@gotcos/glasses-server 6.21.28 → 6.21.30

package/CHANGELOG.md

@@ -1,25 +1,116 @@
+## 6.21.30
+
+- **A name you removed by hand is now stated, and the stale write-up is called
+  out.** De-attribution rewrites the sidecar, the attendee list and the transcript
+  labels, but deliberately leaves narrative prose alone, because substituting into
+  a written sentence mangles grammar and can hit the wrong person. The applied
+  correction row has recorded `proseStale: true` for exactly this since the feature
+  shipped — and NOTHING read it.
+
+  Real case, 2026-08-07: Miles removed "Clem Ukaoma" from a personal call that was
+  only him and Queen (his father's voice matched a similar profile). All 8 label
+  sites were rewritten correctly. The LLM summary still opened "Miles, Queen, and
+  Clem talk through..." and the payload said nothing at all. The allowlist covered
+  it only as "not confirmed", which is far too weak: he did not fail to confirm
+  that person, he explicitly said they were not in the room.
+
+  The payload now carries `removedNames` and states it above the write-up: *"You
+  removed "Clem Ukaoma" from this meeting. The write-up below was written before
+  that and still uses the name: treat every mention of it as a capture error, not
+  a participant."* The prose is left intact — the record stays, the correction
+  travels beside it.
+
+- **The overlap note is gated on how long the meeting RAN, not on voiced time.**
+  Gating on voiced time tripped it on 16 of 23 real meetings, because any overlap
+  at all exceeds the union of voiced speech. At 70% it stopped being a signal and
+  became boilerplate on something pasted into Slack. Rows adding to more than the
+  meeting length is the genuinely confusing case — 71m of rows inside a 66-minute
+  meeting — and that is roughly a tenth of meetings.
+
+  Worth recording for the next person who tests this: only the WORD-TIMING path
+  can overflow. Measured, the chunk-estimate path credits a contested second to
+  one speaker (two speakers at identical timestamps gave MU 273s and Gina 0s), so
+  a chunk-sourced meeting can never trip the note.
+
+## 6.21.29
+
+Everything below was found by two rounds of adversarial review of 6.21.28 against
+the real corpus. **Published 6.21.28 contains the route and none of these fixes**
+— its `meeting-scribe-content.ts` is 192 lines with no `renderProvenance`, no
+`cleanBody`, and no coverage floor (verified by extracting the tarball, not by
+reading the changelog). If you are on 6.21.28, per-voice shares are printed
+without the floor.
+
+- **The compact form no longer ships a transcript.** `contains('transcript')`
+  kept only the longest match and the loser fell through to `extras`, which went
+  into BOTH forms — so the "no transcript" summary carried a second full
+  transcript on 112 of 2,090 real scribes, worst case 78,652 characters, printed
+  directly above its own "Transcript omitted" line. All transcript-shaped
+  sections are now consumed; extras beyond 2,000 characters are omitted from the
+  compact form only. The size ceiling matters because a heading cannot be
+  trusted: one real scribe hides a full transcript under `G2 Glasses Enrichment`.
+
+- **"Voice matching confirmed" was false for two of the three ways a name is
+  asserted.** `nameAsserted` is one boolean over three different warrants — the
+  cosine floor, a human typing the name, and the wearer exemption (identity comes
+  from holding the device, not from a score). The route carried `isOwner` and
+  `confirmedByHuman` and discarded both. The output now names the warrant per
+  person: `"MU" by wearing the device; "Gina Obert" by voice match; "Luke Henry"
+  because a human named that voice`. Labels are quoted, so a typed "Smith, John"
+  cannot read as two people, and the caveat now covers different SPELLINGS of a
+  confirmed name (labels are `MU` while the prose says "Miles").
+
+- **A lone named voice no longer gets a share.** "100% of identified speech" is
+  always true with one name and reads as "he did all the talking" — on 23 real
+  meetings, including one where 6m 29s was unidentified.
+
+- **Rows that overlap say so.** Each per-voice figure is that voice's own union,
+  but two people talking over each other is counted once EACH, so the rows add to
+  more than the meeting on 34 of 323 real meetings (71m of rows inside 66
+  minutes). The figures are right; adding them is what misleads, so the block now
+  explains the overlap instead of shrinking anyone.
+
+- **"(no transcript in this scribe)" was a lie on 140 of 399 sidecars.** Those
+  meetings have no write-up yet while the recording holds the speech — one case
+  today had 27,442 characters in the sidecar this route had just parsed. It now
+  distinguishes "not written up yet" from "nobody spoke".
+
+- **The payload says which business it is.** 98 of 251 real meetings are
+  `personal` and 25 of 251 summaries carry compensation, termination, or legal
+  content, while the buttons are framed for Slack and email. `/speakers` has
+  always carried `domain`; this route dropped it. Personal meetings also get an
+  explicit line before the content.
+
+- **A derived note is never relabelled as the transcript.** With no real
+  transcript, a `Transcript Enrichment (from raw recording)` note won by default
+  and was printed under `## Transcript` with its real heading destroyed. The
+  section's own heading is now used, and an `## Attendees (from transcript)`
+  variant can no longer win the slot at all — nor slip into `extras`, where it
+  printed the unfloored name list this module exists to replace.
+
+- **The generator stamp is stripped by POSITION, not wording.** Measured across
+  1,227 real stamps, four generator names appear ("Meeting Intelligence System",
+  "COS Split Pipeline", "COS Meeting Intelligence", "Manual Granola Paste"), so a
+  name-anchored regex leaks some — I shipped one that leaked 7. Being the last
+  line is the invariant, which also means a mid-body italic line a human wrote
+  now survives. `<!-- g2-needs-domain-review -->` and `<details open>` are
+  stripped too; the internal marker reached 129 of 362 real clipboards.
+
+- Also: `mmss` no longer renders `NaNm NaNs`; `meetingDate(1)` no longer returns
+  1969-12-31; a date-only ISO string no longer reports the previous day; each
+  clipboard form is rendered once instead of twice per request.
+
 ## 6.21.28
 
+**Published. Contains the route only — see 6.21.29 for what it is missing.**
+
 - `GET /meeting/:sessionId/content` — the readable meeting plus two ready-made
-  clipboard forms. Resolution is operations-first, identical to `/speakers`, so
-  the list row and this view can never describe the same meeting differently.
-
-  The attendee block is REBUILT from the speaker review, not taken from the
-  scribe's own `## Attendees`, which applies no confidence floor: the 2026-08-06
-  IJO scribe lists 15 attendees for a 26-minute call including a name already
-  confirmed absent. Copying that verbatim into Slack, an email or an LLM prompt
-  launders a guess into a fact. Only asserted voices are named; the rest collapse
-  into one line with their combined talk time.
-
-  Two forms because they serve different jobs — measured on a real 26-minute
-  meeting, 3.6 KB summary for pasting into a message versus 28 KB with the
-  transcript for pasting into a model. Formatting lives server-side so it is
-  mutation-testable; Swift has no execution-test harness here.
-
-- `meetingDate()` — `startTime` in the sidecar is epoch MILLISECONDS, not ISO.
-  Slicing the stringified number produced "1786123940", which renders as a
-  plausible-looking date field containing a timestamp. Caught only by running the
-  route against a real meeting; the unit tests would have stayed green.
+  clipboard forms. Operations-first resolution, identical to `/speakers`, so the
+  list row and this view can never describe the same meeting differently.
+
+- The attendee block is rebuilt from the review rather than reusing the scribe's
+  own `## Attendees`, which applies no confidence floor: 2026-08 alone carries
+  scribes listing 55, 21, 20, 19, 18, 18, 17 and 15 attendees.
 
 ## 6.21.27
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.21.28",
+  "version": "6.21.30",
   "description": "COS Glasses — self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/lib/meeting-scribe-content.ts

@@ -1,24 +1,44 @@
-// The readable meeting: what the scribe markdown says, and two clipboard forms.
+// The readable meeting, and the two forms of it that leave the machine.
 //
-// WHY THIS IS NOT JUST "SEND THE FILE". The scribe's `## Attendees` list applies
-// NO confidence floor — it is the raw label set from capture. Measured on the
-// 2026-08-06 IJO Post-Mortem: 15 attendees listed for a 26-minute call, one of
-// them a name Miles had already confirmed was never in the room. Copying that
-// verbatim into Slack, an email, or an LLM prompt launders a guess into a fact,
-// which is the exact defect the display floor exists to prevent one layer up.
+// WHAT v1 GOT WRONG, because the shape of the fix follows from it.
 //
-// So the attendee list served here is rebuilt from the speaker review: only
-// voices the review ASSERTS get named, and everything else is reported as
-// unidentified with its share of the talking.
+// v1 floored the attendee block and shipped every other section verbatim. On the
+// 2026-08-06 IJO Post-Mortem — where the review asserts exactly ONE voice — all
+// 14 unasserted names still reached the clipboard, including one Miles had
+// already confirmed was never in the room, as `[Name]:` transcript labels. The
+// stated contract, "only asserted voices are named", was false for the largest
+// output.
 //
-// Formatting lives here rather than in Swift on purpose. Swift has no execution
-// test harness in this project, and these strings are the product — they need to
-// be mutation-testable.
+// The fix is NOT redaction. Two reasons:
+//   1. Transcript labels are EVIDENCE, and they came from the same identifier
+//      whose verdict we would be applying — rewriting them is circular and
+//      destroys the raw record the reviewer needs to judge for themselves.
+//   2. A name in the prose is frequently a person MENTIONED, not one who SPOKE.
+//      An action item naming Jessica Thompson does not claim she was in the room.
+//      Stripping it would replace one wrong claim with a different one.
+//
+// So the output carries an ALLOWLIST: who voice matching confirmed, plus a plain
+// statement that every other name below is unverified capture output. Honest,
+// lossless, and short — a blocklist ran to 14 names on that meeting and 55 on
+// another.
+//
+// v1's second error: it printed "100% of named speech" on a meeting that was
+// 10.5% identified, and 49% of real meetings sit under that floor. A share is a
+// fraction of the IDENTIFIED speech, so at 40% coverage "53%" may be 21% of the
+// room — precise-looking and wrong. Hence SHARE_COVERAGE_FLOOR.
+//
+// And a correction to v1's own comment, which claimed the Control panel already
+// suppressed those shares: it did not. `Views.swift` drew a percentage for every
+// asserted voice with no coverage condition at all — the only `0.6` comparison in
+// the app swapped a caption's colour. Measured: the panel showed shares the
+// clipboard refused on 170 of 355 real meetings, while this file asserted twice
+// that the two "can never disagree". The gate is now IN the panel row. Never
+// describe another surface's behaviour from a comment; read its code.
 
 /** One `## Heading` section of a scribe file, in document order. */
 export interface ScribeSection {
   heading: string
-  /** Body text with the heading line removed and edges trimmed. */
+  /** Body with the heading line removed, scaffolding stripped, edges trimmed. */
   body: string
 }
 
@@ -26,85 +46,212 @@ export interface ParsedScribe {
   /** The `# Title` line, or '' when the file has none. */
   title: string
   sections: ScribeSection[]
-  /** Convenience lookups for the sections a UI renders directly. */
   summary: string
   topics: string
   decisions: string
   actions: string
   transcript: string
+  /**
+   * The heading the transcript body actually came FROM.
+   *
+   * When a file has no real transcript, a `Transcript Enrichment (from raw
+   * recording)` note wins by default and v1 relabelled derived analysis as
+   * `## Transcript` while destroying its real heading — the reader could not
+   * tell. Carry the heading and print it.
+   */
+  transcriptHeading: string
+  /**
+   * Further transcript-ish sections beyond the longest. Carried so nothing is
+   * lost, but they belong ONLY in the full form — 112 real scribes have two.
+   */
+  otherTranscripts: ScribeSection[]
+  /**
+   * Sections that are none of the above, in document order.
+   *
+   * v1 discarded these, losing 116,820 characters across the corpus including
+   * `Granola Structured Notes (canonical)` — Miles's own write-up — and
+   * `Fathom Action Items (with exact timestamps)`. "Copy the meeting" has to
+   * copy the meeting.
+   */
+  extras: ScribeSection[]
 }
 
-const SECTION = /^##\s+(.+?)\s*$/
+const HEADING = /^(#{1,6})\s+(.+?)\s*$/
+const FENCE = /^\s*(```|~~~)/
+
+/**
+ * Strip markdown scaffolding that is structure rather than content.
+ *
+ * 160 of 227 real scribes wrap the transcript in a `<details>` disclosure and
+ * 161 end with a generator stamp. Both land in whatever the final section is, and
+ * both are noise in every destination — the stamp especially, because it is
+ * generation time and reads like meeting content.
+ */
+export function cleanBody(body: string): string {
+  const kept: string[] = []
+  for (const line of body.split('\n')) {
+    const t = line.trim()
+    // `<details open>` and `<details markdown="1">` both occur in LLM-authored
+    // markdown and neither matched the bare-tag test.
+    if (/^<\/?details(\s[^>]*)?>$/i.test(t)) continue
+    if (/^<summary>.*<\/summary>$/i.test(t)) continue
+    // Internal pipeline triage markers. `g2-needs-domain-review` reached 129 of
+    // 362 reachable clipboards — more frequent than the generator stamp, and it
+    // is not meeting content.
+    if (/^<!--[\s\S]*-->$/.test(t)) continue
+    kept.push(line)
+  }
+  // Drop trailing rules AND the blank lines between them, left orphaned by the
+  // stamp that sat underneath. Popping rules alone stops at the first blank line
+  // the stamp left behind, so the rule survived — caught by test, not by reading.
+  // The generator stamp is stripped HERE, as a footer, by POSITION not wording.
+  // Measured across 1,227 real stamps, four different generator names appear
+  // ("Meeting Intelligence System", "COS Split Pipeline", "COS Meeting
+  // Intelligence", "Manual Granola Paste"), so any name-anchored regex leaks
+  // some — I tried one and it leaked 7. Being the last line IS the invariant,
+  // and it also means a mid-body italic line a human wrote ("the deck was
+  // *Generated by the team* last week") now survives, where the old
+  // line-by-line filter deleted it wherever it appeared.
+  const trailingNoise = (line: string) =>
+    line.trim() === '' ||
+    /^\s*(-{3,}|\*{3,}|_{3,})\s*$/.test(line) ||
+    /^\*Generated by .*\*$/i.test(line.trim())
+  while (kept.length > 0 && trailingNoise(kept[kept.length - 1])) kept.pop()
+  return kept.join('\n').trim()
+}
 
 /**
- * Split a scribe file into its `##` sections.
+ * Split a scribe into its `##` sections.
  *
- * Deliberately tolerant: a scribe with no headings returns everything as the
- * summary rather than an empty object, because a partially-written file is more
- * useful to a reviewer than nothing. `###` subheadings (the Action Items split
- * into High Confidence / Needs Review) stay INSIDE their parent section — they
- * are part of that section's body, not sections of their own.
+ * FENCE-AWARE. A `#` inside a fenced code block is code, not a heading. Without
+ * this, a fence truncates its section at the first `##` inside it and can lift a
+ * shell comment into the meeting title. No real scribe carries a fence today, but
+ * the Granola sections are LLM-authored markdown, so one will arrive.
+ *
+ * `###` subheadings stay INSIDE their parent — Action Items splitting into High
+ * Confidence / Needs Review is one section's body, not two sections.
  */
 export function parseScribe(markdown: string): ParsedScribe {
-  const lines = markdown.split('\n')
+  const lines = markdown.replace(/\r\n?/g, '\n').split('\n')
   let title = ''
   const sections: ScribeSection[] = []
   let current: ScribeSection | null = null
-  const preamble: string[] = []
+  let inFence = false
 
   for (const line of lines) {
-    if (!title && /^#\s+/.test(line)) { title = line.replace(/^#\s+/, '').trim(); continue }
-    const m = SECTION.exec(line)
-    if (m) {
-      if (current) sections.push({ ...current, body: current.body.trim() })
-      current = { heading: m[1], body: '' }
-      continue
+    if (FENCE.test(line)) inFence = !inFence
+    if (!inFence) {
+      const m = HEADING.exec(line)
+      if (m && m[1].length === 1 && !title) { title = m[2].trim(); continue }
+      if (m && m[1].length === 2) {
+        if (current) sections.push({ ...current, body: cleanBody(current.body) })
+        current = { heading: m[2], body: '' }
+        continue
+      }
     }
     if (current) current.body += line + '\n'
-    else preamble.push(line)
   }
-  if (current) sections.push({ ...current, body: current.body.trim() })
+  if (current) sections.push({ ...current, body: cleanBody(current.body) })
 
-  const find = (...names: string[]): string => {
+  const used = new Set<ScribeSection>()
+  /** Exact heading match, first name wins. */
+  const exact = (...names: string[]): string => {
     for (const n of names) {
-      const s = sections.find(x => x.heading.toLowerCase() === n.toLowerCase())
-      if (s) return s.body
+      const s = sections.find(x => x.heading.toLowerCase() === n.toLowerCase() && !used.has(x))
+      if (s) { used.add(s); return s.body }
     }
     return ''
   }
-  const summary = find('Summary')
+  /**
+   * CONTAINS match, longest body wins.
+   *
+   * Prefix matching is the obvious rule and it is WRONG: 113 scribes head the
+   * transcript `G2 Speaker-Separated Transcript` — the speaker-attributed one,
+   * the most useful thing to hand a model — which does not start with the word.
+   * Measured across 1,930 transcript headings, prefix catches 94%, contains 100%.
+   * Longest-body separates a real transcript from a short
+   * `Transcript Enrichment (from raw recording)` note in the same file.
+   */
+  const otherTranscripts: ScribeSection[] = []
+  let transcriptHeading = ''
+  const contains = (needle: string): string => {
+    const hits = sections
+      .filter(x => {
+        const h = x.heading.toLowerCase()
+        // `## Attendees (from transcript)` is eligible on a naive match and would
+        // promote the unfloored attendee list — the thing this module drops — into
+        // the transcript slot. Never let an attendee heading win.
+        return h.includes(needle) && !h.includes('attendee') && !used.has(x)
+      })
+      .sort((a, b) => b.body.length - a.body.length)
+    if (hits.length === 0) return ''
+    transcriptHeading = hits[0].heading
+    // Consume EVERY transcript-ish section. Keeping only the longest let the
+    // losers fall through to `extras`, and `extras` goes into BOTH clipboard
+    // forms — so the "compact, no transcript" summary shipped a second full
+    // transcript on 112 of 2,090 real scribes, worst case 78,652 characters,
+    // directly above its own "Transcript omitted" line.
+    for (const h of hits) used.add(h)
+    otherTranscripts.push(...hits.slice(1))
+    return hits[0].body
+  }
+
+  const summary = exact('Summary')
+  const topics = exact('Topics Discussed', 'Topics')
+  const decisions = exact('Decisions Made', 'Decisions')
+  const actions = exact('Action Items', 'Actions')
+  const transcript = contains('transcript')
+  // Attendees is consumed and DROPPED on purpose: it is the unfloored label list
+  // this module exists to replace. CONTAINS, not exact — `## Attendees (from
+  // transcript)` slipped past the exact match, fell through to `extras`, and
+  // printed the unfloored names verbatim in both clipboard forms.
+  for (const x of sections) {
+    if (x.heading.toLowerCase().includes('attendee')) used.add(x)
+  }
+
   return {
     title,
     sections,
-    // No headings at all: treat the whole file as the summary rather than
-    // returning a shell that renders as an empty meeting.
-    summary: summary || (sections.length === 0 ? markdown.trim() : ''),
-    topics: find('Topics Discussed', 'Topics'),
-    decisions: find('Decisions Made', 'Decisions'),
-    actions: find('Action Items', 'Actions'),
-    transcript: find('Transcript'),
+    // Heading-less fallback drops the `# Title` line the parser already consumed;
+    // 18 real files otherwise printed their title twice in the clipboard.
+    summary: summary || (sections.length === 0 ? cleanBody(markdown.split('\n').filter(l => !/^#\s+/.test(l)).join('\n')) : ''),
+    topics,
+    decisions,
+    actions,
+    transcript,
+    transcriptHeading,
+    otherTranscripts,
+    extras: sections.filter(x => !used.has(x) && x.body.trim().length > 0),
   }
 }
 
 /**
  * The meeting's calendar date, as `YYYY-MM-DD`.
  *
- * `startTime` in the sidecar is epoch MILLISECONDS (measured: 1786123940914),
- * not an ISO string. Slicing the stringified number gives "1786123940", which
- * renders in the clipboard as a plausible-looking date field containing a
- * timestamp. LOCAL date on purpose — the scribe filename uses the local day, so
- * a UTC conversion would disagree with the file for anything late in the evening.
+ * `startTime` is epoch MILLISECONDS (measured: 1786123940914), not ISO. Slicing
+ * the stringified number gave "1786123940" — a plausible-looking date field
+ * holding a timestamp. LOCAL date, because the scribe filename uses the local day
+ * and a UTC conversion would disagree with the file late in the evening.
  */
 export function meetingDate(startTime: unknown): string {
   let ms: number | null = null
   if (typeof startTime === 'number' && Number.isFinite(startTime)) {
-    // Tolerate seconds as well as milliseconds: a 10-digit value is seconds.
-    ms = startTime < 1e12 ? startTime * 1000 : startTime
+    // Seconds-vs-ms by magnitude, but only within a plausible capture era:
+    // startTime = 1 was read as 1 second and rendered "1969-12-31".
+    ms = startTime < 1e12 ? (startTime > 1e8 ? startTime * 1000 : 0) : startTime
   } else if (typeof startTime === 'string' && startTime.trim()) {
-    const t = Date.parse(startTime)
+    const numeric = Number(startTime)
+    const t = Number.isFinite(numeric)
+      ? (numeric < 1e12 ? numeric * 1000 : numeric)
+      // A date-only ISO string parses as UTC midnight, so a local getDate()
+      // then reports the PREVIOUS day. Pin it to local noon.
+      : (/^\d{4}-\d{2}-\d{2}$/.test(startTime.trim())
+        ? Date.parse(`${startTime.trim()}T12:00:00`)
+        : Date.parse(startTime))
     if (Number.isFinite(t)) ms = t
   }
-  if (ms === null) return ''
+  // 0 and negatives are not real capture times; they rendered as "1969-12-31".
+  if (ms === null || ms <= 0) return ''
   const d = new Date(ms)
   if (Number.isNaN(d.getTime())) return ''
   const pad = (n: number) => String(n).padStart(2, '0')
@@ -117,58 +264,244 @@ export interface AttendeeLine {
   /** False when the review refuses to assert this name. */
   asserted: boolean
   speakingMs: number
-  /** Share of NAMED speaking time, 0..1, or null when unknown/unnamed. */
+  /** Share of identified speech, 0..1, or null when unknown/unnamed. */
   share: number | null
+  /**
+   * WHY this name is asserted. `nameAsserted` is one boolean over THREE
+   * different warrants — passed the cosine floor, a human typed it, or the
+   * wearer is exempt because identity comes from holding the device. v1 printed
+   * all three as "Voice matching confirmed", which is false for two of them and
+   * is exactly the laundering this module exists to prevent. The review already
+   * carries both flags; the route discarded them.
+   */
+  isOwner: boolean
+  confirmedByHuman: boolean
 }
 
+/**
+ * Coverage below which per-voice shares are NOT reported.
+ *
+ * Mirrors Control's `speakingCoverage < 0.6` gate exactly, so the clipboard and
+ * the panel can never disagree about whether a share is trustworthy. 49% of real
+ * meetings sit below it.
+ */
+export const SHARE_COVERAGE_FLOOR = 0.6
+
 function mmss(ms: number): string {
-  const total = Math.round(ms / 1000)
+  // NaN survives Math.max and renders "NaNm NaNs".
+  if (!Number.isFinite(ms)) return '0s'
+  const total = Math.max(0, Math.round(ms / 1000))
   const m = Math.floor(total / 60)
   const s = total % 60
-  return m > 0 ? `${m}m ${s}s` : `${s}s`
+  if (m === 0) return `${s}s`
+  return s === 0 ? `${m}m` : `${m}m ${s}s`
 }
 
-/**
- * The attendee block, floor-applied.
- *
- * Asserted voices are named with their talk time. Everything else is collapsed
- * into a single honest line rather than listed as people: a large unmatched
- * cluster is frequently several different speakers, and naming them
- * individually would be the 15-attendee defect again in a new place.
- */
-export function renderAttendees(voices: AttendeeLine[]): string {
+export interface AttendeeRenderOptions {
+  /**
+   * Identified share of voiced time, 0..1, or null when unknown. Null suppresses
+   * shares — failing closed, because unknown coverage cannot justify a
+   * precise-looking percentage.
+   */
+  coverage: number | null
+  /**
+   * UNION of unattributed speaking time, from the review.
+   *
+   * Required rather than optional so it cannot be forgotten. Summing per-voice
+   * figures double-counts crosstalk: v1 printed "30m 21s across 15 voices" inside
+   * a 26-minute meeting while the union on the same review said 22m 17s. The
+   * server CHANGELOG states the invariant that sum breaks.
+   */
+  unattributedMs: number
+  /**
+   * UNION of all voiced time. Only used to phrase the crosstalk note.
+   */
+  voicedMs: number
+  /**
+   * How long the meeting RAN. This is what the overlap note is gated on.
+   *
+   * Gating on `voicedMs` instead tripped on 16 of 23 real meetings, because any
+   * overlap at all exceeds the union of voiced time — at 70% the line stops being
+   * a signal and becomes boilerplate on something Miles pastes into Slack. Rows
+   * adding to more than the meeting LENGTH is the genuinely confusing case (71m
+   * of rows inside a 66-minute meeting), and that is ~10% of meetings.
+   */
+  durationMs: number
+}
+
+/** The attendee block, floor-applied. */
+export function renderAttendees(voices: AttendeeLine[], o: AttendeeRenderOptions): string {
   const named = voices.filter(v => v.asserted).sort((a, b) => b.speakingMs - a.speakingMs)
   const rest = voices.filter(v => !v.asserted)
+  // A share needs someone to be a share OF. With one named voice it is always
+  // "100% of identified speech" — 23 real meetings — and on screen that reads as
+  // "he did all the talking" when the same meeting had 6m 29s unidentified.
+  const showShares = o.coverage !== null &&
+    o.coverage >= SHARE_COVERAGE_FLOOR &&
+    named.length >= 2
   const out: string[] = []
   for (const v of named) {
-    const pct = v.share === null ? '' : ` · ${Math.round(v.share * 100)}% of named speech`
-    out.push(`- ${v.label} — ${mmss(v.speakingMs)}${pct}`)
+    const pct = showShares && v.share !== null
+      ? ` · ${Math.round(v.share * 100)}% of identified speech`
+      : ''
+    out.push(`- ${v.label}: ${mmss(v.speakingMs)}${pct}`)
   }
-  const restMs = rest.reduce((n, v) => n + v.speakingMs, 0)
   if (rest.length > 0) {
-    out.push(`- Unidentified — ${mmss(restMs)} across ${rest.length} ` +
+    out.push(`- Unidentified: ${mmss(o.unattributedMs)} across ${rest.length} ` +
              `voice${rest.length === 1 ? '' : 's'} the review could not name`)
   }
+  // Each figure above is that voice's OWN union of speaking time, so crosstalk is
+  // counted once per person — but two people talking over each other is counted
+  // once EACH, and the rows then add to more than the meeting. 34 of 323 real
+  // meetings overflow, worst case 71m of rows inside 66 minutes. The numbers are
+  // right; adding them is what misleads, so say so rather than shrink anyone.
+  const rowTotal = named.reduce((t, v) => t + (Number.isFinite(v.speakingMs) ? v.speakingMs : 0), 0) +
+    (rest.length > 0 && Number.isFinite(o.unattributedMs) ? o.unattributedMs : 0)
+  if (o.durationMs > 0 && rowTotal > o.durationMs * 1.02) {
+    out.push(`- (these overlap: people talked over each other, so the rows add up to ` +
+             `more than the ${mmss(o.durationMs)} the meeting ran)`)
+  }
   return out.length > 0 ? out.join('\n') : '- (no voices identified)'
 }
 
+/**
+ * The provenance block: who was confirmed, and a warning covering everyone else.
+ *
+ * An ALLOWLIST rather than a blocklist. The prose and transcript below carry raw
+ * capture labels, some of which the review rejected, and a reader pasting this
+ * into a model has no other way to tell which. Naming the confirmed set is short
+ * and complete.
+ */
+/**
+ * Names a human explicitly REMOVED from this meeting, still present in the prose.
+ *
+ * De-attribution rewrites the sidecar, the attendee list and the transcript
+ * labels, but deliberately leaves narrative prose alone — substituting into a
+ * written sentence mangles grammar and can hit the wrong person. So the applied
+ * correction row records `proseStale: true` and, until now, NOTHING read it.
+ *
+ * Real case, 2026-08-07: Miles removed "Clem Ukaoma" from a personal call that
+ * was only him and Queen (his father's voice matched a similar profile). All 8
+ * label sites were rewritten correctly; the LLM summary still opened "Miles,
+ * Queen, and Clem talk through..." and the payload said nothing. An allowlist
+ * ("this name was not confirmed") is far too weak here — he did not fail to
+ * confirm this person, he explicitly said they were not in the room.
+ */
+export interface RemovedName {
+  label: string
+  /** True when narrative prose still carries the name. */
+  proseStale: boolean
+}
+
+export function renderProvenance(
+  voices: AttendeeLine[],
+  coverage: number | null,
+  removed: RemovedName[] = [],
+): string {
+  const named = voices.filter(v => v.asserted)
+  // Quoted because a label may legitimately contain a comma — `invalidLabelReason`
+  // rejects brackets and newlines but not commas, and a typed "Smith, John" would
+  // otherwise read as two confirmed people.
+  const q = (v: AttendeeLine) => `"${v.label}"`
+  const clauses: string[] = []
+  const owner = named.filter(v => v.isOwner).map(q)
+  const human = named.filter(v => !v.isOwner && v.confirmedByHuman).map(q)
+  const matched = named.filter(v => !v.isOwner && !v.confirmedByHuman).map(q)
+  if (owner.length) clauses.push(`${owner.join(', ')} by wearing the device`)
+  if (matched.length) clauses.push(`${matched.join(', ')} by voice match`)
+  if (human.length) clauses.push(`${human.join(', ')} because a human named that voice`)
+  const lines: string[] = [
+    clauses.length > 0
+      ? `Names established here: ${clauses.join('; ')}.`
+      : 'No name in this meeting was established by any means.',
+    'Every other name below — and any different spelling of the ones just listed — ' +
+    'comes from the raw capture or the write-up and was NOT confirmed. Some may be ' +
+    'people mentioned rather than people present.',
+  ]
+  // Before the coverage caveat: an explicit human removal outranks every other
+  // statement in this block, and it must not read as one more hedge.
+  const stale = removed.filter(r => r.proseStale).map(r => `"${r.label}"`)
+  const quiet = removed.filter(r => !r.proseStale).map(r => `"${r.label}"`)
+  if (stale.length > 0) {
+    lines.push(
+      `You removed ${stale.join(', ')} from this meeting. The write-up below was ` +
+      'written before that and still uses the name: treat every mention of it as a ' +
+      'capture error, not a participant.',
+    )
+  }
+  if (quiet.length > 0) {
+    lines.push(`You also removed ${quiet.join(', ')} from this meeting.`)
+  }
+  if (coverage !== null && coverage < SHARE_COVERAGE_FLOOR) {
+    lines.push(
+      `Only ${Math.round(coverage * 100)}% of the voice in this meeting was ` +
+      'identified, so speaking shares are not reported.',
+    )
+  }
+  return lines.join(' ')
+}
+
 export interface ClipboardInput {
+  /**
+   * Which business this meeting belongs to, when known.
+   *
+   * 98 of 251 real meetings are `personal`, and 25 of 251 summaries carry
+   * compensation, termination, or legal content — while the buttons are framed
+   * for Slack and email. Nothing in the payload distinguished a 1:1 about
+   * someone's bonus from a marketing sync. The sibling /speakers route already
+   * carries this; this one dropped it.
+   */
+  domain: string
+  /**
+   * Characters of transcript present in the RECORDING, whether or not a write-up
+   * exists. Distinguishes "not written up yet" from "nobody spoke".
+   */
+  capturedChars: number
+  /** UNION of voiced time, for the crosstalk-overflow note. */
+  voicedMs: number
+  /** How long the meeting ran. Gates the crosstalk-overflow note. */
+  durationMs: number
+  /** Names a human explicitly de-attributed from this meeting. */
+  removed: RemovedName[]
   title: string
   date: string
   durationMin: number
   attendees: AttendeeLine[]
   scribe: ParsedScribe
+  /** Both required, so neither can be omitted. See AttendeeRenderOptions. */
+  coverage: number | null
+  unattributedMs: number
 }
 
-/** Compact form: for pasting into Slack, email, or a note. No transcript. */
-export function clipboardSummary(i: ClipboardInput): string {
-  const parts = [
-    `# ${i.title || 'Untitled meeting'}`,
-    `${i.date} · ${i.durationMin} minutes`,
-    '',
-    '## Who spoke',
-    renderAttendees(i.attendees),
-  ]
+/**
+ * Per-extra size ceiling for the COMPACT form.
+ *
+ * A heading cannot be trusted to reveal a transcript: one real scribe carries a
+ * full one under `## G2 Glasses Enrichment ... (Combined)`. Gating on SIZE
+ * catches that generically, where a keyword list never would. The full form has
+ * no ceiling.
+ */
+export const SUMMARY_EXTRA_MAX_CHARS = 2000
+
+function header(i: ClipboardInput, compact: boolean): string[] {
+  const when = [i.date, i.durationMin > 0 ? `${i.durationMin} minutes` : '']
+    .filter(Boolean).join(' · ')
+  const parts = [`# ${i.title || 'Untitled meeting'}`]
+  // Domain on the same line as the date. A reader about to paste this into a
+  // channel should see "personal" before they see the content, not after.
+  const line = [when, i.domain ? `${i.domain.replace(/_/g, ' ')} meeting` : ''].filter(Boolean).join(' · ')
+  if (line) parts.push(line)
+  if (i.domain === 'personal') {
+    parts.push('', '> Personal meeting. Check before pasting this anywhere shared.')
+  }
+  parts.push(
+    '', '## Who spoke',
+    renderAttendees(i.attendees, {
+      coverage: i.coverage, unattributedMs: i.unattributedMs,
+      voicedMs: i.voicedMs, durationMs: i.durationMs,
+    }),
+    '', renderProvenance(i.attendees, i.coverage, i.removed),
+  )
   for (const [heading, body] of [
     ['Summary', i.scribe.summary],
     ['Topics', i.scribe.topics],
@@ -177,16 +510,45 @@ export function clipboardSummary(i: ClipboardInput): string {
   ] as const) {
     if (body.trim()) parts.push('', `## ${heading}`, body.trim())
   }
+  for (const s of i.scribe.extras) {
+    const body = s.body.trim()
+    if (compact && body.length > SUMMARY_EXTRA_MAX_CHARS) {
+      parts.push('', `## ${s.heading}`, `_Omitted from the summary (${body.length} characters). Use Copy full._`)
+      continue
+    }
+    parts.push('', `## ${s.heading}`, body)
+  }
+  return parts
+}
+
+/** Compact form: for pasting into a message. No transcript. */
+export function clipboardSummary(i: ClipboardInput): string {
+  const parts = header(i, true)
+  // State that a transcript exists but was omitted. Without this, a reader
+  // holding only the summary cannot tell whether one exists at all.
+  const tx = i.scribe.transcript.trim()
+  if (tx) parts.push('', `_Transcript omitted (${tx.length} characters). Use Copy full for it._`)
   return parts.join('\n') + '\n'
 }
 
-/** Full form: everything including the transcript, for pasting into an LLM. */
+/** Full form: everything including the transcript, for pasting into a model. */
 export function clipboardFull(i: ClipboardInput): string {
-  const head = clipboardSummary(i).trimEnd()
-  if (!i.scribe.transcript.trim()) {
-    // Say so rather than silently returning the summary — otherwise "Copy full"
-    // and "Copy summary" produce identical text with no explanation.
-    return head + '\n\n## Transcript\n(no transcript in this scribe)\n'
+  const parts = header(i, false)
+  const tx = i.scribe.transcript.trim()
+  // The section's OWN heading, so a `Transcript Enrichment` note is never
+  // presented as the transcript.
+  // "(no transcript in this scribe)" was a lie on 140 of 399 real sidecars: the
+  // write-up has not been generated yet, while the recording itself holds the
+  // speech — one case today had 27,442 characters sitting in the sidecar this
+  // route had just parsed. Say which of the two is actually true.
+  const fallback = i.capturedChars > 0
+    ? `(no write-up saved for this meeting yet — ${i.capturedChars} characters of ` +
+      `transcript are in the recording, and will appear here once it is written up)`
+    : '(no transcript in this scribe)'
+  parts.push('', `## ${i.scribe.transcriptHeading || 'Transcript'}`, tx || fallback)
+  // Additional transcript sections, full form only.
+  for (const o of i.scribe.otherTranscripts) {
+    if (o.body.trim()) parts.push('', `## ${o.heading}`, o.body.trim())
   }
-  return head + '\n\n## Transcript\n' + i.scribe.transcript.trim() + '\n'
+  return parts.join('\n') + '\n'
 }

package/server/routes/meeting.ts

@@ -8,7 +8,7 @@ import { Router } from 'express'
 import { emitDisplay } from '../lib/display-bus.js'
 import { cleanTranscriptLines } from '../lib/hallucination-filter.js'
 import { durableAtomicWriteFileSync } from '../lib/atomic-fs.js'
-import { appendCorrection, pendingCorrections } from '../lib/meeting-corrections.js'
+import { appendCorrection, appliedCorrections, pendingCorrections } from '../lib/meeting-corrections.js'
 import { isSampleFromSession, untraceableSampleCount } from '../lib/training-audio-provenance.js'
 import { sendAudioFile } from '../lib/send-audio.js'
 import { chunkDiagnostics } from '../lib/chunk-embedding-diagnostics.js'
@@ -118,14 +118,15 @@ import {
   attachRawChunkIndices,
   isUnattributed,
   reviewMeetingSpeakers,
+  type ReviewChunk,
   type SpeakerWordSegment,
 } from '../lib/meeting-speaker-review.js'
-import { type ReviewChunk } from '../lib/meeting-speaker-review.js'
 import {
   parseScribe,
   clipboardSummary,
   clipboardFull,
   meetingDate,
+  SHARE_COVERAGE_FLOOR,
 } from '../lib/meeting-scribe-content.js'
 import {
   acquireMaintenanceWork,
@@ -815,11 +816,22 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       return
     }
     const rawChunks = Array.isArray(sidecar) ? sidecar : sidecar.chunks
-    const chunks = (Array.isArray(rawChunks) ? rawChunks : []) as ReviewChunk[]
+    if (!Array.isArray(rawChunks)) {
+      // Mirrors GET /speakers exactly. Coercing to [] returned 200 with an empty
+      // floor while still shipping the full verbatim prose and transcript — the
+      // worst pairing, and the two routes would have disagreed about the same
+      // session (panel 422, copy buttons fine).
+      res.status(422).json({ error: 'Chunk sidecar holds no chunk array', reason: 'sidecar_empty' })
+      return
+    }
+    const chunks = rawChunks as ReviewChunk[]
 
     const review = reviewMeetingSpeakers(attachRawChunkIndices(chunks, sidecar.chunkEntries), {
       owner: getOwnerSpeakerLabel(),
       confirmed: confirmedLabels(sessionId),
+      // This route renders no phrases; the default of 3 per voice computed and
+      // discarded 48 transcript excerpts on a 16-voice meeting.
+      phrasesPerVoice: 1,
       durationMs: typeof sidecar.durationMs === 'number' ? sidecar.durationMs : undefined,
       batchSegments: Array.isArray(sidecar.batchSegments)
         ? (sidecar.batchSegments as SpeakerWordSegment[])
@@ -835,6 +847,11 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       asserted: v.nameAsserted,
       speakingMs: v.speakingMs,
       share: v.nameAsserted && namedTotal > 0 ? v.speakingMs / namedTotal : null,
+      // WHY the name is asserted, not just that it is. The review has always
+      // carried these and this route dropped them, so the clipboard credited
+      // "voice matching" for the wearer exemption and for names a human typed.
+      isOwner: v.isOwner,
+      confirmedByHuman: v.confirmedByHuman,
     }))
 
     // A missing .md is not fatal — the review and the sidecar still describe the
@@ -845,7 +862,52 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
 
     const date = meetingDate(sidecar.startTime)
     const durationMin = Math.round((review.durationMs || 0) / 60_000)
-    const clip = { title: scribe.title || title, date, durationMin, attendees, scribe }
+    // EXACTLY Control's speakingCoverage: attributed / (attributed + unattributed).
+    // Not attributed/voicedMs — voicedMs is the union of everyone, which would
+    // give a different number and let the clipboard and the panel disagree about
+    // whether a share is trustworthy. Null when there is no voice at all, which
+    // suppresses shares rather than dividing by zero.
+    const coverageDenominator = review.attributedSpeakingMs + review.unattributedSpeakingMs
+    const coverage = coverageDenominator > 0
+      ? review.attributedSpeakingMs / coverageDenominator
+      : null
+    const clip = {
+      title: scribe.title || title,
+      date,
+      durationMin,
+      attendees,
+      scribe,
+      coverage,
+      // The UNION, never the sum of per-voice figures — crosstalk is counted once.
+      unattributedMs: review.unattributedSpeakingMs,
+      voicedMs: review.voicedMs,
+      // The overlap note is gated on how long the meeting RAN. Gating on voiced
+      // time tripped on 16 of 23 real meetings.
+      durationMs: review.durationMs || 0,
+      // Names this human explicitly de-attributed. The ledger has recorded
+      // `proseStale` on every applied de-attribution since the feature shipped and
+      // NOTHING has ever read it: on 2026-08-07 Miles removed "Clem Ukaoma" from a
+      // call that was only him and Queen, all 8 label sites were rewritten, and the
+      // summary still opened "Miles, Queen, and Clem talk through..." with no
+      // indication anywhere in the payload.
+      removed: appliedCorrections(sessionId)
+        .filter(r => isUnattributed(r.to))
+        .map(r => ({ label: r.from, proseStale: r.proseStale === true })),
+      // Which business this is. The sibling /speakers route has always carried
+      // this and this one dropped it, so a personal 1:1 about someone's
+      // compensation was byte-identical to a marketing sync.
+      domain: operations?.domain ?? saved?.domain ?? '',
+      // Transcript actually captured, whether or not a write-up exists yet. 140
+      // of 399 real sidecars have no .md, and the fallback text claimed there was
+      // no transcript while holding one.
+      capturedChars: chunks.reduce(
+        (t, c) => t + (typeof c?.text === 'string' ? c.text.length : 0), 0),
+    }
+
+    // Rendered ONCE. Calling each builder twice to measure its own length meant
+    // two extra full renders per request, transcript included.
+    const summaryText = clipboardSummary(clip)
+    const fullText = clipboardFull(clip)
 
     res.set('Cache-Control', 'private, no-store')
     res.json({
@@ -861,9 +923,23 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       topics: scribe.topics,
       decisions: scribe.decisions,
       actions: scribe.actions,
+      extras: scribe.extras.map(x => ({ heading: x.heading, body: x.body })),
       transcriptChars: scribe.transcript.length,
-      clipboardSummary: clipboardSummary(clip),
-      clipboardFull: clipboardFull(clip),
+      // Captured vs written-up are different facts and the panel needs both:
+      // transcriptChars is 0 for a meeting with 27,442 characters of speech and
+      // no write-up yet.
+      capturedChars: clip.capturedChars,
+      domain: clip.domain,
+      // So the panel can warn above the write-up, not just the clipboard.
+      removedNames: clip.removed,
+      coverage,
+      sharesReported: coverage !== null && coverage >= SHARE_COVERAGE_FLOOR,
+      clipboardSummary: summaryText,
+      clipboardFull: fullText,
+      // Sizes of the ACTUAL strings, so the button label and the copy
+      // confirmation can never quote two different numbers for one click.
+      summaryChars: summaryText.length,
+      fullChars: fullText.length,
     })
   })