@gotcos/glasses-server 6.36.4 → 6.36.6

package/CHANGELOG.md

@@ -1,5 +1,56 @@
 ## Unreleased
 
+## 6.36.6
+- **The session digest follows the thread instead of its opening.** Miles, from the
+  lens: "It's currently showing a legacy session that I had over a day ago... The
+  discussion should show the questions that we're asking and a summary of those most
+  recent things, not something that's the 'first' message." The whole budget now goes
+  to recency. `DIGEST_HEAD_TURNS` drops from 2 to 0 — a deliberate reversal of the
+  earlier rule that reserved the opening ask because it "frames everything after it".
+  The opening is not lost: `first_prompt` still carries it in full.
+- **Harness-injected rows no longer render as things you asked.** A slash-command body
+  and a compaction preamble are both written as USER rows, so both appeared in the
+  DISCUSSION list. Filtered on the STRUCTURAL flags Claude already sets — `isMeta` and
+  `isCompactSummary` — not on a markdown heuristic that could misfire on a real paste.
+  The compaction preamble is also filtered by text as a fallback for providers that
+  emit no flag, and that filter reaches titles and the search index too: the preamble
+  is byte-identical across every compacted session, so as a title or a search hit it
+  distinguishes nothing.
+- **On a truncated read the head window no longer feeds the recency list.** The head
+  window IS the session opening, and on a large session the 60-turn window never fills,
+  so those turns survived at the top of the digest indefinitely. Measured on a real
+  94 MiB session: both leading bullets were head-window turns from the previous day.
+  A whole-file read is untouched — it yields `tail: true` for every line.
+- Verified by parsing real transcripts, not fixtures: the 94 MiB session now leads with
+  the two most recent asks, and an ordinary 2.7 MiB session renders nine recent turns
+  in reading order.
+
+
+## 6.36.5
+- **A speaker merge now reaches the meetings, not just the voice store.**
+  `merge-profiles` folded two profiles together and relabelled the calibration log,
+  and stopped there. Meetings keep the speaker strings written at transcription time
+  and the review panel re-reads them from disk, so every meeting recorded before a
+  merge kept rendering two people forever — the merge fixed identification going
+  forward and nothing behind it. Measured on the live library for one real merge:
+  24 sidecars (111 labels) and 18 transcripts (70 labels) were stranded.
+- The fan-out is a **pure string rewrite** — the same `relabelSidecarJson` and
+  `relabelMeetingMarkdown` primitives the per-meeting relabel route uses, minus its
+  `enrolNamedVoice` step. Re-enrolling would double-count audio the merge has already
+  absorbed and drag the centroid, which matters at the margin: one recent merge moved
+  a neighbouring speaker from 0.818 to 0.842.
+- **The confirm gate now shows the blast radius before you approve it**, scoped to the
+  names that would actually merge. Dry run is the default, writes are atomic, and the
+  response names every file touched so the rewrite can be audited and diffed.
+- Renames only what the store actually absorbed. A requested name that matched no
+  profile is reported as missing and left alone everywhere — fanning out the requested
+  list instead would have renamed a real person off the back of a typo.
+- Reports what it cannot fix rather than passing over it: transcripts in the older
+  `**Name**` label form are counted and surfaced, not silently skipped. On the live
+  library that is 12 files carrying 58 labels a rename leaves behind.
+- iCloud conflict copies are skipped by construction, including the compound-extension
+  form (`sync 2.g2-chunks.json`) an earlier pass let through.
+
 ## 6.28.0
 - **Continue Original Agent Thread — attach to a live desktop thread and append a turn
   to it.** From the glasses you can now continue a Claude Code or Codex conversation that

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.36.4",
+  "version": "6.36.6",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/lib/agent-session-store.ts

@@ -103,6 +103,22 @@ export function isKeepWarmSessionTitle(title: string): boolean {
   return t.startsWith('this is an automated local readiness check')
 }
 
+/**
+ * The compaction preamble, which the harness writes as a USER turn.
+ *
+ * Miles's 2026-08-17 screenshot had this sitting in the DISCUSSION list as though he
+ * had asked it: "This session is being continued from a previous conversation… Summary:
+ * ## 1. Primary Request and Intent". It is scaffolding, and it lands in the digest at
+ * full length because it IS recent -- compaction happens mid-session -- so recency
+ * ordering alone does not remove it.
+ *
+ * Measured across the 25 most recently written transcripts on this machine: 29
+ * occurrences, exactly ONE distinct opening. Anchored to that opening rather than to a
+ * loose "continued from" match, so a human sentence about continuing a conversation is
+ * not mistaken for it.
+ */
+const COMPACTION_PREAMBLE = /^this session is being continued from a previous conversation/i
+
 export function isWrapperPrompt(text: string): boolean {
   const trimmed = text.trim()
   return trimmed.startsWith('<')
@@ -110,6 +126,10 @@ export function isWrapperPrompt(text: string): boolean {
     || trimmed.startsWith('You are an agent')
     || trimmed.startsWith('You are QA Agent')
     || trimmed.startsWith('Message Type:')
+    // Filtered HERE rather than only in the digest, so it also stops titling a session
+    // and stops being indexed for search. It is byte-identical across every compacted
+    // session, so as a title or a search hit it distinguishes nothing.
+    || COMPACTION_PREAMBLE.test(trimmed)
 }
 
 export function firstLineTitle(text: string): string {
@@ -249,7 +269,27 @@ export const DISCUSSION_DIGEST_MAX = 2000
 const DIGEST_TURN_MAX = 220
 
 /** Turns kept from the START. The opening ask frames everything after it. */
-const DIGEST_HEAD_TURNS = 2
+/**
+ * User turns reserved from the START of the session before recency gets the budget.
+ *
+ * ZERO, AND THAT IS A REVERSAL. This was 2, on the reasoning that the opening ask
+ * "frames everything after it" -- see the head-first block in composeDiscussionDigest,
+ * which was itself a fix for a digest that spent everything on the tail.
+ *
+ * Miles overruled it from hardware, 2026-08-17, looking at a digest whose first two
+ * bullets were a question from the previous day and a compaction preamble: "It needs to
+ * refresh to the most recent response inside of the thread. The discussion should show
+ * the questions that we're asking and a summary of those most recent things, not
+ * something that's the 'first' message."
+ *
+ * The opening ask is NOT lost -- it is still carried, in full, in `first_prompt`, which
+ * the digest and the row label both fall back to. What changes is that it stops
+ * occupying the two most valuable slots in a list about what is happening NOW.
+ *
+ * Left as a constant rather than deleting the head path: this is a judgement call about
+ * emphasis, and one number is the whole reversal if Miles wants some framing back.
+ */
+const DIGEST_HEAD_TURNS = 0
 
 /** Recent turns retained while streaming. Comfortably more than 2000 chars can
  *  render (~20-25 at typical length), so the budget and not the buffer decides
@@ -1341,7 +1381,32 @@ export async function parseAgentSession(
   // reports what was actually dropped rather than what this buffer happens to hold.
   const digestHead: string[] = []
   const digestRecent: string[] = []
-  const collectTurn = (text: string): void => {
+  /**
+   * Add a user turn to the recency digest -- or decline to.
+   *
+   * TWO DECLINES, both found by parsing Miles's own 94 MiB session rather than by
+   * reasoning about the code.
+   *
+   * `injected`: STRUCTURAL, not a heuristic. Claude marks a slash-command body with
+   * `isMeta: true` and a compaction preamble with `isCompactSummary: true`. Both are
+   * written as USER rows, so both rendered in the digest as things Miles had asked --
+   * his screenshot led with "This session is being continued from a previous
+   * conversation… Summary: ## 1. Primary Request and Intent". Neither is an ask, and
+   * both are recent, so recency ordering alone leaves them exactly where they were.
+   *
+   * `fromTail` on a TRUNCATED read: the head window IS the session opening. Feeding it
+   * into a recency list is the very thing Miles objected to -- "not something that's
+   * the 'first' message" -- and on a large session the 60-turn window never fills, so
+   * those opening turns survive to the top of the digest forever. Measured on his
+   * session: the two leading bullets were both head-window turns from the previous day.
+   * The head is still read and still published, as `first_prompt`.
+   *
+   * A whole-file read yields `tail: true` for every line, so a normal session is
+   * unaffected -- this narrows only the partial read.
+   */
+  const collectTurn = (text: string, fromTail = true, injected = false): void => {
+    if (injected) return
+    if (truncated && !fromTail) return
     // Reuse the wrapper filter the rest of this module already trusts. Without it the
     // opening turns of a slash-command session render as
     // "<command-message>cos-glasses</command-message>…" — scaffolding, not the ask,
@@ -1413,7 +1478,7 @@ export async function parseAgentSession(
       }
       if (obj.type === 'user') {
         userCount += 1
-        collectTurn(text)
+        collectTurn(text, tail, obj.isMeta === true || obj.isCompactSummary === true)
         if (!firstPrompt) firstPrompt = firstLineTitle(text)
         if (!title) title = firstLineTitle(text)
       } else {
@@ -1459,7 +1524,7 @@ export async function parseAgentSession(
       if (obj.role === 'user') {
         userCount += 1
         const query = cursorUserTitle(text, true) ?? cursorUserTitle(text, false)
-        collectTurn(query ?? text)
+        collectTurn(query ?? text, tail)
         if (query) {
           title = query
           if (!firstPrompt) firstPrompt = query

package/server/lib/speaker-rename-fanout.ts

@@ -0,0 +1,311 @@
+// Carry a speaker rename out to the meetings that already have the old name baked in.
+//
+// ---------------------------------------------------------------------------
+// WHY THIS EXISTS
+// ---------------------------------------------------------------------------
+// `merge-profiles` folds two voice profiles together and relabels the calibration log.
+// That is ALL it has ever touched -- verified in the handler, not assumed. Meetings keep
+// the speaker strings that were written at transcription time, and the review panel
+// re-reads those strings from disk on every request, so a merge is invisible to every
+// meeting that already exists.
+//
+// Measured on this machine when the Luke H / Luke Henry merge ran: the split had been
+// live since 2026-03-25, and every affected meeting would have rendered two Lukes
+// forever. The merge fixed identification going FORWARD and nothing behind it.
+//
+// ---------------------------------------------------------------------------
+// WHY IT DOES NOT REUSE THE PER-MEETING RELABEL ROUTE
+// ---------------------------------------------------------------------------
+// `POST /api/meeting/:id/relabel` also calls `enrolNamedVoice`, which folds that
+// meeting's audio into the target profile. That is correct when a human names a voice:
+// the embedding genuinely should learn it.
+//
+// It is WRONG for a merge fan-out, and not by a little. The merge has already absorbed
+// those embeddings; re-enrolling the same audio across every affected meeting would
+// double-count it and drag the centroid further. That matters here specifically because
+// the Luke merge already moved a neighbouring speaker's similarity from 0.818 to 0.842,
+// and 0.842 is close enough to the identification threshold to start producing wrong
+// attributions.
+//
+// So this is a PURE STRING REWRITE. Same two primitives the relabel route uses --
+// `relabelSidecarJson` and `relabelMeetingMarkdown` -- minus the enrolment.
+//
+// ---------------------------------------------------------------------------
+// SAFETY
+// ---------------------------------------------------------------------------
+// This rewrites production meeting records, so:
+//   - DRY RUN IS THE DEFAULT. Writing requires asking for it.
+//   - Atomic writes only, via the same helper the rest of the server uses.
+//   - iCloud conflict copies are skipped by construction. Desktop-and-Documents sync
+//     creates `2026-08 2/` and `meeting 2.md`; rewriting one of those would edit a file
+//     nothing reads while leaving the real one stale. Month directories must match
+//     `YYYY-MM` exactly.
+//   - Every skip is REPORTED rather than silently dropped, because a fan-out that
+//     quietly missed files is worse than one that refused.
+
+import { readFileSync, readdirSync, statSync } from 'node:fs'
+import { join } from 'node:path'
+import { atomicWriteFileSync } from './atomic-fs.js'
+import {
+  relabelSidecarJson,
+  relabelMeetingMarkdown,
+  type SidecarRelabelResult,
+  type MarkdownRelabelResult,
+} from './meeting-relabel.js'
+
+/** A month directory, and nothing that merely looks like one. */
+const CANONICAL_MONTH = /^\d{4}-\d{2}$/
+
+/** The chunk sidecar that drives the speaker review panel. */
+const SIDECAR_SUFFIX = '.g2-chunks.json'
+
+export interface FanOutFile {
+  path: string
+  /** Labels rewritten in this file. */
+  labels: number
+  /**
+   * Something true about this file the operator should know: chunks that still carry
+   * the old name after a partial relabel, or narrative prose the primitive leaves alone
+   * on purpose. Absent when the rewrite was total.
+   */
+  note?: string
+}
+
+export interface FanOutSkip {
+  path: string
+  reason: string
+}
+
+export interface SpeakerRenameFanOut {
+  from: string
+  to: string
+  dryRun: boolean
+  sidecars: FanOutFile[]
+  markdown: FanOutFile[]
+  /** Files opened and examined, whether or not they matched. */
+  scanned: number
+  /** Anything deliberately not touched, and why. */
+  skipped: FanOutSkip[]
+}
+
+export interface FanOutOptions {
+  /** Write. Omitted or false means report what WOULD change and touch nothing. */
+  apply?: boolean
+  /**
+   * Include the hidden `.meeting_archive` tree.
+   *
+   * Off by default: it is a separate store with its own lifecycle, and sweeping it in
+   * silently would triple the blast radius of a rename without anyone asking for it.
+   */
+  includeArchive?: boolean
+}
+
+function safeReaddir(dir: string): string[] {
+  try {
+    return readdirSync(dir)
+  } catch {
+    return []
+  }
+}
+
+function isDir(path: string): boolean {
+  try {
+    return statSync(path).isDirectory()
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Every `{domain}/meetings/{YYYY-MM}` directory under an operations root.
+ *
+ * Walked explicitly rather than recursively: the operations tree also holds weekly work
+ * folders, intelligence libraries and caches, and a rename has no business in any of
+ * them. Three known levels, and nothing else is opened.
+ */
+export function meetingMonthDirs(operationsDir: string, includeArchive = false): string[] {
+  const out: string[] = []
+  for (const domain of safeReaddir(operationsDir)) {
+    if (domain.startsWith('.') && !(includeArchive && domain === '.meeting_archive')) continue
+    const meetingsDir = join(operationsDir, domain, 'meetings')
+    if (!isDir(meetingsDir)) {
+      // `.meeting_archive` nests one level deeper: `.meeting_archive/{name}/meetings`.
+      if (includeArchive && domain === '.meeting_archive') {
+        for (const sub of safeReaddir(join(operationsDir, domain))) {
+          const nested = join(operationsDir, domain, sub, 'meetings')
+          if (isDir(nested)) out.push(...monthsIn(nested))
+        }
+      }
+      continue
+    }
+    out.push(...monthsIn(meetingsDir))
+  }
+  return out
+}
+
+function monthsIn(meetingsDir: string): string[] {
+  const out: string[] = []
+  for (const month of safeReaddir(meetingsDir)) {
+    // STRICT. `2026-08 2` is an iCloud conflict copy; rewriting it would edit a file
+    // nothing reads and leave the real one carrying the old name.
+    if (!CANONICAL_MONTH.test(month)) continue
+    const dir = join(meetingsDir, month)
+    if (isDir(dir)) out.push(dir)
+  }
+  return out
+}
+
+/**
+ * Rewrite `from` to `to` across every meeting sidecar and transcript.
+ *
+ * Returns what changed, or what WOULD change when `apply` is not set. Never throws for
+ * one bad file: an unreadable or unparsable record is reported as a skip and the sweep
+ * continues, because stopping halfway would leave the library in a half-renamed state
+ * that is worse than either end.
+ */
+export function fanOutSpeakerRename(
+  operationsDir: string,
+  from: string,
+  to: string,
+  options: FanOutOptions = {},
+): SpeakerRenameFanOut {
+  const apply = options.apply === true
+  const result: SpeakerRenameFanOut = {
+    from, to, dryRun: !apply, sidecars: [], markdown: [], scanned: 0, skipped: [],
+  }
+  if (!from.trim() || !to.trim() || from === to) return result
+
+  for (const monthDir of meetingMonthDirs(operationsDir, options.includeArchive === true)) {
+    for (const name of safeReaddir(monthDir)) {
+      // A conflict copy of a FILE, same reasoning as the month directory.
+      //
+      // The marker sits before the EXTENSION CHAIN, not just before the last dot.
+      // iCloud writes `sync.g2-chunks 2.json` for a sidecar and `sync 2.md` for a
+      // transcript, and a sidecar belonging to an already-conflicted meeting comes
+      // out as `sync 2.g2-chunks.json`. A first cut anchored the digit to the final
+      // extension and let that third form straight through -- it would have rewritten
+      // a duplicate nobody reads while the real file kept the old name.
+      if (/ \d+(\.[A-Za-z0-9-]+)*\.(md|json)$/.test(name)) {
+        result.skipped.push({ path: join(monthDir, name), reason: 'icloud conflict copy' })
+        continue
+      }
+      const isSidecar = name.endsWith(SIDECAR_SUFFIX)
+      const isMarkdown = name.endsWith('.md')
+      if (!isSidecar && !isMarkdown) continue
+
+      const path = join(monthDir, name)
+      result.scanned += 1
+      let raw: string
+      try {
+        raw = readFileSync(path, 'utf-8')
+      } catch (error) {
+        result.skipped.push({ path, reason: `unreadable: ${(error as Error).message}` })
+        continue
+      }
+      // Cheap pre-filter, and deliberately loose: `from` is a SUBSTRING of the name it
+      // is being merged into ("Luke H" inside "Luke Henry"), so a file holding only the
+      // new name still passes here. The primitives below are exact and reject it, which
+      // is why a plain no-match must not be reported as a skip -- see below.
+      if (!raw.includes(from)) continue
+
+      // TYPED, NOT DUCK-TYPED. A first cut read `changed` as a number and the field is
+      // an ARRAY of chunk indices, so every sidecar would have counted zero labels and
+      // been skipped -- a fan-out that reported success while rewriting nothing.
+      let next: string
+      let labels: number
+      let note: string | undefined
+
+      if (isSidecar) {
+        const outcome = relabelSidecarJson(raw, from, to)
+        if (!outcome.ok) {
+          if (!isNoMatch(outcome.error)) result.skipped.push({ path, reason: outcome.error })
+          continue
+        }
+        const value: SidecarRelabelResult = outcome.value
+        next = value.json
+        labels = value.changed.length
+        // The primitive's own invariant, carried rather than assumed: a partial relabel
+        // means chunks still hold the old name, and the markdown must NOT then be
+        // rewritten by label. Reported so the operator sees it.
+        if (value.remainingWithFrom > 0) {
+          note = `${value.remainingWithFrom} chunk(s) still carry "${from}"`
+        }
+      } else {
+        // A SECOND TRANSCRIPT FORMAT EXISTS AND THE PRIMITIVE DOES NOT HANDLE IT.
+        //
+        // `relabelMeetingMarkdown` rewrites `[Name]:` turn labels, anchored to line
+        // start. Measured across the real library for the Luke rename: 17 files and 97
+        // labels in that form -- and 20 files, 77 labels in a `**Name**` form it does
+        // not match, 13 of those files in LIVE quilt meetings, not the archive.
+        //
+        // That is a 39% silent miss. Detected and REPORTED rather than fixed here: the
+        // primitive is shared with the live per-meeting relabel route, and widening its
+        // matcher changes behaviour for a path nobody asked me to touch. The operator
+        // gets a number instead of a surprise.
+        const unhandled = countBoldLabels(raw, from)
+        const outcome = relabelMeetingMarkdown(raw, from, to)
+        if (!outcome.ok) {
+          if (!isNoMatch(outcome.error)) result.skipped.push({ path, reason: outcome.error })
+          continue
+        }
+        const value: MarkdownRelabelResult = outcome.value
+        next = value.markdown
+        labels = value.attendees + value.transcript
+        // Narrative prose is deliberately untouched by the primitive. Surfaced here so a
+        // stale summary is something the operator knows about rather than discovers.
+        const notes: string[] = []
+        if (unhandled > 0) notes.push(`${unhandled} label(s) in an unhandled **${from}** format`)
+        if (value.proseStale) {
+          notes.push(`prose still mentions "${from}"${value.proseHits.length ? `: ${value.proseHits.slice(0, 3).join(', ')}` : ''}`)
+        }
+        if (notes.length > 0) note = notes.join('; ')
+
+        // A file whose ONLY labels are in the unhandled form changes nothing, and would
+        // otherwise fall out of the report entirely -- the exact silent miss this guard
+        // exists to prevent. Recorded as a skip so it is visible.
+        if (labels === 0 && unhandled > 0) {
+          result.skipped.push({ path, reason: `${unhandled} label(s) in an unhandled **${from}** format` })
+          continue
+        }
+      }
+
+      if (labels === 0) continue
+      if (apply) {
+        try {
+          atomicWriteFileSync(path, next)
+        } catch (error) {
+          result.skipped.push({ path, reason: `write failed: ${(error as Error).message}` })
+          continue
+        }
+      }
+      ;(isSidecar ? result.sidecars : result.markdown).push({ path, labels, note })
+    }
+  }
+  return result
+}
+
+/**
+ * Is this refusal simply "the name is not in here", rather than a problem?
+ *
+ * SKIPS ARE FOR THINGS A HUMAN SHOULD LOOK AT. The loose pre-filter above lets through
+ * every file holding the NEW name, because the old one is a substring of it -- measured
+ * on the real library, that padded the skip list with 15 files that were never affected.
+ * A report where most entries are non-issues is one nobody reads, and it hides the two
+ * that matter.
+ */
+function isNoMatch(error: string): boolean {
+  return /no chunk carries|not found|does not appear|no .* labelled/i.test(error)
+}
+
+/**
+ * Speaker labels in the `**Name**` transcript form, which the primitive does not rewrite.
+ *
+ * Counted so the report can say how much a rename LEAVES BEHIND. Anchored to line start
+ * for the same reason the primitive anchors its own matcher: a bolded name inside spoken
+ * text is a quote, not a label.
+ */
+export function countBoldLabels(markdown: string, name: string): number {
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+  return (markdown.match(new RegExp(`^\\*\\*${escaped}\\*\\*`, 'gm')) ?? []).length
+}
+

package/server/routes/voice.ts

@@ -14,6 +14,8 @@ import { trainingSourceFor } from '../lib/training-audio-provenance.js'
 import { sendAudioFile } from '../lib/send-audio.js'
 import { getVoiceDirectorySnapshot, invalidateVoiceDirectory } from '../lib/voice-directory.js'
 import { greedyDiversitySelect } from '../lib/voice-enrolment-selection.js'
+import { fanOutSpeakerRename, type SpeakerRenameFanOut } from '../lib/speaker-rename-fanout.js'
+import { resolveCosOperationsDir } from '../lib/cos-operations-meetings.js'
 
 // These MUST match the writer in transcribe-stream.ts, which saves under
 // dataPath(). They previously resolved relative to __dirname — i.e. inside the
@@ -572,6 +574,57 @@ voiceRouter.get('/voice/directory', async (req, res) => {
 // 20 samples independently — 40 samples of one person, split, each half a
 // weaker representation of them than the union would be.
 //
+/**
+ * Carry a merge out to the meetings that already carry the absorbed name.
+ *
+ * WHY THE ROUTE DOES THIS AT ALL. A merge folds two voice profiles together and
+ * relabels the calibration log, and that is where it stopped. Meetings keep the
+ * strings written at transcription time and the review panel re-reads them from disk,
+ * so every meeting recorded before the merge kept rendering two people forever. The
+ * merge fixed identification going FORWARD and nothing behind it.
+ *
+ * PURE STRING REWRITE, no enrolment. The per-meeting relabel route also calls
+ * `enrolNamedVoice`, which is right when a human names a voice and wrong here: the
+ * merge has ALREADY absorbed those embeddings, so re-enrolling the same audio across
+ * every affected meeting would double-count it and drag the centroid. That matters
+ * concretely -- the Luke merge moved a neighbouring speaker from 0.818 to 0.842, close
+ * enough to the identification threshold to start producing wrong attributions.
+ *
+ * NEVER THROWS. A merge that succeeded in the store must not report failure because a
+ * meeting file was unreadable; the failure is reported in the payload instead.
+ */
+function fanOutMergeToMeetings(
+  merged: readonly string[],
+  into: string,
+  apply: boolean,
+): { operationsDir: string | null; runs: SpeakerRenameFanOut[]; error?: string } {
+  const operationsDir = resolveCosOperationsDir()
+  // Not an error. A server with no COS library is a supported install; it simply has
+  // no meetings to carry the rename to.
+  if (!operationsDir || merged.length === 0) return { operationsDir, runs: [] }
+  try {
+    return { operationsDir, runs: merged.map(name => fanOutSpeakerRename(operationsDir, name, into, { apply })) }
+  } catch (err: unknown) {
+    return { operationsDir, runs: [], error: errMsg(err) }
+  }
+}
+
+/** The one number a human needs before approving: how many files this touches. */
+function fanOutTotals(runs: readonly SpeakerRenameFanOut[]): {
+  files: number; labels: number; unhandled: number
+} {
+  let files = 0, labels = 0, unhandled = 0
+  for (const run of runs) {
+    for (const f of [...run.sidecars, ...run.markdown]) {
+      files += 1
+      labels += f.labels
+      if (f.note && /unhandled/.test(f.note)) unhandled += 1
+    }
+    unhandled += run.skipped.filter(s => /unhandled/.test(s.reason)).length
+  }
+  return { files, labels, unhandled }
+}
+
 // Fails closed below the search-accept threshold. A wrong merge destroys BOTH
 // identities at once and cannot be undone from the store alone, so the only
 // acceptable evidence is acoustic. `force` exists for the case where Miles
@@ -605,10 +658,18 @@ voiceRouter.post('/voice/merge-profiles', (req, res) => {
 
     if (req.body?.confirm !== true && !dryRun) {
       const preview = mergeSpeakerProfiles(into, from, { force, dryRun: true })
+      // BLAST RADIUS IN THE PREVIEW, not after the fact. The confirm gate exists so a
+      // human sees what a merge does before it happens, and rewriting production
+      // meeting records is the largest thing it does. Scoped to the names that would
+      // ACTUALLY merge, so a refused pair does not advertise a rewrite that will not
+      // run. This walks the meeting library, which is why it happens here -- once, on a
+      // deliberate human action -- and not on any hot path.
+      const fan = fanOutMergeToMeetings(preview.merged, into, false)
       return res.status(400).json({
         error: 'confirmation required',
         message: `Merging is not reversible from the store alone. Review the similarity scores, then pass { confirm: true }.`,
         preview,
+        meetingRewrite: { ...fanOutTotals(fan.runs), dryRun: true, error: fan.error },
       })
     }
 
@@ -638,7 +699,27 @@ voiceRouter.post('/voice/merge-profiles', (req, res) => {
     }
 
     if (!dryRun) invalidateVoiceDirectory()
-    res.json({ ...report, dryRun, forced: force, calibrationRowsRelabeled: calibration })
+
+    // The fan-out honours `dryRun` for the same reason the merge does: a dry run must
+    // stay a dry run all the way down, or `dryRun: true` becomes the most dangerous
+    // parameter in the API.
+    const fan = fanOutMergeToMeetings(report.merged, into, !dryRun)
+    res.json({
+      ...report,
+      dryRun,
+      forced: force,
+      calibrationRowsRelabeled: calibration,
+      meetingRewrite: {
+        ...fanOutTotals(fan.runs),
+        dryRun,
+        error: fan.error,
+        // Paths, not just counts: this rewrote production records and the operator
+        // should be able to see exactly which, and diff them.
+        sidecars: fan.runs.flatMap(r => r.sidecars),
+        markdown: fan.runs.flatMap(r => r.markdown),
+        skipped: fan.runs.flatMap(r => r.skipped),
+      },
+    })
   } catch (err: unknown) {
     res.status(500).json({ error: errMsg(err) })
   }