@gotcos/glasses-server 6.36.28 → 6.37.0

package/.env.example

@@ -177,6 +177,23 @@ BIND_HOST=0.0.0.0
 # deliberately independent from the progressive-HQ compute switch.
 # COS_MEETING_EARLY_SYNC=1
 
+# ── Standalone meeting summaries ──────────────────────────────────────────────
+# Generate summary / topics / decisions / action items for meetings recorded
+# WITHOUT the COS operations pipeline (no COS_SCRIPTS_DIR). Spawns one
+# `claude -p --model haiku` per meeting, at the end of finalization.
+#
+# Default OFF. With it off you still get the deterministic tier — speakers,
+# talk-time, word count, opening excerpt — which costs nothing and always runs.
+#
+# Never runs when COS_SCRIPTS_DIR is set: overwriting the summary section would
+# erase the markers sync_meetings.py uses to decide what to process.
+# COS_MEETING_SUMMARY=1
+#
+# Calls per local day before the summariser falls back to the deterministic
+# tier for the rest of the day. Default 40.
+# COS_MEETING_SUMMARY_DAILY_CAP=40
+
+
 # ── RETAINED MEETING-AUDIO PLAYBACK CLEANUP (6.21.32 canary) ────────────
 # Default OFF. When enabled, the first authenticated Play of a retained raw
 # meeting chunk creates a cached, adaptive cleanup copy. Raw WAV evidence stays

package/CHANGELOG.md

@@ -1,3 +1,109 @@
+## 6.37.0
+
+Meetings recorded without the COS operations pipeline now get a real summary,
+topics, decisions and action items. Until now they got none of that, and the
+server compensated by returning the TRANSCRIPT in the summary slot -- which is
+why this was reported as "no proper summary and transcription."
+
+FEATURE DEFAULTS NOW ON (Miles 2026-08-25)
+
+Ship the capability active; users opt out of what they do not need. Each gate
+stays strict in the other direction -- only a literal '0' disables, so a stray
+or malformed value cannot silently switch a feature off.
+
+  COS_THREAD_ATTACH_ENABLED            Continue agent threads
+  COS_VIDEO_UPLOAD_V2                  Reliable video uploads
+  COS_MEETING_AUDIO_ADAPTIVE_PLAYBACK  Adaptive audio cleanup
+
+COS_WHISPER_MEETING_PREVIEW (Meeting Turbo preview) was ALREADY on by default
+server-side; COS Control mis-renders its checkbox as off because it resolves
+the value as == "1" rather than != "0". That is a Control display bug, not a
+server default, and is not fixed here.
+
+Idle Metal HQ (COS_BATCH_HQ_METAL) is deliberately unchanged -- it is
+hardware-dependent and stays opt-in.
+
+Two consequences worth knowing. An in-flight video upload sets blocksRestart,
+so a drain caught mid-upload waits for it -- that is the contract, not a stuck
+gate, and must never be --forced. Adaptive playback affects review playback
+only; the raw WAV is untouched, and transcript, attribution, save and sync are
+unchanged.
+
+VOICE ENROLMENT
+
+"enroll my voice" followed by more speech created a profile NAMED with the
+entire spoken utterance -- a ~40-second transcript. Reported by a first-time
+user. Because a junk name never equals owner_speaker_label,
+/api/voice/status reported `enrolled: false` no matter how many times you
+enrolled, and editing voice-profiles.json by hand did not help because the
+server rewrites it from memory.
+
+Root cause was client-side: a $-anchored command regex fell through to the
+named-enrolment branch, whose capture group had no length bound. Fixed in
+COS Glasses 6.8.433.
+
+POST /api/voice/enroll now validates ?name= as well, so an OLD client cannot
+write a sentence into the profile store: at most 40 characters, at most 4
+words, letters/spaces/hyphens/apostrophes only, no sentence punctuation, and
+no self-referential phrasing. The wearer's own label is always accepted --
+including the default "Me", which is itself self-referential and would
+otherwise have been rejected by its own guard.
+
+WHAT CHANGED
+
+meeting-store parseMeeting no longer substitutes the transcript into `summary`.
+A standalone placeholder now yields an empty summary, and the transcript is
+carried in its own `transcript` field, which the reader renders as its own
+section (requires COS Glasses 6.8.433). estimatedDetailPages now counts the
+transcript, so a list row no longer advertises ~1p for a meeting that paginates
+to many.
+
+Two enrichment tiers, both standalone-only:
+
+  extractive  always on, zero tokens -- duration, word count, speaker roster
+              with talk-time split, opening excerpt. Fabricates nothing:
+              topics/decisions/actions come back empty rather than guessed.
+
+  llm         COS_MEETING_SUMMARY=1, default OFF. One `claude -p --model haiku`
+              per meeting at the ops_pending phase of finalization.
+
+It runs at ops_pending specifically because batch HQ transcription replaces the
+whole transcript; summarising earlier would describe text the file no longer
+contains. Every generated section is inserted BEFORE `## Transcript`, because
+replaceMeetingTranscriptAtomic replaces from that marker to end of file.
+
+NEVER RUNS FOR OPERATIONS USERS, and refuses twice: the caller gates on
+cosOpsPipelineConfigured(), and the writer independently refuses any file
+carrying the sync_meetings.py markers. Overwriting the summary section would
+erase them and the pipeline would skip the meeting entirely -- losing domain
+reclassification, task extraction and the operations copy.
+
+COST CONTROLS
+  - COS_MEETING_SUMMARY, read live (not frozen at module load)
+  - haiku pinned explicitly, so it can never inherit an Opus session default
+  - own daily cap (COS_MEETING_SUMMARY_DAILY_CAP, default 40), never shared
+    with the archive counter; committed only after a validated summary, so a
+    failure, auth refusal or malformed reply costs nothing
+  - circuit breaker with its own failure accounting
+  - single-slot queue, so a boot replay cannot spawn one provider per meeting
+  - wall budget anchored to the finalization job start, keeping batch decode +
+    summariser + handoff under COS Control's 90s waitForRestartProof
+  - minimum word floor; head+tail input bound, never head-only
+  - surfaced on /api/health as meeting_summary
+
+An unauthenticated CLI exits ZERO with a success-shaped payload carrying the
+bearer token. The result is screened with terminalProviderAuthFailure before
+anything is written, so a 401 can never be persisted into a meeting file.
+
+Generated prose never attributes statements to a speaker, and diarisation
+labels ("Speaker 2", "Ext", "MU") are stripped from action-item owners -- the
+speaker-review flow deliberately never rewrites these sections, so a label
+captured here would stay wrong permanently.
+
+A standalone save with no audio now schedules a finalization pass too; before
+this it was nulled and never reached ops_pending. Orphan recovery, which has
+its own path, enriches as well.
+
 ## 6.36.28
 
 THE bug. Three earlier fixes tonight were each real and none was this one.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.36.28",
+  "version": "6.37.0",
   "description": "COS Glasses — self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/lib/adaptive-playback-audio.ts

@@ -159,7 +159,10 @@ export function analyzePlaybackWav(buffer: Buffer): AudioSignalProfile | null {
 
 export function adaptivePlaybackEnabled(): boolean {
   // Private canary: explicit opt-in, explicit 0 rollback through COS Control.
-  return process.env.COS_MEETING_AUDIO_ADAPTIVE_PLAYBACK === '1'
+  // Default ON since 6.37.0 (Miles 2026-08-25). Absent key = on; only a
+  // literal '0' disables. Raw WAV is untouched either way — this affects
+  // review playback only, never the transcript, attribution, save or sync.
+  return process.env.COS_MEETING_AUDIO_ADAPTIVE_PLAYBACK !== '0'
 }
 
 function outputPathFor(rawPath: string): string | null {

package/server/lib/even-hub-speaker-role.ts

@@ -0,0 +1,116 @@
+// Even Hub 0.0.14 wearer-vs-other histogram, carried on a meeting chunk.
+// Identity is a suggestion. This module parses and logs. It does not name
+// people and does not change identifyChunkSpeaker.
+
+export type EvenSpeakerRole = 'self' | 'other' | 'unknown'
+export type EvenSpeakerRoleMajority = EvenSpeakerRole | 'tie'
+
+export interface EvenSpeakerRoleHistogram {
+  schema: 1
+  frames: number
+  self: number
+  other: number
+  unknown: number
+  majority: EvenSpeakerRoleMajority
+  directionPresent: number
+  directionLast: number | null
+}
+
+export type EvenSpeakerRoleMode = 'off' | 'log' | 'apply'
+
+export function evenSpeakerRoleMode(): EvenSpeakerRoleMode {
+  const raw = (process.env.COS_EVEN_SPEAKER_ROLE ?? 'log').trim().toLowerCase()
+  if (raw === 'off' || raw === '0' || raw === 'false') return 'off'
+  if (raw === 'apply') return 'apply'
+  return 'log'
+}
+
+let applyNotImplementedWarned = false
+
+/** Gate A is not in this slice. apply must not silently change labels. */
+export function warnEvenSpeakerRoleApplyNotImplemented(): void {
+  if (evenSpeakerRoleMode() !== 'apply' || applyNotImplementedWarned) return
+  applyNotImplementedWarned = true
+  console.warn('[even-role] COS_EVEN_SPEAKER_ROLE=apply is not implemented; logging only')
+}
+
+function majorityOf(self: number, other: number, unknown: number, frames: number): EvenSpeakerRoleMajority {
+  if (frames <= 0) return 'unknown'
+  if (self > other && self > unknown) return 'self'
+  if (other > self && other > unknown) return 'other'
+  if (unknown > self && unknown > other) return 'unknown'
+  return 'tie'
+}
+
+function asNonNegInt(raw: unknown): number | null {
+  const n = typeof raw === 'number' ? raw : typeof raw === 'string' && raw !== '' ? Number(raw) : NaN
+  if (!Number.isFinite(n) || n < 0 || !Number.isInteger(n)) return null
+  return n
+}
+
+/** Compact query `eh=self,other,unknown,frames,directionPresent,directionLast`. */
+export function parseEvenHubSpeakerRoleQuery(raw: unknown): EvenSpeakerRoleHistogram | undefined {
+  if (typeof raw !== 'string' || raw.length === 0) return undefined
+  const parts = raw.split(',')
+  if (parts.length < 4 || parts.length > 6) return undefined
+  const self = asNonNegInt(parts[0])
+  const other = asNonNegInt(parts[1])
+  const unknown = asNonNegInt(parts[2])
+  const frames = asNonNegInt(parts[3])
+  if (self == null || other == null || unknown == null || frames == null) return undefined
+  if (self + other + unknown !== frames) return undefined
+  const directionPresent = parts.length >= 5 ? asNonNegInt(parts[4]) : 0
+  if (directionPresent == null) return undefined
+  let directionLast: number | null = null
+  if (parts.length === 6 && parts[5] !== '') {
+    const last = Number(parts[5])
+    if (!Number.isFinite(last)) return undefined
+    directionLast = last
+  }
+  return {
+    schema: 1,
+    frames,
+    self,
+    other,
+    unknown,
+    majority: majorityOf(self, other, unknown, frames),
+    directionPresent,
+    directionLast,
+  }
+}
+
+export function parseEvenHubSpeakerRoleBody(raw: unknown): EvenSpeakerRoleHistogram | undefined {
+  if (!raw || typeof raw !== 'object') return undefined
+  const o = raw as Record<string, unknown>
+  const self = asNonNegInt(o.self)
+  const other = asNonNegInt(o.other)
+  const unknown = asNonNegInt(o.unknown)
+  const frames = asNonNegInt(o.frames)
+  if (self == null || other == null || unknown == null || frames == null) return undefined
+  if (self + other + unknown !== frames) return undefined
+  const directionPresent = o.directionPresent == null ? 0 : asNonNegInt(o.directionPresent)
+  if (directionPresent == null) return undefined
+  const directionLast = o.directionLast == null || o.directionLast === ''
+    ? null
+    : (typeof o.directionLast === 'number' && Number.isFinite(o.directionLast) ? o.directionLast : null)
+  return {
+    schema: 1,
+    frames,
+    self,
+    other,
+    unknown,
+    majority: majorityOf(self, other, unknown, frames),
+    directionPresent,
+    directionLast,
+  }
+}
+
+export function formatEvenRoleAgreement(opts: {
+  chunkIndex: number
+  even: EvenSpeakerRoleHistogram
+  amp: string
+  emb: string
+  similarity: number
+}): string {
+  return `[even-role] chunk=${opts.chunkIndex} even=${opts.even.majority} amp=${opts.amp} emb=${opts.emb} sim=${opts.similarity.toFixed(2)} frames=${opts.even.frames}`
+}

package/server/lib/meeting-store.ts

@@ -321,11 +321,15 @@ function parseMeeting(content: string, filename: string, month: string): Meeting
   const duration = parseField(content, 'Duration')
   const transcript = extractSection(content, ['Transcript'], true)
   const storedSummary = extractSection(content, ['Summary'])
-  // Standalone recordings have no private enrichment pipeline. Returning the
-  // canonical transcript as the detail summary lets the build199 reader review
-  // the saved meeting instead of displaying only a placeholder.
+  // A placeholder is not a summary. Until 6.37 this returned the TRANSCRIPT as
+  // the summary, which put the transcript in the summary slot on every surface
+  // and read as "the summary is broken" — the bug this replaces. The transcript
+  // is returned in its own `transcript` field and each surface renders it in
+  // its own section. An empty summary is the honest state, and every consumer
+  // already handles it: display-pages.ts falls back to 'No summary available.',
+  // and COS Control's Copy-summary button correctly disables on empty.
   const summary = !storedSummary || /standalone recording|summary unavailable/i.test(storedSummary)
-    ? transcript
+    ? ''
     : storedSummary
   const topics = parseListSection(content, ['Topics Discussed'], 10)
   const decisions = parseListSection(content, ['Decisions', 'Decisions Made'], 10)
@@ -369,6 +373,10 @@ export function boundedMeetingSource(content: string): { sourceContent: string;
 }
 
 function toMeta(detail: MeetingDetail, sessionId?: string): MeetingMeta {
+  // Must mirror what the reader actually renders (display-pages.ts
+  // formatMeetingDetailBody), or the list row advertises a page count the
+  // reader does not honour. The transcript is part of that body since 6.37;
+  // omitting it here reported every standalone meeting as ~1p.
   const detailCharEstimate = [
     detail.title,
     detail.date,
@@ -378,6 +386,7 @@ function toMeta(detail: MeetingDetail, sessionId?: string): MeetingMeta {
     detail.decisions.join('\n'),
     detail.actionItems.map(item => `${item.owner ? `[${item.owner}] ` : ''}${item.task}`).join('\n'),
     detail.attendees.join(', '),
+    detail.transcript,
   ].join('\n\n').trim().length
   return {
     filename: detail.filename,

package/server/lib/meeting-summary-budget.ts

@@ -0,0 +1,90 @@
+// Daily budget for standalone meeting summary generation (`claude -p`).
+//
+// Separate counter from archive-budget.ts ON PURPOSE. That module holds a
+// single global `calls` field; folding meeting summaries into it would let a
+// burst of meetings disarm archive summaries for the rest of the day. Every
+// recurring claude -p caller gets its OWN accounting.
+//
+// Two defects in archive-budget.ts are deliberately NOT copied here:
+//   1. It increments BEFORE the call and never refunds, so a machine offline
+//      for one evening burns the whole day's cap on failures. This module
+//      commits only a call that produced a validated summary.
+//   2. It uses plain writeFileSync, violating the atomic-writes rule. This
+//      module uses atomicWriteFileSync + loadJsonOrQuarantine.
+//
+// Reset is lazy: a read that finds date != localDay() starts fresh. No timers.
+
+import { atomicWriteFileSync, loadJsonOrQuarantine } from './atomic-fs.js'
+import { localDay } from './local-day.js'
+import { dataPath } from './data-dir.js'
+
+const BUDGET_FILE = dataPath('meeting-summary-budget.json')
+
+/** Exported for tests that need to drive the real on-disk read path. */
+export function meetingSummaryBudgetFile(): string {
+  return BUDGET_FILE
+}
+
+export const DEFAULT_DAILY_MEETING_SUMMARY_CALLS = 40
+
+/** Max claude -p calls per local day for meeting summarisation.
+ *  Read LIVE for the same reason the feature flag is: COS Control rebuilds the
+ *  runtime plist environment on update, and a module-load const would freeze
+ *  the value at import — making it untunable without a restart and untestable
+ *  in-process. */
+export function maxDailyMeetingSummaryCalls(): number {
+  const raw = Number(process.env.COS_MEETING_SUMMARY_DAILY_CAP)
+  return Number.isFinite(raw) && raw >= 0 ? raw : DEFAULT_DAILY_MEETING_SUMMARY_CALLS
+}
+
+export interface MeetingSummaryBudgetState {
+  date: string
+  calls: number
+}
+
+function readBudget(): MeetingSummaryBudgetState {
+  const today = localDay()
+  const result = loadJsonOrQuarantine<MeetingSummaryBudgetState>(BUDGET_FILE)
+  if (result.status === 'corrupt') {
+    console.error(
+      `[meeting-summary] budget file was corrupt, quarantined as ${result.quarantinedAs} — starting today at 0`,
+    )
+    return { date: today, calls: 0 }
+  }
+  if (result.status !== 'ok') return { date: today, calls: 0 }
+  const data = result.data
+  if (typeof data?.calls !== 'number' || data.date !== today) {
+    return { date: today, calls: 0 }
+  }
+  return data
+}
+
+/**
+ * True when today's budget still has room. Does NOT consume — call
+ * `commitMeetingSummaryCall()` only after a call produced a validated summary,
+ * so failures, auth refusals, and timeouts cost nothing.
+ */
+export function meetingSummaryBudgetAvailable(): boolean {
+  return readBudget().calls < maxDailyMeetingSummaryCalls()
+}
+
+/** Count one call that produced a validated summary. */
+export function commitMeetingSummaryCall(): void {
+  const state = readBudget()
+  state.calls += 1
+  try {
+    atomicWriteFileSync(BUDGET_FILE, JSON.stringify(state))
+  } catch {
+    /* non-fatal — worst case the next read under-counts by one */
+  }
+}
+
+/** For /api/health and dashboards. */
+export function getMeetingSummaryBudgetState(): MeetingSummaryBudgetState & {
+  max: number
+  remaining: number
+} {
+  const state = readBudget()
+  const max = maxDailyMeetingSummaryCalls()
+  return { ...state, max, remaining: Math.max(0, max - state.calls) }
+}

package/server/lib/meeting-summary-persistence.ts

@@ -0,0 +1,179 @@
+// Splice generated enrichment into a saved meeting markdown file.
+//
+// TWO HARD RULES, both learned from validation:
+//
+// 1. EVERY new section goes BEFORE `## Transcript`, never after.
+//    replaceMeetingTranscriptAtomic (meeting-batch-persistence.ts:7-12)
+//    replaces /## Transcript\n\n[\s\S]*$/ — from the marker to END OF FILE —
+//    when HQ batch transcription lands. Anything appended after the transcript
+//    is destroyed minutes later, silently.
+//
+// 2. REFUSE when the operations markers are present.
+//    sync_meetings.py:925-926 decides whether to process a meeting by looking
+//    for 'summary pending pipeline processing' and 'g2-needs-domain-review',
+//    written by MeetingStore.save when COS_SCRIPTS_DIR is set. Overwriting the
+//    summary section erases both, and the pipeline then skips the meeting
+//    entirely — permanent loss of domain reclassification, task extraction and
+//    the operations copy. The caller already gates on
+//    cosOpsPipelineConfigured(); this is defence in depth against a future
+//    caller that forgets.
+//
+// The file is re-read immediately before the write so a speaker relabel that
+// landed during the (up to 45s) LLM call is not clobbered. Atomic write is not
+// atomic read-modify-write; the read has to be late, not early.
+
+import { readFileSync } from 'node:fs'
+import { durableAtomicWriteFileSync } from './atomic-fs.js'
+import type { MeetingSummaryResult } from './meeting-summary.js'
+
+/** Markers that mean the operations pipeline owns this file. */
+export const OPS_PIPELINE_MARKERS = [
+  'summary pending pipeline processing',
+  'g2-needs-domain-review',
+]
+
+export function hasOpsPipelineMarkers(markdown: string): boolean {
+  const lower = markdown.toLowerCase()
+  return OPS_PIPELINE_MARKERS.some(marker => lower.includes(marker.toLowerCase()))
+}
+
+function renderSections(result: MeetingSummaryResult, attendees: string[]): string {
+  const blocks: string[] = []
+  if (result.topics.length > 0) {
+    blocks.push('## Topics Discussed', '', ...result.topics.map(t => `- ${t}`), '')
+  }
+  if (result.decisions.length > 0) {
+    blocks.push('## Decisions', '', ...result.decisions.map(d => `- ${d}`), '')
+  }
+  if (result.actionItems.length > 0) {
+    blocks.push(
+      '## Action Items',
+      '',
+      // parseActions() reads the owner from a trailing (**Name**).
+      ...result.actionItems.map(a => (a.owner ? `- ${a.task} (**${a.owner}**)` : `- ${a.task}`)),
+      '',
+    )
+  }
+  if (attendees.length > 0) {
+    // parseAttendees() reads the name from a leading **Name**.
+    blocks.push('## Attendees', '', ...attendees.map(name => `- **${name}**`), '')
+  }
+  return blocks.join('\n')
+}
+
+/**
+ * Return the markdown with enrichment spliced in, or null when the file must
+ * not be touched. Pure — does no IO — so the splice is unit-testable.
+ */
+export function spliceMeetingEnrichment(
+  markdown: string,
+  result: MeetingSummaryResult,
+  attendees: string[],
+): string | null {
+  if (hasOpsPipelineMarkers(markdown)) return null
+  if (!/^##\s+Summary\s*$/m.test(markdown)) return null
+  if (!/^##\s+Transcript\s*$/m.test(markdown)) return null
+
+  const sections = renderSections(result, attendees)
+
+  // Replace the Summary body (up to the next `## ` heading) with the generated
+  // summary followed by the new sections. Everything from `## Transcript`
+  // onward is left byte-identical.
+  // [^\S\n]* not \s*: \s* also matches the newline, swallowing the blank line
+  // after the heading into the capture and emitting a double blank.
+  return markdown.replace(
+    /(^##[^\S\n]+Summary[^\S\n]*$\n)([\s\S]*?)(?=^##\s)/m,
+    (_full, heading: string) =>
+      `${heading}\n${result.summary}\n\n${sections}${sections ? '\n' : ''}`,
+  )
+}
+
+/**
+ * Read the file fresh, splice, and write atomically. Returns false when the
+ * file was not eligible — never throws for an ineligible file.
+ */
+export function writeMeetingEnrichment(
+  meetingPath: string,
+  result: MeetingSummaryResult,
+  attendees: string[],
+): boolean {
+  let current: string
+  try {
+    current = readFileSync(meetingPath, 'utf-8')
+  } catch {
+    return false
+  }
+  const updated = spliceMeetingEnrichment(current, result, attendees)
+  if (!updated || updated === current) return false
+  durableAtomicWriteFileSync(meetingPath, updated)
+  return true
+}
+
+// ── Orchestrator ────────────────────────────────────────────
+
+import {
+  summariseMeeting,
+  transcriptSpeakers,
+  enqueueSummaryWork,
+  FINALIZATION_WALL_BUDGET_MS,
+} from './meeting-summary.js'
+
+function sectionBody(markdown: string, heading: string, toEnd = false): string {
+  const pattern = toEnd
+    ? new RegExp(`##\\s+${heading}\\s*\\n([\\s\\S]*)$`, 'i')
+    : new RegExp(`##\\s+${heading}\\s*\\n([\\s\\S]*?)(?=\\n##\\s|$)`, 'i')
+  return markdown.match(pattern)?.[1]?.trim() ?? ''
+}
+
+function durationMinutes(markdown: string): number | undefined {
+  const raw = markdown.match(/\*\*Duration\*\*\s*\|\s*(\d+)/)?.[1]
+  return raw ? Number(raw) : undefined
+}
+
+/**
+ * Generate and persist enrichment for a standalone meeting. Never throws — a
+ * summariser failure must not fail the finalization job, mark lastError, or
+ * trigger a retry, because the meeting itself saved correctly.
+ *
+ * `jobStartedAt` anchors the wall budget: the summariser only gets whatever
+ * remains of FINALIZATION_WALL_BUDGET_MS, so batch decode plus this call plus
+ * lease release stays inside COS Control's 90s waitForRestartProof.
+ */
+export async function enrichStandaloneMeeting(
+  meetingPath: string,
+  jobStartedAt: number,
+): Promise<void> {
+  try {
+    let markdown: string
+    try {
+      markdown = readFileSync(meetingPath, 'utf-8')
+    } catch {
+      return
+    }
+    if (hasOpsPipelineMarkers(markdown)) return
+
+    const transcript = sectionBody(markdown, 'Transcript', true)
+    if (!transcript) return
+
+    const remainingWallMs = FINALIZATION_WALL_BUDGET_MS - (Date.now() - jobStartedAt)
+    const result = await enqueueSummaryWork(() =>
+      summariseMeeting(transcript, {
+        durationMinutes: durationMinutes(markdown),
+        remainingWallMs,
+      }),
+    )
+
+    const wrote = writeMeetingEnrichment(meetingPath, result, transcriptSpeakers(transcript))
+    if (wrote) {
+      console.log(
+        `[meeting-summary] enriched ${meetingPath} (tier=${result.tier}`
+        + `${result.skipReason ? `, skipped=${result.skipReason}` : ''})`,
+      )
+    }
+  } catch (error) {
+    console.error(
+      `[meeting-summary] enrichment failed for ${meetingPath}: `
+      + `${error instanceof Error ? error.message : String(error)}`,
+    )
+  }
+}

package/server/lib/meeting-summary.ts

@@ -0,0 +1,420 @@
+// Standalone meeting enrichment — summary / topics / decisions / action items.
+//
+// WHY THIS EXISTS
+// Summary, topics, decisions and actions are normally produced by
+// sync_meetings.py, spawned through g2-ops-handoff. A standalone user has no
+// COS_SCRIPTS_DIR, no Python, and no sync_meetings.py, so that pipeline never
+// runs and MeetingStore.save writes only a placeholder. This module is the
+// standalone-only replacement.
+//
+// TWO TIERS
+//   extractiveMeetingSummary()  — deterministic, zero tokens, always available.
+//                                 Reports what the transcript literally shows:
+//                                 speakers, turns, talk-time, opening excerpt.
+//                                 It does NOT invent topics or decisions.
+//   llmMeetingSummary()         — `claude -p` over the transcript. Default OFF.
+//                                 Falls back to the extractive tier on every
+//                                 failure path.
+//
+// NEVER RUNS FOR OPERATIONS USERS. Overwriting the summary section would erase
+// the two markers sync_meetings.py:925-926 gates on
+// ('summary pending pipeline processing' and 'g2-needs-domain-review'), and the
+// meeting would be skipped by the pipeline entirely — permanent loss of domain
+// reclassification, task extraction, and the operations copy. The caller gates
+// on cosOpsPipelineConfigured(); this module refuses independently as defence
+// in depth.
+
+import { spawnClaudeText } from './prompt-edit.js'
+import { terminalProviderAuthFailure } from './provider-terminal-error.js'
+import { createBreaker } from './claude-circuit.js'
+import {
+  meetingSummaryBudgetAvailable,
+  commitMeetingSummaryCall,
+} from './meeting-summary-budget.js'
+
+export interface MeetingActionItemDraft {
+  task: string
+  owner: string
+}
+
+export interface MeetingSummaryResult {
+  summary: string
+  topics: string[]
+  decisions: string[]
+  actionItems: MeetingActionItemDraft[]
+  /** Which tier produced this. Surfaced so no caller can present a mechanical
+   *  record as though it were an abstractive summary. */
+  tier: 'extractive' | 'llm'
+}
+
+// ── Bounds ──────────────────────────────────────────────────
+
+/** Below this the recording is too short to enrich; spend nothing. */
+export const MIN_SUMMARY_WORDS = 40
+
+/** Input bound for the LLM tier. Head+tail, never head-only: a head-only
+ *  truncation of a long meeting silently discards every decision made in the
+ *  last two thirds and still reads as confident and complete. */
+export const MAX_SUMMARY_INPUT_CHARS = 24_000
+const HEAD_FRACTION = 0.6
+const ELISION = '\n\n[... middle of transcript omitted for length ...]\n\n'
+
+/** Hard wall for one LLM summary call. */
+export const SUMMARY_WALL_MS = 45_000
+
+/** Below this much remaining budget the LLM tier is skipped entirely — a call
+ *  that cannot finish inside the window must not be started. */
+export const MIN_SUMMARY_WALL_MS = 15_000
+
+/** Total wall budget for the whole finalization job (batch decode + handoff +
+ *  this summariser). COS Control's waitForRestartProof defaults to 90s
+ *  (cos-control-macos/HelperSources/main.swift:2645); a drain that catches
+ *  finalization in flight past that hard-fails to Repair. 75s leaves 15s of
+ *  margin for lease release and proof publication. */
+export const FINALIZATION_WALL_BUDGET_MS = 75_000
+
+const MAX_TOPICS = 8
+const MAX_DECISIONS = 8
+const MAX_ACTIONS = 10
+const MAX_SUMMARY_CHARS = 1_200
+
+const breaker = createBreaker({ label: 'meeting-summary', maxFailures: 2 })
+
+/** Exported for tests. */
+export const meetingSummaryBreaker = breaker
+
+// ── Flag ────────────────────────────────────────────────────
+
+/** Read LIVE, not at module load. COS Control rebuilds the runtime plist
+ *  environment on update, and tests flip this per-case; a module-scope const
+ *  would freeze the value at import and make both untestable. */
+export function meetingSummaryLLMEnabled(): boolean {
+  const raw = process.env.COS_MEETING_SUMMARY?.trim()
+  return raw === '1' || raw?.toLowerCase() === 'true'
+}
+
+// ── Transcript parsing ──────────────────────────────────────
+
+export interface TranscriptTurn {
+  speaker: string
+  text: string
+}
+
+/** Parse `[Speaker]: text` turns. Lines without a speaker prefix are appended
+ *  to the previous turn so a wrapped line does not become its own turn. */
+export function parseTranscriptTurns(transcript: string): TranscriptTurn[] {
+  const turns: TranscriptTurn[] = []
+  for (const line of transcript.split('\n')) {
+    const match = line.match(/^\s*\[([^\]]{1,60})\]:\s*(.*)$/)
+    if (match) {
+      turns.push({ speaker: match[1].trim(), text: match[2].trim() })
+      continue
+    }
+    const trimmed = line.trim()
+    if (!trimmed) continue
+    if (turns.length > 0) {
+      turns[turns.length - 1].text = `${turns[turns.length - 1].text} ${trimmed}`.trim()
+    } else {
+      turns.push({ speaker: '', text: trimmed })
+    }
+  }
+  return turns.filter(turn => turn.text.length > 0)
+}
+
+export function countTranscriptWords(transcript: string): number {
+  return transcript.split(/\s+/).filter(Boolean).length
+}
+
+// ── Tier 1: deterministic ───────────────────────────────────
+
+/**
+ * A factual record of what the transcript contains. Deliberately makes no
+ * claim it cannot support: topics, decisions and action items come back EMPTY
+ * because no deterministic method extracts them reliably, and a fabricated
+ * list is worse than an absent one.
+ */
+export function extractiveMeetingSummary(
+  transcript: string,
+  opts: { durationMinutes?: number } = {},
+): MeetingSummaryResult {
+  const turns = parseTranscriptTurns(transcript)
+  const words = countTranscriptWords(transcript)
+
+  const wordsBySpeaker = new Map<string, number>()
+  for (const turn of turns) {
+    if (!turn.speaker) continue
+    wordsBySpeaker.set(
+      turn.speaker,
+      (wordsBySpeaker.get(turn.speaker) ?? 0) + countTranscriptWords(turn.text),
+    )
+  }
+  const speakers = [...wordsBySpeaker.entries()].sort((a, b) => b[1] - a[1])
+
+  const parts: string[] = []
+  if (opts.durationMinutes && opts.durationMinutes > 0) {
+    parts.push(`${opts.durationMinutes}-minute recording`)
+  } else {
+    parts.push('Recording')
+  }
+  parts.push(`${words.toLocaleString()} words`)
+  if (speakers.length > 0) {
+    const roster = speakers
+      .map(([name, count]) => `${name} (${Math.round((count / Math.max(1, words)) * 100)}%)`)
+      .join(', ')
+    parts.push(`${speakers.length} speaker${speakers.length === 1 ? '' : 's'}: ${roster}`)
+  }
+
+  const opening = turns
+    .slice(0, 3)
+    .map(turn => (turn.speaker ? `${turn.speaker}: ${turn.text}` : turn.text))
+    .join(' ')
+    .slice(0, 300)
+    .trim()
+
+  const summary = opening
+    ? `${parts.join('. ')}.\n\nOpening: ${opening}${opening.length >= 300 ? '…' : ''}`
+    : `${parts.join('. ')}.`
+
+  return {
+    summary,
+    topics: [],
+    decisions: [],
+    actionItems: [],
+    tier: 'extractive',
+  }
+}
+
+/** Speaker roster, for the Attendees section. Deterministic either tier. */
+export function transcriptSpeakers(transcript: string): string[] {
+  const seen: string[] = []
+  for (const turn of parseTranscriptTurns(transcript)) {
+    if (turn.speaker && !seen.includes(turn.speaker)) seen.push(turn.speaker)
+  }
+  return seen.slice(0, 20)
+}
+
+// ── Tier 2: LLM ─────────────────────────────────────────────
+
+/** Head+tail bound that never splits a UTF-16 surrogate pair. */
+export function boundTranscriptForSummary(transcript: string): {
+  text: string
+  truncated: boolean
+} {
+  if (transcript.length <= MAX_SUMMARY_INPUT_CHARS) {
+    return { text: transcript, truncated: false }
+  }
+  const budget = MAX_SUMMARY_INPUT_CHARS - ELISION.length
+  let headEnd = Math.floor(budget * HEAD_FRACTION)
+  let tailStart = transcript.length - (budget - headEnd)
+  // Never cut between a surrogate pair (emoji, some CJK extensions).
+  if (isLowSurrogate(transcript.charCodeAt(headEnd))) headEnd -= 1
+  if (isLowSurrogate(transcript.charCodeAt(tailStart))) tailStart += 1
+  return {
+    text: `${transcript.slice(0, headEnd)}${ELISION}${transcript.slice(tailStart)}`,
+    truncated: true,
+  }
+}
+
+function isLowSurrogate(code: number): boolean {
+  return code >= 0xdc00 && code <= 0xdfff
+}
+
+export function buildSummaryPrompt(transcript: string, truncated: boolean): string {
+  return [
+    'You are summarising a meeting transcript for the person who recorded it.',
+    '',
+    'Rules:',
+    '- Reply with ONLY a JSON object. No prose, no code fence.',
+    '- Shape: {"summary": string, "topics": string[], "decisions": string[], "actionItems": [{"task": string, "owner": string}]}',
+    '- "summary" is 2-4 sentences of what actually happened.',
+    '- Use an empty array when the transcript does not support that field. Never invent a decision or an action item.',
+    // Speaker labels in a standalone transcript are diarisation guesses
+    // ("Speaker 2", "Ext") and are corrected later by the speaker-review flow,
+    // which deliberately never rewrites prose (meeting-corrections.ts:19-26).
+    // A generated summary naming a speaker would keep the wrong name forever.
+    '- Do NOT attribute statements to a speaker by name or label. Describe what was discussed, not who said it.',
+    '- "owner" must be a person NAMED ALOUD in the transcript. Diarisation labels'
+      + ' ("Speaker 2", "Ext", "MU", "Me", "Unknown") are placeholders, not names —'
+      + ' use "" for owner in that case.',
+    '- Write in the same language as the transcript.',
+    truncated
+      ? '- The middle of this transcript was omitted for length. Say so in the summary rather than implying full coverage.'
+      : '',
+    '',
+    'Transcript:',
+    transcript,
+  ]
+    .filter(Boolean)
+    .join('\n')
+}
+
+/** Diarisation placeholders. These are corrected later by the speaker-review
+ *  flow, which never rewrites the enrichment sections — so a label captured as
+ *  an action-item owner would stay wrong permanently. Drop it instead. */
+const DIARISATION_LABEL = /^(?:speaker\s*\d+|ext(?:ernal)?|unknown|me|mu)$/i
+
+export function isDiarisationLabel(value: string): boolean {
+  return DIARISATION_LABEL.test(value.trim())
+}
+
+function asStringArray(value: unknown, limit: number): string[] {
+  if (!Array.isArray(value)) return []
+  return value
+    .filter((item): item is string => typeof item === 'string')
+    .map(item => item.trim())
+    .filter(Boolean)
+    .slice(0, limit)
+}
+
+/** Strict shape validation. A malformed reply is a failure, not a partial win. */
+export function parseSummaryResponse(raw: string): MeetingSummaryResult | null {
+  const start = raw.indexOf('{')
+  const end = raw.lastIndexOf('}')
+  if (start === -1 || end <= start) return null
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(raw.slice(start, end + 1))
+  } catch {
+    return null
+  }
+  if (!parsed || typeof parsed !== 'object') return null
+  const record = parsed as Record<string, unknown>
+  const summary = typeof record.summary === 'string' ? record.summary.trim() : ''
+  if (!summary || summary.length > MAX_SUMMARY_CHARS) return null
+
+  const actionItems = Array.isArray(record.actionItems)
+    ? record.actionItems
+        .filter((item): item is Record<string, unknown> => !!item && typeof item === 'object')
+        .map(item => {
+          const owner = typeof item.owner === 'string' ? item.owner.trim() : ''
+          return {
+            task: typeof item.task === 'string' ? item.task.trim() : '',
+            // Belt and braces: the prompt forbids these, and this drops them
+            // if a model returns one anyway.
+            owner: isDiarisationLabel(owner) ? '' : owner,
+          }
+        })
+        .filter(item => item.task.length > 0)
+        .slice(0, MAX_ACTIONS)
+    : []
+
+  return {
+    summary,
+    topics: asStringArray(record.topics, MAX_TOPICS),
+    decisions: asStringArray(record.decisions, MAX_DECISIONS),
+    actionItems,
+    tier: 'llm',
+  }
+}
+
+export interface LlmSummaryOptions {
+  durationMinutes?: number
+  /** Wall time still available before FINALIZATION_WALL_BUDGET_MS is spent. */
+  remainingWallMs?: number
+  signal?: AbortSignal
+  /** Test seam. Defaults to the real spawnClaudeText. */
+  spawn?: (prompt: string, opts: { model: string; timeoutMs: number; label: string; signal?: AbortSignal }) => Promise<string>
+}
+
+export interface SummaryOutcome extends MeetingSummaryResult {
+  /** Why the LLM tier did not run, when it did not. */
+  skipReason?:
+    | 'flag_off'
+    | 'too_short'
+    | 'budget_exhausted'
+    | 'breaker_open'
+    | 'no_wall_time'
+    | 'auth_required'
+    | 'invalid_response'
+    | 'call_failed'
+}
+
+/**
+ * Produce the best available enrichment. Always returns a usable result: the
+ * LLM tier when every gate passes, the deterministic tier otherwise.
+ */
+export async function summariseMeeting(
+  transcript: string,
+  opts: LlmSummaryOptions = {},
+): Promise<SummaryOutcome> {
+  const fallback = extractiveMeetingSummary(transcript, {
+    durationMinutes: opts.durationMinutes,
+  })
+
+  if (!meetingSummaryLLMEnabled()) return { ...fallback, skipReason: 'flag_off' }
+  if (countTranscriptWords(transcript) < MIN_SUMMARY_WORDS) {
+    return { ...fallback, skipReason: 'too_short' }
+  }
+  if (breaker.isOpen()) return { ...fallback, skipReason: 'breaker_open' }
+  if (!meetingSummaryBudgetAvailable()) {
+    return { ...fallback, skipReason: 'budget_exhausted' }
+  }
+
+  const remaining = opts.remainingWallMs ?? SUMMARY_WALL_MS
+  if (remaining < MIN_SUMMARY_WALL_MS) return { ...fallback, skipReason: 'no_wall_time' }
+  const timeoutMs = Math.min(SUMMARY_WALL_MS, remaining)
+
+  const { text, truncated } = boundTranscriptForSummary(transcript)
+  const spawn = opts.spawn ?? ((prompt, spawnOpts) => spawnClaudeText(prompt, spawnOpts))
+
+  let raw: string
+  try {
+    raw = await spawn(buildSummaryPrompt(text, truncated), {
+      // Cheapest tier, and --model is ALWAYS passed by spawnClaudeText so this
+      // can never silently inherit an Opus session default.
+      model: 'haiku',
+      timeoutMs,
+      label: 'Meeting summary',
+      signal: opts.signal,
+    })
+  } catch (err) {
+    breaker.recordFailure()
+    console.error(`[meeting-summary] call failed: ${err instanceof Error ? err.message : String(err)}`)
+    return { ...fallback, skipReason: 'call_failed' }
+  }
+
+  // An unauthenticated CLI exits ZERO with a success-shaped payload carrying
+  // the bearer token (claude-bridge-auth-finalization.test.ts:173-191). Without
+  // this check that credential would be written into a durable meeting file.
+  const authFailure = terminalProviderAuthFailure('claude', raw)
+  if (authFailure) {
+    breaker.recordFailure()
+    console.error(`[meeting-summary] ${authFailure}`)
+    return { ...fallback, skipReason: 'auth_required' }
+  }
+
+  const parsed = parseSummaryResponse(raw)
+  if (!parsed) {
+    breaker.recordFailure()
+    console.error('[meeting-summary] response failed shape validation')
+    return { ...fallback, skipReason: 'invalid_response' }
+  }
+
+  // Committed only now: a failure, refusal, or malformed reply costs nothing.
+  commitMeetingSummaryCall()
+  breaker.recordSuccess()
+  return parsed
+}
+
+// ── Concurrency ─────────────────────────────────────────────
+
+let summaryQueueTail: Promise<unknown> = Promise.resolve()
+
+/**
+ * Serialise summary work to a single slot. resumeMeetingFinalizationJobs()
+ * replays EVERY retained job on boot, so without this a crash-then-restart
+ * would spawn one provider per pending meeting at once.
+ *
+ * Load-shedding is automatic and needs no queue limit: each caller computes
+ * remainingWallMs from its OWN job start, so a job that waited behind others
+ * arrives with too little budget and degrades to the deterministic tier
+ * instead of holding its maintenance lease past COS Control's drain timeout.
+ */
+export function enqueueSummaryWork<T>(fn: () => Promise<T>): Promise<T> {
+  const run = summaryQueueTail.then(fn, fn)
+  summaryQueueTail = run.then(
+    () => undefined,
+    () => undefined,
+  )
+  return run
+}

package/server/lib/speaker-name.ts

@@ -0,0 +1,89 @@
+// What may become a voice-profile name.
+//
+// WHY THIS EXISTS (Chelsie Hodgkiss, first-time user, 2026-08-25)
+// Saying "enroll my voice" and continuing to talk produced a profile whose
+// NAME was the entire ~40-second transcript. Two runs, two junk profiles, one
+// embedding each. Because no junk name ever equals owner_speaker_label,
+// /api/voice/status reported `enrolled: false` forever, and editing
+// voice-profiles.json by hand did not help — the server rewrites it from
+// memory.
+//
+// The client bug was a $-anchored command regex falling through to a
+// named-enrollment branch whose capture group had no length bound. That is
+// fixed in the app (cos-glasses-app src/Main.ts). This module is the SERVER
+// side of the same guard: the app ships in an EHPK on its own release train,
+// so an old client must not be able to write a sentence into the profile store.
+//
+// Counterpart: cos-glasses-app/src/lib/speaker-name.ts — keep the rules and the
+// test vectors in both repos in step.
+
+/** Longest plausible human name we will store. */
+export const MAX_SPEAKER_NAME_CHARS = 40
+/** Most words a name may have ("Maria del Carmen Ruiz" is four). */
+export const MAX_SPEAKER_NAME_WORDS = 4
+
+/** Words that mean "the wearer", never a third party's name. */
+const SELF_REFERENTIAL = /^(?:my|me|mine|myself|voice|voiceprint|my\s+voice|my\s+voiceprint)$/i
+
+/** A name never BEGINS with these. "My Voice Please" is short enough and
+ *  clean enough to pass every other rule, so the leading word is the only
+ *  thing that gives it away. */
+const LEADS_WITH_SELF = /^(?:my|me|mine|myself|voice|voiceprint)\b/i
+
+export type SpeakerNameRejection =
+  | 'empty'
+  | 'too_long'
+  | 'too_many_words'
+  | 'sentence_like'
+  | 'invalid_characters'
+  | 'self_referential'
+
+export interface SpeakerNameCheck {
+  ok: boolean
+  reason?: SpeakerNameRejection
+  /** Human-readable, safe to show on the lens. */
+  message?: string
+}
+
+const MESSAGES: Record<SpeakerNameRejection, string> = {
+  empty: 'A voice profile needs a name.',
+  too_long: `That name is too long (limit ${MAX_SPEAKER_NAME_CHARS} characters). It looks like speech, not a name.`,
+  too_many_words: `That name has too many words (limit ${MAX_SPEAKER_NAME_WORDS}). It looks like speech, not a name.`,
+  sentence_like: 'That looks like a sentence, not a name.',
+  invalid_characters: 'A name may only contain letters, spaces, hyphens and apostrophes.',
+  self_referential: 'Use "enroll my voice" to enrol yourself.',
+}
+
+/**
+ * Is this a plausible person's name for a voice profile?
+ *
+ * Deliberately strict. A false reject costs one clear error message; a false
+ * accept writes an unusable profile into a store the user cannot repair by
+ * hand.
+ */
+export function checkSpeakerName(
+  raw: string | undefined | null,
+  opts: { ownerLabel?: string } = {},
+): SpeakerNameCheck {
+  const name = (raw ?? '').trim()
+  if (!name) return fail('empty')
+  // The wearer's own label MUST pass. It defaults to 'Me' (profile.ts:104),
+  // which is itself self-referential — without this the guard would reject the
+  // very self-enrolment it exists to protect.
+  const owner = opts.ownerLabel?.trim()
+  const isOwner = !!owner && name.toLowerCase() === owner.toLowerCase()
+  if (!isOwner && (SELF_REFERENTIAL.test(name) || LEADS_WITH_SELF.test(name))) {
+    return fail('self_referential')
+  }
+  if (name.length > MAX_SPEAKER_NAME_CHARS) return fail('too_long')
+  if (name.split(/\s+/).length > MAX_SPEAKER_NAME_WORDS) return fail('too_many_words')
+  // Sentence punctuation is the clearest signal that speech was captured.
+  if (/[.!?,;:]/.test(name)) return fail('sentence_like')
+  // Unicode letters, marks, spaces, hyphens, apostrophes. No digits, no symbols.
+  if (!/^[\p{L}\p{M}][\p{L}\p{M}\s'’-]*$/u.test(name)) return fail('invalid_characters')
+  return { ok: true }
+}
+
+function fail(reason: SpeakerNameRejection): SpeakerNameCheck {
+  return { ok: false, reason, message: MESSAGES[reason] }
+}

package/server/lib/video-upload-v2.ts

@@ -54,7 +54,11 @@ const CLIENT_REQUEST_RE = /^[A-Za-z0-9._:-]{16,160}$/
 const MEDIA_ID_RE = /^m_[0-9a-f]{24}$/
 
 export function videoUploadV2Enabled(): boolean {
-  return process.env.COS_VIDEO_UPLOAD_V2 === '1'
+  // Default ON since 6.37.0 (Miles 2026-08-25). Absent key = on; only a
+  // literal '0' disables. NOTE: an in-flight upload sets blocksRestart, so a
+  // drain caught mid-upload waits for it — that is the intended contract, not
+  // a stuck gate, and must never be --forced.
+  return process.env.COS_VIDEO_UPLOAD_V2 !== '0'
 }
 
 export function phoneVideoFramesEnabled(): boolean {

package/server/routes/agent-session-bindings.ts

@@ -1302,7 +1302,9 @@ export const TURN_UNKNOWN_COPY = 'COS has no record of that turn. Nothing was se
 export const CLIENT_TURN_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/
 
 export function threadAttachEnabled(): boolean {
-  return process.env.COS_THREAD_ATTACH_ENABLED === '1'
+  // Default ON since 6.37.0 (Miles 2026-08-25): ship the capability active and
+  // let users opt out. Absent key = on; only a literal '0' disables.
+  return process.env.COS_THREAD_ATTACH_ENABLED !== '0'
 }
 
 export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps): Router {

package/server/routes/health.ts

@@ -20,6 +20,8 @@ import {
   getHighQualityTranscriptionCapability,
 } from '../lib/whisper-local.js'
 import { getOpenAIWhisperBudgetState } from '../lib/openai-whisper-budget.js'
+import { getMeetingSummaryBudgetState } from '../lib/meeting-summary-budget.js'
+import { meetingSummaryLLMEnabled } from '../lib/meeting-summary.js'
 import { getKeyStatus } from '../lib/openai-key.js'
 import {
   getCodexModelCatalog,
@@ -256,6 +258,10 @@ healthRouter.get('/health', async (_req, res) => {
     speakerId: speakerReadinessState,
   }
   const openai_whisper_budget = getOpenAIWhisperBudgetState()
+  const meeting_summary = {
+    enabled: meetingSummaryLLMEnabled(),
+    ...getMeetingSummaryBudgetState(),
+  }
   const codex_models = getCodexModelCatalogSnapshot()
   // Unauthenticated /api/health publishes Cursor slot capability only; concrete
   // agent binary paths stay on the authenticated /api/models surface.
@@ -317,6 +323,7 @@ healthRouter.get('/health', async (_req, res) => {
     readiness,
     whisper_health,
     openai_whisper_budget,
+    meeting_summary,
     tts_local,
     codex_models,
     cursor_models,

package/server/routes/meeting.ts

@@ -153,6 +153,7 @@ import {
   readFinalizationChunkEntries,
   type MeetingFinalizationJob,
 } from '../lib/meeting-finalization-jobs.js'
+import { enrichStandaloneMeeting } from '../lib/meeting-summary-persistence.js'
 
 function cosOpsPipelineConfigured(): boolean {
   // Read env live (not the module-load COS_SCRIPTS_DIR const) so unit tests that
@@ -228,6 +229,7 @@ function scheduleFinalizationJob(job: MeetingFinalizationJob, runtime: Finalizat
     allowDuringDrain: true,
     phase: 'queued',
   })
+  const jobStartedAt = Date.now()
   const task = Promise.resolve().then(async () => {
     lease.setPhase('active')
     let current = runtime.finalizationJobs.get(job.sessionId) ?? job
@@ -317,6 +319,12 @@ function scheduleFinalizationJob(job: MeetingFinalizationJob, runtime: Finalizat
 
     if (cosOpsPipelineConfigured()) {
       await handoffMeetingToOperations(current.meetingPath)
+    } else {
+      // Standalone: no sync_meetings.py to produce summary/topics/decisions.
+      // Runs HERE, after finalizeBatch, because batch HQ replaces the whole
+      // transcript (meeting-batch-persistence.ts:7-12) — summarising earlier
+      // would describe text the file no longer contains.
+      await enrichStandaloneMeeting(current.meetingPath, jobStartedAt)
     }
     markCanonicalFinalizationState(current.sidecarPath, 'complete', false)
     runtime.finalizationJobs.remove(current.sessionId)
@@ -567,7 +575,12 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
         : Math.max(0, Date.now() - startTime)
       const integrity = sessions.getIntegrity(sessionId)
       const needsOperations = cosOpsPipelineConfigured()
-      const finalizationRequired = sessions.hasAudio(sessionId) || needsOperations
+      // Standalone saves need a finalization pass too, for summary enrichment.
+      // Before 6.37 a standalone save with no audio nulled the job below and
+      // never reached the ops_pending slot, so enrichment could never run.
+      const standaloneEnrichmentRequired = !needsOperations
+      const finalizationRequired =
+        sessions.hasAudio(sessionId) || needsOperations || standaloneEnrichmentRequired
       const claimPending = needsOperations && earlyMeetingSyncEnabled()
 
       // Initial canonical text + structured metadata are published before any
@@ -1948,6 +1961,14 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       } catch { /* display is best-effort */ }
       if (cosOpsPipelineConfigured()) {
         await handoffMeetingToOperations(saved.filepath)
+      } else {
+        // Orphan recovery is its own path and never reaches
+        // scheduleFinalizationJob, so a recovered standalone meeting would
+        // otherwise stay permanently un-enriched.
+        // Full wall from here, not a shared finalization budget: recovery
+        // already holds the long-running orphan_recovery lease that COS
+        // Control surfaces and warns on before committing a drain.
+        await enrichStandaloneMeeting(saved.filepath, Date.now())
       }
     }).catch(error => {
       // The quarantined audio is untouched on failure — retry stays possible

package/server/routes/transcribe-stream.ts

@@ -61,6 +61,14 @@ import {
   appendChunkEmbedding,
   sweepExpiredChunkEmbeddings,
 } from '../lib/chunk-embedding-store.js'
+import {
+  evenSpeakerRoleMode,
+  formatEvenRoleAgreement,
+  parseEvenHubSpeakerRoleBody,
+  parseEvenHubSpeakerRoleQuery,
+  warnEvenSpeakerRoleApplyNotImplemented,
+  type EvenSpeakerRoleHistogram,
+} from '../lib/even-hub-speaker-role.js'
 import { archiveSessionAudio, runMeetingAudioRetention } from '../lib/meeting-audio-archive.js'
 import {
   countChunkWavs,
@@ -276,6 +284,7 @@ export interface TranscriptChunk {
   latencyMs?: number
   audioSha256?: string
   canonical?: boolean
+  evenHubSpeakerRole?: EvenSpeakerRoleHistogram
 }
 
 export interface ProviderCandidateRecord {
@@ -1945,8 +1954,11 @@ async function processStreamChunk(opts: {
   clientElapsed?: number
   /** Original client recording start, applied only before canonical chunks. */
   startTimeOverride?: number
+  evenHubSpeakerRole?: EvenSpeakerRoleHistogram
 }): Promise<StreamChunkCompletionResponse> {
   const { sessionId, chunkIndex, clientSpeaker, audioBuffer, candidate } = opts
+  const evenHubSpeakerRole = evenSpeakerRoleMode() === 'off' ? undefined : opts.evenHubSpeakerRole
+  if (evenHubSpeakerRole) warnEvenSpeakerRoleApplyNotImplemented()
   const tReq = performance.now()
   validateSessionId(sessionId)
   validateChunkIndex(chunkIndex)
@@ -2066,6 +2078,15 @@ async function processStreamChunk(opts: {
   }
 
   const { speaker, similarity } = await speakerPromise
+  if (evenHubSpeakerRole) {
+    console.log(formatEvenRoleAgreement({
+      chunkIndex,
+      even: evenHubSpeakerRole,
+      amp: clientSpeaker,
+      emb: speaker,
+      similarity,
+    }))
+  }
   // Client time is authoritative for live network jitter and deferred replay.
   const elapsed = Number.isFinite(opts.clientElapsed) && (opts.clientElapsed as number) >= 0
     ? Math.round(opts.clientElapsed as number)
@@ -2110,6 +2131,7 @@ async function processStreamChunk(opts: {
     latencyMs,
     audioSha256,
     canonical: true,
+    evenHubSpeakerRole,
   }
   const finalExisting = session.chunks[chunkIndex]
   if (finalExisting?.text) {
@@ -2263,6 +2285,7 @@ transcribeStreamRouter.post('/transcribe-stream', async (req, res) => {
       audioBuffer,
       clientElapsed,
       startTimeOverride,
+      evenHubSpeakerRole: parseEvenHubSpeakerRoleQuery(req.query.eh),
     }))
   } catch (err: unknown) {
     sendStreamError(res, err)
@@ -2327,6 +2350,7 @@ transcribeStreamRouter.post('/transcribe-stream/offline-sessions/:sessionId/chun
       clientSpeaker: String(body.clientSpeaker ?? 'Unknown'),
       audioBuffer,
       clientElapsed: typeof body.elapsed === 'number' ? body.elapsed : Number(body.elapsed ?? 0),
+      evenHubSpeakerRole: parseEvenHubSpeakerRoleBody(body.evenHubSpeakerRole),
       candidate: {
         provider: 'iphone-whisperkit-beta',
         text: normalizeCandidateText(candidate.text),
@@ -2405,6 +2429,7 @@ transcribeStreamRouter.post('/transcribe-stream/candidates', async (req, res) =>
       clientSpeaker: String(body.clientSpeaker ?? 'Unknown'),
       audioBuffer,
       clientElapsed: typeof body.elapsed === 'number' ? body.elapsed : Number(body.elapsed ?? 0),
+      evenHubSpeakerRole: parseEvenHubSpeakerRoleBody(body.evenHubSpeakerRole),
       candidate: {
         provider: 'iphone-whisperkit-beta',
         text: normalizeCandidateText(candidate.text),

package/server/routes/voice.ts

@@ -4,6 +4,7 @@ import { Router } from 'express'
 import { errMsg } from '../lib/utils.js'
 import { readdirSync, readFileSync, unlinkSync, existsSync, rmdirSync, rmSync } from 'node:fs'
 import { resolve } from 'node:path'
+import { checkSpeakerName } from '../lib/speaker-name.js'
 import { enrollSpeaker, isEnrolled, getAllSpeakerNames, identifySpeaker, extractEmbedding, enrollEmbedding, getEmbeddingCount, removeSpeakerProfile, readVoiceProfiles, mergeSpeakerProfiles } from '../lib/speaker-embeddings.js'
 import { statSync } from 'node:fs'
 import { trainFromFireflies, getTrainingStatus } from '../lib/speaker-trainer.js'
@@ -48,6 +49,20 @@ voiceRouter.post('/voice/enroll', async (req, res) => {
     // under a stranger's name.
     const name = (req.query.name as string) || getOwnerSpeakerLabel()
 
+    // An old client can still send a whole spoken sentence as the name (the
+    // "enroll my voice" fall-through). Refuse it here: a junk profile can
+    // never match owner_speaker_label, so /voice/status would report
+    // enrolled:false forever, and the store cannot be repaired by editing
+    // voice-profiles.json — the server rewrites it from memory.
+    const nameCheck = checkSpeakerName(name, { ownerLabel: getOwnerSpeakerLabel() })
+    if (!nameCheck.ok) {
+      return res.status(400).json({
+        success: false,
+        error: nameCheck.message,
+        reason: nameCheck.reason,
+      })
+    }
+
     // Collect raw audio body
     const buffers: Buffer[] = []
     for await (const chunk of req) {