, where it was a private function used
+ * by POST /api/voice/enroll-ext. It was copied rather than shared once already
+ * (voice-profile-store.ts `selectDiverseIndices` is the same algorithm over
+ * number[][], with a different return ORDER); this module is now the home for the
+ * Float32Array form so the relabel path and the ext-audio path cannot drift.
+ *
+ * Bounding the count is not cosmetic. Every `enrollEmbedding` does
+ * loadProfileStore -> persistProfile -> invalidateProfileCache, so the next
+ * iteration re-reads and re-parses the whole store — ~41 ms per cycle against a
+ * live 7.9 MB / 77-profile file, before the fsync'd write. At 109 chunks that
+ * blocks the event loop past COS Control's 30 s helper timeout, and the user is
+ * told "Server stopped" for a correction that actually applied.
+ */
+export function greedyDiversitySelect(embeddings: Float32Array[], maxN: number): Float32Array[] {
+  if (embeddings.length <= maxN) return embeddings
+
+  // Find the most dissimilar pair as seeds
+  let maxDist = -1, seedA = 0, seedB = 1
+  for (let i = 0; i < embeddings.length; i++) {
+    for (let j = i + 1; j < embeddings.length; j++) {
+      const dist = 1 - rawCosineSimilarity(embeddings[i], embeddings[j])
+      if (dist > maxDist) { maxDist = dist; seedA = i; seedB = j }
+    }
+  }
+
+  const selected = new Set([seedA, seedB])
+  while (selected.size < maxN) {
+    let bestIdx = -1, bestMinDist = -1
+    for (let i = 0; i < embeddings.length; i++) {
+      if (selected.has(i)) continue
+      let minDist = Infinity
+      for (const s of selected) {
+        const dist = 1 - rawCosineSimilarity(embeddings[i], embeddings[s])
+        if (dist < minDist) minDist = dist
+      }
+      if (minDist > bestMinDist) { bestMinDist = minDist; bestIdx = i }
+    }
+    if (bestIdx === -1) break
+    selected.add(bestIdx)
+  }
+
+  return [...selected].map(i => embeddings[i])
+}

package/server/routes/meeting.ts

@@ -23,8 +23,8 @@ import {
   meetingAudioChunkPath,
   meetingAudioRetentionDays,
 } from '../lib/meeting-audio-archive.js'
-import { enrollEmbedding, readVoiceProfiles, retractEmbeddingsBySource } from '../lib/speaker-embeddings.js'
-import { chunkEmbeddingsForIndices } from '../lib/chunk-embedding-store.js'
+import { readVoiceProfiles, retractEmbeddingsBySource } from '../lib/speaker-embeddings.js'
+import { enrolNamedVoice } from '../lib/meeting-relabel-enrolment.js'
 
 /**
  * The label a de-attributed voice takes, numbered within its meeting.
@@ -975,45 +975,95 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     })
   })
 
-  /** Labels the diariser invents when it does not know who is speaking. Naming one
-   *  of these is a FIRST TRAINING RUN for a new person, not a correction. */
-  const PLACEHOLDER_LABEL = /^(ext|unknown|unidentified(\s+\d+)?|speaker\s*\d+)$/i
-  const isPlaceholderLabel = (label: string): boolean => PLACEHOLDER_LABEL.test(label.trim())
-
   /**
-   * Turn a named placeholder into a real voice profile.
+   * Replay a recorded correction's enrolment — the retroactive path.
+   *
+   * WHY. Enrolment fires inside `POST /relabel`, so a voice named BEFORE that shipped
+   * has a correct transcript and no profile. Kirstyn Blum is the live case: named
+   * across two meetings (60 and 109 chunks), 182 mentions in the sidecars, absent from
+   * a 77-profile store. Re-running the rename cannot help — she is already a real
+   * name there, so the placeholder guard correctly declines.
+   *
+   * The correction LEDGER already holds exactly what enrolment needs: the original
+   * `from`, the `to`, and the precise chunk indices, written at apply time.
    *
-   * WHY THIS EXISTS. Relabelling was TEXT ONLY: it rewrote `speaker` strings in the
-   * meeting sidecar and never touched the voice store. So naming an unidentified
-   * voice "Kirstyn Blum" labelled that one meeting and taught the system nothing —
-   * she never appeared in `/api/voice/profiles`, the review panel still offered her
-   * as `new name` inside the SAME meeting, no later meeting could match her, and
-   * there was no profile to accumulate further chunks against. The server already
-   * had `/api/voice/enroll-ext` for exactly this and the naming flow never called it.
+   * This runs IN-PROCESS on purpose. The voice store is owned by the running server,
+   * which holds it in memory and rewrites it wholesale; an external process that
+   * enrols directly has its work silently clobbered on the next persist. That is not
+   * hypothetical — an attempt on 2026-08-13 validated cleanly, selected 20 samples,
+   * and left the store untouched at its Aug 7 mtime.
    *
-   * Enrolment is ADDITIVE and scoped: it runs only when a placeholder becomes a real
-   * name. Correcting one real name to another is left alone deliberately — moving a
-   * voice between existing people is `merge-profiles`, which is explicit and
-   * confirmation-gated, and doing it implicitly here would poison profiles.
+   * SAME GATES, no exceptions. It calls `enrolNamedVoice`, so raw-index mapping,
+   * refusal when unmappable, voice coherence, the diversity cap and the
+   * `correction:<sessionId>` tag all apply identically. Rows whose `from` is a real
+   * person are skipped by that function's own placeholder rule, which is what keeps a
+   * mis-attribution correction (Allison Wheeler -> Kirstyn) out of the training set.
    *
-   * `enrollEmbedding` owns the diversity gate and the FIFO cap, so feeding it the
-   * relabelled chunks cannot bloat a profile.
+   * FAILS CLOSED. Without `confirm: true` it reports what it would enrol and writes
+   * nothing.
    */
-  const enrolNamedVoice = (sessionId: string, from: string, to: string, changed: number[]): number => {
-    if (!isPlaceholderLabel(from) || isPlaceholderLabel(to) || changed.length === 0) return 0
-    let enrolled = 0
+  router.post('/meeting/:sessionId/backfill-enrolment', (req, res) => {
+    res.set('Cache-Control', 'private, no-store')
+    const sessionId = String(req.params.sessionId ?? '')
+    if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) {
+      res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
+      return
+    }
+    const speaker = typeof req.body?.speaker === 'string' ? req.body.speaker.trim() : ''
+    if (!speaker) {
+      res.status(400).json({ error: 'speaker is required', reason: 'invalid_label' })
+      return
+    }
+
+    const operations = cosOperationsMeetingsConfigured()
+      ? findCosOperationsMeetingBySessionId(sessionId)
+      : null
+    const saved = operations ? null : store.findBySessionId(sessionId)
+    if (!operations && !saved) {
+      res.status(404).json({ error: 'No saved meeting for this session', reason: 'meeting_not_found' })
+      return
+    }
+    const sidecarPath = operations?.sidecarPath ?? saved!.sidecarPath
+    let parsedSidecar: Record<string, unknown> | null = null
     try {
-      for (const row of chunkEmbeddingsForIndices(sessionId, changed)) {
-        if (!row.embedding) continue
-        if (enrollEmbedding(to, row.embedding, 'meeting-relabel').success) enrolled += 1
-      }
+      const doc = JSON.parse(readFileSync(sidecarPath, 'utf-8')) as unknown
+      if (doc && typeof doc === 'object' && !Array.isArray(doc)) parsedSidecar = doc as Record<string, unknown>
     } catch {
-      // Enrolment is a bonus on top of the relabel. A voice store that refuses must
-      // not fail the rename the user actually asked for.
-      return enrolled
+      res.status(422).json({ error: 'Chunk sidecar is missing or unreadable', reason: 'sidecar_unreadable' })
+      return
+    }
+
+    // Only rows that ACTUALLY landed, and only those that named this speaker.
+    const rows = appliedCorrections(sessionId).filter(r => r.to === speaker && r.chunks.length > 0)
+    if (rows.length === 0) {
+      res.status(404).json({ error: `No applied correction named "${speaker}" in this meeting`, reason: 'no_correction' })
+      return
     }
-    return enrolled
-  }
+
+    const confirm = req.body?.confirm === true
+    const reports = rows.map(row => ({
+      correctionId: row.id,
+      from: row.from,
+      chunks: row.chunks.length,
+      // Dry run still evaluates every gate — a preview that skips them would be a
+      // guess about what the real call is going to do.
+      report: enrolNamedVoice({
+        sessionId, from: row.from, to: speaker, changed: row.chunks, sidecar: parsedSidecar!, dryRun: !confirm,
+      }),
+    }))
+
+    res.json({
+      ok: true,
+      speaker,
+      confirmed: confirm,
+      corrections: reports,
+      totals: {
+        eligible: reports.filter(r => r.report.attempted > 0).length,
+        skippedNamedSource: reports.filter(r => r.report.attempted === 0 && !r.report.skipped).length,
+        enrolled: reports.reduce((n, r) => n + r.report.enrolled, 0),
+      },
+    })
+  })
 
   router.post('/meeting/:sessionId/relabel', (req, res) => {
     res.set('Cache-Control', 'private, no-store')
@@ -1192,28 +1242,34 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     })
 
     // Enrol AFTER the sidecar and ledger are durable: the rename is the thing the
-    // user asked for, and a voice store that refuses must not undo it. Reported so
-    // the panel can say a profile was created rather than leaving the user to
-    // discover, in another meeting, that it was not.
-    // DISABLED in 6.27.11. 6.27.10 shipped this joining the WRONG INDEX SPACE:
-    // `plan.value.changed` are positions in the COMPACTED sidecar array
-    // (meeting-relabel.ts:119, over rows already filtered to those with text) while
-    // the embedding store is keyed on the RAW capture index
-    // (transcribe-stream.ts:1868). They diverge at the first text-less chunk.
+    // user asked for, and a voice store that refuses must not undo it.
     //
-    // Measured on a live session: naming one voice enrolled 73 of 103 rows belonging
-    // to OTHER people, including 22 chunks of the owner. It reported success because
-    // rows do come back — just the wrong ones. 73 of 74 live sessions have gaps, so
-    // this was the normal case.
+    // `plan.value.changed` are COMPACTED SIDECAR POSITIONS. They are handed to
+    // enrolNamedVoice together with the PARSED SIDECAR precisely so it can convert
+    // them to raw capture indices via attachRawChunkIndices — the join 6.27.10 got
+    // wrong, enrolling 73 of 103 rows belonging to other people including the
+    // device owner. Never pass these positions to anything keyed on raw indices.
     //
-    // `attachRawChunkIndices` is the conversion for this and is imported at line 126,
-    // used correctly by the review path at 755 and 856. Re-enable only WITH that
-    // mapping, a refusal when the mapping is unavailable, a coherence gate (an `Ext`
-    // bucket is many voices — 98% of its pairwise cosines fall below the identifier's
-    // own 0.55 accept threshold), and a `correction:<sessionId>` source tag so the
-    // samples are human-tier, quota-protected and retractable.
-    const enrolled = 0
-    res.json({ ok: true, correctionId: id, enrolledEmbeddings: enrolled, ...preview })
+    // `sidecarRaw` parses by construction: relabelSidecarJson already parsed it
+    // above and returned ok. The catch is for a caller that reorders those steps.
+    let parsedSidecar: Record<string, unknown> = {}
+    try {
+      const doc = JSON.parse(sidecarRaw) as unknown
+      if (doc && typeof doc === 'object' && !Array.isArray(doc)) parsedSidecar = doc as Record<string, unknown>
+    } catch { /* enrolment refuses on an unusable sidecar; the rename already landed */ }
+
+    const enrolment = enrolNamedVoice({ sessionId, from, to, changed: plan.value.changed, sidecar: parsedSidecar })
+    res.json({
+      ok: true,
+      correctionId: id,
+      // Retained for COS Control builds that read the 6.27.10 field name. The
+      // `enrolment` block is the honest report: a bare count cannot say whether a
+      // profile was created, whether chunks were rejected as a different voice, or
+      // whether the whole thing was skipped for a nameable reason.
+      enrolledEmbeddings: enrolment.enrolled,
+      enrolment,
+      ...preview,
+    })
   })
 
 

package/server/routes/voice.ts

@@ -4,7 +4,7 @@ import { Router } from 'express'
 import { errMsg } from '../lib/utils.js'
 import { readdirSync, readFileSync, unlinkSync, existsSync, rmdirSync, rmSync } from 'node:fs'
 import { resolve } from 'node:path'
-import { enrollSpeaker, isEnrolled, getAllSpeakerNames, identifySpeaker, extractEmbedding, enrollEmbedding, rawCosineSimilarity, getEmbeddingCount, removeSpeakerProfile, readVoiceProfiles, mergeSpeakerProfiles } from '../lib/speaker-embeddings.js'
+import { enrollSpeaker, isEnrolled, getAllSpeakerNames, identifySpeaker, extractEmbedding, enrollEmbedding, getEmbeddingCount, removeSpeakerProfile, readVoiceProfiles, mergeSpeakerProfiles } from '../lib/speaker-embeddings.js'
 import { statSync } from 'node:fs'
 import { trainFromFireflies, getTrainingStatus } from '../lib/speaker-trainer.js'
 import { getOwnerSpeakerLabel } from '../lib/profile.js'
@@ -13,6 +13,7 @@ import { purgeSpeakerCalibrationRows, relabelSpeakerCalibrationRows } from '../l
 import { trainingSourceFor } from '../lib/training-audio-provenance.js'
 import { sendAudioFile } from '../lib/send-audio.js'
 import { getVoiceDirectorySnapshot, invalidateVoiceDirectory } from '../lib/voice-directory.js'
+import { greedyDiversitySelect } from '../lib/voice-enrolment-selection.js'
 
 // These MUST match the writer in transcribe-stream.ts, which saves under
 // dataPath(). They previously resolved relative to __dirname — i.e. inside the
@@ -736,34 +737,7 @@ voiceRouter.post('/voice/delete-person', (req, res) => {
   }
 })
 
-/** Greedy diversity selection — pick N most acoustically diverse embeddings */
-function greedyDiversitySelect(embeddings: Float32Array[], maxN: number): Float32Array[] {
-  if (embeddings.length <= maxN) return embeddings
-
-  // Find the most dissimilar pair as seeds
-  let maxDist = -1, seedA = 0, seedB = 1
-  for (let i = 0; i < embeddings.length; i++) {
-    for (let j = i + 1; j < embeddings.length; j++) {
-      const dist = 1 - rawCosineSimilarity(embeddings[i], embeddings[j])
-      if (dist > maxDist) { maxDist = dist; seedA = i; seedB = j }
-    }
-  }
-
-  const selected = new Set([seedA, seedB])
-  while (selected.size < maxN) {
-    let bestIdx = -1, bestMinDist = -1
-    for (let i = 0; i < embeddings.length; i++) {
-      if (selected.has(i)) continue
-      let minDist = Infinity
-      for (const s of selected) {
-        const dist = 1 - rawCosineSimilarity(embeddings[i], embeddings[s])
-        if (dist < minDist) minDist = dist
-      }
-      if (minDist > bestMinDist) { bestMinDist = minDist; bestIdx = i }
-    }
-    if (bestIdx === -1) break
-    selected.add(bestIdx)
-  }
-
-  return [...selected].map(i => embeddings[i])
-}
+// `greedyDiversitySelect` moved VERBATIM to lib/voice-enrolment-selection.ts and
+// is imported at the top of this file. The meeting-relabel enrolment path needs
+// the same bound and the same selection, and a second copy of a greedy
+// max-min-distance search is how two callers of "pick the diverse ones" drift.