@gotcos/glasses-server 6.36.27 → 6.37.0

package/.env.example

@@ -177,6 +177,23 @@ BIND_HOST=0.0.0.0
 # deliberately independent from the progressive-HQ compute switch.
 # COS_MEETING_EARLY_SYNC=1
 
+# ── Standalone meeting summaries ──────────────────────────────────────────────
+# Generate summary / topics / decisions / action items for meetings recorded
+# WITHOUT the COS operations pipeline (no COS_SCRIPTS_DIR). Spawns one
+# `claude -p --model haiku` per meeting, at the end of finalization.
+#
+# Default OFF. With it off you still get the deterministic tier — speakers,
+# talk-time, word count, opening excerpt — which costs nothing and always runs.
+#
+# Never runs when COS_SCRIPTS_DIR is set: overwriting the summary section would
+# erase the markers sync_meetings.py uses to decide what to process.
+# COS_MEETING_SUMMARY=1
+#
+# Calls per local day before the summariser falls back to the deterministic
+# tier for the rest of the day. Default 40.
+# COS_MEETING_SUMMARY_DAILY_CAP=40
+
+
 # ── RETAINED MEETING-AUDIO PLAYBACK CLEANUP (6.21.32 canary) ────────────
 # Default OFF. When enabled, the first authenticated Play of a retained raw
 # meeting chunk creates a cached, adaptive cleanup copy. Raw WAV evidence stays

package/CHANGELOG.md

@@ -1,3 +1,166 @@
+## 6.37.0
+
+Meetings recorded without the COS operations pipeline now get a real summary,
+topics, decisions and action items. Until now they got none of that, and the
+server compensated by returning the TRANSCRIPT in the summary slot -- which is
+why this was reported as "no proper summary and transcription."
+
+FEATURE DEFAULTS NOW ON (Miles 2026-08-25)
+
+Ship the capability active; users opt out of what they do not need. Each gate
+stays strict in the other direction -- only a literal '0' disables, so a stray
+or malformed value cannot silently switch a feature off.
+
+  COS_THREAD_ATTACH_ENABLED            Continue agent threads
+  COS_VIDEO_UPLOAD_V2                  Reliable video uploads
+  COS_MEETING_AUDIO_ADAPTIVE_PLAYBACK  Adaptive audio cleanup
+
+COS_WHISPER_MEETING_PREVIEW (Meeting Turbo preview) was ALREADY on by default
+server-side; COS Control mis-renders its checkbox as off because it resolves
+the value as == "1" rather than != "0". That is a Control display bug, not a
+server default, and is not fixed here.
+
+Idle Metal HQ (COS_BATCH_HQ_METAL) is deliberately unchanged -- it is
+hardware-dependent and stays opt-in.
+
+Two consequences worth knowing. An in-flight video upload sets blocksRestart,
+so a drain caught mid-upload waits for it -- that is the contract, not a stuck
+gate, and must never be --forced. Adaptive playback affects review playback
+only; the raw WAV is untouched, and transcript, attribution, save and sync are
+unchanged.
+
+VOICE ENROLMENT
+
+"enroll my voice" followed by more speech created a profile NAMED with the
+entire spoken utterance -- a ~40-second transcript. Reported by a first-time
+user. Because a junk name never equals owner_speaker_label,
+/api/voice/status reported `enrolled: false` no matter how many times you
+enrolled, and editing voice-profiles.json by hand did not help because the
+server rewrites it from memory.
+
+Root cause was client-side: a $-anchored command regex fell through to the
+named-enrolment branch, whose capture group had no length bound. Fixed in
+COS Glasses 6.8.433.
+
+POST /api/voice/enroll now validates ?name= as well, so an OLD client cannot
+write a sentence into the profile store: at most 40 characters, at most 4
+words, letters/spaces/hyphens/apostrophes only, no sentence punctuation, and
+no self-referential phrasing. The wearer's own label is always accepted --
+including the default "Me", which is itself self-referential and would
+otherwise have been rejected by its own guard.
+
+WHAT CHANGED
+
+meeting-store parseMeeting no longer substitutes the transcript into `summary`.
+A standalone placeholder now yields an empty summary, and the transcript is
+carried in its own `transcript` field, which the reader renders as its own
+section (requires COS Glasses 6.8.433). estimatedDetailPages now counts the
+transcript, so a list row no longer advertises ~1p for a meeting that paginates
+to many.
+
+Two enrichment tiers, both standalone-only:
+
+  extractive  always on, zero tokens -- duration, word count, speaker roster
+              with talk-time split, opening excerpt. Fabricates nothing:
+              topics/decisions/actions come back empty rather than guessed.
+
+  llm         COS_MEETING_SUMMARY=1, default OFF. One `claude -p --model haiku`
+              per meeting at the ops_pending phase of finalization.
+
+It runs at ops_pending specifically because batch HQ transcription replaces the
+whole transcript; summarising earlier would describe text the file no longer
+contains. Every generated section is inserted BEFORE `## Transcript`, because
+replaceMeetingTranscriptAtomic replaces from that marker to end of file.
+
+NEVER RUNS FOR OPERATIONS USERS, and refuses twice: the caller gates on
+cosOpsPipelineConfigured(), and the writer independently refuses any file
+carrying the sync_meetings.py markers. Overwriting the summary section would
+erase them and the pipeline would skip the meeting entirely -- losing domain
+reclassification, task extraction and the operations copy.
+
+COST CONTROLS
+  - COS_MEETING_SUMMARY, read live (not frozen at module load)
+  - haiku pinned explicitly, so it can never inherit an Opus session default
+  - own daily cap (COS_MEETING_SUMMARY_DAILY_CAP, default 40), never shared
+    with the archive counter; committed only after a validated summary, so a
+    failure, auth refusal or malformed reply costs nothing
+  - circuit breaker with its own failure accounting
+  - single-slot queue, so a boot replay cannot spawn one provider per meeting
+  - wall budget anchored to the finalization job start, keeping batch decode +
+    summariser + handoff under COS Control's 90s waitForRestartProof
+  - minimum word floor; head+tail input bound, never head-only
+  - surfaced on /api/health as meeting_summary
+
+An unauthenticated CLI exits ZERO with a success-shaped payload carrying the
+bearer token. The result is screened with terminalProviderAuthFailure before
+anything is written, so a 401 can never be persisted into a meeting file.
+
+Generated prose never attributes statements to a speaker, and diarisation
+labels ("Speaker 2", "Ext", "MU") are stripped from action-item owners -- the
+speaker-review flow deliberately never rewrites these sections, so a label
+captured here would stay wrong permanently.
+
+A standalone save with no audio now schedules a finalization pass too; before
+this it was nulled and never reached ops_pending. Orphan recovery, which has
+its own path, enriches as well.
+
+## 6.36.28
+
+THE bug. Three earlier fixes tonight were each real and none was this one.
+
+Every segment of a reply is minted at /prepare with a 120s idle deadline that
+starts AT MINT. But the client only touches segment k when segment k-1 starts
+playing. Measured on device, 6,781 chars at 1.25x:
+
+    seg 4   first touched t+101s   played
+    seg 5   first touched t+147s   FAILED
+    seg 6   first touched t+215s   FAILED
+    seg 7   never reached          FAILED
+
+Segment 5 was deleted 27s before the client first asked for it. Reproduced with
+curl against the running server, replaying the exact timeline: HTTP 404 at
+segment 5, t+216s. The 404 reaches the audio element as NotSupportedError at
+readyState 0 -- identical to every other media failure, which is why a char cap,
+a wider idle window and a render gate all left playback stopping at segment 5.
+
+WHAT CHANGED
+
+- An unread session gets a grace window DERIVED from how long the whole reply
+  takes to speak, plus one segment of margin (the last segment is first touched
+  when the second-to-last starts playing).
+- A read may only ever EXTEND a deadline, never shorten one. This is not
+  cosmetic: the client warms segment k one whole segment before playing it, so
+  collapsing the grace on that first read SPENT it. At 0.5x a 900-char segment
+  is 170s of wall time against a 120s window, and the reply lost segment 1 while
+  holding a 1,476s grace. Found by QA, after the first version of this fix.
+- SESSION_IDLE_MS and SESSION_MAX_LIFETIME_MS are now COMPUTED from shared
+  constants rather than written down. Both were derived from ~19 chars/sec, the
+  FAST voice, and this release is the one that measured the slow voice at 10.
+  Leaving them meant the file asserted two contradictory worst cases:
+    idle     900 / 10 / 0.5  =  180s   against a 120s window
+    ceiling  40,000 / 10 / 0.5 = 133 min against a 90 min ceiling
+  The ceiling had also started silently truncating the grace for any reply over
+  ~26,400 chars, relocating the same failure to roughly segment 31 of 46.
+- MAX_LOCAL_TTS_CHARS, LATER_CHUNK_CHARS, the speech rate and the minimum
+  playback rate now live in one place and are imported by the tests that used to
+  restate them. That duplication is why the contradiction above was invisible.
+- /play now logs the 404 it produces. The server held this fact all evening and
+  recorded nothing, so the only reporter was a fire-and-forget client call.
+- CORS exposes Content-Range and Accept-Ranges, without which the client's
+  failure probe reads them as null from the null-origin companion WebView.
+
+SECURITY, stated plainly rather than buried
+
+An unread capability now lives far longer than 120 seconds -- up to the ceiling,
+which is 136 minutes. That is a real widening and it is the price of playing a
+40,000-character reply, which genuinely takes over two hours at 0.5x. What is
+unchanged: the ceiling is absolute, reading cannot extend a capability past the
+grace it was minted with, and an unread capability still expires on its own.
+Both properties are pinned and both mutate red.
+
+216 files, 3047 tests in scope (218 / 3053 including a parallel session's two
+files, which are not part of this release).
+
 ## 6.36.27
 
 The sidecar renders one request at a time. The server finally acts like it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.36.27",
+  "version": "6.37.0",
   "description": "COS Glasses — self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -172,6 +172,12 @@ app.use(cors({
     if (isAllowedNetworkOrigin(origin)) return cb(null, true)
     cb(new Error('CORS blocked'))
   },
+  // Without this, a cross-origin reader sees only the CORS-safelisted response
+  // headers. The companion's origin is `null` (a file:// WebView), so it is
+  // cross-origin by definition, and the TTS failure probe would log
+  // contentRange/acceptRanges as null on every single call -- leading the next
+  // reader to conclude the server had stopped sending Range headers.
+  exposedHeaders: ['Content-Range', 'Accept-Ranges'],
 }))
 // Auth middleware — always active (token is auto-generated if not set).
 // Mounted before body parsers so rejected uploads cannot consume parse memory.

package/server/lib/adaptive-playback-audio.ts

@@ -159,7 +159,10 @@ export function analyzePlaybackWav(buffer: Buffer): AudioSignalProfile | null {
 
 export function adaptivePlaybackEnabled(): boolean {
   // Private canary: explicit opt-in, explicit 0 rollback through COS Control.
-  return process.env.COS_MEETING_AUDIO_ADAPTIVE_PLAYBACK === '1'
+  // Default ON since 6.37.0 (Miles 2026-08-25). Absent key = on; only a
+  // literal '0' disables. Raw WAV is untouched either way — this affects
+  // review playback only, never the transcript, attribution, save or sync.
+  return process.env.COS_MEETING_AUDIO_ADAPTIVE_PLAYBACK !== '0'
 }
 
 function outputPathFor(rawPath: string): string | null {

package/server/lib/even-hub-speaker-role.ts

@@ -0,0 +1,116 @@
+// Even Hub 0.0.14 wearer-vs-other histogram, carried on a meeting chunk.
+// Identity is a suggestion. This module parses and logs. It does not name
+// people and does not change identifyChunkSpeaker.
+
+export type EvenSpeakerRole = 'self' | 'other' | 'unknown'
+export type EvenSpeakerRoleMajority = EvenSpeakerRole | 'tie'
+
+export interface EvenSpeakerRoleHistogram {
+  schema: 1
+  frames: number
+  self: number
+  other: number
+  unknown: number
+  majority: EvenSpeakerRoleMajority
+  directionPresent: number
+  directionLast: number | null
+}
+
+export type EvenSpeakerRoleMode = 'off' | 'log' | 'apply'
+
+export function evenSpeakerRoleMode(): EvenSpeakerRoleMode {
+  const raw = (process.env.COS_EVEN_SPEAKER_ROLE ?? 'log').trim().toLowerCase()
+  if (raw === 'off' || raw === '0' || raw === 'false') return 'off'
+  if (raw === 'apply') return 'apply'
+  return 'log'
+}
+
+let applyNotImplementedWarned = false
+
+/** Gate A is not in this slice. apply must not silently change labels. */
+export function warnEvenSpeakerRoleApplyNotImplemented(): void {
+  if (evenSpeakerRoleMode() !== 'apply' || applyNotImplementedWarned) return
+  applyNotImplementedWarned = true
+  console.warn('[even-role] COS_EVEN_SPEAKER_ROLE=apply is not implemented; logging only')
+}
+
+function majorityOf(self: number, other: number, unknown: number, frames: number): EvenSpeakerRoleMajority {
+  if (frames <= 0) return 'unknown'
+  if (self > other && self > unknown) return 'self'
+  if (other > self && other > unknown) return 'other'
+  if (unknown > self && unknown > other) return 'unknown'
+  return 'tie'
+}
+
+function asNonNegInt(raw: unknown): number | null {
+  const n = typeof raw === 'number' ? raw : typeof raw === 'string' && raw !== '' ? Number(raw) : NaN
+  if (!Number.isFinite(n) || n < 0 || !Number.isInteger(n)) return null
+  return n
+}
+
+/** Compact query `eh=self,other,unknown,frames,directionPresent,directionLast`. */
+export function parseEvenHubSpeakerRoleQuery(raw: unknown): EvenSpeakerRoleHistogram | undefined {
+  if (typeof raw !== 'string' || raw.length === 0) return undefined
+  const parts = raw.split(',')
+  if (parts.length < 4 || parts.length > 6) return undefined
+  const self = asNonNegInt(parts[0])
+  const other = asNonNegInt(parts[1])
+  const unknown = asNonNegInt(parts[2])
+  const frames = asNonNegInt(parts[3])
+  if (self == null || other == null || unknown == null || frames == null) return undefined
+  if (self + other + unknown !== frames) return undefined
+  const directionPresent = parts.length >= 5 ? asNonNegInt(parts[4]) : 0
+  if (directionPresent == null) return undefined
+  let directionLast: number | null = null
+  if (parts.length === 6 && parts[5] !== '') {
+    const last = Number(parts[5])
+    if (!Number.isFinite(last)) return undefined
+    directionLast = last
+  }
+  return {
+    schema: 1,
+    frames,
+    self,
+    other,
+    unknown,
+    majority: majorityOf(self, other, unknown, frames),
+    directionPresent,
+    directionLast,
+  }
+}
+
+export function parseEvenHubSpeakerRoleBody(raw: unknown): EvenSpeakerRoleHistogram | undefined {
+  if (!raw || typeof raw !== 'object') return undefined
+  const o = raw as Record<string, unknown>
+  const self = asNonNegInt(o.self)
+  const other = asNonNegInt(o.other)
+  const unknown = asNonNegInt(o.unknown)
+  const frames = asNonNegInt(o.frames)
+  if (self == null || other == null || unknown == null || frames == null) return undefined
+  if (self + other + unknown !== frames) return undefined
+  const directionPresent = o.directionPresent == null ? 0 : asNonNegInt(o.directionPresent)
+  if (directionPresent == null) return undefined
+  const directionLast = o.directionLast == null || o.directionLast === ''
+    ? null
+    : (typeof o.directionLast === 'number' && Number.isFinite(o.directionLast) ? o.directionLast : null)
+  return {
+    schema: 1,
+    frames,
+    self,
+    other,
+    unknown,
+    majority: majorityOf(self, other, unknown, frames),
+    directionPresent,
+    directionLast,
+  }
+}
+
+export function formatEvenRoleAgreement(opts: {
+  chunkIndex: number
+  even: EvenSpeakerRoleHistogram
+  amp: string
+  emb: string
+  similarity: number
+}): string {
+  return `[even-role] chunk=${opts.chunkIndex} even=${opts.even.majority} amp=${opts.amp} emb=${opts.emb} sim=${opts.similarity.toFixed(2)} frames=${opts.even.frames}`
+}

package/server/lib/meeting-store.ts

@@ -321,11 +321,15 @@ function parseMeeting(content: string, filename: string, month: string): Meeting
   const duration = parseField(content, 'Duration')
   const transcript = extractSection(content, ['Transcript'], true)
   const storedSummary = extractSection(content, ['Summary'])
-  // Standalone recordings have no private enrichment pipeline. Returning the
-  // canonical transcript as the detail summary lets the build199 reader review
-  // the saved meeting instead of displaying only a placeholder.
+  // A placeholder is not a summary. Until 6.37 this returned the TRANSCRIPT as
+  // the summary, which put the transcript in the summary slot on every surface
+  // and read as "the summary is broken" — the bug this replaces. The transcript
+  // is returned in its own `transcript` field and each surface renders it in
+  // its own section. An empty summary is the honest state, and every consumer
+  // already handles it: display-pages.ts falls back to 'No summary available.',
+  // and COS Control's Copy-summary button correctly disables on empty.
   const summary = !storedSummary || /standalone recording|summary unavailable/i.test(storedSummary)
-    ? transcript
+    ? ''
     : storedSummary
   const topics = parseListSection(content, ['Topics Discussed'], 10)
   const decisions = parseListSection(content, ['Decisions', 'Decisions Made'], 10)
@@ -369,6 +373,10 @@ export function boundedMeetingSource(content: string): { sourceContent: string;
 }
 
 function toMeta(detail: MeetingDetail, sessionId?: string): MeetingMeta {
+  // Must mirror what the reader actually renders (display-pages.ts
+  // formatMeetingDetailBody), or the list row advertises a page count the
+  // reader does not honour. The transcript is part of that body since 6.37;
+  // omitting it here reported every standalone meeting as ~1p.
   const detailCharEstimate = [
     detail.title,
     detail.date,
@@ -378,6 +386,7 @@ function toMeta(detail: MeetingDetail, sessionId?: string): MeetingMeta {
     detail.decisions.join('\n'),
     detail.actionItems.map(item => `${item.owner ? `[${item.owner}] ` : ''}${item.task}`).join('\n'),
     detail.attendees.join(', '),
+    detail.transcript,
   ].join('\n\n').trim().length
   return {
     filename: detail.filename,

package/server/lib/meeting-summary-budget.ts

@@ -0,0 +1,90 @@
+// Daily budget for standalone meeting summary generation (`claude -p`).
+//
+// Separate counter from archive-budget.ts ON PURPOSE. That module holds a
+// single global `calls` field; folding meeting summaries into it would let a
+// burst of meetings disarm archive summaries for the rest of the day. Every
+// recurring claude -p caller gets its OWN accounting.
+//
+// Two defects in archive-budget.ts are deliberately NOT copied here:
+//   1. It increments BEFORE the call and never refunds, so a machine offline
+//      for one evening burns the whole day's cap on failures. This module
+//      commits only a call that produced a validated summary.
+//   2. It uses plain writeFileSync, violating the atomic-writes rule. This
+//      module uses atomicWriteFileSync + loadJsonOrQuarantine.
+//
+// Reset is lazy: a read that finds date != localDay() starts fresh. No timers.
+
+import { atomicWriteFileSync, loadJsonOrQuarantine } from './atomic-fs.js'
+import { localDay } from './local-day.js'
+import { dataPath } from './data-dir.js'
+
+const BUDGET_FILE = dataPath('meeting-summary-budget.json')
+
+/** Exported for tests that need to drive the real on-disk read path. */
+export function meetingSummaryBudgetFile(): string {
+  return BUDGET_FILE
+}
+
+export const DEFAULT_DAILY_MEETING_SUMMARY_CALLS = 40
+
+/** Max claude -p calls per local day for meeting summarisation.
+ *  Read LIVE for the same reason the feature flag is: COS Control rebuilds the
+ *  runtime plist environment on update, and a module-load const would freeze
+ *  the value at import — making it untunable without a restart and untestable
+ *  in-process. */
+export function maxDailyMeetingSummaryCalls(): number {
+  const raw = Number(process.env.COS_MEETING_SUMMARY_DAILY_CAP)
+  return Number.isFinite(raw) && raw >= 0 ? raw : DEFAULT_DAILY_MEETING_SUMMARY_CALLS
+}
+
+export interface MeetingSummaryBudgetState {
+  date: string
+  calls: number
+}
+
+function readBudget(): MeetingSummaryBudgetState {
+  const today = localDay()
+  const result = loadJsonOrQuarantine<MeetingSummaryBudgetState>(BUDGET_FILE)
+  if (result.status === 'corrupt') {
+    console.error(
+      `[meeting-summary] budget file was corrupt, quarantined as ${result.quarantinedAs} — starting today at 0`,
+    )
+    return { date: today, calls: 0 }
+  }
+  if (result.status !== 'ok') return { date: today, calls: 0 }
+  const data = result.data
+  if (typeof data?.calls !== 'number' || data.date !== today) {
+    return { date: today, calls: 0 }
+  }
+  return data
+}
+
+/**
+ * True when today's budget still has room. Does NOT consume — call
+ * `commitMeetingSummaryCall()` only after a call produced a validated summary,
+ * so failures, auth refusals, and timeouts cost nothing.
+ */
+export function meetingSummaryBudgetAvailable(): boolean {
+  return readBudget().calls < maxDailyMeetingSummaryCalls()
+}
+
+/** Count one call that produced a validated summary. */
+export function commitMeetingSummaryCall(): void {
+  const state = readBudget()
+  state.calls += 1
+  try {
+    atomicWriteFileSync(BUDGET_FILE, JSON.stringify(state))
+  } catch {
+    /* non-fatal — worst case the next read under-counts by one */
+  }
+}
+
+/** For /api/health and dashboards. */
+export function getMeetingSummaryBudgetState(): MeetingSummaryBudgetState & {
+  max: number
+  remaining: number
+} {
+  const state = readBudget()
+  const max = maxDailyMeetingSummaryCalls()
+  return { ...state, max, remaining: Math.max(0, max - state.calls) }
+}

package/server/lib/meeting-summary-persistence.ts

@@ -0,0 +1,179 @@
+// Splice generated enrichment into a saved meeting markdown file.
+//
+// TWO HARD RULES, both learned from validation:
+//
+// 1. EVERY new section goes BEFORE `## Transcript`, never after.
+//    replaceMeetingTranscriptAtomic (meeting-batch-persistence.ts:7-12)
+//    replaces /## Transcript\n\n[\s\S]*$/ — from the marker to END OF FILE —
+//    when HQ batch transcription lands. Anything appended after the transcript
+//    is destroyed minutes later, silently.
+//
+// 2. REFUSE when the operations markers are present.
+//    sync_meetings.py:925-926 decides whether to process a meeting by looking
+//    for 'summary pending pipeline processing' and 'g2-needs-domain-review',
+//    written by MeetingStore.save when COS_SCRIPTS_DIR is set. Overwriting the
+//    summary section erases both, and the pipeline then skips the meeting
+//    entirely — permanent loss of domain reclassification, task extraction and
+//    the operations copy. The caller already gates on
+//    cosOpsPipelineConfigured(); this is defence in depth against a future
+//    caller that forgets.
+//
+// The file is re-read immediately before the write so a speaker relabel that
+// landed during the (up to 45s) LLM call is not clobbered. Atomic write is not
+// atomic read-modify-write; the read has to be late, not early.
+
+import { readFileSync } from 'node:fs'
+import { durableAtomicWriteFileSync } from './atomic-fs.js'
+import type { MeetingSummaryResult } from './meeting-summary.js'
+
+/** Markers that mean the operations pipeline owns this file. */
+export const OPS_PIPELINE_MARKERS = [
+  'summary pending pipeline processing',
+  'g2-needs-domain-review',
+]
+
+export function hasOpsPipelineMarkers(markdown: string): boolean {
+  const lower = markdown.toLowerCase()
+  return OPS_PIPELINE_MARKERS.some(marker => lower.includes(marker.toLowerCase()))
+}
+
+function renderSections(result: MeetingSummaryResult, attendees: string[]): string {
+  const blocks: string[] = []
+  if (result.topics.length > 0) {
+    blocks.push('## Topics Discussed', '', ...result.topics.map(t => `- ${t}`), '')
+  }
+  if (result.decisions.length > 0) {
+    blocks.push('## Decisions', '', ...result.decisions.map(d => `- ${d}`), '')
+  }
+  if (result.actionItems.length > 0) {
+    blocks.push(
+      '## Action Items',
+      '',
+      // parseActions() reads the owner from a trailing (**Name**).
+      ...result.actionItems.map(a => (a.owner ? `- ${a.task} (**${a.owner}**)` : `- ${a.task}`)),
+      '',
+    )
+  }
+  if (attendees.length > 0) {
+    // parseAttendees() reads the name from a leading **Name**.
+    blocks.push('## Attendees', '', ...attendees.map(name => `- **${name}**`), '')
+  }
+  return blocks.join('\n')
+}
+
+/**
+ * Return the markdown with enrichment spliced in, or null when the file must
+ * not be touched. Pure — does no IO — so the splice is unit-testable.
+ */
+export function spliceMeetingEnrichment(
+  markdown: string,
+  result: MeetingSummaryResult,
+  attendees: string[],
+): string | null {
+  if (hasOpsPipelineMarkers(markdown)) return null
+  if (!/^##\s+Summary\s*$/m.test(markdown)) return null
+  if (!/^##\s+Transcript\s*$/m.test(markdown)) return null
+
+  const sections = renderSections(result, attendees)
+
+  // Replace the Summary body (up to the next `## ` heading) with the generated
+  // summary followed by the new sections. Everything from `## Transcript`
+  // onward is left byte-identical.
+  // [^\S\n]* not \s*: \s* also matches the newline, swallowing the blank line
+  // after the heading into the capture and emitting a double blank.
+  return markdown.replace(
+    /(^##[^\S\n]+Summary[^\S\n]*$\n)([\s\S]*?)(?=^##\s)/m,
+    (_full, heading: string) =>
+      `${heading}\n${result.summary}\n\n${sections}${sections ? '\n' : ''}`,
+  )
+}
+
+/**
+ * Read the file fresh, splice, and write atomically. Returns false when the
+ * file was not eligible — never throws for an ineligible file.
+ */
+export function writeMeetingEnrichment(
+  meetingPath: string,
+  result: MeetingSummaryResult,
+  attendees: string[],
+): boolean {
+  let current: string
+  try {
+    current = readFileSync(meetingPath, 'utf-8')
+  } catch {
+    return false
+  }
+  const updated = spliceMeetingEnrichment(current, result, attendees)
+  if (!updated || updated === current) return false
+  durableAtomicWriteFileSync(meetingPath, updated)
+  return true
+}
+
+// ── Orchestrator ────────────────────────────────────────────
+
+import {
+  summariseMeeting,
+  transcriptSpeakers,
+  enqueueSummaryWork,
+  FINALIZATION_WALL_BUDGET_MS,
+} from './meeting-summary.js'
+
+function sectionBody(markdown: string, heading: string, toEnd = false): string {
+  const pattern = toEnd
+    ? new RegExp(`##\\s+${heading}\\s*\\n([\\s\\S]*)$`, 'i')
+    : new RegExp(`##\\s+${heading}\\s*\\n([\\s\\S]*?)(?=\\n##\\s|$)`, 'i')
+  return markdown.match(pattern)?.[1]?.trim() ?? ''
+}
+
+function durationMinutes(markdown: string): number | undefined {
+  const raw = markdown.match(/\*\*Duration\*\*\s*\|\s*(\d+)/)?.[1]
+  return raw ? Number(raw) : undefined
+}
+
+/**
+ * Generate and persist enrichment for a standalone meeting. Never throws — a
+ * summariser failure must not fail the finalization job, mark lastError, or
+ * trigger a retry, because the meeting itself saved correctly.
+ *
+ * `jobStartedAt` anchors the wall budget: the summariser only gets whatever
+ * remains of FINALIZATION_WALL_BUDGET_MS, so batch decode plus this call plus
+ * lease release stays inside COS Control's 90s waitForRestartProof.
+ */
+export async function enrichStandaloneMeeting(
+  meetingPath: string,
+  jobStartedAt: number,
+): Promise<void> {
+  try {
+    let markdown: string
+    try {
+      markdown = readFileSync(meetingPath, 'utf-8')
+    } catch {
+      return
+    }
+    if (hasOpsPipelineMarkers(markdown)) return
+
+    const transcript = sectionBody(markdown, 'Transcript', true)
+    if (!transcript) return
+
+    const remainingWallMs = FINALIZATION_WALL_BUDGET_MS - (Date.now() - jobStartedAt)
+    const result = await enqueueSummaryWork(() =>
+      summariseMeeting(transcript, {
+        durationMinutes: durationMinutes(markdown),
+        remainingWallMs,
+      }),
+    )
+
+    const wrote = writeMeetingEnrichment(meetingPath, result, transcriptSpeakers(transcript))
+    if (wrote) {
+      console.log(
+        `[meeting-summary] enriched ${meetingPath} (tier=${result.tier}`
+        + `${result.skipReason ? `, skipped=${result.skipReason}` : ''})`,
+      )
+    }
+  } catch (error) {
+    console.error(
+      `[meeting-summary] enrichment failed for ${meetingPath}: `
+      + `${error instanceof Error ? error.message : String(error)}`,
+    )
+  }
+}