@gotcos/glasses-server 6.21.29 → 6.21.31

package/CHANGELOG.md

@@ -1,3 +1,88 @@
+## 6.21.31
+
+Domains belong to the user. Four places in this codebase hardcoded ONE user's
+business units, a fifth pretended to make them configurable, and two of them
+disagreed with each other. A second person set up their own COS on 2026-08-08 and
+nothing she could name would work.
+
+- **New `lib/domains.ts` — one definition of each of these, replacing five.** What
+  it replaced: `['quilt','sprocket_rocket','hermit_crabs','personal']` in the
+  operations lister (used for listing, sidecar lookup, filtering, AND as the
+  path-traversal guard); a hand-written badge table; `domain.slice(0,2)` in the
+  meeting store, which rendered `sprocket_rocket` as "SP" while the lister said
+  "SR"; and `getDomainKeywords()` in `profile.ts`, exported with **zero call
+  sites** — a whole configuration chain built and never connected, which reads as
+  "domains are configurable" to anyone who greps for it.
+
+- **Domains are the UNION of your configuration and what is on disk.** The union
+  is load-bearing, not incidental. Configured with no folder yet: still listed, so
+  a new install can be routed before any folder exists. On disk but unconfigured:
+  still listed, so a folder made by hand never becomes invisible — and that is
+  what makes this change safe for an existing install, whose profile configures
+  nothing and whose folders resolve exactly as before. Nothing is written to any
+  existing profile. Neither: the defaults.
+
+- **Defaults are `personal` and `business`, badged P and B.** Two, not four, and
+  only a genuinely fresh COS ever sees them. Set your own in
+  `.cos-profile.json` — a bare list works (`"domains": ["personal","work"]`), or
+  objects with `keywords` and an `abbr` override.
+
+- **A meeting with no domain from the client is now routed by content.** Keyword
+  scoring over title and transcript, counting DISTINCT matched keywords so one
+  word repeated forty times cannot outvote four different signals, word-boundary
+  matched so "car" does not fire inside "carrier". Deliberately not a model call:
+  this runs on every save. Nothing scoring falls back to `personal`, the safe
+  direction — a work meeting misfiled as personal is a nuisance the user fixes,
+  while a personal conversation filed under a business domain can be pasted into
+  a work channel.
+
+- **A domain name is checked for SAFETY, not style.** The old save-path pattern
+  `/^[a-z][a-z0-9_]{0,31}$/` accepted `sprocket_rocket` and rejected `DNP study`,
+  so a user could select that folder and then never save a meeting into it. The
+  store also lowercased the name, which turned `DNP study` into `dnp study` and
+  matched no directory on disk. Spaces and mixed case are now fine; traversal,
+  control characters and hidden names are still refused.
+
+- **A domain must hold the shape the lister reads.** A `meetings/` folder is no
+  longer enough: it must contain at least one `YYYY-MM` month directory. Measured
+  on a real install, `operations/archive/meetings/` holds domain names rather than
+  months, so a bare directory check listed it as a domain with permanently zero
+  meetings. Structural, so no blocklist of names was needed.
+
+## 6.21.30
+
+- **A name you removed by hand is now stated, and the stale write-up is called
+  out.** De-attribution rewrites the sidecar, the attendee list and the transcript
+  labels, but deliberately leaves narrative prose alone, because substituting into
+  a written sentence mangles grammar and can hit the wrong person. The applied
+  correction row has recorded `proseStale: true` for exactly this since the feature
+  shipped — and NOTHING read it.
+
+  Real case, 2026-08-07: Miles removed "Clem Ukaoma" from a personal call that was
+  only him and Queen (his father's voice matched a similar profile). All 8 label
+  sites were rewritten correctly. The LLM summary still opened "Miles, Queen, and
+  Clem talk through..." and the payload said nothing at all. The allowlist covered
+  it only as "not confirmed", which is far too weak: he did not fail to confirm
+  that person, he explicitly said they were not in the room.
+
+  The payload now carries `removedNames` and states it above the write-up: *"You
+  removed "Clem Ukaoma" from this meeting. The write-up below was written before
+  that and still uses the name: treat every mention of it as a capture error, not
+  a participant."* The prose is left intact — the record stays, the correction
+  travels beside it.
+
+- **The overlap note is gated on how long the meeting RAN, not on voiced time.**
+  Gating on voiced time tripped it on 16 of 23 real meetings, because any overlap
+  at all exceeds the union of voiced speech. At 70% it stopped being a signal and
+  became boilerplate on something pasted into Slack. Rows adding to more than the
+  meeting length is the genuinely confusing case — 71m of rows inside a 66-minute
+  meeting — and that is roughly a tenth of meetings.
+
+  Worth recording for the next person who tests this: only the WORD-TIMING path
+  can overflow. Measured, the chunk-estimate path credits a contested second to
+  one speaker (two speakers at identical timestamps gave MU 273s and Gina 0s), so
+  a chunk-sourced meeting can never trip the note.
+
 ## 6.21.29
 
 Everything below was found by two rounds of adversarial review of 6.21.28 against

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.21.29",
+  "version": "6.21.31",
   "description": "COS Glasses — self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/lib/cos-operations-meetings.ts

@@ -15,16 +15,26 @@
 
 import { closeSync, existsSync, openSync, readdirSync, readFileSync, readSync, statSync } from 'node:fs'
 import { basename, join, resolve } from 'node:path'
+import { discoveredDomains, domainAbbreviation as deriveAbbr, isSafeDomainName as safeName } from './domains.js'
 import type { MeetingDetail, MeetingMeta } from './meeting-store.js'
 import { MEETING_SOURCE_MAX_BYTES } from './meeting-store.js'
 
-export const COS_MEETING_DOMAINS = ['quilt', 'sprocket_rocket', 'hermit_crabs', 'personal'] as const
+/**
+ * The four domains of ONE user's COS. Retained as the documented example layout
+ * and as test material — never as the set this module will accept.
+ */
+export const EXAMPLE_MEETING_DOMAINS = ['quilt', 'sprocket_rocket', 'hermit_crabs', 'personal'] as const
+
+/**
+ * Domain resolution, safe-name checks and badges have exactly ONE definition
+ * each, in `domains.ts`, shared with the meeting store and mirrored by the
+ * Control picker. Re-exported because this module's callers import them.
+ */
+export { domainAbbreviation, isSafeDomainName } from './domains.js'
 
-const DOMAIN_ABBR: Record<string, string> = {
-  quilt: 'Q',
-  sprocket_rocket: 'SR',
-  hermit_crabs: 'HC',
-  personal: 'P',
+/** Immediate subdirectories of `operationsDir` holding a `meetings/` tree. */
+export function discoverMeetingDomains(operationsDir: string): string[] {
+  return discoveredDomains(operationsDir)
 }
 
 const DETAIL_CHUNK_ESTIMATE_CHARS = 1700
@@ -197,7 +207,7 @@ function parseMeetingMeta(content: string, filename: string, domain: string): Co
     date,
     ...(time ? { time } : {}),
     domain,
-    domainAbbr: DOMAIN_ABBR[domain] || '?',
+    domainAbbr: deriveAbbr(domain),
     source,
     duration,
     durationMinutes,
@@ -316,7 +326,7 @@ export function findCosOperationsMeetingBySessionId(sessionId: string): {
   const operationsDir = resolveCosOperationsDir()
   if (!operationsDir) return null
 
-  for (const domain of COS_MEETING_DOMAINS) {
+  for (const domain of discoverMeetingDomains(operationsDir)) {
     const meetingsBase = join(operationsDir, domain, 'meetings')
     let months: string[]
     try {
@@ -363,11 +373,10 @@ export function listCosOperationsMeetings(options: {
 
   const limit = Math.min(Math.max(options.limit ?? 20, 1), 50)
   const domainFilter = options.domain || 'all'
+  const discovered = discoverMeetingDomains(operationsDir)
   const domains = domainFilter === 'all'
-    ? [...COS_MEETING_DOMAINS]
-    : COS_MEETING_DOMAINS.includes(domainFilter as typeof COS_MEETING_DOMAINS[number])
-      ? [domainFilter]
-      : []
+    ? discovered
+    : discovered.includes(domainFilter) ? [domainFilter] : []
 
   const allMeetings: CosOperationsMeetingMeta[] = []
 
@@ -416,7 +425,10 @@ export function getCosOperationsMeetingDetail(
   const operationsDir = resolveCosOperationsDir()
   if (!operationsDir) return null
 
-  if (!(COS_MEETING_DOMAINS as readonly string[]).includes(domain)) return null
+  // Two separate jobs, and the old single membership test conflated them:
+  // traversal safety, then whether this domain actually exists here.
+  if (!safeName(domain)) return null
+  if (!discoverMeetingDomains(operationsDir).includes(domain)) return null
   if (!/^\d{4}-\d{2}$/.test(month) || basename(filename) !== filename || !filename.endsWith('.md')) {
     return null
   }

package/server/lib/domains.ts

@@ -0,0 +1,253 @@
+// Which domains this COS has, and which one a meeting belongs to.
+//
+// WHY THIS FILE EXISTS. Four places independently hardcoded ONE user's business
+// domains, and a fifth pretended to make them configurable:
+//
+//   cos-operations-meetings.ts  ['quilt','sprocket_rocket','hermit_crabs','personal']
+//   cos-control-macos           the same four, in the folder-picker validator
+//   cos-glasses-app             two abbreviation maps (display-pages.ts:843, :1104)
+//   meeting-store.ts            domain.slice(0,2), which renders sprocket_rocket "SP"
+//   profile.ts                  getDomainKeywords() — exported, ZERO call sites
+//
+// The two abbreviation schemes already disagreed with each other, and
+// getDomainKeywords was a whole configuration chain built and never connected —
+// which reads as "domains are configurable" to anyone who greps for it.
+//
+// A second person set up their own COS on 2026-08-08. Nothing she could name
+// would work: the picker demanded a `quilt/` tree, and a domain like `DNP study`
+// was rejected on save by a pattern permitting only lowercase and underscores.
+
+import { existsSync, readdirSync, statSync } from 'node:fs'
+import { join } from 'node:path'
+import { loadProfileObject } from './profile.js'
+
+/**
+ * Defaults for a COS that has never been configured and has no folders yet.
+ *
+ * Two, not four. `personal` and `business` are the split almost everyone has, and
+ * the alternative — shipping the author's own business units — is what created
+ * this file.
+ */
+export const DEFAULT_DOMAINS = ['personal', 'business'] as const
+
+/**
+ * The domain a meeting falls back to when nothing else decides.
+ *
+ * `personal` on purpose, and it is the SAFE direction: a work meeting filed under
+ * personal is a misfiling the user notices and fixes, while a personal
+ * conversation filed under a business domain can end up pasted into a work
+ * channel. Matches the standing correction that G2 recordings default to personal
+ * and get reclassified by content.
+ */
+export const FALLBACK_DOMAIN = 'personal'
+
+/** Keyword seeds for the two defaults, used only when the user has set none. */
+const DEFAULT_KEYWORDS: Record<string, string[]> = {
+  business: [
+    'client', 'customer', 'revenue', 'pipeline', 'roadmap', 'sprint', 'standup',
+    'quarter', 'invoice', 'proposal', 'stakeholder', 'deadline', 'launch',
+    'budget', 'campaign', 'hiring', 'onboarding', 'contract', 'vendor', 'demo',
+  ],
+  personal: [
+    'family', 'kids', 'wife', 'husband', 'partner', 'doctor', 'dentist',
+    'school', 'vacation', 'holiday', 'dinner', 'birthday', 'weekend', 'church',
+    'grocery', 'house', 'insurance', 'therapy', 'workout', 'anniversary',
+  ],
+}
+
+export interface DomainConfig {
+  name: string
+  /** Badge override. Derived when absent. */
+  abbr?: string
+  /** Words that route a meeting here. Case-insensitive, word-boundary matched. */
+  keywords?: string[]
+}
+
+/**
+ * Is this name safe as a path component AND as a domain label?
+ *
+ * A safety check, not a naming policy. Permits spaces and mixed case, because
+ * `DNP study` is a real domain and the previous pattern (`^[a-z][a-z0-9_]{0,31}$`)
+ * silently encoded one author's snake_case habit as a requirement — it accepted
+ * `sprocket_rocket` and rejected `DNP study`.
+ */
+export function isSafeDomainName(name: string): boolean {
+  if (!name || name.length > 64) return false
+  if (name !== name.trim()) return false
+  if (name === '.' || name === '..' || name.startsWith('.')) return false
+  if (/[/\\\0]/.test(name)) return false
+  // Control characters would corrupt a path or a markdown header.
+  if (/[\x00-\x1f\x7f]/.test(name)) return false
+  return true
+}
+
+/** The user's configured domains, or [] when unset. Malformed entries dropped. */
+export function configuredDomains(): DomainConfig[] {
+  const raw = loadProfileObject().domains
+  if (!Array.isArray(raw)) return []
+  const out: DomainConfig[] = []
+  const seen = new Set<string>()
+  for (const entry of raw) {
+    // A bare string is accepted: `"domains": ["personal", "work"]` is the
+    // shortest thing a user will reach for, and rejecting it would be hostile.
+    const name = typeof entry === 'string'
+      ? entry
+      : (entry && typeof entry === 'object' && typeof (entry as DomainConfig).name === 'string')
+        ? (entry as DomainConfig).name
+        : ''
+    const trimmed = name.trim()
+    if (!isSafeDomainName(trimmed) || seen.has(trimmed.toLowerCase())) continue
+    seen.add(trimmed.toLowerCase())
+    const obj: Partial<DomainConfig> =
+      (entry && typeof entry === 'object') ? entry as Partial<DomainConfig> : {}
+    out.push({
+      name: trimmed,
+      ...(typeof obj.abbr === 'string' && obj.abbr.trim() ? { abbr: obj.abbr.trim().slice(0, 4) } : {}),
+      ...(Array.isArray(obj.keywords)
+        ? { keywords: obj.keywords.filter((k): k is string => typeof k === 'string' && !!k.trim()) }
+        : {}),
+    })
+  }
+  return out
+}
+
+/** Immediate subdirectories of `operationsDir` holding a `meetings/` tree. */
+export function discoveredDomains(operationsDir: string | null): string[] {
+  if (!operationsDir || !existsSync(operationsDir)) return []
+  let names: string[]
+  try {
+    names = readdirSync(operationsDir, { withFileTypes: true })
+      .filter(e => e.isDirectory()).map(e => e.name)
+  } catch { return [] }
+  return names.filter(isSafeDomainName).filter(name => {
+    const meetings = join(operationsDir, name, 'meetings')
+    try { if (!statSync(meetings).isDirectory()) return false } catch { return false }
+    // A `meetings/` folder is not enough: it must hold at least one YYYY-MM month
+    // directory, which is the only shape the lister reads. Measured on a real
+    // install, `operations/archive/meetings/` contains domain names rather than
+    // months, so accepting any `meetings/` folder listed it as a domain with
+    // permanently zero meetings. Structural, so it needs no blocklist of names.
+    try {
+      return readdirSync(meetings, { withFileTypes: true })
+        .some(e => e.isDirectory() && /^\d{4}-\d{2}$/.test(e.name))
+    } catch { return false }
+  }).sort()
+}
+
+/**
+ * Every domain this COS has, as a UNION of configuration and what is on disk.
+ *
+ * A union rather than a replacement, and the distinction is load-bearing:
+ *
+ *  - Configured but no folder yet: still listed, so a brand-new user can be
+ *    ROUTED before any folder exists.
+ *  - On disk but not configured: still listed, so a folder someone made by hand
+ *    never becomes invisible. This is also what protects an existing install —
+ *    Miles has no `domains` in his profile, discovery finds his four, and the
+ *    union is exactly his four. Nothing is written to his profile and nothing
+ *    about his setup changes.
+ *  - Neither: the DEFAULTS. Only a genuinely fresh COS ever sees them, which is
+ *    why defaulting to two is safe.
+ *
+ * Configured order is preserved and comes first; discovered extras follow,
+ * sorted, so the list is stable across calls.
+ */
+export function resolveDomains(operationsDir: string | null): DomainConfig[] {
+  const configured = configuredDomains()
+  const discovered = discoveredDomains(operationsDir)
+  if (configured.length === 0 && discovered.length === 0) {
+    return DEFAULT_DOMAINS.map(name => ({ name, keywords: DEFAULT_KEYWORDS[name] }))
+  }
+  const known = new Set(configured.map(d => d.name.toLowerCase()))
+  return [
+    ...configured,
+    ...discovered.filter(name => !known.has(name.toLowerCase())).map(name => ({ name })),
+  ]
+}
+
+/** Just the names, in resolved order. */
+export function domainNames(operationsDir: string | null): string[] {
+  return resolveDomains(operationsDir).map(d => d.name)
+}
+
+/**
+ * Short badge for a domain.
+ *
+ * An explicit `abbr` wins; otherwise initials of up to two words. Derivation
+ * reproduces the old hand-written table exactly — quilt Q, personal P,
+ * hermit_crabs HC, sprocket_rocket SR — which is why that table is gone. The old
+ * `meeting-store` version used `slice(0,2)` and rendered sprocket_rocket "SP", so
+ * the two schemes in this codebase disagreed with each other.
+ */
+export function domainAbbreviation(domain: string, config?: DomainConfig[]): string {
+  const hit = config?.find(d => d.name.toLowerCase() === domain.toLowerCase())
+  if (hit?.abbr) return hit.abbr
+  const words = domain.split(/[^\p{L}\p{N}]+/u).filter(Boolean)
+  if (words.length === 0) return '?'
+  // A short single word IS its own badge: the companion uses the short forms `sr`
+  // and `hc`, and taking a first initial would render them "S" and "H".
+  if (words.length === 1 && words[0].length <= 3) return words[0].toUpperCase()
+  return words.slice(0, 2).map(w => w[0].toUpperCase()).join('')
+}
+
+/**
+ * Which domain does this meeting belong to?
+ *
+ * Keyword scoring over the title and body, highest score wins. Deliberately NOT
+ * an LLM call: this runs on every save, and a per-meeting model call would breach
+ * the standing rule that every recurring LLM caller must justify its volume.
+ *
+ * Scoring counts DISTINCT matched keywords rather than total occurrences, so one
+ * word repeated forty times cannot outvote four different signals. Word-boundary
+ * matched, so "car" does not fire inside "carrier".
+ *
+ * Returns null when nothing scores, rather than picking. The caller decides, and
+ * an unscored meeting must not be asserted into a business domain by accident.
+ */
+export function classifyDomain(
+  text: string,
+  domains: DomainConfig[],
+): { domain: string; score: number; matched: string[] } | null {
+  const haystack = text.toLowerCase()
+  if (!haystack.trim()) return null
+  let best: { domain: string; score: number; matched: string[] } | null = null
+  for (const d of domains) {
+    const keywords = d.keywords?.length ? d.keywords : DEFAULT_KEYWORDS[d.name.toLowerCase()] ?? []
+    const matched: string[] = []
+    for (const kw of keywords) {
+      const needle = kw.toLowerCase().trim()
+      if (!needle) continue
+      const escaped = needle.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+      if (new RegExp(`(^|[^\\p{L}\\p{N}])${escaped}([^\\p{L}\\p{N}]|$)`, 'u').test(haystack)) {
+        matched.push(needle)
+      }
+    }
+    // Strictly greater, so the FIRST domain in resolved order wins a tie. Ties are
+    // then deterministic and under the user's control via ordering.
+    if (matched.length > 0 && (!best || matched.length > best.score)) {
+      best = { domain: d.name, score: matched.length, matched }
+    }
+  }
+  return best
+}
+
+/**
+ * The domain to file a meeting under: the client's choice, else inference, else
+ * the safe fallback.
+ *
+ * The fallback prefers a domain the user actually has — `personal` when present,
+ * otherwise the first resolved domain — so a COS with no `personal` domain does
+ * not have one invented for it.
+ */
+export function domainForMeeting(
+  explicit: string | undefined,
+  text: string,
+  operationsDir: string | null,
+): string {
+  const domains = resolveDomains(operationsDir)
+  if (explicit && explicit.trim() && isSafeDomainName(explicit.trim())) return explicit.trim()
+  const inferred = classifyDomain(text, domains)
+  if (inferred) return inferred.domain
+  const personal = domains.find(d => d.name.toLowerCase() === FALLBACK_DOMAIN)
+  return personal?.name ?? domains[0]?.name ?? FALLBACK_DOMAIN
+}

package/server/lib/meeting-scribe-content.ts

@@ -314,10 +314,19 @@ export interface AttendeeRenderOptions {
    */
   unattributedMs: number
   /**
-   * UNION of all voiced time. Used only to detect that the rows overlap — see
-   * the crosstalk note in `renderAttendees`. 0 disables the check.
+   * UNION of all voiced time. Only used to phrase the crosstalk note.
    */
   voicedMs: number
+  /**
+   * How long the meeting RAN. This is what the overlap note is gated on.
+   *
+   * Gating on `voicedMs` instead tripped on 16 of 23 real meetings, because any
+   * overlap at all exceeds the union of voiced time — at 70% the line stops being
+   * a signal and becomes boilerplate on something Miles pastes into Slack. Rows
+   * adding to more than the meeting LENGTH is the genuinely confusing case (71m
+   * of rows inside a 66-minute meeting), and that is ~10% of meetings.
+   */
+  durationMs: number
 }
 
 /** The attendee block, floor-applied. */
@@ -348,9 +357,9 @@ export function renderAttendees(voices: AttendeeLine[], o: AttendeeRenderOptions
   // right; adding them is what misleads, so say so rather than shrink anyone.
   const rowTotal = named.reduce((t, v) => t + (Number.isFinite(v.speakingMs) ? v.speakingMs : 0), 0) +
     (rest.length > 0 && Number.isFinite(o.unattributedMs) ? o.unattributedMs : 0)
-  if (o.voicedMs > 0 && rowTotal > o.voicedMs * 1.02) {
-    out.push(`- (these overlap: people talked over each other, so the rows add to ` +
-             `more than the ${mmss(o.voicedMs)} of talking)`)
+  if (o.durationMs > 0 && rowTotal > o.durationMs * 1.02) {
+    out.push(`- (these overlap: people talked over each other, so the rows add up to ` +
+             `more than the ${mmss(o.durationMs)} the meeting ran)`)
   }
   return out.length > 0 ? out.join('\n') : '- (no voices identified)'
 }
@@ -363,7 +372,32 @@ export function renderAttendees(voices: AttendeeLine[], o: AttendeeRenderOptions
  * into a model has no other way to tell which. Naming the confirmed set is short
  * and complete.
  */
-export function renderProvenance(voices: AttendeeLine[], coverage: number | null): string {
+/**
+ * Names a human explicitly REMOVED from this meeting, still present in the prose.
+ *
+ * De-attribution rewrites the sidecar, the attendee list and the transcript
+ * labels, but deliberately leaves narrative prose alone — substituting into a
+ * written sentence mangles grammar and can hit the wrong person. So the applied
+ * correction row records `proseStale: true` and, until now, NOTHING read it.
+ *
+ * Real case, 2026-08-07: Miles removed "Clem Ukaoma" from a personal call that
+ * was only him and Queen (his father's voice matched a similar profile). All 8
+ * label sites were rewritten correctly; the LLM summary still opened "Miles,
+ * Queen, and Clem talk through..." and the payload said nothing. An allowlist
+ * ("this name was not confirmed") is far too weak here — he did not fail to
+ * confirm this person, he explicitly said they were not in the room.
+ */
+export interface RemovedName {
+  label: string
+  /** True when narrative prose still carries the name. */
+  proseStale: boolean
+}
+
+export function renderProvenance(
+  voices: AttendeeLine[],
+  coverage: number | null,
+  removed: RemovedName[] = [],
+): string {
   const named = voices.filter(v => v.asserted)
   // Quoted because a label may legitimately contain a comma — `invalidLabelReason`
   // rejects brackets and newlines but not commas, and a typed "Smith, John" would
@@ -384,6 +418,20 @@ export function renderProvenance(voices: AttendeeLine[], coverage: number | null
     'comes from the raw capture or the write-up and was NOT confirmed. Some may be ' +
     'people mentioned rather than people present.',
   ]
+  // Before the coverage caveat: an explicit human removal outranks every other
+  // statement in this block, and it must not read as one more hedge.
+  const stale = removed.filter(r => r.proseStale).map(r => `"${r.label}"`)
+  const quiet = removed.filter(r => !r.proseStale).map(r => `"${r.label}"`)
+  if (stale.length > 0) {
+    lines.push(
+      `You removed ${stale.join(', ')} from this meeting. The write-up below was ` +
+      'written before that and still uses the name: treat every mention of it as a ' +
+      'capture error, not a participant.',
+    )
+  }
+  if (quiet.length > 0) {
+    lines.push(`You also removed ${quiet.join(', ')} from this meeting.`)
+  }
   if (coverage !== null && coverage < SHARE_COVERAGE_FLOOR) {
     lines.push(
       `Only ${Math.round(coverage * 100)}% of the voice in this meeting was ` +
@@ -411,6 +459,10 @@ export interface ClipboardInput {
   capturedChars: number
   /** UNION of voiced time, for the crosstalk-overflow note. */
   voicedMs: number
+  /** How long the meeting ran. Gates the crosstalk-overflow note. */
+  durationMs: number
+  /** Names a human explicitly de-attributed from this meeting. */
+  removed: RemovedName[]
   title: string
   date: string
   durationMin: number
@@ -445,9 +497,10 @@ function header(i: ClipboardInput, compact: boolean): string[] {
   parts.push(
     '', '## Who spoke',
     renderAttendees(i.attendees, {
-      coverage: i.coverage, unattributedMs: i.unattributedMs, voicedMs: i.voicedMs,
+      coverage: i.coverage, unattributedMs: i.unattributedMs,
+      voicedMs: i.voicedMs, durationMs: i.durationMs,
     }),
-    '', renderProvenance(i.attendees, i.coverage),
+    '', renderProvenance(i.attendees, i.coverage, i.removed),
   )
   for (const [heading, body] of [
     ['Summary', i.scribe.summary],

package/server/lib/meeting-store.ts

@@ -17,6 +17,7 @@ import { createHash } from 'node:crypto'
 import { basename, dirname, join, resolve, sep } from 'node:path'
 import { durableAtomicWriteFileSync } from './atomic-fs.js'
 import { dataPath } from './data-dir.js'
+import { FALLBACK_DOMAIN, domainAbbreviation, isSafeDomainName } from './domains.js'
 import type {
   ProviderCandidateRecord,
   IndexedTranscriptChunk,
@@ -128,9 +129,16 @@ function normalizeSessionId(value: string): string {
   return value
 }
 
+/**
+ * Trim, validate, and PRESERVE CASE.
+ *
+ * Lowercasing was silently destructive: a domain folder named `DNP study` became
+ * `dnp study`, which then matched no directory on disk. Existing all-lowercase
+ * domains are unaffected.
+ */
 function normalizeDomain(value?: string): string {
-  const domain = (value || 'personal').trim().toLowerCase()
-  if (!DOMAIN_PATTERN.test(domain)) {
+  const domain = (value || FALLBACK_DOMAIN).trim()
+  if (!isSafeDomainName(domain)) {
     throw new MeetingStoreError('Invalid domain', 400, 'invalid_domain')
   }
   return domain
@@ -272,7 +280,7 @@ function parseDurationMinutes(duration: string): number | undefined {
 function parseMeeting(content: string, filename: string, month: string): MeetingDetail {
   const heading = content.match(/^#\s+(.+)$/m)?.[1]?.trim()
   const date = parseField(content, 'Date') || filename.match(/^(\d{4}-\d{2}-\d{2})/)?.[1] || 'unknown'
-  const domain = parseField(content, 'Domain') || 'personal'
+  const domain = parseField(content, 'Domain') || FALLBACK_DOMAIN
   const duration = parseField(content, 'Duration')
   const transcript = extractSection(content, ['Transcript'], true)
   const storedSummary = extractSection(content, ['Summary'])
@@ -293,7 +301,10 @@ function parseMeeting(content: string, filename: string, month: string): Meeting
     title: heading || basename(filename, '.md').split('_').slice(1).join(' ') || 'Untitled Meeting',
     date,
     domain,
-    domainAbbr: domain === 'personal' ? 'P' : domain.slice(0, 2).toUpperCase() || '?',
+    // Shared derivation. This was slice(0,2), which rendered sprocket_rocket as
+    // "SP" while cos-operations-meetings rendered it "SR" — two schemes in one
+    // codebase, disagreeing with each other.
+    domainAbbr: domainAbbreviation(domain),
     source: parseField(content, 'Source'),
     duration,
     ...(parseDurationMinutes(duration) !== undefined ? { durationMinutes: parseDurationMinutes(duration) } : {}),
@@ -535,7 +546,7 @@ export class MeetingStore {
   list(options: { limit?: number; domain?: string } = {}): MeetingMeta[] {
     const limit = Math.max(1, Math.min(50, Math.trunc(options.limit ?? 20)))
     const domain = options.domain ?? 'all'
-    if (domain !== 'all' && !DOMAIN_PATTERN.test(domain)) {
+    if (domain !== 'all' && !isSafeDomainName(domain)) {
       throw new MeetingStoreError('Invalid domain filter', 400, 'invalid_domain')
     }
     const rootReal = this.existingRootRealpath()
@@ -565,7 +576,7 @@ export class MeetingStore {
   }
 
   detail(domain: string, month: string, filename: string): MeetingDetail {
-    if (!DOMAIN_PATTERN.test(domain)) {
+    if (!isSafeDomainName(domain)) {
       throw new MeetingStoreError('Invalid domain', 400, 'invalid_domain')
     }
     if (!MONTH_PATTERN.test(month)) {

package/server/lib/profile.ts

@@ -41,6 +41,15 @@ function profilePath(): string {
 
 let profileCache: Record<string, unknown> | null = null
 
+/**
+ * The whole profile object, for callers that need a key this module has no
+ * dedicated accessor for. Read-only by convention — mutate via
+ * updateProfileFields so the atomic write and cache-bust chain still applies.
+ */
+export function loadProfileObject(): Record<string, unknown> {
+  return loadProfile()
+}
+
 function loadProfile(): Record<string, unknown> {
   if (profileCache) return profileCache
   try {

package/server/routes/meeting.ts

@@ -8,7 +8,7 @@ import { Router } from 'express'
 import { emitDisplay } from '../lib/display-bus.js'
 import { cleanTranscriptLines } from '../lib/hallucination-filter.js'
 import { durableAtomicWriteFileSync } from '../lib/atomic-fs.js'
-import { appendCorrection, pendingCorrections } from '../lib/meeting-corrections.js'
+import { appendCorrection, appliedCorrections, pendingCorrections } from '../lib/meeting-corrections.js'
 import { isSampleFromSession, untraceableSampleCount } from '../lib/training-audio-provenance.js'
 import { sendAudioFile } from '../lib/send-audio.js'
 import { chunkDiagnostics } from '../lib/chunk-embedding-diagnostics.js'
@@ -111,7 +111,9 @@ import { getServerInstanceId } from '../lib/server-instance-id.js'
 import {
   cosOperationsMeetingsConfigured,
   findCosOperationsMeetingBySessionId,
+  resolveCosOperationsDir,
 } from '../lib/cos-operations-meetings.js'
+import { domainForMeeting, resolveDomains } from '../lib/domains.js'
 import { getOwnerSpeakerLabel } from '../lib/profile.js'
 import {
   DEATTRIBUTED_PREFIX,
@@ -560,10 +562,19 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
 
       // Initial canonical text + structured metadata are published before any
       // live state is removed or background work is scheduled.
+      // The client's choice wins. When it sends none — the normal case for a G2
+      // save — infer from the content instead of filing everything under one
+      // domain. Keyword scoring, no model call: this runs on every save, and a
+      // per-meeting LLM call would breach the recurring-caller rule.
+      const filedDomain = domainForMeeting(
+        body?.domain as string | undefined,
+        `${(body?.title as string | undefined) ?? ''}\n${transcript}`,
+        resolveCosOperationsDir(),
+      )
       const saved = store.save({
         sessionId,
         title: body?.title as string | undefined,
-        domain: body?.domain as string | undefined,
+        domain: filedDomain,
         transcript: cleanFinalTranscript(transcript),
         startTime,
         durationMs,
@@ -880,10 +891,19 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       coverage,
       // The UNION, never the sum of per-voice figures — crosstalk is counted once.
       unattributedMs: review.unattributedSpeakingMs,
-      // Union of ALL voiced time. Only used to notice that the per-voice rows add
-      // to more than the meeting, which happens whenever people talk over
-      // each other — 34 of 323 real meetings.
       voicedMs: review.voicedMs,
+      // The overlap note is gated on how long the meeting RAN. Gating on voiced
+      // time tripped on 16 of 23 real meetings.
+      durationMs: review.durationMs || 0,
+      // Names this human explicitly de-attributed. The ledger has recorded
+      // `proseStale` on every applied de-attribution since the feature shipped and
+      // NOTHING has ever read it: on 2026-08-07 Miles removed "Clem Ukaoma" from a
+      // call that was only him and Queen, all 8 label sites were rewritten, and the
+      // summary still opened "Miles, Queen, and Clem talk through..." with no
+      // indication anywhere in the payload.
+      removed: appliedCorrections(sessionId)
+        .filter(r => isUnattributed(r.to))
+        .map(r => ({ label: r.from, proseStale: r.proseStale === true })),
       // Which business this is. The sibling /speakers route has always carried
       // this and this one dropped it, so a personal 1:1 about someone's
       // compensation was byte-identical to a marketing sync.
@@ -921,6 +941,8 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       // no write-up yet.
       capturedChars: clip.capturedChars,
       domain: clip.domain,
+      // So the panel can warn above the write-up, not just the clipboard.
+      removedNames: clip.removed,
       coverage,
       sharesReported: coverage !== null && coverage >= SHARE_COVERAGE_FLOOR,
       clipboardSummary: summaryText,
@@ -1659,7 +1681,11 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       const saved = store.save({
         sessionId,
         title: typeof body.title === 'string' && body.title.trim() ? body.title : undefined,
-        domain: typeof body.domain === 'string' && body.domain.trim() ? body.domain : undefined,
+        domain: domainForMeeting(
+          typeof body.domain === 'string' && body.domain.trim() ? body.domain : undefined,
+          `${typeof body.title === 'string' ? body.title : ''}\n${transcript}`,
+          resolveCosOperationsDir(),
+        ),
         transcript,
         startTime: capture.startTime,
         durationMs: capture.durationMs,